@adcp/sdk 6.5.0 → 6.7.0

package/dist/lib/server/decisioning/account.js

@@ -15,6 +15,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AccountNotFoundError = void 0;
 exports.toWireAccount = toWireAccount;
+exports.toWireSyncAccountRow = toWireSyncAccountRow;
+exports.toWireSyncGovernanceRow = toWireSyncGovernanceRow;
 exports.refAccountId = refAccountId;
 /**
  * Optional throw-class for `AccountStore.resolve` not-found signaling. Returning
@@ -42,12 +44,17 @@ class AccountNotFoundError extends Error {
     }
 }
 exports.AccountNotFoundError = AccountNotFoundError;
+// ---------------------------------------------------------------------------
+// Wire projection — strip framework-internal fields before emit
+// ---------------------------------------------------------------------------
 /**
  * Project a framework `Account<TCtxMeta>` to the wire `Account` shape.
  *
- * Strips `metadata` and `authInfo` (framework-internal); renames `id` →
- * `account_id`; passes through `name`, `status`, `brand`, `operator`,
- * `advertiser`, and `billing.invoicedTo` mappings.
+ * Strips `ctx_metadata` and `authInfo` (framework-internal); renames `id` →
+ * `account_id`; passes through wire-shaped fields. Strips
+ * `billing_entity.bank` per the schema's write-only constraint — bank
+ * coordinates flow buyer→seller in `sync_accounts` requests but MUST NOT
+ * appear in any response payload.
  *
  * Used by the framework when emitting `list_accounts` and other wire
  * responses that include account data. Adopters never call this directly —
@@ -66,6 +73,8 @@ function toWireAccount(account) {
         wire.operator = account.operator;
     if (account.advertiser !== undefined)
         wire.advertiser = account.advertiser;
+    if (account.billing_proxy !== undefined)
+        wire.billing_proxy = account.billing_proxy;
     if (account.billing !== undefined) {
         // Wire `Account.billing: 'operator' | 'agent' | 'advertiser'` is the
         // invoiced-to party. Internal `billing.invoicedTo` collapses string +
@@ -74,8 +83,143 @@ function toWireAccount(account) {
         const t = account.billing.invoicedTo;
         wire.billing = typeof t === 'string' ? t : 'advertiser';
     }
+    const projectedEntity = projectBillingEntity(account.billing_entity);
+    if (projectedEntity !== undefined)
+        wire.billing_entity = projectedEntity;
+    if (account.rate_card !== undefined)
+        wire.rate_card = account.rate_card;
+    if (account.payment_terms !== undefined)
+        wire.payment_terms = account.payment_terms;
+    if (account.credit_limit !== undefined)
+        wire.credit_limit = account.credit_limit;
+    if (account.setup !== undefined)
+        wire.setup = account.setup;
+    if (account.account_scope !== undefined)
+        wire.account_scope = account.account_scope;
+    if (account.governance_agents !== undefined) {
+        wire.governance_agents = account.governance_agents.map(projectGovernanceAgent);
+    }
+    if (account.reporting_bucket !== undefined)
+        wire.reporting_bucket = account.reporting_bucket;
+    if (account.sandbox !== undefined)
+        wire.sandbox = account.sandbox;
+    if (account.ext !== undefined)
+        wire.ext = account.ext;
     return wire;
 }
+/**
+ * Project an adopter `SyncAccountsResultRow` to the wire shape returned by
+ * `sync_accounts`. Applies the same `billing_entity.bank` strip as
+ * `toWireAccount` — the wire schema marks bank coordinates write-only on
+ * EVERY response, not just `list_accounts`. Adopters returning a row that
+ * spreads a DB record carrying `bank` (e.g.,
+ * `{ ...db.findByBrand(r.brand), action: 'updated' }`) have it stripped
+ * before emit.
+ *
+ * Used by the framework when emitting `sync_accounts` responses. Adopters
+ * never call this directly — they return `SyncAccountsResultRow[]` from
+ * `accounts.upsert` and the framework projects.
+ */
+function toWireSyncAccountRow(row) {
+    const wire = {
+        brand: row.brand,
+        operator: row.operator,
+        action: row.action,
+        status: row.status,
+    };
+    if (row.account_id !== undefined)
+        wire.account_id = row.account_id;
+    if (row.name !== undefined)
+        wire.name = row.name;
+    if (row.billing !== undefined)
+        wire.billing = row.billing;
+    const projectedEntity = projectBillingEntity(row.billing_entity);
+    if (projectedEntity !== undefined)
+        wire.billing_entity = projectedEntity;
+    if (row.account_scope !== undefined)
+        wire.account_scope = row.account_scope;
+    if (row.setup !== undefined)
+        wire.setup = row.setup;
+    if (row.rate_card !== undefined)
+        wire.rate_card = row.rate_card;
+    if (row.payment_terms !== undefined)
+        wire.payment_terms = row.payment_terms;
+    if (row.credit_limit !== undefined)
+        wire.credit_limit = row.credit_limit;
+    if (row.errors !== undefined)
+        wire.errors = row.errors;
+    if (row.warnings !== undefined)
+        wire.warnings = row.warnings;
+    if (row.sandbox !== undefined)
+        wire.sandbox = row.sandbox;
+    return wire;
+}
+/**
+ * Project a `sync_governance` response row to the wire shape, stripping
+ * any fields the buyer is NOT entitled to receive. Critically: each
+ * `governance_agents[i]` is reduced to `{url, categories?}` only — the
+ * spec marks `authentication.credentials` write-only (the buyer sends
+ * the bearer; the seller persists it for outbound `check_governance`
+ * calls but MUST NOT echo it back). The natural `{ ...entry.governance_agents[i] }`
+ * echo idiom would compile silently against the typed return shape and
+ * ship credentials over the wire AND into the idempotency replay cache,
+ * arming the buyer (and any subsequent caller hitting the same key) to
+ * impersonate the seller against the governance agent.
+ *
+ * Defense-in-depth: this dispatcher-level strip runs even if an adopter
+ * returns a loosely-typed row, and even if a future codegen change
+ * loosens the response Zod schema's `.passthrough()` for governance
+ * agents.
+ */
+function toWireSyncGovernanceRow(row) {
+    const wire = {
+        account: row.account,
+        status: row.status,
+    };
+    if (row.governance_agents !== undefined) {
+        wire.governance_agents = row.governance_agents.map(a => {
+            const stripped = { url: a.url };
+            if (a.categories !== undefined)
+                stripped.categories = a.categories;
+            return stripped;
+        });
+    }
+    if (row.errors !== undefined)
+        wire.errors = row.errors;
+    return wire;
+}
+/**
+ * Strip `BusinessEntity.bank` per the schema's write-only constraint, and
+ * skip emission entirely when nothing else is populated. Bank-only inputs
+ * project to `undefined`, signaling the caller to omit `billing_entity`
+ * rather than emit an empty object that would fail `legal_name` validation.
+ *
+ * Destructure-and-rest excludes `bank` regardless of source shape: own
+ * non-enumerable, getter, prototype-chain, and Proxy-backed bank fields
+ * are all excluded by the ES rest-spread evaluation order
+ * (`CopyDataProperties` walks own-enumerable keys and skips the
+ * destructured names).
+ */
+function projectBillingEntity(entity) {
+    if (entity === undefined)
+        return undefined;
+    const { bank: _bank, ...rest } = entity;
+    return Object.keys(rest).length > 0 ? rest : undefined;
+}
+/**
+ * Project a governance-agent element to the wire shape, dropping any keys
+ * the wire schema doesn't model. The schema notes that authentication
+ * credentials are write-only and not included in responses; the wire type
+ * already carries only `url` and `categories`, but TS is erased at runtime
+ * so adopters using JS or `as any` could otherwise smuggle a `credentials`
+ * field straight to the wire. Explicit projection closes that gap.
+ */
+function projectGovernanceAgent(agent) {
+    const projected = { url: agent.url };
+    if (agent.categories !== undefined)
+        projected.categories = agent.categories;
+    return projected;
+}
 // ---------------------------------------------------------------------------
 // AccountReference helpers
 // ---------------------------------------------------------------------------
@@ -90,7 +234,9 @@ function toWireAccount(account) {
  * resolve: async (ref, ctx) => {
  *   const id = refAccountId(ref);
  *   if (id) return this.db.findById(id);
- *   return this.db.findByOAuthClient(ctx?.authInfo?.clientId ?? '');
+ *   const cred = ctx?.authInfo?.credential;
+ *   const key = cred?.kind === 'oauth' ? cred.client_id : cred?.kind === 'api_key' ? cred.key_id : undefined;
+ *   return key ? this.db.findByClientKey(key) : null;
  * }
  * ```
  *

package/dist/lib/server/decisioning/account.js.map

@@ -1 +1 @@
-{"version":3,"file":"account.js","sourceRoot":"","sources":["../../../../src/lib/server/decisioning/account.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAkYH,sCAkBC;AAuBD,oCAEC;AAjHD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAa,oBAAqB,SAAQ,KAAK;IACpC,IAAI,GAAG,sBAA+B,CAAC;IAChD,YAAY,OAAO,GAAG,mBAAmB;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF;AALD,oDAKC;AAkCD;;;;;;;;;;;GAWG;AACH,SAAgB,aAAa,CAAW,OAA0B;IAChE,MAAM,IAAI,GAAgB;QACxB,UAAU,EAAE,OAAO,CAAC,EAAE;QACtB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;IACF,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5D,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IACrE,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAAE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAC3E,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,qEAAqE;QACrE,sEAAsE;QACtE,sEAAsE;QACtE,8DAA8D;QAC9D,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,YAAY,CAAC,GAAsB;IACjD,OAAO,GAAG,IAAI,YAAY,IAAI,GAAG,CAAC,CAAC,CAAE,GAA+B,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9F,CAAC"}
+{"version":3,"file":"account.js","sourceRoot":"","sources":["../../../../src/lib/server/decisioning/account.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAgsBH,sCAgCC;AAiBD,oDAqBC;AAqBD,0DAcC;AA2DD,oCAEC;AA3QD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAa,oBAAqB,SAAQ,KAAK;IACpC,IAAI,GAAG,sBAA+B,CAAC;IAChD,YAAY,OAAO,GAAG,mBAAmB;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF;AALD,oDAKC;AA2DD,8EAA8E;AAC9E,gEAAgE;AAChE,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,SAAgB,aAAa,CAAW,OAA0B;IAChE,MAAM,IAAI,GAAgB;QACxB,UAAU,EAAE,OAAO,CAAC,EAAE;QACtB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;IACF,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5D,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IACrE,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAAE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAC3E,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS;QAAE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IACpF,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,qEAAqE;QACrE,sEAAsE;QACtE,sEAAsE;QACtE,8DAA8D;QAC9D,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IAC1D,CAAC;IACD,MAAM,eAAe,GAAG,oBAAoB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACrE,IAAI,eAAe,KAAK,SAAS;QAAE,IAAI,CAAC,cAAc,GAAG,eAAe,CAAC;IACzE,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;QAAE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACxE,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS;QAAE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IACpF,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;QAAE,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IACjF,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5D,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS;QAAE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IACpF,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC5C,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS;QAAE,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAC7F,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAClE,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS;QAAE,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACtD,OAAO,IAAI,CAAC;AACd,CAAC;AAID;;;;;;;;;;;;GAYG;AACH,SAAgB,oBAAoB,CAAC,GAA0B;IAC7D,MAAM,IAAI,GAAuB;QAC/B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,MAAM,EAAE,GAAG,CAAC,MAAM;KACnB,CAAC;IACF,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS;QAAE,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;IACnE,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACjD,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC1D,MAAM,eAAe,GAAG,oBAAoB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACjE,IAAI,eAAe,KAAK,SAAS;QAAE,IAAI,CAAC,cAAc,GAAG,eAAe,CAAC;IACzE,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS;QAAE,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC,aAAa,CAAC;IAC5E,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACpD,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS;QAAE,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;IAChE,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS;QAAE,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC,aAAa,CAAC;IAC5E,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS;QAAE,IAAI,CAAC,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC;IACzE,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IACvD,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS;QAAE,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC7D,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC1D,OAAO,IAAI,CAAC;AACd,CAAC;AAID;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,uBAAuB,CAAC,GAA0B;IAChE,MAAM,IAAI,GAA0B;QAClC,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,MAAM,EAAE,GAAG,CAAC,MAAM;KACnB,CAAC;IACF,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC,iBAAiB,GAAG,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;YACrD,MAAM,QAAQ,GAA2C,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;YACxE,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS;gBAAE,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;YACnE,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IACvD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,oBAAoB,CAAC,MAAkC;IAC9D,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAID;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAAC,KAA0B;IACxD,MAAM,SAAS,GAAwB,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IAC1D,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,SAAS,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IAC5E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,YAAY,CAAC,GAAsB;IACjD,OAAO,GAAG,IAAI,YAAY,IAAI,GAAG,CAAC,CAAC,CAAE,GAA+B,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9F,CAAC"}

package/dist/lib/server/decisioning/admin-router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-router.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/decisioning/admin-router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,YAAY,KAAK,IAAI,GAAG,OAAO,CAAC;IAChG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,YAAY,KAAK,IAAI,GAAG,OAAO,CAAC;IACjG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,YAAY,KAAK,IAAI,GAAG,OAAO,CAAC;CACpG;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC/C,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC7C,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,IAAI,CAAC;CACrD;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,cAAc,GAAG,mBAAmB,CAoDvF;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,GAAG,UAAU,CAOzF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,UAAU,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,cAAc,GAAG,CAAC,CAG3G;AAED,YAAY,EAAE,OAAO,EAAE,CAAC"}
+{"version":3,"file":"admin-router.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/decisioning/admin-router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGxD;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,YAAY,KAAK,IAAI,GAAG,OAAO,CAAC;IAChG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,YAAY,KAAK,IAAI,GAAG,OAAO,CAAC;IACjG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,YAAY,KAAK,IAAI,GAAG,OAAO,CAAC;CACpG;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC/C,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC7C,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,IAAI,CAAC;CACrD;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,cAAc,GAAG,mBAAmB,CAuDvF;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,GAAG,UAAU,CAOzF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,UAAU,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,cAAc,GAAG,CAAC,CAG3G;AAED,YAAY,EAAE,OAAO,EAAE,CAAC"}

package/dist/lib/server/decisioning/admin-router.js

@@ -32,6 +32,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createTenantAdminHandlers = createTenantAdminHandlers;
 exports.mountTenantAdmin = mountTenantAdmin;
 exports.createTenantAdminRouter = createTenantAdminRouter;
+const redact_1 = require("../redact");
 /**
  * Bare handlers — for adopters running a non-Express framework. The router
  * helper below mounts these on the standard paths.
@@ -69,10 +70,13 @@ function createTenantAdminHandlers(registry) {
                     res.status(404).json({ error: 'tenant_not_found', tenant_id: id });
                     return;
                 }
+                // Redact credential patterns before exposing on the wire (#1330).
+                // The recheck path can throw with upstream errors that echo
+                // basic-auth URLs or other credential bytes.
                 res.status(500).json({
                     error: 'recheck_failed',
                     tenant_id: id,
-                    reason: err instanceof Error ? err.message : String(err),
+                    reason: (0, redact_1.redactCredentialPatterns)(err instanceof Error ? err.message : String(err)),
                 });
             }
         },

package/dist/lib/server/decisioning/admin-router.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-router.js","sourceRoot":"","sources":["../../../../src/lib/server/decisioning/admin-router.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;;AA4BH,8DAoDC;AAOD,4CAOC;AAeD,0DAGC;AAxFD;;;GAGG;AACH,SAAgB,yBAAyB,CAAC,QAAwB;IAChE,OAAO;QACL,WAAW,CAAC,IAAa,EAAE,GAAa;YACtC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACzC,CAAC;QAED,SAAS,CAAC,GAAY,EAAE,GAAa;YACnC,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBACtD,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;gBACnE,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,GAAY,EAAE,GAAa;YAC7C,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBACtD,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBAC1C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACnB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC/D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;oBACnE,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,gBAAgB;oBACvB,SAAS,EAAE,EAAE;oBACb,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACzD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,gBAAgB,CAAC,GAAY,EAAE,GAAa;YAC1C,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBACtD,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,MAAkB,EAAE,QAAwB;IAC3E,MAAM,QAAQ,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC5D,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,uBAAuB,CAAuB,aAAgB,EAAE,QAAwB;IACtG,gBAAgB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAC1C,OAAO,aAAa,CAAC;AACvB,CAAC"}
+{"version":3,"file":"admin-router.js","sourceRoot":"","sources":["../../../../src/lib/server/decisioning/admin-router.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;;AA6BH,8DAuDC;AAOD,4CAOC;AAeD,0DAGC;AAhHD,sCAAqD;AAqBrD;;;GAGG;AACH,SAAgB,yBAAyB,CAAC,QAAwB;IAChE,OAAO;QACL,WAAW,CAAC,IAAa,EAAE,GAAa;YACtC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACzC,CAAC;QAED,SAAS,CAAC,GAAY,EAAE,GAAa;YACnC,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBACtD,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;gBACnE,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,GAAY,EAAE,GAAa;YAC7C,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBACtD,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBAC1C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACnB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC/D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;oBACnE,OAAO;gBACT,CAAC;gBACD,kEAAkE;gBAClE,4DAA4D;gBAC5D,6CAA6C;gBAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,gBAAgB;oBACvB,SAAS,EAAE,EAAE;oBACb,MAAM,EAAE,IAAA,iCAAwB,EAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;iBACnF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,gBAAgB,CAAC,GAAY,EAAE,GAAa;YAC1C,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBACtD,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,MAAkB,EAAE,QAAwB;IAC3E,MAAM,QAAQ,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC5D,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,uBAAuB,CAAuB,aAAgB,EAAE,QAAwB;IACtG,gBAAgB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAC1C,OAAO,aAAa,CAAC;AACvB,CAAC"}