@bevel-software/platform-core-backend 0.33.0 → 0.35.0

package/dist/shared/oauth-token-error.js

@@ -0,0 +1,47 @@
+/**
+ * The error codes a token endpoint may answer with, as RFC 6749 §5.2 and OIDC
+ * Core §3.1.2.6 define them. A finite list, on purpose: a code is taken from
+ * a refusing provider's body only when it is exactly one of these, so no other
+ * string a provider puts in that field (a secret, a secret with a suffix, free
+ * text) reaches a message, a verdict or a log.
+ *
+ * Shared, not a module's own: the OIDC configuration check reads a provider's
+ * refusal through it and the secrets vault a token endpoint's, and one list is
+ * the only way the two cannot disagree about which codes are standard. Each
+ * caller keeps its own sentence per code (what a tool owner should do differs
+ * from what a sign-in administrator should do); the set of codes is one.
+ */
+export const OAUTH_TOKEN_ERROR_CODES = Object.freeze([
+    'invalid_request',
+    'invalid_client',
+    'invalid_grant',
+    'unauthorized_client',
+    'unsupported_grant_type',
+    'invalid_scope',
+    'access_denied',
+    'server_error',
+    'temporarily_unavailable',
+]);
+/** Whether `code` is one of the standard token-endpoint error codes, and so safe to echo. */
+export function isStandardTokenErrorCode(code) {
+    return typeof code === 'string' && OAUTH_TOKEN_ERROR_CODES.includes(code);
+}
+/**
+ * The standard `error` code in a refusing token endpoint's JSON body, or null:
+ * when the body is not JSON, not an object, carries no string `error`, or
+ * carries one that is not a standard code.
+ */
+export function standardTokenErrorCode(bodyText) {
+    let json;
+    try {
+        json = JSON.parse(bodyText);
+    }
+    catch {
+        return null;
+    }
+    if (!json || typeof json !== 'object' || Array.isArray(json))
+        return null;
+    const { error } = json;
+    return isStandardTokenErrorCode(error) ? error : null;
+}
+//# sourceMappingURL=oauth-token-error.js.map

package/dist/shared/oauth-token-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-token-error.js","sourceRoot":"","sources":["../../src/shared/oauth-token-error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACtE,iBAAiB;IACjB,gBAAgB;IAChB,eAAe;IACf,qBAAqB;IACrB,wBAAwB;IACxB,eAAe;IACf,eAAe;IACf,cAAc;IACd,yBAAyB;CAC1B,CAAC,CAAC;AAEH,6FAA6F;AAC7F,MAAM,UAAU,wBAAwB,CAAC,IAAa;IACpD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,uBAAuB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,MAAM,EAAE,KAAK,EAAE,GAAG,IAA+B,CAAC;IAClD,OAAO,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC"}

package/dist/shared/path-order.d.ts

@@ -1,12 +1,25 @@
 /**
- * The ONE ordering of repository paths: component by component, each
- * component by `localeCompare`, a shorter path before its extensions. It is
- * exactly the order a directory walk that sorts each level's entries visits
- * them in — so a consumer that must agree with the walk on "first by path"
- * (plugin discovery keeps the first of two folders sharing a slug; principal
- * synthesis must pick the same one) sorts with this and nothing else. A
- * whole-string `localeCompare` does not agree: it weighs the separator
- * against the next character (`a-b/x` before `a/b/x`), the walk never does.
+ * The TWO orderings of repository paths, and which consumer takes which:
+ *
+ * - {@link comparePathComponents} is the platform's own walk order — component
+ *   by component, each by `localeCompare`, a shorter path before its
+ *   extensions — exactly the order a directory walk that sorts each level's
+ *   entries visits them in. A consumer that must agree with THAT walk on
+ *   "first by path" (plugin discovery keeps the first of two folders sharing a
+ *   slug; principal synthesis must pick the same one) sorts with it and
+ *   nothing else.
+ * - {@link compareSearchPaths} is ripgrep's walk order (`--sort path`):
+ *   component by component, each by its UTF-8 bytes. A `grep` answer is
+ *   assembled from several ripgrep runs and a document pass, and it has to
+ *   sort as ripgrep itself sorts, or the search could not tell which files a
+ *   run has passed. The two orders differ where collation and bytes do
+ *   (`B.md` sorts before `a.md` by bytes, after it by collation), which is why
+ *   a grep answer and the explorer tree can list two siblings the other way
+ *   round. Nothing but the search uses it.
+ *
+ * Both agree on the shape: a whole-string compare does not — it weighs the
+ * separator against the next character (`a-b/x` before `a/b/x`), a walk never
+ * does.
  *
  * TOTAL over distinct paths: two components the collation cannot tell apart
  * (a precomposed `é` and its decomposed spelling) fall through to code-unit
@@ -15,4 +28,11 @@
  * consumers could then pick different folders for one slug.
  */
 export declare function comparePathComponents(a: string, b: string): number;
+/**
+ * The order every `grep` search answers in — ripgrep's: path component by
+ * component, each compared by its UTF-8 bytes, so a folder's files come before
+ * a sibling file whose name extends the folder's. See the note above on how it
+ * differs from {@link comparePathComponents}, and why the search needs it.
+ */
+export declare function compareSearchPaths(a: string, b: string): number;
 //# sourceMappingURL=path-order.d.ts.map

package/dist/shared/path-order.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path-order.d.ts","sourceRoot":"","sources":["../../src/shared/path-order.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CASlE"}
+{"version":3,"file":"path-order.d.ts","sourceRoot":"","sources":["../../src/shared/path-order.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CASlE;AASD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAQ/D"}

package/dist/shared/path-order.js

@@ -1,12 +1,25 @@
 /**
- * The ONE ordering of repository paths: component by component, each
- * component by `localeCompare`, a shorter path before its extensions. It is
- * exactly the order a directory walk that sorts each level's entries visits
- * them in — so a consumer that must agree with the walk on "first by path"
- * (plugin discovery keeps the first of two folders sharing a slug; principal
- * synthesis must pick the same one) sorts with this and nothing else. A
- * whole-string `localeCompare` does not agree: it weighs the separator
- * against the next character (`a-b/x` before `a/b/x`), the walk never does.
+ * The TWO orderings of repository paths, and which consumer takes which:
+ *
+ * - {@link comparePathComponents} is the platform's own walk order — component
+ *   by component, each by `localeCompare`, a shorter path before its
+ *   extensions — exactly the order a directory walk that sorts each level's
+ *   entries visits them in. A consumer that must agree with THAT walk on
+ *   "first by path" (plugin discovery keeps the first of two folders sharing a
+ *   slug; principal synthesis must pick the same one) sorts with it and
+ *   nothing else.
+ * - {@link compareSearchPaths} is ripgrep's walk order (`--sort path`):
+ *   component by component, each by its UTF-8 bytes. A `grep` answer is
+ *   assembled from several ripgrep runs and a document pass, and it has to
+ *   sort as ripgrep itself sorts, or the search could not tell which files a
+ *   run has passed. The two orders differ where collation and bytes do
+ *   (`B.md` sorts before `a.md` by bytes, after it by collation), which is why
+ *   a grep answer and the explorer tree can list two siblings the other way
+ *   round. Nothing but the search uses it.
+ *
+ * Both agree on the shape: a whole-string compare does not — it weighs the
+ * separator against the next character (`a-b/x` before `a/b/x`), a walk never
+ * does.
  *
  * TOTAL over distinct paths: two components the collation cannot tell apart
  * (a precomposed `é` and its decomposed spelling) fall through to code-unit
@@ -32,4 +45,20 @@ function compareComponent(a, b) {
         return order;
     return a < b ? -1 : a > b ? 1 : 0;
 }
+/**
+ * The order every `grep` search answers in — ripgrep's: path component by
+ * component, each compared by its UTF-8 bytes, so a folder's files come before
+ * a sibling file whose name extends the folder's. See the note above on how it
+ * differs from {@link comparePathComponents}, and why the search needs it.
+ */
+export function compareSearchPaths(a, b) {
+    const as = a.split('/');
+    const bs = b.split('/');
+    for (let i = 0; i < Math.min(as.length, bs.length); i++) {
+        const c = Buffer.compare(Buffer.from(as[i], 'utf8'), Buffer.from(bs[i], 'utf8'));
+        if (c !== 0)
+            return c;
+    }
+    return as.length - bs.length;
+}
 //# sourceMappingURL=path-order.js.map

package/dist/shared/path-order.js.map

@@ -1 +1 @@
-{"version":3,"file":"path-order.js","sourceRoot":"","sources":["../../src/shared/path-order.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB,CAAC,CAAS,EAAE,CAAS;IACxD,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC;QAC/C,IAAI,KAAK,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IAChC,CAAC;IACD,OAAO,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC;AAC/B,CAAC;AAED,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,CAAS,EAAE,CAAS;IAC5C,MAAM,KAAK,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC"}
+{"version":3,"file":"path-order.js","sourceRoot":"","sources":["../../src/shared/path-order.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,qBAAqB,CAAC,CAAS,EAAE,CAAS;IACxD,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC;QAC/C,IAAI,KAAK,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IAChC,CAAC;IACD,OAAO,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC;AAC/B,CAAC;AAED,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,CAAS,EAAE,CAAS;IAC5C,MAAM,KAAK,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAS,EAAE,CAAS;IACrD,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACxD,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAE,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC;AAC/B,CAAC"}

package/dist/shared/read-capped.d.ts

@@ -0,0 +1,19 @@
+/**
+ * At most `limit` bytes of a response body, decoded as text, the rest of the
+ * stream cancelled.
+ *
+ * Each CHUNK is sliced to the remaining budget before being decoded, not just
+ * counted against it: a provider that answers in one 5MB chunk would otherwise
+ * put the whole thing through the decoder before the loop noticed it was over,
+ * which is the bound bypassed by the very party it is meant to bound. Never a
+ * byte past the limit: once the budget is spent the read stops without asking
+ * for more, so a body of exactly `limit` bytes on a stream that stays open
+ * returns at once. And the read never falls back to `res.text()` on a live
+ * stream: a cap applied after that read bounds nothing.
+ *
+ * Shared, not a module's own: the connection probe reads a provider's
+ * rejection with it and the secrets vault a token endpoint's refusal, and one
+ * reader is the only way the two cannot disagree about what "bounded" means.
+ */
+export declare function readCapped(res: Response, limit: number): Promise<string>;
+//# sourceMappingURL=read-capped.d.ts.map

package/dist/shared/read-capped.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-capped.d.ts","sourceRoot":"","sources":["../../src/shared/read-capped.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAsB9E"}

package/dist/shared/read-capped.js

@@ -0,0 +1,45 @@
+/**
+ * At most `limit` bytes of a response body, decoded as text, the rest of the
+ * stream cancelled.
+ *
+ * Each CHUNK is sliced to the remaining budget before being decoded, not just
+ * counted against it: a provider that answers in one 5MB chunk would otherwise
+ * put the whole thing through the decoder before the loop noticed it was over,
+ * which is the bound bypassed by the very party it is meant to bound. Never a
+ * byte past the limit: once the budget is spent the read stops without asking
+ * for more, so a body of exactly `limit` bytes on a stream that stays open
+ * returns at once. And the read never falls back to `res.text()` on a live
+ * stream: a cap applied after that read bounds nothing.
+ *
+ * Shared, not a module's own: the connection probe reads a provider's
+ * rejection with it and the secrets vault a token endpoint's refusal, and one
+ * reader is the only way the two cannot disagree about what "bounded" means.
+ */
+export async function readCapped(res, limit) {
+    const reader = res.body?.getReader();
+    // No stream (a mocked or already-consumed response): fall back to the whole
+    // body, which for those cases is ours and small.
+    if (!reader)
+        return (await res.text()).slice(0, limit);
+    const decoder = new TextDecoder();
+    let out = '';
+    let read = 0;
+    try {
+        while (read < limit) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            const remaining = limit - read;
+            const chunk = value.byteLength > remaining ? value.subarray(0, remaining) : value;
+            read += chunk.byteLength;
+            out += decoder.decode(chunk, { stream: true });
+            if (chunk.byteLength < value.byteLength)
+                break;
+        }
+    }
+    finally {
+        await reader.cancel().catch(() => { });
+    }
+    return out;
+}
+//# sourceMappingURL=read-capped.js.map

package/dist/shared/read-capped.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-capped.js","sourceRoot":"","sources":["../../src/shared/read-capped.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAa,EAAE,KAAa;IAC3D,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IACrC,4EAA4E;IAC5E,iDAAiD;IACjD,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,KAAK,EAAE,CAAC;YACpB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,MAAM,SAAS,GAAG,KAAK,GAAG,IAAI,CAAC;YAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAClF,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;YACzB,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,IAAI,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU;gBAAE,MAAM;QACjD,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/migrations/0022_session_version.sql

@@ -0,0 +1,6 @@
+-- The generation of an account's sessions that is honoured: a session token
+-- carries the value it was issued at, and changing the password moves it on.
+-- Every existing row starts at 0, which is what a token issued before this
+-- column existed counts as, so nobody is signed out by the upgrade. Guarded
+-- so a database that already has the column no-ops instead of failing.
+ALTER TABLE "users" ADD COLUMN IF NOT EXISTS "session_version" integer DEFAULT 0 NOT NULL;

package/migrations/0023_agent_path.sql

@@ -0,0 +1,3 @@
+ALTER TABLE "agent_connections" ADD COLUMN "agent_path" text;--> statement-breakpoint
+ALTER TABLE "api_tokens" ADD COLUMN "agent_path" text;--> statement-breakpoint
+ALTER TABLE "oauth_auth_codes" ADD COLUMN "agent_path" text;