@cloud-cli/on 1.63.4 → 1.65.0

package/dist/on.js

@@ -104,7 +104,7 @@ async function m() {
 	let [{ QueueManager: r }, { SecretStore: i }, { WebhookServer: a }, { startWorkers: o }, { WorkflowRepository: s }, { WorkflowScheduler: c }, { OidcUserRepository: l }] = await Promise.all([
 		import("./queue-DhXXzxm3.js"),
 		import("./secrets-DhkqmawU.js"),
-		import("./server-D-hcsRbi.js"),
+		import("./server-DWHXyNZq.js"),
 		import("./worker-BwNyfSpp.js"),
 		import("./workflows-DQQIVH7c.js"),
 		import("./scheduler-2d1UPcxM.js"),

package/dist/pwa.d.ts

@@ -1,4 +1,4 @@
 export declare const webManifest: string;
-export declare const appIcon = "<svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 512 512\">\n  <rect width=\"512\" height=\"512\" rx=\"112\" fill=\"#030712\"/>\n  <path d=\"M128 144h256v224H128z\" fill=\"#111827\" stroke=\"#6366f1\" stroke-width=\"24\"/>\n  <path d=\"m174 218 62 38-62 38M260 300h78\" fill=\"none\" stroke=\"#f9fafb\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"24\"/>\n  <circle cx=\"365\" cy=\"147\" r=\"47\" fill=\"#10b981\" stroke=\"#030712\" stroke-width=\"18\"/>\n</svg>";
-export declare const serviceWorker = "self.addEventListener('install', () => self.skipWaiting());\nself.addEventListener('activate', (event) => event.waitUntil(self.clients.claim()));\nself.addEventListener('push', (event) => {\n  const data = event.data?.json() || {};\n  event.waitUntil(self.registration.showNotification(data.title || 'Runner Engine', {\n    body: data.body || 'A job status changed.',\n    icon: '/app-icon.svg',\n    badge: '/app-icon.svg',\n    data: { url: data.url || '/runs' },\n  }));\n});\nself.addEventListener('notificationclick', (event) => {\n  event.notification.close();\n  const target = event.notification.data?.url || '/runs';\n  event.waitUntil((async () => {\n    const windows = await self.clients.matchAll({ type: 'window', includeUncontrolled: true });\n    const existing = windows.find((client) => new URL(client.url).pathname === target);\n    if (existing) return existing.focus();\n    return self.clients.openWindow(target);\n  })());\n});";
+export declare const appIcon = "<svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 512 512\">\n  <rect width=\"512\" height=\"512\" fill=\"#263d32\"/>\n  <g fill=\"#c8e6a8\">\n    <path d=\"M112 185 400 118v44l-288 67z\"/>\n    <path d=\"M112 253 324 204v44l-212 49z\"/>\n    <path d=\"M112 321 250 289v44l-138 32z\"/>\n  </g>\n</svg>";
+export declare const serviceWorker = "self.addEventListener('install', () => self.skipWaiting());\nself.addEventListener('activate', (event) => event.waitUntil(self.clients.claim()));\nself.addEventListener('push', (event) => {\n  const data = event.data?.json() || {};\n  event.waitUntil(self.registration.showNotification(data.title || 'Flow', {\n    body: data.body || 'A workflow run changed.',\n    icon: '/app-icon.svg',\n    badge: '/app-icon.svg',\n    data: { url: data.url || '/runs' },\n  }));\n});\nself.addEventListener('notificationclick', (event) => {\n  event.notification.close();\n  const target = event.notification.data?.url || '/runs';\n  event.waitUntil((async () => {\n    const windows = await self.clients.matchAll({ type: 'window', includeUncontrolled: true });\n    const existing = windows.find((client) => new URL(client.url).pathname === target);\n    if (existing) return existing.focus();\n    return self.clients.openWindow(target);\n  })());\n});";
 //# sourceMappingURL=pwa.d.ts.map

package/dist/pwa.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pwa.d.ts","sourceRoot":"","sources":["../src/pwa.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,WAAW,QAkBtB,CAAC;AAEH,eAAO,MAAM,OAAO,+eAKb,CAAC;AAER,eAAO,MAAM,aAAa,07BAoBtB,CAAC"}
+{"version":3,"file":"pwa.d.ts","sourceRoot":"","sources":["../src/pwa.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,WAAW,QAkBtB,CAAC;AAEH,eAAO,MAAM,OAAO,wTAOb,CAAC;AAER,eAAO,MAAM,aAAa,m7BAoBtB,CAAC"}

package/dist/safe-return-url.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Safely normalize a return URL for use in OIDC authentication flows.
+ *
+ * Preserves path + query string, rejects protocol-relative URLs, schemes,
+ * backslashes, and control characters. The result should be passed through
+ * encodeURIComponent when used as a query parameter value (e.g. ?url=<returnTo>).
+ *
+ * @param requestedReturnTo - The raw return URL string (pathname [?query] [#fragment])
+ * @returns A safe path [?query] suitable for OIDC returnTo or as a login
+ *   redirect URL. Callers should apply encodeURIComponent when interpolating
+ *   the result into a URL query parameter.
+ */
+export declare function safeReturnUrl(requestedReturnTo: string): string;
+/**
+ * Checks if an OIDC authentication attempt should be allowed for a given
+ * request path and HTTP method. This is used to determine whether the global
+ * OIDC session check applies.
+ *
+ * Browser document GET/HEAD requests to UI routes require a valid OIDC session.
+ * API endpoints, static assets, OIDC auth routes, and route-specific controls
+ * are exempt from this global check.
+ *
+ * @param pathname - The URL pathname to check
+ * @param method - The HTTP method (e.g. 'GET', 'POST', 'HEAD')
+ * @returns true if the route is exempt from the global OIDC auth check
+ */
+export declare function isExemptFromGlobalOidcAuth(pathname: string, method: string): boolean;
+/** True only for known browser-document routes that should require an OIDC session. */
+export declare function isProtectedUiRoute(pathname: string, method: string): boolean;
+//# sourceMappingURL=safe-return-url.d.ts.map

package/dist/safe-return-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-return-url.d.ts","sourceRoot":"","sources":["../src/safe-return-url.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,iBAAiB,EAAE,MAAM,GAAG,MAAM,CA8C/D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAkDpF;AAED,uFAAuF;AACvF,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAmB5E"}