@ganju/utils 0.0.2 → 0.0.4

package/dist/cliConstants.d.ts

@@ -1,6 +1,7 @@
 export declare const CLI_OAUTH_CLIENT_NAME = "Ganju CLI";
 export declare const CLI_OAUTH_REDIRECT_PATH = "/callback";
 export declare const CLI_OAUTH_REDIRECT_PORTS: number[];
+export declare const CONTROL_PLANE_SCOPE = "ganju:manage";
 export declare const CLI_OAUTH_SCOPES: string[];
 export declare const CLI_TOKEN_REFRESH_SKEW_SECONDS = 60;
 export declare const CUSTOM_CODE_SDK_SPECIFIER = "./ganju-sdk.js";

package/dist/cliConstants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cliConstants.d.ts","sourceRoot":"","sources":["../src/cliConstants.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,qBAAqB,cAAc,CAAC;AACjD,eAAO,MAAM,uBAAuB,cAAc,CAAC;AACnD,eAAO,MAAM,wBAAwB,UAAiC,CAAC;AAIvE,eAAO,MAAM,gBAAgB,UAK5B,CAAC;AAIF,eAAO,MAAM,8BAA8B,KAAK,CAAC;AAIjD,eAAO,MAAM,yBAAyB,mBAAmB,CAAC;AAI1D,eAAO,MAAM,4BAA4B,QAAkB,CAAC;AAK5D,eAAO,MAAM,+BAA+B,EAAoB,aAAa,CAAC"}
+{"version":3,"file":"cliConstants.d.ts","sourceRoot":"","sources":["../src/cliConstants.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,qBAAqB,cAAc,CAAC;AACjD,eAAO,MAAM,uBAAuB,cAAc,CAAC;AACnD,eAAO,MAAM,wBAAwB,UAAiC,CAAC;AAOvE,eAAO,MAAM,mBAAmB,iBAAiB,CAAC;AAUlD,eAAO,MAAM,gBAAgB,UAM5B,CAAC;AAIF,eAAO,MAAM,8BAA8B,KAAK,CAAC;AAIjD,eAAO,MAAM,yBAAyB,mBAAmB,CAAC;AAI1D,eAAO,MAAM,4BAA4B,QAAkB,CAAC;AAK5D,eAAO,MAAM,+BAA+B,EAAoB,aAAa,CAAC"}

package/dist/cliConstants.js

@@ -12,7 +12,7 @@
 // The rule for this file: nothing lands here unless the CLI reads it, and it
 // imports nothing.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CREDENTIAL_PROVIDER_CUSTOM_CODE = exports.CUSTOM_CODE_MAX_BUNDLE_BYTES = exports.CUSTOM_CODE_SDK_SPECIFIER = exports.CLI_TOKEN_REFRESH_SKEW_SECONDS = exports.CLI_OAUTH_SCOPES = exports.CLI_OAUTH_REDIRECT_PORTS = exports.CLI_OAUTH_REDIRECT_PATH = exports.CLI_OAUTH_CLIENT_NAME = void 0;
+exports.CREDENTIAL_PROVIDER_CUSTOM_CODE = exports.CUSTOM_CODE_MAX_BUNDLE_BYTES = exports.CUSTOM_CODE_SDK_SPECIFIER = exports.CLI_TOKEN_REFRESH_SKEW_SECONDS = exports.CLI_OAUTH_SCOPES = exports.CONTROL_PLANE_SCOPE = exports.CLI_OAUTH_REDIRECT_PORTS = exports.CLI_OAUTH_REDIRECT_PATH = exports.CLI_OAUTH_CLIENT_NAME = void 0;
 // How `ganju login` identifies itself, and where it listens for the redirect.
 //
 // A fixed port would fail whenever something else already held it, so the CLI
@@ -24,13 +24,26 @@ exports.CREDENTIAL_PROVIDER_CUSTOM_CODE = exports.CUSTOM_CODE_MAX_BUNDLE_BYTES =
 exports.CLI_OAUTH_CLIENT_NAME = 'Ganju CLI';
 exports.CLI_OAUTH_REDIRECT_PATH = '/callback';
 exports.CLI_OAUTH_REDIRECT_PORTS = [8976, 8977, 8978, 8979, 8980];
+// What the API requires before a bearer token may act on the control plane —
+// publish code, read and rotate secrets, change billing. Lives here because the
+// CLI is the client that asks for it; the API's own copy is the re-export in
+// `constants.ts`, so the string the CLI requests and the string the middleware
+// demands cannot drift apart.
+exports.CONTROL_PLANE_SCOPE = 'ganju:manage';
 // `offline_access` is what mints the refresh token; without it a CLI session
 // would end an hour after login.
+//
+// An MCP client reads the discovery document to decide what to ask for, and
+// that document does not list `ganju:manage` — so a token minted for someone's
+// MCP server can reach that server and nothing else, while this one can deploy.
+// The consent screen names the scope, which is the point: deploying code as
+// someone is worth showing them.
 exports.CLI_OAUTH_SCOPES = [
     'openid',
     'profile',
     'email',
-    'offline_access'
+    'offline_access',
+    exports.CONTROL_PLANE_SCOPE
 ];
 // Refresh this far before the access token actually expires, so a long command
 // can't have its token die mid-request.

package/dist/constants.d.ts

@@ -519,6 +519,10 @@ export declare const constants: {
     CUSTOM_CODE_MAX_FILE_PATH: number;
     CUSTOM_CODE_VERSION_STATUSES: ("draft" | "published" | "archived")[];
     CUSTOM_CODE_SCRIPT_NAME_PREFIX: string;
+    CUSTOM_CODE_SCRIPT_NAME_MAX: number;
+    CUSTOM_CODE_UPLOAD_SUFFIX_CHARS: number;
+    CUSTOM_CODE_SWEEP_GRACE_MS: number;
+    CUSTOM_CODE_SWEEP_MAX_DELETES: number;
     CUSTOM_CODE_PREVIEW_SCRIPT_SUFFIX: string;
     CUSTOM_CODE_PREVIEW_TOKEN_TTL_MS: number;
     CUSTOM_CODE_TEST_TIMEOUT_MS: number;
@@ -539,6 +543,7 @@ export declare const constants: {
     OUTPUT_SCHEMA_NOT_OBJECT_MESSAGE: string;
     CUSTOM_CODE_BINDING_TOKEN: string;
     CUSTOM_CODE_BINDING_BROKER: string;
+    CUSTOM_CODE_BINDING_VERSION: string;
     CUSTOM_CODE_BROKER_ORIGIN: string;
     CUSTOM_CODE_BROKER_PATH_CONNECTION: string;
     CUSTOM_CODE_BROKER_PATH_SECRET: string;
@@ -559,6 +564,8 @@ export declare const constants: {
     CUSTOM_CODE_BROKER_SERVICE_ENV: string;
     CUSTOM_CODE_COMPATIBILITY_DATE: string;
     CUSTOM_CODE_SCRIPT_CPU_MS: number;
+    CUSTOM_CODE_REGISTER_TIMEOUT_MS: number;
+    CUSTOM_CODE_REGISTER_INTERVAL_MS: number;
     CUSTOM_CODE_MAX_LOGS: number;
     CUSTOM_CODE_MAX_LOG_LENGTH: number;
     CUSTOM_CODE_SEND_FILE_TARGET_GMAIL: "gmail";
@@ -605,6 +612,7 @@ export declare const constants: {
     OAUTH_SCOPES_SUPPORTED: string[];
     MCP_SCOPE_READ: string;
     ARTIFACT_SCOPE_PREFIX: string;
+    CONTROL_PLANE_SCOPE: string;
     CLI_OAUTH_CLIENT_NAME: string;
     CLI_OAUTH_REDIRECT_PATH: string;
     CLI_OAUTH_REDIRECT_PORTS: number[];

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AA2JA,QAAA,MAAM,yBAAyB,EAAiB,UAAU,CAAC;AAC3D,QAAA,MAAM,+BAA+B,EAAuB,gBAAgB,CAAC;AAC7E,QAAA,MAAM,8BAA8B,EAAsB,eAAe,CAAC;AAC1E,QAAA,MAAM,wBAAwB,EAAgB,SAAS,CAAC;AAuCxD,QAAA,MAAM,sBAAsB,EAAiB,UAAU,CAAC;AACxD,QAAA,MAAM,4BAA4B,EAAuB,gBAAgB,CAAC;AAC1E,QAAA,MAAM,oBAAoB,EAAe,QAAQ,CAAC;AAClD,QAAA,MAAM,oBAAoB,EAAe,QAAQ,CAAC;AAmYlD,QAAA,MAAM,sBAAsB,EAAkB,WAAW,CAAC;AAC1D,QAAA,MAAM,mBAAmB,EAAe,QAAQ,CAAC;AAGjD,QAAA,MAAM,mBAAmB,EAAe,QAAQ,CAAC;AAkTjD,MAAM,MAAM,mBAAmB,GAC3B;IACE,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GACD;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9D;IACE,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GACD;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAu2BpE,UAAU,UAAU;IAElB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAGhC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAMjC,sBAAsB,EAAE,MAAM,CAAC;IAM/B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,SAAS,EAAE,OAAO,CAAC;IAKnB,eAAe,EAAE,OAAO,CAAC;IAOzB,gBAAgB,EAAE,OAAO,CAAC;IAK1B,2BAA2B,EAAE,MAAM,GAAG,IAAI,CAAC;IAG3C,gBAAgB,EAAE,MAAM,CAAC;IACzB,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAqKD,YAAY,EAAE,UAAU,EAAE,CAAC;AAE3B,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAnyDhB,OAAO,yBAAyB,GAChC,OAAO,+BAA+B,GACtC,OAAO,8BAA8B,GACrC,OAAO,wBAAwB;eAC5B,MAAM;;;;;;;;;;;;;;;;;;eAsCT,OAAO,sBAAsB,GAC7B,OAAO,4BAA4B,GACnC,OAAO,oBAAoB,GAC3B,OAAO,oBAAoB;eACxB,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA6YT,OAAO,mBAAmB,GAC1B,OAAO,mBAAmB,GAC1B,OAAO,sBAAsB;eAC1B,MAAM;eACN,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eA6NwB,MAAM,GAAG,MAAM;cAAQ,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsqDnE,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AA6JA,QAAA,MAAM,yBAAyB,EAAiB,UAAU,CAAC;AAC3D,QAAA,MAAM,+BAA+B,EAAuB,gBAAgB,CAAC;AAC7E,QAAA,MAAM,8BAA8B,EAAsB,eAAe,CAAC;AAC1E,QAAA,MAAM,wBAAwB,EAAgB,SAAS,CAAC;AAuCxD,QAAA,MAAM,sBAAsB,EAAiB,UAAU,CAAC;AACxD,QAAA,MAAM,4BAA4B,EAAuB,gBAAgB,CAAC;AAC1E,QAAA,MAAM,oBAAoB,EAAe,QAAQ,CAAC;AAClD,QAAA,MAAM,oBAAoB,EAAe,QAAQ,CAAC;AAmYlD,QAAA,MAAM,sBAAsB,EAAkB,WAAW,CAAC;AAC1D,QAAA,MAAM,mBAAmB,EAAe,QAAQ,CAAC;AAGjD,QAAA,MAAM,mBAAmB,EAAe,QAAQ,CAAC;AAkTjD,MAAM,MAAM,mBAAmB,GAC3B;IACE,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GACD;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9D;IACE,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GACD;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAg6BpE,UAAU,UAAU;IAElB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAGhC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAMjC,sBAAsB,EAAE,MAAM,CAAC;IAM/B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,SAAS,EAAE,OAAO,CAAC;IAKnB,eAAe,EAAE,OAAO,CAAC;IAOzB,gBAAgB,EAAE,OAAO,CAAC;IAK1B,2BAA2B,EAAE,MAAM,GAAG,IAAI,CAAC;IAG3C,gBAAgB,EAAE,MAAM,CAAC;IACzB,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAqKD,YAAY,EAAE,UAAU,EAAE,CAAC;AAE3B,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eA51DhB,OAAO,yBAAyB,GAChC,OAAO,+BAA+B,GACtC,OAAO,8BAA8B,GACrC,OAAO,wBAAwB;eAC5B,MAAM;;;;;;;;;;;;;;;;;;eAsCT,OAAO,sBAAsB,GAC7B,OAAO,4BAA4B,GACnC,OAAO,oBAAoB,GAC3B,OAAO,oBAAoB;eACxB,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA6YT,OAAO,mBAAmB,GAC1B,OAAO,mBAAmB,GAC1B,OAAO,sBAAsB;eAC1B,MAAM;eACN,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eA6NwB,MAAM,GAAG,MAAM;cAAQ,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuuDnE,CAAC"}

package/dist/constants.js

@@ -1041,9 +1041,36 @@ const CUSTOM_CODE_MAIN_MODULE = 'index.js';
 // object read on every deploy.
 const CUSTOM_CODE_MAX_FILES = 25;
 const CUSTOM_CODE_MAX_FILE_PATH = 100;
-// WfP script name: `artifact_<artifactId>`. The id, never the slug — slugs are
-// user-editable and a rename would orphan the deployed script.
+// WfP script name: `artifact_<artifactId>_<upload>`. The id, never the slug —
+// slugs are user-editable and a rename would orphan the deployed script.
+//
+// The trailing segment is minted per upload rather than derived from anything,
+// which is the whole point: uploading over a name that already exists is not
+// read-your-writes, so a deploy that replaces a script can serve the previous
+// edition for up to half a minute. A name nothing has ever used cannot, and
+// costs nothing to mint. Everything a publish used to do to survive that race —
+// waiting on an edition marker, refusing with a 503, putting the previous bundle
+// back when validation failed — went with the reuse that caused it.
 const CUSTOM_CODE_SCRIPT_NAME_PREFIX = 'artifact_';
+// Worker names cap at 63 characters, and `artifact_<uuid>` already spends 45.
+// That leaves 17 for a separator and a suffix, so a second uuid does not fit and
+// neither does a hex-32 digest. Twelve hex characters is 48 bits against a
+// namespace holding at most a few hundred names for any one artifact — not a
+// collision worth checking for, and an upload to a name in use would fail loudly
+// rather than quietly serve the wrong code.
+const CUSTOM_CODE_SCRIPT_NAME_MAX = 63;
+const CUSTOM_CODE_UPLOAD_SUFFIX_CHARS = 12;
+// How long a superseded script stays in the namespace before the hourly sweep
+// may collect it.
+//
+// Deleting at publish time would race the thing it deletes: a tool call that
+// resolved the old pointer a moment earlier is still in flight, and the pointer
+// moving does not recall it. An hour is far longer than any call can take, and
+// the wait costs $0.02 per script per month against an allowance of 1,000.
+const CUSTOM_CODE_SWEEP_GRACE_MS = 60 * 60 * 1_000;
+// Deletes per sweep. A backlog drains over several hourly runs rather than
+// making one run unbounded — the same shape the retention purge uses.
+const CUSTOM_CODE_SWEEP_MAX_DELETES = 200;
 // A second script per artifact, `artifact_<id>_preview`, that the Test panel
 // deploys a draft into and calls.
 //
@@ -1228,6 +1255,17 @@ const CUSTOM_CODE_COMPATIBILITY_DATE = '2025-11-17';
 // tighter than our own workers' 30s — this is the technical cap that bounds
 // what one adversarial call can cost us, so an infinite loop in a customer's
 // tool is billed as five seconds rather than as whatever it wanted.
+// How long a deploy waits for a freshly minted script name to become
+// dispatchable, and how often it asks.
+//
+// Every upload goes to a name that has never been used, which is
+// read-your-writes: ~2s end to end against the deployed namespace, against the
+// 20-41s a replacement could take. So this bounds how long a brand-new name
+// takes to register, never how long an old edition takes to stop answering —
+// there is no old edition. It is short for that reason, and a script that
+// answers with the wrong edition now fails outright instead of being waited on.
+const CUSTOM_CODE_REGISTER_TIMEOUT_MS = 8_000;
+const CUSTOM_CODE_REGISTER_INTERVAL_MS = 500;
 const CUSTOM_CODE_SCRIPT_CPU_MS = 5_000;
 // The ctx.log() caps also live in ./sdkConstants — the buffer that enforces them
 // runs inside the isolate.
@@ -1375,6 +1413,20 @@ const OAUTH_SCOPES_SUPPORTED = ['openid', 'profile', 'email', 'offline_access'];
 // TODO: Net: mcp:read is a cosmetic claim on bot tokens; artifact: is a code path that can't fire. Neither affects security today. They become real only if you build the per-server confinement feature (which would make artifact:<slug> issued + enforced). This is more for OIDC.
 const MCP_SCOPE_READ = 'mcp:read';
 const ARTIFACT_SCOPE_PREFIX = 'artifact:';
+// `CONTROL_PLANE_SCOPE` (defined in ./cliConstants, re-exported below) is what
+// a bearer token needs before it may act as the user on the control plane —
+// publish code, read and rotate secrets, change billing.
+//
+// Access tokens are minted for MCP clients too: a customer who connects Claude
+// Desktop to one of their MCP servers hands it a token for their own account,
+// and `/oauth2/userinfo` will happily confirm that it is theirs. Without a scope
+// that separates the two, "this token belongs to the user" would be the same
+// sentence as "this token may deploy code as the user", and connecting an MCP
+// client would silently be an act of full delegation.
+//
+// Deliberately outside OAUTH_SCOPES_SUPPORTED: it is allowlisted on the provider
+// so the CLI can request it, and left out of discovery, which is what an MCP
+// client reads to decide what to ask for.
 // The CLI signs in as a public OAuth client through a loopback redirect
 // (RFC 8252) — the flow `wrangler`, `gh` and `vercel` all use. It registers
 // itself through RFC 7591 dynamic registration on first login rather than
@@ -2116,6 +2168,10 @@ exports.constants = {
     CUSTOM_CODE_MAX_FILE_PATH,
     CUSTOM_CODE_VERSION_STATUSES,
     CUSTOM_CODE_SCRIPT_NAME_PREFIX,
+    CUSTOM_CODE_SCRIPT_NAME_MAX,
+    CUSTOM_CODE_UPLOAD_SUFFIX_CHARS,
+    CUSTOM_CODE_SWEEP_GRACE_MS,
+    CUSTOM_CODE_SWEEP_MAX_DELETES,
     CUSTOM_CODE_PREVIEW_SCRIPT_SUFFIX,
     CUSTOM_CODE_PREVIEW_TOKEN_TTL_MS,
     CUSTOM_CODE_TEST_TIMEOUT_MS,
@@ -2136,6 +2192,7 @@ exports.constants = {
     OUTPUT_SCHEMA_NOT_OBJECT_MESSAGE,
     CUSTOM_CODE_BINDING_TOKEN: sdkConstants_1.CUSTOM_CODE_BINDING_TOKEN,
     CUSTOM_CODE_BINDING_BROKER: sdkConstants_1.CUSTOM_CODE_BINDING_BROKER,
+    CUSTOM_CODE_BINDING_VERSION: sdkConstants_1.CUSTOM_CODE_BINDING_VERSION,
     CUSTOM_CODE_BROKER_ORIGIN: sdkConstants_1.CUSTOM_CODE_BROKER_ORIGIN,
     CUSTOM_CODE_BROKER_PATH_CONNECTION: sdkConstants_1.CUSTOM_CODE_BROKER_PATH_CONNECTION,
     CUSTOM_CODE_BROKER_PATH_SECRET: sdkConstants_1.CUSTOM_CODE_BROKER_PATH_SECRET,
@@ -2156,6 +2213,8 @@ exports.constants = {
     CUSTOM_CODE_BROKER_SERVICE_ENV,
     CUSTOM_CODE_COMPATIBILITY_DATE,
     CUSTOM_CODE_SCRIPT_CPU_MS,
+    CUSTOM_CODE_REGISTER_TIMEOUT_MS,
+    CUSTOM_CODE_REGISTER_INTERVAL_MS,
     CUSTOM_CODE_MAX_LOGS: sdkConstants_1.CUSTOM_CODE_MAX_LOGS,
     CUSTOM_CODE_MAX_LOG_LENGTH: sdkConstants_1.CUSTOM_CODE_MAX_LOG_LENGTH,
     CUSTOM_CODE_SEND_FILE_TARGET_GMAIL,
@@ -2202,6 +2261,7 @@ exports.constants = {
     OAUTH_SCOPES_SUPPORTED,
     MCP_SCOPE_READ,
     ARTIFACT_SCOPE_PREFIX,
+    CONTROL_PLANE_SCOPE: cliConstants_1.CONTROL_PLANE_SCOPE,
     CLI_OAUTH_CLIENT_NAME: cliConstants_1.CLI_OAUTH_CLIENT_NAME,
     CLI_OAUTH_REDIRECT_PATH: cliConstants_1.CLI_OAUTH_REDIRECT_PATH,
     CLI_OAUTH_REDIRECT_PORTS: cliConstants_1.CLI_OAUTH_REDIRECT_PORTS,

package/dist/customCodeToken.d.ts

@@ -24,18 +24,53 @@ export declare const mintCustomCodeToken: (payload: Omit<CustomCodeTokenPayload,
  */
 export declare const verifyCustomCodeToken: (token: string, secret: string, now?: number) => Promise<CustomCodeTokenPayload | null>;
 /**
- * The dispatch-namespace script name for an artifact: `artifact_<id>`.
+ * The legacy dispatch-namespace script name for an artifact: `artifact_<id>`.
  *
  * The id, never the slug — slugs are user-editable and a rename would orphan the
  * deployed script while the database still pointed at a live version.
+ *
+ * Nothing uploads to this name any more; every deploy mints its own. It survives
+ * as the fallback for a version published before `script_name` existed, whose
+ * bundle really is sitting under this name. Tightening a rule must never stop an
+ * already-published version from serving, because that failure is invisible to
+ * whoever owns it — the same reason the boot loop still accepts a stored tool key
+ * the current catalog no longer offers.
  */
 export declare const customCodeScriptName: (artifactId: string) => string;
 /**
- * The script name a test run deploys into: `artifact_<id>_preview`.
+ * The legacy preview script name: `artifact_<id>_preview`.
  *
- * A second script rather than a second version of the live one, because a test
- * must not be able to disturb what MCP clients are being served — and the only
- * way to be certain of that is for it to run under a name nothing dispatches to.
+ * Kept for the same reason as the one above, and for one more: it is the prefix
+ * the sweep matches to recognise a preview script left behind by a test run that
+ * did not clean up after itself.
  */
 export declare const customCodePreviewScriptName: (artifactId: string) => string;
+/**
+ * A dispatch-namespace name no upload has ever used:
+ * `artifact_<id>_<12 hex chars>`.
+ *
+ * Minted rather than derived, and that is the entire design. Uploading over an
+ * existing name is not read-your-writes — a replacement can serve the previous
+ * edition for tens of seconds — so a deploy that always writes to a new name is
+ * correct by construction rather than by waiting to see whether it worked.
+ *
+ * The suffix deliberately carries no meaning. The two candidates that did are
+ * both wrong: the bundle digest collides whenever a deploy reverts to bytes that
+ * shipped before, which is exactly what a rollback is, and the version id is one
+ * string across every re-upload of a single draft, which is every test run of it.
+ *
+ * Twelve hex characters is what fits. Worker names cap at 63 and
+ * `artifact_<uuid>` spends 45 of them.
+ */
+export declare const customCodeUploadName: (artifactId: string) => string;
+/**
+ * A preview name no test run has ever used:
+ * `artifact_<id>_preview_<12 hex chars>`.
+ *
+ * The sharper version of the same race. Every test used to deploy over one
+ * preview name, so a test could report the run before it — which reads as "my
+ * edit did nothing" from the one tool whose whole job is to say what an edit
+ * does. Nothing stores this: it is minted, used, and deleted inside one request.
+ */
+export declare const customCodePreviewUploadName: (artifactId: string) => string;
 //# sourceMappingURL=customCodeToken.d.ts.map

package/dist/customCodeToken.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"customCodeToken.d.ts","sourceRoot":"","sources":["../src/customCodeToken.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,sBAAsB;IAGrC,CAAC,EAAE,MAAM,CAAC;IACV,UAAU,EAAE,MAAM,CAAC;IAGnB,SAAS,EAAE,MAAM,CAAC;IAIlB,GAAG,EAAE,MAAM,CAAC;IAOZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAGlB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AA0BD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAC9B,SAAS,IAAI,CAAC,sBAAsB,EAAE,GAAG,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,EACD,QAAQ,MAAM,EACd,WAAU,MAAmB,KAC5B,OAAO,CAAC,MAAM,CAmBhB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,GAChC,OAAO,MAAM,EACb,QAAQ,MAAM,EACd,MAAM,MAAM,KACX,OAAO,CAAC,sBAAsB,GAAG,IAAI,CA+DvC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAAI,YAAY,MAAM,KAAG,MACE,CAAC;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,GAAI,YAAY,MAAM,KAAG,MACoB,CAAC"}
+{"version":3,"file":"customCodeToken.d.ts","sourceRoot":"","sources":["../src/customCodeToken.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,sBAAsB;IAGrC,CAAC,EAAE,MAAM,CAAC;IACV,UAAU,EAAE,MAAM,CAAC;IAGnB,SAAS,EAAE,MAAM,CAAC;IAIlB,GAAG,EAAE,MAAM,CAAC;IAOZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAGlB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AA0BD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAC9B,SAAS,IAAI,CAAC,sBAAsB,EAAE,GAAG,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,EACD,QAAQ,MAAM,EACd,WAAU,MAAmB,KAC5B,OAAO,CAAC,MAAM,CAmBhB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,GAChC,OAAO,MAAM,EACb,QAAQ,MAAM,EACd,MAAM,MAAM,KACX,OAAO,CAAC,sBAAsB,GAAG,IAAI,CA+DvC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,GAAI,YAAY,MAAM,KAAG,MACE,CAAC;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,GAAI,YAAY,MAAM,KAAG,MACoB,CAAC;AAEtF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,oBAAoB,GAAI,YAAY,MAAM,KAAG,MACR,CAAC;AAEnD;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,GAAI,YAAY,MAAM,KAAG,MACR,CAAC"}

package/dist/customCodeToken.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.customCodePreviewScriptName = exports.customCodeScriptName = exports.verifyCustomCodeToken = exports.mintCustomCodeToken = void 0;
+exports.customCodePreviewUploadName = exports.customCodeUploadName = exports.customCodePreviewScriptName = exports.customCodeScriptName = exports.verifyCustomCodeToken = exports.mintCustomCodeToken = void 0;
 const base64_1 = require("./base64");
 const constants_1 = require("./constants");
 const encoder = new TextEncoder();
@@ -97,19 +97,90 @@ const verifyCustomCodeToken = async (token, secret, now) => {
 };
 exports.verifyCustomCodeToken = verifyCustomCodeToken;
 /**
- * The dispatch-namespace script name for an artifact: `artifact_<id>`.
+ * The legacy dispatch-namespace script name for an artifact: `artifact_<id>`.
  *
  * The id, never the slug — slugs are user-editable and a rename would orphan the
  * deployed script while the database still pointed at a live version.
+ *
+ * Nothing uploads to this name any more; every deploy mints its own. It survives
+ * as the fallback for a version published before `script_name` existed, whose
+ * bundle really is sitting under this name. Tightening a rule must never stop an
+ * already-published version from serving, because that failure is invisible to
+ * whoever owns it — the same reason the boot loop still accepts a stored tool key
+ * the current catalog no longer offers.
  */
 const customCodeScriptName = (artifactId) => `${constants_1.constants.CUSTOM_CODE_SCRIPT_NAME_PREFIX}${artifactId}`;
 exports.customCodeScriptName = customCodeScriptName;
 /**
- * The script name a test run deploys into: `artifact_<id>_preview`.
+ * The legacy preview script name: `artifact_<id>_preview`.
  *
- * A second script rather than a second version of the live one, because a test
- * must not be able to disturb what MCP clients are being served — and the only
- * way to be certain of that is for it to run under a name nothing dispatches to.
+ * Kept for the same reason as the one above, and for one more: it is the prefix
+ * the sweep matches to recognise a preview script left behind by a test run that
+ * did not clean up after itself.
  */
 const customCodePreviewScriptName = (artifactId) => `${(0, exports.customCodeScriptName)(artifactId)}${constants_1.constants.CUSTOM_CODE_PREVIEW_SCRIPT_SUFFIX}`;
 exports.customCodePreviewScriptName = customCodePreviewScriptName;
+/**
+ * A dispatch-namespace name no upload has ever used:
+ * `artifact_<id>_<12 hex chars>`.
+ *
+ * Minted rather than derived, and that is the entire design. Uploading over an
+ * existing name is not read-your-writes — a replacement can serve the previous
+ * edition for tens of seconds — so a deploy that always writes to a new name is
+ * correct by construction rather than by waiting to see whether it worked.
+ *
+ * The suffix deliberately carries no meaning. The two candidates that did are
+ * both wrong: the bundle digest collides whenever a deploy reverts to bytes that
+ * shipped before, which is exactly what a rollback is, and the version id is one
+ * string across every re-upload of a single draft, which is every test run of it.
+ *
+ * Twelve hex characters is what fits. Worker names cap at 63 and
+ * `artifact_<uuid>` spends 45 of them.
+ */
+const customCodeUploadName = (artifactId) => mintUploadName((0, exports.customCodeScriptName)(artifactId));
+exports.customCodeUploadName = customCodeUploadName;
+/**
+ * A preview name no test run has ever used:
+ * `artifact_<id>_preview_<12 hex chars>`.
+ *
+ * The sharper version of the same race. Every test used to deploy over one
+ * preview name, so a test could report the run before it — which reads as "my
+ * edit did nothing" from the one tool whose whole job is to say what an edit
+ * does. Nothing stores this: it is minted, used, and deleted inside one request.
+ */
+const customCodePreviewUploadName = (artifactId) => mintUploadName((0, exports.customCodePreviewScriptName)(artifactId));
+exports.customCodePreviewUploadName = customCodePreviewUploadName;
+/**
+ * Append `_<hex>` to a base name, spending whatever the 63-character ceiling
+ * leaves and no more.
+ *
+ * The budget is genuinely tight, and the two names spend it differently:
+ *
+ * | name | base | separator | suffix | total |
+ * |---|---|---|---|---|
+ * | live | `artifact_<uuid>` = 45 | 1 | 12 | 58 |
+ * | preview | + `_preview` = 53 | 1 | 8 | 62 |
+ *
+ * Twelve hex characters is 48 bits and eight is 32, against a namespace holding
+ * a few hundred names for any one artifact — and a preview name lives for the
+ * seconds one test run takes. Neither is a collision worth checking for, and an
+ * upload to a name already in use fails loudly rather than quietly serving the
+ * wrong code, which is the failure that matters.
+ *
+ * The ceiling is asserted rather than assumed: it is one number away from being
+ * silently exceeded by a longer prefix, and a name Cloudflare refuses would
+ * surface as a failed publish with nothing explaining why.
+ */
+const mintUploadName = (base) => {
+    const available = constants_1.constants.CUSTOM_CODE_SCRIPT_NAME_MAX - base.length - 1;
+    // Even, because each byte renders as two hex characters.
+    const chars = Math.min(constants_1.constants.CUSTOM_CODE_UPLOAD_SUFFIX_CHARS, available) & ~1;
+    if (chars < 4) {
+        throw new Error(`A dispatch script name based on "${base}" leaves no room for a unique suffix.`);
+    }
+    const bytes = new Uint8Array(chars / 2);
+    crypto.getRandomValues(bytes);
+    return `${base}_${Array.from(bytes)
+        .map(byte => byte.toString(16).padStart(2, '0'))
+        .join('')}`;
+};

package/dist/index.d.ts

@@ -2206,6 +2206,10 @@ export declare const utils: {
         CUSTOM_CODE_MAX_FILE_PATH: number;
         CUSTOM_CODE_VERSION_STATUSES: ("draft" | "published" | "archived")[];
         CUSTOM_CODE_SCRIPT_NAME_PREFIX: string;
+        CUSTOM_CODE_SCRIPT_NAME_MAX: number;
+        CUSTOM_CODE_UPLOAD_SUFFIX_CHARS: number;
+        CUSTOM_CODE_SWEEP_GRACE_MS: number;
+        CUSTOM_CODE_SWEEP_MAX_DELETES: number;
         CUSTOM_CODE_PREVIEW_SCRIPT_SUFFIX: string;
         CUSTOM_CODE_PREVIEW_TOKEN_TTL_MS: number;
         CUSTOM_CODE_TEST_TIMEOUT_MS: number;
@@ -2226,6 +2230,7 @@ export declare const utils: {
         OUTPUT_SCHEMA_NOT_OBJECT_MESSAGE: string;
         CUSTOM_CODE_BINDING_TOKEN: string;
         CUSTOM_CODE_BINDING_BROKER: string;
+        CUSTOM_CODE_BINDING_VERSION: string;
         CUSTOM_CODE_BROKER_ORIGIN: string;
         CUSTOM_CODE_BROKER_PATH_CONNECTION: string;
         CUSTOM_CODE_BROKER_PATH_SECRET: string;
@@ -2246,6 +2251,8 @@ export declare const utils: {
         CUSTOM_CODE_BROKER_SERVICE_ENV: string;
         CUSTOM_CODE_COMPATIBILITY_DATE: string;
         CUSTOM_CODE_SCRIPT_CPU_MS: number;
+        CUSTOM_CODE_REGISTER_TIMEOUT_MS: number;
+        CUSTOM_CODE_REGISTER_INTERVAL_MS: number;
         CUSTOM_CODE_MAX_LOGS: number;
         CUSTOM_CODE_MAX_LOG_LENGTH: number;
         CUSTOM_CODE_SEND_FILE_TARGET_GMAIL: "gmail";
@@ -2292,6 +2299,7 @@ export declare const utils: {
         OAUTH_SCOPES_SUPPORTED: string[];
         MCP_SCOPE_READ: string;
         ARTIFACT_SCOPE_PREFIX: string;
+        CONTROL_PLANE_SCOPE: string;
         CLI_OAUTH_CLIENT_NAME: string;
         CLI_OAUTH_REDIRECT_PATH: string;
         CLI_OAUTH_REDIRECT_PORTS: number[];
@@ -2349,6 +2357,8 @@ export declare const utils: {
     verifyCustomCodeToken: (token: string, secret: string, now?: number) => Promise<CustomCodeTokenPayload | null>;
     customCodeScriptName: (artifactId: string) => string;
     customCodePreviewScriptName: (artifactId: string) => string;
+    customCodeUploadName: (artifactId: string) => string;
+    customCodePreviewUploadName: (artifactId: string) => string;
     oauthProviders: Record<string, OAuthProviderConfig>;
     resolveAttachment: (resource: AttachmentResource, readObject: (key: string) => Promise<ArrayBuffer | null>, verb?: "attach" | "upload") => Promise<ResolveAttachmentResult>;
     isExposedResource: (resource: ExposableResource) => boolean;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,sBAAsB,EACtB,kBAAkB,EAClB,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACzB,MAAM,UAAU,CAAC;AAElB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAyCvD,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,mBAAmB,EACnB,oBAAoB,EACpB,iCAAiC,EAClC,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,8BAA8B,EAC/B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,gCAAgC,EACjC,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EACV,mBAAmB,EACnB,oBAAoB,EACpB,iCAAiC,EAClC,MAAM,gBAAgB,CAAC;AAKxB,OAAO,EACL,UAAU,EAGX,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAQ9D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAEhE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAG5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAW3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,KAAK,EACV,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,cAAc,CAAC;AAgBtB,OAAO,KAAK,EACV,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,YAAY,EACZ,OAAO,EACR,MAAM,eAAe,CAAC;AAiBvB,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAI1E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAErD,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EACV,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACxB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAM1E,OAAO,KAAK,EACV,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAS3B,OAAO,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EAEL,wBAAwB,EAIzB,MAAM,SAAS,CAAC;AACjB,OAAO,KAAK,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAoB,MAAM,kBAAkB,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aAlGhB,CAAC;;;;;;;;;;;;;;;;;;;;;;;kBAjHkB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBA0DF,CAAC;oBAEd,CAAC;;;;aA0BkB,CAAC;mBAA8B,CAAC;WACvC,CAAC;gBACf,CAAC;gBAA4B,CAAA;;;mBAmBK,CAAC;oBACtC,CAAC;;;;;;;;;;;;;;;kBA1DmB,CAAC;;;;;;;sBAqCR,CAAC;;;;;;;;;CAuOf,CAAC;AAEF,YAAY,EACV,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,YAAY,EACZ,OAAO,EACP,mBAAmB,EACnB,UAAU,EACV,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,8BAA8B,EAC9B,mBAAmB,EACnB,oBAAoB,EACpB,iCAAiC,EACjC,kBAAkB,EAClB,mBAAmB,EACnB,gCAAgC,EAChC,mBAAmB,EACnB,oBAAoB,EACpB,iCAAiC,EACjC,SAAS,EACT,SAAS,EACT,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACvB,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EACzB,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,MAAM,EACN,kBAAkB,EAClB,YAAY,EACZ,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACX,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,sBAAsB,EACtB,kBAAkB,EAClB,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACzB,MAAM,UAAU,CAAC;AAElB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAyCvD,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,mBAAmB,EACnB,oBAAoB,EACpB,iCAAiC,EAClC,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,8BAA8B,EAC/B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,gCAAgC,EACjC,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EACV,mBAAmB,EACnB,oBAAoB,EACpB,iCAAiC,EAClC,MAAM,gBAAgB,CAAC;AAKxB,OAAO,EACL,UAAU,EAGX,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAU9D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAEhE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAG5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAW3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,KAAK,EACV,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,cAAc,CAAC;AAgBtB,OAAO,KAAK,EACV,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,YAAY,EACZ,OAAO,EACR,MAAM,eAAe,CAAC;AAiBvB,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAI1E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAErD,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EACV,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACxB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAM1E,OAAO,KAAK,EACV,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAS3B,OAAO,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EAEL,wBAAwB,EAIzB,MAAM,SAAS,CAAC;AACjB,OAAO,KAAK,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAoB,MAAM,kBAAkB,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aArGf,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;kBAhHiB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBA0DF,CAAC;oBAEd,CAAC;;;;aA0BkB,CAAC;mBAA8B,CAAC;WACvC,CAAC;gBACf,CAAC;gBAA4B,CAAA;;;mBAoBK,CAAC;oBACjC,CAAC;;;;;;;;;;;;;;;kBA3Dc,CAAC;;;;;;;sBAqCR,CAAC;;;;;;;;;CA2Of,CAAC;AAEF,YAAY,EACV,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,YAAY,EACZ,OAAO,EACP,mBAAmB,EACnB,UAAU,EACV,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,8BAA8B,EAC9B,mBAAmB,EACnB,oBAAoB,EACpB,iCAAiC,EACjC,kBAAkB,EAClB,mBAAmB,EACnB,gCAAgC,EAChC,mBAAmB,EACnB,oBAAoB,EACpB,iCAAiC,EACjC,SAAS,EACT,SAAS,EACT,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACvB,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EACzB,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,MAAM,EACN,kBAAkB,EAClB,YAAY,EACZ,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACX,CAAC"}

package/dist/index.js

@@ -89,6 +89,8 @@ exports.utils = {
     verifyCustomCodeToken: customCodeToken_1.verifyCustomCodeToken,
     customCodeScriptName: customCodeToken_1.customCodeScriptName,
     customCodePreviewScriptName: customCodeToken_1.customCodePreviewScriptName,
+    customCodeUploadName: customCodeToken_1.customCodeUploadName,
+    customCodePreviewUploadName: customCodeToken_1.customCodePreviewUploadName,
     oauthProviders: oauthProviders_1.oauthProviders,
     resolveAttachment: attachment_1.resolveAttachment,
     isExposedResource: exposedResource_1.isExposedResource,

package/dist/sdkConstants.d.ts

@@ -9,6 +9,7 @@ export declare const CUSTOM_CODE_BROKER_PATH_RESOURCES_LIST = "/resources/list";
 export declare const CUSTOM_CODE_BROKER_PATH_RESOURCES_CREATE = "/resources/create";
 export declare const CUSTOM_CODE_BROKER_PATH_RESOURCES_DELETE = "/resources/delete";
 export declare const CUSTOM_CODE_BROKER_PATH_SEND_FILE = "/send-file";
+export declare const CUSTOM_CODE_BINDING_VERSION = "GANJU_SCRIPT_VERSION";
 export declare const CUSTOM_CODE_HEALTH_TOOL = "__ganju_health";
 export declare const CUSTOM_CODE_MAX_LOGS = 50;
 export declare const CUSTOM_CODE_MAX_LOG_LENGTH = 2000;

package/dist/sdkConstants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sdkConstants.d.ts","sourceRoot":"","sources":["../src/sdkConstants.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,yBAAyB,qBAAqB,CAAC;AAC5D,eAAO,MAAM,0BAA0B,iBAAiB,CAAC;AAKzD,eAAO,MAAM,yBAAyB,kCAAkC,CAAC;AACzE,eAAO,MAAM,kCAAkC,gBAAgB,CAAC;AAChE,eAAO,MAAM,8BAA8B,YAAY,CAAC;AACxD,eAAO,MAAM,wCAAwC,sBAAsB,CAAC;AAC5E,eAAO,MAAM,sCAAsC,oBAAoB,CAAC;AACxE,eAAO,MAAM,sCAAsC,oBAAoB,CAAC;AACxE,eAAO,MAAM,wCAAwC,sBAAsB,CAAC;AAC5E,eAAO,MAAM,wCAAwC,sBAAsB,CAAC;AAC5E,eAAO,MAAM,iCAAiC,eAAe,CAAC;AAO9D,eAAO,MAAM,uBAAuB,mBAAmB,CAAC;AAKxD,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC,eAAO,MAAM,0BAA0B,OAAQ,CAAC"}
+{"version":3,"file":"sdkConstants.d.ts","sourceRoot":"","sources":["../src/sdkConstants.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,yBAAyB,qBAAqB,CAAC;AAC5D,eAAO,MAAM,0BAA0B,iBAAiB,CAAC;AAKzD,eAAO,MAAM,yBAAyB,kCAAkC,CAAC;AACzE,eAAO,MAAM,kCAAkC,gBAAgB,CAAC;AAChE,eAAO,MAAM,8BAA8B,YAAY,CAAC;AACxD,eAAO,MAAM,wCAAwC,sBAAsB,CAAC;AAC5E,eAAO,MAAM,sCAAsC,oBAAoB,CAAC;AACxE,eAAO,MAAM,sCAAsC,oBAAoB,CAAC;AACxE,eAAO,MAAM,wCAAwC,sBAAsB,CAAC;AAC5E,eAAO,MAAM,wCAAwC,sBAAsB,CAAC;AAC5E,eAAO,MAAM,iCAAiC,eAAe,CAAC;AAY9D,eAAO,MAAM,2BAA2B,yBAAyB,CAAC;AAOlE,eAAO,MAAM,uBAAuB,mBAAmB,CAAC;AAKxD,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC,eAAO,MAAM,0BAA0B,OAAQ,CAAC"}

package/dist/sdkConstants.js

@@ -11,7 +11,7 @@
 // The rule for this file: nothing lands here unless the SDK reads it at runtime,
 // and it imports nothing.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CUSTOM_CODE_MAX_LOG_LENGTH = exports.CUSTOM_CODE_MAX_LOGS = exports.CUSTOM_CODE_HEALTH_TOOL = exports.CUSTOM_CODE_BROKER_PATH_SEND_FILE = exports.CUSTOM_CODE_BROKER_PATH_RESOURCES_DELETE = exports.CUSTOM_CODE_BROKER_PATH_RESOURCES_CREATE = exports.CUSTOM_CODE_BROKER_PATH_RESOURCES_LIST = exports.CUSTOM_CODE_BROKER_PATH_RESOURCES_READ = exports.CUSTOM_CODE_BROKER_PATH_RESOURCES_SEARCH = exports.CUSTOM_CODE_BROKER_PATH_SECRET = exports.CUSTOM_CODE_BROKER_PATH_CONNECTION = exports.CUSTOM_CODE_BROKER_ORIGIN = exports.CUSTOM_CODE_BINDING_BROKER = exports.CUSTOM_CODE_BINDING_TOKEN = void 0;
+exports.CUSTOM_CODE_MAX_LOG_LENGTH = exports.CUSTOM_CODE_MAX_LOGS = exports.CUSTOM_CODE_HEALTH_TOOL = exports.CUSTOM_CODE_BINDING_VERSION = exports.CUSTOM_CODE_BROKER_PATH_SEND_FILE = exports.CUSTOM_CODE_BROKER_PATH_RESOURCES_DELETE = exports.CUSTOM_CODE_BROKER_PATH_RESOURCES_CREATE = exports.CUSTOM_CODE_BROKER_PATH_RESOURCES_LIST = exports.CUSTOM_CODE_BROKER_PATH_RESOURCES_READ = exports.CUSTOM_CODE_BROKER_PATH_RESOURCES_SEARCH = exports.CUSTOM_CODE_BROKER_PATH_SECRET = exports.CUSTOM_CODE_BROKER_PATH_CONNECTION = exports.CUSTOM_CODE_BROKER_ORIGIN = exports.CUSTOM_CODE_BINDING_BROKER = exports.CUSTOM_CODE_BINDING_TOKEN = void 0;
 // Bindings injected into every user script at upload time. The token is a
 // secret_text binding rotated on each publish; the broker is a service binding.
 // Names are part of the SDK's contract with the script, so they can't be
@@ -30,6 +30,17 @@ exports.CUSTOM_CODE_BROKER_PATH_RESOURCES_LIST = '/resources/list';
 exports.CUSTOM_CODE_BROKER_PATH_RESOURCES_CREATE = '/resources/create';
 exports.CUSTOM_CODE_BROKER_PATH_RESOURCES_DELETE = '/resources/delete';
 exports.CUSTOM_CODE_BROKER_PATH_SEND_FILE = '/send-file';
+// Injected at upload time and echoed back by the health probe below. Uploading a
+// script into the dispatch namespace is not read-your-writes: dispatching to the
+// name immediately afterwards can still reach the previous edition. Tool names
+// alone cannot tell the two apart when a deploy does not rename anything, so the
+// script carries the digest of the bytes it was uploaded from and the publish
+// pipeline waits until the edition answering is the one it just wrote.
+//
+// The bytes rather than the version id: a draft is re-uploaded in place, so its
+// id is the same string across every edit and could never separate this upload
+// from the one before it.
+exports.CUSTOM_CODE_BINDING_VERSION = 'GANJU_SCRIPT_VERSION';
 // The reserved tool name the publish pipeline calls against a freshly uploaded
 // script to ask which tools it actually exports — which is what turns "the
 // manifest declares lookup-order but the code exports lookupOrder" from a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ganju/utils",
-  "version": "0.0.2",
+  "version": "0.0.4",
   "description": "Shared constants, schemas and helpers for Ganju",
   "license": "Apache-2.0",
   "author": "MontoyaAndres <andresmontoyafcb@gmail.com>",

package/src/cliConstants.ts

@@ -23,13 +23,27 @@ export const CLI_OAUTH_CLIENT_NAME = 'Ganju CLI';
 export const CLI_OAUTH_REDIRECT_PATH = '/callback';
 export const CLI_OAUTH_REDIRECT_PORTS = [8976, 8977, 8978, 8979, 8980];
 
+// What the API requires before a bearer token may act on the control plane —
+// publish code, read and rotate secrets, change billing. Lives here because the
+// CLI is the client that asks for it; the API's own copy is the re-export in
+// `constants.ts`, so the string the CLI requests and the string the middleware
+// demands cannot drift apart.
+export const CONTROL_PLANE_SCOPE = 'ganju:manage';
+
 // `offline_access` is what mints the refresh token; without it a CLI session
 // would end an hour after login.
+//
+// An MCP client reads the discovery document to decide what to ask for, and
+// that document does not list `ganju:manage` — so a token minted for someone's
+// MCP server can reach that server and nothing else, while this one can deploy.
+// The consent screen names the scope, which is the point: deploying code as
+// someone is worth showing them.
 export const CLI_OAUTH_SCOPES = [
   'openid',
   'profile',
   'email',
-  'offline_access'
+  'offline_access',
+  CONTROL_PLANE_SCOPE
 ];
 
 // Refresh this far before the access token actually expires, so a long command

package/src/constants.ts

@@ -3,6 +3,7 @@ import {
   CLI_OAUTH_REDIRECT_PATH,
   CLI_OAUTH_REDIRECT_PORTS,
   CLI_OAUTH_SCOPES,
+  CONTROL_PLANE_SCOPE,
   CLI_TOKEN_REFRESH_SKEW_SECONDS,
   CUSTOM_CODE_SDK_SPECIFIER,
   CUSTOM_CODE_MAX_BUNDLE_BYTES,
@@ -11,6 +12,7 @@ import {
 import {
   CUSTOM_CODE_BINDING_TOKEN,
   CUSTOM_CODE_BINDING_BROKER,
+  CUSTOM_CODE_BINDING_VERSION,
   CUSTOM_CODE_BROKER_ORIGIN,
   CUSTOM_CODE_BROKER_PATH_CONNECTION,
   CUSTOM_CODE_BROKER_PATH_SECRET,
@@ -1237,10 +1239,40 @@ const CUSTOM_CODE_MAIN_MODULE = 'index.js';
 const CUSTOM_CODE_MAX_FILES = 25;
 const CUSTOM_CODE_MAX_FILE_PATH = 100;
 
-// WfP script name: `artifact_<artifactId>`. The id, never the slug — slugs are
-// user-editable and a rename would orphan the deployed script.
+// WfP script name: `artifact_<artifactId>_<upload>`. The id, never the slug —
+// slugs are user-editable and a rename would orphan the deployed script.
+//
+// The trailing segment is minted per upload rather than derived from anything,
+// which is the whole point: uploading over a name that already exists is not
+// read-your-writes, so a deploy that replaces a script can serve the previous
+// edition for up to half a minute. A name nothing has ever used cannot, and
+// costs nothing to mint. Everything a publish used to do to survive that race —
+// waiting on an edition marker, refusing with a 503, putting the previous bundle
+// back when validation failed — went with the reuse that caused it.
 const CUSTOM_CODE_SCRIPT_NAME_PREFIX = 'artifact_';
 
+// Worker names cap at 63 characters, and `artifact_<uuid>` already spends 45.
+// That leaves 17 for a separator and a suffix, so a second uuid does not fit and
+// neither does a hex-32 digest. Twelve hex characters is 48 bits against a
+// namespace holding at most a few hundred names for any one artifact — not a
+// collision worth checking for, and an upload to a name in use would fail loudly
+// rather than quietly serve the wrong code.
+const CUSTOM_CODE_SCRIPT_NAME_MAX = 63;
+const CUSTOM_CODE_UPLOAD_SUFFIX_CHARS = 12;
+
+// How long a superseded script stays in the namespace before the hourly sweep
+// may collect it.
+//
+// Deleting at publish time would race the thing it deletes: a tool call that
+// resolved the old pointer a moment earlier is still in flight, and the pointer
+// moving does not recall it. An hour is far longer than any call can take, and
+// the wait costs $0.02 per script per month against an allowance of 1,000.
+const CUSTOM_CODE_SWEEP_GRACE_MS = 60 * 60 * 1_000;
+
+// Deletes per sweep. A backlog drains over several hourly runs rather than
+// making one run unbounded — the same shape the retention purge uses.
+const CUSTOM_CODE_SWEEP_MAX_DELETES = 200;
+
 // A second script per artifact, `artifact_<id>_preview`, that the Test panel
 // deploys a draft into and calls.
 //
@@ -1451,6 +1483,18 @@ const CUSTOM_CODE_COMPATIBILITY_DATE = '2025-11-17';
 // tighter than our own workers' 30s — this is the technical cap that bounds
 // what one adversarial call can cost us, so an infinite loop in a customer's
 // tool is billed as five seconds rather than as whatever it wanted.
+// How long a deploy waits for a freshly minted script name to become
+// dispatchable, and how often it asks.
+//
+// Every upload goes to a name that has never been used, which is
+// read-your-writes: ~2s end to end against the deployed namespace, against the
+// 20-41s a replacement could take. So this bounds how long a brand-new name
+// takes to register, never how long an old edition takes to stop answering —
+// there is no old edition. It is short for that reason, and a script that
+// answers with the wrong edition now fails outright instead of being waited on.
+const CUSTOM_CODE_REGISTER_TIMEOUT_MS = 8_000;
+const CUSTOM_CODE_REGISTER_INTERVAL_MS = 500;
+
 const CUSTOM_CODE_SCRIPT_CPU_MS = 5_000;
 
 // The ctx.log() caps also live in ./sdkConstants — the buffer that enforces them
@@ -1623,6 +1667,21 @@ const OAUTH_SCOPES_SUPPORTED = ['openid', 'profile', 'email', 'offline_access'];
 const MCP_SCOPE_READ = 'mcp:read';
 const ARTIFACT_SCOPE_PREFIX = 'artifact:';
 
+// `CONTROL_PLANE_SCOPE` (defined in ./cliConstants, re-exported below) is what
+// a bearer token needs before it may act as the user on the control plane —
+// publish code, read and rotate secrets, change billing.
+//
+// Access tokens are minted for MCP clients too: a customer who connects Claude
+// Desktop to one of their MCP servers hands it a token for their own account,
+// and `/oauth2/userinfo` will happily confirm that it is theirs. Without a scope
+// that separates the two, "this token belongs to the user" would be the same
+// sentence as "this token may deploy code as the user", and connecting an MCP
+// client would silently be an act of full delegation.
+//
+// Deliberately outside OAUTH_SCOPES_SUPPORTED: it is allowlisted on the provider
+// so the CLI can request it, and left out of discovery, which is what an MCP
+// client reads to decide what to ask for.
+
 // The CLI signs in as a public OAuth client through a loopback redirect
 // (RFC 8252) — the flow `wrangler`, `gh` and `vercel` all use. It registers
 // itself through RFC 7591 dynamic registration on first login rather than
@@ -2438,6 +2497,10 @@ export const constants = {
   CUSTOM_CODE_MAX_FILE_PATH,
   CUSTOM_CODE_VERSION_STATUSES,
   CUSTOM_CODE_SCRIPT_NAME_PREFIX,
+  CUSTOM_CODE_SCRIPT_NAME_MAX,
+  CUSTOM_CODE_UPLOAD_SUFFIX_CHARS,
+  CUSTOM_CODE_SWEEP_GRACE_MS,
+  CUSTOM_CODE_SWEEP_MAX_DELETES,
   CUSTOM_CODE_PREVIEW_SCRIPT_SUFFIX,
   CUSTOM_CODE_PREVIEW_TOKEN_TTL_MS,
   CUSTOM_CODE_TEST_TIMEOUT_MS,
@@ -2458,6 +2521,7 @@ export const constants = {
   OUTPUT_SCHEMA_NOT_OBJECT_MESSAGE,
   CUSTOM_CODE_BINDING_TOKEN,
   CUSTOM_CODE_BINDING_BROKER,
+  CUSTOM_CODE_BINDING_VERSION,
   CUSTOM_CODE_BROKER_ORIGIN,
   CUSTOM_CODE_BROKER_PATH_CONNECTION,
   CUSTOM_CODE_BROKER_PATH_SECRET,
@@ -2478,6 +2542,8 @@ export const constants = {
   CUSTOM_CODE_BROKER_SERVICE_ENV,
   CUSTOM_CODE_COMPATIBILITY_DATE,
   CUSTOM_CODE_SCRIPT_CPU_MS,
+  CUSTOM_CODE_REGISTER_TIMEOUT_MS,
+  CUSTOM_CODE_REGISTER_INTERVAL_MS,
   CUSTOM_CODE_MAX_LOGS,
   CUSTOM_CODE_MAX_LOG_LENGTH,
   CUSTOM_CODE_SEND_FILE_TARGET_GMAIL,
@@ -2524,6 +2590,7 @@ export const constants = {
   OAUTH_SCOPES_SUPPORTED,
   MCP_SCOPE_READ,
   ARTIFACT_SCOPE_PREFIX,
+  CONTROL_PLANE_SCOPE,
   CLI_OAUTH_CLIENT_NAME,
   CLI_OAUTH_REDIRECT_PATH,
   CLI_OAUTH_REDIRECT_PORTS,

package/src/customCodeToken.ts

@@ -179,20 +179,100 @@ export const verifyCustomCodeToken = async (
 };
 
 /**
- * The dispatch-namespace script name for an artifact: `artifact_<id>`.
+ * The legacy dispatch-namespace script name for an artifact: `artifact_<id>`.
  *
  * The id, never the slug — slugs are user-editable and a rename would orphan the
  * deployed script while the database still pointed at a live version.
+ *
+ * Nothing uploads to this name any more; every deploy mints its own. It survives
+ * as the fallback for a version published before `script_name` existed, whose
+ * bundle really is sitting under this name. Tightening a rule must never stop an
+ * already-published version from serving, because that failure is invisible to
+ * whoever owns it — the same reason the boot loop still accepts a stored tool key
+ * the current catalog no longer offers.
  */
 export const customCodeScriptName = (artifactId: string): string =>
   `${constants.CUSTOM_CODE_SCRIPT_NAME_PREFIX}${artifactId}`;
 
 /**
- * The script name a test run deploys into: `artifact_<id>_preview`.
+ * The legacy preview script name: `artifact_<id>_preview`.
  *
- * A second script rather than a second version of the live one, because a test
- * must not be able to disturb what MCP clients are being served — and the only
- * way to be certain of that is for it to run under a name nothing dispatches to.
+ * Kept for the same reason as the one above, and for one more: it is the prefix
+ * the sweep matches to recognise a preview script left behind by a test run that
+ * did not clean up after itself.
  */
 export const customCodePreviewScriptName = (artifactId: string): string =>
   `${customCodeScriptName(artifactId)}${constants.CUSTOM_CODE_PREVIEW_SCRIPT_SUFFIX}`;
+
+/**
+ * A dispatch-namespace name no upload has ever used:
+ * `artifact_<id>_<12 hex chars>`.
+ *
+ * Minted rather than derived, and that is the entire design. Uploading over an
+ * existing name is not read-your-writes — a replacement can serve the previous
+ * edition for tens of seconds — so a deploy that always writes to a new name is
+ * correct by construction rather than by waiting to see whether it worked.
+ *
+ * The suffix deliberately carries no meaning. The two candidates that did are
+ * both wrong: the bundle digest collides whenever a deploy reverts to bytes that
+ * shipped before, which is exactly what a rollback is, and the version id is one
+ * string across every re-upload of a single draft, which is every test run of it.
+ *
+ * Twelve hex characters is what fits. Worker names cap at 63 and
+ * `artifact_<uuid>` spends 45 of them.
+ */
+export const customCodeUploadName = (artifactId: string): string =>
+  mintUploadName(customCodeScriptName(artifactId));
+
+/**
+ * A preview name no test run has ever used:
+ * `artifact_<id>_preview_<12 hex chars>`.
+ *
+ * The sharper version of the same race. Every test used to deploy over one
+ * preview name, so a test could report the run before it — which reads as "my
+ * edit did nothing" from the one tool whose whole job is to say what an edit
+ * does. Nothing stores this: it is minted, used, and deleted inside one request.
+ */
+export const customCodePreviewUploadName = (artifactId: string): string =>
+  mintUploadName(customCodePreviewScriptName(artifactId));
+
+/**
+ * Append `_<hex>` to a base name, spending whatever the 63-character ceiling
+ * leaves and no more.
+ *
+ * The budget is genuinely tight, and the two names spend it differently:
+ *
+ * | name | base | separator | suffix | total |
+ * |---|---|---|---|---|
+ * | live | `artifact_<uuid>` = 45 | 1 | 12 | 58 |
+ * | preview | + `_preview` = 53 | 1 | 8 | 62 |
+ *
+ * Twelve hex characters is 48 bits and eight is 32, against a namespace holding
+ * a few hundred names for any one artifact — and a preview name lives for the
+ * seconds one test run takes. Neither is a collision worth checking for, and an
+ * upload to a name already in use fails loudly rather than quietly serving the
+ * wrong code, which is the failure that matters.
+ *
+ * The ceiling is asserted rather than assumed: it is one number away from being
+ * silently exceeded by a longer prefix, and a name Cloudflare refuses would
+ * surface as a failed publish with nothing explaining why.
+ */
+const mintUploadName = (base: string): string => {
+  const available = constants.CUSTOM_CODE_SCRIPT_NAME_MAX - base.length - 1;
+  // Even, because each byte renders as two hex characters.
+  const chars =
+    Math.min(constants.CUSTOM_CODE_UPLOAD_SUFFIX_CHARS, available) & ~1;
+
+  if (chars < 4) {
+    throw new Error(
+      `A dispatch script name based on "${base}" leaves no room for a unique suffix.`
+    );
+  }
+
+  const bytes = new Uint8Array(chars / 2);
+  crypto.getRandomValues(bytes);
+
+  return `${base}_${Array.from(bytes)
+    .map(byte => byte.toString(16).padStart(2, '0'))
+    .join('')}`;
+};

package/src/index.ts

@@ -102,7 +102,9 @@ import {
   mintCustomCodeToken,
   verifyCustomCodeToken,
   customCodeScriptName,
-  customCodePreviewScriptName
+  customCodePreviewScriptName,
+  customCodeUploadName,
+  customCodePreviewUploadName
 } from './customCodeToken';
 import type { CustomCodeTokenPayload } from './customCodeToken';
 import { oauthProviders } from './oauthProviders';
@@ -257,6 +259,8 @@ export const utils = {
   verifyCustomCodeToken,
   customCodeScriptName,
   customCodePreviewScriptName,
+  customCodeUploadName,
+  customCodePreviewUploadName,
   oauthProviders,
   resolveAttachment,
   isExposedResource,

package/src/sdkConstants.ts

@@ -30,6 +30,18 @@ export const CUSTOM_CODE_BROKER_PATH_RESOURCES_CREATE = '/resources/create';
 export const CUSTOM_CODE_BROKER_PATH_RESOURCES_DELETE = '/resources/delete';
 export const CUSTOM_CODE_BROKER_PATH_SEND_FILE = '/send-file';
 
+// Injected at upload time and echoed back by the health probe below. Uploading a
+// script into the dispatch namespace is not read-your-writes: dispatching to the
+// name immediately afterwards can still reach the previous edition. Tool names
+// alone cannot tell the two apart when a deploy does not rename anything, so the
+// script carries the digest of the bytes it was uploaded from and the publish
+// pipeline waits until the edition answering is the one it just wrote.
+//
+// The bytes rather than the version id: a draft is re-uploaded in place, so its
+// id is the same string across every edit and could never separate this upload
+// from the one before it.
+export const CUSTOM_CODE_BINDING_VERSION = 'GANJU_SCRIPT_VERSION';
+
 // The reserved tool name the publish pipeline calls against a freshly uploaded
 // script to ask which tools it actually exports — which is what turns "the
 // manifest declares lookup-order but the code exports lookupOrder" from a