@knpkv/alchemy-console 0.4.1 → 0.5.0

package/dist/server/PlanReader.d.ts

@@ -0,0 +1,19 @@
+/** Reads trusted CI publications as data. Never imports a stack, runs Alchemy or touches provider state. */
+import { Config, Context, Crypto, Effect, Layer, Schema } from "effect";
+import type { PlanState } from "../plan.js";
+import { PlanGithub } from "./plan/github.js";
+declare const PlanProvenanceInvalid_base: Schema.Class<PlanProvenanceInvalid, Schema.TaggedStruct<"PlanProvenanceInvalid", {}>, import("effect/Cause").YieldableError>;
+export declare class PlanProvenanceInvalid extends PlanProvenanceInvalid_base {
+}
+declare const PlanReader_base: Context.ServiceClass<PlanReader, "@knpkv/alchemy-console/PlanReader", {
+    readonly read: (app: string, stage: string) => Effect.Effect<PlanState>;
+}>;
+export declare class PlanReader extends PlanReader_base {
+}
+/** One typed failure class per refusal, transport, metadata, provenance, archive, digest and receipt boundary. */
+export declare const readerLayer: Layer.Layer<PlanReader, never, Crypto.Crypto | PlanGithub>;
+export declare const disconnectedLayer: Layer.Layer<PlanReader, never, never>;
+/** Dedicated read-only Actions token is optional and server-held. No host gh token discovery or client credential configuration. */
+export declare const configuredPlanLayer: Layer.Layer<PlanReader, Config.ConfigError, Crypto.Crypto | import("effect/http/HttpClient").HttpClient>;
+export {};
+//# sourceMappingURL=PlanReader.d.ts.map

package/dist/server/PlanReader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PlanReader.d.ts","sourceRoot":"","sources":["../../src/server/PlanReader.ts"],"names":[],"mappings":"AAAA,4GAA4G;AAC5G,OAAO,EAAS,MAAM,EAAE,OAAO,EAAE,MAAM,EAAY,MAAM,EAAE,KAAK,EAAU,MAAM,EAAE,MAAM,QAAQ,CAAA;AAChG,OAAO,KAAK,EAAc,SAAS,EAAiB,MAAM,YAAY,CAAA;AAEtE,OAAO,EAML,UAAU,EAIX,MAAM,kBAAkB,CAAA;;AAUzB,qBAAa,qBAAsB,SAAQ,0BAAwE;CAAG;;mBAGrG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;;AADzE,qBAAa,UAAW,SAAQ,eAES;CAAG;AAmE5C,kHAAkH;AAClH,eAAO,MAAM,WAAW,4DA0KvB,CAAA;AAED,eAAO,MAAM,iBAAiB,uCAG7B,CAAA;AAED,oIAAoI;AACpI,eAAO,MAAM,mBAAmB,0GAG7B,CAAA"}

package/dist/server/PlanReader.js

@@ -0,0 +1,201 @@
+/** Reads trusted CI publications as data. Never imports a stack, runs Alchemy or touches provider state. */
+import { Clock, Config, Context, Crypto, DateTime, Effect, Layer, Option, Schema } from "effect";
+import { archiveLimit, archiveText } from "./plan/archive.js";
+import { githubLayer, PlanCiUnreachable, PlanGithub, PlanMetadataInvalid, publishedMillis } from "./plan/github.js";
+import { decodeReceipt, hashBytes, PlanDigestMismatch, stageFor } from "./plan/receipt.js";
+export class PlanProvenanceInvalid extends Schema.TaggedError()("PlanProvenanceInvalid", {}) {
+}
+export class PlanReader extends Context.Service()("@knpkv/alchemy-console/PlanReader") {
+}
+/** Explicit app/stage allowlist. Similar names and unrelated stages do not inherit a CI source. */
+const mappedStack = (app, stage) => app === "site" && stage === "prod" ? "site" : app === "aws-org" && stage === "org" ? "aws-org" : null;
+const repoId = 1288997422;
+const compareProducerRuns = (a, b) => DateTime.toEpochMillis(b.created_at) - DateTime.toEpochMillis(a.created_at) || b.id - a.id;
+const runHref = (id) => `https://github.com/knpkv/infra/actions/runs/${id}`;
+const sourceFor = (artifact, head, now, producer) => ({
+    pr: producer?.pull_requests.find((pr) => pr.head.sha === head)?.number ?? null,
+    head: head.slice(0, 7),
+    base: null,
+    publishedAt: DateTime.formatIso(artifact.created_at),
+    ageDays: Math.max(0, Math.floor(now / 86_400_000) - Math.floor(publishedMillis(artifact) / 86_400_000)),
+    runHref: runHref(artifact.workflow_run.id)
+});
+const QualifiedWorkflowPath = Schema.TemplateLiteralParser([
+    ".github/workflows/",
+    Schema.Literals(["infra.yml", "infra-publish.yml"]),
+    "@",
+    Schema.NonEmptyString.check(Schema.isPattern(/^[^@]+$/u))
+]);
+/** GitHub can qualify a workflow filename with a branch or PR merge ref; neither part is a prefix match. */
+const workflowPathMatches = (run, file) => {
+    if (run.path === `.github/workflows/${file}`)
+        return true;
+    const qualified = Option.getOrNull(Schema.decodeUnknownOption(QualifiedWorkflowPath)(run.path));
+    if (qualified === null || qualified[1] !== file)
+        return false;
+    const ref = qualified[3];
+    return ref === "main" || ref === "refs/heads/main" ||
+        (file === "infra.yml" && (ref === run.head_branch || ref === `refs/heads/${run.head_branch}` ||
+            run.pull_requests.some((pr) => ref === `refs/pull/${pr.number}/merge`)));
+};
+const privateRunMatches = (run, workflowId, file, event) => run.workflow_id === workflowId && workflowPathMatches(run, file) && run.event === event &&
+    run.repository.id === repoId && run.head_repository.id === repoId &&
+    run.actor.id === 833092 && run.triggering_actor.id === 833092;
+const project = (receipt, source, latestMainSeenByCi, now, artifact) => ({
+    source: { ...source, pr: receipt.pr, base: receipt.base.slice(0, 7) },
+    digest: `${receipt.native.digest.slice(0, 4)}…${receipt.native.digest.slice(-4)}`,
+    rows: receipt.native.semantic.rows.map((row) => ({
+        fqn: row.fqn,
+        resourceType: row.type,
+        action: row.action,
+        changedKeys: [...row.changedKeys]
+    })),
+    stale: latestMainSeenByCi !== null && receipt.base !== latestMainSeenByCi
+        ? "base"
+        : now - publishedMillis(artifact) > 86_400_000
+            ? "age"
+            : null
+});
+/** One typed failure class per refusal, transport, metadata, provenance, archive, digest and receipt boundary. */
+export const readerLayer = Layer.effect(PlanReader, Effect.gen(function* () {
+    const github = yield* PlanGithub;
+    const cryptoService = yield* Crypto.Crypto;
+    const read = Effect.fn("AlchemyConsole.readCiPlan")(function* (app, stage) {
+        const stack = mappedStack(app, stage);
+        if (stack === null)
+            return { _tag: "NotConnected" };
+        const now = yield* Clock.currentTimeMillis;
+        const publisherWorkflow = yield* github.workflow("infra-publish.yml");
+        const producerWorkflow = yield* github.workflow("infra.yml");
+        if (publisherWorkflow.path !== ".github/workflows/infra-publish.yml" ||
+            producerWorkflow.path !== ".github/workflows/infra.yml") {
+            return yield* new PlanProvenanceInvalid({});
+        }
+        const publishing = publisherWorkflow.state === "active" && producerWorkflow.state === "active";
+        if (!publishing)
+            return { _tag: "NotPublishing" };
+        const producerRuns = (yield* github.runs("infra.yml")).filter((run) => privateRunMatches(run, producerWorkflow.id, "infra.yml", "pull_request")).sort(compareProducerRuns);
+        const latest = producerRuns[0];
+        const jobs = latest === undefined ? [] : yield* github.jobs(latest.id);
+        const paused = jobs.length > 0 && jobs.every((job) => job.conclusion === "skipped");
+        if (paused)
+            return { _tag: "NotPublishing" };
+        // A successful matrix job can skip this stack. Only the actual native-plan step proves an attempt.
+        let attempt;
+        for (const [index, run] of producerRuns.entries()) {
+            const runJobs = index === 0 ? jobs : yield* github.jobs(run.id);
+            const nativeJobs = runJobs.filter((job) => job.name === `${stack} / native`);
+            if (nativeJobs.length > 1)
+                return yield* new PlanMetadataInvalid({});
+            const job = nativeJobs[0];
+            if (job === undefined)
+                continue;
+            if (job.run_attempt !== run.run_attempt)
+                return yield* new PlanProvenanceInvalid({});
+            const nativeSteps = job.steps.filter((step) => step.name === "Native read-only plan");
+            if (nativeSteps.length > 1)
+                return yield* new PlanMetadataInvalid({});
+            const step = nativeSteps[0];
+            if (step === undefined || step.started_at === undefined || step.started_at === null ||
+                step.status === "queued" || step.conclusion === "skipped")
+                continue;
+            if (step.status !== "completed" && step.status !== "in_progress")
+                return yield* new PlanMetadataInvalid({});
+            attempt = { run, job };
+            break;
+        }
+        const failed = attempt?.job.status === "completed" &&
+            ["failure", "cancelled", "timed_out", "action_required", "stale"].includes(attempt.job.conclusion ?? "")
+            ? attempt.run :
+            undefined;
+        const artifacts = (yield* github.artifacts(stack)).filter((artifact) => artifact.name.startsWith(`infra-plan-${stack}-`))
+            .sort((a, b) => publishedMillis(b) - publishedMillis(a) || b.id - a.id);
+        const selected = artifacts.find((artifact) => !artifact.expired && DateTime.toEpochMillis(artifact.expires_at) > now);
+        if (selected === undefined) {
+            if (failed !== undefined)
+                return { _tag: "Failed", runHref: runHref(failed.id), lastPublished: null };
+            const expired = artifacts[0];
+            if (expired === undefined)
+                return { _tag: "NotPublished" };
+            const match = expired.name.match(new RegExp(`^infra-plan-${stack}-([a-f0-9]{40})$`));
+            const head = match?.[1];
+            return {
+                _tag: "Expired",
+                source: head === undefined
+                    ? null
+                    : sourceFor(expired, head, now, producerRuns.find((run) => run.head_sha === head))
+            };
+        }
+        const artifact = selected;
+        const head = artifact.name.slice(`infra-plan-${stack}-`.length);
+        const producer = producerRuns.find((run) => run.head_sha === head);
+        const source = /^[a-f0-9]{40}$/.test(head) ? sourceFor(artifact, head, now, producer) : null;
+        const verified = Effect.gen(function* () {
+            if (source === null || artifact.digest === null || artifact.size_in_bytes >= archiveLimit ||
+                artifact.workflow_run.repository_id !== repoId || artifact.workflow_run.head_repository_id !== repoId ||
+                artifact.workflow_run.head_branch !== "main")
+                return yield* new PlanProvenanceInvalid({});
+            const publisher = yield* github.run(artifact.workflow_run.id);
+            if (!privateRunMatches(publisher, publisherWorkflow.id, "infra-publish.yml", "workflow_run") ||
+                publisher.head_branch !== "main" || publisher.status !== "completed" ||
+                publisher.conclusion !== "success" ||
+                publisher.head_sha !== artifact.workflow_run.head_sha)
+                return yield* new PlanProvenanceInvalid({});
+            const bytes = yield* github.download(artifact.id);
+            if (bytes.length !== artifact.size_in_bytes || `sha256:${yield* hashBytes(bytes)}` !== artifact.digest) {
+                return yield* new PlanDigestMismatch({});
+            }
+            const receipt = yield* decodeReceipt(yield* archiveText(bytes), stack);
+            const producingRun = yield* github.run(receipt.producerRunId);
+            const publicationJobs = yield* github.jobs(publisher.id);
+            const producingJobs = (yield* github.jobs(producingRun.id)).filter((job) => job.name === `${stack} / native`);
+            const producingJob = producingJobs[0];
+            const producingSteps = producingJob?.steps.filter((step) => step.name === "Native read-only plan") ?? [];
+            const producingStep = producingSteps[0];
+            if (receipt.runId !== publisher.id || receipt.base !== publisher.head_sha || receipt.head !== head ||
+                receipt.native.stage !== stageFor(stack) ||
+                !privateRunMatches(producingRun, producerWorkflow.id, "infra.yml", "pull_request") ||
+                producingRun.head_sha !== receipt.head || producingRun.status !== "completed" ||
+                producingRun.conclusion !== "success" ||
+                producingJobs.length !== 1 || producingJob === undefined ||
+                producingJob.run_attempt !== producingRun.run_attempt || producingJob.status !== "completed" ||
+                producingJob.conclusion !== "success" || producingSteps.length !== 1 || producingStep === undefined ||
+                producingStep.status !== "completed" || producingStep.conclusion !== "success" ||
+                producingStep.started_at === undefined || producingStep.started_at === null ||
+                producingRun.referenced_workflows?.some((workflow) => [
+                    "knpkv/infra/.github/workflows/_infra-plan.yml@main",
+                    "knpkv/infra/.github/workflows/_infra-plan.yml@refs/heads/main"
+                ].includes(workflow.path) && workflow.ref === "refs/heads/main" && workflow.sha === receipt.base) !== true ||
+                !producingRun.pull_requests.some((pr) => pr.number === receipt.pr && pr.head.sha === receipt.head && pr.base.sha === receipt.base) ||
+                !publicationJobs.some((job) => job.id === receipt.publisherJobId && job.name === `${stack} / publish` &&
+                    job.run_attempt === publisher.run_attempt &&
+                    job.status === "completed" && job.conclusion === "success")) {
+                return yield* new PlanProvenanceInvalid({});
+            }
+            return { plan: project(receipt, source, yield* github.latestMainSeenByCi(), now, artifact), producingRun };
+        }).pipe(Effect.map(({ plan, producingRun }) => failed !== undefined && compareProducerRuns(failed, producingRun) < 0
+            ? { _tag: "Failed", runHref: runHref(failed.id), lastPublished: { ...plan, stale: "failed" } }
+            : { _tag: "Ready", plan }), Effect.catchTags({
+            PlanProvenanceInvalid: () => Effect.succeed({ _tag: "Unverified", reason: "provenance", source }),
+            PlanArchiveInvalid: () => Effect.succeed({ _tag: "Unverified", reason: "archive", source }),
+            PlanDigestMismatch: () => Effect.succeed({ _tag: "Unverified", reason: "digest", source }),
+            PlanReceiptInvalid: () => Effect.succeed({ _tag: "Unverified", reason: "receipt", source })
+        }));
+        return yield* verified;
+    }, (effect) => effect.pipe(Effect.timeoutOrElse({ duration: "30 seconds", orElse: () => Effect.fail(new PlanCiUnreachable({})) }), Effect.catchTags({
+        PlanProvenanceInvalid: () => Effect.succeed({ _tag: "Unverified", reason: "provenance", source: null }),
+        PlanMetadataInvalid: () => Effect.succeed({ _tag: "Unverified", reason: "metadata", source: null }),
+        PlanCiUnreachable: () => Effect.succeed({ _tag: "Unreachable" }),
+        PlanCiRefused: () => Effect.succeed({ _tag: "Refused" })
+    }), Effect.withTracerEnabled(false)));
+    return PlanReader.of({
+        read: (app, stage) => read(app, stage).pipe(Effect.provideService(Crypto.Crypto, cryptoService))
+    });
+}));
+export const disconnectedLayer = Layer.succeed(PlanReader, PlanReader.of({ read: () => Effect.succeed({ _tag: "NotConnected" }) }));
+/** Dedicated read-only Actions token is optional and server-held. No host gh token discovery or client credential configuration. */
+export const configuredPlanLayer = Layer.unwrap(Effect.gen(function* () {
+    const token = yield* Config.option(Config.Redacted("ALCHEMY_CONSOLE_CI_TOKEN"));
+    return Option.isNone(token) ? disconnectedLayer : readerLayer.pipe(Layer.provide(githubLayer(token.value)));
+}));
+//# sourceMappingURL=PlanReader.js.map

package/dist/server/PlanReader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PlanReader.js","sourceRoot":"","sources":["../../src/server/PlanReader.ts"],"names":[],"mappings":"AAAA,4GAA4G;AAC5G,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAEhG,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC7D,OAAO,EAGL,WAAW,EAEX,iBAAiB,EACjB,UAAU,EACV,mBAAmB,EACnB,eAAe,EAEhB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,aAAa,EACb,SAAS,EAET,kBAAkB,EAElB,QAAQ,EACT,MAAM,mBAAmB,CAAA;AAE1B,MAAM,OAAO,qBAAsB,SAAQ,MAAM,CAAC,WAAW,EAAyB,CAAC,uBAAuB,EAAE,EAAE,CAAC;CAAG;AAEtH,MAAM,OAAO,UAAW,SAAQ,OAAO,CAAC,OAAO,EAE3C,CAAC,mCAAmC,CAAC;CAAG;AAE5C,mGAAmG;AACnG,MAAM,WAAW,GAAG,CAAC,GAAW,EAAE,KAAa,EAAqB,EAAE,CACpE,GAAG,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;AACvG,MAAM,MAAM,GAAG,UAAU,CAAA;AACzB,MAAM,mBAAmB,GAAG,CAAC,CAAM,EAAE,CAAM,EAAU,EAAE,CACrD,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAA;AAC5F,MAAM,OAAO,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,+CAA+C,EAAE,EAAE,CAAA;AAC3F,MAAM,SAAS,GAAG,CAAC,QAAkB,EAAE,IAAY,EAAE,GAAW,EAAE,QAAyB,EAAc,EAAE,CAAC,CAAC;IAC3G,EAAE,EAAE,QAAQ,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,EAAE,MAAM,IAAI,IAAI;IAC9E,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;IACtB,IAAI,EAAE,IAAI;IACV,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;IACpD,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,UAAU,CAAC,CAAC;IACvG,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;CAC3C,CAAC,CAAA;AACF,MAAM,qBAAqB,GAAG,MAAM,CAAC,qBAAqB,CAAC;IACzD,oBAAoB;IACpB,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IACnD,GAAG;IACH,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;CAC1D,CAAC,CAAA;AACF,4GAA4G;AAC5G,MAAM,mBAAmB,GAAG,CAAC,GAAQ,EAAE,IAAuC,EAAW,EAAE;IACzF,IAAI,GAAG,CAAC,IAAI,KAAK,qBAAqB,IAAI,EAAE;QAAE,OAAO,IAAI,CAAA;IACzD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,mBAAmB,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;IAC/F,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAA;IACxB,OAAO,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,iBAAiB;QAChD,CAAC,IAAI,KAAK,WAAW,IAAI,CACvB,GAAG,KAAK,GAAG,CAAC,WAAW,IAAI,GAAG,KAAK,cAAc,GAAG,CAAC,WAAW,EAAE;YAClE,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,aAAa,EAAE,CAAC,MAAM,QAAQ,CAAC,CACvE,CAAC,CAAA;AACN,CAAC,CAAA;AACD,MAAM,iBAAiB,GAAG,CACxB,GAAQ,EACR,UAAkB,EAClB,IAAuC,EACvC,KAAa,EACJ,EAAE,CACX,GAAG,CAAC,WAAW,KAAK,UAAU,IAAI,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK;IACvF,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,MAAM,IAAI,GAAG,CAAC,eAAe,CAAC,EAAE,KAAK,MAAM;IACjE,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,IAAI,GAAG,CAAC,gBAAgB,CAAC,EAAE,KAAK,MAAM,CAAA;AAE/D,MAAM,OAAO,GAAG,CACd,OAAgB,EAChB,MAAkB,EAClB,kBAAiC,EACjC,GAAW,EACX,QAAkB,EACH,EAAE,CAAC,CAAC;IACnB,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;IACrE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;IACjF,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC/C,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,YAAY,EAAE,GAAG,CAAC,IAAI;QACtB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,WAAW,EAAE,CAAC,GAAG,GAAG,CAAC,WAAW,CAAC;KAClC,CAAC,CAAC;IACH,KAAK,EAAE,kBAAkB,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,kBAAkB;QACvE,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,GAAG,GAAG,eAAe,CAAC,QAAQ,CAAC,GAAG,UAAU;YAC9C,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,IAAI;CACT,CAAC,CAAA;AAEF,kHAAkH;AAClH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CACrC,UAAU,EACV,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAAA;IAChC,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAA;IAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,2BAA2B,CAAC,CACjD,QAAQ,CAAC,EACP,GAAW,EACX,KAAa;QAEb,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACrC,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAA;QACnD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAA;QAC1C,MAAM,iBAAiB,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAA;QACrE,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QAC5D,IACE,iBAAiB,CAAC,IAAI,KAAK,qCAAqC;YAChE,gBAAgB,CAAC,IAAI,KAAK,6BAA6B,EACvD,CAAC;YACD,OAAO,KAAK,CAAC,CAAC,IAAI,qBAAqB,CAAC,EAAE,CAAC,CAAA;QAC7C,CAAC;QACD,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,KAAK,QAAQ,IAAI,gBAAgB,CAAC,KAAK,KAAK,QAAQ,CAAA;QAC9F,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAA;QACjD,MAAM,YAAY,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CACpE,iBAAiB,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,CACzE,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;QAC3B,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC9B,MAAM,IAAI,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACtE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAA;QACnF,IAAI,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAA;QAC5C,mGAAmG;QACnG,IAAI,OAA6D,CAAA;QACjE,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;YAClD,MAAM,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC/D,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,GAAG,KAAK,WAAW,CAAC,CAAA;YAC5E,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC,CAAC,IAAI,mBAAmB,CAAC,EAAE,CAAC,CAAA;YACpE,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;YACzB,IAAI,GAAG,KAAK,SAAS;gBAAE,SAAQ;YAC/B,IAAI,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC,CAAC,IAAI,qBAAqB,CAAC,EAAE,CAAC,CAAA;YACpF,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,uBAAuB,CAAC,CAAA;YACrF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC,CAAC,IAAI,mBAAmB,CAAC,EAAE,CAAC,CAAA;YACrE,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;YAC3B,IACE,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI;gBAC/E,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;gBACzD,SAAQ;YACV,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa;gBAAE,OAAO,KAAK,CAAC,CAAC,IAAI,mBAAmB,CAAC,EAAE,CAAC,CAAA;YAC3G,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;YACtB,MAAK;QACP,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,EAAE,GAAG,CAAC,MAAM,KAAK,WAAW;YAC9C,CAAC,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;YAC1G,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACf,SAAS,CAAA;QACX,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CACrE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,KAAK,GAAG,CAAC,CACjD;aACE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAA;QACzE,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC3C,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,GAAG,CACvE,CAAA;QACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAA;YACrG,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAA;YAC5B,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAA;YAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,eAAe,KAAK,kBAAkB,CAAC,CAAC,CAAA;YACpF,MAAM,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;YACvB,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,IAAI,KAAK,SAAS;oBACxB,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,SAAS,CACT,OAAO,EACP,IAAI,EACJ,GAAG,EACH,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAClD;aACJ,CAAA;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAA;QACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,KAAK,GAAG,CAAC,MAAM,CAAC,CAAA;QAC/D,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAA;QAClE,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC5F,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YACnC,IACE,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC,aAAa,IAAI,YAAY;gBACrF,QAAQ,CAAC,YAAY,CAAC,aAAa,KAAK,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,kBAAkB,KAAK,MAAM;gBACrG,QAAQ,CAAC,YAAY,CAAC,WAAW,KAAK,MAAM;gBAC5C,OAAO,KAAK,CAAC,CAAC,IAAI,qBAAqB,CAAC,EAAE,CAAC,CAAA;YAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;YAC7D,IACE,CAAC,iBAAiB,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,EAAE,mBAAmB,EAAE,cAAc,CAAC;gBACxF,SAAS,CAAC,WAAW,KAAK,MAAM,IAAI,SAAS,CAAC,MAAM,KAAK,WAAW;gBACpE,SAAS,CAAC,UAAU,KAAK,SAAS;gBAClC,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,YAAY,CAAC,QAAQ;gBACrD,OAAO,KAAK,CAAC,CAAC,IAAI,qBAAqB,CAAC,EAAE,CAAC,CAAA;YAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;YACjD,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,aAAa,IAAI,UAAU,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACvG,OAAO,KAAK,CAAC,CAAC,IAAI,kBAAkB,CAAC,EAAE,CAAC,CAAA;YAC1C,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAA;YACtE,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;YAC7D,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YACxD,MAAM,aAAa,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,GAAG,KAAK,WAAW,CAAC,CAAA;YAC7G,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,CAAA;YACrC,MAAM,cAAc,GAAG,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,uBAAuB,CAAC,IAAI,EAAE,CAAA;YACxG,MAAM,aAAa,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;YACvC,IACE,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,EAAE,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI;gBAC9F,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,CAAC;gBACxC,CAAC,iBAAiB,CAAC,YAAY,EAAE,gBAAgB,CAAC,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC;gBAClF,YAAY,CAAC,QAAQ,KAAK,OAAO,CAAC,IAAI,IAAI,YAAY,CAAC,MAAM,KAAK,WAAW;gBAC7E,YAAY,CAAC,UAAU,KAAK,SAAS;gBACrC,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,KAAK,SAAS;gBACxD,YAAY,CAAC,WAAW,KAAK,YAAY,CAAC,WAAW,IAAI,YAAY,CAAC,MAAM,KAAK,WAAW;gBAC5F,YAAY,CAAC,UAAU,KAAK,SAAS,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,KAAK,SAAS;gBACnG,aAAa,CAAC,MAAM,KAAK,WAAW,IAAI,aAAa,CAAC,UAAU,KAAK,SAAS;gBAC9E,aAAa,CAAC,UAAU,KAAK,SAAS,IAAI,aAAa,CAAC,UAAU,KAAK,IAAI;gBAC3E,YAAY,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CACjD;oBACE,oDAAoD;oBACpD,+DAA+D;iBAChE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,GAAG,KAAK,iBAAiB,IAAI,QAAQ,CAAC,GAAG,KAAK,OAAO,CAAC,IAAI,CACjG,KAAK,IAAI;gBACZ,CAAC,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CACtC,EAAE,CAAC,MAAM,KAAK,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,IAAI,CACzF;gBACD,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAC5B,GAAG,CAAC,EAAE,KAAK,OAAO,CAAC,cAAc,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,KAAK,YAAY;oBACtE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;oBACzC,GAAG,CAAC,MAAM,KAAK,WAAW,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,CAC3D,EACD,CAAC;gBACD,OAAO,KAAK,CAAC,CAAC,IAAI,qBAAqB,CAAC,EAAE,CAAC,CAAA;YAC7C,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,kBAAkB,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAA;QAC5G,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,EAAa,EAAE,CAC/C,MAAM,KAAK,SAAS,IAAI,mBAAmB,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC;YACnE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YAC9F,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAC5B,EACD,MAAM,CAAC,SAAS,CAAC;YACf,qBAAqB,EAAE,GAAG,EAAE,CAC1B,MAAM,CAAC,OAAO,CAAY,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;YACjF,kBAAkB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAY,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;YACtG,kBAAkB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAY,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YACrG,kBAAkB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAY,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;SACvG,CAAC,CACH,CAAA;QACD,OAAO,KAAK,CAAC,CAAC,QAAQ,CAAA;IACxB,CAAC,EACD,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EACtG,MAAM,CAAC,SAAS,CAAC;QACf,qBAAqB,EAAE,GAAG,EAAE,CAC1B,MAAM,CAAC,OAAO,CAAY,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACvF,mBAAmB,EAAE,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CAAY,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACrF,iBAAiB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAY,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QAC3E,aAAa,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAY,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KACpE,CAAC,EACF,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAChC,CACJ,CAAA;IACD,OAAO,UAAU,CAAC,EAAE,CAAC;QACnB,IAAI,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;KACjG,CAAC,CAAA;AACJ,CAAC,CAAC,CACH,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAC5C,UAAU,EACV,UAAU,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,CACxE,CAAA;AAED,oIAAoI;AACpI,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC,CAAA;IAC/E,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAC7G,CAAC,CAAC,CAAC,CAAA"}

package/dist/server/Server.d.ts

@@ -2,5 +2,5 @@ import * as OwnerSession from "@knpkv/browser-pairing/owner-session";
 import { Deferred, Layer } from "effect";
 import { type ControlOptions } from "./ControlSocket.js";
 /** Catalog and platform services are supplied by the executable. This layer owns both listeners. */
-export declare const makeServer: (options: ControlOptions, ready: Deferred.Deferred<string>) => Layer.Layer<never, import("effect/PlatformError").BadArgument | import("@knpkv/browser-pairing").BrowserPairingError | import("./ControlSocket.js").ControlError | import("@knpkv/browser-pairing").CredentialCookieError | import("effect/PlatformError").PlatformError | import("effect/http/HttpServerError").ServeError | OwnerSession.UnsafeLoopbackAddressError, import("./Catalog.ts").Catalog | import("effect/Crypto").Crypto | import("effect/FileSystem").FileSystem | import("effect/Path").Path>;
+export declare const makeServer: (options: ControlOptions, ready: Deferred.Deferred<string>) => Layer.Layer<never, import("effect/PlatformError").BadArgument | import("@knpkv/browser-pairing").BrowserPairingError | import("./ControlSocket.js").ControlError | import("@knpkv/browser-pairing").CredentialCookieError | import("effect/PlatformError").PlatformError | import("effect/http/HttpServerError").ServeError | OwnerSession.UnsafeLoopbackAddressError, import("./Catalog.ts").Catalog | import("effect/Crypto").Crypto | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("./PlanReader.ts").PlanReader>;
 //# sourceMappingURL=Server.d.ts.map

package/dist/server/Server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Server.d.ts","sourceRoot":"","sources":["../../src/server/Server.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,YAAY,MAAM,sCAAsC,CAAA;AACpE,OAAO,EAAE,QAAQ,EAAU,KAAK,EAAE,MAAM,QAAQ,CAAA;AAGhD,OAAO,EAAE,KAAK,cAAc,EAAiB,MAAM,oBAAoB,CAAA;AAIvE,oGAAoG;AACpG,eAAO,MAAM,UAAU,YAAa,cAAc,SAAS,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,kfAuBwB,CAAA"}
+{"version":3,"file":"Server.d.ts","sourceRoot":"","sources":["../../src/server/Server.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,YAAY,MAAM,sCAAsC,CAAA;AACpE,OAAO,EAAE,QAAQ,EAAU,KAAK,EAAE,MAAM,QAAQ,CAAA;AAGhD,OAAO,EAAE,KAAK,cAAc,EAAiB,MAAM,oBAAoB,CAAA;AAIvE,oGAAoG;AACpG,eAAO,MAAM,UAAU,YAAa,cAAc,SAAS,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,yhBAuBwB,CAAA"}

package/dist/server/plan/archive.d.ts

@@ -0,0 +1,10 @@
+/** Node compression adapter. Inspects one regular plan.json member in memory, without filesystem extraction. */
+import { Effect, Schema } from "effect";
+export declare const archiveLimit = 1000000;
+declare const PlanArchiveInvalid_base: Schema.Class<PlanArchiveInvalid, Schema.TaggedStruct<"PlanArchiveInvalid", {}>, import("effect/Cause").YieldableError>;
+export declare class PlanArchiveInvalid extends PlanArchiveInvalid_base {
+}
+/** Both ZIP metadata and actual expanded bytes must fit the cap. Local and central identities must agree. */
+export declare const archiveText: (bytes: Uint8Array) => Effect.Effect<string, PlanArchiveInvalid, never>;
+export {};
+//# sourceMappingURL=archive.d.ts.map

package/dist/server/plan/archive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive.d.ts","sourceRoot":"","sources":["../../../src/server/plan/archive.ts"],"names":[],"mappings":"AAAA,gHAAgH;AAChH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAGvC,eAAO,MAAM,YAAY,UAAY,CAAA;;AACrC,qBAAa,kBAAmB,SAAQ,uBAAkE;CAAG;AAM7G,6GAA6G;AAC7G,eAAO,MAAM,WAAW,UAAW,UAAU,qDAsDzC,CAAA"}

package/dist/server/plan/archive.js

@@ -0,0 +1,62 @@
+/** Node compression adapter. Inspects one regular plan.json member in memory, without filesystem extraction. */
+import { Effect, Schema } from "effect";
+import { crc32, inflateRawSync } from "node:zlib";
+export const archiveLimit = 1_000_000;
+export class PlanArchiveInvalid extends Schema.TaggedError()("PlanArchiveInvalid", {}) {
+}
+const requireArchive = (condition) => {
+    if (!condition)
+        throw new PlanArchiveInvalid({});
+};
+/** Both ZIP metadata and actual expanded bytes must fit the cap. Local and central identities must agree. */
+export const archiveText = (bytes) => Effect.try({
+    try: () => {
+        requireArchive(bytes.length > 0 && bytes.length < archiveLimit);
+        const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+        const u16 = (offset) => view.getUint16(offset, true);
+        const u32 = (offset) => view.getUint32(offset, true);
+        let end = bytes.length - 22;
+        while (end >= Math.max(0, bytes.length - 65557) && u32(end) !== 0x06054b50)
+            end--;
+        requireArchive(end >= 0 && end + 22 + u16(end + 20) === bytes.length);
+        requireArchive(u16(end + 4) === 0 && u16(end + 6) === 0 && u16(end + 8) === 1 && u16(end + 10) === 1);
+        const directory = u32(end + 16);
+        requireArchive(directory + u32(end + 12) === end && u32(directory) === 0x02014b50);
+        const flags = u16(directory + 8);
+        const method = u16(directory + 10);
+        const checksum = u32(directory + 16);
+        const compressed = u32(directory + 20);
+        const expanded = u32(directory + 24);
+        const nameLength = u16(directory + 28);
+        const name = new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(directory + 46, directory + 46 + nameLength));
+        const mode = u32(directory + 38) >>> 16;
+        requireArchive(name === "plan.json" && nameLength === 9 && u16(directory + 34) === 0);
+        requireArchive((mode & 0xf000) === 0 || (mode & 0xf000) === 0x8000);
+        requireArchive((flags & ~0x808) === 0 && (method === 0 || method === 8));
+        requireArchive(expanded > 0 && expanded < archiveLimit && compressed > 0 && compressed < archiveLimit);
+        requireArchive(directory + 46 + nameLength + u16(directory + 30) + u16(directory + 32) === end);
+        const local = u32(directory + 42);
+        requireArchive(local === 0 && u32(local) === 0x04034b50);
+        requireArchive(u16(local + 6) === flags && u16(local + 8) === method && u16(local + 26) === nameLength);
+        const localName = bytes.subarray(local + 30, local + 30 + nameLength);
+        requireArchive(new TextDecoder("utf-8", { fatal: true }).decode(localName) === name);
+        const start = local + 30 + nameLength + u16(local + 28);
+        const dataEnd = start + compressed;
+        if ((flags & 8) === 0) {
+            requireArchive(u32(local + 14) === checksum && u32(local + 18) === compressed && u32(local + 22) === expanded &&
+                dataEnd === directory);
+        }
+        else {
+            const descriptor = u32(dataEnd) === 0x08074b50 ? dataEnd + 4 : dataEnd;
+            requireArchive(descriptor + 12 === directory && u32(descriptor) === checksum && u32(descriptor + 4) === compressed &&
+                u32(descriptor + 8) === expanded);
+        }
+        requireArchive(start < dataEnd && dataEnd <= directory);
+        const data = bytes.subarray(start, dataEnd);
+        const text = method === 0 ? data : inflateRawSync(data, { maxOutputLength: archiveLimit - 1 });
+        requireArchive(text.length === expanded && crc32(text) === checksum);
+        return new TextDecoder("utf-8", { fatal: true }).decode(text);
+    },
+    catch: () => new PlanArchiveInvalid({})
+});
+//# sourceMappingURL=archive.js.map

package/dist/server/plan/archive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive.js","sourceRoot":"","sources":["../../../src/server/plan/archive.ts"],"names":[],"mappings":"AAAA,gHAAgH;AAChH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACvC,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAEjD,MAAM,CAAC,MAAM,YAAY,GAAG,SAAS,CAAA;AACrC,MAAM,OAAO,kBAAmB,SAAQ,MAAM,CAAC,WAAW,EAAsB,CAAC,oBAAoB,EAAE,EAAE,CAAC;CAAG;AAE7G,MAAM,cAAc,GAAG,CAAC,SAAkB,EAAQ,EAAE;IAClD,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,kBAAkB,CAAC,EAAE,CAAC,CAAA;AAClD,CAAC,CAAA;AAED,6GAA6G;AAC7G,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAiB,EAAE,EAAE,CAC/C,MAAM,CAAC,GAAG,CAAC;IACT,GAAG,EAAE,GAAG,EAAE;QACR,cAAc,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,YAAY,CAAC,CAAA;QAC/D,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;QAC3E,MAAM,GAAG,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC5D,MAAM,GAAG,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC5D,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,GAAG,EAAE,CAAA;QAC3B,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,UAAU;YAAE,GAAG,EAAE,CAAA;QACjF,cAAc,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,EAAE,GAAG,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,CAAA;QACrE,cAAc,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAA;QACrG,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,CAAA;QAC/B,cAAc,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,UAAU,CAAC,CAAA;QAClF,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;QAChC,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC,CAAA;QAClC,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC,CAAA;QACpC,MAAM,UAAU,GAAG,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC,CAAA;QACtC,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC,CAAA;QACpC,MAAM,UAAU,GAAG,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC,CAAA;QACtC,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAC3D,KAAK,CAAC,QAAQ,CAAC,SAAS,GAAG,EAAE,EAAE,SAAS,GAAG,EAAE,GAAG,UAAU,CAAC,CAC5D,CAAA;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC,KAAK,EAAE,CAAA;QACvC,cAAc,CAAC,IAAI,KAAK,WAAW,IAAI,UAAU,KAAK,CAAC,IAAI,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAA;QACrF,cAAc,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,MAAM,CAAC,CAAA;QACnE,cAAc,CAAC,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,CAAC,CAAC,CAAA;QACxE,cAAc,CAAC,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,YAAY,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,GAAG,YAAY,CAAC,CAAA;QACtG,cAAc,CAAC,SAAS,GAAG,EAAE,GAAG,UAAU,GAAG,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC,KAAK,GAAG,CAAC,CAAA;QAC/F,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC,CAAA;QACjC,cAAc,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,UAAU,CAAC,CAAA;QACxD,cAAc,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,KAAK,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,MAAM,IAAI,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,KAAK,UAAU,CAAC,CAAA;QACvG,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,GAAG,EAAE,EAAE,KAAK,GAAG,EAAE,GAAG,UAAU,CAAC,CAAA;QACrE,cAAc,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,CAAA;QACpF,MAAM,KAAK,GAAG,KAAK,GAAG,EAAE,GAAG,UAAU,GAAG,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,CAAA;QACvD,MAAM,OAAO,GAAG,KAAK,GAAG,UAAU,CAAA;QAClC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,cAAc,CACZ,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,KAAK,UAAU,IAAI,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,KAAK,QAAQ;gBAC5F,OAAO,KAAK,SAAS,CACxB,CAAA;QACH,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;YACtE,cAAc,CACZ,UAAU,GAAG,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,UAAU;gBACjG,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,QAAQ,CACnC,CAAA;QACH,CAAC;QACD,cAAc,CAAC,KAAK,GAAG,OAAO,IAAI,OAAO,IAAI,SAAS,CAAC,CAAA;QACvD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAC3C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,eAAe,EAAE,YAAY,GAAG,CAAC,EAAE,CAAC,CAAA;QAC9F,cAAc,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAA;QACpE,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC/D,CAAC;IACD,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,kBAAkB,CAAC,EAAE,CAAC;CACxC,CAAC,CAAA"}

package/dist/server/plan/github.d.ts

@@ -0,0 +1,105 @@
+import { Context, Effect, Layer, Redacted, Schema } from "effect";
+import { HttpClient } from "effect/http";
+declare const PlanCiUnreachable_base: Schema.Class<PlanCiUnreachable, Schema.TaggedStruct<"PlanCiUnreachable", {}>, import("effect/Cause").YieldableError>;
+export declare class PlanCiUnreachable extends PlanCiUnreachable_base {
+}
+declare const PlanCiRefused_base: Schema.Class<PlanCiRefused, Schema.TaggedStruct<"PlanCiRefused", {}>, import("effect/Cause").YieldableError>;
+export declare class PlanCiRefused extends PlanCiRefused_base {
+}
+declare const PlanMetadataInvalid_base: Schema.Class<PlanMetadataInvalid, Schema.TaggedStruct<"PlanMetadataInvalid", {}>, import("effect/Cause").YieldableError>;
+export declare class PlanMetadataInvalid extends PlanMetadataInvalid_base {
+}
+export type GithubFailure = PlanCiUnreachable | PlanCiRefused | PlanMetadataInvalid;
+export declare const Run: Schema.Struct<{
+    readonly id: Schema.Int;
+    readonly workflow_id: Schema.Int;
+    readonly path: Schema.String;
+    readonly event: Schema.String;
+    readonly head_sha: Schema.String;
+    readonly head_branch: Schema.String;
+    readonly status: Schema.String;
+    readonly conclusion: Schema.NullOr<Schema.String>;
+    readonly run_attempt: Schema.Int;
+    readonly created_at: Schema.DateTimeUtcFromString;
+    readonly updated_at: Schema.DateTimeUtcFromString;
+    readonly actor: Schema.Struct<{
+        readonly id: Schema.Int;
+    }>;
+    readonly triggering_actor: Schema.Struct<{
+        readonly id: Schema.Int;
+    }>;
+    readonly referenced_workflows: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+        readonly path: Schema.String;
+        readonly ref: Schema.String;
+        readonly sha: Schema.String;
+    }>>>;
+    readonly repository: Schema.Struct<{
+        readonly id: Schema.Int;
+    }>;
+    readonly head_repository: Schema.Struct<{
+        readonly id: Schema.Int;
+    }>;
+    readonly pull_requests: Schema.$Array<Schema.Struct<{
+        readonly number: Schema.Int;
+        readonly head: Schema.Struct<{
+            readonly sha: Schema.String;
+        }>;
+        readonly base: Schema.Struct<{
+            readonly sha: Schema.String;
+        }>;
+    }>>;
+}>;
+export type Run = typeof Run.Type;
+export declare const Artifact: Schema.Struct<{
+    readonly id: Schema.Int;
+    readonly name: Schema.String;
+    readonly size_in_bytes: Schema.Int;
+    readonly digest: Schema.NullOr<Schema.String>;
+    readonly expired: Schema.Boolean;
+    readonly created_at: Schema.DateTimeUtcFromString;
+    readonly expires_at: Schema.DateTimeUtcFromString;
+    readonly workflow_run: Schema.Struct<{
+        readonly id: Schema.Int;
+        readonly repository_id: Schema.Int;
+        readonly head_repository_id: Schema.Int;
+        readonly head_branch: Schema.String;
+        readonly head_sha: Schema.String;
+    }>;
+}>;
+export type Artifact = typeof Artifact.Type;
+export declare const Job: Schema.Struct<{
+    readonly id: Schema.Int;
+    readonly name: Schema.String;
+    readonly conclusion: Schema.NullOr<Schema.String>;
+    readonly status: Schema.String;
+    readonly run_attempt: Schema.Int;
+    readonly steps: Schema.$Array<Schema.Struct<{
+        readonly started_at: Schema.optionalKey<Schema.NullOr<Schema.DateTimeUtcFromString>>;
+        readonly name: Schema.String;
+        readonly status: Schema.String;
+        readonly conclusion: Schema.NullOr<Schema.String>;
+    }>>;
+}>;
+export type Job = typeof Job.Type;
+declare const Workflow: Schema.Struct<{
+    readonly id: Schema.Int;
+    readonly path: Schema.String;
+    readonly state: Schema.String;
+}>;
+export type Workflow = typeof Workflow.Type;
+declare const PlanGithub_base: Context.ServiceClass<PlanGithub, "@knpkv/alchemy-console/PlanGithub", {
+    readonly workflow: (file: "infra.yml" | "infra-publish.yml") => Effect.Effect<Workflow, GithubFailure>;
+    readonly runs: (file: "infra.yml" | "infra-publish.yml") => Effect.Effect<ReadonlyArray<Run>, GithubFailure>;
+    readonly artifacts: (stack: string) => Effect.Effect<ReadonlyArray<Artifact>, GithubFailure>;
+    readonly run: (id: number) => Effect.Effect<Run, GithubFailure>;
+    readonly jobs: (id: number) => Effect.Effect<ReadonlyArray<Job>, GithubFailure>;
+    readonly latestMainSeenByCi: () => Effect.Effect<string | null, GithubFailure>;
+    readonly download: (id: number) => Effect.Effect<Uint8Array, GithubFailure>;
+}>;
+export declare class PlanGithub extends PlanGithub_base {
+}
+/** Disable redirects on authenticated requests. Only the validated HTTPS blob redirect is followed, without Authorization. */
+export declare const githubLayer: (token: Redacted.Redacted<string>) => Layer.Layer<PlanGithub, never, HttpClient.HttpClient>;
+export declare const publishedMillis: (artifact: Artifact) => number;
+export {};
+//# sourceMappingURL=github.d.ts.map

package/dist/server/plan/github.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../../src/server/plan/github.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAY,MAAM,EAAE,KAAK,EAAU,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACnF,OAAO,EAAmB,UAAU,EAA2B,MAAM,aAAa,CAAA;;AAIlF,qBAAa,iBAAkB,SAAQ,sBAAgE;CAAG;;AAC1G,qBAAa,aAAc,SAAQ,kBAAwD;CAAG;;AAC9F,qBAAa,mBAAoB,SAAQ,wBAAoE;CAAG;AAChH,MAAM,MAAM,aAAa,GAAG,iBAAiB,GAAG,aAAa,GAAG,mBAAmB,CAAA;AAInF,eAAO,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsBd,CAAA;AACF,MAAM,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,IAAI,CAAA;AACjC,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;EAenB,CAAA;AACF,MAAM,MAAM,QAAQ,GAAG,OAAO,QAAQ,CAAC,IAAI,CAAA;AAC3C,eAAO,MAAM,GAAG;;;;;;;;;;;;EAcd,CAAA;AACF,MAAM,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,IAAI,CAAA;AACjC,QAAA,MAAM,QAAQ;;;;EAA6E,CAAA;AAC3F,MAAM,MAAM,QAAQ,GAAG,OAAO,QAAQ,CAAC,IAAI,CAAA;;uBAMtB,CAAC,IAAI,EAAE,WAAW,GAAG,mBAAmB,KAAK,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC;mBACvF,CAAC,IAAI,EAAE,WAAW,GAAG,mBAAmB,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC;wBACxF,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;kBAC9E,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,aAAa,CAAC;mBAChD,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC;iCAClD,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,aAAa,CAAC;uBAC3D,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC;;AAP7E,qBAAa,UAAW,SAAQ,eAQS;CAAG;AAE5C,8HAA8H;AAC9H,eAAO,MAAM,WAAW,UAAW,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,0DAmHzD,CAAA;AAEH,eAAO,MAAM,eAAe,aAAc,QAAQ,KAAG,MAAqD,CAAA"}

package/dist/server/plan/github.js

@@ -0,0 +1,155 @@
+/** Server-private GitHub transport. Token and signed download URLs stay here; body limits apply before buffering. */
+import { collectBounded } from "@knpkv/bounded-io";
+import { Context, DateTime, Effect, Layer, Option, Redacted, Schema } from "effect";
+import { FetchHttpClient, HttpClient } from "effect/http";
+import { archiveLimit } from "./archive.js";
+import { Digest, Positive, Sha } from "./receipt.js";
+export class PlanCiUnreachable extends Schema.TaggedError()("PlanCiUnreachable", {}) {
+}
+export class PlanCiRefused extends Schema.TaggedError()("PlanCiRefused", {}) {
+}
+export class PlanMetadataInvalid extends Schema.TaggedError()("PlanMetadataInvalid", {}) {
+}
+const Timestamp = Schema.DateTimeUtcFromString;
+const Repository = Schema.Struct({ id: Positive });
+export const Run = Schema.Struct({
+    id: Positive,
+    workflow_id: Positive,
+    path: Schema.String,
+    event: Schema.String,
+    head_sha: Sha,
+    head_branch: Schema.String,
+    status: Schema.String,
+    conclusion: Schema.NullOr(Schema.String),
+    run_attempt: Positive,
+    created_at: Timestamp,
+    updated_at: Timestamp,
+    actor: Repository,
+    triggering_actor: Repository,
+    referenced_workflows: Schema.optionalKey(Schema.Array(Schema.Struct({ path: Schema.String, ref: Schema.String, sha: Sha })).check(Schema.isMaxLength(10))),
+    repository: Repository,
+    head_repository: Repository,
+    pull_requests: Schema.Array(Schema.Struct({ number: Positive, head: Schema.Struct({ sha: Sha }), base: Schema.Struct({ sha: Sha }) })).check(Schema.isMaxLength(100))
+});
+export const Artifact = Schema.Struct({
+    id: Positive,
+    name: Schema.String.check(Schema.isMaxLength(256)),
+    size_in_bytes: Positive,
+    digest: Schema.NullOr(Digest),
+    expired: Schema.Boolean,
+    created_at: Timestamp,
+    expires_at: Timestamp,
+    workflow_run: Schema.Struct({
+        id: Positive,
+        repository_id: Positive,
+        head_repository_id: Positive,
+        head_branch: Schema.String,
+        head_sha: Sha
+    })
+});
+export const Job = Schema.Struct({
+    id: Positive,
+    name: Schema.String,
+    conclusion: Schema.NullOr(Schema.String),
+    status: Schema.String,
+    run_attempt: Positive,
+    steps: Schema.Array(Schema.Struct({
+        started_at: Schema.optionalKey(Schema.NullOr(Timestamp)),
+        name: Schema.String,
+        status: Schema.String,
+        conclusion: Schema.NullOr(Schema.String)
+    })).check(Schema.isMaxLength(1000))
+});
+const Workflow = Schema.Struct({ id: Positive, path: Schema.String, state: Schema.String });
+const RefusalBody = Schema.fromJsonString(Schema.Struct({ message: Schema.String }));
+// A 100-run page includes repository/user/commit envelopes before schema projection (~12 KiB per run).
+const metadataLimit = 2 * 1024 * 1024;
+export class PlanGithub extends Context.Service()("@knpkv/alchemy-console/PlanGithub") {
+}
+/** Disable redirects on authenticated requests. Only the validated HTTPS blob redirect is followed, without Authorization. */
+export const githubLayer = (token) => Layer.effect(PlanGithub, Effect.gen(function* () {
+    const client = yield* HttpClient.HttpClient;
+    const request = Effect.fn("AlchemyConsole.planGithubRequest")(function* (path) {
+        const response = yield* client.get(`https://api.github.com/repos/knpkv/infra/${path}`, {
+            headers: {
+                authorization: `Bearer ${Redacted.value(token)}`,
+                accept: "application/vnd.github+json",
+                "x-github-api-version": "2022-11-28"
+            }
+        }).pipe(Effect.provideService(FetchHttpClient.RequestInit, { redirect: "manual", cache: "no-store" }), Effect.mapError(() => new PlanCiUnreachable({})));
+        if (response.status === 401)
+            return yield* new PlanCiRefused({});
+        if (response.status === 403) {
+            if (response.headers["x-ratelimit-remaining"] === "0" || response.headers["retry-after"] !== undefined) {
+                return yield* new PlanCiUnreachable({});
+            }
+            const bytes = yield* collectBounded(response.stream, 8192).pipe(Effect.mapError(() => new PlanCiUnreachable({})));
+            const refusal = Option.getOrNull(Schema.decodeUnknownOption(RefusalBody)(new TextDecoder().decode(bytes)));
+            if (refusal !== null &&
+                /\b(?:API rate limit exceeded|(?:primary|secondary) rate limit)\b/iu.test(refusal.message)) {
+                return yield* new PlanCiUnreachable({});
+            }
+            return yield* new PlanCiRefused({});
+        }
+        if (response.status !== 200 && response.status !== 302)
+            return yield* new PlanCiUnreachable({});
+        return response;
+    });
+    const body = (response, limit) => collectBounded(response.stream, limit).pipe(Effect.catchTags({
+        ByteLimitExceeded: () => Effect.fail(new PlanMetadataInvalid({})),
+        HttpClientError: () => Effect.fail(new PlanCiUnreachable({}))
+    }));
+    const json = (path, schema) => request(path).pipe(Effect.flatMap((response) => response.status === 200
+        ? body(response, metadataLimit).pipe(Effect.flatMap((bytes) => Schema.decodeUnknownEffect(Schema.fromJsonString(schema))(new TextDecoder().decode(bytes)).pipe(Effect.mapError(() => new PlanMetadataInvalid({})))))
+        : Effect.fail(new PlanMetadataInvalid({}))));
+    const list = (path, field, schema) => Effect.gen(function* () {
+        const all = [];
+        for (let page = 1; page <= 10; page++) {
+            const envelope = Schema.Struct({ [field]: Schema.Array(schema).check(Schema.isMaxLength(100)) });
+            const body = yield* json(`${path}${path.includes("?") ? "&" : "?"}per_page=100&page=${page}`, envelope);
+            const rows = body[field];
+            if (rows === undefined)
+                return yield* new PlanMetadataInvalid({});
+            for (const row of rows)
+                all.push(row);
+            if (rows.length < 100)
+                return all;
+        }
+        return yield* new PlanMetadataInvalid({});
+    });
+    return PlanGithub.of({
+        workflow: (file) => json(`actions/workflows/${file}`, Workflow),
+        runs: (file) => list(`actions/workflows/${file}/runs?event=${file === "infra.yml" ? "pull_request" : "workflow_run"}`, "workflow_runs", Run),
+        artifacts: () => list("actions/artifacts", "artifacts", Artifact),
+        run: (id) => json(`actions/runs/${id}`, Run),
+        jobs: (id) => list(`actions/runs/${id}/jobs?filter=latest`, "jobs", Job),
+        latestMainSeenByCi: () => json("actions/runs?branch=main&event=push&per_page=1", Schema.Struct({
+            workflow_runs: Schema.Array(Schema.Struct({
+                head_sha: Sha,
+                head_branch: Schema.Literal("main"),
+                event: Schema.Literal("push"),
+                repository: Schema.Struct({ id: Schema.Literal(1288997422) }),
+                head_repository: Schema.Struct({ id: Schema.Literal(1288997422) })
+            })).check(Schema.isMaxLength(1))
+        })).pipe(Effect.map((body) => body.workflow_runs[0]?.head_sha ?? null)),
+        download: Effect.fn("AlchemyConsole.downloadCiPlan")(function* (id) {
+            const response = yield* request(`actions/artifacts/${id}/zip`);
+            if (response.status !== 302)
+                return yield* new PlanMetadataInvalid({});
+            const location = response.headers.location;
+            if (location === undefined || !URL.canParse(location))
+                return yield* new PlanMetadataInvalid({});
+            const url = new URL(location);
+            if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.port !== "" ||
+                !(url.hostname.endsWith(".blob.core.windows.net") || url.hostname === "objects.githubusercontent.com")) {
+                return yield* new PlanMetadataInvalid({});
+            }
+            const blob = yield* client.get(location).pipe(Effect.provideService(FetchHttpClient.RequestInit, { redirect: "manual", cache: "no-store" }), Effect.mapError(() => new PlanCiUnreachable({})));
+            if (blob.status !== 200)
+                return yield* new PlanCiUnreachable({});
+            return yield* body(blob, archiveLimit - 1);
+        })
+    });
+}));
+export const publishedMillis = (artifact) => DateTime.toEpochMillis(artifact.created_at);
+//# sourceMappingURL=github.js.map