@miakapp/cli 4.0.0-alpha.0 → 4.0.0-alpha.10

package/dist/contexts.js

@@ -0,0 +1,388 @@
+/**
+ * Persistent, multi-home CLI contexts in `~/.miakapp`.
+ *
+ * A context names one Home Key for one home at one issuer, so an agent or a
+ * machine that works on several homes never re-exports a secret and never
+ * guesses which secret belongs to which house. Two files, split by sensitivity:
+ *
+ * - `config.json` holds what is safe to show: the context names, their issuer,
+ *   home ID, key ID, key label and the current context. Printing it leaks
+ *   nothing.
+ * - `credentials.json` holds the Home Keys and nothing else.
+ *
+ * Both are written mode 0600 inside a 0700 directory, through a temporary file,
+ * an fsync and a rename, so a crash leaves either the old file or the new one
+ * and never half of each. A lock file serializes writers: two `miakapp pair`
+ * runs finishing at the same moment must both keep their context, because the
+ * code each one redeemed cannot be redeemed again.
+ *
+ * Reads refuse a credentials file that another account could read or replace,
+ * the way `ssh` refuses a private key with loose permissions: silently using a
+ * leaked key is worse than stopping.
+ */
+import { randomBytes } from 'node:crypto';
+import { isAbsolute, join } from 'node:path';
+import { authorizationError, usageError } from './errors.js';
+import { canonicalHttpsUrl } from './internal/http.js';
+import { InvalidJsonError, boundedString, exactRecord, parseJson } from './internal/json.js';
+import { isHomeId, isRandomId } from './internal/names.js';
+export const CONFIG_DIRECTORY_VARIABLE = 'MIAKAPP_CONFIG_DIR';
+export const CONFIG_FILE = 'config.json';
+export const CREDENTIALS_FILE = 'credentials.json';
+export const CONFIG_SCHEMA = 'miakapp.cli-config/1';
+export const CREDENTIALS_SCHEMA = 'miakapp.cli-credentials/1';
+const LOCK_FILE = 'lock';
+const LOCK_WAIT_MS = 5_000;
+const LOCK_STALE_MS = 30_000;
+const MAXIMUM_FILE_BYTES = 262_144;
+const MAXIMUM_CONTEXTS = 256;
+const CONTEXT_NAME = /^[a-z0-9][a-z0-9._-]{0,62}$/;
+const HOME_KEY = /^mhk1_([A-Za-z0-9_-]{22})_([A-Za-z0-9_-]{43})$/;
+export function isContextName(value) {
+    return typeof value === 'string' && CONTEXT_NAME.test(value);
+}
+export function contextNameError(name) {
+    throw usageError(`Invalid context name ${JSON.stringify(name)}`, 'A context name is 1..63 characters of a-z, 0-9, ".", "_" and "-", starting with a letter or digit.');
+}
+/**
+ * The directory holding both files. `MIAKAPP_CONFIG_DIR` relocates it for CI,
+ * containers and tests; it must be absolute so a relative value can never
+ * resolve to a different directory from one working directory to the next.
+ */
+export function configDirectory(env, home) {
+    const override = env(CONFIG_DIRECTORY_VARIABLE);
+    if (override !== undefined && override !== '') {
+        if (!isAbsolute(override)) {
+            throw usageError(`${CONFIG_DIRECTORY_VARIABLE} must be an absolute path`);
+        }
+        return override;
+    }
+    return join(home, '.miakapp');
+}
+function enforcesModes() {
+    return process.platform !== 'win32';
+}
+function errorCode(error) {
+    return typeof error === 'object' && error !== null && 'code' in error
+        ? String(error.code)
+        : undefined;
+}
+function storeError(path, problem) {
+    throw authorizationError(`${path} ${problem}`, 'Repair or remove the file, then pair again with miakapp pair. The CLI never guesses at a '
+        + 'credential store it cannot read exactly.');
+}
+async function readStoreFile(path, secret) {
+    const fs = await import('node:fs/promises');
+    let status;
+    try {
+        status = await fs.lstat(path);
+    }
+    catch (error) {
+        if (errorCode(error) === 'ENOENT')
+            return undefined;
+        throw error;
+    }
+    if (!status.isFile())
+        storeError(path, 'is not a regular file (symbolic links are refused)');
+    if (status.size > MAXIMUM_FILE_BYTES)
+        storeError(path, 'is larger than any context store');
+    if (enforcesModes()) {
+        const uid = process.getuid?.();
+        if (uid !== undefined && status.uid !== uid)
+            storeError(path, 'is owned by another account');
+        // The credentials must be private. The configuration holds no secret, but
+        // anyone able to rewrite it could repoint a context at their own issuer.
+        const forbidden = secret ? 0o077 : 0o022;
+        if ((status.mode & forbidden) !== 0) {
+            throw authorizationError(`${path} is accessible to other accounts (mode ${(status.mode & 0o777).toString(8)})`, `Run chmod 600 ${path}. Rotate the Home Keys it holds if anyone else could have read it.`);
+        }
+    }
+    return new Uint8Array(await fs.readFile(path));
+}
+function decodeDocument(path, bytes) {
+    try {
+        const value = parseJson(bytes);
+        if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+            return storeError(path, 'is not a JSON object');
+        }
+        return value;
+    }
+    catch (error) {
+        if (error instanceof InvalidJsonError)
+            return storeError(path, 'is not valid JSON');
+        throw error;
+    }
+}
+function decodeContext(path, name, value) {
+    try {
+        const entry = exactRecord(value, ['issuer', 'home_id', 'key_id', 'label', 'created_at']);
+        const issuer = canonicalHttpsUrl(entry.issuer, 'issuer');
+        if (issuer.endsWith('/') || !isHomeId(entry.home_id) || !isRandomId(entry.key_id)) {
+            throw new InvalidJsonError();
+        }
+        return Object.freeze({
+            name,
+            issuer,
+            homeId: entry.home_id,
+            keyId: entry.key_id,
+            label: boundedString(entry.label, 1, 64),
+            createdAt: boundedString(entry.created_at, 1, 64),
+        });
+    }
+    catch {
+        return storeError(path, `holds an invalid context ${JSON.stringify(name)}`);
+    }
+}
+async function readSnapshot(directory) {
+    const configPath = join(directory, CONFIG_FILE);
+    const credentialsPath = join(directory, CREDENTIALS_FILE);
+    const contexts = new Map();
+    const keys = new Map();
+    let current = null;
+    const configBytes = await readStoreFile(configPath, false);
+    if (configBytes !== undefined) {
+        const document = decodeDocument(configPath, configBytes);
+        if (document.schema !== CONFIG_SCHEMA)
+            storeError(configPath, `does not declare ${CONFIG_SCHEMA}`);
+        let entries;
+        try {
+            exactRecord(document, ['schema', 'current_context', 'contexts']);
+            entries = exactRecord(document.contexts, [], Object.keys(document.contexts ?? {}));
+        }
+        catch {
+            return storeError(configPath, 'does not match the closed configuration schema');
+        }
+        const names = Object.keys(entries);
+        if (names.length > MAXIMUM_CONTEXTS)
+            storeError(configPath, 'holds too many contexts');
+        for (const name of names) {
+            if (!isContextName(name))
+                storeError(configPath, `holds an invalid context name ${JSON.stringify(name)}`);
+            contexts.set(name, decodeContext(configPath, name, entries[name]));
+        }
+        const selected = document.current_context;
+        if (selected !== null && (typeof selected !== 'string' || !contexts.has(selected))) {
+            storeError(configPath, 'names a current context it does not define');
+        }
+        current = selected;
+    }
+    const credentialBytes = await readStoreFile(credentialsPath, true);
+    if (credentialBytes !== undefined) {
+        const document = decodeDocument(credentialsPath, credentialBytes);
+        if (document.schema !== CREDENTIALS_SCHEMA) {
+            storeError(credentialsPath, `does not declare ${CREDENTIALS_SCHEMA}`);
+        }
+        let entries;
+        try {
+            exactRecord(document, ['schema', 'credentials']);
+            entries = exactRecord(document.credentials, [], Object.keys(document.credentials ?? {}));
+        }
+        catch {
+            return storeError(credentialsPath, 'does not match the closed credentials schema');
+        }
+        for (const [name, value] of Object.entries(entries)) {
+            let key;
+            try {
+                key = exactRecord(value, ['home_key']).home_key;
+            }
+            catch {
+                key = undefined;
+            }
+            if (typeof key !== 'string' || !HOME_KEY.test(key)) {
+                storeError(credentialsPath, `holds an invalid credential for ${JSON.stringify(name)}`);
+            }
+            keys.set(name, key);
+        }
+    }
+    return { current, contexts, keys };
+}
+function credentialStatus(snapshot, context) {
+    const key = snapshot.keys.get(context.name);
+    if (key === undefined)
+        return 'missing';
+    return HOME_KEY.exec(key)?.[1] === context.keyId ? 'stored' : 'mismatched';
+}
+/**
+ * Reads the safe half of the store, plus whether each key is present. A
+ * missing directory is an empty store. No Home Key leaves this function.
+ */
+export async function readContexts(directory) {
+    const snapshot = await readSnapshot(directory);
+    const credentials = new Map();
+    for (const context of snapshot.contexts.values()) {
+        credentials.set(context.name, credentialStatus(snapshot, context));
+    }
+    return { current: snapshot.current, contexts: snapshot.contexts, credentials };
+}
+/**
+ * Returns one context and its Home Key, or fails with a remedy.
+ *
+ * The key ID recorded at pairing time is compared with the stored key, so a
+ * credentials file edited by hand cannot silently attach another home's key to
+ * this context.
+ */
+export async function readCredential(directory, name) {
+    const snapshot = await readSnapshot(directory);
+    const context = snapshot.contexts.get(name);
+    if (context === undefined) {
+        const known = [...snapshot.contexts.keys()];
+        throw usageError(`No context named ${name}`, known.length === 0
+            ? 'No context is configured yet. Run miakapp pair to add one.'
+            : `Known contexts: ${known.join(', ')}. Run miakapp context list for details.`);
+    }
+    const homeKey = snapshot.keys.get(name);
+    const status = credentialStatus(snapshot, context);
+    if (homeKey === undefined || status === 'missing') {
+        throw authorizationError(`Context ${name} has no stored credential`, `Remove it with miakapp context remove ${name} and pair the home again.`);
+    }
+    if (status === 'mismatched') {
+        throw authorizationError(`The credential stored for ${name} is not the key ${context.keyId} it was paired with`, `Remove the context with miakapp context remove ${name} and pair the home again.`);
+    }
+    return { context, homeKey };
+}
+async function syncDirectory(directory) {
+    const fs = await import('node:fs/promises');
+    let handle;
+    try {
+        handle = await fs.open(directory, 'r');
+        await handle.sync();
+    }
+    catch {
+        // Not every platform can fsync a directory; the rename is still atomic.
+    }
+    finally {
+        await handle?.close();
+    }
+}
+/**
+ * Replaces one file atomically with a private one. The temporary name is
+ * random and opened exclusively, so a stale temporary from a crashed run can
+ * neither be reused nor followed.
+ */
+async function writeAtomic(directory, name, document) {
+    const fs = await import('node:fs/promises');
+    const target = join(directory, name);
+    const temporary = join(directory, `.${name}.${randomBytes(8).toString('hex')}.tmp`);
+    const handle = await fs.open(temporary, 'wx', 0o600);
+    try {
+        await handle.writeFile(`${JSON.stringify(document, null, 2)}\n`);
+        if (enforcesModes())
+            await handle.chmod(0o600);
+        await handle.sync();
+    }
+    catch (error) {
+        await handle.close();
+        await fs.rm(temporary, { force: true });
+        throw error;
+    }
+    await handle.close();
+    try {
+        await fs.rename(temporary, target);
+    }
+    catch (error) {
+        await fs.rm(temporary, { force: true });
+        throw error;
+    }
+    await syncDirectory(directory);
+}
+async function ensureDirectory(directory) {
+    const fs = await import('node:fs/promises');
+    await fs.mkdir(directory, { recursive: true, mode: 0o700 });
+    const status = await fs.lstat(directory);
+    if (!status.isDirectory()) {
+        throw authorizationError(`${directory} is not a directory (symbolic links are refused)`, `Move it aside, or point ${CONFIG_DIRECTORY_VARIABLE} at the real directory.`);
+    }
+    if (enforcesModes()) {
+        const uid = process.getuid?.();
+        if (uid !== undefined && status.uid !== uid) {
+            throw authorizationError(`${directory} is owned by another account`, 'Use a directory you own.');
+        }
+        if ((status.mode & 0o077) !== 0)
+            await fs.chmod(directory, 0o700);
+    }
+}
+async function acquireLock(directory) {
+    const fs = await import('node:fs/promises');
+    const path = join(directory, LOCK_FILE);
+    const deadline = Date.now() + LOCK_WAIT_MS;
+    while (true) {
+        try {
+            const handle = await fs.open(path, 'wx', 0o600);
+            await handle.writeFile(`${process.pid}\n`);
+            await handle.close();
+            return async () => {
+                await fs.rm(path, { force: true });
+            };
+        }
+        catch (error) {
+            if (errorCode(error) !== 'EEXIST')
+                throw error;
+        }
+        try {
+            const status = await fs.stat(path);
+            if (Date.now() - status.mtimeMs > LOCK_STALE_MS) {
+                await fs.rm(path, { force: true });
+                continue;
+            }
+        }
+        catch (error) {
+            if (errorCode(error) === 'ENOENT')
+                continue;
+            throw error;
+        }
+        if (Date.now() > deadline) {
+            throw authorizationError(`Another miakapp process holds ${path}`, 'Wait for it to finish. If none is running, delete the lock file.');
+        }
+        await new Promise((resolve) => setTimeout(resolve, 25));
+    }
+}
+/**
+ * Applies one change under the lock and writes both files.
+ *
+ * The credentials are written before the configuration, so a crash between the
+ * two leaves an unreferenced key rather than a context with no key. The next
+ * write drops any credential no context references.
+ */
+export async function mutateContexts(directory, change) {
+    await ensureDirectory(directory);
+    const release = await acquireLock(directory);
+    try {
+        const snapshot = await readSnapshot(directory);
+        const state = {
+            current: snapshot.current,
+            contexts: new Map(snapshot.contexts),
+            keys: new Map(snapshot.keys),
+        };
+        const result = change(state);
+        if (state.contexts.size > MAXIMUM_CONTEXTS) {
+            throw usageError(`At most ${MAXIMUM_CONTEXTS} contexts can be stored`);
+        }
+        if (state.current !== null && !state.contexts.has(state.current))
+            state.current = null;
+        const credentials = {};
+        const contexts = {};
+        for (const [name, context] of [...state.contexts].sort(([a], [b]) => (a < b ? -1 : 1))) {
+            const key = state.keys.get(name);
+            if (key !== undefined)
+                credentials[name] = { home_key: key };
+            contexts[name] = {
+                issuer: context.issuer,
+                home_id: context.homeId,
+                key_id: context.keyId,
+                label: context.label,
+                created_at: context.createdAt,
+            };
+        }
+        await writeAtomic(directory, CREDENTIALS_FILE, { schema: CREDENTIALS_SCHEMA, credentials });
+        await writeAtomic(directory, CONFIG_FILE, {
+            schema: CONFIG_SCHEMA,
+            current_context: state.current,
+            contexts,
+        });
+        return result;
+    }
+    finally {
+        await release();
+    }
+}
+//# sourceMappingURL=contexts.js.map

package/dist/contexts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contexts.js","sourceRoot":"","sources":["../src/contexts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC7F,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAE3D,MAAM,CAAC,MAAM,yBAAyB,GAAG,oBAAoB,CAAC;AAC9D,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC;AACzC,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AACnD,MAAM,CAAC,MAAM,aAAa,GAAG,sBAAsB,CAAC;AACpD,MAAM,CAAC,MAAM,kBAAkB,GAAG,2BAA2B,CAAC;AAE9D,MAAM,SAAS,GAAG,MAAM,CAAC;AACzB,MAAM,YAAY,GAAG,KAAK,CAAC;AAC3B,MAAM,aAAa,GAAG,MAAM,CAAC;AAC7B,MAAM,kBAAkB,GAAG,OAAO,CAAC;AACnC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,YAAY,GAAG,6BAA6B,CAAC;AACnD,MAAM,QAAQ,GAAG,gDAAgD,CAAC;AAuBlE,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,UAAU,CACd,wBAAwB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAC9C,oGAAoG,CACrG,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,GAAyC,EAAE,IAAY;IACrF,MAAM,QAAQ,GAAG,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC9C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,UAAU,CAAC,GAAG,yBAAyB,2BAA2B,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;AACtC,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK;QACnE,CAAC,CAAC,MAAM,CAAE,KAA2B,CAAC,IAAI,CAAC;QAC3C,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,OAAe;IAC/C,MAAM,kBAAkB,CACtB,GAAG,IAAI,IAAI,OAAO,EAAE,EACpB,2FAA2F;UACzF,0CAA0C,CAC7C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,MAAe;IACxD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACpD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;QAAE,UAAU,CAAC,IAAI,EAAE,oDAAoD,CAAC,CAAC;IAC7F,IAAI,MAAM,CAAC,IAAI,GAAG,kBAAkB;QAAE,UAAU,CAAC,IAAI,EAAE,kCAAkC,CAAC,CAAC;IAC3F,IAAI,aAAa,EAAE,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC/B,IAAI,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG;YAAE,UAAU,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;QAC7F,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,MAAM,kBAAkB,CACtB,GAAG,IAAI,0CAA0C,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EACrF,iBAAiB,IAAI,oEAAoE,CAC1F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,KAAiB;IACrD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,OAAO,UAAU,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,KAA0C,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,gBAAgB;YAAE,OAAO,UAAU,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QACpF,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,IAAY,EAAE,KAAc;IAC/D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QACzF,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACzD,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,gBAAgB,EAAE,CAAC;QAC/B,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,IAAI;YACJ,MAAM;YACN,MAAM,EAAE,KAAK,CAAC,OAAO;YACrB,KAAK,EAAE,KAAK,CAAC,MAAM;YACnB,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;SAClD,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAAC,IAAI,EAAE,4BAA4B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,SAAiB;IAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAChD,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,IAAI,OAAO,GAAkB,IAAI,CAAC;IAElC,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC3D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,cAAc,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACzD,IAAI,QAAQ,CAAC,MAAM,KAAK,aAAa;YAAE,UAAU,CAAC,UAAU,EAAE,oBAAoB,aAAa,EAAE,CAAC,CAAC;QACnG,IAAI,OAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,WAAW,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAC;YACjE,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;QACrF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,UAAU,CAAC,UAAU,EAAE,gDAAgD,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB;YAAE,UAAU,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAC;QACvF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;gBAAE,UAAU,CAAC,UAAU,EAAE,iCAAiC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1G,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,eAAe,CAAC;QAC1C,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YACnF,UAAU,CAAC,UAAU,EAAE,4CAA4C,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,GAAG,QAAyB,CAAC;IACtC,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,cAAc,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;QAClE,IAAI,QAAQ,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;YAC3C,UAAU,CAAC,eAAe,EAAE,oBAAoB,kBAAkB,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,OAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,WAAW,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;YACjD,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3F,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,UAAU,CAAC,eAAe,EAAE,8CAA8C,CAAC,CAAC;QACrF,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACpD,IAAI,GAAY,CAAC;YACjB,IAAI,CAAC;gBACH,GAAG,GAAG,WAAW,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;YAClD,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,GAAG,SAAS,CAAC;YAClB,CAAC;YACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnD,UAAU,CAAC,eAAe,EAAE,mCAAmC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzF,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAkB,EAAE,OAAsB;IAClE,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC;AAC7E,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,SAAiB;IAEjB,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,IAAI,GAAG,EAA4B,CAAC;IACxD,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACjD,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;AACjF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,SAAiB,EACjB,IAAY;IAEZ,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,UAAU,CACd,oBAAoB,IAAI,EAAE,EAC1B,KAAK,CAAC,MAAM,KAAK,CAAC;YAChB,CAAC,CAAC,4DAA4D;YAC9D,CAAC,CAAC,mBAAmB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,yCAAyC,CACjF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,kBAAkB,CACtB,WAAW,IAAI,2BAA2B,EAC1C,yCAAyC,IAAI,2BAA2B,CACzE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC5B,MAAM,kBAAkB,CACtB,6BAA6B,IAAI,mBAAmB,OAAO,CAAC,KAAK,qBAAqB,EACtF,kDAAkD,IAAI,2BAA2B,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,SAAiB;IAC5C,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACvC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;IAC1E,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,WAAW,CAAC,SAAiB,EAAE,IAAY,EAAE,QAAiB;IAC3E,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,aAAa,EAAE;YAAE,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,SAAiB;IAC9C,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC5C,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QAC1B,MAAM,kBAAkB,CACtB,GAAG,SAAS,kDAAkD,EAC9D,2BAA2B,yBAAyB,yBAAyB,CAC9E,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,EAAE,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC/B,IAAI,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YAC5C,MAAM,kBAAkB,CAAC,GAAG,SAAS,8BAA8B,EAAE,0BAA0B,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;YAAE,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,SAAiB;IAC1C,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;IAC3C,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAChD,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;YAC3C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,OAAO,KAAK,IAAI,EAAE;gBAChB,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACrC,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QACjD,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,GAAG,aAAa,EAAE,CAAC;gBAChD,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnC,SAAS;YACX,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ;gBAAE,SAAS;YAC5C,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC1B,MAAM,kBAAkB,CACtB,iCAAiC,IAAI,EAAE,EACvC,kEAAkE,CACnE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAQD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,SAAiB,EACjB,MAA8B;IAE9B,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAa;YACtB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,QAAQ,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACpC,IAAI,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;SAC7B,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,gBAAgB,EAAE,CAAC;YAC3C,MAAM,UAAU,CAAC,WAAW,gBAAgB,yBAAyB,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;YAAE,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;QAEvF,MAAM,WAAW,GAAyC,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAA4B,EAAE,CAAC;QAC7C,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,GAAG,KAAK,SAAS;gBAAE,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;YAC7D,QAAQ,CAAC,IAAI,CAAC,GAAG;gBACf,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,OAAO,EAAE,OAAO,CAAC,MAAM;gBACvB,MAAM,EAAE,OAAO,CAAC,KAAK;gBACrB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,UAAU,EAAE,OAAO,CAAC,SAAS;aAC9B,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,CAAC,SAAS,EAAE,gBAAgB,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,CAAC,CAAC;QAC5F,MAAM,WAAW,CAAC,SAAS,EAAE,WAAW,EAAE;YACxC,MAAM,EAAE,aAAa;YACrB,eAAe,EAAE,KAAK,CAAC,OAAO;YAC9B,QAAQ;SACT,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/control-plane.d.ts

@@ -6,7 +6,21 @@ export interface Discovery {
     readonly userRelayExchangeEndpoint: string;
     readonly pushAudience: string;
     readonly componentsAudience: string;
+    /**
+     * `https://<trusted web origin>/app?home={home_id}` when the deployment
+     * declares where residents open homes. The only source of a `home_url`; the
+     * artifact `url` is never a resident link.
+     */
+    readonly homeUrlTemplate?: string;
 }
+/**
+ * Accepts exactly `<canonical https origin>/app?home={home_id}`: no path, no
+ * credentials, no port games, nothing a server could use to point residents
+ * somewhere else under a plausible-looking link.
+ */
+export declare function parseHomeUrlTemplate(value: unknown): string;
+/** The trusted resident link for a home, or null when discovery names none. */
+export declare function homeUrl(discovery: Pick<Discovery, 'homeUrlTemplate'>, homeId: string): string | null;
 export interface PublisherToken {
     readonly accessToken: string;
     readonly expiresAtMs: number;

package/dist/control-plane.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"control-plane.d.ts","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AACA,OAAO,EAKL,KAAK,SAAS,EACf,MAAM,oBAAoB,CAAC;AAY5B,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC;IAC3C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;CAC5B;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAUjD;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,SAAS,CAAC,CAwCrF;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAA;CAAO,GAC3C,OAAO,CAAC,cAAc,CAAC,CA4DzB"}
+{"version":3,"file":"control-plane.d.ts","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AACA,OAAO,EAKL,KAAK,SAAS,EACf,MAAM,oBAAoB,CAAC;AAY5B,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC;IAC3C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAID;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAU3D;AAED,+EAA+E;AAC/E,wBAAgB,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIpG;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;CAC5B;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAUjD;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,SAAS,CAAC,CAiDrF;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAA;CAAO,GAC3C,OAAO,CAAC,cAAc,CAAC,CA4DzB"}

package/dist/control-plane.js

@@ -7,6 +7,29 @@ const MAXIMUM_DISCOVERY_BYTES = 4_096;
 const MAXIMUM_TOKEN_LIFETIME_MS = 330_000;
 const HOME_KEY = /^mhk1_([A-Za-z0-9_-]{22})_([A-Za-z0-9_-]{43})$/;
 const DISCOVERY_PATH = '/.well-known/miakapp-control-plane';
+const HOME_URL_SUFFIX = '/app?home={home_id}';
+/**
+ * Accepts exactly `<canonical https origin>/app?home={home_id}`: no path, no
+ * credentials, no port games, nothing a server could use to point residents
+ * somewhere else under a plausible-looking link.
+ */
+export function parseHomeUrlTemplate(value) {
+    if (typeof value !== 'string' || !value.endsWith(HOME_URL_SUFFIX)) {
+        throw contractError('home_url_template is not <origin>/app?home={home_id}');
+    }
+    const origin = value.slice(0, -HOME_URL_SUFFIX.length);
+    canonicalHttpsUrl(origin, 'home_url_template origin');
+    if (new URL(origin).origin !== origin) {
+        throw contractError('home_url_template must be rooted at a bare origin');
+    }
+    return value;
+}
+/** The trusted resident link for a home, or null when discovery names none. */
+export function homeUrl(discovery, homeId) {
+    return discovery.homeUrlTemplate === undefined
+        ? null
+        : discovery.homeUrlTemplate.replace('{home_id}', encodeURIComponent(homeId));
+}
 export function homeKeyId(homeKey) {
     const match = HOME_KEY.exec(homeKey);
     const keyId = match?.[1];
@@ -43,13 +66,19 @@ export async function fetchDiscovery(options) {
         'user_relay_exchange_endpoint',
         'push_audience',
         'components_audience',
-    ]);
+    ], ['runtime_diagnostics_endpoint', 'home_url_template']);
     if (document.schema !== 'miakapp.control-plane-discovery/1') {
         throw contractError('Discovery document has an unsupported schema');
     }
     if (document.issuer !== issuer) {
         throw contractError('Discovery document advertises a different issuer');
     }
+    // Optional, but never unchecked: it is still a location under this issuer.
+    if (document.runtime_diagnostics_endpoint !== undefined
+        && canonicalHttpsUrl(document.runtime_diagnostics_endpoint, 'runtime_diagnostics_endpoint')
+            !== `${issuer}/v1/runtime-diagnostics`) {
+        throw contractError('runtime_diagnostics_endpoint is not under this issuer');
+    }
     return Object.freeze({
         issuer,
         jwksUri: canonicalHttpsUrl(document.jwks_uri, 'jwks_uri'),
@@ -57,6 +86,9 @@ export async function fetchDiscovery(options) {
         userRelayExchangeEndpoint: canonicalHttpsUrl(document.user_relay_exchange_endpoint, 'user_relay_exchange_endpoint'),
         pushAudience: canonicalHttpsUrl(document.push_audience, 'push_audience'),
         componentsAudience: canonicalHttpsUrl(document.components_audience, 'components_audience'),
+        ...(document.home_url_template === undefined
+            ? {}
+            : { homeUrlTemplate: parseHomeUrlTemplate(document.home_url_template) }),
     });
 }
 /**

package/dist/control-plane.js.map

@@ -1 +1 @@
-{"version":3,"file":"control-plane.js","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EACL,iBAAiB,EACjB,UAAU,EACV,eAAe,EACf,WAAW,GAEZ,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE3E,wDAAwD;AACxD,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAEtC,sEAAsE;AACtE,MAAM,yBAAyB,GAAG,OAAO,CAAC;AAE1C,MAAM,QAAQ,GAAG,gDAAgD,CAAC;AAClE,MAAM,cAAc,GAAG,oCAAoC,CAAC;AAuB5D,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,kBAAkB,CACtB,6CAA6C,EAC7C,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA4B;IAC/D,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,aAAa,CAAC,uCAAuC,CAAC,CAAC;IACvF,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,GAAG,cAAc,EAAE,EAAE;QAC3D,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACvC,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,UAAU,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,aAAa,CAAC,oCAAoC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QAC5C,QAAQ;QACR,QAAQ;QACR,UAAU;QACV,mBAAmB;QACnB,8BAA8B;QAC9B,eAAe;QACf,qBAAqB;KACtB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,KAAK,mCAAmC,EAAE,CAAC;QAC5D,MAAM,aAAa,CAAC,8CAA8C,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,aAAa,CAAC,kDAAkD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM;QACN,OAAO,EAAE,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;QACzD,gBAAgB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;QACpF,yBAAyB,EAAE,iBAAiB,CAC1C,QAAQ,CAAC,4BAA4B,EACrC,8BAA8B,CAC/B;QACD,YAAY,EAAE,iBAAiB,CAAC,QAAQ,CAAC,aAAa,EAAE,eAAe,CAAC;QACxE,kBAAkB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;KAC3F,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAAoB,EACpB,OAAe,EACf,OAAO,GAAmC,EAAE;IAE5C,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,gBAAgB,EAAE;QACzD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,OAAO,EAAE;YAClC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,WAAW,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QAC5C,2EAA2E;QAC3E,0EAA0E;QAC1E,gEAAgE;QAChE,WAAW,EAAE,MAAM;QACnB,QAAQ,EAAE,OAAO;QACjB,cAAc,EAAE,aAAa;KAC9B,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,UAAU,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,kBAAkB,CACtB,0CAA0C,QAAQ,CAAC,MAAM,EAAE,EAC3D,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,UAAU;WACnD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,UAAU;WAC7C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,aAAa,EAAE,CAAC;QAC/D,UAAU,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,aAAa,CAAC,mEAAmE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QAC5C,QAAQ;QACR,cAAc;QACd,YAAY;QACZ,eAAe;QACf,KAAK;KACN,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,MAAM,WAAW,GAAG,aAAa,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IACnE,MAAM,WAAW,GAAG,QAAQ,CAAC,aAAa,CAAC;IAC3C,IAAI,QAAQ,CAAC,MAAM,KAAK,wBAAwB;WAC3C,QAAQ,CAAC,UAAU,KAAK,QAAQ;WAChC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;WACnC,OAAO,WAAW,KAAK,QAAQ;WAC/B,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC;WAClC,GAAG,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,aAAa,CAAC,oEAAoE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,WAAW,IAAI,GAAG,IAAI,WAAW,GAAG,GAAG,GAAG,yBAAyB,EAAE,CAAC;QACxE,MAAM,aAAa,CAAC,yEAAyE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,WAAW;QACX,WAAW;QACX,KAAK;QACL,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;KAC1C,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"control-plane.js","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EACL,iBAAiB,EACjB,UAAU,EACV,eAAe,EACf,WAAW,GAEZ,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE3E,wDAAwD;AACxD,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAEtC,sEAAsE;AACtE,MAAM,yBAAyB,GAAG,OAAO,CAAC;AAE1C,MAAM,QAAQ,GAAG,gDAAgD,CAAC;AAClE,MAAM,cAAc,GAAG,oCAAoC,CAAC;AAiB5D,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAE9C;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAClE,MAAM,aAAa,CAAC,sDAAsD,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IACvD,iBAAiB,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;IACtD,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACtC,MAAM,aAAa,CAAC,mDAAmD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,OAAO,CAAC,SAA6C,EAAE,MAAc;IACnF,OAAO,SAAS,CAAC,eAAe,KAAK,SAAS;QAC5C,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,OAAO,CAAC,WAAW,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;AACjF,CAAC;AAcD,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,kBAAkB,CACtB,6CAA6C,EAC7C,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA4B;IAC/D,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,aAAa,CAAC,uCAAuC,CAAC,CAAC;IACvF,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,GAAG,cAAc,EAAE,EAAE;QAC3D,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACvC,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,UAAU,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,aAAa,CAAC,oCAAoC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QAC5C,QAAQ;QACR,QAAQ;QACR,UAAU;QACV,mBAAmB;QACnB,8BAA8B;QAC9B,eAAe;QACf,qBAAqB;KACtB,EAAE,CAAC,8BAA8B,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAC1D,IAAI,QAAQ,CAAC,MAAM,KAAK,mCAAmC,EAAE,CAAC;QAC5D,MAAM,aAAa,CAAC,8CAA8C,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,aAAa,CAAC,kDAAkD,CAAC,CAAC;IAC1E,CAAC;IACD,2EAA2E;IAC3E,IAAI,QAAQ,CAAC,4BAA4B,KAAK,SAAS;WAClD,iBAAiB,CAAC,QAAQ,CAAC,4BAA4B,EAAE,8BAA8B,CAAC;gBACrF,GAAG,MAAM,yBAAyB,EAAE,CAAC;QAC3C,MAAM,aAAa,CAAC,uDAAuD,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM;QACN,OAAO,EAAE,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;QACzD,gBAAgB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;QACpF,yBAAyB,EAAE,iBAAiB,CAC1C,QAAQ,CAAC,4BAA4B,EACrC,8BAA8B,CAC/B;QACD,YAAY,EAAE,iBAAiB,CAAC,QAAQ,CAAC,aAAa,EAAE,eAAe,CAAC;QACxE,kBAAkB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;QAC1F,GAAG,CAAC,QAAQ,CAAC,iBAAiB,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,eAAe,EAAE,oBAAoB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;KAC3E,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAAoB,EACpB,OAAe,EACf,OAAO,GAAmC,EAAE;IAE5C,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,gBAAgB,EAAE;QACzD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,OAAO,EAAE;YAClC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,WAAW,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QAC5C,2EAA2E;QAC3E,0EAA0E;QAC1E,gEAAgE;QAChE,WAAW,EAAE,MAAM;QACnB,QAAQ,EAAE,OAAO;QACjB,cAAc,EAAE,aAAa;KAC9B,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,UAAU,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,kBAAkB,CACtB,0CAA0C,QAAQ,CAAC,MAAM,EAAE,EAC3D,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,UAAU;WACnD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,UAAU;WAC7C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,aAAa,EAAE,CAAC;QAC/D,UAAU,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,aAAa,CAAC,mEAAmE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QAC5C,QAAQ;QACR,cAAc;QACd,YAAY;QACZ,eAAe;QACf,KAAK;KACN,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,MAAM,WAAW,GAAG,aAAa,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IACnE,MAAM,WAAW,GAAG,QAAQ,CAAC,aAAa,CAAC;IAC3C,IAAI,QAAQ,CAAC,MAAM,KAAK,wBAAwB;WAC3C,QAAQ,CAAC,UAAU,KAAK,QAAQ;WAChC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;WACnC,OAAO,WAAW,KAAK,QAAQ;WAC/B,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC;WAClC,GAAG,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,aAAa,CAAC,oEAAoE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,WAAW,IAAI,GAAG,IAAI,WAAW,GAAG,GAAG,GAAG,yBAAyB,EAAE,CAAC;QACxE,MAAM,aAAa,CAAC,yEAAyE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,WAAW;QACX,WAAW;QACX,KAAK;QACL,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;KAC1C,CAAC,CAAC;AACL,CAAC"}

package/dist/internal/names.d.ts

@@ -1,5 +1,10 @@
 /** RFC 0002 §7.1 caps the artifact at 2 MiB decoded. */
 export declare const MAXIMUM_ARTIFACT_BYTES = 2097152;
+/** RFC 0002 semantic component and whole-house application (house-app ABI spec). */
+export declare const COMPONENT_ABI = "miakapp.component/1";
+export declare const APP_ABI = "miakapp.app/1";
+export type ReleaseAbi = typeof COMPONENT_ABI | typeof APP_ABI;
+export declare function isReleaseAbi(value: unknown): value is ReleaseAbi;
 /** RFC 0002 §10 aborts tokenization beyond this program ceiling. */
 export declare const MAXIMUM_PROGRAM_TOKENS = 100000;
 /**

package/dist/internal/names.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"names.d.ts","sourceRoot":"","sources":["../../src/internal/names.ts"],"names":[],"mappings":"AAYA,wDAAwD;AACxD,eAAO,MAAM,sBAAsB,UAAY,CAAC;AAEhD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,SAAU,CAAC;AAE9C;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,MAAM,CAAC;AAEjD,eAAO,MAAM,iBAAiB,YAC5B,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,MAAM,EACN,cAAc,CACN,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,IAAI,IAAI,eAAe,GAAG,SAAS,MAAM,EAAE;CACtD,CAAC;AAEF,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAExD;AAED,gFAAgF;AAChF,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAE1D;AAED,oFAAoF;AACpF,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAE7D;AAED,yEAAyE;AACzE,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAExD;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAIxE;AAED,0DAA0D;AAC1D,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAIzD;AAED,+CAA+C;AAC/C,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAE5D;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAO5D;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAKpE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEpE;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAEjF"}
+{"version":3,"file":"names.d.ts","sourceRoot":"","sources":["../../src/internal/names.ts"],"names":[],"mappings":"AAYA,wDAAwD;AACxD,eAAO,MAAM,sBAAsB,UAAY,CAAC;AAEhD,oFAAoF;AACpF,eAAO,MAAM,aAAa,wBAAwB,CAAC;AACnD,eAAO,MAAM,OAAO,kBAAkB,CAAC;AACvC,MAAM,MAAM,UAAU,GAAG,OAAO,aAAa,GAAG,OAAO,OAAO,CAAC;AAE/D,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAEhE;AAED,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,SAAU,CAAC;AAE9C;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,MAAM,CAAC;AAEjD,eAAO,MAAM,iBAAiB,YAC5B,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,MAAM,EACN,cAAc,CACN,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,IAAI,IAAI,eAAe,GAAG,SAAS,MAAM,EAAE;CACtD,CAAC;AAEF,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAExD;AAED,gFAAgF;AAChF,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAE1D;AAED,oFAAoF;AACpF,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAE7D;AAED,yEAAyE;AACzE,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAExD;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAIxE;AAED,0DAA0D;AAC1D,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAIzD;AAED,+CAA+C;AAC/C,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAE5D;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAO5D;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAKpE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEpE;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAEjF"}

package/dist/internal/names.js

@@ -10,6 +10,12 @@ const BASE64URL = /^[A-Za-z0-9_-]+$/;
 const PRESENTATION_HANDLE = /^media\.[^.]/;
 /** RFC 0002 §7.1 caps the artifact at 2 MiB decoded. */
 export const MAXIMUM_ARTIFACT_BYTES = 2_097_152;
+/** RFC 0002 semantic component and whole-house application (house-app ABI spec). */
+export const COMPONENT_ABI = 'miakapp.component/1';
+export const APP_ABI = 'miakapp.app/1';
+export function isReleaseAbi(value) {
+    return value === COMPONENT_ABI || value === APP_ABI;
+}
 /** RFC 0002 §10 aborts tokenization beyond this program ceiling. */
 export const MAXIMUM_PROGRAM_TOKENS = 100_000;
 /**

package/dist/internal/names.js.map

@@ -1 +1 @@
-{"version":3,"file":"names.js","sourceRoot":"","sources":["../../src/internal/names.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,SAAS,CAAC;AACpC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;AAE/B,MAAM,OAAO,GAAG,gCAAgC,CAAC;AACjD,MAAM,SAAS,GAAG,kBAAkB,CAAC;AACrC,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAE3C,wDAAwD;AACxD,MAAM,CAAC,MAAM,sBAAsB,GAAG,SAAS,CAAC;AAEhD,oEAAoE;AACpE,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAG,CAAC;AAEjD,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,YAAY;IACZ,iBAAiB;IACjB,eAAe;IACf,MAAM;IACN,cAAc;CACN,CAAC;AAQX,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;AAChF,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,kBAAkB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,kBAAkB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,KAAa;IAC7D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,OAAO,OAAO,CAAC,UAAU,KAAK,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK,CAAC;AACjF,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7E,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;AACnC,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;AAC/E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC;IAC3C,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClC,OAAO,SAAS,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAqB,EAAE,KAAc;IACtE,OAAO,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;AAC7F,CAAC"}
+{"version":3,"file":"names.js","sourceRoot":"","sources":["../../src/internal/names.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,SAAS,CAAC;AACpC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;AAE/B,MAAM,OAAO,GAAG,gCAAgC,CAAC;AACjD,MAAM,SAAS,GAAG,kBAAkB,CAAC;AACrC,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAE3C,wDAAwD;AACxD,MAAM,CAAC,MAAM,sBAAsB,GAAG,SAAS,CAAC;AAEhD,oFAAoF;AACpF,MAAM,CAAC,MAAM,aAAa,GAAG,qBAAqB,CAAC;AACnD,MAAM,CAAC,MAAM,OAAO,GAAG,eAAe,CAAC;AAGvC,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,OAAO,CAAC;AACtD,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAG,CAAC;AAEjD,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,YAAY;IACZ,iBAAiB;IACjB,eAAe;IACf,MAAM;IACN,cAAc;CACN,CAAC;AAQX,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;AAChF,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,kBAAkB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,kBAAkB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,KAAa;IAC7D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,OAAO,OAAO,CAAC,UAAU,KAAK,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK,CAAC;AACjF,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7E,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;AACnC,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;AAC/E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC;IAC3C,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClC,OAAO,SAAS,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAqB,EAAE,KAAc;IACtE,OAAO,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;AAC7F,CAAC"}

package/dist/main.d.ts

@@ -1,11 +1,15 @@
+import { CLI_VERSION } from './version.js';
 import type { FetchLike } from './internal/http.js';
-export declare const CLI_VERSION = "4.0.0-alpha.0";
+export { CLI_VERSION };
 /**
- * The Home Key is read from the environment only. A secret passed as an
- * argument would land in shell history, in a process listing and in most CI
- * logs, so no command accepts one.
+ * A Home Key comes from a paired context in `~/.miakapp` or, for CI and
+ * compatibility, from this variable. A secret passed as an argument would land
+ * in shell history, in a process listing and in most CI logs, so no command
+ * accepts one.
  */
 export declare const HOME_KEY_VARIABLE = "MIAKAPP_HOME_KEY";
+/** Selects a stored context for one invocation, like `--context`. */
+export declare const CONTEXT_VARIABLE = "MIAKAPP_CONTEXT";
 export interface FileSystem {
     read(path: string): Promise<Uint8Array>;
     /** Creates. Fails if the path exists: no command may clobber by accident. */
@@ -33,12 +37,24 @@ export interface CliHost {
     fetch?: FetchLike;
     /** Read only by `mcp`, which serves a request stream instead of one command. */
     input?: AsyncIterable<Uint8Array>;
+    /** Parent of `.miakapp`. Injected by tests; defaults to the account's home. */
+    homeDirectory?(): string;
+    /** Names the machine in a default key label. Defaults to the OS host name. */
+    hostname?(): string;
+    /**
+     * Reads one secret line without echoing it: a hidden prompt on a terminal,
+     * the first line of a pipe otherwise. Absent under MCP, whose stdin is the
+     * protocol stream.
+     */
+    readSecret?(prompt: string): Promise<string>;
 }
 type Field = readonly [key: string, value: string | number | readonly string[]];
 export interface CommandResult {
     readonly summary: string;
     readonly fields: readonly Field[];
     readonly json: Record<string, unknown>;
+    /** Complete human-facing document for commands such as `docs start`. */
+    readonly text?: string;
 }
 export interface Invocation {
     readonly command: string;
@@ -67,6 +83,8 @@ export declare function parseArguments(argv: readonly string[]): Invocation;
  * fixture at a path the command never opens would prove nothing.
  */
 export declare function guideAssetPath(): Promise<string>;
+/** Directory of the design files (`tokens.css`, `gallery.html`…), resolved like the guide. */
+export declare function designAssetDirectory(): Promise<string>;
 /**
  * Runs one parsed invocation.
  *
@@ -82,5 +100,4 @@ export declare function dispatch(host: CliHost, invocation: Invocation): Promise
  * the control plane was left untouched.
  */
 export declare function run(argv: readonly string[], host: CliHost): Promise<number>;
-export {};
 //# sourceMappingURL=main.d.ts.map