@miakapp/cli 4.0.0-alpha.3 → 4.0.0-alpha.5

package/dist/artifact.js

@@ -0,0 +1,328 @@
+import { createHash } from 'node:crypto';
+import { artifactError } from './errors.js';
+import { MAXIMUM_ARTIFACT_BYTES, MAXIMUM_PROGRAM_TOKENS, } from './internal/names.js';
+const IDENTIFIER_START = /[$_\p{ID_Start}]/u;
+const IDENTIFIER_PART = /[$_\u200c\u200d\p{ID_Continue}]/u;
+/**
+ * Tokens after which a `/` starts a regular expression rather than a division.
+ * The list is deliberately conservative: a wrong guess only changes how the
+ * scanner counts, never whether the broker's pinned parser accepts the program.
+ */
+const REGEX_ALLOWED_AFTER = new Set([
+    'case', 'delete', 'do', 'else', 'in', 'instanceof', 'new', 'of', 'return',
+    'throw', 'typeof', 'void', 'yield',
+]);
+function isRegexPosition(previous) {
+    if (previous === undefined)
+        return true;
+    if (REGEX_ALLOWED_AFTER.has(previous))
+        return true;
+    if (/^[A-Za-z_$]/.test(previous))
+        return false;
+    if (/^[0-9]/.test(previous))
+        return false;
+    return previous !== ')' && previous !== ']' && previous !== '}' && previous !== '++'
+        && previous !== '--' && previous[0] !== '"' && previous[0] !== "'" && previous[0] !== '`';
+}
+/**
+ * Publisher pre-check for the RFC 0002 §7.2 artifact rules.
+ *
+ * RFC 0002 makes the broker's pinned platform parser authoritative; this scan
+ * exists so an agent learns about module syntax, a dynamic import, a source-map
+ * directive or an oversized program before spending an upload capability. It
+ * reports findings rather than throwing, so one run can show every problem.
+ */
+export function scanArtifactSource(source) {
+    const findings = [];
+    let index = 0;
+    let line = 1;
+    let tokens = 0;
+    let previous;
+    let lineStartOnlyWhitespace = true;
+    const record = (kind, detail) => {
+        if (findings.some((finding) => finding.kind === kind && finding.line === line))
+            return;
+        findings.push({ kind, line, detail });
+    };
+    const advanceLines = (text) => {
+        for (const character of text)
+            if (character === '\n')
+                line += 1;
+    };
+    while (index < source.length) {
+        const character = source[index];
+        if (character === '\n') {
+            line += 1;
+            lineStartOnlyWhitespace = true;
+            index += 1;
+            continue;
+        }
+        if (character === ' ' || character === '\t' || character === '\r' || character === '\f'
+            || character === '\v' || character === '\u00a0' || character === '\ufeff') {
+            index += 1;
+            continue;
+        }
+        if (character === '/' && source[index + 1] === '/') {
+            const end = source.indexOf('\n', index);
+            const comment = source.slice(index, end === -1 ? source.length : end);
+            if (/^\/\/[#@]\s*sourceMappingURL=/.test(comment)) {
+                record('source_map_directive', comment.trim());
+            }
+            index = end === -1 ? source.length : end;
+            continue;
+        }
+        if (character === '/' && source[index + 1] === '*') {
+            const end = source.indexOf('*/', index + 2);
+            if (end === -1) {
+                record('unterminated', 'Unterminated block comment');
+                break;
+            }
+            const comment = source.slice(index, end + 2);
+            if (/^\/\*[#@]\s*sourceMappingURL=/.test(comment)) {
+                record('source_map_directive', comment.slice(0, 64));
+            }
+            advanceLines(comment);
+            index = end + 2;
+            continue;
+        }
+        if (character === '"' || character === "'") {
+            const end = scanQuoted(source, index, character);
+            if (end === -1) {
+                record('unterminated', 'Unterminated string literal');
+                break;
+            }
+            advanceLines(source.slice(index, end));
+            previous = `${character}string`;
+            tokens += 1;
+            index = end;
+            lineStartOnlyWhitespace = false;
+            continue;
+        }
+        if (character === '`') {
+            const end = scanTemplate(source, index);
+            if (end === -1) {
+                record('unterminated', 'Unterminated template literal');
+                break;
+            }
+            advanceLines(source.slice(index, end));
+            previous = '`template';
+            tokens += 1;
+            index = end;
+            lineStartOnlyWhitespace = false;
+            continue;
+        }
+        if (character === '/' && isRegexPosition(previous)) {
+            const end = scanRegex(source, index);
+            if (end === -1) {
+                record('unterminated', 'Unterminated regular expression literal');
+                break;
+            }
+            previous = '/regex';
+            tokens += 1;
+            index = end;
+            lineStartOnlyWhitespace = false;
+            continue;
+        }
+        if (IDENTIFIER_START.test(character)) {
+            let end = index + 1;
+            while (end < source.length && IDENTIFIER_PART.test(source[end]))
+                end += 1;
+            const word = source.slice(index, end);
+            if (word === 'import') {
+                const next = nextSignificant(source, end);
+                if (next === '(')
+                    record('dynamic_import', 'import( expression');
+                else if (next === '.')
+                    record('dynamic_import', 'import.meta reference');
+                else
+                    record('module_syntax', 'import declaration');
+            }
+            else if (word === 'export' && lineStartOnlyWhitespace) {
+                record('module_syntax', 'export declaration');
+            }
+            previous = word;
+            tokens += 1;
+            index = end;
+            lineStartOnlyWhitespace = false;
+            continue;
+        }
+        if (character >= '0' && character <= '9') {
+            let end = index + 1;
+            while (end < source.length && /[0-9a-fA-FxXoObBn._]/.test(source[end]))
+                end += 1;
+            previous = source.slice(index, end);
+            tokens += 1;
+            index = end;
+            lineStartOnlyWhitespace = false;
+            continue;
+        }
+        const punctuator = scanPunctuator(source, index);
+        previous = punctuator;
+        tokens += 1;
+        index += punctuator.length;
+        lineStartOnlyWhitespace = false;
+        if (tokens > MAXIMUM_PROGRAM_TOKENS)
+            break;
+    }
+    if (tokens > MAXIMUM_PROGRAM_TOKENS) {
+        findings.push({
+            kind: 'token_ceiling',
+            line,
+            detail: `Program exceeds the ABI 1 ceiling of ${MAXIMUM_PROGRAM_TOKENS} lexical tokens`,
+        });
+    }
+    return { tokens, findings };
+}
+function scanQuoted(source, start, quote) {
+    let index = start + 1;
+    while (index < source.length) {
+        const character = source[index];
+        if (character === '\\') {
+            index += 2;
+            continue;
+        }
+        if (character === quote)
+            return index + 1;
+        if (character === '\n')
+            return -1;
+        index += 1;
+    }
+    return -1;
+}
+function scanTemplate(source, start) {
+    let index = start + 1;
+    while (index < source.length) {
+        const character = source[index];
+        if (character === '\\') {
+            index += 2;
+            continue;
+        }
+        if (character === '`')
+            return index + 1;
+        if (character === '$' && source[index + 1] === '{') {
+            let depth = 1;
+            index += 2;
+            while (index < source.length && depth > 0) {
+                const inner = source[index];
+                if (inner === '{')
+                    depth += 1;
+                else if (inner === '}')
+                    depth -= 1;
+                else if (inner === '`') {
+                    const nested = scanTemplate(source, index);
+                    if (nested === -1)
+                        return -1;
+                    index = nested;
+                    continue;
+                }
+                else if (inner === '"' || inner === "'") {
+                    const nested = scanQuoted(source, index, inner);
+                    if (nested === -1)
+                        return -1;
+                    index = nested;
+                    continue;
+                }
+                index += 1;
+            }
+            continue;
+        }
+        index += 1;
+    }
+    return -1;
+}
+function scanRegex(source, start) {
+    let index = start + 1;
+    let inClass = false;
+    while (index < source.length) {
+        const character = source[index];
+        if (character === '\\') {
+            index += 2;
+            continue;
+        }
+        if (character === '\n')
+            return -1;
+        if (character === '[')
+            inClass = true;
+        else if (character === ']')
+            inClass = false;
+        else if (character === '/' && !inClass) {
+            index += 1;
+            while (index < source.length && IDENTIFIER_PART.test(source[index]))
+                index += 1;
+            return index;
+        }
+        index += 1;
+    }
+    return -1;
+}
+const PUNCTUATORS = [
+    '>>>=', '...', '===', '!==', '**=', '<<=', '>>=', '>>>', '&&=', '||=', '??=',
+    '=>', '==', '!=', '<=', '>=', '&&', '||', '??', '?.', '++', '--', '+=', '-=',
+    '*=', '/=', '%=', '&=', '|=', '^=', '<<', '>>', '**',
+];
+function scanPunctuator(source, index) {
+    for (const punctuator of PUNCTUATORS) {
+        if (source.startsWith(punctuator, index))
+            return punctuator;
+    }
+    return source[index];
+}
+function nextSignificant(source, from) {
+    let index = from;
+    while (index < source.length) {
+        const character = source[index];
+        if (/\s/.test(character)) {
+            index += 1;
+            continue;
+        }
+        if (character === '/' && source[index + 1] === '/') {
+            const end = source.indexOf('\n', index);
+            if (end === -1)
+                return undefined;
+            index = end + 1;
+            continue;
+        }
+        if (character === '/' && source[index + 1] === '*') {
+            const end = source.indexOf('*/', index + 2);
+            if (end === -1)
+                return undefined;
+            index = end + 2;
+            continue;
+        }
+        return character;
+    }
+    return undefined;
+}
+/**
+ * Verifies the exact bytes an upload would deliver and derives the digest and
+ * size that bind the upload capability.
+ */
+export function prepareArtifact(bytes) {
+    if (bytes.byteLength === 0)
+        throw artifactError('Artifact is empty');
+    if (bytes.byteLength > MAXIMUM_ARTIFACT_BYTES) {
+        throw artifactError(`Artifact is ${bytes.byteLength} bytes, above the ABI 1 ceiling of ${MAXIMUM_ARTIFACT_BYTES}`);
+    }
+    let source;
+    try {
+        source = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+    }
+    catch {
+        throw artifactError('Artifact is not valid UTF-8');
+    }
+    const { tokens, findings } = scanArtifactSource(source);
+    if (findings.length > 0) {
+        const detail = findings
+            .map((finding) => `  line ${finding.line}: ${finding.kind} — ${finding.detail}`)
+            .join('\n');
+        throw artifactError(`Artifact violates the RFC 0002 §7.2 artifact rules:\n${detail}`, 'Bundle to one self-contained classic Worker program with no module syntax, '
+            + 'no dynamic import and no source map.');
+    }
+    return Object.freeze({
+        bytes,
+        sha256: createHash('sha256').update(bytes).digest('base64url'),
+        size: bytes.byteLength,
+        tokens,
+    });
+}
+//# sourceMappingURL=artifact.js.map

package/dist/artifact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact.js","sourceRoot":"","sources":["../src/artifact.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAwB7B,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAC7C,MAAM,eAAe,GAAG,kCAAkC,CAAC;AAE3D;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ;IACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO;CACnC,CAAC,CAAC;AAEH,SAAS,eAAe,CAAC,QAA4B;IACnD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,IAAI;WAC/E,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;AAC9F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAI/C,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,QAA4B,CAAC;IACjC,IAAI,uBAAuB,GAAG,IAAI,CAAC;IAEnC,MAAM,MAAM,GAAG,CAAC,IAAyB,EAAE,MAAc,EAAQ,EAAE;QACjE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO;QACvF,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,CAAC,IAAY,EAAQ,EAAE;QAC1C,KAAK,MAAM,SAAS,IAAI,IAAI;YAAE,IAAI,SAAS,KAAK,IAAI;gBAAE,IAAI,IAAI,CAAC,CAAC;IAClE,CAAC,CAAC;IAEF,OAAO,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAW,CAAC;QAC1C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,IAAI,IAAI,CAAC,CAAC;YACV,uBAAuB,GAAG,IAAI,CAAC;YAC/B,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI;eAClF,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC5E,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,GAAG,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACnD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACxC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACtE,IAAI,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClD,MAAM,CAAC,sBAAsB,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACjD,CAAC;YACD,KAAK,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;YACzC,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,GAAG,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACnD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC5C,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,MAAM,CAAC,cAAc,EAAE,4BAA4B,CAAC,CAAC;gBACrD,MAAM;YACR,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;YAC7C,IAAI,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClD,MAAM,CAAC,sBAAsB,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YACvD,CAAC;YACD,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,KAAK,GAAG,GAAG,GAAG,CAAC,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YAC3C,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YACjD,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,MAAM,CAAC,cAAc,EAAE,6BAA6B,CAAC,CAAC;gBACtD,MAAM;YACR,CAAC;YACD,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;YACvC,QAAQ,GAAG,GAAG,SAAS,QAAQ,CAAC;YAChC,MAAM,IAAI,CAAC,CAAC;YACZ,KAAK,GAAG,GAAG,CAAC;YACZ,uBAAuB,GAAG,KAAK,CAAC;YAChC,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACxC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,MAAM,CAAC,cAAc,EAAE,+BAA+B,CAAC,CAAC;gBACxD,MAAM;YACR,CAAC;YACD,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;YACvC,QAAQ,GAAG,WAAW,CAAC;YACvB,MAAM,IAAI,CAAC,CAAC;YACZ,KAAK,GAAG,GAAG,CAAC;YACZ,uBAAuB,GAAG,KAAK,CAAC;YAChC,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,GAAG,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnD,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACrC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,MAAM,CAAC,cAAc,EAAE,yCAAyC,CAAC,CAAC;gBAClE,MAAM;YACR,CAAC;YACD,QAAQ,GAAG,QAAQ,CAAC;YACpB,MAAM,IAAI,CAAC,CAAC;YACZ,KAAK,GAAG,GAAG,CAAC;YACZ,uBAAuB,GAAG,KAAK,CAAC;YAChC,SAAS;QACX,CAAC;QACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,IAAI,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC;YACpB,OAAO,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAW,CAAC;gBAAE,GAAG,IAAI,CAAC,CAAC;YACpF,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACtC,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;gBAC1C,IAAI,IAAI,KAAK,GAAG;oBAAE,MAAM,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,CAAC;qBAC5D,IAAI,IAAI,KAAK,GAAG;oBAAE,MAAM,CAAC,gBAAgB,EAAE,uBAAuB,CAAC,CAAC;;oBACpE,MAAM,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC;YACrD,CAAC;iBAAM,IAAI,IAAI,KAAK,QAAQ,IAAI,uBAAuB,EAAE,CAAC;gBACxD,MAAM,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC;YAChD,CAAC;YACD,QAAQ,GAAG,IAAI,CAAC;YAChB,MAAM,IAAI,CAAC,CAAC;YACZ,KAAK,GAAG,GAAG,CAAC;YACZ,uBAAuB,GAAG,KAAK,CAAC;YAChC,SAAS;QACX,CAAC;QACD,IAAI,SAAS,IAAI,GAAG,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;YACzC,IAAI,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC;YACpB,OAAO,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAW,CAAC;gBAAE,GAAG,IAAI,CAAC,CAAC;YAC3F,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACpC,MAAM,IAAI,CAAC,CAAC;YACZ,KAAK,GAAG,GAAG,CAAC;YACZ,uBAAuB,GAAG,KAAK,CAAC;YAChC,SAAS;QACX,CAAC;QACD,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACjD,QAAQ,GAAG,UAAU,CAAC;QACtB,MAAM,IAAI,CAAC,CAAC;QACZ,KAAK,IAAI,UAAU,CAAC,MAAM,CAAC;QAC3B,uBAAuB,GAAG,KAAK,CAAC;QAChC,IAAI,MAAM,GAAG,sBAAsB;YAAE,MAAM;IAC7C,CAAC;IAED,IAAI,MAAM,GAAG,sBAAsB,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,eAAe;YACrB,IAAI;YACJ,MAAM,EAAE,wCAAwC,sBAAsB,iBAAiB;SACxF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,UAAU,CAAC,MAAc,EAAE,KAAa,EAAE,KAAa;IAC9D,IAAI,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC;IACtB,OAAO,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,KAAK;YAAE,OAAO,KAAK,GAAG,CAAC,CAAC;QAC1C,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,CAAC;QAClC,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,SAAS,YAAY,CAAC,MAAc,EAAE,KAAa;IACjD,IAAI,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC;IACtB,OAAO,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,GAAG;YAAE,OAAO,KAAK,GAAG,CAAC,CAAC;QACxC,IAAI,SAAS,KAAK,GAAG,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACnD,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,KAAK,IAAI,CAAC,CAAC;YACX,OAAO,KAAK,GAAG,MAAM,CAAC,MAAM,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC5B,IAAI,KAAK,KAAK,GAAG;oBAAE,KAAK,IAAI,CAAC,CAAC;qBACzB,IAAI,KAAK,KAAK,GAAG;oBAAE,KAAK,IAAI,CAAC,CAAC;qBAC9B,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;oBACvB,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;oBAC3C,IAAI,MAAM,KAAK,CAAC,CAAC;wBAAE,OAAO,CAAC,CAAC,CAAC;oBAC7B,KAAK,GAAG,MAAM,CAAC;oBACf,SAAS;gBACX,CAAC;qBAAM,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;oBAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;oBAChD,IAAI,MAAM,KAAK,CAAC,CAAC;wBAAE,OAAO,CAAC,CAAC,CAAC;oBAC7B,KAAK,GAAG,MAAM,CAAC;oBACf,SAAS;gBACX,CAAC;gBACD,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;YACD,SAAS;QACX,CAAC;QACD,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,KAAa;IAC9C,IAAI,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC;IACtB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,OAAO,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,CAAC;QAClC,IAAI,SAAS,KAAK,GAAG;YAAE,OAAO,GAAG,IAAI,CAAC;aACjC,IAAI,SAAS,KAAK,GAAG;YAAE,OAAO,GAAG,KAAK,CAAC;aACvC,IAAI,SAAS,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,KAAK,IAAI,CAAC,CAAC;YACX,OAAO,KAAK,GAAG,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAW,CAAC;gBAAE,KAAK,IAAI,CAAC,CAAC;YAC1F,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,MAAM,WAAW,GAAG;IAClB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;IAC5E,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5E,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CACrD,CAAC;AAEF,SAAS,cAAc,CAAC,MAAc,EAAE,KAAa;IACnD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,KAAK,CAAC;YAAE,OAAO,UAAU,CAAC;IAC9D,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAW,CAAC;AACjC,CAAC;AAED,SAAS,eAAe,CAAC,MAAc,EAAE,IAAY;IACnD,IAAI,KAAK,GAAG,IAAI,CAAC;IACjB,OAAO,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAW,CAAC;QAC1C,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACzB,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,GAAG,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACnD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACxC,IAAI,GAAG,KAAK,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAC;YACjC,KAAK,GAAG,GAAG,GAAG,CAAC,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,GAAG,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACnD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC5C,IAAI,GAAG,KAAK,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAC;YACjC,KAAK,GAAG,GAAG,GAAG,CAAC,CAAC;YAChB,SAAS;QACX,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC;QAAE,MAAM,aAAa,CAAC,mBAAmB,CAAC,CAAC;IACrE,IAAI,KAAK,CAAC,UAAU,GAAG,sBAAsB,EAAE,CAAC;QAC9C,MAAM,aAAa,CACjB,eAAe,KAAK,CAAC,UAAU,sCAAsC,sBAAsB,EAAE,CAC9F,CAAC;IACJ,CAAC;IACD,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,aAAa,CAAC,6BAA6B,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,QAAQ;aACpB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;aAC/E,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,aAAa,CACjB,wDAAwD,MAAM,EAAE,EAChE,6EAA6E;cAC3E,sCAAsC,CACzC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK;QACL,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;QAC9D,IAAI,EAAE,KAAK,CAAC,UAAU;QACtB,MAAM;KACP,CAAC,CAAC;AACL,CAAC"}

package/dist/control-plane.d.ts

@@ -0,0 +1,37 @@
+import { type FetchLike } from './internal/http.js';
+export interface Discovery {
+    readonly issuer: string;
+    readonly jwksUri: string;
+    readonly exchangeEndpoint: string;
+    readonly userRelayExchangeEndpoint: string;
+    readonly pushAudience: string;
+    readonly componentsAudience: string;
+}
+export interface PublisherToken {
+    readonly accessToken: string;
+    readonly expiresAtMs: number;
+    readonly keyId: string;
+    readonly keyLabel: string;
+}
+export interface ControlPlaneOptions {
+    readonly issuer: string;
+    readonly fetch?: FetchLike;
+}
+export declare function homeKeyId(homeKey: string): string;
+/**
+ * Reads the pinned deployment profile. The CLI never follows an issuer, JWKS URL
+ * or audience supplied by a token: only this document, fetched from the issuer
+ * the operator configured, selects endpoints.
+ */
+export declare function fetchDiscovery(options: ControlPlaneOptions): Promise<Discovery>;
+/**
+ * Exchanges a Home Key for the five-minute `components:publish` profile.
+ *
+ * RFC 0004 §7.2 attenuates the issued token to exactly that one scope, and
+ * §7.3 omits `relay_url` for this purpose: a component token is useless at a
+ * relay. Publication APIs never accept the Home Key itself.
+ */
+export declare function exchangePublisherToken(discovery: Discovery, homeKey: string, options?: {
+    readonly fetch?: FetchLike;
+}): Promise<PublisherToken>;
+//# sourceMappingURL=control-plane.d.ts.map

package/dist/control-plane.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-plane.d.ts","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AACA,OAAO,EAKL,KAAK,SAAS,EACf,MAAM,oBAAoB,CAAC;AAY5B,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC;IAC3C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;CAC5B;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAUjD;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,SAAS,CAAC,CAwCrF;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAA;CAAO,GAC3C,OAAO,CAAC,cAAc,CAAC,CA4DzB"}

package/dist/control-plane.js

@@ -0,0 +1,127 @@
+import { authorizationError, contractError } from './errors.js';
+import { canonicalHttpsUrl, cancelBody, readBoundedBody, requestBody, } from './internal/http.js';
+import { boundedString, exactRecord, parseJson } from './internal/json.js';
+/** RFC 0004 §3 caps the discovery document at 4 KiB. */
+const MAXIMUM_DISCOVERY_BYTES = 4_096;
+/** RFC 0004 §7 leases every access token for at most five minutes. */
+const MAXIMUM_TOKEN_LIFETIME_MS = 330_000;
+const HOME_KEY = /^mhk1_([A-Za-z0-9_-]{22})_([A-Za-z0-9_-]{43})$/;
+const DISCOVERY_PATH = '/.well-known/miakapp-control-plane';
+export function homeKeyId(homeKey) {
+    const match = HOME_KEY.exec(homeKey);
+    const keyId = match?.[1];
+    if (keyId === undefined) {
+        throw authorizationError('The Home Key is not a valid mhk1 credential', 'Create a new Home Key with the components:publish scope and store it outside Git.');
+    }
+    return keyId;
+}
+/**
+ * Reads the pinned deployment profile. The CLI never follows an issuer, JWKS URL
+ * or audience supplied by a token: only this document, fetched from the issuer
+ * the operator configured, selects endpoints.
+ */
+export async function fetchDiscovery(options) {
+    const issuer = canonicalHttpsUrl(options.issuer, 'issuer');
+    if (issuer.endsWith('/'))
+        throw contractError('issuer must not have a trailing slash');
+    const fetcher = options.fetch ?? globalThis.fetch;
+    const response = await fetcher(`${issuer}${DISCOVERY_PATH}`, {
+        method: 'GET',
+        headers: { accept: 'application/json' },
+        redirect: 'error',
+    });
+    if (response.status !== 200) {
+        cancelBody(response);
+        throw contractError(`Discovery document returned HTTP ${response.status}`);
+    }
+    const body = await readBoundedBody(response, MAXIMUM_DISCOVERY_BYTES);
+    const document = exactRecord(parseJson(body), [
+        'schema',
+        'issuer',
+        'jwks_uri',
+        'exchange_endpoint',
+        'user_relay_exchange_endpoint',
+        'push_audience',
+        'components_audience',
+    ]);
+    if (document.schema !== 'miakapp.control-plane-discovery/1') {
+        throw contractError('Discovery document has an unsupported schema');
+    }
+    if (document.issuer !== issuer) {
+        throw contractError('Discovery document advertises a different issuer');
+    }
+    return Object.freeze({
+        issuer,
+        jwksUri: canonicalHttpsUrl(document.jwks_uri, 'jwks_uri'),
+        exchangeEndpoint: canonicalHttpsUrl(document.exchange_endpoint, 'exchange_endpoint'),
+        userRelayExchangeEndpoint: canonicalHttpsUrl(document.user_relay_exchange_endpoint, 'user_relay_exchange_endpoint'),
+        pushAudience: canonicalHttpsUrl(document.push_audience, 'push_audience'),
+        componentsAudience: canonicalHttpsUrl(document.components_audience, 'components_audience'),
+    });
+}
+/**
+ * Exchanges a Home Key for the five-minute `components:publish` profile.
+ *
+ * RFC 0004 §7.2 attenuates the issued token to exactly that one scope, and
+ * §7.3 omits `relay_url` for this purpose: a component token is useless at a
+ * relay. Publication APIs never accept the Home Key itself.
+ */
+export async function exchangePublisherToken(discovery, homeKey, options = {}) {
+    const keyId = homeKeyId(homeKey);
+    const fetcher = options.fetch ?? globalThis.fetch;
+    const response = await fetcher(discovery.exchangeEndpoint, {
+        method: 'POST',
+        headers: {
+            accept: 'application/json',
+            authorization: `Bearer ${homeKey}`,
+            'content-type': 'application/json',
+        },
+        body: requestBody({ purpose: 'components' }),
+        // No request-side `cache` hint: Node and Bun have no HTTP cache to opt out
+        // of, and the response-side no-store headers checked below are the actual
+        // guarantee that this token is never stored by an intermediary.
+        credentials: 'omit',
+        redirect: 'error',
+        referrerPolicy: 'no-referrer',
+    });
+    if (response.status !== 200) {
+        cancelBody(response);
+        throw authorizationError(`Component token exchange returned HTTP ${response.status}`, 'Confirm the Home Key exists, is not revoked and holds the components:publish scope.');
+    }
+    if (response.headers.get('cache-control') !== 'no-store'
+        || response.headers.get('pragma') !== 'no-cache'
+        || response.headers.get('referrer-policy') !== 'no-referrer') {
+        cancelBody(response);
+        throw contractError('Component token response is missing its required no-store headers');
+    }
+    const body = await readBoundedBody(response, 65_536);
+    const document = exactRecord(parseJson(body), [
+        'schema',
+        'access_token',
+        'token_type',
+        'expires_at_ms',
+        'key',
+    ]);
+    const key = exactRecord(document.key, ['id', 'label']);
+    const accessToken = boundedString(document.access_token, 1, 8_192);
+    const expiresAtMs = document.expires_at_ms;
+    if (document.schema !== 'miakapp.access-token/1'
+        || document.token_type !== 'Bearer'
+        || accessToken.split('.').length !== 3
+        || typeof expiresAtMs !== 'number'
+        || !Number.isSafeInteger(expiresAtMs)
+        || key.id !== keyId) {
+        throw contractError('Component token response does not match the closed exchange schema');
+    }
+    const now = Date.now();
+    if (expiresAtMs <= now || expiresAtMs - now > MAXIMUM_TOKEN_LIFETIME_MS) {
+        throw contractError('Component token lease is expired or longer than the five-minute ceiling');
+    }
+    return Object.freeze({
+        accessToken,
+        expiresAtMs,
+        keyId,
+        keyLabel: boundedString(key.label, 1, 64),
+    });
+}
+//# sourceMappingURL=control-plane.js.map

package/dist/control-plane.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-plane.js","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EACL,iBAAiB,EACjB,UAAU,EACV,eAAe,EACf,WAAW,GAEZ,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE3E,wDAAwD;AACxD,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAEtC,sEAAsE;AACtE,MAAM,yBAAyB,GAAG,OAAO,CAAC;AAE1C,MAAM,QAAQ,GAAG,gDAAgD,CAAC;AAClE,MAAM,cAAc,GAAG,oCAAoC,CAAC;AAuB5D,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,kBAAkB,CACtB,6CAA6C,EAC7C,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA4B;IAC/D,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,aAAa,CAAC,uCAAuC,CAAC,CAAC;IACvF,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,GAAG,cAAc,EAAE,EAAE;QAC3D,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACvC,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,UAAU,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,aAAa,CAAC,oCAAoC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QAC5C,QAAQ;QACR,QAAQ;QACR,UAAU;QACV,mBAAmB;QACnB,8BAA8B;QAC9B,eAAe;QACf,qBAAqB;KACtB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,KAAK,mCAAmC,EAAE,CAAC;QAC5D,MAAM,aAAa,CAAC,8CAA8C,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,aAAa,CAAC,kDAAkD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM;QACN,OAAO,EAAE,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;QACzD,gBAAgB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;QACpF,yBAAyB,EAAE,iBAAiB,CAC1C,QAAQ,CAAC,4BAA4B,EACrC,8BAA8B,CAC/B;QACD,YAAY,EAAE,iBAAiB,CAAC,QAAQ,CAAC,aAAa,EAAE,eAAe,CAAC;QACxE,kBAAkB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;KAC3F,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAAoB,EACpB,OAAe,EACf,OAAO,GAAmC,EAAE;IAE5C,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,gBAAgB,EAAE;QACzD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,OAAO,EAAE;YAClC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,WAAW,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QAC5C,2EAA2E;QAC3E,0EAA0E;QAC1E,gEAAgE;QAChE,WAAW,EAAE,MAAM;QACnB,QAAQ,EAAE,OAAO;QACjB,cAAc,EAAE,aAAa;KAC9B,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,UAAU,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,kBAAkB,CACtB,0CAA0C,QAAQ,CAAC,MAAM,EAAE,EAC3D,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,UAAU;WACnD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,UAAU;WAC7C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,aAAa,EAAE,CAAC;QAC/D,UAAU,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,aAAa,CAAC,mEAAmE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QAC5C,QAAQ;QACR,cAAc;QACd,YAAY;QACZ,eAAe;QACf,KAAK;KACN,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,MAAM,WAAW,GAAG,aAAa,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IACnE,MAAM,WAAW,GAAG,QAAQ,CAAC,aAAa,CAAC;IAC3C,IAAI,QAAQ,CAAC,MAAM,KAAK,wBAAwB;WAC3C,QAAQ,CAAC,UAAU,KAAK,QAAQ;WAChC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;WACnC,OAAO,WAAW,KAAK,QAAQ;WAC/B,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC;WAClC,GAAG,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,aAAa,CAAC,oEAAoE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,WAAW,IAAI,GAAG,IAAI,WAAW,GAAG,GAAG,GAAG,yBAAyB,EAAE,CAAC;QACxE,MAAM,aAAa,CAAC,yEAAyE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,WAAW;QACX,WAAW;QACX,KAAK;QACL,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;KAC1C,CAAC,CAAC;AACL,CAAC"}

package/dist/discovery.d.ts

@@ -0,0 +1,95 @@
+/**
+ * A generous ceiling for a local export. The strict parser in `internal/json.ts`
+ * is bounded for untrusted control-plane responses at 2,048 values, which a real
+ * house blows through in the first tab; a flows export is an operator-supplied
+ * local file, so the bound here is on bytes rather than on structure.
+ */
+export declare const MAXIMUM_FLOWS_BYTES = 33554432;
+export type FindingKind = 
+/** A coordinator secret sits in cleartext in the export. */
+'secret_in_export'
+/** An action any signed-in user may invoke, because no group was listed. */
+ | 'unrestricted_action'
+/** A V3 name that is not a legal V4 dotted name and has to be renamed. */
+ | 'name_needs_rename'
+/** A subscription pattern rather than one device's topic. */
+ | 'wildcard_subscription'
+/** A broker reached without TLS. */
+ | 'broker_without_tls'
+/** A node type this inventory does not model. */
+ | 'unmodelled_node';
+export type FindingSeverity = 'critical' | 'attention' | 'note';
+export interface Finding {
+    readonly kind: FindingKind;
+    readonly severity: FindingSeverity;
+    readonly detail: string;
+    readonly nodeId: string | undefined;
+}
+export interface Broker {
+    readonly id: string;
+    readonly name: string;
+    readonly host: string;
+    readonly port: number | undefined;
+    readonly tls: boolean;
+    readonly subscribes: readonly string[];
+    readonly publishes: readonly string[];
+}
+export interface FlowTab {
+    readonly id: string;
+    readonly label: string;
+    readonly disabled: boolean;
+    readonly nodeCount: number;
+}
+export interface HomeBinding {
+    readonly nodeId: string;
+    readonly homeId: string;
+    readonly coordinatorId: string;
+    readonly secretInExport: boolean;
+}
+/** One `commitVariables` entry: a V3 variable path and where its value came from. */
+export interface StateCandidate {
+    readonly path: string;
+    readonly source: 'jsonata' | 'env' | 'literal';
+    readonly nodeId: string;
+    readonly legalV4Name: boolean;
+}
+/** One `onUserAction` handler: the V3 shape of what becomes a V4 function. */
+export interface ActionCandidate {
+    readonly inputId: string;
+    readonly allowedGroups: readonly string[];
+    readonly nodeId: string;
+    readonly legalV4Name: boolean;
+}
+/** One `sendPushNotif` node: the V3 shape of what becomes a V4 published event. */
+export interface NotificationCandidate {
+    readonly nodeId: string;
+    readonly name: string;
+    readonly adminOnly: boolean;
+    readonly group: string;
+}
+export interface Inventory {
+    readonly nodeCount: number;
+    readonly flows: readonly FlowTab[];
+    readonly brokers: readonly Broker[];
+    readonly homes: readonly HomeBinding[];
+    readonly state: readonly StateCandidate[];
+    readonly actions: readonly ActionCandidate[];
+    readonly notifications: readonly NotificationCandidate[];
+    /** Every type this module does not model, with how many nodes carry it. */
+    readonly unmodelled: readonly {
+        readonly type: string;
+        readonly count: number;
+    }[];
+    readonly findings: readonly Finding[];
+}
+/**
+ * Builds the inventory for one Node-RED export.
+ *
+ * The result is a pure function of the bytes: the same export always produces
+ * the same report, which is what makes it usable as a migration baseline that
+ * can be diffed between two runs.
+ */
+export declare function discoverFlows(source: Uint8Array): Inventory;
+/** The JSON body of `miakapp discover --json`, with no secret value in it. */
+export declare function inventoryJson(inventory: Inventory): Record<string, unknown>;
+//# sourceMappingURL=discovery.d.ts.map

package/dist/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../src/discovery.ts"],"names":[],"mappings":"AA0BA;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,WAAa,CAAC;AAiB9C,MAAM,MAAM,WAAW;AACrB,4DAA4D;AAC1D,kBAAkB;AACpB,4EAA4E;GAC1E,qBAAqB;AACvB,0EAA0E;GACxE,mBAAmB;AACrB,6DAA6D;GAC3D,uBAAuB;AACzB,oCAAoC;GAClC,oBAAoB;AACtB,iDAAiD;GAC/C,iBAAiB,CAAC;AAEtB,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,WAAW,GAAG,MAAM,CAAC;AAEhE,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC;AAED,qFAAqF;AACrF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,KAAK,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED,8EAA8E;AAC9E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED,mFAAmF;AACnF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,OAAO,EAAE,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;IAC7C,QAAQ,CAAC,aAAa,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACzD,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAClF,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC;CACvC;AA0TD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAsB3D;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,SAAS,EAAE,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAsD3E"}