@nuetzliches/croniq-runner 0.2.0 → 0.4.0

package/dist/sanitize.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Hygiene for server-supplied strings.
+ *
+ * `job_key` and `execution_id` arrive from the Croniq server and are echoed
+ * into logs and telemetry. The threat actor is a malicious or compromised
+ * server — but not only: in a multi-tenant deployment anyone who can name a
+ * job key in the Croniqfile controls a string that round-trips to every
+ * runner unchanged. A value carrying CRLF forges log records; one carrying
+ * ANSI escapes repaints the operator's terminal.
+ *
+ * Two layers defend against that:
+ *
+ * 1. {@link assertSafeAssignmentIdentifiers} rejects an assignment whose
+ *    identifiers fall outside the shape Croniq itself defines, so hostile
+ *    values never enter the SDK.
+ * 2. {@link escapeControlChars} escapes anything a terminal would interpret,
+ *    applied wherever this SDK renders text itself (see `logger.ts`).
+ */
+/**
+ * Maximum accepted `job_key` length, counted in Unicode scalar values.
+ *
+ * The server stores job keys in an unbounded `TEXT` column
+ * (`crates/croniq-store/src/migrations/001_initial.sql`), so this bound is the
+ * SDK's own. 256 is far above any plausible `namespace:name:variant` while
+ * still bounding what a single log line can be made to hold.
+ */
+export declare const MAX_JOB_KEY_LENGTH = 256;
+/**
+ * Maximum accepted `execution_id` length. The server always emits a v4 UUID
+ * (36 characters); 64 leaves room for the shorter opaque ids used by mock
+ * servers and the conformance suite.
+ */
+export declare const MAX_EXECUTION_ID_LENGTH = 64;
+/**
+ * Escape every character a terminal interprets rather than prints: the C0
+ * range (including ESC, `0x1B`, which introduces every ANSI sequence), DEL,
+ * and the C1 range.
+ *
+ * This mirrors what Go's `slog` handlers do for attribute values, and is
+ * applied here because this SDK's console logger writes the message itself.
+ * Field maps do not need it — they are rendered with `JSON.stringify`, which
+ * already escapes these.
+ */
+export declare function escapeControlChars(value: string): string;
+/**
+ * Render a rejected value for a diagnostic: escaped so it cannot forge a
+ * record, and truncated so an over-long value cannot flood the log either.
+ */
+export declare function previewForLog(value: unknown, maxLength?: number): string;
+/**
+ * True when `value` is a job key this runner is willing to act on: non-empty,
+ * within {@link MAX_JOB_KEY_LENGTH} scalar values, and free of control
+ * characters. Iteration is over scalar values (`for…of`), not UTF-16 code
+ * units, so an astral character counts once and a surrogate pair is never
+ * inspected half at a time.
+ */
+export declare function isSafeJobKey(value: unknown): value is string;
+/** True when `value` is an execution id this runner is willing to act on. */
+export declare function isSafeExecutionId(value: unknown): value is string;
+/** The identifier that makes a work assignment unacceptable. */
+export type RejectedField = 'execution_id' | 'job_key';
+/**
+ * Names the identifier that makes a work assignment unacceptable, or
+ * `undefined` when both pass. Only the field name is returned — the offending
+ * value is reported separately, escaped, so the diagnostic cannot itself become
+ * the injection vector.
+ *
+ * The two outcomes are handled differently by the caller, and the order here
+ * is what makes that possible. An unsafe `execution_id` leaves nothing to
+ * address the server with, so the assignment is dropped silently. An unsafe
+ * `job_key` with a *valid* `execution_id` can still be acked as a failure, so
+ * the operator gets a dead-lettered execution naming the problem instead of a
+ * silent requeue loop.
+ */
+export declare function rejectAssignmentReason(executionId: unknown, jobKey: unknown): RejectedField | undefined;
+/**
+ * The `error` string acked for an assignment rejected on `job_key`. Names the
+ * field and shows the offending value escaped, so the dead-letter row explains
+ * itself without carrying a live payload.
+ */
+export declare function rejectionAckError(field: RejectedField, value: unknown): string;
+//# sourceMappingURL=sanitize.d.ts.map

package/dist/sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../src/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,MAAM,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAkC1C;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAcxD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,SAAM,GAAG,MAAM,CASrE;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAQ5D;AAED,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAOjE;AAED,gEAAgE;AAChE,MAAM,MAAM,aAAa,GAAG,cAAc,GAAG,SAAS,CAAC;AAEvD;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,OAAO,EACpB,MAAM,EAAE,OAAO,GACd,aAAa,GAAG,SAAS,CAI3B;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAE9E"}

package/dist/sanitize.js

@@ -0,0 +1,157 @@
+/**
+ * Hygiene for server-supplied strings.
+ *
+ * `job_key` and `execution_id` arrive from the Croniq server and are echoed
+ * into logs and telemetry. The threat actor is a malicious or compromised
+ * server — but not only: in a multi-tenant deployment anyone who can name a
+ * job key in the Croniqfile controls a string that round-trips to every
+ * runner unchanged. A value carrying CRLF forges log records; one carrying
+ * ANSI escapes repaints the operator's terminal.
+ *
+ * Two layers defend against that:
+ *
+ * 1. {@link assertSafeAssignmentIdentifiers} rejects an assignment whose
+ *    identifiers fall outside the shape Croniq itself defines, so hostile
+ *    values never enter the SDK.
+ * 2. {@link escapeControlChars} escapes anything a terminal would interpret,
+ *    applied wherever this SDK renders text itself (see `logger.ts`).
+ */
+/**
+ * Maximum accepted `job_key` length, counted in Unicode scalar values.
+ *
+ * The server stores job keys in an unbounded `TEXT` column
+ * (`crates/croniq-store/src/migrations/001_initial.sql`), so this bound is the
+ * SDK's own. 256 is far above any plausible `namespace:name:variant` while
+ * still bounding what a single log line can be made to hold.
+ */
+export const MAX_JOB_KEY_LENGTH = 256;
+/**
+ * Maximum accepted `execution_id` length. The server always emits a v4 UUID
+ * (36 characters); 64 leaves room for the shorter opaque ids used by mock
+ * servers and the conformance suite.
+ */
+export const MAX_EXECUTION_ID_LENGTH = 64;
+/**
+ * Whether `codePoint` is one a terminal interprets rather than prints: the C0
+ * range (`U+0000`–`U+001F`, covering NUL, CR, LF and the ESC that introduces
+ * every ANSI sequence), DEL (`U+007F`), and the C1 range
+ * (`U+0080`–`U+009F`).
+ *
+ * This is the rule for `job_key`, and it is a *denylist* on purpose. An
+ * allowlist — say, the character set `Lexer::is_ident_char` accepts for an
+ * unquoted key in `crates/croniq-config/src/lexer.rs` — would reject keys a
+ * legitimate server can issue: `parse_job_key` (`parser.rs:687-717`) also
+ * accepts a `QuotedString` and then enforces only the "two or three
+ * colon-separated parts" rule, so `job "billing:monthly invoice" { … }` is
+ * legal DSL today, and `POST /v1/jobs` constrains the key not at all. Dropping
+ * such an assignment would strand a valid configuration.
+ *
+ * Rejecting the control classes instead blocks precisely the log-forgery and
+ * ANSI-injection payloads without touching anything legitimate. An interior
+ * space is accepted; so is any other printable scalar value, in any script.
+ */
+function isControlScalar(codePoint) {
+    return codePoint <= 0x1f || (codePoint >= 0x7f && codePoint <= 0x9f);
+}
+/**
+ * Accepted `execution_id` shape. The server generates these as v4 UUIDs
+ * (`Uuid::new_v4()`), which is a strict subset of this pattern; the pattern is
+ * kept slightly wider so opaque ids from mock servers and older builds still
+ * round-trip. What it excludes is what matters: control characters, ESC,
+ * whitespace, and anything else a terminal or log parser reacts to.
+ */
+const EXECUTION_ID_PATTERN = /^[A-Za-z0-9._:-]+$/;
+/**
+ * Escape every character a terminal interprets rather than prints: the C0
+ * range (including ESC, `0x1B`, which introduces every ANSI sequence), DEL,
+ * and the C1 range.
+ *
+ * This mirrors what Go's `slog` handlers do for attribute values, and is
+ * applied here because this SDK's console logger writes the message itself.
+ * Field maps do not need it — they are rendered with `JSON.stringify`, which
+ * already escapes these.
+ */
+export function escapeControlChars(value) {
+    // eslint-disable-next-line no-control-regex
+    return value.replace(/[\u0000-\u001F\u007F-\u009F]/g, (ch) => {
+        switch (ch) {
+            case '\n':
+                return '\\n';
+            case '\r':
+                return '\\r';
+            case '\t':
+                return '\\t';
+            default:
+                return `\\u${ch.charCodeAt(0).toString(16).padStart(4, '0')}`;
+        }
+    });
+}
+/**
+ * Render a rejected value for a diagnostic: escaped so it cannot forge a
+ * record, and truncated so an over-long value cannot flood the log either.
+ */
+export function previewForLog(value, maxLength = 120) {
+    const text = typeof value === 'string' ? value : String(value);
+    // Slice by scalar values, not UTF-16 code units, so truncation cannot leave
+    // a lone surrogate behind.
+    const scalars = [...text];
+    const clipped = scalars.length > maxLength
+        ? `${scalars.slice(0, maxLength).join('')}…`
+        : text;
+    return escapeControlChars(clipped);
+}
+/**
+ * True when `value` is a job key this runner is willing to act on: non-empty,
+ * within {@link MAX_JOB_KEY_LENGTH} scalar values, and free of control
+ * characters. Iteration is over scalar values (`for…of`), not UTF-16 code
+ * units, so an astral character counts once and a surrogate pair is never
+ * inspected half at a time.
+ */
+export function isSafeJobKey(value) {
+    if (typeof value !== 'string' || value.length === 0)
+        return false;
+    let scalars = 0;
+    for (const ch of value) {
+        if (++scalars > MAX_JOB_KEY_LENGTH)
+            return false;
+        if (isControlScalar(ch.codePointAt(0)))
+            return false;
+    }
+    return true;
+}
+/** True when `value` is an execution id this runner is willing to act on. */
+export function isSafeExecutionId(value) {
+    return (typeof value === 'string' &&
+        value.length > 0 &&
+        value.length <= MAX_EXECUTION_ID_LENGTH &&
+        EXECUTION_ID_PATTERN.test(value));
+}
+/**
+ * Names the identifier that makes a work assignment unacceptable, or
+ * `undefined` when both pass. Only the field name is returned — the offending
+ * value is reported separately, escaped, so the diagnostic cannot itself become
+ * the injection vector.
+ *
+ * The two outcomes are handled differently by the caller, and the order here
+ * is what makes that possible. An unsafe `execution_id` leaves nothing to
+ * address the server with, so the assignment is dropped silently. An unsafe
+ * `job_key` with a *valid* `execution_id` can still be acked as a failure, so
+ * the operator gets a dead-lettered execution naming the problem instead of a
+ * silent requeue loop.
+ */
+export function rejectAssignmentReason(executionId, jobKey) {
+    if (!isSafeExecutionId(executionId))
+        return 'execution_id';
+    if (!isSafeJobKey(jobKey))
+        return 'job_key';
+    return undefined;
+}
+/**
+ * The `error` string acked for an assignment rejected on `job_key`. Names the
+ * field and shows the offending value escaped, so the dead-letter row explains
+ * itself without carrying a live payload.
+ */
+export function rejectionAckError(field, value) {
+    return `rejected by runner: unsafe ${field} ${previewForLog(value)}`;
+}
+//# sourceMappingURL=sanitize.js.map

package/dist/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../src/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAEtC;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAE1C;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,eAAe,CAAC,SAAiB;IACxC,OAAO,SAAS,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AAElD;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,4CAA4C;IAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,+BAA+B,EAAE,CAAC,EAAE,EAAE,EAAE;QAC3D,QAAQ,EAAE,EAAE,CAAC;YACX,KAAK,IAAI;gBACP,OAAO,KAAK,CAAC;YACf,KAAK,IAAI;gBACP,OAAO,KAAK,CAAC;YACf,KAAK,IAAI;gBACP,OAAO,KAAK,CAAC;YACf;gBACE,OAAO,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QAClE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,SAAS,GAAG,GAAG;IAC3D,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/D,4EAA4E;IAC5E,2BAA2B;IAC3B,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS;QACxC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG;QAC5C,CAAC,CAAC,IAAI,CAAC;IACT,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,EAAE,OAAO,GAAG,kBAAkB;YAAE,OAAO,KAAK,CAAC;QACjD,IAAI,eAAe,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC;YAAE,OAAO,KAAK,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,KAAK,CAAC,MAAM,IAAI,uBAAuB;QACvC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CACjC,CAAC;AACJ,CAAC;AAKD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAAoB,EACpB,MAAe;IAEf,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC;QAAE,OAAO,cAAc,CAAC;IAC3D,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAoB,EAAE,KAAc;IACpE,OAAO,8BAA8B,KAAK,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;AACvE,CAAC"}

package/dist/security.d.ts

@@ -0,0 +1,19 @@
+import type { Logger } from './logger.js';
+/**
+ * `true` for the loopback hosts the SDK considers safe over cleartext HTTP:
+ * `localhost`, anything in `127.0.0.0/8`, and IPv6 `::1` (in the bracketed
+ * `[::1]` form the WHATWG URL parser produces).
+ */
+export declare function isLoopbackHostname(hostname: string): boolean;
+/**
+ * Throws a {@link TypeError} when `serverUrl` is a non-loopback `http://` URL
+ * and `allowInsecureHttp` is not set. When the opt-in IS set for such a URL,
+ * emits exactly one loud warning naming the risk.
+ *
+ * @param serverUrl Configured base URL (already known to be parseable).
+ * @param allowInsecureHttp Caller's explicit opt-in to cleartext HTTP.
+ * @param optionPath Dotted option path, used to make the error actionable.
+ * @param logger Sink for the opt-in warning.
+ */
+export declare function assertSecureServerUrl(serverUrl: string, allowInsecureHttp: boolean, optionPath: string, logger: Logger): void;
+//# sourceMappingURL=security.d.ts.map

package/dist/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAQ5D;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,iBAAiB,EAAE,OAAO,EAC1B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GACb,IAAI,CA+BN"}

package/dist/security.js

@@ -0,0 +1,83 @@
+// Transport-security checks applied to the configured base URL.
+//
+// Both the runner and the producer-side trigger client attach the credential
+// as an `Authorization` header on every request. Over `http://` that key
+// travels in cleartext — and undici honours `HTTP_PROXY` by default, so it may
+// traverse an intermediary in the clear as well.
+//
+// The rule (identical in the .NET, Java, Python and Go SDKs): `https://` is
+// always fine, `http://` is fine for a loopback host — that is the
+// `http://localhost:4000` quickstart path — and `http://` against any other
+// host is refused unless the caller explicitly opts in with
+// `allowInsecureHttp: true`. Enforcement happens at options-resolution /
+// construction time so a misconfiguration fails fast rather than on first poll.
+//
+// Kept regex-free on purpose, matching `url.ts`: CodeQL's "polynomial regex"
+// heuristic flags even linear patterns over library-controlled input.
+/**
+ * `true` for the loopback hosts the SDK considers safe over cleartext HTTP:
+ * `localhost`, anything in `127.0.0.0/8`, and IPv6 `::1` (in the bracketed
+ * `[::1]` form the WHATWG URL parser produces).
+ */
+export function isLoopbackHostname(hostname) {
+    const host = hostname.toLowerCase();
+    if (host === 'localhost')
+        return true;
+    if (host.startsWith('[') && host.endsWith(']')) {
+        return host.slice(1, -1) === '::1';
+    }
+    if (host === '::1')
+        return true;
+    return isIpv4Loopback(host);
+}
+/**
+ * Throws a {@link TypeError} when `serverUrl` is a non-loopback `http://` URL
+ * and `allowInsecureHttp` is not set. When the opt-in IS set for such a URL,
+ * emits exactly one loud warning naming the risk.
+ *
+ * @param serverUrl Configured base URL (already known to be parseable).
+ * @param allowInsecureHttp Caller's explicit opt-in to cleartext HTTP.
+ * @param optionPath Dotted option path, used to make the error actionable.
+ * @param logger Sink for the opt-in warning.
+ */
+export function assertSecureServerUrl(serverUrl, allowInsecureHttp, optionPath, logger) {
+    const parsed = new URL(serverUrl);
+    const protocol = parsed.protocol.toLowerCase();
+    if (protocol === 'https:')
+        return;
+    if (protocol !== 'http:') {
+        throw new TypeError(`${optionPath} "${serverUrl}" has unsupported scheme "${parsed.protocol}": ` +
+            'use https:// (or http:// for a loopback host)');
+    }
+    if (isLoopbackHostname(parsed.hostname))
+        return;
+    if (!allowInsecureHttp) {
+        throw new TypeError(`${optionPath} "${serverUrl}" uses cleartext http:// with the non-loopback host ` +
+            `"${parsed.hostname}": the API key would be sent in the clear on every request, ` +
+            'and through any configured HTTP proxy. Use https://, or set ' +
+            'allowInsecureHttp: true to accept that risk explicitly.');
+    }
+    logger.warn(`SECURITY: Croniq is configured against the cleartext URL "${serverUrl}" with ` +
+        'allowInsecureHttp: true. The API key is transmitted in cleartext on every request ' +
+        'and is readable by anyone on the network path (including HTTP proxies). ' +
+        'Use https:// in production.', { server_url: serverUrl });
+}
+/** `true` for a dotted-quad IPv4 literal inside `127.0.0.0/8`. */
+function isIpv4Loopback(host) {
+    const parts = host.split('.');
+    if (parts.length !== 4)
+        return false;
+    for (const part of parts) {
+        if (part.length === 0 || part.length > 3)
+            return false;
+        for (let i = 0; i < part.length; i++) {
+            const code = part.charCodeAt(i);
+            if (code < 48 /* '0' */ || code > 57 /* '9' */)
+                return false;
+        }
+        if (Number(part) > 255)
+            return false;
+    }
+    return Number(parts[0]) === 127;
+}
+//# sourceMappingURL=security.js.map

package/dist/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,EAAE;AACF,6EAA6E;AAC7E,yEAAyE;AACzE,+EAA+E;AAC/E,iDAAiD;AACjD,EAAE;AACF,4EAA4E;AAC5E,mEAAmE;AACnE,4EAA4E;AAC5E,4DAA4D;AAC5D,yEAAyE;AACzE,gFAAgF;AAChF,EAAE;AACF,6EAA6E;AAC7E,sEAAsE;AAItE;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACpC,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC;IACrC,CAAC;IACD,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAiB,EACjB,iBAA0B,EAC1B,UAAkB,EAClB,MAAc;IAEd,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAE/C,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO;IAElC,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,IAAI,SAAS,CACjB,GAAG,UAAU,KAAK,SAAS,6BAA6B,MAAM,CAAC,QAAQ,KAAK;YAC1E,+CAA+C,CAClD,CAAC;IACJ,CAAC;IAED,IAAI,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO;IAEhD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,MAAM,IAAI,SAAS,CACjB,GAAG,UAAU,KAAK,SAAS,sDAAsD;YAC/E,IAAI,MAAM,CAAC,QAAQ,8DAA8D;YACjF,8DAA8D;YAC9D,yDAAyD,CAC5D,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,IAAI,CACT,6DAA6D,SAAS,SAAS;QAC7E,oFAAoF;QACpF,0EAA0E;QAC1E,6BAA6B,EAC/B,EAAE,UAAU,EAAE,SAAS,EAAE,CAC1B,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACvD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAChC,IAAI,IAAI,GAAG,EAAE,CAAC,SAAS,IAAI,IAAI,GAAG,EAAE,CAAC,SAAS;gBAAE,OAAO,KAAK,CAAC;QAC/D,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG;YAAE,OAAO,KAAK,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;AAClC,CAAC"}

package/dist/trigger.d.ts

@@ -1,8 +1,23 @@
 import { HttpError } from './client.js';
+import type { Logger } from './logger.js';
 /** Options for {@link CroniqTriggerClient} / {@link createTriggerClient}. */
 export interface CroniqTriggerClientOptions {
-    /** Base URL of the Croniq server, e.g. `http://localhost:4000`. */
+    /**
+     * Base URL of the Croniq server, e.g. `http://localhost:4000`.
+     *
+     * `https://` is required unless the host is loopback (`localhost`,
+     * `127.0.0.0/8`, `::1`) — the trigger credential rides along on every request
+     * and would otherwise travel in cleartext. See {@link allowInsecureHttp}.
+     */
     serverUrl: string;
+    /**
+     * Opt in to a cleartext `http://` {@link serverUrl} on a non-loopback host.
+     *
+     * Off by default: without it the constructor throws. With it, the client
+     * still emits one loud warning — the credential then travels in cleartext on
+     * every trigger call. Default `false`.
+     */
+    allowInsecureHttp?: boolean | undefined;
     /**
      * API key for `Authorization: ApiKey {key}`. Takes precedence over
      * {@link bearerToken} when both are set. Needs the `jobs:trigger` (or
@@ -15,6 +30,11 @@ export interface CroniqTriggerClientOptions {
     requestTimeoutMs?: number | undefined;
     /** Custom `fetch` implementation. Defaults to the global `fetch`. */
     fetchImpl?: typeof fetch | undefined;
+    /**
+     * Sink for SDK-level diagnostics (currently the insecure-transport warning).
+     * Defaults to a console logger that emits warn/error only.
+     */
+    logger?: Logger | undefined;
 }
 /** Optional arguments for a single {@link CroniqTriggerClient.trigger} call. */
 export interface TriggerParams {

package/dist/trigger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"trigger.d.ts","sourceRoot":"","sources":["../src/trigger.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAMxC,6EAA6E;AAC7E,MAAM,WAAW,0BAA0B;IACzC,mEAAmE;IACnE,SAAS,EAAE,MAAM,CAAC;IAElB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE5B,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEjC,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEtC,qEAAqE;IACrE,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,SAAS,CAAC;CACtC;AAED,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEnC,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAEnB,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,uDAAuD;IACvD,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,+DAA+D;AAC/D,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IAEf;;;;;OAKG;IACH,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;GAMG;AACH,qBAAa,kBAAmB,SAAQ,SAAS;aAI7B,YAAY,CAAC,EAAE,MAAM;gBAFrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACI,YAAY,CAAC,EAAE,MAAM,YAAA;CAKxC;AAKD;;;;;;GAMG;AACH,qBAAa,mBAAmB;;gBAOlB,IAAI,EAAE,0BAA0B;IAiB5C;;;;;;;;;OASG;IACG,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,GAAE,aAAkB,GAAG,OAAO,CAAC,aAAa,CAAC;CAoElF;AAED,oDAAoD;AACpD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,mBAAmB,CAEzF"}
+{"version":3,"file":"trigger.d.ts","sourceRoot":"","sources":["../src/trigger.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAM1C,6EAA6E;AAC7E,MAAM,WAAW,0BAA0B;IACzC;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAExC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE5B,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEjC,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEtC,qEAAqE;IACrE,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,SAAS,CAAC;IAErC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AAED,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEnC,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAEnB,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,uDAAuD;IACvD,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,+DAA+D;AAC/D,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IAEf;;;;;OAKG;IACH,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;GAMG;AACH,qBAAa,kBAAmB,SAAQ,SAAS;aAI7B,YAAY,CAAC,EAAE,MAAM;gBAFrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACI,YAAY,CAAC,EAAE,MAAM,YAAA;CAKxC;AAKD;;;;;;GAMG;AACH,qBAAa,mBAAmB;;gBAOlB,IAAI,EAAE,0BAA0B;IAwB5C;;;;;;;;;OASG;IACG,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,GAAE,aAAkB,GAAG,OAAO,CAAC,aAAa,CAAC;CAoElF;AAED,oDAAoD;AACpD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,mBAAmB,CAEzF"}

package/dist/trigger.js

@@ -9,6 +9,8 @@
 import { HttpError } from './client.js';
 import { AbortError } from './deferred.js';
 import { composeSignals, isAbortLikeError } from './http.js';
+import { consoleLogger } from './logger.js';
+import { assertSecureServerUrl } from './security.js';
 import { trimTrailingSlashes } from './url.js';
 /**
  * Thrown when `POST /v1/trigger` is rejected with `429 Too Many Requests`
@@ -51,6 +53,8 @@ export class CroniqTriggerClient {
         catch {
             throw new TypeError(`CroniqTriggerClientOptions.serverUrl is not a valid URL: ${opts.serverUrl}`);
         }
+        // Fail fast on a cleartext base URL that would leak the credential (#440).
+        assertSecureServerUrl(opts.serverUrl, opts.allowInsecureHttp ?? false, 'CroniqTriggerClientOptions.serverUrl', opts.logger ?? consoleLogger('warn'));
         this.#baseUrl = trimTrailingSlashes(opts.serverUrl);
         this.#apiKey = opts.apiKey;
         this.#bearerToken = opts.bearerToken;

package/dist/trigger.js.map

@@ -1 +1 @@
-{"version":3,"file":"trigger.js","sourceRoot":"","sources":["../src/trigger.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,+EAA+E;AAC/E,uEAAuE;AACvE,0EAA0E;AAC1E,+EAA+E;AAC/E,wEAAwE;AACxE,8CAA8C;AAE9C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AA4E/C;;;;;;GAMG;AACH,MAAM,OAAO,kBAAmB,SAAQ,SAAS;IAI7B;IAHlB,YACE,IAAY,EACZ,IAAY,EACI,YAAqB;QAErC,KAAK,CAAC,GAAG,EAAE,mBAAmB,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAF5B,iBAAY,GAAZ,YAAY,CAAS;QAGrC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,YAAY,GAAG,aAAa,CAAC;AACnC,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,OAAO,mBAAmB;IACrB,QAAQ,CAAS;IACjB,OAAO,CAAqB;IAC5B,YAAY,CAAqB;IACjC,iBAAiB,CAAS;IAC1B,MAAM,CAAe;IAE9B,YAAY,IAAgC;QAC1C,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC1D,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,CAAC;YACH,kCAAkC;YAClC,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,SAAS,CAAC,4DAA4D,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;QAC7E,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IACxC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,SAAwB,EAAE;QACtD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,SAAS,CAAC,oDAAoD,CAAC,CAAC;QAC5E,CAAC;QAED,0EAA0E;QAC1E,sCAAsC;QACtC,MAAM,WAAW,GAAmB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QACxD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;YAAE,WAAW,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC1E,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;YAAE,WAAW,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QACvE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,WAAW,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QACpE,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;YAAE,WAAW,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QACvE,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS;YAAE,WAAW,CAAC,eAAe,GAAG,MAAM,CAAC,cAAc,CAAC;QAE7F,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QACF,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC,aAAa,GAAG,UAAU,IAAI,CAAC,OAAO,EAAE,CAAC;QACnD,CAAC;aAAM,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7B,OAAO,CAAC,aAAa,GAAG,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAElF,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,GAAG,YAAY,EAAE,EAAE;gBAC9D,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;gBACjC,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,UAAU,CAAC,cAAc,YAAY,UAAU,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,IAAI,kBAAkB,CAAC,YAAY,EAAE,IAAI,EAAE,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;YAC3G,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,EAAE,YAAY,EAAE,qBAAqB,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,MAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,EAAE,YAAY,EAAE,2BAA2B,IAAI,EAAE,CAAC,CAAC;QAC7G,CAAC;QAED,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,YAAY;YAChC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,KAAK;SAC3C,CAAC;IACJ,CAAC;CACF;AAED,oDAAoD;AACpD,MAAM,UAAU,mBAAmB,CAAC,IAAgC;IAClE,OAAO,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,WAA0B;IACnD,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"trigger.js","sourceRoot":"","sources":["../src/trigger.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,+EAA+E;AAC/E,uEAAuE;AACvE,0EAA0E;AAC1E,+EAA+E;AAC/E,wEAAwE;AACxE,8CAA8C;AAE9C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAiG/C;;;;;;GAMG;AACH,MAAM,OAAO,kBAAmB,SAAQ,SAAS;IAI7B;IAHlB,YACE,IAAY,EACZ,IAAY,EACI,YAAqB;QAErC,KAAK,CAAC,GAAG,EAAE,mBAAmB,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAF5B,iBAAY,GAAZ,YAAY,CAAS;QAGrC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,YAAY,GAAG,aAAa,CAAC;AACnC,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,OAAO,mBAAmB;IACrB,QAAQ,CAAS;IACjB,OAAO,CAAqB;IAC5B,YAAY,CAAqB;IACjC,iBAAiB,CAAS;IAC1B,MAAM,CAAe;IAE9B,YAAY,IAAgC;QAC1C,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC1D,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,CAAC;YACH,kCAAkC;YAClC,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,SAAS,CAAC,4DAA4D,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,2EAA2E;QAC3E,qBAAqB,CACnB,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,iBAAiB,IAAI,KAAK,EAC/B,sCAAsC,EACtC,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,CACrC,CAAC;QACF,IAAI,CAAC,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;QAC7E,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IACxC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,SAAwB,EAAE;QACtD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,SAAS,CAAC,oDAAoD,CAAC,CAAC;QAC5E,CAAC;QAED,0EAA0E;QAC1E,sCAAsC;QACtC,MAAM,WAAW,GAAmB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QACxD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;YAAE,WAAW,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC1E,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;YAAE,WAAW,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QACvE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,WAAW,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QACpE,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;YAAE,WAAW,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QACvE,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS;YAAE,WAAW,CAAC,eAAe,GAAG,MAAM,CAAC,cAAc,CAAC;QAE7F,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QACF,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC,aAAa,GAAG,UAAU,IAAI,CAAC,OAAO,EAAE,CAAC;QACnD,CAAC;aAAM,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7B,OAAO,CAAC,aAAa,GAAG,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAElF,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,GAAG,YAAY,EAAE,EAAE;gBAC9D,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;gBACjC,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,UAAU,CAAC,cAAc,YAAY,UAAU,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,IAAI,kBAAkB,CAAC,YAAY,EAAE,IAAI,EAAE,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;YAC3G,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,EAAE,YAAY,EAAE,qBAAqB,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,MAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,EAAE,YAAY,EAAE,2BAA2B,IAAI,EAAE,CAAC,CAAC;QAC7G,CAAC;QAED,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,YAAY;YAChC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,KAAK;SAC3C,CAAC;IACJ,CAAC;CACF;AAED,oDAAoD;AACpD,MAAM,UAAU,mBAAmB,CAAC,IAAgC;IAClE,OAAO,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,WAA0B;IACnD,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nuetzliches/croniq-runner",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "Croniq runner SDK for Node.js. Polls a Croniq server for work, dispatches handlers, streams logs back.",
   "type": "module",
   "main": "./dist/index.js",