@positronic/spec 0.0.68 → 0.0.70

package/dist/api/scoping.js

@@ -0,0 +1,265 @@
+import { BRAIN_EVENTS } from '@positronic/core';
+import { startBrainRun, readSseUntil } from './helpers.js';
+/**
+ * Helper: start a brain run as a specific user's fetch, wait for completion,
+ * and return the brainRunId.
+ */
+async function runBrainAndWait(fetchFn, brainIdentifier) {
+    try {
+        const brainRunId = await startBrainRun(fetchFn, brainIdentifier);
+        if (!brainRunId)
+            return null;
+        // Watch until completion
+        const watchResponse = await fetchFn(new Request(`http://example.com/brains/runs/${brainRunId}/watch`));
+        if (!watchResponse.ok || !watchResponse.body) {
+            console.error(`GET /brains/runs/${brainRunId}/watch returned ${watchResponse.status}`);
+            return null;
+        }
+        await readSseUntil(watchResponse.body, (event) => event.type === BRAIN_EVENTS.COMPLETE ||
+            event.type === BRAIN_EVENTS.ERROR);
+        return brainRunId;
+    }
+    catch (error) {
+        console.error('Failed to run brain and wait:', error);
+        return null;
+    }
+}
+export const scoping = {
+    /**
+     * Test that brain runs are isolated between users.
+     *
+     * userA creates a run and waits for completion. Then:
+     * - userB gets 404 on GET /runs/:runId
+     * - root gets 200 on GET /runs/:runId
+     * - userA's history has the run
+     * - userB's history is empty
+     */
+    async brainRunIsolation(rootFetch, fetchFactory, brainIdentifier) {
+        try {
+            const userA = await fetchFactory('scoping-alice-run');
+            const userB = await fetchFactory('scoping-bob-run');
+            // userA creates a run and waits for completion
+            const brainRunId = await runBrainAndWait(userA.fetch, brainIdentifier);
+            if (!brainRunId) {
+                console.error('Failed to create and complete brain run as userA');
+                return false;
+            }
+            // userB tries to get the run — should get 404
+            const responseB = await userB.fetch(new Request(`http://example.com/brains/runs/${brainRunId}`));
+            if (responseB.status !== 404) {
+                console.error(`Expected userB to get 404 for userA's run, got ${responseB.status}`);
+                return false;
+            }
+            // root can see the run — should get 200
+            const responseRoot = await rootFetch(new Request(`http://example.com/brains/runs/${brainRunId}`));
+            if (responseRoot.status !== 200) {
+                console.error(`Expected root to get 200 for userA's run, got ${responseRoot.status}`);
+                return false;
+            }
+            const rootRun = (await responseRoot.json());
+            if (rootRun.brainRunId !== brainRunId) {
+                console.error(`Root returned wrong brainRunId: expected ${brainRunId}, got ${rootRun.brainRunId}`);
+                return false;
+            }
+            // userA's history has the run
+            const historyA = await userA.fetch(new Request(`http://example.com/brains/${encodeURIComponent(brainIdentifier)}/history?limit=50`));
+            if (historyA.status !== 200) {
+                console.error(`Expected userA history to return 200, got ${historyA.status}`);
+                return false;
+            }
+            const historyDataA = (await historyA.json());
+            if (historyDataA.runs.length === 0) {
+                console.error("userA's history is empty but should have the run");
+                return false;
+            }
+            // userB's history is empty for this brain
+            const historyB = await userB.fetch(new Request(`http://example.com/brains/${encodeURIComponent(brainIdentifier)}/history?limit=50`));
+            if (historyB.status !== 200) {
+                console.error(`Expected userB history to return 200, got ${historyB.status}`);
+                return false;
+            }
+            const historyDataB = (await historyB.json());
+            if (historyDataB.runs.length !== 0) {
+                console.error(`userB's history should be empty but has ${historyDataB.runs.length} runs`);
+                return false;
+            }
+            return true;
+        }
+        catch (error) {
+            console.error('Failed brain run isolation spec:', error);
+            return false;
+        }
+    },
+    /**
+     * Test that active runs are isolated between users.
+     *
+     * userA starts a delayed brain (will remain running).
+     * - userA sees it in active-runs
+     * - userB does not see it in active-runs
+     */
+    async activeRunIsolation(rootFetch, fetchFactory, delayedBrainIdentifier) {
+        try {
+            const userA = await fetchFactory('scoping-alice-active');
+            const userB = await fetchFactory('scoping-bob-active');
+            // Start a delayed brain as userA (will be running for a while)
+            const brainRunId = await startBrainRun(userA.fetch, delayedBrainIdentifier);
+            if (!brainRunId)
+                return false;
+            // userB checks active runs — should be empty
+            const responseB = await userB.fetch(new Request(`http://example.com/brains/${encodeURIComponent(delayedBrainIdentifier)}/active-runs`));
+            if (responseB.status !== 200) {
+                console.error(`Expected userB active-runs to return 200, got ${responseB.status}`);
+                return false;
+            }
+            const activeB = (await responseB.json());
+            if (activeB.runs.length !== 0) {
+                console.error(`userB should see 0 active runs but sees ${activeB.runs.length}`);
+                return false;
+            }
+            // userA checks active runs — should have the run
+            const responseA = await userA.fetch(new Request(`http://example.com/brains/${encodeURIComponent(delayedBrainIdentifier)}/active-runs`));
+            if (responseA.status !== 200) {
+                console.error(`Expected userA active-runs to return 200, got ${responseA.status}`);
+                return false;
+            }
+            const activeA = (await responseA.json());
+            if (activeA.runs.length === 0) {
+                console.error('userA should see at least 1 active run but sees 0');
+                return false;
+            }
+            return true;
+        }
+        catch (error) {
+            console.error('Failed active run isolation spec:', error);
+            return false;
+        }
+    },
+    /**
+     * Test that schedules are isolated between users.
+     *
+     * userA creates a schedule. Then:
+     * - userB can't see it in GET /schedules
+     * - userA can see it in GET /schedules
+     * - root can see it in GET /schedules
+     * - userB can't see runs for it in GET /schedules/runs
+     */
+    async scheduleIsolation(rootFetch, fetchFactory, brainIdentifier) {
+        try {
+            const userA = await fetchFactory('scoping-alice-sched');
+            const userB = await fetchFactory('scoping-bob-sched');
+            // userA creates a schedule
+            const createResponse = await userA.fetch(new Request('http://example.com/brains/schedules', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    identifier: brainIdentifier,
+                    cronExpression: '0 6 * * *',
+                }),
+            }));
+            if (createResponse.status !== 201) {
+                console.error(`POST /brains/schedules returned ${createResponse.status}, expected 201`);
+                return false;
+            }
+            const schedule = (await createResponse.json());
+            if (schedule.runAsUserId !== userA.userId) {
+                console.error(`Expected runAsUserId to be '${userA.userId}', got '${schedule.runAsUserId}'`);
+                return false;
+            }
+            // userB lists schedules — should not see userA's schedule
+            const listResponseB = await userB.fetch(new Request('http://example.com/brains/schedules'));
+            if (listResponseB.status !== 200) {
+                console.error(`Expected userB schedule list to return 200, got ${listResponseB.status}`);
+                return false;
+            }
+            const listB = (await listResponseB.json());
+            if (listB.schedules.some((s) => s.id === schedule.id)) {
+                console.error("userB should not see userA's schedule in list");
+                return false;
+            }
+            // userA lists schedules — should see their own
+            const listResponseA = await userA.fetch(new Request('http://example.com/brains/schedules'));
+            if (listResponseA.status !== 200) {
+                console.error(`Expected userA schedule list to return 200, got ${listResponseA.status}`);
+                return false;
+            }
+            const listA = (await listResponseA.json());
+            if (!listA.schedules.some((s) => s.id === schedule.id)) {
+                console.error("userA should see their own schedule in list");
+                return false;
+            }
+            // root lists schedules — should see it
+            const listResponseRoot = await rootFetch(new Request('http://example.com/brains/schedules'));
+            if (listResponseRoot.status !== 200) {
+                console.error(`Expected root schedule list to return 200, got ${listResponseRoot.status}`);
+                return false;
+            }
+            const listRoot = (await listResponseRoot.json());
+            if (!listRoot.schedules.some((s) => s.id === schedule.id)) {
+                console.error("root should see userA's schedule in list");
+                return false;
+            }
+            // userB can't see runs for userA's schedule
+            const runsResponseB = await userB.fetch(new Request(`http://example.com/brains/schedules/runs?scheduleId=${schedule.id}`));
+            if (runsResponseB.status !== 200) {
+                console.error(`Expected userB schedule runs to return 200, got ${runsResponseB.status}`);
+                return false;
+            }
+            const runsB = (await runsResponseB.json());
+            if (runsB.runs.length !== 0) {
+                console.error(`userB should see 0 schedule runs but sees ${runsB.runs.length}`);
+                return false;
+            }
+            return true;
+        }
+        catch (error) {
+            console.error('Failed schedule isolation spec:', error);
+            return false;
+        }
+    },
+    /**
+     * Test that non-root users get 403 on secrets endpoints.
+     *
+     * A non-root user calling GET/POST/DELETE /secrets gets 403.
+     * (Root access to secrets is already tested by secrets.list spec.)
+     */
+    async secretsRequireRoot(rootFetch, fetchFactory) {
+        try {
+            const user = await fetchFactory('scoping-user-secrets');
+            // GET /secrets — should get 403
+            const getResponse = await user.fetch(new Request('http://example.com/secrets'));
+            if (getResponse.status !== 403) {
+                console.error(`Expected non-root GET /secrets to return 403, got ${getResponse.status}`);
+                return false;
+            }
+            const getBody = (await getResponse.json());
+            if (getBody.error !== 'Root access required') {
+                console.error(`Expected error 'Root access required', got '${getBody.error}'`);
+                return false;
+            }
+            // POST /secrets — should get 403
+            const postResponse = await user.fetch(new Request('http://example.com/secrets', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ name: 'MY_SECRET', value: 'secret-value' }),
+            }));
+            if (postResponse.status !== 403) {
+                console.error(`Expected non-root POST /secrets to return 403, got ${postResponse.status}`);
+                return false;
+            }
+            // DELETE /secrets/:name — should get 403
+            const deleteResponse = await user.fetch(new Request('http://example.com/secrets/MY_SECRET', {
+                method: 'DELETE',
+            }));
+            if (deleteResponse.status !== 403) {
+                console.error(`Expected non-root DELETE /secrets to return 403, got ${deleteResponse.status}`);
+                return false;
+            }
+            return true;
+        }
+        catch (error) {
+            console.error('Failed secrets require root spec:', error);
+            return false;
+        }
+    },
+};
+//# sourceMappingURL=scoping.js.map

package/dist/api/scoping.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoping.js","sourceRoot":"","sources":["../../src/api/scoping.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE3D;;;GAGG;AACH,KAAK,UAAU,eAAe,CAC5B,OAAc,EACd,eAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACjE,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAE7B,yBAAyB;QACzB,MAAM,aAAa,GAAG,MAAM,OAAO,CACjC,IAAI,OAAO,CAAC,kCAAkC,UAAU,QAAQ,CAAC,CAClE,CAAC;QAEF,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YAC7C,OAAO,CAAC,KAAK,CACX,oBAAoB,UAAU,mBAAmB,aAAa,CAAC,MAAM,EAAE,CACxE,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,YAAY,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAC/C,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,QAAQ;YACpC,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,KAAK,CAClC,CAAC;QAEF,OAAO,UAAU,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB;;;;;;;;OAQG;IACH,KAAK,CAAC,iBAAiB,CACrB,SAAgB,EAChB,YAA0B,EAC1B,eAAuB;QAEvB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,mBAAmB,CAAC,CAAC;YACtD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,iBAAiB,CAAC,CAAC;YAEpD,+CAA+C;YAC/C,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YACvE,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBAClE,OAAO,KAAK,CAAC;YACf,CAAC;YAED,8CAA8C;YAC9C,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,KAAK,CACjC,IAAI,OAAO,CAAC,kCAAkC,UAAU,EAAE,CAAC,CAC5D,CAAC;YACF,IAAI,SAAS,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7B,OAAO,CAAC,KAAK,CACX,kDAAkD,SAAS,CAAC,MAAM,EAAE,CACrE,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;YAED,wCAAwC;YACxC,MAAM,YAAY,GAAG,MAAM,SAAS,CAClC,IAAI,OAAO,CAAC,kCAAkC,UAAU,EAAE,CAAC,CAC5D,CAAC;YACF,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAChC,OAAO,CAAC,KAAK,CACX,iDAAiD,YAAY,CAAC,MAAM,EAAE,CACvE,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,OAAO,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAA2B,CAAC;YACtE,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;gBACtC,OAAO,CAAC,KAAK,CACX,4CAA4C,UAAU,SAAS,OAAO,CAAC,UAAU,EAAE,CACpF,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;YAED,8BAA8B;YAC9B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAChC,IAAI,OAAO,CACT,6BAA6B,kBAAkB,CAAC,eAAe,CAAC,mBAAmB,CACpF,CACF,CAAC;YACF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,OAAO,CAAC,KAAK,CACX,6CAA6C,QAAQ,CAAC,MAAM,EAAE,CAC/D,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,YAAY,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAE1C,CAAC;YACF,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnC,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBAClE,OAAO,KAAK,CAAC;YACf,CAAC;YAED,0CAA0C;YAC1C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAChC,IAAI,OAAO,CACT,6BAA6B,kBAAkB,CAAC,eAAe,CAAC,mBAAmB,CACpF,CACF,CAAC;YACF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,OAAO,CAAC,KAAK,CACX,6CAA6C,QAAQ,CAAC,MAAM,EAAE,CAC/D,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,YAAY,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAE1C,CAAC;YACF,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnC,OAAO,CAAC,KAAK,CACX,2CAA2C,YAAY,CAAC,IAAI,CAAC,MAAM,OAAO,CAC3E,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;YACzD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,kBAAkB,CACtB,SAAgB,EAChB,YAA0B,EAC1B,sBAA8B;QAE9B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,sBAAsB,CAAC,CAAC;YACzD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,oBAAoB,CAAC,CAAC;YAEvD,+DAA+D;YAC/D,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;YAC5E,IAAI,CAAC,UAAU;gBAAE,OAAO,KAAK,CAAC;YAE9B,6CAA6C;YAC7C,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,KAAK,CACjC,IAAI,OAAO,CACT,6BAA6B,kBAAkB,CAAC,sBAAsB,CAAC,cAAc,CACtF,CACF,CAAC;YACF,IAAI,SAAS,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7B,OAAO,CAAC,KAAK,CACX,iDAAiD,SAAS,CAAC,MAAM,EAAE,CACpE,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,OAAO,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAEtC,CAAC;YACF,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9B,OAAO,CAAC,KAAK,CACX,2CAA2C,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CACjE,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;YAED,iDAAiD;YACjD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,KAAK,CACjC,IAAI,OAAO,CACT,6BAA6B,kBAAkB,CAAC,sBAAsB,CAAC,cAAc,CACtF,CACF,CAAC;YACF,IAAI,SAAS,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7B,OAAO,CAAC,KAAK,CACX,iDAAiD,SAAS,CAAC,MAAM,EAAE,CACpE,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,OAAO,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAEtC,CAAC;YACF,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9B,OAAO,CAAC,KAAK,CACX,mDAAmD,CACpD,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,iBAAiB,CACrB,SAAgB,EAChB,YAA0B,EAC1B,eAAuB;QAEvB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,qBAAqB,CAAC,CAAC;YACxD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,mBAAmB,CAAC,CAAC;YAEtD,2BAA2B;YAC3B,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,KAAK,CACtC,IAAI,OAAO,CAAC,qCAAqC,EAAE;gBACjD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,UAAU,EAAE,eAAe;oBAC3B,cAAc,EAAE,WAAW;iBAC5B,CAAC;aACH,CAAC,CACH,CAAC;YACF,IAAI,cAAc,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAClC,OAAO,CAAC,KAAK,CACX,mCAAmC,cAAc,CAAC,MAAM,gBAAgB,CACzE,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,QAAQ,GAAG,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,CAG5C,CAAC;YACF,IAAI,QAAQ,CAAC,WAAW,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC1C,OAAO,CAAC,KAAK,CACX,+BAA+B,KAAK,CAAC,MAAM,WAAW,QAAQ,CAAC,WAAW,GAAG,CAC9E,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;YAED,0DAA0D;YAC1D,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,KAAK,CACrC,IAAI,OAAO,CAAC,qCAAqC,CAAC,CACnD,CAAC;YACF,IAAI,aAAa,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACjC,OAAO,CAAC,KAAK,CACX,mDAAmD,aAAa,CAAC,MAAM,EAAE,CAC1E,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAExC,CAAC;YACF,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBACtD,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;gBAC/D,OAAO,KAAK,CAAC;YACf,CAAC;YAED,+CAA+C;YAC/C,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,KAAK,CACrC,IAAI,OAAO,CAAC,qCAAqC,CAAC,CACnD,CAAC;YACF,IAAI,aAAa,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACjC,OAAO,CAAC,KAAK,CACX,mDAAmD,aAAa,CAAC,MAAM,EAAE,CAC1E,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAExC,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBACvD,OAAO,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBAC7D,OAAO,KAAK,CAAC;YACf,CAAC;YAED,uCAAuC;YACvC,MAAM,gBAAgB,GAAG,MAAM,SAAS,CACtC,IAAI,OAAO,CAAC,qCAAqC,CAAC,CACnD,CAAC;YACF,IAAI,gBAAgB,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACpC,OAAO,CAAC,KAAK,CACX,kDAAkD,gBAAgB,CAAC,MAAM,EAAE,CAC5E,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,QAAQ,GAAG,CAAC,MAAM,gBAAgB,CAAC,IAAI,EAAE,CAE9C,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC1D,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;gBAC1D,OAAO,KAAK,CAAC;YACf,CAAC;YAED,4CAA4C;YAC5C,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,KAAK,CACrC,IAAI,OAAO,CACT,uDAAuD,QAAQ,CAAC,EAAE,EAAE,CACrE,CACF,CAAC;YACF,IAAI,aAAa,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACjC,OAAO,CAAC,KAAK,CACX,mDAAmD,aAAa,CAAC,MAAM,EAAE,CAC1E,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAExC,CAAC;YACF,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5B,OAAO,CAAC,KAAK,CACX,6CAA6C,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CACjE,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;YACxD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB,CACtB,SAAgB,EAChB,YAA0B;QAE1B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,sBAAsB,CAAC,CAAC;YAExD,gCAAgC;YAChC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAClC,IAAI,OAAO,CAAC,4BAA4B,CAAC,CAC1C,CAAC;YACF,IAAI,WAAW,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC/B,OAAO,CAAC,KAAK,CACX,qDAAqD,WAAW,CAAC,MAAM,EAAE,CAC1E,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,OAAO,GAAG,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,CAAsB,CAAC;YAChE,IAAI,OAAO,CAAC,KAAK,KAAK,sBAAsB,EAAE,CAAC;gBAC7C,OAAO,CAAC,KAAK,CACX,+CAA+C,OAAO,CAAC,KAAK,GAAG,CAChE,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;YAED,iCAAiC;YACjC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CACnC,IAAI,OAAO,CAAC,4BAA4B,EAAE;gBACxC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;aACnE,CAAC,CACH,CAAC;YACF,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAChC,OAAO,CAAC,KAAK,CACX,sDAAsD,YAAY,CAAC,MAAM,EAAE,CAC5E,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;YAED,yCAAyC;YACzC,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,KAAK,CACrC,IAAI,OAAO,CAAC,sCAAsC,EAAE;gBAClD,MAAM,EAAE,QAAQ;aACjB,CAAC,CACH,CAAC;YACF,IAAI,cAAc,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAClC,OAAO,CAAC,KAAK,CACX,wDAAwD,cAAc,CAAC,MAAM,EAAE,CAChF,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/api/types.d.ts

@@ -1,2 +1,6 @@
 export type Fetch = (request: Request) => Promise<Response>;
+export type FetchFactory = (userName: string) => Promise<{
+    fetch: Fetch;
+    userId: string;
+}>;
 //# sourceMappingURL=types.d.ts.map

package/dist/api/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/api/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/api/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC5D,MAAM,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC"}

package/dist/index.d.ts

@@ -119,6 +119,6 @@ export interface PositronicDevServer {
      */
     bulkSecrets(filePath: string): Promise<void>;
 }
-export { testStatus, resources, brains, schedules, secrets, webhooks, signals, pages, bundle, auth } from './api/index.js';
-export type { AuthSetupResponse } from './api/index.js';
+export { testStatus, resources, brains, schedules, secrets, webhooks, signals, pages, bundle, auth, scoping } from './api/index.js';
+export type { AuthSetupResponse, Fetch, FetchFactory } from './api/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI,CAAC;IAExD;;;OAGG;IACH,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,IAAI,CAAC;IAEhD;;;;OAIG;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAE/B;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAEzB;;;;OAIG;IACH,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtD;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtC;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAE5C;;;;;OAKG;IACH,KAAK,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5E;;;OAGG;IACH,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpC;;;OAGG;IACH,KAAK,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC;IAEjD;;;OAGG;IACH,OAAO,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC;IAEnD;;;OAGG;IACH,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC;IAErD;;;OAGG;IACH,WAAW,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC,CAAC;IAErF;;;;OAIG;IACH,SAAS,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvD;;;;OAIG;IACH,YAAY,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9C;;;OAGG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9C;AAED,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAC3H,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI,CAAC;IAExD;;;OAGG;IACH,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,IAAI,CAAC;IAEhD;;;;OAIG;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAE/B;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAEzB;;;;OAIG;IACH,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtD;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtC;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAE5C;;;;;OAKG;IACH,KAAK,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5E;;;OAGG;IACH,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpC;;;OAGG;IACH,KAAK,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC;IAEjD;;;OAGG;IACH,OAAO,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC;IAEnD;;;OAGG;IACH,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC;IAErD;;;OAGG;IACH,WAAW,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC,CAAC;IAErF;;;;OAIG;IACH,SAAS,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvD;;;;OAIG;IACH,YAAY,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9C;;;OAGG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9C;AAED,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACpI,YAAY,EAAE,iBAAiB,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -9,5 +9,5 @@
  * Currently includes the PositronicDevServer interface.
  * Future additions will include REST API specifications and tests.
  */
-export { testStatus, resources, brains, schedules, secrets, webhooks, signals, pages, bundle, auth } from './api/index.js';
+export { testStatus, resources, brains, schedules, secrets, webhooks, signals, pages, bundle, auth, scoping } from './api/index.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AA6HH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AA6HH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC"}