npm - @rubytech/create-maxy-code - Versions diffs - 0.1.451 → 0.1.452 - Mend

@rubytech/create-maxy-code 0.1.451 → 0.1.452

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (76) hide show

package/dist/__tests__/preserve-house-cloudflare.test.js CHANGED Viewed

@@ -6,10 +6,10 @@
 // Runs under `node --test dist/__tests__/*`.
 import test from "node:test";
 import assert from "node:assert/strict";
-import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync, rmSync } from "node:fs";
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync, rmSync, statSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { backupHouseCloudflare, restoreHouseCloudflare } from "../preserve-house-cloudflare.js";
+import { backupHouseCloudflare, restoreHouseCloudflare, migrateHouseCredentialFromAccount, } from "../preserve-house-cloudflare.js";
 function makeDirs() {
     const root = mkdtempSync(join(tmpdir(), "house-1664-"));
     const installDir = join(root, "install");
@@ -57,3 +57,82 @@ test("a fresh install with no house credential creates nothing", () => {
         rmSync(root, { recursive: true, force: true });
     }
 });
+// Task 1671 — upgrade-time relocation of a per-account master into the house
+// file when none exists yet (a pre-1631 install crossing the 0.1.449 boundary).
+function acctSecrets(installDir, id, contents) {
+    const dir = join(installDir, "data/accounts", id, "secrets");
+    mkdirSync(dir, { recursive: true });
+    const p = join(dir, "cloudflare.env");
+    writeFileSync(p, contents);
+    return p;
+}
+test("relocates a per-account master into the house file, mode 600, account untouched", () => {
+    const { root, installDir } = makeDirs();
+    try {
+        const acct = acctSecrets(installDir, "acc-1", "CLOUDFLARE_API_TOKEN=cfat_minter\nCLOUDFLARE_ACCOUNT_ID=deadbeef\nCF_PAGES_D1_TOKEN=stale\n");
+        const before = readFileSync(acct, "utf-8");
+        const r = migrateHouseCredentialFromAccount(installDir);
+        assert.equal(r.result, "relocated");
+        assert.equal(r.source, "acc-1");
+        const house = join(installDir, "platform/config", "cloudflare-house.env");
+        assert.equal(readFileSync(house, "utf-8"), "CLOUDFLARE_API_TOKEN=cfat_minter\nCLOUDFLARE_ACCOUNT_ID=deadbeef\n", "only the two master keys are relocated, no stale scoped token");
+        assert.equal(statSync(house).mode & 0o777, 0o600, "house file is mode 600");
+        assert.equal(readFileSync(acct, "utf-8"), before, "account file untouched");
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+});
+test("no-op when the house file already exists (never overwrites)", () => {
+    const { root, installDir, configDir } = makeDirs();
+    try {
+        const house = join(configDir, "cloudflare-house.env");
+        writeFileSync(house, "CLOUDFLARE_API_TOKEN=existing\nCLOUDFLARE_ACCOUNT_ID=xyz\n");
+        acctSecrets(installDir, "acc-1", "CLOUDFLARE_API_TOKEN=other\nCLOUDFLARE_ACCOUNT_ID=zzz\n");
+        const r = migrateHouseCredentialFromAccount(installDir);
+        assert.equal(r.result, "noop");
+        assert.equal(readFileSync(house, "utf-8"), "CLOUDFLARE_API_TOKEN=existing\nCLOUDFLARE_ACCOUNT_ID=xyz\n", "existing house file is untouched");
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+});
+test("absent when no account carries a master (no house file, no error)", () => {
+    const { root, installDir } = makeDirs();
+    try {
+        acctSecrets(installDir, "acc-1", "CF_PAGES_D1_TOKEN=scoped_only\n");
+        const r = migrateHouseCredentialFromAccount(installDir);
+        assert.equal(r.result, "absent");
+        assert.ok(!existsSync(join(installDir, "platform/config", "cloudflare-house.env")));
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+});
+test("deterministic pick — lexicographically-first account id wins", () => {
+    const { root, installDir } = makeDirs();
+    try {
+        acctSecrets(installDir, "bbb", "CLOUDFLARE_API_TOKEN=tok_b\nCLOUDFLARE_ACCOUNT_ID=idb\n");
+        acctSecrets(installDir, "aaa", "CLOUDFLARE_API_TOKEN=tok_a\nCLOUDFLARE_ACCOUNT_ID=ida\n");
+        const r = migrateHouseCredentialFromAccount(installDir);
+        assert.equal(r.source, "aaa");
+        assert.match(readFileSync(join(installDir, "platform/config", "cloudflare-house.env"), "utf-8"), /tok_a/);
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+});
+test("full upgrade path: pre-1631 relocates, second run is a no-op", () => {
+    const { root, installDir, persistentDir } = makeDirs();
+    try {
+        // Pre-1631 upgrade: no house file survives the wipe/restore (nothing saved).
+        simulateUpgrade(installDir, persistentDir);
+        assert.ok(!existsSync(join(installDir, "platform/config", "cloudflare-house.env")));
+        acctSecrets(installDir, "acc-1", "CLOUDFLARE_API_TOKEN=cfat_minter\nCLOUDFLARE_ACCOUNT_ID=deadbeef\n");
+        assert.equal(migrateHouseCredentialFromAccount(installDir).result, "relocated");
+        assert.equal(migrateHouseCredentialFromAccount(installDir).result, "noop", "second run is idempotent");
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+});

package/dist/index.js CHANGED Viewed

@@ -11,7 +11,7 @@ import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig,
 import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
 import { findPeerBrandOnDefaultNeo4jPort } from "./peer-brand-detect.js";
 import { removeClientAdminsKey } from "./converge-client-admins.js";
-import { backupHouseCloudflare, restoreHouseCloudflare } from "./preserve-house-cloudflare.js";
+import { backupHouseCloudflare, restoreHouseCloudflare, migrateHouseCredentialFromAccount, } from "./preserve-house-cloudflare.js";
 import { resolveNeo4jPidfileScrub } from "./neo4j-pidfile-scrub.js";
 import { runInitLogging } from "./init-logging.js";
 import { requireSupportedPlatform, detectPlatform } from "./platform-detect.js";
@@ -2558,6 +2558,15 @@ function deployPayload() {
     if (restoreHouseCloudflare(INSTALL_DIR, persistentDir)) {
         console.log("  Restored Cloudflare house credential (cloudflare-house.env preserved).");
     }
+    // Task 1671 — a pre-1631 install crossing the 0.1.449 boundary has no house
+    // credential yet, but its per-account secrets still carry the account-wide
+    // master (a minter, Task 1670). Relocate it into the house file so the broker
+    // and calendar find it where the 1631 readers expect it, with zero manual
+    // step. Idempotent: no-op once the house file exists (fresh install → absent).
+    {
+        const mig = migrateHouseCredentialFromAccount(INSTALL_DIR);
+        console.log(`  [install] op=house-cred-migrate result=${mig.result}${mig.source ? ` source=${mig.source}` : ""}`);
+    }
     // users.json is read directly from persistentDir by both
     // platform/ui/app/lib/paths.ts (USERS_FILE = MAXY_DIR/users.json) and the
     // admin MCP plugin (USERS_FILE = CONFIG_DIR/users.json). No copy into the

package/dist/preserve-house-cloudflare.js CHANGED Viewed

@@ -6,8 +6,8 @@
 // calendar reconcile/publish scripts) fails with "house credential not found"
 // until an operator re-mints the token by hand. The persistent copy lives in
 // the brand's persistent config dir so even a full reinstall restores it.
-import { existsSync, cpSync, chmodSync } from "node:fs";
-import { join } from "node:path";
+import { existsSync, cpSync, chmodSync, readdirSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { join, dirname } from "node:path";
 const HOUSE_CRED_FILE = "cloudflare-house.env";
 /**
  * Copy the live house credential (if any) into the persistent store before the
@@ -35,3 +35,50 @@ export function restoreHouseCloudflare(installDir, persistentDir) {
     chmodSync(dest, 0o600);
     return true;
 }
+/**
+ * Task 1671 — on upgrade, if no house credential exists yet, relocate an
+ * existing per-account master (CLOUDFLARE_API_TOKEN + CLOUDFLARE_ACCOUNT_ID)
+ * into the house file (mode 600). This lets a pre-1631 install cross the 0.1.449
+ * boundary with zero manual step: the broker/calendar (Task 1670) then mint
+ * their scoped tokens from the relocated minter where the 1631 readers expect it.
+ *
+ * Fail-safe and idempotent:
+ * - never overwrites an existing house file (returns "noop");
+ * - never guesses a token (both master keys required);
+ * - deterministic: scans accounts sorted by id, takes the first with a master;
+ * - relocates only the two master keys, so no per-account scoped token leaks
+ *   house-side.
+ *
+ * The relocated file is preserved on subsequent upgrades by backupHouseCloudflare
+ * (Task 1664), which runs before the wipe on the next install.
+ */
+export function migrateHouseCredentialFromAccount(installDir) {
+    const house = join(installDir, "platform/config", HOUSE_CRED_FILE);
+    if (existsSync(house))
+        return { result: "noop" };
+    const accountsDir = join(installDir, "data/accounts");
+    if (!existsSync(accountsDir))
+        return { result: "absent" };
+    for (const id of readdirSync(accountsDir).sort()) {
+        const secrets = join(accountsDir, id, "secrets", "cloudflare.env");
+        if (!existsSync(secrets))
+            continue;
+        const env = {};
+        for (const line of readFileSync(secrets, "utf8").split("\n")) {
+            const m = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+            if (m)
+                env[m[1]] = m[2].trim();
+        }
+        const apiToken = env.CLOUDFLARE_API_TOKEN;
+        const accountId = env.CLOUDFLARE_ACCOUNT_ID;
+        if (!apiToken || !accountId)
+            continue;
+        mkdirSync(dirname(house), { recursive: true });
+        writeFileSync(house, `CLOUDFLARE_API_TOKEN=${apiToken}\nCLOUDFLARE_ACCOUNT_ID=${accountId}\n`, {
+            mode: 0o600,
+        });
+        chmodSync(house, 0o600);
+        return { result: "relocated", source: id };
+    }
+    return { result: "absent" };
+}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.451",
+  "version": "0.1.452",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/lib/storage-broker/dist/__tests__/cf-exec.test.js CHANGED Viewed

@@ -5,6 +5,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const node_test_1 = __importDefault(require("node:test"));
 const strict_1 = __importDefault(require("node:assert/strict"));
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
 const cf_exec_js_1 = require("../cf-exec.js");
 const cred = { apiToken: "cfat_x", accountId: "acc-h" };
 function recordingRun(stdout) {
@@ -145,4 +148,25 @@ function recordingFetch(response) {
     const cf = (0, cf_exec_js_1.makeCfExec)(cred, run);
     await strict_1.default.rejects(() => cf.d1List(), /not json/);
 });
+// Task 1670 — makeHouseCfExec resolves a scoped storage token from the house
+// minter via cf-token.sh and uses THAT token (never the minter) for wrangler.
+(0, node_test_1.default)("makeHouseCfExec runs wrangler with the scoped token, not the minter", async () => {
+    const platformRoot = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), "house-cfexec-"));
+    const cfg = (0, node_path_1.join)(platformRoot, "config");
+    (0, node_fs_1.mkdirSync)(cfg, { recursive: true });
+    const houseEnv = (0, node_path_1.join)(cfg, "cloudflare-house.env");
+    (0, node_fs_1.writeFileSync)(houseEnv, "CLOUDFLARE_API_TOKEN=cfat_minter\nCLOUDFLARE_ACCOUNT_ID=acc-h\n");
+    let sawToken = "";
+    const run = async (_cmd, args, env) => {
+        if (args.some((a) => a.endsWith("cf-token.sh"))) {
+            (0, node_fs_1.appendFileSync)(houseEnv, "CF_STORAGE_TOKEN=scoped_tok\n");
+            return { stdout: "CF_STORAGE_TOKEN\n" };
+        }
+        sawToken = env.CLOUDFLARE_API_TOKEN;
+        return { stdout: "[]" };
+    };
+    const cf = await (0, cf_exec_js_1.makeHouseCfExec)(platformRoot, run);
+    await cf.d1List();
+    strict_1.default.equal(sawToken, "scoped_tok", "wrangler saw the scoped token, not the minter");
+});
 //# sourceMappingURL=cf-exec.test.js.map

package/payload/platform/lib/storage-broker/dist/__tests__/cf-exec.test.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"cf-exec.test.js","sourceRoot":"","sources":["../../src/__tests__/cf-exec.test.ts"],"names":[],"mappings":";;;;;AAAA,0DAA6B;AAC7B,gEAAwC;AACxC,~~8CAAqE~~;~~AAErE~~,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAExD,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,KAAK,GAAwE,EAAE,CAAC;IACtF,MAAM,GAAG,GAAU,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC1C,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/B,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AACxB,CAAC;AAED,2EAA2E;AAC3E,sEAAsE;AACtE,yEAAyE;AACzE,MAAM,WAAW,GAAU,KAAK,IAAI,EAAE;IACpC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;AAC7C,CAAC,CAAC;AAEF,SAAS,cAAc,CAAC,QAAuD;IAC7E,MAAM,KAAK,GAGN,EAAE,CAAC;IACR,MAAM,OAAO,GAAY,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3C,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACvF,CAAC,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,IAAA,mBAAI,EAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;IACzE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACzF,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,gBAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACzE,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,gBAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACtE,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC;IAC1D,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;IAC5D,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IAC1C,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,gBAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAC9B,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU;KACxF,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;IACnG,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC;QACxC,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,sBAAsB,EAAE;SAChF,CAAC;KACH,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,gBAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnE,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,iEAAiE,CAAC,CAAC;IAC9F,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IACnE,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACxE,gBAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;AAC9E,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;IAC/E,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QACjC,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,EAAE,CAAC;KACrG,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,gBAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,gCAAgC,CAAC,CAAC;AACvF,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;IACnG,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QACjC,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;KAC9C,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,gBAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC,CAAC;AACnE,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;IAC3D,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IACxC,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAChC,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,gBAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;AACxF,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;IAC3F,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC;QACxC,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE;gBACN,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,sBAAsB,EAAE;oBAC7D,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,sBAAsB,EAAE;iBAC5D;aACF;SACF,CAAC;KACH,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,gBAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IACpF,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,gEAAgE,CAAC,CAAC;IAC7F,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC1C,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;AACrE,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;IAClE,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QACjC,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC;KAC3F,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,gBAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;IAC7E,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QACjC,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,EAAE,CAAC;KACrG,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,gBAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gCAAgC,CAAC,CAAC;AAC5E,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;IACjG,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QACjC,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;KAC9C,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,gBAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC;AACxD,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;IAC1D,MAAM,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,MAAM,gBAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC;AACtD,CAAC,CAAC,CAAC"}
1	+ {"version":3,"file":"cf-exec.test.js","sourceRoot":"","sources":["../../src/__tests__/cf-exec.test.ts"],"names":[],"mappings":";;;;;AAAA,0DAA6B;AAC7B,gEAAwC;AACxC,qCAAgF;AAChF,qCAAiC;AACjC,yCAAiC;AACjC,8CAAsF;AAEtF,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAExD,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,KAAK,GAAwE,EAAE,CAAC;IACtF,MAAM,GAAG,GAAU,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC1C,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/B,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AACxB,CAAC;AAED,2EAA2E;AAC3E,sEAAsE;AACtE,yEAAyE;AACzE,MAAM,WAAW,GAAU,KAAK,IAAI,EAAE;IACpC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;AAC7C,CAAC,CAAC;AAEF,SAAS,cAAc,CAAC,QAAuD;IAC7E,MAAM,KAAK,GAGN,EAAE,CAAC;IACR,MAAM,OAAO,GAAY,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3C,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACvF,CAAC,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,IAAA,mBAAI,EAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;IACzE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACzF,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,gBAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACzE,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,gBAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACtE,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC;IAC1D,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;IAC5D,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IAC1C,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,gBAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAC9B,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU;KACxF,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;IACnG,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC;QACxC,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,sBAAsB,EAAE;SAChF,CAAC;KACH,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,gBAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnE,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,iEAAiE,CAAC,CAAC;IAC9F,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IACnE,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACxE,gBAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;AAC9E,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;IAC/E,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QACjC,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,EAAE,CAAC;KACrG,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,gBAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,gCAAgC,CAAC,CAAC;AACvF,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;IACnG,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QACjC,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;KAC9C,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,gBAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC,CAAC;AACnE,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;IAC3D,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IACxC,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAChC,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,gBAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;AACxF,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;IAC3F,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC;QACxC,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE;gBACN,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,sBAAsB,EAAE;oBAC7D,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,sBAAsB,EAAE;iBAC5D;aACF;SACF,CAAC;KACH,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,gBAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IACpF,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,gEAAgE,CAAC,CAAC;IAC7F,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC1C,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;AACrE,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;IAClE,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QACjC,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC;KAC3F,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,gBAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;IAC7E,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QACjC,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,EAAE,CAAC;KACrG,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,gBAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gCAAgC,CAAC,CAAC;AAC5E,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;IACjG,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QACjC,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;KAC9C,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,gBAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC;AACxD,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;IAC1D,MAAM,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,MAAM,gBAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC;AACtD,CAAC,CAAC,CAAC;AAEH,6EAA6E;AAC7E,8EAA8E;AAC9E,IAAA,mBAAI,EAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;IACrF,MAAM,YAAY,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,IAAA,gBAAI,EAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACzC,IAAA,mBAAS,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;IACnD,IAAA,uBAAa,EAAC,QAAQ,EAAE,iEAAiE,CAAC,CAAC;IAE3F,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,MAAM,GAAG,GAAU,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC3C,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;YAChD,IAAA,wBAAc,EAAC,QAAQ,EAAE,+BAA+B,CAAC,CAAC;YAC1D,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QAC1C,CAAC;QACD,QAAQ,GAAG,GAAG,CAAC,oBAAoB,CAAC;QACpC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC,CAAC;IAEF,MAAM,EAAE,GAAG,MAAM,IAAA,4BAAe,EAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC;IAClB,gBAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,YAAY,EAAE,+CAA+C,CAAC,CAAC;AACxF,CAAC,CAAC,CAAC"}

package/payload/platform/lib/storage-broker/dist/__tests__/house-scoped-token.test.d.ts ADDED Viewed

	@@ -0,0 +1,2 @@
1	+ export {};
2	+ //# sourceMappingURL=house-scoped-token.test.d.ts.map

package/payload/platform/lib/storage-broker/dist/__tests__/house-scoped-token.test.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"house-scoped-token.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/house-scoped-token.test.ts"],"names":[],"mappings":""}

package/payload/platform/lib/storage-broker/dist/__tests__/house-scoped-token.test.js ADDED Viewed

@@ -0,0 +1,48 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// Task 1670 — resolveHouseScopedToken shells cf-token.sh against the house env
+// file and reads back the persisted key value. The cf-token.sh invocation is
+// mocked via the injected RunFn (it appends the key and echoes the key name).
+const node_test_1 = __importDefault(require("node:test"));
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const house_scoped_token_js_1 = require("../house-scoped-token.js");
+function houseFile(contents) {
+    const dir = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), "hst-"));
+    const p = (0, node_path_1.join)(dir, "cloudflare-house.env");
+    (0, node_fs_1.writeFileSync)(p, contents);
+    return p;
+}
+(0, node_test_1.default)("mints and reads back the scoped token value", async () => {
+    const p = houseFile("CLOUDFLARE_API_TOKEN=cfat_minter\nCLOUDFLARE_ACCOUNT_ID=acc\n");
+    const run = async (_cmd, args) => {
+        strict_1.default.equal(args[1], "storage", "scope passed to cf-token.sh");
+        (0, node_fs_1.appendFileSync)(p, "CF_STORAGE_TOKEN=minted_value\n");
+        return { stdout: "CF_STORAGE_TOKEN\n" };
+    };
+    const tok = await (0, house_scoped_token_js_1.resolveHouseScopedToken)("storage", p, "/x/cf-token.sh", run);
+    strict_1.default.equal(tok, "minted_value");
+});
+(0, node_test_1.default)("reuse: a pre-existing key resolves to its value", async () => {
+    const p = houseFile("CLOUDFLARE_API_TOKEN=cfat_minter\nCLOUDFLARE_ACCOUNT_ID=acc\nCF_STORAGE_TOKEN=already_here\n");
+    // cf-token.sh reuse path writes nothing new, still echoes the key.
+    const run = async () => ({ stdout: "CF_STORAGE_TOKEN\n" });
+    const tok = await (0, house_scoped_token_js_1.resolveHouseScopedToken)("storage", p, "/x/cf-token.sh", run);
+    strict_1.default.equal(tok, "already_here");
+});
+(0, node_test_1.default)("throws when the persisted key is absent after the run", async () => {
+    const p = houseFile("CLOUDFLARE_API_TOKEN=cfat_minter\nCLOUDFLARE_ACCOUNT_ID=acc\n");
+    const run = async () => ({ stdout: "CF_STORAGE_TOKEN\n" }); // writes nothing
+    await strict_1.default.rejects(() => (0, house_scoped_token_js_1.resolveHouseScopedToken)("storage", p, "/x/cf-token.sh", run));
+});
+(0, node_test_1.default)("throws when cf-token.sh returns no key name", async () => {
+    const p = houseFile("CLOUDFLARE_API_TOKEN=cfat_minter\nCLOUDFLARE_ACCOUNT_ID=acc\n");
+    const run = async () => ({ stdout: "\n" });
+    await strict_1.default.rejects(() => (0, house_scoped_token_js_1.resolveHouseScopedToken)("storage", p, "/x/cf-token.sh", run));
+});
+//# sourceMappingURL=house-scoped-token.test.js.map

package/payload/platform/lib/storage-broker/dist/__tests__/house-scoped-token.test.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"house-scoped-token.test.js","sourceRoot":"","sources":["../../src/__tests__/house-scoped-token.test.ts"],"names":[],"mappings":";;;;;AAAA,+EAA+E;AAC/E,6EAA6E;AAC7E,8EAA8E;AAC9E,0DAA6B;AAC7B,gEAAwC;AACxC,qCAA6E;AAC7E,qCAAiC;AACjC,yCAAiC;AACjC,oEAAmE;AAGnE,SAAS,SAAS,CAAC,QAAgB;IACjC,MAAM,GAAG,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,MAAM,CAAC,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;IAC5C,IAAA,uBAAa,EAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC3B,OAAO,CAAC,CAAC;AACX,CAAC;AAED,IAAA,mBAAI,EAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;IAC7D,MAAM,CAAC,GAAG,SAAS,CAAC,+DAA+D,CAAC,CAAC;IACrF,MAAM,GAAG,GAAU,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QACtC,gBAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,6BAA6B,CAAC,CAAC;QAChE,IAAA,wBAAc,EAAC,CAAC,EAAE,iCAAiC,CAAC,CAAC;QACrD,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC1C,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,IAAA,+CAAuB,EAAC,SAAS,EAAE,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAC/E,gBAAM,CAAC,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;IACjE,MAAM,CAAC,GAAG,SAAS,CAAC,8FAA8F,CAAC,CAAC;IACpH,mEAAmE;IACnE,MAAM,GAAG,GAAU,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,IAAA,+CAAuB,EAAC,SAAS,EAAE,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAC/E,gBAAM,CAAC,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;IACvE,MAAM,CAAC,GAAG,SAAS,CAAC,+DAA+D,CAAC,CAAC;IACrF,MAAM,GAAG,GAAU,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,iBAAiB;IACpF,MAAM,gBAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAA,+CAAuB,EAAC,SAAS,EAAE,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;IAC7D,MAAM,CAAC,GAAG,SAAS,CAAC,+DAA+D,CAAC,CAAC;IACrF,MAAM,GAAG,GAAU,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,gBAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAA,+CAAuB,EAAC,SAAS,EAAE,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC,CAAC;AAC3F,CAAC,CAAC,CAAC"}

package/payload/platform/lib/storage-broker/dist/__tests__/remediate.test.js CHANGED Viewed

@@ -20,4 +20,10 @@ const remediate_js_1 = require("../remediate.js");
     const before = "CLOUDFLARE_ACCOUNT_ID=acc\nCLOUDFLARE_API_TOKEN=cfat_x\nCF_PAGES_D1_TOKEN=y\nCF_DNS_TOKEN=keep\n";
     strict_1.default.equal((0, remediate_js_1.stripAccountWideTokens)(before), "CLOUDFLARE_ACCOUNT_ID=acc\nCF_DNS_TOKEN=keep\n");
 });
+// Task 1670 — the house-code data scopes reach the whole shared account, so a
+// stray copy in a sub-account file is a cross-tenant leak and must be stripped.
+(0, node_test_1.default)("strips the account-wide data scopes (storage, calendar-d1), keeps zone hosting tokens", () => {
+    const before = "CLOUDFLARE_ACCOUNT_ID=acc\nCF_STORAGE_TOKEN=cfat_d1r2\nCF_CALENDAR_D1_TOKEN=cfat_d1\nCF_DNS_TOKEN=keep\n";
+    strict_1.default.equal((0, remediate_js_1.stripAccountWideTokens)(before), "CLOUDFLARE_ACCOUNT_ID=acc\nCF_DNS_TOKEN=keep\n");
+});
 //# sourceMappingURL=remediate.test.js.map

package/payload/platform/lib/storage-broker/dist/__tests__/remediate.test.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"remediate.test.js","sourceRoot":"","sources":["../../src/__tests__/remediate.test.ts"],"names":[],"mappings":";;;;;AAAA,0DAA6B;AAC7B,gEAAwC;AACxC,kDAA0E;AAE1E,IAAA,mBAAI,EAAC,sCAAsC,EAAE,GAAG,EAAE;IAChD,MAAM,CAAC,GAAG,IAAA,8BAAe,EAAC,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;IACvF,gBAAM,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;AACpE,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,sCAAsC,EAAE,GAAG,EAAE;IAChD,gBAAM,CAAC,SAAS,CAAC,IAAA,8BAAe,EAAC,CAAC,WAAW,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,EAAE;QACzE,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,EAAE;KACZ,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,8EAA8E,EAAE,GAAG,EAAE;IACxF,MAAM,MAAM,GACV,kGAAkG,CAAC;IACrG,gBAAM,CAAC,KAAK,CAAC,IAAA,qCAAsB,EAAC,MAAM,CAAC,EAAE,gDAAgD,CAAC,CAAC;AACjG,CAAC,CAAC,CAAC"}
1	+ {"version":3,"file":"remediate.test.js","sourceRoot":"","sources":["../../src/__tests__/remediate.test.ts"],"names":[],"mappings":";;;;;AAAA,0DAA6B;AAC7B,gEAAwC;AACxC,kDAA0E;AAE1E,IAAA,mBAAI,EAAC,sCAAsC,EAAE,GAAG,EAAE;IAChD,MAAM,CAAC,GAAG,IAAA,8BAAe,EAAC,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;IACvF,gBAAM,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;AACpE,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,sCAAsC,EAAE,GAAG,EAAE;IAChD,gBAAM,CAAC,SAAS,CAAC,IAAA,8BAAe,EAAC,CAAC,WAAW,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,EAAE;QACzE,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,EAAE;KACZ,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,8EAA8E,EAAE,GAAG,EAAE;IACxF,MAAM,MAAM,GACV,kGAAkG,CAAC;IACrG,gBAAM,CAAC,KAAK,CAAC,IAAA,qCAAsB,EAAC,MAAM,CAAC,EAAE,gDAAgD,CAAC,CAAC;AACjG,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,gFAAgF;AAChF,IAAA,mBAAI,EAAC,uFAAuF,EAAE,GAAG,EAAE;IACjG,MAAM,MAAM,GACV,0GAA0G,CAAC;IAC7G,gBAAM,CAAC,KAAK,CAAC,IAAA,qCAAsB,EAAC,MAAM,CAAC,EAAE,gDAAgD,CAAC,CAAC;AACjG,CAAC,CAAC,CAAC"}

package/payload/platform/lib/storage-broker/dist/bin/remediate-run.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"remediate-run.d.ts","sourceRoot":"","sources":["../../src/bin/remediate-run.ts"],"names":[],"mappings":"AAaA,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;~~AAIxE~~,MAAM,WAAW,eAAe;IAC9B,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAC/D,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAC/D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,QAAQ,CAAC,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAChD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA2CtF"}
1	+ {"version":3,"file":"remediate-run.d.ts","sourceRoot":"","sources":["../../src/bin/remediate-run.ts"],"names":[],"mappings":"AAaA,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAKxE,MAAM,WAAW,eAAe;IAC9B,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAC/D,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAC/D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,QAAQ,CAAC,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAChD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA2CtF"}

package/payload/platform/lib/storage-broker/dist/bin/remediate-run.js CHANGED Viewed

@@ -16,6 +16,7 @@ const remediate_js_1 = require("../remediate.js");
 const registry_js_1 = require("../registry.js");
 const house_credential_js_1 = require("../house-credential.js");
 const cf_exec_js_1 = require("../cf-exec.js");
+const house_scoped_token_js_1 = require("../house-scoped-token.js");
 async function runRemediation(deps) {
     const d1 = await deps.cfD1();
     const r2 = await deps.cfR2();
@@ -67,7 +68,7 @@ function findMasterFromAccounts(accountsDir) {
                 env[m[1]] = m[2].trim();
         }
         if (env.CLOUDFLARE_API_TOKEN && env.CLOUDFLARE_ACCOUNT_ID) {
-            return { apiToken: env.CLOUDFLARE_API_TOKEN, accountId: env.CLOUDFLARE_ACCOUNT_ID };
+            return { apiToken: env.CLOUDFLARE_API_TOKEN, accountId: env.CLOUDFLARE_ACCOUNT_ID, path: p };
         }
     }
     return null;
@@ -87,10 +88,13 @@ async function main() {
     const configPath = (0, node_path_1.join)(platformRoot, "config", "cloudflare-house.env");
     const mapping = JSON.parse((0, node_fs_1.readFileSync)(mappingFile, "utf8"));
     // The master is wherever it lives today: the house file if already relocated,
-    // else the first sub-account secrets file that still carries it.
+    // else the first sub-account secrets file that still carries it. masterFile is
+    // the file cf-token.sh mints the scoped enumeration token against.
     let master;
+    let masterFile;
     try {
         master = (0, house_credential_js_1.readHouseCredential)(platformRoot);
+        masterFile = configPath;
     }
     catch {
         const found = findMasterFromAccounts(accountsDir);
@@ -99,9 +103,15 @@ async function main() {
             process.exit(2);
             return;
         }
-        master = found;
+        master = { apiToken: found.apiToken, accountId: found.accountId };
+        masterFile = found.path;
     }
-    const cf = (0, cf_exec_js_1.makeCfExec)(master);
+    // Task 1670 — the master is a minter; enumerate D1/R2 through a scoped storage
+    // token minted from it, never the minter directly. `master` (the raw minter)
+    // is still what runRemediation relocates into the house file below.
+    const cfTokenSh = (0, node_path_1.join)(platformRoot, "plugins/cloudflare/bin/cf-token.sh");
+    const scoped = await (0, house_scoped_token_js_1.resolveHouseScopedToken)("storage", masterFile, cfTokenSh);
+    const cf = (0, cf_exec_js_1.makeCfExec)({ apiToken: scoped, accountId: master.accountId });
     const neo4j = (await import("neo4j-driver"));
     const driver = neo4j.default.driver(process.env.NEO4J_URI, neo4j.default.auth.basic(process.env.NEO4J_USER ?? "neo4j", process.env.NEO4J_PASSWORD ?? ""));
     const session = driver.session();

package/payload/platform/lib/storage-broker/dist/bin/remediate-run.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"remediate-run.js","sourceRoot":"","sources":["../../src/bin/remediate-run.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,iFAAiF;AACjF,6EAA6E;AAC7E,+EAA+E;AAC/E,wDAAwD;AACxD,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,iBAAiB;;~~AAwBjB~~,wCA2CC;~~AAjED~~,qCAA0F;AAC1F,yCAAmD;AACnD,kDAA0E;AAC1E,gDAAwE;AACxE,gEAA6D;AAC7D,8CAA2C;~~AAiBpC~~,KAAK,UAAU,cAAc,CAAC,IAAqB;IACxD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAExE,4EAA4E;IAC5E,uDAAuD;IACvD,MAAM,UAAU,GAAG,IAAA,8BAAe,EAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,mDAAmD,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtG,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;IACnH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;IACnH,CAAC;IAED,+EAA+E;IAC/E,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,IAAA,uBAAa,EACX,IAAI,CAAC,UAAU,EACf,wBAAwB,IAAI,CAAC,MAAM,CAAC,QAAQ,2BAA2B,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,EAChG,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IAEF,sEAAsE;IACtE,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,IAAI,IAAA,oBAAU,EAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,KAAK,MAAM,SAAS,IAAI,IAAA,qBAAW,EAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACtD,MAAM,CAAC,GAAG,IAAA,gBAAI,EAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;YACzE,IAAI,CAAC,IAAA,oBAAU,EAAC,CAAC,CAAC;gBAAE,SAAS;YAC7B,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACvC,MAAM,KAAK,GAAG,IAAA,qCAAsB,EAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBACrB,IAAA,uBAAa,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACzC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC;AAC9D,CAAC;AAED,6EAA6E;AAE7E,SAAS,sBAAsB,~~CAAC~~,WAAmB;~~IACjD~~,IAAI,CAAC,IAAA,oBAAU,EAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,KAAK,MAAM,SAAS,IAAI,IAAA,qBAAW,EAAC,WAAW,CAAC,EAAE,CAAC;QACjD,MAAM,CAAC,GAAG,IAAA,gBAAI,EAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;QACpE,IAAI,CAAC,IAAA,oBAAU,EAAC,CAAC,CAAC;YAAE,SAAS;QAC7B,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,IAAA,sBAAY,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;YAC3D,IAAI,CAAC;gBAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC;QACD,IAAI,GAAG,CAAC,oBAAoB,IAAI,GAAG,CAAC,qBAAqB,EAAE,CAAC;YAC1D,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,oBAAoB,EAAE,SAAS,EAAE,GAAG,CAAC,qBAAqB,EAAE,CAAC;~~QACtF~~,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAA,oBAAU,EAAC,WAAW,CAAC,EAAE,CAAC;QAC7C,OAAO,CAAC,KAAK,CAAC,8CAA8C,WAAW,IAAI,QAAQ,EAAE,CAAC,CAAC;QACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC/C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,WAAW,GAAG,IAAA,mBAAO,EAAC,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,IAAA,gBAAI,EAAC,YAAY,EAAE,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,WAAW,EAAE,MAAM,CAAC,CAA2B,CAAC;IAExF,8EAA8E;IAC9E,~~iEAAiE~~;~~IACjE~~,IAAI,MAA+C,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,IAAA,yCAAmB,EAAC,YAAY,CAAC,CAAC;~~IAC7C~~,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,wFAAwF,CAAC,CAAC;YACxG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QACD,MAAM,GAAG,KAAK,CAAC;~~IACjB~~,CAAC;IAED,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,MAAM,CAAC,CAAC;~~IAC9B~~,MAAM,KAAK,GAAG,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,CAAQ,CAAC;IACpD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CACjC,OAAO,CAAC,GAAG,CAAC,SAAS,EACrB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAC9F,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1F,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1F,OAAO;YACP,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,8BAAgB,EAAC,OAAO,EAAE,CAAC,CAAC;YAC7C,WAAW;YACX,MAAM;YACN,UAAU;SACX,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,+BAA+B,MAAM,CAAC,UAAU,aAAa,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5G,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC5B,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACnB,OAAO,CAAC,KAAK,CAAC,sBAAuB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
1	+ {"version":3,"file":"remediate-run.js","sourceRoot":"","sources":["../../src/bin/remediate-run.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,iFAAiF;AACjF,6EAA6E;AAC7E,+EAA+E;AAC/E,wDAAwD;AACxD,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,iBAAiB;;AAyBjB,wCA2CC;AAlED,qCAA0F;AAC1F,yCAAmD;AACnD,kDAA0E;AAC1E,gDAAwE;AACxE,gEAA6D;AAC7D,8CAA2C;AAC3C,oEAAmE;AAiB5D,KAAK,UAAU,cAAc,CAAC,IAAqB;IACxD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAExE,4EAA4E;IAC5E,uDAAuD;IACvD,MAAM,UAAU,GAAG,IAAA,8BAAe,EAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,mDAAmD,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtG,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;IACnH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;IACnH,CAAC;IAED,+EAA+E;IAC/E,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,IAAA,uBAAa,EACX,IAAI,CAAC,UAAU,EACf,wBAAwB,IAAI,CAAC,MAAM,CAAC,QAAQ,2BAA2B,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,EAChG,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IAEF,sEAAsE;IACtE,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,IAAI,IAAA,oBAAU,EAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,KAAK,MAAM,SAAS,IAAI,IAAA,qBAAW,EAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACtD,MAAM,CAAC,GAAG,IAAA,gBAAI,EAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;YACzE,IAAI,CAAC,IAAA,oBAAU,EAAC,CAAC,CAAC;gBAAE,SAAS;YAC7B,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACvC,MAAM,KAAK,GAAG,IAAA,qCAAsB,EAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBACrB,IAAA,uBAAa,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACzC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC;AAC9D,CAAC;AAED,6EAA6E;AAE7E,SAAS,sBAAsB,CAC7B,WAAmB;IAEnB,IAAI,CAAC,IAAA,oBAAU,EAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,KAAK,MAAM,SAAS,IAAI,IAAA,qBAAW,EAAC,WAAW,CAAC,EAAE,CAAC;QACjD,MAAM,CAAC,GAAG,IAAA,gBAAI,EAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;QACpE,IAAI,CAAC,IAAA,oBAAU,EAAC,CAAC,CAAC;YAAE,SAAS;QAC7B,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,IAAA,sBAAY,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;YAC3D,IAAI,CAAC;gBAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC;QACD,IAAI,GAAG,CAAC,oBAAoB,IAAI,GAAG,CAAC,qBAAqB,EAAE,CAAC;YAC1D,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,oBAAoB,EAAE,SAAS,EAAE,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/F,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAA,oBAAU,EAAC,WAAW,CAAC,EAAE,CAAC;QAC7C,OAAO,CAAC,KAAK,CAAC,8CAA8C,WAAW,IAAI,QAAQ,EAAE,CAAC,CAAC;QACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC/C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,WAAW,GAAG,IAAA,mBAAO,EAAC,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,IAAA,gBAAI,EAAC,YAAY,EAAE,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,WAAW,EAAE,MAAM,CAAC,CAA2B,CAAC;IAExF,8EAA8E;IAC9E,+EAA+E;IAC/E,mEAAmE;IACnE,IAAI,MAA+C,CAAC;IACpD,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,IAAA,yCAAmB,EAAC,YAAY,CAAC,CAAC;QAC3C,UAAU,GAAG,UAAU,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,wFAAwF,CAAC,CAAC;YACxG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QACD,MAAM,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QAClE,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC;IAC1B,CAAC;IAED,+EAA+E;IAC/E,6EAA6E;IAC7E,oEAAoE;IACpE,MAAM,SAAS,GAAG,IAAA,gBAAI,EAAC,YAAY,EAAE,oCAAoC,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,MAAM,IAAA,+CAAuB,EAAC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAC/E,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,CAAQ,CAAC;IACpD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CACjC,OAAO,CAAC,GAAG,CAAC,SAAS,EACrB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAC9F,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1F,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1F,OAAO;YACP,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,8BAAgB,EAAC,OAAO,EAAE,CAAC,CAAC;YAC7C,WAAW;YACX,MAAM;YACN,UAAU;SACX,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,+BAA+B,MAAM,CAAC,UAAU,aAAa,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5G,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC5B,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACnB,OAAO,CAAC,KAAK,CAAC,sBAAuB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/payload/platform/lib/storage-broker/dist/cf-exec.d.ts CHANGED Viewed

@@ -26,4 +26,5 @@ export interface CfExec {
     r2Create(name: string): Promise<void>;
 }
 export declare function makeCfExec(cred: HouseCredential, run?: RunFn, fetchFn?: FetchFn): CfExec;
+export declare function makeHouseCfExec(platformRoot: string, run?: RunFn, fetchFn?: FetchFn): Promise<CfExec>;
 //# sourceMappingURL=cf-exec.d.ts.map

package/payload/platform/lib/storage-broker/dist/cf-exec.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"cf-exec.d.ts","sourceRoot":"","sources":["../src/cf-exec.ts"],"names":[],"mappings":"~~AAKA~~,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;~~AAE7D~~,MAAM,MAAM,KAAK,GAAG,CAClB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KACxB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAMjC,MAAM,MAAM,OAAO,GAAG,CACpB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,KACrE,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC,CAAC;AAEvE,MAAM,WAAW,MAAM;IACrB,MAAM,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAC;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAuBD,wBAAgB,UAAU,CACxB,IAAI,EAAE,eAAe,EACrB,GAAG,GAAE,KAAkB,EACvB,OAAO,GAAE,OAAsB,GAC9B,MAAM,CAmFR"}
1	+ {"version":3,"file":"cf-exec.d.ts","sourceRoot":"","sources":["../src/cf-exec.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAI7D,MAAM,MAAM,KAAK,GAAG,CAClB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KACxB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAMjC,MAAM,MAAM,OAAO,GAAG,CACpB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,KACrE,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC,CAAC;AAEvE,MAAM,WAAW,MAAM;IACrB,MAAM,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAC;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAuBD,wBAAgB,UAAU,CACxB,IAAI,EAAE,eAAe,EACrB,GAAG,GAAE,KAAkB,EACvB,OAAO,GAAE,OAAsB,GAC9B,MAAM,CAmFR;AASD,wBAAsB,eAAe,CACnC,YAAY,EAAE,MAAM,EACpB,GAAG,GAAE,KAAkB,EACvB,OAAO,GAAE,OAAsB,GAC9B,OAAO,CAAC,MAAM,CAAC,CAMjB"}

package/payload/platform/lib/storage-broker/dist/cf-exec.js CHANGED Viewed

@@ -4,7 +4,11 @@
 // wrangler. `run` is injectable so the wiring is unit-testable without wrangler.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.makeCfExec = makeCfExec;
+exports.makeHouseCfExec = makeHouseCfExec;
 const node_child_process_1 = require("node:child_process");
+const node_path_1 = require("node:path");
+const house_credential_js_1 = require("./house-credential.js");
+const house_scoped_token_js_1 = require("./house-scoped-token.js");
 const defaultFetch = (url, init) => fetch(url, init);
 const defaultRun = (cmd, args, env) => new Promise((resolve, reject) => {
     (0, node_child_process_1.execFile)(cmd, args, { env }, (err, stdout, stderr) => {
@@ -94,4 +98,18 @@ function makeCfExec(cred, run = defaultRun, fetchFn = defaultFetch) {
         },
     };
 }
+// Task 1670 — build a CfExec whose token is a D1+R2 "storage" scope minted from
+// the house minter, never the minter used directly (a minter cannot run
+// wrangler d1/r2 or hit the D1/R2 API — it returns 10000). cf-token.sh
+// mints-or-reuses and persists the scope house-side; the resolved value is used
+// for both the wrangler run env and the API Bearer. The two UI-route broker
+// sites and remediate-run construct their CfExec through the house minter this
+// way instead of `makeCfExec(readHouseCredential(...))`.
+async function makeHouseCfExec(platformRoot, run = defaultRun, fetchFn = defaultFetch) {
+    const cred = (0, house_credential_js_1.readHouseCredential)(platformRoot);
+    const houseEnvPath = (0, node_path_1.join)(platformRoot, "config", "cloudflare-house.env");
+    const cfTokenSh = (0, node_path_1.join)(platformRoot, "plugins/cloudflare/bin/cf-token.sh");
+    const scoped = await (0, house_scoped_token_js_1.resolveHouseScopedToken)("storage", houseEnvPath, cfTokenSh, run);
+    return makeCfExec({ apiToken: scoped, accountId: cred.accountId }, run, fetchFn);
+}
 //# sourceMappingURL=cf-exec.js.map

package/payload/platform/lib/storage-broker/dist/cf-exec.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"cf-exec.js","sourceRoot":"","sources":["../src/cf-exec.ts"],"names":[],"mappings":";AAAA,yEAAyE;AACzE,iFAAiF;AACjF,iFAAiF;;~~AAiDjF~~,gCAuFC;~~AAtID~~,2DAA8C;~~AA0B9C~~,MAAM,YAAY,GAAY,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAE9D,MAAM,UAAU,GAAU,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAC3C,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,IAAA,6BAAQ,EAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QACnD,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,GAAG,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QACD,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,SAAS,SAAS,CAAC,GAAW,EAAE,OAAe;IAC7C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,8BAA8B,GAAG,EAAE,CAAC,CAAC;IACjF,CAAC;AACH,CAAC;AAED,SAAgB,UAAU,CACxB,IAAqB,EACrB,MAAa,UAAU,EACvB,UAAmB,YAAY;IAE/B,MAAM,GAAG,GAAG;QACV,GAAG,OAAO,CAAC,GAAG;QACd,oBAAoB,EAAE,IAAI,CAAC,QAAQ;QACnC,qBAAqB,EAAE,IAAI,CAAC,SAAS;KACZ,CAAC;IAE5B,2EAA2E;IAC3E,2EAA2E;IAC3E,gFAAgF;IAChF,OAAO;QACL,KAAK,CAAC,MAAM;YACV,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/E,OAAO,SAAS,CAAC,MAAM,EAAE,SAAS,CAAqC,CAAC;QAC1E,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,IAAI;YACjB,2EAA2E;YAC3E,wEAAwE;YACxE,uEAAuE;YACvE,MAAM,GAAG,GAAG,iDAAiD,IAAI,CAAC,SAAS,cAAc,CAAC;YAC1F,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;gBAC7B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE;oBACxC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;aAC/B,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,WAAW,CAIzC,CAAC;YACF,wEAAwE;YACxE,0EAA0E;YAC1E,+CAA+C;YAC/C,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,MAAM,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvE,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,EAAE,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACtC,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG;YACrB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAC1B,KAAK,EACL,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,CAAC,EAC3E,GAAG,CACJ,CAAC;YACF,OAAO,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,MAAM;YACV,yEAAyE;YACzE,qEAAqE;YACrE,gEAAgE;YAChE,MAAM,GAAG,GAAG,iDAAiD,IAAI,CAAC,SAAS,aAAa,CAAC;YACzF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;gBAC7B,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE;aACtD,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,gBAAgB,CAI9C,CAAC;YACF,kEAAkE;YAClE,wEAAwE;YACxE,yCAAyC;YACzC,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,IAAI;YACjB,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC"}
1	+ {"version":3,"file":"cf-exec.js","sourceRoot":"","sources":["../src/cf-exec.ts"],"names":[],"mappings":";AAAA,yEAAyE;AACzE,iFAAiF;AACjF,iFAAiF;;AAoDjF,gCAuFC;AASD,0CAUC;AA5JD,2DAA8C;AAC9C,yCAAiC;AAEjC,+DAA4D;AAC5D,mEAAkE;AAyBlE,MAAM,YAAY,GAAY,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAE9D,MAAM,UAAU,GAAU,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAC3C,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,IAAA,6BAAQ,EAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QACnD,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,GAAG,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QACD,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,SAAS,SAAS,CAAC,GAAW,EAAE,OAAe;IAC7C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,8BAA8B,GAAG,EAAE,CAAC,CAAC;IACjF,CAAC;AACH,CAAC;AAED,SAAgB,UAAU,CACxB,IAAqB,EACrB,MAAa,UAAU,EACvB,UAAmB,YAAY;IAE/B,MAAM,GAAG,GAAG;QACV,GAAG,OAAO,CAAC,GAAG;QACd,oBAAoB,EAAE,IAAI,CAAC,QAAQ;QACnC,qBAAqB,EAAE,IAAI,CAAC,SAAS;KACZ,CAAC;IAE5B,2EAA2E;IAC3E,2EAA2E;IAC3E,gFAAgF;IAChF,OAAO;QACL,KAAK,CAAC,MAAM;YACV,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/E,OAAO,SAAS,CAAC,MAAM,EAAE,SAAS,CAAqC,CAAC;QAC1E,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,IAAI;YACjB,2EAA2E;YAC3E,wEAAwE;YACxE,uEAAuE;YACvE,MAAM,GAAG,GAAG,iDAAiD,IAAI,CAAC,SAAS,cAAc,CAAC;YAC1F,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;gBAC7B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE;oBACxC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;aAC/B,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,WAAW,CAIzC,CAAC;YACF,wEAAwE;YACxE,0EAA0E;YAC1E,+CAA+C;YAC/C,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,MAAM,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvE,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,EAAE,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACtC,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG;YACrB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAC1B,KAAK,EACL,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,CAAC,EAC3E,GAAG,CACJ,CAAC;YACF,OAAO,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,MAAM;YACV,yEAAyE;YACzE,qEAAqE;YACrE,gEAAgE;YAChE,MAAM,GAAG,GAAG,iDAAiD,IAAI,CAAC,SAAS,aAAa,CAAC;YACzF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;gBAC7B,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE;aACtD,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,gBAAgB,CAI9C,CAAC;YACF,kEAAkE;YAClE,wEAAwE;YACxE,yCAAyC;YACzC,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,IAAI;YACjB,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,wEAAwE;AACxE,uEAAuE;AACvE,gFAAgF;AAChF,4EAA4E;AAC5E,+EAA+E;AAC/E,yDAAyD;AAClD,KAAK,UAAU,eAAe,CACnC,YAAoB,EACpB,MAAa,UAAU,EACvB,UAAmB,YAAY;IAE/B,MAAM,IAAI,GAAG,IAAA,yCAAmB,EAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,IAAA,gBAAI,EAAC,YAAY,EAAE,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,IAAA,gBAAI,EAAC,YAAY,EAAE,oCAAoC,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,MAAM,IAAA,+CAAuB,EAAC,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACtF,OAAO,UAAU,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;AACnF,CAAC"}

package/payload/platform/lib/storage-broker/dist/house-scoped-token.d.ts ADDED Viewed

@@ -0,0 +1,9 @@
+import type { RunFn } from "./cf-exec.js";
+/**
+ * Resolve a scoped data token (e.g. "storage" = D1+R2) from the house minter.
+ * Shells cf-token.sh, which mints or reuses the scope and persists the key into
+ * the house env file, echoing the key name. Reads that key back and returns its
+ * value. Throws if the key is absent after the run (never returns the minter).
+ */
+export declare function resolveHouseScopedToken(scope: string, houseEnvPath: string, cfTokenShPath: string, run?: RunFn): Promise<string>;
+//# sourceMappingURL=house-scoped-token.d.ts.map

package/payload/platform/lib/storage-broker/dist/house-scoped-token.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"house-scoped-token.d.ts","sourceRoot":"","sources":["../src/house-scoped-token.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAqB1C;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,GAAG,GAAE,KAAkB,GACtB,OAAO,CAAC,MAAM,CAAC,CAiBjB"}

package/payload/platform/lib/storage-broker/dist/house-scoped-token.js ADDED Viewed

@@ -0,0 +1,60 @@
+"use strict";
+// Task 1670 — the house credential is a minter. Each broker/calendar consumer
+// mints (and thereafter reuses) a scoped data token from it via cf-token.sh, the
+// single Cloudflare mint/reuse state machine. This wrapper shells that script
+// against the house env file and reads back the persisted key value. The mint
+// logic itself is not duplicated here — it lives only in cf-token.sh.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveHouseScopedToken = resolveHouseScopedToken;
+const node_fs_1 = require("node:fs");
+const node_child_process_1 = require("node:child_process");
+const defaultRun = (cmd, args, env) => new Promise((resolve, reject) => {
+    (0, node_child_process_1.execFile)(cmd, args, { env }, (err, stdout, stderr) => {
+        if (err) {
+            reject(new Error(`${cmd} ${args.join(" ")} failed: ${err.message}\n${stderr}`));
+            return;
+        }
+        resolve({ stdout: stdout.toString() });
+    });
+});
+function readKey(path, key) {
+    for (const line of (0, node_fs_1.readFileSync)(path, "utf8").split("\n")) {
+        const m = line.match(/^([A-Z0-9_]+)=(.*)$/);
+        if (m && m[1] === key)
+            return m[2].trim();
+    }
+    return undefined;
+}
+/**
+ * Resolve a scoped data token (e.g. "storage" = D1+R2) from the house minter.
+ * Shells cf-token.sh, which mints or reuses the scope and persists the key into
+ * the house env file, echoing the key name. Reads that key back and returns its
+ * value. Throws if the key is absent after the run (never returns the minter).
+ */
+async function resolveHouseScopedToken(scope, houseEnvPath, cfTokenShPath, run = defaultRun) {
+    const preexisting = readKey(houseEnvPath, keyForScope(scope)) !== undefined;
+    const { stdout } = await run("bash", [cfTokenShPath, scope, houseEnvPath], { ...process.env });
+    const keyName = stdout.trim().split("\n").pop()?.trim() ?? "";
+    if (!keyName)
+        throw new Error(`storage-broker: cf-token.sh ${scope} returned no key name`);
+    const value = readKey(houseEnvPath, keyName);
+    if (!value) {
+        throw new Error(`storage-broker: scoped token ${keyName} absent in ${houseEnvPath} after mint`);
+    }
+    console.error(`[storage-broker] op=house-scoped-token src=house scope=${scope} action=${preexisting ? "reuse" : "mint"} result=active`);
+    return value;
+}
+// The persisted key name for each scope, mirroring cf-token.sh's scope table.
+// Used only to derive the mint/reuse action for the observability line; the
+// authoritative key is whatever cf-token.sh echoes.
+function keyForScope(scope) {
+    switch (scope) {
+        case "storage":
+            return "CF_STORAGE_TOKEN";
+        case "calendar-d1":
+            return "CF_CALENDAR_D1_TOKEN";
+        default:
+            return "";
+    }
+}
+//# sourceMappingURL=house-scoped-token.js.map

package/payload/platform/lib/storage-broker/dist/house-scoped-token.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"house-scoped-token.js","sourceRoot":"","sources":["../src/house-scoped-token.ts"],"names":[],"mappings":";AAAA,8EAA8E;AAC9E,iFAAiF;AACjF,8EAA8E;AAC9E,8EAA8E;AAC9E,sEAAsE;;AA+BtE,0DAsBC;AAnDD,qCAAuC;AACvC,2DAA8C;AAG9C,MAAM,UAAU,GAAU,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAC3C,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,IAAA,6BAAQ,EAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QACnD,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,GAAG,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QACD,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,SAAS,OAAO,CAAC,IAAY,EAAE,GAAW;IACxC,KAAK,MAAM,IAAI,IAAI,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,uBAAuB,CAC3C,KAAa,EACb,YAAoB,EACpB,aAAqB,EACrB,MAAa,UAAU;IAEvB,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,KAAK,SAAS,CAAC;IAC5E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAC1B,MAAM,EACN,CAAC,aAAa,EAAE,KAAK,EAAE,YAAY,CAAC,EACpC,EAAE,GAAG,OAAO,CAAC,GAAG,EAA4B,CAC7C,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC9D,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,uBAAuB,CAAC,CAAC;IAC3F,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,gCAAgC,OAAO,cAAc,YAAY,aAAa,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,CAAC,KAAK,CACX,0DAA0D,KAAK,WAAW,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,gBAAgB,CACzH,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,oDAAoD;AACpD,SAAS,WAAW,CAAC,KAAa;IAChC,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,SAAS;YACZ,OAAO,kBAAkB,CAAC;QAC5B,KAAK,aAAa;YAChB,OAAO,sBAAsB,CAAC;QAChC;YACE,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC"}

package/payload/platform/lib/storage-broker/dist/index.d.ts CHANGED Viewed

@@ -2,6 +2,7 @@ export * from "./authorize.js";
 export * from "./registry.js";
 export * from "./house-credential.js";
 export * from "./cf-exec.js";
+export * from "./house-scoped-token.js";
 export * from "./audit.js";
 export * from "./remediate.js";
 //# sourceMappingURL=index.d.ts.map

package/payload/platform/lib/storage-broker/dist/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,cAAc,CAAC;AAC7B,cAAc,yBAAyB,CAAC;AACxC,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC"}

package/payload/platform/lib/storage-broker/dist/index.js CHANGED Viewed

@@ -25,6 +25,7 @@ __exportStar(require("./authorize.js"), exports);
 __exportStar(require("./registry.js"), exports);
 __exportStar(require("./house-credential.js"), exports);
 __exportStar(require("./cf-exec.js"), exports);
+__exportStar(require("./house-scoped-token.js"), exports);
 __exportStar(require("./audit.js"), exports);
 __exportStar(require("./remediate.js"), exports);
 //# sourceMappingURL=index.js.map