@sanoma-ai/workflows 0.10.2 → 0.10.6

package/dist/identity-broker.js

@@ -0,0 +1,84 @@
+import { createHash } from "node:crypto";
+const CREDENTIAL = /^[A-Za-z0-9_-]{43}$/;
+const ACCOUNT = /^[a-z][a-z0-9-]+@[a-z][a-z0-9-]+\.iam\.gserviceaccount\.com$/;
+const credentialHash = (credential) => createHash("sha256").update(credential).digest("hex");
+const validEnrollment = (e) => !!e &&
+    [e.deployment, e.company, e.environment].every((v) => typeof v === "string" && v.length > 0 && v.length <= 256) &&
+    ACCOUNT.test(e.serviceAccount) &&
+    Number.isSafeInteger(e.generation) &&
+    e.generation > 0;
+const reply = (status, body) => Response.json(body, {
+    status,
+    headers: { "Cache-Control": "no-store", Pragma: "no-cache" },
+});
+// Node/edge adapters can represent an empty POST as a stream. Reject actual bytes,
+// without buffering attacker-controlled input or waiting indefinitely for its end.
+async function hasBody(request) {
+    if (!request.body)
+        return false;
+    const reader = request.body.getReader();
+    let timeout;
+    try {
+        const first = await Promise.race([
+            reader.read(),
+            new Promise((_, reject) => {
+                timeout = setTimeout(() => reject(new Error("Invalid broker request")), 5_000);
+            }),
+        ]);
+        return !first.done;
+    }
+    finally {
+        clearTimeout(timeout);
+        void reader.cancel().catch(() => { });
+    }
+}
+/** Shared server-only issuance boundary. Public factories fix the route, audience and token kind. */
+export function enrollmentBroker(options) {
+    return async (request) => {
+        let enrollment;
+        try {
+            const url = new URL(request.url);
+            if (url.pathname !== options.path || request.method !== options.method)
+                return reply(404, { error: "not_found" });
+            if (url.search || (await hasBody(request)))
+                return reply(400, { error: "invalid_request" });
+            const authorization = request.headers.get("authorization") ?? "";
+            const credential = authorization.startsWith("Bearer ") ? authorization.slice(7) : "";
+            const hash = CREDENTIAL.test(credential) ? credentialHash(credential) : undefined;
+            enrollment = hash ? await options.enrollments.active(hash) : undefined;
+            if (!validEnrollment(enrollment) || !options.accept(enrollment)) {
+                await options.audit({ result: "denied" });
+                return reply(401, { error: "unauthorized" });
+            }
+            // Copy authoritative values before any awaits; caller fields never select a target or lifetime.
+            enrollment = {
+                deployment: enrollment.deployment,
+                company: enrollment.company,
+                environment: enrollment.environment,
+                serviceAccount: enrollment.serviceAccount,
+                generation: enrollment.generation,
+            };
+            const token = await options.issue(enrollment);
+            if (!options.valid(token, Date.now()))
+                throw new Error("Invalid issued token");
+            const current = await options.enrollments.active(hash);
+            if (!current ||
+                Object.keys(enrollment).some((key) => current[key] !== enrollment[key])) {
+                await options.audit({ result: "denied", enrollment });
+                return reply(401, { error: "unauthorized" });
+            }
+            await options.audit({ result: "issued", enrollment, expiresAt: token.expiresAt });
+            return reply(200, options.body(token));
+        }
+        catch {
+            try {
+                await options.audit({ result: "unavailable", ...(enrollment && { enrollment }) });
+            }
+            catch {
+                /* fail closed */
+            }
+            return reply(503, { error: "unavailable" });
+        }
+    };
+}
+//# sourceMappingURL=identity-broker.js.map

package/dist/identity-broker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-broker.js","sourceRoot":"","sources":["../src/identity-broker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,MAAM,UAAU,GAAG,qBAAqB,CAAC;AACzC,MAAM,OAAO,GAAG,8DAA8D,CAAC;AAC/E,MAAM,cAAc,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAErG,MAAM,eAAe,GAAG,CAAC,CAAiC,EAA2B,EAAE,CACrF,CAAC,CAAC,CAAC;IACH,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC;IAC/G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC;IAC9B,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC;IAClC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC;AACnB,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,IAAa,EAAE,EAAE,CAC9C,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE;IAClB,MAAM;IACN,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE;CAC7D,CAAC,CAAC;AAEL,mFAAmF;AACnF,mFAAmF;AACnF,KAAK,UAAU,OAAO,CAAC,OAAgB;IACrC,IAAI,CAAC,OAAO,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACxC,IAAI,OAAkD,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAC/B,MAAM,CAAC,IAAI,EAAE;YACb,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC/B,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACjF,CAAC,CAAC;SACH,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;IACrB,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACtB,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,gBAAgB,CAAkC,OASjE;IACC,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,IAAI,UAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAClH,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC5F,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;YACjE,MAAM,UAAU,GAAG,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAClF,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACvE,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChE,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC1C,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAC/C,CAAC;YACD,gGAAgG;YAChG,UAAU,GAAG;gBACX,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,UAAU,EAAE,UAAU,CAAC,UAAU;aAClC,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC9C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC/E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,IAAK,CAAC,CAAC;YACxD,IACE,CAAC,OAAO;gBACP,MAAM,CAAC,IAAI,CAAC,UAAU,CAAkC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,UAAW,CAAC,GAAG,CAAC,CAAC,EAC1G,CAAC;gBACD,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;gBACtD,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAC/C,CAAC;YACD,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;YAClF,OAAO,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;YACpF,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;YACD,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/identity-provisioning.d.ts

@@ -0,0 +1,29 @@
+import type { Pool } from "pg";
+import type { IdentityEnrollment } from "./cloud-identity.ts";
+export type DeploymentIdentity = Omit<IdentityEnrollment, "generation">;
+export interface EnrollIdentity extends IdentityEnrollment {
+    hash: string;
+    validUntil: string;
+}
+/** Provisioning authority only. The serving broker receives the separate read-only interface. */
+export interface IdentityProvisioning {
+    enroll(input: EnrollIdentity): Promise<void>;
+    retire(input: DeploymentIdentity & {
+        generation: number;
+        validUntil: string;
+    }): Promise<void>;
+    revoke(input: DeploymentIdentity): Promise<void>;
+}
+export declare class IdentityProvisioningError extends Error {
+    readonly retryable: boolean;
+    readonly code: "invalid" | "conflict" | "unavailable";
+    constructor(code: "invalid" | "conflict" | "unavailable");
+}
+/** Recognize another package copy without ever forwarding arbitrary messages or code strings. */
+export declare function identityProvisioningCode(error: unknown): IdentityProvisioningError["code"] | undefined;
+/** Caller owns a dedicated writer pool; never give this pool to the broker or company code. */
+export declare function postgresIdentityProvisioning(database: () => Promise<Pick<Pool, "connect">>, options: {
+    maxValidityMs: number;
+}): IdentityProvisioning;
+/** Run-local sandbox authority: never reads or mutates the live enrollment database. */
+export declare function memoryIdentityProvisioning(): IdentityProvisioning;

package/dist/identity-provisioning.js

@@ -0,0 +1,178 @@
+export class IdentityProvisioningError extends Error {
+    retryable;
+    code;
+    constructor(code) {
+        super(`Identity provisioning: ${code}`);
+        this.name = "IdentityProvisioningError";
+        this.code = code;
+        this.retryable = code === "unavailable";
+    }
+}
+/** Recognize another package copy without ever forwarding arbitrary messages or code strings. */
+export function identityProvisioningCode(error) {
+    if (!error || typeof error !== "object" || !("name" in error) || error.name !== "IdentityProvisioningError")
+        return;
+    if (!("code" in error))
+        return;
+    switch (error.code) {
+        case "invalid":
+            return "invalid";
+        case "conflict":
+            return "conflict";
+        case "unavailable":
+            return "unavailable";
+    }
+}
+function fail(code) {
+    throw new IdentityProvisioningError(code);
+}
+const sameIdentity = (a, b) => a.deployment === b.deployment &&
+    a.company === b.company &&
+    a.environment === b.environment &&
+    a.serviceAccount === b.serviceAccount;
+const checkIdentity = (input) => {
+    if (![input.deployment, input.company, input.environment].every((s) => typeof s === "string" && s.length > 0 && s.length <= 256 && !s.includes("\0")) ||
+        !/^[a-z][a-z0-9-]+@[a-z][a-z0-9-]+\.iam\.gserviceaccount\.com$/.test(input.serviceAccount))
+        fail("invalid");
+};
+const generationOf = (generation) => {
+    if (!Number.isSafeInteger(generation) || generation <= 0)
+        fail("invalid");
+};
+const deadlineOf = (value) => {
+    const time = Date.parse(value);
+    if (!Number.isFinite(time))
+        fail("invalid");
+    return time;
+};
+/** Caller owns a dedicated writer pool; never give this pool to the broker or company code. */
+export function postgresIdentityProvisioning(database, options) {
+    const maximum = options.maxValidityMs;
+    if (!Number.isSafeInteger(maximum) || maximum <= 0)
+        fail("invalid");
+    async function transaction(input, create, run) {
+        checkIdentity(input);
+        let db;
+        try {
+            db = await (await database()).connect();
+            await db.query("BEGIN");
+            if (create)
+                await db.query(`INSERT INTO sanoma_identity.deployments (id, company, environment, service_account)
+          VALUES ($1,$2,$3,$4) ON CONFLICT (id) DO NOTHING`, [input.deployment, input.company, input.environment, input.serviceAccount]);
+            // Every writer takes the deployment row lock: enrollment cannot race revocation/retirement.
+            const { rows } = await db.query(`SELECT id AS deployment, company, environment, service_account AS "serviceAccount", enabled
+          FROM sanoma_identity.deployments WHERE id=$1 FOR UPDATE`, [input.deployment]);
+            const row = rows[0];
+            if (!row || !sameIdentity(row, input))
+                fail("conflict");
+            const clock = await db.query("SELECT clock_timestamp() AS now");
+            await run(db, row.enabled, clock.rows[0].now.getTime());
+            await db.query("COMMIT");
+        }
+        catch (error) {
+            await db?.query("ROLLBACK").catch(() => { });
+            const code = identityProvisioningCode(error);
+            if (code)
+                throw new IdentityProvisioningError(code);
+            if (error?.code === "23505")
+                throw new IdentityProvisioningError("conflict");
+            throw new IdentityProvisioningError("unavailable");
+        }
+        finally {
+            db?.release();
+        }
+    }
+    return {
+        async enroll(input) {
+            generationOf(input.generation);
+            const until = deadlineOf(input.validUntil);
+            if (!/^[0-9a-f]{64}$/.test(input.hash))
+                fail("invalid");
+            await transaction(input, true, async (db, enabled, now) => {
+                if (!enabled)
+                    fail("conflict");
+                if (until <= now || until - now > maximum)
+                    fail("invalid");
+                const { rows } = await db.query(`SELECT generation, hash, valid_until, revoked FROM sanoma_identity.credentials
+            WHERE deployment=$1 ORDER BY generation DESC`, [input.deployment]);
+                const existing = rows.find((r) => Number(r.generation) === input.generation);
+                if (existing) {
+                    // An exact retry is safe. Never extend a retired generation or revive a revoked one.
+                    if (existing.hash !== input.hash || existing.revoked || existing.valid_until.getTime() !== until)
+                        fail("conflict");
+                    return;
+                }
+                if (rows[0] && Number(rows[0].generation) >= input.generation)
+                    fail("conflict");
+                await db.query(`INSERT INTO sanoma_identity.credentials (hash, deployment, generation, valid_until)
+            VALUES ($1,$2,$3,$4)`, [input.hash, input.deployment, input.generation, new Date(until)]);
+            });
+        },
+        async retire(input) {
+            generationOf(input.generation);
+            const until = deadlineOf(input.validUntil);
+            await transaction(input, false, async (db) => {
+                // Retirement only shortens access. The predicate protects the schema's finite interval.
+                const result = await db.query(`UPDATE sanoma_identity.credentials SET
+            revoked=revoked OR $3::timestamptz <= clock_timestamp(),
+            valid_until=CASE WHEN $3::timestamptz > valid_from THEN LEAST(valid_until,$3::timestamptz) ELSE valid_until END
+            WHERE deployment=$1 AND generation=$2`, [input.deployment, input.generation, new Date(until)]);
+                if (!result.rowCount)
+                    fail("conflict");
+            });
+        },
+        async revoke(input) {
+            await transaction(input, false, async (db) => {
+                // Terminal for this deployment id. A new enrollment cannot silently re-enable it.
+                await db.query("UPDATE sanoma_identity.deployments SET enabled=false WHERE id=$1", [input.deployment]);
+            });
+        },
+    };
+}
+/** Run-local sandbox authority: never reads or mutates the live enrollment database. */
+export function memoryIdentityProvisioning() {
+    const deployments = new Map();
+    const hashes = new Set();
+    const find = (input) => {
+        checkIdentity(input);
+        const found = deployments.get(input.deployment);
+        if (!found || !sameIdentity(found.identity, input))
+            return fail("conflict");
+        return found;
+    };
+    return {
+        async enroll(input) {
+            checkIdentity(input);
+            generationOf(input.generation);
+            if (deadlineOf(input.validUntil) <= Date.now() || !/^[0-9a-f]{64}$/.test(input.hash))
+                fail("invalid");
+            const found = deployments.get(input.deployment);
+            if (found && (!sameIdentity(found.identity, input) || !found.enabled))
+                fail("conflict");
+            const current = found?.credentials.get(input.generation);
+            if (current) {
+                if (current.hash !== input.hash || deadlineOf(current.validUntil) !== deadlineOf(input.validUntil))
+                    fail("conflict");
+                return;
+            }
+            if (hashes.has(input.hash) || (found && [...found.credentials.keys()].some((g) => g >= input.generation)))
+                fail("conflict");
+            const row = found ?? { identity: { ...input }, enabled: true, credentials: new Map() };
+            row.credentials.set(input.generation, { ...input });
+            hashes.add(input.hash);
+            deployments.set(input.deployment, row);
+        },
+        async retire(input) {
+            generationOf(input.generation);
+            const deadline = deadlineOf(input.validUntil);
+            const current = find(input).credentials.get(input.generation);
+            if (!current)
+                return fail("conflict");
+            current.validUntil = new Date(Math.min(deadlineOf(current.validUntil), deadline)).toISOString();
+        },
+        async revoke(input) {
+            find(input).enabled = false;
+        },
+    };
+}
+//# sourceMappingURL=identity-provisioning.js.map

package/dist/identity-provisioning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-provisioning.js","sourceRoot":"","sources":["../src/identity-provisioning.ts"],"names":[],"mappings":"AAgBA,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,SAAS,CAAU;IACnB,IAAI,CAAyC;IACtD,YAAY,IAA4C;QACtD,KAAK,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,IAAI,KAAK,aAAa,CAAC;IAC1C,CAAC;CACF;AAED,iGAAiG;AACjG,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,2BAA2B;QAAE,OAAO;IACpH,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC;QAAE,OAAO;IAC/B,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;QACnB,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB,KAAK,aAAa;YAChB,OAAO,aAAa,CAAC;IACzB,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,IAA4B;IACxC,MAAM,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AACD,MAAM,YAAY,GAAG,CAAC,CAAqB,EAAE,CAAqB,EAAE,EAAE,CACpE,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;IAC7B,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO;IACvB,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW;IAC/B,CAAC,CAAC,cAAc,KAAK,CAAC,CAAC,cAAc,CAAC;AACxC,MAAM,aAAa,GAAG,CAAC,KAAyB,EAAE,EAAE;IAClD,IACE,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,CACzD,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CACrF;QACD,CAAC,8DAA8D,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;QAE1F,IAAI,CAAC,SAAS,CAAC,CAAC;AACpB,CAAC,CAAC;AACF,MAAM,YAAY,GAAG,CAAC,UAAkB,EAAE,EAAE;IAC1C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC;QAAE,IAAI,CAAC,SAAS,CAAC,CAAC;AAC5E,CAAC,CAAC;AACF,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,EAAE;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,+FAA+F;AAC/F,MAAM,UAAU,4BAA4B,CAC1C,QAA8C,EAC9C,OAAkC;IAElC,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC;QAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACpE,KAAK,UAAU,WAAW,CACxB,KAAyB,EACzB,MAAe,EACf,GAAqE;QAErE,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,IAAI,EAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,EAAE,GAAG,MAAM,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACxB,IAAI,MAAM;gBACR,MAAM,EAAE,CAAC,KAAK,CACZ;2DACiD,EACjD,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC,CAC3E,CAAC;YACJ,4FAA4F;YAC5F,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,KAAK,CAC7B;kEAC0D,EAC1D,CAAC,KAAK,CAAC,UAAU,CAAC,CACnB,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC;gBAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACxD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,KAAK,CAAgB,iCAAiC,CAAC,CAAC;YAC/E,MAAM,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACzD,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC5C,MAAM,IAAI,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,IAAI;gBAAE,MAAM,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC;YACpD,IAAK,KAA2B,EAAE,IAAI,KAAK,OAAO;gBAAE,MAAM,IAAI,yBAAyB,CAAC,UAAU,CAAC,CAAC;YACpG,MAAM,IAAI,yBAAyB,CAAC,aAAa,CAAC,CAAC;QACrD,CAAC;gBAAS,CAAC;YACT,EAAE,EAAE,OAAO,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAAK;YAChB,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC3C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACxD,MAAM,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;gBACxD,IAAI,CAAC,OAAO;oBAAE,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC/B,IAAI,KAAK,IAAI,GAAG,IAAI,KAAK,GAAG,GAAG,GAAG,OAAO;oBAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC3D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,KAAK,CAC7B;yDAC+C,EAC/C,CAAC,KAAK,CAAC,UAAU,CAAC,CACnB,CAAC;gBACF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC7E,IAAI,QAAQ,EAAE,CAAC;oBACb,qFAAqF;oBACrF,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,KAAK;wBAC9F,IAAI,CAAC,UAAU,CAAC,CAAC;oBACnB,OAAO;gBACT,CAAC;gBACD,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,UAAU;oBAAE,IAAI,CAAC,UAAU,CAAC,CAAC;gBAChF,MAAM,EAAE,CAAC,KAAK,CACZ;iCACuB,EACvB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAClE,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,KAAK;YAChB,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC3C,MAAM,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;gBAC3C,wFAAwF;gBACxF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B;;;kDAGwC,EACxC,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CACtD,CAAC;gBACF,IAAI,CAAC,MAAM,CAAC,QAAQ;oBAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACzC,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,KAAK;YAChB,MAAM,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;gBAC3C,kFAAkF;gBAClF,MAAM,EAAE,CAAC,KAAK,CAAC,kEAAkE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;YACzG,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,0BAA0B;IACxC,MAAM,WAAW,GAAG,IAAI,GAAG,EAGxB,CAAC;IACJ,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,IAAI,GAAG,CAAC,KAAyB,EAAE,EAAE;QACzC,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAAK;YAChB,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC/B,IAAI,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACtG,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAChD,IAAI,KAAK,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;gBAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACxF,MAAM,OAAO,GAAG,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACzD,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC;oBAChG,IAAI,CAAC,UAAU,CAAC,CAAC;gBACnB,OAAO;YACT,CAAC;YACD,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;gBACvG,IAAI,CAAC,UAAU,CAAC,CAAC;YACnB,MAAM,GAAG,GAAG,KAAK,IAAI,EAAE,QAAQ,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,GAAG,EAA0B,EAAE,CAAC;YAC/G,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;YACpD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACvB,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,KAAK;YAChB,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC/B,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC9D,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;YACtC,OAAO,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAClG,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,KAAK;YAChB,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/identity-service.d.ts

@@ -0,0 +1,25 @@
+import { type ProvisioningIdentity } from "./cloud-identity.ts";
+/** Install with administrative authority in the audit database, separately from the serving process. */
+export declare const CLOUD_IDENTITY_AUDIT_SQL = "\nCREATE SCHEMA IF NOT EXISTS sanoma_identity;\nREVOKE ALL ON SCHEMA sanoma_identity FROM PUBLIC;\nCREATE TABLE IF NOT EXISTS sanoma_identity.audit_events (\n  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),\n  recorded_at timestamptz NOT NULL DEFAULT clock_timestamp(),\n  result text NOT NULL CHECK (result IN ('issued', 'denied', 'unavailable')),\n  deployment text, company text, environment text, service_account text,\n  generation bigint, expires_at timestamptz\n);\nREVOKE ALL ON sanoma_identity.audit_events FROM PUBLIC;\n";
+export interface IdentityServiceOptions {
+    /** Explicit broker database login with SELECT only on the enrollment tables. */
+    enrollmentDatabaseUrl: string;
+    /** Explicit audit database login with INSERT only on audit_events. */
+    auditDatabaseUrl: string;
+    mode: {
+        type: "runtime";
+    } | {
+        type: "provisioning";
+        identity: ProvisioningIdentity;
+    };
+    /** Cloud Run terminates TLS. Keep this service behind the deployment's HTTPS ingress. */
+    host?: string;
+    port?: number;
+    /** Bound in-flight issuance work and database waiters; excess requests receive 429. */
+    maxConcurrentRequests?: number;
+}
+/** Starts a standalone broker without loading company code, starting a worker or installing schemas. */
+export declare function startIdentityService(options: IdentityServiceOptions): Promise<{
+    url: string;
+    stop(): Promise<void>;
+}>;

package/dist/identity-service.js

@@ -0,0 +1,148 @@
+import { createServer } from "node:http";
+import { Pool } from "pg";
+import { NodeRequest, sendNodeResponse } from "srvx/node";
+import { identityBroker, postgresIdentityEnrollments, attachedGoogleTokenIssuer, provisioningIdentityBroker, attachedGoogleIdTokenIssuer, } from "./cloud-identity.js";
+/** Install with administrative authority in the audit database, separately from the serving process. */
+export const CLOUD_IDENTITY_AUDIT_SQL = `
+CREATE SCHEMA IF NOT EXISTS sanoma_identity;
+REVOKE ALL ON SCHEMA sanoma_identity FROM PUBLIC;
+CREATE TABLE IF NOT EXISTS sanoma_identity.audit_events (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  recorded_at timestamptz NOT NULL DEFAULT clock_timestamp(),
+  result text NOT NULL CHECK (result IN ('issued', 'denied', 'unavailable')),
+  deployment text, company text, environment text, service_account text,
+  generation bigint, expires_at timestamptz
+);
+REVOKE ALL ON sanoma_identity.audit_events FROM PUBLIC;
+`;
+const unavailable = () => new Error("Identity service unavailable");
+const poolFor = (connectionString) => {
+    if (!connectionString)
+        throw unavailable();
+    const pool = new Pool({
+        connectionString,
+        max: 5,
+        connectionTimeoutMillis: 10_000,
+        query_timeout: 10_000,
+        statement_timeout: 10_000,
+    });
+    // Never forward database diagnostics: they can contain connection information.
+    pool.on("error", () => { });
+    return pool;
+};
+async function checkRoles(reader, audit) {
+    const read = await reader.query(`SELECT
+    has_schema_privilege('sanoma_identity', 'USAGE') AND
+    NOT has_schema_privilege('sanoma_identity', 'CREATE') AND
+    NOT EXISTS (SELECT FROM pg_roles WHERE rolname = current_user AND (rolsuper OR rolcreaterole OR rolcreatedb OR rolbypassrls)) AND
+    has_table_privilege('sanoma_identity.deployments', 'SELECT') AND
+    has_table_privilege('sanoma_identity.credentials', 'SELECT') AND
+    NOT has_table_privilege('sanoma_identity.deployments', 'INSERT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER') AND
+    NOT has_table_privilege('sanoma_identity.credentials', 'INSERT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER') AS allowed`);
+    const write = await audit.query(`SELECT
+    has_schema_privilege('sanoma_identity', 'USAGE') AND
+    NOT has_schema_privilege('sanoma_identity', 'CREATE') AND
+    NOT EXISTS (SELECT FROM pg_roles WHERE rolname = current_user AND (rolsuper OR rolcreaterole OR rolcreatedb OR rolbypassrls)) AND
+    has_table_privilege('sanoma_identity.audit_events', 'INSERT') AND
+    NOT has_table_privilege('sanoma_identity.audit_events', 'SELECT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER') AS allowed`);
+    if (read.rows[0]?.allowed !== true || write.rows[0]?.allowed !== true)
+        throw unavailable();
+}
+/** Starts a standalone broker without loading company code, starting a worker or installing schemas. */
+export async function startIdentityService(options) {
+    let reader, audit;
+    const server = createServer();
+    let closing;
+    const close = () => (closing ??= (async () => {
+        await new Promise((resolve) => {
+            server.close(() => resolve());
+            server.closeAllConnections();
+        });
+        await Promise.all([reader?.end(), audit?.end()]);
+    })());
+    try {
+        const limit = options.maxConcurrentRequests ?? 32;
+        if (!Number.isInteger(limit) || limit < 1 || limit > 256)
+            throw unavailable();
+        let active = 0;
+        reader = poolFor(options.enrollmentDatabaseUrl);
+        audit = poolFor(options.auditDatabaseUrl);
+        await checkRoles(reader, audit);
+        const record = async (event) => {
+            const e = event.enrollment;
+            // Fixed columns only: no tokens, hashes, headers or arbitrary caller fields.
+            await audit.query(`INSERT INTO sanoma_identity.audit_events
+        (result, deployment, company, environment, service_account, generation, expires_at)
+        VALUES ($1,$2,$3,$4,$5,$6,$7)`, [
+                event.result,
+                e?.deployment ?? null,
+                e?.company ?? null,
+                e?.environment ?? null,
+                e?.serviceAccount ?? null,
+                e?.generation ?? null,
+                event.expiresAt === undefined ? null : new Date(event.expiresAt),
+            ]);
+        };
+        const enrollments = postgresIdentityEnrollments(async () => reader);
+        const handle = options.mode.type === "runtime"
+            ? identityBroker({ enrollments, issue: attachedGoogleTokenIssuer(), audit: record })
+            : options.mode.type === "provisioning"
+                ? provisioningIdentityBroker({
+                    identity: options.mode.identity,
+                    enrollments,
+                    issue: attachedGoogleIdTokenIssuer(options.mode.identity),
+                    audit: record,
+                })
+                : (() => {
+                    throw unavailable();
+                })();
+        server.requestTimeout = 15_000;
+        server.headersTimeout = 10_000;
+        server.on("request", (req, res) => {
+            // Fetch Request adapters may hide a GET body. Refuse it at the HTTP boundary.
+            if (req.method === "GET" &&
+                (req.headers["transfer-encoding"] || (req.headers["content-length"] ?? "0") !== "0")) {
+                res.writeHead(400, { "Content-Type": "application/json", "Cache-Control": "no-store" });
+                res.end('{"error":"invalid_request"}');
+                return;
+            }
+            if (req.url === "/healthz" && (req.method === "GET" || req.method === "HEAD")) {
+                res.writeHead(200, { "Content-Type": "text/plain", "Cache-Control": "no-store" });
+                res.end("ok\n");
+                return;
+            }
+            if (active >= limit) {
+                res.writeHead(429, { "Content-Type": "application/json", "Cache-Control": "no-store", "Retry-After": "1" });
+                res.end('{"error":"busy"}');
+                return;
+            }
+            active++;
+            Promise.resolve()
+                .then(() => handle(new NodeRequest({ req, res })))
+                .then((response) => sendNodeResponse(res, response))
+                .catch(() => {
+                if (res.headersSent)
+                    res.destroy();
+                else {
+                    res.writeHead(503, { "Content-Type": "application/json", "Cache-Control": "no-store" });
+                    res.end('{"error":"unavailable"}');
+                }
+            })
+                .finally(() => {
+                active--;
+            });
+        });
+        await new Promise((resolve, reject) => {
+            server.once("error", reject);
+            server.listen(options.port ?? 8080, options.host ?? "127.0.0.1", resolve);
+        });
+        const { address, family, port } = server.address();
+        const hostname = address === "0.0.0.0" || address === "::" ? "localhost" : family === "IPv6" ? `[${address}]` : address;
+        return { url: `http://${hostname}:${port}`, stop: close };
+    }
+    catch {
+        await close().catch(() => { });
+        throw unavailable();
+    }
+}
+//# sourceMappingURL=identity-service.js.map

package/dist/identity-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-service.js","sourceRoot":"","sources":["../src/identity-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EACL,cAAc,EACd,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,GAG5B,MAAM,qBAAqB,CAAC;AAE7B,wGAAwG;AACxG,MAAM,CAAC,MAAM,wBAAwB,GAAG;;;;;;;;;;;CAWvC,CAAC;AAeF,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;AACpE,MAAM,OAAO,GAAG,CAAC,gBAAwB,EAAE,EAAE;IAC3C,IAAI,CAAC,gBAAgB;QAAE,MAAM,WAAW,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;QACpB,gBAAgB;QAChB,GAAG,EAAE,CAAC;QACN,uBAAuB,EAAE,MAAM;QAC/B,aAAa,EAAE,MAAM;QACrB,iBAAiB,EAAE,MAAM;KAC1B,CAAC,CAAC;IACH,+EAA+E;IAC/E,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC3B,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,KAAK,UAAU,UAAU,CAAC,MAAY,EAAE,KAAW;IACjD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAuB;;;;;;;0HAOkE,CAAC,CAAC;IAC1H,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,KAAK,CAAuB;;;;;2HAKmE,CAAC,CAAC;IAC3H,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,KAAK,IAAI;QAAE,MAAM,WAAW,EAAE,CAAC;AAC7F,CAAC;AAED,wGAAwG;AACxG,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAA+B;IAIxE,IAAI,MAAwB,EAAE,KAAuB,CAAC;IACtD,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,IAAI,OAAkC,CAAC;IACvC,MAAM,KAAK,GAAG,GAAG,EAAE,CACjB,CAAC,OAAO,KAAK,CAAC,KAAK,IAAI,EAAE;QACvB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9B,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC/B,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,EAAE,CAAC,CAAC;IACR,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,qBAAqB,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG;YAAE,MAAM,WAAW,EAAE,CAAC;QAC9E,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAChD,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC1C,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,KAAK,EAAE,KAAoB,EAAE,EAAE;YAC5C,MAAM,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;YAC3B,6EAA6E;YAC7E,MAAM,KAAM,CAAC,KAAK,CAChB;;sCAE8B,EAC9B;gBACE,KAAK,CAAC,MAAM;gBACZ,CAAC,EAAE,UAAU,IAAI,IAAI;gBACrB,CAAC,EAAE,OAAO,IAAI,IAAI;gBAClB,CAAC,EAAE,WAAW,IAAI,IAAI;gBACtB,CAAC,EAAE,cAAc,IAAI,IAAI;gBACzB,CAAC,EAAE,UAAU,IAAI,IAAI;gBACrB,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;aACjE,CACF,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,WAAW,GAAG,2BAA2B,CAAC,KAAK,IAAI,EAAE,CAAC,MAAO,CAAC,CAAC;QACrE,MAAM,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;YAC7B,CAAC,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACpF,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,cAAc;gBACpC,CAAC,CAAC,0BAA0B,CAAC;oBACzB,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;oBAC/B,WAAW;oBACX,KAAK,EAAE,2BAA2B,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;oBACzD,KAAK,EAAE,MAAM;iBACd,CAAC;gBACJ,CAAC,CAAC,CAAC,GAAG,EAAE;oBACJ,MAAM,WAAW,EAAE,CAAC;gBACtB,CAAC,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC;QAC/B,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC;QAC/B,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAChC,8EAA8E;YAC9E,IACE,GAAG,CAAC,MAAM,KAAK,KAAK;gBACpB,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,EACpF,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;gBACxF,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;gBACvC,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,GAAG,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;gBAC9E,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;gBAClF,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YACD,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;gBACpB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC5G,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,MAAM,EAAE,CAAC;YACT,OAAO,CAAC,OAAO,EAAE;iBACd,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;iBACjD,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;iBACnD,KAAK,CAAC,GAAG,EAAE;gBACV,IAAI,GAAG,CAAC,WAAW;oBAAE,GAAG,CAAC,OAAO,EAAE,CAAC;qBAC9B,CAAC;oBACJ,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;oBACxF,GAAG,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE;gBACZ,MAAM,EAAE,CAAC;YACX,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,OAAO,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;QAClE,MAAM,QAAQ,GACZ,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;QACzG,OAAO,EAAE,GAAG,EAAE,UAAU,QAAQ,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC9B,MAAM,WAAW,EAAE,CAAC;IACtB,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -1,8 +1,9 @@
-export { type CallContext, CLIENT_IP_HEADER, type Connector, type ConnectorSetup, type ConnectorVendor, type Driver, type DriverEnv, type DriverFn, defineConnector, DriverError, type Effect, isOp, isSvgElement, type LoginContext, type LoginHalf, type ModelContext, type Op, type OpSpec, type ResourceGroup, retryableStatus, type VendorInfo, withSetup, } from "./op.ts";
+export { type CallContext, CLIENT_IP_HEADER, requestOrigin, sameOrigin, type Connector, type ConnectorSetup, type ConnectorVendor, type Driver, type DriverEnv, type DriverFn, defineConnector, DriverError, type Effect, isOp, isSvgElement, INVITE_SECONDS, type LoginContext, type LoginHalf, type LoginIdentity, type LoginMethod, type ModelContext, type Op, type OpSpec, type ResourceGroup, retryableStatus, type SignInMethod, type SocialClients, type VendorInfo, withSetup, } from "./op.ts";
 export { SanomaPackageField, vendorInfo } from "./vendor-info.ts";
-export { defineWorkflow, Principal, type ApprovalRequest, type ApprovalResult, type ApprovalState, type Approver, type Builtin, type Ctx, type SleepRequest, type StepOptions, type Trigger, type Use, type WorkflowDefinition, } from "./define.ts";
+export { defineWorkflow, Principal, type ApprovalRequest, type ApprovalResult, type ApprovalState, type Approver, type Builtin, type Ctx, type SleepRequest, type StartedBy, type StepOptions, type Trigger, type Use, type WorkflowDefinition, } from "./define.ts";
 export { compareDeclared, type Declared, type Declaring, defineResource, diffDeclared, type FieldReference, type PlanAction, type References, type Resource, type ResourceFields, type ResourceOps, type ResourceSpec, withoutWriteOnly, } from "./resource.ts";
-export { declaredWakeup, defineConfig, resolveConfig, resolveDatabaseUrl, type ResolvedConfig, type SanomaConfig, } from "./config.ts";
+export { type DnsRecord, dnsRecord } from "./dns.ts";
+export { declaredWakeup, defineConfig, envWakeup, resolveConfig, resolveDatabaseUrl, type ResolvedConfig, type SanomaConfig, } from "./config.ts";
 export { type AppEntry, appSourceOf, readApps } from "./apps.ts";
 export { type AppDefinition, defineApp } from "./definitions.ts";
 export { appFolders, APPS_DIR, filesUnder, kindDirs } from "./paths.ts";
@@ -31,15 +32,19 @@ export { type AppMerge, type CheckResult, type Draft, draftBranch, type DraftDif
 export type { HostCapabilities, HostLifetime, HostOutputs, HostSpec } from "./host.ts";
 export { checkDatabase, type DatabaseCapabilities, type DatabaseOutputs, type DatabaseSpec, databaseUrlSecret, storeDatabaseUrl, } from "./database.ts";
 export type { Chat, Chats } from "./chats.ts";
-export { checkWakeup, type DeclaredWakeup, type WakeupOutputs, type WakeupRegistration, type WakeupSpec, wakeupHostTypes, } from "./wakeup.ts";
+export type { Tokens } from "./tokens.ts";
+export { type InviteRequest, openInvite, sealInvite, sealLoginCode } from "./seal.ts";
+export { postInvite, sanoma } from "./runtime-ops.ts";
+export { sourceKeyPair, sshPublicKey } from "./ssh-key.ts";
+export { checkWakeup, type DeclaredWakeup, type EnvWakeup, HOST_URL, WAKE_PATH, type WakeupOutputs, type WakeupRegistration, type WakeupSpec, wakeupHostTypes, } from "./wakeup.ts";
 export { type CallOptions, type ChangesFilter, type ChangeView, type ClientOptions, type ConnectionReview, SanomaClient, type RunsFilter, type RunSummary, type StartOptions, type StoredSecret, } from "./client.ts";
 export { dbosClient } from "./db.ts";
-export { AGENTS, ANONYMOUS, ANONYMOUS_PRINCIPAL, approverLabel, approverOf, CHANGE_CLOSE, CHANGE_EVENT, CHANGE_MERGE, CHANGE_OPEN, CHANGE_REVIEW, CHANGE_TOPIC, CHANGE_WORKFLOW, declaresPeople, type PeopleResource, personOf, principalOf, RUNTIME_AGENTS, HOST_CHECK_AGENT, SCHEDULE_AGENT, credentialReady, DEFAULT_SLEEP_NAME, ENDED_STATUSES, errorMessage, isEnded, isLoopback, isVisitor, mayDecide, problemAt, problemLine, RUN_STATUSES, type RunStatus, VISITORS, visitorPrincipal, warningLine, } from "./shared.ts";
+export { AGENTS, ANONYMOUS, ANONYMOUS_PRINCIPAL, approverLabel, approverOf, CHANGE_CLOSE, CHANGE_EVENT, CHANGE_MERGE, CHANGE_OPEN, CHANGE_REVIEW, CHANGE_TOPIC, CHANGE_WORKFLOW, declaresPeople, type PeopleResource, personOf, principalOf, RUNTIME_AGENTS, HOST_CHECK_AGENT, LOGIN_AGENT, LOGIN_CODE_WORKFLOW, SCHEDULE_AGENT, credentialReady, DEFAULT_SLEEP_NAME, ENDED_STATUSES, errorMessage, isEnded, isLoopback, isVisitor, mayDecide, problemAt, problemLine, RUN_STATUSES, type RunStatus, VISITORS, visitorPrincipal, warningLine, } from "./shared.ts";
 export { defineDriver, type DriverImpl, type OpIdOf } from "./op.ts";
 export { defineSteps, type Expect, type RunView, type Seed, type Steps } from "./steps.ts";
 export { SecretAccess, SecretStoreError, checkSecretConfiguration, memorySecretStore, type SecretAddress, type SecretBinding, type SecretConfiguration, type SecretLocation, type SecretStore, type SecretStoreCapabilities, type SecretStoreErrorCode, type SecretValue, } from "./secret-store.ts";
 export { defineAuthentication, checkAuthenticationStore, encodeCredentials, decodeCredentials, authenticationCredentials, verifyAuthentication, AuthenticationError, type AuthenticationProblem, type Authentication, type AuthenticationIdentity, type AuthenticationContext, type CallAuthentication, } from "./authentication.ts";
 export { checkSecretStore, type SecretStoreCheck } from "./secret-store-check.ts";
 export { postgresSecretStore } from "./credentials.ts";
-export { deploymentKey } from "./deployment-key.ts";
+export { deploymentKey, signingKeyFor } from "./deployment-key.ts";
 export { defineConnection, defineConnectionRule, connectionRef, connectionOps, type ConnectionRef, type ConnectionDefinition, type ConnectionRule, type ConnectionSnapshot, type ConnectionCard, type ConnectionHealth, type ConnectionTarget, type ConnectionSetup, } from "./connection.ts";

package/dist/index.js

@@ -1,8 +1,9 @@
-export { CLIENT_IP_HEADER, defineConnector, DriverError, isOp, isSvgElement, retryableStatus, withSetup, } from "./op.js";
+export { CLIENT_IP_HEADER, requestOrigin, sameOrigin, defineConnector, DriverError, isOp, isSvgElement, INVITE_SECONDS, retryableStatus, withSetup, } from "./op.js";
 export { SanomaPackageField, vendorInfo } from "./vendor-info.js";
 export { defineWorkflow, Principal, } from "./define.js";
 export { compareDeclared, defineResource, diffDeclared, withoutWriteOnly, } from "./resource.js";
-export { declaredWakeup, defineConfig, resolveConfig, resolveDatabaseUrl, } from "./config.js";
+export { dnsRecord } from "./dns.js";
+export { declaredWakeup, defineConfig, envWakeup, resolveConfig, resolveDatabaseUrl, } from "./config.js";
 // An app's `app.ts` (`defineApp`), and where the launcher finds an app's workflows and data file.
 export { appSourceOf, readApps } from "./apps.js";
 export { defineApp } from "./definitions.js";
@@ -30,12 +31,15 @@ export { nextFire, nextScheduledFire } from "./schedules.js";
 export { generateSecret, isSecret, memorySecrets, resolveSecrets, } from "./secret.js";
 export { draftBranch, draftOf, remoteFor, resolveRevision, SOURCE_RESOLVE, } from "./source.js";
 export { checkDatabase, databaseUrlSecret, storeDatabaseUrl, } from "./database.js";
-export { checkWakeup, wakeupHostTypes, } from "./wakeup.js";
+export { openInvite, sealInvite, sealLoginCode } from "./seal.js";
+export { postInvite, sanoma } from "./runtime-ops.js";
+export { sourceKeyPair, sshPublicKey } from "./ssh-key.js";
+export { checkWakeup, HOST_URL, WAKE_PATH, wakeupHostTypes, } from "./wakeup.js";
 export { SanomaClient, } from "./client.js";
 // A raw DBOS client on the runtime's database, for tests and tools that read DBOS directly.
 export { dbosClient } from "./db.js";
 // Also at `@sanoma-ai/workflows/shared`, which a browser bundle can import.
-export { AGENTS, ANONYMOUS, ANONYMOUS_PRINCIPAL, approverLabel, approverOf, CHANGE_CLOSE, CHANGE_EVENT, CHANGE_MERGE, CHANGE_OPEN, CHANGE_REVIEW, CHANGE_TOPIC, CHANGE_WORKFLOW, declaresPeople, personOf, principalOf, RUNTIME_AGENTS, HOST_CHECK_AGENT, SCHEDULE_AGENT, credentialReady, DEFAULT_SLEEP_NAME, ENDED_STATUSES, errorMessage, isEnded, isLoopback, isVisitor, mayDecide, problemAt, problemLine, RUN_STATUSES, VISITORS, visitorPrincipal, warningLine, } from "./shared.js";
+export { AGENTS, ANONYMOUS, ANONYMOUS_PRINCIPAL, approverLabel, approverOf, CHANGE_CLOSE, CHANGE_EVENT, CHANGE_MERGE, CHANGE_OPEN, CHANGE_REVIEW, CHANGE_TOPIC, CHANGE_WORKFLOW, declaresPeople, personOf, principalOf, RUNTIME_AGENTS, HOST_CHECK_AGENT, LOGIN_AGENT, LOGIN_CODE_WORKFLOW, SCHEDULE_AGENT, credentialReady, DEFAULT_SLEEP_NAME, ENDED_STATUSES, errorMessage, isEnded, isLoopback, isVisitor, mayDecide, problemAt, problemLine, RUN_STATUSES, VISITORS, visitorPrincipal, warningLine, } from "./shared.js";
 // describeConfig, with the outline and every problem lintWorkflow finds, lives at
 // `@sanoma-ai/workflows/describe`: what a UI renders from, apart from what runs. The worker reads
 // each workflow's outline too, to hold its runs to it.
@@ -47,6 +51,6 @@ export { SecretAccess, SecretStoreError, checkSecretConfiguration, memorySecretS
 export { defineAuthentication, checkAuthenticationStore, encodeCredentials, decodeCredentials, authenticationCredentials, verifyAuthentication, AuthenticationError, } from "./authentication.js";
 export { checkSecretStore } from "./secret-store-check.js";
 export { postgresSecretStore } from "./credentials.js";
-export { deploymentKey } from "./deployment-key.js";
+export { deploymentKey, signingKeyFor } from "./deployment-key.js";
 export { defineConnection, defineConnectionRule, connectionRef, connectionOps, } from "./connection.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,gBAAgB,EAOhB,eAAe,EACf,WAAW,EAEX,IAAI,EACJ,YAAY,EAOZ,eAAe,EAEf,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EACL,cAAc,EACd,SAAS,GAYV,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EAGf,cAAc,EACd,YAAY,EAQZ,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,cAAc,EACd,YAAY,EACZ,aAAa,EACb,kBAAkB,GAGnB,MAAM,aAAa,CAAC;AACrB,kGAAkG;AAClG,OAAO,EAAiB,WAAW,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAsB,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACxE,2GAA2G;AAC3G,gIAAgI;AAChI,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAyB,aAAa,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,EACL,cAAc,EACd,UAAU,GAMX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACL,KAAK,EAIL,WAAW,EACX,WAAW,EACX,SAAS,EAIT,OAAO,EACP,gBAAgB,EAChB,WAAW,EACX,SAAS,GACV,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EACL,cAAc,GAMf,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EACL,KAAK,EACL,QAAQ,EACR,OAAO,EACP,WAAW,EAEX,IAAI,EAIJ,UAAU,EAIV,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,WAAW,EAEX,YAAY,EACZ,YAAY,EAEZ,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,SAAS,EAET,YAAY,EAGZ,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,WAAW,EACX,YAAY,EACZ,cAAc,GAKf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACvG,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAmC,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,eAAe,EAA2C,MAAM,iBAAiB,CAAC;AAE3F,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC7D,qGAAqG;AACrG,OAAO,EACL,cAAc,EACd,QAAQ,EACR,aAAa,EAEb,cAAc,GAGf,MAAM,aAAa,CAAC;AACrB,OAAO,EAIL,WAAW,EAEX,OAAO,EAMP,SAAS,EAET,eAAe,EACf,cAAc,GAGf,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,aAAa,EAIb,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,WAAW,EAKX,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAML,YAAY,GAKb,MAAM,aAAa,CAAC;AACrB,4FAA4F;AAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,4EAA4E;AAC5E,OAAO,EACL,MAAM,EACN,SAAS,EACT,mBAAmB,EACnB,aAAa,EACb,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,aAAa,EACb,YAAY,EACZ,eAAe,EACf,cAAc,EAEd,QAAQ,EACR,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,OAAO,EACP,UAAU,EACV,SAAS,EACT,SAAS,EACT,SAAS,EACT,WAAW,EACX,YAAY,EAEZ,QAAQ,EACR,gBAAgB,EAChB,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,kFAAkF;AAClF,kGAAkG;AAClG,uDAAuD;AACvD,OAAO,EAAE,YAAY,EAAgC,MAAM,SAAS,CAAC;AACrE,6FAA6F;AAC7F,OAAO,EAAE,WAAW,EAAoD,MAAM,YAAY,CAAC;AAC3F,8EAA8E;AAC9E,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,GASlB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,GAMpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAyB,MAAM,yBAAyB,CAAC;AAElF,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,aAAa,GASd,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,gBAAgB,EAChB,aAAa,EACb,UAAU,EAOV,eAAe,EACf,WAAW,EAEX,IAAI,EACJ,YAAY,EACZ,cAAc,EASd,eAAe,EAIf,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EACL,cAAc,EACd,SAAS,GAaV,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EAGf,cAAc,EACd,YAAY,EAQZ,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAkB,SAAS,EAAE,MAAM,UAAU,CAAC;AACrD,OAAO,EACL,cAAc,EACd,YAAY,EACZ,SAAS,EACT,aAAa,EACb,kBAAkB,GAGnB,MAAM,aAAa,CAAC;AACrB,kGAAkG;AAClG,OAAO,EAAiB,WAAW,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAsB,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACxE,2GAA2G;AAC3G,gIAAgI;AAChI,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAyB,aAAa,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,EACL,cAAc,EACd,UAAU,GAMX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACL,KAAK,EAIL,WAAW,EACX,WAAW,EACX,SAAS,EAIT,OAAO,EACP,gBAAgB,EAChB,WAAW,EACX,SAAS,GACV,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EACL,cAAc,GAMf,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EACL,KAAK,EACL,QAAQ,EACR,OAAO,EACP,WAAW,EAEX,IAAI,EAIJ,UAAU,EAIV,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,WAAW,EAEX,YAAY,EACZ,YAAY,EAEZ,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,SAAS,EAET,YAAY,EAGZ,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,WAAW,EACX,YAAY,EACZ,cAAc,GAKf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACvG,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAmC,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,eAAe,EAA2C,MAAM,iBAAiB,CAAC;AAE3F,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC7D,qGAAqG;AACrG,OAAO,EACL,cAAc,EACd,QAAQ,EACR,aAAa,EAEb,cAAc,GAGf,MAAM,aAAa,CAAC;AACrB,OAAO,EAIL,WAAW,EAEX,OAAO,EAMP,SAAS,EAET,eAAe,EACf,cAAc,GAGf,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,aAAa,EAIb,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAsB,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AACtF,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EACL,WAAW,EAGX,QAAQ,EACR,SAAS,EAIT,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAML,YAAY,GAKb,MAAM,aAAa,CAAC;AACrB,4FAA4F;AAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,4EAA4E;AAC5E,OAAO,EACL,MAAM,EACN,SAAS,EACT,mBAAmB,EACnB,aAAa,EACb,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,aAAa,EACb,YAAY,EACZ,eAAe,EACf,cAAc,EAEd,QAAQ,EACR,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,OAAO,EACP,UAAU,EACV,SAAS,EACT,SAAS,EACT,SAAS,EACT,WAAW,EACX,YAAY,EAEZ,QAAQ,EACR,gBAAgB,EAChB,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,kFAAkF;AAClF,kGAAkG;AAClG,uDAAuD;AACvD,OAAO,EAAE,YAAY,EAAgC,MAAM,SAAS,CAAC;AACrE,6FAA6F;AAC7F,OAAO,EAAE,WAAW,EAAoD,MAAM,YAAY,CAAC;AAC3F,8EAA8E;AAC9E,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,GASlB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,GAMpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAyB,MAAM,yBAAyB,CAAC;AAElF,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEnE,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,aAAa,GASd,MAAM,iBAAiB,CAAC"}