@sema-agent/sdk 0.0.74 → 0.0.76
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/client.d.ts +48 -0
- package/dist/client.d.ts.map +1 -1
- package/dist/client.js +55 -2
- package/dist/client.js.map +1 -1
- package/dist/control-client.d.ts +21 -0
- package/dist/control-client.d.ts.map +1 -1
- package/dist/control-client.js +42 -1
- package/dist/control-client.js.map +1 -1
- package/dist/control-types.d.ts +108 -0
- package/dist/control-types.d.ts.map +1 -1
- package/dist/control-types.js +15 -0
- package/dist/control-types.js.map +1 -1
- package/dist/errors.d.ts +88 -2
- package/dist/errors.d.ts.map +1 -1
- package/dist/errors.js +105 -8
- package/dist/errors.js.map +1 -1
- package/dist/events.d.ts +154 -16
- package/dist/events.d.ts.map +1 -1
- package/dist/events.js +1 -0
- package/dist/events.js.map +1 -1
- package/dist/health.d.ts +44 -0
- package/dist/health.d.ts.map +1 -1
- package/dist/health.js +32 -0
- package/dist/health.js.map +1 -1
- package/dist/idempotency.d.ts +8 -0
- package/dist/idempotency.d.ts.map +1 -1
- package/dist/idempotency.js +8 -0
- package/dist/idempotency.js.map +1 -1
- package/dist/index.d.ts +19 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +13 -0
- package/dist/index.js.map +1 -1
- package/dist/resources/approvals.d.ts +43 -0
- package/dist/resources/approvals.d.ts.map +1 -1
- package/dist/resources/approvals.js +23 -3
- package/dist/resources/approvals.js.map +1 -1
- package/dist/resources/assistant.d.ts +23 -0
- package/dist/resources/assistant.d.ts.map +1 -1
- package/dist/resources/assistant.js +22 -0
- package/dist/resources/assistant.js.map +1 -1
- package/dist/resources/control/auth-providers.d.ts +17 -0
- package/dist/resources/control/auth-providers.d.ts.map +1 -1
- package/dist/resources/control/auth-providers.js +6 -0
- package/dist/resources/control/auth-providers.js.map +1 -1
- package/dist/resources/control/config.d.ts +22 -0
- package/dist/resources/control/config.d.ts.map +1 -1
- package/dist/resources/control/config.js +12 -0
- package/dist/resources/control/config.js.map +1 -1
- package/dist/resources/control/fleet.d.ts +15 -0
- package/dist/resources/control/fleet.d.ts.map +1 -1
- package/dist/resources/control/fleet.js +8 -0
- package/dist/resources/control/fleet.js.map +1 -1
- package/dist/resources/control/images.d.ts +20 -0
- package/dist/resources/control/images.d.ts.map +1 -1
- package/dist/resources/control/images.js +10 -0
- package/dist/resources/control/images.js.map +1 -1
- package/dist/resources/control/lifecycle.d.ts +8 -0
- package/dist/resources/control/lifecycle.d.ts.map +1 -1
- package/dist/resources/control/lifecycle.js +3 -0
- package/dist/resources/control/lifecycle.js.map +1 -1
- package/dist/resources/control/publish.d.ts +12 -0
- package/dist/resources/control/publish.d.ts.map +1 -1
- package/dist/resources/control/publish.js +6 -0
- package/dist/resources/control/publish.js.map +1 -1
- package/dist/resources/control/secrets.d.ts +28 -0
- package/dist/resources/control/secrets.d.ts.map +1 -1
- package/dist/resources/control/secrets.js +16 -0
- package/dist/resources/control/secrets.js.map +1 -1
- package/dist/resources/control/users.d.ts +22 -0
- package/dist/resources/control/users.d.ts.map +1 -1
- package/dist/resources/control/users.js +12 -0
- package/dist/resources/control/users.js.map +1 -1
- package/dist/resources/control/versioning.d.ts +12 -0
- package/dist/resources/control/versioning.d.ts.map +1 -1
- package/dist/resources/control/versioning.js +6 -0
- package/dist/resources/control/versioning.js.map +1 -1
- package/dist/resources/control/workers.d.ts +14 -0
- package/dist/resources/control/workers.d.ts.map +1 -1
- package/dist/resources/control/workers.js +7 -0
- package/dist/resources/control/workers.js.map +1 -1
- package/dist/resources/elicitations.d.ts +43 -0
- package/dist/resources/elicitations.d.ts.map +1 -1
- package/dist/resources/elicitations.js +8 -0
- package/dist/resources/elicitations.js.map +1 -1
- package/dist/resources/fleet.d.ts +90 -0
- package/dist/resources/fleet.d.ts.map +1 -1
- package/dist/resources/fleet.js +27 -4
- package/dist/resources/fleet.js.map +1 -1
- package/dist/resources/images.d.ts +34 -0
- package/dist/resources/images.d.ts.map +1 -1
- package/dist/resources/images.js +29 -3
- package/dist/resources/images.js.map +1 -1
- package/dist/resources/leader.d.ts +10 -0
- package/dist/resources/leader.d.ts.map +1 -1
- package/dist/resources/leader.js +4 -0
- package/dist/resources/leader.js.map +1 -1
- package/dist/resources/memory.d.ts +37 -0
- package/dist/resources/memory.d.ts.map +1 -1
- package/dist/resources/memory.js +28 -0
- package/dist/resources/memory.js.map +1 -1
- package/dist/resources/models.d.ts +12 -0
- package/dist/resources/models.d.ts.map +1 -1
- package/dist/resources/models.js +4 -0
- package/dist/resources/models.js.map +1 -1
- package/dist/resources/ops.d.ts +16 -0
- package/dist/resources/ops.d.ts.map +1 -1
- package/dist/resources/ops.js +6 -0
- package/dist/resources/ops.js.map +1 -1
- package/dist/resources/policy.d.ts +8 -0
- package/dist/resources/policy.d.ts.map +1 -1
- package/dist/resources/policy.js +1 -0
- package/dist/resources/policy.js.map +1 -1
- package/dist/resources/questions.d.ts +57 -0
- package/dist/resources/questions.d.ts.map +1 -1
- package/dist/resources/questions.js +9 -0
- package/dist/resources/questions.js.map +1 -1
- package/dist/resources/runs.d.ts +143 -0
- package/dist/resources/runs.d.ts.map +1 -1
- package/dist/resources/runs.js +129 -2
- package/dist/resources/runs.js.map +1 -1
- package/dist/resources/session-sync.d.ts +61 -0
- package/dist/resources/session-sync.d.ts.map +1 -1
- package/dist/resources/session-sync.js +54 -1
- package/dist/resources/session-sync.js.map +1 -1
- package/dist/resources/sessions.d.ts +74 -0
- package/dist/resources/sessions.d.ts.map +1 -1
- package/dist/resources/sessions.js +64 -2
- package/dist/resources/sessions.js.map +1 -1
- package/dist/resources/side-query.d.ts +18 -0
- package/dist/resources/side-query.d.ts.map +1 -1
- package/dist/resources/side-query.js +1 -0
- package/dist/resources/side-query.js.map +1 -1
- package/dist/resources/tasks.d.ts +19 -0
- package/dist/resources/tasks.d.ts.map +1 -1
- package/dist/resources/tasks.js +21 -2
- package/dist/resources/tasks.js.map +1 -1
- package/dist/resources/tool-approvals.d.ts +53 -0
- package/dist/resources/tool-approvals.d.ts.map +1 -1
- package/dist/resources/tool-approvals.js +10 -0
- package/dist/resources/tool-approvals.js.map +1 -1
- package/dist/resources/trace.d.ts +23 -0
- package/dist/resources/trace.d.ts.map +1 -1
- package/dist/resources/trace.js +27 -2
- package/dist/resources/trace.js.map +1 -1
- package/dist/resources/usage.d.ts +21 -0
- package/dist/resources/usage.d.ts.map +1 -1
- package/dist/resources/usage.js +8 -0
- package/dist/resources/usage.js.map +1 -1
- package/dist/resources/workflows.d.ts +48 -0
- package/dist/resources/workflows.d.ts.map +1 -1
- package/dist/resources/workflows.js +40 -3
- package/dist/resources/workflows.js.map +1 -1
- package/dist/settings.d.ts +90 -0
- package/dist/settings.d.ts.map +1 -1
- package/dist/settings.js +24 -0
- package/dist/settings.js.map +1 -1
- package/dist/sse.d.ts +36 -0
- package/dist/sse.d.ts.map +1 -1
- package/dist/sse.js +53 -8
- package/dist/sse.js.map +1 -1
- package/dist/sync.d.ts +56 -0
- package/dist/sync.d.ts.map +1 -1
- package/dist/sync.js +48 -4
- package/dist/sync.js.map +1 -1
- package/dist/transport.d.ts +32 -0
- package/dist/transport.d.ts.map +1 -1
- package/dist/transport.js +40 -8
- package/dist/transport.js.map +1 -1
- package/dist/types.d.ts +691 -1
- package/dist/types.d.ts.map +1 -1
- package/package.json +1 -1
package/dist/control-types.d.ts
CHANGED
|
@@ -1,44 +1,87 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Control-plane wire types — the **sema-registry** (config-center) `/api/config/*` API. This is a DIFFERENT
|
|
3
|
+
* backend from the worker `/v1` usage plane (see client.ts / types.ts): different host
|
|
4
|
+
* (the registry deployment), different auth (editor/admin Bearer, NOT a worker session token).
|
|
5
|
+
*
|
|
6
|
+
* These shapes are grounded in the config-center's `src/app/api/config/<route>/route.ts` sources — not
|
|
7
|
+
* guesses. Where a
|
|
8
|
+
* route returns a store-shaped payload that the SDK does not need to interpret (the FleetSnapshot, the
|
|
9
|
+
* placement/rebalance/reschedule plans, the JSON Schemas, per-domain config values), the type is left
|
|
10
|
+
* deliberately `unknown` / open: the SDK is a faithful transport, it does NOT re-validate the control plane's
|
|
11
|
+
* own validated output, and it never lets an untrusted-but-typed shape masquerade as parsed-and-trusted.
|
|
12
|
+
*
|
|
13
|
+
* 🔴 secret discipline: the registry token is the SAME tier of secret as the worker token — it never appears
|
|
14
|
+
* in any of these types, never in an error message (errors.ts scrub), never logged.
|
|
15
|
+
*/
|
|
16
|
+
/** The config domains live behind GET/PUT /api/config/[domain]. Open string — the registry is the source of
|
|
17
|
+
* truth for the exact set (DOMAIN_SCHEMAS); a stale hard-coded union here would drift. Known at time of writing
|
|
18
|
+
* (registry-core 0.6): models, rosters, workers, hosts, systems, teams, skills, mcp, scenarios, auth,
|
|
19
|
+
* governance, providers/runtime (access + integrations deleted in 0.6, no compat). */
|
|
1
20
|
export type ConfigDomain = string;
|
|
21
|
+
/** Min RBAC role a write needs. Read endpoints accept any authenticated role (viewer+). The SDK does NOT
|
|
22
|
+
* hard-code the per-domain write-role table (domainWriteRole drifts with the registry) — it sends the write
|
|
23
|
+
* and surfaces a 403 as a ControlForbiddenError. This type is for documentation/typing only. */
|
|
2
24
|
export type ControlRole = "viewer" | "editor" | "publisher" | "admin";
|
|
25
|
+
/** GET /api/config/[domain] → the domain value + the GLOBAL config version (echo it back as `baseVersion` on a
|
|
26
|
+
* PUT for true optimistic locking). `value` is the domain's own (already schema-valid) payload — left `unknown`
|
|
27
|
+
* because the SDK does not interpret per-domain shapes (use control.config.schema to introspect them). */
|
|
3
28
|
export interface DomainRead {
|
|
4
29
|
domain: ConfigDomain;
|
|
30
|
+
/** The domain's current value, or `null` if never set. */
|
|
5
31
|
value: unknown;
|
|
32
|
+
/** Global config version at read time — CAS base for a subsequent put(). */
|
|
6
33
|
version: number;
|
|
7
34
|
}
|
|
35
|
+
/** PUT /api/config/[domain] success. A "successful" write that silently dropped unknown/misplaced keys surfaces
|
|
36
|
+
* them in `droppedKeys` (NOT a false success); a workers write that auto-assigned hosts sets `autoPlaced`. */
|
|
8
37
|
export interface PutResult {
|
|
9
38
|
ok: true;
|
|
10
39
|
version: number;
|
|
11
40
|
autoPlaced?: boolean;
|
|
12
41
|
note?: string;
|
|
42
|
+
/** Submitted keys the zod schema did not recognize and dropped — check field name/placement. */
|
|
13
43
|
droppedKeys?: string[];
|
|
14
44
|
warning?: string;
|
|
15
45
|
}
|
|
46
|
+
/** One change in a batch write. `value` is the domain's payload (unknown — same reason as DomainRead.value). */
|
|
16
47
|
export interface BatchChange {
|
|
17
48
|
domain: ConfigDomain;
|
|
18
49
|
value: unknown;
|
|
19
50
|
}
|
|
51
|
+
/** POST /api/config/batch success — atomic (all-or-nothing), version bumped ONCE. */
|
|
20
52
|
export interface BatchResult {
|
|
21
53
|
ok: true;
|
|
22
54
|
version: number;
|
|
55
|
+
/** The domains applied, in submitted order. */
|
|
23
56
|
applied: ConfigDomain[];
|
|
57
|
+
/** Auto-placement / advisory notes folded into the audit summary. */
|
|
24
58
|
notes?: string[];
|
|
25
59
|
}
|
|
60
|
+
/** A single validation issue (the flat `{ path, message }` shape PUT/batch return; batch prefixes `path` with
|
|
61
|
+
* `[changeIndex, domain, …]`). Surfaced inside ControlValidationError.issues. */
|
|
26
62
|
export interface ControlIssue {
|
|
27
63
|
path: (string | number)[];
|
|
28
64
|
message: string;
|
|
29
65
|
code?: string;
|
|
30
66
|
}
|
|
67
|
+
/** GET /api/config/schema → all domains' JSON Schema (Draft-07). The schemas are open structures (the SDK does
|
|
68
|
+
* not interpret them) keyed by domain name. */
|
|
31
69
|
export interface SchemaAll {
|
|
32
70
|
domains: Record<string, unknown>;
|
|
33
71
|
}
|
|
72
|
+
/** GET /api/config/schema?domain=<d> → one domain's JSON Schema. */
|
|
34
73
|
export interface SchemaOne {
|
|
35
74
|
domain: ConfigDomain;
|
|
36
75
|
schema: unknown;
|
|
37
76
|
}
|
|
77
|
+
/** GET /api/config/export → a portable config bundle (env-NAME refs only, never secret VALUES). `source`
|
|
78
|
+
* distinguishes the live draft from the last published snapshot. `bundle` is the `config.d/<domain>.json`
|
|
79
|
+
* shape the TOC/CLI consumes — left open (the SDK passes it through; @sema-agent/registry-core validates it). */
|
|
38
80
|
export interface ExportResult {
|
|
39
81
|
bundle: Record<string, unknown>;
|
|
40
82
|
source: "draft" | "published";
|
|
41
83
|
}
|
|
84
|
+
/** GET /api/config/changes → recent ConfigChange metadata (newest-first). `id` is the handle for diff/rollback. */
|
|
42
85
|
export interface ConfigChange {
|
|
43
86
|
id: string;
|
|
44
87
|
domain: ConfigDomain;
|
|
@@ -46,6 +89,8 @@ export interface ConfigChange {
|
|
|
46
89
|
at: string;
|
|
47
90
|
summary?: string;
|
|
48
91
|
}
|
|
92
|
+
/** GET /api/config/changes/<id>/diff → the domain payload before/after a change. before/after are domain
|
|
93
|
+
* values (unknown — not interpreted). */
|
|
49
94
|
export interface ChangeDiff {
|
|
50
95
|
domain: ConfigDomain;
|
|
51
96
|
actor: string;
|
|
@@ -54,24 +99,32 @@ export interface ChangeDiff {
|
|
|
54
99
|
before: unknown;
|
|
55
100
|
after: unknown;
|
|
56
101
|
}
|
|
102
|
+
/** POST /api/config/rollback → re-applied a past change's snapshot as a NEW change (forward-only history). */
|
|
57
103
|
export interface RollbackResult {
|
|
58
104
|
ok: true;
|
|
59
105
|
domain: ConfigDomain;
|
|
60
106
|
version: number;
|
|
61
107
|
restoredFrom: string;
|
|
62
108
|
}
|
|
109
|
+
/** Published-snapshot metadata (GET /api/config/publish → `published`). */
|
|
63
110
|
export interface PublishedMeta {
|
|
64
111
|
version: number;
|
|
65
112
|
publishedAt: string;
|
|
66
113
|
publishedBy: string;
|
|
67
114
|
summary?: string;
|
|
68
115
|
}
|
|
116
|
+
/** A pending publish request awaiting N approvals (GET /api/config/publish → `pending`). Open structure —
|
|
117
|
+
* the SDK passes the registry's PendingPublish through (requestedBy/requestedAt/draftVersion/approvals/…). */
|
|
69
118
|
export type PendingPublish = Record<string, unknown>;
|
|
119
|
+
/** GET /api/config/publish → the publish gate's current state. */
|
|
70
120
|
export interface PublishState {
|
|
71
121
|
published: PublishedMeta | null;
|
|
72
122
|
pending: PendingPublish | null;
|
|
73
123
|
approvalsRequired: number;
|
|
74
124
|
}
|
|
125
|
+
/** POST /api/config/publish result. Two shapes by approval mode:
|
|
126
|
+
* - immediate (CONFIG_PUBLISH_APPROVALS=0): `{ ok, published: true, version, publishedAt, publishedBy }`
|
|
127
|
+
* - approval mode (N>0): `{ ok, published: false, pending: true, approvalsRequired, draftVersion }`. */
|
|
75
128
|
export interface PublishResult {
|
|
76
129
|
ok: true;
|
|
77
130
|
published: boolean;
|
|
@@ -82,6 +135,7 @@ export interface PublishResult {
|
|
|
82
135
|
approvalsRequired?: number;
|
|
83
136
|
draftVersion?: number;
|
|
84
137
|
}
|
|
138
|
+
/** POST /api/config/publish/approve → one approval recorded; `published` flips true at the Nth. */
|
|
85
139
|
export interface ApprovePublishResult {
|
|
86
140
|
approved: true;
|
|
87
141
|
published: boolean;
|
|
@@ -89,12 +143,16 @@ export interface ApprovePublishResult {
|
|
|
89
143
|
approvals: number;
|
|
90
144
|
required: number;
|
|
91
145
|
}
|
|
146
|
+
/** DELETE /api/config/publish → cancel the pending request. */
|
|
92
147
|
export interface CancelPublishResult {
|
|
93
148
|
ok: true;
|
|
94
149
|
cancelled?: boolean;
|
|
95
150
|
note?: string;
|
|
96
151
|
}
|
|
152
|
+
/** GET /api/config/fleet → the operations-dashboard FleetSnapshot (desired ⊕ reconciler-reported ⊕ lifecycle,
|
|
153
|
+
* with derived signals). A large fused store shape — passed through open; the SDK does not re-fold it. */
|
|
97
154
|
export type FleetSnapshot = Record<string, unknown>;
|
|
155
|
+
/** GET /api/config/fleet/metrics → { worker → MetricsSummary } plus per-worker scrape errors / unconfigured. */
|
|
98
156
|
export interface FleetMetrics {
|
|
99
157
|
at: number;
|
|
100
158
|
metrics: Record<string, unknown>;
|
|
@@ -102,15 +160,22 @@ export interface FleetMetrics {
|
|
|
102
160
|
unconfigured: string[];
|
|
103
161
|
note?: string;
|
|
104
162
|
}
|
|
163
|
+
/** A scheduling plan (placement / rebalance / reschedule GET previews). Open — assignments/moves/violations/
|
|
164
|
+
* host-load shapes are the registry's; the SDK previews them, it does not compute scheduling. */
|
|
105
165
|
export type SchedulePlan = Record<string, unknown>;
|
|
166
|
+
/** A scheduling-apply result (placement / rebalance / reschedule POST). `applied` = count moved; `plan` echoes
|
|
167
|
+
* what was applied. */
|
|
106
168
|
export interface ScheduleApplyResult {
|
|
107
169
|
ok: true;
|
|
108
170
|
applied: number;
|
|
109
171
|
plan: SchedulePlan;
|
|
110
172
|
}
|
|
173
|
+
/** GET /api/config/workers/status → reconciler-reported worker health rows. Open per-worker status shape. */
|
|
111
174
|
export interface WorkerStatuses {
|
|
112
175
|
statuses: unknown[];
|
|
113
176
|
}
|
|
177
|
+
/** POST /api/config/workers/roll → roll matching workers' image to a git sha and publish (full-auto CD).
|
|
178
|
+
* No-match is a clean 200 no-op: `{ rolled: [], note, published: false }`. */
|
|
114
179
|
export interface RollResult {
|
|
115
180
|
rolled: {
|
|
116
181
|
workerId: string;
|
|
@@ -120,15 +185,20 @@ export interface RollResult {
|
|
|
120
185
|
version?: number;
|
|
121
186
|
note?: string;
|
|
122
187
|
}
|
|
188
|
+
/** POST /api/config/workers/<name>/rotate → bumped the worker's recreateNonce (drafted; publish to apply). */
|
|
123
189
|
export interface RotateResult {
|
|
124
190
|
ok: true;
|
|
125
191
|
worker: string;
|
|
126
192
|
recreateNonce: string;
|
|
127
193
|
note: string;
|
|
128
194
|
}
|
|
195
|
+
/** One published-or-building sandbox image row (GET images / images/:profile / images/digests/:digest). The
|
|
196
|
+
* registry already zod-validated it against its ImageIndexEntry contract; the SDK does NOT re-fold it — open
|
|
197
|
+
* shape with the stable, load-bearing fields typed. `digest` is the immutable runtime ref (`sha256:…`). */
|
|
129
198
|
export interface ControlImageEntry {
|
|
130
199
|
id?: string;
|
|
131
200
|
profile?: string;
|
|
201
|
+
/** Immutable runtime ref — `sha256:<64 hex>`. The drift lookup keys on this. */
|
|
132
202
|
digest?: string;
|
|
133
203
|
tag?: string;
|
|
134
204
|
status?: string;
|
|
@@ -136,12 +206,16 @@ export interface ControlImageEntry {
|
|
|
136
206
|
capabilities?: Record<string, unknown>;
|
|
137
207
|
[k: string]: unknown;
|
|
138
208
|
}
|
|
209
|
+
/** GET /api/config/images → a page of image rows (the registry unwraps the worker's list envelope). `nextCursor`
|
|
210
|
+
* (when present) feeds the next `cursor=` query for pagination. Open-ish: additive list metadata tolerated. */
|
|
139
211
|
export interface ControlImageList {
|
|
140
212
|
images?: ControlImageEntry[];
|
|
141
213
|
items?: ControlImageEntry[];
|
|
142
214
|
nextCursor?: string;
|
|
143
215
|
[k: string]: unknown;
|
|
144
216
|
}
|
|
217
|
+
/** Filters for GET /api/config/images. Only the contract's documented list params are forwarded by the registry;
|
|
218
|
+
* anything else is dropped server-side (no smuggled upstream query). */
|
|
145
219
|
export interface ImageListQuery {
|
|
146
220
|
status?: string;
|
|
147
221
|
profile?: string;
|
|
@@ -151,18 +225,25 @@ export interface ImageListQuery {
|
|
|
151
225
|
limit?: number;
|
|
152
226
|
cursor?: string;
|
|
153
227
|
}
|
|
228
|
+
/** POST /api/config/images/select body — a PURE resolution preview (resolve a profile/bands to a concrete
|
|
229
|
+
* `ref`), NOT a build. One of `profile` or `bands` is required (the registry 400s otherwise). */
|
|
154
230
|
export interface ImageSelectQuery {
|
|
155
231
|
profile?: string;
|
|
156
232
|
bands?: string[];
|
|
157
233
|
capabilitiesNeeded?: Record<string, boolean>;
|
|
158
234
|
}
|
|
235
|
+
/** POST /api/config/images/select → the resolved pull ref (`repo@digest`) WorkerForm writes to
|
|
236
|
+
* env.K8S_SANDBOX_IMAGE. Open-ish: `ref`/`digest` are load-bearing, the rest is the registry's projection. */
|
|
159
237
|
export interface ImageSelectResolution {
|
|
160
238
|
profile?: string;
|
|
239
|
+
/** `repo@digest` — the immutable pull ref bound to the worker. */
|
|
161
240
|
ref?: string;
|
|
162
241
|
digest?: string;
|
|
163
242
|
capabilities?: Record<string, unknown>;
|
|
164
243
|
[k: string]: unknown;
|
|
165
244
|
}
|
|
245
|
+
/** GET /api/config/secrets → the env-NAMEs stored in the secret source (NEVER values), each tagged whether the
|
|
246
|
+
* effective config references it (so orphans are reclaimable). publisher+. */
|
|
166
247
|
export interface SecretInventory {
|
|
167
248
|
secrets: {
|
|
168
249
|
name: string;
|
|
@@ -173,6 +254,8 @@ export interface SecretInventory {
|
|
|
173
254
|
total: number;
|
|
174
255
|
orphans: number;
|
|
175
256
|
}
|
|
257
|
+
/** POST /api/config/secrets {name, value} → write-through ONE secret value (publisher+). 🔴 The response carries
|
|
258
|
+
* NO value field (I1). `warning`/`nextSteps` remind that running pods keep the old value until recreated. */
|
|
176
259
|
export interface SecretWriteResult {
|
|
177
260
|
ok: true;
|
|
178
261
|
name: string;
|
|
@@ -184,18 +267,24 @@ export interface SecretWriteResult {
|
|
|
184
267
|
why: string;
|
|
185
268
|
}[];
|
|
186
269
|
}
|
|
270
|
+
/** POST /api/config/secrets/<name>/rotate → drafted recreate of every worker referencing this env-NAME (one
|
|
271
|
+
* atomic draft; publish to apply). `workers:[]` (200) when nothing references it — NOT an error. publisher+. */
|
|
187
272
|
export interface SecretRotateResult {
|
|
188
273
|
ok: true;
|
|
189
274
|
secret: string;
|
|
190
275
|
workers: string[];
|
|
191
276
|
note?: string;
|
|
192
277
|
}
|
|
278
|
+
/** DELETE /api/config/secrets/<name> → reclaim an orphan name from the secret source. `removed:false` is an
|
|
279
|
+
* idempotent no-op (the name wasn't present). publisher+. A referenced name → 409 unless force. */
|
|
193
280
|
export interface SecretDeleteResult {
|
|
194
281
|
ok: true;
|
|
195
282
|
name: string;
|
|
196
283
|
removed: boolean;
|
|
197
284
|
note?: string;
|
|
198
285
|
}
|
|
286
|
+
/** GET /api/config/secrets/refs → every env-NAME the effective config references, grouped (audit which env vars
|
|
287
|
+
* each host/service must provide). NAMES only, never values. admin. */
|
|
199
288
|
export interface SecretRefsResult {
|
|
200
289
|
refs: {
|
|
201
290
|
envName: string;
|
|
@@ -205,6 +294,8 @@ export interface SecretRefsResult {
|
|
|
205
294
|
}[];
|
|
206
295
|
}[];
|
|
207
296
|
}
|
|
297
|
+
/** One login auth provider's NON-secret config (GET/POST /api/config/auth/providers). `secretPresent` is the
|
|
298
|
+
* registry-derived "is process.env[clientSecretEnv] set" flag — never the secret value. */
|
|
208
299
|
export interface AuthProviderConfig {
|
|
209
300
|
id: string;
|
|
210
301
|
type: "gitea" | "oauth2" | "oidc";
|
|
@@ -215,11 +306,15 @@ export interface AuthProviderConfig {
|
|
|
215
306
|
issuer?: string;
|
|
216
307
|
clientId: string;
|
|
217
308
|
scopes: string[];
|
|
309
|
+
/** The ENV-NAME holding the client secret — never the value. */
|
|
218
310
|
clientSecretEnv: string;
|
|
219
311
|
enabled: boolean;
|
|
220
312
|
updatedAt?: string;
|
|
313
|
+
/** Registry-derived: is the referenced env in place? (UI shows "待 ops 注入 secret".) Never the value. */
|
|
221
314
|
secretPresent?: boolean;
|
|
222
315
|
}
|
|
316
|
+
/** The upsert body for POST /api/config/auth/providers. `clientSecretEnv` is an ENV-NAME (the registry rejects a
|
|
317
|
+
* value-shaped string). Omits the derived `secretPresent`/`updatedAt` (registry-computed). */
|
|
223
318
|
export interface AuthProviderUpsert {
|
|
224
319
|
id: string;
|
|
225
320
|
type: "gitea" | "oauth2";
|
|
@@ -233,40 +328,53 @@ export interface AuthProviderUpsert {
|
|
|
233
328
|
clientSecretEnv: string;
|
|
234
329
|
enabled: boolean;
|
|
235
330
|
}
|
|
331
|
+
/** GET /api/config/auth/providers → all providers (each NON-secret + secretPresent). admin. */
|
|
236
332
|
export interface AuthProvidersResult {
|
|
237
333
|
providers: AuthProviderConfig[];
|
|
238
334
|
}
|
|
335
|
+
/** POST /api/config/auth/providers → the upserted NON-secret record (never the secret value). admin. */
|
|
239
336
|
export interface AuthProviderUpsertResult {
|
|
240
337
|
ok: true;
|
|
241
338
|
provider: AuthProviderConfig;
|
|
242
339
|
}
|
|
340
|
+
/** One console user (GET /api/config/users). NO password hash is ever returned. admin. */
|
|
243
341
|
export interface ControlUser {
|
|
244
342
|
username: string;
|
|
245
343
|
role: ControlRole;
|
|
246
344
|
[k: string]: unknown;
|
|
247
345
|
}
|
|
346
|
+
/** GET /api/config/users → console users (no password hashes). admin. */
|
|
248
347
|
export interface UsersResult {
|
|
249
348
|
users: ControlUser[];
|
|
250
349
|
}
|
|
350
|
+
/** PUT /api/config/users → upserted user (role/username echo). admin. */
|
|
251
351
|
export interface UserUpsertResult {
|
|
252
352
|
ok: true;
|
|
253
353
|
username: string;
|
|
254
354
|
role: ControlRole;
|
|
255
355
|
}
|
|
356
|
+
/** POST /api/config/users/<name>/token → mint/rotate a user's scoped API token. 🔴 `token` is the PLAINTEXT,
|
|
357
|
+
* returned ONCE and never again (the registry stores only its hash; this response is `Cache-Control: no-store`).
|
|
358
|
+
* Treat `token` like any secret: surface it to the operator once, never log/persist it. admin. */
|
|
256
359
|
export interface UserTokenMintResult {
|
|
257
360
|
ok: true;
|
|
258
361
|
username: string;
|
|
362
|
+
/** Plaintext token — shown ONCE; cannot be retrieved again. Treat as a secret. */
|
|
259
363
|
token: string;
|
|
260
364
|
note?: string;
|
|
261
365
|
}
|
|
366
|
+
/** DELETE /api/config/users/<name>/token → revoke a user's scoped token. admin. */
|
|
262
367
|
export interface UserTokenRevokeResult {
|
|
263
368
|
ok: true;
|
|
264
369
|
revoked: true;
|
|
265
370
|
}
|
|
371
|
+
/** POST /api/config/lifecycle/cascade-owner → removed all workers owned by a decommissioned owner. */
|
|
266
372
|
export interface CascadeOwnerResult {
|
|
267
373
|
ok: true;
|
|
268
374
|
removed: string[];
|
|
269
375
|
}
|
|
376
|
+
/** POST /api/config/lifecycle/sweep → one sweep pass (or a `?dryRun` preview). Open-ish: the SDK passes the
|
|
377
|
+
* registry's sweep report through with the stable top-level fields typed. */
|
|
270
378
|
export interface SweepResult {
|
|
271
379
|
ok: true;
|
|
272
380
|
dryRun: boolean;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"control-types.d.ts","sourceRoot":"","sources":["../src/control-types.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"control-types.d.ts","sourceRoot":"","sources":["../src/control-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;uFAGuF;AACvF,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC;;iGAEiG;AACjG,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;AAItE;;2GAE2G;AAC3G,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,YAAY,CAAC;IACrB,0DAA0D;IAC1D,KAAK,EAAE,OAAO,CAAC;IACf,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;+GAC+G;AAC/G,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,gHAAgH;AAChH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,qFAAqF;AACrF,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;kFACkF;AAClF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;gDACgD;AAChD,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,oEAAoE;AACpE,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;kHAEkH;AAClH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,MAAM,EAAE,OAAO,GAAG,WAAW,CAAC;CAC/B;AAID,mHAAmH;AACnH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;0CAC0C;AAC1C,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,8GAA8G;AAC9G,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;CACtB;AAID,2EAA2E;AAC3E,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;+GAC+G;AAC/G,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAErD,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,aAAa,GAAG,IAAI,CAAC;IAChC,OAAO,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/B,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED;;yGAEyG;AACzG,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,IAAI,CAAC;IACT,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,mGAAmG;AACnG,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,IAAI,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,+DAA+D;AAC/D,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,IAAI,CAAC;IACT,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAID;2GAC2G;AAC3G,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpD,gHAAgH;AAChH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;kGACkG;AAClG,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnD;wBACwB;AACxB,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;CACpB;AAID,6GAA6G;AAC7G,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAED;+EAC+E;AAC/E,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC9C,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,8GAA8G;AAC9G,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;CACd;AAQD;;4GAE4G;AAC5G,MAAM,WAAW,iBAAiB;IAChC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED;gHACgH;AAChH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC7B,KAAK,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED;yEACyE;AACzE,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;kGACkG;AAClG,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9C;AAED;+GAC+G;AAC/G,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAOD;+EAC+E;AAC/E,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,EAAE,OAAO,EAAE,CAAA;KAAE,EAAE,CAAC;IACrF,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;8GAC8G;AAC9G,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC7E;AAED;iHACiH;AACjH,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;oGACoG;AACpG,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;wEACwE;AACxE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,EAAE,CAAC;CACzE;AAOD;4FAC4F;AAC5F,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,gEAAgE;IAChE,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uGAAuG;IACvG,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;+FAC+F;AAC/F,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,+FAA+F;AAC/F,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,kBAAkB,EAAE,CAAC;CACjC;AAED,wGAAwG;AACxG,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,kBAAkB,CAAC;CAC9B;AAID,0FAA0F;AAC1F,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,WAAW,CAAC;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,WAAW,EAAE,CAAC;CACtB;AAED,yEAAyE;AACzE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,WAAW,CAAC;CACnB;AAED;;mGAEmG;AACnG,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,mFAAmF;AACnF,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,IAAI,CAAC;CACf;AAID,sGAAsG;AACtG,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;8EAC8E;AAC9E,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,OAAO,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB"}
|
package/dist/control-types.js
CHANGED
|
@@ -1,2 +1,17 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Control-plane wire types — the **sema-registry** (config-center) `/api/config/*` API. This is a DIFFERENT
|
|
3
|
+
* backend from the worker `/v1` usage plane (see client.ts / types.ts): different host
|
|
4
|
+
* (the registry deployment), different auth (editor/admin Bearer, NOT a worker session token).
|
|
5
|
+
*
|
|
6
|
+
* These shapes are grounded in the config-center's `src/app/api/config/<route>/route.ts` sources — not
|
|
7
|
+
* guesses. Where a
|
|
8
|
+
* route returns a store-shaped payload that the SDK does not need to interpret (the FleetSnapshot, the
|
|
9
|
+
* placement/rebalance/reschedule plans, the JSON Schemas, per-domain config values), the type is left
|
|
10
|
+
* deliberately `unknown` / open: the SDK is a faithful transport, it does NOT re-validate the control plane's
|
|
11
|
+
* own validated output, and it never lets an untrusted-but-typed shape masquerade as parsed-and-trusted.
|
|
12
|
+
*
|
|
13
|
+
* 🔴 secret discipline: the registry token is the SAME tier of secret as the worker token — it never appears
|
|
14
|
+
* in any of these types, never in an error message (errors.ts scrub), never logged.
|
|
15
|
+
*/
|
|
1
16
|
export {};
|
|
2
17
|
//# sourceMappingURL=control-types.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"control-types.js","sourceRoot":"","sources":["../src/control-types.ts"],"names":[],"mappings":""}
|
|
1
|
+
{"version":3,"file":"control-types.js","sourceRoot":"","sources":["../src/control-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG"}
|
package/dist/errors.d.ts
CHANGED
|
@@ -1,83 +1,163 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Typed error hierarchy (openai-node style — DESIGN §2.3). The service's error codes become semantic types so
|
|
3
|
+
* callers branch on the error, not on a string. 🔴 messages are SECRET-SCRUBBED before surfacing (never echo a
|
|
4
|
+
* token / presigned URL into an error).
|
|
5
|
+
*/
|
|
1
6
|
export declare class APIError extends Error {
|
|
2
7
|
readonly status: number;
|
|
3
8
|
readonly code: string | undefined;
|
|
4
9
|
constructor(status: number, code: string | undefined, message: string);
|
|
5
10
|
}
|
|
11
|
+
/** 401 / 503 — fail-closed auth (missing/bad SERVICE_AUTH_TOKEN). */
|
|
6
12
|
export declare class AuthError extends APIError {
|
|
7
13
|
}
|
|
14
|
+
/** 429 — per-principal rate limit. `retryAfterMs` from `Retry-After` (the SDK honors it on retry). */
|
|
8
15
|
export declare class RateLimitedError extends APIError {
|
|
9
16
|
readonly retryAfterMs?: number | undefined;
|
|
10
17
|
constructor(status: number, code: string | undefined, message: string, retryAfterMs?: number | undefined);
|
|
11
18
|
}
|
|
19
|
+
/** E4 quota deny detail (定稿形状) — the center's structured 409 fields, passed VERBATIM through the
|
|
20
|
+
* service's 429 body (`{code:"quota_exhausted", windowType, remaining, resetAt, isEstimate, pool?}`). Every
|
|
21
|
+
* field is optional at the wire boundary (a cached in-window rejection or an older service may carry a bare
|
|
22
|
+
* code) — consumers MUST render a generic fallback when fields are absent. Units: `remaining` is WEIGHTED
|
|
23
|
+
* TOKENS for the fiveHour/weekly windows and MICRO-USD for the budget window; `resetAt` is an ISO instant
|
|
24
|
+
* (null = no periodic reset — budget pools may only recover via an admin refresh). */
|
|
12
25
|
export interface QuotaExhaustedDetail {
|
|
13
26
|
windowType?: "fiveHour" | "weekly" | "budget";
|
|
14
27
|
remaining?: number;
|
|
15
28
|
resetAt?: string | null;
|
|
16
29
|
isEstimate?: boolean;
|
|
30
|
+
/** Budget-pool id, or "personal" for the personal budget. Present only on the budget window. */
|
|
17
31
|
pool?: string;
|
|
32
|
+
/** The service's own suggested retry window (seconds; EXHAUSTED_RETRY_MS cache). */
|
|
18
33
|
retryAfterSec?: number;
|
|
19
34
|
}
|
|
35
|
+
/** 429 `code:"quota_exhausted"` — the principal's usage quota (token windows / budget) is exhausted
|
|
36
|
+
* (E4 double-rail, service ≥1.150.0). Extends RateLimitedError so existing 429 handling still matches;
|
|
37
|
+
* carries the structured deny detail so the RENDER layer can produce a human message (人话归壳 — the wire
|
|
38
|
+
* stays structured, no display strings here). NOT usefully retryable inside the deny window. */
|
|
20
39
|
export declare class QuotaExhaustedError extends RateLimitedError {
|
|
21
40
|
readonly detail: QuotaExhaustedDetail;
|
|
22
41
|
constructor(status: number, code: string | undefined, message: string, retryAfterMs: number | undefined, detail: QuotaExhaustedDetail);
|
|
23
42
|
}
|
|
43
|
+
/** 400 `code:"scenario_not_allowed"` — the request's explicit `body.scenario` is outside the principal's
|
|
44
|
+
* assigned allowlist (scenario governance, service ≥1.152.0). Carries the service's
|
|
45
|
+
* `allowlist` VERBATIM (pure scenario names) so the RENDER layer can offer the valid choices (人话归壳 —
|
|
46
|
+
* the wire stays structured, no display strings here). NOT retryable verbatim: pick a scenario from
|
|
47
|
+
* `allowlist`, or omit `scenario` entirely to run on the assigned default. */
|
|
24
48
|
export declare class ScenarioNotAllowedError extends APIError {
|
|
49
|
+
/** The principal's allowed scenario names (may be empty on an older service / defensive drop). */
|
|
25
50
|
readonly allowlist: string[];
|
|
26
|
-
constructor(status: number, code: string | undefined, message: string,
|
|
51
|
+
constructor(status: number, code: string | undefined, message: string,
|
|
52
|
+
/** The principal's allowed scenario names (may be empty on an older service / defensive drop). */
|
|
53
|
+
allowlist: string[]);
|
|
27
54
|
}
|
|
55
|
+
/** errorCode `budget.precall` / `budget.exceeded` — per-task or per-principal cost ceiling. NOT retryable. */
|
|
28
56
|
export declare class BudgetExceededError extends APIError {
|
|
29
57
|
}
|
|
58
|
+
/** 409 — session already has an active run, or an idempotency conflict / session CAS conflict. */
|
|
30
59
|
export declare class ConflictError extends APIError {
|
|
31
60
|
readonly activeTaskId?: string | undefined;
|
|
32
61
|
constructor(status: number, code: string | undefined, message: string, activeTaskId?: string | undefined);
|
|
33
62
|
}
|
|
63
|
+
/** 2c session-sync (P1d) — a PUSH (`POST …/sync/import` or its Phase-B commit) or a `POST …/sync/plan` that WOULD
|
|
64
|
+
* lose destination history: the relation classified to `fork` or `stale` and the caller did NOT pass
|
|
65
|
+
* `{ resolution: "overwrite-dst" }`. 409, errorCode `conflict`, with the classified `relation` carrying the
|
|
66
|
+
* exclusive entry sets (mirrors the service SyncConflictError). DISTINCT from the session-CAS ConflictError
|
|
67
|
+
* (same status+code, but THIS one carries a `relation` — that's how the mapper tells them apart). Client action:
|
|
68
|
+
* surface the keep-local / keep-cloud divergence to the user; to override, re-push with `resolution:"overwrite-dst"`.
|
|
69
|
+
* NEVER auto-overwrite (a silent clobber is exactly the data loss the classifier exists to prevent). */
|
|
34
70
|
export declare class SyncConflictError extends ConflictError {
|
|
71
|
+
/** The §7 `fork`/`stale` relation with the exclusive entry sets (untyped at the JSON boundary). */
|
|
35
72
|
readonly relation: {
|
|
36
73
|
relation: "fork" | "stale";
|
|
37
74
|
[k: string]: unknown;
|
|
38
75
|
};
|
|
39
|
-
constructor(status: number, code: string | undefined, message: string,
|
|
76
|
+
constructor(status: number, code: string | undefined, message: string,
|
|
77
|
+
/** The §7 `fork`/`stale` relation with the exclusive entry sets (untyped at the JSON boundary). */
|
|
78
|
+
relation: {
|
|
40
79
|
relation: "fork" | "stale";
|
|
41
80
|
[k: string]: unknown;
|
|
42
81
|
});
|
|
43
82
|
}
|
|
83
|
+
/** design/80 D-1 — the checkpoint you tried to decide is already TERMINAL (someone else resolved it, it was
|
|
84
|
+
* GC'd past its abandonment-TTL, or its SLA deadline fired a resolve-deny). DISTINCT from a binding mismatch
|
|
85
|
+
* and from session-CAS 409. Client action: this pending is gone → REFETCH the inbox; do not retry the decide. */
|
|
44
86
|
export declare class ApprovalStaleError extends APIError {
|
|
45
87
|
readonly terminal?: "resolved" | "expired_abort" | "expired_sla" | undefined;
|
|
46
88
|
constructor(status: number, code: string | undefined, message: string, terminal?: "resolved" | "expired_abort" | "expired_sla" | undefined);
|
|
47
89
|
}
|
|
90
|
+
/** design/80 D-1 — your decide's binding (`boundCallId` / `boundInputHash`) does NOT match the current pending
|
|
91
|
+
* action: it was swapped under you (TOCTOU) or you replayed a stale yes. A SAFETY signal, not an expiry.
|
|
92
|
+
* Client action: REFETCH the PendingCheckpoint, RE-PRESENT it to the human, NEVER auto-retry. */
|
|
48
93
|
export declare class ApprovalBindingMismatchError extends APIError {
|
|
49
94
|
readonly field?: "boundCallId" | "boundInputHash" | undefined;
|
|
50
95
|
constructor(status: number, code: string | undefined, message: string, field?: "boundCallId" | "boundInputHash" | undefined);
|
|
51
96
|
}
|
|
97
|
+
/** design/80 D-1 (core 1.101.0) — a concurrent resolve/reopen advanced the checkpoint's revision inside the
|
|
98
|
+
* engine's get→resolve window, so this resume failed-closed; the row is STILL pending. TRANSIENT (≠ terminal):
|
|
99
|
+
* do NOT treat as ApprovalStaleError. Client action: REFETCH the PendingCheckpoint + re-present, then decide
|
|
100
|
+
* again (retryable). */
|
|
52
101
|
export declare class ApprovalConcurrentlyReopenedError extends APIError {
|
|
53
102
|
}
|
|
103
|
+
/** design/80 D-A — you steered a run that is NOT running (it is durable-`suspended`, terminal, or unknown).
|
|
104
|
+
* Steer is at-most-once and NOT queued. Client action: surface "task isn't running"; if suspended, the path
|
|
105
|
+
* forward is the approval decide, not a steer. */
|
|
54
106
|
export declare class SteeringNotRunningError extends APIError {
|
|
55
107
|
}
|
|
108
|
+
/** design/80 D-A — the steer text carried a control-plane escape (e.g. `</system-reminder>`) and core rejected
|
|
109
|
+
* it (runtask.ts:489). Client action: it's an injection attempt or a malformed steer — surface it; don't retry
|
|
110
|
+
* verbatim. (The BFF also fences steer text defensively; this is core's authoritative reject.) */
|
|
56
111
|
export declare class SteeringInvalidContentError extends APIError {
|
|
57
112
|
}
|
|
113
|
+
/** design/80 D-G (direct-connect door, service [84]) — the signed principal JWT (`X-Approval-Principal-Token`)
|
|
114
|
+
* failed to verify against the worker's projected pubkey anchor (bad sig / exp / iss / aud / alg-not-pinned).
|
|
115
|
+
* 401. Client action: re-sign a fresh short-TTL JWT; persistent ⇒ BFF signing key/anchor misaligned. FORWARD-
|
|
116
|
+
* DRAFT: wire codes are service-locked; the BFF signer + live path land at M2. */
|
|
58
117
|
export declare class PrincipalUnverifiedError extends APIError {
|
|
59
118
|
}
|
|
119
|
+
/** design/80 D-G — the JWT verified but its `cnf.bnd` ≠ SHA256(checkpointToken): the identity assertion was
|
|
120
|
+
* minted for a DIFFERENT decision and lifted onto this one (token-lift). A SAFETY signal. 401. Client action:
|
|
121
|
+
* NEVER retry verbatim; re-mint the JWT bound to THIS checkpointToken. */
|
|
60
122
|
export declare class PrincipalUnboundError extends APIError {
|
|
61
123
|
}
|
|
124
|
+
/** ASSISTANT-WIRE-CONTRACT §4b(service main 6cd0164)— 你对一个 human/policy_ask 门调了 resume(CONTINUE)。
|
|
125
|
+
* 409 errorCode `gate_not_resumable`。一个 "continue" 绝不能绕过人审。SEMANTIC(错门), NOT session-CAS ConflictError。
|
|
126
|
+
* Client action: 这条路是 /decide(approve/deny), 不是 resume —— 改走人审 UI。 */
|
|
62
127
|
export declare class GateNotResumableError extends APIError {
|
|
63
128
|
}
|
|
129
|
+
/** ASSISTANT-WIRE-CONTRACT §4c(service main 6cd0164)— 你对一个非 plan_review 门调了 plan_review。
|
|
130
|
+
* 409 errorCode `gate_not_plan_review`。一个 plan 决策绝不能解 tool 审批 / resource_limit。SEMANTIC(错门), NOT ConflictError。
|
|
131
|
+
* Client action: 按 gateKind 选对的决策端点(/decide 或 /resume), 重取 inbox。 */
|
|
64
132
|
export declare class GateNotPlanReviewError extends APIError {
|
|
65
133
|
}
|
|
134
|
+
/** design/80 D-G — the direct-connect door requires the HMAC envelope (`X-Approval-Mac`) and it was absent. */
|
|
66
135
|
export declare class ApprovalMacRequiredError extends APIError {
|
|
67
136
|
}
|
|
137
|
+
/** design/80 D-G — the HMAC envelope failed verification (wrong key/kid, or a tampered [token,callId,hash,
|
|
138
|
+
* decision] tuple). 401. Client action: re-sign with the active HMAC kid; persistent ⇒ key rotation skew. */
|
|
68
139
|
export declare class ApprovalMacInvalidError extends APIError {
|
|
69
140
|
}
|
|
141
|
+
/** Map an HTTP status + parsed body to the right typed error. Used by transport.ts. */
|
|
70
142
|
export declare function toApiError(status: number, body: unknown, retryAfterMs?: number): APIError;
|
|
143
|
+
/** Base for every control-plane (registry) error. Distinct from APIError so a caller can branch on which plane
|
|
144
|
+
* failed. `message` is secret-scrubbed (a registry/proxy may echo an Authorization header into an error body). */
|
|
71
145
|
export declare class ControlError extends Error {
|
|
72
146
|
readonly status: number;
|
|
73
147
|
constructor(status: number, message: string);
|
|
74
148
|
}
|
|
149
|
+
/** 401 — missing/invalid registry Bearer (SEMA_REGISTRY_TOKEN). Fail-closed. */
|
|
75
150
|
export declare class ControlAuthError extends ControlError {
|
|
76
151
|
}
|
|
152
|
+
/** 403 — authenticated but the token's role is below what the write needs (editor / publisher per domain).
|
|
153
|
+
* Client action: surface "needs a higher role"; do NOT retry with the same token. */
|
|
77
154
|
export declare class ControlForbiddenError extends ControlError {
|
|
78
155
|
}
|
|
156
|
+
/** 404 — unknown domain / unknown change id / unknown worker. */
|
|
79
157
|
export declare class ControlNotFoundError extends ControlError {
|
|
80
158
|
}
|
|
159
|
+
/** 400 — zod validation failed. `issues` carries the flat `{ path, message }[]` (batch prefixes path with
|
|
160
|
+
* `[changeIndex, domain, …]`). Client action: fix the offending field; this is deterministic, do NOT retry. */
|
|
81
161
|
export declare class ControlValidationError extends ControlError {
|
|
82
162
|
readonly issues: {
|
|
83
163
|
path: (string | number)[];
|
|
@@ -90,10 +170,16 @@ export declare class ControlValidationError extends ControlError {
|
|
|
90
170
|
code?: string;
|
|
91
171
|
}[]);
|
|
92
172
|
}
|
|
173
|
+
/** 409 — optimistic-lock (CAS) conflict: config changed since the version you read, or a publish-gate / draft
|
|
174
|
+
* conflict. `currentVersion` (when present) is where the store is now. Client action: re-read, re-base, retry.
|
|
175
|
+
* NOT auto-resolved (a silent clobber is exactly what the CAS prevents). */
|
|
93
176
|
export declare class ControlConflictError extends ControlError {
|
|
94
177
|
readonly currentVersion?: number | undefined;
|
|
95
178
|
constructor(status: number, message: string, currentVersion?: number | undefined);
|
|
96
179
|
}
|
|
180
|
+
/** Map a control-plane HTTP status + parsed body to the right typed error. Body envelope is `{ error, issues?,
|
|
181
|
+
* message?, currentVersion? }`. 🔴 message is scrubbed (Bearer / presigned) before surfacing. */
|
|
97
182
|
export declare function toControlError(status: number, body: unknown): ControlError;
|
|
183
|
+
/** Best-effort secret scrub for error text (Bearer tokens, presigned-URL signatures). Defense in depth. */
|
|
98
184
|
export declare function scrub(s: string): string;
|
|
99
185
|
//# sourceMappingURL=errors.d.ts.map
|
package/dist/errors.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,qBAAa,QAAS,SAAQ,KAAK;IAE/B,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS;gBADxB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GAAG,SAAS,EACjC,OAAO,EAAE,MAAM;CAKlB;AAED,qEAAqE;AACrE,qBAAa,SAAU,SAAQ,QAAQ;CAAG;AAE1C,sGAAsG;AACtG,qBAAa,gBAAiB,SAAQ,QAAQ;IAC2B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM;gBAAzF,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,EAAW,YAAY,CAAC,EAAE,MAAM,YAAA;CAGtG;AAED;;;;;uFAKuF;AACvF,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,EAAE,UAAU,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,gGAAgG;IAChG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;iGAGiG;AACjG,qBAAa,mBAAoB,SAAQ,gBAAgB;IAMrD,QAAQ,CAAC,MAAM,EAAE,oBAAoB;gBAJrC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,GAAG,SAAS,EACvB,MAAM,EAAE,oBAAoB;CAIxC;AAED;;;;+EAI+E;AAC/E,qBAAa,uBAAwB,SAAQ,QAAQ;IAKjD,kGAAkG;IAClG,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE;gBAJ5B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,MAAM;IACf,kGAAkG;IACzF,SAAS,EAAE,MAAM,EAAE;CAI/B;AAED,8GAA8G;AAC9G,qBAAa,mBAAoB,SAAQ,QAAQ;CAAG;AAEpD,kGAAkG;AAClG,qBAAa,aAAc,SAAQ,QAAQ;IAC8B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM;gBAAzF,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,EAAW,YAAY,CAAC,EAAE,MAAM,YAAA;CAGtG;AAED;;;;;;yGAMyG;AACzG,qBAAa,iBAAkB,SAAQ,aAAa;IAKhD,mGAAmG;IACnG,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE;gBAJvE,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,MAAM;IACf,mGAAmG;IAC1F,QAAQ,EAAE;QAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE;CAI1E;AAED;;kHAEkH;AAClH,qBAAa,kBAAmB,SAAQ,QAAQ;IACyB,QAAQ,CAAC,QAAQ,CAAC,EAAE,UAAU,GAAG,eAAe,GAAG,aAAa;gBAA3H,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,EAAW,QAAQ,CAAC,EAAE,UAAU,GAAG,eAAe,GAAG,aAAa,YAAA;CAGxI;AAED;;kGAEkG;AAClG,qBAAa,4BAA6B,SAAQ,QAAQ;IACe,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,GAAG,gBAAgB;gBAA5G,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,EAAW,KAAK,CAAC,EAAE,aAAa,GAAG,gBAAgB,YAAA;CAGzH;AAED;;;yBAGyB;AACzB,qBAAa,iCAAkC,SAAQ,QAAQ;CAAG;AAElE;;mDAEmD;AACnD,qBAAa,uBAAwB,SAAQ,QAAQ;CAAG;AAExD;;mGAEmG;AACnG,qBAAa,2BAA4B,SAAQ,QAAQ;CAAG;AAE5D;;;mFAGmF;AACnF,qBAAa,wBAAyB,SAAQ,QAAQ;CAAG;AAEzD;;2EAE2E;AAC3E,qBAAa,qBAAsB,SAAQ,QAAQ;CAAG;AAEtD;;uEAEuE;AACvE,qBAAa,qBAAsB,SAAQ,QAAQ;CAAG;AAEtD;;sEAEsE;AACtE,qBAAa,sBAAuB,SAAQ,QAAQ;CAAG;AAEvD,+GAA+G;AAC/G,qBAAa,wBAAyB,SAAQ,QAAQ;CAAG;AAEzD;8GAC8G;AAC9G,qBAAa,uBAAwB,SAAQ,QAAQ;CAAG;AAExD,uFAAuF;AACvF,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,QAAQ,CA+DzF;AAQD;mHACmH;AACnH,qBAAa,YAAa,SAAQ,KAAK;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAIrD;AAED,gFAAgF;AAChF,qBAAa,gBAAiB,SAAQ,YAAY;CAAG;AAErD;sFACsF;AACtF,qBAAa,qBAAsB,SAAQ,YAAY;CAAG;AAE1D,iEAAiE;AACjE,qBAAa,oBAAqB,SAAQ,YAAY;CAAG;AAEzD;gHACgH;AAChH,qBAAa,sBAAuB,SAAQ,YAAY;IACT,QAAQ,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE;gBAAjH,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAW,MAAM,EAAE;QAAE,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE;CAG9H;AAED;;6EAE6E;AAC7E,qBAAa,oBAAqB,SAAQ,YAAY;IACP,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM;gBAAjE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAW,cAAc,CAAC,EAAE,MAAM,YAAA;CAG9E;AAED;kGACkG;AAClG,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,YAAY,CAe1E;AAED,2GAA2G;AAC3G,wBAAgB,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAIvC"}
|