@substrat-run/adapter-cloudflare 0.81.0 → 0.83.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/dist/host.d.ts +31 -4
  2. package/dist/host.d.ts.map +1 -1
  3. package/dist/host.js +86 -15
  4. package/dist/host.js.map +1 -1
  5. package/dist/scope-do.d.ts.map +1 -1
  6. package/dist/scope-do.js +71 -1
  7. package/dist/scope-do.js.map +1 -1
  8. package/package.json +4 -4
package/dist/host.d.ts CHANGED
@@ -54,6 +54,12 @@ export interface ConnectorDelegation {
54
54
  scopeId: ScopeId;
55
55
  vertical: string;
56
56
  attachmentId: string;
57
+ /**
58
+ * The delivery this read is for (#726 remedy B). The serving deployment resolves it
59
+ * against its OWN outbox to decide what may be read — so what crosses this seam is
60
+ * the name of a delivery, not a claim about which entity the platform may reach.
61
+ */
62
+ eventId?: string;
57
63
  }): Promise<OpenedAttachment | null>;
58
64
  /** Write the scope-local `connection:<id>` grant tuple in the serving deployment. */
59
65
  grant(args: {
@@ -325,13 +331,25 @@ export declare class CloudflareScopeHost implements ScopeHost {
325
331
  provisionScope(actor: PlatformActorId, input: ProvisionScopeInput): Promise<void>;
326
332
  provisionTenantStore(actor: PlatformActorId, input: TenantStoreProvisionInput): Promise<TenantStoreHandle>;
327
333
  openTenantStore(handle: TenantStoreHandle): TenantRelationalStore;
328
- /** The injected D1 client, or a loud refusal naming what to configure. */
334
+ /** The injected D1 client, or a loud refusal naming what to configure — typed
335
+ * `unavailable` for the reason its blob-store twin below is (#828). */
329
336
  private requireTenantStores;
330
337
  provisionBlobStore(actor: PlatformActorId, input: BlobStoreProvisionInput): Promise<BlobStoreHandle>;
331
- /** The injected R2 client, or a loud refusal naming what to configure. */
338
+ /**
339
+ * The injected R2 client, or a loud refusal naming what to configure.
340
+ *
341
+ * Typed `unavailable` (#828) for the reason `SecretBoxUnconfiguredError` is: this is a
342
+ * DEPLOYMENT fact, not a fault in the caller's request — the same request succeeds
343
+ * unchanged once the host is wired. Untyped, it reached the control-plane transport as
344
+ * an unrecognised throw and was flattened to a bare `500 internal error`, so a message
345
+ * that names its own fix was discarded at the boundary and the operator was left
346
+ * unable to tell a missing client from a bad scope id.
347
+ */
332
348
  private requireBlobStores;
333
349
  attachments(principal: PrincipalId, tenantId: TenantId, scopeId: ScopeId): Promise<ScopeAttachments>;
334
- getConnectorAttachments(connectionId: ConnectionId, scopeId: ScopeId): Promise<ScopeAttachments>;
350
+ getConnectorAttachments(connectionId: ConnectionId, scopeId: ScopeId, forEvent?: {
351
+ eventId: string;
352
+ }): Promise<ScopeAttachments>;
335
353
  /** Resolve the per-tenant R2 blob store, or fail closed exactly as `attachments` did. */
336
354
  private resolveAttachmentStore;
337
355
  /**
@@ -403,6 +421,15 @@ export declare class CloudflareScopeHost implements ScopeHost {
403
421
  private subjectKeysFor;
404
422
  private recordAccess;
405
423
  private recordAdmin;
424
+ /**
425
+ * The scope's own answer to "what may this connection do here" (#726 gap 1).
426
+ *
427
+ * Read from the ScopeDO's delivered tuples rather than the directory's grant rows:
428
+ * the two are different facts, and the one a caller wants when asking whether a
429
+ * dispatch will be refused is what this deployment would actually enforce. The
430
+ * directory's view stays on `HostAdmin.listConnectionGrants`.
431
+ */
432
+ connectionGrantsInScope(tenantId: TenantId, scopeId: ScopeId): Promise<ProjectedConnectionGrant[]>;
406
433
  private writeScopeTuple;
407
434
  /**
408
435
  * The connection's CURRENT public sealing key, minted on first ask (#687).
@@ -542,7 +569,7 @@ export declare class CloudflareScopeHost implements ScopeHost {
542
569
  * delivered `connection:<id>` tuple. `null` for an id this scope does not know,
543
570
  * so a caller falls back rather than failing a dispatch over a missing file.
544
571
  */
545
- connectorAttachmentOpenLocal(connectionId: ConnectionId, tenantId: TenantId, scopeId: ScopeId, attachmentId: string): Promise<OpenedAttachment | null>;
572
+ connectorAttachmentOpenLocal(connectionId: ConnectionId, tenantId: TenantId, scopeId: ScopeId, attachmentId: string, eventId?: string): Promise<OpenedAttachment | null>;
546
573
  /**
547
574
  * The delivery half of `grantToConnection` for a scope served HERE (#574): write
548
575
  * the scope-local `connection:<id>` grant tuple the permission checker reads.
package/dist/host.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../src/host.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EAwCpB,KAAK,YAAY,EAEjB,KAAK,QAAQ,EAUb,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EAKd,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAI1B,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,WAAW,EAQhB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EAExB,KAAK,cAAc,EAGnB,KAAK,SAAS,EACd,KAAK,cAAc,EAGnB,KAAK,OAAO,EAIZ,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAE1B,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,cAAc,EAEnB,KAAK,QAAQ,EAGb,KAAK,iBAAiB,EAEvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAWL,KAAK,uBAAuB,EAE5B,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EAErB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EAUtB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EAExB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EAEtB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,gBAAgB,EAErB,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAE/B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAA2B,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC;AACvE,OAAO,EAA0C,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AAymBpF;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,mBAAmB;IAClC,yEAAyE;IACzE,MAAM,CAAC,IAAI,EAAE;QACX,YAAY,EAAE,YAAY,CAAC;QAC3B,QAAQ,EAAE,QAAQ,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,OAAO,CAAC;KAChB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrB,wEAAwE;IACxE,gBAAgB,CAAC,IAAI,EAAE;QACrB,YAAY,EAAE,YAAY,CAAC;QAC3B,QAAQ,EAAE,QAAQ,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,qBAAqB,CAAC;KAC/B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC9B;;;;;;;;;;;;;;;OAeG;IACH,cAAc,CAAC,IAAI,EAAE;QACnB,YAAY,EAAE,YAAY,CAAC;QAC3B,QAAQ,EAAE,QAAQ,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrC,qFAAqF;IACrF,KAAK,CAAC,IAAI,EAAE;QACV,YAAY,EAAE,YAAY,CAAC;QAC3B,QAAQ,EAAE,QAAQ,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,aAAa,CAAC;QAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,sBAAsB,CAAC;IAC9B;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,sBAAsB,CAAC;IACtC;;;;OAIG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACnF;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,cAAc,CAAC;IAC9B;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAoCD,qBAAa,mBAAoB,YAAW,SAAS;IACnD,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAE1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IACjD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAmB;IACtC,yFAAyF;IACzF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IACjC,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAU;IAIhD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,wGAAwG;IACxG,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqC;IACrE,mGAAmG;IACnG,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAChD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA6B;IAC5D,uFAAuF;IACvF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAiB;IAC/C,uFAAuF;IACvF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAe;IAC3C,wFAAwF;IACxF,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAiE;IACpG,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyC;IACnE;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA6B;IACvD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA6B;IAClE,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAsB;IAE3D;;;;;;;;;;OAUG;IACH,YAAY,OAAO,EAAE,0BAA0B,EAc9C;IAID,gBAAgB,CACd,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,eAAe,EACxB,KAAK,CAAC,EAAE,mBAAmB,GAC1B,IAAI,CAQN;IAED,iBAAiB,CACf,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,gBAAgB,EACzB,OAAO,CAAC,EAAE,gBAAgB,GACzB,IAAI,CAUN;IAGD;;;;OAIG;YACW,gBAAgB;IAoE9B;;;;;;;;;;;;;OAaG;YACW,cAAc;IAwEtB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAMjF;IAEK,iBAAiB,CACrB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/B,OAAO,CAAC,IAAI,CAAC,CAgBf;IAEK,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAI7F;IAEK,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAI3F;IAEK,0BAA0B,CAC9B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,eAAe,EAAE,CAAC,CAI5B;IAEK,qBAAqB,CACzB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,EAAE,EAAE,iBAAiB,EACrB,OAAO,EAAE;QAAE,MAAM,EAAE,qBAAqB,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GACtF,OAAO,CAAC,IAAI,CAAC,CASf;IAED,iBAAiB,IAAI,iBAAiB,CAErC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACG,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA8BrF;IAED;;;;;;;OAOG;IACG,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAEnE;IAEK,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC,CAEhG;IAED,iFAAiF;IAC3E,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAE9F;IAED;;;;;;;;OAQG;IACG,kBAAkB,CACtB,aAAa,EAAE,OAAO,EACtB,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAI7B;IAED;;;;;OAKG;IACG,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAG/F;IAED;;;;;;;;OAQG;IACG,iBAAiB,CACrB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,cAAc,EAAE,GACtB,OAAO,CAAC,IAAI,CAAC,CAMf;IAED;;;;;OAKG;IACG,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtD;IAED;;;;;;OAMG;IACG,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAElE;IAED;;;;OAIG;IACG,uBAAuB,CAC3B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC,CAErE;IAED;;;;OAIG;IACG,gBAAgB,CACpB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GACzB,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAElC;IAED,cAAc,CAAC,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAkDrD;IAED,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAE1E;IAED,OAAO,CAAC,aAAa;IAQf,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4CtF;IAQK,oBAAoB,CACxB,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CAmD5B;IAED,eAAe,CAAC,MAAM,EAAE,iBAAiB,GAAG,qBAAqB,CAgBhE;IAED,0EAA0E;IAC1E,OAAO,CAAC,mBAAmB;IAWrB,kBAAkB,CACtB,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,eAAe,CAAC,CAwC1B;IAED,0EAA0E;IAC1E,OAAO,CAAC,iBAAiB;IAWnB,WAAW,CACf,SAAS,EAAE,WAAW,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,gBAAgB,CAAC,CAS3B;IAEK,uBAAuB,CAC3B,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,gBAAgB,CAAC,CAkD3B;IAED,yFAAyF;YAC3E,sBAAsB;IAkBpC;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;IAiFxB,WAAW,CACf,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,SAAS,GACd,OAAO,CAAC,IAAI,CAAC,CAmBf;IAEK,YAAY,CAChB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,SAAS,GACd,OAAO,CAAC,IAAI,CAAC,CAYf;IAEK,aAAa,CACjB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,OAAO,CAAC,OAAO,CAAC,CAwBlB;IAEK,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBhG;IAED;;;;;;;;;OASG;YACW,gBAAgB;IAwBxB,QAAQ,CACZ,SAAS,EAAE,WAAW,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CAOpB;IAED;;;;;;;;;;OAUG;IACG,iBAAiB,CAAC,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAoCxF;IAED;;;;;OAKG;IACG,cAAc,CAClB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,SAAS,CAAC,CAOpB;IAED,mBAAmB,IAAI,oBAAoB,EAAE,CAM5C;IAEK,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,iBAAiB,CAAC,CA4C5B;IAED,4EAA4E;IAC5E,OAAO,CAAC,SAAS;IA0EX,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAE3B;IAID,OAAO,CAAC,UAAU;IA2wDlB;;;OAGG;IACH;;;;OAIG;YACW,WAAW;IAKzB;;;;OAIG;IACH,OAAO,CAAC,cAAc;YAUR,YAAY;YAmBZ,WAAW;YAqBX,eAAe;IAU7B;;;;;;;;;;;;OAYG;YACW,gBAAgB;IA+B9B;;;;;;;;OAQG;YACW,eAAe;IAY7B,OAAO,CAAC,SAAS;IAYjB;;;6FAGyF;YAC3E,gBAAgB;IA2B9B;;;;;;;;;OASG;YACW,iBAAiB;IAc/B,4EAA4E;YAC9D,YAAY;IAgB1B;;;;OAIG;YACW,MAAM;IA8BpB;;;;;OAKG;IACG,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjE;IAED;;;;;;;;;OASG;IACG,mBAAmB,CAAC,KAAK,EAAE;QAC/B,QAAQ,EAAE,QAAQ,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC;QACjB,KAAK,EAAE,WAAW,CAAC;QACnB,wFAAwF;QACxF,KAAK,EAAE,cAAc,EAAE,CAAC;QACxB,wDAAwD;QACxD,YAAY,EAAE,MAAM,CAAC;QACrB;;uGAE+F;QAC/F,YAAY,CAAC,EAAE,gBAAgB,EAAE,CAAC;QAClC;;;yFAGiF;QACjF,aAAa,CAAC,EAAE,qBAAqB,EAAE,CAAC;QACxC;;;;;;;kDAO0C;QAC1C,gBAAgB,CAAC,EAAE,wBAAwB,EAAE,CAAC;QAC9C;;;;mEAI2D;QAC3D,cAAc,CAAC,EAAE,sBAAsB,EAAE,CAAC;KAC3C,GAAG,OAAO,CAAC,IAAI,CAAC,CAgFhB;IAED;;;;;;;;OAQG;IACG,oBAAoB,CACxB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAIvC;IAED;;;;;;OAMG;IACG,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9F;IAED;;;;;;;;OAQG;IACG,gBAAgB,CACpB,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,WAAW,EACtB,UAAU,EAAE,aAAa,EACzB,MAAM,EAAE,SAAS,GAChB,OAAO,CAAC,IAAI,CAAC,CAOf;IAYD,sEAAsE;IAChE,oBAAoB,CACxB,YAAY,EAAE,YAAY,EAC1B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,OAAO,GACd,OAAO,CAAC,OAAO,CAAC,CAGlB;IAED,qFAAqF;IAC/E,8BAA8B,CAClC,YAAY,EAAE,YAAY,EAC1B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CAI3B;IAED;;;;;;OAMG;IACG,4BAA4B,CAChC,YAAY,EAAE,YAAY,EAC1B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAMlC;IAED;;;;;;OAMG;IACG,mBAAmB,CACvB,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,aAAa,EACzB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAQf;CACF"}
1
+ {"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../src/host.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EAyCpB,KAAK,YAAY,EAEjB,KAAK,QAAQ,EAUb,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EAKd,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAI1B,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,WAAW,EAQhB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EAExB,KAAK,cAAc,EAGnB,KAAK,SAAS,EACd,KAAK,cAAc,EAGnB,KAAK,OAAO,EAIZ,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAE1B,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,cAAc,EAEnB,KAAK,QAAQ,EAGb,KAAK,iBAAiB,EAGvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAWL,KAAK,uBAAuB,EAE5B,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EAErB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EAUtB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EAExB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EAEtB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,gBAAgB,EAErB,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAE/B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAA2B,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC;AACvE,OAAO,EAA0C,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AAinBpF;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,mBAAmB;IAClC,yEAAyE;IACzE,MAAM,CAAC,IAAI,EAAE;QACX,YAAY,EAAE,YAAY,CAAC;QAC3B,QAAQ,EAAE,QAAQ,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,OAAO,CAAC;KAChB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrB,wEAAwE;IACxE,gBAAgB,CAAC,IAAI,EAAE;QACrB,YAAY,EAAE,YAAY,CAAC;QAC3B,QAAQ,EAAE,QAAQ,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,qBAAqB,CAAC;KAC/B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC9B;;;;;;;;;;;;;;;OAeG;IACH,cAAc,CAAC,IAAI,EAAE;QACnB,YAAY,EAAE,YAAY,CAAC;QAC3B,QAAQ,EAAE,QAAQ,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB;;;;WAIG;QACH,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrC,qFAAqF;IACrF,KAAK,CAAC,IAAI,EAAE;QACV,YAAY,EAAE,YAAY,CAAC;QAC3B,QAAQ,EAAE,QAAQ,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,aAAa,CAAC;QAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,sBAAsB,CAAC;IAC9B;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,sBAAsB,CAAC;IACtC;;;;OAIG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACnF;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,cAAc,CAAC;IAC9B;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAoCD,qBAAa,mBAAoB,YAAW,SAAS;IACnD,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAE1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IACjD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAmB;IACtC,yFAAyF;IACzF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IACjC,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAU;IAIhD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,wGAAwG;IACxG,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqC;IACrE,mGAAmG;IACnG,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAChD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA6B;IAC5D,uFAAuF;IACvF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAiB;IAC/C,uFAAuF;IACvF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAe;IAC3C,wFAAwF;IACxF,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAiE;IACpG,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyC;IACnE;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA6B;IACvD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA6B;IAClE,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAsB;IAE3D;;;;;;;;;;OAUG;IACH,YAAY,OAAO,EAAE,0BAA0B,EAc9C;IAID,gBAAgB,CACd,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,eAAe,EACxB,KAAK,CAAC,EAAE,mBAAmB,GAC1B,IAAI,CAQN;IAED,iBAAiB,CACf,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,gBAAgB,EACzB,OAAO,CAAC,EAAE,gBAAgB,GACzB,IAAI,CAUN;IAGD;;;;OAIG;YACW,gBAAgB;IA+E9B;;;;;;;;;;;;;OAaG;YACW,cAAc;IAwEtB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAMjF;IAEK,iBAAiB,CACrB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/B,OAAO,CAAC,IAAI,CAAC,CAgBf;IAEK,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAI7F;IAEK,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAI3F;IAEK,0BAA0B,CAC9B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,eAAe,EAAE,CAAC,CAI5B;IAEK,qBAAqB,CACzB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,EAAE,EAAE,iBAAiB,EACrB,OAAO,EAAE;QAAE,MAAM,EAAE,qBAAqB,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GACtF,OAAO,CAAC,IAAI,CAAC,CASf;IAED,iBAAiB,IAAI,iBAAiB,CAErC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACG,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA8BrF;IAED;;;;;;;OAOG;IACG,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAEnE;IAEK,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC,CAEhG;IAED,iFAAiF;IAC3E,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAE9F;IAED;;;;;;;;OAQG;IACG,kBAAkB,CACtB,aAAa,EAAE,OAAO,EACtB,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAI7B;IAED;;;;;OAKG;IACG,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAG/F;IAED;;;;;;;;OAQG;IACG,iBAAiB,CACrB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,cAAc,EAAE,GACtB,OAAO,CAAC,IAAI,CAAC,CAMf;IAED;;;;;OAKG;IACG,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtD;IAED;;;;;;OAMG;IACG,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAElE;IAED;;;;OAIG;IACG,uBAAuB,CAC3B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC,CAErE;IAED;;;;OAIG;IACG,gBAAgB,CACpB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GACzB,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAElC;IAED,cAAc,CAAC,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAkDrD;IAED,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAE1E;IAED,OAAO,CAAC,aAAa;IAQf,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4CtF;IAQK,oBAAoB,CACxB,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CAmD5B;IAED,eAAe,CAAC,MAAM,EAAE,iBAAiB,GAAG,qBAAqB,CAgBhE;IAED;4EACwE;IACxE,OAAO,CAAC,mBAAmB;IAYrB,kBAAkB,CACtB,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,eAAe,CAAC,CAwC1B;IAED;;;;;;;;;OASG;IACH,OAAO,CAAC,iBAAiB;IAYnB,WAAW,CACf,SAAS,EAAE,WAAW,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,gBAAgB,CAAC,CAS3B;IAEK,uBAAuB,CAC3B,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE,OAAO,EAChB,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAC7B,OAAO,CAAC,gBAAgB,CAAC,CA4D3B;IAED,yFAAyF;YAC3E,sBAAsB;IAkBpC;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;IAoFxB,WAAW,CACf,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,SAAS,GACd,OAAO,CAAC,IAAI,CAAC,CAmBf;IAEK,YAAY,CAChB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,SAAS,GACd,OAAO,CAAC,IAAI,CAAC,CAYf;IAEK,aAAa,CACjB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,OAAO,CAAC,OAAO,CAAC,CAwBlB;IAEK,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBhG;IAED;;;;;;;;;OASG;YACW,gBAAgB;IAwBxB,QAAQ,CACZ,SAAS,EAAE,WAAW,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CAOpB;IAED;;;;;;;;;;OAUG;IACG,iBAAiB,CAAC,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAoCxF;IAED;;;;;OAKG;IACG,cAAc,CAClB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,SAAS,CAAC,CAOpB;IAED,mBAAmB,IAAI,oBAAoB,EAAE,CAM5C;IAEK,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,iBAAiB,CAAC,CA4C5B;IAED,4EAA4E;IAC5E,OAAO,CAAC,SAAS;IA0EX,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAE3B;IAID,OAAO,CAAC,UAAU;IA2wDlB;;;OAGG;IACH;;;;OAIG;YACW,WAAW;IAKzB;;;;OAIG;IACH,OAAO,CAAC,cAAc;YAUR,YAAY;YAmBZ,WAAW;IAqBzB;;;;;;;OAOG;IACG,uBAAuB,CAC3B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAuCrC;YAEa,eAAe;IAU7B;;;;;;;;;;;;OAYG;YACW,gBAAgB;IA+B9B;;;;;;;;OAQG;YACW,eAAe;IAY7B,OAAO,CAAC,SAAS;IAYjB;;;6FAGyF;YAC3E,gBAAgB;IA2B9B;;;;;;;;;OASG;YACW,iBAAiB;IAc/B,4EAA4E;YAC9D,YAAY;IAgB1B;;;;OAIG;YACW,MAAM;IA8BpB;;;;;OAKG;IACG,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjE;IAED;;;;;;;;;OASG;IACG,mBAAmB,CAAC,KAAK,EAAE;QAC/B,QAAQ,EAAE,QAAQ,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC;QACjB,KAAK,EAAE,WAAW,CAAC;QACnB,wFAAwF;QACxF,KAAK,EAAE,cAAc,EAAE,CAAC;QACxB,wDAAwD;QACxD,YAAY,EAAE,MAAM,CAAC;QACrB;;uGAE+F;QAC/F,YAAY,CAAC,EAAE,gBAAgB,EAAE,CAAC;QAClC;;;yFAGiF;QACjF,aAAa,CAAC,EAAE,qBAAqB,EAAE,CAAC;QACxC;;;;;;;kDAO0C;QAC1C,gBAAgB,CAAC,EAAE,wBAAwB,EAAE,CAAC;QAC9C;;;;mEAI2D;QAC3D,cAAc,CAAC,EAAE,sBAAsB,EAAE,CAAC;KAC3C,GAAG,OAAO,CAAC,IAAI,CAAC,CAgFhB;IAED;;;;;;;;OAQG;IACG,oBAAoB,CACxB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAIvC;IAED;;;;;;OAMG;IACG,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9F;IAED;;;;;;;;OAQG;IACG,gBAAgB,CACpB,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,WAAW,EACtB,UAAU,EAAE,aAAa,EACzB,MAAM,EAAE,SAAS,GAChB,OAAO,CAAC,IAAI,CAAC,CAOf;IAYD,sEAAsE;IAChE,oBAAoB,CACxB,YAAY,EAAE,YAAY,EAC1B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,OAAO,GACd,OAAO,CAAC,OAAO,CAAC,CAGlB;IAED,qFAAqF;IAC/E,8BAA8B,CAClC,YAAY,EAAE,YAAY,EAC1B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CAI3B;IAED;;;;;;OAMG;IACG,4BAA4B,CAChC,YAAY,EAAE,YAAY,EAC1B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAYlC;IAED;;;;;;OAMG;IACG,mBAAmB,CACvB,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,aAAa,EACzB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAQf;CACF"}
package/dist/host.js CHANGED
@@ -1,4 +1,4 @@
1
- import { fromWireFailure, accessLogEntry, adminLogEntry, opsFailureEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, entitlementGrant, entitlementGrantInput, instant, meterReading, subjectRef, createConnectionInput, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, platformRequest, connectorDispatchKind, outboundOfManifestJson, } from '@substrat-run/contracts';
1
+ import { fromWireFailure, accessLogEntry, adminLogEntry, opsFailureEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, entitlementGrant, entitlementGrantInput, instant, meterReading, subjectRef, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, platformRequest, connectorDispatchKind, outboundOfManifestJson, substratError, } from '@substrat-run/contracts';
2
2
  import { normalizeHostname, toRouteTarget } from './route-resolver.js';
3
3
  import { attachmentBlobKey, entitlementDenial, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, backoffAt, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, } from '@substrat-run/kernel';
4
4
  import { tenantStoreDatabaseName } from './d1.js';
@@ -158,7 +158,9 @@ export class CloudflareScopeHost {
158
158
  * taken from the event's scope, never from an argument — so a connector cannot
159
159
  * reach a credential another vertical connected even by accident.
160
160
  */
161
- async connectorContext(tenantId, scopeId, timeoutMs) {
161
+ async connectorContext(tenantId, scopeId, timeoutMs,
162
+ /** The delivery this context is FOR (#726) — the dispatch capability's whole basis. */
163
+ eventId) {
162
164
  const scope = await this.cp.getScopeRecord(tenantId, scopeId);
163
165
  const vertical = scope?.vertical ?? null;
164
166
  const admin = this.admin;
@@ -187,7 +189,13 @@ export class CloudflareScopeHost {
187
189
  // delegated read verb when the serving deployment is elsewhere (#574) —
188
190
  // the control plane holds the directory and the credential but not the
189
191
  // vertical's R2, so the bytes come back over the seam.
190
- openAttachment: (attachmentId) => this.getConnectorAttachments(open.id, scopeId).then((a) => a.open(attachmentId)),
192
+ // #726 gap 1: this connection's live grants IN THIS SCOPE, so a connector can
193
+ // assert its preconditions at the top of a dispatch rather than meeting a
194
+ // missing grant as a refusal several calls later.
195
+ grants: async () => (await this.connectionGrantsInScope(tenantId, scopeId))
196
+ .filter((g) => g.connectionId === open.id)
197
+ .map((g) => g.permission),
198
+ openAttachment: (attachmentId) => this.getConnectorAttachments(open.id, scopeId, { eventId }).then((a) => a.open(attachmentId)),
191
199
  // #687: open a cell the scope sealed TO this connection. The keyId-indexed
192
200
  // map goes in, never out — a connector receives the plaintext of one cell,
193
201
  // not a private key it could mislay. Retired keys are in the map too, so a
@@ -259,7 +267,7 @@ export class CloudflareScopeHost {
259
267
  report.routedToPlatform += 1;
260
268
  }
261
269
  else if (executor.kind === 'connector') {
262
- await executor.handler(await this.connectorContext(tenantId, scopeId, executor.timeoutMs), event);
270
+ await executor.handler(await this.connectorContext(tenantId, scopeId, executor.timeoutMs, event.id), event);
263
271
  await stub.recordExecutorAttempt(event.id, deliveryId, null, null);
264
272
  report.delivered += 1;
265
273
  }
@@ -305,7 +313,7 @@ export class CloudflareScopeHost {
305
313
  await this.cp.validateScopeAccess(tenantId, scopeId);
306
314
  this.causedBy = event.id;
307
315
  try {
308
- await handler(await this.connectorContext(tenantId, scopeId, options?.timeoutMs ?? 30_000), event);
316
+ await handler(await this.connectorContext(tenantId, scopeId, options?.timeoutMs ?? 30_000, event.id), event);
309
317
  }
310
318
  finally {
311
319
  this.causedBy = null;
@@ -630,10 +638,11 @@ export class CloudflareScopeHost {
630
638
  native: null,
631
639
  };
632
640
  }
633
- /** The injected D1 client, or a loud refusal naming what to configure. */
641
+ /** The injected D1 client, or a loud refusal naming what to configure — typed
642
+ * `unavailable` for the reason its blob-store twin below is (#828). */
634
643
  requireTenantStores(what) {
635
644
  if (!this.tenantStores) {
636
- throw new Error(`per-tenant stores are not configured on this host (#301): pass ` +
645
+ throw substratError('unavailable', `per-tenant stores are not configured on this host (#301): pass ` +
637
646
  `CloudflareScopeHostOptions.tenantStores (createD1TenantStores with the platform's ` +
638
647
  `Cloudflare credential) — refused ${what}`);
639
648
  }
@@ -671,10 +680,19 @@ export class CloudflareScopeHost {
671
680
  await this.recordAdmin(actor, 'provisionBlobStore', { tenantId: input.tenantId, vertical: input.vertical }, null, { binding: input.binding, kind: 'blob', ref });
672
681
  return { binding: input.binding, kind: 'blob', ref };
673
682
  }
674
- /** The injected R2 client, or a loud refusal naming what to configure. */
683
+ /**
684
+ * The injected R2 client, or a loud refusal naming what to configure.
685
+ *
686
+ * Typed `unavailable` (#828) for the reason `SecretBoxUnconfiguredError` is: this is a
687
+ * DEPLOYMENT fact, not a fault in the caller's request — the same request succeeds
688
+ * unchanged once the host is wired. Untyped, it reached the control-plane transport as
689
+ * an unrecognised throw and was flattened to a bare `500 internal error`, so a message
690
+ * that names its own fix was discarded at the boundary and the operator was left
691
+ * unable to tell a missing client from a bad scope id.
692
+ */
675
693
  requireBlobStores(what) {
676
694
  if (!this.blobStores) {
677
- throw new Error(`per-tenant blob stores are not configured on this host (#473): pass ` +
695
+ throw substratError('unavailable', `per-tenant blob stores are not configured on this host (#473): pass ` +
678
696
  `CloudflareScopeHostOptions.blobStores (createR2BlobStores with the platform's ` +
679
697
  `Cloudflare credential) — refused ${what}`);
680
698
  }
@@ -690,7 +708,7 @@ export class CloudflareScopeHost {
690
708
  const store = await this.resolveAttachmentStore(tenantId);
691
709
  return this.buildAttachmentSurface({ principal }, tenantId, scopeId, store);
692
710
  }
693
- async getConnectorAttachments(connectionId, scopeId) {
711
+ async getConnectorAttachments(connectionId, scopeId, forEvent) {
694
712
  // The exact door `getConnectorScope` opens — same (tenant, vertical) gate — but it
695
713
  // returns the attachment surface instead of the invoke stub, gated as the connection
696
714
  // rather than a principal (#476).
@@ -729,6 +747,10 @@ export class CloudflareScopeHost {
729
747
  scopeId,
730
748
  vertical,
731
749
  attachmentId,
750
+ // #726 remedy B: the delivery, resolved at the far end against the
751
+ // deployment's own outbox. Absent outside a dispatch, where the ordinary
752
+ // permission check still applies.
753
+ eventId: forEvent?.eventId,
732
754
  }),
733
755
  list: notDelegated('list'),
734
756
  remove: notDelegated('remove'),
@@ -736,7 +758,7 @@ export class CloudflareScopeHost {
736
758
  }
737
759
  await this.migrateAndRecord(scopeId);
738
760
  const store = await this.resolveAttachmentStore(conn.tenant_id);
739
- return this.buildAttachmentSurface({ connectionId }, conn.tenant_id, scopeId, store);
761
+ return this.buildAttachmentSurface({ connectionId }, conn.tenant_id, scopeId, store, forEvent);
740
762
  }
741
763
  /** Resolve the per-tenant R2 blob store, or fail closed exactly as `attachments` did. */
742
764
  async resolveAttachmentStore(tenantId) {
@@ -758,7 +780,9 @@ export class CloudflareScopeHost {
758
780
  * to the DO so its permission gate resolves against `connection:<id>` grants (and a denial is
759
781
  * attributed to the connection, not a laundered principal). Bytes never cross the DO boundary.
760
782
  */
761
- buildAttachmentSurface(subject, tenantId, scopeId, store) {
783
+ buildAttachmentSurface(subject, tenantId, scopeId, store,
784
+ /** The delivery admitting this surface's reads (#726 remedy B), when there is one. */
785
+ forEvent) {
762
786
  const connectionId = 'connectionId' in subject ? subject.connectionId : undefined;
763
787
  const createdBy = 'principal' in subject ? subject.principal : subject.connectionId;
764
788
  // The DO needs SOME principal-shaped value for `ctx.principal`; for a connection it is
@@ -800,7 +824,7 @@ export class CloudflareScopeHost {
800
824
  },
801
825
  list: (entity) => stub.attachmentList(entity, asPrincipalId, tenantId, scopeId, connectionId),
802
826
  open: async (attachmentId) => {
803
- const record = await stub.attachmentAuthorize(attachmentId, 'read', asPrincipalId, tenantId, scopeId, connectionId);
827
+ const record = await stub.attachmentAuthorize(attachmentId, 'read', asPrincipalId, tenantId, scopeId, connectionId, forEvent?.eventId);
804
828
  if (!record)
805
829
  return null;
806
830
  const obj = await store.get(attachmentBlobKey(scopeId, record.id));
@@ -2572,6 +2596,50 @@ export class CloudflareScopeHost {
2572
2596
  at: new Date().toISOString(),
2573
2597
  });
2574
2598
  }
2599
+ /**
2600
+ * The scope's own answer to "what may this connection do here" (#726 gap 1).
2601
+ *
2602
+ * Read from the ScopeDO's delivered tuples rather than the directory's grant rows:
2603
+ * the two are different facts, and the one a caller wants when asking whether a
2604
+ * dispatch will be refused is what this deployment would actually enforce. The
2605
+ * directory's view stays on `HostAdmin.listConnectionGrants`.
2606
+ */
2607
+ async connectionGrantsInScope(tenantId, scopeId) {
2608
+ await this.cp.validateScopeAccess(tenantId, scopeId);
2609
+ await this.migrateAndRecord(scopeId);
2610
+ const now = new Date().toISOString();
2611
+ // Both stores again, but the CF split is not the pure adapter's. The DO holds the
2612
+ // scope's own tuples plus whatever tenant-level ones were PROJECTED into it (the
2613
+ // CP-less shape); a scope with a live control plane has its tenant-level grants in
2614
+ // the directory instead, where the checker reads them from (`cp.tenantTuples`). Read
2615
+ // only the DO and a tenant-wide grant would be reported absent on exactly the
2616
+ // deployments that have a control plane — the fleet — while being enforced.
2617
+ const rows = [
2618
+ ...(await this.scopeStub(scopeId).listConnectionGrants(now)),
2619
+ ...(await this.cp.dumpTenantTuples(tenantId))
2620
+ .filter((r) => r.subject.startsWith('connection:') &&
2621
+ r.relation.startsWith('granted:') &&
2622
+ r.revoked_at === null &&
2623
+ (r.expires_at === null || r.expires_at > now))
2624
+ .map((r) => ({ subject: r.subject, relation: r.relation, expires_at: r.expires_at })),
2625
+ ];
2626
+ // One tuple per (connection, permission) however many stores answered.
2627
+ const seen = new Set();
2628
+ return rows
2629
+ .filter((r) => {
2630
+ const key = `${r.subject}\u0000${r.relation}`;
2631
+ if (seen.has(key))
2632
+ return false;
2633
+ seen.add(key);
2634
+ return true;
2635
+ })
2636
+ .sort((a, b) => a.subject.localeCompare(b.subject) || a.relation.localeCompare(b.relation))
2637
+ .map((r) => projectedConnectionGrant.parse({
2638
+ connectionId: r.subject.slice('connection:'.length),
2639
+ permission: r.relation.slice('granted:'.length),
2640
+ ...(r.expires_at ? { expiresAt: r.expires_at } : {}),
2641
+ }));
2642
+ }
2575
2643
  async writeScopeTuple(scopeId, subject, relation, object, expiresAt) {
2576
2644
  await this.scopeStub(scopeId).writeTuple(subject, relation, object, expiresAt);
2577
2645
  }
@@ -2886,10 +2954,13 @@ export class CloudflareScopeHost {
2886
2954
  * delivered `connection:<id>` tuple. `null` for an id this scope does not know,
2887
2955
  * so a caller falls back rather than failing a dispatch over a missing file.
2888
2956
  */
2889
- async connectorAttachmentOpenLocal(connectionId, tenantId, scopeId, attachmentId) {
2957
+ async connectorAttachmentOpenLocal(connectionId, tenantId, scopeId, attachmentId, eventId) {
2890
2958
  await this.migrateAndRecord(scopeId);
2891
2959
  const store = await this.resolveAttachmentStore(tenantId);
2892
- return this.buildAttachmentSurface({ connectionId }, tenantId, scopeId, store).open(attachmentId);
2960
+ return this.buildAttachmentSurface({ connectionId }, tenantId, scopeId, store,
2961
+ // #726 remedy B: the platform named a delivery; this deployment decides what that
2962
+ // delivery reaches, from its own spine row. Absent ⇒ the ordinary grant check.
2963
+ eventId === undefined ? undefined : { eventId }).open(attachmentId);
2893
2964
  }
2894
2965
  /**
2895
2966
  * The delivery half of `grantToConnection` for a scope served HERE (#574): write