@substrat-run/control-plane-api 0.118.0 → 0.120.0

package/dist/preview-auth.js

@@ -0,0 +1,273 @@
+import { SHARED_ISSUER_CONFIG_KEY, oidcCallbackUrl, } from '@substrat-run/contracts';
+import { ControlPlaneError } from './client.js';
+/**
+ * A preview's login (#1704) — the control plane's half. The issuer's half, and why the
+ * protocol has the shape it has, are in `@substrat-run/contracts`' `preview-client.ts`.
+ *
+ * A fork arrives with the parent's DATA and none of its delivered config: the PR's version
+ * is its own script with its own, empty, config store — at create and again after every push,
+ * which binds yet another script. The parent's `substrat:auth` carries a client secret the
+ * platform neither stores nor reads back, so it cannot be copied either. What CAN be done,
+ * when the parent signs in at one of the team's own auth-servers, is to give the preview a
+ * client of its own there and deliver THAT. Prod's client is never read, written, or taught a
+ * preview's callback.
+ *
+ * ## Which issuer
+ *
+ * Nothing the control plane holds says which issuer an app chose — only the dashboard knows,
+ * and it tells the ISSUER (#1619's resource rows, #1670's places), never the plane. So every
+ * active auth-server of the preview's OWN tenant is asked whether it signs the parent in; a
+ * fork or preview of an auth-server is never asked (it holds copies of prod's clients, not
+ * the parent's binding). One claim is wired. None is `unregistered` — an external issuer, a
+ * builtin login, or an install the dashboard has not registered yet — and more than one is
+ * `ambiguous`, which wires nothing rather than guess.
+ *
+ * ## Concurrent pushes
+ *
+ * Two pushes to one preview each bind their own version, and each version is its own config
+ * store; only the version the preview is bound to NOW is served. So a push:
+ *
+ *   1. re-reads the binding before it mints, and stops if its version is no longer bound;
+ *   2. delivers into ITS OWN version's deployment — never "whatever the scope is bound to",
+ *      which would let an older push overwrite a newer push's store;
+ *   3. re-reads the binding before it retires anything, and if its version has moved on,
+ *      deletes only the client it minted (which lives in its own, unserved, store) and stops;
+ *   4. otherwise retires the preview's clients OLDER than its own. `superseded` (a newer one
+ *      exists) means stop: the push that minted it owns what happens next. Only `kept: false`
+ *      — its own client vanished while its version is still bound — is retried, three
+ *      attempts in all; running out is a failure, never a success.
+ */
+/** The capability a vertical declares to be a team issuer (manifest `provides`, #427). */
+const OIDC_ISSUER = 'oidc-issuer';
+/** Rows pushed before `provides` existed — the same legacy slug the dashboard counts. */
+const LEGACY_ISSUER_SLUG = 'auth-server';
+/** The most callbacks a parent's hostnames yield in one check (the wire bound). */
+const MAX_PARENT_CALLBACKS = 32;
+const MAX_ATTEMPTS = 3;
+/** The team's own auth-servers: active, not a fork, not a preview, of a vertical that provides `oidc-issuer`. */
+export async function tenantIssuers(deps, tenantId) {
+    const verticals = await deps.admin.listVerticals(deps.actor);
+    const issuerSlugs = new Set([LEGACY_ISSUER_SLUG, ...verticals.filter((v) => v.provides?.includes(OIDC_ISSUER)).map((v) => v.slug)]);
+    const scopes = await deps.admin.listScopes(deps.actor, { tenantId, status: ['active'] });
+    return scopes.filter((s) => s.tenantId === tenantId && s.vertical !== null && issuerSlugs.has(s.vertical) && !s.forkedFrom && s.kind !== 'preview');
+}
+/** The hostname an issuer is addressed by: its canonical app hostname, else any live one. */
+function issuerHostname(bound) {
+    const live = bound.filter((h) => h.status !== 'failed');
+    const active = live.filter((h) => h.status === 'active');
+    const pick = (hs) => hs.find((h) => h.surface === 'app' && h.canonical) ?? hs.find((h) => h.canonical) ?? hs[0];
+    return (pick(active) ?? pick(live))?.hostname;
+}
+const reasonOf = (e) => (e instanceof Error ? e.message : String(e));
+/** Re-exported for the preview routes, which name a preview's callback on every row. */
+export { oidcCallbackUrl };
+/** Why a push left the login alone, as `preview create` reports it. */
+function superseded(callbackUrl, why) {
+    return {
+        status: 'superseded',
+        callbackUrl,
+        note: `Sign-in: ${why} — a newer push owns this preview's login, so this push delivered none.`,
+    };
+}
+/**
+ * Give a freshly bound preview its own client at the team auth-server its parent signs in
+ * with. Answers what it did; THROWS only when it minted a client and could not leave the
+ * preview with a working login — that is a failure, and `preview create` must not report it
+ * as success. The secret travels from the mint's answer into `deliver` and nowhere else.
+ */
+export async function wirePreviewAuth(deps, input) {
+    const callbackUrl = oidcCallbackUrl(input.previewHostname);
+    if (!input.parent) {
+        return {
+            status: 'not-applicable',
+            callbackUrl,
+            note: 'Sign-in: a clean-room preview forks no app, so it has no login to take after and none was delivered.',
+        };
+    }
+    const parent = input.parent;
+    const parentRedirectUris = [
+        ...new Set((await deps.admin.listHostnames(deps.actor, { scopeId: parent.id }))
+            .filter((h) => h.status !== 'failed')
+            .map((h) => oidcCallbackUrl(h.hostname))),
+    ].slice(0, MAX_PARENT_CALLBACKS);
+    const unregistered = (extra) => ({
+        status: 'unregistered',
+        callbackUrl,
+        note: `Sign-in: no team auth server of this team signs in the app this preview forks, so no client was minted ` +
+            `for it and no login config was delivered.${extra ? ` ${extra}` : ''} If the app signs in at an EXTERNAL ` +
+            `issuer, that issuer needs ${callbackUrl} registered as a redirect URI — and the preview still has no ` +
+            `login config, because an external client's credentials are never copied to a preview. If the app signs ` +
+            `in at one of your auth servers, open the dashboard's Apps list once (it registers existing installs ` +
+            `there) and re-run.`,
+    });
+    if (parentRedirectUris.length === 0)
+        return unregistered('The app it forks has no hostname to sign in at.');
+    // Ask every issuer of the tenant; mint only where exactly one claims.
+    const claims = [];
+    const problems = [];
+    for (const scope of await tenantIssuers(deps, input.tenantId)) {
+        const client = await deps.issuerClient(scope);
+        if (!client) {
+            problems.push({ issuerScopeId: scope.id, problem: 'its deployment could not be resolved' });
+            continue;
+        }
+        try {
+            const { claimed } = await client.checkPreviewClient({
+                tenantId: input.tenantId,
+                scopeId: scope.id,
+                parentScopeId: parent.id,
+                parentRedirectUris,
+            });
+            if (!claimed)
+                continue;
+            const hostname = issuerHostname(await deps.admin.listHostnames(deps.actor, { scopeId: scope.id }));
+            if (!hostname) {
+                problems.push({ issuerScopeId: scope.id, problem: 'it claims the app but has no hostname to be an issuer at' });
+                continue;
+            }
+            claims.push({ scope, client, hostname });
+        }
+        catch (e) {
+            problems.push({ issuerScopeId: scope.id, problem: reasonOf(e) });
+        }
+    }
+    if (claims.length > 1) {
+        return {
+            status: 'ambiguous',
+            callbackUrl,
+            issuers: claims.map((c) => ({ issuerScopeId: c.scope.id })),
+            note: `Sign-in: more than one of your auth servers claims the app this preview forks ` +
+                `(${claims.map((c) => c.scope.id).join(', ')}), so the platform wired none rather than guess. ` +
+                `Open the dashboard's Apps list once so each auth server learns which apps are its own, then re-run.`,
+        };
+    }
+    const claim = claims[0];
+    if (!claim) {
+        if (problems.length === 0)
+            return unregistered();
+        return {
+            status: 'unknown',
+            callbackUrl,
+            issuers: problems,
+            note: `Sign-in: not set up — ${problems.length === 1 ? 'an auth server' : 'some auth servers'} of this team ` +
+                `could not be asked: ${problems.map((p) => `${p.issuerScopeId}: ${p.problem}`).join('; ')}. None that could ` +
+                `be asked signs the app in. Fix that and re-run to give this preview its login.`,
+        };
+    }
+    const issuer = `https://${claim.hostname}`;
+    const address = { tenantId: input.tenantId, scopeId: claim.scope.id, previewScopeId: input.previewId };
+    const retireOwn = (minted) => claim.client.retirePreviewClients({ ...address, only: minted.clientId }).then(() => null, (e) => reasonOf(e));
+    const bound = async () => {
+        const rec = await deps.admin.getScopeRecord(deps.actor, input.tenantId, input.previewId);
+        if (!rec || rec.status !== 'active')
+            return 'gone';
+        return rec.verticalVersionId === input.versionId ? 'ours' : 'moved';
+    };
+    const reapedMeanwhile = async () => {
+        // The preview was reaped while this push ran: nothing may outlive it at the issuer.
+        await claim.client.retirePreviewClients(address).catch(() => undefined);
+        return superseded(callbackUrl, 'the preview was reaped while this push ran');
+    };
+    const noLogin = (why) => new ControlPlaneError(502, `preview '${input.tag}' was created but has NO working login: ${why}. Re-run \`preview create\` to retry.`);
+    for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
+        const before = await bound();
+        if (before === 'gone')
+            return reapedMeanwhile();
+        if (before === 'moved')
+            return superseded(callbackUrl, 'another push re-bound the preview');
+        let minted;
+        try {
+            minted = await claim.client.mintPreviewClient({
+                ...address,
+                parentScopeId: parent.id,
+                parentRedirectUris,
+                redirectUri: callbackUrl,
+                postLogoutRedirectUri: `https://${input.previewHostname}/`,
+                clientName: `${input.appName} (preview ${input.tag})`,
+            });
+        }
+        catch (e) {
+            throw noLogin(`the auth server ${claim.scope.id} did not mint its client (${reasonOf(e)})`);
+        }
+        try {
+            await input.deliver([
+                {
+                    key: 'substrat:auth',
+                    value: JSON.stringify({ mode: 'oidc', issuer, clientId: minted.clientId, clientSecret: minted.clientSecret }),
+                },
+                // A team auth-server is shared by construction (#1683): the preview accepts its OWN tokens only.
+                { key: SHARED_ISSUER_CONFIG_KEY, value: 'true' },
+            ]);
+        }
+        catch (e) {
+            const cleanup = await retireOwn(minted);
+            throw noLogin(`delivering its client failed (${reasonOf(e)})` +
+                (cleanup ? `, and removing that client failed too (${cleanup}) — the preview's reap removes it` : ''));
+        }
+        const after = await bound();
+        if (after !== 'ours') {
+            // Our client sits only in our own version's store, which is no longer served.
+            await retireOwn(minted);
+            return after === 'gone' ? reapedMeanwhile() : superseded(callbackUrl, 'another push re-bound the preview');
+        }
+        let retired;
+        try {
+            retired = await claim.client.retirePreviewClients({ ...address, keep: minted.clientId });
+        }
+        catch (e) {
+            // Delivered and bound: the login works. What is left is older clients, which the next
+            // push or the reap removes — said, not hidden.
+            return wired(claim.scope.id, issuer, minted.clientId, callbackUrl, ` Older clients of this preview could not be removed yet (${reasonOf(e)}); the next push or the reap removes them.`);
+        }
+        if (retired.kept === false)
+            continue; // our own client vanished while our version is bound
+        if ((await bound()) === 'gone')
+            return reapedMeanwhile();
+        return wired(claim.scope.id, issuer, minted.clientId, callbackUrl);
+    }
+    throw noLogin(`its client kept disappearing at the auth server ${claim.scope.id} (${MAX_ATTEMPTS} attempts)`);
+}
+function wired(issuerScopeId, issuer, clientId, callbackUrl, extra = '') {
+    return {
+        status: 'wired',
+        callbackUrl,
+        issuer,
+        issuerScopeId,
+        clientId,
+        note: `Sign-in: this preview has its own client at your auth server ${issuer} (client ${clientId}); it is deleted when the preview is reaped.${extra}`,
+    };
+}
+/**
+ * Delete every client minted for a preview, at every auth-server of its tenant — the reap's
+ * half, run BEFORE the preview's storage and row go, so a failure leaves a preview a retry can
+ * still find. An auth-server that predates preview clients cannot have minted one and is
+ * skipped; any other failure throws.
+ */
+export async function retireAllPreviewClients(deps, tenantId, previewScopeId) {
+    const deleted = [];
+    for (const scope of await tenantIssuers(deps, tenantId)) {
+        const client = await deps.issuerClient(scope);
+        if (!client)
+            throw new ControlPlaneError(502, `the auth server ${scope.id} could not be reached to delete preview ${previewScopeId}'s clients`);
+        try {
+            deleted.push(...(await client.retirePreviewClients({ tenantId, scopeId: scope.id, previewScopeId })).deleted);
+        }
+        catch (e) {
+            if (e instanceof ControlPlaneError && e.status === 501)
+                continue;
+            throw e;
+        }
+    }
+    return deleted;
+}
+/**
+ * The reap's half for ANY scope about to go, as the platform sweep's expiry GC sees it: a
+ * preview fork's clients are retired, and anything else — a snapshot, a clean room — has none
+ * and is left alone. One predicate for the interactive reap and the sweep, so they agree.
+ */
+export async function retireClientsOfReapedScope(deps, scope) {
+    if (!scope || scope.kind !== 'preview' || !scope.forkedFrom)
+        return [];
+    return retireAllPreviewClients(deps, scope.tenantId, scope.id);
+}
+//# sourceMappingURL=preview-auth.js.map

package/dist/preview-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preview-auth.js","sourceRoot":"","sources":["../src/preview-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,eAAe,GAQhB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,0FAA0F;AAC1F,MAAM,WAAW,GAAG,aAAa,CAAC;AAClC,yFAAyF;AACzF,MAAM,kBAAkB,GAAG,aAAa,CAAC;AACzC,mFAAmF;AACnF,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,YAAY,GAAG,CAAC,CAAC;AASvB,iHAAiH;AACjH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAqB,EAAE,QAAkB;IAC3E,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpI,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACzF,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,CAC9H,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,SAAS,cAAc,CAAC,KAAiC;IACvD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,CAAC,EAA8B,EAAE,EAAE,CAC9C,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7F,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC;AAChD,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAEtF,wFAAwF;AACxF,OAAO,EAAE,eAAe,EAAE,CAAC;AAiB3B,uEAAuE;AACvE,SAAS,UAAU,CAAC,WAAmB,EAAE,GAAW;IAClD,OAAO;QACL,MAAM,EAAE,YAAY;QACpB,WAAW;QACX,IAAI,EAAE,YAAY,GAAG,yEAAyE;KAC/F,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAqB,EAAE,KAA2B;IACtF,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO;YACL,MAAM,EAAE,gBAAgB;YACxB,WAAW;YACX,IAAI,EAAE,sGAAsG;SAC7G,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,MAAM,kBAAkB,GAAG;QACzB,GAAG,IAAI,GAAG,CACR,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;aACjE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAC3C;KACF,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACjC,MAAM,YAAY,GAAG,CAAC,KAAc,EAAe,EAAE,CAAC,CAAC;QACrD,MAAM,EAAE,cAAc;QACtB,WAAW;QACX,IAAI,EACF,yGAAyG;YACzG,4CAA4C,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,sCAAsC;YAC1G,6BAA6B,WAAW,+DAA+D;YACvG,yGAAyG;YACzG,sGAAsG;YACtG,oBAAoB;KACvB,CAAC,CAAC;IACH,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC,iDAAiD,CAAC,CAAC;IAE5G,sEAAsE;IACtE,MAAM,MAAM,GAAsE,EAAE,CAAC;IACrF,MAAM,QAAQ,GAAuD,EAAE,CAAC;IACxE,KAAK,MAAM,KAAK,IAAI,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;YAC5F,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC;gBAClD,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,aAAa,EAAE,MAAM,CAAC,EAAE;gBACxB,kBAAkB;aACnB,CAAC,CAAC;YACH,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YACnG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC,CAAC;gBAChH,SAAS;YACX,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,WAAW;YACX,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3D,IAAI,EACF,gFAAgF;gBAChF,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mDAAmD;gBAC/F,qGAAqG;SACxG,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,YAAY,EAAE,CAAC;QACjD,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,WAAW;YACX,OAAO,EAAE,QAAQ;YACjB,IAAI,EACF,yBAAyB,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,mBAAmB,gBAAgB;gBACvG,uBAAuB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB;gBAC7G,gFAAgF;SACnF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;IACvG,MAAM,SAAS,GAAG,CAAC,MAA2B,EAAE,EAAE,CAChD,KAAK,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAC3E,GAAG,EAAE,CAAC,IAAI,EACV,CAAC,CAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC5B,CAAC;IACJ,MAAM,KAAK,GAAG,KAAK,IAAwC,EAAE;QAC3D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACzF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC;QACnD,OAAO,GAAG,CAAC,iBAAiB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IACtE,CAAC,CAAC;IACF,MAAM,eAAe,GAAG,KAAK,IAA0B,EAAE;QACvD,oFAAoF;QACpF,MAAM,KAAK,CAAC,MAAM,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACxE,OAAO,UAAU,CAAC,WAAW,EAAE,4CAA4C,CAAC,CAAC;IAC/E,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,GAAW,EAAqB,EAAE,CACjD,IAAI,iBAAiB,CACnB,GAAG,EACH,YAAY,KAAK,CAAC,GAAG,2CAA2C,GAAG,uCAAuC,CAC3G,CAAC;IAEJ,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,YAAY,EAAE,OAAO,EAAE,EAAE,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC;QAC7B,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,eAAe,EAAE,CAAC;QAChD,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,UAAU,CAAC,WAAW,EAAE,mCAAmC,CAAC,CAAC;QAE5F,IAAI,MAA2B,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC;gBAC5C,GAAG,OAAO;gBACV,aAAa,EAAE,MAAM,CAAC,EAAE;gBACxB,kBAAkB;gBAClB,WAAW,EAAE,WAAW;gBACxB,qBAAqB,EAAE,WAAW,KAAK,CAAC,eAAe,GAAG;gBAC1D,UAAU,EAAE,GAAG,KAAK,CAAC,OAAO,aAAa,KAAK,CAAC,GAAG,GAAG;aACtD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,OAAO,CAAC,mBAAmB,KAAK,CAAC,KAAK,CAAC,EAAE,6BAA6B,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9F,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,OAAO,CAAC;gBAClB;oBACE,GAAG,EAAE,eAAe;oBACpB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;iBAC9G;gBACD,iGAAiG;gBACjG,EAAE,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,EAAE;aACjD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,OAAO,CACX,iCAAiC,QAAQ,CAAC,CAAC,CAAC,GAAG;gBAC7C,CAAC,OAAO,CAAC,CAAC,CAAC,0CAA0C,OAAO,mCAAmC,CAAC,CAAC,CAAC,EAAE,CAAC,CACxG,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,KAAK,EAAE,CAAC;QAC5B,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,8EAA8E;YAC9E,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;YACxB,OAAO,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,mCAAmC,CAAC,CAAC;QAC7G,CAAC;QAED,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3F,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,sFAAsF;YACtF,+CAA+C;YAC/C,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,4DAA4D,QAAQ,CAAC,CAAC,CAAC,4CAA4C,CAAC,CAAC;QAC1L,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK;YAAE,SAAS,CAAC,qDAAqD;QAC3F,IAAI,CAAC,MAAM,KAAK,EAAE,CAAC,KAAK,MAAM;YAAE,OAAO,eAAe,EAAE,CAAC;QACzD,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,OAAO,CAAC,mDAAmD,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,YAAY,YAAY,CAAC,CAAC;AAChH,CAAC;AAED,SAAS,KAAK,CAAC,aAAsB,EAAE,MAAc,EAAE,QAAgB,EAAE,WAAmB,EAAE,KAAK,GAAG,EAAE;IACtG,OAAO;QACL,MAAM,EAAE,OAAO;QACf,WAAW;QACX,MAAM;QACN,aAAa;QACb,QAAQ;QACR,IAAI,EAAE,gEAAgE,MAAM,YAAY,QAAQ,+CAA+C,KAAK,EAAE;KACvJ,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAqB,EACrB,QAAkB,EAClB,cAAuB;IAEvB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,mBAAmB,KAAK,CAAC,EAAE,2CAA2C,cAAc,YAAY,CAAC,CAAC;QAChJ,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,oBAAoB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAChH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,iBAAiB,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,SAAS;YACjE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,IAAqB,EAAE,KAAwB;IAC9F,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IACvE,OAAO,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;AACjE,CAAC"}

package/dist/vertical-client.d.ts

@@ -1,4 +1,4 @@
-import type { AttachmentRecord, ConnectionId, EntityRef, EntitlementGrant, ModuleId, PermissionKey, PlatformRequest, PlatformRequestFilter, PlatformRequestId, PlatformRequestStatus, PlatformRequestFailure, PrincipalId, SystemSwitchOutcome, ConnectionGrantRecord, ProjectedConnectionGrant, ProjectedConnectionKey, ProjectedIdentityLink, OwnerSeat, OwnerClaimLink, QueryScopeInput, ReadScopeTableInput, EntityHistoryInput, EventFacetInput, EventCauseInput, EventEffectsInput, EffectsTree, InvocationEventsInput, InvocationEvents, DeadLettersInput, DeadLetter, CauseChain, EventFacetResult, HistoryEntry, Page, ScopeDumpTable, ScopeId, ScopeQueryResult, DenialFilter, DenialSummary, PermissionDenial, ScopeTable, ScopeTablePage, TenantId, TenantStoreHandle, Visibility } from '@substrat-run/contracts';
+import type { AttachmentRecord, ConnectionId, EntityRef, EntitlementGrant, ModuleId, PermissionKey, PlatformRequest, PlatformRequestFilter, PlatformRequestId, PlatformRequestStatus, PlatformRequestFailure, MintedPreviewClient, PreviewClientCheck, PreviewClientClaim, PreviewClientMint, PreviewClientRetire, PrincipalId, RetiredPreviewClients, PeerGrantsEntry, PeerSwitchOutcome, SystemSwitchOutcome, SystemScheduleEntry, ConnectionGrantRecord, ProjectedConnectionGrant, ProjectedConnectionKey, ProjectedIdentityLink, OwnerSeat, OwnerClaimLink, QueryScopeInput, ReadScopeTableInput, EntityHistoryInput, EventFacetInput, EventCauseInput, EventEffectsInput, EffectsTree, InvocationEventsInput, InvocationEvents, DeadLettersInput, DeadLetter, CauseChain, EventFacetResult, HistoryEntry, Page, ScopeDumpTable, ScopeId, ScopeQueryResult, DenialFilter, DenialSummary, PermissionDenial, ScopeTable, ScopeTablePage, TenantId, TenantStoreHandle, Visibility } from '@substrat-run/contracts';
 import type { OpenedAttachment, UndrainedEvents } from '@substrat-run/kernel';
 /**
  * The platform's client for calling a VERTICAL (K-31).
@@ -355,6 +355,69 @@ export declare class VerticalClient {
         moduleId: ModuleId;
         to: 'on' | 'off';
     }): Promise<SystemSwitchOutcome>;
+    /**
+     * The read half of the schedule kill switch's status (#1674): every module the
+     * deployment serving this scope holds or has held system authority for, and where each
+     * stands. Mirrors `systemSwitch`'s seam and its skew rule exactly (#1666's "only the
+     * explicit legacy signal reads as redeploy"): a 404 (the route does not exist) or an SPA
+     * shell (a 200 that is not JSON) are the deployment's own proof it predates this read,
+     * and become a 501 that says so. A 200 of the wrong-shaped JSON is NOT that proof — it
+     * is a failure this client cannot explain, so it surfaces as the 502 it is rather than a
+     * guess at "redeploy". The far end's own 501 (the route exists, the method doesn't)
+     * passes through `refusal` verbatim, unchanged either way.
+     */
+    systemGrantsStatus(input: {
+        scopeId: ScopeId;
+    }): Promise<SystemScheduleEntry[]>;
+    /**
+     * The read half of the peer kill switch's status (#1706): every peer the deployment
+     * serving this scope holds or has held grants for, and where each stands. Mirrors
+     * `peerSwitch`'s seam and `systemGrantsStatus`'s skew rule exactly — a 404 or an SPA
+     * shell are the deployment's own proof it predates this read and become a 501 that says
+     * to redeploy; a wrong-shaped 200 is not that proof and surfaces as the 502 it is.
+     */
+    peerGrantsStatus(input: {
+        scopeId: ScopeId;
+    }): Promise<PeerGrantsEntry[]>;
+    /**
+     * Move one PEER's kill switch in the deployment serving the scope (#1706) — the far end
+     * of `revokeFromPeer` / `restoreToPeer` for a hosted scope, whose `vertical:<slug>` grants
+     * live there and nowhere the shared control plane can reach.
+     *
+     * The seam, the skew rule and the honesty rule are `systemSwitch`'s, for the same reasons:
+     * a **404** (no such route) or an **SPA shell** (a 200 that is not JSON) are the
+     * deployment's own proof that it predates this route and therefore cannot have switched
+     * anything — the route itself answers a peer the scope holds nothing for with a 200
+     * `held: false`, never a 404. Everything else surfaces as the failure it is, because the
+     * request may have landed and the switch may have moved before the answer was lost.
+     */
+    peerSwitch(input: {
+        scopeId: ScopeId;
+        vertical: string;
+        to: 'on' | 'off';
+    }): Promise<PeerSwitchOutcome>;
+    /**
+     * A preview's own client at a team auth-server (#1704, `@substrat-run/contracts`'
+     * `preview-client.ts`): does the parent sign in at THIS issuer, mint the preview a client
+     * here, delete the preview's clients. Addressed to the ISSUER's deployment (this client),
+     * never the preview's.
+     *
+     * The skew rule is `systemSwitch`'s, widened by one status: a deployment built before these
+     * routes answers its `/internal/*` fallback — a JSON **501** on the auth-server — or a
+     * **404**, or an SPA shell (a 200 that is not JSON). All three are the deployment's own
+     * proof it cannot have acted, and become a 501 that says to redeploy the auth server. The
+     * caller must never read that as "the parent does not sign in here". A 200 of the wrong
+     * shape is not that proof and surfaces as a 502; a refusal (403 another tenant's issuer,
+     * 409 a parent it does not claim) passes through verbatim.
+     *
+     * The mint's answer carries a client SECRET. It is returned to the caller and nothing here
+     * keeps, logs or quotes it: no error message on this path includes a response body that
+     * could hold one.
+     */
+    checkPreviewClient(input: PreviewClientCheck): Promise<PreviewClientClaim>;
+    mintPreviewClient(input: PreviewClientMint): Promise<MintedPreviewClient>;
+    retirePreviewClients(input: PreviewClientRetire): Promise<RetiredPreviewClients>;
+    private previewClientCall;
     /** Journal a platform-request outcome back in the vertical after the platform ran it. */
     settlePlatformRequest(tenantId: TenantId, scopeId: ScopeId, id: PlatformRequestId, outcome: {
         status: PlatformRequestStatus;
@@ -509,6 +572,23 @@ export declare class VerticalClient {
      */
     private parseInternal;
     /** A platform-authenticated POST to the vertical's `/internal/*` surface. */
+    /**
+     * Invoke ONE operation on this deployment as a PEER vertical (#1706) — the far end of an
+     * asynchronous peer call, whose caller the platform took from the scope it drained the
+     * intent from. The door at the other end admits it (declared peer, switch on, operation
+     * allowlisted) and every check inside runs as `{ vertical, scope }`.
+     */
+    verticalInvoke(input: {
+        caller: {
+            vertical: string;
+            scope: ScopeId;
+        };
+        tenantId: TenantId;
+        scopeId: ScopeId;
+        operation: string;
+        input?: unknown;
+        idempotencyKey?: string;
+    }): Promise<unknown>;
     private postInternal;
     /** A platform-authenticated GET to the vertical's `/internal/*` surface. */
     private getInternal;

package/dist/vertical-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vertical-client.d.ts","sourceRoot":"","sources":["../src/vertical-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EAEZ,SAAS,EACT,gBAAgB,EAChB,QAAQ,EACR,aAAa,EACb,eAAe,EACf,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,WAAW,EACX,mBAAmB,EACnB,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,EACtB,qBAAqB,EACrB,SAAS,EACT,cAAc,EACd,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,IAAI,EACJ,cAAc,EACd,OAAO,EACP,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,QAAQ,EACR,iBAAiB,EACjB,UAAU,EACX,MAAM,yBAAyB,CAAC;AAQjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAiB,MAAM,sBAAsB,CAAC;AAiB7F;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,wDAAwD;IACxD,KAAK,EAAE,WAAW,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAClC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,qBAAqB,EAAE,CAAC;IACxC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,wBAAwB,EAAE,CAAC;IAC9C;;;;;;;;;;;;;;;;OAgBG;IACH,cAAc,CAAC,EAAE,sBAAsB,EAAE,CAAC;IAC1C;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,iBAAiB,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,sBAAsB;IACrC;8FAC0F;IAC1F,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,6EAA6E;IAC7E,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,WAAW,CAAC;IACnB;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAgCD,MAAM,WAAW,sBAAsB;IACrC;iGAC6F;IAC7F,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB;;uEAEmE;IACnE,YAAY,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAClC;;2DAEuD;IACvD,aAAa,CAAC,EAAE,qBAAqB,EAAE,CAAC;IACxC;;;gEAG4D;IAC5D,gBAAgB,CAAC,EAAE,wBAAwB,EAAE,CAAC;IAC9C;;;wEAGoE;IACpE,cAAc,CAAC,EAAE,sBAAsB,EAAE,CAAC;IAC1C;;;;8EAI0E;IAC1E,YAAY,CAAC,EAAE,iBAAiB,EAAE,CAAC;CACpC;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,qBAAqB,EAAE,EAC/B,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACnC,OAAO,EAAE,OAAO,GACf,wBAAwB,EAAE,CAS5B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,gGAAgG;IAChG,KAAK,EAAE,WAAW,CAAC;CACpB;AAED,qBAAa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,OAAO;IAApC,YAA6B,OAAO,EAAE,qBAAqB,EAAI;IAE/D;;;;;;OAMG;IACG,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAwBnF;IAED;;;;;;;OAOG;IACG,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpE;IAED;;;;;;;;OAQG;IACG,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAElF;IAED;;;;;;;OAOG;IACG,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAE7D;IAED,mDAAmD;IAC7C,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC,CAS1F;IAED;;;;;;OAMG;IACG,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAEpF;IAED;;;;;;OAMG;IACG,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAEtF;IAED,wFAAwF;IAClF,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAItF;IAED;;;;;OAKG;IACG,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAGxE;IAED;;;;;;OAMG;IACG,cAAc,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAE7G;IAED;;;;;OAKG;IACG,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAG3F;IAED;;;;;OAKG;IACG,0BAA0B,CAC9B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,eAAe,EAAE,CAAC,CAM5B;IAED;;;;;;OAMG;IACG,eAAe,CAAC,KAAK,EAAE;QAC3B,YAAY,EAAE,YAAY,CAAC;QAC3B,QAAQ,EAAE,QAAQ,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GAAG,OAAO,CAAC,OAAO,CAAC,CAOnB;IAED;;;;OAIG;IACG,yBAAyB,CAAC,KAAK,EAAE;QACrC,YAAY,EAAE,YAAY,CAAC;QAC3B,QAAQ,EAAE,QAAQ,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,SAAS,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,UAAU,CAAC;QACvB,IAAI,EAAE,UAAU,CAAC;KAClB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgB5B;IAED;;;;;;;;;;OAUG;IACG,uBAAuB,CAAC,KAAK,EAAE;QACnC,YAAY,EAAE,YAAY,CAAC;QAC3B,QAAQ,EAAE,QAAQ,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB;;;;WAIG;QACH,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAiCnC;IAED;;;;OAIG;IACG,cAAc,CAAC,KAAK,EAAE;QAC1B,YAAY,EAAE,YAAY,CAAC;QAC3B,OAAO,EAAE,OAAO,CAAC;QACjB,UAAU,EAAE,aAAa,CAAC;QAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhB;IAED;;;;;;;;;;;;;;;OAeG;IACG,YAAY,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,QAAQ,CAAC;QAAC,EAAE,EAAE,IAAI,GAAG,KAAK,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAkClH;IAED,yFAAyF;IACnF,qBAAqB,CACzB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,EAAE,EAAE,iBAAiB,EACrB,OAAO,EAAE;QACP,MAAM,EAAE,qBAAqB,CAAC;QAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,OAAO,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC;KACzC,GACA,OAAO,CAAC,IAAI,CAAC,CAMf;IAED;;;;;OAKG;IACG,aAAa,CAAC,KAAK,EAAE;QACzB,aAAa,EAAE,OAAO,CAAC;QACvB,UAAU,EAAE,OAAO,CAAC;KACrB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAE9B;IAED;;;;;OAKG;IACG,WAAW,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5D;IAED;;;;;OAKG;IACG,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAI7D;IAED;;;;;;;;;OASG;IACG,YAAY,CAChB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,cAAc,EAAE,GACvB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAE7B;IAED,yFAAyF;IACnF,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC,CASrF;IAED,6FAA6F;IACvF,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAI9E;IAED,iFAAiF;IAC3E,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAInF;IAED,sFAAsF;IAChF,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAIhG;IAED,sFAAsF;IAChF,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAKtF;IAED,6GAA6G;IACvG,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAS5F;IAED;;;;;;;;OAQG;IACG,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAM/E;IAED;;;;OAIG;IACG,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOzG;IAED;;;;;;;;;;OAUG;IACG,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAoBjG;IAED;;;OAGG;IACG,iBAAiB,CACrB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC,CAI5E;IAED;;;;OAIG;IACG,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAQpD;IAED;;;;OAIG;IACG,kBAAkB,CACtB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC,CAIrE;IAED;;;;;OAKG;IACG,WAAW,CACf,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GACzB,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAMlC;IAED;;;;;;;OAOG;YACW,KAAK;IASnB;;;;;;;;;;OAUG;YACW,OAAO;IAmBrB;;;;;;OAMG;YACW,aAAa;IAa3B,6EAA6E;YAC/D,YAAY;IAgB1B,4EAA4E;YAC9D,WAAW;CAU1B"}
+{"version":3,"file":"vertical-client.d.ts","sourceRoot":"","sources":["../src/vertical-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EAEZ,SAAS,EACT,gBAAgB,EAChB,QAAQ,EACR,aAAa,EACb,eAAe,EACf,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,qBAAqB,EACrB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,EACtB,qBAAqB,EACrB,SAAS,EACT,cAAc,EACd,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,IAAI,EACJ,cAAc,EACd,OAAO,EACP,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,QAAQ,EACR,iBAAiB,EACjB,UAAU,EACX,MAAM,yBAAyB,CAAC;AAejC,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAiB,MAAM,sBAAsB,CAAC;AAiB7F;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,wDAAwD;IACxD,KAAK,EAAE,WAAW,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAClC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,qBAAqB,EAAE,CAAC;IACxC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,wBAAwB,EAAE,CAAC;IAC9C;;;;;;;;;;;;;;;;OAgBG;IACH,cAAc,CAAC,EAAE,sBAAsB,EAAE,CAAC;IAC1C;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,iBAAiB,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,sBAAsB;IACrC;8FAC0F;IAC1F,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,6EAA6E;IAC7E,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,WAAW,CAAC;IACnB;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAgCD,MAAM,WAAW,sBAAsB;IACrC;iGAC6F;IAC7F,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB;;uEAEmE;IACnE,YAAY,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAClC;;2DAEuD;IACvD,aAAa,CAAC,EAAE,qBAAqB,EAAE,CAAC;IACxC;;;gEAG4D;IAC5D,gBAAgB,CAAC,EAAE,wBAAwB,EAAE,CAAC;IAC9C;;;wEAGoE;IACpE,cAAc,CAAC,EAAE,sBAAsB,EAAE,CAAC;IAC1C;;;;8EAI0E;IAC1E,YAAY,CAAC,EAAE,iBAAiB,EAAE,CAAC;CACpC;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,qBAAqB,EAAE,EAC/B,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACnC,OAAO,EAAE,OAAO,GACf,wBAAwB,EAAE,CAS5B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,gGAAgG;IAChG,KAAK,EAAE,WAAW,CAAC;CACpB;AAED,qBAAa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,OAAO;IAApC,YAA6B,OAAO,EAAE,qBAAqB,EAAI;IAE/D;;;;;;OAMG;IACG,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAwBnF;IAED;;;;;;;OAOG;IACG,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpE;IAED;;;;;;;;OAQG;IACG,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAElF;IAED;;;;;;;OAOG;IACG,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAE7D;IAED,mDAAmD;IAC7C,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC,CAS1F;IAED;;;;;;OAMG;IACG,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAEpF;IAED;;;;;;OAMG;IACG,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAEtF;IAED,wFAAwF;IAClF,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAItF;IAED;;;;;OAKG;IACG,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAGxE;IAED;;;;;;OAMG;IACG,cAAc,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAE7G;IAED;;;;;OAKG;IACG,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAG3F;IAED;;;;;OAKG;IACG,0BAA0B,CAC9B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,eAAe,EAAE,CAAC,CAM5B;IAED;;;;;;OAMG;IACG,eAAe,CAAC,KAAK,EAAE;QAC3B,YAAY,EAAE,YAAY,CAAC;QAC3B,QAAQ,EAAE,QAAQ,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GAAG,OAAO,CAAC,OAAO,CAAC,CAOnB;IAED;;;;OAIG;IACG,yBAAyB,CAAC,KAAK,EAAE;QACrC,YAAY,EAAE,YAAY,CAAC;QAC3B,QAAQ,EAAE,QAAQ,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,SAAS,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,UAAU,CAAC;QACvB,IAAI,EAAE,UAAU,CAAC;KAClB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgB5B;IAED;;;;;;;;;;OAUG;IACG,uBAAuB,CAAC,KAAK,EAAE;QACnC,YAAY,EAAE,YAAY,CAAC;QAC3B,QAAQ,EAAE,QAAQ,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB;;;;WAIG;QACH,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAiCnC;IAED;;;;OAIG;IACG,cAAc,CAAC,KAAK,EAAE;QAC1B,YAAY,EAAE,YAAY,CAAC;QAC3B,OAAO,EAAE,OAAO,CAAC;QACjB,UAAU,EAAE,aAAa,CAAC;QAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhB;IAED;;;;;;;;;;;;;;;OAeG;IACG,YAAY,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,QAAQ,CAAC;QAAC,EAAE,EAAE,IAAI,GAAG,KAAK,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAkClH;IAED;;;;;;;;;;OAUG;IACG,kBAAkB,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAgCpF;IAED;;;;;;OAMG;IACG,gBAAgB,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CA6B9E;IAED;;;;;;;;;;;OAWG;IACG,UAAU,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,IAAI,GAAG,KAAK,CAAA;KAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAkC5G;IAED;;;;;;;;;;;;;;;;;OAiBG;IACG,kBAAkB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAE/E;IAEK,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAE9E;IAEK,oBAAoB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAErF;YAEa,iBAAiB;IAsC/B,yFAAyF;IACnF,qBAAqB,CACzB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,EAAE,EAAE,iBAAiB,EACrB,OAAO,EAAE;QACP,MAAM,EAAE,qBAAqB,CAAC;QAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,OAAO,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC;KACzC,GACA,OAAO,CAAC,IAAI,CAAC,CAMf;IAED;;;;;OAKG;IACG,aAAa,CAAC,KAAK,EAAE;QACzB,aAAa,EAAE,OAAO,CAAC;QACvB,UAAU,EAAE,OAAO,CAAC;KACrB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAE9B;IAED;;;;;OAKG;IACG,WAAW,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5D;IAED;;;;;OAKG;IACG,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAI7D;IAED;;;;;;;;;OASG;IACG,YAAY,CAChB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,cAAc,EAAE,GACvB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAE7B;IAED,yFAAyF;IACnF,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC,CASrF;IAED,6FAA6F;IACvF,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAI9E;IAED,iFAAiF;IAC3E,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAInF;IAED,sFAAsF;IAChF,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAIhG;IAED,sFAAsF;IAChF,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAKtF;IAED,6GAA6G;IACvG,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAS5F;IAED;;;;;;;;OAQG;IACG,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAM/E;IAED;;;;OAIG;IACG,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOzG;IAED;;;;;;;;;;OAUG;IACG,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAoBjG;IAED;;;OAGG;IACG,iBAAiB,CACrB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC,CAI5E;IAED;;;;OAIG;IACG,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAQpD;IAED;;;;OAIG;IACG,kBAAkB,CACtB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC,CAIrE;IAED;;;;;OAKG;IACG,WAAW,CACf,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GACzB,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAMlC;IAED;;;;;;;OAOG;YACW,KAAK;IASnB;;;;;;;;;;OAUG;YACW,OAAO;IAmBrB;;;;;;OAMG;YACW,aAAa;IAa3B,6EAA6E;IAC7E;;;;;OAKG;IACG,cAAc,CAAC,KAAK,EAAE;QAC1B,MAAM,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,OAAO,CAAA;SAAE,CAAC;QAC7C,QAAQ,EAAE,QAAQ,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,OAAO,CAAC,OAAO,CAAC,CAcnB;YAEa,YAAY;IAgB1B,4EAA4E;YAC9D,WAAW;CAU1B"}

package/dist/vertical-client.js

@@ -1,4 +1,4 @@
-import { attachmentRecord, denialFilterParams, ownerSeat, ownerClaimLink, systemSwitchOutcome, } from '@substrat-run/contracts';
+import { PREVIEW_CLIENT_PATH, attachmentRecord, denialFilterParams, mintedPreviewClient, ownerSeat, ownerClaimLink, previewClientClaim, retiredPreviewClients, peerGrantsEntry, peerSwitchOutcome, systemSwitchOutcome, systemScheduleEntry, } from '@substrat-run/contracts';
 import { CONNECTOR_ATTACHMENT_RECORD_HEADER, PLATFORM_SECRET_HEADER, undrainedEventsOf } from '@substrat-run/kernel';
 import { ControlPlaneError } from './client.js';
 /**
@@ -338,6 +338,173 @@ export class VerticalClient {
         }
         return parsed.data;
     }
+    /**
+     * The read half of the schedule kill switch's status (#1674): every module the
+     * deployment serving this scope holds or has held system authority for, and where each
+     * stands. Mirrors `systemSwitch`'s seam and its skew rule exactly (#1666's "only the
+     * explicit legacy signal reads as redeploy"): a 404 (the route does not exist) or an SPA
+     * shell (a 200 that is not JSON) are the deployment's own proof it predates this read,
+     * and become a 501 that says so. A 200 of the wrong-shaped JSON is NOT that proof — it
+     * is a failure this client cannot explain, so it surfaces as the 502 it is rather than a
+     * guess at "redeploy". The far end's own 501 (the route exists, the method doesn't)
+     * passes through `refusal` verbatim, unchanged either way.
+     */
+    async systemGrantsStatus(input) {
+        const verb = 'system-grants';
+        const predates = () => new ControlPlaneError(501, `the deployment serving scope ${input.scopeId} predates the schedule switch's status read (#1674) — ` +
+            `redeploy the vertical, then retry.`);
+        const base = this.options.baseUrl ?? 'https://vertical.invalid';
+        const res = await this.reach(verb, () => this.options.fetch(`${base}/internal/system-grants?scopeId=${encodeURIComponent(input.scopeId)}`, {
+            method: 'GET',
+            headers: { [PLATFORM_SECRET_HEADER]: this.options.platformSecret },
+        }));
+        if (res.status === 404)
+            throw predates();
+        if (!res.ok)
+            throw await this.refusal(verb, res);
+        const text = await res.text();
+        let raw;
+        try {
+            raw = JSON.parse(text);
+        }
+        catch {
+            throw predates();
+        }
+        const parsed = systemScheduleEntry.array().safeParse(raw);
+        if (!parsed.success) {
+            throw new ControlPlaneError(502, `vertical answered ${verb} with an unexpected shape for scope ${input.scopeId}.`);
+        }
+        return parsed.data;
+    }
+    /**
+     * The read half of the peer kill switch's status (#1706): every peer the deployment
+     * serving this scope holds or has held grants for, and where each stands. Mirrors
+     * `peerSwitch`'s seam and `systemGrantsStatus`'s skew rule exactly — a 404 or an SPA
+     * shell are the deployment's own proof it predates this read and become a 501 that says
+     * to redeploy; a wrong-shaped 200 is not that proof and surfaces as the 502 it is.
+     */
+    async peerGrantsStatus(input) {
+        const verb = 'peer-grants';
+        const predates = () => new ControlPlaneError(501, `the deployment serving scope ${input.scopeId} predates the peer switch's status read (#1706) — ` +
+            `redeploy the vertical, then retry.`);
+        const base = this.options.baseUrl ?? 'https://vertical.invalid';
+        const res = await this.reach(verb, () => this.options.fetch(`${base}/internal/peer-grants?scopeId=${encodeURIComponent(input.scopeId)}`, {
+            method: 'GET',
+            headers: { [PLATFORM_SECRET_HEADER]: this.options.platformSecret },
+        }));
+        if (res.status === 404)
+            throw predates();
+        if (!res.ok)
+            throw await this.refusal(verb, res);
+        const text = await res.text();
+        let raw;
+        try {
+            raw = JSON.parse(text);
+        }
+        catch {
+            throw predates();
+        }
+        const parsed = peerGrantsEntry.array().safeParse(raw);
+        if (!parsed.success) {
+            throw new ControlPlaneError(502, `vertical answered ${verb} with an unexpected shape for scope ${input.scopeId}.`);
+        }
+        return parsed.data;
+    }
+    /**
+     * Move one PEER's kill switch in the deployment serving the scope (#1706) — the far end
+     * of `revokeFromPeer` / `restoreToPeer` for a hosted scope, whose `vertical:<slug>` grants
+     * live there and nowhere the shared control plane can reach.
+     *
+     * The seam, the skew rule and the honesty rule are `systemSwitch`'s, for the same reasons:
+     * a **404** (no such route) or an **SPA shell** (a 200 that is not JSON) are the
+     * deployment's own proof that it predates this route and therefore cannot have switched
+     * anything — the route itself answers a peer the scope holds nothing for with a 200
+     * `held: false`, never a 404. Everything else surfaces as the failure it is, because the
+     * request may have landed and the switch may have moved before the answer was lost.
+     */
+    async peerSwitch(input) {
+        const verb = 'peer-switch';
+        const predates = () => new ControlPlaneError(501, `the deployment serving scope ${input.scopeId} predates the peer kill switch (#1706) — ` +
+            `redeploy the vertical, then retry. Nothing was switched.`);
+        const base = this.options.baseUrl ?? 'https://vertical.invalid';
+        const res = await this.reach(verb, () => this.options.fetch(`${base}/internal/peer-switch`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', [PLATFORM_SECRET_HEADER]: this.options.platformSecret },
+            body: JSON.stringify(input),
+        }));
+        if (res.status === 404)
+            throw predates();
+        if (!res.ok)
+            throw await this.refusal(verb, res);
+        const text = await res.text();
+        let raw;
+        try {
+            raw = JSON.parse(text);
+        }
+        catch {
+            throw predates();
+        }
+        const parsed = peerSwitchOutcome.safeParse(raw);
+        if (!parsed.success) {
+            throw new ControlPlaneError(502, `vertical answered ${verb} with an unexpected shape — the switch for peer '${input.vertical}' on ` +
+                `scope ${input.scopeId} may or may not have moved. Confirm its position before retrying.`);
+        }
+        return parsed.data;
+    }
+    /**
+     * A preview's own client at a team auth-server (#1704, `@substrat-run/contracts`'
+     * `preview-client.ts`): does the parent sign in at THIS issuer, mint the preview a client
+     * here, delete the preview's clients. Addressed to the ISSUER's deployment (this client),
+     * never the preview's.
+     *
+     * The skew rule is `systemSwitch`'s, widened by one status: a deployment built before these
+     * routes answers its `/internal/*` fallback — a JSON **501** on the auth-server — or a
+     * **404**, or an SPA shell (a 200 that is not JSON). All three are the deployment's own
+     * proof it cannot have acted, and become a 501 that says to redeploy the auth server. The
+     * caller must never read that as "the parent does not sign in here". A 200 of the wrong
+     * shape is not that proof and surfaces as a 502; a refusal (403 another tenant's issuer,
+     * 409 a parent it does not claim) passes through verbatim.
+     *
+     * The mint's answer carries a client SECRET. It is returned to the caller and nothing here
+     * keeps, logs or quotes it: no error message on this path includes a response body that
+     * could hold one.
+     */
+    async checkPreviewClient(input) {
+        return this.previewClientCall('POST', `${PREVIEW_CLIENT_PATH}/check`, input, previewClientClaim, 'preview-client check', input.scopeId);
+    }
+    async mintPreviewClient(input) {
+        return this.previewClientCall('POST', PREVIEW_CLIENT_PATH, input, mintedPreviewClient, 'preview-client mint', input.scopeId);
+    }
+    async retirePreviewClients(input) {
+        return this.previewClientCall('DELETE', PREVIEW_CLIENT_PATH, input, retiredPreviewClients, 'preview-client retire', input.scopeId);
+    }
+    async previewClientCall(method, path, body, schema, verb, issuerScopeId) {
+        const predates = () => new ControlPlaneError(501, `the auth server serving scope ${issuerScopeId} predates preview clients (#1704) — redeploy it, ` +
+            `then re-run. Nothing was minted or deleted there.`);
+        const base = this.options.baseUrl ?? 'https://vertical.invalid';
+        const res = await this.reach(verb, () => this.options.fetch(`${base}${path}`, {
+            method,
+            headers: { 'content-type': 'application/json', [PLATFORM_SECRET_HEADER]: this.options.platformSecret },
+            body: JSON.stringify(body),
+        }));
+        if (res.status === 404 || res.status === 501)
+            throw predates();
+        if (!res.ok)
+            throw await this.refusal(verb, res);
+        const text = await res.text();
+        let raw;
+        try {
+            raw = JSON.parse(text);
+        }
+        catch {
+            throw predates();
+        }
+        const parsed = schema.safeParse(raw);
+        if (!parsed.success) {
+            throw new ControlPlaneError(502, `auth server answered ${verb} with an unexpected shape for scope ${issuerScopeId}.`);
+        }
+        return parsed.data;
+    }
     /** Journal a platform-request outcome back in the vertical after the platform ran it. */
     async settlePlatformRequest(tenantId, scopeId, id, outcome) {
         await this.postInternal('/internal/platform-requests/settle', { tenantId, scopeId, id, ...outcome }, 'settle-platform-request');
@@ -587,6 +754,23 @@ export class VerticalClient {
         }
     }
     /** A platform-authenticated POST to the vertical's `/internal/*` surface. */
+    /**
+     * Invoke ONE operation on this deployment as a PEER vertical (#1706) — the far end of an
+     * asynchronous peer call, whose caller the platform took from the scope it drained the
+     * intent from. The door at the other end admits it (declared peer, switch on, operation
+     * allowlisted) and every check inside runs as `{ vertical, scope }`.
+     */
+    async verticalInvoke(input) {
+        const { result } = await this.postInternal('/internal/vertical-invoke', {
+            caller: input.caller,
+            tenantId: input.tenantId,
+            scopeId: input.scopeId,
+            operation: input.operation,
+            ...(input.input === undefined ? {} : { input: input.input }),
+            ...(input.idempotencyKey === undefined ? {} : { idempotencyKey: input.idempotencyKey }),
+        }, 'peer call');
+        return result;
+    }
     async postInternal(path, body, verb) {
         const base = this.options.baseUrl ?? 'https://vertical.invalid';
         const res = await this.reach(verb, () => this.options.fetch(`${base}${path}`, {