@substrat-run/control-plane-api 0.129.0 → 0.130.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/api.d.ts.map +1 -1
- package/dist/api.js +90 -29
- package/dist/api.js.map +1 -1
- package/dist/deploy.js +3 -3
- package/dist/deploy.js.map +1 -1
- package/dist/platform-entry.generated.d.ts +1 -1
- package/dist/platform-entry.generated.d.ts.map +1 -1
- package/dist/platform-entry.generated.js +2 -2
- package/dist/platform-entry.generated.js.map +1 -1
- package/package.json +6 -6
package/dist/deploy.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { ADMISSIBLE_BINDING_TYPES, substratError } from '@substrat-run/contracts';
|
|
1
|
+
import { ADMISSIBLE_BINDING_TYPES, PLATFORM_BINDING_PREFIX, substratError } from '@substrat-run/contracts';
|
|
2
2
|
/**
|
|
3
3
|
* The deploy seam (self-serve-deploy.md). A `substrat push` uploads a *built* worker
|
|
4
4
|
* bundle; this layer forwards it to the platform's runtime (a Workers-for-Platforms
|
|
@@ -99,8 +99,8 @@ export function assertSandboxContract(m) {
|
|
|
99
99
|
// unforgeability `domainEventInput` gives the kernel-stamped envelope fields
|
|
100
100
|
// for free, a binding channel has to be given here. Prefix-refused so the
|
|
101
101
|
// namespace stays the platform's as it grows.
|
|
102
|
-
if (b.name.startsWith(
|
|
103
|
-
refuse(
|
|
102
|
+
if (b.name.startsWith(PLATFORM_BINDING_PREFIX)) {
|
|
103
|
+
refuse(`the '${PLATFORM_BINDING_PREFIX}' binding namespace is the platform's — these names are injected at deploy, never declared`);
|
|
104
104
|
}
|
|
105
105
|
// Allowlist: a type not among the vertical's own admissible resources is refused — with a
|
|
106
106
|
// teachable reason where we have one, the generic one otherwise.
|
package/dist/deploy.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"deploy.js","sourceRoot":"","sources":["../src/deploy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;
|
|
1
|
+
{"version":3,"file":"deploy.js","sourceRoot":"","sources":["../src/deploy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAG3G;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,uFAAuF;AACvF,oFAAoF;AACpF,2CAA2C;AAC3C,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAqFzG;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAE/B,cAAc;IADzB,YACW,cAAsB,EAC/B,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;8BAHN,cAAc;QAIvB,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,6GAA6G;AAC7G,MAAM,UAAU,gBAAgB,CAAC,CAAU;IACzC,OAAO,CAAC,YAAY,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAwBD;;;;GAIG;AACH,MAAM,cAAc,GAA2B;IAC7C,OAAO,EACL,8GAA8G;IAChH,kBAAkB,EAChB,oFAAoF;CACvF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,qBAAqB,CAAC,CAAiB;IACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,wBAAwB,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,yBAAyB,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,CAAC,GAAW,EAAS,EAAE;YACpC,MAAM,aAAa,CAAC,WAAW,EAAE,4BAA4B,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,IAAI,QAAQ,GAAG,KAAK,GAAG,GAAG,CAAC,CAAC;QAC/G,CAAC,CAAC;QACF,uFAAuF;QACvF,yDAAyD;QACzD,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAC/B,MAAM,CAAC,+DAA+D,CAAC,CAAC;QAC1E,CAAC;QACD,2EAA2E;QAC3E,2EAA2E;QAC3E,6EAA6E;QAC7E,6EAA6E;QAC7E,0EAA0E;QAC1E,8CAA8C;QAC9C,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,QAAQ,uBAAuB,4FAA4F,CAAC,CAAC;QACtI,CAAC;QACD,0FAA0F;QAC1F,iEAAiE;QACjE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,CAAC,IAAI,kDAAkD,CAAC,CAAC;QACtG,CAAC;QACD,2FAA2F;QAC3F,yBAAyB;QACzB,IAAI,CAAC,CAAC,IAAI,KAAK,0BAA0B,EAAE,CAAC;YAC1C,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClB,MAAM,CAAC,oCAAoC,CAAC,CAAC,WAAW,kDAAkD,CAAC,CAAC;YAC9G,CAAC;YACD,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC3C,MAAM,CAAC,aAAa,CAAC,CAAC,UAAU,+CAA+C,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC;YACtH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,SAAiB;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACtF,OAAO,GAAG,IAAI,IAAI,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAClF,CAAC;AAED;0FAC0F;AAC1F,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;AAC1C,CAAC"}
|
|
@@ -7,6 +7,6 @@
|
|
|
7
7
|
export declare const PLATFORM_ENTRY_MODULE = "substrat-platform-entry.js";
|
|
8
8
|
/** The import specifier the uploader replaces with `./<the bundle's entry>`. */
|
|
9
9
|
export declare const PLATFORM_ENTRY_PLACEHOLDER = "__SUBSTRAT_VERTICAL_ENTRY__";
|
|
10
|
-
/** The entry itself —
|
|
10
|
+
/** The entry itself — 8673 bytes of ESM. */
|
|
11
11
|
export declare const PLATFORM_ENTRY_SOURCE: string;
|
|
12
12
|
//# sourceMappingURL=platform-entry.generated.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"platform-entry.generated.d.ts","sourceRoot":"","sources":["../src/platform-entry.generated.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,+BAA+B,CAAC;AAElE,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,gCAAgC,CAAC;AAExE,4CAA4C;AAC5C,eAAO,MAAM,qBAAqB,EAAE,
|
|
1
|
+
{"version":3,"file":"platform-entry.generated.d.ts","sourceRoot":"","sources":["../src/platform-entry.generated.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,+BAA+B,CAAC;AAElE,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,gCAAgC,CAAC;AAExE,4CAA4C;AAC5C,eAAO,MAAM,qBAAqB,EAAE,MAAq1R,CAAC"}
|
|
@@ -9,6 +9,6 @@
|
|
|
9
9
|
export const PLATFORM_ENTRY_MODULE = 'substrat-platform-entry.js';
|
|
10
10
|
/** The import specifier the uploader replaces with `./<the bundle's entry>`. */
|
|
11
11
|
export const PLATFORM_ENTRY_PLACEHOLDER = '__SUBSTRAT_VERTICAL_ENTRY__';
|
|
12
|
-
/** The entry itself —
|
|
13
|
-
export const PLATFORM_ENTRY_SOURCE = "// packages/contracts/dist/invocation-record.js\nvar INVOCATION_RECORD_HEADER = \"x-substrat-invocation-record\";\nvar INVOCATION_RECORD_FIELD_MAX = 128;\nvar FIELDS = [\"operation\", \"problemCode\", \"principalKind\"];\nfunction encodeInvocationRecord(record) {\n const params = new URLSearchParams();\n for (const key of FIELDS) {\n const v = record[key];\n if (typeof v === \"string\" && v !== \"\")\n params.set(key, v.slice(0, INVOCATION_RECORD_FIELD_MAX));\n }\n const value = params.toString();\n return value === \"\" ? null : value;\n}\nfunction invocationLevelOf(status, threw, problemCode) {\n if (threw || status === null || status >= 500)\n return \"error\";\n if (status >= 400)\n return \"warn\";\n if (problemCode)\n return \"warn\";\n return \"info\";\n}\n\n// packages/kernel/src/ulid.ts\nvar B32 = \"0123456789ABCDEFGHJKMNPQRSTVWXYZ\";\nvar MAX_ULID_TIME = 2 ** 48 - 1;\nvar ULID_SHAPE = /^[0-9A-HJKMNP-TV-Z]{26}$/;\nvar unencodable = (t) => `not an encodable ULID instant: ${t} (want 0..${MAX_ULID_TIME})`;\nfunction encodeTime(time) {\n let ts = \"\";\n let t = time;\n for (let i = 0; i < 10; i++) {\n ts = B32[t % 32] + ts;\n t = Math.floor(t / 32);\n }\n return ts;\n}\nfunction createUlid() {\n let lastTime = -1;\n const lastRand = new Array(16).fill(0);\n function freshRandom() {\n const bytes = crypto.getRandomValues(new Uint8Array(16));\n for (let i = 0; i < 16; i++) lastRand[i] = bytes[i] % 32;\n }\n function incrementRandom() {\n for (let i = 15; i >= 0; i--) {\n if (lastRand[i] < 31) {\n lastRand[i]++;\n return true;\n }\n lastRand[i] = 0;\n }\n return false;\n }\n const mint = ((now = Date.now()) => {\n if (!Number.isSafeInteger(now)) throw new RangeError(unencodable(now));\n let time = now;\n if (time <= lastTime) {\n time = lastTime;\n if (!incrementRandom()) {\n time = lastTime + 1;\n freshRandom();\n }\n } else {\n freshRandom();\n }\n if (time < 0 || time > MAX_ULID_TIME) throw new RangeError(unencodable(time));\n lastTime = time;\n let r = \"\";\n for (const d of lastRand) r += B32[d];\n return encodeTime(time) + r;\n });\n mint.seedFrom = (id) => {\n const time = ulidTime(id);\n if (time < lastTime) return;\n const rand = [];\n for (const ch of id.slice(10)) rand.push(B32.indexOf(ch));\n if (time === lastTime) {\n let ahead = false;\n for (let i = 0; i < 16; i++) {\n if (rand[i] !== lastRand[i]) {\n ahead = rand[i] > lastRand[i];\n break;\n }\n }\n if (!ahead) return;\n }\n lastTime = time;\n for (let i = 0; i < 16; i++) lastRand[i] = rand[i];\n };\n return mint;\n}\nvar processUlid = createUlid();\nfunction ulid(now = Date.now()) {\n return processUlid(now);\n}\nfunction ulidTime(id) {\n if (!ULID_SHAPE.test(id)) throw new Error(`not a ULID: ${id}`);\n let t = 0;\n for (const ch of id.slice(0, 10)) t = t * 32 + B32.indexOf(ch);\n if (t > MAX_ULID_TIME) throw new Error(`not a ULID: ${id}`);\n return t;\n}\n\n// packages/kernel/src/platform-call.ts\nfunction secretMatches(presented, expected) {\n if (!presented || presented.length !== expected.length) return false;\n let diff = 0;\n for (let i = 0; i < expected.length; i++) {\n diff |= presented.charCodeAt(i) ^ expected.charCodeAt(i);\n }\n return diff === 0;\n}\n\n// packages/kernel/src/routed-node.ts\nvar ROUTED_ID = /^[0-9A-HJKMNP-TV-Z]{26}$/;\nvar RouterAssertionError = class extends Error {\n};\nfunction readRoutedNode(headers, options = {}) {\n const rawTenant = headers.get(\"x-substrat-tenant\");\n const rawScope = headers.get(\"x-substrat-scope\");\n if (!rawTenant && !rawScope) return null;\n const { expectedSecret, allowUnsigned = false } = options;\n if (expectedSecret) {\n if (!secretMatches(headers.get(\"x-substrat-router\"), expectedSecret)) {\n throw new RouterAssertionError(\"router assertion is not signed by a known router\");\n }\n } else if (!allowUnsigned) {\n throw new RouterAssertionError(\n \"router assertion cannot be verified: this worker has no ROUTER_SECRET configured\"\n );\n }\n if (!rawTenant || !rawScope) {\n throw new RouterAssertionError(\"router assertion is incomplete\");\n }\n if (!ROUTED_ID.test(rawTenant) || !ROUTED_ID.test(rawScope)) {\n throw new RouterAssertionError(\"router assertion carries a malformed id\");\n }\n return {\n tenantId: rawTenant,\n scopeId: rawScope,\n surface: headers.get(\"x-substrat-surface\") ?? \"app\",\n verticalSlug: headers.get(\"x-substrat-vertical\")\n };\n}\n\n// packages/kernel/src/invocation-log.ts\nfunction distinct(values) {\n return [...new Set(values)];\n}\nfunction versionIdOf(env) {\n const v = env?.SUBSTRAT_VERSION_ID;\n return typeof v === \"string\" && v.length > 0 ? v : null;\n}\nfunction pathOf(url) {\n try {\n return new URL(url).pathname;\n } catch {\n return \"/\";\n }\n}\nvar STAMPS = /* @__PURE__ */ Symbol.for(\"substrat.invocation-stamp\");\nfunction stamps() {\n const g = globalThis;\n return g[STAMPS] ??= /* @__PURE__ */ new WeakMap();\n}\nfunction invocationStampOf(request) {\n return stamps().get(request);\n}\nfunction beginStamp(request) {\n const stamp = { invocationId: ulid(), record: {} };\n stamps().set(request, stamp);\n return stamp;\n}\nfunction writeInvocationLine(stamp, done, options) {\n try {\n writeLineOrThrow(stamp, done, options);\n } catch (e) {\n try {\n console.log(JSON.stringify({ substrat: \"invocation-log-fault\", detail: String(e) }));\n } catch {\n }\n }\n}\nfunction writeLineOrThrow(stamp, done, options) {\n const node = routedNodeOrNull(done.request.headers, done.env, options);\n if (!node) return;\n const { record, invocationId } = stamp;\n const emitted = record.emitted;\n const line = {\n substrat: \"invocation\",\n tenantId: node.tenantId,\n scopeId: node.scopeId,\n vertical: node.verticalSlug,\n surface: node.surface,\n method: done.request.method,\n path: pathOf(done.request.url),\n status: done.status,\n threw: done.threw,\n durationMs: Date.now() - done.started,\n invocationId,\n level: invocationLevelOf(done.status, done.threw, record.problemCode),\n operation: record.operation ?? null,\n problemCode: record.problemCode ?? null,\n principalKind: record.principalKind ?? null,\n eventCount: emitted ? emitted.total : null,\n eventTypes: emitted ? distinct(emitted.events.map((e) => e.type)) : [],\n entities: emitted ? distinct(emitted.events.map((e) => e.entity)) : [],\n versionId: versionIdOf(done.env)\n };\n console.log(JSON.stringify(line));\n}\nvar OTHER_HANDLERS = [\"scheduled\", \"queue\", \"email\", \"tail\", \"trace\", \"alarm\", \"test\"];\nfunction withInvocationLog(worker, options = {}) {\n const inner = worker?.fetch;\n if (typeof inner !== \"function\") return worker;\n const wrapped = {\n async fetch(request, env, ctx) {\n if (invocationStampOf(request)) return inner.call(worker, request, env, ctx);\n const started = Date.now();\n const stamp = beginStamp(request);\n let status = null;\n let threw = false;\n try {\n const response = await inner.call(worker, request, env, ctx);\n status = response.status;\n handRecordToRouter(response, stamp.record, request, env, options);\n return response;\n } catch (e) {\n threw = true;\n throw e;\n } finally {\n writeInvocationLine(stamp, { request, env, status, threw, started }, options);\n }\n }\n };\n for (const name of OTHER_HANDLERS) {\n const h = worker[name];\n if (typeof h === \"function\") wrapped[name] = h.bind(worker);\n }\n return wrapped;\n}\nfunction handRecordToRouter(response, record, request, env, options) {\n try {\n const value = encodeInvocationRecord(record);\n if (value === null || !routedNodeOrNull(request.headers, env, options)) return;\n response.headers?.set?.(\n INVOCATION_RECORD_HEADER,\n value\n );\n } catch {\n }\n}\nfunction routedNodeOrNull(headers, env, options) {\n try {\n return readRoutedNode(headers, {\n expectedSecret: options.routerSecret?.(env),\n allowUnsigned: options.allowUnsigned?.(env) ?? false\n });\n } catch (e) {\n if (!(e instanceof RouterAssertionError)) console.log(JSON.stringify({ substrat: \"invocation-log-fault\", detail: String(e) }));\n return null;\n }\n}\n\n// substrat-platform-entry.ts\nimport * as vertical from \"__SUBSTRAT_VERTICAL_ENTRY__\";\nexport * from \"__SUBSTRAT_VERTICAL_ENTRY__\";\nvar substrat_platform_entry_default = withInvocationLog(vertical.default, {\n routerSecret: (env) => env.ROUTER_SECRET,\n allowUnsigned: (env) => env.ALLOW_DEV_NODE === \"true\"\n});\nexport {\n substrat_platform_entry_default as default\n};\n";
|
|
12
|
+
/** The entry itself — 8673 bytes of ESM. */
|
|
13
|
+
export const PLATFORM_ENTRY_SOURCE = "// packages/contracts/dist/invocation-record.js\nvar INVOCATION_RECORD_HEADER = \"x-substrat-invocation-record\";\nvar INVOCATION_RECORD_FIELD_MAX = 128;\nvar FIELDS = [\"operation\", \"problemCode\", \"principalKind\"];\nfunction encodeInvocationRecord(record) {\n const params = new URLSearchParams();\n for (const key of FIELDS) {\n const v = record[key];\n if (typeof v === \"string\" && v !== \"\")\n params.set(key, v.slice(0, INVOCATION_RECORD_FIELD_MAX));\n }\n const value = params.toString();\n return value === \"\" ? null : value;\n}\nfunction invocationLevelOf(status, threw, problemCode) {\n if (threw || status === null || status >= 500)\n return \"error\";\n if (status >= 400)\n return \"warn\";\n if (problemCode)\n return \"warn\";\n return \"info\";\n}\n\n// packages/kernel/src/ulid.ts\nvar B32 = \"0123456789ABCDEFGHJKMNPQRSTVWXYZ\";\nvar MAX_ULID_TIME = 2 ** 48 - 1;\nvar ULID_SHAPE = /^[0-9A-HJKMNP-TV-Z]{26}$/;\nvar unencodable = (t) => `not an encodable ULID instant: ${t} (want 0..${MAX_ULID_TIME})`;\nfunction encodeTime(time) {\n let ts = \"\";\n let t = time;\n for (let i = 0; i < 10; i++) {\n ts = B32[t % 32] + ts;\n t = Math.floor(t / 32);\n }\n return ts;\n}\nfunction createUlid() {\n let lastTime = -1;\n const lastRand = new Array(16).fill(0);\n function freshRandom() {\n const bytes = crypto.getRandomValues(new Uint8Array(16));\n for (let i = 0; i < 16; i++) lastRand[i] = bytes[i] % 32;\n }\n function incrementRandom() {\n for (let i = 15; i >= 0; i--) {\n if (lastRand[i] < 31) {\n lastRand[i]++;\n return true;\n }\n lastRand[i] = 0;\n }\n return false;\n }\n const mint = ((now = Date.now()) => {\n if (!Number.isSafeInteger(now)) throw new RangeError(unencodable(now));\n let time = now;\n if (time <= lastTime) {\n time = lastTime;\n if (!incrementRandom()) {\n time = lastTime + 1;\n freshRandom();\n }\n } else {\n freshRandom();\n }\n if (time < 0 || time > MAX_ULID_TIME) throw new RangeError(unencodable(time));\n lastTime = time;\n let r = \"\";\n for (const d of lastRand) r += B32[d];\n return encodeTime(time) + r;\n });\n mint.seedFrom = (id) => {\n const time = ulidTime(id);\n if (time < lastTime) return;\n const rand = [];\n for (const ch of id.slice(10)) rand.push(B32.indexOf(ch));\n if (time === lastTime) {\n let ahead = false;\n for (let i = 0; i < 16; i++) {\n if (rand[i] !== lastRand[i]) {\n ahead = rand[i] > lastRand[i];\n break;\n }\n }\n if (!ahead) return;\n }\n lastTime = time;\n for (let i = 0; i < 16; i++) lastRand[i] = rand[i];\n };\n return mint;\n}\nvar processUlid = createUlid();\nfunction ulid(now = Date.now()) {\n return processUlid(now);\n}\nfunction ulidTime(id) {\n if (!ULID_SHAPE.test(id)) throw new Error(`not a ULID: ${id}`);\n let t = 0;\n for (const ch of id.slice(0, 10)) t = t * 32 + B32.indexOf(ch);\n if (t > MAX_ULID_TIME) throw new Error(`not a ULID: ${id}`);\n return t;\n}\n\n// packages/kernel/src/platform-call.ts\nfunction secretMatches(presented, expected) {\n if (!presented || presented.length !== expected.length) return false;\n let diff = 0;\n for (let i = 0; i < expected.length; i++) {\n diff |= presented.charCodeAt(i) ^ expected.charCodeAt(i);\n }\n return diff === 0;\n}\n\n// packages/kernel/src/routed-node.ts\nvar ROUTED_ID = /^[0-9A-HJKMNP-TV-Z]{26}$/;\nvar RouterAssertionError = class extends Error {\n};\nfunction readRoutedNode(headers, options = {}) {\n const rawTenant = headers.get(\"x-substrat-tenant\");\n const rawScope = headers.get(\"x-substrat-scope\");\n if (!rawTenant && !rawScope) return null;\n const { expectedSecret, allowUnsigned = false } = options;\n if (expectedSecret) {\n if (!secretMatches(headers.get(\"x-substrat-router\"), expectedSecret)) {\n throw new RouterAssertionError(\"router assertion is not signed by a known router\");\n }\n } else if (!allowUnsigned) {\n throw new RouterAssertionError(\n \"router assertion cannot be verified: this worker has no ROUTER_SECRET configured\"\n );\n }\n if (!rawTenant || !rawScope) {\n throw new RouterAssertionError(\"router assertion is incomplete\");\n }\n if (!ROUTED_ID.test(rawTenant) || !ROUTED_ID.test(rawScope)) {\n throw new RouterAssertionError(\"router assertion carries a malformed id\");\n }\n return {\n tenantId: rawTenant,\n scopeId: rawScope,\n surface: headers.get(\"x-substrat-surface\") ?? \"app\",\n verticalSlug: headers.get(\"x-substrat-vertical\")\n };\n}\n\n// packages/kernel/src/invocation-log.ts\nfunction distinct(values) {\n return [...new Set(values)];\n}\nfunction versionIdOf(env) {\n const v = env?.SUBSTRAT_VERSION_ID;\n return typeof v === \"string\" && v.length > 0 ? v : null;\n}\nfunction pathOf(url) {\n try {\n return new URL(url).pathname;\n } catch {\n return \"/\";\n }\n}\nvar STAMPS = /* @__PURE__ */ Symbol.for(\"substrat.invocation-stamp\");\nfunction stamps() {\n const g = globalThis;\n return g[STAMPS] ??= /* @__PURE__ */ new WeakMap();\n}\nfunction invocationStampOf(request) {\n return stamps().get(request);\n}\nfunction beginStamp(request) {\n const stamp = { invocationId: ulid(), record: {} };\n stamps().set(request, stamp);\n return stamp;\n}\nfunction writeInvocationLine(stamp, done, options) {\n try {\n writeLineOrThrow(stamp, done, options);\n } catch (e) {\n try {\n console.log(JSON.stringify({ substrat: \"invocation-log-fault\", detail: String(e) }));\n } catch {\n }\n }\n}\nfunction writeLineOrThrow(stamp, done, options) {\n const node = routedNodeOrNull(done.request.headers, done.env, options);\n if (!node) return;\n const { record, invocationId } = stamp;\n const emitted = record.emitted;\n const line = {\n substrat: \"invocation\",\n tenantId: node.tenantId,\n scopeId: node.scopeId,\n vertical: node.verticalSlug,\n surface: node.surface,\n method: done.request.method,\n path: pathOf(done.request.url),\n status: done.status,\n threw: done.threw,\n durationMs: Date.now() - done.started,\n invocationId,\n level: invocationLevelOf(done.status, done.threw, record.problemCode),\n operation: record.operation ?? null,\n problemCode: record.problemCode ?? null,\n principalKind: record.principalKind ?? null,\n eventCount: emitted ? emitted.total : null,\n eventTypes: emitted ? distinct(emitted.events.map((e) => e.type)) : [],\n entities: emitted ? distinct(emitted.events.map((e) => e.entity)) : [],\n versionId: versionIdOf(done.env),\n ...record.outputFields ? { outputFields: record.outputFields } : {}\n };\n console.log(JSON.stringify(line));\n}\nvar OTHER_HANDLERS = [\"scheduled\", \"queue\", \"email\", \"tail\", \"trace\", \"alarm\", \"test\"];\nfunction withInvocationLog(worker, options = {}) {\n const inner = worker?.fetch;\n if (typeof inner !== \"function\") return worker;\n const wrapped = {\n async fetch(request, env, ctx) {\n if (invocationStampOf(request)) return inner.call(worker, request, env, ctx);\n const started = Date.now();\n const stamp = beginStamp(request);\n let status = null;\n let threw = false;\n try {\n const response = await inner.call(worker, request, env, ctx);\n status = response.status;\n handRecordToRouter(response, stamp.record, request, env, options);\n return response;\n } catch (e) {\n threw = true;\n throw e;\n } finally {\n writeInvocationLine(stamp, { request, env, status, threw, started }, options);\n }\n }\n };\n for (const name of OTHER_HANDLERS) {\n const h = worker[name];\n if (typeof h === \"function\") wrapped[name] = h.bind(worker);\n }\n return wrapped;\n}\nfunction handRecordToRouter(response, record, request, env, options) {\n try {\n const value = encodeInvocationRecord(record);\n if (value === null || !routedNodeOrNull(request.headers, env, options)) return;\n response.headers?.set?.(\n INVOCATION_RECORD_HEADER,\n value\n );\n } catch {\n }\n}\nfunction routedNodeOrNull(headers, env, options) {\n try {\n return readRoutedNode(headers, {\n expectedSecret: options.routerSecret?.(env),\n allowUnsigned: options.allowUnsigned?.(env) ?? false\n });\n } catch (e) {\n if (!(e instanceof RouterAssertionError)) console.log(JSON.stringify({ substrat: \"invocation-log-fault\", detail: String(e) }));\n return null;\n }\n}\n\n// substrat-platform-entry.ts\nimport * as vertical from \"__SUBSTRAT_VERTICAL_ENTRY__\";\nexport * from \"__SUBSTRAT_VERTICAL_ENTRY__\";\nvar substrat_platform_entry_default = withInvocationLog(vertical.default, {\n routerSecret: (env) => env.ROUTER_SECRET,\n allowUnsigned: (env) => env.ALLOW_DEV_NODE === \"true\"\n});\nexport {\n substrat_platform_entry_default as default\n};\n";
|
|
14
14
|
//# sourceMappingURL=platform-entry.generated.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"platform-entry.generated.js","sourceRoot":"","sources":["../src/platform-entry.generated.ts"],"names":[],"mappings":"AAAA,+GAA+G;AAC/G,sEAAsE;AAEtE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,4BAA4B,CAAC;AAElE,gFAAgF;AAChF,MAAM,CAAC,MAAM,0BAA0B,GAAG,6BAA6B,CAAC;AAExE,4CAA4C;AAC5C,MAAM,CAAC,MAAM,qBAAqB,GAAW,
|
|
1
|
+
{"version":3,"file":"platform-entry.generated.js","sourceRoot":"","sources":["../src/platform-entry.generated.ts"],"names":[],"mappings":"AAAA,+GAA+G;AAC/G,sEAAsE;AAEtE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,4BAA4B,CAAC;AAElE,gFAAgF;AAChF,MAAM,CAAC,MAAM,0BAA0B,GAAG,6BAA6B,CAAC;AAExE,4CAA4C;AAC5C,MAAM,CAAC,MAAM,qBAAqB,GAAW,40RAA40R,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@substrat-run/control-plane-api",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.130.1",
|
|
4
4
|
"description": "HTTP surface over HostAdmin — the audited control-plane transport (control-plane.md §4.5)",
|
|
5
5
|
"license": "AGPL-3.0-only",
|
|
6
6
|
"repository": {
|
|
@@ -23,9 +23,9 @@
|
|
|
23
23
|
],
|
|
24
24
|
"dependencies": {
|
|
25
25
|
"hono": "^4.13.9",
|
|
26
|
-
"@substrat-run/contracts": "^0.
|
|
27
|
-
"@substrat-run/
|
|
28
|
-
"@substrat-run/
|
|
26
|
+
"@substrat-run/contracts": "^0.130.1",
|
|
27
|
+
"@substrat-run/psl": "^0.2.5",
|
|
28
|
+
"@substrat-run/kernel": "^0.130.1"
|
|
29
29
|
},
|
|
30
30
|
"devDependencies": {
|
|
31
31
|
"@hono/node-server": "^1.13.0",
|
|
@@ -36,8 +36,8 @@
|
|
|
36
36
|
"tsx": "^4.19.0",
|
|
37
37
|
"typescript": "^7.0.0",
|
|
38
38
|
"vitest": "^3.2.7",
|
|
39
|
-
"@substrat-run/adapter-sqlite": "^0.
|
|
40
|
-
"@substrat-run/vertical-host": "^0.
|
|
39
|
+
"@substrat-run/adapter-sqlite": "^0.130.1",
|
|
40
|
+
"@substrat-run/vertical-host": "^0.130.1"
|
|
41
41
|
},
|
|
42
42
|
"publishConfig": {
|
|
43
43
|
"access": "public"
|