@substrat-run/control-plane-api 0.133.0 → 0.134.0

package/dist/staff-client.js

@@ -0,0 +1,299 @@
+import { denialQuery } from '@substrat-run/contracts';
+import { ControlPlaneTransport } from './transport.js';
+/** Repeatable params (status, action) are appended once per value — the API reads them
+ *  with `c.req.queries()`. `undefined` is dropped. */
+function query(params) {
+    const q = new URLSearchParams();
+    for (const [k, v] of Object.entries(params)) {
+        if (v === undefined)
+            continue;
+        if (Array.isArray(v))
+            for (const one of v)
+                q.append(k, one);
+        else
+            q.append(k, String(v));
+    }
+    const s = q.toString();
+    return s ? `?${s}` : '';
+}
+const seg = encodeURIComponent;
+export class ControlPlaneStaffClient extends ControlPlaneTransport {
+    json(method, path, body) {
+        return this.call(path, {
+            method,
+            body: body === undefined ? undefined : JSON.stringify(body),
+        });
+    }
+    post = (path, body) => this.json('POST', path, body);
+    // -- tenants ---------------------------------------------------------------
+    listTenants = (page = {}) => this.call(`/tenants${query({ ...page })}`);
+    getTenant = (id) => this.call(`/tenants/${id}`);
+    createTenant = (input) => this.post('/tenants', input);
+    setTenantStatus = (id, status) => this.json('PATCH', `/tenants/${id}/status`, { status });
+    // Reap a deleting tenant NOW (§4.8) — skips the grace window: every scope reaped,
+    // PII/config directory rows cleared, the tenant row kept as a `reaped` tombstone.
+    reapTenant = (id) => this.post(`/tenants/${id}/reap`);
+    // The per-tenant store ledgers as inventory (#301 D1, #473 R2): which database and
+    // which bucket hold this tenant's bytes. Read-only — stores are minted by
+    // provisioning, never from here.
+    tenantStores = (id) => this.call(`/tenants/${id}/stores`);
+    listEntitlements = (id) => this.call(`/tenants/${id}/entitlements`);
+    // The key rides in the PATH, so it is encoded (#691). `entitlementGrant` accepts any
+    // non-empty string — looser than the manifest's `/^[a-z0-9-]+$/` — precisely so a
+    // legacy grant like `t-0wv2mwk4j5/crm-eff` round-trips. Unencoded, its slash forked the
+    // route and the console could neither grant nor REVOKE the very rows that needed
+    // cleaning up, which is what forced the hand-curl.
+    grantEntitlement = (id, key, plan) => this.json('PUT', `/tenants/${id}/entitlements/${seg(key)}`, plan);
+    revokeEntitlement = (id, key) => this.json('DELETE', `/tenants/${id}/entitlements/${seg(key)}`);
+    // -- platform --------------------------------------------------------------
+    // Where the platform's compute and stores live — the account + dispatch namespace the
+    // refs this console renders resolve in, so a scope's script or a tenant's database can
+    // be a LINK into the Cloudflare dashboard rather than an id to search for. Answers
+    // null on a control plane with no runtime configured (self-host): the views then show
+    // the same identifiers, unlinked.
+    platformRuntime = () => this.call('/platform/runtime');
+    // The Durable Object namespaces one script defines, scope-class first — the ids the
+    // dashboard addresses a namespace by. 501s when the control plane has no lookup
+    // configured, which callers treat as "link to the list instead".
+    doNamespaces = (script) => this.call(`/platform/do-namespaces${query({ script })}`);
+    // §5's meters 1 and 2 (#38) — tenants + effective-active scopes, and the entitlement
+    // store grouped by SKU and tier. Computed platform-side because the billable rule
+    // (a scope is billable only if its tenant is active; expiry decided at `readAt`)
+    // belongs to one definition, not to whichever surface renders it. Omit `tenantId`
+    // for the fleet reading.
+    readMeters = (tenantId) => this.call(`/meters${query({ tenantId })}`);
+    // Storage (#1524): one PAGE of a tenant's scope-database sizes, read on demand. Each
+    // scope read wakes its Durable Object, so the card calls this only when a person asks,
+    // and walks further pages with `cursor` one press at a time.
+    readStorage = (tenantId, cursor) => this.call(`/meters/storage${query({ tenantId, cursor })}`);
+    // Meter 3 (#1054) — model usage, the one D-30 could not compute: the lines the
+    // `model-usage` intents drained into the directory, folded per (tenant, vertical,
+    // model) with the platform's margin applied at read time. Defaults to the current
+    // calendar month so far; omit `tenantId` for the fleet.
+    readModelUsage = (q = {}) => this.call(`/model-usage/summary${query({ ...q })}`);
+    // -- scopes ----------------------------------------------------------------
+    listScopes = (filter) => this.call(`/scopes${query({ ...filter })}`);
+    // Fleet migration progress (kernel-design §5.3, #49): "release N: X/Y
+    // migrated, P pending, F failed" against the deployment's frontier.
+    migrationProgress = (vertical) => this.call(`/fleet/migrations${query({ vertical })}`);
+    getScope = (tenantId, scopeId) => this.call(`/tenants/${tenantId}/scopes/${scopeId}`);
+    // Scope health (#321): an ACTIVE scope with a resolvable serving script but an empty
+    // role projection serves traffic every check denies — surfaced as a platform condition
+    // here instead of only as a per-app 403. `missingStores` (#825) is the same kind of
+    // condition one layer down: a per-tenant store the vertical declares that this tenant
+    // was never minted, invisible until the code touches it.
+    scopeHealth = (tenantId, scopeId) => this.call(`/tenants/${tenantId}/scopes/${scopeId}/health`);
+    // The K-35 denial log (#867) — the scope's own record of every ENFORCED permission
+    // refusal. Summary first: the raw log's volume is attacker-influenceable (a probing
+    // client mints rows), so bucketing is what keeps a quiet actor visible next to a loud
+    // one. The rows are the drill-down behind a bucket.
+    denialSummary = (t, s, filter) => this.call(`/tenants/${t}/scopes/${s}/denials/summary${denialQuery(filter)}`);
+    listDenials = (t, s, filter) => this.call(`/tenants/${t}/scopes/${s}/denials${denialQuery(filter)}`);
+    // The #1666 schedule kill switch, read and moved from the console (#1674/#1675). No
+    // new permission surface here — the route is already staff-only server-side
+    // (`confinedTenant`), and the console is a staff session. `moduleId` is the module's
+    // manifest id (e.g. '@substrat-run/engine-absence'), always read off a status entry
+    // rather than typed by hand. A deployment predating the route answers 501, which
+    // `ControlPlaneError` relays verbatim (never a wrong `on`).
+    systemGrantsStatus = (t, s) => this.call(`/tenants/${t}/scopes/${s}/system-grants`);
+    // DELETE on the switch route (#1676) — `reason` is required server-side
+    // (`z.string().trim().min(1).max(500)`) and lands on the admin log beside the actor.
+    switchScheduleOff = (t, s, moduleId, reason) => this.json('DELETE', `/tenants/${t}/scopes/${s}/system-grants`, {
+        moduleId,
+        reason,
+    });
+    // POST on the same route — the only way back on; restores exactly what the DELETE took.
+    switchScheduleOn = (t, s, moduleId, reason) => this.post(`/tenants/${t}/scopes/${s}/system-grants`, { moduleId, reason });
+    // The #1706 peer kill switch, read and moved from the console. The route admits a
+    // tenant's own credential as well as staff (unlike the schedule switch above), because
+    // it answers a question about the tenant's own two apps; the console is a staff session
+    // either way. `vertical` is the CALLING vertical's registry slug, always read off a
+    // status entry rather than typed by hand. A deployment predating the route answers 501,
+    // which `ControlPlaneError` relays verbatim (never a wrong `on`).
+    peerGrantsStatus = (t, s) => this.call(`/tenants/${t}/scopes/${s}/peer-grants`);
+    // DELETE on the switch route — `reason` is required server-side and lands on the admin
+    // log beside the actor, exactly as the schedule switch's does.
+    switchPeerOff = (t, s, vertical, reason) => this.json('DELETE', `/tenants/${t}/scopes/${s}/peer-grants`, {
+        vertical,
+        reason,
+    });
+    // POST on the same route — the only way back on; restores exactly what the DELETE took.
+    switchPeerOn = (t, s, vertical, reason) => this.post(`/tenants/${t}/scopes/${s}/peer-grants`, { vertical, reason });
+    // #1705 PR 3: where each cross-vertical edge of a tenant stands, read live through the
+    // sweep's own reach, and the replay lever on a consumer scope. The lever's body carries its
+    // acknowledgement literal. Without it the plane refuses in the words it stands for.
+    // `focus` narrows the read to one scope's edges, into it and out of it.
+    crossVerticalEdges = (t, focus) => this.call(`/tenants/${t}/cross-vertical/edges${focus ? `?scopeId=${seg(focus)}` : ''}`);
+    moveImportCursor = (t, s, move) => this.post(`/tenants/${t}/scopes/${s}/import-cursor`, move);
+    provisionScope = (input) => this.post('/scopes', input);
+    // One method per audited transition, mirroring the API and HostAdmin. The
+    // console renders only legal transitions; the graph is enforced below.
+    // provisioning → active: the vertical has confirmed the scope exists (K-31).
+    activateScope = (t, s) => this.post(`/tenants/${t}/scopes/${s}/activate`);
+    suspendScope = (t, s) => this.post(`/tenants/${t}/scopes/${s}/suspend`);
+    unsuspendScope = (t, s) => this.post(`/tenants/${t}/scopes/${s}/unsuspend`);
+    /**
+     * Re-run the vertical's provision for a scope that already has one — NOT a status
+     * transition, which is why it sits outside the ladder above and outside
+     * `availableActions`. Nothing about the scope's state changes; what happens is that
+     * everything provisioning delivers is delivered again: entitlements, identity links,
+     * connection grants, and the vertical's OWN `onProvision` hook.
+     *
+     * Idempotent at the far end (K-31), so it is safe to press twice. It is the lever
+     * for two shapes of stuck install: the #332 lockout (roles projected, zero tuples,
+     * every login denied), and an install that predates something its vertical now mints
+     * for itself at provision — a new service principal, say — which no other path can
+     * ever deliver, because provision runs at install and never again.
+     */
+    reprovisionScope = (t, s) => this.post(`/tenants/${t}/scopes/${s}/provision`);
+    archiveScope = (t, s) => this.post(`/tenants/${t}/scopes/${s}/archive`);
+    unarchiveScope = (t, s) => this.post(`/tenants/${t}/scopes/${s}/unarchive`);
+    // archived → reaped (§4.4): irreversibly wipe the scope's DO storage, keeping the
+    // directory row as a tombstone. Staff-only server-side; the console arms it behind a
+    // type-to-confirm dialog because, unlike archive, there is no restore.
+    //
+    // `backup: true` is sent ALWAYS, never omitted (#493): the control plane treats an
+    // explicit ask as "back up or refuse", so a console reap can never quietly wipe a
+    // scope because the backup bucket went unbound. The returned `backup` names the copy
+    // that landed — the operator's proof it exists, and the address to restore from.
+    reapScope = (t, s, opts = { backup: true }) => this.post(`/tenants/${t}/scopes/${s}/reap`, opts);
+    // Move ONE scope onto a DIFFERENT vertical lineage's serving script (#389) — the
+    // update-rebind behind retiring a lineage in favour of another. Data-first with the
+    // source script kept as the backout. `ackMigrations` is the digest gate's override:
+    // the control plane refuses the crossing when the two lineages' migration digests
+    // differ unless the operator acknowledges having read both surfaces. `abandonData`
+    // is deliberately NOT exposed — it exists for pre-#236 relic scripts only, and a
+    // console that offers it invites moving an install while leaving its data behind.
+    rebindScopeVertical = (t, s, vertical, opts = {}) => this.post(`/tenants/${t}/scopes/${s}/rebind-vertical`, { vertical, ...opts });
+    /** The copies held for a scope, newest first — readable after the reap (the tombstone survives). */
+    listScopeBackups = (t, s) => this.call(`/tenants/${t}/scopes/${s}/backups`);
+    /** Take a copy without reaping — a pre-migration checkpoint, or an export to keep. */
+    backupScope = (t, s) => this.post(`/tenants/${t}/scopes/${s}/backups`);
+    // The PLATFORM's own copies (#40) — the directory, not a tenant's scope. Read and
+    // take-now only: `POST /directory/restore` is deliberately NOT on this client. A
+    // one-click replace-the-whole-directory control is well past what a type-to-confirm
+    // dialog can guard (its blast radius is every tenant at once), and the scenario it
+    // exists for is one where the directory is GONE — a recovery path that assumes a
+    // healthy console is a recovery path that is not there when it is needed. Restore is
+    // a deliberate API call from the runbook (control-plane.md §4.9).
+    //
+    // A 501 here is meaningful, not an error to swallow: it means no backup store is
+    // bound, i.e. this control plane keeps NO platform copy. The view renders that as
+    // the alarm it is.
+    listDirectoryBackups = () => this.call('/directory/backups');
+    backupDirectory = () => this.post('/directory/backups');
+    // Hard-delete a SNAPSHOT fork (forkedFrom set): wipes its storage, hostnames, and the
+    // row (unlike reap, which keeps a tombstone). Refused (409) on a non-fork primary scope.
+    deleteScope = (t, s) => this.json('DELETE', `/tenants/${t}/scopes/${s}`);
+    // Read only — there is no route that writes a role, by design.
+    // Cursor is the composite `${tenantId}|${roleKey}` sort key (scope-host.ts listRoles).
+    listRoles = (filter) => this.call(`/roles${query({ ...filter })}`);
+    // The hostname map (§4.7). `resolveHostname` is absent on purpose — that is the
+    // router's per-request path, not a staff action, and it is not on this surface.
+    listHostnames = (filter) => this.call(`/hostnames${query({ ...filter })}`);
+    bindHostname = (input) => this.post('/hostnames', input);
+    setHostnameStatus = (hostname, status, note) => this.json('PATCH', `/hostnames/${seg(hostname)}/status`, { status, note });
+    // Release a bound name — what a retire pass runs before reaping a scope, so the
+    // reap's bound-hostname guard is satisfied and the router stops resolving it.
+    unbindHostname = (hostname) => this.json('DELETE', `/hostnames/${seg(hostname)}`);
+    /**
+     * Create one instance of a vertical (K-31). The control plane calls the
+     * vertical, because only it can create a usable scope DO.
+     *
+     * Call this BEFORE `provisionScope`: the directory row should only exist once
+     * the vertical is ready, so a failure leaves an invisible orphan rather than a
+     * directory row promising a scope that is not there.
+     */
+    provisionInstance = (verticalSlug, input) => this.post(`/verticals/${seg(verticalSlug)}/instances`, input);
+    // -- logs and fleet reads --------------------------------------------------
+    adminLog = (q = {}) => this.call(`/admin-log${query({ ...q })}`);
+    // Operational failures (#559) — what the platform could NOT do, durable and
+    // queryable, distinct from the admin log's successful mutations. Newest first
+    // by default; `reference` finds the row a `reference = <id>` CI error names.
+    listOpsFailures = (q = {}) => this.call(`/ops-failures${query({ ...q })}`);
+    // The fleet's sweep record (#1232) — connections polled, schedules fired or
+    // skipped, freshness verdicts. Newest first; 14-day retention.
+    listSweepRuns = (q = {}) => this.call(`/sweep-runs${query({ ...q })}`);
+    // The schedule kill-switch fleet read (#1674) — every (tenant, scope, module) the
+    // directory records a switch position for. `position` defaults to `off` server-side:
+    // "what is switched off across the fleet" is the question this read exists to answer.
+    listSystemSwitches = (q = {}) => this.call(`/system-switches${query({ ...q })}`);
+    // Fleet-wide connection health (#1690) — every tenant's connections with their
+    // derived health, refresh-expiry warning, and connector dead letters per provider.
+    listConnectionHealth = (q = {}) => this.call(`/connections/health${query({ ...q })}`);
+    // Connector calls per provider over a window (#1691) — the trend behind the health
+    // line. 501s where the control plane names no connector-call dataset.
+    connectorCalls = (q) => this.call(`/connections/calls${query({ ...q })}`);
+    // Failures grouped by fingerprint (#1233) — counted defects with a lifecycle.
+    // `{ entries }` alone: the server sends no cursor, deliberately.
+    listIssues = (q = {}) => this.call(`/issues${query({ ...q })}`);
+    // The staff verdict: resolve / ignore / reopen. The fingerprint rides in the
+    // body — it embeds U+001F, and a path segment would demand percent-encoding
+    // every caller can get subtly wrong.
+    setIssueStatus = (fingerprint, status) => this.json('PUT', '/issues/status', { fingerprint, status });
+    // -- vertical + version registry (orchestration.md §5.6) ----------------
+    // The staff surface for the two human checkpoints: admit/reject a version,
+    // and promote a channel — which refuses a changed permission/migration digest
+    // unless acknowledged. Register is a producer action; publishing a version
+    // (with digests from a build) is CI/CLI, not hand-entry.
+    listVerticals = (page = {}) => this.call(`/verticals${query({ ...page })}`);
+    registerVertical = (input) => this.post('/verticals', input);
+    listVersions = (slug, page = {}) => this.call(`/verticals/${seg(slug)}/versions${query({ ...page })}`);
+    admitVersion = (slug, id) => this.post(`/verticals/${seg(slug)}/versions/${id}/admit`);
+    rejectVersion = (slug, id, note) => this.post(`/verticals/${seg(slug)}/versions/${id}/reject`, { note });
+    listChannels = (slug, page = {}) => this.call(`/verticals/${seg(slug)}/channels${query({ ...page })}`);
+    // Publish/unpublish to the PUBLIC marketplace (marketplace-publish.md §5) — the staff
+    // admission of a builder's publish request. The API refuses `listed: true` while prod
+    // points at an auto-admitted version; that refusal is surfaced verbatim, not pre-checked.
+    setVerticalListed = (slug, listed) => this.post(`/verticals/${seg(slug)}/listing`, { listed });
+    // The install kill-switch: block/unblock NEW installs (existing scopes keep serving).
+    setInstallsBlocked = (slug, blocked) => this.post(`/verticals/${seg(slug)}/install-block`, {
+        blocked,
+    });
+    // Grant/revoke the tenant-provisioner capability (#412): whether this vertical's scopes
+    // may enqueue provision-tenant / set-entitlements intents the platform executes.
+    setTenantProvisioner = (slug, granted) => this.post(`/verticals/${seg(slug)}/tenant-provisioner`, { granted });
+    // Grant/revoke the email-sender capability (#303): whether this vertical's scopes may POST
+    // to the /internal/email/send relay and have transactional mail sent on their behalf.
+    setEmailSender = (slug, granted) => this.post(`/verticals/${seg(slug)}/email-sender`, {
+        granted,
+    });
+    // Delete a vertical + its versions/channels. Refused (4xx) while any scope is bound.
+    deleteVertical = (slug) => this.json('DELETE', `/verticals/${seg(slug)}`);
+    promoteVersion = (slug, channel, versionId, acknowledge) => this.post(`/verticals/${seg(slug)}/channels/${channel}/promote`, {
+        versionId,
+        acknowledge,
+    });
+    // #1705 PR 3: which installed apps promoting `versionId` would break, read before promoting
+    // so the dialog can ask for the export-break acknowledgement up front. Staff see every app.
+    promotionImpact = (slug, channel, versionId) => this.call(`/verticals/${seg(slug)}/channels/${channel}/promote-impact?versionId=${seg(versionId)}`);
+    // #1677: the two diffs a promote acknowledges. `registry` is null for a version that declared
+    // none ("cannot diff"), `migrations` null for one that carries no SQL ("not available").
+    versionRegistry = (slug, versionId) => this.call(`/verticals/${seg(slug)}/versions/${seg(versionId)}/registry`);
+    versionMigrations = (slug, versionId, base) => this.call(`/verticals/${seg(slug)}/versions/${seg(versionId)}/migrations${base === undefined ? '' : `?base=${seg(base)}`}`);
+    // Pin a scope to a version — what the router dispatches on (orchestration.md §5.4).
+    // Refuses a non-admitted version below the seam.
+    bindScopeVersion = (tenantId, scopeId, versionId) => this.post(`/tenants/${tenantId}/scopes/${scopeId}/version`, { versionId });
+    // -- members (console → Members) ----------------------------------------
+    // Who may act on the control plane (staff_actor) — the CP worker's own D1,
+    // not the directory, so the routes live beside /api/auth/* rather than in
+    // control-plane-api. Every mutation returns the fresh reading: one round
+    // trip, no refetch. (Builder-studio access is NOT managed here — it is the
+    // `builder` entitlement on the tenant, granted like any SKU.)
+    listMembers = () => this.call('/members');
+    grantStaffAccess = (email, name) => this.post('/members/staff', { email, name });
+    revokeStaffAccess = (email) => this.post('/members/staff/revoke', { email });
+    // -- observability (design/observability.md §4.1) -----------------------
+    // Proxied reads over the control plane's observability seam; 501 when no
+    // backend is configured. Tier-3 numbers: sampled, approximate, never money
+    // (master-plan §5.3).
+    serviceMetrics = (hours) => this.call(`/observability/metrics${query({ hours })}`);
+    recentLogs = (q = {}) => this.call(`/observability/logs${query({ ...q })}`);
+    /** Observed-vs-declared outbound egress for a vertical's deployed versions (#859). */
+    verticalEgress = (slug, q = {}) => this.call(`/verticals/${seg(slug)}/egress${query({ ...q })}`);
+    // Platform-request drain backlog, fleet-wide (#1690 §2) — terminal give-ups over a
+    // window, plus the pending count as of the sweep's last drain pass (#1840). See
+    // `PlatformRequestBacklog`'s own doc.
+    platformRequestBacklog = () => this.call('/platform-requests/backlog');
+}
+//# sourceMappingURL=staff-client.js.map

package/dist/staff-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"staff-client.js","sourceRoot":"","sources":["../src/staff-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AA2DtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAiOvD;sDACsD;AACtD,SAAS,KAAK,CAAC,MAA8D;IAC3E,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,KAAK,MAAM,GAAG,IAAI,CAAC;gBAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;;YACvD,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvB,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,GAAG,GAAG,kBAAkB,CAAC;AAE/B,MAAM,OAAO,uBAAwB,SAAQ,qBAAqB;IACxD,IAAI,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QAC1D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YACrB,MAAM;YACN,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC5D,CAAC,CAAC;IACL,CAAC;IACO,IAAI,GAAG,CAAI,IAAY,EAAE,IAAc,EAAc,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAE9F,6EAA6E;IAE7E,WAAW,GAAG,CAAC,IAAI,GAAc,EAAE,EAAyB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1G,SAAS,GAAG,CAAC,EAAY,EAAmB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC3E,YAAY,GAAG,CAAC,KAAmD,EAAmB,EAAE,CACtF,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC/B,eAAe,GAAG,CAAC,EAAY,EAAE,MAAoB,EAAmB,EAAE,CACxE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1D,kFAAkF;IAClF,kFAAkF;IAClF,UAAU,GAAG,CAAC,EAAY,EAAmB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAEjF,mFAAmF;IACnF,0EAA0E;IAC1E,iCAAiC;IACjC,YAAY,GAAG,CAAC,EAAY,EAAyB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAE3F,gBAAgB,GAAG,CAAC,EAAY,EAA+B,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IAC3G,qFAAqF;IACrF,kFAAkF;IAClF,wFAAwF;IACxF,iFAAiF;IACjF,mDAAmD;IACnD,gBAAgB,GAAG,CAAC,EAAY,EAAE,GAAW,EAAE,IAA4B,EAA+B,EAAE,CAC1G,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,iBAAiB,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACpE,iBAAiB,GAAG,CAAC,EAAY,EAAE,GAAW,EAA+B,EAAE,CAC7E,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,iBAAiB,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEjE,6EAA6E;IAE7E,sFAAsF;IACtF,uFAAuF;IACvF,mFAAmF;IACnF,sFAAsF;IACtF,kCAAkC;IAClC,eAAe,GAAG,GAAoC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACxF,oFAAoF;IACpF,gFAAgF;IAChF,iEAAiE;IACjE,YAAY,GAAG,CAAC,MAAc,EAA0B,EAAE,CACxD,IAAI,CAAC,IAAI,CAAC,0BAA0B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAE3D,qFAAqF;IACrF,kFAAkF;IAClF,iFAAiF;IACjF,kFAAkF;IAClF,yBAAyB;IACzB,UAAU,GAAG,CAAC,QAAmB,EAAyB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IACxG,qFAAqF;IACrF,uFAAuF;IACvF,6DAA6D;IAC7D,WAAW,GAAG,CAAC,QAAkB,EAAE,MAAgB,EAAgC,EAAE,CACnF,IAAI,CAAC,IAAI,CAAC,kBAAkB,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7D,+EAA+E;IAC/E,kFAAkF;IAClF,kFAAkF;IAClF,wDAAwD;IACxD,cAAc,GAAG,CAAC,CAAC,GAA4D,EAAE,EAA8B,EAAE,CAC/G,IAAI,CAAC,IAAI,CAAC,uBAAuB,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAEtD,6EAA6E;IAE7E,UAAU,GAAG,CAAC,MAAuF,EAAwB,EAAE,CAC7H,IAAI,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9C,sEAAsE;IACtE,oEAAoE;IACpE,iBAAiB,GAAG,CAAC,QAAiB,EAA8B,EAAE,CACpE,IAAI,CAAC,IAAI,CAAC,oBAAoB,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IACvD,QAAQ,GAAG,CAAC,QAAkB,EAAE,OAAgB,EAAkB,EAAE,CAClE,IAAI,CAAC,IAAI,CAAC,YAAY,QAAQ,WAAW,OAAO,EAAE,CAAC,CAAC;IACtD,qFAAqF;IACrF,uFAAuF;IACvF,oFAAoF;IACpF,sFAAsF;IACtF,yDAAyD;IACzD,WAAW,GAAG,CAAC,QAAkB,EAAE,OAAgB,EAAwB,EAAE,CAC3E,IAAI,CAAC,IAAI,CAAC,YAAY,QAAQ,WAAW,OAAO,SAAS,CAAC,CAAC;IAE7D,mFAAmF;IACnF,oFAAoF;IACpF,sFAAsF;IACtF,oDAAoD;IACpD,aAAa,GAAG,CAAC,CAAW,EAAE,CAAU,EAAE,MAAqB,EAA0B,EAAE,CACzF,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,mBAAmB,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/E,WAAW,GAAG,CAAC,CAAW,EAAE,CAAU,EAAE,MAAqB,EAA+B,EAAE,CAC5F,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,WAAW,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAEvE,oFAAoF;IACpF,4EAA4E;IAC5E,qFAAqF;IACrF,oFAAoF;IACpF,iFAAiF;IACjF,4DAA4D;IAC5D,kBAAkB,GAAG,CAAC,CAAW,EAAE,CAAU,EAAsC,EAAE,CACnF,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;IACvD,wEAAwE;IACxE,qFAAqF;IACrF,iBAAiB,GAAG,CAAC,CAAW,EAAE,CAAU,EAAE,QAAkB,EAAE,MAAc,EAA+B,EAAE,CAC/G,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,WAAW,CAAC,gBAAgB,EAAE;QAC7D,QAAQ;QACR,MAAM;KACP,CAAC,CAAC;IACL,wFAAwF;IACxF,gBAAgB,GAAG,CAAC,CAAW,EAAE,CAAU,EAAE,QAAkB,EAAE,MAAc,EAA+B,EAAE,CAC9G,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAE7E,kFAAkF;IAClF,uFAAuF;IACvF,wFAAwF;IACxF,oFAAoF;IACpF,wFAAwF;IACxF,kEAAkE;IAClE,gBAAgB,GAAG,CAAC,CAAW,EAAE,CAAU,EAAoC,EAAE,CAC/E,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;IACrD,uFAAuF;IACvF,+DAA+D;IAC/D,aAAa,GAAG,CAAC,CAAW,EAAE,CAAU,EAAE,QAAgB,EAAE,MAAc,EAA6B,EAAE,CACvG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,WAAW,CAAC,cAAc,EAAE;QAC3D,QAAQ;QACR,MAAM;KACP,CAAC,CAAC;IACL,wFAAwF;IACxF,YAAY,GAAG,CAAC,CAAW,EAAE,CAAU,EAAE,QAAgB,EAAE,MAAc,EAA6B,EAAE,CACtG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAE3E,uFAAuF;IACvF,4FAA4F;IAC5F,oFAAoF;IACpF,wEAAwE;IACxE,kBAAkB,GAAG,CAAC,CAAW,EAAE,KAAe,EAA6B,EAAE,CAC/E,IAAI,CAAC,IAAI,CACP,YAAY,CAAC,wBAAwB,KAAK,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7E,CAAC;IACJ,gBAAgB,GAAG,CAAC,CAAW,EAAE,CAAU,EAAE,IAAsB,EAA8B,EAAE,CACjG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IAE7D,cAAc,GAAG,CAAC,KAA0B,EAAkB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAE7F,0EAA0E;IAC1E,uEAAuE;IACvE,6EAA6E;IAC7E,aAAa,GAAG,CAAC,CAAW,EAAE,CAAU,EAAkB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IAC7G,YAAY,GAAG,CAAC,CAAW,EAAE,CAAU,EAAkB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAC3G,cAAc,GAAG,CAAC,CAAW,EAAE,CAAU,EAAkB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAC/G;;;;;;;;;;;;OAYG;IACH,gBAAgB,GAAG,CAAC,CAAW,EAAE,CAAU,EAAkB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IACjH,YAAY,GAAG,CAAC,CAAW,EAAE,CAAU,EAAkB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAC3G,cAAc,GAAG,CAAC,CAAW,EAAE,CAAU,EAAkB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAC/G,kFAAkF;IAClF,qFAAqF;IACrF,uEAAuE;IACvE,EAAE;IACF,mFAAmF;IACnF,kFAAkF;IAClF,qFAAqF;IACrF,iFAAiF;IACjF,SAAS,GAAG,CACV,CAAW,EACX,CAAU,EACV,IAAI,GAAyB,EAAE,MAAM,EAAE,IAAI,EAAE,EACI,EAAE,CACnD,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACpD,iFAAiF;IACjF,oFAAoF;IACpF,oFAAoF;IACpF,kFAAkF;IAClF,mFAAmF;IACnF,iFAAiF;IACjF,kFAAkF;IAClF,mBAAmB,GAAG,CACpB,CAAW,EACX,CAAU,EACV,QAAgB,EAChB,IAAI,GAAgC,EAAE,EACV,EAAE,CAC9B,IAAI,CAAC,IAAI,CACP,YAAY,CAAC,WAAW,CAAC,kBAAkB,EAC3C,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,CACtB,CAAC;IACJ,oGAAoG;IACpG,gBAAgB,GAAG,CAAC,CAAW,EAAE,CAAU,EAA0B,EAAE,CACrE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IACjD,sFAAsF;IACtF,WAAW,GAAG,CAAC,CAAW,EAAE,CAAU,EAAwB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAEhH,kFAAkF;IAClF,iFAAiF;IACjF,oFAAoF;IACpF,mFAAmF;IACnF,iFAAiF;IACjF,qFAAqF;IACrF,kEAAkE;IAClE,EAAE;IACF,iFAAiF;IACjF,kFAAkF;IAClF,mBAAmB;IACnB,oBAAoB,GAAG,GAA+B,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACzF,eAAe,GAAG,GAA6B,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAClF,sFAAsF;IACtF,yFAAyF;IACzF,WAAW,GAAG,CAAC,CAAW,EAAE,CAAU,EAAiC,EAAE,CACvE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAEnD,+DAA+D;IAC/D,uFAAuF;IACvF,SAAS,GAAG,CAAC,MAA6D,EAA6B,EAAE,CACvG,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAE7C,gFAAgF;IAChF,gFAAgF;IAChF,aAAa,GAAG,CAAC,MAA+D,EAAkC,EAAE,CAClH,IAAI,CAAC,IAAI,CAAC,aAAa,KAAK,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IACjD,YAAY,GAAG,CAAC,KAAwB,EAA4B,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACtG,iBAAiB,GAAG,CAAC,QAAgB,EAAE,MAAsB,EAAE,IAAa,EAA4B,EAAE,CACxG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7E,gFAAgF;IAChF,8EAA8E;IAC9E,cAAc,GAAG,CAAC,QAAgB,EAAiB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAEzG;;;;;;;OAOG;IACH,iBAAiB,GAAG,CAClB,YAAoB,EACpB,KAA0F,EACxB,EAAE,CACpE,IAAI,CAAC,IAAI,CACP,cAAc,GAAG,CAAC,YAAY,CAAC,YAAY,EAC3C,KAAK,CACN,CAAC;IAEJ,6EAA6E;IAE7E,QAAQ,GAAG,CAAC,CAAC,GAAkB,EAAE,EAAyB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAEvG,4EAA4E;IAC5E,8EAA8E;IAC9E,6EAA6E;IAC7E,eAAe,GAAG,CAAC,CAAC,GAAqB,EAAE,EAAkC,EAAE,CAC7E,IAAI,CAAC,IAAI,CAAC,gBAAgB,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/C,4EAA4E;IAC5E,+DAA+D;IAC/D,aAAa,GAAG,CAAC,CAAC,GAAmB,EAAE,EAAgC,EAAE,CACvE,IAAI,CAAC,IAAI,CAAC,cAAc,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7C,kFAAkF;IAClF,qFAAqF;IACrF,sFAAsF;IACtF,kBAAkB,GAAG,CAAC,CAAC,GAAwB,EAAE,EAAqC,EAAE,CACtF,IAAI,CAAC,IAAI,CAAC,mBAAmB,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAClD,+EAA+E;IAC/E,mFAAmF;IACnF,oBAAoB,GAAG,CAAC,CAAC,GAA0B,EAAE,EAAiC,EAAE,CACtF,IAAI,CAAC,IAAI,CAAC,sBAAsB,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACrD,mFAAmF;IACnF,sEAAsE;IACtE,cAAc,GAAG,CAAC,CAAuC,EAA+D,EAAE,CACxH,IAAI,CAAC,IAAI,CAAC,qBAAqB,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACpD,8EAA8E;IAC9E,iEAAiE;IACjE,UAAU,GAAG,CAAC,CAAC,GAAgB,EAAE,EAAsC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACjH,6EAA6E;IAC7E,4EAA4E;IAC5E,qCAAqC;IACrC,cAAc,GAAG,CAAC,WAAmB,EAAE,MAAwB,EAAuB,EAAE,CACtF,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;IAE9D,0EAA0E;IAC1E,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E,yDAAyD;IACzD,aAAa,GAAG,CAAC,IAAI,GAAc,EAAE,EAA2B,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IAChH,gBAAgB,GAAG,CAAC,KAA6D,EAAqB,EAAE,CACtG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACjC,YAAY,GAAG,CAAC,IAAY,EAAE,IAAI,GAAc,EAAE,EAAkC,EAAE,CACpF,IAAI,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IACrE,YAAY,GAAG,CAAC,IAAY,EAAE,EAAU,EAA4B,EAAE,CACpE,IAAI,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAC5D,aAAa,GAAG,CAAC,IAAY,EAAE,EAAU,EAAE,IAAY,EAA4B,EAAE,CACnF,IAAI,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACvE,YAAY,GAAG,CAAC,IAAY,EAAE,IAAI,GAAc,EAAE,EAAkC,EAAE,CACpF,IAAI,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IACrE,sFAAsF;IACtF,sFAAsF;IACtF,0FAA0F;IAC1F,iBAAiB,GAAG,CAAC,IAAY,EAAE,MAAe,EAA8C,EAAE,CAChG,IAAI,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3D,sFAAsF;IACtF,kBAAkB,GAAG,CAAC,IAAY,EAAE,OAAgB,EAAuD,EAAE,CAC3G,IAAI,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE;QACjD,OAAO;KACR,CAAC,CAAC;IACL,wFAAwF;IACxF,iFAAiF;IACjF,oBAAoB,GAAG,CAAC,IAAY,EAAE,OAAgB,EAAyD,EAAE,CAC/G,IAAI,CAAC,IAAI,CACP,cAAc,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAC5C,EAAE,OAAO,EAAE,CACZ,CAAC;IACJ,2FAA2F;IAC3F,sFAAsF;IACtF,cAAc,GAAG,CAAC,IAAY,EAAE,OAAgB,EAAmD,EAAE,CACnG,IAAI,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE;QAChD,OAAO;KACR,CAAC,CAAC;IACL,qFAAqF;IACrF,cAAc,GAAG,CAAC,IAAY,EAA+C,EAAE,CAC7E,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjD,cAAc,GAAG,CACf,IAAY,EACZ,OAAoB,EACpB,SAAiB,EACjB,WAAsC,EACZ,EAAE,CAC5B,IAAI,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,IAAI,CAAC,aAAa,OAAO,UAAU,EAAE;QAC/D,SAAS;QACT,WAAW;KACZ,CAAC,CAAC;IACL,4FAA4F;IAC5F,4FAA4F;IAC5F,eAAe,GAAG,CAChB,IAAY,EACZ,OAAoB,EACpB,SAAiB,EAC4C,EAAE,CAC/D,IAAI,CAAC,IAAI,CACP,cAAc,GAAG,CAAC,IAAI,CAAC,aAAa,OAAO,6BAA6B,GAAG,CAAC,SAAS,CAAC,EAAE,CACzF,CAAC;IACJ,8FAA8F;IAC9F,yFAAyF;IACzF,eAAe,GAAG,CAAC,IAAY,EAAE,SAAiB,EAAoD,EAAE,CACtG,IAAI,CAAC,IAAI,CACP,cAAc,GAAG,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,SAAS,CAAC,WAAW,CAC9D,CAAC;IACJ,iBAAiB,GAAG,CAAC,IAAY,EAAE,SAAiB,EAAE,IAAa,EAAiD,EAAE,CACpH,IAAI,CAAC,IAAI,CACP,cAAc,GAAG,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,SAAS,CAAC,cAChD,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,EAC9C,EAAE,CACH,CAAC;IACJ,oFAAoF;IACpF,iDAAiD;IACjD,gBAAgB,GAAG,CAAC,QAAkB,EAAE,OAAgB,EAAE,SAAiB,EAAkB,EAAE,CAC7F,IAAI,CAAC,IAAI,CAAC,YAAY,QAAQ,WAAW,OAAO,UAAU,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IAE7E,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,8DAA8D;IAC9D,WAAW,GAAG,GAA4B,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACnE,gBAAgB,GAAG,CAAC,KAAa,EAAE,IAAa,EAA2B,EAAE,CAC3E,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,iBAAiB,GAAG,CAAC,KAAa,EAA2B,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAE9G,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,sBAAsB;IACtB,cAAc,GAAG,CAAC,KAAa,EAAgC,EAAE,CAC/D,IAAI,CAAC,IAAI,CAAC,yBAAyB,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACzD,UAAU,GAAG,CAAC,CAAC,GAAyE,EAAE,EAA6B,EAAE,CACvH,IAAI,CAAC,IAAI,CAAC,sBAAsB,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACrD,sFAAsF;IACtF,cAAc,GAAG,CAAC,IAAY,EAAE,CAAC,GAAuC,EAAE,EAAyB,EAAE,CACnG,IAAI,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAChE,mFAAmF;IACnF,gFAAgF;IAChF,sCAAsC;IACtC,sBAAsB,GAAG,GAAoC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;CACzG"}

package/dist/transport.d.ts

@@ -0,0 +1,56 @@
+import type { ConnectionProbe } from '@substrat-run/contracts';
+/**
+ * The one HTTP seam every control-plane caller shares (#971): how a request is
+ * authenticated, how a failure is read, and what an empty answer is. The callers
+ * differ in what they ask — `ControlPlaneClient` is the vertical's connect seam,
+ * `ControlPlaneStaffClient` the console's staff surface — not in how they ask it.
+ *
+ * Browser-safe: nothing here reaches past `fetch` and `@substrat-run/contracts`, which is
+ * why the console can import it (`@substrat-run/control-plane-api/client`).
+ */
+export interface ControlPlaneTransportOptions {
+    /** Base URL of the control-plane API; a path such as `/api` is fine in a browser. */
+    baseUrl: string;
+    /**
+     * The dev-only `x-platform-actor` header, sent only when no `serviceToken` is set. `null`
+     * sends none: the console's session mode, where the staff cookie authenticates instead.
+     */
+    actor: string | null;
+    serviceToken?: string;
+    fetch?: typeof globalThis.fetch;
+    /** Passed to `fetch` only when set — `'include'` carries the console's staff session cookie. */
+    credentials?: RequestCredentials;
+}
+/** A non-2xx (or unreachable) control-plane response. `status` is 0 on a transport error. */
+export declare class ControlPlaneError extends Error {
+    readonly status: number;
+    /**
+     * The provider's own answer, when the plane refused a connect because the credential
+     * was rejected upstream (#605, 422). Carried so a console can show WHY — "Scrive:
+     * No valid access credentials were provided" — instead of a generic save failure.
+     */
+    readonly probe?: ConnectionProbe | undefined;
+    constructor(status: number, message: string, 
+    /**
+     * The provider's own answer, when the plane refused a connect because the credential
+     * was rejected upstream (#605, 422). Carried so a console can show WHY — "Scrive:
+     * No valid access credentials were provided" — instead of a generic save failure.
+     */
+    probe?: ConnectionProbe | undefined);
+}
+export declare class ControlPlaneTransport {
+    private readonly baseUrl;
+    private readonly actor;
+    private readonly serviceToken?;
+    private readonly fetchImpl;
+    private readonly credentials?;
+    constructor(options: ControlPlaneTransportOptions);
+    /**
+     * One request, and the one place a failure is read: a transport error or a non-2xx answer
+     * throws `ControlPlaneError`, so what comes back is always a successful `Response`. A 404
+     * is handed back as-is when the caller allows it.
+     */
+    protected send(path: string, init?: RequestInit, allow404?: boolean): Promise<Response>;
+    protected call<T>(path: string, init?: RequestInit, allow404?: boolean): Promise<T>;
+}
+//# sourceMappingURL=transport.d.ts.map

package/dist/transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAI/D;;;;;;;;GAQG;AACH,MAAM,WAAW,4BAA4B;IAC3C,qFAAqF;IACrF,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAChC,gGAAgG;IAChG,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC;AAED,6FAA6F;AAC7F,qBAAa,iBAAkB,SAAQ,KAAK;IAExC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAEvB;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe;IARlC,YACW,MAAM,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM;IACf;;;;OAIG;IACM,KAAK,CAAC,EAAE,eAAe,YAAA,EAIjC;CACF;AAED,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgB;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0B;IACpD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAqB;IAElD,YAAY,OAAO,EAAE,4BAA4B,EAShD;IAED;;;;OAIG;IACH,UAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,EAAE,QAAQ,UAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwC1F;IAED,UAAgB,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,EAAE,QAAQ,UAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAItF;CACF"}

package/dist/transport.js

@@ -0,0 +1,88 @@
+import { problemDetail } from '@substrat-run/contracts';
+import { DEV_ACTOR_HEADER, SERVICE_TOKEN_HEADER } from './auth.js';
+/** A non-2xx (or unreachable) control-plane response. `status` is 0 on a transport error. */
+export class ControlPlaneError extends Error {
+    status;
+    probe;
+    constructor(status, message, 
+    /**
+     * The provider's own answer, when the plane refused a connect because the credential
+     * was rejected upstream (#605, 422). Carried so a console can show WHY — "Scrive:
+     * No valid access credentials were provided" — instead of a generic save failure.
+     */
+    probe) {
+        super(message);
+        this.status = status;
+        this.probe = probe;
+        this.name = 'ControlPlaneError';
+    }
+}
+export class ControlPlaneTransport {
+    baseUrl;
+    actor;
+    serviceToken;
+    fetchImpl;
+    credentials;
+    constructor(options) {
+        this.baseUrl = options.baseUrl.replace(/\/$/, '');
+        this.actor = options.actor;
+        this.serviceToken = options.serviceToken;
+        this.credentials = options.credentials;
+        // Bind to globalThis: workerd throws "Illegal invocation" if `fetch` is called
+        // with a `this` other than the global scope (which `this.fetchImpl(...)` would
+        // otherwise set to this instance). An injected fetch is used as-is.
+        this.fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);
+    }
+    /**
+     * One request, and the one place a failure is read: a transport error or a non-2xx answer
+     * throws `ControlPlaneError`, so what comes back is always a successful `Response`. A 404
+     * is handed back as-is when the caller allows it.
+     */
+    async send(path, init, allow404 = false) {
+        let res;
+        try {
+            res = await this.fetchImpl(`${this.baseUrl}${path}`, {
+                ...init,
+                ...(this.credentials ? { credentials: this.credentials } : {}),
+                headers: {
+                    // One credential per request (#980): a service token identifies the caller as
+                    // the plane's service actor and is checked BEFORE the dev-actor stub, so the
+                    // actor header would be ignored there — and a dev-only header has no business
+                    // leaving a production caller at all. Without a token, the actor header IS the
+                    // (local, UNSAFE) credential.
+                    ...(this.serviceToken
+                        ? { [SERVICE_TOKEN_HEADER]: this.serviceToken }
+                        : this.actor !== null
+                            ? { [DEV_ACTOR_HEADER]: this.actor }
+                            : {}),
+                    'content-type': 'application/json',
+                    ...init?.headers,
+                },
+            });
+        }
+        catch (e) {
+            // A transport failure (control plane down) must fail closed, not silently
+            // pass — a vertical that cannot reach the authority does not get to run.
+            throw new ControlPlaneError(0, `control plane unreachable: ${e.message}`);
+        }
+        if (res.status === 404 && allow404)
+            return res;
+        if (!res.ok) {
+            // `problemDetail` is the one reading of a failed body (#971): the RFC 9457
+            // `detail` first, the deprecated `error` duplicate second, both against the
+            // published schema — so this works either way, and keeps working the day the
+            // duplicate is deleted. The status line is the fallback only when the body
+            // said nothing readable.
+            const body = await res.json().catch(() => null);
+            throw new ControlPlaneError(res.status, problemDetail(body) ?? `${res.status} ${res.statusText}`);
+        }
+        return res;
+    }
+    async call(path, init, allow404 = false) {
+        const res = await this.send(path, init, allow404);
+        if (res.status === 404 && allow404)
+            return undefined;
+        return res.status === 204 ? undefined : (await res.json());
+    }
+}
+//# sourceMappingURL=transport.js.map

package/dist/transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAGxD,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAyBnE,6FAA6F;AAC7F,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAE/B,MAAM;IAON,KAAK;IARhB,YACW,MAAc,EACvB,OAAe;IACf;;;;OAIG;IACM,KAAuB;QAEhC,KAAK,CAAC,OAAO,CAAC,CAAC;sBATN,MAAM;qBAON,KAAK;QAGd,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,OAAO,qBAAqB;IACf,OAAO,CAAS;IAChB,KAAK,CAAgB;IACrB,YAAY,CAAU;IACtB,SAAS,CAA0B;IACnC,WAAW,CAAsB;IAElD,YAAY,OAAqC;QAC/C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,+EAA+E;QAC/E,+EAA+E;QAC/E,oEAAoE;QACpE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtE,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,IAAkB,EAAE,QAAQ,GAAG,KAAK;QACrE,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;gBACnD,GAAG,IAAI;gBACP,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,OAAO,EAAE;oBACP,8EAA8E;oBAC9E,6EAA6E;oBAC7E,8EAA8E;oBAC9E,+EAA+E;oBAC/E,8BAA8B;oBAC9B,GAAG,CAAC,IAAI,CAAC,YAAY;wBACnB,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE;wBAC/C,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI;4BACnB,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE;4BACpC,CAAC,CAAC,EAAE,CAAC;oBACT,cAAc,EAAE,kBAAkB;oBAClC,GAAG,IAAI,EAAE,OAAO;iBACjB;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,0EAA0E;YAC1E,yEAAyE;YACzE,MAAM,IAAI,iBAAiB,CAAC,CAAC,EAAE,8BAA+B,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ;YAAE,OAAO,GAAG,CAAC;QAC/C,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,2EAA2E;YAC3E,4EAA4E;YAC5E,6EAA6E;YAC7E,2EAA2E;YAC3E,yBAAyB;YACzB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAChD,MAAM,IAAI,iBAAiB,CACzB,GAAG,CAAC,MAAM,EACV,aAAa,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CACzD,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAES,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAkB,EAAE,QAAQ,GAAG,KAAK;QACxE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAClD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ;YAAE,OAAO,SAAc,CAAC;QAC1D,OAAO,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAE,SAAe,CAAC,CAAC,CAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAO,CAAC;IAC3E,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@substrat-run/control-plane-api",
-  "version": "0.133.0",
+  "version": "0.134.0",
   "description": "HTTP surface over HostAdmin — the audited control-plane transport (control-plane.md §4.5)",
   "license": "AGPL-3.0-only",
   "repository": {
@@ -16,6 +16,10 @@
     ".": {
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
+    },
+    "./browser": {
+      "types": "./dist/browser.d.ts",
+      "default": "./dist/browser.js"
     }
   },
   "files": [
@@ -23,9 +27,9 @@
   ],
   "dependencies": {
     "hono": "^4.13.9",
-    "@substrat-run/kernel": "^0.133.0",
-    "@substrat-run/psl": "^0.2.5",
-    "@substrat-run/contracts": "^0.133.0"
+    "@substrat-run/contracts": "^0.134.0",
+    "@substrat-run/kernel": "^0.134.0",
+    "@substrat-run/psl": "^0.2.5"
   },
   "devDependencies": {
     "@hono/node-server": "^1.13.0",
@@ -36,8 +40,8 @@
     "tsx": "^4.19.0",
     "typescript": "^7.0.0",
     "vitest": "^3.2.7",
-    "@substrat-run/adapter-sqlite": "^0.133.0",
-    "@substrat-run/vertical-host": "^0.133.0"
+    "@substrat-run/adapter-sqlite": "^0.134.0",
+    "@substrat-run/vertical-host": "^0.134.0"
   },
   "publishConfig": {
     "access": "public"