@substrat-run/control-plane-api 0.134.0 → 0.135.0

package/dist/client.d.ts

@@ -1,111 +0,0 @@
-import type { EntitlementGrant, EntitlementGrantInput, QueryScopeInput, ReadScopeTableInput, Scope, ScopeId, ScopeQueryResult, DenialFilter, DenialSummary, PermissionDenial, ScopeTable, ScopeTablePage, Tenant, TenantId } from '@substrat-run/contracts';
-import { ControlPlaneError, ControlPlaneTransport } from './transport.js';
-import { type IdentityTenant } from './identity-tenants.js';
-/**
- * A typed HTTP client for the control-plane API — the vertical side of the
- * connect seam (first-flow.md slice 4).
- *
- * A vertical that runs against a *separately deployed* shared control plane uses
- * this to (a) register its tenant, entitlements, and scope on boot, and (b) gate
- * each request on the directory's authoritative lifecycle — `assertScopeActive`
- * fails closed exactly as the kernel's own `getScope` does, so a suspend in the
- * console bites the vertical's next operation even across process and deployment
- * boundaries.
- *
- * What it deliberately does NOT do: write roles or grants. Those are not on the
- * control-plane HTTP surface (api.ts §4.5 — permission writes are the human
- * checkpoint, D-22/D-29), so a connected vertical keeps its permission model
- * local and treats the shared plane as the authority for tenant/scope lifecycle
- * and entitlements only.
- *
- * `fetch` is injectable: pass a Worker service-binding's fetch, or the router's
- * own `app.fetch` for an in-process test, instead of the global.
- */
-export interface ControlPlaneClientOptions {
-    /** Base URL of the control-plane API, e.g. `https://cp.example.com` or `http://127.0.0.1:8788`. */
-    baseUrl: string;
-    /**
-     * The platform actor id stamped as the audit subject on every write — sent as the
-     * dev-only `x-platform-actor` header, and ONLY when no `serviceToken` is set. With a
-     * token the control plane resolves the subject from the token (its fixed service
-     * actor), so the header is never consulted there and is not sent (#980).
-     */
-    actor: string;
-    /**
-     * A service credential (`x-service-token`) proving the caller is an authorized
-     * vertical, not just anyone with an actor id. Required when the control plane
-     * has real auth — the dev-actor header alone does not authenticate there. When
-     * set, it is the request's only credential: `actor` is not sent.
-     */
-    serviceToken?: string;
-    /** Defaults to the global `fetch`. */
-    fetch?: typeof globalThis.fetch;
-}
-export { ControlPlaneError };
-export interface ClientProvisionScopeInput {
-    tenantId: TenantId;
-    scopeId: ScopeId;
-    slug?: string;
-    kind?: string;
-    name?: string;
-    vertical?: string | null;
-    jurisdiction?: 'eu' | 'us' | 'global';
-}
-export declare class ControlPlaneClient extends ControlPlaneTransport {
-    constructor(options: ControlPlaneClientOptions);
-    createTenant(input: {
-        id: TenantId;
-        slug: string;
-        name: string;
-    }): Promise<Tenant>;
-    grantEntitlement(tenantId: TenantId, key: string, plan?: EntitlementGrantInput): Promise<EntitlementGrant[]>;
-    provisionScope(input: ClientProvisionScopeInput): Promise<Scope>;
-    /**
-     * Confirm the scope exists here, moving the directory row provisioning → active.
-     *
-     * In this (push) direction the vertical has already built the scope locally, so
-     * registering and confirming are the same moment — but they stay two calls so
-     * `provisionScope` means one thing everywhere, and so the directory is never the
-     * one deciding a scope is ready (K-31).
-     */
-    activateScope(tenantId: TenantId, scopeId: ScopeId): Promise<Scope>;
-    getTenant(tenantId: TenantId): Promise<Tenant | undefined>;
-    getScopeRecord(tenantId: TenantId, scopeId: ScopeId): Promise<Scope | undefined>;
-    listEntitlements(tenantId: TenantId): Promise<EntitlementGrant[]>;
-    /**
-     * The tenants a login builds for, each flagged with whether it holds the `builder`
-     * entitlement — the builder studio's membership read (builder-plane.md §4). `externalId`
-     * is the login's OIDC subject. Service-token gated: an unset token is refused by the
-     * plane, never bypassed.
-     *
-     * The answer is PARSED, not asserted: a plane that renamed `entitled`, or answered an
-     * `{ error }` body with a 200, would hand a cast `entitled: undefined` — falsy, so the
-     * studio would lock the tenant out with the ordinary "not enabled" page and nothing
-     * anywhere would say the directory had changed shape. A refused parse throws instead.
-     * The message names the shape that was wrong, never the body — the body is directory
-     * facts about a person's tenants.
-     */
-    identityTenants(externalId: string): Promise<IdentityTenant[]>;
-    /** Every table in the scope's own database, with row counts (Data view). */
-    listScopeTables(tenantId: TenantId, scopeId: ScopeId): Promise<ScopeTable[]>;
-    /** A bounded page of one table of the scope's database. */
-    readScopeTable(tenantId: TenantId, scopeId: ScopeId, input: ReadScopeTableInput): Promise<ScopeTablePage>;
-    /** One read-only SQL statement against the scope's database — the console (#219). */
-    queryScope(tenantId: TenantId, scopeId: ScopeId, input: QueryScopeInput): Promise<ScopeQueryResult>;
-    /**
-     * The scope's recorded permission refusals, bucketed per (actor, permission) with the
-     * window's own facts beside them — the view to open first, because the raw log's
-     * volume is attacker-influenceable and a prober can flood a newest-first page.
-     */
-    summarizeDenials(tenantId: TenantId, scopeId: ScopeId, filter?: DenialFilter): Promise<DenialSummary>;
-    /** The raw rows behind a bucket, newest first. */
-    listDenials(tenantId: TenantId, scopeId: ScopeId, filter?: DenialFilter): Promise<PermissionDenial[]>;
-    /**
-     * The gate. Throws unless the tenant is active AND the scope exists and is
-     * active — the same fail-closed logic the kernel's `validateScopeAccess`
-     * applies locally, so a tenant-level cascade suspend bites too, not just a
-     * per-scope one. Call it before handing a request to the local scope host.
-     */
-    assertScopeActive(tenantId: TenantId, scopeId: ScopeId): Promise<void>;
-}
-//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,KAAK,EACL,OAAO,EACP,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,MAAM,EACN,QAAQ,EACT,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAA2B,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAErF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,yBAAyB;IACxC,mGAAmG;IACnG,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CACjC;AAID,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAE7B,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEzB,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,QAAQ,CAAC;CACvC;AAED,qBAAa,kBAAmB,SAAQ,qBAAqB;IAC3D,YAAY,OAAO,EAAE,yBAAyB,EAE7C;IAID,YAAY,CAAC,KAAK,EAAE;QAAE,EAAE,EAAE,QAAQ,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAEjF;IAED,gBAAgB,CACd,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,qBAAqB,GAC3B,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAK7B;IAED,cAAc,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,KAAK,CAAC,CAE/D;IAED;;;;;;;OAOG;IACH,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAElE;IAID,SAAS,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAEzD;IAED,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,CAE/E;IAED,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAEhE;IAED;;;;;;;;;;;;OAYG;IACG,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAanE;IAID,4EAA4E;IAC5E,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAE3E;IAED,2DAA2D;IAC3D,cAAc,CACZ,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,cAAc,CAAC,CAKzB;IAED,qFAAqF;IACrF,UAAU,CACR,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,gBAAgB,CAAC,CAK3B;IAID;;;;OAIG;IACH,gBAAgB,CACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC,CAExB;IAED,kDAAkD;IAClD,WAAW,CACT,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAE7B;IAED;;;;;OAKG;IACG,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAa3E;CACF"}

package/dist/client.js

@@ -1,122 +0,0 @@
-import { denialQuery } from '@substrat-run/contracts';
-import { ControlPlaneError, ControlPlaneTransport } from './transport.js';
-import { identityTenantsResponse } from './identity-tenants.js';
-// The error is raised by the transport; this is the path callers (and `errors.ts`)
-// have always imported it from.
-export { ControlPlaneError };
-export class ControlPlaneClient extends ControlPlaneTransport {
-    constructor(options) {
-        super(options);
-    }
-    // -- registration (idempotent, mirrors HostAdmin) --------------------------
-    createTenant(input) {
-        return this.call('/tenants', { method: 'POST', body: JSON.stringify(input) });
-    }
-    grantEntitlement(tenantId, key, plan) {
-        return this.call(`/tenants/${tenantId}/entitlements/${key}`, {
-            method: 'PUT',
-            body: plan === undefined ? undefined : JSON.stringify(plan),
-        });
-    }
-    provisionScope(input) {
-        return this.call('/scopes', { method: 'POST', body: JSON.stringify(input) });
-    }
-    /**
-     * Confirm the scope exists here, moving the directory row provisioning → active.
-     *
-     * In this (push) direction the vertical has already built the scope locally, so
-     * registering and confirming are the same moment — but they stay two calls so
-     * `provisionScope` means one thing everywhere, and so the directory is never the
-     * one deciding a scope is ready (K-31).
-     */
-    activateScope(tenantId, scopeId) {
-        return this.call(`/tenants/${tenantId}/scopes/${scopeId}/activate`, { method: 'POST' });
-    }
-    // -- reads used for gating -------------------------------------------------
-    getTenant(tenantId) {
-        return this.call(`/tenants/${tenantId}`, undefined, true);
-    }
-    getScopeRecord(tenantId, scopeId) {
-        return this.call(`/tenants/${tenantId}/scopes/${scopeId}`, undefined, true);
-    }
-    listEntitlements(tenantId) {
-        return this.call(`/tenants/${tenantId}/entitlements`);
-    }
-    /**
-     * The tenants a login builds for, each flagged with whether it holds the `builder`
-     * entitlement — the builder studio's membership read (builder-plane.md §4). `externalId`
-     * is the login's OIDC subject. Service-token gated: an unset token is refused by the
-     * plane, never bypassed.
-     *
-     * The answer is PARSED, not asserted: a plane that renamed `entitled`, or answered an
-     * `{ error }` body with a 200, would hand a cast `entitled: undefined` — falsy, so the
-     * studio would lock the tenant out with the ordinary "not enabled" page and nothing
-     * anywhere would say the directory had changed shape. A refused parse throws instead.
-     * The message names the shape that was wrong, never the body — the body is directory
-     * facts about a person's tenants.
-     */
-    async identityTenants(externalId) {
-        const res = await this.send('/internal/builder/identity-tenants', {
-            method: 'POST',
-            body: JSON.stringify({ externalId }),
-        });
-        const parsed = identityTenantsResponse.safeParse(await res.json().catch(() => null));
-        if (!parsed.success) {
-            throw new ControlPlaneError(res.status, `identity-tenants returned an unexpected shape: ${parsed.error.message}`);
-        }
-        return parsed.data.tenants;
-    }
-    // -- read-only scope-DB introspection (§5.4 admin-query RPC) ----------------
-    /** Every table in the scope's own database, with row counts (Data view). */
-    listScopeTables(tenantId, scopeId) {
-        return this.call(`/tenants/${tenantId}/scopes/${scopeId}/tables`);
-    }
-    /** A bounded page of one table of the scope's database. */
-    readScopeTable(tenantId, scopeId, input) {
-        const q = new URLSearchParams({ limit: String(input.limit), offset: String(input.offset) });
-        return this.call(`/tenants/${tenantId}/scopes/${scopeId}/tables/${encodeURIComponent(input.table)}?${q}`);
-    }
-    /** One read-only SQL statement against the scope's database — the console (#219). */
-    queryScope(tenantId, scopeId, input) {
-        return this.call(`/tenants/${tenantId}/scopes/${scopeId}/query`, {
-            method: 'POST',
-            body: JSON.stringify(input),
-        });
-    }
-    // -- the denial log (K-35, #867) --------------------------------------------
-    /**
-     * The scope's recorded permission refusals, bucketed per (actor, permission) with the
-     * window's own facts beside them — the view to open first, because the raw log's
-     * volume is attacker-influenceable and a prober can flood a newest-first page.
-     */
-    summarizeDenials(tenantId, scopeId, filter) {
-        return this.call(`/tenants/${tenantId}/scopes/${scopeId}/denials/summary${denialQuery(filter)}`);
-    }
-    /** The raw rows behind a bucket, newest first. */
-    listDenials(tenantId, scopeId, filter) {
-        return this.call(`/tenants/${tenantId}/scopes/${scopeId}/denials${denialQuery(filter)}`);
-    }
-    /**
-     * The gate. Throws unless the tenant is active AND the scope exists and is
-     * active — the same fail-closed logic the kernel's `validateScopeAccess`
-     * applies locally, so a tenant-level cascade suspend bites too, not just a
-     * per-scope one. Call it before handing a request to the local scope host.
-     */
-    async assertScopeActive(tenantId, scopeId) {
-        const [tenant, scope] = await Promise.all([
-            this.getTenant(tenantId),
-            this.getScopeRecord(tenantId, scopeId),
-        ]);
-        if (!tenant)
-            throw new ControlPlaneError(403, `unknown tenant: ${tenantId}`);
-        if (tenant.status !== 'active') {
-            throw new ControlPlaneError(403, `tenant not active (status: ${tenant.status}): ${tenantId}`);
-        }
-        if (!scope)
-            throw new ControlPlaneError(403, `unknown scope for tenant: (${tenantId}, ${scopeId})`);
-        if (scope.status !== 'active') {
-            throw new ControlPlaneError(403, `scope not active (status: ${scope.status}): ${scopeId}`);
-        }
-    }
-}
-//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAkBtD,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAuB,MAAM,uBAAuB,CAAC;AA2CrF,mFAAmF;AACnF,gCAAgC;AAChC,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAa7B,MAAM,OAAO,kBAAmB,SAAQ,qBAAqB;IAC3D,YAAY,OAAkC;QAC5C,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;IAED,6EAA6E;IAE7E,YAAY,CAAC,KAAmD;QAC9D,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,gBAAgB,CACd,QAAkB,EAClB,GAAW,EACX,IAA4B;QAE5B,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,QAAQ,iBAAiB,GAAG,EAAE,EAAE;YAC3D,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC5D,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CAAC,KAAgC;QAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED;;;;;;;OAOG;IACH,aAAa,CAAC,QAAkB,EAAE,OAAgB;QAChD,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,QAAQ,WAAW,OAAO,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,6EAA6E;IAE7E,SAAS,CAAC,QAAkB;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC5D,CAAC;IAED,cAAc,CAAC,QAAkB,EAAE,OAAgB;QACjD,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,QAAQ,WAAW,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9E,CAAC;IAED,gBAAgB,CAAC,QAAkB;QACjC,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,QAAQ,eAAe,CAAC,CAAC;IACxD,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,eAAe,CAAC,UAAkB;QACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,oCAAoC,EAAE;YAChE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC;SACrC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QACrF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,iBAAiB,CACzB,GAAG,CAAC,MAAM,EACV,kDAAkD,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CACzE,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;IAC7B,CAAC;IAED,8EAA8E;IAE9E,4EAA4E;IAC5E,eAAe,CAAC,QAAkB,EAAE,OAAgB;QAClD,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,QAAQ,WAAW,OAAO,SAAS,CAAC,CAAC;IACpE,CAAC;IAED,2DAA2D;IAC3D,cAAc,CACZ,QAAkB,EAClB,OAAgB,EAChB,KAA0B;QAE1B,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5F,OAAO,IAAI,CAAC,IAAI,CACd,YAAY,QAAQ,WAAW,OAAO,WAAW,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CACxF,CAAC;IACJ,CAAC;IAED,qFAAqF;IACrF,UAAU,CACR,QAAkB,EAClB,OAAgB,EAChB,KAAsB;QAEtB,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,QAAQ,WAAW,OAAO,QAAQ,EAAE;YAC/D,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAE9E;;;;OAIG;IACH,gBAAgB,CACd,QAAkB,EAClB,OAAgB,EAChB,MAAqB;QAErB,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,QAAQ,WAAW,OAAO,mBAAmB,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACnG,CAAC;IAED,kDAAkD;IAClD,WAAW,CACT,QAAkB,EAClB,OAAgB,EAChB,MAAqB;QAErB,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,QAAQ,WAAW,OAAO,WAAW,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CAAC,QAAkB,EAAE,OAAgB;QAC1D,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACxC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YACxB,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC;SACvC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,mBAAmB,QAAQ,EAAE,CAAC,CAAC;QAC7E,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,8BAA8B,MAAM,CAAC,MAAM,MAAM,QAAQ,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,8BAA8B,QAAQ,KAAK,OAAO,GAAG,CAAC,CAAC;QACpG,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,6BAA6B,KAAK,CAAC,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;CACF"}

package/dist/identity-tenants.d.ts

@@ -1,30 +0,0 @@
-import { z } from '@substrat-run/contracts';
-/**
- * A tenant a login builds for, as the control plane's studio membership read states it
- * (`POST /internal/builder/identity-tenants`, builder-plane.md §4).
- *
- * The three directory fields are parsed with the SAME schemas the `tenant` record
- * publishes (`contracts/src/tenancy.ts`), not with generic strings: the id is a ULID, the
- * slug is the constrained slug, the name is non-empty. That costs nothing in lockout risk
- * — `createTenantInput` picks those same three, so a tenant that exists satisfied them at
- * creation — and it buys the half a loose parse would miss. A non-empty but malformed id
- * passes `z.string()` and then becomes a Durable Object key and a team route, which is the
- * downstream use this parse exists to protect.
- */
-export declare const identityTenant: z.ZodObject<{
-    id: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
-    slug: z.ZodString;
-    name: z.ZodString;
-    entitled: z.ZodBoolean;
-}, z.core.$strip>;
-/** The `/internal/builder/identity-tenants` response body. */
-export declare const identityTenantsResponse: z.ZodObject<{
-    tenants: z.ZodArray<z.ZodObject<{
-        id: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
-        slug: z.ZodString;
-        name: z.ZodString;
-        entitled: z.ZodBoolean;
-    }, z.core.$strip>>;
-}, z.core.$strip>;
-export type IdentityTenant = z.infer<typeof identityTenant>;
-//# sourceMappingURL=identity-tenants.d.ts.map

package/dist/identity-tenants.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity-tenants.d.ts","sourceRoot":"","sources":["../src/identity-tenants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,CAAC,EAAE,MAAM,yBAAyB,CAAC;AAE5D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc;;;;;iBAMzB,CAAC;AAEH,8DAA8D;AAC9D,eAAO,MAAM,uBAAuB;;;;;;;iBAAiD,CAAC;AAEtF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC"}

package/dist/identity-tenants.js

@@ -1,23 +0,0 @@
-import { slug, tenantId, z } from '@substrat-run/contracts';
-/**
- * A tenant a login builds for, as the control plane's studio membership read states it
- * (`POST /internal/builder/identity-tenants`, builder-plane.md §4).
- *
- * The three directory fields are parsed with the SAME schemas the `tenant` record
- * publishes (`contracts/src/tenancy.ts`), not with generic strings: the id is a ULID, the
- * slug is the constrained slug, the name is non-empty. That costs nothing in lockout risk
- * — `createTenantInput` picks those same three, so a tenant that exists satisfied them at
- * creation — and it buys the half a loose parse would miss. A non-empty but malformed id
- * passes `z.string()` and then becomes a Durable Object key and a team route, which is the
- * downstream use this parse exists to protect.
- */
-export const identityTenant = z.object({
-    id: tenantId,
-    slug,
-    name: z.string().min(1),
-    /** Whether the tenant holds the `builder` entitlement (the control plane applies expiry at read). */
-    entitled: z.boolean(),
-});
-/** The `/internal/builder/identity-tenants` response body. */
-export const identityTenantsResponse = z.object({ tenants: z.array(identityTenant) });
-//# sourceMappingURL=identity-tenants.js.map

package/dist/identity-tenants.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity-tenants.js","sourceRoot":"","sources":["../src/identity-tenants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,yBAAyB,CAAC;AAE5D;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,EAAE,EAAE,QAAQ;IACZ,IAAI;IACJ,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,qGAAqG;IACrG,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;CACtB,CAAC,CAAC;AAEH,8DAA8D;AAC9D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC"}

package/dist/transport.d.ts

@@ -1,56 +0,0 @@
-import type { ConnectionProbe } from '@substrat-run/contracts';
-/**
- * The one HTTP seam every control-plane caller shares (#971): how a request is
- * authenticated, how a failure is read, and what an empty answer is. The callers
- * differ in what they ask — `ControlPlaneClient` is the vertical's connect seam,
- * `ControlPlaneStaffClient` the console's staff surface — not in how they ask it.
- *
- * Browser-safe: nothing here reaches past `fetch` and `@substrat-run/contracts`, which is
- * why the console can import it (`@substrat-run/control-plane-api/client`).
- */
-export interface ControlPlaneTransportOptions {
-    /** Base URL of the control-plane API; a path such as `/api` is fine in a browser. */
-    baseUrl: string;
-    /**
-     * The dev-only `x-platform-actor` header, sent only when no `serviceToken` is set. `null`
-     * sends none: the console's session mode, where the staff cookie authenticates instead.
-     */
-    actor: string | null;
-    serviceToken?: string;
-    fetch?: typeof globalThis.fetch;
-    /** Passed to `fetch` only when set — `'include'` carries the console's staff session cookie. */
-    credentials?: RequestCredentials;
-}
-/** A non-2xx (or unreachable) control-plane response. `status` is 0 on a transport error. */
-export declare class ControlPlaneError extends Error {
-    readonly status: number;
-    /**
-     * The provider's own answer, when the plane refused a connect because the credential
-     * was rejected upstream (#605, 422). Carried so a console can show WHY — "Scrive:
-     * No valid access credentials were provided" — instead of a generic save failure.
-     */
-    readonly probe?: ConnectionProbe | undefined;
-    constructor(status: number, message: string, 
-    /**
-     * The provider's own answer, when the plane refused a connect because the credential
-     * was rejected upstream (#605, 422). Carried so a console can show WHY — "Scrive:
-     * No valid access credentials were provided" — instead of a generic save failure.
-     */
-    probe?: ConnectionProbe | undefined);
-}
-export declare class ControlPlaneTransport {
-    private readonly baseUrl;
-    private readonly actor;
-    private readonly serviceToken?;
-    private readonly fetchImpl;
-    private readonly credentials?;
-    constructor(options: ControlPlaneTransportOptions);
-    /**
-     * One request, and the one place a failure is read: a transport error or a non-2xx answer
-     * throws `ControlPlaneError`, so what comes back is always a successful `Response`. A 404
-     * is handed back as-is when the caller allows it.
-     */
-    protected send(path: string, init?: RequestInit, allow404?: boolean): Promise<Response>;
-    protected call<T>(path: string, init?: RequestInit, allow404?: boolean): Promise<T>;
-}
-//# sourceMappingURL=transport.d.ts.map

package/dist/transport.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAI/D;;;;;;;;GAQG;AACH,MAAM,WAAW,4BAA4B;IAC3C,qFAAqF;IACrF,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAChC,gGAAgG;IAChG,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC;AAED,6FAA6F;AAC7F,qBAAa,iBAAkB,SAAQ,KAAK;IAExC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAEvB;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe;IARlC,YACW,MAAM,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM;IACf;;;;OAIG;IACM,KAAK,CAAC,EAAE,eAAe,YAAA,EAIjC;CACF;AAED,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgB;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0B;IACpD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAqB;IAElD,YAAY,OAAO,EAAE,4BAA4B,EAShD;IAED;;;;OAIG;IACH,UAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,EAAE,QAAQ,UAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwC1F;IAED,UAAgB,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,EAAE,QAAQ,UAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAItF;CACF"}

package/dist/transport.js

@@ -1,88 +0,0 @@
-import { problemDetail } from '@substrat-run/contracts';
-import { DEV_ACTOR_HEADER, SERVICE_TOKEN_HEADER } from './auth.js';
-/** A non-2xx (or unreachable) control-plane response. `status` is 0 on a transport error. */
-export class ControlPlaneError extends Error {
-    status;
-    probe;
-    constructor(status, message, 
-    /**
-     * The provider's own answer, when the plane refused a connect because the credential
-     * was rejected upstream (#605, 422). Carried so a console can show WHY — "Scrive:
-     * No valid access credentials were provided" — instead of a generic save failure.
-     */
-    probe) {
-        super(message);
-        this.status = status;
-        this.probe = probe;
-        this.name = 'ControlPlaneError';
-    }
-}
-export class ControlPlaneTransport {
-    baseUrl;
-    actor;
-    serviceToken;
-    fetchImpl;
-    credentials;
-    constructor(options) {
-        this.baseUrl = options.baseUrl.replace(/\/$/, '');
-        this.actor = options.actor;
-        this.serviceToken = options.serviceToken;
-        this.credentials = options.credentials;
-        // Bind to globalThis: workerd throws "Illegal invocation" if `fetch` is called
-        // with a `this` other than the global scope (which `this.fetchImpl(...)` would
-        // otherwise set to this instance). An injected fetch is used as-is.
-        this.fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);
-    }
-    /**
-     * One request, and the one place a failure is read: a transport error or a non-2xx answer
-     * throws `ControlPlaneError`, so what comes back is always a successful `Response`. A 404
-     * is handed back as-is when the caller allows it.
-     */
-    async send(path, init, allow404 = false) {
-        let res;
-        try {
-            res = await this.fetchImpl(`${this.baseUrl}${path}`, {
-                ...init,
-                ...(this.credentials ? { credentials: this.credentials } : {}),
-                headers: {
-                    // One credential per request (#980): a service token identifies the caller as
-                    // the plane's service actor and is checked BEFORE the dev-actor stub, so the
-                    // actor header would be ignored there — and a dev-only header has no business
-                    // leaving a production caller at all. Without a token, the actor header IS the
-                    // (local, UNSAFE) credential.
-                    ...(this.serviceToken
-                        ? { [SERVICE_TOKEN_HEADER]: this.serviceToken }
-                        : this.actor !== null
-                            ? { [DEV_ACTOR_HEADER]: this.actor }
-                            : {}),
-                    'content-type': 'application/json',
-                    ...init?.headers,
-                },
-            });
-        }
-        catch (e) {
-            // A transport failure (control plane down) must fail closed, not silently
-            // pass — a vertical that cannot reach the authority does not get to run.
-            throw new ControlPlaneError(0, `control plane unreachable: ${e.message}`);
-        }
-        if (res.status === 404 && allow404)
-            return res;
-        if (!res.ok) {
-            // `problemDetail` is the one reading of a failed body (#971): the RFC 9457
-            // `detail` first, the deprecated `error` duplicate second, both against the
-            // published schema — so this works either way, and keeps working the day the
-            // duplicate is deleted. The status line is the fallback only when the body
-            // said nothing readable.
-            const body = await res.json().catch(() => null);
-            throw new ControlPlaneError(res.status, problemDetail(body) ?? `${res.status} ${res.statusText}`);
-        }
-        return res;
-    }
-    async call(path, init, allow404 = false) {
-        const res = await this.send(path, init, allow404);
-        if (res.status === 404 && allow404)
-            return undefined;
-        return res.status === 204 ? undefined : (await res.json());
-    }
-}
-//# sourceMappingURL=transport.js.map

package/dist/transport.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"transport.js","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAGxD,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAyBnE,6FAA6F;AAC7F,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAE/B,MAAM;IAON,KAAK;IARhB,YACW,MAAc,EACvB,OAAe;IACf;;;;OAIG;IACM,KAAuB;QAEhC,KAAK,CAAC,OAAO,CAAC,CAAC;sBATN,MAAM;qBAON,KAAK;QAGd,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,OAAO,qBAAqB;IACf,OAAO,CAAS;IAChB,KAAK,CAAgB;IACrB,YAAY,CAAU;IACtB,SAAS,CAA0B;IACnC,WAAW,CAAsB;IAElD,YAAY,OAAqC;QAC/C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,+EAA+E;QAC/E,+EAA+E;QAC/E,oEAAoE;QACpE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtE,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,IAAkB,EAAE,QAAQ,GAAG,KAAK;QACrE,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;gBACnD,GAAG,IAAI;gBACP,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,OAAO,EAAE;oBACP,8EAA8E;oBAC9E,6EAA6E;oBAC7E,8EAA8E;oBAC9E,+EAA+E;oBAC/E,8BAA8B;oBAC9B,GAAG,CAAC,IAAI,CAAC,YAAY;wBACnB,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE;wBAC/C,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI;4BACnB,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE;4BACpC,CAAC,CAAC,EAAE,CAAC;oBACT,cAAc,EAAE,kBAAkB;oBAClC,GAAG,IAAI,EAAE,OAAO;iBACjB;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,0EAA0E;YAC1E,yEAAyE;YACzE,MAAM,IAAI,iBAAiB,CAAC,CAAC,EAAE,8BAA+B,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ;YAAE,OAAO,GAAG,CAAC;QAC/C,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,2EAA2E;YAC3E,4EAA4E;YAC5E,6EAA6E;YAC7E,2EAA2E;YAC3E,yBAAyB;YACzB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAChD,MAAM,IAAI,iBAAiB,CACzB,GAAG,CAAC,MAAM,EACV,aAAa,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CACzD,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAES,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAkB,EAAE,QAAQ,GAAG,KAAK;QACxE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAClD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ;YAAE,OAAO,SAAc,CAAC;QAC1D,OAAO,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAE,SAAe,CAAC,CAAC,CAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAO,CAAC;IAC3E,CAAC;CACF"}