@substrat-run/control-plane-api 0.134.0 → 0.136.0

package/dist/auth.d.ts

@@ -14,19 +14,8 @@ import { type OnBehalfOf, type PlatformActorId, type TenantId } from '@substrat-
  * the log cannot name is exactly that.
  */
 export type PlatformActorAuth = (request: Request) => Promise<PlatformActorId | null> | PlatformActorId | null;
-/** Header the dev stub reads. Mirrors the demos' `x-principal` dev affordance. */
-export declare const DEV_ACTOR_HEADER = "x-platform-actor";
-/** Header a SERVICE (a vertical registering itself) presents — not a staff subject. */
-export declare const SERVICE_TOKEN_HEADER = "x-service-token";
-/**
- * Header naming the tenant a caller ACTS FOR. For a builder session it selects the
- * workspace (`--tenant`) the builder reader narrows to. For a staff/service caller it is
- * the slug-resolution pin (#417): vertical routes form `<tenantSlug>/<slug>` from it the
- * way a pinned push does, so `versions <bare> --tenant <t>` over a service token reaches
- * the same registry row a builder session would. It never widens access — staff reach
- * everything already, and for builders the tenant must be one of their memberships.
- */
-export declare const TENANT_HEADER = "x-substrat-tenant";
+import { DEV_ACTOR_HEADER, SERVICE_TOKEN_HEADER, TENANT_HEADER } from '@substrat-run/control-plane-client';
+export { DEV_ACTOR_HEADER, SERVICE_TOKEN_HEADER, TENANT_HEADER };
 /**
  * A service credential (open decision 2): a shared bearer token that resolves to
  * a fixed service actor. This is how a *vertical* authenticates to the control

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAEhH;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,eAAe,GAAG,IAAI,CAAC;AAE/G,kFAAkF;AAClF,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD,uFAAuF;AACvF,eAAO,MAAM,oBAAoB,oBAAoB,CAAC;AAEtD;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,sBAAsB,CAAC;AAEjD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,iBAAiB,CAQzF;AAED,kFAAkF;AAClF,wBAAgB,sBAAsB,CAAC,GAAG,KAAK,EAAE,iBAAiB,EAAE,GAAG,iBAAiB,CAQvF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,IAAI,iBAAiB,CAO/D;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,kFAAkF;AAClF,MAAM,MAAM,kBAAkB,GAAG,CAC/B,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,aAAa,GAAG,IAAI,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAC/B,QAAQ,EAAE,aAAa,KACpB,eAAe,GAAG,IAAI,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;AAE9D;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,kBAAkB,EAC/B,YAAY,EAAE,kBAAkB,GAC/B,iBAAiB,CAMnB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,aAAa,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,CAAC,GAChE,kBAAkB,CAGpB;AAUD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,eAAe,CAAC;IACvB,QAAQ,EAAE,QAAQ,CAAC;IACnB;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,CACxB,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,eAAe,GAAG,IAAI,CAAC;AAE9D,+FAA+F;AAC/F,wBAAgB,gBAAgB,CAAC,GAAG,KAAK,EAAE,WAAW,EAAE,GAAG,WAAW,CAQrE;AAcD;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,eAAe,CAAC;IACvB,QAAQ,EAAE,QAAQ,CAAC;IACnB;;;OAGG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,qBAAqB,GAAG,IAAI,CAAC;AAE1E;;;;;;;;;GASG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAKnF;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,UAAU,CAAC,EAAE,UAAU,CAAA;CAAE,CAAC;AAE5F;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,IAAI,CAE5D"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAEhH;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,eAAe,GAAG,IAAI,CAAC;AAI/G,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAC3G,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,aAAa,EAAE,CAAC;AAEjE;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,iBAAiB,CAQzF;AAED,kFAAkF;AAClF,wBAAgB,sBAAsB,CAAC,GAAG,KAAK,EAAE,iBAAiB,EAAE,GAAG,iBAAiB,CAQvF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,IAAI,iBAAiB,CAO/D;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,kFAAkF;AAClF,MAAM,MAAM,kBAAkB,GAAG,CAC/B,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,aAAa,GAAG,IAAI,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAC/B,QAAQ,EAAE,aAAa,KACpB,eAAe,GAAG,IAAI,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;AAE9D;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,kBAAkB,EAC/B,YAAY,EAAE,kBAAkB,GAC/B,iBAAiB,CAMnB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,aAAa,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,CAAC,GAChE,kBAAkB,CAGpB;AAUD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,eAAe,CAAC;IACvB,QAAQ,EAAE,QAAQ,CAAC;IACnB;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,CACxB,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,eAAe,GAAG,IAAI,CAAC;AAE9D,+FAA+F;AAC/F,wBAAgB,gBAAgB,CAAC,GAAG,KAAK,EAAE,WAAW,EAAE,GAAG,WAAW,CAQrE;AAcD;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,eAAe,CAAC;IACvB,QAAQ,EAAE,QAAQ,CAAC;IACnB;;;OAGG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,qBAAqB,GAAG,IAAI,CAAC;AAE1E;;;;;;;;;GASG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAKnF;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,UAAU,CAAC,EAAE,UAAU,CAAA;CAAE,CAAC;AAE5F;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,IAAI,CAE5D"}

package/dist/auth.js

@@ -1,17 +1,8 @@
 import { platformActorId } from '@substrat-run/contracts';
-/** Header the dev stub reads. Mirrors the demos' `x-principal` dev affordance. */
-export const DEV_ACTOR_HEADER = 'x-platform-actor';
-/** Header a SERVICE (a vertical registering itself) presents — not a staff subject. */
-export const SERVICE_TOKEN_HEADER = 'x-service-token';
-/**
- * Header naming the tenant a caller ACTS FOR. For a builder session it selects the
- * workspace (`--tenant`) the builder reader narrows to. For a staff/service caller it is
- * the slug-resolution pin (#417): vertical routes form `<tenantSlug>/<slug>` from it the
- * way a pinned push does, so `versions <bare> --tenant <t>` over a service token reaches
- * the same registry row a builder session would. It never widens access — staff reach
- * everything already, and for builders the tenant must be one of their memberships.
- */
-export const TENANT_HEADER = 'x-substrat-tenant';
+// The header names live in the client package, which every caller can import without taking
+// this server with it; this module re-exports them so the server reads the same spelling.
+import { DEV_ACTOR_HEADER, SERVICE_TOKEN_HEADER, TENANT_HEADER } from '@substrat-run/control-plane-client';
+export { DEV_ACTOR_HEADER, SERVICE_TOKEN_HEADER, TENANT_HEADER };
 /**
  * A service credential (open decision 2): a shared bearer token that resolves to
  * a fixed service actor. This is how a *vertical* authenticates to the control

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAwD,MAAM,yBAAyB,CAAC;AAkBhH,kFAAkF;AAClF,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAEnD,uFAAuF;AACvF,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAEjD;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,KAAsB;IACpE,OAAO,CAAC,OAAO,EAAE,EAAE;QACjB,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAC5D,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAC3E,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,IAAI,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC7F,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,sBAAsB,CAAC,GAAG,KAA0B;IAClE,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO,CAAC,OAAO,EAAE,EAAE;QACjB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC,CAAC;AACJ,CAAC;AA0BD;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAA+B,EAC/B,YAAgC;IAEhC,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,OAAO,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAiE;IAEjE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1E,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,IAAI,CAAC;AACrE,CAAC;AA0CD,+FAA+F;AAC/F,MAAM,UAAU,gBAAgB,CAAC,GAAG,KAAoB;IACtD,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;QAChC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AA2DD;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,CAAY;IACzC,OAAO,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAChD,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAwD,MAAM,yBAAyB,CAAC;AAkBhH,4FAA4F;AAC5F,0FAA0F;AAC1F,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAC3G,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,aAAa,EAAE,CAAC;AAEjE;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,KAAsB;IACpE,OAAO,CAAC,OAAO,EAAE,EAAE;QACjB,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAC5D,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAC3E,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,IAAI,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC7F,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,sBAAsB,CAAC,GAAG,KAA0B;IAClE,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO,CAAC,OAAO,EAAE,EAAE;QACjB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC,CAAC;AACJ,CAAC;AA0BD;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAA+B,EAC/B,YAAgC;IAEhC,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,OAAO,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAiE;IAEjE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1E,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,IAAI,CAAC;AACrE,CAAC;AA0CD,+FAA+F;AAC/F,MAAM,UAAU,gBAAgB,CAAC,GAAG,KAAoB;IACtD,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;QAChC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AA2DD;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,CAAY;IACzC,OAAO,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAChD,CAAC"}

package/dist/browser.d.ts

@@ -1,12 +1,12 @@
 /**
  * The browser-safe entry (`@substrat-run/control-plane-api/browser`, #971): the typed
  * client a staff console runs in a page, and the types it renders. Everything reachable
- * from here is `fetch` + `@substrat-run/contracts` + type-only imports — never `hono`,
- * never a Node builtin — so a bundler can follow it without pulling the server in.
+ * from here is `fetch` + `@substrat-run/contracts` + `@substrat-run/control-plane-client`
+ * (itself only those two) + type-only imports — never `hono`, never a Node builtin — so a
+ * bundler can follow it without pulling the server in.
  * `test/browser-entry.test.ts` holds that line.
  */
 export { ControlPlaneStaffClient } from './staff-client.js';
 export type { AdminLogPage, AuditLogQuery, BindHostnameInput, ConnectionHealthQuery, ConnectorCallsBucket, DoNamespace, EgressReport, IssuesQuery, MembersReading, ObservedEgressRow, OpsFailuresQuery, PageQuery, PlatformRuntime, ProvisionScopeInput, RebindScopeResult, RecentLogEvent, ScopeHealth, ServiceMetricsRow, StaffMember, SweepRunsQuery, SystemSwitchesQuery, TenantStores, } from './staff-client.js';
-export { ControlPlaneError } from './transport.js';
-export type { ControlPlaneTransportOptions } from './transport.js';
+export * from '@substrat-run/control-plane-client';
 //# sourceMappingURL=browser.d.ts.map

package/dist/browser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../src/browser.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,YAAY,EACV,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,SAAS,EACT,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,mBAAmB,EACnB,YAAY,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,YAAY,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../src/browser.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,YAAY,EACV,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,SAAS,EACT,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,mBAAmB,EACnB,YAAY,GACb,MAAM,mBAAmB,CAAC;AAG3B,cAAc,oCAAoC,CAAC"}

package/dist/browser.js

@@ -1,10 +1,13 @@
 /**
  * The browser-safe entry (`@substrat-run/control-plane-api/browser`, #971): the typed
  * client a staff console runs in a page, and the types it renders. Everything reachable
- * from here is `fetch` + `@substrat-run/contracts` + type-only imports — never `hono`,
- * never a Node builtin — so a bundler can follow it without pulling the server in.
+ * from here is `fetch` + `@substrat-run/contracts` + `@substrat-run/control-plane-client`
+ * (itself only those two) + type-only imports — never `hono`, never a Node builtin — so a
+ * bundler can follow it without pulling the server in.
  * `test/browser-entry.test.ts` holds that line.
  */
 export { ControlPlaneStaffClient } from './staff-client.js';
-export { ControlPlaneError } from './transport.js';
+// The client package's whole surface, so a caller of either entry reaches it from here and
+// no existing import moved (#971). `test/reexports.test.ts` pins that nothing is missing.
+export * from '@substrat-run/control-plane-client';
 //# sourceMappingURL=browser.js.map

package/dist/browser.js.map

@@ -1 +1 @@
-{"version":3,"file":"browser.js","sourceRoot":"","sources":["../src/browser.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAyB5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"browser.js","sourceRoot":"","sources":["../src/browser.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAyB5D,2FAA2F;AAC3F,0FAA0F;AAC1F,cAAc,oCAAoC,CAAC"}

package/dist/cf-observability.d.ts

@@ -1,5 +1,11 @@
 import { type CubeStore } from './aggregate-source.js';
 import type { ObservabilityReader } from './observability.js';
+/**
+ * An HTTP method as RFC 9110 §9.1 defines it: a `token` (§5.6.2), one or more `tchar`.
+ * Not `[A-Z]+`: the writer records `Request.method` verbatim, and `M-SEARCH` and `X1` are
+ * methods too.
+ */
+export declare const HTTP_METHOD_PATTERN = "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$";
 /**
  * The Cloudflare implementation of the observability seam (`observability.ts`) —
  * GraphQL invocation analytics + the Workers Observability telemetry query API,

package/dist/cf-observability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cf-observability.d.ts","sourceRoot":"","sources":["../src/cf-observability.ts"],"names":[],"mappings":"AAEA,OAAO,EAAqE,KAAK,SAAS,EAAuB,MAAM,uBAAuB,CAAC;AAG/I,OAAO,KAAK,EACV,mBAAmB,EASpB,MAAM,oBAAoB,CAAC;AAqa5B;;;;;;;;GAQG;AACH,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;;;OAgBG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;OASG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAuED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,sBAAsB,GAAG,mBAAmB,CA8uC7F"}
+{"version":3,"file":"cf-observability.d.ts","sourceRoot":"","sources":["../src/cf-observability.ts"],"names":[],"mappings":"AAEA,OAAO,EAAqE,KAAK,SAAS,EAAuB,MAAM,uBAAuB,CAAC;AAG/I,OAAO,KAAK,EACV,mBAAmB,EASpB,MAAM,oBAAoB,CAAC;AAG5B;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,kCAAkC,CAAC;AA0enE;;;;;;;;GAQG;AACH,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;;;OAgBG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;OASG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAuED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,sBAAsB,GAAG,mBAAmB,CAywC7F"}

package/dist/cf-observability.js

@@ -1,9 +1,23 @@
 import { resolveObservabilityWindow, observabilityBucketMinutes } from './observability-window.js';
-import { ControlPlaneError } from './client.js';
+import { ControlPlaneError } from '@substrat-run/control-plane-client';
 import { cachedSource, cutOverSource } from './aggregate-source.js';
 import { stableDeploymentRefFor } from './deploy.js';
 import { aggregateReads } from './aggregate-reads.js';
-import { TENANT_METRICS_LIMIT, REQUEST_FACET_KEYS } from './observability.js';
+import { TENANT_METRICS_LIMIT, REQUEST_FACET_KEYS, INVOCATION_KINDS, invocationKindOf } from './observability.js';
+/**
+ * An HTTP method as RFC 9110 §9.1 defines it: a `token` (§5.6.2), one or more `tchar`.
+ * Not `[A-Z]+`: the writer records `Request.method` verbatim, and `M-SEARCH` and `X1` are
+ * methods too.
+ */
+export const HTTP_METHOD_PATTERN = "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$";
+/**
+ * #1901: a request's line, as a filter. Every request line carries its HTTP method — the
+ * lines written before `kind` existed included — and an async line's `method` is `null`,
+ * so this is the `kind = request` the lines themselves cannot spell.
+ */
+const REQUEST_LINE_FILTER = { key: 'method', operation: 'regex', type: 'string', value: HTTP_METHOD_PATTERN };
+/** #1901: the kinds of async work a scope host logs — every kind but a request. */
+const ASYNC_KINDS = INVOCATION_KINDS.filter((k) => k !== 'request');
 /**
  * The filters for a tenant's stamped invocation lines (#1746), with the facet filters ANDed
  * on. `omit` leaves one facet's own filter out, which is how a facet is counted "with every
@@ -29,6 +43,14 @@ function requestFilters(scope, omit) {
         const values = scope.where?.[key] ?? [];
         if (values.length === 0)
             continue;
+        // #1901: `request` is a kind no line spells — a request's line has no `kind` — so it is
+        // matched by what every request line has and no async line does: a method. Narrowed
+        // HERE, before the limit, so a window full of async lines still pages its requests.
+        if (key === 'kind') {
+            const kinds = values.map((v) => v === 'request' ? REQUEST_LINE_FILTER : { key: 'kind', operation: 'eq', type: 'string', value: v });
+            filters.push(kinds.length === 1 ? kinds[0] : { kind: 'group', filterCombination: 'or', filters: kinds });
+            continue;
+        }
         const leaves = values.map((v) => key === 'status'
             ? { key, operation: 'eq', type: 'number', value: Number(v) }
             : { key, operation: 'eq', type: 'string', value: v });
@@ -116,6 +138,13 @@ function countOf(p) {
 function sampled(p) {
     return typeof p.sampleInterval === 'number' && p.sampleInterval > 1;
 }
+/** #1901: does a raw line pass the scope's `kind` selection, a missing `kind` read as `request`? */
+function kindMatches(e, scope) {
+    const values = scope.where?.kind ?? [];
+    if (values.length === 0)
+        return true;
+    return values.includes(invocationKindOf((e['source'] ?? {})['kind']));
+}
 /** The stamped line of a raw event, as the Requests view lists it. */
 function requestRecordOf(e) {
     const source = (e['source'] ?? {});
@@ -141,6 +170,12 @@ function requestRecordOf(e) {
         eventTypes: strings(source['eventTypes']),
         entities: strings(source['entities']),
         versionId: str(source['versionId']),
+        kind: invocationKindOf(source['kind']),
+        outcome: str(source['outcome']),
+        eventType: str(source['eventType']),
+        eventId: str(source['eventId']),
+        attempt: num(source['attempt']),
+        latenessMs: num(source['latenessMs']),
     };
 }
 /**
@@ -219,6 +254,16 @@ function describeInvocation(e) {
     const source = (e.raw?.['source'] ?? {});
     if (source['substrat'] !== 'invocation')
         return e;
+    // #1901: async work has no method, path or status — it says what ran and how it ended.
+    const kind = invocationKindOf(source['kind']);
+    if (kind !== 'request') {
+        return {
+            ...e,
+            invocationId: typeof source['invocationId'] === 'string' ? source['invocationId'] : null,
+            message: describeAsync(kind, source),
+            level: e.level ?? (typeof source['level'] === 'string' ? source['level'] : null),
+        };
+    }
     const method = typeof source['method'] === 'string' ? source['method'] : '?';
     const path = typeof source['path'] === 'string' ? source['path'] : '?';
     const status = typeof source['status'] === 'number' ? source['status'] : null;
@@ -239,6 +284,31 @@ function describeInvocation(e) {
         level: e.level ?? (isFailedInvocation(e) ? 'error' : 'info'),
     };
 }
+/**
+ * #1901: an async line's message, from its own fields — names and counts only, as the line
+ * carries nothing else:
+ *
+ * - `consumer notify ← ticket.created (attempt 2) → retrying (12 ms)`
+ * - `schedule digest/send → ok (40 ms, 1200 ms late)`
+ * - `consumer: 5 more lines withheld (consumer:dead-lettered 5)`
+ */
+function describeAsync(kind, source) {
+    const n = (v) => (typeof v === 'number' ? v : null);
+    const outcome = str(source['outcome']) ?? '—';
+    if (outcome === 'suppressed') {
+        const by = (source['suppressedBy'] ?? {});
+        const parts = Object.entries(by).map(([k, v]) => `${k} ${String(v)}`);
+        return `${kind}: ${n(source['suppressed']) ?? '?'} more lines withheld${parts.length ? ` (${parts.join(', ')})` : ''}`;
+    }
+    const operation = str(source['operation']) ?? '?';
+    const ms = n(source['durationMs']);
+    const late = n(source['latenessMs']);
+    const timing = [ms === null ? null : `${ms} ms`, late === null ? null : `${late} ms late`].filter(Boolean).join(', ');
+    const subject = kind === 'consumer'
+        ? `${operation} ← ${str(source['eventType']) ?? '?'}${n(source['attempt']) === null ? '' : ` (attempt ${n(source['attempt'])})`}`
+        : operation;
+    return `${kind} ${subject} → ${outcome}${timing ? ` (${timing})` : ''}`;
+}
 /**
  * The filters for a tenant's `ctx.log` lines (#1746/#1747). The tenant predicate first and
  * always, as for the invocation line; everything else is one more equality on a field the
@@ -463,38 +533,17 @@ export function createCfObservabilityReader(opts) {
      */
     const telemetry = {
         async requests(q) {
-            const { rows, estimated, complete } = await countGrouped(q, 'invocation', [
-                { type: 'string', value: 'tenantId' },
-                { type: 'string', value: 'scopeId' },
-                { type: 'string', value: 'level' },
-                { type: 'string', value: 'operation' },
-                { type: 'string', value: 'problemCode' },
-                { type: 'string', value: 'principalKind' },
-                { type: 'string', value: 'surface' },
-                { type: 'number', value: 'status' },
+            return requestCube(q);
+        },
+        // #1901: the async lines alone, for the part of a window the router's datapoints serve.
+        async asyncRequests(q) {
+            return requestCube(q, [
+                {
+                    kind: 'group',
+                    filterCombination: 'or',
+                    filters: ASYNC_KINDS.map((value) => ({ key: 'kind', operation: 'eq', type: 'string', value })),
+                },
             ]);
-            return {
-                estimated,
-                complete,
-                rows: rows.flatMap(({ bucket, groups, count }) => {
-                    const tenantId = str(groups.get('tenantId'));
-                    if (tenantId === null)
-                        return [];
-                    const status = groups.get('status');
-                    return [{
-                            bucket,
-                            tenantId,
-                            scopeId: str(groups.get('scopeId')),
-                            level: str(groups.get('level')),
-                            operation: str(groups.get('operation')),
-                            problemCode: str(groups.get('problemCode')),
-                            principalKind: str(groups.get('principalKind')),
-                            surface: str(groups.get('surface')),
-                            status: typeof status === 'number' ? status : typeof status === 'string' && status !== '' ? Number(status) : null,
-                            count,
-                        }];
-                }),
-            };
         },
         async patterns(q) {
             const { rows, estimated, complete } = await countGrouped(q, 'log', [
@@ -517,6 +566,43 @@ export function createCfObservabilityReader(opts) {
             };
         },
     };
+    /** The request cube over stamped lines, grouped by every facet (#1746) and `kind` (#1901). */
+    async function requestCube(q, extra = []) {
+        const { rows, estimated, complete } = await countGrouped(q, 'invocation', [
+            { type: 'string', value: 'tenantId' },
+            { type: 'string', value: 'scopeId' },
+            { type: 'string', value: 'level' },
+            { type: 'string', value: 'operation' },
+            { type: 'string', value: 'problemCode' },
+            { type: 'string', value: 'principalKind' },
+            { type: 'string', value: 'surface' },
+            { type: 'number', value: 'status' },
+            { type: 'string', value: 'kind' },
+        ], extra);
+        return {
+            estimated,
+            complete,
+            rows: rows.flatMap(({ bucket, groups, count }) => {
+                const tenantId = str(groups.get('tenantId'));
+                if (tenantId === null)
+                    return [];
+                const status = groups.get('status');
+                return [{
+                        bucket,
+                        tenantId,
+                        scopeId: str(groups.get('scopeId')),
+                        level: str(groups.get('level')),
+                        operation: str(groups.get('operation')),
+                        problemCode: str(groups.get('problemCode')),
+                        principalKind: str(groups.get('principalKind')),
+                        surface: str(groups.get('surface')),
+                        status: typeof status === 'number' ? status : typeof status === 'string' && status !== '' ? Number(status) : null,
+                        kind: str(groups.get('kind')),
+                        count,
+                    }];
+            }),
+        };
+    }
     const logs = opts.cubeStore ? cachedSource(telemetry, opts.cubeStore) : telemetry;
     const routerSince = opts.requestsFromRouterSince ? Date.parse(opts.requestsFromRouterSince) : undefined;
     const routerDataset = opts.routerDataset;
@@ -637,10 +723,13 @@ export function createCfObservabilityReader(opts) {
      * answer with no order to trust. Only a single grain that is still full is paged, and a
      * cube built that way is marked incomplete so the cache never keeps it as final.
      */
-    async function countGrouped(q, kind, groupBys) {
+    async function countGrouped(q, kind, groupBys, 
+    /** #1901: more filters ANDed on — the async cube's `kind`. */
+    extra = []) {
         const filters = [
             ...serviceFilter([q.service]),
             { key: 'substrat', operation: 'eq', type: 'string', value: kind },
+            ...extra,
         ];
         const once = async (from, to, offsetBy) => {
             const calc = await queryCalculation(filters, { from, to }, {
@@ -839,6 +928,9 @@ export function createCfObservabilityReader(opts) {
         async tenantRequests(input) {
             const events = await queryRaw(requestFilters(input), { from: input.from, to: input.to }, input.limit);
             return events
+                // #1901: the query narrowed on kind already; this holds the answer to the same
+                // reading (a missing `kind` is a request) whatever the backend did with the filter.
+                .filter((e) => kindMatches(e, input))
                 .sort((a, b) => rawTime(b) - rawTime(a))
                 .slice(0, input.limit)
                 .map(requestRecordOf);