@substrat-run/control-plane-api 0.142.0 → 0.144.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/api.d.ts +8 -0
- package/dist/api.d.ts.map +1 -1
- package/dist/api.js +152 -82
- package/dist/api.js.map +1 -1
- package/dist/connect-links.d.ts.map +1 -1
- package/dist/connect-links.js +2 -1
- package/dist/connect-links.js.map +1 -1
- package/dist/connect-state.d.ts +104 -0
- package/dist/connect-state.d.ts.map +1 -0
- package/dist/connect-state.js +129 -0
- package/dist/connect-state.js.map +1 -0
- package/dist/connect-url.d.ts.map +1 -1
- package/dist/connect-url.js +2 -1
- package/dist/connect-url.js.map +1 -1
- package/dist/index.d.ts +4 -2
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +2 -1
- package/dist/index.js.map +1 -1
- package/dist/platform-drain.d.ts +17 -0
- package/dist/platform-drain.d.ts.map +1 -1
- package/dist/platform-drain.js +48 -27
- package/dist/platform-drain.js.map +1 -1
- package/dist/platform-entry.d.ts +3 -1
- package/dist/platform-entry.d.ts.map +1 -1
- package/dist/platform-entry.generated.d.ts +1 -1
- package/dist/platform-entry.generated.d.ts.map +1 -1
- package/dist/platform-entry.generated.js +2 -2
- package/dist/platform-entry.generated.js.map +1 -1
- package/dist/platform-entry.js +41 -7
- package/dist/platform-entry.js.map +1 -1
- package/dist/scope-deployment.d.ts +33 -0
- package/dist/scope-deployment.d.ts.map +1 -1
- package/dist/scope-deployment.js +38 -0
- package/dist/scope-deployment.js.map +1 -1
- package/dist/staff-client.d.ts +2 -1
- package/dist/staff-client.d.ts.map +1 -1
- package/dist/staff-client.js +3 -0
- package/dist/staff-client.js.map +1 -1
- package/dist/vertical-client.d.ts +16 -4
- package/dist/vertical-client.d.ts.map +1 -1
- package/dist/vertical-client.js +34 -1
- package/dist/vertical-client.js.map +1 -1
- package/package.json +7 -6
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"connect-links.d.ts","sourceRoot":"","sources":["../src/connect-links.ts"],"names":[],"mappings":"AAAA,OAAO,
|
|
1
|
+
{"version":3,"file":"connect-links.d.ts","sourceRoot":"","sources":["../src/connect-links.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEtE,OAAO,EAKL,KAAK,WAAW,EAChB,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC3B,KAAK,4BAA4B,EACjC,KAAK,eAAe,EACpB,KAAK,eAAe,EAIrB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAuD,KAAK,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAEpH;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,6FAA6F;AAC7F,eAAO,MAAM,iBAAiB,SAAU,WAAW,KAAG,eAWpD,CAAC;AA6BH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,sBAAsB,CAAC,CAgEjC;AAED,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,0BAA0B,CAAC,CAiBrC;AAED,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,4BAA4B,CAAC,CAUvC"}
|
package/dist/connect-links.js
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
|
-
import { isPrimaryScope
|
|
1
|
+
import { isPrimaryScope } from '@substrat-run/kernel';
|
|
2
|
+
import { signConnectState } from './connect-state.js';
|
|
2
3
|
import { CONNECT_LINK_DEFAULT_TTL_SECONDS, connectLinkListRelayRequest, connectLinkRelayRequest, connectLinkRevokeRelayRequest, } from '@substrat-run/contracts';
|
|
3
4
|
import { PREVIEW_CONNECTIONS_REFUSAL } from './connection-relay.js';
|
|
4
5
|
import { assertReturnUrlBelongsToScope, ConnectUrlRelayError } from './connect-url.js';
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"connect-links.js","sourceRoot":"","sources":["../src/connect-links.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,
|
|
1
|
+
{"version":3,"file":"connect-links.js","sourceRoot":"","sources":["../src/connect-links.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAkB,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EACL,gCAAgC,EAChC,2BAA2B,EAC3B,uBAAuB,EACvB,6BAA6B,GAU9B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,6BAA6B,EAAE,oBAAoB,EAA+B,MAAM,kBAAkB,CAAC;AAEpH;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,6FAA6F;AAC7F,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAAiB,EAAmB,EAAE,CAAC,CAAC;IACxE,EAAE,EAAE,IAAI,CAAC,EAAE;IACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;IACvB,MAAM,EAAE,IAAI,CAAC,MAAM;IACnB,SAAS,EAAE,IAAI,CAAC,SAAS;IACzB,UAAU,EAAE,IAAI,CAAC,UAAU;IAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;IACzB,SAAS,EAAE,IAAI,CAAC,SAAS;IACzB,MAAM,EAAE,IAAI,CAAC,MAAM;IACnB,UAAU,EAAE,IAAI,CAAC,UAAU;IAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;CAChC,CAAC,CAAC;AAEH,SAAS,UAAU,CAAyB,MAAS,EAAE,IAAa,EAAE,IAAY;IAChF,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,IAAI,oBAAoB,CAC5B,WAAW,IAAI,aAAa,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,gBAAgB,EAAE,EACjH,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,mGAAmG;AACnG,KAAK,UAAU,sBAAsB,CACnC,IAAe,EACf,KAAsB,EACtB,QAAkB,EAClB,OAAgB;IAEhB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACtE,IAAI,CAAC,GAAG,EAAE,QAAQ;QAAE,MAAM,IAAI,oBAAoB,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IACvF,qFAAqF;IACrF,4EAA4E;IAC5E,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;IAC3F,OAAO,GAAG,CAAC,QAAQ,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAe,EACf,KAAsB,EACtB,IAAa,EACb,OAA+B;IAE/B,MAAM,KAAK,GAAG,UAAU,CAAC,uBAAuB,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IAExE,wFAAwF;IACxF,6EAA6E;IAC7E,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAC5B,mFAAmF;YACjF,mDAAmD,EACrD,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,MAAM,IAAI,oBAAoB,CAC5B,2FAA2F;YACzF,2BAA2B,EAC7B,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,oBAAoB,CAC5B,aAAa,KAAK,CAAC,QAAQ,6DAA6D;YACtF,qDAAqD,EACvD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1F,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,6BAA6B,CAAC,IAAI,EAAE,KAAK,EAAE;YAC/C,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,EAAE;QACnD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ;QACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,gCAAgC,CAAC,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KAC9G,CAAC,CAAC;IACH,yFAAyF;IACzF,oCAAoC;IACpC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,cAAc,EAAE;QAC3D,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ;QACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;KAChC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC;IACrF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAe,EACf,KAAsB,EACtB,IAAa;IAEb,MAAM,KAAK,GAAG,UAAU,CAAC,2BAA2B,EAAE,IAAI,EAAE,mBAAmB,CAAC,CAAC;IACjF,MAAM,sBAAsB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACzE,yFAAyF;IACzF,yFAAyF;IACzF,wFAAwF;IACxF,qFAAqF;IACrF,0FAA0F;IAC1F,qEAAqE;IACrE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE;QACrD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,EAAE,KAAK,CAAC,OAAO;QAClB,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAe,EACf,KAAsB,EACtB,IAAa;IAEb,MAAM,KAAK,GAAG,UAAU,CAAC,6BAA6B,EAAE,IAAI,EAAE,qBAAqB,CAAC,CAAC;IACrF,MAAM,sBAAsB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,KAAK,EAAE;QACrD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,EAAE,EAAE,KAAK,CAAC,MAAM;KACjB,CAAC,CAAC;IACH,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,oBAAoB,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;IACvE,OAAO,EAAE,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3C,CAAC"}
|
|
@@ -0,0 +1,104 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* The signed state of a PLATFORM-MINTED provider consent round (connections.md §3.5.3).
|
|
3
|
+
*
|
|
4
|
+
* §3.5.1 settled how an OAuth connection is authorized: the act originates in-scope, a
|
|
5
|
+
* signed state token carries the proof, and the host-side callback effects the write
|
|
6
|
+
* stamped with the principal from that state. The dashboard's connect link is one
|
|
7
|
+
* instance of it. This is the second: a tenant admin working inside a VERTICAL — a
|
|
8
|
+
* bookkeeping bureau connecting a client company, with no dashboard account and no
|
|
9
|
+
* reason to have one — presses Connect on the vertical's own screen, and the vertical's
|
|
10
|
+
* operation is the permission-checked act.
|
|
11
|
+
*
|
|
12
|
+
* **Why an in-session claim carries no link row.** The dashboard's connect link is minted,
|
|
13
|
+
* mailed, and clicked days later by someone else, so it is a row: single-use, revocable, and
|
|
14
|
+
* dead when the minting admin loses access. A vertical-minted round is clicked in-session by
|
|
15
|
+
* the person who just pressed the button, so the row would be state nobody reads. What
|
|
16
|
+
* replaces it is the expiry — minutes, not a week — and the account leg of the connection
|
|
17
|
+
* key: a replayed round re-consents the SAME company, which the store rotates in place
|
|
18
|
+
* rather than duplicating (#1267). The consent code itself is single-use at the provider.
|
|
19
|
+
* A vertical's MAILED link is the other case again, and carries a row: `linkId`, below.
|
|
20
|
+
*
|
|
21
|
+
* **Why here.** Two workers hold the halves — the control plane mints (it owns the
|
|
22
|
+
* directory the vertical is re-derived from), the dashboard verifies (it owns the one
|
|
23
|
+
* `redirect_uri` registered with the provider) — and a MAC that two deployments must agree
|
|
24
|
+
* on is exactly the thing that must not be written twice. The mint lives in this package
|
|
25
|
+
* and the dashboard already depends on it, so one copy here serves both. It needs no
|
|
26
|
+
* kernel guarantee, which is why it left the kernel (#1978).
|
|
27
|
+
*
|
|
28
|
+
* Web Crypto only, so this file is testable in Node and runs unchanged in workerd.
|
|
29
|
+
*/
|
|
30
|
+
/** Thrown when a claim cannot be minted — never when one fails to verify (that is `null`). */
|
|
31
|
+
export declare class ConnectStateError extends Error {
|
|
32
|
+
constructor(message: string);
|
|
33
|
+
}
|
|
34
|
+
/**
|
|
35
|
+
* The purpose label, and the `:v1` is the key-derivation version. Signing key is
|
|
36
|
+
* HKDF(PLATFORM_SECRET, info = this), so a token minted here can never verify anywhere
|
|
37
|
+
* else the platform secret is presented — `/internal/provision` and the two relays
|
|
38
|
+
* compare the secret raw, and a MAC family shared with them would let a signature minted
|
|
39
|
+
* for one be replayed as the other wherever the shapes overlap (the same trap #968 fixed
|
|
40
|
+
* inside the dashboard).
|
|
41
|
+
*/
|
|
42
|
+
export declare const CONNECT_STATE_PURPOSE = "substrat-platform:connect-state:v1";
|
|
43
|
+
/**
|
|
44
|
+
* What a platform-minted consent round proves. Every field is decided by the control
|
|
45
|
+
* plane from its own directory — never taken from the caller — except `subjectRef`,
|
|
46
|
+
* which is opaque to the platform by design (see below).
|
|
47
|
+
*/
|
|
48
|
+
export interface ConnectStateClaim {
|
|
49
|
+
/** The tenant the connection lands under. */
|
|
50
|
+
tenantId: string;
|
|
51
|
+
/**
|
|
52
|
+
* The VERTICAL's scope. The callback upserts against this, and the connection store
|
|
53
|
+
* re-derives the vertical from it a second time — so a claim cannot plant a
|
|
54
|
+
* credential on a vertical other than the one that asked for the round.
|
|
55
|
+
*/
|
|
56
|
+
scopeId: string;
|
|
57
|
+
/** The vertical slug, as the directory had it at mint. Carried for the log, not for trust. */
|
|
58
|
+
vertical: string;
|
|
59
|
+
/** Provider slug (`fortnox`). */
|
|
60
|
+
provider: string;
|
|
61
|
+
/**
|
|
62
|
+
* The tenant principal whose in-scope `ctx.check` authorized the round — stamped on
|
|
63
|
+
* the connection as `createdBy`, exactly as §3.5.1 requires. Not a dashboard member.
|
|
64
|
+
*/
|
|
65
|
+
principal: string;
|
|
66
|
+
/** Where the browser is sent when the round settles; validated against the scope's own hostnames at mint. */
|
|
67
|
+
returnUrl?: string;
|
|
68
|
+
/**
|
|
69
|
+
* The vertical's OWN name for what is being connected — its client row's id. Opaque to
|
|
70
|
+
* the platform, which never parses, stores, or acts on it; it is echoed back on the
|
|
71
|
+
* return so a bureau holding two hundred outstanding rounds can attribute the one that
|
|
72
|
+
* just landed without waiting to match on an organisation number.
|
|
73
|
+
*/
|
|
74
|
+
subjectRef?: string;
|
|
75
|
+
/**
|
|
76
|
+
* Set when the round is a MAILED link (connections.md §3.5.4): the platform-held row in
|
|
77
|
+
* `_substrat_connect_links` that makes it single-use and revocable. The signature alone
|
|
78
|
+
* cannot be withdrawn, and a link lives days — so the callback asks this row, consumes it
|
|
79
|
+
* before storing, and refuses a round whose row is spent or revoked. Absent: an in-session
|
|
80
|
+
* round, which lives minutes and has no row (above). `exp` is then the row's own expiry.
|
|
81
|
+
*/
|
|
82
|
+
linkId?: string;
|
|
83
|
+
/** Epoch ms. */
|
|
84
|
+
exp: number;
|
|
85
|
+
}
|
|
86
|
+
/**
|
|
87
|
+
* `<base64url(JSON claim)>.<base64url(HMAC)>`.
|
|
88
|
+
*
|
|
89
|
+
* Refuses an unset secret rather than signing with `''` — the same law
|
|
90
|
+
* `assertPlatformCall` states: an unset secret is a failure, not a bypass. A token
|
|
91
|
+
* signed under the empty string would verify for anyone who guessed that it was.
|
|
92
|
+
*/
|
|
93
|
+
export declare function signConnectState(platformSecret: string, claim: ConnectStateClaim): Promise<string>;
|
|
94
|
+
/**
|
|
95
|
+
* The claim if the signature verifies under this deployment's platform secret and `exp`
|
|
96
|
+
* is still ahead of `now`; `null` for everything else — a forgery, a token minted with
|
|
97
|
+
* the raw secret, an expired round, a malformed string. One `null` for every failure on
|
|
98
|
+
* purpose: the caller renders one refusal, and a distinguishable error is an oracle.
|
|
99
|
+
*
|
|
100
|
+
* An unset secret verifies nothing (never throws): a deployment holding no platform
|
|
101
|
+
* secret has no platform-minted rounds to accept.
|
|
102
|
+
*/
|
|
103
|
+
export declare function verifyConnectState(platformSecret: string | undefined, token: string, now: number): Promise<ConnectStateClaim | null>;
|
|
104
|
+
//# sourceMappingURL=connect-state.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"connect-state.d.ts","sourceRoot":"","sources":["../src/connect-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,8FAA8F;AAC9F,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,uCAAuC,CAAC;AAE1E;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,8FAA8F;IAC9F,QAAQ,EAAE,MAAM,CAAC;IACjB,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,6GAA6G;IAC7G,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB;IAChB,GAAG,EAAE,MAAM,CAAC;CACb;AA6DD;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAOxG;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CA6BnC"}
|
|
@@ -0,0 +1,129 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* The signed state of a PLATFORM-MINTED provider consent round (connections.md §3.5.3).
|
|
3
|
+
*
|
|
4
|
+
* §3.5.1 settled how an OAuth connection is authorized: the act originates in-scope, a
|
|
5
|
+
* signed state token carries the proof, and the host-side callback effects the write
|
|
6
|
+
* stamped with the principal from that state. The dashboard's connect link is one
|
|
7
|
+
* instance of it. This is the second: a tenant admin working inside a VERTICAL — a
|
|
8
|
+
* bookkeeping bureau connecting a client company, with no dashboard account and no
|
|
9
|
+
* reason to have one — presses Connect on the vertical's own screen, and the vertical's
|
|
10
|
+
* operation is the permission-checked act.
|
|
11
|
+
*
|
|
12
|
+
* **Why an in-session claim carries no link row.** The dashboard's connect link is minted,
|
|
13
|
+
* mailed, and clicked days later by someone else, so it is a row: single-use, revocable, and
|
|
14
|
+
* dead when the minting admin loses access. A vertical-minted round is clicked in-session by
|
|
15
|
+
* the person who just pressed the button, so the row would be state nobody reads. What
|
|
16
|
+
* replaces it is the expiry — minutes, not a week — and the account leg of the connection
|
|
17
|
+
* key: a replayed round re-consents the SAME company, which the store rotates in place
|
|
18
|
+
* rather than duplicating (#1267). The consent code itself is single-use at the provider.
|
|
19
|
+
* A vertical's MAILED link is the other case again, and carries a row: `linkId`, below.
|
|
20
|
+
*
|
|
21
|
+
* **Why here.** Two workers hold the halves — the control plane mints (it owns the
|
|
22
|
+
* directory the vertical is re-derived from), the dashboard verifies (it owns the one
|
|
23
|
+
* `redirect_uri` registered with the provider) — and a MAC that two deployments must agree
|
|
24
|
+
* on is exactly the thing that must not be written twice. The mint lives in this package
|
|
25
|
+
* and the dashboard already depends on it, so one copy here serves both. It needs no
|
|
26
|
+
* kernel guarantee, which is why it left the kernel (#1978).
|
|
27
|
+
*
|
|
28
|
+
* Web Crypto only, so this file is testable in Node and runs unchanged in workerd.
|
|
29
|
+
*/
|
|
30
|
+
/** Thrown when a claim cannot be minted — never when one fails to verify (that is `null`). */
|
|
31
|
+
export class ConnectStateError extends Error {
|
|
32
|
+
constructor(message) {
|
|
33
|
+
super(message);
|
|
34
|
+
this.name = 'ConnectStateError';
|
|
35
|
+
}
|
|
36
|
+
}
|
|
37
|
+
/**
|
|
38
|
+
* The purpose label, and the `:v1` is the key-derivation version. Signing key is
|
|
39
|
+
* HKDF(PLATFORM_SECRET, info = this), so a token minted here can never verify anywhere
|
|
40
|
+
* else the platform secret is presented — `/internal/provision` and the two relays
|
|
41
|
+
* compare the secret raw, and a MAC family shared with them would let a signature minted
|
|
42
|
+
* for one be replayed as the other wherever the shapes overlap (the same trap #968 fixed
|
|
43
|
+
* inside the dashboard).
|
|
44
|
+
*/
|
|
45
|
+
export const CONNECT_STATE_PURPOSE = 'substrat-platform:connect-state:v1';
|
|
46
|
+
const enc = (s) => new TextEncoder().encode(s);
|
|
47
|
+
const b64url = (bytes) => {
|
|
48
|
+
let s = '';
|
|
49
|
+
for (const b of bytes)
|
|
50
|
+
s += String.fromCharCode(b);
|
|
51
|
+
return btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
|
|
52
|
+
};
|
|
53
|
+
const b64urlToBytes = (s) => {
|
|
54
|
+
const padded = s.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat((4 - (s.length % 4)) % 4);
|
|
55
|
+
const raw = atob(padded);
|
|
56
|
+
const out = new Uint8Array(raw.length);
|
|
57
|
+
for (let i = 0; i < raw.length; i++)
|
|
58
|
+
out[i] = raw.charCodeAt(i);
|
|
59
|
+
return out;
|
|
60
|
+
};
|
|
61
|
+
/** HKDF-SHA-256(ikm = the platform secret, info = the purpose) → an HMAC-SHA-256 key. */
|
|
62
|
+
async function stateKey(platformSecret) {
|
|
63
|
+
const ikm = await crypto.subtle.importKey('raw', enc(platformSecret), 'HKDF', false, ['deriveKey']);
|
|
64
|
+
return crypto.subtle.deriveKey({ name: 'HKDF', hash: 'SHA-256', salt: enc('substrat-platform'), info: enc(CONNECT_STATE_PURPOSE) }, ikm, { name: 'HMAC', hash: 'SHA-256', length: 256 }, false, ['sign', 'verify']);
|
|
65
|
+
}
|
|
66
|
+
/**
|
|
67
|
+
* `<base64url(JSON claim)>.<base64url(HMAC)>`.
|
|
68
|
+
*
|
|
69
|
+
* Refuses an unset secret rather than signing with `''` — the same law
|
|
70
|
+
* `assertPlatformCall` states: an unset secret is a failure, not a bypass. A token
|
|
71
|
+
* signed under the empty string would verify for anyone who guessed that it was.
|
|
72
|
+
*/
|
|
73
|
+
export async function signConnectState(platformSecret, claim) {
|
|
74
|
+
if (!platformSecret) {
|
|
75
|
+
throw new ConnectStateError('cannot mint a connect state: PLATFORM_SECRET is unset on this deployment');
|
|
76
|
+
}
|
|
77
|
+
const body = b64url(enc(JSON.stringify(claim)));
|
|
78
|
+
const sig = new Uint8Array(await crypto.subtle.sign('HMAC', await stateKey(platformSecret), enc(body)));
|
|
79
|
+
return `${body}.${b64url(sig)}`;
|
|
80
|
+
}
|
|
81
|
+
/**
|
|
82
|
+
* The claim if the signature verifies under this deployment's platform secret and `exp`
|
|
83
|
+
* is still ahead of `now`; `null` for everything else — a forgery, a token minted with
|
|
84
|
+
* the raw secret, an expired round, a malformed string. One `null` for every failure on
|
|
85
|
+
* purpose: the caller renders one refusal, and a distinguishable error is an oracle.
|
|
86
|
+
*
|
|
87
|
+
* An unset secret verifies nothing (never throws): a deployment holding no platform
|
|
88
|
+
* secret has no platform-minted rounds to accept.
|
|
89
|
+
*/
|
|
90
|
+
export async function verifyConnectState(platformSecret, token, now) {
|
|
91
|
+
if (!platformSecret || !token)
|
|
92
|
+
return null;
|
|
93
|
+
const parts = token.split('.');
|
|
94
|
+
if (parts.length !== 2)
|
|
95
|
+
return null;
|
|
96
|
+
const [body, sig] = parts;
|
|
97
|
+
if (!body || !sig)
|
|
98
|
+
return null;
|
|
99
|
+
let ok = false;
|
|
100
|
+
try {
|
|
101
|
+
ok = await crypto.subtle.verify('HMAC', await stateKey(platformSecret), b64urlToBytes(sig), enc(body));
|
|
102
|
+
}
|
|
103
|
+
catch {
|
|
104
|
+
return null;
|
|
105
|
+
}
|
|
106
|
+
if (!ok)
|
|
107
|
+
return null;
|
|
108
|
+
try {
|
|
109
|
+
const claim = JSON.parse(new TextDecoder().decode(b64urlToBytes(body)));
|
|
110
|
+
if (typeof claim.exp !== 'number' || claim.exp <= now)
|
|
111
|
+
return null;
|
|
112
|
+
// A verified signature proves the platform minted it; it does not prove the shape,
|
|
113
|
+
// and a claim missing one of these would reach the store as `undefined` — which is
|
|
114
|
+
// how a credential lands under the wrong key rather than not at all.
|
|
115
|
+
for (const field of ['tenantId', 'scopeId', 'vertical', 'provider', 'principal']) {
|
|
116
|
+
if (typeof claim[field] !== 'string' || !claim[field])
|
|
117
|
+
return null;
|
|
118
|
+
}
|
|
119
|
+
// A link round with a malformed row reference would read as an in-session round — the
|
|
120
|
+
// one kind the callback spends nothing for — so it is refused, never downgraded.
|
|
121
|
+
if (claim.linkId !== undefined && (typeof claim.linkId !== 'string' || !claim.linkId))
|
|
122
|
+
return null;
|
|
123
|
+
return claim;
|
|
124
|
+
}
|
|
125
|
+
catch {
|
|
126
|
+
return null;
|
|
127
|
+
}
|
|
128
|
+
}
|
|
129
|
+
//# sourceMappingURL=connect-state.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"connect-state.js","sourceRoot":"","sources":["../src/connect-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,8FAA8F;AAC9F,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,oCAAoC,CAAC;AA6E1E,MAAM,GAAG,GAAG,CAAC,CAAS,EAAc,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAEnE,MAAM,MAAM,GAAG,CAAC,KAAiB,EAAU,EAAE;IAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5E,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,CAAS,EAAc,EAAE;IAC9C,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9F,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,yFAAyF;AACzF,KAAK,UAAU,QAAQ,CAAC,cAAsB;IAC5C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IACpG,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,qBAAqB,CAAC,EAAE,EACnG,GAAG,EACH,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAC9C,KAAK,EACL,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,cAAsB,EAAE,KAAwB;IACrF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,iBAAiB,CAAC,0EAA0E,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,QAAQ,CAAC,cAAc,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxG,OAAO,GAAG,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AAClC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,cAAkC,EAClC,KAAa,EACb,GAAW;IAEX,IAAI,CAAC,cAAc,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;IAC1B,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,EAAE,GAAG,KAAK,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACzG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAsB,CAAC;QAC7F,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC;QACnE,mFAAmF;QACnF,mFAAmF;QACnF,qEAAqE;QACrE,KAAK,MAAM,KAAK,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,CAAU,EAAE,CAAC;YAC1F,IAAI,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QACrE,CAAC;QACD,sFAAsF;QACtF,iFAAiF;QACjF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACnG,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"connect-url.d.ts","sourceRoot":"","sources":["../src/connect-url.ts"],"names":[],"mappings":"AAAA,OAAO,
|
|
1
|
+
{"version":3,"file":"connect-url.d.ts","sourceRoot":"","sources":["../src/connect-url.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEtE,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,OAAO,EACZ,KAAK,QAAQ,EACd,MAAM,yBAAyB,CAAC;AAGjC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAG3C,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG;IAHxC,YACE,OAAO,EAAE,MAAM;IACf,2FAA2F;IAClF,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,EAIvC;CACF;AAED,+DAA+D;AAC/D,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0FAA0F;IAC1F,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC,CAAC,CAAC;IAC7D,gFAAgF;IAChF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAKD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACjE,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CA6EhC"}
|
package/dist/connect-url.js
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
|
-
import { isPrimaryScope
|
|
1
|
+
import { isPrimaryScope } from '@substrat-run/kernel';
|
|
2
|
+
import { signConnectState } from './connect-state.js';
|
|
2
3
|
import { connectUrlRelayRequest, instant, } from '@substrat-run/contracts';
|
|
3
4
|
import { PREVIEW_CONNECTIONS_REFUSAL } from './connection-relay.js';
|
|
4
5
|
/**
|
package/dist/connect-url.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"connect-url.js","sourceRoot":"","sources":["../src/connect-url.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,
|
|
1
|
+
{"version":3,"file":"connect-url.js","sourceRoot":"","sources":["../src/connect-url.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAkB,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EACL,sBAAsB,EACtB,OAAO,GAKR,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAIlC,MAAM;IAHjB,YACE,OAAe;IACf,2FAA2F;IAClF,MAA6B;QAEtC,KAAK,CAAC,OAAO,CAAC,CAAC;sBAFN,MAAM;QAGf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAyBD,0FAA0F;AAC1F,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,IAAe,EACf,KAAsB,EACtB,KAAkE;IAElE,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,oBAAoB,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,oBAAoB,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE;QACrD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/F,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,oBAAoB,CAC5B,mBAAmB,MAAM,CAAC,QAAQ,yCAAyC;YACzE,mEAAmE,EACrE,GAAG,CACJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAe,EACf,KAAsB,EACtB,IAAa,EACb,OAA+B;IAE/B,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,IAAI,oBAAoB,CAC5B,gCAAgC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,gBAAgB,EAAE,EACrH,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;IAE1B,wFAAwF;IACxF,sFAAsF;IACtF,gFAAgF;IAChF,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAC5B,mFAAmF;YACjF,mDAAmD,EACrD,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,MAAM,IAAI,oBAAoB,CAC5B,2FAA2F;YACzF,2BAA2B,EAC7B,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,oBAAoB,CAC5B,aAAa,KAAK,CAAC,QAAQ,6DAA6D;YACtF,qDAAqD,EACvD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,wFAAwF;IACxF,yFAAyF;IACzF,mEAAmE;IACnE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAClF,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;QACnB,MAAM,IAAI,oBAAoB,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IACrE,CAAC;IACD,0FAA0F;IAC1F,8FAA8F;IAC9F,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,oBAAoB,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,6BAA6B,CAAC,IAAI,EAAE,KAAK,EAAE;YAC/C,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,mBAAmB,CAAC,GAAG,IAAI,CAAC;IAClF,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,cAAc,EAAE;QAC3D,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,EAAE,WAAW;KACjB,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC;IACrF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,OAAO;QACL,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;QACnB,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7D,QAAQ,EAAE,GAAG,CAAC,QAAQ;KACvB,CAAC;AACJ,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -3,6 +3,8 @@ export type { ControlPlaneApiOptions, ConnectionInspector } from './api.js';
|
|
|
3
3
|
export { DEV_ACTOR_HEADER, SERVICE_TOKEN_HEADER, TENANT_HEADER, UNSAFE_devPlatformActorAuth, sessionPlatformAuth, staffAllowlist, serviceTokenAuth, firstPlatformActorAuth, firstBuilderAuth, confinedTenant, } from './auth.js';
|
|
4
4
|
export { relayConnectionUpsert, ConnectionRelayError, PREVIEW_CONNECTIONS_REFUSAL } from './connection-relay.js';
|
|
5
5
|
export type { ConnectionCandidatePrepare, ConnectionCandidatePreparer } from './connection-relay.js';
|
|
6
|
+
export { signConnectState, verifyConnectState, ConnectStateError } from './connect-state.js';
|
|
7
|
+
export type { ConnectStateClaim } from './connect-state.js';
|
|
6
8
|
export { relayConnectUrl, ConnectUrlRelayError } from './connect-url.js';
|
|
7
9
|
export type { ConnectFlowSpec, ConnectUrlRelayOptions } from './connect-url.js';
|
|
8
10
|
export { relayConnectLinkMint, relayConnectLinkList, relayConnectLinkRevoke, connectLinkViewOf } from './connect-links.js';
|
|
@@ -14,11 +16,11 @@ export * from './browser.js';
|
|
|
14
16
|
export { VerticalClient, AUDITED_CALL_DEADLINE_MS } from './vertical-client.js';
|
|
15
17
|
export { assertNoUnreachableScopeCopies, retryScopeScriptCopy, retryScopeScriptCopies, reapScopeScriptCopies, settleExpiredScopeScriptCopies, sweepScopeScriptCopies, } from './scope-copy-cleanup.js';
|
|
16
18
|
export { BIRTH_WINDOW_MS, backfillScopeScriptCopies, type CopyBackfillPage, } from './scope-copy-backfill.js';
|
|
17
|
-
export { versionReachedAt } from './scope-deployment.js';
|
|
19
|
+
export { scopeDeployment, versionReachedAt } from './scope-deployment.js';
|
|
18
20
|
export { hostedCrossVerticalReach } from './cross-vertical.js';
|
|
19
21
|
export { retireAllPreviewClients, retireClientsOfReapedScope, tenantIssuers, wirePreviewAuth } from './preview-auth.js';
|
|
20
22
|
export type { PreviewAuthDeps, WirePreviewAuthInput } from './preview-auth.js';
|
|
21
|
-
export type { ScopeDeployment, ScopeDeploymentVia } from './scope-deployment.js';
|
|
23
|
+
export type { ScopeDeployment, ScopeDeploymentLadder, ScopeDeploymentVia } from './scope-deployment.js';
|
|
22
24
|
export { drainScopePlatformRequests, MAX_PLATFORM_REQUEST_ATTEMPTS, provisionSiblingScope, provisionSiblingHandler, archiveScopeHandler, peerInvokeHandler, provisionTenantHandler, setEntitlementsHandler, modelUsageHandler, sweepRunsHandler, connectorDispatchHandler, type ConnectorDispatchDeps, type ManagedTenantDeps, type PlatformDrainOptions, type ArchiveScopeDeps, type PlatformRequestHandler, type PlatformDrainContext, type PlatformRequestContext, type PlatformRequestOutcome, type PlatformDrainReport, type PeerInvokeDeps, type ProvisionSiblingDeps, type ProvisionSiblingInput, type ProvisionSiblingResult, } from './platform-drain.js';
|
|
23
25
|
export { reconcilePayloadFor, reconcileThenReassert, reviewedEntityGrants, switchCarryFor, type SwitchCarry } from './reconcile.js';
|
|
24
26
|
export type { ReconcilePayload, ReconcileGatherAdmin } from './reconcile.js';
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC5E,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,2BAA2B,EAC3B,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACjH,YAAY,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACrG,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACzE,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC3H,OAAO,EACL,yBAAyB,EACzB,KAAK,4BAA4B,EACjC,KAAK,8BAA8B,GACpC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrG,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACxF,YAAY,EACV,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,qBAAqB,EACrB,iBAAiB,EACjB,SAAS,GACV,MAAM,WAAW,CAAC;AAGnB,cAAc,cAAc,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EACL,8BAA8B,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,qBAAqB,EACnG,8BAA8B,EAAE,sBAAsB,GACvD,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,eAAe,EAAE,yBAAyB,EAAE,KAAK,gBAAgB,GAClE,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC5E,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,2BAA2B,EAC3B,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACjH,YAAY,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC7F,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACzE,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC3H,OAAO,EACL,yBAAyB,EACzB,KAAK,4BAA4B,EACjC,KAAK,8BAA8B,GACpC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrG,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACxF,YAAY,EACV,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,qBAAqB,EACrB,iBAAiB,EACjB,SAAS,GACV,MAAM,WAAW,CAAC;AAGnB,cAAc,cAAc,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EACL,8BAA8B,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,qBAAqB,EACnG,8BAA8B,EAAE,sBAAsB,GACvD,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,eAAe,EAAE,yBAAyB,EAAE,KAAK,gBAAgB,GAClE,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAG/D,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACxH,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACxG,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC7B,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACpI,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,KAAK,SAAS,EACd,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAChG,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,aAAa,EACb,aAAa,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,aAAa,EACb,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAClI,OAAO,EACL,+BAA+B,EAC/B,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,yBAAyB,EACzB,gCAAgC,EAChC,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,UAAU,EACV,WAAW,EACX,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACzE,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpF,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAEpE,OAAO,EAAE,kBAAkB,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAC9F,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAGpI,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC1G,YAAY,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACtI,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACtE,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,YAAY,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,YAAY,EACV,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,4BAA4B,EAI5B,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAI/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAM3F,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC3E,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEhE,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACnG,YAAY,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
export { createControlPlaneApi, tenantCredentialPin, CLI_MIN_VERSION_HEADER, CLI_LATEST_VERSION_HEADER, } from './api.js';
|
|
2
2
|
export { DEV_ACTOR_HEADER, SERVICE_TOKEN_HEADER, TENANT_HEADER, UNSAFE_devPlatformActorAuth, sessionPlatformAuth, staffAllowlist, serviceTokenAuth, firstPlatformActorAuth, firstBuilderAuth, confinedTenant, } from './auth.js';
|
|
3
3
|
export { relayConnectionUpsert, ConnectionRelayError, PREVIEW_CONNECTIONS_REFUSAL } from './connection-relay.js';
|
|
4
|
+
export { signConnectState, verifyConnectState, ConnectStateError } from './connect-state.js';
|
|
4
5
|
export { relayConnectUrl, ConnectUrlRelayError } from './connect-url.js';
|
|
5
6
|
export { relayConnectLinkMint, relayConnectLinkList, relayConnectLinkRevoke, connectLinkViewOf } from './connect-links.js';
|
|
6
7
|
export { reconcileConnectionGrants, } from './connection-grants.js';
|
|
@@ -12,7 +13,7 @@ export * from './browser.js';
|
|
|
12
13
|
export { VerticalClient, AUDITED_CALL_DEADLINE_MS } from './vertical-client.js';
|
|
13
14
|
export { assertNoUnreachableScopeCopies, retryScopeScriptCopy, retryScopeScriptCopies, reapScopeScriptCopies, settleExpiredScopeScriptCopies, sweepScopeScriptCopies, } from './scope-copy-cleanup.js';
|
|
14
15
|
export { BIRTH_WINDOW_MS, backfillScopeScriptCopies, } from './scope-copy-backfill.js';
|
|
15
|
-
export { versionReachedAt } from './scope-deployment.js';
|
|
16
|
+
export { scopeDeployment, versionReachedAt } from './scope-deployment.js';
|
|
16
17
|
// #1705 PR 2: the cross-vertical phase's reach for a control plane whose scopes live elsewhere.
|
|
17
18
|
export { hostedCrossVerticalReach } from './cross-vertical.js';
|
|
18
19
|
// A preview's own sign-in client (#1704): the create's wiring, and the reap's half the
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,2BAA2B,EAC3B,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAEjH,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAEzE,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC3H,OAAO,EACL,yBAAyB,GAG1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrG,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAYxF,uFAAuF;AACvF,iFAAiF;AACjF,cAAc,cAAc,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EACL,8BAA8B,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,qBAAqB,EACnG,8BAA8B,EAAE,sBAAsB,GACvD,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,eAAe,EAAE,yBAAyB,GAC3C,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,2BAA2B,EAC3B,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAEjH,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE7F,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAEzE,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC3H,OAAO,EACL,yBAAyB,GAG1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrG,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAYxF,uFAAuF;AACvF,iFAAiF;AACjF,cAAc,cAAc,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EACL,8BAA8B,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,qBAAqB,EACnG,8BAA8B,EAAE,sBAAsB,GACvD,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,eAAe,EAAE,yBAAyB,GAC3C,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC1E,gGAAgG;AAChG,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,uFAAuF;AACvF,wEAAwE;AACxE,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGxH,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC7B,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,GAczB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,cAAc,EAAoB,MAAM,gBAAgB,CAAC;AAEpI,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,GAGnB,MAAM,mBAAmB,CAAC;AAC3B,oEAAoE;AACpE,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAUrB,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAChG,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAQ7B,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,aAAa,EACb,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,+BAA+B,EAC/B,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AA2B/B,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACpE,yGAAyG;AACzG,OAAO,EAAE,kBAAkB,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAE9F,qFAAqF;AACrF,2DAA2D;AAC3D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE1G,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAStE,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,4BAA4B;AAC5B,iFAAiF;AACjF,mFAAmF;AACnF,gFAAgF;AAChF,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,kFAAkF;AAClF,iFAAiF;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,yFAAyF;AACzF,yFAAyF;AACzF,oFAAoF;AACpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,uFAAuF;AACvF,yFAAyF;AACzF,uFAAuF;AACvF,yFAAyF;AACzF,+EAA+E;AAC/E,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAG3E,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC"}
|
package/dist/platform-drain.d.ts
CHANGED
|
@@ -74,7 +74,22 @@ export interface PlatformDrainReport {
|
|
|
74
74
|
* none was dispatched or settled. Absent otherwise.
|
|
75
75
|
*/
|
|
76
76
|
held?: true;
|
|
77
|
+
/**
|
|
78
|
+
* #1637: pending rows whose identity did not decode AND whose stored id is not an id — so
|
|
79
|
+
* nothing can address them: the settle route parses the id as a ULID, and that stays strict.
|
|
80
|
+
* Never executed and never settled; they stay pending (holding a backpressure slot) until an
|
|
81
|
+
* operator repairs the row, and every pass counts them again. Not in `drained` or `pending`. Absent when
|
|
82
|
+
* there were none.
|
|
83
|
+
*/
|
|
84
|
+
unsettleable?: {
|
|
85
|
+
/** Exact. */
|
|
86
|
+
count: number;
|
|
87
|
+
/** The stored ids, as text (`null` for SQL NULL), the first {@link UNSETTLEABLE_IDS} of them. */
|
|
88
|
+
ids: (string | null)[];
|
|
89
|
+
};
|
|
77
90
|
}
|
|
91
|
+
/** How many stored ids an `unsettleable` report names; `count` stays exact. */
|
|
92
|
+
export declare const UNSETTLEABLE_IDS = 10;
|
|
78
93
|
/**
|
|
79
94
|
* How many drain passes a pending intent may burn before the platform stops retrying and
|
|
80
95
|
* settles it `failed` (#570). Every pass through the ceiling means a HANDLER judged the
|
|
@@ -100,6 +115,8 @@ export interface PlatformDrainOptions {
|
|
|
100
115
|
* handler for its `kind`, and settle the outcome back in the vertical. An unknown kind settles
|
|
101
116
|
* `failed` (never silently dropped); a thrown handler settles `pending` (retried on the next drain);
|
|
102
117
|
* a row that did not decode (`decodeError`, #1588) settles `failed` without reaching any handler.
|
|
118
|
+
* So does a row whose identity did not decode (#1637) — when its stored id is still an id; when it
|
|
119
|
+
* is not, nothing can settle it, and it is reported `unsettleable` instead.
|
|
103
120
|
* The `VerticalClient` transport is narrowed so tests can pass a fake.
|
|
104
121
|
*/
|
|
105
122
|
export declare function drainScopePlatformRequests(client: Pick<VerticalClient, 'listPlatformRequests' | 'settlePlatformRequest'>, ctx: PlatformDrainContext, handlers: Record<string, PlatformRequestHandler>, opts?: PlatformDrainOptions): Promise<PlatformDrainReport>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"platform-drain.d.ts","sourceRoot":"","sources":["../src/platform-drain.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,SAAS,EACf,MAAM,sBAAsB,CAAC;AAE9B,OAAO,
|
|
1
|
+
{"version":3,"file":"platform-drain.d.ts","sourceRoot":"","sources":["../src/platform-drain.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,SAAS,EACf,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAkBL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,KAAK,EACV,KAAK,OAAO,EACZ,KAAK,cAAc,EACnB,KAAK,QAAQ,EAEd,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGrF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAEtD;;;;;;;GAOG;AAEH,uGAAuG;AACvG,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAqB,SAAQ,sBAAsB;IAClE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,CAAC,CAAC;IAC1C;;;;;;OAMG;IACH,SAAS,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,GAAG,QAAQ,CAAC,CAAC;CACrD;AAaD,2GAA2G;AAC3G,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC;IACnD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,oBAAoB,CAAC;IAC7B;;;;OAIG;IACH,OAAO,CAAC,EAAE,sBAAsB,CAAC;CAClC;AAED,4GAA4G;AAC5G,MAAM,MAAM,sBAAsB,GAAG,CACnC,GAAG,EAAE,sBAAsB,EAC3B,OAAO,EAAE,eAAe,KACrB,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAErC,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ;;;;;;OAMG;IACH,YAAY,CAAC,EAAE;QACb,aAAa;QACb,KAAK,EAAE,MAAM,CAAC;QACd,iGAAiG;QACjG,GAAG,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;KACxB,CAAC;CACH;AAED,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,KAAK,CAAC;AASnC;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,MAAM,CAAC;AAEjD,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAChE,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;GAQG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,sBAAsB,GAAG,uBAAuB,CAAC,EAC9E,GAAG,EAAE,oBAAoB,EACzB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,EAChD,IAAI,CAAC,EAAE,oBAAoB,GAC1B,OAAO,CAAC,mBAAmB,CAAC,CAiI9B;AA6BD,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,eAAe,CAAC;IACvB,6FAA6F;IAC7F,uBAAuB,EAAE,CAAC,KAAK,EAAE;QAC/B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAC1C;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;CAC7C;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,QAAQ,CAAC;IACnB,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,oBAAoB,EAC1B,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,sBAAsB,CAAC,CA2DjC;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,oBAAoB,GAAG,sBAAsB,CAyB1F;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,eAAe,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,sBAAsB,CAclF;AAED,gDAAgD;AAChD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,eAAe,CAAC;IACvB,4FAA4F;IAC5F,uBAAuB,EAAE,CAAC,KAAK,EAAE;QAC/B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;CAC3C;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,sBAAsB,CA0F9E;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,eAAe,CAAC;IACvB,4FAA4F;IAC5F,uBAAuB,EAAE,CAAC,KAAK,EAAE;QAC/B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAC1C,2FAA2F;IAC3F,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;CAC7C;AAiDD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,iBAAiB,GAAG,sBAAsB,CA6GtF;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,SAAS,CAAC;IAChB;;;;OAIG;IACH,SAAS,EAAE,gBAAgB,CAAC;IAC5B,2FAA2F;IAC3F,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,qBAAqB,GAAG,sBAAsB,CA6C5F;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,iBAAiB,GAAG,sBAAsB,CA+DtF;AAED;;;;;;;;GAQG;AACH;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GAAG,sBAAsB,CAqClF;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GAAG,sBAAsB,CAwBnF"}
|