@substrat-run/control-plane-api 0.158.0 → 0.160.0

package/dist/wire-upload.js

@@ -0,0 +1,114 @@
+/**
+ * The uploader's half of RFC wire-signing step 2 (follow-on 3): what one upload gives the deployment
+ * it goes to, and the capability record of it (§5, §6, §7, Q8).
+ *
+ * A deployment is given both issuers' public key lists, its own dispatch name for the audience
+ * check and the state `dual`, all plain configuration, rewritten on every upload. Nothing is given
+ * until the control plane's `WIRE_KEYS_ROLLOUT` says so: unset or `off` gives no deployment lists,
+ * `canary:<vertical>` gives them to that one vertical's deployments only (the single canary the RFC
+ * puts first in each environment), and `fleet` to every deployment. A setting that cannot be read
+ * gives nothing. So with the setting unset, every upload is what it was before this existed.
+ *
+ * The lists are judged before they are given, by the function the platform's entry loads them with
+ * (`wireUploadSettings`), so a deployment is never given lists its verifier would refuse: the upload
+ * gives nothing instead, and says why. No code here can give a state other than `dual`: moving a
+ * deployment to `signed-only` is the flip, a later and separate step.
+ *
+ * Every upload has a record, given lists or not, written from what the uploader built: whether the
+ * bundle carries the platform's entry (which holds the verifier), the state, the audience and the key
+ * ids, or why nothing was given. The vertical never declares any of it.
+ */
+import { verticalSlug } from '@substrat-run/contracts';
+import { wireUploadSettings, wireVerificationKeys, WIRE_ENVELOPE_VERSION, WIRE_UPLOAD_STATE } from '@substrat-run/contracts/wire-signing';
+import { platformEntrySkipReason } from './platform-entry.js';
+const CANARY = 'canary:';
+/**
+ * The rollout setting's one reading. Unset, empty or `off` is off; `fleet` is every deployment;
+ * `canary:<vertical>` is one vertical, named as the registry names it. Anything else is refused
+ * with the reason, a second vertical in a canary included: the RFC's canary is one, before the rest.
+ */
+export function wireKeysRolloutOf(value) {
+    if (value === undefined || value === null)
+        return { kind: 'off' };
+    if (typeof value !== 'string')
+        return { refused: 'the rollout setting is not text' };
+    const text = value.trim();
+    if (text === '' || text === 'off')
+        return { kind: 'off' };
+    if (text === 'fleet')
+        return { kind: 'fleet' };
+    if (!text.startsWith(CANARY))
+        return { refused: 'the rollout setting is `off`, `canary:<vertical>` or `fleet`' };
+    const vertical = text.slice(CANARY.length).trim();
+    if (/[,\s]/.test(vertical))
+        return { refused: 'a canary names one vertical' };
+    if (!verticalSlug.safeParse(vertical).success)
+        return { refused: 'a canary names a vertical by its registry slug' };
+    return { kind: 'canary', vertical };
+}
+/**
+ * What the upload of `bundle` to the script `deploymentRef`, a deployment of `vertical`, gives it
+ * under `settings`, and the record of it. Gives nothing while the rollout is off or leaves the
+ * vertical out, while the setting cannot be read, or while the lists would not load.
+ */
+export async function wireUploadFor(settings, upload) {
+    const { vertical, deploymentRef } = upload;
+    const skipped = platformEntrySkipReason(upload.bundle) ?? null;
+    const entry = { envelope: skipped === null ? WIRE_ENVELOPE_VERSION : null, entrySkipped: skipped };
+    const nothing = (withheld, refusal = null) => ({
+        vertical,
+        deploymentRef,
+        bindings: [],
+        record: { ...entry, state: 'legacy-only', audience: null, routerKids: [], platformKids: [], withheld },
+        refusal,
+    });
+    const rollout = wireKeysRolloutOf(settings?.rollout);
+    if ('refused' in rollout)
+        return nothing('rollout-refused', rollout.refused);
+    if (rollout.kind === 'off')
+        return nothing('unconfigured');
+    if (rollout.kind === 'canary' && rollout.vertical !== vertical)
+        return nothing('not-in-rollout');
+    try {
+        const given = await wireUploadSettings({
+            routerKeys: settings?.routerKeys ?? '',
+            platformKeys: settings?.platformKeys ?? '',
+            audience: deploymentRef,
+        });
+        return {
+            vertical,
+            deploymentRef,
+            bindings: given.settings.map((setting) => ({ type: 'plain_text', ...setting })),
+            record: { ...entry, state: WIRE_UPLOAD_STATE, audience: deploymentRef, routerKids: given.routerKids, platformKids: given.platformKids, withheld: null },
+            refusal: null,
+        };
+    }
+    catch (error) {
+        return nothing('lists-refused', await refusedList(settings, error));
+    }
+}
+/**
+ * Why the lists were refused, naming the setting to fix: each list is loaded alone, and the first
+ * that fails is named with its problem. When each loads alone (a key in both, or an audience the
+ * encoder would not carry), the refusal is the one given. The parser's messages are fixed text
+ * naming a problem, never a key.
+ */
+async function refusedList(settings, error) {
+    const problem = (e) => (e instanceof Error ? e.message : 'the list did not load').replace(/^a store public key/, 'a public key');
+    for (const [name, router, platform] of [
+        ['WIRE_ROUTER_PUBLIC_KEYS', settings?.routerKeys, undefined],
+        ['WIRE_PLATFORM_PUBLIC_KEYS', undefined, settings?.platformKeys],
+    ]) {
+        const list = router ?? platform;
+        if (!list?.trim())
+            return `${name} lists no key`;
+        try {
+            await wireVerificationKeys({ router, platform });
+        }
+        catch (e) {
+            return `${name}: ${problem(e)}`;
+        }
+    }
+    return problem(error);
+}
+//# sourceMappingURL=wire-upload.js.map

package/dist/wire-upload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire-upload.js","sourceRoot":"","sources":["../src/wire-upload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,YAAY,EAAuB,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC1I,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAmB9D,MAAM,MAAM,GAAG,SAAS,CAAC;AAEzB;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAClE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC;IACrF,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC1D,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC/C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,8DAA8D,EAAE,CAAC;IACjH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;IAC9E,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC;IACpH,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AACtC,CAAC;AAcD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAAwC,EACxC,MAAiI;IAEjI,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC;IAC3C,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IAC/D,MAAM,KAAK,GAAsD,EAAE,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACtJ,MAAM,OAAO,GAAG,CAAC,QAAiD,EAAE,OAAO,GAAkB,IAAI,EAAc,EAAE,CAAC,CAAC;QACjH,QAAQ;QACR,aAAa;QACb,QAAQ,EAAE,EAAE;QACZ,MAAM,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,QAAQ,EAAE;QACtG,OAAO;KACR,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,SAAS,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7E,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACjG,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC;YACrC,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,EAAE;YACtC,YAAY,EAAE,QAAQ,EAAE,YAAY,IAAI,EAAE;YAC1C,QAAQ,EAAE,aAAa;SACxB,CAAC,CAAC;QACH,OAAO;YACL,QAAQ;YACR,aAAa;YACb,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;YAC/E,MAAM,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE;YACvJ,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,eAAe,EAAE,MAAM,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,WAAW,CAAC,QAAwC,EAAE,KAAc;IACjF,MAAM,OAAO,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,cAAc,CAAC,CAAC;IAC1I,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI;QACrC,CAAC,yBAAyB,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC;QAC5D,CAAC,2BAA2B,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,CAAC;KACxD,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,MAAM,IAAI,QAAQ,CAAC;QAChC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE;YAAE,OAAO,GAAG,IAAI,eAAe,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,oBAAoB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@substrat-run/control-plane-api",
-  "version": "0.158.0",
+  "version": "0.160.0",
   "description": "HTTP surface over HostAdmin — the audited control-plane transport (control-plane.md §4.5)",
   "license": "AGPL-3.0-only",
   "repository": {
@@ -27,10 +27,10 @@
   ],
   "dependencies": {
     "hono": "^4.13.13",
-    "@substrat-run/contracts": "^0.158.0",
-    "@substrat-run/kernel": "^0.158.0",
-    "@substrat-run/control-plane-client": "^0.3.9",
-    "@substrat-run/psl": "^0.2.5"
+    "@substrat-run/contracts": "^0.160.0",
+    "@substrat-run/control-plane-client": "^0.3.11",
+    "@substrat-run/psl": "^0.2.5",
+    "@substrat-run/kernel": "^0.160.0"
   },
   "devDependencies": {
     "@hono/node-server": "^1.13.0",
@@ -43,17 +43,17 @@
     "tsx": "^4.19.0",
     "typescript": "^7.0.0",
     "vitest": "^5.0.5",
-    "@substrat-run/adapter-sqlite": "^0.158.0",
-    "@substrat-run/connector-fortnox": "^0.4.60",
-    "@substrat-run/connector-planima": "^0.2.55",
-    "@substrat-run/vertical-host": "^0.158.0"
+    "@substrat-run/adapter-sqlite": "^0.160.0",
+    "@substrat-run/connector-fortnox": "^0.4.62",
+    "@substrat-run/vertical-host": "^0.160.0",
+    "@substrat-run/connector-planima": "^0.2.57"
   },
   "publishConfig": {
     "access": "public"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.platform-entry.json",
     "test": "vitest run",
     "dev": "tsx dev/server.mts"
   }