@substrat-run/control-plane-api 0.160.0 → 0.162.0

package/dist/wire-settings.js

@@ -0,0 +1,155 @@
+/**
+ * The fleet walk's one write (RFC wire-signing follow-on 4): bring a deployed script's four
+ * `SUBSTRAT_WIRE_*` settings to what the control plane gives now, through the namespace's
+ * script-settings endpoint, without uploading the script again.
+ *
+ * Only those four are ever changed. Every other binding goes back exactly as it was read, and a
+ * secret is never read back at all: the endpoint answers a secret's name and type without its value,
+ * so secrets ride `keep_bindings`, as the store patcher's do (`createWfpBindingsPatcher`). Nothing
+ * here logs, stores or echoes a binding's value; a failure names the script, the status, and binding
+ * NAMES only.
+ *
+ * It writes nothing when the four already match. Otherwise it re-reads before it writes and verifies
+ * after.
+ *
+ * A script's bindings are also written by its uploads and by a store attached to one of its scopes.
+ * The walk is not run while a push or promote of the same vertical is in flight, and every walk ends
+ * with a confirming pass, which is mandatory.
+ */
+import { WIRE_AUDIENCE_VAR, WIRE_PLATFORM_KEYS_VAR, WIRE_ROUTER_KEYS_VAR, WIRE_STATE_VAR } from '@substrat-run/contracts/wire-signing';
+/** The four settings the walk owns, and no other. */
+const WIRE_SETTING_NAMES = Object.freeze([WIRE_ROUTER_KEYS_VAR, WIRE_PLATFORM_KEYS_VAR, WIRE_AUDIENCE_VAR, WIRE_STATE_VAR]);
+const OWNED = new Set(WIRE_SETTING_NAMES);
+/** Binding types whose values the endpoint never returns: carried by `keep_bindings`, never sent. */
+export const SECRET_BINDING_TYPES = Object.freeze(['secret_text', 'secret_key']);
+const SECRET = new Set(SECRET_BINDING_TYPES);
+/** The version a script runs, as its upload injected it (#1242). */
+export const VERSION_ID_VAR = 'SUBSTRAT_VERSION_ID';
+/** How many times a change between the two reads is retried from the newer read. */
+export const CONCURRENT_RETRIES = 3;
+/** A binding's identity: its type and name. Two bindings of one name and different types are two. */
+const keyOf = (b) => `${b.type}:${b.name}`;
+/** The plain-text value of one of the four, or `undefined` when the script does not carry it as plain text. */
+function plainText(bindings, name) {
+    const b = bindings.find((x) => x.name === name);
+    return b && b.type === 'plain_text' && typeof b['text'] === 'string' ? b['text'] : undefined;
+}
+/** The names among the four whose value (or presence, or type) differs from what is wanted. */
+export function wireSettingsChanges(bindings, wanted) {
+    const want = new Map(wanted.map((w) => [w.name, w.text]));
+    const changes = [];
+    for (const name of WIRE_SETTING_NAMES) {
+        const present = bindings.filter((b) => b.name === name);
+        const text = want.get(name);
+        if (text === undefined ? present.length > 0 : present.length !== 1 || plainText(bindings, name) !== text)
+            changes.push(name);
+    }
+    return changes;
+}
+/**
+ * A comparable form of what was read: every binding by identity, a non-secret one with all its
+ * fields, a secret one by name and type alone (its value is never in the answer, and never used).
+ */
+function snapshot(bindings) {
+    const out = new Map();
+    for (const b of bindings) {
+        out.set(keyOf(b), SECRET.has(b.type) ? '' : JSON.stringify(Object.keys(b).sort().map((k) => [k, b[k]])));
+    }
+    return out;
+}
+const sameSnapshot = (a, b) => a.size === b.size && [...a].every(([k, v]) => b.get(k) === v);
+/** The binding names whose snapshot differs between two reads, a name once. */
+function differingNames(before, after) {
+    const names = new Set();
+    for (const [k, v] of before)
+        if (after.get(k) !== v)
+            names.add(k.slice(k.indexOf(':') + 1));
+    for (const k of after.keys())
+        if (!before.has(k))
+            names.add(k.slice(k.indexOf(':') + 1));
+    return [...names].sort();
+}
+/** The write body: every non-secret binding as read but the four, then the four as wanted. */
+function bodyOf(bindings, wanted) {
+    return {
+        bindings: [
+            ...bindings.filter((b) => !SECRET.has(b.type) && !OWNED.has(b.name)),
+            ...wanted.map((w) => ({ type: 'plain_text', name: w.name, text: w.text })),
+        ],
+        keep_bindings: SECRET_BINDING_TYPES,
+    };
+}
+/**
+ * Bring `script`'s four settings to `wanted` (all four, or none to withdraw them). With `apply`
+ * false it only reads: the write is unreachable. With `servedVersion`, the script is a serving
+ * script and that is the version the directory says it serves; `servedVersionAfter` reads the
+ * directory again after the write.
+ */
+export async function applyWireSettings(api, script, wanted, opts) {
+    const servesOther = (bindings) => opts.servedVersion !== undefined && plainText(bindings, VERSION_ID_VAR) !== opts.servedVersion;
+    let current = await api.read(script);
+    if (servesOther(current))
+        return { outcome: 'serve-in-flight', written: false };
+    let changes = wireSettingsChanges(current, wanted);
+    if (changes.length === 0)
+        return { outcome: 'unchanged' };
+    if (!opts.apply)
+        return { outcome: 'would-change', changes };
+    for (let attempt = 1;; attempt++) {
+        const again = await api.read(script);
+        if (sameSnapshot(snapshot(current), snapshot(again)))
+            break;
+        if (attempt >= CONCURRENT_RETRIES)
+            return { outcome: 'concurrent-change' };
+        current = again;
+        if (servesOther(current))
+            return { outcome: 'serve-in-flight', written: false };
+        changes = wireSettingsChanges(current, wanted);
+        if (changes.length === 0)
+            return { outcome: 'unchanged' };
+    }
+    const body = bodyOf(current, wanted);
+    await api.write(script, body);
+    const after = await api.read(script);
+    // What the read after must hold: the body as sent, and every secret read before (kept, not sent).
+    const expected = snapshot([...body.bindings, ...current.filter((b) => SECRET.has(b.type))]);
+    const differing = differingNames(expected, snapshot(after));
+    if (differing.length > 0)
+        return { outcome: 'verify', bindings: differing };
+    if (opts.servedVersionAfter && (await opts.servedVersionAfter()) !== opts.servedVersion)
+        return { outcome: 'serve-in-flight', written: true };
+    return { outcome: 'updated', changes };
+}
+/**
+ * The `WireSettingsApi` over the namespace's script-settings endpoint. A failure names the script and
+ * the status only, never a response body: the body of a settings answer holds binding values.
+ */
+export function createWfpWireSettingsApi(opts) {
+    const urlOf = (script) => `https://api.cloudflare.com/client/v4/accounts/${opts.accountId}` +
+        `/workers/dispatch/namespaces/${opts.namespace}/scripts/${encodeURIComponent(script)}/settings`;
+    const auth = { authorization: `Bearer ${opts.apiToken}` };
+    return {
+        async read(script) {
+            const res = await fetch(urlOf(script), { headers: auth });
+            if (!res.ok) {
+                await res.body?.cancel();
+                throw new Error(`the settings of '${script}' could not be read (${res.status})`);
+            }
+            const parsed = (await res.json().catch(() => null));
+            const bindings = parsed?.result?.bindings ?? parsed?.bindings;
+            if (!Array.isArray(bindings) || !bindings.every((b) => b && typeof b === 'object' && typeof b.type === 'string' && typeof b.name === 'string')) {
+                throw new Error(`the settings of '${script}' did not read as a list of bindings`);
+            }
+            return bindings;
+        },
+        async write(script, body) {
+            const form = new FormData();
+            form.set('settings', new Blob([JSON.stringify(body)], { type: 'application/json' }), 'settings.json');
+            const res = await fetch(urlOf(script), { method: 'PATCH', headers: auth, body: form });
+            await res.body?.cancel();
+            if (!res.ok)
+                throw new Error(`the settings of '${script}' could not be written (${res.status})`);
+        },
+    };
+}
+//# sourceMappingURL=wire-settings.js.map

package/dist/wire-settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire-settings.js","sourceRoot":"","sources":["../src/wire-settings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AAEvI,qDAAqD;AACrD,MAAM,kBAAkB,GAAsB,MAAM,CAAC,MAAM,CAAC,CAAC,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAC;AAC/I,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAE1C,qGAAqG;AACrG,MAAM,CAAC,MAAM,oBAAoB,GAAsB,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC;AACpG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,oBAAoB,CAAC,CAAC;AAE7C,oEAAoE;AACpE,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAEpD,oFAAoF;AACpF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAgCpC,qGAAqG;AACrG,MAAM,KAAK,GAAG,CAAC,CAAgB,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AAE1D,+GAA+G;AAC/G,SAAS,SAAS,CAAC,QAAkC,EAAE,IAAY;IACjE,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAChD,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,MAAM,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3G,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,mBAAmB,CAAC,QAAkC,EAAE,MAA0B;IAChG,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/H,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,QAAkC;IAClD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,CAAsB,EAAE,CAAsB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAEvI,+EAA+E;AAC/E,SAAS,cAAc,CAAC,MAA2B,EAAE,KAA0B;IAC7E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM;QAAE,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5F,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE;QAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACzF,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,8FAA8F;AAC9F,SAAS,MAAM,CAAC,QAAkC,EAAE,MAA0B;IAC5E,OAAO;QACL,QAAQ,EAAE;YACR,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACpE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;SAC3E;QACD,aAAa,EAAE,oBAAoB;KACpC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAoB,EACpB,MAAc,EACd,MAA0B,EAC1B,IAA8H;IAE9H,MAAM,WAAW,GAAG,CAAC,QAAkC,EAAE,EAAE,CACzD,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,SAAS,CAAC,QAAQ,EAAE,cAAc,CAAC,KAAK,IAAI,CAAC,aAAa,CAAC;IACjG,IAAI,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,WAAW,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAChF,IAAI,OAAO,GAAG,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC1D,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;IAE7D,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YAAE,MAAM;QAC5D,IAAI,OAAO,IAAI,kBAAkB;YAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;QAC3E,OAAO,GAAG,KAAK,CAAC;QAChB,IAAI,WAAW,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAChF,OAAO,GAAG,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACrC,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrC,kGAAkG;IAClG,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5F,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC5E,IAAI,IAAI,CAAC,kBAAkB,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC,KAAK,IAAI,CAAC,aAAa;QAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9I,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAA2F;IAClI,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,EAAE,CAC/B,iDAAiD,IAAI,CAAC,SAAS,EAAE;QACjE,gCAAgC,IAAI,CAAC,SAAS,YAAY,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC;IAClG,MAAM,IAAI,GAAG,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC1D,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,MAAM;YACf,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,wBAAwB,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmE,CAAC;YACtH,MAAM,QAAQ,GAAG,MAAM,EAAE,MAAM,EAAE,QAAQ,IAAI,MAAM,EAAE,QAAQ,CAAC;YAC9D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;gBAC/I,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,sCAAsC,CAAC,CAAC;YACpF,CAAC;YACD,OAAO,QAA2B,CAAC;QACrC,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI;YACtB,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,EAAE,eAAe,CAAC,CAAC;YACtG,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACvF,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,2BAA2B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QACnG,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/wire-upload.d.ts

@@ -71,4 +71,30 @@ export declare function wireUploadFor(settings: WireUploadSettings | undefined,
     readonly deploymentRef: string;
     readonly bundle: Pick<VerticalBundle, 'entry' | 'modules'>;
 }): Promise<WireUpload>;
+/** Whether a bundle carries the platform's entry, which holds the verifier, as a record states it. */
+export declare function wireEntryOf(bundle: Pick<VerticalBundle, 'entry' | 'modules'>): WireEntry;
+/** The record's half that is a fact about the bundle: its envelope version, or why the entry was left off. */
+export type WireEntry = Pick<WireAuthRecord, 'envelope' | 'entrySkipped'>;
+/**
+ * `wireUploadFor` from a bundle's entry state already known (`wireEntryOf`, or a record of the
+ * script's upload): what the settings give the script now, and the record of it. The fleet walk's
+ * reading of the same rule, so a walked script and an uploaded one are given the same.
+ */
+export declare function wireUploadGiven(settings: WireUploadSettings | undefined, upload: {
+    readonly vertical: string;
+    readonly deploymentRef: string;
+    readonly entry: WireEntry;
+}): Promise<WireUpload>;
+/**
+ * Whether the settings themselves are refused: the rollout setting does not parse, or, where it gives
+ * lists to anything, the lists do not load. `null` when they are usable, `off` included. An upload under
+ * refused settings gives nothing and says why; the fleet walk refuses the whole pass instead, since
+ * giving nothing to every script would withdraw the lists fleet-wide. The decision is the uploader's
+ * own (`wireUploadGiven`, asked for a deployment inside the rollout), so the two cannot drift; the
+ * reason names the setting, never a key.
+ */
+export declare function wireSettingsRefusal(settings: WireUploadSettings | undefined): Promise<{
+    readonly withheld: 'rollout-refused' | 'lists-refused';
+    readonly reason: string;
+} | null>;
 //# sourceMappingURL=wire-upload.d.ts.map

package/dist/wire-upload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wire-upload.d.ts","sourceRoot":"","sources":["../src/wire-upload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAG5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,yFAAyF;AACzF,MAAM,WAAW,kBAAkB;IACjC,4EAA4E;IAC5E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,qFAAqF;IACrF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,kDAAkD;AAClD,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;CAAE,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAI/B;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAWhG;AAED,kEAAkE;AAClE,MAAM,WAAW,UAAU;IACzB,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC5G,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,kBAAkB,GAAG,SAAS,EACxC,MAAM,EAAE;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,GAAG,SAAS,CAAC,CAAA;CAAE,GAChI,OAAO,CAAC,UAAU,CAAC,CA+BrB"}
+{"version":3,"file":"wire-upload.d.ts","sourceRoot":"","sources":["../src/wire-upload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAG5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,yFAAyF;AACzF,MAAM,WAAW,kBAAkB;IACjC,4EAA4E;IAC5E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,qFAAqF;IACrF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,kDAAkD;AAClD,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;CAAE,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAI/B;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAWhG;AAED,kEAAkE;AAClE,MAAM,WAAW,UAAU;IACzB,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC5G,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,kBAAkB,GAAG,SAAS,EACxC,MAAM,EAAE;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,GAAG,SAAS,CAAC,CAAA;CAAE,GAChI,OAAO,CAAC,UAAU,CAAC,CAErB;AAED,sGAAsG;AACtG,wBAAgB,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,GAAG,SAAS,CAAC,GAAG,SAAS,CAGxF;AAED,8GAA8G;AAC9G,MAAM,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,EAAE,UAAU,GAAG,cAAc,CAAC,CAAC;AAE1E;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,kBAAkB,GAAG,SAAS,EACxC,MAAM,EAAE;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;CAAE,GAC/F,OAAO,CAAC,UAAU,CAAC,CA8BrB;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,kBAAkB,GAAG,SAAS,GACvC,OAAO,CAAC;IAAE,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,GAAG,eAAe,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAMrG"}

package/dist/wire-upload.js

@@ -52,9 +52,21 @@ export function wireKeysRolloutOf(value) {
  * vertical out, while the setting cannot be read, or while the lists would not load.
  */
 export async function wireUploadFor(settings, upload) {
+    return wireUploadGiven(settings, { vertical: upload.vertical, deploymentRef: upload.deploymentRef, entry: wireEntryOf(upload.bundle) });
+}
+/** Whether a bundle carries the platform's entry, which holds the verifier, as a record states it. */
+export function wireEntryOf(bundle) {
+    const skipped = platformEntrySkipReason(bundle) ?? null;
+    return { envelope: skipped === null ? WIRE_ENVELOPE_VERSION : null, entrySkipped: skipped };
+}
+/**
+ * `wireUploadFor` from a bundle's entry state already known (`wireEntryOf`, or a record of the
+ * script's upload): what the settings give the script now, and the record of it. The fleet walk's
+ * reading of the same rule, so a walked script and an uploaded one are given the same.
+ */
+export async function wireUploadGiven(settings, upload) {
     const { vertical, deploymentRef } = upload;
-    const skipped = platformEntrySkipReason(upload.bundle) ?? null;
-    const entry = { envelope: skipped === null ? WIRE_ENVELOPE_VERSION : null, entrySkipped: skipped };
+    const entry = { envelope: upload.entry.envelope, entrySkipped: upload.entry.entrySkipped };
     const nothing = (withheld, refusal = null) => ({
         vertical,
         deploymentRef,
@@ -87,6 +99,21 @@ export async function wireUploadFor(settings, upload) {
         return nothing('lists-refused', await refusedList(settings, error));
     }
 }
+/**
+ * Whether the settings themselves are refused: the rollout setting does not parse, or, where it gives
+ * lists to anything, the lists do not load. `null` when they are usable, `off` included. An upload under
+ * refused settings gives nothing and says why; the fleet walk refuses the whole pass instead, since
+ * giving nothing to every script would withdraw the lists fleet-wide. The decision is the uploader's
+ * own (`wireUploadGiven`, asked for a deployment inside the rollout), so the two cannot drift; the
+ * reason names the setting, never a key.
+ */
+export async function wireSettingsRefusal(settings) {
+    const rollout = wireKeysRolloutOf(settings?.rollout);
+    const vertical = 'refused' in rollout || rollout.kind !== 'canary' ? 'wire-settings-check' : rollout.vertical;
+    const given = await wireUploadGiven(settings, { vertical, deploymentRef: 'wire-settings-check', entry: { envelope: 1, entrySkipped: null } });
+    const withheld = given.record.withheld;
+    return given.refusal !== null && (withheld === 'rollout-refused' || withheld === 'lists-refused') ? { withheld, reason: given.refusal } : null;
+}
 /**
  * Why the lists were refused, naming the setting to fix: each list is loaded alone, and the first
  * that fails is named with its problem. When each loads alone (a key in both, or an audience the

package/dist/wire-upload.js.map

@@ -1 +1 @@
-{"version":3,"file":"wire-upload.js","sourceRoot":"","sources":["../src/wire-upload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,YAAY,EAAuB,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC1I,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAmB9D,MAAM,MAAM,GAAG,SAAS,CAAC;AAEzB;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAClE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC;IACrF,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC1D,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC/C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,8DAA8D,EAAE,CAAC;IACjH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;IAC9E,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC;IACpH,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AACtC,CAAC;AAcD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAAwC,EACxC,MAAiI;IAEjI,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC;IAC3C,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IAC/D,MAAM,KAAK,GAAsD,EAAE,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACtJ,MAAM,OAAO,GAAG,CAAC,QAAiD,EAAE,OAAO,GAAkB,IAAI,EAAc,EAAE,CAAC,CAAC;QACjH,QAAQ;QACR,aAAa;QACb,QAAQ,EAAE,EAAE;QACZ,MAAM,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,QAAQ,EAAE;QACtG,OAAO;KACR,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,SAAS,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7E,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACjG,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC;YACrC,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,EAAE;YACtC,YAAY,EAAE,QAAQ,EAAE,YAAY,IAAI,EAAE;YAC1C,QAAQ,EAAE,aAAa;SACxB,CAAC,CAAC;QACH,OAAO;YACL,QAAQ;YACR,aAAa;YACb,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;YAC/E,MAAM,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE;YACvJ,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,eAAe,EAAE,MAAM,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,WAAW,CAAC,QAAwC,EAAE,KAAc;IACjF,MAAM,OAAO,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,cAAc,CAAC,CAAC;IAC1I,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI;QACrC,CAAC,yBAAyB,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC;QAC5D,CAAC,2BAA2B,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,CAAC;KACxD,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,MAAM,IAAI,QAAQ,CAAC;QAChC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE;YAAE,OAAO,GAAG,IAAI,eAAe,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,oBAAoB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC"}
+{"version":3,"file":"wire-upload.js","sourceRoot":"","sources":["../src/wire-upload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,YAAY,EAAuB,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC1I,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAmB9D,MAAM,MAAM,GAAG,SAAS,CAAC;AAEzB;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAClE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC;IACrF,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC1D,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC/C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,8DAA8D,EAAE,CAAC;IACjH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;IAC9E,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC;IACpH,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AACtC,CAAC;AAcD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAAwC,EACxC,MAAiI;IAEjI,OAAO,eAAe,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAC1I,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,WAAW,CAAC,MAAiD;IAC3E,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IACxD,OAAO,EAAE,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AAC9F,CAAC;AAKD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAwC,EACxC,MAAgG;IAEhG,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC;IAC3C,MAAM,KAAK,GAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;IACtG,MAAM,OAAO,GAAG,CAAC,QAAiD,EAAE,OAAO,GAAkB,IAAI,EAAc,EAAE,CAAC,CAAC;QACjH,QAAQ;QACR,aAAa;QACb,QAAQ,EAAE,EAAE;QACZ,MAAM,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,QAAQ,EAAE;QACtG,OAAO;KACR,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,SAAS,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7E,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACjG,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC;YACrC,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,EAAE;YACtC,YAAY,EAAE,QAAQ,EAAE,YAAY,IAAI,EAAE;YAC1C,QAAQ,EAAE,aAAa;SACxB,CAAC,CAAC;QACH,OAAO;YACL,QAAQ;YACR,aAAa;YACb,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;YAC/E,MAAM,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE;YACvJ,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,eAAe,EAAE,MAAM,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAwC;IAExC,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,SAAS,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC9G,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,qBAAqB,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC9I,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC;IACvC,OAAO,KAAK,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,iBAAiB,IAAI,QAAQ,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACjJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,WAAW,CAAC,QAAwC,EAAE,KAAc;IACjF,MAAM,OAAO,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,cAAc,CAAC,CAAC;IAC1I,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI;QACrC,CAAC,yBAAyB,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC;QAC5D,CAAC,2BAA2B,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,CAAC;KACxD,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,MAAM,IAAI,QAAQ,CAAC;QAChC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE;YAAE,OAAO,GAAG,IAAI,eAAe,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,oBAAoB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC"}

package/dist/wire-walk.d.ts

@@ -0,0 +1,161 @@
+/**
+ * The fleet walk (RFC wire-signing follow-on 4): bring every deployed script's key lists, audience
+ * and state to what the control plane gives now, so that a key listed, rotated, dropped or withdrawn
+ * reaches every script, not only the ones an upload happens to reach. A vertical's serving script is
+ * uploaded again at each promote, but a version's own script (its archive script, which a preview is
+ * routed to) is uploaded once, at its push, and nothing else ever rewrites it.
+ *
+ * A person runs it, a pass at a time, and it reports before it changes anything:
+ *
+ * - **Dry run by default.** Without `apply` a pass only reads: the settings write is unreachable, no
+ *   operational failure is filed and no hold is released.
+ * - **Bounded and resumable.** A pass walks at most `limit` scripts in a fixed order (verticals by
+ *   slug; each one's serving script, then its versions' scripts by id) and answers the cursor the next
+ *   pass starts from, `null` when the fleet is done. A vertical deleted since it was listed, or named by
+ *   a saved cursor, is passed over.
+ * - **Only scripts it can attribute.** The inventory is the registry's: a vertical's serving script and
+ *   each of its versions' scripts. A script the registry does not name is never touched, nor is one
+ *   whose name is the platform's own.
+ * - **No call it does not need.** A script whose record already says it was given what the settings give
+ *   now is not read. A script with no record, which the settings give nothing, is not read either: in an
+ *   environment where the rollout was never set, a pass makes no call to the runtime at all. A
+ *   **confirming** pass (`confirm`) reads every recorded script instead, trusting no record; a held
+ *   script, and one with no record that nothing is given or that is skipped, it leaves unread as well.
+ * - **Only a script that verifies is given lists by it.** A script with no record is read back first, on
+ *   every pass that reaches it (no verdict is kept between passes: pushing it again gives it a record);
+ *   one that runs without the platform's entry is skipped (`no-entry`), never recorded as verifying.
+ * - **One script's failure is that script's.** It is reported, recorded as an operational failure by
+ *   reason, and the pass goes on.
+ * - **A script it cannot vouch for is held.** When the read after an update differs, or the serve moved
+ *   under it, the script's record is marked held, with the binding names that differed, and later passes
+ *   leave it alone until a person names it in `release`, or an upload of it writes a fresh record.
+ *
+ * Each script it changes writes its capability record and that record's admin row in one directory
+ * transaction (`recordWireAuth`), and each pass writes one `walkWireAuth` row. The settings write is
+ * `wire-settings.ts`. Do not run the walk while a push or promote of the same vertical is in flight,
+ * and end with a confirming pass.
+ */
+import { type DeploymentWireAuth, type PlatformActorId, type WireAuthRecord } from '@substrat-run/contracts';
+import type { HostAdmin } from '@substrat-run/kernel';
+import type { FetchVerticalModulesFn } from './deploy.js';
+import { type WireSettingsApi } from './wire-settings.js';
+import { type WireUploadSettings } from './wire-upload.js';
+/** A pass walks this many scripts when it names no limit. */
+export declare const WIRE_WALK_LIMIT_DEFAULT = 25;
+/** A pass walks at most this many scripts. */
+export declare const WIRE_WALK_LIMIT_MAX = 50;
+/** A pass releases at most this many held scripts. */
+export declare const WIRE_WALK_RELEASE_MAX = 50;
+/**
+ * Where a pass starts: inside a vertical, after its serving script (`after` empty) or after one of its
+ * versions (`after` that version's id, whatever its spelling: the publish route takes any id).
+ */
+export interface WireWalkCursor {
+    readonly vertical: string;
+    readonly after: string;
+}
+/**
+ * A cursor as a pass answers it, or `null` for one that is not one. Opaque to a caller. A slug never
+ * holds a `|`, so the first one ends it, and everything after it is the position.
+ */
+export declare function parseWireWalkCursor(text: string): WireWalkCursor | null;
+/** What a pass did, or in a dry run would do, with one script. */
+export type WireWalkAction = 
+/** Its record says it was given what the settings give now: not read. */
+'current'
+/** No record, and the settings give it nothing: not read. */
+ | 'unrecorded'
+/** Held by an earlier pass and not released: not read. */
+ | 'held'
+/** Not given lists, for `reason`: `no-entry`, a script with no record that runs without the platform's entry. */
+ | 'skipped'
+/** Read: it already carries what the settings give now. Applied, its record is refreshed. */
+ | 'unchanged'
+/** A dry run: these settings would change. */
+ | 'would-change'
+/** Updated, verified and recorded. */
+ | 'updated'
+/** Not done, for `reason`; held as well when the reason says the script could not be vouched for. */
+ | 'failed';
+export interface WireWalkScript {
+    readonly deploymentRef: string;
+    readonly vertical: string;
+    readonly versionId: string | null;
+    readonly kind: 'serving' | 'version';
+    readonly action: WireWalkAction;
+    /** The settings that differ (`would-change`, `updated`), by name. */
+    readonly changes?: readonly string[];
+    /**
+     * Why it failed (`concurrent-change`, `serve-in-flight`, `verify`, `entry-unknown`, `settings`,
+     * `settings-refused` or `record`), or was skipped (`no-entry`).
+     */
+    readonly reason?: string;
+    /** For `verify`: the binding names that differed. Never a value. */
+    readonly bindings?: readonly string[];
+    /** For `verify`: how many more bindings differed than `bindings` names (it keeps the first `WALK_HOLD_BINDINGS_MAX`). */
+    readonly more?: number;
+    /** Whether the pass left the script held. */
+    readonly held?: true;
+    /** Whether it was held and a person released it for this pass. */
+    readonly released?: true;
+}
+export interface WireWalkPass {
+    readonly apply: boolean;
+    /** The cursor the pass started from, `null` for the start of the fleet. */
+    readonly from: string | null;
+    /** Where the next pass starts, or `null` when this one reached the end of the fleet. */
+    readonly next: string | null;
+    readonly scripts: readonly WireWalkScript[];
+}
+export interface WireWalkDeps {
+    readonly admin: HostAdmin;
+    readonly actor: PlatformActorId;
+    readonly settings: WireUploadSettings | undefined;
+    readonly api: WireSettingsApi;
+    /** Reads a script's modules back, to learn whether a script with no record carries the platform's entry. */
+    readonly fetchModules?: FetchVerticalModulesFn;
+    /** Records a script's failure as an operational failure: names, reasons and binding names only. */
+    readonly fail: (entry: {
+        readonly vertical: string;
+        readonly version: string | null;
+        readonly stage: string;
+        readonly message: string;
+    }) => void;
+    readonly now?: () => Date;
+}
+/** One script the registry names, as the walk and the readiness report reach it. */
+export interface InventoryScript {
+    readonly vertical: string;
+    readonly deploymentRef: string;
+    readonly versionId: string | null;
+    readonly kind: 'serving' | 'version';
+    /** Where a pass that ends on this script answers the next one starts. */
+    readonly cursor: string;
+}
+/** Every capability record of one vertical's scripts, by script name, read a page at a time. */
+export declare function wireAuthRecordsOf(admin: HostAdmin, actor: PlatformActorId, vertical: string): Promise<Map<string, DeploymentWireAuth>>;
+/**
+ * Hand each script from `fleet` to `each` in order, at most `limit` of them, answering where the next pass starts:
+ * `null` when the last one handled was the fleet's last. Looks one ahead, so the pass that ends on the
+ * fleet's last script already answers `null`; a look that fails does not undo a pass that is done.
+ */
+export declare function wireInventoryPass<T>(fleet: AsyncGenerator<InventoryScript>, limit: number, each: (script: InventoryScript) => Promise<T>, out: T[]): Promise<string | null>;
+/** The registry's scripts in walk order, from `from` on: each vertical's serving script, then its versions' scripts. */
+export declare function wireInventory(admin: HostAdmin, actor: PlatformActorId, from: WireWalkCursor | null): AsyncGenerator<InventoryScript>;
+/** Whether a record already holds what a given record says, in what a script carries: the state, the audience and the key ids. */
+export declare function carriesAlready(stored: WireAuthRecord, given: WireAuthRecord): boolean;
+/** Run one pass. Never throws for one script's failure; throws only for a directory read that fails. */
+export declare function runWireWalk(deps: WireWalkDeps, input: {
+    readonly apply: boolean;
+    readonly cursor: WireWalkCursor | null;
+    readonly limit: number;
+    readonly release: readonly string[];
+    /** A confirming pass: read every recorded script, never trusting its record (no `current`). */
+    readonly confirm?: boolean;
+    /**
+     * Where each script's result is put as soon as it is known: the caller's, so a pass that ends in a
+     * throw still says what it did. Defaults to a fresh list.
+     */
+    readonly sink?: WireWalkScript[];
+}): Promise<WireWalkPass>;
+//# sourceMappingURL=wire-walk.d.ts.map

package/dist/wire-walk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire-walk.d.ts","sourceRoot":"","sources":["../src/wire-walk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAQL,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAyC,KAAK,eAAe,EAA4B,MAAM,oBAAoB,CAAC;AAC3H,OAAO,EAAgD,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEzG,6DAA6D;AAC7D,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C,8CAA8C;AAC9C,eAAO,MAAM,mBAAmB,KAAK,CAAC;AACtC,sDAAsD;AACtD,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAOxC;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAMvE;AAGD,kEAAkE;AAClE,MAAM,MAAM,cAAc;AACxB,yEAAyE;AACvE,SAAS;AACX,6DAA6D;GAC3D,YAAY;AACd,0DAA0D;GACxD,MAAM;AACR,iHAAiH;GAC/G,SAAS;AACX,6FAA6F;GAC3F,WAAW;AACb,8CAA8C;GAC5C,cAAc;AAChB,sCAAsC;GACpC,SAAS;AACX,qGAAqG;GACnG,QAAQ,CAAC;AAEb,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,qEAAqE;IACrE,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,yHAAyH;IACzH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,6CAA6C;IAC7C,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;IACrB,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,wFAAwF;IACxF,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;CAC7C;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC;IAC9B,4GAA4G;IAC5G,QAAQ,CAAC,YAAY,CAAC,EAAE,sBAAsB,CAAC;IAC/C,mGAAmG;IACnG,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACjJ,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED,oFAAoF;AACpF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,SAAS,CAAC;IACrC,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,gGAAgG;AAChG,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAS5I;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,KAAK,EAAE,cAAc,CAAC,eAAe,CAAC,EACtC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,EAC7C,GAAG,EAAE,CAAC,EAAE,GACP,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoBxB;AAED,wHAAwH;AACxH,wBAAuB,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,GAAG,IAAI,GAAG,cAAc,CAAC,eAAe,CAAC,CAyC3I;AAED,kIAAkI;AAClI,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAQrF;AAED,wGAAwG;AACxG,wBAAsB,WAAW,CAC/B,IAAI,EAAE,YAAY,EAClB,KAAK,EAAE;IACL,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,+FAA+F;IAC/F,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,CAAC;CAClC,GACA,OAAO,CAAC,YAAY,CAAC,CAuLvB"}