@substrat-run/control-plane-api 0.161.0 → 0.162.0

package/dist/platform-wire.d.ts

@@ -45,7 +45,8 @@ export declare function platformCallScope(request: Request, body: ArrayBuffer |
  * dispatch stub from, so the envelope always names the script the call reaches. A signer that cannot
  * sign never fails the call: it goes with its legacy header and its whole body, and the line says
  * why, never a key. A streamed call is not signed and its body is not read: it goes exactly as
- * given, counted `skipped`, which is a decision, not a failure.
+ * given, counted `skipped` when its route is listed as unsigned by design, which is a decision, not a
+ * failure, and `failed` (`stream-unlisted`) when it is not.
  */
 export declare function platformSignedFetch(settings: PlatformWireSettings, aud: string, send: typeof fetch): typeof fetch;
 //# sourceMappingURL=platform-wire.d.ts.map

package/dist/platform-wire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform-wire.d.ts","sourceRoot":"","sources":["../src/platform-wire.ts"],"names":[],"mappings":"AAUA,uEAAuE;AACvE,MAAM,WAAW,oBAAoB;IACnC,qCAAqC;IACrC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,iGAAiG;IACjG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC;AAoBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CA6CxF;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,SAAS,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAY/H;AAmBD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,oBAAoB,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,GAAG,OAAO,KAAK,CAejH"}
+{"version":3,"file":"platform-wire.d.ts","sourceRoot":"","sources":["../src/platform-wire.ts"],"names":[],"mappings":"AAUA,uEAAuE;AACvE,MAAM,WAAW,oBAAoB;IACnC,qCAAqC;IACrC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,iGAAiG;IACjG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC;AAoBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CA6CxF;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,SAAS,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAY/H;AAmCD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,oBAAoB,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,GAAG,OAAO,KAAK,CAgBjH"}

package/dist/platform-wire.js

@@ -6,7 +6,7 @@
  * existed.
  */
 import { ULID_PATTERN } from '@substrat-run/contracts';
-import { wireSignerOf } from '@substrat-run/contracts/wire-signing';
+import { wireSignerOf, wireUnsignedRouteOf } from '@substrat-run/contracts/wire-signing';
 /** Bodies that are bytes rather than JSON (a multipart attachment, an octet stream) name no scope. */
 const BYTES = /^(multipart\/|application\/octet-stream)/i;
 const QUOTE = 0x22;
@@ -135,6 +135,22 @@ function streamed(input, init) {
         return isStream(init.body);
     return input instanceof Request && input.body !== null;
 }
+/**
+ * Whether a streamed call goes to a route listed as unsigned by design (`WIRE_UNSIGNED_ROUTES`), by
+ * the method and path it would send. Only such a call is a deliberate skip; a streamed call to any
+ * other route still goes as given, since it cannot be bound without being read, but is counted a
+ * failure (`stream-unlisted`), so a new streamed route shows in the counts until it is listed.
+ */
+function listedStream(input, init) {
+    try {
+        const url = new URL(input instanceof Request ? input.url : String(input));
+        const method = init?.method ?? (input instanceof Request ? input.method : 'GET');
+        return wireUnsignedRouteOf(method, url.pathname) !== undefined;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * The `fetch` a client for the deployment the dispatch namespace knows as `aud` is given: `send`
  * itself while the flag is off; on, `send` behind the signer, so every call, a retry included, is
@@ -142,7 +158,8 @@ function streamed(input, init) {
  * dispatch stub from, so the envelope always names the script the call reaches. A signer that cannot
  * sign never fails the call: it goes with its legacy header and its whole body, and the line says
  * why, never a key. A streamed call is not signed and its body is not read: it goes exactly as
- * given, counted `skipped`, which is a decision, not a failure.
+ * given, counted `skipped` when its route is listed as unsigned by design, which is a decision, not a
+ * failure, and `failed` (`stream-unlisted`) when it is not.
  */
 export function platformSignedFetch(settings, aud, send) {
     const signer = wireSignerOf(settings);
@@ -152,7 +169,10 @@ export function platformSignedFetch(settings, aud, send) {
     const count = (outcome, reason) => log(JSON.stringify({ substrat: 'wire-sign', issuer: 'platform', aud, outcome, ...(reason ? { reason } : {}) }));
     return (async (input, init) => {
         if (streamed(input, init)) {
-            count('skipped', 'stream');
+            if (listedStream(input, init))
+                count('skipped', 'stream');
+            else
+                count('failed', 'stream-unlisted');
             return send(input, init);
         }
         const result = await signer(new Request(input, init), { iss: 'platform', kind: 'call', aud }, platformCallScope);

package/dist/platform-wire.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform-wire.js","sourceRoot":"","sources":["../src/platform-wire.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAuB,MAAM,sCAAsC,CAAC;AAYzF,sGAAsG;AACtG,MAAM,KAAK,GAAG,2CAA2C,CAAC;AAE1D,MAAM,KAAK,GAAG,IAAI,CAAC;AACnB,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB,MAAM,KAAK,GAAG,IAAI,CAAC;AACnB,MAAM,KAAK,GAAG,IAAI,CAAC;AACnB,MAAM,WAAW,GAAG,IAAI,CAAC;AACzB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;AAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AACrC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAChD,qGAAqG;AACrG,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,KAAK,GAAG;IACZ,CAAC,UAAU,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAClD,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;CACxC,CAAC;AAEX;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,WAAW,CAAC,KAAiB;IAC3C,MAAM,KAAK,GAA8C,EAAE,CAAC;IAC5D,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;QAAE,CAAC,EAAE,CAAC;IACrD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,wFAAwF;IACxF,IAAI,OAAO,GAAuC,IAAI,CAAC;IACvD,MAAM,MAAM,GAAG,CAAC,KAAc,EAAE,EAAE;QAChC,IAAI,OAAO;YAAE,KAAK,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;QACpC,OAAO,GAAG,IAAI,CAAC;QACf,OAAO,UAAU,IAAI,KAAK,IAAI,SAAS,IAAI,KAAK,CAAC;IACnD,CAAC,CAAC;IACF,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACpB,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC,GAAG,KAAK,CAAC;YACV,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK;gBAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YACpC,6FAA6F;YAC7F,4EAA4E;YAC5E,IAAI,SAAS,EAAE,CAAC;gBACd,SAAS,GAAG,KAAK,CAAC;gBAClB,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3H,CAAC;iBAAM,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAClG,IAAI,MAAM,CAAC,IAAI,CAAC;oBAAE,OAAO,KAAK,CAAC;YACjC,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACxB,gGAAgG;YAChG,IAAI,OAAO,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC;YACnD,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,KAAK,CAAC;gBAAE,SAAS,GAAG,IAAI,CAAC;QACpC,CAAC;aAAM,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACzB,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;QAChC,CAAC;aAAM,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,KAAK;gBAAE,SAAS,GAAG,IAAI,CAAC;YAClC,qEAAqE;iBAChE,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,OAAO,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC;QAC1F,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAgB,EAAE,IAA6B;IAC/E,MAAM,IAAI,GAAG,CAAC,QAAiB,EAAE,OAAgB,EAAE,EAAE,CACnD,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;QACtH,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE;QACvB,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACxG,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;IAChC,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;IAChD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,kDAAkD;AAClD,MAAM,QAAQ,GAAG,CAAC,IAAa,EAAE,EAAE,CACjC,IAAI,YAAY,cAAc,IAAI,OAAQ,IAAmD,EAAE,SAAS,KAAK,UAAU,CAAC;AAE1H;;;;;;;GAOG;AACH,SAAS,QAAQ,CAAC,KAAwB,EAAE,IAA6B;IACvE,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,OAAO,KAAK,YAAY,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AACzD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA8B,EAAE,GAAW,EAAE,IAAkB;IACjG,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,CAAC,OAA8C,EAAE,MAAe,EAAE,EAAE,CAChF,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAClH,OAAO,CAAC,KAAK,EAAE,KAAwB,EAAE,IAAkB,EAAE,EAAE;QAC7D,IAAI,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;YAC1B,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC3B,OAAO,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACjH,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC/E,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC,CAAiB,CAAC;AACrB,CAAC"}
+{"version":3,"file":"platform-wire.js","sourceRoot":"","sources":["../src/platform-wire.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAuB,MAAM,sCAAsC,CAAC;AAY9G,sGAAsG;AACtG,MAAM,KAAK,GAAG,2CAA2C,CAAC;AAE1D,MAAM,KAAK,GAAG,IAAI,CAAC;AACnB,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB,MAAM,KAAK,GAAG,IAAI,CAAC;AACnB,MAAM,KAAK,GAAG,IAAI,CAAC;AACnB,MAAM,WAAW,GAAG,IAAI,CAAC;AACzB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;AAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AACrC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAChD,qGAAqG;AACrG,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,KAAK,GAAG;IACZ,CAAC,UAAU,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAClD,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;CACxC,CAAC;AAEX;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,WAAW,CAAC,KAAiB;IAC3C,MAAM,KAAK,GAA8C,EAAE,CAAC;IAC5D,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;QAAE,CAAC,EAAE,CAAC;IACrD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,wFAAwF;IACxF,IAAI,OAAO,GAAuC,IAAI,CAAC;IACvD,MAAM,MAAM,GAAG,CAAC,KAAc,EAAE,EAAE;QAChC,IAAI,OAAO;YAAE,KAAK,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;QACpC,OAAO,GAAG,IAAI,CAAC;QACf,OAAO,UAAU,IAAI,KAAK,IAAI,SAAS,IAAI,KAAK,CAAC;IACnD,CAAC,CAAC;IACF,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACpB,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC,GAAG,KAAK,CAAC;YACV,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK;gBAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YACpC,6FAA6F;YAC7F,4EAA4E;YAC5E,IAAI,SAAS,EAAE,CAAC;gBACd,SAAS,GAAG,KAAK,CAAC;gBAClB,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3H,CAAC;iBAAM,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAClG,IAAI,MAAM,CAAC,IAAI,CAAC;oBAAE,OAAO,KAAK,CAAC;YACjC,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACxB,gGAAgG;YAChG,IAAI,OAAO,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC;YACnD,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,KAAK,CAAC;gBAAE,SAAS,GAAG,IAAI,CAAC;QACpC,CAAC;aAAM,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACzB,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;QAChC,CAAC;aAAM,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,KAAK;gBAAE,SAAS,GAAG,IAAI,CAAC;YAClC,qEAAqE;iBAChE,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,OAAO,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC;QAC1F,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAgB,EAAE,IAA6B;IAC/E,MAAM,IAAI,GAAG,CAAC,QAAiB,EAAE,OAAgB,EAAE,EAAE,CACnD,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;QACtH,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE;QACvB,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACxG,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;IAChC,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;IAChD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,kDAAkD;AAClD,MAAM,QAAQ,GAAG,CAAC,IAAa,EAAE,EAAE,CACjC,IAAI,YAAY,cAAc,IAAI,OAAQ,IAAmD,EAAE,SAAS,KAAK,UAAU,CAAC;AAE1H;;;;;;;GAOG;AACH,SAAS,QAAQ,CAAC,KAAwB,EAAE,IAA6B;IACvE,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,OAAO,KAAK,YAAY,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,KAAwB,EAAE,IAA6B;IAC3E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACjF,OAAO,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA8B,EAAE,GAAW,EAAE,IAAkB;IACjG,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,CAAC,OAA8C,EAAE,MAAe,EAAE,EAAE,CAChF,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAClH,OAAO,CAAC,KAAK,EAAE,KAAwB,EAAE,IAAkB,EAAE,EAAE;QAC7D,IAAI,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;YAC1B,IAAI,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC;gBAAE,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;;gBACrD,KAAK,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;YACxC,OAAO,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACjH,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC/E,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC,CAAiB,CAAC;AACrB,CAAC"}

package/dist/wire-readiness.d.ts

@@ -0,0 +1,149 @@
+/**
+ * The readiness report (RFC wire-signing §7, follow-on 4): what the fleet's capability records say
+ * about each rollout step, and what still blocks it. Three gates, each a list of blockers:
+ *
+ * - **`signed-only`**: what blocks moving an environment's down-channel from `dual` to `signed-only`.
+ * - **key drop**: what blocks dropping a public key from an issuer's list.
+ * - **credential withdrawal**: what blocks withdrawing the shared credential (step 7).
+ *
+ * It is **advisory**: it informs the person who flips a setting or drops a key, and nothing in the
+ * tooling enforces it yet (follow-on 7). It is **read-only** by construction: it reads the registry,
+ * the capability records and the fleet walk's admin rows, and calls nothing else. It never reads a
+ * script, never walks, and writes nothing; the record reads it makes leave their own access-log rows.
+ *
+ * **Unknown is never read as fact.** A script with no record, a record the walk holds (`walkHold`),
+ * and a record the walk could not verify (`withheld: 'unverified'`) are listed as unknown, and every
+ * gate treats unknown as blocking. A record is trusted as current only when it was written after the
+ * last confirming walk began (`wireConfirmation`); when that walk cannot be found whole in the admin
+ * log, confirmation is unknown, and every gate that needs it is blocked.
+ *
+ * Every reason is a fixed sentence, naming at most a setting or a vertical; never a key, a key id or
+ * a tenant.
+ */
+import { type AdminLogEntry, type PlatformActorId, type WireAuthRecord } from '@substrat-run/contracts';
+import type { HostAdmin } from '@substrat-run/kernel';
+import { type WireUploadSettings } from './wire-upload.js';
+import { type WireWalkCursor } from './wire-walk.js';
+/** A report page covers this many scripts when it names no limit. */
+export declare const WIRE_READINESS_LIMIT_DEFAULT = 25;
+/** A report page covers at most this many scripts. */
+export declare const WIRE_READINESS_LIMIT_MAX = 50;
+/** The most walk rows the report reads to find the last confirming walk; a walk longer than that is unknown. */
+export declare const WIRE_CONFIRM_ROWS_MAX = 200;
+/** What every report says first. */
+export declare const WIRE_READINESS_ADVISORY = "advisory: this report informs the person who flips the down-channel, drops a key or withdraws the shared credential; no tooling enforces it yet (follow-on 7)";
+/** What every report says second: when its answer holds. */
+export declare const WIRE_READINESS_AS_OF = "the answer is as of each record\u2019s recorded time, not live: run the confirming pass immediately before any flip or drop, and run the report after it";
+export type WireGate = 'signed-only' | 'key-drop' | 'credential-withdrawal';
+/** One thing that blocks a gate. */
+export interface WireBlocker {
+    /**
+     * `standing`: by design, until a later step answers it. `settings`: the control plane's own wire
+     * settings. `confirmation`: the last confirming walk. `script`: one script, named.
+     */
+    readonly kind: 'standing' | 'settings' | 'confirmation' | 'script';
+    readonly deploymentRef?: string;
+    readonly vertical?: string;
+    readonly reason: string;
+}
+/** What the last confirming walk proves: when it began, or why it proves nothing. */
+export type WireConfirmation = {
+    readonly status: 'confirmed';
+    readonly startedAt: string;
+    readonly passes: number;
+} | {
+    readonly status: 'unknown';
+    readonly reason: string;
+};
+/** One script, as the records say. */
+export interface WireReadinessScript {
+    readonly deploymentRef: string;
+    readonly vertical: string;
+    readonly versionId: string | null;
+    readonly kind: 'serving' | 'version';
+    /**
+     * `unknown`: no record, held by the walk, or unverified by it. `verifies`: its record says it carries
+     * the platform's entry and was given lists. `not-verifying`: its record says it verifies nothing
+     * (no entry, or no lists).
+     */
+    readonly status: 'unknown' | 'verifies' | 'not-verifying';
+    /** Its record's state, when it has a record. */
+    readonly state?: WireAuthRecord['state'];
+    /** Whether its record was written after the last confirming walk began; `null` when that is unknown. */
+    readonly confirmed: boolean | null;
+}
+/** The key a person asks to drop, and when the control plane's list stopped naming it. */
+export interface WireKeyDrop {
+    readonly issuer: 'router' | 'platform';
+    readonly kid: string;
+    readonly since: string;
+}
+export interface WireReadinessReport {
+    readonly advisory: string;
+    readonly asOf: string;
+    readonly from: string | null;
+    /** Where the next page starts, `null` at the end of the fleet. A gate is clear only when every page, from the start, shows it clear. */
+    readonly next: string | null;
+    readonly confirmation: WireConfirmation;
+    /** The key drop asked about, echoed: its issuer and `since`. */
+    readonly keyDrop?: {
+        readonly issuer: WireKeyDrop['issuer'];
+        readonly since: string;
+    };
+    readonly scripts: readonly WireReadinessScript[];
+    readonly blockers: {
+        readonly signedOnly: readonly WireBlocker[];
+        readonly keyDrop?: readonly WireBlocker[];
+        readonly credentialWithdrawal: readonly WireBlocker[];
+    };
+}
+/** The fixed sentences, in one place, so every copy reads the same. */
+export declare const WIRE_READINESS_REASONS: {
+    readonly counters: 'the cutover counters (no legacy acceptance, no dual-mismatch, no fault, no refusal outside client noise) are not read by this report yet, nor is a version whose default export has no fetch, which only the counters show';
+    readonly notSignedOnly: 'no environment is signed-only: every upload and every walk gives dual';
+    readonly upChannel: 'the up-channel removals (step 6) are not recorded per version, so no version is shown to make no up-call with the shared credential';
+    readonly perDeployment: 'no version carries per-deployment values for its legacy checks (Q10), so a version never rebuilt still needs the shared credential';
+    readonly rolloutNotFleet: 'WIRE_KEYS_ROLLOUT is not fleet: not every deployment is given key lists';
+    readonly noRecord: 'it has no capability record, so what it carries is unknown';
+    readonly held: 'the fleet walk holds it, so its record states what was last known, not what it runs: look at it, then release it or push it again';
+    readonly unverified: 'the fleet walk found it with no record and could not verify it, so what it carries is unknown';
+    readonly noEntry: 'it was uploaded without the platform entry, so it verifies nothing: it is ready once pushed again';
+    readonly noLists: 'it was given no key lists, so it is legacy-only';
+    readonly stale: 'it does not carry the key lists, audience and state the control plane gives now: walk the fleet';
+    readonly noRouterStandby: 'its router key list holds no standby key beside the key in use';
+    readonly noPlatformStandby: 'its platform key list holds no standby key beside the key in use';
+    readonly unconfirmed: 'its record was written before the last confirming walk began, so it is not trusted as current';
+    readonly confirmationUnknown: 'the last confirming walk is unknown, so no record is trusted as current';
+    readonly confirmedBeforeSince: 'the last confirming walk began before the key left the list, so it does not show the key gone';
+    readonly stillListed: 'the control plane still lists the key';
+    readonly listWouldEmpty: 'the key is the only one its issuer lists';
+    readonly stillTrusted: 'it still trusts the key';
+    readonly lacksKeyInUse: 'it does not carry every key its issuer lists now';
+};
+/**
+ * What the last confirming walk proves, from the walk's admin rows, newest first (at most
+ * `WIRE_CONFIRM_ROWS_MAX`, plus one more to tell a full read from a cut one). Fails closed: confirmed
+ * only when the newest APPLIED pass is a confirming one that reached the end of the fleet, and the
+ * applied passes before it, one after another with no other applied pass between, are confirming ones
+ * chained back to the start of the fleet (each pass's `from` the `next` of the pass before), none of
+ * them refused or ended in an error, each with its start time. Anything else is `unknown`, with why:
+ * no such walk, a gap in the chain, a refused or failed pass in it, a row it cannot read, or a chain
+ * that runs past the rows read.
+ */
+export declare function wireConfirmation(rows: readonly Pick<AdminLogEntry, 'after'>[]): WireConfirmation;
+/** `since` as a person gives it: an instant, not in the future. A fixed sentence when it is not. */
+export declare function wireKeyDropSince(since: unknown, now: Date): string | {
+    readonly refused: string;
+};
+/** One page of the report. Reads only; never throws for one script, only for a directory read that fails. */
+export declare function wireReadinessReport(deps: {
+    readonly admin: HostAdmin;
+    readonly actor: PlatformActorId;
+    readonly settings: WireUploadSettings | undefined;
+}, input: {
+    readonly cursor: WireWalkCursor | null;
+    readonly from: string | null;
+    readonly limit: number;
+    readonly keyDrop?: WireKeyDrop;
+}): Promise<WireReadinessReport>;
+//# sourceMappingURL=wire-readiness.d.ts.map

package/dist/wire-readiness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire-readiness.d.ts","sourceRoot":"","sources":["../src/wire-readiness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAc,KAAK,aAAa,EAA2B,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAE7I,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAA2D,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACpH,OAAO,EAA6F,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhJ,qEAAqE;AACrE,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAC/C,sDAAsD;AACtD,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,gHAAgH;AAChH,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC,oCAAoC;AACpC,eAAO,MAAM,uBAAuB,kKAC6H,CAAC;AAElK,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,6JACsH,CAAC;AAExJ,MAAM,MAAM,QAAQ,GAAG,aAAa,GAAG,UAAU,GAAG,uBAAuB,CAAC;AAE5E,oCAAoC;AACpC,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,GAAG,cAAc,GAAG,QAAQ,CAAC;IACnE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,qFAAqF;AACrF,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrF;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5D,sCAAsC;AACtC,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,SAAS,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,eAAe,CAAC;IAC1D,gDAAgD;IAChD,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;IACzC,wGAAwG;IACxG,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;CACpC;AAED,0FAA0F;AAC1F,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAC;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,wIAAwI;IACxI,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;IACxC,gEAAgE;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACtF,QAAQ,CAAC,OAAO,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,UAAU,EAAE,SAAS,WAAW,EAAE,CAAC;QAC5C,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;QAC1C,QAAQ,CAAC,oBAAoB,EAAE,SAAS,WAAW,EAAE,CAAC;KACvD,CAAC;CACH;AAED,uEAAuE;AACvE,eAAO,MAAM,sBAAsB;aACjC,QAAQ,EACN,4NAA4N;aAC9N,aAAa,EAAE,uEAAuE;aACtF,SAAS,EAAE,qIAAqI;aAChJ,aAAa,EAAE,oIAAoI;aACnJ,eAAe,EAAE,yEAAyE;aAC1F,QAAQ,EAAE,4DAA4D;aACtE,IAAI,EAAE,mIAAmI;aACzI,UAAU,EAAE,+FAA+F;aAC3G,OAAO,EAAE,mGAAmG;aAC5G,OAAO,EAAE,iDAAiD;aAC1D,KAAK,EAAE,iGAAiG;aACxG,eAAe,EAAE,gEAAgE;aACjF,iBAAiB,EAAE,kEAAkE;aACrF,WAAW,EAAE,+FAA+F;aAC5G,mBAAmB,EAAE,yEAAyE;aAC9F,oBAAoB,EAAE,+FAA+F;aACrH,WAAW,EAAE,uCAAuC;aACpD,cAAc,EAAE,0CAA0C;aAC1D,YAAY,EAAE,yBAAyB;aACvC,aAAa,EAAE,kDAAkD;CACzD,CAAC;AAeX;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,GAAG,gBAAgB,CA0BhG;AAED,oGAAoG;AACpG,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAMjG;AAeD,6GAA6G;AAC7G,wBAAsB,mBAAmB,CACvC,IAAI,EAAE;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,GAAG,SAAS,CAAA;CAAE,EACvH,KAAK,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAA;CAAE,GACtI,OAAO,CAAC,mBAAmB,CAAC,CAyG9B"}

package/dist/wire-readiness.js

@@ -0,0 +1,250 @@
+/**
+ * The readiness report (RFC wire-signing §7, follow-on 4): what the fleet's capability records say
+ * about each rollout step, and what still blocks it. Three gates, each a list of blockers:
+ *
+ * - **`signed-only`**: what blocks moving an environment's down-channel from `dual` to `signed-only`.
+ * - **key drop**: what blocks dropping a public key from an issuer's list.
+ * - **credential withdrawal**: what blocks withdrawing the shared credential (step 7).
+ *
+ * It is **advisory**: it informs the person who flips a setting or drops a key, and nothing in the
+ * tooling enforces it yet (follow-on 7). It is **read-only** by construction: it reads the registry,
+ * the capability records and the fleet walk's admin rows, and calls nothing else. It never reads a
+ * script, never walks, and writes nothing; the record reads it makes leave their own access-log rows.
+ *
+ * **Unknown is never read as fact.** A script with no record, a record the walk holds (`walkHold`),
+ * and a record the walk could not verify (`withheld: 'unverified'`) are listed as unknown, and every
+ * gate treats unknown as blocking. A record is trusted as current only when it was written after the
+ * last confirming walk began (`wireConfirmation`); when that walk cannot be found whole in the admin
+ * log, confirmation is unknown, and every gate that needs it is blocked.
+ *
+ * Every reason is a fixed sentence, naming at most a setting or a vertical; never a key, a key id or
+ * a tenant.
+ */
+import { instant, z } from '@substrat-run/contracts';
+import { wireUploadSettings, WIRE_UNSIGNED_ROUTES } from '@substrat-run/contracts/wire-signing';
+import { wireSettingsRefusal, wireKeysRolloutOf, wireUploadGiven } from './wire-upload.js';
+import { carriesAlready, wireAuthRecordsOf, wireInventory, wireInventoryPass } from './wire-walk.js';
+/** A report page covers this many scripts when it names no limit. */
+export const WIRE_READINESS_LIMIT_DEFAULT = 25;
+/** A report page covers at most this many scripts. */
+export const WIRE_READINESS_LIMIT_MAX = 50;
+/** The most walk rows the report reads to find the last confirming walk; a walk longer than that is unknown. */
+export const WIRE_CONFIRM_ROWS_MAX = 200;
+/** What every report says first. */
+export const WIRE_READINESS_ADVISORY = 'advisory: this report informs the person who flips the down-channel, drops a key or withdraws the shared credential; no tooling enforces it yet (follow-on 7)';
+/** What every report says second: when its answer holds. */
+export const WIRE_READINESS_AS_OF = 'the answer is as of each record’s recorded time, not live: run the confirming pass immediately before any flip or drop, and run the report after it';
+/** The fixed sentences, in one place, so every copy reads the same. */
+export const WIRE_READINESS_REASONS = {
+    counters: 'the cutover counters (no legacy acceptance, no dual-mismatch, no fault, no refusal outside client noise) are not read by this report yet, nor is a version whose default export has no fetch, which only the counters show',
+    notSignedOnly: 'no environment is signed-only: every upload and every walk gives dual',
+    upChannel: 'the up-channel removals (step 6) are not recorded per version, so no version is shown to make no up-call with the shared credential',
+    perDeployment: 'no version carries per-deployment values for its legacy checks (Q10), so a version never rebuilt still needs the shared credential',
+    rolloutNotFleet: 'WIRE_KEYS_ROLLOUT is not fleet: not every deployment is given key lists',
+    noRecord: 'it has no capability record, so what it carries is unknown',
+    held: 'the fleet walk holds it, so its record states what was last known, not what it runs: look at it, then release it or push it again',
+    unverified: 'the fleet walk found it with no record and could not verify it, so what it carries is unknown',
+    noEntry: 'it was uploaded without the platform entry, so it verifies nothing: it is ready once pushed again',
+    noLists: 'it was given no key lists, so it is legacy-only',
+    stale: 'it does not carry the key lists, audience and state the control plane gives now: walk the fleet',
+    noRouterStandby: 'its router key list holds no standby key beside the key in use',
+    noPlatformStandby: 'its platform key list holds no standby key beside the key in use',
+    unconfirmed: 'its record was written before the last confirming walk began, so it is not trusted as current',
+    confirmationUnknown: 'the last confirming walk is unknown, so no record is trusted as current',
+    confirmedBeforeSince: 'the last confirming walk began before the key left the list, so it does not show the key gone',
+    stillListed: 'the control plane still lists the key',
+    listWouldEmpty: 'the key is the only one its issuer lists',
+    stillTrusted: 'it still trusts the key',
+    lacksKeyInUse: 'it does not carry every key its issuer lists now',
+};
+const R = WIRE_READINESS_REASONS;
+/** The walk row's fields the report reads; any other shape is a row it cannot read. */
+const walkRow = z.object({
+    apply: z.boolean(),
+    confirm: z.boolean(),
+    startedAt: instant.optional(),
+    from: z.string().nullable(),
+    next: z.string().nullable(),
+    error: z.string().optional(),
+    refused: z.string().optional(),
+});
+/**
+ * What the last confirming walk proves, from the walk's admin rows, newest first (at most
+ * `WIRE_CONFIRM_ROWS_MAX`, plus one more to tell a full read from a cut one). Fails closed: confirmed
+ * only when the newest APPLIED pass is a confirming one that reached the end of the fleet, and the
+ * applied passes before it, one after another with no other applied pass between, are confirming ones
+ * chained back to the start of the fleet (each pass's `from` the `next` of the pass before), none of
+ * them refused or ended in an error, each with its start time. Anything else is `unknown`, with why:
+ * no such walk, a gap in the chain, a refused or failed pass in it, a row it cannot read, or a chain
+ * that runs past the rows read.
+ */
+export function wireConfirmation(rows) {
+    const unknown = (reason) => ({ status: 'unknown', reason });
+    const read = rows.slice(0, WIRE_CONFIRM_ROWS_MAX);
+    const parsed = [];
+    for (const row of read) {
+        const p = walkRow.safeParse(row.after);
+        if (!p.success)
+            return unknown('a fleet walk row could not be read');
+        parsed.push(p.data);
+    }
+    const applied = parsed.filter((p) => p.apply);
+    if (applied.length === 0) {
+        return unknown(rows.length > read.length ? 'no applied walk is among the rows read' : 'no applied confirming walk is recorded');
+    }
+    let expected = null;
+    for (let i = 0; i < applied.length; i++) {
+        const p = applied[i];
+        if (!p.confirm) {
+            return unknown(i === 0 ? 'the last applied walk was not a confirming one' : 'an applied walk that was not confirming ran inside the last confirming walk');
+        }
+        if (p.refused !== undefined || p.error !== undefined)
+            return unknown('a pass of the last confirming walk was refused or ended in an error');
+        if (p.next !== expected)
+            return unknown(i === 0 ? 'the last confirming walk did not reach the end of the fleet' : 'the last confirming walk has a gap between its passes');
+        if (p.startedAt === undefined)
+            return unknown('a pass of the last confirming walk does not record when it began');
+        if (p.from === null)
+            return { status: 'confirmed', startedAt: p.startedAt, passes: i + 1 };
+        expected = p.from;
+    }
+    return unknown(rows.length > read.length ? 'the last confirming walk runs past the rows read' : 'the last confirming walk does not reach back to the start of the fleet');
+}
+/** `since` as a person gives it: an instant, not in the future. A fixed sentence when it is not. */
+export function wireKeyDropSince(since, now) {
+    if (since === undefined || since === null || since === '')
+        return { refused: 'a key drop names since: when the control plane’s list stopped naming the key' };
+    const parsed = instant.safeParse(since);
+    if (!parsed.success)
+        return { refused: 'since is an ISO 8601 instant' };
+    if (Date.parse(parsed.data) > now.getTime())
+        return { refused: 'since is not in the future' };
+    return parsed.data;
+}
+/** The key ids each issuer's list names now, or `null` when the lists do not load. */
+async function listedKids(settings) {
+    try {
+        const given = await wireUploadSettings({ routerKeys: settings?.routerKeys ?? '', platformKeys: settings?.platformKeys ?? '', audience: 'wire-settings-check' });
+        return { router: given.routerKids, platform: given.platformKids };
+    }
+    catch {
+        return null;
+    }
+}
+const unknownReason = (record) => !record ? R.noRecord : record.record.walkHold !== undefined ? R.held : record.record.withheld === 'unverified' ? R.unverified : null;
+/** One page of the report. Reads only; never throws for one script, only for a directory read that fails. */
+export async function wireReadinessReport(deps, input) {
+    const { admin, actor, settings } = deps;
+    const rows = await admin.auditLog(actor, { action: 'walkWireAuth', order: 'desc', limit: WIRE_CONFIRM_ROWS_MAX + 1 });
+    const confirmation = wireConfirmation(rows);
+    const refused = await wireSettingsRefusal(settings);
+    const rollout = wireKeysRolloutOf(settings?.rollout);
+    const kids = await listedKids(settings);
+    const signedOnly = [
+        ...WIRE_UNSIGNED_ROUTES.map((r) => ({ kind: 'standing', reason: `${r.method} ${r.path}: ${r.reason}` })),
+        { kind: 'standing', reason: R.counters },
+    ];
+    const drop = input.keyDrop ? [] : undefined;
+    const settingsBlocker = refused ? { kind: 'settings', reason: `the control plane’s wire settings are refused (${refused.withheld}): ${refused.reason}` } : null;
+    if (settingsBlocker) {
+        signedOnly.push(settingsBlocker);
+        drop?.push(settingsBlocker);
+    }
+    else if ('refused' in rollout || rollout.kind !== 'fleet') {
+        // Only while the settings are usable: a refusal hides the rollout state, and is the fix to make first.
+        signedOnly.push({ kind: 'settings', reason: R.rolloutNotFleet });
+    }
+    if (confirmation.status === 'unknown') {
+        const blocker = { kind: 'confirmation', reason: `${R.confirmationUnknown}: ${confirmation.reason}` };
+        signedOnly.push(blocker);
+        drop?.push(blocker);
+    }
+    const keyDrop = input.keyDrop;
+    if (keyDrop && drop) {
+        const listed = kids?.[keyDrop.issuer] ?? null;
+        if (listed === null) {
+            if (!settingsBlocker)
+                drop.push({ kind: 'settings', reason: 'the control plane’s key lists do not load' });
+        }
+        else {
+            if (listed.includes(keyDrop.kid))
+                drop.push({ kind: 'settings', reason: R.stillListed });
+            if (listed.every((k) => k === keyDrop.kid))
+                drop.push({ kind: 'settings', reason: R.listWouldEmpty });
+        }
+        if (confirmation.status === 'confirmed' && Date.parse(confirmation.startedAt) < Date.parse(keyDrop.since)) {
+            drop.push({ kind: 'confirmation', reason: R.confirmedBeforeSince });
+        }
+    }
+    let records = null;
+    const recordOf = async (script) => {
+        if (records?.vertical !== script.vertical)
+            records = { vertical: script.vertical, held: await wireAuthRecordsOf(admin, actor, script.vertical) };
+        return records.held.get(script.deploymentRef);
+    };
+    const judge = async (script) => {
+        const stored = await recordOf(script);
+        const named = (reason) => ({ kind: 'script', deploymentRef: script.deploymentRef, vertical: script.vertical, reason });
+        const base = { deploymentRef: script.deploymentRef, vertical: script.vertical, versionId: script.versionId, kind: script.kind };
+        const unknown = unknownReason(stored);
+        if (unknown !== null || !stored) {
+            const blocker = named(unknown ?? R.noRecord);
+            signedOnly.push(blocker);
+            drop?.push(blocker);
+            return { ...base, status: 'unknown', ...(stored ? { state: stored.record.state } : {}), confirmed: null };
+        }
+        const record = stored.record;
+        const confirmed = confirmation.status === 'confirmed' ? Date.parse(stored.recordedAt) >= Date.parse(confirmation.startedAt) : null;
+        const verifies = record.envelope !== null && record.withheld === null;
+        if (record.envelope === null) {
+            signedOnly.push(named(R.noEntry));
+        }
+        else if (record.withheld !== null) {
+            signedOnly.push(named(`${R.noLists} (${record.withheld})`));
+        }
+        const given = await wireUploadGiven(settings, { vertical: script.vertical, deploymentRef: script.deploymentRef, entry: { envelope: record.envelope, entrySkipped: record.entrySkipped } });
+        if (verifies) {
+            if (!carriesAlready(record, given.record))
+                signedOnly.push(named(R.stale));
+            if (record.routerKids.length < 2)
+                signedOnly.push(named(R.noRouterStandby));
+            if (record.platformKids.length < 2)
+                signedOnly.push(named(R.noPlatformStandby));
+        }
+        if (confirmed === false) {
+            signedOnly.push(named(R.unconfirmed));
+            drop?.push(named(R.unconfirmed));
+        }
+        if (keyDrop && drop) {
+            const trusted = keyDrop.issuer === 'router' ? record.routerKids : record.platformKids;
+            if (trusted.includes(keyDrop.kid))
+                drop.push(named(R.stillTrusted));
+            const listed = kids?.[keyDrop.issuer];
+            if (trusted.length > 0 && listed && listed.some((k) => k !== keyDrop.kid && !trusted.includes(k)))
+                drop.push(named(R.lacksKeyInUse));
+        }
+        return { ...base, status: verifies ? 'verifies' : 'not-verifying', state: record.state, confirmed };
+    };
+    const scripts = [];
+    const next = await wireInventoryPass(wireInventory(admin, actor, input.cursor), input.limit, judge, scripts);
+    // Everything that blocks signed-only but its standing blockers blocks the withdrawal too: a script
+    // that does not carry and verify signed calls still needs the shared credential. Signed-only's
+    // standing blockers are covered by the withdrawal's own first one (no environment is signed-only).
+    const withdrawal = [
+        { kind: 'standing', reason: R.notSignedOnly },
+        { kind: 'standing', reason: R.upChannel },
+        { kind: 'standing', reason: R.perDeployment },
+        ...signedOnly.filter((b) => b.kind !== 'standing'),
+    ];
+    return {
+        advisory: WIRE_READINESS_ADVISORY,
+        asOf: WIRE_READINESS_AS_OF,
+        from: input.from,
+        next,
+        confirmation,
+        ...(keyDrop ? { keyDrop: { issuer: keyDrop.issuer, since: keyDrop.since } } : {}),
+        scripts,
+        blockers: { signedOnly, ...(drop ? { keyDrop: drop } : {}), credentialWithdrawal: withdrawal },
+    };
+}
+//# sourceMappingURL=wire-readiness.js.map

package/dist/wire-readiness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire-readiness.js","sourceRoot":"","sources":["../src/wire-readiness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,OAAO,EAAE,CAAC,EAA0F,MAAM,yBAAyB,CAAC;AAC7I,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAEhG,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,eAAe,EAA2B,MAAM,kBAAkB,CAAC;AACpH,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,iBAAiB,EAA6C,MAAM,gBAAgB,CAAC;AAEhJ,qEAAqE;AACrE,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,CAAC;AAC/C,sDAAsD;AACtD,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAC3C,gHAAgH;AAChH,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAEzC,oCAAoC;AACpC,MAAM,CAAC,MAAM,uBAAuB,GAClC,+JAA+J,CAAC;AAElK,4DAA4D;AAC5D,MAAM,CAAC,MAAM,oBAAoB,GAC/B,qJAAqJ,CAAC;AA+DxJ,uEAAuE;AACvE,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,QAAQ,EACN,4NAA4N;IAC9N,aAAa,EAAE,uEAAuE;IACtF,SAAS,EAAE,qIAAqI;IAChJ,aAAa,EAAE,oIAAoI;IACnJ,eAAe,EAAE,yEAAyE;IAC1F,QAAQ,EAAE,4DAA4D;IACtE,IAAI,EAAE,mIAAmI;IACzI,UAAU,EAAE,+FAA+F;IAC3G,OAAO,EAAE,mGAAmG;IAC5G,OAAO,EAAE,iDAAiD;IAC1D,KAAK,EAAE,iGAAiG;IACxG,eAAe,EAAE,gEAAgE;IACjF,iBAAiB,EAAE,kEAAkE;IACrF,WAAW,EAAE,+FAA+F;IAC5G,mBAAmB,EAAE,yEAAyE;IAC9F,oBAAoB,EAAE,+FAA+F;IACrH,WAAW,EAAE,uCAAuC;IACpD,cAAc,EAAE,0CAA0C;IAC1D,YAAY,EAAE,yBAAyB;IACvC,aAAa,EAAE,kDAAkD;CACzD,CAAC;AAEX,MAAM,CAAC,GAAG,sBAAsB,CAAC;AAEjC,uFAAuF;AACvF,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;IAClB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAA6C;IAC5E,MAAM,OAAO,GAAG,CAAC,MAAc,EAAoB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IACtF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAClD,MAAM,MAAM,GAA8B,EAAE,CAAC;IAC7C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,OAAO,OAAO,CAAC,oCAAoC,CAAC,CAAC;QACrE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC;IAClI,CAAC;IACD,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QACtB,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC,CAAC,6EAA6E,CAAC,CAAC;QAC7J,CAAC;QACD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,qEAAqE,CAAC,CAAC;QAC5I,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,6DAA6D,CAAC,CAAC,CAAC,uDAAuD,CAAC,CAAC;QAC3K,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,kEAAkE,CAAC,CAAC;QAClH,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3F,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC;IACpB,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC,wEAAwE,CAAC,CAAC;AAC5K,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,gBAAgB,CAAC,KAAc,EAAE,GAAS;IACxD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,8EAA8E,EAAE,CAAC;IAC9J,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;IACxE,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;IAC9F,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,UAAU,CAAC,QAAwC;IAChE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,IAAI,EAAE,EAAE,QAAQ,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAChK,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,MAAsC,EAAiB,EAAE,CAC9E,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;AAEvI,6GAA6G;AAC7G,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAuH,EACvH,KAAuI;IAEvI,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,GAAG,CAAC,EAAE,CAAC,CAAC;IACtH,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;IAExC,MAAM,UAAU,GAAkB;QAChC,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAmB,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjH,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KACzC,CAAC;IACF,MAAM,IAAI,GAA8B,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,eAAe,GAAuB,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,kDAAkD,OAAO,CAAC,QAAQ,MAAM,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpL,IAAI,eAAe,EAAE,CAAC;QACpB,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACjC,IAAI,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC9B,CAAC;SAAM,IAAI,SAAS,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5D,uGAAuG;QACvG,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,OAAO,GAAgB,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,mBAAmB,KAAK,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC;QAClH,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;QAC9C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,IAAI,CAAC,eAAe;gBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC,CAAC;QAC7G,CAAC;aAAM,CAAC;YACN,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACzF,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;QACxG,CAAC;QACD,IAAI,YAAY,CAAC,MAAM,KAAK,WAAW,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1G,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,IAAI,OAAO,GAAuE,IAAI,CAAC;IACvF,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAuB,EAAE,EAAE;QACjD,IAAI,OAAO,EAAE,QAAQ,KAAK,MAAM,CAAC,QAAQ;YAAE,OAAO,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjJ,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAChD,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,KAAK,EAAE,MAAuB,EAAgC,EAAE;QAC5E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,CAAC,MAAc,EAAe,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5I,MAAM,IAAI,GAAG,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAChI,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC7C,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzB,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACpB,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5G,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnI,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC;QACtE,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC7B,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACpC,CAAC;aAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YACpC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC3L,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;gBAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3E,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;gBAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;YAC5E,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;gBAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YACxB,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;YACtC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;YACtF,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;YACpE,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACtC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;QACvI,CAAC;QACD,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,eAAe,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC;IACtG,CAAC,CAAC;IAEF,MAAM,OAAO,GAA0B,EAAE,CAAC;IAC1C,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7G,mGAAmG;IACnG,+FAA+F;IAC/F,mGAAmG;IACnG,MAAM,UAAU,GAAkB;QAChC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,aAAa,EAAE;QAC7C,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,SAAS,EAAE;QACzC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,aAAa,EAAE;QAC7C,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC;KACnD,CAAC;IACF,OAAO;QACL,QAAQ,EAAE,uBAAuB;QACjC,IAAI,EAAE,oBAAoB;QAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI;QACJ,YAAY;QACZ,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,OAAO;QACP,QAAQ,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,oBAAoB,EAAE,UAAU,EAAE;KAC/F,CAAC;AACJ,CAAC"}

package/dist/wire-walk.d.ts

@@ -35,7 +35,7 @@
  * `wire-settings.ts`. Do not run the walk while a push or promote of the same vertical is in flight,
  * and end with a confirming pass.
  */
-import { type PlatformActorId } from '@substrat-run/contracts';
+import { type DeploymentWireAuth, type PlatformActorId, type WireAuthRecord } from '@substrat-run/contracts';
 import type { HostAdmin } from '@substrat-run/kernel';
 import type { FetchVerticalModulesFn } from './deploy.js';
 import { type WireSettingsApi } from './wire-settings.js';
@@ -123,6 +123,27 @@ export interface WireWalkDeps {
     }) => void;
     readonly now?: () => Date;
 }
+/** One script the registry names, as the walk and the readiness report reach it. */
+export interface InventoryScript {
+    readonly vertical: string;
+    readonly deploymentRef: string;
+    readonly versionId: string | null;
+    readonly kind: 'serving' | 'version';
+    /** Where a pass that ends on this script answers the next one starts. */
+    readonly cursor: string;
+}
+/** Every capability record of one vertical's scripts, by script name, read a page at a time. */
+export declare function wireAuthRecordsOf(admin: HostAdmin, actor: PlatformActorId, vertical: string): Promise<Map<string, DeploymentWireAuth>>;
+/**
+ * Hand each script from `fleet` to `each` in order, at most `limit` of them, answering where the next pass starts:
+ * `null` when the last one handled was the fleet's last. Looks one ahead, so the pass that ends on the
+ * fleet's last script already answers `null`; a look that fails does not undo a pass that is done.
+ */
+export declare function wireInventoryPass<T>(fleet: AsyncGenerator<InventoryScript>, limit: number, each: (script: InventoryScript) => Promise<T>, out: T[]): Promise<string | null>;
+/** The registry's scripts in walk order, from `from` on: each vertical's serving script, then its versions' scripts. */
+export declare function wireInventory(admin: HostAdmin, actor: PlatformActorId, from: WireWalkCursor | null): AsyncGenerator<InventoryScript>;
+/** Whether a record already holds what a given record says, in what a script carries: the state, the audience and the key ids. */
+export declare function carriesAlready(stored: WireAuthRecord, given: WireAuthRecord): boolean;
 /** Run one pass. Never throws for one script's failure; throws only for a directory read that fails. */
 export declare function runWireWalk(deps: WireWalkDeps, input: {
     readonly apply: boolean;

package/dist/wire-walk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wire-walk.d.ts","sourceRoot":"","sources":["../src/wire-walk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EASL,KAAK,eAAe,EAErB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAyC,KAAK,eAAe,EAA4B,MAAM,oBAAoB,CAAC;AAC3H,OAAO,EAAgD,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEzG,6DAA6D;AAC7D,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C,8CAA8C;AAC9C,eAAO,MAAM,mBAAmB,KAAK,CAAC;AACtC,sDAAsD;AACtD,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAOxC;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAMvE;AAGD,kEAAkE;AAClE,MAAM,MAAM,cAAc;AACxB,yEAAyE;AACvE,SAAS;AACX,6DAA6D;GAC3D,YAAY;AACd,0DAA0D;GACxD,MAAM;AACR,iHAAiH;GAC/G,SAAS;AACX,6FAA6F;GAC3F,WAAW;AACb,8CAA8C;GAC5C,cAAc;AAChB,sCAAsC;GACpC,SAAS;AACX,qGAAqG;GACnG,QAAQ,CAAC;AAEb,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,qEAAqE;IACrE,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,yHAAyH;IACzH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,6CAA6C;IAC7C,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;IACrB,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,wFAAwF;IACxF,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;CAC7C;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC;IAC9B,4GAA4G;IAC5G,QAAQ,CAAC,YAAY,CAAC,EAAE,sBAAsB,CAAC;IAC/C,mGAAmG;IACnG,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACjJ,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAiED,wGAAwG;AACxG,wBAAsB,WAAW,CAC/B,IAAI,EAAE,YAAY,EAClB,KAAK,EAAE;IACL,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,+FAA+F;IAC/F,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,CAAC;CAClC,GACA,OAAO,CAAC,YAAY,CAAC,CAsNvB"}
+{"version":3,"file":"wire-walk.d.ts","sourceRoot":"","sources":["../src/wire-walk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAQL,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAyC,KAAK,eAAe,EAA4B,MAAM,oBAAoB,CAAC;AAC3H,OAAO,EAAgD,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEzG,6DAA6D;AAC7D,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C,8CAA8C;AAC9C,eAAO,MAAM,mBAAmB,KAAK,CAAC;AACtC,sDAAsD;AACtD,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAOxC;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAMvE;AAGD,kEAAkE;AAClE,MAAM,MAAM,cAAc;AACxB,yEAAyE;AACvE,SAAS;AACX,6DAA6D;GAC3D,YAAY;AACd,0DAA0D;GACxD,MAAM;AACR,iHAAiH;GAC/G,SAAS;AACX,6FAA6F;GAC3F,WAAW;AACb,8CAA8C;GAC5C,cAAc;AAChB,sCAAsC;GACpC,SAAS;AACX,qGAAqG;GACnG,QAAQ,CAAC;AAEb,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,qEAAqE;IACrE,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,yHAAyH;IACzH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,6CAA6C;IAC7C,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;IACrB,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,wFAAwF;IACxF,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;CAC7C;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC;IAC9B,4GAA4G;IAC5G,QAAQ,CAAC,YAAY,CAAC,EAAE,sBAAsB,CAAC;IAC/C,mGAAmG;IACnG,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACjJ,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED,oFAAoF;AACpF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,SAAS,CAAC;IACrC,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,gGAAgG;AAChG,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAS5I;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,KAAK,EAAE,cAAc,CAAC,eAAe,CAAC,EACtC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,EAC7C,GAAG,EAAE,CAAC,EAAE,GACP,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoBxB;AAED,wHAAwH;AACxH,wBAAuB,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,GAAG,IAAI,GAAG,cAAc,CAAC,eAAe,CAAC,CAyC3I;AAED,kIAAkI;AAClI,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAQrF;AAED,wGAAwG;AACxG,wBAAsB,WAAW,CAC/B,IAAI,EAAE,YAAY,EAClB,KAAK,EAAE;IACL,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,+FAA+F;IAC/F,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,CAAC;CAClC,GACA,OAAO,CAAC,YAAY,CAAC,CAuLvB"}