@substrat-run/control-plane-api 0.165.0 → 0.166.0

package/dist/github-app.d.ts

@@ -0,0 +1,31 @@
+/** What the worker needs to act as the App. All come from secrets (see Env). */
+export interface GithubConfig {
+    appId: string;
+    /** The App's public slug — builds the install URL `github.com/apps/<slug>/installations/new`. */
+    appSlug: string;
+    /** RSA private key PEM, RS256 — PKCS#8 or PKCS#1 (the format GitHub's key download uses). A worker secret. */
+    privateKeyPem: string;
+    /**
+     * The HTTP client, injected (never the global). Same seam as authority.ts: this is
+     * host/edge code, so it carries `fetch` as a dependency rather than reaching for the
+     * ambient one — which is also what keeps boundary-lint's R3 honest.
+     */
+    fetchImpl: typeof globalThis.fetch;
+}
+/** Read the GitHub App config from the environment, or `null` if it isn't configured. */
+export declare function githubConfig(env: {
+    GITHUB_APP_ID?: string;
+    GITHUB_APP_SLUG?: string;
+    GITHUB_APP_PRIVATE_KEY?: string;
+}, fetchImpl?: typeof globalThis.fetch): GithubConfig | null;
+/** The URL a tenant admin is sent to, to install the App and pick repos. `state` is our signed token. */
+export declare function installUrl(cfg: GithubConfig, state: string): string;
+/** A GitHub App JWT — proves we are the App. Short-lived (10 min max, per GitHub). */
+export declare function appJwt(cfg: GithubConfig): Promise<string>;
+export declare function gh(cfg: GithubConfig, url: string, auth: string, init?: RequestInit): Promise<Response>;
+/** Mint a short-lived installation access token (acts on the repos the tenant granted). */
+export declare function installationToken(cfg: GithubConfig, installationId: string, repository?: {
+    name: string;
+    write: boolean;
+}): Promise<string>;
+//# sourceMappingURL=github-app.d.ts.map

package/dist/github-app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-app.d.ts","sourceRoot":"","sources":["../src/github-app.ts"],"names":[],"mappings":"AAIA,gFAAgF;AAChF,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,iGAAiG;IACjG,OAAO,EAAE,MAAM,CAAC;IAChB,8GAA8G;IAC9G,aAAa,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,SAAS,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CACpC;AAED,yFAAyF;AACzF,wBAAgB,YAAY,CAC1B,GAAG,EAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,sBAAsB,CAAC,EAAE,MAAM,CAAA;CAAE,EAC1F,SAAS,GAAE,OAAO,UAAU,CAAC,KAAyC,GACrE,YAAY,GAAG,IAAI,CAGrB;AAED,yGAAyG;AACzG,wBAAgB,UAAU,CAAC,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnE;AAuCD,sFAAsF;AACtF,wBAAsB,MAAM,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAc/D;AAED,wBAAsB,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAW5G;AAED,2FAA2F;AAC3F,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAOjJ"}

package/dist/github-app.js

@@ -0,0 +1,86 @@
+/** Shared GitHub App transport: dashboard connections and platform source builds. */
+const API = 'https://api.github.com';
+const UA = 'substrat-dashboard';
+/** Read the GitHub App config from the environment, or `null` if it isn't configured. */
+export function githubConfig(env, fetchImpl = globalThis.fetch.bind(globalThis)) {
+    if (!env.GITHUB_APP_ID || !env.GITHUB_APP_SLUG || !env.GITHUB_APP_PRIVATE_KEY)
+        return null;
+    return { appId: env.GITHUB_APP_ID, appSlug: env.GITHUB_APP_SLUG, privateKeyPem: env.GITHUB_APP_PRIVATE_KEY, fetchImpl };
+}
+/** The URL a tenant admin is sent to, to install the App and pick repos. `state` is our signed token. */
+export function installUrl(cfg, state) {
+    return `https://github.com/apps/${encodeURIComponent(cfg.appSlug)}/installations/new?state=${encodeURIComponent(state)}`;
+}
+const b64url = (bytes) => {
+    const arr = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+    return btoa(String.fromCharCode(...arr)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+};
+/**
+ * Wrap a PKCS#1 `RSAPrivateKey` DER in a PKCS#8 `PrivateKeyInfo` (rsaEncryption).
+ * GitHub's App key download is PKCS#1 (`BEGIN RSA PRIVATE KEY`), which Web Crypto's
+ * `importKey('pkcs8', …)` rejects with `DataError` — so the raw downloaded PEM pasted
+ * into the secret would break every GitHub call. Wrapping is a fixed DER prefix.
+ */
+function pkcs1ToPkcs8(pkcs1) {
+    const derLen = (n) => (n < 0x80 ? [n] : n < 0x100 ? [0x81, n] : [0x82, n >> 8, n & 0xff]);
+    const version = [0x02, 0x01, 0x00];
+    // AlgorithmIdentifier { OID 1.2.840.113549.1.1.1 (rsaEncryption), NULL }
+    const algorithm = [0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00];
+    const octetHeader = [0x04, ...derLen(pkcs1.length)];
+    const bodyLen = version.length + algorithm.length + octetHeader.length + pkcs1.length;
+    return Uint8Array.from([0x30, ...derLen(bodyLen), ...version, ...algorithm, ...octetHeader, ...pkcs1]);
+}
+/** Import an RSA private key PEM (PKCS#8, or PKCS#1 as GitHub downloads it) as an RS256 signing key. */
+async function importKey(pem) {
+    // PKCS#1 is detectable from the marker; check before the markers are stripped.
+    const isPkcs1 = /BEGIN\s+RSA\s+PRIVATE\s+KEY/.test(pem);
+    const der = pem
+        // Single-line secrets often carry literal "\n"/"\r" escape sequences rather than
+        // real newlines; drop them BEFORE stripping whitespace so no stray char survives
+        // into the base64 (a leftover backslash would make atob throw "invalid base64").
+        .replace(/\\[rn]/g, '')
+        .replace(/-----[^-]+-----/g, '') // BEGIN/END markers
+        .replace(/\s+/g, '');
+    const bytes = Uint8Array.from(atob(der), (ch) => ch.charCodeAt(0));
+    const pkcs8 = isPkcs1 ? pkcs1ToPkcs8(bytes) : bytes;
+    return crypto.subtle.importKey('pkcs8', new Uint8Array(pkcs8).buffer, { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, false, ['sign']);
+}
+/** A GitHub App JWT — proves we are the App. Short-lived (10 min max, per GitHub). */
+export async function appJwt(cfg) {
+    // boundary-lint-allow R6
+    // GitHub judges `iat`/`exp` against ITS clock, not ours, so this is one of the
+    // few timestamps that must be the real wall clock: a frozen or replayed one
+    // would mint a token the remote end rejects as expired or not-yet-valid. The
+    // operation instant would be wrong here even when it is available.
+    const now = Math.floor(Date.now() / 1000);
+    // boundary-lint-end R6
+    const header = b64url(new TextEncoder().encode(JSON.stringify({ alg: 'RS256', typ: 'JWT' })));
+    // `iat` back-dated 60s for clock drift; `exp` well inside GitHub's 10-min ceiling.
+    const payload = b64url(new TextEncoder().encode(JSON.stringify({ iat: now - 60, exp: now + 540, iss: cfg.appId })));
+    const signingInput = `${header}.${payload}`;
+    const sig = await crypto.subtle.sign('RSASSA-PKCS1-v1_5', await importKey(cfg.privateKeyPem), new TextEncoder().encode(signingInput));
+    return `${signingInput}.${b64url(sig)}`;
+}
+export async function gh(cfg, url, auth, init) {
+    return cfg.fetchImpl(`${API}${url}`, {
+        ...init,
+        headers: {
+            accept: 'application/vnd.github+json',
+            authorization: auth,
+            'user-agent': UA,
+            'x-github-api-version': '2022-11-28',
+            ...init?.headers,
+        },
+    });
+}
+/** Mint a short-lived installation access token (acts on the repos the tenant granted). */
+export async function installationToken(cfg, installationId, repository) {
+    const res = await gh(cfg, `/app/installations/${encodeURIComponent(installationId)}/access_tokens`, `Bearer ${await appJwt(cfg)}`, {
+        method: 'POST',
+        ...(repository ? { headers: { 'content-type': 'application/json' }, body: JSON.stringify({ repositories: [repository.name], permissions: { contents: repository.write ? 'write' : 'read', metadata: 'read' } }) } : {}),
+    });
+    if (!res.ok)
+        throw new Error(`github: installation token failed (${res.status})`);
+    return (await res.json()).token;
+}
+//# sourceMappingURL=github-app.js.map

package/dist/github-app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-app.js","sourceRoot":"","sources":["../src/github-app.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,MAAM,GAAG,GAAG,wBAAwB,CAAC;AACrC,MAAM,EAAE,GAAG,oBAAoB,CAAC;AAiBhC,yFAAyF;AACzF,MAAM,UAAU,YAAY,CAC1B,GAA0F,EAC1F,SAAS,GAA4B,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;IAEtE,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,GAAG,CAAC,sBAAsB;QAAE,OAAO,IAAI,CAAC;IAC3F,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,aAAa,EAAE,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,aAAa,EAAE,GAAG,CAAC,sBAAsB,EAAE,SAAS,EAAE,CAAC;AAC1H,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,UAAU,CAAC,GAAiB,EAAE,KAAa;IACzD,OAAO,2BAA2B,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,4BAA4B,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;AAC3H,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,KAA+B,EAAU,EAAE;IACzD,MAAM,GAAG,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACxE,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACtG,CAAC,CAAC;AAEF;;;;;GAKG;AACH,SAAS,YAAY,CAAC,KAAiB;IACrC,MAAM,MAAM,GAAG,CAAC,CAAS,EAAY,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAC5G,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACnC,yEAAyE;IACzE,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7G,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IACtF,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,SAAS,EAAE,GAAG,WAAW,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;AACzG,CAAC;AAED,wGAAwG;AACxG,KAAK,UAAU,SAAS,CAAC,GAAW;IAClC,+EAA+E;IAC/E,MAAM,OAAO,GAAG,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,GAAG;QACb,iFAAiF;QACjF,iFAAiF;QACjF,iFAAiF;SAChF,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;SACtB,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,oBAAoB;SACpD,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvB,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACpD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;AACzI,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,GAAiB;IAC5C,yBAAyB;IACzB,+EAA+E;IAC/E,4EAA4E;IAC5E,6EAA6E;IAC7E,mEAAmE;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,uBAAuB;IACvB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9F,mFAAmF;IACnF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACpH,MAAM,YAAY,GAAG,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IACtI,OAAO,GAAG,YAAY,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC,GAAiB,EAAE,GAAW,EAAE,IAAY,EAAE,IAAkB;IACvF,OAAO,GAAG,CAAC,SAAS,CAAC,GAAG,GAAG,GAAG,GAAG,EAAE,EAAE;QACnC,GAAG,IAAI;QACP,OAAO,EAAE;YACP,MAAM,EAAE,6BAA6B;YACrC,aAAa,EAAE,IAAI;YACnB,YAAY,EAAE,EAAE;YAChB,sBAAsB,EAAE,YAAY;YACpC,GAAI,IAAI,EAAE,OAAkC;SAC7C;KACF,CAAC,CAAC;AACL,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAiB,EAAE,cAAsB,EAAE,UAA6C;IAC9H,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,sBAAsB,kBAAkB,CAAC,cAAc,CAAC,gBAAgB,EAAE,UAAU,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE;QACjI,MAAM,EAAE,MAAM;QACd,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxN,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAClF,OAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC,KAAK,CAAC;AACzD,CAAC"}

package/dist/index.d.ts

@@ -36,9 +36,9 @@ export { assertSandboxContract, deployManifest, deploymentRefFor, stableDeployme
 export type { DeployVerticalFn, FetchVerticalAssetFn, FetchVerticalModulesFn, RecoverAssetContentFn, VerticalBundle, DeclaredBinding, DeployManifest, } from './deploy.js';
 export { createWfpUploader, createWfpModulesFetcher, createWfpBindingsPatcher } from './wfp.js';
 export { createWfpWireSettingsApi, type WireSettingsApi } from './wire-settings.js';
-export { createScopeStoreEnsurer, createStoreCanaryEnsurer, STORE_BUILD_VAR, STORE_RELEASE_VAR, storePlatformFingerprint } from './store-script.js';
+export { createScopeStoreEnsurer, createStoreCanaryEnsurer, readStoreScriptSettings, STORE_BUILD_VAR, STORE_RELEASE_VAR, storePlatformFingerprint } from './store-script.js';
 export { STORE_REBUILD_PASS_SUBREQUESTS, runStoreFleetRebuild, storeRebuildBudget, storeRebuildStatus, type StoreDriverRebuildPass, } from './store-rebuild.js';
-export { ROLLOUT_WALKS_PER_REQUEST, ROLLOUT_HOLD_TTL_MS, ROLLOUT_VERTICALS_PER_REQUEST, canaryObjectName, canaryStoreRelease, decodeStoreDriverRelease, runStoreDriverRollout, storeDriverRelease, storeReleaseKey, storedReleaseLoader, type CanaryCall, type StoreDriverRolloutDeps, type StoreDriverRolloutResult, type StoreReleaseBytes, } from './store-releases.js';
+export { ROLLOUT_WALKS_PER_REQUEST, ROLLOUT_HOLD_TTL_MS, ROLLOUT_VERTICALS_PER_REQUEST, canaryObjectName, canaryStoreRelease, approveStoredDriverRelease, decodeStoreDriverRelease, runStoreDriverRollout, runStoreDriverRevoke, storeDriverRelease, storeReleaseKey, storedReleaseLoader, type CanaryCall, type StoreDriverRolloutDeps, type StoreDriverRolloutResult, type StoreDriverRevokeResult, type StoreReleaseBytes, } from './store-releases.js';
 export type { ScopeStoreEnsurerOptions, StoreCanaryTarget, StoreDriverReleaseArtifact } from './store-script.js';
 export { withPlatformEntry, platformEntrySkipReason, platformSweeperDecision, PLATFORM_ENTRY_MODULE, PLATFORM_SWEEPER_MODULE, } from './platform-entry.js';
 export { withStoreEntry, withPythonStoreEntry, STORE_ENTRY_MODULE, STORE_ENTRY_PYTHON_MODULE, STORE_ENTRY_PYTHON_SOURCE, STORE_ENTRY_PYTHON_VERIFIER_SOURCE, STORE_OBJECT_CLASS, STORE_RESERVED_MODULES, STORE_VERIFIER_MODULE, } from './store-entry.js';
@@ -83,4 +83,6 @@ export type { ObservabilityWindow, ObservabilityWindowInput } from './observabil
 export { connectionBindingOptions } from './connection-binding-options.js';
 export { resolveVerticalConnectorTarget, verticalConnectorBinder, verticalConnectorDispatchHandler, verticalConnectorInspector, verticalConnectorReadsOf, verticalConnectorSweeper, } from './vertical-connectors.js';
 export type { VerticalConnectorDeps, VerticalConnectorReads, VerticalConnectorTarget } from './vertical-connectors.js';
+export { gh, appJwt, installationToken, githubConfig, installUrl, type GithubConfig } from './github-app.js';
+export { sourceBuildService } from './source-builds.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC5E,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,2BAA2B,EAC3B,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACjH,YAAY,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AAC3L,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC7F,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACzE,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC3H,OAAO,EACL,yBAAyB,EACzB,KAAK,4BAA4B,EACjC,KAAK,8BAA8B,GACpC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrG,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACxF,YAAY,EACV,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,qBAAqB,EACrB,iBAAiB,EACjB,SAAS,GACV,MAAM,WAAW,CAAC;AAGnB,cAAc,cAAc,CAAC;AAC7B,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,8BAA8B,EAC9B,WAAW,EACX,cAAc,EACd,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,mBAAmB,EAAE,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EACL,cAAc,EACd,SAAS,EACT,mBAAmB,EACnB,cAAc,EACd,UAAU,EACV,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,aAAa,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,qBAAqB,EAAE,KAAK,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AACzF,OAAO,EACL,8BAA8B,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,qBAAqB,EACjJ,8BAA8B,EAAE,sBAAsB,GACvD,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,eAAe,EAAE,yBAAyB,EAAE,KAAK,gBAAgB,GAClE,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAG/D,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACxH,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACxG,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC7B,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACxJ,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,KAAK,SAAS,EACd,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,EACtB,aAAa,EACb,YAAY,EACZ,8BAA8B,EAC9B,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAE,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,eAAe,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AACpJ,OAAO,EACL,8BAA8B,EAC9B,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,sBAAsB,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,6BAA6B,EAC7B,gBAAgB,EAChB,kBAAkB,EAClB,wBAAwB,EACxB,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,KAAK,UAAU,EACf,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AACjH,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,EACzB,kCAAkC,EAClC,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACvG,YAAY,EACV,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,aAAa,EACb,aAAa,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,aAAa,EACb,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAClI,OAAO,EACL,+BAA+B,EAC/B,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,EACpB,cAAc,EACd,cAAc,EACd,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACpG,YAAY,EACV,yBAAyB,EACzB,gCAAgC,EAChC,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,YAAY,EACZ,cAAc,EACd,UAAU,EACV,WAAW,EACX,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,sBAAsB,EACtB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACzE,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpF,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAE5H,OAAO,EAAE,kBAAkB,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAC9F,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAGpI,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC1G,YAAY,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACtI,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACtE,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,YAAY,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,YAAY,EACV,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,4BAA4B,EAI5B,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAG/D,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAI7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAM3F,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC3E,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEhE,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACnG,YAAY,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAG/F,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EACL,8BAA8B,EAC9B,uBAAuB,EACvB,gCAAgC,EAChC,0BAA0B,EAC1B,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC5E,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,2BAA2B,EAC3B,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACjH,YAAY,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AAC3L,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC7F,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACzE,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC3H,OAAO,EACL,yBAAyB,EACzB,KAAK,4BAA4B,EACjC,KAAK,8BAA8B,GACpC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrG,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACxF,YAAY,EACV,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,qBAAqB,EACrB,iBAAiB,EACjB,SAAS,GACV,MAAM,WAAW,CAAC;AAGnB,cAAc,cAAc,CAAC;AAC7B,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,8BAA8B,EAC9B,WAAW,EACX,cAAc,EACd,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,mBAAmB,EAAE,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EACL,cAAc,EACd,SAAS,EACT,mBAAmB,EACnB,cAAc,EACd,UAAU,EACV,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,aAAa,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,qBAAqB,EAAE,KAAK,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AACzF,OAAO,EACL,8BAA8B,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,qBAAqB,EACjJ,8BAA8B,EAAE,sBAAsB,GACvD,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,eAAe,EAAE,yBAAyB,EAAE,KAAK,gBAAgB,GAClE,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAG/D,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACxH,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACxG,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC7B,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACxJ,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,KAAK,SAAS,EACd,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,EACtB,aAAa,EACb,YAAY,EACZ,8BAA8B,EAC9B,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAE,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,eAAe,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7K,OAAO,EACL,8BAA8B,EAC9B,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,sBAAsB,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,6BAA6B,EAC7B,gBAAgB,EAChB,kBAAkB,EAClB,0BAA0B,EAC1B,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,KAAK,UAAU,EACf,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AACjH,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,EACzB,kCAAkC,EAClC,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACvG,YAAY,EACV,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,aAAa,EACb,aAAa,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,aAAa,EACb,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAClI,OAAO,EACL,+BAA+B,EAC/B,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,EACpB,cAAc,EACd,cAAc,EACd,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACpG,YAAY,EACV,yBAAyB,EACzB,gCAAgC,EAChC,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,YAAY,EACZ,cAAc,EACd,UAAU,EACV,WAAW,EACX,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,sBAAsB,EACtB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACzE,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpF,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAE5H,OAAO,EAAE,kBAAkB,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAC9F,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAGpI,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC1G,YAAY,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACtI,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACtE,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,YAAY,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,YAAY,EACV,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,4BAA4B,EAI5B,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAG/D,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAI7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAM3F,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC3E,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEhE,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACnG,YAAY,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAG/F,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EACL,8BAA8B,EAC9B,uBAAuB,EACvB,gCAAgC,EAChC,0BAA0B,EAC1B,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAEvH,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC7G,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -32,9 +32,9 @@ export { callPlatformScopeStore, callPlatformScopeStoreAt, platformScopeStoresFo
 export { assertSandboxContract, deployManifest, deploymentRefFor, stableDeploymentRefFor, nextMigrationTag, DeployUploadError, upstreamStatusOf, } from './deploy.js';
 export { createWfpUploader, createWfpModulesFetcher, createWfpBindingsPatcher } from './wfp.js';
 export { createWfpWireSettingsApi } from './wire-settings.js';
-export { createScopeStoreEnsurer, createStoreCanaryEnsurer, STORE_BUILD_VAR, STORE_RELEASE_VAR, storePlatformFingerprint } from './store-script.js';
+export { createScopeStoreEnsurer, createStoreCanaryEnsurer, readStoreScriptSettings, STORE_BUILD_VAR, STORE_RELEASE_VAR, storePlatformFingerprint } from './store-script.js';
 export { STORE_REBUILD_PASS_SUBREQUESTS, runStoreFleetRebuild, storeRebuildBudget, storeRebuildStatus, } from './store-rebuild.js';
-export { ROLLOUT_WALKS_PER_REQUEST, ROLLOUT_HOLD_TTL_MS, ROLLOUT_VERTICALS_PER_REQUEST, canaryObjectName, canaryStoreRelease, decodeStoreDriverRelease, runStoreDriverRollout, storeDriverRelease, storeReleaseKey, storedReleaseLoader, } from './store-releases.js';
+export { ROLLOUT_WALKS_PER_REQUEST, ROLLOUT_HOLD_TTL_MS, ROLLOUT_VERTICALS_PER_REQUEST, canaryObjectName, canaryStoreRelease, approveStoredDriverRelease, decodeStoreDriverRelease, runStoreDriverRollout, runStoreDriverRevoke, storeDriverRelease, storeReleaseKey, storedReleaseLoader, } from './store-releases.js';
 export { withPlatformEntry, platformEntrySkipReason, platformSweeperDecision, PLATFORM_ENTRY_MODULE, PLATFORM_SWEEPER_MODULE, } from './platform-entry.js';
 export { withStoreEntry, withPythonStoreEntry, STORE_ENTRY_MODULE, STORE_ENTRY_PYTHON_MODULE, STORE_ENTRY_PYTHON_SOURCE, STORE_ENTRY_PYTHON_VERIFIER_SOURCE, STORE_OBJECT_CLASS, STORE_RESERVED_MODULES, STORE_VERIFIER_MODULE, } from './store-entry.js';
 export { blobStoreBindings, collectBlobStoreHandles, collectTenantStoreHandles, tenantStoreBindings, } from './tenant-stores.js';
@@ -76,4 +76,6 @@ export { resolveObservabilityWindow, observabilityBucketMinutes } from './observ
 // #2316: the binding options a provider takes — the staff door and the connector pass validate with it.
 export { connectionBindingOptions } from './connection-binding-options.js';
 export { resolveVerticalConnectorTarget, verticalConnectorBinder, verticalConnectorDispatchHandler, verticalConnectorInspector, verticalConnectorReadsOf, verticalConnectorSweeper, } from './vertical-connectors.js';
+export { gh, appJwt, installationToken, githubConfig, installUrl } from './github-app.js';
+export { sourceBuildService } from './source-builds.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,2BAA2B,EAC3B,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAEjH,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE7F,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAEzE,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC3H,OAAO,EACL,yBAAyB,GAG1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrG,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAYxF,uFAAuF;AACvF,iFAAiF;AACjF,cAAc,cAAc,CAAC;AAC7B,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,8BAA8B,EAC9B,WAAW,EACX,cAAc,EACd,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,mBAAmB,EAA6B,MAAM,oBAAoB,CAAC;AACpF,OAAO,EACL,cAAc,EACd,SAAS,EACT,mBAAmB,EACnB,cAAc,EACd,UAAU,EACV,mBAAmB,EACnB,eAAe,EACf,gBAAgB,GAMjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,qBAAqB,EAA6B,MAAM,uBAAuB,CAAC;AACzF,OAAO,EACL,8BAA8B,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,qBAAqB,EACjJ,8BAA8B,EAAE,sBAAsB,GACvD,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,eAAe,EAAE,yBAAyB,GAC3C,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC1E,gGAAgG;AAChG,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,uFAAuF;AACvF,wEAAwE;AACxE,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGxH,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC7B,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,GAczB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,cAAc,EAAoB,MAAM,gBAAgB,CAAC;AAExJ,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,GAGnB,MAAM,mBAAmB,CAAC;AAC3B,oEAAoE;AACpE,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,EACtB,aAAa,EACb,YAAY,EACZ,8BAA8B,EAI9B,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAUrB,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAwB,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,eAAe,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AACpJ,OAAO,EACL,8BAA8B,EAC9B,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,GAEnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,6BAA6B,EAC7B,gBAAgB,EAChB,kBAAkB,EAClB,wBAAwB,EACxB,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,mBAAmB,GAKpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,EACzB,kCAAkC,EAClC,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAS1B,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,aAAa,EACb,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,+BAA+B,EAC/B,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,EACpB,cAAc,EACd,cAAc,EACd,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AA8B3B,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,sBAAsB,EACtB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEpF,OAAO,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC5H,yGAAyG;AACzG,OAAO,EAAE,kBAAkB,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAE9F,qFAAqF;AACrF,2DAA2D;AAC3D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE1G,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAStE,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,4BAA4B;AAC5B,iFAAiF;AACjF,mFAAmF;AACnF,gFAAgF;AAChF,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,kFAAkF;AAClF,iFAAiF;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAI/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,yFAAyF;AACzF,yFAAyF;AACzF,oFAAoF;AACpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,uFAAuF;AACvF,yFAAyF;AACzF,uFAAuF;AACvF,yFAAyF;AACzF,+EAA+E;AAC/E,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAG3E,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAGnG,wGAAwG;AACxG,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EACL,8BAA8B,EAC9B,uBAAuB,EACvB,gCAAgC,EAChC,0BAA0B,EAC1B,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,2BAA2B,EAC3B,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAEjH,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE7F,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAEzE,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC3H,OAAO,EACL,yBAAyB,GAG1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrG,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAYxF,uFAAuF;AACvF,iFAAiF;AACjF,cAAc,cAAc,CAAC;AAC7B,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,8BAA8B,EAC9B,WAAW,EACX,cAAc,EACd,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,mBAAmB,EAA6B,MAAM,oBAAoB,CAAC;AACpF,OAAO,EACL,cAAc,EACd,SAAS,EACT,mBAAmB,EACnB,cAAc,EACd,UAAU,EACV,mBAAmB,EACnB,eAAe,EACf,gBAAgB,GAMjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,qBAAqB,EAA6B,MAAM,uBAAuB,CAAC;AACzF,OAAO,EACL,8BAA8B,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,qBAAqB,EACjJ,8BAA8B,EAAE,sBAAsB,GACvD,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,eAAe,EAAE,yBAAyB,GAC3C,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC1E,gGAAgG;AAChG,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,uFAAuF;AACvF,wEAAwE;AACxE,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGxH,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC7B,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,GAczB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,cAAc,EAAoB,MAAM,gBAAgB,CAAC;AAExJ,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,GAGnB,MAAM,mBAAmB,CAAC;AAC3B,oEAAoE;AACpE,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,EACtB,aAAa,EACb,YAAY,EACZ,8BAA8B,EAI9B,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAUrB,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAwB,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,eAAe,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7K,OAAO,EACL,8BAA8B,EAC9B,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,GAEnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,6BAA6B,EAC7B,gBAAgB,EAChB,kBAAkB,EAClB,0BAA0B,EAC1B,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,mBAAmB,GAMpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,EACzB,kCAAkC,EAClC,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAS1B,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,aAAa,EACb,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,+BAA+B,EAC/B,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,EACpB,cAAc,EACd,cAAc,EACd,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AA8B3B,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,sBAAsB,EACtB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEpF,OAAO,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC5H,yGAAyG;AACzG,OAAO,EAAE,kBAAkB,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAE9F,qFAAqF;AACrF,2DAA2D;AAC3D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE1G,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAStE,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,4BAA4B;AAC5B,iFAAiF;AACjF,mFAAmF;AACnF,gFAAgF;AAChF,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,kFAAkF;AAClF,iFAAiF;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAI/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,yFAAyF;AACzF,yFAAyF;AACzF,oFAAoF;AACpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,uFAAuF;AACvF,yFAAyF;AACzF,uFAAuF;AACvF,yFAAyF;AACzF,+EAA+E;AAC/E,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAG3E,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAGnG,wGAAwG;AACxG,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EACL,8BAA8B,EAC9B,uBAAuB,EACvB,gCAAgC,EAChC,0BAA0B,EAC1B,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,YAAY,EAAE,UAAU,EAAqB,MAAM,iBAAiB,CAAC;AAC7G,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/source-builds.d.ts

@@ -0,0 +1,6 @@
+import { type SourceBuildService } from '@substrat-run/contracts';
+/** Private service transport. An absent binding fails closed; it never accepts local bundles. */
+export declare function sourceBuildService(service: {
+    fetch(request: Request): Promise<Response>;
+} | undefined, token: string | undefined): SourceBuildService;
+//# sourceMappingURL=source-builds.d.ts.map

package/dist/source-builds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-builds.d.ts","sourceRoot":"","sources":["../src/source-builds.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuC,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAGvG,iGAAiG;AACjG,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAAE,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAAE,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,kBAAkB,CAoCrJ"}

package/dist/source-builds.js

@@ -0,0 +1,55 @@
+import { sourceBuildResult } from '@substrat-run/contracts';
+import { ControlPlaneError } from '@substrat-run/control-plane-client';
+/** Private service transport. An absent binding fails closed; it never accepts local bundles. */
+export function sourceBuildService(service, token) {
+    const request = async (tenantId, path, init) => {
+        if (!service || !token)
+            throw new ControlPlaneError(503, 'platform source builds are not configured');
+        return service.fetch(new Request(`https://builder/internal/${path}`, {
+            ...init,
+            headers: { ...Object.fromEntries(new Headers(init?.headers)), 'x-service-token': token, 'x-substrat-tenant': tenantId },
+        }));
+    };
+    return {
+        async build(tenantId, slug, input) {
+            const response = await request(tenantId, 'build', {
+                method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ slug, request: input }),
+            });
+            if (!response.ok) {
+                const problem = await response.json().catch(() => null);
+                throw new ControlPlaneError(response.status, problem?.detail ?? 'platform build service failed');
+            }
+            let form;
+            try {
+                form = await response.formData();
+            }
+            catch {
+                throw new ControlPlaneError(502, 'build service returned an invalid multipart release');
+            }
+            const result = form.get('buildResult');
+            if (typeof result !== 'string')
+                throw new ControlPlaneError(502, 'build service returned no release identity');
+            let decoded;
+            try {
+                decoded = JSON.parse(result);
+            }
+            catch {
+                throw new ControlPlaneError(502, 'build service returned an invalid release identity');
+            }
+            const metadata = sourceBuildResult.safeParse(decoded);
+            if (!metadata.success)
+                throw new ControlPlaneError(502, 'build service returned an invalid release identity');
+            if (input.revision && metadata.data.revision !== input.revision)
+                throw new ControlPlaneError(502, 'build service did not build the requested source revision');
+            form.delete('buildResult');
+            return { form, ...metadata.data };
+        },
+        async projects(tenantId, input) {
+            return request(tenantId, 'projects', {
+                method: input.method,
+                ...(input.method === 'GET' ? {} : { headers: { 'content-type': 'application/json' }, body: await input.text() }),
+            });
+        },
+    };
+}
+//# sourceMappingURL=source-builds.js.map

package/dist/source-builds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-builds.js","sourceRoot":"","sources":["../src/source-builds.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAA6C,MAAM,yBAAyB,CAAC;AACvG,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAEvE,iGAAiG;AACjG,MAAM,UAAU,kBAAkB,CAAC,OAAmE,EAAE,KAAyB;IAC/H,MAAM,OAAO,GAAG,KAAK,EAAE,QAAgB,EAAE,IAAY,EAAE,IAAkB,EAAqB,EAAE;QAC9F,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,2CAA2C,CAAC,CAAC;QACtG,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,4BAA4B,IAAI,EAAE,EAAE;YACnE,GAAG,IAAI;YACP,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE;SACxH,CAAC,CAAC,CAAC;IACN,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK;YAC/B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE;gBAChD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;aAChH,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAA+B,CAAC;gBACtF,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,+BAA+B,CAAC,CAAC;YACnG,CAAC;YACD,IAAI,IAAc,CAAC;YACnB,IAAI,CAAC;gBAAC,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,qDAAqD,CAAC,CAAC;YAAC,CAAC;YAC5I,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACvC,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,4CAA4C,CAAC,CAAC;YAC/G,IAAI,OAAgB,CAAC;YACrB,IAAI,CAAC;gBAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAC;YAAC,CAAC;YACvI,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACtD,IAAI,CAAC,QAAQ,CAAC,OAAO;gBAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAC;YAC9G,IAAI,KAAK,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;gBAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,2DAA2D,CAAC,CAAC;YAC/J,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAC3B,OAAO,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpC,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK;YAC5B,OAAO,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE;gBACnC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;aACjH,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/store-releases.d.ts

@@ -18,13 +18,23 @@
  * converges, a rollback included. A request that stops on a failure ends `failed` or `diverged`.
  */
 import { type PlatformActorId, type ReservedStoreOperation, type ScopeStoreNeed, type StoreDriverRegistration } from '@substrat-run/contracts';
-import { type HostAdmin, type StoreDriverRolloutAction, type StoreDriverRolloutRecord } from '@substrat-run/kernel';
+import { type HostAdmin, type StoreDriverApprovalRecord, type StoreDriverRolloutAction, type StoreDriverRolloutRecord } from '@substrat-run/kernel';
 import type { ScopeStoreEnsurerOptions, StoreDriverReleaseArtifact } from './store-script.js';
 /** Where a release's bytes are kept: an object store keyed by driver and sha256. */
 export interface StoreReleaseBytes {
     get(key: string): Promise<Uint8Array | undefined>;
     put(key: string, bytes: Uint8Array): Promise<void>;
+    /** Object metadata is read before opening approval bytes. */
+    head(key: string): Promise<{
+        size: number;
+    } | undefined>;
+    open(key: string): Promise<{
+        size: number;
+        body: ReadableStream<Uint8Array>;
+    } | undefined>;
 }
+/** The JSON/base64 envelope around at most STORE_RELEASE_MAX_BYTES of module bytes. */
+export declare const STORE_RELEASE_STORED_MAX_BYTES: number;
 /** The key a release's bytes are stored under. */
 export declare const storeReleaseKey: (driver: string, sha256: string) => string;
 /** How long a rollout's exclusive hold lives between renewals. */
@@ -49,6 +59,26 @@ export declare const ROLLOUT_VERTICALS_PER_REQUEST = 100;
  * converges them.
  */
 export declare const ROLLOUT_WALKS_PER_REQUEST = 300;
+export interface StoreDriverRevokeResult {
+    approval: StoreDriverApprovalRecord;
+    complete: boolean;
+    remaining: number;
+}
+/** Walk the scripts' own settings under the driver's exclusive hold before a normal revoke. */
+export declare function runStoreDriverRevoke(input: {
+    admin: HostAdmin;
+    actor: PlatformActorId;
+    driver: string;
+    sha256: string;
+    reason: string;
+    emergency: boolean;
+    readScriptRelease: (scriptName: string) => Promise<{
+        exists: boolean;
+        release?: string;
+    }>;
+    ensureCanary: (sha256: string) => Promise<unknown>;
+    perRequestWalks?: number;
+}): Promise<StoreDriverRevokeResult>;
 type LoadRelease = ScopeStoreEnsurerOptions['loadRelease'];
 /**
  * A release bundle as uploaded or as stored, decoded and judged: the upload body's shape, the
@@ -76,6 +106,15 @@ export declare function storedReleaseLoader(input: {
     actor: PlatformActorId;
     bytes: StoreReleaseBytes;
 }): LoadRelease;
+/** Verify the named stored bundle before an approval can be recorded. */
+export declare function approveStoredDriverRelease(input: {
+    admin: HostAdmin;
+    actor: PlatformActorId;
+    bytes: StoreReleaseBytes;
+    driver: string;
+    sha256: string;
+    approval: Omit<Parameters<HostAdmin['approveStoreDriverRelease']>[1], 'driver' | 'sha256'>;
+}): Promise<StoreDriverApprovalRecord>;
 /** The reserved calls a canary makes, at the canary script. */
 export type CanaryCall = (target: {
     scriptName: string;

package/dist/store-releases.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store-releases.d.ts","sourceRoot":"","sources":["../src/store-releases.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAKL,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACnB,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAE9B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAE9F,oFAAoF;AACpF,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IAClD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD;AAED,kDAAkD;AAClD,eAAO,MAAM,eAAe,WAAY,MAAM,UAAU,MAAM,KAAG,MAA+B,CAAC;AAEjG,kEAAkE;AAClE,eAAO,MAAM,mBAAmB,QAAc,CAAC;AAC/C;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,QAAc,CAAC;AAC5C;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,MAAM,CAAC;AACjD;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAE7C,KAAK,WAAW,GAAG,wBAAwB,CAAC,aAAa,CAAC,CAAC;AAY3D;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAAC,0BAA0B,EAAE,QAAQ,CAAC,CAqBjG;AAkBD;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,eAAe,CAAC;IACvB,KAAK,EAAE,iBAAiB,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACf,oEAWA;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,eAAe,CAAC;IAAC,KAAK,EAAE,iBAAiB,CAAA;CAAE,GAAG,WAAW,CAc9H;AAED,+DAA+D;AAC/D,MAAM,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAAE,SAAS,EAAE,sBAAsB,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtJ;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,YAAa,MAAM,KAAG,MAA6E,CAAC;AAIjI;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBzH;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,eAAe,CAAC;IACvB,YAAY,EAAE,uBAAuB,CAAC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,wBAAwB,CAAC;IACjC;;;OAGG;IACH,MAAM,EAAE,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzG,gEAAgE;IAChE,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9D,UAAU,EAAE,UAAU,CAAC;IACvB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6FAA6F;IAC7F,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,wBAAwB,CAAC;IAClC,yDAAyD;IACzD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,gEAAgE;IAChE,QAAQ,EAAE,OAAO,CAAC;IAClB,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAC;CACnB;AAaD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAqE3G"}
+{"version":3,"file":"store-releases.d.ts","sourceRoot":"","sources":["../src/store-releases.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAOL,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACnB,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAIL,KAAK,SAAS,EACd,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAE9B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAE9F,oFAAoF;AACpF,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IAClD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,6DAA6D;IAC7D,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAC;IACzD,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,CAAA;KAAE,GAAG,SAAS,CAAC,CAAC;CAC5F;AAED,uFAAuF;AACvF,eAAO,MAAM,8BAA8B,QAA6D,CAAC;AAEzG,kDAAkD;AAClD,eAAO,MAAM,eAAe,WAAY,MAAM,UAAU,MAAM,KAAG,MAA+B,CAAC;AAEjG,kEAAkE;AAClE,eAAO,MAAM,mBAAmB,QAAc,CAAC;AAC/C;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,QAAc,CAAC;AAC5C;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,MAAM,CAAC;AACjD;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAE7C,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,yBAAyB,CAAC;IACpC,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,+FAA+F;AAC/F,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,KAAK,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IACzE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IACnC,iBAAiB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1F,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAmFnC;AAED,KAAK,WAAW,GAAG,wBAAwB,CAAC,aAAa,CAAC,CAAC;AAY3D;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAAC,0BAA0B,EAAE,QAAQ,CAAC,CAqBjG;AAkBD;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,eAAe,CAAC;IACvB,KAAK,EAAE,iBAAiB,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACf,oEAWA;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,eAAe,CAAC;IAAC,KAAK,EAAE,iBAAiB,CAAA;CAAE,GAAG,WAAW,CAQ9H;AAYD,yEAAyE;AACzE,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,KAAK,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,eAAe,CAAC;IAAC,KAAK,EAAE,iBAAiB,CAAC;IACnE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAC/B,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC,CAAC;CAC5F,sCAwDA;AAED,+DAA+D;AAC/D,MAAM,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAAE,SAAS,EAAE,sBAAsB,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtJ;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,YAAa,MAAM,KAAG,MAA6E,CAAC;AAIjI;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBzH;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,eAAe,CAAC;IACvB,YAAY,EAAE,uBAAuB,CAAC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,wBAAwB,CAAC;IACjC;;;OAGG;IACH,MAAM,EAAE,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzG,gEAAgE;IAChE,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9D,UAAU,EAAE,UAAU,CAAC;IACvB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6FAA6F;IAC7F,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,wBAAwB,CAAC;IAClC,yDAAyD;IACzD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,gEAAgE;IAChE,QAAQ,EAAE,OAAO,CAAC;IAClB,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAC;CACnB;AAaD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAqE3G"}

package/dist/store-releases.js

@@ -17,10 +17,12 @@
  * rollback) again continues it from the attempt's walk ledger (#2312), so a fleet of any size
  * converges, a rollback included. A request that stops on a failure ends `failed` or `diverged`.
  */
-import { STORE_RELEASE_MAX_BYTES, scopeStoreCanaryObjectName, storeDriverReleaseDigest, storeDriverReleaseUpload, } from '@substrat-run/contracts';
+import { STORE_RELEASE_MAX_BYTES, scopeStoreCanaryObjectName, scopeStoreCanaryScriptName, scopeStoreScriptName, storeDriverReleaseDigest, storeDriverReleaseUpload, } from '@substrat-run/contracts';
 import { ControlPlaneError } from '@substrat-run/control-plane-client';
-import { createUlid, ulid, } from '@substrat-run/kernel';
+import { createUlid, runtimeSha256, ulid, } from '@substrat-run/kernel';
 import { assertPythonDriverModules } from './store-entry.js';
+/** The JSON/base64 envelope around at most STORE_RELEASE_MAX_BYTES of module bytes. */
+export const STORE_RELEASE_STORED_MAX_BYTES = Math.ceil((STORE_RELEASE_MAX_BYTES * 4) / 3) + 1024 * 1024;
 /** The key a release's bytes are stored under. */
 export const storeReleaseKey = (driver, sha256) => `${driver}/${sha256}`;
 /** How long a rollout's exclusive hold lives between renewals. */
@@ -45,6 +47,96 @@ export const ROLLOUT_VERTICALS_PER_REQUEST = 100;
  * converges them.
  */
 export const ROLLOUT_WALKS_PER_REQUEST = 300;
+/** Walk the scripts' own settings under the driver's exclusive hold before a normal revoke. */
+export async function runStoreDriverRevoke(input) {
+    const { admin, actor, driver, sha256 } = input;
+    const holder = ulid();
+    if (!(await admin.holdStoreDriver(actor, { driver, holder, mode: 'exclusive', ttlMs: ROLLOUT_HOLD_TTL_MS }))) {
+        throw new ControlPlaneError(409, `driver '${driver}' is held by a rollout or push; try the revoke again shortly`);
+    }
+    try {
+        const approval = await admin.liveStoreDriverApproval(actor, driver, sha256);
+        if (!approval)
+            throw new ControlPlaneError(409, `release ${sha256} of '${driver}' has no live approval to revoke`);
+        const state = await admin.storeDriverState(actor, driver);
+        if (!input.emergency && state.current?.sha256 === sha256) {
+            throw new ControlPlaneError(409, `release ${sha256} is current for '${driver}'; an emergency revoke with a reason is required`);
+        }
+        if (input.emergency) {
+            return {
+                approval: await admin.revokeStoreDriverRelease(actor, { approvalId: approval.approvalId, driver, sha256, holder, reason: input.reason, emergency: true }),
+                complete: true, remaining: 0,
+            };
+        }
+        const declarations = await admin.storeDriverDeclarations(actor, driver);
+        if (declarations.unreadable.length > 0) {
+            throw new ControlPlaneError(409, `driver '${driver}' cannot be revoked: ${declarations.unreadable.join(', ')} cannot name its store scripts; roll it out first`);
+        }
+        const rolloutSeq = state.rollouts.at(-1)?.seq ?? 0;
+        const prior = await admin.storeDriverRevokeWalk(actor, approval.approvalId);
+        const cursor = prior?.actor === actor && prior.reason === input.reason && prior.rolloutSeq === rolloutSeq ? prior.cursor : null;
+        const verticals = declarations.verticals.map((v) => v.vertical).sort();
+        const pending = verticals.filter((v) => cursor === null || v > cursor);
+        const limit = input.perRequestWalks ?? ROLLOUT_WALKS_PER_REQUEST;
+        if (!(Number.isInteger(limit) && limit > 0 && limit <= ROLLOUT_WALKS_PER_REQUEST)) {
+            throw new ControlPlaneError(422, 'a revoke page needs a positive bounded walk limit');
+        }
+        const page = pending.slice(0, limit);
+        const renew = async () => {
+            const held = await admin.holdStoreDriver(actor, { driver, holder, mode: 'exclusive', ttlMs: ROLLOUT_HOLD_TTL_MS, renew: true });
+            if (!held)
+                throw new ControlPlaneError(409, `the hold on driver '${driver}' lapsed; post the revoke again`);
+        };
+        for (const vertical of page) {
+            await renew();
+            const script = scopeStoreScriptName(vertical, driver);
+            let running;
+            try {
+                running = await input.readScriptRelease(script);
+            }
+            catch {
+                throw new ControlPlaneError(409, `store script '${script}' settings are unreadable; roll it out before revoking ${sha256}`);
+            }
+            if (running.exists && !running.release) {
+                throw new ControlPlaneError(409, `store script '${script}' records no release; roll it out before revoking ${sha256}`);
+            }
+            if (running.release === sha256) {
+                throw new ControlPlaneError(409, `store script '${script}' still runs ${sha256}; roll it out before revoking`);
+            }
+        }
+        const remaining = pending.length - page.length;
+        if (remaining > 0) {
+            await admin.recordStoreDriverRevokeWalk(actor, { approvalId: approval.approvalId, driver, holder, cursor: page.at(-1), reason: input.reason, rolloutSeq });
+            return { approval, complete: false, remaining };
+        }
+        await renew();
+        const canary = scopeStoreCanaryScriptName(driver);
+        let runningCanary;
+        try {
+            runningCanary = await input.readScriptRelease(canary);
+        }
+        catch {
+            throw new ControlPlaneError(409, `store canary '${canary}' settings are unreadable; roll it out before revoking ${sha256}`);
+        }
+        if (runningCanary.exists && !runningCanary.release) {
+            throw new ControlPlaneError(409, `store canary '${canary}' records no release; roll it out before revoking ${sha256}`);
+        }
+        if (runningCanary.release === sha256 && state.current) {
+            if (!(await admin.liveStoreDriverApproval(actor, driver, state.current.sha256))) {
+                throw new ControlPlaneError(409, `current release ${state.current.sha256} of '${driver}' has no live approval for a canary move`);
+            }
+            await renew();
+            await input.ensureCanary(state.current.sha256);
+        }
+        return {
+            approval: await admin.revokeStoreDriverRelease(actor, { approvalId: approval.approvalId, driver, sha256, holder, reason: input.reason, emergency: false }),
+            complete: true, remaining: 0,
+        };
+    }
+    finally {
+        await admin.releaseStoreDriverHold(actor, { driver, holder }).catch(() => undefined);
+    }
+}
 const decodeBase64 = (text) => {
     let binary;
     try {
@@ -126,15 +218,84 @@ export function storedReleaseLoader(input) {
         const raw = await input.bytes.get(storeReleaseKey(driver, wanted));
         if (!raw)
             return undefined;
-        let json;
-        try {
-            json = JSON.parse(new TextDecoder().decode(raw));
+        return { ...decodeStoredReleaseBytes(raw, driver, wanted), sha256: wanted };
+    };
+}
+function decodeStoredReleaseBytes(raw, driver, sha256) {
+    let json;
+    try {
+        json = JSON.parse(new TextDecoder().decode(raw));
+    }
+    catch {
+        throw new ControlPlaneError(422, `driver '${driver}' release ${sha256} is stored as something other than a release`);
+    }
+    return decodeStoreDriverRelease(json);
+}
+/** Verify the named stored bundle before an approval can be recorded. */
+export async function approveStoredDriverRelease(input) {
+    const { admin, actor, bytes, driver, sha256 } = input;
+    const stored = await admin.getStoreDriverRelease(actor, driver, sha256);
+    if (!stored)
+        throw new ControlPlaneError(404, `release ${sha256} of '${driver}' is not stored`);
+    const key = storeReleaseKey(driver, sha256);
+    const head = await bytes.head(key);
+    if (!head)
+        throw new ControlPlaneError(404, `release ${sha256} of '${driver}' has no stored bytes`);
+    if (!Number.isSafeInteger(head.size) || head.size < 0 || head.size > STORE_RELEASE_STORED_MAX_BYTES) {
+        throw new ControlPlaneError(409, `release ${sha256} of '${driver}' has unverifiable stored bytes`);
+    }
+    const opened = await bytes.open(key);
+    if (!opened)
+        throw new ControlPlaneError(404, `release ${sha256} of '${driver}' has no stored bytes`);
+    if (opened.size !== head.size) {
+        await opened.body.cancel();
+        throw new ControlPlaneError(409, `release ${sha256} of '${driver}' has unverifiable stored bytes`);
+    }
+    const reader = opened.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > head.size || size > STORE_RELEASE_STORED_MAX_BYTES) {
+                throw new ControlPlaneError(409, `release ${sha256} of '${driver}' has unverifiable stored bytes`);
+            }
+            chunks.push(value);
         }
-        catch {
-            throw new ControlPlaneError(422, `driver '${driver}' release ${wanted} is stored as something other than a release`);
+    }
+    catch (e) {
+        await reader.cancel().catch(() => undefined);
+        throw e;
+    }
+    finally {
+        reader.releaseLock();
+    }
+    if (size !== head.size)
+        throw new ControlPlaneError(409, `release ${sha256} of '${driver}' has unverifiable stored bytes`);
+    const raw = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+        raw.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    let release;
+    try {
+        release = decodeStoredReleaseBytes(raw, driver, sha256);
+    }
+    catch (e) {
+        if (e instanceof ControlPlaneError && e.status === 422) {
+            throw new ControlPlaneError(409, `release ${sha256} of '${driver}' has unverifiable stored bytes`);
         }
-        return { ...decodeStoreDriverRelease(json), sha256: wanted };
-    };
+        throw e;
+    }
+    const digest = await storeDriverReleaseDigest(release, runtimeSha256()).catch(() => undefined);
+    if (digest !== sha256 || release.sourceCommit !== stored.sourceCommit) {
+        throw new ControlPlaneError(409, `release ${sha256} of '${driver}' differs from its stored digest or source commit`);
+    }
+    return admin.approveStoreDriverRelease(actor, { driver, sha256, ...input.approval });
 }
 /**
  * A canary object's name. Each id comes from a mint of its own, so its 80 random bits are fresh