@substrat-run/kernel 0.140.0 → 0.142.0

package/dist/invocation-log.js

@@ -1,410 +0,0 @@
-/**
- * One structured log line per invocation, carrying the two dimensions Cloudflare
- * structurally cannot record: which TENANT and which SCOPE a request belonged to
- * (`docs/architecture/observability.md` §4.2/§4.3).
- *
- * ## Why this exists at all
- *
- * Observability is keyed on the deployed unit — a worker script — and one vertical's
- * script serves every tenant that installed it. That makes script-grain data safe for
- * staff and for the vertical's builder, and unsafe for an installer: their own numbers
- * are inseparable from everyone else's (§3). The router already stamps `tenantId` on the
- * datapoints and log lines IT emits, which is why tenant-keyed *metrics* need no code in
- * this package. Logs are the other half, and the router cannot supply it: a trace does
- * not cross the dispatch hop. Verified against production — a router line's `traceId`
- * reaches `substrat-control-plane` (a service binding) but never the dispatched vertical,
- * and every vertical event is a trace of exactly one event. There is nothing to join on,
- * so the line has to be emitted on this side.
- *
- * ## What it makes possible that nothing else does
- *
- * A vertical's successful request emits NO log event whatsoever — the host logs only on a
- * platform fault, and the scope host logs nothing at all. So before this middleware, a
- * vertical's entire log presence was its crashes. The stamped line is therefore not only
- * the correlation key; it is the thing that makes a tenant-facing log view have any rows.
- *
- * ## The correlation contract
- *
- * Every log line emitted during one invocation shares `$metadata.requestId`, so a reader
- * resolves a tenant's lines in two phases: filter on `tenantId` to find the invocations,
- * then fetch every line sharing their request ids. That is what attributes a vertical's
- * OWN `console.log` output — which carries no tenant of its own — to the tenant whose
- * request produced it.
- *
- * The inverse of that contract is a rule, not an optimisation: a line with no `tenantId`
- * is never shown to a tenant (§4.3). An un-routed local invocation has no asserted
- * headers and therefore emits no line — there is no tenant it could be attributed to, and
- * inventing one is the only way this could ever leak.
- *
- * ## The tenant is a VERIFIED assertion, never a header
- *
- * Which is why the line is written from `readRoutedNode`'s answer and not from
- * `headers.get('x-substrat-tenant')`. The two look interchangeable — behind the router
- * they are — and they are not, for exactly the reason #966 made `readRoutedNode` itself
- * fail closed: K-26's boundary is that a vertical's script has no public route, and that
- * is a DEPLOYMENT fact, with `workers.dev` on by default. Reading the header directly
- * meant anyone who could reach the script could name any tenant they liked and have the
- * line filed under it — a request the vertical then refuses with a 400, since `nodeFor`
- * does verify, while this middleware's `finally` had already written the forged line.
- *
- * That is not a cosmetic wrong row. The read path uses the stamped line as PROOF that an
- * invocation was a given tenant's, and admits that invocation's other log lines — which
- * carry no tenant of their own — into that tenant's view on the strength of it. A forged
- * stamp is therefore a way to put chosen text on somebody else's dashboard. So the same
- * verification the vertical does for its own routing happens here, with the same secret
- * and the same dev opt-out, and a failed one writes nothing at all.
- */
-// The subpath, not the root: this module is bundled into every vertical's upload (the
-// platform entry, #1893), and the root carries every schema in the vocabulary.
-import { encodeInvocationRecord, FIELD_COVERAGE_HEADER, INVOCATION_RECORD_HEADER, invocationLevelOf, } from '@substrat-run/contracts/invocation-record';
-import { ulid } from './ulid.js';
-import { readRoutedNode, ROUTED_ID, RouterAssertionError } from './routed-node.js';
-/**
- * The per-request store key the middleware parks its {@link InvocationRecord} under (#1746).
- * A published name, like `substratInvocationId`: `mountOperations` reads it in another
- * package, and a vertical's own routes may fill it in too.
- */
-export const INVOCATION_RECORD_KEY = 'substratInvocationRecord';
-// The level and its type moved to contracts in #1904 — the router files its datapoint under
-// the same level — and stay exported from here, where every caller already reads them.
-export { invocationLevelOf } from '@substrat-run/contracts/invocation-record';
-/** Build a line. Unfilled fields are `null` (or empty), as the line's contract says. */
-export function invocationLine(f) {
-    const emitted = f.emitted;
-    return {
-        substrat: 'invocation',
-        ...(f.kind ? { kind: f.kind } : {}),
-        tenantId: f.tenantId,
-        scopeId: f.scopeId,
-        vertical: f.vertical ?? null,
-        surface: f.surface ?? null,
-        method: f.method ?? null,
-        path: f.path ?? null,
-        status: f.status ?? null,
-        threw: f.threw,
-        durationMs: f.durationMs,
-        invocationId: f.invocationId,
-        level: f.level,
-        operation: f.operation ?? null,
-        problemCode: f.problemCode ?? null,
-        principalKind: f.principalKind ?? null,
-        eventCount: emitted ? emitted.total : null,
-        eventTypes: emitted ? distinct(emitted.events.map((e) => e.type)) : [],
-        entities: emitted && f.withEntities !== false ? distinct(emitted.events.map((e) => e.entity)) : [],
-        versionId: f.versionId ?? null,
-        ...(f.outputFields ? { outputFields: f.outputFields, ...(f.fieldCoverageId ? { fieldCoverageId: f.fieldCoverageId } : {}) } : {}),
-        ...(f.async ?? {}),
-    };
-}
-/** Distinct values, first occurrence wins — the order a reader expects to see them in. */
-function distinct(values) {
-    return [...new Set(values)];
-}
-/**
- * The platform's version binding, read straight off the env.
- *
- * The one exception to "bindings only through the options": `SUBSTRAT_VERSION_ID` is not
- * the vertical's binding to name, the platform attaches it to every pushed script, and a
- * vertical that had to pass it through would be one more line to forget with no way for
- * it to be wrong. Read defensively — the env is typed `unknown` here.
- */
-function versionIdOf(env) {
-    const v = env?.SUBSTRAT_VERSION_ID;
-    return typeof v === 'string' && v.length > 0 ? v : null;
-}
-/**
- * The path, with the query string DISCARDED.
- *
- * Not a tidiness choice. A vertical that speaks OIDC carries `code`, `state` and
- * `id_token_hint` in its query strings, an invite or magic-link flow carries a
- * single-use token, and the platform's own internal calls carry `tenantId`/`scopeId`.
- * An access log that swallowed those would put live credentials into a store that is
- * read by a wider audience than the request ever had, and keep them there for the
- * backend's whole retention window. Logging the path alone loses nothing a reader
- * needs: which route ran is the question, and the identifiers are already dimensions.
- */
-function pathOf(url) {
-    try {
-        return new URL(url).pathname;
-    }
-    catch {
-        // A URL the runtime accepted but `URL` will not parse is not worth failing over.
-        return '/';
-    }
-}
-/**
- * The registry of stamps, keyed by the incoming `Request`, on `globalThis` under a GLOBAL
- * symbol. Global rather than module state, because two copies of this code meet in one
- * request: the platform's entry (`withInvocationLog`, prebuilt into the upload) and the
- * kernel the vertical bundled — different module instances, one `Symbol.for`. Weak, so a
- * finished request's stamp goes with its `Request`.
- */
-const STAMPS = Symbol.for('substrat.invocation-stamp');
-function stamps() {
-    const g = globalThis;
-    return (g[STAMPS] ??= new WeakMap());
-}
-/**
- * The stamp a request already carries, if a layer outside this one started it (#1893).
- * `vertical-host` reads the record through this when the Hono context has none, which is
- * the case when the platform's entry stamped the request and the vertical mounts nothing.
- */
-export function invocationStampOf(request) {
-    return stamps().get(request);
-}
-/**
- * #1923: whether the per-response field walk is armed for this request — the one question the
- * walk's two callers in `vertical-host` (the operation routes and the MCP door) ask.
- *
- * `false` for a request no stamp covers, and for a stamp begun by a layer that predates the
- * switch: every version skew between the platform's entry and a vertical's bundled kernel
- * reads as off, never as on.
- */
-export function fieldCoverageArmed(request) {
-    return typeof stamps().get(request)?.fieldCoverageId === 'string';
-}
-function beginStamp(request, env, options) {
-    const stamp = { invocationId: ulid(), record: {} };
-    const fieldCoverageId = armedFieldCoverageId(request.headers, env, options);
-    if (fieldCoverageId)
-        stamp.fieldCoverageId = fieldCoverageId;
-    stamps().set(request, stamp);
-    return stamp;
-}
-/**
- * #1923: the dispatch id the ROUTER armed the field walk with for this request, or `undefined`.
- *
- * The header alone is a claim. It is honoured only when its value is a ULID and the request's
- * router assertion verifies, with the same secret and the same dev opt-out as the tenant on
- * the line, because it is trusted for the same reason: the router strips every inbound
- * `x-substrat-*` header, and a caller that reaches the script some other way holds no secret.
- * An unrouted request, or one whose assertion fails, is never armed.
- *
- * The header is read first, so a request the router did not sample — almost all of them —
- * pays one header read and no verification.
- */
-function armedFieldCoverageId(headers, env, options) {
-    let id;
-    try {
-        id = headers.get(FIELD_COVERAGE_HEADER);
-    }
-    catch {
-        return undefined;
-    }
-    if (id === null || !ROUTED_ID.test(id))
-        return undefined;
-    return routedNodeOrNull(headers, env, options) !== null ? id : undefined;
-}
-/**
- * Write the line for a finished request — the one place it is written, whichever layer
- * started the stamp.
- *
- * No VERIFIED tenant ⇒ no line, and the three ways that happens are all silence here: no
- * assertion at all (an un-routed call), an assertion this worker cannot verify or that is
- * not the router's (`RouterAssertionError`), and — defensively — anything else the read
- * throws. Writing a line for any of them would be filing one caller's request under a
- * tenant of their choosing.
- */
-function writeInvocationLine(stamp, done, options) {
-    // Called from a `finally`: a throw here would replace the vertical's answer, or its own
-    // error, with a logging failure. The platform wraps every uploaded script in this (#1893),
-    // so nothing in it may escape — a line that cannot be written is one missing line.
-    try {
-        writeLineOrThrow(stamp, done, options);
-    }
-    catch (e) {
-        try {
-            console.log(JSON.stringify({ substrat: 'invocation-log-fault', detail: String(e) }));
-        }
-        catch {
-            /* the console itself is gone; there is nowhere left to say so */
-        }
-    }
-}
-function writeLineOrThrow(stamp, done, options) {
-    const node = routedNodeOrNull(done.request.headers, done.env, options);
-    if (!node)
-        return;
-    const { record, invocationId } = stamp;
-    const line = invocationLine({
-        tenantId: node.tenantId,
-        scopeId: node.scopeId,
-        vertical: node.verticalSlug,
-        surface: node.surface,
-        method: done.request.method,
-        path: pathOf(done.request.url),
-        status: done.status,
-        threw: done.threw,
-        durationMs: Date.now() - done.started,
-        invocationId,
-        level: invocationLevelOf(done.status, done.threw, record.problemCode),
-        operation: record.operation,
-        problemCode: record.problemCode,
-        principalKind: record.principalKind,
-        ...(record.emitted ? { emitted: record.emitted } : {}),
-        versionId: versionIdOf(done.env),
-        ...(record.outputFields ? { outputFields: record.outputFields } : {}),
-        ...(stamp.fieldCoverageId ? { fieldCoverageId: stamp.fieldCoverageId } : {}),
-    });
-    console.log(JSON.stringify(line));
-}
-/**
- * Mount as the FIRST middleware on a vertical's app, with the same two answers the
- * vertical gives `readRoutedNode` in its own `nodeFor`:
- *
- * ```ts
- * const app = new Hono<{ Bindings: Env }>();
- * app.use(
- *   '*',
- *   invocationLog<Env>({
- *     routerSecret: (env) => env.ROUTER_SECRET,
- *     allowUnsigned: (env) => env.ALLOW_DEV_NODE === 'true',
- *   }),
- * );
- * ```
- *
- * First, because Hono composes handlers in registration order and stops at the one that
- * returns a response — middleware registered after a route does not wrap that route.
- *
- * **Since #1893 the platform stamps every deployed request itself**, by wrapping the
- * uploaded entry with `withInvocationLog`. A vertical that still mounts this middleware
- * then finds the request already stamped and steps aside — it hands the platform's stamp
- * to the handler chain through the context, as it always did, and writes no second line.
- * Mounted where no platform entry runs (a dev server behind a dev router), it stamps as
- * before.
- *
- * Nothing here can fail a request: the line is written in a `finally`, and a throw from
- * the handler is re-thrown untouched for `onError` to map as it always did.
- */
-export function invocationLog(options = {}) {
-    return async (c, next) => {
-        // Stamped already by the platform's entry: pass the stamp down, write nothing.
-        const existing = invocationStampOf(c.req.raw);
-        if (existing) {
-            c.set?.('substratInvocationId', existing.invocationId);
-            c.set?.(INVOCATION_RECORD_KEY, existing.record);
-            await next();
-            return;
-        }
-        // Host code, so a real clock is correct here — `ctx.now()` is the module-code rule,
-        // and this middleware runs outside any operation's transaction.
-        const started = Date.now();
-        // Minted per request, before anything can emit. A ULID so it sorts by time like
-        // every other id on the spine.
-        const stamp = beginStamp(c.req.raw, c.env, options);
-        c.set?.('substratInvocationId', stamp.invocationId);
-        c.set?.(INVOCATION_RECORD_KEY, stamp.record);
-        let threw = false;
-        try {
-            await next();
-        }
-        catch (e) {
-            threw = true;
-            // Always re-thrown: the envelope `mountPlatformSurface` installs is what answers
-            // the caller, and swallowing here would turn a fault into a silent 200.
-            throw e;
-        }
-        finally {
-            writeInvocationLine(stamp, { request: { method: c.req.method, url: c.req.raw.url, headers: c.req.raw.headers }, env: c.env, status: threw ? null : (c.res?.status ?? null), threw, started }, options);
-        }
-    };
-}
-/** The handlers a module worker may export besides `fetch`, passed through untouched. */
-const OTHER_HANDLERS = ['scheduled', 'queue', 'email', 'tail', 'trace', 'alarm', 'test'];
-/**
- * The platform's half of the stamp (#1893): wrap a module worker's `fetch` so every request
- * it serves is stamped, whatever framework the worker is written in and whether or not it
- * mounts the middleware.
- *
- * The control plane builds this into the entry it uploads in front of every vertical's
- * bundle (`platform-entry.generated.ts`), which is what makes the stamp the platform's
- * rather than a line each vertical has to remember. A request the vertical's own
- * middleware already stamped — possible only if something wrapped this one — is passed
- * straight through. The other handlers (`scheduled`, `queue`, …) are passed through
- * untouched, bound to the worker, since a stamp is about a routed request.
- *
- * Nothing here can fail a request: the line is written in a `finally`, and a throw is
- * re-thrown untouched.
- */
-export function withInvocationLog(worker, options = {}) {
-    // The platform wraps whatever a bundle's default export is (#1893): a class entrypoint or
-    // no default at all has no `fetch` to stamp, and is handed back untouched.
-    const inner = worker?.fetch;
-    if (typeof inner !== 'function')
-        return worker;
-    const wrapped = {
-        async fetch(request, env, ctx) {
-            if (invocationStampOf(request))
-                return inner.call(worker, request, env, ctx);
-            const started = Date.now();
-            const stamp = beginStamp(request, env, options);
-            let status = null;
-            let threw = false;
-            try {
-                const response = await inner.call(worker, request, env, ctx);
-                status = response.status;
-                handRecordToRouter(response, stamp.record, request, env, options);
-                return response;
-            }
-            catch (e) {
-                threw = true;
-                throw e;
-            }
-            finally {
-                writeInvocationLine(stamp, { request, env, status, threw, started }, options);
-            }
-        },
-    };
-    for (const name of OTHER_HANDLERS) {
-        const h = worker[name];
-        if (typeof h === 'function')
-            wrapped[name] = h.bind(worker);
-    }
-    return wrapped;
-}
-/**
- * #1904: hand the record back to the router on the response, which meters the request with
- * it and strips the header before the response leaves (`INVOCATION_RECORD_HEADER`).
- *
- * Only on a request the router vouched for: a direct caller gets no header, and the router
- * is the only reader. Never a throw — a response whose headers are immutable (one passed
- * straight through from a `fetch`) reached no operation and has nothing to hand back, and
- * metering must not fail a request either way.
- */
-function handRecordToRouter(response, record, request, env, options) {
-    try {
-        const value = encodeInvocationRecord(record);
-        if (value === null || !routedNodeOrNull(request.headers, env, options))
-            return;
-        response.headers?.set?.(INVOCATION_RECORD_HEADER, value);
-    }
-    catch {
-        /* immutable headers: see above */
-    }
-}
-/**
- * The verified node, or `null` — never a throw.
- *
- * `readRoutedNode` is deliberately loud: present-but-wrong headers are a
- * misconfiguration or an attack and a caller that routes on them must hear about it.
- * This caller does not route on them; it writes a log line in a `finally`, where a throw
- * would replace the vertical's real answer with a logging failure. So the loudness is
- * swallowed HERE and only here, and the request is unaffected either way.
- */
-function routedNodeOrNull(headers, env, options) {
-    try {
-        return readRoutedNode(headers, {
-            expectedSecret: options.routerSecret?.(env),
-            allowUnsigned: options.allowUnsigned?.(env) ?? false,
-        });
-    }
-    catch (e) {
-        // `RouterAssertionError` is the expected shape — a bad, missing or unverifiable
-        // secret, or a malformed id. Anything else would be a bug in the read, and a bug in
-        // the LOGGER must not become a failed request either.
-        if (!(e instanceof RouterAssertionError))
-            console.log(JSON.stringify({ substrat: 'invocation-log-fault', detail: String(e) }));
-        return null;
-    }
-}
-//# sourceMappingURL=invocation-log.js.map

package/dist/invocation-log.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"invocation-log.js","sourceRoot":"","sources":["../src/invocation-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,sFAAsF;AACtF,+EAA+E;AAC/E,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,iBAAiB,GAElB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAInF;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,0BAA0B,CAAC;AA+ChE,4FAA4F;AAC5F,uFAAuF;AACvF,OAAO,EAAE,iBAAiB,EAAwB,MAAM,2CAA2C,CAAC;AA8QpG,wFAAwF;AACxF,MAAM,UAAU,cAAc,CAAC,CAAuB;IACpD,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;IAC1B,OAAO;QACL,QAAQ,EAAE,YAAY;QACtB,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;QAC5B,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI;QAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI;QACxB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI;QACpB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI;QACxB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;QAC9B,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;QAClC,aAAa,EAAE,CAAC,CAAC,aAAa,IAAI,IAAI;QACtC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QAC1C,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;QACtE,QAAQ,EAAE,OAAO,IAAI,CAAC,CAAC,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;QAClG,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;QAC9B,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;KACnB,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,SAAS,QAAQ,CAAC,MAAyB;IACzC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,CAAC,GAAI,GAA4D,EAAE,mBAAmB,CAAC;IAC7F,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,MAAM,CAAC,GAAW;IACzB,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,iFAAiF;QACjF,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAiBD;;;;;;GAMG;AACH,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;AAEvD,SAAS,MAAM;IACb,MAAM,CAAC,GAAG,UAAqF,CAAC;IAChG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,EAAE,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,OAAO,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,eAAe,KAAK,QAAQ,CAAC;AACpE,CAAC;AAED,SAAS,UAAU,CAAM,OAAkC,EAAE,GAAQ,EAAE,OAAkC;IACvG,MAAM,KAAK,GAAoB,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACpE,MAAM,eAAe,GAAG,oBAAoB,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5E,IAAI,eAAe;QAAE,KAAK,CAAC,eAAe,GAAG,eAAe,CAAC;IAC7D,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC7B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,oBAAoB,CAC3B,OAAqB,EACrB,GAAQ,EACR,OAAkC;IAElC,IAAI,EAAiB,CAAC;IACtB,IAAI,CAAC;QACH,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IACzD,OAAO,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAWD;;;;;;;;;GASG;AACH,SAAS,mBAAmB,CAAM,KAAsB,EAAE,IAAmB,EAAE,OAAkC;IAC/G,wFAAwF;IACxF,2FAA2F;IAC3F,mFAAmF;IACnF,IAAI,CAAC;QACH,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvF,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAM,KAAsB,EAAE,IAAmB,EAAE,OAAkC;IAC5G,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACvE,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IACvC,MAAM,IAAI,GAAG,cAAc,CAAC;QAC1B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,YAAY;QAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;QAC3B,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;QAC9B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO;QACrC,YAAY;QACZ,KAAK,EAAE,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC;QACrE,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;QAChC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAO,GAA8B,EAAE;IAEvC,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,+EAA+E;QAC/E,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,QAAQ,EAAE,CAAC;YACb,CAAC,CAAC,GAAG,EAAE,CAAC,sBAAsB,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;YACvD,CAAC,CAAC,GAAG,EAAE,CAAC,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,oFAAoF;QACpF,gEAAgE;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,gFAAgF;QAChF,+BAA+B;QAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACpD,CAAC,CAAC,GAAG,EAAE,CAAC,sBAAsB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACpD,CAAC,CAAC,GAAG,EAAE,CAAC,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,CAAC;YACb,iFAAiF;YACjF,wEAAwE;YACxE,MAAM,CAAC,CAAC;QACV,CAAC;gBAAS,CAAC;YACT,mBAAmB,CACjB,KAAK,EACL,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,IAAI,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EACjK,OAAO,CACR,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAmBD,yFAAyF;AACzF,MAAM,cAAc,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AAElG;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAyB,EACzB,OAAO,GAA8B,EAAE;IAEvC,0FAA0F;IAC1F,2EAA2E;IAC3E,MAAM,KAAK,GAAI,MAAwC,EAAE,KAAK,CAAC;IAC/D,IAAI,OAAO,KAAK,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC;IAC/C,MAAM,OAAO,GAAsB;QACjC,KAAK,CAAC,KAAK,CAAC,OAAwB,EAAE,GAAQ,EAAE,GAAY;YAC1D,IAAI,iBAAiB,CAAC,OAAO,CAAC;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YAChD,IAAI,MAAM,GAAkB,IAAI,CAAC;YACjC,IAAI,KAAK,GAAG,KAAK,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC7D,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;gBACzB,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBAClE,OAAO,QAAQ,CAAC;YAClB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,KAAK,GAAG,IAAI,CAAC;gBACb,MAAM,CAAC,CAAC;YACV,CAAC;oBAAS,CAAC;gBACT,mBAAmB,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;KACF,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,OAAO,CAAC,KAAK,UAAU;YAAE,OAAO,CAAC,IAAI,CAAC,GAAI,CAAkC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CACzB,QAAiB,EACjB,MAAwB,EACxB,OAAwB,EACxB,GAAQ,EACR,OAAkC;IAElC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC;YAAE,OAAO;QAC9E,QAA0E,CAAC,OAAO,EAAE,GAAG,EAAE,CACxF,wBAAwB,EACxB,KAAK,CACN,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAM,OAAqB,EAAE,GAAQ,EAAE,OAAkC;IAChG,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,OAAO,EAAE;YAC7B,cAAc,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC;YAC3C,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK;SACrD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,gFAAgF;QAChF,oFAAoF;QACpF,sDAAsD;QACtD,IAAI,CAAC,CAAC,CAAC,YAAY,oBAAoB,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/H,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/platform-call.d.ts

@@ -1,45 +0,0 @@
-import type { HeaderReader } from './routed-node.js';
-import type { ScopeStubOptions } from './scope-host.js';
-/**
- * Authenticating a call FROM the platform TO a vertical (K-31).
- *
- * Provisioning is control-plane-driven: the platform decides an instance should
- * exist and tells the vertical to create it, because only the vertical can create a
- * usable scope DO. This is the vertical's side of that call.
- *
- * It is shared code for the same reason `readRoutedNode` is — five verticals each
- * re-deriving how to trust a header is five chances to get it wrong, and the one that
- * gets it wrong is not obviously broken. Both are moving from the kernel to
- * `vertical-host` (#1978), which already re-exports them.
- *
- * Note the direction. `readRoutedNode` answers "which tenant is this request for",
- * and a request with no assertion is legitimate (a standalone deploy). This answers
- * "is the platform itself calling", and there is no legitimate unauthenticated case:
- * an open provisioning endpoint lets a stranger mint tenants inside the vertical.
- * So this one **fails closed with no configuration at all**.
- */
-/** Thrown when a call does not prove it came from the platform. */
-export declare class PlatformCallError extends Error {
-}
-/** Constant-time compare, so a wrong secret leaks nothing through timing. */
-export declare function secretMatches(presented: string | null, expected: string): boolean;
-/**
- * Both kick flags as the stub options that raise them (#1705 PR 2): spread into `getScope`'s
- * options with the handler's header setter. One call per worker rather than one line per flag,
- * so a flag added later reaches every vertical that uses this, and not only the ones that
- * remembered the line. A vertical that skips it still works, and waits for the sweep.
- */
-export declare function kickFlags(setHeader: (name: string, value: string) => void): Pick<ScopeStubOptions, 'onPlatformRequests' | 'onExportedEvents'>;
-/**
- * Throw unless this request proves it came from the platform.
- *
- * **An unset secret is a failure, not a bypass.** That is the opposite of how the
- * router secret behaves, and deliberately so: there, an unset secret means "no router
- * is configured", which a standalone deploy legitimately wants. Here it would mean
- * "anyone may provision", which nothing legitimately wants. A template copied without
- * the secret configured must refuse to provision rather than provision for strangers.
- */
-export declare function assertPlatformCall(headers: HeaderReader, options?: {
-    expectedSecret?: string;
-}): void;
-//# sourceMappingURL=platform-call.d.ts.map

package/dist/platform-call.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"platform-call.d.ts","sourceRoot":"","sources":["../src/platform-call.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAOxD;;;;;;;;;;;;;;;;;GAiBG;AAEH,mEAAmE;AACnE,qBAAa,iBAAkB,SAAQ,KAAK;CAAG;AAE/C,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAOjF;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CACvB,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GAC/C,IAAI,CAAC,gBAAgB,EAAE,oBAAoB,GAAG,kBAAkB,CAAC,CAKnE;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,YAAY,EACrB,OAAO,GAAE;IAAE,cAAc,CAAC,EAAE,MAAM,CAAA;CAAO,GACxC,IAAI,CAQN"}

package/dist/platform-call.js

@@ -1,63 +0,0 @@
-import { EXPORTED_EVENTS_HEADER, PLATFORM_REQUEST_HEADER, PLATFORM_SECRET_HEADER, } from '@substrat-run/contracts/wire-headers';
-/**
- * Authenticating a call FROM the platform TO a vertical (K-31).
- *
- * Provisioning is control-plane-driven: the platform decides an instance should
- * exist and tells the vertical to create it, because only the vertical can create a
- * usable scope DO. This is the vertical's side of that call.
- *
- * It is shared code for the same reason `readRoutedNode` is — five verticals each
- * re-deriving how to trust a header is five chances to get it wrong, and the one that
- * gets it wrong is not obviously broken. Both are moving from the kernel to
- * `vertical-host` (#1978), which already re-exports them.
- *
- * Note the direction. `readRoutedNode` answers "which tenant is this request for",
- * and a request with no assertion is legitimate (a standalone deploy). This answers
- * "is the platform itself calling", and there is no legitimate unauthenticated case:
- * an open provisioning endpoint lets a stranger mint tenants inside the vertical.
- * So this one **fails closed with no configuration at all**.
- */
-/** Thrown when a call does not prove it came from the platform. */
-export class PlatformCallError extends Error {
-}
-/** Constant-time compare, so a wrong secret leaks nothing through timing. */
-export function secretMatches(presented, expected) {
-    if (!presented || presented.length !== expected.length)
-        return false;
-    let diff = 0;
-    for (let i = 0; i < expected.length; i++) {
-        diff |= presented.charCodeAt(i) ^ expected.charCodeAt(i);
-    }
-    return diff === 0;
-}
-/**
- * Both kick flags as the stub options that raise them (#1705 PR 2): spread into `getScope`'s
- * options with the handler's header setter. One call per worker rather than one line per flag,
- * so a flag added later reaches every vertical that uses this, and not only the ones that
- * remembered the line. A vertical that skips it still works, and waits for the sweep.
- */
-export function kickFlags(setHeader) {
-    return {
-        onPlatformRequests: () => setHeader(PLATFORM_REQUEST_HEADER, '1'),
-        onExportedEvents: () => setHeader(EXPORTED_EVENTS_HEADER, '1'),
-    };
-}
-/**
- * Throw unless this request proves it came from the platform.
- *
- * **An unset secret is a failure, not a bypass.** That is the opposite of how the
- * router secret behaves, and deliberately so: there, an unset secret means "no router
- * is configured", which a standalone deploy legitimately wants. Here it would mean
- * "anyone may provision", which nothing legitimately wants. A template copied without
- * the secret configured must refuse to provision rather than provision for strangers.
- */
-export function assertPlatformCall(headers, options = {}) {
-    const { expectedSecret } = options;
-    if (!expectedSecret) {
-        throw new PlatformCallError('platform calls are not configured on this deployment');
-    }
-    if (!secretMatches(headers.get(PLATFORM_SECRET_HEADER), expectedSecret)) {
-        throw new PlatformCallError('not a platform call');
-    }
-}
-//# sourceMappingURL=platform-call.js.map

package/dist/platform-call.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"platform-call.js","sourceRoot":"","sources":["../src/platform-call.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,sCAAsC,CAAC;AAE9C;;;;;;;;;;;;;;;;;GAiBG;AAEH,mEAAmE;AACnE,MAAM,OAAO,iBAAkB,SAAQ,KAAK;CAAG;AAE/C,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,SAAwB,EAAE,QAAgB;IACtE,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACrE,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,IAAI,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CACvB,SAAgD;IAEhD,OAAO;QACL,kBAAkB,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,uBAAuB,EAAE,GAAG,CAAC;QACjE,gBAAgB,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,sBAAsB,EAAE,GAAG,CAAC;KAC/D,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAqB,EACrB,OAAO,GAAgC,EAAE;IAEzC,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IACnC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,iBAAiB,CAAC,sDAAsD,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;IACrD,CAAC;AACH,CAAC"}

package/dist/provider-error.d.ts

@@ -1,38 +0,0 @@
-/**
- * 4xx statuses that are nevertheless worth retrying: the provider is refusing this attempt,
- * not the request. Timeouts and locks clear on their own; a rate limit is an instruction to
- * come back later, which is exactly what the next drain pass does.
- */
-export declare const RETRYABLE_CLIENT_STATUSES: ReadonlySet<number>;
-/**
- * The HTTP status an error carries, if it carries one. Structural on purpose (see above):
- * `ScriveApiError` and any future connector's error type both satisfy it without a shared base
- * class, and an error that carries no status — a network failure, a bug — reads as `undefined`,
- * which is the honest answer and keeps it retryable.
- */
-export declare function providerErrorStatus(error: unknown): number | undefined;
-/**
- * Is this delivery over? — the DRAIN's question, and the only one that decides retries.
- *
- * A non-retryable 4xx, whoever raised it: attempt 101 carries the identical bytes past the
- * identical check. Deliberately blind to WHO refused, because terminality does not depend on
- * it — our own `validation_failed` is as final as the provider's 409, and both statuses come
- * from the same structural read (`SubstratError` carries its catalog status; a connector's
- * error carries the provider's).
- */
-export declare function isTerminalDispatchFailure(error: unknown): boolean;
-/**
- * The PROVIDER refused the request — a 4xx that came back over the wire, not one we raised.
- *
- * The exclusion is the whole point (#841). This predicate reads a bare numeric `status`, and
- * every `SubstratError` carries one from the problem catalog — so a `permission denied:
- * protocol:read` raised on our own side of egress answered `true` here, and the drain
- * captioned it "a client error the provider will refuse identically on retry". Scrive never
- * saw that request. An operator who reads that sentence goes and audits their Scrive account.
- *
- * Terminality was never the part that was wrong, so it did not move: see
- * {@link isTerminalDispatchFailure}, which is what the drain now asks. This one answers only
- * "may we quote this as the provider's words", and one of ours never may.
- */
-export declare function isTerminalProviderError(error: unknown): boolean;
-//# sourceMappingURL=provider-error.d.ts.map

package/dist/provider-error.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"provider-error.d.ts","sourceRoot":"","sources":["../src/provider-error.ts"],"names":[],"mappings":"AAkBA;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,WAAW,CAAC,MAAM,CAAiC,CAAC;AAE5F;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAItE;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAGjE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE/D"}

package/dist/provider-error.js

@@ -1,65 +0,0 @@
-/**
- * Is a failed outbound call worth trying again? (#618)
- *
- * The platform retries a connector delivery by re-draining its `connector:<provider>` intent,
- * and until now every failure looked the same to that loop: a throw meant "transient", so a
- * provider answering `409 requires valid personal number field` was retried a hundred times
- * over two days. That answer is not a fault to wait out — it is the provider telling the
- * CALLER its request is wrong, and attempt 101 carries the identical bytes.
- *
- * The rule lives in one place rather than in any one connector because both ends need it
- * (in the kernel, moving to `control-plane-api` beside the drain, #1978):
- * a connector decides what status to raise, the drain decides whether to keep the intent
- * drainable, and they must not disagree. It is deliberately STRUCTURAL — any error carrying a
- * numeric `status` — so the drain never has to import a provider's error class to classify it,
- * and a connector gets the behaviour by raising the status it already knows.
- */
-import { isSubstratError } from '@substrat-run/contracts';
-/**
- * 4xx statuses that are nevertheless worth retrying: the provider is refusing this attempt,
- * not the request. Timeouts and locks clear on their own; a rate limit is an instruction to
- * come back later, which is exactly what the next drain pass does.
- */
-export const RETRYABLE_CLIENT_STATUSES = new Set([408, 423, 425, 429]);
-/**
- * The HTTP status an error carries, if it carries one. Structural on purpose (see above):
- * `ScriveApiError` and any future connector's error type both satisfy it without a shared base
- * class, and an error that carries no status — a network failure, a bug — reads as `undefined`,
- * which is the honest answer and keeps it retryable.
- */
-export function providerErrorStatus(error) {
-    if (typeof error !== 'object' || error === null)
-        return undefined;
-    const status = error.status;
-    return typeof status === 'number' && Number.isFinite(status) ? status : undefined;
-}
-/**
- * Is this delivery over? — the DRAIN's question, and the only one that decides retries.
- *
- * A non-retryable 4xx, whoever raised it: attempt 101 carries the identical bytes past the
- * identical check. Deliberately blind to WHO refused, because terminality does not depend on
- * it — our own `validation_failed` is as final as the provider's 409, and both statuses come
- * from the same structural read (`SubstratError` carries its catalog status; a connector's
- * error carries the provider's).
- */
-export function isTerminalDispatchFailure(error) {
-    const status = providerErrorStatus(error);
-    return status !== undefined && status >= 400 && status < 500 && !RETRYABLE_CLIENT_STATUSES.has(status);
-}
-/**
- * The PROVIDER refused the request — a 4xx that came back over the wire, not one we raised.
- *
- * The exclusion is the whole point (#841). This predicate reads a bare numeric `status`, and
- * every `SubstratError` carries one from the problem catalog — so a `permission denied:
- * protocol:read` raised on our own side of egress answered `true` here, and the drain
- * captioned it "a client error the provider will refuse identically on retry". Scrive never
- * saw that request. An operator who reads that sentence goes and audits their Scrive account.
- *
- * Terminality was never the part that was wrong, so it did not move: see
- * {@link isTerminalDispatchFailure}, which is what the drain now asks. This one answers only
- * "may we quote this as the provider's words", and one of ours never may.
- */
-export function isTerminalProviderError(error) {
-    return !isSubstratError(error) && isTerminalDispatchFailure(error);
-}
-//# sourceMappingURL=provider-error.js.map

package/dist/provider-error.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"provider-error.js","sourceRoot":"","sources":["../src/provider-error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAE5F;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,MAAM,GAAI,KAA8B,CAAC,MAAM,CAAC;IACtD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACpF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC1C,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACzG,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,yBAAyB,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC"}