@substrat-run/vertical-host 0.147.0 → 0.149.0

package/dist/upload-link.js

@@ -0,0 +1,267 @@
+import { PROBLEM_CONTENT_TYPE, UPLOAD_LINK_IDEMPOTENCY_HEADER, UPLOAD_LINK_PATH_PREFIX, isUploadLinkIdempotencyKey, isUploadLinkSecretShape, substratError, uploadLinkFilename, } from '@substrat-run/contracts';
+import { UPLOAD_LINK_GONE, UPLOAD_LINK_REPLAY_MISMATCH, UPLOAD_LINK_TOO_LARGE, UPLOAD_LINK_TYPE_REFUSED, UPLOAD_LINK_WRONG_TARGET, normalizeUploadMediaType, uploadContentTypeAllowed, } from '@substrat-run/kernel';
+import { problemOf, messageOf } from './errors.js';
+/**
+ * Where `mountUploadLinkRedeem` listens — the one path, not an option: `uploadLinkPath` mints
+ * URLs under it, and `invocationLog` redacts the secret segment under it.
+ */
+export const UPLOAD_LINK_REDEEM_PATH = `${UPLOAD_LINK_PATH_PREFIX}/:entityType/:entityId/:secret`;
+// ---------------------------------------------------------------------------
+// The media type. A client's `Content-Type` is a claim; the bytes get a say where they can.
+// ---------------------------------------------------------------------------
+const GENERIC_TYPES = new Set(['application/octet-stream', 'application/x-www-form-urlencoded', 'binary/octet-stream']);
+const EXTENSION_TYPES = {
+    pdf: 'application/pdf',
+    png: 'image/png',
+    jpg: 'image/jpeg',
+    jpeg: 'image/jpeg',
+    gif: 'image/gif',
+    txt: 'text/plain',
+    csv: 'text/csv',
+    json: 'application/json',
+    xml: 'application/xml',
+    html: 'text/html',
+    zip: 'application/zip',
+    docx: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+    xlsx: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+    pptx: 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+};
+const startsWith = (bytes, magic) => bytes.length >= magic.length && magic.every((b, i) => bytes[i] === b);
+/** The few types whose first bytes say what they are. Anything else is `null`: not sniffable, not suspect. */
+export function sniffMediaType(bytes) {
+    if (startsWith(bytes, [0x25, 0x50, 0x44, 0x46, 0x2d]))
+        return 'application/pdf'; // %PDF-
+    if (startsWith(bytes, [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]))
+        return 'image/png';
+    if (startsWith(bytes, [0xff, 0xd8, 0xff]))
+        return 'image/jpeg';
+    if (startsWith(bytes, [0x47, 0x49, 0x46, 0x38]))
+        return 'image/gif'; // GIF8
+    return null;
+}
+const SNIFFABLE = new Set(['application/pdf', 'image/png', 'image/jpeg', 'image/gif']);
+/**
+ * The type the platform will record. Order: the request's own `Content-Type` unless it is
+ * generic (`curl --upload-file` sends none), else the file name's extension, else what the
+ * bytes say, else `application/octet-stream`. A claim about a type the bytes can prove — PDF,
+ * PNG, JPEG, GIF — that the bytes contradict is refused (`null`), as is a sniffable file under
+ * another claim: a `.pdf` that is a PNG is not what the link's allowlist was written for.
+ */
+export function resolveUploadMediaType(header, filename, bytes) {
+    const fromHeader = header ? normalizeUploadMediaType(header) : '';
+    const ext = filename.includes('.') ? filename.slice(filename.lastIndexOf('.') + 1).toLowerCase() : '';
+    const claimed = fromHeader && !GENERIC_TYPES.has(fromHeader) ? fromHeader : (EXTENSION_TYPES[ext] ?? null);
+    const sniffed = sniffMediaType(bytes);
+    if (claimed === null)
+        return sniffed ?? 'application/octet-stream';
+    if (SNIFFABLE.has(claimed))
+        return sniffed === claimed ? claimed : null;
+    return sniffed !== null ? null : claimed;
+}
+// ---------------------------------------------------------------------------
+// The file name.
+// ---------------------------------------------------------------------------
+function dispositionFilename(header) {
+    if (!header)
+        return undefined;
+    const star = /filename\*\s*=\s*UTF-8''([^;]+)/i.exec(header);
+    if (star) {
+        try {
+            return decodeURIComponent(star[1].trim());
+        }
+        catch {
+            return undefined;
+        }
+    }
+    const plain = /filename\s*=\s*(?:"([^"]*)"|([^;]+))/i.exec(header);
+    return (plain?.[1] ?? plain?.[2])?.trim();
+}
+/** A leaf name, never a path: what the uploader called it, cleaned, or `undefined` if nothing usable. */
+function cleanFilename(raw) {
+    if (raw === undefined)
+        return undefined;
+    const leaf = raw.split(/[\\/]/).pop() ?? '';
+    // eslint-disable-next-line no-control-regex
+    const cleaned = leaf.replace(/[\u0000-\u001f\u007f]/g, '').trim().slice(0, 255);
+    return uploadLinkFilename.safeParse(cleaned).success ? cleaned : undefined;
+}
+// ---------------------------------------------------------------------------
+// The body, read under a ceiling.
+// ---------------------------------------------------------------------------
+class TooLarge extends Error {
+}
+/** Read the request body, refusing past `max` bytes as they arrive — not after buffering them all. */
+async function readBody(request, max) {
+    const declared = request.headers.get('content-length');
+    if (declared !== null && Number(declared) > max)
+        throw new TooLarge();
+    if (!request.body)
+        return new Uint8Array(0);
+    const reader = request.body.getReader();
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.byteLength;
+        if (total > max) {
+            await reader.cancel().catch(() => { });
+            throw new TooLarge();
+        }
+        chunks.push(value);
+    }
+    const out = new Uint8Array(total);
+    let at = 0;
+    for (const chunk of chunks) {
+        out.set(chunk, at);
+        at += chunk.byteLength;
+    }
+    return out;
+}
+// ---------------------------------------------------------------------------
+// The answers.
+// ---------------------------------------------------------------------------
+const reasonOf = (err) => {
+    const ext = err?.extensions;
+    return typeof ext?.reason === 'string' ? ext.reason : undefined;
+};
+const STATUS_BY_REASON = {
+    [UPLOAD_LINK_GONE]: 410,
+    [UPLOAD_LINK_TOO_LARGE]: 413,
+    [UPLOAD_LINK_TYPE_REFUSED]: 415,
+    [UPLOAD_LINK_WRONG_TARGET]: 404,
+    [UPLOAD_LINK_REPLAY_MISMATCH]: 422,
+};
+const CORS_HEADERS = [
+    'access-control-allow-origin',
+    'access-control-allow-credentials',
+    'access-control-expose-headers',
+    'vary',
+];
+function refuse(c, err) {
+    const reason = reasonOf(err);
+    const status = reason !== undefined ? STATUS_BY_REASON[reason] : undefined;
+    if (status === undefined) {
+        // Not ours to reclassify: the platform's ordinary vocabulary (403 for a lost key, 404 for an unknown secret).
+        const { status: decided, body } = problemOf({ status: errorStatus(err), message: messageOf(err) }, err, c.req.path.replace(/\/[^/]+$/, '/…'));
+        return c.body(JSON.stringify(body), decided, { 'content-type': PROBLEM_CONTENT_TYPE });
+    }
+    const body = {
+        type: 'about:blank',
+        title: reason,
+        status,
+        detail: messageOf(err),
+        reason,
+    };
+    return c.body(JSON.stringify(body), status, { 'content-type': PROBLEM_CONTENT_TYPE });
+}
+const STATUS_BY_CODE = {
+    unauthenticated: 401,
+    permission_denied: 403,
+    forbidden: 403,
+    not_found: 404,
+    conflict: 409,
+    validation_failed: 400,
+    unavailable: 503,
+};
+function errorStatus(err) {
+    const code = err?.code;
+    return (code && STATUS_BY_CODE[code]) || 500;
+}
+/**
+ * The `Idempotency-Key` a request carries, or `undefined` for none: the bare token, or one
+ * structured-field string (`"…"`, the IETF draft's spelling) with its quotes taken off. Anything
+ * else is a 400 — never a key matched loosely.
+ */
+function idempotencyKeyOf(header) {
+    if (header === undefined)
+        return undefined;
+    const key = header.length >= 2 && header.startsWith('"') && header.endsWith('"') ? header.slice(1, -1) : header;
+    if (!isUploadLinkIdempotencyKey(key)) {
+        throw substratError('validation_failed', 'An Idempotency-Key is 16 to 255 visible ASCII characters, with no space, quote or backslash, such as a UUID.');
+    }
+    return key;
+}
+/** The 404 every secret that names nothing gets — the scope's answer, and this route's for a malformed one. */
+const unknownLink = () => substratError('not_found', 'This upload link is not valid.');
+/**
+ * Mount `PUT` and `POST` on `UPLOAD_LINK_REDEEM_PATH`: redeem one upload link. See the module
+ * header for the answers and the hygiene.
+ */
+export function mountUploadLinkRedeem(app, options) {
+    const handler = async (c) => {
+        // Before anything can fail: nothing here may be cached or handed onwards, and an outer
+        // blanket CORS layer must not make the answer readable by a page that learned the link.
+        c.header('Cache-Control', 'no-store');
+        c.header('Referrer-Policy', 'no-referrer');
+        c.header('X-Content-Type-Options', 'nosniff');
+        for (const name of CORS_HEADERS)
+            c.header(name, undefined);
+        try {
+            const entityType = c.req.param('entityType');
+            const entityId = c.req.param('entityId');
+            const secret = c.req.param('secret');
+            // A secret that cannot be one the kernel minted costs the scope nothing: the same 404 an
+            // unknown one gets, before the host, the scope or its Durable Object is touched.
+            if (!entityType || !entityId || !isUploadLinkSecretShape(secret))
+                throw unknownLink();
+            // #2315: the redeemer's own id for this redemption, judged before the scope is asked, so a
+            // malformed one is the same 400 whatever the link's state.
+            const idempotencyKey = idempotencyKeyOf(c.req.header(UPLOAD_LINK_IDEMPOTENCY_HEADER));
+            const [host, node] = await Promise.all([options.host(c), options.node(c)]);
+            if (!host.inspectUploadLink || !host.redeemUploadLink) {
+                throw substratError('unavailable', 'this scope host serves no upload links');
+            }
+            // The link first, so a refusal costs no body: unknown or minted for another target (404,
+            // judged before its state), used / expired / revoked (410), and what the body will be
+            // judged against.
+            const view = await host.inspectUploadLink(node.tenantId, node.scopeId, secret, { entityType, entityId }, idempotencyKey);
+            const filename = view.filename ??
+                cleanFilename(c.req.query('filename')) ??
+                cleanFilename(dispositionFilename(c.req.header('content-disposition'))) ??
+                'upload';
+            let body;
+            try {
+                body = await readBody(c.req.raw, view.maxBytes);
+            }
+            catch (err) {
+                if (err instanceof TooLarge) {
+                    throw substratError('validation_failed', `The file is larger than the ${view.maxBytes} bytes this link admits.`, {
+                        reason: UPLOAD_LINK_TOO_LARGE,
+                    });
+                }
+                throw err;
+            }
+            if (body.byteLength === 0)
+                throw substratError('validation_failed', 'An empty file cannot be uploaded.');
+            const contentType = resolveUploadMediaType(c.req.header('content-type'), filename, body);
+            if (contentType === null || !uploadContentTypeAllowed(view.contentTypes, contentType)) {
+                throw substratError('validation_failed', 'A file of that type is not admitted by this link.', {
+                    reason: UPLOAD_LINK_TYPE_REFUSED,
+                });
+            }
+            const record = await host.redeemUploadLink(node.tenantId, node.scopeId, secret, {
+                entity: view.entity,
+                filename,
+                contentType,
+                body,
+                ...(idempotencyKey !== undefined ? { idempotencyKey } : {}),
+            });
+            // 200 for a replay of the redemption that spent the link, 201 for a file stored now.
+            return c.body(JSON.stringify({
+                id: record.id,
+                filename: record.filename,
+                contentType: record.contentType,
+                size: record.size,
+                sha256: record.sha256,
+            }), record.replayed ? 200 : 201, { 'content-type': 'application/json' });
+        }
+        catch (err) {
+            return refuse(c, err);
+        }
+    };
+    app.put(UPLOAD_LINK_REDEEM_PATH, handler);
+    app.post(UPLOAD_LINK_REDEEM_PATH, handler);
+}
+//# sourceMappingURL=upload-link.js.map

package/dist/upload-link.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-link.js","sourceRoot":"","sources":["../src/upload-link.ts"],"names":[],"mappings":"AAuDA,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAC9B,uBAAuB,EACvB,0BAA0B,EAC1B,uBAAuB,EACvB,aAAa,EACb,kBAAkB,GAGnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,gBAAgB,EAChB,2BAA2B,EAC3B,qBAAqB,EACrB,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,GAEzB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAKnD;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,uBAAuB,gCAAgC,CAAC;AASlG,8EAA8E;AAC9E,4FAA4F;AAC5F,8EAA8E;AAE9E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,0BAA0B,EAAE,mCAAmC,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAExH,MAAM,eAAe,GAAqC;IACxD,GAAG,EAAE,iBAAiB;IACtB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,YAAY;IACjB,GAAG,EAAE,UAAU;IACf,IAAI,EAAE,kBAAkB;IACxB,GAAG,EAAE,iBAAiB;IACtB,IAAI,EAAE,WAAW;IACjB,GAAG,EAAE,iBAAiB;IACtB,IAAI,EAAE,yEAAyE;IAC/E,IAAI,EAAE,mEAAmE;IACzE,IAAI,EAAE,2EAA2E;CAClF,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,KAAiB,EAAE,KAAwB,EAAW,EAAE,CAC1E,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAExE,8GAA8G;AAC9G,MAAM,UAAU,cAAc,CAAC,KAAiB;IAC9C,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAAE,OAAO,iBAAiB,CAAC,CAAC,QAAQ;IACzF,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAAE,OAAO,WAAW,CAAC;IAC5F,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAAE,OAAO,YAAY,CAAC;IAC/D,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAAE,OAAO,WAAW,CAAC,CAAC,OAAO;IAC5E,OAAO,IAAI,CAAC;AACd,CAAC;AACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;AAGvF;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA0B,EAC1B,QAAgB,EAChB,KAAiB;IAEjB,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtG,MAAM,OAAO,GAAG,UAAU,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC;IAC3G,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,IAAI,0BAA0B,CAAC;IACnE,IAAI,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AAC3C,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,SAAS,mBAAmB,CAAC,MAA0B;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,IAAI,GAAG,kCAAkC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,uCAAuC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED,yGAAyG;AACzG,SAAS,aAAa,CAAC,GAAuB;IAC5C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAC5C,4CAA4C;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChF,OAAO,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7E,CAAC;AAED,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E,MAAM,QAAS,SAAQ,KAAK;CAAG;AAE/B,sGAAsG;AACtG,KAAK,UAAU,QAAQ,CAAC,OAAgB,EAAE,GAAW;IACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACvD,IAAI,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,GAAG;QAAE,MAAM,IAAI,QAAQ,EAAE,CAAC;IACtE,IAAI,CAAC,OAAO,CAAC,IAAI;QAAE,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACxC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,SAAS,CAAC;QACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;QAC1B,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YAChB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACtC,MAAM,IAAI,QAAQ,EAAE,CAAC;QACvB,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnB,EAAE,IAAI,KAAK,CAAC,UAAU,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAsB,EAAE;IACpD,MAAM,GAAG,GAAI,GAAoD,EAAE,UAAU,CAAC;IAC9E,OAAO,OAAO,GAAG,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAmD;IACvE,CAAC,gBAAgB,CAAC,EAAE,GAAG;IACvB,CAAC,qBAAqB,CAAC,EAAE,GAAG;IAC5B,CAAC,wBAAwB,CAAC,EAAE,GAAG;IAC/B,CAAC,wBAAwB,CAAC,EAAE,GAAG;IAC/B,CAAC,2BAA2B,CAAC,EAAE,GAAG;CACnC,CAAC;AAEF,MAAM,YAAY,GAAG;IACnB,6BAA6B;IAC7B,kCAAkC;IAClC,+BAA+B;IAC/B,MAAM;CACP,CAAC;AAEF,SAAS,MAAM,CAAC,CAAU,EAAE,GAAY;IACtC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,8GAA8G;QAC9G,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,SAAS,CACzC,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,EACrD,GAAG,EACH,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CACrC,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,oBAAoB,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,MAAM;QACb,MAAM;QACN,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC;QACtB,MAAM;KACP,CAAC;IACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,oBAAoB,EAAE,CAAC,CAAC;AACxF,CAAC;AAED,MAAM,cAAc,GAAqD;IACvE,eAAe,EAAE,GAAG;IACpB,iBAAiB,EAAE,GAAG;IACtB,SAAS,EAAE,GAAG;IACd,SAAS,EAAE,GAAG;IACd,QAAQ,EAAE,GAAG;IACb,iBAAiB,EAAE,GAAG;IACtB,WAAW,EAAE,GAAG;CACjB,CAAC;AACF,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,IAAI,GAAI,GAAmC,EAAE,IAAI,CAAC;IACxD,OAAO,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,MAA0B;IAClD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAChH,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,aAAa,CACjB,mBAAmB,EACnB,8GAA8G,CAC/G,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+GAA+G;AAC/G,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,gCAAgC,CAAC,CAAC;AAEvF;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAgB,GAAY,EAAE,OAAmC;IACpG,MAAM,OAAO,GAAG,KAAK,EAAE,CAAa,EAAqB,EAAE;QACzD,uFAAuF;QACvF,wFAAwF;QACxF,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACtC,CAAC,CAAC,MAAM,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QAC9C,KAAK,MAAM,IAAI,IAAI,YAAY;YAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAC7C,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACrC,yFAAyF;YACzF,iFAAiF;YACjF,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC;gBAAE,MAAM,WAAW,EAAE,CAAC;YACtF,2FAA2F;YAC3F,2DAA2D;YAC3D,MAAM,cAAc,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC,CAAC;YACtF,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3E,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtD,MAAM,aAAa,CAAC,aAAa,EAAE,wCAAwC,CAAC,CAAC;YAC/E,CAAC;YACD,yFAAyF;YACzF,sFAAsF;YACtF,kBAAkB;YAClB,MAAM,IAAI,GAAmB,MAAM,IAAI,CAAC,iBAAiB,CACvD,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,OAAO,EACZ,MAAM,EACN,EAAE,UAAU,EAAE,QAAQ,EAAE,EACxB,cAAc,CACf,CAAC;YACF,MAAM,QAAQ,GACZ,IAAI,CAAC,QAAQ;gBACb,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBACtC,aAAa,CAAC,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC;gBACvE,QAAQ,CAAC;YACX,IAAI,IAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;oBAC5B,MAAM,aAAa,CAAC,mBAAmB,EAAE,+BAA+B,IAAI,CAAC,QAAQ,0BAA0B,EAAE;wBAC/G,MAAM,EAAE,qBAAqB;qBAC9B,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,IAAI,IAAI,CAAC,UAAU,KAAK,CAAC;gBAAE,MAAM,aAAa,CAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAAC;YACzG,MAAM,WAAW,GAAG,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YACzF,IAAI,WAAW,KAAK,IAAI,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC;gBACtF,MAAM,aAAa,CAAC,mBAAmB,EAAE,mDAAmD,EAAE;oBAC5F,MAAM,EAAE,wBAAwB;iBACjC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE;gBAC9E,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ;gBACR,WAAW;gBACX,IAAI;gBACJ,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5D,CAAC,CAAC;YACH,qFAAqF;YACrF,OAAO,CAAC,CAAC,IAAI,CACX,IAAI,CAAC,SAAS,CAAC;gBACb,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC,EACF,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAC3B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CACvC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;IAC1C,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;AAC7C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@substrat-run/vertical-host",
-  "version": "0.147.0",
+  "version": "0.149.0",
   "description": "The platform's /internal/* surface + error envelope, authored once — mount it in a vertical worker instead of re-copying the control-plane contract",
   "license": "AGPL-3.0-only",
   "repository": {
@@ -29,18 +29,18 @@
     "ai": "7.0.136",
     "hono": "^4.13.13",
     "workers-ai-provider": "^4.0.0",
-    "@substrat-run/contracts": "^0.147.0",
-    "@substrat-run/model-providers": "^0.5.37",
-    "@substrat-run/kernel": "^0.147.0"
+    "@substrat-run/contracts": "^0.149.0",
+    "@substrat-run/model-providers": "^0.5.39",
+    "@substrat-run/kernel": "^0.149.0"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^9.6.0",
     "better-sqlite3": "^13.0.3",
     "typescript": "^7.0.0",
     "vitest": "^5.0.3",
-    "@substrat-run/adapter-sqlite": "^0.147.0",
-    "@substrat-run/vertical-auth": "^0.24.2",
-    "@substrat-run/contract-tests": "^0.147.0"
+    "@substrat-run/contract-tests": "^0.149.0",
+    "@substrat-run/vertical-auth": "^0.24.4",
+    "@substrat-run/adapter-sqlite": "^0.149.0"
   },
   "publishConfig": {
     "access": "public"