@superblocksteam/shared 0.9603.3 → 0.9604.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (145) hide show
  1. package/dist/database-lifecycle/capacityPolicy.d.ts +51 -0
  2. package/dist/database-lifecycle/capacityPolicy.d.ts.map +1 -0
  3. package/dist/database-lifecycle/capacityPolicy.js +159 -0
  4. package/dist/database-lifecycle/capacityPolicy.js.map +1 -0
  5. package/dist/database-lifecycle/capacityPolicy.test.d.ts +2 -0
  6. package/dist/database-lifecycle/capacityPolicy.test.d.ts.map +1 -0
  7. package/dist/database-lifecycle/capacityPolicy.test.js +159 -0
  8. package/dist/database-lifecycle/capacityPolicy.test.js.map +1 -0
  9. package/dist/database-lifecycle/edit-lifecycle-capability.d.ts +18 -0
  10. package/dist/database-lifecycle/edit-lifecycle-capability.d.ts.map +1 -0
  11. package/dist/database-lifecycle/edit-lifecycle-capability.js +32 -0
  12. package/dist/database-lifecycle/edit-lifecycle-capability.js.map +1 -0
  13. package/dist/database-lifecycle/edit-lifecycle-capability.test.d.ts +2 -0
  14. package/dist/database-lifecycle/edit-lifecycle-capability.test.d.ts.map +1 -0
  15. package/dist/database-lifecycle/edit-lifecycle-capability.test.js +91 -0
  16. package/dist/database-lifecycle/edit-lifecycle-capability.test.js.map +1 -0
  17. package/dist/database-lifecycle/index.d.ts +50 -27
  18. package/dist/database-lifecycle/index.d.ts.map +1 -1
  19. package/dist/database-lifecycle/index.js +78 -54
  20. package/dist/database-lifecycle/index.js.map +1 -1
  21. package/dist/database-lifecycle/index.test.js +120 -77
  22. package/dist/database-lifecycle/index.test.js.map +1 -1
  23. package/dist/database-lifecycle/physicalPoolIdentity.d.ts +29 -0
  24. package/dist/database-lifecycle/physicalPoolIdentity.d.ts.map +1 -0
  25. package/dist/database-lifecycle/physicalPoolIdentity.js +64 -0
  26. package/dist/database-lifecycle/physicalPoolIdentity.js.map +1 -0
  27. package/dist/database-lifecycle/physicalPoolIdentity.test.d.ts +2 -0
  28. package/dist/database-lifecycle/physicalPoolIdentity.test.d.ts.map +1 -0
  29. package/dist/database-lifecycle/physicalPoolIdentity.test.js +51 -0
  30. package/dist/database-lifecycle/physicalPoolIdentity.test.js.map +1 -0
  31. package/dist/index.d.ts +1 -0
  32. package/dist/index.d.ts.map +1 -1
  33. package/dist/index.js +1 -0
  34. package/dist/index.js.map +1 -1
  35. package/dist/types/audit/ocsf.d.ts +60 -6
  36. package/dist/types/audit/ocsf.d.ts.map +1 -1
  37. package/dist/types/audit/ocsf.js +12 -1
  38. package/dist/types/audit/ocsf.js.map +1 -1
  39. package/dist/types/deployment/deployQueueStatus.d.ts +13 -0
  40. package/dist/types/deployment/deployQueueStatus.d.ts.map +1 -1
  41. package/dist/types/deployment/index.d.ts +1 -1
  42. package/dist/types/deployment/index.d.ts.map +1 -1
  43. package/dist/types/deployment/index.js.map +1 -1
  44. package/dist/types/policyGate/index.d.ts +5 -0
  45. package/dist/types/policyGate/index.d.ts.map +1 -1
  46. package/dist/types/policyGate/index.js +5 -1
  47. package/dist/types/policyGate/index.js.map +1 -1
  48. package/dist/types/publishPipeline/plan.js +1 -1
  49. package/dist/types/publishPipeline/plan.js.map +1 -1
  50. package/dist/types/publishPipeline/plan.test.js +3 -3
  51. package/dist/types/publishPipeline/plan.test.js.map +1 -1
  52. package/dist/types/rbac/index.d.ts +2 -0
  53. package/dist/types/rbac/index.d.ts.map +1 -1
  54. package/dist/types/rbac/index.js +3 -1
  55. package/dist/types/rbac/index.js.map +1 -1
  56. package/dist/types/reviewPolicy/index.d.ts +35 -4
  57. package/dist/types/reviewPolicy/index.d.ts.map +1 -1
  58. package/dist/types/reviewPolicy/index.js +15 -1
  59. package/dist/types/reviewPolicy/index.js.map +1 -1
  60. package/dist/types/reviewPolicy/index.test.d.ts +2 -0
  61. package/dist/types/reviewPolicy/index.test.d.ts.map +1 -0
  62. package/dist/types/reviewPolicy/index.test.js +17 -0
  63. package/dist/types/reviewPolicy/index.test.js.map +1 -0
  64. package/dist-esm/database-lifecycle/capacityPolicy.d.ts +51 -0
  65. package/dist-esm/database-lifecycle/capacityPolicy.d.ts.map +1 -0
  66. package/dist-esm/database-lifecycle/capacityPolicy.js +150 -0
  67. package/dist-esm/database-lifecycle/capacityPolicy.js.map +1 -0
  68. package/dist-esm/database-lifecycle/capacityPolicy.test.d.ts +2 -0
  69. package/dist-esm/database-lifecycle/capacityPolicy.test.d.ts.map +1 -0
  70. package/dist-esm/database-lifecycle/capacityPolicy.test.js +157 -0
  71. package/dist-esm/database-lifecycle/capacityPolicy.test.js.map +1 -0
  72. package/dist-esm/database-lifecycle/edit-lifecycle-capability.d.ts +18 -0
  73. package/dist-esm/database-lifecycle/edit-lifecycle-capability.d.ts.map +1 -0
  74. package/dist-esm/database-lifecycle/edit-lifecycle-capability.js +29 -0
  75. package/dist-esm/database-lifecycle/edit-lifecycle-capability.js.map +1 -0
  76. package/dist-esm/database-lifecycle/edit-lifecycle-capability.test.d.ts +2 -0
  77. package/dist-esm/database-lifecycle/edit-lifecycle-capability.test.d.ts.map +1 -0
  78. package/dist-esm/database-lifecycle/edit-lifecycle-capability.test.js +89 -0
  79. package/dist-esm/database-lifecycle/edit-lifecycle-capability.test.js.map +1 -0
  80. package/dist-esm/database-lifecycle/index.d.ts +50 -27
  81. package/dist-esm/database-lifecycle/index.d.ts.map +1 -1
  82. package/dist-esm/database-lifecycle/index.js +62 -51
  83. package/dist-esm/database-lifecycle/index.js.map +1 -1
  84. package/dist-esm/database-lifecycle/index.test.js +90 -47
  85. package/dist-esm/database-lifecycle/index.test.js.map +1 -1
  86. package/dist-esm/database-lifecycle/physicalPoolIdentity.d.ts +29 -0
  87. package/dist-esm/database-lifecycle/physicalPoolIdentity.d.ts.map +1 -0
  88. package/dist-esm/database-lifecycle/physicalPoolIdentity.js +59 -0
  89. package/dist-esm/database-lifecycle/physicalPoolIdentity.js.map +1 -0
  90. package/dist-esm/database-lifecycle/physicalPoolIdentity.test.d.ts +2 -0
  91. package/dist-esm/database-lifecycle/physicalPoolIdentity.test.d.ts.map +1 -0
  92. package/dist-esm/database-lifecycle/physicalPoolIdentity.test.js +49 -0
  93. package/dist-esm/database-lifecycle/physicalPoolIdentity.test.js.map +1 -0
  94. package/dist-esm/index.d.ts +1 -0
  95. package/dist-esm/index.d.ts.map +1 -1
  96. package/dist-esm/index.js +1 -0
  97. package/dist-esm/index.js.map +1 -1
  98. package/dist-esm/types/audit/ocsf.d.ts +60 -6
  99. package/dist-esm/types/audit/ocsf.d.ts.map +1 -1
  100. package/dist-esm/types/audit/ocsf.js +12 -1
  101. package/dist-esm/types/audit/ocsf.js.map +1 -1
  102. package/dist-esm/types/deployment/deployQueueStatus.d.ts +13 -0
  103. package/dist-esm/types/deployment/deployQueueStatus.d.ts.map +1 -1
  104. package/dist-esm/types/deployment/index.d.ts +1 -1
  105. package/dist-esm/types/deployment/index.d.ts.map +1 -1
  106. package/dist-esm/types/deployment/index.js.map +1 -1
  107. package/dist-esm/types/policyGate/index.d.ts +5 -0
  108. package/dist-esm/types/policyGate/index.d.ts.map +1 -1
  109. package/dist-esm/types/policyGate/index.js +5 -1
  110. package/dist-esm/types/policyGate/index.js.map +1 -1
  111. package/dist-esm/types/publishPipeline/plan.js +1 -1
  112. package/dist-esm/types/publishPipeline/plan.js.map +1 -1
  113. package/dist-esm/types/publishPipeline/plan.test.js +3 -3
  114. package/dist-esm/types/publishPipeline/plan.test.js.map +1 -1
  115. package/dist-esm/types/rbac/index.d.ts +2 -0
  116. package/dist-esm/types/rbac/index.d.ts.map +1 -1
  117. package/dist-esm/types/rbac/index.js +3 -1
  118. package/dist-esm/types/rbac/index.js.map +1 -1
  119. package/dist-esm/types/reviewPolicy/index.d.ts +35 -4
  120. package/dist-esm/types/reviewPolicy/index.d.ts.map +1 -1
  121. package/dist-esm/types/reviewPolicy/index.js +13 -0
  122. package/dist-esm/types/reviewPolicy/index.js.map +1 -1
  123. package/dist-esm/types/reviewPolicy/index.test.d.ts +2 -0
  124. package/dist-esm/types/reviewPolicy/index.test.d.ts.map +1 -0
  125. package/dist-esm/types/reviewPolicy/index.test.js +15 -0
  126. package/dist-esm/types/reviewPolicy/index.test.js.map +1 -0
  127. package/package.json +1 -1
  128. package/src/database-lifecycle/capacityPolicy.test.ts +209 -0
  129. package/src/database-lifecycle/capacityPolicy.ts +197 -0
  130. package/src/database-lifecycle/edit-lifecycle-capability.test.ts +116 -0
  131. package/src/database-lifecycle/edit-lifecycle-capability.ts +34 -0
  132. package/src/database-lifecycle/index.test.ts +105 -48
  133. package/src/database-lifecycle/index.ts +157 -90
  134. package/src/database-lifecycle/physicalPoolIdentity.test.ts +64 -0
  135. package/src/database-lifecycle/physicalPoolIdentity.ts +75 -0
  136. package/src/index.ts +1 -0
  137. package/src/types/audit/ocsf.ts +73 -7
  138. package/src/types/deployment/deployQueueStatus.ts +14 -0
  139. package/src/types/deployment/index.ts +2 -1
  140. package/src/types/policyGate/index.ts +5 -1
  141. package/src/types/publishPipeline/plan.test.ts +3 -3
  142. package/src/types/publishPipeline/plan.ts +1 -1
  143. package/src/types/rbac/index.ts +3 -1
  144. package/src/types/reviewPolicy/index.test.ts +17 -0
  145. package/src/types/reviewPolicy/index.ts +52 -5
@@ -1,6 +1,20 @@
1
1
  import { describe, expect, test } from 'vitest';
2
- import { computeBindingKey, computeDesiredSpecHash, computeNativeDbApplicationToken, computeNativeDbBindingToken, computeNativeDbDatabaseName, computeRequirementKey, containsCredentialMaterial, isSecretKey, isTerminalLifecycleState, nativeDbIamSessionPolicy, parseNativeDbIamDescriptor, redactLifecycleSecrets } from './index.js';
2
+ import { ApiTriggerType } from '../types/api/index.js';
3
+ import { DATABASE_LIFECYCLE_MANAGED_BY, LIFECYCLE_OPERATIONS, computeBindingKey, computeDesiredSpecHash, computeNativeDbApplicationToken, computeNativeDbProfileToken, computeRequirementKey, containsCredentialMaterial, isLifecycleManagedIntegrationAllowedForApiTrigger, isSecretKey, isTerminalLifecycleState, nativeDbIamSessionPolicy, parseNativeDbIamDescriptor, redactLifecycleSecrets } from './index.js';
3
4
  describe('database lifecycle contracts', () => {
5
+ // Postgres `ALTER TYPE ... ADD VALUE` appends. TypeORM's entity-vs-schema
6
+ // check treats enum label order as part of the contract, so this array must
7
+ // match the live `lifecycle_operation_enum` order rather than alphabetical
8
+ // or semantic grouping.
9
+ test('lists lifecycle operations in Postgres enum order', () => {
10
+ expect(LIFECYCLE_OPERATIONS).toEqual(['ensure_database', 'migrate_schema', 'retire_database', 'ensure_physical_database_instance']);
11
+ });
12
+ test('allows lifecycle-managed integrations only in application APIs', () => {
13
+ expect(isLifecycleManagedIntegrationAllowedForApiTrigger(ApiTriggerType.UI, DATABASE_LIFECYCLE_MANAGED_BY)).toBe(true);
14
+ expect(isLifecycleManagedIntegrationAllowedForApiTrigger(ApiTriggerType.WORKFLOW, DATABASE_LIFECYCLE_MANAGED_BY)).toBe(false);
15
+ expect(isLifecycleManagedIntegrationAllowedForApiTrigger(ApiTriggerType.SCHEDULE, DATABASE_LIFECYCLE_MANAGED_BY)).toBe(false);
16
+ expect(isLifecycleManagedIntegrationAllowedForApiTrigger(ApiTriggerType.WORKFLOW, null)).toBe(true);
17
+ });
4
18
  test('computes stable requirement, binding, and desired spec identifiers', async () => {
5
19
  const requirement = {
6
20
  logicalName: 'Orders DB',
@@ -16,21 +30,22 @@ describe('database lifecycle contracts', () => {
16
30
  expect(computeRequirementKey({ logicalName: 'orders/db', engine: 'postgres' })).toBe('orders-db~orders%2Fdb:postgres');
17
31
  expect(computeRequirementKey({ logicalName: 'orders-db', engine: 'postgres' })).toBe('orders-db~orders-db:postgres');
18
32
  // binding_key excludes the logical name on purpose: one database per
19
- // (organization, application, environment, profile). Two different logical
20
- // names under the same profile resolve to the same binding_key.
33
+ // (organization, application, profile). Two different logical names under
34
+ // the same profile resolve to the same binding_key.
21
35
  expect(computeBindingKey({
22
36
  organizationId: 'org-1',
23
37
  applicationId: 'app-1',
24
- environment: 'edit',
25
38
  profile: 'Staging EU'
26
- })).toBe('org-1:app-1:edit:staging-eu~Staging%20EU');
39
+ })).toBe('org-1:app-1:staging-eu~Staging%20EU');
27
40
  expect(computeBindingKey({
28
41
  organizationId: 'org-1',
29
42
  applicationId: 'app-1',
30
- environment: 'edit',
31
43
  profile: 'staging'
32
- })).toBe('org-1:app-1:edit:staging~staging');
33
- await expect(computeDesiredSpecHash(requirement)).resolves.toBe(await computeDesiredSpecHash({ ...requirement, extensions: ['uuid-ossp', 'pgcrypto'] }));
44
+ })).toBe('org-1:app-1:staging~staging');
45
+ await expect(computeDesiredSpecHash(requirement)).resolves.toBe(await computeDesiredSpecHash({
46
+ ...requirement,
47
+ extensions: ['uuid-ossp', 'pgcrypto']
48
+ }));
34
49
  await expect(computeDesiredSpecHash(requirement)).resolves.toBe('QsCl6RVzJVEwf4Nuk0D27rRtycYe2vQZMxcXLt9WUkQ=');
35
50
  });
36
51
  test('ignores migrationDirectory when hashing the desired spec', async () => {
@@ -42,8 +57,14 @@ describe('database lifecycle contracts', () => {
42
57
  extensions: ['pgcrypto', 'uuid-ossp']
43
58
  };
44
59
  const withoutDirectory = await computeDesiredSpecHash(infrastructureSpec);
45
- const withDirectory = await computeDesiredSpecHash({ ...infrastructureSpec, migrationDirectory: 'db/migrations' });
46
- const withOtherDirectory = await computeDesiredSpecHash({ ...infrastructureSpec, migrationDirectory: 'db/other-migrations' });
60
+ const withDirectory = await computeDesiredSpecHash({
61
+ ...infrastructureSpec,
62
+ migrationDirectory: 'db/migrations'
63
+ });
64
+ const withOtherDirectory = await computeDesiredSpecHash({
65
+ ...infrastructureSpec,
66
+ migrationDirectory: 'db/other-migrations'
67
+ });
47
68
  // migrationDirectory only says where the SQL files live, not what
48
69
  // infrastructure to provision, so changing it must not look like drift.
49
70
  expect(withDirectory).toBe(withoutDirectory);
@@ -62,7 +83,7 @@ describe('database lifecycle contracts', () => {
62
83
  });
63
84
  expect(first).toBe(second);
64
85
  });
65
- test('redacts raw credential material while preserving credential refs', () => {
86
+ test('redacts raw credential material and generic credential refs while preserving physical masterCredentialRef', () => {
66
87
  const redacted = redactLifecycleSecrets({
67
88
  host: 'db.internal',
68
89
  password: 'raw-password',
@@ -79,6 +100,11 @@ describe('database lifecycle contracts', () => {
79
100
  ref: 'database/orders',
80
101
  field: 'password'
81
102
  }
103
+ },
104
+ masterCredentialRef: {
105
+ resolver: 'aws_secrets_manager',
106
+ ref: 'physical-instance/master',
107
+ field: 'password'
82
108
  }
83
109
  });
84
110
  expect(redacted).toEqual({
@@ -92,11 +118,12 @@ describe('database lifecycle contracts', () => {
92
118
  }
93
119
  },
94
120
  credential_refs: {
95
- password: {
96
- resolver: 'vault',
97
- ref: 'database/orders',
98
- field: 'password'
99
- }
121
+ password: '[REDACTED]'
122
+ },
123
+ masterCredentialRef: {
124
+ resolver: 'aws_secrets_manager',
125
+ ref: 'physical-instance/master',
126
+ field: 'password'
100
127
  }
101
128
  });
102
129
  });
@@ -124,117 +151,133 @@ describe('database lifecycle contracts', () => {
124
151
  test('builds a canonical session policy from a valid managed Postgres IAM descriptor', () => {
125
152
  const descriptor = parseNativeDbIamDescriptor({
126
153
  application_id: 'application-id',
127
- auth_descriptor_version: 1,
154
+ auth_descriptor_version: 3,
128
155
  auth_mode: 'aws_iam_role',
129
156
  aws_account_id: '123456789012',
130
157
  binding_id: 'binding-id',
131
158
  cluster_resource_id: 'cluster-ABC123DEF456EXAMPLE',
132
159
  connector_role_arn: 'arn:aws:iam::123456789012:role/superblocks-native-db-connector-prod',
133
- database: 'sbndb_abcdef123456_0123456789abcdef01234567',
160
+ database: 'sbndb_abcdef1234567890_0123456789abcdef01234567',
134
161
  host: 'native-db.cluster-example.us-west-2.rds.amazonaws.com',
135
162
  port: 5432,
136
163
  region: 'us-west-2',
137
- username: 'sbndb_abcdef123456_7bfeae1170db923274f1943f_runtime'
164
+ username: 'sbndb_abcdef1234567890_0123456789abcdef01234567_runtime'
138
165
  });
139
166
  expect(descriptor).toBeDefined();
140
167
  if (!descriptor) {
141
168
  throw new Error('Expected a valid IAM descriptor');
142
169
  }
143
- expect(nativeDbIamSessionPolicy(descriptor)).toBe('{"Version":"2012-10-17","Statement":[{"Sid":"ConnectToThisNativeDatabaseUser","Effect":"Allow","Action":"rds-db:connect","Resource":"arn:aws:rds-db:us-west-2:123456789012:dbuser:cluster-ABC123DEF456EXAMPLE/sbndb_abcdef123456_7bfeae1170db923274f1943f_runtime"}]}');
170
+ expect(nativeDbIamSessionPolicy(descriptor)).toBe('{"Version":"2012-10-17","Statement":[{"Sid":"ConnectToThisNativeDatabaseUser","Effect":"Allow","Action":"rds-db:connect","Resource":"arn:aws:rds-db:us-west-2:123456789012:dbuser:cluster-ABC123DEF456EXAMPLE/sbndb_abcdef1234567890_0123456789abcdef01234567_runtime"}]}');
144
171
  });
145
- test('reads binding-scoped v2 managed Postgres IAM descriptors', () => {
172
+ test('reads managed Postgres IAM descriptors with auth_descriptor_version 3', () => {
146
173
  expect(parseNativeDbIamDescriptor({
147
174
  application_id: 'application-id',
148
- auth_descriptor_version: 2,
175
+ auth_descriptor_version: 3,
149
176
  auth_mode: 'aws_iam_role',
150
177
  aws_account_id: '123456789012',
151
178
  binding_id: 'binding-id',
152
179
  cluster_resource_id: 'cluster-ABC123DEF456EXAMPLE',
153
180
  connector_role_arn: 'arn:aws:iam::123456789012:role/superblocks-native-db-connector-prod',
154
- database: 'sbndb_abcdef123456_0123456789abcdef01234567',
181
+ database: 'sbndb_abcdef1234567890_0123456789abcdef01234567',
155
182
  host: 'native-db.cluster-example.us-west-2.rds.amazonaws.com',
156
183
  port: 5432,
157
184
  region: 'us-west-2',
158
- username: 'sbndb_abcdef123456_0123456789abcdef01234567_runtime'
185
+ username: 'sbndb_abcdef1234567890_0123456789abcdef01234567_runtime'
159
186
  })).toEqual({
160
187
  application_id: 'application-id',
161
- auth_descriptor_version: 2,
188
+ auth_descriptor_version: 3,
162
189
  auth_mode: 'aws_iam_role',
163
190
  aws_account_id: '123456789012',
164
191
  binding_id: 'binding-id',
165
192
  cluster_resource_id: 'cluster-ABC123DEF456EXAMPLE',
166
193
  connector_role_arn: 'arn:aws:iam::123456789012:role/superblocks-native-db-connector-prod',
167
- database: 'sbndb_abcdef123456_0123456789abcdef01234567',
194
+ database: 'sbndb_abcdef1234567890_0123456789abcdef01234567',
168
195
  host: 'native-db.cluster-example.us-west-2.rds.amazonaws.com',
169
196
  port: 5432,
170
197
  region: 'us-west-2',
171
- username: 'sbndb_abcdef123456_0123456789abcdef01234567_runtime'
198
+ username: 'sbndb_abcdef1234567890_0123456789abcdef01234567_runtime'
172
199
  });
173
200
  });
174
- test('rejects v2 descriptors when database and runtime username use different binding tokens', () => {
201
+ test('rejects descriptors when database and runtime username do not match', () => {
175
202
  expect(parseNativeDbIamDescriptor({
176
203
  application_id: 'application-id',
177
- auth_descriptor_version: 2,
204
+ auth_descriptor_version: 3,
178
205
  auth_mode: 'aws_iam_role',
179
206
  aws_account_id: '123456789012',
180
207
  binding_id: 'binding-id',
181
208
  cluster_resource_id: 'cluster-ABC123DEF456EXAMPLE',
182
209
  connector_role_arn: 'arn:aws:iam::123456789012:role/superblocks-native-db-connector-prod',
183
- database: 'sbndb_abcdef123456_0123456789abcdef01234567',
210
+ database: 'sbndb_abcdef1234567890_0123456789abcdef01234567',
184
211
  host: 'native-db.cluster-example.us-west-2.rds.amazonaws.com',
185
212
  port: 5432,
186
213
  region: 'us-west-2',
187
- username: 'sbndb_abcdef123456_fedcba9876543210fedcba98_runtime'
214
+ username: 'sbndb_abcdef1234567890_fedcba9876543210fedcba98_runtime'
188
215
  })).toBeUndefined();
189
216
  });
190
217
  test('rejects malformed or non-commercial managed Postgres IAM descriptors', () => {
191
218
  const descriptor = {
192
219
  application_id: 'application-id',
193
- auth_descriptor_version: 1,
220
+ auth_descriptor_version: 3,
194
221
  auth_mode: 'aws_iam_role',
195
222
  aws_account_id: '123456789012',
196
223
  binding_id: 'binding-id',
197
224
  cluster_resource_id: 'cluster-ABC123DEF456EXAMPLE',
198
225
  connector_role_arn: 'arn:aws:iam::123456789012:role/superblocks-native-db-connector-prod',
199
- database: 'sbndb_abcdef123456_0123456789abcdef01234567',
226
+ database: 'sbndb_abcdef1234567890_0123456789abcdef01234567',
200
227
  host: 'native-db.cluster-example.us-west-2.rds.amazonaws.com',
201
228
  port: 5432,
202
229
  region: 'us-west-2',
203
- username: 'sbndb_abcdef123456_7bfeae1170db923274f1943f_runtime'
230
+ username: 'sbndb_abcdef1234567890_0123456789abcdef01234567_runtime'
204
231
  };
205
- expect(parseNativeDbIamDescriptor({ ...descriptor, auth_descriptor_version: 3 })).toBeUndefined();
206
- expect(parseNativeDbIamDescriptor({ ...descriptor, cluster_resource_id: 'not-an-rds-resource' })).toBeUndefined();
207
- expect(parseNativeDbIamDescriptor({ ...descriptor, connector_role_arn: 'arn:aws:iam::210987654321:role/other' })).toBeUndefined();
232
+ expect(parseNativeDbIamDescriptor({ ...descriptor, auth_descriptor_version: 1 })).toBeUndefined();
233
+ expect(parseNativeDbIamDescriptor({ ...descriptor, auth_descriptor_version: 2 })).toBeUndefined();
234
+ expect(parseNativeDbIamDescriptor({
235
+ ...descriptor,
236
+ cluster_resource_id: 'not-an-rds-resource'
237
+ })).toBeUndefined();
238
+ expect(parseNativeDbIamDescriptor({
239
+ ...descriptor,
240
+ connector_role_arn: 'arn:aws:iam::210987654321:role/other'
241
+ })).toBeUndefined();
208
242
  expect(parseNativeDbIamDescriptor({ ...descriptor, database: 'orders' })).toBeUndefined();
209
- expect(parseNativeDbIamDescriptor({ ...descriptor, host: descriptor.host.toUpperCase() })).toBeUndefined();
210
- expect(parseNativeDbIamDescriptor({ ...descriptor, host: 'native-db.cluster-example.us-east-1.rds.amazonaws.com' })).toBeUndefined();
243
+ expect(parseNativeDbIamDescriptor({
244
+ ...descriptor,
245
+ host: descriptor.host.toUpperCase()
246
+ })).toBeUndefined();
247
+ expect(parseNativeDbIamDescriptor({
248
+ ...descriptor,
249
+ host: 'native-db.cluster-example.us-east-1.rds.amazonaws.com'
250
+ })).toBeUndefined();
211
251
  expect(parseNativeDbIamDescriptor({ ...descriptor, port: 0 })).toBeUndefined();
212
252
  expect(parseNativeDbIamDescriptor({ ...descriptor, region: 'cn-north-1' })).toBeUndefined();
213
253
  expect(parseNativeDbIamDescriptor({ ...descriptor, region: 'us-gov-west-1' })).toBeUndefined();
214
- expect(parseNativeDbIamDescriptor({ ...descriptor, username: 'sbndb_000000000000_7bfeae1170db923274f1943f_runtime' })).toBeUndefined();
254
+ expect(parseNativeDbIamDescriptor({
255
+ ...descriptor,
256
+ username: 'sbndb_0000000000000000_7bfeae1170db923274f1943f_runtime'
257
+ })).toBeUndefined();
215
258
  });
216
259
  test('accepts standalone RDS IAM resource IDs', () => {
217
260
  expect(parseNativeDbIamDescriptor({
218
261
  application_id: 'application-id',
219
- auth_descriptor_version: 1,
262
+ auth_descriptor_version: 3,
220
263
  auth_mode: 'aws_iam_role',
221
264
  aws_account_id: '123456789012',
222
265
  binding_id: 'binding-id',
223
266
  cluster_resource_id: 'db-ABCDEF0123456789-1',
224
267
  connector_role_arn: 'arn:aws:iam::123456789012:role/superblocks-native-db-connector-prod',
225
- database: 'sbndb_abcdef123456_0123456789abcdef01234567',
268
+ database: 'sbndb_abcdef1234567890_0123456789abcdef01234567',
226
269
  host: 'native-db.example.us-west-2.rds.amazonaws.com',
227
270
  port: 5432,
228
271
  region: 'us-west-2',
229
- username: 'sbndb_abcdef123456_7bfeae1170db923274f1943f_runtime'
272
+ username: 'sbndb_abcdef1234567890_0123456789abcdef01234567_runtime'
230
273
  })).toBeDefined();
231
274
  });
232
- test('derives canonical IAM database and runtime-user identity tokens', async () => {
275
+ test('derives canonical IAM application token', async () => {
233
276
  await expect(computeNativeDbApplicationToken('application-id')).resolves.toBe('7bfeae1170db923274f1943f');
234
- await expect(computeNativeDbDatabaseName('abcdef123456', 'database-id')).resolves.toBe('sbndb_abcdef123456_dad72612f7a80580b028178f');
235
277
  });
236
- test('derives a stable binding identity token for v2 database and runtime-user names', async () => {
237
- await expect(computeNativeDbBindingToken('binding-id')).resolves.toBe('927968fc37b7b41be7e14cf9');
278
+ test('derives canonical IAM profile token', async () => {
279
+ await expect(computeNativeDbProfileToken('production')).resolves.toHaveLength(16);
280
+ await expect(computeNativeDbProfileToken('Production')).resolves.toBe(await computeNativeDbProfileToken('production'));
238
281
  });
239
282
  });
240
283
  //# sourceMappingURL=index.test.js.map
@@ -1 +1 @@
1
- {"version":3,"file":"index.test.js","sourceRoot":"","sources":["../../src/database-lifecycle/index.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAEhD,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,+BAA+B,EAC/B,2BAA2B,EAC3B,2BAA2B,EAC3B,qBAAqB,EACrB,0BAA0B,EAC1B,WAAW,EACX,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC1B,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,IAAI,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,WAAW,GAAG;YAClB,WAAW,EAAE,WAAW;YACxB,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE;gBACN,SAAS,EAAE,EAAE;gBACb,IAAI,EAAE,QAAQ;aACf;YACD,UAAU,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC;SAC7B,CAAC;QAEX,MAAM,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAClF,MAAM,CAAC,qBAAqB,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QACvH,MAAM,CAAC,qBAAqB,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QACrH,qEAAqE;QACrE,2EAA2E;QAC3E,gEAAgE;QAChE,MAAM,CACJ,iBAAiB,CAAC;YAChB,cAAc,EAAE,OAAO;YACvB,aAAa,EAAE,OAAO;YACtB,WAAW,EAAE,MAAM;YACnB,OAAO,EAAE,YAAY;SACtB,CAAC,CACH,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QACnD,MAAM,CACJ,iBAAiB,CAAC;YAChB,cAAc,EAAE,OAAO;YACvB,aAAa,EAAE,OAAO;YACtB,WAAW,EAAE,MAAM;YACnB,OAAO,EAAE,SAAS;SACnB,CAAC,CACH,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QAE3C,MAAM,MAAM,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAC7D,MAAM,sBAAsB,CAAC,EAAE,GAAG,WAAW,EAAE,UAAU,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC,CACxF,CAAC;QACF,MAAM,MAAM,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAClH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,kBAAkB,GAAG;YACzB,WAAW,EAAE,WAAW;YACxB,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzC,UAAU,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC;SAC7B,CAAC;QAEX,MAAM,gBAAgB,GAAG,MAAM,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;QAC1E,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC,EAAE,GAAG,kBAAkB,EAAE,kBAAkB,EAAE,eAAe,EAAE,CAAC,CAAC;QACnH,MAAM,kBAAkB,GAAG,MAAM,sBAAsB,CAAC,EAAE,GAAG,kBAAkB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAE9H,kEAAkE;QAClE,wEAAwE;QACxE,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC7C,MAAM,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC;YACzC,WAAW,EAAE,WAAW;YACxB,MAAM,EAAE,UAAU;YAClB,UAAU,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;SAC5B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;YAC1C,WAAW,EAAE,WAAW;YACxB,MAAM,EAAE,UAAU;YAClB,UAAU,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;SAC5B,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC5E,MAAM,QAAQ,GAAG,sBAAsB,CAAC;YACtC,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,cAAc;YACxB,MAAM,EAAE;gBACN,KAAK,EAAE,WAAW;gBAClB,aAAa,EAAE;oBACb,QAAQ,EAAE,qBAAqB;oBAC/B,GAAG,EAAE,oDAAoD;iBAC1D;aACF;YACD,eAAe,EAAE;gBACf,QAAQ,EAAE;oBACR,QAAQ,EAAE,OAAO;oBACjB,GAAG,EAAE,iBAAiB;oBACtB,KAAK,EAAE,UAAU;iBAClB;aACF;SACF,CAAC,CAAC;QAEH,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;YACvB,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE;gBACN,KAAK,EAAE,YAAY;gBACnB,aAAa,EAAE;oBACb,QAAQ,EAAE,qBAAqB;oBAC/B,GAAG,EAAE,oDAAoD;iBAC1D;aACF;YACD,eAAe,EAAE;gBACf,QAAQ,EAAE;oBACR,QAAQ,EAAE,OAAO;oBACjB,GAAG,EAAE,iBAAiB;oBACtB,KAAK,EAAE,UAAU;iBAClB;aACF;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,CAAC,wBAAwB,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,0BAA0B,EAAE,GAAG,EAAE;QACpC,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC;YAC7F,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;YAC3D,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,0BAA0B,CAAC,8CAA8C,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9F,MAAM,CAAC,0BAA0B,CAAC,kDAAkD,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClG,MAAM,CAAC,0BAA0B,CAAC,mCAAmC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnF,MAAM,CAAC,0BAA0B,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxE,MAAM,CAAC,0BAA0B,CAAC,4BAA4B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7E,MAAM,CAAC,0BAA0B,CAAC,oDAAoD,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,gFAAgF,EAAE,GAAG,EAAE;QAC1F,MAAM,UAAU,GAAG,0BAA0B,CAAC;YAC5C,cAAc,EAAE,gBAAgB;YAChC,uBAAuB,EAAE,CAAC;YAC1B,SAAS,EAAE,cAAc;YACzB,cAAc,EAAE,cAAc;YAC9B,UAAU,EAAE,YAAY;YACxB,mBAAmB,EAAE,6BAA6B;YAClD,kBAAkB,EAAE,qEAAqE;YACzF,QAAQ,EAAE,6CAA6C;YACvD,IAAI,EAAE,uDAAuD;YAC7D,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,qDAAqD;SAChE,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAC/C,uQAAuQ,CACxQ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,0DAA0D,EAAE,GAAG,EAAE;QACpE,MAAM,CACJ,0BAA0B,CAAC;YACzB,cAAc,EAAE,gBAAgB;YAChC,uBAAuB,EAAE,CAAC;YAC1B,SAAS,EAAE,cAAc;YACzB,cAAc,EAAE,cAAc;YAC9B,UAAU,EAAE,YAAY;YACxB,mBAAmB,EAAE,6BAA6B;YAClD,kBAAkB,EAAE,qEAAqE;YACzF,QAAQ,EAAE,6CAA6C;YACvD,IAAI,EAAE,uDAAuD;YAC7D,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,qDAAqD;SAChE,CAAC,CACH,CAAC,OAAO,CAAC;YACR,cAAc,EAAE,gBAAgB;YAChC,uBAAuB,EAAE,CAAC;YAC1B,SAAS,EAAE,cAAc;YACzB,cAAc,EAAE,cAAc;YAC9B,UAAU,EAAE,YAAY;YACxB,mBAAmB,EAAE,6BAA6B;YAClD,kBAAkB,EAAE,qEAAqE;YACzF,QAAQ,EAAE,6CAA6C;YACvD,IAAI,EAAE,uDAAuD;YAC7D,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,qDAAqD;SAChE,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,wFAAwF,EAAE,GAAG,EAAE;QAClG,MAAM,CACJ,0BAA0B,CAAC;YACzB,cAAc,EAAE,gBAAgB;YAChC,uBAAuB,EAAE,CAAC;YAC1B,SAAS,EAAE,cAAc;YACzB,cAAc,EAAE,cAAc;YAC9B,UAAU,EAAE,YAAY;YACxB,mBAAmB,EAAE,6BAA6B;YAClD,kBAAkB,EAAE,qEAAqE;YACzF,QAAQ,EAAE,6CAA6C;YACvD,IAAI,EAAE,uDAAuD;YAC7D,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,qDAAqD;SAChE,CAAC,CACH,CAAC,aAAa,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAChF,MAAM,UAAU,GAAG;YACjB,cAAc,EAAE,gBAAgB;YAChC,uBAAuB,EAAE,CAAC;YAC1B,SAAS,EAAE,cAAc;YACzB,cAAc,EAAE,cAAc;YAC9B,UAAU,EAAE,YAAY;YACxB,mBAAmB,EAAE,6BAA6B;YAClD,kBAAkB,EAAE,qEAAqE;YACzF,QAAQ,EAAE,6CAA6C;YACvD,IAAI,EAAE,uDAAuD;YAC7D,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,qDAAqD;SAChE,CAAC;QAEF,MAAM,CAAC,0BAA0B,CAAC,EAAE,GAAG,UAAU,EAAE,uBAAuB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAClG,MAAM,CAAC,0BAA0B,CAAC,EAAE,GAAG,UAAU,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAClH,MAAM,CAAC,0BAA0B,CAAC,EAAE,GAAG,UAAU,EAAE,kBAAkB,EAAE,sCAAsC,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAClI,MAAM,CAAC,0BAA0B,CAAC,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC1F,MAAM,CAAC,0BAA0B,CAAC,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC3G,MAAM,CAAC,0BAA0B,CAAC,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,uDAAuD,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACrI,MAAM,CAAC,0BAA0B,CAAC,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC/E,MAAM,CAAC,0BAA0B,CAAC,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC5F,MAAM,CAAC,0BAA0B,CAAC,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC/F,MAAM,CAAC,0BAA0B,CAAC,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,qDAAqD,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACzI,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACnD,MAAM,CACJ,0BAA0B,CAAC;YACzB,cAAc,EAAE,gBAAgB;YAChC,uBAAuB,EAAE,CAAC;YAC1B,SAAS,EAAE,cAAc;YACzB,cAAc,EAAE,cAAc;YAC9B,UAAU,EAAE,YAAY;YACxB,mBAAmB,EAAE,uBAAuB;YAC5C,kBAAkB,EAAE,qEAAqE;YACzF,QAAQ,EAAE,6CAA6C;YACvD,IAAI,EAAE,+CAA+C;YACrD,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,qDAAqD;SAChE,CAAC,CACH,CAAC,WAAW,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,MAAM,CAAC,+BAA+B,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC1G,MAAM,MAAM,CAAC,2BAA2B,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IACxI,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAChG,MAAM,MAAM,CAAC,2BAA2B,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACpG,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
1
+ {"version":3,"file":"index.test.js","sourceRoot":"","sources":["../../src/database-lifecycle/index.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAEhD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EACL,6BAA6B,EAC7B,oBAAoB,EACpB,iBAAiB,EACjB,sBAAsB,EACtB,+BAA+B,EAC/B,2BAA2B,EAC3B,qBAAqB,EACrB,0BAA0B,EAC1B,iDAAiD,EACjD,WAAW,EACX,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC1B,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,wBAAwB;IACxB,IAAI,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mCAAmC,CAAC,CAAC,CAAC;IACtI,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,gEAAgE,EAAE,GAAG,EAAE;QAC1E,MAAM,CAAC,iDAAiD,CAAC,cAAc,CAAC,EAAE,EAAE,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvH,MAAM,CAAC,iDAAiD,CAAC,cAAc,CAAC,QAAQ,EAAE,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9H,MAAM,CAAC,iDAAiD,CAAC,cAAc,CAAC,QAAQ,EAAE,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9H,MAAM,CAAC,iDAAiD,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtG,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,WAAW,GAAG;YAClB,WAAW,EAAE,WAAW;YACxB,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE;gBACN,SAAS,EAAE,EAAE;gBACb,IAAI,EAAE,QAAQ;aACf;YACD,UAAU,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC;SAC7B,CAAC;QAEX,MAAM,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAClF,MAAM,CAAC,qBAAqB,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QACvH,MAAM,CAAC,qBAAqB,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QACrH,qEAAqE;QACrE,0EAA0E;QAC1E,oDAAoD;QACpD,MAAM,CACJ,iBAAiB,CAAC;YAChB,cAAc,EAAE,OAAO;YACvB,aAAa,EAAE,OAAO;YACtB,OAAO,EAAE,YAAY;SACtB,CAAC,CACH,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QAC9C,MAAM,CACJ,iBAAiB,CAAC;YAChB,cAAc,EAAE,OAAO;YACvB,aAAa,EAAE,OAAO;YACtB,OAAO,EAAE,SAAS;SACnB,CAAC,CACH,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAEtC,MAAM,MAAM,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAC7D,MAAM,sBAAsB,CAAC;YAC3B,GAAG,WAAW;YACd,UAAU,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC;SACtC,CAAC,CACH,CAAC;QACF,MAAM,MAAM,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAClH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,kBAAkB,GAAG;YACzB,WAAW,EAAE,WAAW;YACxB,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzC,UAAU,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC;SAC7B,CAAC;QAEX,MAAM,gBAAgB,GAAG,MAAM,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;QAC1E,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC;YACjD,GAAG,kBAAkB;YACrB,kBAAkB,EAAE,eAAe;SACpC,CAAC,CAAC;QACH,MAAM,kBAAkB,GAAG,MAAM,sBAAsB,CAAC;YACtD,GAAG,kBAAkB;YACrB,kBAAkB,EAAE,qBAAqB;SAC1C,CAAC,CAAC;QAEH,kEAAkE;QAClE,wEAAwE;QACxE,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC7C,MAAM,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC;YACzC,WAAW,EAAE,WAAW;YACxB,MAAM,EAAE,UAAU;YAClB,UAAU,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;SAC5B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;YAC1C,WAAW,EAAE,WAAW;YACxB,MAAM,EAAE,UAAU;YAClB,UAAU,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;SAC5B,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,2GAA2G,EAAE,GAAG,EAAE;QACrH,MAAM,QAAQ,GAAG,sBAAsB,CAAC;YACtC,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,cAAc;YACxB,MAAM,EAAE;gBACN,KAAK,EAAE,WAAW;gBAClB,aAAa,EAAE;oBACb,QAAQ,EAAE,qBAAqB;oBAC/B,GAAG,EAAE,oDAAoD;iBAC1D;aACF;YACD,eAAe,EAAE;gBACf,QAAQ,EAAE;oBACR,QAAQ,EAAE,OAAO;oBACjB,GAAG,EAAE,iBAAiB;oBACtB,KAAK,EAAE,UAAU;iBAClB;aACF;YACD,mBAAmB,EAAE;gBACnB,QAAQ,EAAE,qBAAqB;gBAC/B,GAAG,EAAE,0BAA0B;gBAC/B,KAAK,EAAE,UAAU;aAClB;SACF,CAAC,CAAC;QAEH,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;YACvB,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE;gBACN,KAAK,EAAE,YAAY;gBACnB,aAAa,EAAE;oBACb,QAAQ,EAAE,qBAAqB;oBAC/B,GAAG,EAAE,oDAAoD;iBAC1D;aACF;YACD,eAAe,EAAE;gBACf,QAAQ,EAAE,YAAY;aACvB;YACD,mBAAmB,EAAE;gBACnB,QAAQ,EAAE,qBAAqB;gBAC/B,GAAG,EAAE,0BAA0B;gBAC/B,KAAK,EAAE,UAAU;aAClB;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,CAAC,wBAAwB,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,0BAA0B,EAAE,GAAG,EAAE;QACpC,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC;YAC7F,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;YAC3D,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,0BAA0B,CAAC,8CAA8C,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9F,MAAM,CAAC,0BAA0B,CAAC,kDAAkD,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClG,MAAM,CAAC,0BAA0B,CAAC,mCAAmC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnF,MAAM,CAAC,0BAA0B,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxE,MAAM,CAAC,0BAA0B,CAAC,4BAA4B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7E,MAAM,CAAC,0BAA0B,CAAC,oDAAoD,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,gFAAgF,EAAE,GAAG,EAAE;QAC1F,MAAM,UAAU,GAAG,0BAA0B,CAAC;YAC5C,cAAc,EAAE,gBAAgB;YAChC,uBAAuB,EAAE,CAAC;YAC1B,SAAS,EAAE,cAAc;YACzB,cAAc,EAAE,cAAc;YAC9B,UAAU,EAAE,YAAY;YACxB,mBAAmB,EAAE,6BAA6B;YAClD,kBAAkB,EAAE,qEAAqE;YACzF,QAAQ,EAAE,iDAAiD;YAC3D,IAAI,EAAE,uDAAuD;YAC7D,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,yDAAyD;SACpE,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAC/C,2QAA2Q,CAC5Q,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,uEAAuE,EAAE,GAAG,EAAE;QACjF,MAAM,CACJ,0BAA0B,CAAC;YACzB,cAAc,EAAE,gBAAgB;YAChC,uBAAuB,EAAE,CAAC;YAC1B,SAAS,EAAE,cAAc;YACzB,cAAc,EAAE,cAAc;YAC9B,UAAU,EAAE,YAAY;YACxB,mBAAmB,EAAE,6BAA6B;YAClD,kBAAkB,EAAE,qEAAqE;YACzF,QAAQ,EAAE,iDAAiD;YAC3D,IAAI,EAAE,uDAAuD;YAC7D,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,yDAAyD;SACpE,CAAC,CACH,CAAC,OAAO,CAAC;YACR,cAAc,EAAE,gBAAgB;YAChC,uBAAuB,EAAE,CAAC;YAC1B,SAAS,EAAE,cAAc;YACzB,cAAc,EAAE,cAAc;YAC9B,UAAU,EAAE,YAAY;YACxB,mBAAmB,EAAE,6BAA6B;YAClD,kBAAkB,EAAE,qEAAqE;YACzF,QAAQ,EAAE,iDAAiD;YAC3D,IAAI,EAAE,uDAAuD;YAC7D,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,yDAAyD;SACpE,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC/E,MAAM,CACJ,0BAA0B,CAAC;YACzB,cAAc,EAAE,gBAAgB;YAChC,uBAAuB,EAAE,CAAC;YAC1B,SAAS,EAAE,cAAc;YACzB,cAAc,EAAE,cAAc;YAC9B,UAAU,EAAE,YAAY;YACxB,mBAAmB,EAAE,6BAA6B;YAClD,kBAAkB,EAAE,qEAAqE;YACzF,QAAQ,EAAE,iDAAiD;YAC3D,IAAI,EAAE,uDAAuD;YAC7D,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,yDAAyD;SACpE,CAAC,CACH,CAAC,aAAa,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAChF,MAAM,UAAU,GAAG;YACjB,cAAc,EAAE,gBAAgB;YAChC,uBAAuB,EAAE,CAAC;YAC1B,SAAS,EAAE,cAAc;YACzB,cAAc,EAAE,cAAc;YAC9B,UAAU,EAAE,YAAY;YACxB,mBAAmB,EAAE,6BAA6B;YAClD,kBAAkB,EAAE,qEAAqE;YACzF,QAAQ,EAAE,iDAAiD;YAC3D,IAAI,EAAE,uDAAuD;YAC7D,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,yDAAyD;SACpE,CAAC;QAEF,MAAM,CAAC,0BAA0B,CAAC,EAAE,GAAG,UAAU,EAAE,uBAAuB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAClG,MAAM,CAAC,0BAA0B,CAAC,EAAE,GAAG,UAAU,EAAE,uBAAuB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAClG,MAAM,CACJ,0BAA0B,CAAC;YACzB,GAAG,UAAU;YACb,mBAAmB,EAAE,qBAAqB;SAC3C,CAAC,CACH,CAAC,aAAa,EAAE,CAAC;QAClB,MAAM,CACJ,0BAA0B,CAAC;YACzB,GAAG,UAAU;YACb,kBAAkB,EAAE,sCAAsC;SAC3D,CAAC,CACH,CAAC,aAAa,EAAE,CAAC;QAClB,MAAM,CAAC,0BAA0B,CAAC,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC1F,MAAM,CACJ,0BAA0B,CAAC;YACzB,GAAG,UAAU;YACb,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE;SACpC,CAAC,CACH,CAAC,aAAa,EAAE,CAAC;QAClB,MAAM,CACJ,0BAA0B,CAAC;YACzB,GAAG,UAAU;YACb,IAAI,EAAE,uDAAuD;SAC9D,CAAC,CACH,CAAC,aAAa,EAAE,CAAC;QAClB,MAAM,CAAC,0BAA0B,CAAC,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC/E,MAAM,CAAC,0BAA0B,CAAC,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC5F,MAAM,CAAC,0BAA0B,CAAC,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC/F,MAAM,CACJ,0BAA0B,CAAC;YACzB,GAAG,UAAU;YACb,QAAQ,EAAE,yDAAyD;SACpE,CAAC,CACH,CAAC,aAAa,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACnD,MAAM,CACJ,0BAA0B,CAAC;YACzB,cAAc,EAAE,gBAAgB;YAChC,uBAAuB,EAAE,CAAC;YAC1B,SAAS,EAAE,cAAc;YACzB,cAAc,EAAE,cAAc;YAC9B,UAAU,EAAE,YAAY;YACxB,mBAAmB,EAAE,uBAAuB;YAC5C,kBAAkB,EAAE,qEAAqE;YACzF,QAAQ,EAAE,iDAAiD;YAC3D,IAAI,EAAE,+CAA+C;YACrD,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,yDAAyD;SACpE,CAAC,CACH,CAAC,WAAW,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,MAAM,CAAC,+BAA+B,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC5G,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,MAAM,CAAC,2BAA2B,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAClF,MAAM,MAAM,CAAC,2BAA2B,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,2BAA2B,CAAC,YAAY,CAAC,CAAC,CAAC;IACzH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
@@ -0,0 +1,29 @@
1
+ import type { PhysicalDatabaseCapacityPolicy } from './capacityPolicy.js';
2
+ /**
3
+ * Agent tag key for the customer-managed deployment name that identifies a
4
+ * worker's physical database pool, `(organizationId, agentName, engine)`.
5
+ *
6
+ * Published on its own rather than read out of
7
+ * `databaseLifecycle:capacityPolicies`, so a customer who wants no proactive
8
+ * scaling still gets a resolvable pool. One value, e.g. `customer-opa`.
9
+ */
10
+ export declare const DATABASE_LIFECYCLE_TAG_AGENT_NAME = "databaseLifecycle:agentName";
11
+ export declare class PhysicalPoolIdentityError extends Error {
12
+ readonly code = "physical_pool_identity_invalid";
13
+ constructor(message: string);
14
+ }
15
+ /**
16
+ * The single physical pool a worker's registration names, or undefined when it
17
+ * published none.
18
+ *
19
+ * Throws {@link PhysicalPoolIdentityError} when the registration names more
20
+ * than one pool. Guessing between them would provision infrastructure under
21
+ * one deployment's Terraform state and hand it to another, so callers must
22
+ * either refuse the registration or withhold the identity.
23
+ *
24
+ * Falls back to the capacity policy's name when the tag is absent, for a
25
+ * worker predating {@link DATABASE_LIFECYCLE_TAG_AGENT_NAME} that is still
26
+ * rolling: the policy names the same pool, so identity stays unambiguous.
27
+ */
28
+ export declare function parsePhysicalPoolAgentNameTag(published: string[] | undefined, capacityPolicies?: readonly PhysicalDatabaseCapacityPolicy[]): string | undefined;
29
+ //# sourceMappingURL=physicalPoolIdentity.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"physicalPoolIdentity.d.ts","sourceRoot":"","sources":["../../src/database-lifecycle/physicalPoolIdentity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,iCAAiC,gCAAgC,CAAC;AAE/E,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,IAAI,oCAAoC;gBAErC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS,EAC/B,gBAAgB,GAAE,SAAS,8BAA8B,EAAO,GAC/D,MAAM,GAAG,SAAS,CAqCpB"}
@@ -0,0 +1,59 @@
1
+ /**
2
+ * Agent tag key for the customer-managed deployment name that identifies a
3
+ * worker's physical database pool, `(organizationId, agentName, engine)`.
4
+ *
5
+ * Published on its own rather than read out of
6
+ * `databaseLifecycle:capacityPolicies`, so a customer who wants no proactive
7
+ * scaling still gets a resolvable pool. One value, e.g. `customer-opa`.
8
+ */
9
+ export const DATABASE_LIFECYCLE_TAG_AGENT_NAME = 'databaseLifecycle:agentName';
10
+ export class PhysicalPoolIdentityError extends Error {
11
+ code = 'physical_pool_identity_invalid';
12
+ constructor(message) {
13
+ super(message);
14
+ this.name = 'PhysicalPoolIdentityError';
15
+ }
16
+ }
17
+ /**
18
+ * The single physical pool a worker's registration names, or undefined when it
19
+ * published none.
20
+ *
21
+ * Throws {@link PhysicalPoolIdentityError} when the registration names more
22
+ * than one pool. Guessing between them would provision infrastructure under
23
+ * one deployment's Terraform state and hand it to another, so callers must
24
+ * either refuse the registration or withhold the identity.
25
+ *
26
+ * Falls back to the capacity policy's name when the tag is absent, for a
27
+ * worker predating {@link DATABASE_LIFECYCLE_TAG_AGENT_NAME} that is still
28
+ * rolling: the policy names the same pool, so identity stays unambiguous.
29
+ */
30
+ export function parsePhysicalPoolAgentNameTag(published, capacityPolicies = []) {
31
+ if (published !== undefined && !Array.isArray(published)) {
32
+ throw new PhysicalPoolIdentityError(`${DATABASE_LIFECYCLE_TAG_AGENT_NAME} must be an array holding one deployment name.`);
33
+ }
34
+ const values = published ?? [];
35
+ if (values.some((value) => typeof value !== 'string' || value.trim() === '')) {
36
+ throw new PhysicalPoolIdentityError(`${DATABASE_LIFECYCLE_TAG_AGENT_NAME} must be a non-empty string when provided.`);
37
+ }
38
+ const declared = new Set(values.map((value) => value.trim()));
39
+ if (declared.size > 1) {
40
+ throw new PhysicalPoolIdentityError(`${DATABASE_LIFECYCLE_TAG_AGENT_NAME} names ${declared.size} pools (${[...declared].sort().join(', ')}); it must name exactly one.`);
41
+ }
42
+ const policyNames = new Set(capacityPolicies.map((policy) => policy.agentName));
43
+ const [declaredName] = declared;
44
+ if (declaredName !== undefined) {
45
+ // Every policy has to be for the pool this deployment owns. A policy for
46
+ // another pool would have proactive evaluation scaling something the
47
+ // deployment cannot provision into.
48
+ if ([...policyNames].some((policyName) => policyName !== declaredName)) {
49
+ throw new PhysicalPoolIdentityError(`${DATABASE_LIFECYCLE_TAG_AGENT_NAME} is ${declaredName} but databaseLifecycle:capacityPolicies names ${[...policyNames].sort().join(', ')}; they must name the same pool.`);
50
+ }
51
+ return declaredName;
52
+ }
53
+ if (policyNames.size > 1) {
54
+ throw new PhysicalPoolIdentityError(`databaseLifecycle:capacityPolicies names ${policyNames.size} pools; publish ${DATABASE_LIFECYCLE_TAG_AGENT_NAME} to say which one this deployment owns.`);
55
+ }
56
+ const [policyName] = policyNames;
57
+ return policyName;
58
+ }
59
+ //# sourceMappingURL=physicalPoolIdentity.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"physicalPoolIdentity.js","sourceRoot":"","sources":["../../src/database-lifecycle/physicalPoolIdentity.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,6BAA6B,CAAC;AAE/E,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,IAAI,GAAG,gCAAgC,CAAC;IAEjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,6BAA6B,CAC3C,SAA+B,EAC/B,mBAA8D,EAAE;IAEhE,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,yBAAyB,CAAC,GAAG,iCAAiC,gDAAgD,CAAC,CAAC;IAC5H,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,IAAI,EAAE,CAAC;IAC/B,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,yBAAyB,CAAC,GAAG,iCAAiC,4CAA4C,CAAC,CAAC;IACxH,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9D,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,yBAAyB,CACjC,GAAG,iCAAiC,UAAU,QAAQ,CAAC,IAAI,WAAW,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B,CACpI,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAChF,MAAM,CAAC,YAAY,CAAC,GAAG,QAAQ,CAAC;IAChC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,yEAAyE;QACzE,qEAAqE;QACrE,oCAAoC;QACpC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,KAAK,YAAY,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,yBAAyB,CACjC,GAAG,iCAAiC,OAAO,YAAY,iDAAiD,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC,CAC5K,CAAC;QACJ,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,IAAI,WAAW,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,yBAAyB,CACjC,4CAA4C,WAAW,CAAC,IAAI,mBAAmB,iCAAiC,yCAAyC,CAC1J,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,UAAU,CAAC,GAAG,WAAW,CAAC;IACjC,OAAO,UAAU,CAAC;AACpB,CAAC"}
@@ -0,0 +1,2 @@
1
+ export {};
2
+ //# sourceMappingURL=physicalPoolIdentity.test.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"physicalPoolIdentity.test.d.ts","sourceRoot":"","sources":["../../src/database-lifecycle/physicalPoolIdentity.test.ts"],"names":[],"mappings":""}
@@ -0,0 +1,49 @@
1
+ import { describe, expect, test } from 'vitest';
2
+ import { PhysicalPoolIdentityError, parsePhysicalPoolAgentNameTag } from './physicalPoolIdentity.js';
3
+ const policy = (agentName) => ({
4
+ agentName,
5
+ engine: 'postgres',
6
+ thresholdType: 'minAvailableCapacityPercent',
7
+ thresholdValue: 20
8
+ });
9
+ describe('parsePhysicalPoolAgentNameTag', () => {
10
+ test('reads the pool a deployment named', () => {
11
+ expect(parsePhysicalPoolAgentNameTag(['customer-opa'])).toBe('customer-opa');
12
+ expect(parsePhysicalPoolAgentNameTag([' customer-opa '])).toBe('customer-opa');
13
+ });
14
+ test('reports no identity for a deployment that named no pool', () => {
15
+ expect(parsePhysicalPoolAgentNameTag(undefined)).toBeUndefined();
16
+ expect(parsePhysicalPoolAgentNameTag([])).toBeUndefined();
17
+ });
18
+ test('rejects a tag that is not one non-empty name', () => {
19
+ expect(() => parsePhysicalPoolAgentNameTag([''])).toThrow(PhysicalPoolIdentityError);
20
+ expect(() => parsePhysicalPoolAgentNameTag([' '])).toThrow(PhysicalPoolIdentityError);
21
+ expect(() => parsePhysicalPoolAgentNameTag(['customer-opa', 'other-opa'])).toThrow(/must name exactly one/);
22
+ });
23
+ // Replicas of one deployment publish the same registration.
24
+ test('accepts a name repeated across replicas', () => {
25
+ expect(parsePhysicalPoolAgentNameTag(['customer-opa', 'customer-opa'])).toBe('customer-opa');
26
+ });
27
+ describe('agreement with capacity policies', () => {
28
+ test('accepts a policy for the pool the deployment named', () => {
29
+ expect(parsePhysicalPoolAgentNameTag(['customer-opa'], [policy('customer-opa')])).toBe('customer-opa');
30
+ });
31
+ test('rejects a policy for a pool the deployment does not own', () => {
32
+ expect(() => parsePhysicalPoolAgentNameTag(['customer-opa'], [policy('other-opa')])).toThrow(/must name the same pool/);
33
+ });
34
+ // A deployment scales the pool it owns and nothing else. Accepting a
35
+ // foreign policy alongside a matching one would let proactive evaluation
36
+ // key off a pool the wizard would never resolve to.
37
+ test('rejects a foreign policy published alongside the deployments own', () => {
38
+ expect(() => parsePhysicalPoolAgentNameTag(['customer-opa'], [policy('customer-opa'), policy('other-opa')])).toThrow(/must name the same pool/);
39
+ });
40
+ // Older workers publish identity only inside the policy.
41
+ test('falls back to the policy name when the deployment published no tag', () => {
42
+ expect(parsePhysicalPoolAgentNameTag(undefined, [policy('customer-opa')])).toBe('customer-opa');
43
+ });
44
+ test('refuses to guess when policies alone name two pools', () => {
45
+ expect(() => parsePhysicalPoolAgentNameTag(undefined, [policy('customer-opa'), policy('other-opa')])).toThrow(/publish databaseLifecycle:agentName/);
46
+ });
47
+ });
48
+ });
49
+ //# sourceMappingURL=physicalPoolIdentity.test.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"physicalPoolIdentity.test.js","sourceRoot":"","sources":["../../src/database-lifecycle/physicalPoolIdentity.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAGhD,OAAO,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAErG,MAAM,MAAM,GAAG,CAAC,SAAiB,EAAkC,EAAE,CAAC,CAAC;IACrE,SAAS;IACT,MAAM,EAAE,UAAU;IAClB,aAAa,EAAE,6BAA6B;IAC5C,cAAc,EAAE,EAAE;CACnB,CAAC,CAAC;AAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,IAAI,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,6BAA6B,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC7E,MAAM,CAAC,6BAA6B,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,6BAA6B,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACjE,MAAM,CAAC,6BAA6B,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,GAAG,EAAE,CAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;QACrF,MAAM,CAAC,GAAG,EAAE,CAAC,6BAA6B,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;QACxF,MAAM,CAAC,GAAG,EAAE,CAAC,6BAA6B,CAAC,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC9G,CAAC,CAAC,CAAC;IAEH,4DAA4D;IAC5D,IAAI,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,6BAA6B,CAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAChD,IAAI,CAAC,oDAAoD,EAAE,GAAG,EAAE;YAC9D,MAAM,CAAC,6BAA6B,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACzG,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,yDAAyD,EAAE,GAAG,EAAE;YACnE,MAAM,CAAC,GAAG,EAAE,CAAC,6BAA6B,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;QAC1H,CAAC,CAAC,CAAC;QAEH,qEAAqE;QACrE,yEAAyE;QACzE,oDAAoD;QACpD,IAAI,CAAC,kEAAkE,EAAE,GAAG,EAAE;YAC5E,MAAM,CAAC,GAAG,EAAE,CAAC,6BAA6B,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAClH,yBAAyB,CAC1B,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,yDAAyD;QACzD,IAAI,CAAC,oEAAoE,EAAE,GAAG,EAAE;YAC9E,MAAM,CAAC,6BAA6B,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAClG,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,qDAAqD,EAAE,GAAG,EAAE;YAC/D,MAAM,CAAC,GAAG,EAAE,CAAC,6BAA6B,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAC3G,qCAAqC,CACtC,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
@@ -27,4 +27,5 @@ export * from './tracing/errorSanitizer.js';
27
27
  export * from './jwt/index.js';
28
28
  export * from './org-features/index.js';
29
29
  export * from './database-lifecycle/index.js';
30
+ export * from './database-lifecycle/edit-lifecycle-capability.js';
30
31
  //# sourceMappingURL=index.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kCAAkC,CAAC;AACjD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,+BAA+B,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kCAAkC,CAAC;AACjD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,mDAAmD,CAAC"}
package/dist-esm/index.js CHANGED
@@ -27,4 +27,5 @@ export * from './tracing/errorSanitizer.js';
27
27
  export * from './jwt/index.js';
28
28
  export * from './org-features/index.js';
29
29
  export * from './database-lifecycle/index.js';
30
+ export * from './database-lifecycle/edit-lifecycle-capability.js';
30
31
  //# sourceMappingURL=index.js.map
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kCAAkC,CAAC;AACjD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,+BAA+B,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kCAAkC,CAAC;AACjD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,mDAAmD,CAAC"}
@@ -123,14 +123,32 @@ export interface AuditEventTypeEntry {
123
123
  export declare const AUDIT_EVENT_TYPE_CATALOG: AuditEventTypeEntry[];
124
124
  export declare function buildOCSFMetadata(logName: string): OCSFMetadata;
125
125
  /**
126
- * Wire payload for the `v1.audit.npmInstallBlocked` socket method.
126
+ * Provisional install-time exploitability decision for a CVE finding.
127
+ * Shared by the agent triage path and `NpmInstallBlockedAuditReport.triage`.
128
+ */
129
+ export interface TriageVerdict {
130
+ advisoryId: string;
131
+ confidence: 'high' | 'low' | 'medium';
132
+ evaluatedAt: string;
133
+ factors?: {
134
+ appExposure?: string;
135
+ intendedUse?: string;
136
+ vulnerableFunctionalityInPlay?: boolean;
137
+ };
138
+ model: string;
139
+ package: string;
140
+ reasoning: string;
141
+ stage: 'install';
142
+ verdict: 'exploitable' | 'not_exploitable' | 'uncertain';
143
+ }
144
+ /**
145
+ * Wire payload for the historical `v1.audit.npmInstallBlocked` socket method.
127
146
  *
128
- * Emitted by the Clark dev-server runtime when the controlled install path
129
- * reports `NpmInstallBlocked`. The server derives org + actor from the
130
- * authenticated connection (never trusting the client for identity),
147
+ * Emitted by the Clark dev-server runtime for blocked installs and successful
148
+ * security decisions such as substitutions, triage, and user overrides. The
149
+ * server derives org, actor, and app from the authenticated connection,
131
150
  * throttles per-org and globally, sanitizes via the P6.1 telemetry helpers,
132
- * and writes an OCSF `audit_event` row with operation
133
- * `organization.npm_install.blocked`.
151
+ * and writes an application-scoped OCSF `audit_event` row.
134
152
  *
135
153
  * Carries only structured, low-risk fields — deliberately NO free-text error
136
154
  * message, so a registry token embedded in CLI output can never reach the wire.
@@ -153,5 +171,41 @@ export interface NpmInstallBlockedAuditReport {
153
171
  runner?: string;
154
172
  /** Epoch ms when the block occurred (client clock). */
155
173
  occurredAt: number;
174
+ /**
175
+ * Vulnerability-index findings when `reason === "vulnerable_package"`. One
176
+ * block can name several advisories across several packages, so each finding
177
+ * carries its own package spec and a SIEM query on `advisory_id` matches
178
+ * every row it should. Server allowlists `kind`, scrubs string fields, drops
179
+ * off-shape entries rather than coercing them, and caps the array length.
180
+ */
181
+ vulnerabilities?: Array<{
182
+ advisoryId: string;
183
+ kind: 'cve' | 'malware';
184
+ package: string;
185
+ severity?: string;
186
+ suggestedVersion?: string;
187
+ }>;
188
+ /**
189
+ * Silent version substitution when `reason === "package_substituted"`
190
+ * (CVE safe-swap or quarantine hold-back). Server scrubs versions and
191
+ * allowlists `reason`. One row per substitution — the client reports each
192
+ * one separately with `packages` naming the swapped package, which is why
193
+ * this object carries no name of its own.
194
+ */
195
+ substitution?: {
196
+ fromVersion: string;
197
+ toVersion: string;
198
+ reason: 'cve_swap' | 'quarantine';
199
+ };
200
+ /** Provisional install-time exploitability decision for a CVE finding. */
201
+ triage?: TriageVerdict;
202
+ /**
203
+ * Builder-approved proceed-with-reason override when `reason ===
204
+ * "vulnerability_user_override"`. Server scrubs `reason` and caps lengths.
205
+ */
206
+ userOverride?: {
207
+ packages: string[];
208
+ reason: string;
209
+ };
156
210
  }
157
211
  //# sourceMappingURL=ocsf.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"ocsf.d.ts","sourceRoot":"","sources":["../../../src/types/audit/ocsf.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,oBAAY,eAAe;IACzB,GAAG,IAAI;IACP,oBAAoB,IAAI;CACzB;AAED,oBAAY,YAAY;IACtB,cAAc,OAAO;IACrB,cAAc,OAAO;IACrB,iBAAiB,OAAO;IACxB,sBAAsB,OAAO;IAC7B,qBAAqB,OAAO;IAC5B,YAAY,OAAO;CACpB;AAED,oBAAY,cAAc;IACxB,OAAO,IAAI;IACX,MAAM,IAAI;IACV,IAAI,IAAI;IACR,MAAM,IAAI;IACV,MAAM,IAAI;IACV,OAAO,IAAI;IACX,KAAK,IAAI;IACT,MAAM,IAAI;IACV,MAAM,IAAI;IACV,KAAK,IAAI;IACT,MAAM,KAAK;IACX,KAAK,KAAK;CACX;AAED,oBAAY,YAAY;IACtB,OAAO,IAAI;IACX,OAAO,IAAI;IACX,OAAO,IAAI;IACX,WAAW,KAAK;CACjB;AAED,oBAAY,cAAc;IACxB,OAAO,IAAI;IACX,aAAa,IAAI;IACjB,GAAG,IAAI;IACP,MAAM,IAAI;IACV,IAAI,IAAI;IACR,QAAQ,IAAI;IACZ,KAAK,IAAI;CACV;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE;QACJ,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,CAAC,EAAE;QACR,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,eAAe,CAAC;IAC9B,SAAS,EAAE,YAAY,CAAC;IACxB,WAAW,EAAE,cAAc,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,YAAY,CAAC;IACxB,WAAW,EAAE,cAAc,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,SAAS,CAAC;IACjB,QAAQ,EAAE,YAAY,CAAC;IACvB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc,GAAG,MAAM,CAEzF;AAMD;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,YAAY,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,eAAe,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,mBAAmB,EA4LzD,CAAC;AAWF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAE/D;AAMD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,4BAA4B;IAC3C,yFAAyF;IACzF,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;CAKpB"}
1
+ {"version":3,"file":"ocsf.d.ts","sourceRoot":"","sources":["../../../src/types/audit/ocsf.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,oBAAY,eAAe;IACzB,GAAG,IAAI;IACP,oBAAoB,IAAI;CACzB;AAED,oBAAY,YAAY;IACtB,cAAc,OAAO;IACrB,cAAc,OAAO;IACrB,iBAAiB,OAAO;IACxB,sBAAsB,OAAO;IAC7B,qBAAqB,OAAO;IAC5B,YAAY,OAAO;CACpB;AAED,oBAAY,cAAc;IACxB,OAAO,IAAI;IACX,MAAM,IAAI;IACV,IAAI,IAAI;IACR,MAAM,IAAI;IACV,MAAM,IAAI;IACV,OAAO,IAAI;IACX,KAAK,IAAI;IACT,MAAM,IAAI;IACV,MAAM,IAAI;IACV,KAAK,IAAI;IACT,MAAM,KAAK;IACX,KAAK,KAAK;CACX;AAED,oBAAY,YAAY;IACtB,OAAO,IAAI;IACX,OAAO,IAAI;IACX,OAAO,IAAI;IACX,WAAW,KAAK;CACjB;AAED,oBAAY,cAAc;IACxB,OAAO,IAAI;IACX,aAAa,IAAI;IACjB,GAAG,IAAI;IACP,MAAM,IAAI;IACV,IAAI,IAAI;IACR,QAAQ,IAAI;IACZ,KAAK,IAAI;CACV;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE;QACJ,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,CAAC,EAAE;QACR,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,eAAe,CAAC;IAC9B,SAAS,EAAE,YAAY,CAAC;IACxB,WAAW,EAAE,cAAc,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,YAAY,CAAC;IACxB,WAAW,EAAE,cAAc,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,SAAS,CAAC;IACjB,QAAQ,EAAE,YAAY,CAAC;IACvB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc,GAAG,MAAM,CAEzF;AAMD;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,YAAY,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,eAAe,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,mBAAmB,EAuMzD,CAAC;AAWF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAE/D;AAMD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,6BAA6B,CAAC,EAAE,OAAO,CAAC;KACzC,CAAC;IACF,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,EAAE,aAAa,GAAG,iBAAiB,GAAG,WAAW,CAAC;CAC1D;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,4BAA4B;IAC3C,yFAAyF;IACzF,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,KAAK,CAAC;QACtB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,KAAK,GAAG,SAAS,CAAC;QACxB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC,CAAC;IACH;;;;;;OAMG;IACH,YAAY,CAAC,EAAE;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,UAAU,GAAG,YAAY,CAAC;KACnC,CAAC;IACF,0EAA0E;IAC1E,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB;;;OAGG;IACH,YAAY,CAAC,EAAE;QACb,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CAKH"}