@things-factory/webhook 10.1.38 → 10.1.39

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/webhook",
-  "version": "10.1.38",
+  "version": "10.1.39",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -29,11 +29,11 @@
   "dependencies": {
     "@operato/graphql": "^10.0.0",
     "@operato/i18n": "^10.0.0",
-    "@operato/ops-contract": "^0.9.33",
-    "@things-factory/auth-base": "^10.1.38",
+    "@operato/ops-contract": "^0.9.35",
+    "@things-factory/auth-base": "^10.1.39",
     "@things-factory/env": "^10.1.20",
-    "@things-factory/shell": "^10.1.38",
-    "@things-factory/task-lease": "^10.1.38"
+    "@things-factory/shell": "^10.1.39",
+    "@things-factory/task-lease": "^10.1.39"
   },
-  "gitHead": "b947349fe1c27d11038b592ceadaba336f14785b"
+  "gitHead": "fe5257ad8995fe7e79275e287f36e95b5fd32d1c"
 }

package/dist-server/service/outbox/pump-gate.d.ts

@@ -1,74 +0,0 @@
-/**
- * **Can this installation send at all** — a pure judgement, no imports, no environment read here.
- *
- * ═════════════════════════════════════════════════════════════════════════
- * ## What used to guard this door, and why it moved
- *
- * The pump used to stand only if a destination was named in the configuration file. Destinations then
- * moved to a table an administrator edits, and the door stayed where it was: a site could name its
- * destination on the screen and **the pump still would not stand**. Rows piled up with nobody sending
- * them, and nothing failed, so nobody knew.
- *
- * ## So the key is what declares a sender
- *
- * Destinations live in a table now, and the pump reads that table every round - a boot-time reading
- * would not see a destination added later. What is left is the signing key. An installation with no
- * key cannot deliver one record even with a destination: unsigned, the receiver refuses it. So the
- * key is the declaration that this installation sends.
- *
- * ## The names belong to the caller, the shape belongs here
- *
- * This module never reads `process.env`, and it has **no default names**: a product that forgets to
- * name its variables would otherwise sign with somebody else's key and nothing would say so. What the
- * module does own is how a domain becomes a variable suffix - if each product wrote that rule itself,
- * the same domain would look for different variables depending on which product asked.
- *
- * ```
- * <common>                     one key for the installation - a single-site install
- * <common>__MIRATEK_GUNSAN     one key per domain - what a multi-tenant install should use
- * ```
- *
- * A domain's name is not known at boot, so this counts by prefix. Which domain gave the key is
- * settled on that domain's turn, and named there.
- *
- * ⚠ This door answers "can we sign", not "is there anything to send". An installation with a key and
- * no destination row still stands the pump - and says, once per domain with facts waiting, that it
- * has nowhere to send them. That is better than not standing and saying nothing.
- * ═════════════════════════════════════════════════════════════════════════
- */
-/**
- * The two variable name stems a product declares. **Required** - see above on why there is no default.
- *
- * `domainPrefix` is the stem the per-domain names are built on; `domainSecretName` makes the whole
- * name from it.
- */
-export interface SecretNames {
-    common: string;
-    domainPrefix: string;
-}
-/**
- * The variable a domain's own key lives in.
- *
- * Anything that is not a letter or a digit becomes `_`, because that is what an environment variable
- * name may hold. Written once, here: a product that rounded this differently would look for
- * `MIRATEK_GUNSAN` while another looked for `MIRATEK-GUNSAN`, for the same domain.
- */
-export declare function domainSecretName(prefix: string, subdomain: string): string;
-/**
- * Does this installation hold any key to sign with?
- *
- * The environment arrives as an argument. Reading the process here would put this judgement out of
- * reach of a test, and this is the judgement that decides whether anything is delivered at all.
- */
-export declare function outboxCanSign(env: Record<string, string | undefined>, names: SecretNames, declaredSecret?: string): boolean;
-/**
- * This domain's key: its own first, then the installation's common one.
- *
- * **Absent is `undefined`, never an empty string.** An empty string signs, and a request signed with
- * nothing cannot be told from a forgery. Falling back to the common key stops here; a caller with
- * neither has to stop and name the domain it was working on.
- *
- * A multi-tenant installation should give per-domain keys and no common one. Then a domain nobody
- * gave a key to is caught, rather than opening with somebody else's.
- */
-export declare function outboxSecretFor(env: Record<string, string | undefined>, names: SecretNames, subdomain: string, declaredSecret?: string): string | undefined;

package/dist-server/service/outbox/pump-gate.js

@@ -1,90 +0,0 @@
-"use strict";
-/**
- * **Can this installation send at all** — a pure judgement, no imports, no environment read here.
- *
- * ═════════════════════════════════════════════════════════════════════════
- * ## What used to guard this door, and why it moved
- *
- * The pump used to stand only if a destination was named in the configuration file. Destinations then
- * moved to a table an administrator edits, and the door stayed where it was: a site could name its
- * destination on the screen and **the pump still would not stand**. Rows piled up with nobody sending
- * them, and nothing failed, so nobody knew.
- *
- * ## So the key is what declares a sender
- *
- * Destinations live in a table now, and the pump reads that table every round - a boot-time reading
- * would not see a destination added later. What is left is the signing key. An installation with no
- * key cannot deliver one record even with a destination: unsigned, the receiver refuses it. So the
- * key is the declaration that this installation sends.
- *
- * ## The names belong to the caller, the shape belongs here
- *
- * This module never reads `process.env`, and it has **no default names**: a product that forgets to
- * name its variables would otherwise sign with somebody else's key and nothing would say so. What the
- * module does own is how a domain becomes a variable suffix - if each product wrote that rule itself,
- * the same domain would look for different variables depending on which product asked.
- *
- * ```
- * <common>                     one key for the installation - a single-site install
- * <common>__MIRATEK_GUNSAN     one key per domain - what a multi-tenant install should use
- * ```
- *
- * A domain's name is not known at boot, so this counts by prefix. Which domain gave the key is
- * settled on that domain's turn, and named there.
- *
- * ⚠ This door answers "can we sign", not "is there anything to send". An installation with a key and
- * no destination row still stands the pump - and says, once per domain with facts waiting, that it
- * has nowhere to send them. That is better than not standing and saying nothing.
- * ═════════════════════════════════════════════════════════════════════════
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.domainSecretName = domainSecretName;
-exports.outboxCanSign = outboxCanSign;
-exports.outboxSecretFor = outboxSecretFor;
-/**
- * The variable a domain's own key lives in.
- *
- * Anything that is not a letter or a digit becomes `_`, because that is what an environment variable
- * name may hold. Written once, here: a product that rounded this differently would look for
- * `MIRATEK_GUNSAN` while another looked for `MIRATEK-GUNSAN`, for the same domain.
- */
-function domainSecretName(prefix, subdomain) {
-    return `${prefix}${subdomain.toUpperCase().replace(/[^A-Z0-9]+/g, '_')}`;
-}
-/** A value that is only whitespace is no value: signing with it produces a signature that stands. */
-function filled(value) {
-    return typeof value === 'string' && value.trim().length > 0;
-}
-/**
- * Does this installation hold any key to sign with?
- *
- * The environment arrives as an argument. Reading the process here would put this judgement out of
- * reach of a test, and this is the judgement that decides whether anything is delivered at all.
- */
-function outboxCanSign(env, names, declaredSecret) {
-    if (filled(env[names.common]) || filled(declaredSecret)) {
-        return true;
-    }
-    return Object.keys(env).some(name => name.startsWith(names.domainPrefix) && filled(env[name]));
-}
-/**
- * This domain's key: its own first, then the installation's common one.
- *
- * **Absent is `undefined`, never an empty string.** An empty string signs, and a request signed with
- * nothing cannot be told from a forgery. Falling back to the common key stops here; a caller with
- * neither has to stop and name the domain it was working on.
- *
- * A multi-tenant installation should give per-domain keys and no common one. Then a domain nobody
- * gave a key to is caught, rather than opening with somebody else's.
- */
-function outboxSecretFor(env, names, subdomain, declaredSecret) {
-    const mine = env[domainSecretName(names.domainPrefix, subdomain)];
-    if (filled(mine)) {
-        return mine;
-    }
-    if (filled(env[names.common])) {
-        return env[names.common];
-    }
-    return filled(declaredSecret) ? declaredSecret : undefined;
-}
-//# sourceMappingURL=pump-gate.js.map

package/dist-server/service/outbox/pump-gate.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pump-gate.js","sourceRoot":"","sources":["../../../server/service/outbox/pump-gate.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;;AAoBH,4CAEC;AAaD,sCAUC;AAYD,0CAiBC;AA7DD;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAAC,MAAc,EAAE,SAAiB;IAChE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,EAAE,CAAA;AAC1E,CAAC;AAED,qGAAqG;AACrG,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA;AAC7D,CAAC;AAED;;;;;GAKG;AACH,SAAgB,aAAa,CAC3B,GAAuC,EACvC,KAAkB,EAClB,cAAuB;IAEvB,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QACxD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AAChG,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,eAAe,CAC7B,GAAuC,EACvC,KAAkB,EAClB,SAAiB,EACjB,cAAuB;IAEvB,MAAM,IAAI,GAAG,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,CAAA;IAEjE,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACjB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC9B,OAAO,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC1B,CAAC;IAED,OAAO,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAA;AAC5D,CAAC","sourcesContent":["/**\n * **Can this installation send at all** — a pure judgement, no imports, no environment read here.\n *\n * ═════════════════════════════════════════════════════════════════════════\n * ## What used to guard this door, and why it moved\n *\n * The pump used to stand only if a destination was named in the configuration file. Destinations then\n * moved to a table an administrator edits, and the door stayed where it was: a site could name its\n * destination on the screen and **the pump still would not stand**. Rows piled up with nobody sending\n * them, and nothing failed, so nobody knew.\n *\n * ## So the key is what declares a sender\n *\n * Destinations live in a table now, and the pump reads that table every round - a boot-time reading\n * would not see a destination added later. What is left is the signing key. An installation with no\n * key cannot deliver one record even with a destination: unsigned, the receiver refuses it. So the\n * key is the declaration that this installation sends.\n *\n * ## The names belong to the caller, the shape belongs here\n *\n * This module never reads `process.env`, and it has **no default names**: a product that forgets to\n * name its variables would otherwise sign with somebody else's key and nothing would say so. What the\n * module does own is how a domain becomes a variable suffix - if each product wrote that rule itself,\n * the same domain would look for different variables depending on which product asked.\n *\n * ```\n * <common>                     one key for the installation - a single-site install\n * <common>__MIRATEK_GUNSAN     one key per domain - what a multi-tenant install should use\n * ```\n *\n * A domain's name is not known at boot, so this counts by prefix. Which domain gave the key is\n * settled on that domain's turn, and named there.\n *\n * ⚠ This door answers \"can we sign\", not \"is there anything to send\". An installation with a key and\n * no destination row still stands the pump - and says, once per domain with facts waiting, that it\n * has nowhere to send them. That is better than not standing and saying nothing.\n * ═════════════════════════════════════════════════════════════════════════\n */\n\n/**\n * The two variable name stems a product declares. **Required** - see above on why there is no default.\n *\n * `domainPrefix` is the stem the per-domain names are built on; `domainSecretName` makes the whole\n * name from it.\n */\nexport interface SecretNames {\n  common: string\n  domainPrefix: string\n}\n\n/**\n * The variable a domain's own key lives in.\n *\n * Anything that is not a letter or a digit becomes `_`, because that is what an environment variable\n * name may hold. Written once, here: a product that rounded this differently would look for\n * `MIRATEK_GUNSAN` while another looked for `MIRATEK-GUNSAN`, for the same domain.\n */\nexport function domainSecretName(prefix: string, subdomain: string): string {\n  return `${prefix}${subdomain.toUpperCase().replace(/[^A-Z0-9]+/g, '_')}`\n}\n\n/** A value that is only whitespace is no value: signing with it produces a signature that stands. */\nfunction filled(value: unknown): boolean {\n  return typeof value === 'string' && value.trim().length > 0\n}\n\n/**\n * Does this installation hold any key to sign with?\n *\n * The environment arrives as an argument. Reading the process here would put this judgement out of\n * reach of a test, and this is the judgement that decides whether anything is delivered at all.\n */\nexport function outboxCanSign(\n  env: Record<string, string | undefined>,\n  names: SecretNames,\n  declaredSecret?: string\n): boolean {\n  if (filled(env[names.common]) || filled(declaredSecret)) {\n    return true\n  }\n\n  return Object.keys(env).some(name => name.startsWith(names.domainPrefix) && filled(env[name]))\n}\n\n/**\n * This domain's key: its own first, then the installation's common one.\n *\n * **Absent is `undefined`, never an empty string.** An empty string signs, and a request signed with\n * nothing cannot be told from a forgery. Falling back to the common key stops here; a caller with\n * neither has to stop and name the domain it was working on.\n *\n * A multi-tenant installation should give per-domain keys and no common one. Then a domain nobody\n * gave a key to is caught, rather than opening with somebody else's.\n */\nexport function outboxSecretFor(\n  env: Record<string, string | undefined>,\n  names: SecretNames,\n  subdomain: string,\n  declaredSecret?: string\n): string | undefined {\n  const mine = env[domainSecretName(names.domainPrefix, subdomain)]\n\n  if (filled(mine)) {\n    return mine\n  }\n\n  if (filled(env[names.common])) {\n    return env[names.common]\n  }\n\n  return filled(declaredSecret) ? declaredSecret : undefined\n}\n"]}