@tokenoftrust/storefront-runner 2.0.23 → 2.0.25

package/apps/storefront/astro.config.mjs

@@ -58,6 +58,7 @@ import preact from "@astrojs/preact";
 import tailwindcss from "@tailwindcss/vite";
 import { tenantHotReload } from "./dev-plugins/tenant-hot-reload.mjs";
 import { materializeGuard } from "./integrations/materialize-guard.mjs";
+import { lifecycleHostAsset } from "./integrations/lifecycle-host-asset.mjs";
 
 // SSR on Cloudflare Workers. `output: 'server'` because every response is
 // tenant-resolved at the edge from the Host header (see src/middleware).
@@ -94,6 +95,10 @@ export default defineConfig({
     // resolves from KV/R2 at request time. The same integration becomes strict
     // only when TOT_BUILD_TENANTS names a per-tenant static publish input.
     materializeGuard(),
+    // The document.deferred lifecycle host, emitted as one self-contained module at a
+    // stable same-origin URL so BOTH document mounts load the same boot — the raw
+    // marketing mount has no bundler to hoist a module import through.
+    lifecycleHostAsset(),
     preact({ compat: true }),
     // Astro's file-based router ignores ANY path segment starting with "_" (see
     // `astro/dist/core/routing/create-manifest.js`), so a page literally named

package/apps/storefront/integrations/lifecycle-host-asset.mjs

@@ -0,0 +1,125 @@
+/**
+ * Emit the document.deferred lifecycle host as ONE self-contained module at a stable
+ * same-origin URL, so both document mounts can load the same host.
+ *
+ * WHY NOT A ROLLUP CHUNK. `Layout.astro` gets its client code through Astro's bundler,
+ * which hashes filenames and splits shared modules into sibling chunks. The raw marketing
+ * mount can use neither: it serves a tenant's own document verbatim, so it needs a URL it
+ * can hardcode. And a SPLIT bundle is actively unsafe here — a published static bundle
+ * (`scripts/publish/materialize-tenant.mjs`) copies only what the rendered HTML references
+ * and follows CSS `url()` but NOT JavaScript imports, so a sibling chunk would resolve on
+ * the Cloudflare plane and 404 on the S3/CloudFront one. That asymmetry is exactly the
+ * both-CDNs failure this repo treats as an invariant, and nothing downstream would report
+ * it: validate-bundle only checks HTML-referenced paths.
+ *
+ * So the host is bundled ONCE by esbuild with no code splitting, and this REFUSES to emit
+ * anything carrying an import. A single import-free file behaves identically on both
+ * providers by construction.
+ *
+ * It is an Astro INTEGRATION rather than a bare Vite plugin because Astro is the only
+ * thing that knows where the client output actually goes: every one of Astro's build
+ * passes — the client pass included — runs with `build.ssr === true`, so a Vite plugin
+ * cannot tell them apart, while `config.build.client` says it outright.
+ */
+import { mkdir, writeFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { LIFECYCLE_HOST_ASSET_PATH } from "@tot/public-runtime/integration/lifecycle-host-asset";
+
+const HOST_ENTRY = fileURLToPath(
+  new URL(
+    "../../../packages/public-runtime/src/integration/lifecycle-host-entry.ts",
+    import.meta.url,
+  ),
+);
+
+/**
+ * Bundle the host to a single self-contained ES module.
+ *
+ * esbuild is resolved through `astro` (a direct dependency of this app, always present
+ * whenever this integration runs) rather than declared again here, so its version cannot
+ * drift from the one the build already uses.
+ * @returns {Promise<string>}
+ */
+export async function bundleLifecycleHost() {
+  const require = createRequire(import.meta.url);
+  const esbuild = createRequire(require.resolve("astro/package.json"))("esbuild");
+  const result = await esbuild.build({
+    entryPoints: [HOST_ENTRY],
+    bundle: true,
+    write: false,
+    metafile: true,
+    format: "esm",
+    platform: "browser",
+    target: "es2022",
+    minify: true,
+    treeShaking: true,
+    legalComments: "none",
+    sourcemap: false,
+    logLevel: "silent",
+  });
+  if (result.outputFiles.length !== 1) {
+    throw new Error(
+      `The lifecycle host bundled to ${result.outputFiles.length} files; it must be one ` +
+        `self-contained module (a sibling chunk 404s on the S3/CloudFront plane).`,
+    );
+  }
+  // The metafile is authoritative about imports in a way a regex over minified code is
+  // not: any entry here is a file the browser would have to fetch separately.
+  for (const output of Object.values(result.metafile.outputs)) {
+    const external = (output.imports ?? []).filter((i) => i.kind !== "file-loader");
+    if (external.length > 0) {
+      throw new Error(
+        `The lifecycle host bundle imports ${external.map((i) => i.path).join(", ")}; it ` +
+          `must carry no imports, because the static publish pipeline does not follow them.`,
+      );
+    }
+  }
+  return result.outputFiles[0].text;
+}
+
+/**
+ * @returns {import("astro").AstroIntegration}
+ */
+export function lifecycleHostAsset() {
+  /** @type {URL | null} */
+  let clientDir = null;
+
+  return {
+    name: "tot-lifecycle-host-asset",
+    hooks: {
+      "astro:config:done": ({ config }) => {
+        clientDir = config.build.client;
+      },
+
+      // Dev serves it from memory: the raw marketing mount bypasses Astro's pipeline
+      // entirely, so without this the host 404s in `astro dev` and `tot dev` on exactly
+      // the pages this asset exists to cover. Rebundled per request (esbuild is fast) so
+      // an edit to the runtime shows up on reload rather than being pinned to server boot.
+      "astro:server:setup": ({ server }) => {
+        server.middlewares.use((req, res, next) => {
+          const path = (req.url ?? "").split("?")[0];
+          if (path !== `/${LIFECYCLE_HOST_ASSET_PATH}`) return next();
+          bundleLifecycleHost().then(
+            (code) => {
+              res.setHeader("content-type", "text/javascript; charset=utf-8");
+              res.setHeader("cache-control", "no-store");
+              res.end(code);
+            },
+            (error) => next(error),
+          );
+        });
+      },
+
+      "astro:build:done": async ({ logger }) => {
+        if (!clientDir) throw new Error("the lifecycle host has no resolved client output dir");
+        const code = await bundleLifecycleHost();
+        const target = fileURLToPath(new URL(LIFECYCLE_HOST_ASSET_PATH, clientDir));
+        await mkdir(dirname(target), { recursive: true });
+        await writeFile(target, code, "utf8");
+        logger.info(`lifecycle host → /${LIFECYCLE_HOST_ASSET_PATH} (${code.length} bytes)`);
+      },
+    },
+  };
+}

package/apps/storefront/src/layouts/Layout.astro

@@ -618,16 +618,14 @@ const footerWidgets = await renderWidgetSlot(
         entry in lib/cspStaticHashes.ts. */}
     <script is:inline nonce={cspNonce} set:html={INTERACTION_TRACKING_BOOT_JS}></script>
 
-    {/* document.deferred global-entry boundary (ext-kernel-04) — the last phase,
-        the renderer-owned mount point for the deferred integration entry. */}
+    {/* document.deferred global-entry boundary (ext-kernel-04) — the last phase, the
+        renderer-owned mount point for the deferred integration entry. This region also
+        CARRIES the lifecycle host tag (ext-kernel-05), which initializes the plan's
+        integrations exactly once per document, emits the governed page view, wires the
+        reserved completed-navigation event, and disposes on teardown; a no-op for an
+        empty plan. It ships with the phase markup rather than as a per-mount addition,
+        so the same bytes reach the raw marketing mount — which serves a tenant's
+        document verbatim and has no bundler to hoist a module import through. */}
     <Fragment set:html={integrationPhases.bodyDeferred} />
-
-    {/* document.deferred lifecycle boot (ext-kernel-05) — initializes the plan's
-        integrations exactly once per document, wires the reserved completed-
-        navigation event, and disposes on teardown; a no-op for an empty plan. */}
-    <script>
-      import { bootIntegrationLifecycleFromDocument } from "@tot/public-runtime";
-      bootIntegrationLifecycleFromDocument();
-    </script>
   </body>
 </html>

package/apps/storefront/src/lib/integration/bakedManagedInstalls.ts

@@ -0,0 +1,56 @@
+/**
+ * Read a tenant's BAKED managed installs off the materialize-only signed header.
+ *
+ * This is the read half of the wire documented in
+ * `packages/public-runtime/src/integration/baked-managed-installs.ts`. It exists because
+ * ADR 0013 gives a public page no per-request access to admin-installed state — the
+ * static bake has no D1 binding at all — so an active install can only reach a published
+ * bundle by being resolved and signed once, by the Worker, at go-live.
+ *
+ * Fail-safe at every step: not in materialize mode, no header, no secret, a signature
+ * that does not verify, or a payload that does not parse all yield an EMPTY list, and the
+ * render then resolves the environment-only plan exactly as it would for a tenant with no
+ * integrations. Nothing here can widen what a public request may inject, because gate one
+ * is a binding the deployed Worker never has.
+ */
+import {
+  MANAGED_INSTALLS_INPUT_HEADER,
+  MANAGED_INSTALLS_SIG_HEADER,
+  parseManagedInstalls,
+  verifyManagedInstallsSig,
+  MATERIALIZE_MODE_BINDING,
+  CONSENT_SNAPSHOT_HMAC_SECRET_BINDING,
+  type IntegrationDeclarationInput,
+} from "@tot/public-runtime";
+
+/** Reads a runtime binding; injected so this is testable without a Worker env. */
+export type ReadEnv = (key: string) => Promise<string | undefined>;
+
+/**
+ * The signed, materialize-only managed installs for `tenantPublicId`, or `[]`.
+ *
+ * The signature is TENANT-BOUND, so a payload signed for one tenant cannot be replayed
+ * into another tenant's bundle even by something that legitimately holds a signed header
+ * — which matters because one publish job builds one tenant at a time from a shared
+ * pipeline.
+ */
+export async function readBakedManagedInstalls(
+  request: Request,
+  tenantPublicId: string,
+  readEnv: ReadEnv,
+): Promise<IntegrationDeclarationInput[]> {
+  // Gate 1: the materialize-mode binding. The deployed Worker never declares it, so this
+  // header is unreadable on any public request and can never enter a cache key.
+  if ((await readEnv(MATERIALIZE_MODE_BINDING)) !== "1") return [];
+
+  const payload = request.headers.get(MANAGED_INSTALLS_INPUT_HEADER);
+  if (!payload) return [];
+
+  // Gate 2: the tenant-bound HMAC, verified constant-time against the go-live secret.
+  const secret = await readEnv(CONSENT_SNAPSHOT_HMAC_SECRET_BINDING);
+  if (!secret) return [];
+  const signature = request.headers.get(MANAGED_INSTALLS_SIG_HEADER);
+  if (!(await verifyManagedInstallsSig(secret, tenantPublicId, payload, signature))) return [];
+
+  return parseManagedInstalls(payload) ?? [];
+}

package/apps/storefront/src/lib/integration/managedInstallDeclarations.ts

@@ -6,11 +6,13 @@
 import {
   ENVIRONMENT_SCHEMA_VERSION,
   buildPlatformAdapterDeclaration,
+  getPlatformAdapter,
   validateIntegrationManifest,
   type IntegrationDeclarationInput,
 } from "@tot/public-runtime";
 import { AppVersionStore } from "../apps/appVersionStore.js";
 import type { Queryable } from "../d1/catalog.js";
+import { parseStageDestinationIds } from "./stageDestinationIds.js";
 
 const MANAGED_KIND = "managed-analytics-v1";
 
@@ -47,11 +49,17 @@ export async function loadActiveManagedInstallDeclarations(
       if (!manifest.ok || !current || current.tenantId !== tenantPublicId) continue;
       if (current.appVersion !== row.app_version || current.facets.appVersion !== row.app_version) continue;
       if (current.facets.digest !== manifest.value.app.digest || manifest.value.app.id !== row.app_id) continue;
-      const destinationId = current.facets.publicConfig["destinationId"];
-      if (typeof destinationId !== "string") continue;
+      // The stored per-stage map, re-parsed through the SAME validator the API used, so a
+      // row that no longer satisfies the contract disables its install rather than
+      // resolving a partial or stale destination set.
+      const ids = parseStageDestinationIds(
+        current.facets.publicConfig["destinationIds"],
+        getPlatformAdapter(row.app_id),
+      );
+      if (!ids.ok) continue;
       const built = buildPlatformAdapterDeclaration({
         adapterId: row.app_id,
-        ids: { live: destinationId },
+        ids: ids.value,
         tenantPublicId,
         environment: {
           schemaVersion: ENVIRONMENT_SCHEMA_VERSION,

package/apps/storefront/src/lib/integration/stageDestinationIds.ts

@@ -0,0 +1,103 @@
+/**
+ * The per-stage destination map, parsed once for both callers that need it: the
+ * managed-analytics API (validating what a merchant submits) and the render plane
+ * (rebuilding a stored install's declaration). One parser, so what the console accepts
+ * and what actually fires can never disagree.
+ *
+ * WHY PER STAGE. `resolveAdapterDestinationId` reads only the CURRENT stage's id, and
+ * `buildPlatformAdapterDeclaration` refuses a non-live stage that reuses the live one. So
+ * with a single id the runtime is already correct — a non-live stage resolves nothing and
+ * dispatches nothing — but the merchant has no way to measure anything off live either.
+ * A per-stage map is what makes non-live verification possible without pointing preview
+ * traffic at the property that carries real reporting.
+ */
+import {
+  ADAPTER_CONFIG_STAGES,
+  type AdapterConfigStage,
+  type DestinationIdsByEnvironment,
+  type PlatformAdapterDefinition,
+} from "@tot/public-runtime";
+
+export interface StageDestinationIdsOk {
+  ok: true;
+  value: DestinationIdsByEnvironment;
+}
+
+export interface StageDestinationIdsError {
+  ok: false;
+  details: { path: string; code: string; message: string }[];
+}
+
+export type StageDestinationIdsResult = StageDestinationIdsOk | StageDestinationIdsError;
+
+/**
+ * Parse and validate a submitted per-stage map fail-closed.
+ *
+ * `live` is required because it is the stage that publishes; a non-live stage is optional
+ * and simply resolves nothing when absent. Every id is checked against the ADAPTER's own
+ * format validator, so a Meta pixel id cannot be accepted where a GA4 measurement id
+ * belongs. Reusing the live id on a non-live stage is refused HERE with a field-level
+ * message rather than left to the declaration builder, so the console can point at the
+ * offending stage instead of failing the whole submission opaquely.
+ */
+export function parseStageDestinationIds(
+  input: unknown,
+  platform: PlatformAdapterDefinition | undefined,
+): StageDestinationIdsResult {
+  const base = "body.configuration.destinationIds";
+  if (typeof input !== "object" || input === null || Array.isArray(input)) {
+    return {
+      ok: false,
+      details: [{ path: base, code: "type", message: "Expected a map of stage to destination identifier." }],
+    };
+  }
+  if (!platform) {
+    return { ok: false, details: [{ path: "body.adapterId", code: "unknown_adapter", message: "Unknown adapter." }] };
+  }
+
+  const entries = Object.entries(input as Record<string, unknown>);
+  const details: StageDestinationIdsError["details"] = [];
+  const value: DestinationIdsByEnvironment = {};
+
+  for (const [stage, id] of entries) {
+    const path = `${base}.${stage}`;
+    if (!(ADAPTER_CONFIG_STAGES as readonly string[]).includes(stage)) {
+      details.push({
+        path,
+        code: "unknown_enum",
+        message: `Stage must be one of: ${ADAPTER_CONFIG_STAGES.join(", ")}.`,
+      });
+      continue;
+    }
+    if (typeof id !== "string" || !platform.validateId(id)) {
+      details.push({ path, code: "format", message: "Destination identifier has an invalid format." });
+      continue;
+    }
+    value[stage as AdapterConfigStage] = id;
+  }
+
+  if (!value.live) {
+    details.push({
+      path: `${base}.live`,
+      code: "required",
+      message: "A live destination identifier is required.",
+    });
+  } else {
+    for (const stage of ADAPTER_CONFIG_STAGES) {
+      if (stage === "live") continue;
+      if (value[stage] === value.live) {
+        details.push({
+          path: `${base}.${stage}`,
+          code: "live_destination_reused",
+          message:
+            "A non-live stage must use its own TEST destination, never the live one — " +
+            "otherwise preview and candidate traffic lands in the property that carries " +
+            "real reporting.",
+        });
+      }
+    }
+  }
+
+  if (details.length > 0) return { ok: false, details };
+  return { ok: true, value };
+}

package/apps/storefront/src/middleware/renderChain.ts

@@ -62,6 +62,7 @@ import {
   MATERIALIZE_MODE_BINDING,
   verifyConsentSnapshotSig,
 } from "@tot/public-runtime";
+import { readBakedManagedInstalls } from "@/lib/integration/bakedManagedInstalls";
 import type {
   CapabilityConfig,
   ConsentSnapshot,
@@ -219,7 +220,20 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
     ? publicationSource.publicationTimestamp
     : exactPublicationTimestamp(await readEnv("TOT_PUBLICATION_TIMESTAMP"));
 
-  const managedIntegrationDeclarations = input.managedIntegrationDeclarations;
+  // Managed installs reach this render one of two ways, never both. The control plane
+  // reads them from D1 per request (`controlPlane.ts`). A PUBLIC render supplies none by
+  // design (ADR 0013: "baked at publish, never read per request on a public page") — so
+  // on the materialize render, which is a public render with no D1 at all, they arrive
+  // BAKED: resolved and signed once by the go-live Worker, carried in a materialize-only
+  // signed header. Without this the bundle serves a plan whose `integrations` is empty
+  // for a tenant that has an active install, and nothing anywhere reports the difference.
+  //
+  // Read here, before declarations are assembled below, because the resolved plan and its
+  // compiled CSP both depend on the full declaration set.
+  const managedIntegrationDeclarations =
+    input.managedIntegrationDeclarations.length > 0
+      ? input.managedIntegrationDeclarations
+      : await readBakedManagedInstalls(request, tenant.tenant_id, readEnv);
 
   // Digest-addressed static-bundle serving. Deliberately before the edge page
   // cache/catalog/theme machinery. A selected publication bypasses this legacy

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.0.23",
+  "version": "2.0.25",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/package.json

@@ -9,7 +9,8 @@
   "types": "./src/index.ts",
   "exports": {
     ".": "./src/index.ts",
-    "./blog-visibility": "./src/blog-visibility.mjs"
+    "./blog-visibility": "./src/blog-visibility.mjs",
+    "./integration/lifecycle-host-asset": "./src/integration/lifecycle-host-asset.mjs"
   },
   "scripts": {
     "typecheck": "tsc --noEmit",

package/packages/public-runtime/schemas/managed-analytics/v1/adapter-definition.schema.json

@@ -202,7 +202,8 @@
             "enum": [
               "string",
               "boolean",
-              "integer"
+              "integer",
+              "stageMap"
             ]
           },
           "required": {

package/packages/public-runtime/schemas/managed-analytics/v1/create-integration-install-request.schema.json

@@ -147,6 +147,85 @@
               },
               {
                 "type": "integer"
+              },
+              {
+                "type": "object",
+                "additionalProperties": false,
+                "minProperties": 1,
+                "properties": {
+                  "candidate": {
+                    "type": "string",
+                    "not": {
+                      "anyOf": [
+                        {
+                          "type": "string",
+                          "pattern": "(?:[Gg][Tt][Mm]-[A-Za-z0-9]+|[Uu][Aa]-[0-9]+-[0-9]+)"
+                        },
+                        {
+                          "type": "string",
+                          "pattern": "(?:-----BEGIN(?: [A-Z]+)? PRIVATE KEY-----|\\bAKIA[0-9A-Z]{16}\\b|\\bsk-proj-[A-Za-z0-9_-]{8,}\\b|\\bsk-[A-Za-z0-9_-]{20,}\\b|\\b(?:sk|rk)_(?:live|test|prod)_[A-Za-z0-9_-]{8,}\\b|\\b(?:gh[pousr]_|github_pat_)[A-Za-z0-9_]{20,}\\b|\\b(?:npm_|glpat-)[A-Za-z0-9_.-]{8,}\\b|\\bxox[baprs]-[A-Za-z0-9-]{10,}\\b|\\bAIza[A-Za-z0-9_-]{20,}\\b|\\bSG\\.[A-Za-z0-9_.-]{8,}\\b|\\b(?:[Ss]ecret|[Pp]assword|[Cc]redential)[_-][A-Za-z0-9_-]{4,}\\b|\\b[Bb]earer\\s+[A-Za-z0-9._~+/-]{12,}={0,2}\\b|\\beyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]+\\b|\\b(?:api[_ -]?[Kk]ey|client[_ -]?[Ss]ecret|[Pp]assword|[Cc]redential|private[_ -]?[Kk]ey)\\s*[:=]\\s*\\S+)"
+                        },
+                        {
+                          "type": "string",
+                          "pattern": "(?:[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}|\\b[0-9]{3}-[0-9]{2}-[0-9]{4}\\b|\\b(?:[0-9][ -]?){13,19}\\b|(?:^|[^0-9])(?:\\+?1[ .-]?)?(?:\\([2-9][0-9]{2}\\)|[2-9][0-9]{2})[ .-]?[0-9]{3}[ .-]?[0-9]{4}(?=$|[^0-9]))"
+                        },
+                        {
+                          "type": "string",
+                          "pattern": "(?:</?[A-Za-z][^>]*>|[Jj][Aa][Vv][Aa][Ss][Cc][Rr][Ii][Pp][Tt]\\s*:|[Ee][Vv][Aa][Ll]\\s*\\(|(?:[Aa][Ll][Ee][Rr][Tt]|[Ff][Ee][Tt][Cc][Hh])\\s*\\(|\\{\\{|\\}\\}|\\$\\{|#[A-Za-z_][A-Za-z0-9_-]*|(?:^|[\\s,>+~])\\.[A-Za-z_-][A-Za-z0-9_-]*(?:$|[\\s,>+~.#[\\:])|\\[[A-Za-z_:][-A-Za-z0-9_:.]*(?:[~|^$*]?=[^\\]]+)?\\]|(?:[Ll][Oo][Cc][Aa][Ll]|[Ss][Ee][Ss][Ss][Ii][Oo][Nn])[Ss][Tt][Oo][Rr][Aa][Gg][Ee]|[Ii][Nn][Dd][Ee][Xx][Ee][Dd][Dd][Bb]|[Qq][Uu][Ee][Rr][Yy][Ss][Ee][Ll][Ee][Cc][Tt][Oo][Rr]|(?:[Ww][Ii][Nn][Dd][Oo][Ww]|[Dd][Oo][Cc][Uu][Mm][Ee][Nn][Tt]|[Gg][Ll][Oo][Bb][Aa][Ll][Tt][Hh][Ii][Ss]|[Cc][Oo][Nn][Ss][Oo][Ll][Ee])\\s*(?:\\.|\\[)|[A-Za-z_$][A-Za-z0-9_$]*\\s*\\.\\s*[A-Za-z_$][A-Za-z0-9_$]*\\s*\\(|[A-Za-z_$][A-Za-z0-9_$]*\\s*\\([^)]*\\)\\s*;|[Rr][Ee][Tt][Uu][Rr][Nn][^;{}]*;|[Ff][Uu][Nn][Cc][Tt][Ii][Oo][Nn]|=>|(?:[Vv][Aa][Rr]|[Ll][Ee][Tt]|[Cc][Oo][Nn][Ss][Tt])\\s+[A-Za-z_$])"
+                        }
+                      ]
+                    },
+                    "minLength": 1
+                  },
+                  "staged": {
+                    "type": "string",
+                    "not": {
+                      "anyOf": [
+                        {
+                          "type": "string",
+                          "pattern": "(?:[Gg][Tt][Mm]-[A-Za-z0-9]+|[Uu][Aa]-[0-9]+-[0-9]+)"
+                        },
+                        {
+                          "type": "string",
+                          "pattern": "(?:-----BEGIN(?: [A-Z]+)? PRIVATE KEY-----|\\bAKIA[0-9A-Z]{16}\\b|\\bsk-proj-[A-Za-z0-9_-]{8,}\\b|\\bsk-[A-Za-z0-9_-]{20,}\\b|\\b(?:sk|rk)_(?:live|test|prod)_[A-Za-z0-9_-]{8,}\\b|\\b(?:gh[pousr]_|github_pat_)[A-Za-z0-9_]{20,}\\b|\\b(?:npm_|glpat-)[A-Za-z0-9_.-]{8,}\\b|\\bxox[baprs]-[A-Za-z0-9-]{10,}\\b|\\bAIza[A-Za-z0-9_-]{20,}\\b|\\bSG\\.[A-Za-z0-9_.-]{8,}\\b|\\b(?:[Ss]ecret|[Pp]assword|[Cc]redential)[_-][A-Za-z0-9_-]{4,}\\b|\\b[Bb]earer\\s+[A-Za-z0-9._~+/-]{12,}={0,2}\\b|\\beyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]+\\b|\\b(?:api[_ -]?[Kk]ey|client[_ -]?[Ss]ecret|[Pp]assword|[Cc]redential|private[_ -]?[Kk]ey)\\s*[:=]\\s*\\S+)"
+                        },
+                        {
+                          "type": "string",
+                          "pattern": "(?:[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}|\\b[0-9]{3}-[0-9]{2}-[0-9]{4}\\b|\\b(?:[0-9][ -]?){13,19}\\b|(?:^|[^0-9])(?:\\+?1[ .-]?)?(?:\\([2-9][0-9]{2}\\)|[2-9][0-9]{2})[ .-]?[0-9]{3}[ .-]?[0-9]{4}(?=$|[^0-9]))"
+                        },
+                        {
+                          "type": "string",
+                          "pattern": "(?:</?[A-Za-z][^>]*>|[Jj][Aa][Vv][Aa][Ss][Cc][Rr][Ii][Pp][Tt]\\s*:|[Ee][Vv][Aa][Ll]\\s*\\(|(?:[Aa][Ll][Ee][Rr][Tt]|[Ff][Ee][Tt][Cc][Hh])\\s*\\(|\\{\\{|\\}\\}|\\$\\{|#[A-Za-z_][A-Za-z0-9_-]*|(?:^|[\\s,>+~])\\.[A-Za-z_-][A-Za-z0-9_-]*(?:$|[\\s,>+~.#[\\:])|\\[[A-Za-z_:][-A-Za-z0-9_:.]*(?:[~|^$*]?=[^\\]]+)?\\]|(?:[Ll][Oo][Cc][Aa][Ll]|[Ss][Ee][Ss][Ss][Ii][Oo][Nn])[Ss][Tt][Oo][Rr][Aa][Gg][Ee]|[Ii][Nn][Dd][Ee][Xx][Ee][Dd][Dd][Bb]|[Qq][Uu][Ee][Rr][Yy][Ss][Ee][Ll][Ee][Cc][Tt][Oo][Rr]|(?:[Ww][Ii][Nn][Dd][Oo][Ww]|[Dd][Oo][Cc][Uu][Mm][Ee][Nn][Tt]|[Gg][Ll][Oo][Bb][Aa][Ll][Tt][Hh][Ii][Ss]|[Cc][Oo][Nn][Ss][Oo][Ll][Ee])\\s*(?:\\.|\\[)|[A-Za-z_$][A-Za-z0-9_$]*\\s*\\.\\s*[A-Za-z_$][A-Za-z0-9_$]*\\s*\\(|[A-Za-z_$][A-Za-z0-9_$]*\\s*\\([^)]*\\)\\s*;|[Rr][Ee][Tt][Uu][Rr][Nn][^;{}]*;|[Ff][Uu][Nn][Cc][Tt][Ii][Oo][Nn]|=>|(?:[Vv][Aa][Rr]|[Ll][Ee][Tt]|[Cc][Oo][Nn][Ss][Tt])\\s+[A-Za-z_$])"
+                        }
+                      ]
+                    },
+                    "minLength": 1
+                  },
+                  "live": {
+                    "type": "string",
+                    "not": {
+                      "anyOf": [
+                        {
+                          "type": "string",
+                          "pattern": "(?:[Gg][Tt][Mm]-[A-Za-z0-9]+|[Uu][Aa]-[0-9]+-[0-9]+)"
+                        },
+                        {
+                          "type": "string",
+                          "pattern": "(?:-----BEGIN(?: [A-Z]+)? PRIVATE KEY-----|\\bAKIA[0-9A-Z]{16}\\b|\\bsk-proj-[A-Za-z0-9_-]{8,}\\b|\\bsk-[A-Za-z0-9_-]{20,}\\b|\\b(?:sk|rk)_(?:live|test|prod)_[A-Za-z0-9_-]{8,}\\b|\\b(?:gh[pousr]_|github_pat_)[A-Za-z0-9_]{20,}\\b|\\b(?:npm_|glpat-)[A-Za-z0-9_.-]{8,}\\b|\\bxox[baprs]-[A-Za-z0-9-]{10,}\\b|\\bAIza[A-Za-z0-9_-]{20,}\\b|\\bSG\\.[A-Za-z0-9_.-]{8,}\\b|\\b(?:[Ss]ecret|[Pp]assword|[Cc]redential)[_-][A-Za-z0-9_-]{4,}\\b|\\b[Bb]earer\\s+[A-Za-z0-9._~+/-]{12,}={0,2}\\b|\\beyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]+\\b|\\b(?:api[_ -]?[Kk]ey|client[_ -]?[Ss]ecret|[Pp]assword|[Cc]redential|private[_ -]?[Kk]ey)\\s*[:=]\\s*\\S+)"
+                        },
+                        {
+                          "type": "string",
+                          "pattern": "(?:[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}|\\b[0-9]{3}-[0-9]{2}-[0-9]{4}\\b|\\b(?:[0-9][ -]?){13,19}\\b|(?:^|[^0-9])(?:\\+?1[ .-]?)?(?:\\([2-9][0-9]{2}\\)|[2-9][0-9]{2})[ .-]?[0-9]{3}[ .-]?[0-9]{4}(?=$|[^0-9]))"
+                        },
+                        {
+                          "type": "string",
+                          "pattern": "(?:</?[A-Za-z][^>]*>|[Jj][Aa][Vv][Aa][Ss][Cc][Rr][Ii][Pp][Tt]\\s*:|[Ee][Vv][Aa][Ll]\\s*\\(|(?:[Aa][Ll][Ee][Rr][Tt]|[Ff][Ee][Tt][Cc][Hh])\\s*\\(|\\{\\{|\\}\\}|\\$\\{|#[A-Za-z_][A-Za-z0-9_-]*|(?:^|[\\s,>+~])\\.[A-Za-z_-][A-Za-z0-9_-]*(?:$|[\\s,>+~.#[\\:])|\\[[A-Za-z_:][-A-Za-z0-9_:.]*(?:[~|^$*]?=[^\\]]+)?\\]|(?:[Ll][Oo][Cc][Aa][Ll]|[Ss][Ee][Ss][Ss][Ii][Oo][Nn])[Ss][Tt][Oo][Rr][Aa][Gg][Ee]|[Ii][Nn][Dd][Ee][Xx][Ee][Dd][Dd][Bb]|[Qq][Uu][Ee][Rr][Yy][Ss][Ee][Ll][Ee][Cc][Tt][Oo][Rr]|(?:[Ww][Ii][Nn][Dd][Oo][Ww]|[Dd][Oo][Cc][Uu][Mm][Ee][Nn][Tt]|[Gg][Ll][Oo][Bb][Aa][Ll][Tt][Hh][Ii][Ss]|[Cc][Oo][Nn][Ss][Oo][Ll][Ee])\\s*(?:\\.|\\[)|[A-Za-z_$][A-Za-z0-9_$]*\\s*\\.\\s*[A-Za-z_$][A-Za-z0-9_$]*\\s*\\(|[A-Za-z_$][A-Za-z0-9_$]*\\s*\\([^)]*\\)\\s*;|[Rr][Ee][Tt][Uu][Rr][Nn][^;{}]*;|[Ff][Uu][Nn][Cc][Tt][Ii][Oo][Nn]|=>|(?:[Vv][Aa][Rr]|[Ll][Ee][Tt]|[Cc][Oo][Nn][Ss][Tt])\\s+[A-Za-z_$])"
+                        }
+                      ]
+                    },
+                    "minLength": 1
+                  }
+                }
               }
             ]
           }

package/packages/public-runtime/schemas/managed-analytics/v1/create-migration-draft-request.schema.json

@@ -120,6 +120,85 @@
               },
               {
                 "type": "integer"
+              },
+              {
+                "type": "object",
+                "additionalProperties": false,
+                "minProperties": 1,
+                "properties": {
+                  "candidate": {
+                    "type": "string",
+                    "not": {
+                      "anyOf": [
+                        {
+                          "type": "string",
+                          "pattern": "(?:[Gg][Tt][Mm]-[A-Za-z0-9]+|[Uu][Aa]-[0-9]+-[0-9]+)"
+                        },
+                        {
+                          "type": "string",
+                          "pattern": "(?:-----BEGIN(?: [A-Z]+)? PRIVATE KEY-----|\\bAKIA[0-9A-Z]{16}\\b|\\bsk-proj-[A-Za-z0-9_-]{8,}\\b|\\bsk-[A-Za-z0-9_-]{20,}\\b|\\b(?:sk|rk)_(?:live|test|prod)_[A-Za-z0-9_-]{8,}\\b|\\b(?:gh[pousr]_|github_pat_)[A-Za-z0-9_]{20,}\\b|\\b(?:npm_|glpat-)[A-Za-z0-9_.-]{8,}\\b|\\bxox[baprs]-[A-Za-z0-9-]{10,}\\b|\\bAIza[A-Za-z0-9_-]{20,}\\b|\\bSG\\.[A-Za-z0-9_.-]{8,}\\b|\\b(?:[Ss]ecret|[Pp]assword|[Cc]redential)[_-][A-Za-z0-9_-]{4,}\\b|\\b[Bb]earer\\s+[A-Za-z0-9._~+/-]{12,}={0,2}\\b|\\beyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]+\\b|\\b(?:api[_ -]?[Kk]ey|client[_ -]?[Ss]ecret|[Pp]assword|[Cc]redential|private[_ -]?[Kk]ey)\\s*[:=]\\s*\\S+)"
+                        },
+                        {
+                          "type": "string",
+                          "pattern": "(?:[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}|\\b[0-9]{3}-[0-9]{2}-[0-9]{4}\\b|\\b(?:[0-9][ -]?){13,19}\\b|(?:^|[^0-9])(?:\\+?1[ .-]?)?(?:\\([2-9][0-9]{2}\\)|[2-9][0-9]{2})[ .-]?[0-9]{3}[ .-]?[0-9]{4}(?=$|[^0-9]))"
+                        },
+                        {
+                          "type": "string",
+                          "pattern": "(?:</?[A-Za-z][^>]*>|[Jj][Aa][Vv][Aa][Ss][Cc][Rr][Ii][Pp][Tt]\\s*:|[Ee][Vv][Aa][Ll]\\s*\\(|(?:[Aa][Ll][Ee][Rr][Tt]|[Ff][Ee][Tt][Cc][Hh])\\s*\\(|\\{\\{|\\}\\}|\\$\\{|#[A-Za-z_][A-Za-z0-9_-]*|(?:^|[\\s,>+~])\\.[A-Za-z_-][A-Za-z0-9_-]*(?:$|[\\s,>+~.#[\\:])|\\[[A-Za-z_:][-A-Za-z0-9_:.]*(?:[~|^$*]?=[^\\]]+)?\\]|(?:[Ll][Oo][Cc][Aa][Ll]|[Ss][Ee][Ss][Ss][Ii][Oo][Nn])[Ss][Tt][Oo][Rr][Aa][Gg][Ee]|[Ii][Nn][Dd][Ee][Xx][Ee][Dd][Dd][Bb]|[Qq][Uu][Ee][Rr][Yy][Ss][Ee][Ll][Ee][Cc][Tt][Oo][Rr]|(?:[Ww][Ii][Nn][Dd][Oo][Ww]|[Dd][Oo][Cc][Uu][Mm][Ee][Nn][Tt]|[Gg][Ll][Oo][Bb][Aa][Ll][Tt][Hh][Ii][Ss]|[Cc][Oo][Nn][Ss][Oo][Ll][Ee])\\s*(?:\\.|\\[)|[A-Za-z_$][A-Za-z0-9_$]*\\s*\\.\\s*[A-Za-z_$][A-Za-z0-9_$]*\\s*\\(|[A-Za-z_$][A-Za-z0-9_$]*\\s*\\([^)]*\\)\\s*;|[Rr][Ee][Tt][Uu][Rr][Nn][^;{}]*;|[Ff][Uu][Nn][Cc][Tt][Ii][Oo][Nn]|=>|(?:[Vv][Aa][Rr]|[Ll][Ee][Tt]|[Cc][Oo][Nn][Ss][Tt])\\s+[A-Za-z_$])"
+                        }
+                      ]
+                    },
+                    "minLength": 1
+                  },
+                  "staged": {
+                    "type": "string",
+                    "not": {
+                      "anyOf": [
+                        {
+                          "type": "string",
+                          "pattern": "(?:[Gg][Tt][Mm]-[A-Za-z0-9]+|[Uu][Aa]-[0-9]+-[0-9]+)"
+                        },
+                        {
+                          "type": "string",
+                          "pattern": "(?:-----BEGIN(?: [A-Z]+)? PRIVATE KEY-----|\\bAKIA[0-9A-Z]{16}\\b|\\bsk-proj-[A-Za-z0-9_-]{8,}\\b|\\bsk-[A-Za-z0-9_-]{20,}\\b|\\b(?:sk|rk)_(?:live|test|prod)_[A-Za-z0-9_-]{8,}\\b|\\b(?:gh[pousr]_|github_pat_)[A-Za-z0-9_]{20,}\\b|\\b(?:npm_|glpat-)[A-Za-z0-9_.-]{8,}\\b|\\bxox[baprs]-[A-Za-z0-9-]{10,}\\b|\\bAIza[A-Za-z0-9_-]{20,}\\b|\\bSG\\.[A-Za-z0-9_.-]{8,}\\b|\\b(?:[Ss]ecret|[Pp]assword|[Cc]redential)[_-][A-Za-z0-9_-]{4,}\\b|\\b[Bb]earer\\s+[A-Za-z0-9._~+/-]{12,}={0,2}\\b|\\beyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]+\\b|\\b(?:api[_ -]?[Kk]ey|client[_ -]?[Ss]ecret|[Pp]assword|[Cc]redential|private[_ -]?[Kk]ey)\\s*[:=]\\s*\\S+)"
+                        },
+                        {
+                          "type": "string",
+                          "pattern": "(?:[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}|\\b[0-9]{3}-[0-9]{2}-[0-9]{4}\\b|\\b(?:[0-9][ -]?){13,19}\\b|(?:^|[^0-9])(?:\\+?1[ .-]?)?(?:\\([2-9][0-9]{2}\\)|[2-9][0-9]{2})[ .-]?[0-9]{3}[ .-]?[0-9]{4}(?=$|[^0-9]))"
+                        },
+                        {
+                          "type": "string",
+                          "pattern": "(?:</?[A-Za-z][^>]*>|[Jj][Aa][Vv][Aa][Ss][Cc][Rr][Ii][Pp][Tt]\\s*:|[Ee][Vv][Aa][Ll]\\s*\\(|(?:[Aa][Ll][Ee][Rr][Tt]|[Ff][Ee][Tt][Cc][Hh])\\s*\\(|\\{\\{|\\}\\}|\\$\\{|#[A-Za-z_][A-Za-z0-9_-]*|(?:^|[\\s,>+~])\\.[A-Za-z_-][A-Za-z0-9_-]*(?:$|[\\s,>+~.#[\\:])|\\[[A-Za-z_:][-A-Za-z0-9_:.]*(?:[~|^$*]?=[^\\]]+)?\\]|(?:[Ll][Oo][Cc][Aa][Ll]|[Ss][Ee][Ss][Ss][Ii][Oo][Nn])[Ss][Tt][Oo][Rr][Aa][Gg][Ee]|[Ii][Nn][Dd][Ee][Xx][Ee][Dd][Dd][Bb]|[Qq][Uu][Ee][Rr][Yy][Ss][Ee][Ll][Ee][Cc][Tt][Oo][Rr]|(?:[Ww][Ii][Nn][Dd][Oo][Ww]|[Dd][Oo][Cc][Uu][Mm][Ee][Nn][Tt]|[Gg][Ll][Oo][Bb][Aa][Ll][Tt][Hh][Ii][Ss]|[Cc][Oo][Nn][Ss][Oo][Ll][Ee])\\s*(?:\\.|\\[)|[A-Za-z_$][A-Za-z0-9_$]*\\s*\\.\\s*[A-Za-z_$][A-Za-z0-9_$]*\\s*\\(|[A-Za-z_$][A-Za-z0-9_$]*\\s*\\([^)]*\\)\\s*;|[Rr][Ee][Tt][Uu][Rr][Nn][^;{}]*;|[Ff][Uu][Nn][Cc][Tt][Ii][Oo][Nn]|=>|(?:[Vv][Aa][Rr]|[Ll][Ee][Tt]|[Cc][Oo][Nn][Ss][Tt])\\s+[A-Za-z_$])"
+                        }
+                      ]
+                    },
+                    "minLength": 1
+                  },
+                  "live": {
+                    "type": "string",
+                    "not": {
+                      "anyOf": [
+                        {
+                          "type": "string",
+                          "pattern": "(?:[Gg][Tt][Mm]-[A-Za-z0-9]+|[Uu][Aa]-[0-9]+-[0-9]+)"
+                        },
+                        {
+                          "type": "string",
+                          "pattern": "(?:-----BEGIN(?: [A-Z]+)? PRIVATE KEY-----|\\bAKIA[0-9A-Z]{16}\\b|\\bsk-proj-[A-Za-z0-9_-]{8,}\\b|\\bsk-[A-Za-z0-9_-]{20,}\\b|\\b(?:sk|rk)_(?:live|test|prod)_[A-Za-z0-9_-]{8,}\\b|\\b(?:gh[pousr]_|github_pat_)[A-Za-z0-9_]{20,}\\b|\\b(?:npm_|glpat-)[A-Za-z0-9_.-]{8,}\\b|\\bxox[baprs]-[A-Za-z0-9-]{10,}\\b|\\bAIza[A-Za-z0-9_-]{20,}\\b|\\bSG\\.[A-Za-z0-9_.-]{8,}\\b|\\b(?:[Ss]ecret|[Pp]assword|[Cc]redential)[_-][A-Za-z0-9_-]{4,}\\b|\\b[Bb]earer\\s+[A-Za-z0-9._~+/-]{12,}={0,2}\\b|\\beyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]+\\b|\\b(?:api[_ -]?[Kk]ey|client[_ -]?[Ss]ecret|[Pp]assword|[Cc]redential|private[_ -]?[Kk]ey)\\s*[:=]\\s*\\S+)"
+                        },
+                        {
+                          "type": "string",
+                          "pattern": "(?:[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}|\\b[0-9]{3}-[0-9]{2}-[0-9]{4}\\b|\\b(?:[0-9][ -]?){13,19}\\b|(?:^|[^0-9])(?:\\+?1[ .-]?)?(?:\\([2-9][0-9]{2}\\)|[2-9][0-9]{2})[ .-]?[0-9]{3}[ .-]?[0-9]{4}(?=$|[^0-9]))"
+                        },
+                        {
+                          "type": "string",
+                          "pattern": "(?:</?[A-Za-z][^>]*>|[Jj][Aa][Vv][Aa][Ss][Cc][Rr][Ii][Pp][Tt]\\s*:|[Ee][Vv][Aa][Ll]\\s*\\(|(?:[Aa][Ll][Ee][Rr][Tt]|[Ff][Ee][Tt][Cc][Hh])\\s*\\(|\\{\\{|\\}\\}|\\$\\{|#[A-Za-z_][A-Za-z0-9_-]*|(?:^|[\\s,>+~])\\.[A-Za-z_-][A-Za-z0-9_-]*(?:$|[\\s,>+~.#[\\:])|\\[[A-Za-z_:][-A-Za-z0-9_:.]*(?:[~|^$*]?=[^\\]]+)?\\]|(?:[Ll][Oo][Cc][Aa][Ll]|[Ss][Ee][Ss][Ss][Ii][Oo][Nn])[Ss][Tt][Oo][Rr][Aa][Gg][Ee]|[Ii][Nn][Dd][Ee][Xx][Ee][Dd][Dd][Bb]|[Qq][Uu][Ee][Rr][Yy][Ss][Ee][Ll][Ee][Cc][Tt][Oo][Rr]|(?:[Ww][Ii][Nn][Dd][Oo][Ww]|[Dd][Oo][Cc][Uu][Mm][Ee][Nn][Tt]|[Gg][Ll][Oo][Bb][Aa][Ll][Tt][Hh][Ii][Ss]|[Cc][Oo][Nn][Ss][Oo][Ll][Ee])\\s*(?:\\.|\\[)|[A-Za-z_$][A-Za-z0-9_$]*\\s*\\.\\s*[A-Za-z_$][A-Za-z0-9_$]*\\s*\\(|[A-Za-z_$][A-Za-z0-9_$]*\\s*\\([^)]*\\)\\s*;|[Rr][Ee][Tt][Uu][Rr][Nn][^;{}]*;|[Ff][Uu][Nn][Cc][Tt][Ii][Oo][Nn]|=>|(?:[Vv][Aa][Rr]|[Ll][Ee][Tt]|[Cc][Oo][Nn][Ss][Tt])\\s+[A-Za-z_$])"
+                        }
+                      ]
+                    },
+                    "minLength": 1
+                  }
+                }
               }
             ]
           }