@variance-authority/tribunal 0.1.0

package/dist/worker-input.js

@@ -0,0 +1,296 @@
+import { BANDS as FREQUENCY_BANDS, profileById, } from '@variance-authority/core';
+import { BANDS, MAX_CURRENT_SUBJECTS, } from '@variance-authority/history';
+import { identityFrom } from '@variance-authority/raster';
+import { BadRequest, array, asRecordBody, describe, flag, instant, optional, record, string, } from './worker-http.js';
+/**
+ * Every request body and query string this deployment accepts, checked before any
+ * of it reaches a store.
+ *
+ * One file because these share a deadline rather than a subject. The baseline
+ * routes, the history routes and the build ingest all write to something that
+ * does not forget, and each function below is the last moment its route can still
+ * refuse — the history record is append-only, a promoted baseline is what the
+ * next run compares against, and a build row outlives the request that made it.
+ * What each one checks differs, and the argument for it sits on the function.
+ *
+ * Reading a *response* is a different job with a different consequence and is not
+ * here: `identityFrom` and `rasterFrom` come from `@variance-authority/raster`
+ * because a misread response becomes a verdict, while everything below becomes a
+ * 4xx nobody mistakes for an answer.
+ */
+export function asKey(value) {
+    const source = record(value, '`key`');
+    const label = source['label'];
+    if (label !== undefined && typeof label !== 'string') {
+        throw new BadRequest('`key.label` must be a string when present');
+    }
+    return {
+        subject: string(source, 'subject', '`key`'),
+        ...(typeof label === 'string' ? { label } : {}),
+    };
+}
+export function asIdentity(value) {
+    const identity = identityFrom(value);
+    if (identity === null) {
+        // Never defaulted, and never partially rebuilt. An identity missing a field
+        // is a different machine from the one that wrote the baseline, and inventing
+        // the field would make a wrong-machine comparison look comparable.
+        throw new BadRequest('`identity` is not a renderer identity. Every field is required, because the identity is ' +
+            'the partition that decides whether two images may be compared at all');
+    }
+    return identity;
+}
+export function asDecision(value) {
+    if (value !== 'approved' && value !== 'rejected') {
+        throw new BadRequest(`\`decision\` must be "approved" or "rejected"; received ${describe(value)}`);
+    }
+    return value;
+}
+/**
+ * A build, checked before any of it is stored.
+ *
+ * The report itself is handed to `review.ingest` as-is rather than rebuilt field
+ * by field, and that is a deliberate asymmetry with the baseline routes. A
+ * misread *response* becomes a verdict; a misread *request* becomes a 4xx nobody
+ * mistakes for an answer. What is checked here is what the store would otherwise
+ * crash on or silently mis-record — the version, and the shape of the wrapper.
+ */
+export async function asBuildIngest(request) {
+    const body = await asRecordBody(request);
+    const report = record(body['report'], '`report`');
+    if (report['runVersion'] !== 1) {
+        throw new BadRequest(`\`report.runVersion\` must be 1; received ${describe(report['runVersion'])}. A report from ` +
+            'a writer this deployment does not understand would be partly stored and wholly believed');
+    }
+    if (!Array.isArray(report['observations'])) {
+        throw new BadRequest('`report.observations` must be an array');
+    }
+    const branch = body['branch'];
+    const images = body['images'];
+    return {
+        build: string(body, 'build', 'the build'),
+        commit: string(body, 'commit', 'the build'),
+        report: report,
+        ...(typeof branch === 'string' && branch !== '' ? { branch } : {}),
+        ...(images === undefined || images === null
+            ? {}
+            : { images: record(images, '`images`') }),
+    };
+}
+/**
+ * The window, validated before it can quietly select nothing.
+ *
+ * An unparseable `since` would reach the query as `NaN`, bind as NULL, match no
+ * row, and answer a churn of zero over zero runs — indistinguishable from a
+ * component that has never changed. A limit of zero is refused for the same
+ * reason: it asks for an answer computed over nothing, dressed as an answer.
+ */
+export function windowOf(url) {
+    const since = optional(url, 'since');
+    const until = optional(url, 'until');
+    const limit = optional(url, 'limit');
+    if (since !== undefined && Number.isNaN(Date.parse(since))) {
+        throw new BadRequest(`\`since\` must be an ISO-8601 instant; received "${since}"`);
+    }
+    if (until !== undefined && Number.isNaN(Date.parse(until))) {
+        throw new BadRequest(`\`until\` must be an ISO-8601 instant; received "${until}"`);
+    }
+    let parsedLimit;
+    if (limit !== undefined) {
+        parsedLimit = Number(limit);
+        if (!Number.isInteger(parsedLimit) || parsedLimit < 1) {
+            throw new BadRequest(`\`limit\` must be a whole number of at least 1; received "${limit}". A limit of 0 asks ` +
+                'for a drift answer computed over no rows, which reads as stability');
+        }
+    }
+    return {
+        ...(since !== undefined ? { since } : {}),
+        ...(until !== undefined ? { until } : {}),
+        ...(parsedLimit !== undefined ? { limit: parsedLimit } : {}),
+    };
+}
+/**
+ * A write, validated completely before any of it is appended.
+ *
+ * The history store is append-only, so this is the last moment anything can be
+ * refused. A row with an unknown band or an unparseable instant that gets in
+ * stays in, and every later query over that window either throws or silently
+ * misorders — so the strictness here is not politeness about input, it is the
+ * only place the invariant can still be enforced.
+ */
+export async function asRecordRequest(request) {
+    const body = await asRecordBody(request);
+    return {
+        run: asRunRecord(body['run']),
+        observations: array(body['observations'], '`observations`').map((row, index) => asObservation(row, `observations[${index}]`)),
+        tokens: array(body['tokens'], '`tokens`').map((row, index) => asTokenValue(row, `tokens[${index}]`)),
+        // Absent is an empty list here and nowhere else in this file, because the
+        // claim it makes is carried by a different field: `run.swept` says whether
+        // anything examined every subject, so "no instabilities" from a caller that
+        // never looked cannot be read as "nothing read differently".
+        instabilities: array(body['instabilities'] ?? [], '`instabilities`').map((row, index) => asInstability(row, `instabilities[${index}]`)),
+    };
+}
+/**
+ * An acceptance, and who made it when the surface that recorded it knows.
+ *
+ * The route this parses is how churn learns that anything shipped. Every
+ * observation is written unapproved — a run has not been reviewed at the moment
+ * it writes — so a deployment that could not take approvals answers *this
+ * component has never changed* about a component that changed forty times.
+ */
+export async function asApprovals(request) {
+    const body = await asRecordBody(request);
+    return array(body['approvals'], '`approvals`').map((row, index) => {
+        const what = `approvals[${index}]`;
+        const source = record(row, what);
+        const by = source['by'];
+        if (by !== undefined && by !== null && (typeof by !== 'string' || by === '')) {
+            throw new BadRequest(`${what}.by must be a non-empty string when present; received ${describe(by)}`);
+        }
+        return {
+            project: string(source, 'project', what),
+            subject: string(source, 'subject', what),
+            run: string(source, 'run', what),
+            at: instant(source, 'at', what),
+            ...(typeof by === 'string' ? { by } : {}),
+        };
+    });
+}
+/**
+ * The subject list a run asks about before it writes.
+ *
+ * The only validation here that refuses a request for being *large* rather than
+ * malformed, and the reason is that the answer cannot be trimmed: a `previous`
+ * set with a hole in it is a change that did not happen, appended to a store that
+ * does not forget. So a caller naming more than one request may carry is told the
+ * cap rather than answered with the first {@link MAX_CURRENT_SUBJECTS} and left
+ * looking successful.
+ */
+export async function asCurrentRequest(request) {
+    const body = await asRecordBody(request);
+    const subjects = array(body['subjects'], '`subjects`').map((value, index) => {
+        if (typeof value !== 'string' || value === '') {
+            throw new BadRequest(`subjects[${index}] must be a non-empty string; received ${describe(value)}`);
+        }
+        return value;
+    });
+    const distinct = new Set(subjects).size;
+    if (distinct > MAX_CURRENT_SUBJECTS) {
+        throw new BadRequest(`this request names ${distinct} subjects and one \`current\` request may name ` +
+            `${MAX_CURRENT_SUBJECTS}. The answer is not trimmed to fit — a missing previous row is ` +
+            'indistinguishable from a hash that was never recorded, so the run would append a change ' +
+            'that did not happen — so the request is refused and the caller splits its list');
+    }
+    return subjects;
+}
+export function asBand(value, what) {
+    if (typeof value !== 'string' || !BANDS.includes(value)) {
+        throw new BadRequest(`${what} must be one of ${BANDS.join(', ')}; received ${describe(value)}`);
+    }
+    return value;
+}
+/** Checked against `core`'s own table, so a tier added there needs no edit here. */
+function asProfile(value, what) {
+    const known = typeof value === 'string' ? profileById(value) : undefined;
+    if (known === undefined) {
+        throw new BadRequest(`${what}.profile is not a known observation profile: ${describe(value)}`);
+    }
+    return value;
+}
+function asRunRecord(value) {
+    const what = '`run`';
+    const source = record(value, what);
+    const swept = source['swept'];
+    if (swept !== undefined && swept !== null && typeof swept !== 'boolean') {
+        throw new BadRequest(`${what}.swept must be a boolean when present; received ${describe(swept)}`);
+    }
+    return {
+        project: string(source, 'project', what),
+        run: string(source, 'run', what),
+        commit: string(source, 'commit', what),
+        profile: asProfile(source['profile'], what),
+        at: instant(source, 'at', what),
+        // Absent stays absent through the whole path: a run that never said what it
+        // examined must not be stored as one that examined nothing, because that
+        // number becomes the denominator of a flake rate.
+        ...(typeof swept === 'boolean' ? { swept } : {}),
+    };
+}
+/**
+ * One occurrence of a subject failing to read the same way twice.
+ *
+ * `component` and `band` are optional and their absence is meaningful: a
+ * collector that supplied documents without snapshots proved the instability and
+ * gave nobody the means to name it. An empty string is refused rather than
+ * stored, because it would come back as a component named "".
+ */
+function asInstability(value, what) {
+    const source = record(value, what);
+    const component = source['component'];
+    const band = source['band'];
+    const absorbedBy = source['absorbedBy'];
+    for (const [key, held] of [
+        ['component', component],
+        ['absorbedBy', absorbedBy],
+    ]) {
+        if (held !== undefined && held !== null && (typeof held !== 'string' || held === '')) {
+            throw new BadRequest(`${what}.${key} must be a non-empty string when present; received ${describe(held)}`);
+        }
+    }
+    return {
+        project: string(source, 'project', what),
+        subject: string(source, 'subject', what),
+        ...(typeof component === 'string' ? { component } : {}),
+        ...(band === undefined || band === null ? {} : { band: asFrequencyBand(band, `${what}.band`) }),
+        profile: asProfile(source['profile'], what),
+        commit: string(source, 'commit', what),
+        run: string(source, 'run', what),
+        at: instant(source, 'at', what),
+        ...(typeof absorbedBy === 'string' ? { absorbedBy } : {}),
+    };
+}
+/**
+ * A frequency band, checked against `core`'s list rather than this package's.
+ *
+ * The two `Band` types classify different things — one names which part of a
+ * component was hashed, the other how often that kind of thing changes — and an
+ * instability is reported in the second, because that is what a fix is aimed at.
+ */
+function asFrequencyBand(value, what) {
+    if (typeof value !== 'string' || !FREQUENCY_BANDS.includes(value)) {
+        throw new BadRequest(`${what} must be one of ${FREQUENCY_BANDS.join(', ')}; received ${describe(value)}`);
+    }
+    return value;
+}
+function asObservation(value, what) {
+    const source = record(value, what);
+    const file = source['file'];
+    if (file !== undefined && file !== null && typeof file !== 'string') {
+        throw new BadRequest(`${what}.file must be a string when present; received ${describe(file)}`);
+    }
+    return {
+        project: string(source, 'project', what),
+        subject: string(source, 'subject', what),
+        component: string(source, 'component', what),
+        band: asBand(source['band'], `${what}.band`),
+        hash: string(source, 'hash', what),
+        profile: asProfile(source['profile'], what),
+        commit: string(source, 'commit', what),
+        run: string(source, 'run', what),
+        at: instant(source, 'at', what),
+        accepted: flag(source, 'accepted', what),
+        ...(typeof file === 'string' && file !== '' ? { file } : {}),
+    };
+}
+function asTokenValue(value, what) {
+    const source = record(value, what);
+    return {
+        project: string(source, 'project', what),
+        token: string(source, 'token', what),
+        value: string(source, 'value', what),
+        commit: string(source, 'commit', what),
+        at: instant(source, 'at', what),
+    };
+}
+//# sourceMappingURL=worker-input.js.map

package/dist/worker-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-input.js","sourceRoot":"","sources":["../src/worker-input.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,IAAI,eAAe,EACxB,WAAW,GAGZ,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,KAAK,EACL,oBAAoB,GASrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAG1D,OAAO,EACL,UAAU,EACV,KAAK,EACL,YAAY,EACZ,QAAQ,EACR,IAAI,EACJ,OAAO,EACP,QAAQ,EACR,MAAM,EACN,MAAM,GACP,MAAM,kBAAkB,CAAC;AAE1B;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,UAAU,KAAK,CAAC,KAAc;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrD,MAAM,IAAI,UAAU,CAAC,2CAA2C,CAAC,CAAC;IACpE,CAAC;IACD,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC;QAC3C,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,4EAA4E;QAC5E,6EAA6E;QAC7E,mEAAmE;QACnE,MAAM,IAAI,UAAU,CAClB,0FAA0F;YACxF,sEAAsE,CACzE,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;QACjD,MAAM,IAAI,UAAU,CAAC,2DAA2D,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAgB;IAClD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC;IAElD,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,UAAU,CAClB,6CAA6C,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,kBAAkB;YAC3F,yFAAyF,CAC5F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,UAAU,CAAC,wCAAwC,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE9B,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC;QACzC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC;QAC3C,MAAM,EAAE,MAA8B;QACtC,GAAG,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI;YACzC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAA4C,EAAE,CAAC;KACvF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAQ;IAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAErC,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,UAAU,CAAC,oDAAoD,KAAK,GAAG,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,UAAU,CAAC,oDAAoD,KAAK,GAAG,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,WAA+B,CAAC;IACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,UAAU,CAClB,6DAA6D,KAAK,uBAAuB;gBACvF,oEAAoE,CACvE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAgB;IAMpD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;IAEzC,OAAO;QACL,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAC7E,aAAa,CAAC,GAAG,EAAE,gBAAgB,KAAK,GAAG,CAAC,CAC7C;QACD,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAC3D,YAAY,CAAC,GAAG,EAAE,UAAU,KAAK,GAAG,CAAC,CACtC;QACD,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,6DAA6D;QAC7D,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CACtF,aAAa,CAAC,GAAG,EAAE,iBAAiB,KAAK,GAAG,CAAC,CAC9C;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAgB;IAChD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;IAEzC,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QAChE,MAAM,IAAI,GAAG,aAAa,KAAK,GAAG,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACjC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAExB,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,UAAU,CAClB,GAAG,IAAI,yDAAyD,QAAQ,CAAC,EAAE,CAAC,EAAE,CAC/E,CAAC;QACJ,CAAC;QAED,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC;YACxC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC;YACxC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC;YAChC,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;YAC/B,GAAG,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAgB;IACrD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;IAEzC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC1E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YAC9C,MAAM,IAAI,UAAU,CAClB,YAAY,KAAK,0CAA0C,QAAQ,CAAC,KAAK,CAAC,EAAE,CAC7E,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;IACxC,IAAI,QAAQ,GAAG,oBAAoB,EAAE,CAAC;QACpC,MAAM,IAAI,UAAU,CAClB,sBAAsB,QAAQ,iDAAiD;YAC7E,GAAG,oBAAoB,iEAAiE;YACxF,0FAA0F;YAC1F,gFAAgF,CACnF,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAc,EAAE,IAAY;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAa,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,UAAU,CAAC,GAAG,IAAI,mBAAmB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,KAAa,CAAC;AACvB,CAAC;AAED,oFAAoF;AACpF,SAAS,SAAS,CAAC,KAAc,EAAE,IAAY;IAC7C,MAAM,KAAK,GAAY,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,KAAkB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/F,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,UAAU,CAAC,GAAG,IAAI,gDAAgD,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,KAAkB,CAAC;AAC5B,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,MAAM,IAAI,GAAG,OAAO,CAAC;IACrB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAE9B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QACxE,MAAM,IAAI,UAAU,CAAC,GAAG,IAAI,mDAAmD,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC;QACxC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC;QAChC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC;QACtC,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;QAC3C,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;QAC/B,4EAA4E;QAC5E,yEAAyE;QACzE,kDAAkD;QAClD,GAAG,CAAC,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,KAAc,EAAE,IAAY;IACjD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IAExC,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI;QACxB,CAAC,WAAW,EAAE,SAAS,CAAC;QACxB,CAAC,YAAY,EAAE,UAAU,CAAC;KAClB,EAAE,CAAC;QACX,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE,CAAC,EAAE,CAAC;YACrF,MAAM,IAAI,UAAU,CAClB,GAAG,IAAI,IAAI,GAAG,sDAAsD,QAAQ,CAAC,IAAI,CAAC,EAAE,CACrF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC;QACxC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC;QACxC,GAAG,CAAC,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,EAAE,GAAG,IAAI,OAAO,CAAC,EAAE,CAAC;QAC/F,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;QAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC;QACtC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC;QAChC,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;QAC/B,GAAG,CAAC,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,KAAc,EAAE,IAAY;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAsB,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,UAAU,CAClB,GAAG,IAAI,mBAAmB,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,QAAQ,CAAC,KAAK,CAAC,EAAE,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,KAAsB,CAAC;AAChC,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,IAAY;IACjD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAE5B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpE,MAAM,IAAI,UAAU,CAAC,GAAG,IAAI,iDAAiD,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC;QACxC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC;QACxC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC;QAC5C,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,OAAO,CAAC;QAC5C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAW;QAC5C,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;QAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC;QACtC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC;QAChC,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;QAC/B,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC;QACxC,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,IAAY;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACnC,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC;QACxC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;QACpC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;QACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC;QACtC,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;KAChC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  BANDS as FREQUENCY_BANDS,\n  profileById,\n  type Digest,\n  type ProfileId,\n} from '@variance-authority/core';\nimport {\n  BANDS,\n  MAX_CURRENT_SUBJECTS,\n  type Approval,\n  type Band,\n  type FrequencyBand,\n  type Instability,\n  type Observation,\n  type RunRecord,\n  type TokenValue,\n  type Window,\n} from '@variance-authority/history';\nimport { identityFrom } from '@variance-authority/raster';\nimport type { RunReport } from '@variance-authority/report';\nimport type { BuildIngest, Decision, SubjectImages } from './review-types.js';\nimport {\n  BadRequest,\n  array,\n  asRecordBody,\n  describe,\n  flag,\n  instant,\n  optional,\n  record,\n  string,\n} from './worker-http.js';\n\n/**\n * Every request body and query string this deployment accepts, checked before any\n * of it reaches a store.\n *\n * One file because these share a deadline rather than a subject. The baseline\n * routes, the history routes and the build ingest all write to something that\n * does not forget, and each function below is the last moment its route can still\n * refuse — the history record is append-only, a promoted baseline is what the\n * next run compares against, and a build row outlives the request that made it.\n * What each one checks differs, and the argument for it sits on the function.\n *\n * Reading a *response* is a different job with a different consequence and is not\n * here: `identityFrom` and `rasterFrom` come from `@variance-authority/raster`\n * because a misread response becomes a verdict, while everything below becomes a\n * 4xx nobody mistakes for an answer.\n */\n\nexport function asKey(value: unknown): { readonly subject: string; readonly label?: string } {\n  const source = record(value, '`key`');\n  const label = source['label'];\n  if (label !== undefined && typeof label !== 'string') {\n    throw new BadRequest('`key.label` must be a string when present');\n  }\n  return {\n    subject: string(source, 'subject', '`key`'),\n    ...(typeof label === 'string' ? { label } : {}),\n  };\n}\n\nexport function asIdentity(value: unknown): ReturnType<typeof identityFrom> & object {\n  const identity = identityFrom(value);\n  if (identity === null) {\n    // Never defaulted, and never partially rebuilt. An identity missing a field\n    // is a different machine from the one that wrote the baseline, and inventing\n    // the field would make a wrong-machine comparison look comparable.\n    throw new BadRequest(\n      '`identity` is not a renderer identity. Every field is required, because the identity is ' +\n        'the partition that decides whether two images may be compared at all',\n    );\n  }\n  return identity;\n}\n\nexport function asDecision(value: unknown): Decision {\n  if (value !== 'approved' && value !== 'rejected') {\n    throw new BadRequest(`\\`decision\\` must be \"approved\" or \"rejected\"; received ${describe(value)}`);\n  }\n  return value;\n}\n\n/**\n * A build, checked before any of it is stored.\n *\n * The report itself is handed to `review.ingest` as-is rather than rebuilt field\n * by field, and that is a deliberate asymmetry with the baseline routes. A\n * misread *response* becomes a verdict; a misread *request* becomes a 4xx nobody\n * mistakes for an answer. What is checked here is what the store would otherwise\n * crash on or silently mis-record — the version, and the shape of the wrapper.\n */\nexport async function asBuildIngest(request: Request): Promise<BuildIngest> {\n  const body = await asRecordBody(request);\n  const report = record(body['report'], '`report`');\n\n  if (report['runVersion'] !== 1) {\n    throw new BadRequest(\n      `\\`report.runVersion\\` must be 1; received ${describe(report['runVersion'])}. A report from ` +\n        'a writer this deployment does not understand would be partly stored and wholly believed',\n    );\n  }\n  if (!Array.isArray(report['observations'])) {\n    throw new BadRequest('`report.observations` must be an array');\n  }\n\n  const branch = body['branch'];\n  const images = body['images'];\n\n  return {\n    build: string(body, 'build', 'the build'),\n    commit: string(body, 'commit', 'the build'),\n    report: report as unknown as RunReport,\n    ...(typeof branch === 'string' && branch !== '' ? { branch } : {}),\n    ...(images === undefined || images === null\n      ? {}\n      : { images: record(images, '`images`') as Readonly<Record<string, SubjectImages>> }),\n  };\n}\n\n/**\n * The window, validated before it can quietly select nothing.\n *\n * An unparseable `since` would reach the query as `NaN`, bind as NULL, match no\n * row, and answer a churn of zero over zero runs — indistinguishable from a\n * component that has never changed. A limit of zero is refused for the same\n * reason: it asks for an answer computed over nothing, dressed as an answer.\n */\nexport function windowOf(url: URL): Window {\n  const since = optional(url, 'since');\n  const until = optional(url, 'until');\n  const limit = optional(url, 'limit');\n\n  if (since !== undefined && Number.isNaN(Date.parse(since))) {\n    throw new BadRequest(`\\`since\\` must be an ISO-8601 instant; received \"${since}\"`);\n  }\n  if (until !== undefined && Number.isNaN(Date.parse(until))) {\n    throw new BadRequest(`\\`until\\` must be an ISO-8601 instant; received \"${until}\"`);\n  }\n\n  let parsedLimit: number | undefined;\n  if (limit !== undefined) {\n    parsedLimit = Number(limit);\n    if (!Number.isInteger(parsedLimit) || parsedLimit < 1) {\n      throw new BadRequest(\n        `\\`limit\\` must be a whole number of at least 1; received \"${limit}\". A limit of 0 asks ` +\n          'for a drift answer computed over no rows, which reads as stability',\n      );\n    }\n  }\n\n  return {\n    ...(since !== undefined ? { since } : {}),\n    ...(until !== undefined ? { until } : {}),\n    ...(parsedLimit !== undefined ? { limit: parsedLimit } : {}),\n  };\n}\n\n/**\n * A write, validated completely before any of it is appended.\n *\n * The history store is append-only, so this is the last moment anything can be\n * refused. A row with an unknown band or an unparseable instant that gets in\n * stays in, and every later query over that window either throws or silently\n * misorders — so the strictness here is not politeness about input, it is the\n * only place the invariant can still be enforced.\n */\nexport async function asRecordRequest(request: Request): Promise<{\n  readonly run: RunRecord;\n  readonly observations: readonly Observation[];\n  readonly tokens: readonly TokenValue[];\n  readonly instabilities: readonly Instability[];\n}> {\n  const body = await asRecordBody(request);\n\n  return {\n    run: asRunRecord(body['run']),\n    observations: array(body['observations'], '`observations`').map((row, index) =>\n      asObservation(row, `observations[${index}]`),\n    ),\n    tokens: array(body['tokens'], '`tokens`').map((row, index) =>\n      asTokenValue(row, `tokens[${index}]`),\n    ),\n    // Absent is an empty list here and nowhere else in this file, because the\n    // claim it makes is carried by a different field: `run.swept` says whether\n    // anything examined every subject, so \"no instabilities\" from a caller that\n    // never looked cannot be read as \"nothing read differently\".\n    instabilities: array(body['instabilities'] ?? [], '`instabilities`').map((row, index) =>\n      asInstability(row, `instabilities[${index}]`),\n    ),\n  };\n}\n\n/**\n * An acceptance, and who made it when the surface that recorded it knows.\n *\n * The route this parses is how churn learns that anything shipped. Every\n * observation is written unapproved — a run has not been reviewed at the moment\n * it writes — so a deployment that could not take approvals answers *this\n * component has never changed* about a component that changed forty times.\n */\nexport async function asApprovals(request: Request): Promise<readonly Approval[]> {\n  const body = await asRecordBody(request);\n\n  return array(body['approvals'], '`approvals`').map((row, index) => {\n    const what = `approvals[${index}]`;\n    const source = record(row, what);\n    const by = source['by'];\n\n    if (by !== undefined && by !== null && (typeof by !== 'string' || by === '')) {\n      throw new BadRequest(\n        `${what}.by must be a non-empty string when present; received ${describe(by)}`,\n      );\n    }\n\n    return {\n      project: string(source, 'project', what),\n      subject: string(source, 'subject', what),\n      run: string(source, 'run', what),\n      at: instant(source, 'at', what),\n      ...(typeof by === 'string' ? { by } : {}),\n    };\n  });\n}\n\n/**\n * The subject list a run asks about before it writes.\n *\n * The only validation here that refuses a request for being *large* rather than\n * malformed, and the reason is that the answer cannot be trimmed: a `previous`\n * set with a hole in it is a change that did not happen, appended to a store that\n * does not forget. So a caller naming more than one request may carry is told the\n * cap rather than answered with the first {@link MAX_CURRENT_SUBJECTS} and left\n * looking successful.\n */\nexport async function asCurrentRequest(request: Request): Promise<readonly string[]> {\n  const body = await asRecordBody(request);\n\n  const subjects = array(body['subjects'], '`subjects`').map((value, index) => {\n    if (typeof value !== 'string' || value === '') {\n      throw new BadRequest(\n        `subjects[${index}] must be a non-empty string; received ${describe(value)}`,\n      );\n    }\n    return value;\n  });\n\n  const distinct = new Set(subjects).size;\n  if (distinct > MAX_CURRENT_SUBJECTS) {\n    throw new BadRequest(\n      `this request names ${distinct} subjects and one \\`current\\` request may name ` +\n        `${MAX_CURRENT_SUBJECTS}. The answer is not trimmed to fit — a missing previous row is ` +\n        'indistinguishable from a hash that was never recorded, so the run would append a change ' +\n        'that did not happen — so the request is refused and the caller splits its list',\n    );\n  }\n\n  return subjects;\n}\n\nexport function asBand(value: unknown, what: string): Band {\n  if (typeof value !== 'string' || !BANDS.includes(value as Band)) {\n    throw new BadRequest(`${what} must be one of ${BANDS.join(', ')}; received ${describe(value)}`);\n  }\n  return value as Band;\n}\n\n/** Checked against `core`'s own table, so a tier added there needs no edit here. */\nfunction asProfile(value: unknown, what: string): ProfileId {\n  const known: unknown = typeof value === 'string' ? profileById(value as ProfileId) : undefined;\n  if (known === undefined) {\n    throw new BadRequest(`${what}.profile is not a known observation profile: ${describe(value)}`);\n  }\n  return value as ProfileId;\n}\n\nfunction asRunRecord(value: unknown): RunRecord {\n  const what = '`run`';\n  const source = record(value, what);\n  const swept = source['swept'];\n\n  if (swept !== undefined && swept !== null && typeof swept !== 'boolean') {\n    throw new BadRequest(`${what}.swept must be a boolean when present; received ${describe(swept)}`);\n  }\n\n  return {\n    project: string(source, 'project', what),\n    run: string(source, 'run', what),\n    commit: string(source, 'commit', what),\n    profile: asProfile(source['profile'], what),\n    at: instant(source, 'at', what),\n    // Absent stays absent through the whole path: a run that never said what it\n    // examined must not be stored as one that examined nothing, because that\n    // number becomes the denominator of a flake rate.\n    ...(typeof swept === 'boolean' ? { swept } : {}),\n  };\n}\n\n/**\n * One occurrence of a subject failing to read the same way twice.\n *\n * `component` and `band` are optional and their absence is meaningful: a\n * collector that supplied documents without snapshots proved the instability and\n * gave nobody the means to name it. An empty string is refused rather than\n * stored, because it would come back as a component named \"\".\n */\nfunction asInstability(value: unknown, what: string): Instability {\n  const source = record(value, what);\n  const component = source['component'];\n  const band = source['band'];\n  const absorbedBy = source['absorbedBy'];\n\n  for (const [key, held] of [\n    ['component', component],\n    ['absorbedBy', absorbedBy],\n  ] as const) {\n    if (held !== undefined && held !== null && (typeof held !== 'string' || held === '')) {\n      throw new BadRequest(\n        `${what}.${key} must be a non-empty string when present; received ${describe(held)}`,\n      );\n    }\n  }\n\n  return {\n    project: string(source, 'project', what),\n    subject: string(source, 'subject', what),\n    ...(typeof component === 'string' ? { component } : {}),\n    ...(band === undefined || band === null ? {} : { band: asFrequencyBand(band, `${what}.band`) }),\n    profile: asProfile(source['profile'], what),\n    commit: string(source, 'commit', what),\n    run: string(source, 'run', what),\n    at: instant(source, 'at', what),\n    ...(typeof absorbedBy === 'string' ? { absorbedBy } : {}),\n  };\n}\n\n/**\n * A frequency band, checked against `core`'s list rather than this package's.\n *\n * The two `Band` types classify different things — one names which part of a\n * component was hashed, the other how often that kind of thing changes — and an\n * instability is reported in the second, because that is what a fix is aimed at.\n */\nfunction asFrequencyBand(value: unknown, what: string): FrequencyBand {\n  if (typeof value !== 'string' || !FREQUENCY_BANDS.includes(value as FrequencyBand)) {\n    throw new BadRequest(\n      `${what} must be one of ${FREQUENCY_BANDS.join(', ')}; received ${describe(value)}`,\n    );\n  }\n  return value as FrequencyBand;\n}\n\nfunction asObservation(value: unknown, what: string): Observation {\n  const source = record(value, what);\n  const file = source['file'];\n\n  if (file !== undefined && file !== null && typeof file !== 'string') {\n    throw new BadRequest(`${what}.file must be a string when present; received ${describe(file)}`);\n  }\n\n  return {\n    project: string(source, 'project', what),\n    subject: string(source, 'subject', what),\n    component: string(source, 'component', what),\n    band: asBand(source['band'], `${what}.band`),\n    hash: string(source, 'hash', what) as Digest,\n    profile: asProfile(source['profile'], what),\n    commit: string(source, 'commit', what),\n    run: string(source, 'run', what),\n    at: instant(source, 'at', what),\n    accepted: flag(source, 'accepted', what),\n    ...(typeof file === 'string' && file !== '' ? { file } : {}),\n  };\n}\n\nfunction asTokenValue(value: unknown, what: string): TokenValue {\n  const source = record(value, what);\n  return {\n    project: string(source, 'project', what),\n    token: string(source, 'token', what),\n    value: string(source, 'value', what),\n    commit: string(source, 'commit', what),\n    at: instant(source, 'at', what),\n  };\n}\n"]}

package/dist/worker.d.ts

@@ -0,0 +1,91 @@
+import { RasterStoreError } from '@variance-authority/raster';
+import type { TribunalBindings } from './bindings.js';
+/**
+ * One `fetch` handler, three surfaces, and no outbound call.
+ *
+ * The operator writes the Worker entry and hands this their bindings; everything
+ * below is the composition. Two of the three surfaces are protocols defined
+ * elsewhere and re-served here, so a CLI configured with
+ * `baselines.kind: "remote"` and a client built from
+ * `@variance-authority/history/client` both reach this deployment unchanged.
+ *
+ * ## The Worker never calls anything
+ *
+ * No status check, no pull-request comment, no webhook, no telemetry. The
+ * pipeline reports to the server and the server reports to nobody. That is the
+ * project's standing constraint, and it is also what keeps this deployment free
+ * of a credential for somebody else's system: there is nothing here to steal that
+ * is useful anywhere but here.
+ *
+ * ## Two tokens, and what each one is for
+ *
+ * `ingest` is written into CI configuration and can write builds, baselines and
+ * history. `review` belongs to people and can read the review surface and decide.
+ * They are separate because deciding *promotes a baseline*, and one secret doing
+ * both means anything that can read a CI log can approve a regression.
+ *
+ * They may not be equal, and construction refuses it. A deployment that set both
+ * to the same value would satisfy every check in this file while having exactly
+ * one secret, and nothing in a request would show it.
+ *
+ * ## Authentication happens before routing
+ *
+ * A caller holding neither token gets one sentence, whatever it asked for,
+ * including for paths that do not exist. The alternative — 404 for unknown paths,
+ * 401 for known ones — hands an unauthorised caller a map of the API, and on a
+ * subject-scoped path it answers "that subject exists" to somebody holding
+ * nothing.
+ *
+ * The *capability* check happens after routing, and deliberately: it can only be
+ * reached by someone already holding a valid token, so telling them which of the
+ * two a route wants reveals nothing they could not learn by trying.
+ *
+ * ## What is next door
+ *
+ * The token comparison and the capability rule are in
+ * [`worker-auth.ts`](./worker-auth.ts); the refusals and the readers every route
+ * validates in are in [`worker-http.ts`](./worker-http.ts) and
+ * [`worker-input.ts`](./worker-input.ts). What is left here is the composition and
+ * the routing table, which is the part an operator has to read.
+ */
+export interface TribunalOptions extends TribunalBindings {
+    /** Scopes every row and object. One deployment, several repositories. */
+    readonly project: string;
+    /** Written into CI. Writes builds, baselines and history. At least 16 characters. */
+    readonly ingestToken: string;
+    /** Held by people. Reads the review surface and decides. At least 16 characters. */
+    readonly reviewToken: string;
+    /**
+     * Days of builds to keep when `POST /review/sweep` is called.
+     *
+     * Applied on request rather than on a timer, because a Worker has no timer and
+     * this package will not invent a cron the operator did not ask for. Wire it to a
+     * scheduled trigger, or call it from a CI job, or never.
+     */
+    readonly retentionDays?: number;
+    readonly now?: () => Date;
+}
+/**
+ * The whole service, as one `fetch` handler.
+ *
+ * Deliberately nothing else. A handler is what a Worker exports, what a Next
+ * route handler is, and what `node:http` can be adapted to in a dozen lines — so
+ * the three deployments differ in their wiring and not in their router. It is
+ * also the reason a `Tribunal` cannot be asked for its own tokens: a value with
+ * one method has nothing to leak when it is logged.
+ */
+export interface Tribunal {
+    fetch(request: Request): Promise<Response>;
+}
+/**
+ * Build the service over a database, a bucket and two tokens.
+ *
+ * Refuses a token under 16 characters and refuses two identical ones, here
+ * rather than on the first request: a deployment whose ingest token also
+ * promotes baselines is a misconfiguration that would otherwise be discovered by
+ * the build log that used it.
+ */
+export declare function createTribunal(options: TribunalOptions): Tribunal;
+/** Re-exported so a Worker entry can recognise a store failure without a second import. */
+export { RasterStoreError };
+//# sourceMappingURL=worker.d.ts.map