@variance-authority/tribunal 0.1.0

package/dist/worker.js

@@ -0,0 +1,287 @@
+import { APPROVALS_PATH, CHURN_PATH, CURRENT_PATH, FLAKINESS_PATH, LAST_CHANGED_PATH, OBSERVATIONS_PATH, REACH_PATH, VALUE_JOURNEY_PATH, } from '@variance-authority/history';
+import { RasterStoreError, rasterFrom } from '@variance-authority/raster';
+import { HistoryWriteConflict, churnFrom, currentFrom, flakinessFrom, journeyFrom, lastChangedFrom, reachFrom, } from '@variance-authority/server';
+import { createD1Backend } from './history.js';
+import { ReviewError, createReviewStore } from './review.js';
+import { createBucketStore } from './store.js';
+import { UNAUTHENTICATED, grant, refuseWeakTokens, requires } from './worker-auth.js';
+import { BadRequest, Forbidden, MethodNotAllowed, asRecordBody, count, json, optional, requireMethod, required, string, } from './worker-http.js';
+import { asApprovals, asBand, asBuildIngest, asCurrentRequest, asDecision, asIdentity, asKey, asRecordRequest, windowOf, } from './worker-input.js';
+/**
+ * The baseline-store routes, restated.
+ *
+ * They are `@variance-authority/remote`'s and must stay byte-identical to them —
+ * a client and a server disagreeing about a URL is the class of failure that
+ * presents as a verdict. They are *restated* rather than imported because that
+ * package's entrypoint pulls in `node:http` to serve them, and a Worker bundle
+ * that drags a Node HTTP server in to read five string constants has acquired a
+ * dependency on a runtime it is not running on.
+ *
+ * The equality is a test, not a hope: `worker.test.ts` imports the constants from
+ * `remote` and asserts these against them, so drift fails the suite rather than a
+ * deployment.
+ */
+const BASELINE_FIND_PATH = '/baseline/find';
+const BASELINE_DESCRIBE_PATH = '/baseline/describe';
+const BASELINE_PUT_PATH = '/baseline/put';
+const CACHE_FIND_PATH = '/cache/find';
+const CACHE_PUT_PATH = '/cache/put';
+/**
+ * Build the service over a database, a bucket and two tokens.
+ *
+ * Refuses a token under 16 characters and refuses two identical ones, here
+ * rather than on the first request: a deployment whose ingest token also
+ * promotes baselines is a misconfiguration that would otherwise be discovered by
+ * the build log that used it.
+ */
+export function createTribunal(options) {
+    refuseWeakTokens(options);
+    const baselines = createBucketStore(options);
+    const history = createD1Backend(options.db);
+    const review = createReviewStore(options);
+    const retentionDays = options.retentionDays ?? 30;
+    return {
+        async fetch(request) {
+            const granted = await grant(request, options);
+            if (granted === null) {
+                return json(401, { error: UNAUTHENTICATED }, { 'www-authenticate': 'Bearer' });
+            }
+            let url;
+            try {
+                url = new URL(request.url);
+            }
+            catch {
+                return json(400, { error: `"${request.url}" is not a request URL` });
+            }
+            try {
+                return await route({ baselines, history, review, retentionDays }, granted, url, request);
+            }
+            catch (error) {
+                if (error instanceof BadRequest)
+                    return json(400, { error: error.message });
+                if (error instanceof Forbidden)
+                    return json(403, { error: error.message });
+                if (error instanceof MethodNotAllowed) {
+                    return json(405, { error: error.message }, { allow: error.allow });
+                }
+                if (error instanceof HistoryWriteConflict)
+                    return json(409, { error: error.message });
+                if (error instanceof ReviewError)
+                    return json(422, { error: error.message });
+                // Reported as a failure and never as an empty answer. Every client in
+                // this project turns a non-2xx into a thrown error precisely so that a
+                // broken service cannot become the sentence "no baseline" or "nothing has
+                // drifted".
+                return json(500, { error: error instanceof Error ? error.message : String(error) });
+            }
+        },
+    };
+}
+async function route(surfaces, granted, url, request) {
+    const path = url.pathname;
+    // ------------------------------------------------------------- baselines
+    if (path === BASELINE_FIND_PATH) {
+        requires(granted, 'ingest', path);
+        requireMethod(request, 'POST');
+        const body = await asRecordBody(request);
+        const found = await surfaces.baselines.find(asKey(body['key']), asIdentity(body['identity']));
+        return json(200, { found });
+    }
+    if (path === BASELINE_DESCRIBE_PATH) {
+        requires(granted, 'ingest', path);
+        requireMethod(request, 'POST');
+        const body = await asRecordBody(request);
+        const described = await surfaces.baselines.describe(asKey(body['key']), asIdentity(body['identity']));
+        return json(200, { described });
+    }
+    if (path === BASELINE_PUT_PATH) {
+        requires(granted, 'ingest', path);
+        requireMethod(request, 'POST');
+        const body = await asRecordBody(request);
+        const raster = rasterFrom(body['raster']);
+        if (raster === null)
+            throw new BadRequest('`raster` is not a raster');
+        await surfaces.baselines.put(asKey(body['key']), raster);
+        return json(200, { ok: true });
+    }
+    if (path === CACHE_FIND_PATH) {
+        requires(granted, 'ingest', path);
+        requireMethod(request, 'POST');
+        const body = await asRecordBody(request);
+        const digest = body['digest'];
+        if (typeof digest !== 'string')
+            throw new BadRequest('`digest` must be a string');
+        const raster = await surfaces.baselines.renderCache.get(digest, asIdentity(body['identity']));
+        return json(200, { raster });
+    }
+    if (path === CACHE_PUT_PATH) {
+        requires(granted, 'ingest', path);
+        requireMethod(request, 'POST');
+        const body = await asRecordBody(request);
+        const raster = rasterFrom(body['raster']);
+        if (raster === null)
+            throw new BadRequest('`raster` is not a raster');
+        await surfaces.baselines.renderCache.put(raster);
+        return json(200, { ok: true });
+    }
+    // --------------------------------------------------------------- history
+    const project = optional(url, 'project');
+    if (path === OBSERVATIONS_PATH) {
+        requires(granted, 'ingest', path);
+        requireMethod(request, 'POST');
+        const write = await asRecordRequest(request);
+        await surfaces.history.append(write.run, write.observations, write.tokens, write.instabilities);
+        // 204: the write left nothing to say, and the client treats any body on this
+        // route as a shape error rather than guessing at it.
+        return new Response(null, { status: 204 });
+    }
+    if (path === APPROVALS_PATH) {
+        requires(granted, 'ingest', path);
+        requireMethod(request, 'POST');
+        await surfaces.history.appendApprovals(await asApprovals(request));
+        return new Response(null, { status: 204 });
+    }
+    if (path === CURRENT_PATH) {
+        // A read, and still a POST, and still the ingest capability. Its argument is
+        // a subject list — three hundred subject ids in a query string is a 414 from
+        // a proxy nobody configured — and its caller is a run deciding what to write,
+        // not a person deciding what to ship (`CurrentRequest`).
+        requires(granted, 'ingest', path);
+        requireMethod(request, 'POST');
+        return json(200, await currentFrom(surfaces.history, project, await asCurrentRequest(request)));
+    }
+    if (path === LAST_CHANGED_PATH) {
+        readable(granted, path);
+        requireMethod(request, 'GET');
+        const band = optional(url, 'band');
+        return json(200, {
+            observation: await lastChangedFrom(surfaces.history, project, required(url, 'subject'), required(url, 'component'), band === undefined ? undefined : asBand(band, 'the `band` parameter')),
+        });
+    }
+    if (path === CHURN_PATH) {
+        readable(granted, path);
+        requireMethod(request, 'GET');
+        return json(200, await churnFrom(surfaces.history, project, required(url, 'component'), windowOf(url)));
+    }
+    if (path === VALUE_JOURNEY_PATH) {
+        readable(granted, path);
+        requireMethod(request, 'GET');
+        return json(200, await journeyFrom(surfaces.history, project, required(url, 'token'), windowOf(url)));
+    }
+    if (path === REACH_PATH) {
+        readable(granted, path);
+        requireMethod(request, 'GET');
+        return json(200, await reachFrom(surfaces.history, project, required(url, 'component'), windowOf(url)));
+    }
+    if (path === FLAKINESS_PATH) {
+        readable(granted, path);
+        requireMethod(request, 'GET');
+        return json(200, await flakinessFrom(surfaces.history, project, required(url, 'subject'), windowOf(url)));
+    }
+    // ---------------------------------------------------------------- review
+    if (path === '/review/builds' && request.method === 'POST') {
+        // The one review route the ingest token owns, and the only one it owns:
+        // posting a build is what CI does, and everything else on this surface is
+        // what a person does.
+        requires(granted, 'ingest', path);
+        await surfaces.review.ingest(await asBuildIngest(request));
+        return json(201, { ok: true });
+    }
+    if (path === '/review/builds') {
+        requires(granted, 'review', path);
+        requireMethod(request, 'GET');
+        const limit = optional(url, 'limit');
+        return json(200, { builds: await surfaces.review.builds(limit === undefined ? undefined : count(limit)) });
+    }
+    if (path === '/review/changelog') {
+        requires(granted, 'review', path);
+        requireMethod(request, 'GET');
+        const limit = optional(url, 'limit');
+        return json(200, await surfaces.review.changelog({
+            ...(optional(url, 'component') !== undefined
+                ? { component: required(url, 'component') }
+                : {}),
+            ...(optional(url, 'subject') !== undefined ? { subject: required(url, 'subject') } : {}),
+            ...(optional(url, 'since') !== undefined ? { since: required(url, 'since') } : {}),
+            ...(limit !== undefined ? { limit: count(limit) } : {}),
+        }));
+    }
+    if (path === '/review/sweep') {
+        requires(granted, 'review', path);
+        requireMethod(request, 'POST');
+        const days = optional(url, 'days');
+        // Reported rather than performed silently. An operator who cannot see what a
+        // sweep removed cannot tell a working retention policy from one deleting a
+        // build a day.
+        return json(200, await surfaces.review.sweep(days === undefined ? surfaces.retentionDays : count(days)));
+    }
+    const build = /^\/review\/builds\/([^/]+)$/.exec(path);
+    if (build?.[1] !== undefined) {
+        requires(granted, 'review', path);
+        requireMethod(request, 'GET');
+        const detail = await surfaces.review.build(decodeURIComponent(build[1]));
+        return detail === null
+            ? json(404, { error: `no build "${decodeURIComponent(build[1])}" in this project` })
+            : json(200, detail);
+    }
+    const decision = /^\/review\/builds\/([^/]+)\/subjects\/([^/]+)\/decision$/.exec(path);
+    if (decision?.[1] !== undefined && decision[2] !== undefined) {
+        requires(granted, 'review', path);
+        requireMethod(request, 'POST');
+        const body = await asRecordBody(request);
+        return json(200, await surfaces.review.decide({
+            build: decodeURIComponent(decision[1]),
+            subject: decodeURIComponent(decision[2]),
+            decision: asDecision(body['decision']),
+            by: string(body, 'by', 'the decision'),
+            ...(typeof body['note'] === 'string' && body['note'] !== '' ? { note: body['note'] } : {}),
+        }));
+    }
+    const image = /^\/review\/builds\/([^/]+)\/subjects\/([^/]+)\/(before|after|diff)\.png$/.exec(path);
+    if (image?.[1] !== undefined && image[2] !== undefined && image[3] !== undefined) {
+        requires(granted, 'review', path);
+        requireMethod(request, 'GET');
+        const bytes = await surfaces.review.image(decodeURIComponent(image[1]), decodeURIComponent(image[2]), image[3]);
+        if (bytes === null)
+            return json(404, { error: 'this build kept no such image' });
+        return new Response(bytes, {
+            headers: {
+                'content-type': 'image/png',
+                // A build's images never change: the row is written once and the object
+                // with it. Anything a reviewer reloads is fetched again for nothing.
+                'cache-control': 'private, max-age=31536000, immutable',
+            },
+        });
+    }
+    return json(404, {
+        error: `no route for ${request.method} ${path}. This deployment answers the baseline routes ` +
+            `(${BASELINE_FIND_PATH}, ${BASELINE_DESCRIBE_PATH}, ${BASELINE_PUT_PATH}, ` +
+            `${CACHE_FIND_PATH}, ${CACHE_PUT_PATH}), the history routes (${OBSERVATIONS_PATH}, ` +
+            `${APPROVALS_PATH}, ${CURRENT_PATH}, ${LAST_CHANGED_PATH}, ${CHURN_PATH}, ` +
+            `${FLAKINESS_PATH}, ${VALUE_JOURNEY_PATH}, ${REACH_PATH}) and /review/builds and ` +
+            '/review/changelog. A path from a different API version is a client and a service that ' +
+            'disagree about a recorded shape',
+    });
+}
+/**
+ * The history routes that answer a question rather than record one.
+ *
+ * Either capability may ask. The split everywhere else in this file is *who is
+ * allowed to write*, and these five write nothing: churn, reach, flakiness, the
+ * value journey and the last change are derived from rows already recorded. A
+ * reviewer looking at a build needs exactly these to know whether the difference
+ * in front of them is the third this week or the first this year, and the browser
+ * that draws that page holds the review token — so refusing them here would mean
+ * a review surface that can approve a change it cannot put in context.
+ *
+ * It stays a rule with a name rather than an omitted check, because the next
+ * history route added is a write far more often than it is a read, and the
+ * default has to be the strict one.
+ */
+function readable(granted, path) {
+    if (granted !== 'ingest')
+        requires(granted, 'review', path);
+}
+/** Re-exported so a Worker entry can recognise a store failure without a second import. */
+export { RasterStoreError };
+//# sourceMappingURL=worker.js.map

package/dist/worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AACA,OAAO,EACL,cAAc,EACd,UAAU,EACV,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,UAAU,EACV,kBAAkB,GACnB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EACL,oBAAoB,EACpB,SAAS,EACT,WAAW,EACX,aAAa,EACb,WAAW,EACX,eAAe,EACf,SAAS,GACV,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAgB,MAAM,kBAAkB,CAAC;AACpG,OAAO,EACL,UAAU,EACV,SAAS,EACT,gBAAgB,EAChB,YAAY,EACZ,KAAK,EACL,IAAI,EACJ,QAAQ,EACR,aAAa,EACb,QAAQ,EACR,MAAM,GACP,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,WAAW,EACX,MAAM,EACN,aAAa,EACb,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,KAAK,EACL,eAAe,EACf,QAAQ,GACT,MAAM,mBAAmB,CAAC;AAkF3B;;;;;;;;;;;;;GAaG;AACH,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAC5C,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AACpD,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAC1C,MAAM,eAAe,GAAG,aAAa,CAAC;AACtC,MAAM,cAAc,GAAG,YAAY,CAAC;AAEpC;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,OAAwB;IACrD,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAE1B,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAElD,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAgB;YAC1B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC,CAAC;YACjF,CAAC;YAED,IAAI,GAAQ,CAAC;YACb,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,OAAO,CAAC,GAAG,wBAAwB,EAAE,CAAC,CAAC;YACvE,CAAC;YAED,IAAI,CAAC;gBACH,OAAO,MAAM,KAAK,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YAC3F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,UAAU;oBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC5E,IAAI,KAAK,YAAY,SAAS;oBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC3E,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;oBACtC,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;gBACrE,CAAC;gBACD,IAAI,KAAK,YAAY,oBAAoB;oBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBACtF,IAAI,KAAK,YAAY,WAAW;oBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7E,sEAAsE;gBACtE,uEAAuE;gBACvE,0EAA0E;gBAC1E,YAAY;gBACZ,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AASD,KAAK,UAAU,KAAK,CAClB,QAAkB,EAClB,OAAgB,EAChB,GAAQ,EACR,OAAgB;IAEhB,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAE1B,0EAA0E;IAC1E,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAChC,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAClC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9F,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;QACpC,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAClC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,QAAQ,CACjD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAClB,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAC7B,CAAC;QACF,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAClC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1C,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM,IAAI,UAAU,CAAC,0BAA0B,CAAC,CAAC;QACtE,MAAM,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QAC7B,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAClC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,MAAM,IAAI,UAAU,CAAC,2BAA2B,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CACrD,MAAgB,EAChB,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAC7B,CAAC;QACF,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAClC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1C,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM,IAAI,UAAU,CAAC,0BAA0B,CAAC,CAAC;QACtE,MAAM,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,0EAA0E;IAC1E,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAEzC,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAClC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAChG,6EAA6E;QAC7E,qDAAqD;QACrD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAClC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/B,MAAM,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;QACnE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,6EAA6E;QAC7E,6EAA6E;QAC7E,8EAA8E;QAC9E,yDAAyD;QACzD,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAClC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC,GAAG,EAAE,MAAM,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAClG,CAAC;IAED,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACxB,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC,GAAG,EAAE;YACf,WAAW,EAAE,MAAM,eAAe,CAChC,QAAQ,CAAC,OAAO,EAChB,OAAO,EACP,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,EACxB,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,EAC1B,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,sBAAsB,CAAC,CACtE;SACF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACxB,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9B,OAAO,IAAI,CACT,GAAG,EACH,MAAM,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CACtF,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAChC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACxB,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9B,OAAO,IAAI,CACT,GAAG,EACH,MAAM,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CACpF,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACxB,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9B,OAAO,IAAI,CACT,GAAG,EACH,MAAM,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CACtF,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACxB,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9B,OAAO,IAAI,CACT,GAAG,EACH,MAAM,aAAa,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CACxF,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,IAAI,IAAI,KAAK,gBAAgB,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC3D,wEAAwE;QACxE,0EAA0E;QAC1E,sBAAsB;QACtB,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAClC,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAClC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7G,CAAC;IAED,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACjC,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAClC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACrC,OAAO,IAAI,CACT,GAAG,EACH,MAAM,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;YAC9B,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE;gBAC3C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC,CACH,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QAC7B,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAClC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACnC,6EAA6E;QAC7E,2EAA2E;QAC3E,eAAe;QACf,OAAO,IAAI,CAAC,GAAG,EAAE,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3G,CAAC;IAED,MAAM,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC7B,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAClC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,OAAO,MAAM,KAAK,IAAI;YACpB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,aAAa,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC;YACpF,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACxB,CAAC;IAED,MAAM,QAAQ,GAAG,0DAA0D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvF,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC7D,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAClC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QACzC,OAAO,IAAI,CACT,GAAG,EACH,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;YAC3B,KAAK,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YACtC,OAAO,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YACxC,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACtC,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC;YACtC,GAAG,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3F,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,0EAA0E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACjF,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAClC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CACvC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAC5B,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAC5B,KAAK,CAAC,CAAC,CAAgC,CACxC,CAAC;QACF,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;QACjF,OAAO,IAAI,QAAQ,CAAC,KAAK,EAAE;YACzB,OAAO,EAAE;gBACP,cAAc,EAAE,WAAW;gBAC3B,wEAAwE;gBACxE,qEAAqE;gBACrE,eAAe,EAAE,sCAAsC;aACxD;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC,GAAG,EAAE;QACf,KAAK,EACH,gBAAgB,OAAO,CAAC,MAAM,IAAI,IAAI,gDAAgD;YACtF,IAAI,kBAAkB,KAAK,sBAAsB,KAAK,iBAAiB,IAAI;YAC3E,GAAG,eAAe,KAAK,cAAc,0BAA0B,iBAAiB,IAAI;YACpF,GAAG,cAAc,KAAK,YAAY,KAAK,iBAAiB,KAAK,UAAU,IAAI;YAC3E,GAAG,cAAc,KAAK,kBAAkB,KAAK,UAAU,2BAA2B;YAClF,wFAAwF;YACxF,iCAAiC;KACpC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,QAAQ,CAAC,OAAgB,EAAE,IAAY;IAC9C,IAAI,OAAO,KAAK,QAAQ;QAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED,2FAA2F;AAC3F,OAAO,EAAE,gBAAgB,EAAE,CAAC","sourcesContent":["import type { Digest } from '@variance-authority/core';\nimport {\n  APPROVALS_PATH,\n  CHURN_PATH,\n  CURRENT_PATH,\n  FLAKINESS_PATH,\n  LAST_CHANGED_PATH,\n  OBSERVATIONS_PATH,\n  REACH_PATH,\n  VALUE_JOURNEY_PATH,\n} from '@variance-authority/history';\nimport { RasterStoreError, rasterFrom } from '@variance-authority/raster';\nimport {\n  HistoryWriteConflict,\n  churnFrom,\n  currentFrom,\n  flakinessFrom,\n  journeyFrom,\n  lastChangedFrom,\n  reachFrom,\n} from '@variance-authority/server';\nimport type { TribunalBindings } from './bindings.js';\nimport { createD1Backend } from './history.js';\nimport { ReviewError, createReviewStore } from './review.js';\nimport { createBucketStore } from './store.js';\nimport { UNAUTHENTICATED, grant, refuseWeakTokens, requires, type Granted } from './worker-auth.js';\nimport {\n  BadRequest,\n  Forbidden,\n  MethodNotAllowed,\n  asRecordBody,\n  count,\n  json,\n  optional,\n  requireMethod,\n  required,\n  string,\n} from './worker-http.js';\nimport {\n  asApprovals,\n  asBand,\n  asBuildIngest,\n  asCurrentRequest,\n  asDecision,\n  asIdentity,\n  asKey,\n  asRecordRequest,\n  windowOf,\n} from './worker-input.js';\n\n/**\n * One `fetch` handler, three surfaces, and no outbound call.\n *\n * The operator writes the Worker entry and hands this their bindings; everything\n * below is the composition. Two of the three surfaces are protocols defined\n * elsewhere and re-served here, so a CLI configured with\n * `baselines.kind: \"remote\"` and a client built from\n * `@variance-authority/history/client` both reach this deployment unchanged.\n *\n * ## The Worker never calls anything\n *\n * No status check, no pull-request comment, no webhook, no telemetry. The\n * pipeline reports to the server and the server reports to nobody. That is the\n * project's standing constraint, and it is also what keeps this deployment free\n * of a credential for somebody else's system: there is nothing here to steal that\n * is useful anywhere but here.\n *\n * ## Two tokens, and what each one is for\n *\n * `ingest` is written into CI configuration and can write builds, baselines and\n * history. `review` belongs to people and can read the review surface and decide.\n * They are separate because deciding *promotes a baseline*, and one secret doing\n * both means anything that can read a CI log can approve a regression.\n *\n * They may not be equal, and construction refuses it. A deployment that set both\n * to the same value would satisfy every check in this file while having exactly\n * one secret, and nothing in a request would show it.\n *\n * ## Authentication happens before routing\n *\n * A caller holding neither token gets one sentence, whatever it asked for,\n * including for paths that do not exist. The alternative — 404 for unknown paths,\n * 401 for known ones — hands an unauthorised caller a map of the API, and on a\n * subject-scoped path it answers \"that subject exists\" to somebody holding\n * nothing.\n *\n * The *capability* check happens after routing, and deliberately: it can only be\n * reached by someone already holding a valid token, so telling them which of the\n * two a route wants reveals nothing they could not learn by trying.\n *\n * ## What is next door\n *\n * The token comparison and the capability rule are in\n * [`worker-auth.ts`](./worker-auth.ts); the refusals and the readers every route\n * validates in are in [`worker-http.ts`](./worker-http.ts) and\n * [`worker-input.ts`](./worker-input.ts). What is left here is the composition and\n * the routing table, which is the part an operator has to read.\n */\n\nexport interface TribunalOptions extends TribunalBindings {\n  /** Scopes every row and object. One deployment, several repositories. */\n  readonly project: string;\n  /** Written into CI. Writes builds, baselines and history. At least 16 characters. */\n  readonly ingestToken: string;\n  /** Held by people. Reads the review surface and decides. At least 16 characters. */\n  readonly reviewToken: string;\n  /**\n   * Days of builds to keep when `POST /review/sweep` is called.\n   *\n   * Applied on request rather than on a timer, because a Worker has no timer and\n   * this package will not invent a cron the operator did not ask for. Wire it to a\n   * scheduled trigger, or call it from a CI job, or never.\n   */\n  readonly retentionDays?: number;\n  readonly now?: () => Date;\n}\n\n/**\n * The whole service, as one `fetch` handler.\n *\n * Deliberately nothing else. A handler is what a Worker exports, what a Next\n * route handler is, and what `node:http` can be adapted to in a dozen lines — so\n * the three deployments differ in their wiring and not in their router. It is\n * also the reason a `Tribunal` cannot be asked for its own tokens: a value with\n * one method has nothing to leak when it is logged.\n */\nexport interface Tribunal {\n  fetch(request: Request): Promise<Response>;\n}\n\n/**\n * The baseline-store routes, restated.\n *\n * They are `@variance-authority/remote`'s and must stay byte-identical to them —\n * a client and a server disagreeing about a URL is the class of failure that\n * presents as a verdict. They are *restated* rather than imported because that\n * package's entrypoint pulls in `node:http` to serve them, and a Worker bundle\n * that drags a Node HTTP server in to read five string constants has acquired a\n * dependency on a runtime it is not running on.\n *\n * The equality is a test, not a hope: `worker.test.ts` imports the constants from\n * `remote` and asserts these against them, so drift fails the suite rather than a\n * deployment.\n */\nconst BASELINE_FIND_PATH = '/baseline/find';\nconst BASELINE_DESCRIBE_PATH = '/baseline/describe';\nconst BASELINE_PUT_PATH = '/baseline/put';\nconst CACHE_FIND_PATH = '/cache/find';\nconst CACHE_PUT_PATH = '/cache/put';\n\n/**\n * Build the service over a database, a bucket and two tokens.\n *\n * Refuses a token under 16 characters and refuses two identical ones, here\n * rather than on the first request: a deployment whose ingest token also\n * promotes baselines is a misconfiguration that would otherwise be discovered by\n * the build log that used it.\n */\nexport function createTribunal(options: TribunalOptions): Tribunal {\n  refuseWeakTokens(options);\n\n  const baselines = createBucketStore(options);\n  const history = createD1Backend(options.db);\n  const review = createReviewStore(options);\n  const retentionDays = options.retentionDays ?? 30;\n\n  return {\n    async fetch(request: Request): Promise<Response> {\n      const granted = await grant(request, options);\n      if (granted === null) {\n        return json(401, { error: UNAUTHENTICATED }, { 'www-authenticate': 'Bearer' });\n      }\n\n      let url: URL;\n      try {\n        url = new URL(request.url);\n      } catch {\n        return json(400, { error: `\"${request.url}\" is not a request URL` });\n      }\n\n      try {\n        return await route({ baselines, history, review, retentionDays }, granted, url, request);\n      } catch (error) {\n        if (error instanceof BadRequest) return json(400, { error: error.message });\n        if (error instanceof Forbidden) return json(403, { error: error.message });\n        if (error instanceof MethodNotAllowed) {\n          return json(405, { error: error.message }, { allow: error.allow });\n        }\n        if (error instanceof HistoryWriteConflict) return json(409, { error: error.message });\n        if (error instanceof ReviewError) return json(422, { error: error.message });\n        // Reported as a failure and never as an empty answer. Every client in\n        // this project turns a non-2xx into a thrown error precisely so that a\n        // broken service cannot become the sentence \"no baseline\" or \"nothing has\n        // drifted\".\n        return json(500, { error: error instanceof Error ? error.message : String(error) });\n      }\n    },\n  };\n}\n\ninterface Surfaces {\n  readonly baselines: ReturnType<typeof createBucketStore>;\n  readonly history: ReturnType<typeof createD1Backend>;\n  readonly review: ReturnType<typeof createReviewStore>;\n  readonly retentionDays: number;\n}\n\nasync function route(\n  surfaces: Surfaces,\n  granted: Granted,\n  url: URL,\n  request: Request,\n): Promise<Response> {\n  const path = url.pathname;\n\n  // ------------------------------------------------------------- baselines\n  if (path === BASELINE_FIND_PATH) {\n    requires(granted, 'ingest', path);\n    requireMethod(request, 'POST');\n    const body = await asRecordBody(request);\n    const found = await surfaces.baselines.find(asKey(body['key']), asIdentity(body['identity']));\n    return json(200, { found });\n  }\n\n  if (path === BASELINE_DESCRIBE_PATH) {\n    requires(granted, 'ingest', path);\n    requireMethod(request, 'POST');\n    const body = await asRecordBody(request);\n    const described = await surfaces.baselines.describe(\n      asKey(body['key']),\n      asIdentity(body['identity']),\n    );\n    return json(200, { described });\n  }\n\n  if (path === BASELINE_PUT_PATH) {\n    requires(granted, 'ingest', path);\n    requireMethod(request, 'POST');\n    const body = await asRecordBody(request);\n    const raster = rasterFrom(body['raster']);\n    if (raster === null) throw new BadRequest('`raster` is not a raster');\n    await surfaces.baselines.put(asKey(body['key']), raster);\n    return json(200, { ok: true });\n  }\n\n  if (path === CACHE_FIND_PATH) {\n    requires(granted, 'ingest', path);\n    requireMethod(request, 'POST');\n    const body = await asRecordBody(request);\n    const digest = body['digest'];\n    if (typeof digest !== 'string') throw new BadRequest('`digest` must be a string');\n    const raster = await surfaces.baselines.renderCache.get(\n      digest as Digest,\n      asIdentity(body['identity']),\n    );\n    return json(200, { raster });\n  }\n\n  if (path === CACHE_PUT_PATH) {\n    requires(granted, 'ingest', path);\n    requireMethod(request, 'POST');\n    const body = await asRecordBody(request);\n    const raster = rasterFrom(body['raster']);\n    if (raster === null) throw new BadRequest('`raster` is not a raster');\n    await surfaces.baselines.renderCache.put(raster);\n    return json(200, { ok: true });\n  }\n\n  // --------------------------------------------------------------- history\n  const project = optional(url, 'project');\n\n  if (path === OBSERVATIONS_PATH) {\n    requires(granted, 'ingest', path);\n    requireMethod(request, 'POST');\n    const write = await asRecordRequest(request);\n    await surfaces.history.append(write.run, write.observations, write.tokens, write.instabilities);\n    // 204: the write left nothing to say, and the client treats any body on this\n    // route as a shape error rather than guessing at it.\n    return new Response(null, { status: 204 });\n  }\n\n  if (path === APPROVALS_PATH) {\n    requires(granted, 'ingest', path);\n    requireMethod(request, 'POST');\n    await surfaces.history.appendApprovals(await asApprovals(request));\n    return new Response(null, { status: 204 });\n  }\n\n  if (path === CURRENT_PATH) {\n    // A read, and still a POST, and still the ingest capability. Its argument is\n    // a subject list — three hundred subject ids in a query string is a 414 from\n    // a proxy nobody configured — and its caller is a run deciding what to write,\n    // not a person deciding what to ship (`CurrentRequest`).\n    requires(granted, 'ingest', path);\n    requireMethod(request, 'POST');\n    return json(200, await currentFrom(surfaces.history, project, await asCurrentRequest(request)));\n  }\n\n  if (path === LAST_CHANGED_PATH) {\n    readable(granted, path);\n    requireMethod(request, 'GET');\n    const band = optional(url, 'band');\n    return json(200, {\n      observation: await lastChangedFrom(\n        surfaces.history,\n        project,\n        required(url, 'subject'),\n        required(url, 'component'),\n        band === undefined ? undefined : asBand(band, 'the `band` parameter'),\n      ),\n    });\n  }\n\n  if (path === CHURN_PATH) {\n    readable(granted, path);\n    requireMethod(request, 'GET');\n    return json(\n      200,\n      await churnFrom(surfaces.history, project, required(url, 'component'), windowOf(url)),\n    );\n  }\n\n  if (path === VALUE_JOURNEY_PATH) {\n    readable(granted, path);\n    requireMethod(request, 'GET');\n    return json(\n      200,\n      await journeyFrom(surfaces.history, project, required(url, 'token'), windowOf(url)),\n    );\n  }\n\n  if (path === REACH_PATH) {\n    readable(granted, path);\n    requireMethod(request, 'GET');\n    return json(\n      200,\n      await reachFrom(surfaces.history, project, required(url, 'component'), windowOf(url)),\n    );\n  }\n\n  if (path === FLAKINESS_PATH) {\n    readable(granted, path);\n    requireMethod(request, 'GET');\n    return json(\n      200,\n      await flakinessFrom(surfaces.history, project, required(url, 'subject'), windowOf(url)),\n    );\n  }\n\n  // ---------------------------------------------------------------- review\n  if (path === '/review/builds' && request.method === 'POST') {\n    // The one review route the ingest token owns, and the only one it owns:\n    // posting a build is what CI does, and everything else on this surface is\n    // what a person does.\n    requires(granted, 'ingest', path);\n    await surfaces.review.ingest(await asBuildIngest(request));\n    return json(201, { ok: true });\n  }\n\n  if (path === '/review/builds') {\n    requires(granted, 'review', path);\n    requireMethod(request, 'GET');\n    const limit = optional(url, 'limit');\n    return json(200, { builds: await surfaces.review.builds(limit === undefined ? undefined : count(limit)) });\n  }\n\n  if (path === '/review/changelog') {\n    requires(granted, 'review', path);\n    requireMethod(request, 'GET');\n    const limit = optional(url, 'limit');\n    return json(\n      200,\n      await surfaces.review.changelog({\n        ...(optional(url, 'component') !== undefined\n          ? { component: required(url, 'component') }\n          : {}),\n        ...(optional(url, 'subject') !== undefined ? { subject: required(url, 'subject') } : {}),\n        ...(optional(url, 'since') !== undefined ? { since: required(url, 'since') } : {}),\n        ...(limit !== undefined ? { limit: count(limit) } : {}),\n      }),\n    );\n  }\n\n  if (path === '/review/sweep') {\n    requires(granted, 'review', path);\n    requireMethod(request, 'POST');\n    const days = optional(url, 'days');\n    // Reported rather than performed silently. An operator who cannot see what a\n    // sweep removed cannot tell a working retention policy from one deleting a\n    // build a day.\n    return json(200, await surfaces.review.sweep(days === undefined ? surfaces.retentionDays : count(days)));\n  }\n\n  const build = /^\\/review\\/builds\\/([^/]+)$/.exec(path);\n  if (build?.[1] !== undefined) {\n    requires(granted, 'review', path);\n    requireMethod(request, 'GET');\n    const detail = await surfaces.review.build(decodeURIComponent(build[1]));\n    return detail === null\n      ? json(404, { error: `no build \"${decodeURIComponent(build[1])}\" in this project` })\n      : json(200, detail);\n  }\n\n  const decision = /^\\/review\\/builds\\/([^/]+)\\/subjects\\/([^/]+)\\/decision$/.exec(path);\n  if (decision?.[1] !== undefined && decision[2] !== undefined) {\n    requires(granted, 'review', path);\n    requireMethod(request, 'POST');\n    const body = await asRecordBody(request);\n    return json(\n      200,\n      await surfaces.review.decide({\n        build: decodeURIComponent(decision[1]),\n        subject: decodeURIComponent(decision[2]),\n        decision: asDecision(body['decision']),\n        by: string(body, 'by', 'the decision'),\n        ...(typeof body['note'] === 'string' && body['note'] !== '' ? { note: body['note'] } : {}),\n      }),\n    );\n  }\n\n  const image = /^\\/review\\/builds\\/([^/]+)\\/subjects\\/([^/]+)\\/(before|after|diff)\\.png$/.exec(path);\n  if (image?.[1] !== undefined && image[2] !== undefined && image[3] !== undefined) {\n    requires(granted, 'review', path);\n    requireMethod(request, 'GET');\n    const bytes = await surfaces.review.image(\n      decodeURIComponent(image[1]),\n      decodeURIComponent(image[2]),\n      image[3] as 'before' | 'after' | 'diff',\n    );\n    if (bytes === null) return json(404, { error: 'this build kept no such image' });\n    return new Response(bytes, {\n      headers: {\n        'content-type': 'image/png',\n        // A build's images never change: the row is written once and the object\n        // with it. Anything a reviewer reloads is fetched again for nothing.\n        'cache-control': 'private, max-age=31536000, immutable',\n      },\n    });\n  }\n\n  return json(404, {\n    error:\n      `no route for ${request.method} ${path}. This deployment answers the baseline routes ` +\n      `(${BASELINE_FIND_PATH}, ${BASELINE_DESCRIBE_PATH}, ${BASELINE_PUT_PATH}, ` +\n      `${CACHE_FIND_PATH}, ${CACHE_PUT_PATH}), the history routes (${OBSERVATIONS_PATH}, ` +\n      `${APPROVALS_PATH}, ${CURRENT_PATH}, ${LAST_CHANGED_PATH}, ${CHURN_PATH}, ` +\n      `${FLAKINESS_PATH}, ${VALUE_JOURNEY_PATH}, ${REACH_PATH}) and /review/builds and ` +\n      '/review/changelog. A path from a different API version is a client and a service that ' +\n      'disagree about a recorded shape',\n  });\n}\n\n/**\n * The history routes that answer a question rather than record one.\n *\n * Either capability may ask. The split everywhere else in this file is *who is\n * allowed to write*, and these five write nothing: churn, reach, flakiness, the\n * value journey and the last change are derived from rows already recorded. A\n * reviewer looking at a build needs exactly these to know whether the difference\n * in front of them is the third this week or the first this year, and the browser\n * that draws that page holds the review token — so refusing them here would mean\n * a review surface that can approve a change it cannot put in context.\n *\n * It stays a rule with a name rather than an omitted check, because the next\n * history route added is a write far more often than it is a read, and the\n * default has to be the strict one.\n */\nfunction readable(granted: Granted, path: string): void {\n  if (granted !== 'ingest') requires(granted, 'review', path);\n}\n\n/** Re-exported so a Worker entry can recognise a store failure without a second import. */\nexport { RasterStoreError };\n"]}

package/mark.svg

@@ -0,0 +1,30 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 320" role="img" aria-labelledby="title desc">
+  <title id="title">Variance Authority mark</title>
+  <desc id="desc">Folded ribbon VA mark in charcoal and orange.</desc>
+
+  <defs>
+    <style>
+      .ribbon-dark {
+        fill: #24282A;
+      }
+
+      @media (prefers-color-scheme: dark) {
+        .ribbon-dark {
+          fill: #F3F4F6;
+        }
+      }
+    </style>
+  </defs>
+
+  <!-- Left descending ribbon -->
+  <path class="ribbon-dark" d="M64 54H159L256 266H160Z"/>
+
+  <!-- Right descending ribbon -->
+  <path class="ribbon-dark" d="M331 28H419L494 266H397Z"/>
+
+  <!-- Chosen / variant ribbon -->
+  <path d="M256 266L202 152L283 28H376L301 165Z" fill="#FF4A19"/>
+
+  <!-- Fold shadow -->
+  <path d="M202 152L256 266L301 165L264 103Z" fill="#D83A13" opacity="0.72"/>
+</svg>

package/migrations/0001_initial.sql

@@ -0,0 +1,193 @@
+-- Generated from packages/tribunal/src/schema.ts by tools/tribunal-migrations.mjs.
+-- Do not edit. `migrations.test.ts` fails when this file and the array disagree.
+-- Schema version 3.
+
+CREATE TABLE schema_version (
+     version INTEGER NOT NULL
+   ) STRICT;
+INSERT INTO schema_version (version) VALUES (3);
+CREATE TABLE baselines (
+     project         TEXT NOT NULL,
+     identity_digest TEXT NOT NULL,
+     subject         TEXT NOT NULL,
+     label           TEXT NOT NULL,
+     identity        TEXT NOT NULL,
+     document_digest TEXT NOT NULL,
+     width           INTEGER NOT NULL,
+     height          INTEGER NOT NULL,
+     missing_fonts   TEXT NOT NULL,
+     object_key      TEXT NOT NULL,
+     at              TEXT NOT NULL,
+     at_ms           INTEGER NOT NULL,
+     PRIMARY KEY (project, identity_digest, subject, label)
+   ) STRICT;
+CREATE INDEX baselines_across_identities ON baselines (project, subject, label, at_ms DESC);
+CREATE TABLE render_cache (
+     project         TEXT NOT NULL,
+     identity_digest TEXT NOT NULL,
+     document_digest TEXT NOT NULL,
+     identity        TEXT NOT NULL,
+     width           INTEGER NOT NULL,
+     height          INTEGER NOT NULL,
+     missing_fonts   TEXT NOT NULL,
+     object_key      TEXT NOT NULL,
+     at_ms           INTEGER NOT NULL,
+     PRIMARY KEY (project, identity_digest, document_digest)
+   ) STRICT;
+CREATE TABLE builds (
+     project           TEXT NOT NULL,
+     build             TEXT NOT NULL,
+     "commit"          TEXT NOT NULL,
+     branch            TEXT,
+     intent            TEXT,
+     at                TEXT NOT NULL,
+     at_ms             INTEGER NOT NULL,
+     identity          TEXT NOT NULL,
+     identity_digest   TEXT NOT NULL,
+     retention         TEXT NOT NULL,
+     run_version       INTEGER NOT NULL,
+     says_not_observed INTEGER NOT NULL,
+     PRIMARY KEY (project, build)
+   ) STRICT;
+CREATE INDEX builds_recent ON builds (project, at_ms DESC);
+CREATE TABLE build_subjects (
+     project        TEXT NOT NULL,
+     build          TEXT NOT NULL,
+     subject        TEXT NOT NULL,
+     verdict        TEXT NOT NULL,
+     because        TEXT NOT NULL,
+     changed_pixels INTEGER NOT NULL,
+     regions        TEXT NOT NULL,
+     truncated      TEXT,
+     missing_fonts  TEXT,
+     findings       TEXT,
+     before_key     TEXT,
+     after_key      TEXT,
+     diff_key       TEXT,
+     candidate_document_digest TEXT,
+     candidate_width           INTEGER,
+     candidate_height          INTEGER,
+     candidate_missing_fonts   TEXT,
+     PRIMARY KEY (project, build, subject)
+   ) STRICT;
+CREATE TABLE build_not_observed (
+     project TEXT NOT NULL,
+     build   TEXT NOT NULL,
+     subject TEXT NOT NULL,
+     kind    TEXT NOT NULL,
+     because TEXT NOT NULL,
+     PRIMARY KEY (project, build, subject)
+   ) STRICT;
+CREATE TABLE decisions (
+     seq       INTEGER PRIMARY KEY AUTOINCREMENT,
+     project   TEXT NOT NULL,
+     build     TEXT NOT NULL,
+     subject   TEXT NOT NULL,
+     decision  TEXT NOT NULL,
+     decided_by TEXT NOT NULL,
+     note      TEXT,
+     at        TEXT NOT NULL,
+     at_ms     INTEGER NOT NULL
+   ) STRICT;
+CREATE INDEX decisions_latest ON decisions (project, build, subject, seq DESC);
+CREATE TRIGGER decisions_are_append_only BEFORE UPDATE ON decisions BEGIN
+     SELECT RAISE(ABORT, 'decisions are append-only: a rewritten decision erases the review it replaced, and the earlier one is what makes the later one reviewable');
+   END;
+CREATE TRIGGER decisions_are_permanent BEFORE DELETE ON decisions BEGIN
+     SELECT RAISE(ABORT, 'decisions are append-only: a deleted approval leaves a promoted baseline nobody can attribute to anyone');
+   END;
+CREATE TABLE runs (
+     project  TEXT NOT NULL,
+     run      TEXT NOT NULL,
+     "commit" TEXT NOT NULL,
+     profile  TEXT NOT NULL,
+     at       TEXT NOT NULL,
+     at_ms    INTEGER NOT NULL,
+     -- Nullable, and the null is load-bearing: a run that never said what it
+     -- examined must not be read as one that examined nothing, because that
+     -- number becomes the denominator of a flake rate.
+     swept    INTEGER
+   ) STRICT;
+CREATE UNIQUE INDEX runs_identity ON runs (project, run, profile);
+CREATE INDEX runs_window ON runs (project, at_ms);
+CREATE TABLE observations (
+     project   TEXT NOT NULL,
+     subject   TEXT NOT NULL,
+     component TEXT NOT NULL,
+     band      TEXT NOT NULL,
+     hash      TEXT NOT NULL,
+     profile   TEXT NOT NULL,
+     "commit"  TEXT NOT NULL,
+     run       TEXT NOT NULL,
+     at        TEXT NOT NULL,
+     at_ms     INTEGER NOT NULL,
+     accepted  INTEGER NOT NULL,
+     file      TEXT
+   ) STRICT;
+CREATE INDEX observations_area      ON observations (project, subject, component, band, at_ms);
+CREATE INDEX observations_component ON observations (project, component, at_ms);
+CREATE INDEX observations_reach     ON observations (project, component, subject, at_ms);
+CREATE TABLE token_values (
+     project  TEXT NOT NULL,
+     token    TEXT NOT NULL,
+     value    TEXT NOT NULL,
+     "commit" TEXT NOT NULL,
+     at       TEXT NOT NULL,
+     at_ms    INTEGER NOT NULL,
+     run      TEXT NOT NULL,
+     accepted INTEGER NOT NULL
+   ) STRICT;
+CREATE INDEX token_values_journey ON token_values (project, token, at_ms);
+CREATE TABLE instabilities (
+     project     TEXT NOT NULL,
+     subject     TEXT NOT NULL,
+     component   TEXT,
+     band        TEXT,
+     profile     TEXT NOT NULL,
+     "commit"    TEXT NOT NULL,
+     run         TEXT NOT NULL,
+     at          TEXT NOT NULL,
+     at_ms       INTEGER NOT NULL,
+     absorbed_by TEXT
+   ) STRICT;
+CREATE INDEX instabilities_subject ON instabilities (project, subject, at_ms);
+CREATE TABLE approvals (
+     project  TEXT NOT NULL,
+     subject  TEXT NOT NULL,
+     run      TEXT NOT NULL,
+     at       TEXT NOT NULL,
+     at_ms    INTEGER NOT NULL,
+     approver TEXT
+   ) STRICT;
+CREATE UNIQUE INDEX approvals_identity ON approvals (project, subject, run);
+CREATE INDEX approvals_window ON approvals (project, at_ms);
+CREATE TRIGGER runs_are_append_only BEFORE UPDATE ON runs BEGIN
+     SELECT RAISE(ABORT, 'runs are append-only: a recorded run is a fact about a moment, and rewriting one changes a denominator somebody already read');
+   END;
+CREATE TRIGGER runs_are_permanent BEFORE DELETE ON runs BEGIN
+     SELECT RAISE(ABORT, 'runs are append-only: deleting a quiet run inflates every rate computed over its window');
+   END;
+CREATE TRIGGER observations_are_append_only BEFORE UPDATE ON observations BEGIN
+     SELECT RAISE(ABORT, 'observations are append-only: two hashes for one key are two rows, and an update is the merge this store exists to avoid');
+   END;
+CREATE TRIGGER observations_are_permanent BEFORE DELETE ON observations BEGIN
+     SELECT RAISE(ABORT, 'observations are append-only: a deleted change is a change nobody can ever ask about again');
+   END;
+CREATE TRIGGER token_values_are_append_only BEFORE UPDATE ON token_values BEGIN
+     SELECT RAISE(ABORT, 'token values are append-only: a rewritten value breaks the journey that was the reason for keeping it');
+   END;
+CREATE TRIGGER token_values_are_permanent BEFORE DELETE ON token_values BEGIN
+     SELECT RAISE(ABORT, 'token values are append-only: a removed step turns a drift total into a lower bound with nothing saying so');
+   END;
+CREATE TRIGGER instabilities_are_append_only BEFORE UPDATE ON instabilities BEGIN
+     SELECT RAISE(ABORT, 'instabilities are append-only: an occurrence is a fact about one run, and rewriting one changes a rate somebody already acted on');
+   END;
+CREATE TRIGGER instabilities_are_permanent BEFORE DELETE ON instabilities BEGIN
+     SELECT RAISE(ABORT, 'instabilities are append-only: deleting an occurrence is how a flake that was fixed becomes a flake that never happened');
+   END;
+CREATE TRIGGER approvals_are_append_only BEFORE UPDATE ON approvals BEGIN
+     SELECT RAISE(ABORT, 'approvals are append-only: a rewritten acceptance changes what a reviewer agreed to after they agreed to it');
+   END;
+CREATE TRIGGER approvals_are_permanent BEFORE DELETE ON approvals BEGIN
+     SELECT RAISE(ABORT, 'approvals are append-only: a deleted acceptance turns a reviewed change back into an unreviewed one, and every drift total over it drops');
+   END;

package/migrations/0002_changelog.sql

@@ -0,0 +1,30 @@
+-- Generated from packages/tribunal/src/schema.ts by tools/tribunal-migrations.mjs.
+-- Do not edit. `migrations.test.ts` fails when this file and the array disagree.
+-- Schema version 4.
+
+CREATE TABLE changelog (
+       seq            INTEGER PRIMARY KEY AUTOINCREMENT,
+       project        TEXT NOT NULL,
+       build          TEXT NOT NULL,
+       subject        TEXT NOT NULL,
+       "commit"       TEXT NOT NULL,
+       intent         TEXT,
+       decided_by     TEXT NOT NULL,
+       note           TEXT,
+       -- The region list the build reported, frozen. Shapes are grouped when
+       -- somebody reads: approval here is per subject, so there is no batch at
+       -- write time to cluster, and a shape approved across three sessions should
+       -- still read as one change.
+       regions        TEXT NOT NULL,
+       at             TEXT NOT NULL,
+       at_ms          INTEGER NOT NULL
+     ) STRICT;
+CREATE INDEX changelog_recent ON changelog (project, at_ms DESC);
+CREATE INDEX changelog_subject ON changelog (project, subject, at_ms DESC);
+CREATE TRIGGER changelog_is_append_only BEFORE UPDATE ON changelog BEGIN
+       SELECT RAISE(ABORT, 'the changelog is append-only: an edited explanation is an explanation of a baseline that was promoted for a different reason');
+     END;
+CREATE TRIGGER changelog_is_permanent BEFORE DELETE ON changelog BEGIN
+       SELECT RAISE(ABORT, 'the changelog is append-only: a deleted entry leaves a baseline nobody can account for, which is the state this table exists to end');
+     END;
+UPDATE schema_version SET version = 4;

package/migrations/0003_accessibility.sql

@@ -0,0 +1,8 @@
+-- Generated from packages/tribunal/src/schema.ts by tools/tribunal-migrations.mjs.
+-- Do not edit. `migrations.test.ts` fails when this file and the array disagree.
+-- Schema version 5.
+
+ALTER TABLE baselines ADD COLUMN accessibility TEXT;
+ALTER TABLE build_subjects ADD COLUMN signals TEXT;
+ALTER TABLE build_subjects ADD COLUMN candidate_accessibility TEXT;
+UPDATE schema_version SET version = 5;

package/migrations/0004_variations.sql

@@ -0,0 +1,19 @@
+-- Generated from packages/tribunal/src/schema.ts by tools/tribunal-migrations.mjs.
+-- Do not edit. `migrations.test.ts` fails when this file and the array disagree.
+-- Schema version 6.
+
+CREATE TABLE build_variations (
+       project    TEXT NOT NULL,
+       build      TEXT NOT NULL,
+       subject    TEXT NOT NULL,
+       parent     TEXT,
+       identical  INTEGER,
+       bands      TEXT,
+       unobserved TEXT,
+       components TEXT,
+       digest     TEXT,
+       how        TEXT,
+       because    TEXT NOT NULL,
+       PRIMARY KEY (project, build, subject)
+     ) STRICT;
+UPDATE schema_version SET version = 6;