@void/platform 0.28.0 → 1.0.3

package/dist/browser-page.mjs

@@ -37,7 +37,8 @@ html[data-theme="dark"] { color-scheme: dark; }
 .void-auth-page p { margin: 0; font: inherit; color: var(--auth-secondary); overflow-wrap: anywhere; }
 .void-auth-page strong { font-weight: 600; color: var(--auth-text); }
 .void-auth-page a:not(.void-auth-button) { color: var(--auth-text); text-underline-offset: 3px; }
-.void-auth-page .void-auth-actions { display: grid; gap: 12px; }
+.void-auth-page form { display: grid; gap: 12px; }
+.void-auth-page .void-auth-actions { display: grid; gap: 8px; }
 .void-auth-page .void-auth-button { display: flex; align-items: center; justify-content: center; width: 100%; min-height: 44px; padding: 10px 16px; border: 1px solid var(--auth-border); border-radius: var(--auth-radius-element); background: var(--auth-body); color: var(--auth-text); font: inherit; font-weight: 550; line-height: 1.4; text-align: center; text-decoration: none; overflow-wrap: anywhere; cursor: pointer; }
 .void-auth-page .void-auth-button-primary { background: var(--auth-accent); color: var(--auth-on-accent); border-color: var(--auth-accent); }
 .void-auth-page .void-auth-button:hover { filter: brightness(.92); }

package/dist/index.d.mts

@@ -1,6 +1,23 @@
 import { BUILD_INSTANCE_FREE, BUILD_INSTANCE_LARGE, BuildInstanceType, BuiltinPlanId, EditablePlanLimit, PLAN_EDITABLE_LIMIT_KEYS, PLAN_LIMITS, PlanId, PlanLimits, PlanLimitsPatch, PlatformPlanCatalog, PlatformPlanDefinition, PlatformPlanReconciliation, createDefaultPlanCatalog, parseBuildInstanceType, parsePlanLimitsPatch, parsePlanName, parsePlatformPlanCatalog, parsePlatformPlanId, validatePlanLimits } from "./plans.mjs";
+//#region src/access-policy.d.ts
+/** An exact email domain, such as `example.com`, without wildcards or an `@`. */
+export declare function isPlatformAccessEmailDomain(value: unknown): value is string;
+/** Whether signing in with this Access identity provider proves a company identity. */
+export declare function isPlatformAccessCompanyIdentityProvider(provider: Readonly<Record<string, unknown>>): boolean;
+/**
+ * Whether one Access include or require rule restricts people to company
+ * identities. The installer checks the policies that protect the platform and
+ * the API checks project Zero Trust policies with this same rule list.
+ *
+ * A `login_method` rule admits everyone who can use the identity provider it
+ * names, so it counts only when `companyLoginMethod` accepts that provider ID.
+ */
+export declare function isPlatformAccessIdentityRule(rule: Readonly<Record<string, unknown>>, companyLoginMethod: (identityProviderId: string) => boolean): boolean;
+//#endregion
 //#region src/app-access.d.ts
 export declare const PLATFORM_APP_ACCESS_SETUP_PROOF_PREFIX = "void-platform-app-access-v1";
+/** Uninstall handoff that turns off installer-managed project Zero Trust before any user exists. */
+export declare const PLATFORM_APP_ACCESS_TURN_OFF_PROOF_PREFIX = "void-platform-app-access-turn-off-v1";
 /** Installer handoff. Token values belong only in encrypted recovery and request bodies. */
 type PlatformAppAccessSetup = Readonly<{
   version: 1;

package/dist/index.mjs

@@ -1,7 +1,62 @@
 import { a as isSourceRevision, c as requiredString, i as isSandboxDrainProtocol, n as isPrintableText, o as isUsageProtocolVersion, s as record, t as assertRecord } from "./validate-DbJR7Q0Z.mjs";
 import { BUILD_INSTANCE_FREE, BUILD_INSTANCE_LARGE, PLAN_EDITABLE_LIMIT_KEYS, PLAN_LIMITS, createDefaultPlanCatalog, parseBuildInstanceType, parsePlanLimitsPatch, parsePlanName, parsePlatformPlanCatalog, parsePlatformPlanId, validatePlanLimits } from "./plans.mjs";
+//#region src/access-policy.ts
+const COMPANY_IDENTITY_RULES = [
+	"email_list",
+	"gsuite",
+	"github-organization",
+	"saml",
+	"okta",
+	"azureAD",
+	"auth_context",
+	"group"
+];
+const COMPANY_IDENTITY_PROVIDER_TYPES = /* @__PURE__ */ new Set([
+	"azureAD",
+	"centrify",
+	"google-apps",
+	"okta",
+	"onelogin",
+	"pingone"
+]);
+function plainObject(value) {
+	return !!value && typeof value === "object" && !Array.isArray(value);
+}
+/** An exact email domain, such as `example.com`, without wildcards or an `@`. */
+function isPlatformAccessEmailDomain(value) {
+	return typeof value === "string" && /^(?:[a-z0-9-]+\.)+[a-z]{2,63}$/i.test(value);
+}
+/** Whether signing in with this Access identity provider proves a company identity. */
+function isPlatformAccessCompanyIdentityProvider(provider) {
+	if (provider.type === "cloudflare") return plainObject(provider.config) && provider.config.restrict_to_account_members === true;
+	return COMPANY_IDENTITY_PROVIDER_TYPES.has(provider.type);
+}
+/**
+* Whether one Access include or require rule restricts people to company
+* identities. The installer checks the policies that protect the platform and
+* the API checks project Zero Trust policies with this same rule list.
+*
+* A `login_method` rule admits everyone who can use the identity provider it
+* names, so it counts only when `companyLoginMethod` accepts that provider ID.
+*/
+function isPlatformAccessIdentityRule(rule, companyLoginMethod) {
+	if (rule.email_domain) return plainObject(rule.email_domain) && isPlatformAccessEmailDomain(rule.email_domain.domain);
+	if (rule.email) return plainObject(rule.email) && typeof rule.email.email === "string" && /^[^\s*@]+@[^\s*@]+\.[^\s*@]+$/.test(rule.email.email);
+	if (rule.login_method) return plainObject(rule.login_method) && typeof rule.login_method.id === "string" && companyLoginMethod(rule.login_method.id);
+	if (rule.cloudflare_account_member) {
+		const member = rule.cloudflare_account_member;
+		return plainObject(member) && (member.account_id === void 0 || typeof member.account_id === "string" && /^[0-9a-f]{32}$/i.test(member.account_id));
+	}
+	return COMPANY_IDENTITY_RULES.some((key) => {
+		const value = Object.hasOwn(rule, key) ? rule[key] : void 0;
+		return plainObject(value) && Object.keys(value).length > 0;
+	});
+}
+//#endregion
 //#region src/app-access.ts
 const PLATFORM_APP_ACCESS_SETUP_PROOF_PREFIX = "void-platform-app-access-v1";
+/** Uninstall handoff that turns off installer-managed project Zero Trust before any user exists. */
+const PLATFORM_APP_ACCESS_TURN_OFF_PROOF_PREFIX = "void-platform-app-access-turn-off-v1";
 function parsePlatformAppAccessSetup(value) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Invalid app access setup.");
 	const input = value;
@@ -1342,4 +1397,4 @@ function createPlatformWorkerConfigs(input) {
 	};
 }
 //#endregion
-export { BUILD_INSTANCE_FREE, BUILD_INSTANCE_LARGE, DEFAULT_PLATFORM_SESSION_SECONDS, GOOGLE_OIDC_ISSUER, PLAN_EDITABLE_LIMIT_KEYS, PLAN_LIMITS, PLATFORM_APPLICATION_KEY, PLATFORM_APP_ACCESS_SETUP_PROOF_PREFIX, PLATFORM_AUTH_SETUP_PROOF_PREFIX, PLATFORM_DEPLOYMENT_SCHEMA_VERSION, PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_DISCOVERY_SCHEMA_VERSION, PLATFORM_HEALTH_HOSTNAME_LABEL, PLATFORM_INSTALLATION_SCHEMA_VERSION, PLATFORM_LOGIN_KINDS, PLATFORM_PROJECT_INGRESS_SOURCE, PLATFORM_R2_OWNERSHIP_MARKER_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, PLATFORM_RESOURCE_OWNERSHIP_SCHEMA_VERSION, PLATFORM_SANDBOX_DRAIN_KEY, PLATFORM_USAGE_PROTOCOL_VERSION, createApplicationRoutes, createDefaultPlanCatalog, createPlatformDeploymentManifest, createPlatformDiscoveryDocument, createPlatformInstallationManifest, createPlatformResourceNames, createPlatformResourceOwnershipMarker, createPlatformWorkerConfigs, isPlatformSignupAllowed, normalizeApplicationDomain, normalizeInstallationSlug, normalizePlatformDashboardUrl, parseBuildInstanceType, parsePlanLimitsPatch, parsePlanName, parsePlatformAccessProtection, parsePlatformAdmissionPolicy, parsePlatformAppAccessSetup, parsePlatformAuthenticationSetup, parsePlatformDeploymentManifest, parsePlatformDiscoveryDocument, parsePlatformIdentityUrl, parsePlatformInstallationManifest, parsePlatformLifecycleOperation, parsePlatformLoginConfiguration, parsePlatformLoginDescriptor, parsePlatformLoginId, parsePlatformPlanCatalog, parsePlatformPlanId, parsePlatformResourceOwnershipMarker, parsePlatformSignupAllowlistEntry, platformAuthenticationRecoveryMessage, platformDashboardUrl, platformHealthHostname, platformProjectHostname, platformProjectHostnames, platformProjectIngressName, platformProjectIngressPrefix, platformProjectWorkersDevHostname, platformProtectionProofMessage, platformWorkersDevAliasKey, readPlatformApplication, recordInstallationResource, recordInstallationStep, resolvePlatformApplicationEnvironment, setInstallationDesiredState, setInstallationEndpoints, transitionInstallation, validatePlanLimits, validatePlatformAdmissionPolicy };
+export { BUILD_INSTANCE_FREE, BUILD_INSTANCE_LARGE, DEFAULT_PLATFORM_SESSION_SECONDS, GOOGLE_OIDC_ISSUER, PLAN_EDITABLE_LIMIT_KEYS, PLAN_LIMITS, PLATFORM_APPLICATION_KEY, PLATFORM_APP_ACCESS_SETUP_PROOF_PREFIX, PLATFORM_APP_ACCESS_TURN_OFF_PROOF_PREFIX, PLATFORM_AUTH_SETUP_PROOF_PREFIX, PLATFORM_DEPLOYMENT_SCHEMA_VERSION, PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_DISCOVERY_SCHEMA_VERSION, PLATFORM_HEALTH_HOSTNAME_LABEL, PLATFORM_INSTALLATION_SCHEMA_VERSION, PLATFORM_LOGIN_KINDS, PLATFORM_PROJECT_INGRESS_SOURCE, PLATFORM_R2_OWNERSHIP_MARKER_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, PLATFORM_RESOURCE_OWNERSHIP_SCHEMA_VERSION, PLATFORM_SANDBOX_DRAIN_KEY, PLATFORM_USAGE_PROTOCOL_VERSION, createApplicationRoutes, createDefaultPlanCatalog, createPlatformDeploymentManifest, createPlatformDiscoveryDocument, createPlatformInstallationManifest, createPlatformResourceNames, createPlatformResourceOwnershipMarker, createPlatformWorkerConfigs, isPlatformAccessCompanyIdentityProvider, isPlatformAccessEmailDomain, isPlatformAccessIdentityRule, isPlatformSignupAllowed, normalizeApplicationDomain, normalizeInstallationSlug, normalizePlatformDashboardUrl, parseBuildInstanceType, parsePlanLimitsPatch, parsePlanName, parsePlatformAccessProtection, parsePlatformAdmissionPolicy, parsePlatformAppAccessSetup, parsePlatformAuthenticationSetup, parsePlatformDeploymentManifest, parsePlatformDiscoveryDocument, parsePlatformIdentityUrl, parsePlatformInstallationManifest, parsePlatformLifecycleOperation, parsePlatformLoginConfiguration, parsePlatformLoginDescriptor, parsePlatformLoginId, parsePlatformPlanCatalog, parsePlatformPlanId, parsePlatformResourceOwnershipMarker, parsePlatformSignupAllowlistEntry, platformAuthenticationRecoveryMessage, platformDashboardUrl, platformHealthHostname, platformProjectHostname, platformProjectHostnames, platformProjectIngressName, platformProjectIngressPrefix, platformProjectWorkersDevHostname, platformProtectionProofMessage, platformWorkersDevAliasKey, readPlatformApplication, recordInstallationResource, recordInstallationStep, resolvePlatformApplicationEnvironment, setInstallationDesiredState, setInstallationEndpoints, transitionInstallation, validatePlanLimits, validatePlatformAdmissionPolicy };