primitive-admin 1.2.0-alpha.0 → 1.2.0-alpha.10

package/dist/src/lib/schema-codegen/schemaToTs.js

@@ -0,0 +1,305 @@
+/**
+ * JSON-Schema → TypeScript converter shared by `functions codegen` and the
+ * prompt codegen (issue #1442, written for `workflows codegen`, which #3190
+ * retired).
+ *
+ * An `inputSchema`/`outputSchema` is real JSON Schema. This converter
+ * types only the subset the server's validator descends into — and it reads
+ * that interpretation from the SAME descriptor the server validator consumes,
+ * vendored into the CLI as `generated-schema-descriptor.ts` (a byte copy of
+ * `src/function-runs/schema-descriptor.ts`, kept fresh by
+ * `cli/scripts/gen-schema-descriptor.mjs` + its drift guard). So the
+ * generated type and the runtime validation can never disagree on:
+ *
+ *   - `type` single scalar (`string`/`number`/`integer`/`boolean`/`null`) →
+ *     the mapped TS scalar.
+ *   - `type` array-union — only when every member is a scalar/`null` → a TS
+ *     union. A union that contains `object` or `array` renders `unknown`,
+ *     because the server only walks `properties`/`items` for the bare string
+ *     `"object"`/`"array"` — a union is never descended, so a precise-looking
+ *     type would over-promise.
+ *   - `enum` → a scalar-literal union, intersected with the declared `type`
+ *     first (the server gates on `type` before checking `enum`).
+ *   - `type: "object"` with `properties` → a nested object type; `required[]`
+ *     drives `name:` vs `name?:`. An OPEN object (no `additionalProperties:
+ *     false`) also emits `[key: string]: unknown` so extra keys the runtime
+ *     validator accepts don't hit TS excess-property errors; a CLOSED object
+ *     (`additionalProperties: false`) omits the index signature.
+ *   - `type: "array"` with `items` → `T[]`.
+ *   - `oneOf` whose members are ALL `type: "object"` → a discriminated
+ *     (tagged) union: the `|`-union of member object types, keyed by an
+ *     auto-detected single-literal-`enum` discriminator (#1511). A defective
+ *     all-object tagged union (no/ambiguous discriminator, <2 members) or an
+ *     all-object `anyOf` (unsupported in v1) is a STRICT codegen error, not a
+ *     silent `unknown` (Fork 3, resolved by the maintainer).
+ *
+ * Everything else the server ignores (`$ref`, `allOf`, `format`,
+ * `patternProperties`, numeric constraints, tuple `items`, and a `oneOf`/`anyOf`
+ * whose members are NOT all objects) renders `unknown`.
+ *
+ * Errors are NOT swallowed here — a malformed schema fails upstream at parse
+ * time, and a defective tagged union throws — this walker otherwise returns
+ * `unknown` for anything it does not recognize.
+ *
+ * FORMATTING CONTRACT (#1565): the types emitted here must be a fixed point of
+ * Prettier's DEFAULT config, since `workflows codegen --check` byte-compares
+ * the emission against disk. Long unions therefore render through
+ * `codegen-shared/prettierStable.ts` (which reproduces Prettier's width
+ * decision) instead of being joined with `" | "`. There is no Prettier
+ * dependency and no automated round-trip test, so verify any change to these
+ * shapes by hand — see that module's header.
+ */
+import { describeSchema, isType, } from "./generated-schema-descriptor.js";
+import { arrayOf, atom, block, indent as pad2, printType, recordOf, renderMember, tsStringLiteral, union, } from "../codegen-shared/prettierStable.js";
+/** Scalar JSON-schema types this converter maps to a concrete TS scalar. */
+const SCALAR_TS = {
+    string: "string",
+    number: "number",
+    integer: "number",
+    boolean: "boolean",
+    null: "null",
+};
+/** A shared empty-object reference for the `{}`-rejection probe below. */
+const EMPTY_OBJECT = Object.freeze({});
+/**
+ * Render a scalar-literal union from an `enum` array. A string member is
+ * emitted via `tsStringLiteral` (Prettier's quote choice, #1565); a number,
+ * boolean, or `null` via `JSON.stringify`, which is already a Prettier fixed
+ * point for those. An object/array member has no TS literal form, so the whole
+ * enum falls back to `unknown` (returns `null` here).
+ */
+function tsUnionFromScalarEnum(values) {
+    if (!Array.isArray(values) || values.length === 0)
+        return null;
+    const literals = [];
+    const seen = new Set();
+    for (const v of values) {
+        if (v !== null && (typeof v === "object" || Array.isArray(v))) {
+            // Objects/arrays are not representable as TS literals.
+            return null;
+        }
+        const literal = typeof v === "string" ? tsStringLiteral(v) : JSON.stringify(v);
+        if (literal === undefined)
+            return null; // e.g. `undefined` in the enum
+        if (!seen.has(literal)) {
+            seen.add(literal);
+            literals.push(literal);
+        }
+    }
+    return literals.length > 0 ? union(literals.map(atom)) : null;
+}
+/**
+ * Convert a parsed JSON Schema node to a TypeScript type expression. Object
+ * types render multi-line (2-space indent per level); everything else renders
+ * on a single line unless it is too wide for Prettier's default print width
+ * (#1565). `indent` is the current indentation depth.
+ */
+export function schemaToTsType(schema, indent = 0) {
+    return printType(schemaToTypeNode(schema), indent * 2, indent);
+}
+/**
+ * `schemaToTsType` as a wrappable node — the emitters print it at the position
+ * it actually occupies so long unions/objects wrap exactly as Prettier would
+ * (#1565). See `codegen-shared/prettierStable.ts`.
+ */
+export function schemaToTypeNode(schema) {
+    const d = describeSchema(schema);
+    // `enum` is the most specific constraint — the server checks it AFTER the
+    // type gate, so when both are present only the enum members that satisfy the
+    // declared type(s) are reachable. Emit just those (intersect with `type`
+    // via the shared `isType`). If the type filter leaves nothing representable,
+    // fall through to plain `type` rendering rather than over-promising.
+    if (d.enumValues) {
+        const allowedTypes = d.types;
+        const candidates = allowedTypes.length > 0
+            ? d.enumValues.filter((v) => allowedTypes.some((t) => isType(v, t)))
+            : d.enumValues;
+        if (candidates.length === 0) {
+            // No enum member satisfies the declared type gate (or the enum is empty),
+            // so the runtime rejects EVERY value: the type gate lets some values
+            // through, then `enum.includes(value)` fails them all. The reachable set
+            // is empty → an uninhabitable `never`. Widening to the declared type here
+            // (e.g. `{type:"string", enum:[1]}` → `string`) would let typed callers
+            // pass values the server always rejects.
+            return atom("never");
+        }
+        const enumUnion = tsUnionFromScalarEnum(candidates);
+        if (enumUnion !== null)
+            return enumUnion;
+        // Candidates survive the type gate but aren't representable as TS literals
+        // (object/array enum members). With no declared type there is nothing to
+        // fall back on → `unknown`; otherwise fall through to plain `type`.
+        if (allowedTypes.length === 0)
+            return atom("unknown");
+    }
+    // Array-union type (e.g. `["string", "null"]`). Only scalar/null members get
+    // a precise union — the server never descends `properties`/`items` for a
+    // union, so an object/array member forces `unknown`.
+    if (d.isUnion) {
+        const parts = [];
+        const seen = new Set();
+        for (const t of d.types) {
+            const mapped = SCALAR_TS[t];
+            // object/array/unknown member
+            if (mapped === undefined)
+                return atom("unknown");
+            if (!seen.has(mapped)) {
+                seen.add(mapped);
+                parts.push(mapped);
+            }
+        }
+        return parts.length > 0 ? union(parts.map(atom)) : atom("unknown");
+    }
+    // Discriminated-union (`oneOf`) rendering (#1511). A qualifying tagged union
+    // has no top-level `type`, so this runs ahead of the `singularType === null`
+    // fallback. Render each member via the existing object rendering and join
+    // with `|` — the natural TS discriminated union TS narrows on. A defective
+    // all-object tagged union (`kind: "invalid"`) is a strict codegen error
+    // (Fork 3, resolved by the maintainer), not a silent `unknown`.
+    if (d.oneOf) {
+        if (d.oneOf.kind === "invalid") {
+            throw new Error(`schema codegen: ${d.oneOf.reason}`);
+        }
+        const { discriminant } = d.oneOf;
+        const members = d.oneOf.members.map((m) => {
+            const md = describeSchema(m.schema);
+            // Every member is `type: "object"` with `properties`, so `md.object` is
+            // non-null — reuse the shared object rendering rather than reimplement it.
+            if (!md.object)
+                return schemaToTypeNode(m.schema);
+            // The runtime validator always requires the discriminator present before
+            // it can select a branch — regardless of whether the member lists it in
+            // its own `required`. Force it required so the generated union can't
+            // compile a value that omits the tag (which the runtime rejects as
+            // "matches no case") (#1511).
+            const required = md.object.required.includes(discriminant)
+                ? md.object.required
+                : [...md.object.required, discriminant];
+            return objectNode({ ...md.object, required });
+        });
+        return union(members);
+    }
+    if (d.singularType === null) {
+        // No usable single type and no enum — the server enforces nothing.
+        return atom("unknown");
+    }
+    // Object: the server walks `properties`/`required` ONLY when the type is
+    // exactly `"object"`. `d.object` is non-null only in that case with declared
+    // properties; a typed object with no properties is open → Record.
+    if (d.singularType === "object") {
+        if (d.object)
+            return objectNode(d.object);
+        return recordOf("unknown");
+    }
+    // Array: the server walks `items` ONLY when the type is exactly `"array"`.
+    if (d.singularType === "array") {
+        const items = d.array ? d.array.items : undefined;
+        // Missing or tuple `items` (an array of schemas) is ignored → unknown[].
+        if (!items || typeof items !== "object" || Array.isArray(items)) {
+            return atom("unknown[]");
+        }
+        return arrayOf(schemaToTypeNode(items));
+    }
+    // Single scalar type.
+    const scalar = SCALAR_TS[d.singularType];
+    return scalar ? atom(scalar) : atom("unknown");
+}
+/** An object type as a node — always multi-line, so Prettier never collapses it. */
+function objectNode(objectDesc) {
+    return block((level) => renderObjectType(objectDesc, level));
+}
+/**
+ * Render an object descriptor (`describeSchema(...).object`) as a TS object
+ * type. `required[]` drives optionality. An OPEN object (not
+ * `additionalProperties: false`) emits `[key: string]: unknown` so extra keys
+ * the runtime accepts don't trip TS excess-property checks; a CLOSED object
+ * omits it.
+ */
+function renderObjectType(objectDesc, indent) {
+    const { properties, required, additionalPropertiesClosed } = objectDesc;
+    const propNames = Object.keys(properties);
+    const requiredSet = new Set(Array.isArray(required)
+        ? required.filter((k) => typeof k === "string")
+        : []);
+    const pad = pad2(indent + 1);
+    const closePad = pad2(indent);
+    const propNameSet = new Set(propNames);
+    const lines = [];
+    for (const name of propNames) {
+        lines.push(renderMember(indent + 1, quotePropIfNeeded(name), !requiredSet.has(name), schemaToTypeNode(properties[name])));
+    }
+    // A key listed in `required` but absent from `properties` has no declared
+    // child schema, yet the validator still rejects an object missing it. Emit it
+    // as a required `unknown` member so the generated type demands the key too —
+    // otherwise `{properties:{}, required:["id"]}` would accept `{}`, which the
+    // runtime rejects.
+    for (const name of requiredSet) {
+        if (!propNameSet.has(name)) {
+            lines.push(`${pad}${quotePropIfNeeded(name)}: unknown;`);
+        }
+    }
+    // Open objects accept extra keys at runtime; model that with an index
+    // signature so a call site passing an unlisted key still compiles.
+    if (!additionalPropertiesClosed) {
+        lines.push(`${pad}[key: string]: unknown;`);
+    }
+    // A closed object with no members at all renders `{}` — Prettier collapses an
+    // empty `{\n}` to `{}`, so emit it that way to stay byte-stable (#1565).
+    if (lines.length === 0)
+        return "{}";
+    return ["{", ...lines, `${closePad}}`].join("\n");
+}
+/**
+ * Quote an object-property name when it is not a plain identifier (so keys with
+ * hyphens, dots, or other characters render as valid TS). A quoted key uses
+ * Prettier's quote choice so it stays a fixed point (#1565).
+ */
+function quotePropIfNeeded(name) {
+    if (/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name))
+        return name;
+    return tsStringLiteral(name);
+}
+/**
+ * True when the schema REJECTS an empty object `{}` — i.e. the client's
+ * `rootInput: options.input ?? {}` fallback would fail validation, so `input`
+ * must be a compile-time-required option (issue #1442, P4). Derived from the
+ * shared descriptor so it matches the server validator exactly:
+ *
+ *   - a valid top-level discriminated-union (`oneOf`): the runtime always
+ *     requires the discriminator present, so `{}` matches no case;
+ *   - a declared top-level `type` that `{}` does not satisfy (anything but
+ *     `object`, e.g. `string`/`array`, or a union with no `object` arm);
+ *   - a top-level `enum` (a fresh `{}` is never an enum member);
+ *   - `type: "object"` with a non-empty `required[]` (a missing required key).
+ *
+ * An all-optional object schema, or a schema with no top-level constraints,
+ * accepts `{}` → `input` is optional.
+ */
+export function schemaRejectsEmptyObject(schema) {
+    const d = describeSchema(schema);
+    // 0. A valid discriminated-union (`oneOf`) always requires the discriminator
+    //    present before the runtime can select a branch, so a fresh `{}` (the
+    //    client's `input ?? {}` fallback) matches no case and is rejected. The
+    //    generated `input` must therefore be required, not optional (#1511).
+    if (d.oneOf && d.oneOf.kind === "valid") {
+        return true;
+    }
+    // 1. Type gate: `{}` must satisfy at least one declared type.
+    if (d.types.length && !d.types.some((t) => isType(EMPTY_OBJECT, t))) {
+        return true;
+    }
+    // 2. Enum gate: a JSON enum never contains a value reference-equal to `{}`,
+    //    so any enum rejects it (mirrors `enum.includes(value)` at runtime).
+    if (d.enumValues && !d.enumValues.includes(EMPTY_OBJECT)) {
+        return true;
+    }
+    // 3. Object required: any required key is absent from `{}`.
+    if (d.object) {
+        for (const key of d.object.required) {
+            if (!(key in EMPTY_OBJECT))
+                return true;
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=schemaToTs.js.map

package/dist/src/lib/schema-codegen/schemaToTs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemaToTs.js","sourceRoot":"","sources":["../../../../src/lib/schema-codegen/schemaToTs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,OAAO,EACL,cAAc,EACd,MAAM,GAEP,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,OAAO,EACP,IAAI,EACJ,KAAK,EACL,MAAM,IAAI,IAAI,EAEd,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,KAAK,GAEN,MAAM,qCAAqC,CAAC;AAE7C,4EAA4E;AAC5E,MAAM,SAAS,GAA2B;IACxC,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,QAAQ;IACjB,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,MAAM;CACb,CAAC;AAEF,0EAA0E;AAC1E,MAAM,YAAY,GAA0B,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE9D;;;;;;GAMG;AACH,SAAS,qBAAqB,CAAC,MAAa;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,uDAAuD;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC/E,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,CAAC,+BAA+B;QACvE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,MAAW,EAAE,MAAM,GAAG,CAAC;IACpD,OAAO,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAW;IAC1C,MAAM,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAEjC,0EAA0E;IAC1E,6EAA6E;IAC7E,yEAAyE;IACzE,6EAA6E;IAC7E,qEAAqE;IACrE,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;QACjB,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC;QAC7B,MAAM,UAAU,GACd,YAAY,CAAC,MAAM,GAAG,CAAC;YACrB,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAC7B,YAAY,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAC5C;YACH,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QACnB,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,0EAA0E;YAC1E,qEAAqE;YACrE,yEAAyE;YACzE,0EAA0E;YAC1E,wEAAwE;YACxE,yCAAyC;YACzC,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;QACD,MAAM,SAAS,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACzC,2EAA2E;QAC3E,yEAAyE;QACzE,oEAAoE;QACpE,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC;IAED,6EAA6E;IAC7E,yEAAyE;IACzE,qDAAqD;IACrD,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAC5B,8BAA8B;YAC9B,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACjB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrE,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,gEAAgE;IAChE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QACZ,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC;QACjC,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACxC,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACpC,wEAAwE;YACxE,2EAA2E;YAC3E,IAAI,CAAC,EAAE,CAAC,MAAM;gBAAE,OAAO,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAClD,yEAAyE;YACzE,wEAAwE;YACxE,qEAAqE;YACrE,mEAAmE;YACnE,8BAA8B;YAC9B,MAAM,QAAQ,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;gBACxD,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ;gBACpB,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YAC1C,OAAO,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAED,IAAI,CAAC,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QAC5B,mEAAmE;QACnE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,kEAAkE;IAClE,IAAI,CAAC,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,MAAM;YAAE,OAAO,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC1C,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IAED,2EAA2E;IAC3E,IAAI,CAAC,CAAC,YAAY,KAAK,OAAO,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAClD,yEAAyE;QACzE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,sBAAsB;IACtB,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACjD,CAAC;AAED,oFAAoF;AACpF,SAAS,UAAU,CACjB,UAAmD;IAEnD,OAAO,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CACvB,UAAmD,EACnD,MAAc;IAEd,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,0BAA0B,EAAE,GAAG,UAAU,CAAC;IACxE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAE1C,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QACrB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACpD,CAAC,CAAC,EAAE,CACP,CAAC;IAEF,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,SAAS,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CACR,YAAY,CACV,MAAM,GAAG,CAAC,EACV,iBAAiB,CAAC,IAAI,CAAC,EACvB,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EACtB,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CACnC,CACF,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,mBAAmB;IACnB,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,sEAAsE;IACtE,mEAAmE;IACnE,IAAI,CAAC,0BAA0B,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,yBAAyB,CAAC,CAAC;IAC9C,CAAC;IACD,8EAA8E;IAC9E,yEAAyE;IACzE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAW;IAClD,MAAM,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAEjC,6EAA6E;IAC7E,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8DAA8D;IAC9D,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,4EAA4E;IAC5E,yEAAyE;IACzE,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,4DAA4D;IAC5D,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACb,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC,CAAC,GAAG,IAAI,YAAY,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/src/lib/scope-request.d.ts

@@ -0,0 +1,84 @@
+/**
+ * The request `primitive login` and `primitive token --scope …` send to
+ * `GET /admin/api/oauth-cli` (#3889).
+ *
+ * One builder serves both commands, so they agree on every rule: `--step-up`
+ * asks for a step-up holding exactly `--scope` (#4564), and a list holding
+ * `admin` is one with or without the flag; a step-up names the current
+ * session as its parent and is pinned to the environment's app unless
+ * `--app` says otherwise (`--app all` asks for an unpinned one); any other
+ * login in a project is pinned to the project's apps on its server (#4512);
+ * a printed token carries its lifetime. `primitive auth sessions create`
+ * builds its CI-session request here too (#3890). Every mistake is a usage
+ * error before any browser opens.
+ *
+ * Pure: the flags, the environment's app id, the project's apps and the
+ * stored session's id are arguments.
+ */
+/** The five admin scopes. */
+export declare const ADMIN_SCOPES: readonly ["read", "write", "admin", "data:read", "data:write"];
+/** The longest a step-up lives. */
+export declare const STEP_UP_MAX_SECONDS: number;
+/** The longest a token `primitive token` prints lives. */
+export declare const PRINTED_TOKEN_MAX_SECONDS: number;
+/** How long a CI session lives unless `--ttl` says otherwise: 90 days (#3890). */
+export declare const CI_SESSION_DEFAULT_SECONDS: number;
+/** The longest a CI session lives: 1 year. */
+export declare const CI_SESSION_MAX_SECONDS: number;
+/** The longest a CI session's name may be. */
+export declare const CI_SESSION_NAME_MAX_LENGTH = 64;
+/**
+ * Seconds in a duration of the `tokens create --ttl` grammar (`15m`, `1h`,
+ * `7d`, `6mo`, `1y`), or null when it is not one.
+ */
+export declare function parseDurationSeconds(value: string): number | null;
+/** The flags and context one request is built from. */
+export interface ScopeRequestInput {
+    /** `sessions` is `primitive auth sessions create`: a CI session (#3890). */
+    command: "login" | "token" | "sessions";
+    /** `--scope`: a comma-separated list. */
+    scope?: string;
+    /** `--app`: a comma-separated list, or `all`. */
+    app?: string;
+    /** `--ttl` (`token` and `sessions` only). */
+    ttl?: string;
+    /** `--step-up` (`login` and `token`): a step-up holding exactly `--scope`. */
+    stepUp?: boolean;
+    /** `--name` (`sessions` only). */
+    name?: string;
+    /** The environment's app, when the command runs in a project. */
+    envAppId?: string;
+    /**
+     * The project a login runs in: the server it signs in to and the apps of
+     * the committed environments on that server (`projectLoginApps`). Absent
+     * outside a project.
+     */
+    project?: {
+        serverUrl: string;
+        apps: string[];
+    };
+    /** The stored session's `sid`, when there is one. */
+    parentSid?: string;
+    /**
+     * The stored login a CI session is created from (`sessions` only); null
+     * when there is none. Only a login holding a refresh token can prove it is
+     * an original login.
+     */
+    login?: {
+        refreshToken: string;
+    } | null;
+}
+export type ScopeRequest = {
+    ok: true;
+    query: Record<string, string>;
+    stepUp: boolean;
+} | {
+    ok: false;
+    message: string;
+};
+/**
+ * The `oauth-cli` query for a login or a printed token, or the usage error
+ * that stops the command. A login without `--scope` asks for the server's
+ * default scope and sends none.
+ */
+export declare function buildScopeRequest(input: ScopeRequestInput): ScopeRequest;

package/dist/src/lib/scope-request.js

@@ -0,0 +1,235 @@
+/**
+ * The request `primitive login` and `primitive token --scope …` send to
+ * `GET /admin/api/oauth-cli` (#3889).
+ *
+ * One builder serves both commands, so they agree on every rule: `--step-up`
+ * asks for a step-up holding exactly `--scope` (#4564), and a list holding
+ * `admin` is one with or without the flag; a step-up names the current
+ * session as its parent and is pinned to the environment's app unless
+ * `--app` says otherwise (`--app all` asks for an unpinned one); any other
+ * login in a project is pinned to the project's apps on its server (#4512);
+ * a printed token carries its lifetime. `primitive auth sessions create`
+ * builds its CI-session request here too (#3890). Every mistake is a usage
+ * error before any browser opens.
+ *
+ * Pure: the flags, the environment's app id, the project's apps and the
+ * stored session's id are arguments.
+ */
+/** The five admin scopes. */
+export const ADMIN_SCOPES = ["read", "write", "admin", "data:read", "data:write"];
+/** The longest a step-up lives. */
+export const STEP_UP_MAX_SECONDS = 15 * 60;
+/** The longest a token `primitive token` prints lives. */
+export const PRINTED_TOKEN_MAX_SECONDS = 60 * 60;
+/** How long a CI session lives unless `--ttl` says otherwise: 90 days (#3890). */
+export const CI_SESSION_DEFAULT_SECONDS = 90 * 86400;
+/** The longest a CI session lives: 1 year. */
+export const CI_SESSION_MAX_SECONDS = 365 * 86400;
+/** The longest a CI session's name may be. */
+export const CI_SESSION_NAME_MAX_LENGTH = 64;
+const UNIT_SECONDS = {
+    m: 60,
+    min: 60,
+    h: 3600,
+    d: 86400,
+    w: 7 * 86400,
+    mo: 30 * 86400,
+    y: 365 * 86400,
+};
+/**
+ * Seconds in a duration of the `tokens create --ttl` grammar (`15m`, `1h`,
+ * `7d`, `6mo`, `1y`), or null when it is not one.
+ */
+export function parseDurationSeconds(value) {
+    const match = /^(\d+)(mo|min|m|h|d|w|y)$/.exec(value);
+    if (!match)
+        return null;
+    return Number(match[1]) * UNIT_SECONDS[match[2]];
+}
+const NONE_RENAMED = "--app none is now --app all: pass --app all for an unpinned request";
+function usage(message) {
+    return { ok: false, message };
+}
+const OUTSIDE_PROJECT = "Outside a project there is no list of apps to limit this login to. Run `primitive login --app all` to sign in to all of your apps, or `primitive init` to create a project.";
+/**
+ * The apps `--app` names: none for `all`, or the list. Only `all` unpins: an
+ * empty list (an unset `$APP_ID`) or an empty entry must not quietly widen
+ * the request to every app.
+ */
+function appsFlag(app) {
+    if (app === "none")
+        return usage(NONE_RENAMED);
+    if (app === "all")
+        return [];
+    const apps = app.split(",").map((a) => a.trim());
+    if (apps.some((a) => a === "")) {
+        return usage("--app is a comma-separated list of app ids; pass --app all for an unpinned request");
+    }
+    return apps;
+}
+/**
+ * The pins of a login that does not name its apps and is not a step-up: the
+ * project's apps on its server (#4512).
+ */
+function projectPins(input) {
+    if (!input.project)
+        return usage(OUTSIDE_PROJECT);
+    if (input.project.apps.length === 0) {
+        return usage(`No environment in primitive/config.json uses ${input.project.serverUrl}, so there is nothing to pin this login to. Run \`primitive login --app all\` to sign in to all of your apps, or \`primitive login --app <ids>\`.`);
+    }
+    return input.project.apps;
+}
+/**
+ * The `oauth-cli` query for a login or a printed token, or the usage error
+ * that stops the command. A login without `--scope` asks for the server's
+ * default scope and sends none.
+ */
+export function buildScopeRequest(input) {
+    const { command } = input;
+    if (command === "sessions")
+        return buildCiSessionRequest(input);
+    if (input.stepUp && input.scope === undefined) {
+        return usage(`--step-up needs the scopes the command needs: primitive ${command} --step-up --scope <list> [--app <ids>]`);
+    }
+    if (input.scope === undefined) {
+        if (command === "token") {
+            if (input.app !== undefined)
+                return usage("--app needs --scope: primitive token --scope <list> --app <ids>");
+            return usage("--ttl needs --scope: primitive token --scope <list> --ttl <d>");
+        }
+        if (input.ttl !== undefined)
+            return usage("--ttl applies only to primitive token");
+        const apps = input.app !== undefined ? appsFlag(input.app) : projectPins(input);
+        if (!Array.isArray(apps))
+            return apps;
+        const query = {};
+        if (apps.length > 0)
+            query.apps = apps.join(",");
+        query.origin = "login";
+        return { ok: true, query, stepUp: false };
+    }
+    if (command === "login" && input.ttl !== undefined) {
+        return usage("--ttl applies only to primitive token; a login keeps its usual lifetime");
+    }
+    const scopes = input.scope.split(",").map((s) => s.trim());
+    if (scopes.some((s) => s === "")) {
+        return usage(`--scope is a comma-separated list of ${ADMIN_SCOPES.join(", ")}`);
+    }
+    const unknown = scopes.filter((s) => !ADMIN_SCOPES.includes(s));
+    if (unknown.length > 0) {
+        return usage(`Unknown scope ${unknown.join(", ")}. Scopes are ${ADMIN_SCOPES.join(", ")}.`);
+    }
+    const stepUp = input.stepUp === true || scopes.includes("admin");
+    if (stepUp && !input.parentSid) {
+        return usage("A step-up builds on your current login. Run `primitive login` first.");
+    }
+    const apps = input.app !== undefined
+        ? appsFlag(input.app)
+        : stepUp
+            ? input.envAppId
+                ? [input.envAppId]
+                : []
+            : command === "login"
+                ? projectPins(input)
+                : [];
+    if (!Array.isArray(apps))
+        return apps;
+    // An explicit step-up says so; one holding `admin` is inferred by the
+    // server, as it is from older CLIs.
+    const query = {
+        ...(input.stepUp ? { kind: "step-up" } : {}),
+        scope: scopes.join(","),
+    };
+    if (apps.length > 0)
+        query.apps = apps.join(",");
+    if (stepUp)
+        query.parent = input.parentSid;
+    query.origin = command;
+    if (command === "token") {
+        const max = stepUp ? STEP_UP_MAX_SECONDS : PRINTED_TOKEN_MAX_SECONDS;
+        let seconds = max;
+        if (input.ttl !== undefined) {
+            const parsed = parseDurationSeconds(input.ttl);
+            if (parsed === null || parsed <= 0) {
+                return usage(`Invalid --ttl ${input.ttl}: use a duration such as 15m or 1h`);
+            }
+            if (parsed > max) {
+                return usage(stepUp
+                    ? `A step-up lives at most 15 minutes; --ttl ${input.ttl} is longer`
+                    : `A printed token lives at most 1 hour; --ttl ${input.ttl} is longer`);
+            }
+            seconds = parsed;
+        }
+        query.ttl = String(seconds);
+    }
+    return { ok: true, query, stepUp };
+}
+const CREATE_USAGE = "primitive auth sessions create --name <name> --scope <list> --app <ids> [--ttl <d>]";
+/**
+ * The `oauth-cli` query of `primitive auth sessions create` (#3890), without
+ * the proof the command asks the server for next: a CI session is named,
+ * pinned, never holds `admin`, lives 90 days unless `--ttl` says otherwise
+ * and a year at most, and is created from a stored login that holds a
+ * refresh token. Every mistake is a usage error before any request.
+ */
+function buildCiSessionRequest(input) {
+    const name = (input.name ?? "").trim();
+    if (!name)
+        return usage(`--name is required: ${CREATE_USAGE}`);
+    if (name.length > CI_SESSION_NAME_MAX_LENGTH) {
+        return usage(`--name is at most ${CI_SESSION_NAME_MAX_LENGTH} characters`);
+    }
+    if (input.scope === undefined)
+        return usage(`--scope is required: ${CREATE_USAGE}`);
+    const scopes = input.scope.split(",").map((s) => s.trim());
+    if (scopes.some((s) => s === "")) {
+        return usage(`--scope is a comma-separated list of ${ADMIN_SCOPES.join(", ")}`);
+    }
+    const unknown = scopes.filter((s) => !ADMIN_SCOPES.includes(s));
+    if (unknown.length > 0) {
+        return usage(`Unknown scope ${unknown.join(", ")}. Scopes are ${ADMIN_SCOPES.join(", ")}.`);
+    }
+    if (scopes.includes("admin")) {
+        return usage("A CI session never holds admin: drop it from --scope");
+    }
+    if (input.app === undefined) {
+        return usage(`A CI session must be pinned: pass --app <ids>. ${CREATE_USAGE}`);
+    }
+    if (input.app === "none" || input.app === "all") {
+        return usage(`A CI session must be pinned to its apps; --app ${input.app} is not allowed. Pass --app <ids>.`);
+    }
+    const apps = input.app.split(",").map((a) => a.trim());
+    if (apps.some((a) => a === "")) {
+        return usage("--app is a comma-separated list of app ids");
+    }
+    let seconds = CI_SESSION_DEFAULT_SECONDS;
+    if (input.ttl !== undefined) {
+        const parsed = parseDurationSeconds(input.ttl);
+        if (parsed === null || parsed <= 0) {
+            return usage(`Invalid --ttl ${input.ttl}: use a duration such as 30d, 6mo or 1y`);
+        }
+        if (parsed > CI_SESSION_MAX_SECONDS) {
+            return usage(`A CI session lives at most 1 year; --ttl ${input.ttl} is longer`);
+        }
+        seconds = parsed;
+    }
+    if (!input.login) {
+        return usage("Not logged in. Run `primitive login` first, then create the CI session.");
+    }
+    if (!input.login.refreshToken) {
+        return usage("Your login has no refresh token, so it cannot create CI sessions. Run `primitive login`.");
+    }
+    return {
+        ok: true,
+        stepUp: false,
+        query: {
+            kind: "ci",
+            name,
+            scope: scopes.join(","),
+            apps: apps.join(","),
+            origin: "sessions",
+            ttl: String(seconds),
+        },
+    };
+}
+//# sourceMappingURL=scope-request.js.map

package/dist/src/lib/scope-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-request.js","sourceRoot":"","sources":["../../../src/lib/scope-request.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,6BAA6B;AAC7B,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,CAAU,CAAC;AAE3F,mCAAmC;AACnC,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,CAAC;AAE3C,0DAA0D;AAC1D,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,CAAC;AAEjD,kFAAkF;AAClF,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,KAAK,CAAC;AAErD,8CAA8C;AAC9C,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,GAAG,KAAK,CAAC;AAElD,8CAA8C;AAC9C,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C,MAAM,YAAY,GAA2B;IAC3C,CAAC,EAAE,EAAE;IACL,GAAG,EAAE,EAAE;IACP,CAAC,EAAE,IAAI;IACP,CAAC,EAAE,KAAK;IACR,CAAC,EAAE,CAAC,GAAG,KAAK;IACZ,EAAE,EAAE,EAAE,GAAG,KAAK;IACd,CAAC,EAAE,GAAG,GAAG,KAAK;CACf,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,KAAK,GAAG,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC;AAsCD,MAAM,YAAY,GAAG,qEAAqE,CAAC;AAE3F,SAAS,KAAK,CAAC,OAAe;IAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,eAAe,GACnB,6KAA6K,CAAC;AAEhL;;;;GAIG;AACH,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/C,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,oFAAoF,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,KAAwB;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC,eAAe,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,KAAK,CACV,gDAAgD,KAAK,CAAC,OAAO,CAAC,SAAS,mJAAmJ,CAC3N,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAwB;IACxD,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,KAAK,CACV,2DAA2D,OAAO,yCAAyC,CAC5G,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC,iEAAiE,CAAC,CAAC;YAC7G,OAAO,KAAK,CAAC,+DAA+D,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACnF,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAChF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,KAAK,GAA2B,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjD,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,IAAI,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC,wCAAwC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAE,YAAkC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC,iBAAiB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjE,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,sEAAsE,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,IAAI,GACR,KAAK,CAAC,GAAG,KAAK,SAAS;QACrB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;QACrB,CAAC,CAAC,MAAM;YACN,CAAC,CAAC,KAAK,CAAC,QAAQ;gBACd,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;gBAClB,CAAC,CAAC,EAAE;YACN,CAAC,CAAC,OAAO,KAAK,OAAO;gBACnB,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC;gBACpB,CAAC,CAAC,EAAE,CAAC;IACb,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,sEAAsE;IACtE,oCAAoC;IACpC,MAAM,KAAK,GAA2B;QACpC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;KACxB,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,MAAM;QAAE,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,SAAU,CAAC;IAC5C,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC;IAEvB,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,yBAAyB,CAAC;QACrE,IAAI,OAAO,GAAG,GAAG,CAAC;QAClB,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/C,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;gBACnC,OAAO,KAAK,CAAC,iBAAiB,KAAK,CAAC,GAAG,oCAAoC,CAAC,CAAC;YAC/E,CAAC;YACD,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;gBACjB,OAAO,KAAK,CACV,MAAM;oBACJ,CAAC,CAAC,6CAA6C,KAAK,CAAC,GAAG,YAAY;oBACpE,CAAC,CAAC,+CAA+C,KAAK,CAAC,GAAG,YAAY,CACzE,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,MAAM,CAAC;QACnB,CAAC;QACD,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,YAAY,GAChB,qFAAqF,CAAC;AAExF;;;;;;GAMG;AACH,SAAS,qBAAqB,CAAC,KAAwB;IACrD,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC,uBAAuB,YAAY,EAAE,CAAC,CAAC;IAC/D,IAAI,IAAI,CAAC,MAAM,GAAG,0BAA0B,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC,qBAAqB,0BAA0B,aAAa,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,wBAAwB,YAAY,EAAE,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC,wCAAwC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAE,YAAkC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC,iBAAiB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,kDAAkD,YAAY,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC,kDAAkD,KAAK,CAAC,GAAG,oCAAoC,CAAC,CAAC;IAChH,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,OAAO,GAAG,0BAA0B,CAAC;IACzC,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC,iBAAiB,KAAK,CAAC,GAAG,yCAAyC,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,MAAM,GAAG,sBAAsB,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC,4CAA4C,KAAK,CAAC,GAAG,YAAY,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAC9B,OAAO,KAAK,CACV,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,KAAK;QACb,KAAK,EAAE;YACL,IAAI,EAAE,IAAI;YACV,IAAI;YACJ,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACpB,MAAM,EAAE,UAAU;YAClB,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC;SACrB;KACF,CAAC;AACJ,CAAC"}

package/dist/src/lib/session-id.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The admin session a token belongs to: a JWT's `sid` claim, or the session
+ * segment of an opaque CI token (`primadm_<sessionId>_<secret>`, #3890).
+ * Read without verifying anything; the server is the judge of the token.
+ */
+/** Whether `token` is an opaque CI token rather than a JWT. */
+export declare function isCiToken(token: string | undefined | null): boolean;
+/** The session id `token` names, or undefined when it names none. */
+export declare function sessionIdOfToken(token: string | undefined | null): string | undefined;