sliccy 6.256.7 → 6.256.9

package/dist/node-server/_cloud_core/src/cone-config/cone-config-rules.d.mts

@@ -0,0 +1,89 @@
+export type EffortLevel = 'off' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh';
+export type OAuthAccount = {
+    providerId: string;
+    kind: 'oauth';
+    accessToken: string;
+    refreshToken?: string;
+    tokenExpiresAt?: number;
+    userName?: string;
+    baseUrl?: string;
+};
+export type ApiKeyAccount = {
+    providerId: string;
+    kind: 'apikey';
+    apiKey: string;
+    baseUrl?: string;
+    deployment?: string;
+    apiVersion?: string;
+};
+export type SecretEntry = {
+    name: string;
+    value: string;
+    domains: string[];
+};
+/** @typedef {'off' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh'} EffortLevel */
+/**
+ * @typedef {{
+ *   providerId: string;
+ *   kind: 'oauth';
+ *   accessToken: string;
+ *   refreshToken?: string;
+ *   tokenExpiresAt?: number;
+ *   userName?: string;
+ *   baseUrl?: string;
+ * }} OAuthAccount
+ */
+/**
+ * @typedef {{
+ *   providerId: string;
+ *   kind: 'apikey';
+ *   apiKey: string;
+ *   baseUrl?: string;
+ *   deployment?: string;
+ *   apiVersion?: string;
+ * }} ApiKeyAccount
+ */
+/** @typedef {{ name: string; value: string; domains: string[] }} SecretEntry */
+/** @type {readonly EffortLevel[]} */
+export declare const EFFORT_LEVELS: readonly EffortLevel[];
+/**
+ * @param {unknown} value
+ * @returns {value is EffortLevel}
+ */
+export declare function isEffortLevel(value: unknown): value is EffortLevel;
+/**
+ * Secret names: identifier-shaped, plus `.` and `-` for namespaced subsystem
+ * secrets (`s3.<profile>.access_key_id`). The `secrets.env` key is everything
+ * before the first `=`, so none of these characters can split a line; only
+ * POSIX-identifier names ever reach the agent shell as `$NAME`.
+ */
+export declare const SECRET_NAME_RE: RegExp;
+/**
+ * Validate one untrusted provider account. Only the known fields of the
+ * chosen kind survive; the credential and `providerId` must be non-empty.
+ * @param {unknown} input
+ * @param {string} where error-message prefix, e.g. `cone-config: accounts[0]`
+ * @returns {OAuthAccount | ApiKeyAccount}
+ */
+export declare function validateAccount(input: unknown, where: string): OAuthAccount | ApiKeyAccount;
+/**
+ * Validate one untrusted secret against the line-oriented `secrets.env`
+ * schema (no escaping): a {@link SECRET_NAME_RE} name outside the reserved
+ * `oauth.*` namespace and not ending in `_DOMAINS`, a single-line value, and
+ * at least one domain, each trimmed, non-blank, single-line and comma-free.
+ * node-server drops a secret with no domains, so `[]` is rejected here
+ * rather than shipped as a secret that silently never loads.
+ * @param {unknown} input
+ * @param {string} where error-message prefix, e.g. `cone-config: secrets[0]`
+ * @returns {SecretEntry}
+ */
+export declare function validateSecret(input: unknown, where: string): SecretEntry;
+/**
+ * Serialize validated secrets to the `NAME=value` / `NAME_DOMAINS=a,b` lines
+ * node-server's EnvSecretStore reads. Values are written verbatim, so callers
+ * pass entries that went through {@link validateSecret}.
+ * @param {readonly SecretEntry[]} secrets
+ * @returns {string}
+ */
+export declare function serializeSecretsEnv(secrets: readonly SecretEntry[]): string;
+//# sourceMappingURL=cone-config-rules.d.mts.map

package/dist/node-server/_cloud_core/src/cone-config/cone-config-rules.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cone-config-rules.d.mts","sourceRoot":"","sources":["../../../src/cone-config/cone-config-rules.mjs"],"names":[],"mappings":"AAaI,YAAmE,WAAW,GAApE,KAAK,GAAG,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAa;AAG/E,YAQG,YAAY,GARL;IACR,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAc;AAIf,YAOG,aAAa,GAPN;IACR,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAe;AAGf,YAA8D,WAAW,GAA/D;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAa;AAzB7E,qFAAqF;AAErF;;;;;;;;;;GAUG;AAEH;;;;;;;;;GASG;AAEH,gFAAgF;AAEhF,qCAAqC;AACrC,eAAO,MAAM,aAAa,EADf,SAAS,WAAW,EACiE,CAAC;AAEjG;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAHxB,OAGwB,GAFtB,KAAK,IAAI,WAAW,CAMhC;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,QAA+B,CAAC;AAkC3D;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAJ1B,OAI0B,EAAE,KAAK,EAHjC,MAGiC,GAF/B,YAAY,GAAG,aAAa,CAgCxC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAJzB,OAIyB,EAAE,KAAK,EAHhC,MAGgC,GAF9B,WAAW,CAyBvB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAHhC,SAAS,WAAW,EAGY,GAF9B,MAAM,CASlB"}

package/dist/node-server/_cloud_core/src/cone-config/cone-config-rules.mjs

@@ -0,0 +1,170 @@
+// @ts-check
+// Zero-dependency rules for the untrusted cone-config bundle: provider
+// accounts, domain-scoped secrets, the effort-level set, and the `secrets.env`
+// serializer. Plain JS with no imports, so both floats that write a cone's
+// credential files run the exact same checks.
+//
+// CANONICAL COPY: packages/cloud-core/src/cone-config/cone-config-rules.mjs
+// (wrapped with types by cone-config/index.ts). packages/github-workflow/
+// scripts/cone-config-rules.mjs is a byte-identical vendored copy, because the
+// workflow scripts run from a sparse checkout of packages/github-workflow and
+// cannot import another package. Edit the canonical file, then copy it over;
+// github-workflow's cone-config-rules.test.mjs fails while the two differ.
+/** @typedef {'off' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh'} EffortLevel */
+/**
+ * @typedef {{
+ *   providerId: string;
+ *   kind: 'oauth';
+ *   accessToken: string;
+ *   refreshToken?: string;
+ *   tokenExpiresAt?: number;
+ *   userName?: string;
+ *   baseUrl?: string;
+ * }} OAuthAccount
+ */
+/**
+ * @typedef {{
+ *   providerId: string;
+ *   kind: 'apikey';
+ *   apiKey: string;
+ *   baseUrl?: string;
+ *   deployment?: string;
+ *   apiVersion?: string;
+ * }} ApiKeyAccount
+ */
+/** @typedef {{ name: string; value: string; domains: string[] }} SecretEntry */
+/** @type {readonly EffortLevel[]} */
+export const EFFORT_LEVELS = Object.freeze(['off', 'minimal', 'low', 'medium', 'high', 'xhigh']);
+/**
+ * @param {unknown} value
+ * @returns {value is EffortLevel}
+ */
+export function isEffortLevel(value) {
+    return (typeof value === 'string' && /** @type {readonly string[]} */ (EFFORT_LEVELS).includes(value));
+}
+/**
+ * Secret names: identifier-shaped, plus `.` and `-` for namespaced subsystem
+ * secrets (`s3.<profile>.access_key_id`). The `secrets.env` key is everything
+ * before the first `=`, so none of these characters can split a line; only
+ * POSIX-identifier names ever reach the agent shell as `$NAME`.
+ */
+export const SECRET_NAME_RE = /^[A-Za-z_][A-Za-z0-9_.-]*$/;
+/** Owned by node-server's in-memory OAuth replica store; a bundle may not write it. */
+const RESERVED_PREFIX = 'oauth.';
+/** `secrets.env` reads any `<NAME>_DOMAINS` key as NAME's domain list. */
+const DOMAINS_SUFFIX = '_DOMAINS';
+/**
+ * @param {unknown} v
+ * @returns {v is string}
+ */
+function isStr(v) {
+    return typeof v === 'string';
+}
+/**
+ * @param {string} v
+ * @returns {boolean}
+ */
+function hasNewline(v) {
+    return /[\r\n]/.test(v);
+}
+/**
+ * @param {Record<string, unknown>} obj
+ * @param {string} key
+ * @returns {Record<string, string>}
+ */
+function optionalStr(obj, key) {
+    const v = obj[key];
+    return isStr(v) ? { [key]: v } : {};
+}
+/**
+ * Validate one untrusted provider account. Only the known fields of the
+ * chosen kind survive; the credential and `providerId` must be non-empty.
+ * @param {unknown} input
+ * @param {string} where error-message prefix, e.g. `cone-config: accounts[0]`
+ * @returns {OAuthAccount | ApiKeyAccount}
+ */
+export function validateAccount(input, where) {
+    if (input === null || typeof input !== 'object')
+        throw new Error(`${where} is not an object`);
+    const a = /** @type {Record<string, unknown>} */ (input);
+    if (!isStr(a.providerId) || !a.providerId)
+        throw new Error(`${where}.providerId required`);
+    if (a.kind === 'oauth') {
+        if (!isStr(a.accessToken) || !a.accessToken) {
+            throw new Error(`${where}: oauth account requires accessToken`);
+        }
+        return {
+            providerId: a.providerId,
+            kind: 'oauth',
+            accessToken: a.accessToken,
+            ...optionalStr(a, 'refreshToken'),
+            ...(typeof a.tokenExpiresAt === 'number' ? { tokenExpiresAt: a.tokenExpiresAt } : {}),
+            ...optionalStr(a, 'userName'),
+            ...optionalStr(a, 'baseUrl'),
+        };
+    }
+    if (a.kind === 'apikey') {
+        if (!isStr(a.apiKey) || !a.apiKey)
+            throw new Error(`${where}: apikey account requires apiKey`);
+        return {
+            providerId: a.providerId,
+            kind: 'apikey',
+            apiKey: a.apiKey,
+            ...optionalStr(a, 'baseUrl'),
+            ...optionalStr(a, 'deployment'),
+            ...optionalStr(a, 'apiVersion'),
+        };
+    }
+    throw new Error(`${where}.kind must be 'oauth' | 'apikey'`);
+}
+/**
+ * Validate one untrusted secret against the line-oriented `secrets.env`
+ * schema (no escaping): a {@link SECRET_NAME_RE} name outside the reserved
+ * `oauth.*` namespace and not ending in `_DOMAINS`, a single-line value, and
+ * at least one domain, each trimmed, non-blank, single-line and comma-free.
+ * node-server drops a secret with no domains, so `[]` is rejected here
+ * rather than shipped as a secret that silently never loads.
+ * @param {unknown} input
+ * @param {string} where error-message prefix, e.g. `cone-config: secrets[0]`
+ * @returns {SecretEntry}
+ */
+export function validateSecret(input, where) {
+    if (input === null || typeof input !== 'object')
+        throw new Error(`${where} is not an object`);
+    const s = /** @type {Record<string, unknown>} */ (input);
+    if (!isStr(s.name) || !SECRET_NAME_RE.test(s.name)) {
+        throw new Error(`${where}: name must be an identifier matching ${SECRET_NAME_RE}`);
+    }
+    if (s.name.startsWith(RESERVED_PREFIX)) {
+        throw new Error(`${where} ${s.name}: the oauth.* namespace is reserved for OAuth replicas`);
+    }
+    if (s.name.endsWith(DOMAINS_SUFFIX)) {
+        throw new Error(`${where} ${s.name}: names ending in _DOMAINS are reserved for domain lines`);
+    }
+    if (!isStr(s.value) || hasNewline(s.value)) {
+        throw new Error(`${where} ${s.name}: value must be a single-line string`);
+    }
+    if (!Array.isArray(s.domains) || s.domains.length === 0 || !s.domains.every(isStr)) {
+        throw new Error(`${where} ${s.name}: domains must be a non-empty string[]`);
+    }
+    const domains = s.domains.map((d) => d.trim());
+    if (domains.some((d) => !d || hasNewline(d) || d.includes(','))) {
+        throw new Error(`${where} ${s.name}: domains must be non-blank, single-line and comma-free`);
+    }
+    return { name: s.name, value: s.value, domains };
+}
+/**
+ * Serialize validated secrets to the `NAME=value` / `NAME_DOMAINS=a,b` lines
+ * node-server's EnvSecretStore reads. Values are written verbatim, so callers
+ * pass entries that went through {@link validateSecret}.
+ * @param {readonly SecretEntry[]} secrets
+ * @returns {string}
+ */
+export function serializeSecretsEnv(secrets) {
+    const lines = [];
+    for (const s of secrets) {
+        lines.push(`${s.name}=${s.value}`);
+        lines.push(`${s.name}${DOMAINS_SUFFIX}=${s.domains.join(',')}`);
+    }
+    return lines.length ? `${lines.join('\n')}\n` : '';
+}

package/dist/node-server/_cloud_core/src/cone-config/index.d.ts

@@ -72,9 +72,8 @@ export declare function mergeConeConfig(base: ConeConfig, delta: ConeConfigDelta
 /**
  * Serialize flat secrets to the `NAME=value` / `NAME_DOMAINS=a,b` line format
  * that node-server's EnvSecretStore reads. Values are written verbatim (no
- * escaping — matching the existing parser), so secret names must be env-var
- * identifiers and values/domains must be single-line (no newlines, and values
- * must not break `NAME=value` parsing). Callers sanitize/validate inputs.
+ * escaping — matching the existing parser), so entries must have passed the
+ * bundle validators (single-line values, comma-free domains, safe names).
  */
 export declare function serializeSecretsEnv(secrets: SecretEntry[]): string;
 export declare function bundleToFiles(cfg: ConeConfig): {

package/dist/node-server/_cloud_core/src/cone-config/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cone-config/index.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AACD,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AACD,MAAM,MAAM,OAAO,GAAG,YAAY,GAAG,aAAa,CAAC;AAEnD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;IACtE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IAC7E,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,WAAW,EAAE,CAAA;KAAE,CAAC;IAC3D,MAAM,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CAC7D;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;IACtE,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,WAAW,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3F,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,4EAA4E;AAC5E,eAAO,MAAM,qBAAqB,QAAa,CAAC;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,0BAA0B,CAAC;AAmE1D,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAgB7D;AAyGD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAsBvE;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,GAAG,UAAU,CAkBpF;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CAOlE;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAU7F;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,eAAe,CAY5D;AAED,yFAAyF;AACzF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQpD;AACD,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAInD;AAWD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAchE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cone-config/index.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AACD,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AACD,MAAM,MAAM,OAAO,GAAG,YAAY,GAAG,aAAa,CAAC;AAEnD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;IACtE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IAC7E,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,WAAW,EAAE,CAAA;KAAE,CAAC;IAC3D,MAAM,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CAC7D;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;IACtE,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,WAAW,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3F,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,4EAA4E;AAC5E,eAAO,MAAM,qBAAqB,QAAa,CAAC;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,0BAA0B,CAAC;AA4C1D,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAgB7D;AAkDD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAsBvE;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,GAAG,UAAU,CAkBpF;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CAElE;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAU7F;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,eAAe,CAY5D;AAED,yFAAyF;AACzF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQpD;AACD,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAInD;AAWD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAchE"}

package/dist/node-server/_cloud_core/src/cone-config/index.js

@@ -1,6 +1,10 @@
 // Side-effect-free shared contract for cloud-cone configuration.
 // MUST NOT import e2b, node:*, or any runtime substrate — it is imported
 // by the browser webapp via the @slicc/cloud-core/cone-config subpath.
+// Account and secret rules (including the secrets.env line-format constraints)
+// live in the zero-dependency cone-config-rules.mjs, shared byte-for-byte with
+// packages/github-workflow so both floats accept exactly the same bundles.
+import { isEffortLevel, serializeSecretsEnv as serializeSecretLines, validateAccount, validateSecret, } from './cone-config-rules.mjs';
 /** Max serialized bundle size (bytes) accepted as a preboot env payload. */
 export const MAX_CONE_CONFIG_BYTES = 256 * 1024;
 /**
@@ -17,7 +21,6 @@ function isUntrustedObject(value) {
 function isStr(v) {
     return typeof v === 'string';
 }
-const VALID_EFFORT_LEVELS = new Set(['off', 'minimal', 'low', 'medium', 'high', 'xhigh']);
 export function validateConeConfig(input) {
     if (!isUntrustedObject(input))
         throw new Error('cone-config: not an object');
@@ -28,80 +31,17 @@ export function validateConeConfig(input) {
         throw new Error('cone-config: accounts must be an array');
     if (!Array.isArray(cfg.secrets))
         throw new Error('cone-config: secrets must be an array');
-    const accounts = cfg.accounts.map((a) => validateAccount(a));
-    const secrets = cfg.secrets.map((s) => validateSecret(s));
+    const accounts = cfg.accounts.map((a, i) => validateAccount(a, `cone-config: accounts[${i}]`));
+    const secrets = cfg.secrets.map((s, i) => validateSecret(s, `cone-config: secrets[${i}]`));
     const result = { model: cfg.model, accounts, secrets };
     if (cfg.effortLevel !== undefined) {
-        if (!isStr(cfg.effortLevel) || !VALID_EFFORT_LEVELS.has(cfg.effortLevel)) {
+        if (!isEffortLevel(cfg.effortLevel)) {
             throw new Error('cone-config: effortLevel must be one of off|minimal|low|medium|high|xhigh');
         }
         result.effortLevel = cfg.effortLevel;
     }
     return result;
 }
-function validateAccount(a) {
-    if (!isUntrustedObject(a))
-        throw new Error('cone-config: account not an object');
-    const acc = a;
-    if (!isStr(acc.providerId))
-        throw new Error('cone-config: account.providerId required');
-    if (!isStr(acc.kind))
-        throw new Error('cone-config: account.kind required');
-    if (acc.kind === 'oauth') {
-        if (!isStr(acc.accessToken))
-            throw new Error('cone-config: oauth account requires accessToken');
-        return {
-            providerId: acc.providerId,
-            kind: 'oauth',
-            accessToken: acc.accessToken,
-            ...(isStr(acc.refreshToken) ? { refreshToken: acc.refreshToken } : {}),
-            ...(typeof acc.tokenExpiresAt === 'number' ? { tokenExpiresAt: acc.tokenExpiresAt } : {}),
-            ...(isStr(acc.userName) ? { userName: acc.userName } : {}),
-            ...(isStr(acc.baseUrl) ? { baseUrl: acc.baseUrl } : {}),
-        };
-    }
-    if (acc.kind === 'apikey') {
-        if (!isStr(acc.apiKey))
-            throw new Error('cone-config: apikey account requires apiKey');
-        return {
-            providerId: acc.providerId,
-            kind: 'apikey',
-            apiKey: acc.apiKey,
-            ...(isStr(acc.baseUrl) ? { baseUrl: acc.baseUrl } : {}),
-            ...(isStr(acc.deployment) ? { deployment: acc.deployment } : {}),
-            ...(isStr(acc.apiVersion) ? { apiVersion: acc.apiVersion } : {}),
-        };
-    }
-    throw new Error(`cone-config: account.kind must be 'oauth' | 'apikey'`);
-}
-// secrets.env is line-based (NAME=value / NAME_DOMAINS=a,b) with no escaping,
-// so a newline/CR in a name or value would inject phantom lines on round-trip.
-// Names must be env-var identifiers; values and domains must be single-line.
-const ENV_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-function hasNewline(v) {
-    return /[\r\n]/.test(v);
-}
-function validateSecret(s) {
-    if (!isUntrustedObject(s))
-        throw new Error('cone-config: secret not an object');
-    const sec = s;
-    if (!isStr(sec.name))
-        throw new Error('cone-config: secret.name required');
-    if (!ENV_NAME_RE.test(sec.name)) {
-        throw new Error('cone-config: secret.name must be an env-var identifier ([A-Za-z_][A-Za-z0-9_]*)');
-    }
-    if (!isStr(sec.value))
-        throw new Error('cone-config: secret.value required');
-    if (hasNewline(sec.value))
-        throw new Error('cone-config: secret.value must be single-line');
-    if (!Array.isArray(sec.domains) || !sec.domains.every(isStr)) {
-        throw new Error('cone-config: secret.domains must be string[]');
-    }
-    if (sec.domains.some((d) => hasNewline(d) || d.includes(','))) {
-        throw new Error('cone-config: secret.domains entries must be single-line and comma-free');
-    }
-    return { name: sec.name, value: sec.value, domains: sec.domains };
-}
 /** Validate the `upsert` arm of a resume delta (accounts/secrets reuse the full-bundle validators). */
 function validateDeltaUpsert(input) {
     if (!isUntrustedObject(input)) {
@@ -113,13 +53,13 @@ function validateDeltaUpsert(input) {
         if (!Array.isArray(up.accounts)) {
             throw new Error('cone-config: delta.upsert.accounts must be an array');
         }
-        upsert.accounts = up.accounts.map((a) => validateAccount(a));
+        upsert.accounts = up.accounts.map((a, i) => validateAccount(a, `cone-config: delta.upsert.accounts[${i}]`));
     }
     if (up.secrets !== undefined) {
         if (!Array.isArray(up.secrets)) {
             throw new Error('cone-config: delta.upsert.secrets must be an array');
         }
-        upsert.secrets = up.secrets.map((s) => validateSecret(s));
+        upsert.secrets = up.secrets.map((s, i) => validateSecret(s, `cone-config: delta.upsert.secrets[${i}]`));
     }
     return upsert;
 }
@@ -164,7 +104,7 @@ export function validateConeConfigDelta(input) {
         if (d.effortLevel === null) {
             out.effortLevel = null;
         }
-        else if (!isStr(d.effortLevel) || !VALID_EFFORT_LEVELS.has(d.effortLevel)) {
+        else if (!isEffortLevel(d.effortLevel)) {
             throw new Error('cone-config: delta.effortLevel must be one of off|minimal|low|medium|high|xhigh or null');
         }
         else {
@@ -204,17 +144,11 @@ export function mergeConeConfig(base, delta) {
 /**
  * Serialize flat secrets to the `NAME=value` / `NAME_DOMAINS=a,b` line format
  * that node-server's EnvSecretStore reads. Values are written verbatim (no
- * escaping — matching the existing parser), so secret names must be env-var
- * identifiers and values/domains must be single-line (no newlines, and values
- * must not break `NAME=value` parsing). Callers sanitize/validate inputs.
+ * escaping — matching the existing parser), so entries must have passed the
+ * bundle validators (single-line values, comma-free domains, safe names).
  */
 export function serializeSecretsEnv(secrets) {
-    const lines = [];
-    for (const s of secrets) {
-        lines.push(`${s.name}=${s.value}`);
-        lines.push(`${s.name}_DOMAINS=${s.domains.join(',')}`);
-    }
-    return lines.length ? lines.join('\n') + '\n' : '';
+    return serializeSecretLines(secrets);
 }
 export function bundleToFiles(cfg) {
     return {

package/dist/node-server/_cloud_core/tests/cone-config/bundle-cases.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=bundle-cases.test.d.ts.map

package/dist/node-server/_cloud_core/tests/cone-config/bundle-cases.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-cases.test.d.ts","sourceRoot":"","sources":["../../../tests/cone-config/bundle-cases.test.ts"],"names":[],"mappings":""}

package/dist/node-server/_cloud_core/tests/cone-config/bundle-cases.test.js

@@ -0,0 +1,57 @@
+import { describe, expect, it } from 'vitest';
+import { bundleToFiles, validateConeConfig, validateConeConfigDelta, } from '../../src/cone-config/index.js';
+import { ACCOUNT_CASES, INVALID_EFFORT_LEVELS, SECRET_CASES, VALID_EFFORT_LEVELS, } from '../fixtures/cone-config-cases.mjs';
+// The same table runs against github-workflow's buildConeConfigFiles in
+// packages/github-workflow/scripts/cone-config-rules.test.mjs (#4129).
+const bundle = (extra) => ({ model: 'm', accounts: [], secrets: [], ...extra });
+describe('shared cone-config cases: secrets', () => {
+    for (const c of SECRET_CASES) {
+        if (c.reject) {
+            it(`rejects ${c.id} (bundle and resume delta)`, () => {
+                const re = new RegExp(c.reject);
+                expect(() => validateConeConfig(bundle({ secrets: [c.secret] }))).toThrow(re);
+                expect(() => validateConeConfigDelta({ upsert: { secrets: [c.secret] } })).toThrow(re);
+            });
+        }
+        else {
+            it(`accepts ${c.id}`, () => {
+                const cfg = validateConeConfig(bundle({ secrets: [c.secret] }));
+                const { name, value } = c.secret;
+                expect(cfg.secrets).toEqual([{ name, value, domains: c.domains }]);
+                expect(bundleToFiles(cfg).secretsEnv).toBe(`${name}=${value}\n${name}_DOMAINS=${c.domains.join(',')}\n`);
+                expect(validateConeConfigDelta({ upsert: { secrets: [c.secret] } }).upsert?.secrets).toEqual(cfg.secrets);
+            });
+        }
+    }
+});
+describe('shared cone-config cases: accounts', () => {
+    for (const c of ACCOUNT_CASES) {
+        if (c.reject) {
+            it(`rejects ${c.id}`, () => {
+                const re = new RegExp(c.reject);
+                expect(() => validateConeConfig(bundle({ accounts: [c.account] }))).toThrow(re);
+                expect(() => validateConeConfigDelta({ upsert: { accounts: [c.account] } })).toThrow(re);
+            });
+        }
+        else {
+            it(`accepts ${c.id}`, () => {
+                const [account] = validateConeConfig(bundle({ accounts: [c.account] })).accounts;
+                const allowed = ['providerId', 'kind', 'baseUrl'].concat(account.kind === 'oauth'
+                    ? ['accessToken', 'refreshToken', 'tokenExpiresAt', 'userName']
+                    : ['apiKey', 'deployment', 'apiVersion']);
+                for (const key of Object.keys(account))
+                    expect(allowed).toContain(key);
+            });
+        }
+    }
+});
+describe('shared cone-config cases: effort levels', () => {
+    it.each(VALID_EFFORT_LEVELS)('accepts %s', (level) => {
+        expect(validateConeConfig(bundle({ effortLevel: level })).effortLevel).toBe(level);
+        expect(validateConeConfigDelta({ effortLevel: level }).effortLevel).toBe(level);
+    });
+    it.each(INVALID_EFFORT_LEVELS)('rejects %s', (level) => {
+        expect(() => validateConeConfig(bundle({ effortLevel: level }))).toThrow(/effortLevel/);
+        expect(() => validateConeConfigDelta({ effortLevel: level })).toThrow(/effortLevel/);
+    });
+});

package/dist/node-server/_cloud_core/tests/cone-config/cone-config.test.js

@@ -44,13 +44,13 @@ describe('validateConeConfig', () => {
         expect(() => validateConeConfig({ ...base, secrets: [{ name: 'X', value: 'v', domains: 'a,b' }] })).toThrow(/domains/);
     });
     it('rejects an account with a missing/invalid kind', () => {
-        expect(() => validateConeConfig({ ...base, accounts: [{ providerId: 'x' }] })).toThrow(/kind required/);
+        expect(() => validateConeConfig({ ...base, accounts: [{ providerId: 'x' }] })).toThrow(/kind must be/);
     });
-    it('rejects a secret name that is not an env-var identifier', () => {
-        expect(() => validateConeConfig({ ...base, secrets: [{ name: 'FOO=BAR', value: 'v', domains: [] }] })).toThrow(/identifier/);
+    it('rejects a secret name that is not an identifier', () => {
+        expect(() => validateConeConfig({ ...base, secrets: [{ name: 'FOO=BAR', value: 'v', domains: ['d'] }] })).toThrow(/identifier/);
     });
     it('rejects a secret value or domain with a newline (secrets.env is line-based)', () => {
-        expect(() => validateConeConfig({ ...base, secrets: [{ name: 'X', value: 'a\nb', domains: [] }] })).toThrow(/single-line/);
+        expect(() => validateConeConfig({ ...base, secrets: [{ name: 'X', value: 'a\nb', domains: ['d'] }] })).toThrow(/single-line/);
         expect(() => validateConeConfig({ ...base, secrets: [{ name: 'X', value: 'v', domains: ['a,b'] }] })).toThrow(/comma-free/);
     });
     it('accepts a config with a valid effortLevel', () => {
@@ -80,7 +80,9 @@ describe('validateConeConfigDelta', () => {
         expect(() => validateConeConfigDelta({ upsert: { accounts: 'nope' } })).toThrow(/upsert.accounts must be an array/);
     });
     it('rejects a nested secret that would inject a newline', () => {
-        expect(() => validateConeConfigDelta({ upsert: { secrets: [{ name: 'X', value: 'a\nb', domains: [] }] } })).toThrow(/single-line/);
+        expect(() => validateConeConfigDelta({
+            upsert: { secrets: [{ name: 'X', value: 'a\nb', domains: ['d'] }] },
+        })).toThrow(/single-line/);
     });
     it('rejects a non-string delete.secretNames entry', () => {
         expect(() => validateConeConfigDelta({ delete: { secretNames: [1] } })).toThrow(/secretNames must be string\[\]/);

package/dist/node-server/_cloud_core/tests/fixtures/cone-config-cases.d.mts

@@ -0,0 +1,37 @@
+export type SecretCase = {
+    id: string;
+    secret: unknown;
+    reject?: string;
+    domains?: string[];
+    changed?: Array<'cloud-core' | 'github-workflow'>;
+};
+/**
+ * @typedef {{
+ *   id: string;
+ *   secret: unknown;
+ *   reject?: string;
+ *   domains?: string[];
+ *   changed?: Array<'cloud-core' | 'github-workflow'>;
+ * }} SecretCase
+ */
+/** @type {SecretCase[]} */
+export declare const SECRET_CASES: SecretCase[];
+export type AccountCase = {
+    id: string;
+    account: unknown;
+    reject?: string;
+    changed?: Array<'cloud-core' | 'github-workflow'>;
+};
+/**
+ * @typedef {{
+ *   id: string;
+ *   account: unknown;
+ *   reject?: string;
+ *   changed?: Array<'cloud-core' | 'github-workflow'>;
+ * }} AccountCase
+ */
+/** @type {AccountCase[]} */
+export declare const ACCOUNT_CASES: AccountCase[];
+export declare const VALID_EFFORT_LEVELS: string[];
+export declare const INVALID_EFFORT_LEVELS: string[];
+//# sourceMappingURL=cone-config-cases.d.mts.map

package/dist/node-server/_cloud_core/tests/fixtures/cone-config-cases.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cone-config-cases.d.mts","sourceRoot":"","sources":["../../../tests/fixtures/cone-config-cases.mjs"],"names":[],"mappings":"AAWG,YAMG,UAAU,GANH;IACR,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,KAAK,CAAC,YAAY,GAAG,iBAAiB,CAAC,CAAC;CACnD,CAAY;AAPhB;;;;;;;;GAQG;AAEH,2BAA2B;AAC3B,eAAO,MAAM,YAAY,EADd,UAAU,EA0DpB,CAAC;AAGC,YAKG,WAAW,GALJ;IACR,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,KAAK,CAAC,YAAY,GAAG,iBAAiB,CAAC,CAAC;CACnD,CAAa;AANjB;;;;;;;GAOG;AAEH,4BAA4B;AAC5B,eAAO,MAAM,aAAa,EADf,WAAW,EAoDrB,CAAC;AAEF,eAAO,MAAM,mBAAmB,UAAuD,CAAC;AACxF,eAAO,MAAM,qBAAqB,UAA2B,CAAC"}