@2kw/ai 7.3.0-dev.1 → 7.3.0-dev.8

package/dist/bridge/store.js

@@ -0,0 +1,110 @@
+import { basename, dirname, join, resolve } from "node:path";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { CliUsageError } from "../lib/errors.js";
+import { privateKeyFromPem, privateKeyToPem } from "../relay-protocol/keys.js";
+import { MAX_WORKSPACES, WORKSPACE_NAME, parseBridgeToml, stringifyBridgeToml } from "./toml.js";
+/**
+ * The bridge's three files (#1377, plan P14): `key.pem` and `identity.json`, readable by the user
+ * only, and `bridge.toml`. On Windows the mode bits are inert; the files rely on the profile
+ * directory's own permissions.
+ */
+const KEY_FILE = "key.pem";
+const IDENTITY_FILE = "identity.json";
+const CONFIG_FILE = "bridge.toml";
+function writeSecretFile(path, data) {
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const tmp = `${path}.tmp`;
+    // Owner-only from the first byte; the rename replaces the old file in one step.
+    writeFileSync(tmp, data, { mode: 0o600 });
+    renameSync(tmp, path);
+    chmodSync(path, 0o600);
+}
+export function writeKey(dir, key) {
+    writeSecretFile(join(dir, KEY_FILE), privateKeyToPem(key));
+}
+export function readKey(dir) {
+    return privateKeyFromPem(readFileSync(join(dir, KEY_FILE), "utf8"));
+}
+export function writeIdentity(dir, identity) {
+    writeSecretFile(join(dir, IDENTITY_FILE), JSON.stringify(identity, null, 2));
+}
+/** identity.json is not JSON: `connect` pairs over it, every other command names the file to delete. */
+export class UnreadableIdentityError extends CliUsageError {
+    path;
+    constructor(path) {
+        super(`${path} is unreadable. Delete ${path}, then run 2kw bridge connect again.`);
+        this.path = path;
+        this.name = "UnreadableIdentityError";
+    }
+}
+/** null when this computer is not connected. */
+export function readIdentity(dir) {
+    const path = join(dir, IDENTITY_FILE);
+    if (!existsSync(path))
+        return null;
+    try {
+        return JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        throw new UnreadableIdentityError(path);
+    }
+}
+export function deleteIdentity(dir) {
+    rmSync(join(dir, IDENTITY_FILE), { force: true });
+}
+export function configPath(dir) {
+    return join(dir, CONFIG_FILE);
+}
+export function readConfig(dir) {
+    const path = configPath(dir);
+    if (!existsSync(path))
+        return { workspaces: [] };
+    try {
+        return parseBridgeToml(readFileSync(path, "utf8"));
+    }
+    catch (error) {
+        throw new CliUsageError(`${path}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function writeConfig(dir, config) {
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    writeFileSync(configPath(dir), stringifyBridgeToml(config));
+}
+/** The folder name, lowercased, with every character a workspace name cannot hold turned into `-`. */
+function defaultName(path) {
+    return basename(path)
+        .toLowerCase()
+        .replace(/[^a-z0-9._-]+/g, "-")
+        .replace(/^[^a-z0-9]+/, "")
+        .slice(0, 64);
+}
+export function addWorkspace(dir, path, name) {
+    const resolved = resolve(path);
+    if (!existsSync(resolved) || !statSync(resolved).isDirectory()) {
+        throw new CliUsageError(`${resolved} is not an existing folder`);
+    }
+    const workspaceName = name ?? defaultName(resolved);
+    if (!WORKSPACE_NAME.test(workspaceName)) {
+        throw new CliUsageError(`'${workspaceName}' cannot be a workspace name: use 1 to 64 lowercase letters, digits, '.', '_' or '-', ` +
+            "starting with a letter or digit (--name sets it)");
+    }
+    const config = readConfig(dir);
+    if (config.workspaces.length >= MAX_WORKSPACES) {
+        throw new CliUsageError(`This computer already offers ${MAX_WORKSPACES} workspaces, the most it can. Remove one first with 2kw bridge remove <name>.`);
+    }
+    if (config.workspaces.some((w) => w.name === workspaceName)) {
+        throw new CliUsageError(`A workspace named '${workspaceName}' already exists`);
+    }
+    const workspace = { name: workspaceName, path: resolved };
+    writeConfig(dir, { ...config, workspaces: [...config.workspaces, workspace] });
+    return workspace;
+}
+export function removeWorkspace(dir, name) {
+    const config = readConfig(dir);
+    const workspaces = config.workspaces.filter((w) => w.name !== name);
+    if (workspaces.length === config.workspaces.length) {
+        throw new CliUsageError(`No workspace named '${name}'`);
+    }
+    writeConfig(dir, { ...config, workspaces });
+}
+//# sourceMappingURL=store.js.map

package/dist/bridge/toml.d.ts

@@ -0,0 +1,16 @@
+export interface Workspace {
+    name: string;
+    path: string;
+}
+/** bridge.toml: an optional top-level `shell` and `[[workspace]]` tables with `name` and `path`. */
+export interface BridgeConfig {
+    shell?: string;
+    workspaces: Workspace[];
+}
+export declare const WORKSPACE_NAME: RegExp;
+/** The most workspaces the backend takes in one inventory. */
+export declare const MAX_WORKSPACES = 50;
+/** Throws a plain message on anything that is not a bridge.toml this bridge wrote or could have. */
+export declare function parseBridgeToml(text: string): BridgeConfig;
+export declare function stringifyBridgeToml(config: BridgeConfig): string;
+//# sourceMappingURL=toml.d.ts.map

package/dist/bridge/toml.js

@@ -0,0 +1,39 @@
+import { parse, stringify } from "smol-toml";
+export const WORKSPACE_NAME = /^[a-z0-9][a-z0-9._-]{0,63}$/;
+/** The most workspaces the backend takes in one inventory. */
+export const MAX_WORKSPACES = 50;
+/** Throws a plain message on anything that is not a bridge.toml this bridge wrote or could have. */
+export function parseBridgeToml(text) {
+    const raw = parse(text);
+    const shell = raw.shell;
+    if (shell !== undefined && typeof shell !== "string") {
+        throw new Error("shell must be a path");
+    }
+    const tables = raw.workspace ?? [];
+    if (!Array.isArray(tables)) {
+        throw new Error("workspace must be a list of [[workspace]] tables");
+    }
+    if (tables.length > MAX_WORKSPACES) {
+        throw new Error(`at most ${MAX_WORKSPACES} [[workspace]] tables`);
+    }
+    const names = new Set();
+    const workspaces = tables.map((table) => {
+        const { name, path } = (table ?? {});
+        if (typeof name !== "string" || !WORKSPACE_NAME.test(name) || typeof path !== "string" || path === "") {
+            throw new Error("every [[workspace]] needs a valid name and a path");
+        }
+        if (names.has(name))
+            throw new Error(`the workspace name '${name}' is used twice`);
+        names.add(name);
+        return { name, path };
+    });
+    return shell === undefined ? { workspaces } : { shell, workspaces };
+}
+export function stringifyBridgeToml(config) {
+    const doc = {};
+    if (config.shell !== undefined)
+        doc.shell = config.shell;
+    doc.workspace = config.workspaces.map(({ name, path }) => ({ name, path }));
+    return `${stringify(doc)}\n`;
+}
+//# sourceMappingURL=toml.js.map

package/dist/commands/bridge.d.ts

@@ -0,0 +1,7 @@
+import { Command } from "commander";
+/**
+ * `2kw bridge`: lets chat run the commands you approve on this computer (#1377, spec §2.1, plan P14).
+ * S1 pairs, registers and stays present; commands arrive with #1378.
+ */
+export declare function makeBridgeCommand(): Command;
+//# sourceMappingURL=bridge.d.ts.map

package/dist/commands/bridge.js

@@ -0,0 +1,228 @@
+import chalk from "chalk";
+import { Command } from "commander";
+import { LABEL, collectInventory, deviceName, deviceOs } from "../bridge/inventory.js";
+import { DeviceGoneError, awaitConfirmation, disconnectDevice, redeem, reportInventory } from "../bridge/pairing.js";
+import { bridgeDir } from "../bridge/paths.js";
+import { runBridge } from "../bridge/run.js";
+import { findBash } from "../bridge/shell.js";
+import { addWorkspace, configPath, deleteIdentity, readConfig, readIdentity, readKey, removeWorkspace, UnreadableIdentityError, writeIdentity, writeKey, } from "../bridge/store.js";
+import { getClient, runAction } from "../lib/client.js";
+import { DEFAULT_BASE_URL, getActiveContext, isJsonOutput } from "../lib/config.js";
+import { CliUsageError } from "../lib/errors.js";
+import { formatList, formatSuccess } from "../lib/output.js";
+import { generatePrivateKey } from "../relay-protocol/keys.js";
+/** Account endpoints take a browser sign-in; said where `--help` shows it, as in connectors.ts. */
+const SESSION_ONLY = "Signed-in accounts only: run 2kw auth login and sign in through the browser";
+/** The backend to pair with: `--base-url`, then AI_2KW_BASE_URL, the active context, the default. No credential needed. */
+function baseUrlOf(command) {
+    let root = command;
+    while (root.parent)
+        root = root.parent;
+    const url = root.opts().baseUrl ?? process.env.AI_2KW_BASE_URL ?? getActiveContext()?.baseUrl;
+    return (url ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
+}
+/** Plain http only to this computer: the pairing answer carries the keys the bridge trusts. */
+function requireHttps(baseUrl) {
+    const { protocol, hostname } = new URL(baseUrl);
+    if (protocol === "https:" || (protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(hostname))) {
+        return baseUrl;
+    }
+    throw new CliUsageError(`${baseUrl} is not an https address. The bridge connects only over https, or over http to this computer (localhost).`);
+}
+function checkLabel(value, what) {
+    if (!LABEL.test(value)) {
+        throw new CliUsageError(`${what} must be 1 to 64 characters on one line, without control or invisible characters`);
+    }
+    return value;
+}
+/** Loads the key and identity of a connected computer, or says how to connect one. */
+function connected(dir) {
+    const identity = readIdentity(dir);
+    if (identity === null) {
+        throw new CliUsageError("This computer is not connected. Run 2kw bridge connect <code> with the code from chat.");
+    }
+    return { identity, key: readKey(dir) };
+}
+/**
+ * `2kw bridge`: lets chat run the commands you approve on this computer (#1377, spec §2.1, plan P14).
+ * S1 pairs, registers and stays present; commands arrive with #1378.
+ */
+export function makeBridgeCommand() {
+    const cmd = new Command("bridge").description("Connect this computer to chat, so commands you approve in a conversation can run here");
+    cmd
+        .command("connect")
+        .description("Connect this computer with the code shown in chat under Devices")
+        .argument("<code>", "Pairing code from chat (bbp_…)")
+        .option("--name <name>", "Name chat shows for this computer; the computer name when omitted")
+        .action(async (code, opts, command) => {
+        await runAction(command, async () => {
+            const dir = bridgeDir();
+            let existing;
+            try {
+                existing = readIdentity(dir);
+            }
+            catch (error) {
+                if (!(error instanceof UnreadableIdentityError))
+                    throw error;
+                console.error(chalk.yellow(`${error.path} is unreadable; this pairing replaces it once you confirm.`));
+                existing = null;
+            }
+            if (existing !== null) {
+                throw new CliUsageError(`This computer is already connected as '${existing.name}'. Run 2kw bridge disconnect first.`);
+            }
+            const baseUrl = requireHttps(baseUrlOf(command));
+            const name = checkLabel(opts.name ?? deviceName(), "--name");
+            const key = generatePrivateKey();
+            const redeemed = await redeem(baseUrl, key, code.trim(), name, deviceOs());
+            console.log(`Check that chat shows these six words for '${name}':\n`);
+            console.log(`    ${chalk.bold(redeemed.fingerprint.join(" "))}\n`);
+            console.log("If they match, confirm in chat. If they do not, do not confirm. Waiting…");
+            const confirmed = await awaitConfirmation(baseUrl, key, redeemed);
+            if (confirmed === null) {
+                throw new Error("The code expired before it was confirmed. Create a new one in chat and run this again.");
+            }
+            const identity = { ...confirmed, baseUrl, name, pairedAt: new Date().toISOString() };
+            writeKey(dir, key);
+            writeIdentity(dir, identity);
+            try {
+                await reportInventory(identity, key, await collectInventory(readConfig(dir)));
+            }
+            catch (error) {
+                // Paired all the same; `2kw bridge run` reports again when it starts.
+                console.error(chalk.yellow(`Could not send this computer's folders yet: ${String(error)}`));
+            }
+            formatSuccess(`Connected as '${name}'. Add folders with 2kw bridge add <path>, then keep 2kw bridge run open.`, command);
+        });
+    });
+    cmd
+        .command("add")
+        .description("Make a folder on this computer available as a workspace")
+        .argument("<path>", "An existing folder")
+        .option("--name <name>", "Workspace name; the folder name when omitted")
+        .action(async (path, opts, command) => {
+        await runAction(command, async () => {
+            const workspace = addWorkspace(bridgeDir(), path, opts.name);
+            formatSuccess(`Added workspace '${workspace.name}' (${workspace.path}).`, command);
+        });
+    });
+    cmd
+        .command("remove")
+        .description("Stop offering a workspace; the folder itself is untouched")
+        .argument("<name>", "Workspace name, from 2kw bridge list")
+        .action(async (name, _opts, command) => {
+        await runAction(command, async () => {
+            removeWorkspace(bridgeDir(), name);
+            formatSuccess(`Removed workspace '${name}'.`, command);
+        });
+    });
+    cmd
+        .command("list")
+        .description("Show whether this computer is connected, its shell and its workspaces")
+        .action(async (_opts, command) => {
+        await runAction(command, async () => {
+            const dir = bridgeDir();
+            const identity = readIdentity(dir);
+            const config = readConfig(dir);
+            const shell = findBash(config.shell);
+            if (isJsonOutput(command)) {
+                console.log(JSON.stringify({ connected: identity !== null, name: identity?.name, deviceId: identity?.relayId, shell, workspaces: config.workspaces }, null, 2));
+                return;
+            }
+            console.log(identity === null
+                ? "Not connected. Run 2kw bridge connect <code> with the code from chat."
+                : `Connected as '${identity.name}' to ${identity.baseUrl} (device ${identity.relayId}).`);
+            if (shell !== null) {
+                console.log(`Shell: ${shell}`);
+            }
+            else if (config.shell !== undefined) {
+                console.log(chalk.yellow(`The shell set in ${configPath(dir)} does not exist: ${config.shell}`));
+            }
+            else {
+                console.log(chalk.yellow(process.platform === "win32"
+                    ? "No bash found: install Git for Windows, or set shell = \"<path to bash.exe>\" in " + configPath(dir)
+                    : "No bash found on PATH: install bash, or set shell = \"<path>\" in " + configPath(dir)));
+            }
+            if (config.workspaces.length === 0) {
+                console.log("No workspaces. Add one with 2kw bridge add <path>.");
+            }
+            else {
+                formatList(config.workspaces, command, ["name", "path"]);
+            }
+        });
+    });
+    cmd
+        .command("run")
+        .description("Keep this computer reachable from chat while this command runs (Ctrl+C stops)")
+        .action(async (_opts, command) => {
+        await runAction(command, async () => {
+            const dir = bridgeDir();
+            const { identity, key } = connected(dir);
+            requireHttps(identity.baseUrl);
+            const stop = new AbortController();
+            const onSignal = () => stop.abort();
+            process.once("SIGINT", onSignal);
+            process.once("SIGTERM", onSignal);
+            console.log(`'${identity.name}' is reachable from chat while this runs. Press Ctrl+C to stop.`);
+            try {
+                await runBridge(dir, identity, key, stop.signal);
+            }
+            catch (error) {
+                // Revoked: these files can never authenticate again.
+                if (error instanceof DeviceGoneError)
+                    deleteIdentity(dir);
+                throw error;
+            }
+            finally {
+                process.off("SIGINT", onSignal);
+                process.off("SIGTERM", onSignal);
+            }
+        });
+    });
+    cmd
+        .command("disconnect")
+        .description("Disconnect this computer; chat can no longer reach it")
+        .action(async (_opts, command) => {
+        await runAction(command, async () => {
+            const dir = bridgeDir();
+            const { identity, key } = connected(dir);
+            try {
+                await disconnectDevice(identity, key);
+            }
+            catch (error) {
+                // Already revoked elsewhere: forgetting it here is all that is left to do.
+                if (!(error instanceof DeviceGoneError))
+                    throw error;
+            }
+            deleteIdentity(dir);
+            formatSuccess(`Disconnected '${identity.name}'.`, command);
+        });
+    });
+    cmd
+        .command("devices")
+        .description(`List the computers connected to your account. ${SESSION_ONLY}`)
+        .option("--all", "Every computer in the organization, without its folders (admins only)")
+        .action(async (opts, command) => {
+        await runAction(command, async () => {
+            const client = getClient(command);
+            const { data } = await client.GET("/v1/local-bridge/devices", {
+                params: { query: opts.all ? { all: true } : {} },
+            });
+            formatList(data, command, opts.all
+                ? ["id", "name", "ownerMemberId", "os", "status", "lastSeenAt"]
+                : ["id", "name", "os", "status", "lastSeenAt", "workspaces"]);
+        });
+    });
+    cmd
+        .command("revoke")
+        .description(`Disconnect one of your computers; an admin can disconnect any. ${SESSION_ONLY}`)
+        .argument("<deviceId>", "Device ID, from 2kw bridge devices")
+        .action(async (deviceId, _opts, command) => {
+        await runAction(command, async () => {
+            const client = getClient(command);
+            await client.DELETE("/v1/local-bridge/devices/{id}", { params: { path: { id: deviceId } } });
+            formatSuccess(`Device ${deviceId} disconnected.`, command);
+        });
+    });
+    return cmd;
+}
+//# sourceMappingURL=bridge.js.map

package/dist/commands/extractions.js

@@ -131,13 +131,32 @@ export function makeExtractionsCommand() {
     });
     cmd
         .command("rerun")
-        .description("Re-run an extraction")
-        .argument("<id>", "Extraction ID to rerun")
-        .action(async (id, _opts, command) => {
+        .description("Re-run one extraction, or queue a batch (several IDs, or a filter) of up to 100")
+        .argument("[ids...]", "Extraction IDs to rerun")
+        .option("--status <status>", "Rerun extractions with this status (e.g. FAILED)")
+        .option("--schema-version <id>", "Rerun extractions of this schema version")
+        .option("-s, --search <term>", "Rerun extractions whose model contains this text")
+        .action(async (ids, opts, command) => {
         await runAction(command, async () => {
             const client = getClient(command);
-            const { data } = await withSpinner("Re-running extraction...", () => client.POST("/v1/extractions/{id}/rerun", {
-                params: { path: { id } },
+            const filtered = Boolean(opts.status || opts.schemaVersion || opts.search);
+            if (ids.length === 1 && !filtered) {
+                const { data } = await withSpinner("Re-running extraction...", () => client.POST("/v1/extractions/{id}/rerun", {
+                    params: { path: { id: ids[0] } },
+                }));
+                formatDetail(data, command);
+                return;
+            }
+            if (ids.length === 0 && !filtered) {
+                throw new Error("Pass an extraction ID, several IDs, or a filter (--status, --schema-version, --search).");
+            }
+            if (ids.length > 0 && filtered) {
+                throw new Error("Pass extraction IDs or a filter, not both.");
+            }
+            const { data } = await withSpinner("Queueing re-runs...", () => client.POST("/v1/extractions/rerun", {
+                body: filtered
+                    ? { status: opts.status, schemaVersionId: opts.schemaVersion, search: opts.search }
+                    : { ids },
             }));
             formatDetail(data, command);
         });

package/dist/index.js

@@ -34,6 +34,7 @@ import { makeFilesCommand } from "./commands/files.js";
 import { makeInstallationsCommand } from "./commands/installations.js";
 import { makeConnectorsCommand } from "./commands/connectors.js";
 import { makeRelaysCommand } from "./commands/relays.js";
+import { makeBridgeCommand } from "./commands/bridge.js";
 import { checkForUpdates } from "./lib/update-notifier.js";
 const updater = checkForUpdates(pkg.version);
 const program = new Command();
@@ -75,6 +76,7 @@ program.addCommand(makeFilesCommand());
 program.addCommand(makeInstallationsCommand());
 program.addCommand(makeConnectorsCommand());
 program.addCommand(makeRelaysCommand());
+program.addCommand(makeBridgeCommand());
 program.addCommand(makeDocsCommand());
 program.parseAsync().then(() => updater.notify());
 //# sourceMappingURL=index.js.map

package/dist/relay-protocol/b64.d.ts

@@ -0,0 +1,13 @@
+/** base64url without padding (RFC 4648 §5), contract C1. */
+export declare function b64url(bytes: Uint8Array): string;
+/**
+ * Decodes the canonical unpadded base64url of contract C1 and nothing else. Node's decoder is
+ * lenient: it drops a dangling character that carries no whole byte ("A" gives no bytes) and
+ * ignores non-canonical trailing bits ("-_8", "-_9" and "-__" all give 0xfb 0xff). Re-encoding
+ * the result is what rejects those, so one byte string has exactly one accepted spelling.
+ */
+export declare function fromB64url(value: string): Buffer;
+export declare function sha256(data: Uint8Array | string): Buffer;
+export declare function sha256b64url(data: Uint8Array | string): string;
+export declare function randomHex(bytes: number): string;
+//# sourceMappingURL=b64.d.ts.map

package/dist/relay-protocol/b64.js

@@ -0,0 +1,34 @@
+// GENERATED COPY of relay/src/protocol/b64.ts (#1377). Do not edit here: edit the relay's file,
+// then run `npm run sync:relay-protocol` in cli/. `npm run check:relay-protocol` fails on any drift.
+import { createHash, randomBytes } from "node:crypto";
+const BASE64URL = /^[A-Za-z0-9_-]*$/;
+/** base64url without padding (RFC 4648 §5), contract C1. */
+export function b64url(bytes) {
+    return Buffer.from(bytes).toString("base64url");
+}
+/**
+ * Decodes the canonical unpadded base64url of contract C1 and nothing else. Node's decoder is
+ * lenient: it drops a dangling character that carries no whole byte ("A" gives no bytes) and
+ * ignores non-canonical trailing bits ("-_8", "-_9" and "-__" all give 0xfb 0xff). Re-encoding
+ * the result is what rejects those, so one byte string has exactly one accepted spelling.
+ */
+export function fromB64url(value) {
+    if (!BASE64URL.test(value)) {
+        throw new Error("invalid base64url");
+    }
+    const decoded = Buffer.from(value, "base64url");
+    if (b64url(decoded) !== value) {
+        throw new Error("invalid base64url");
+    }
+    return decoded;
+}
+export function sha256(data) {
+    return createHash("sha256").update(data).digest();
+}
+export function sha256b64url(data) {
+    return b64url(sha256(data));
+}
+export function randomHex(bytes) {
+    return randomBytes(bytes).toString("hex");
+}
+//# sourceMappingURL=b64.js.map

package/dist/relay-protocol/canonical-json.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Contract C10: keys sorted by code unit, arrays in order, no whitespace.
+ *
+ * The Java twin is CanonicalJson.java, and the two must agree byte for byte — `configHash` is
+ * computed on both sides, so a value the two platforms serialize differently would change the
+ * hash silently and every request assertion would then fail with no clue why. Where the
+ * platforms differ by default, the vectors in test/vectors/inventory.json pin this side's
+ * behaviour and test/vectors/README.md restates it: non-ASCII characters stay raw (never
+ * `\uXXXX`), control characters escape to lower-case `\u00xx` with the short forms for
+ * \b \f \n \r \t, `/` and DEL stay unescaped, and key order is UTF-16 code unit order
+ * (JavaScript `<`, Java `String.compareTo`), not UTF-8 byte order.
+ *
+ * Ruling C10-strict: everything outside that agreement is REFUSED rather than serialized.
+ * Fail closed — a `CanonicalJsonError` at the call site is a bug report; a hash that differs
+ * by platform is a support case nobody can diagnose.
+ */
+export declare class CanonicalJsonError extends Error {
+    readonly code = "unsupported_value";
+    constructor(message: string);
+}
+export declare function canonicalJson(value: unknown): string;
+//# sourceMappingURL=canonical-json.d.ts.map

package/dist/relay-protocol/canonical-json.js

@@ -0,0 +1,101 @@
+// GENERATED COPY of relay/src/protocol/canonical-json.ts (#1377). Do not edit here: edit the relay's file,
+// then run `npm run sync:relay-protocol` in cli/. `npm run check:relay-protocol` fails on any drift.
+/**
+ * Contract C10: keys sorted by code unit, arrays in order, no whitespace.
+ *
+ * The Java twin is CanonicalJson.java, and the two must agree byte for byte — `configHash` is
+ * computed on both sides, so a value the two platforms serialize differently would change the
+ * hash silently and every request assertion would then fail with no clue why. Where the
+ * platforms differ by default, the vectors in test/vectors/inventory.json pin this side's
+ * behaviour and test/vectors/README.md restates it: non-ASCII characters stay raw (never
+ * `\uXXXX`), control characters escape to lower-case `\u00xx` with the short forms for
+ * \b \f \n \r \t, `/` and DEL stay unescaped, and key order is UTF-16 code unit order
+ * (JavaScript `<`, Java `String.compareTo`), not UTF-8 byte order.
+ *
+ * Ruling C10-strict: everything outside that agreement is REFUSED rather than serialized.
+ * Fail closed — a `CanonicalJsonError` at the call site is a bug report; a hash that differs
+ * by platform is a support case nobody can diagnose.
+ */
+export class CanonicalJsonError extends Error {
+    code = "unsupported_value";
+    constructor(message) {
+        super(message);
+        this.name = "CanonicalJsonError";
+    }
+}
+/**
+ * A lone surrogate — a UTF-16 code unit with no partner. It is legal in a JavaScript string
+ * and reachable from legal JSON text (`"\ud800"`), but it has no UTF-8 encoding: JavaScript
+ * escapes it back, Java writes a replacement character or raises, and the two digests part
+ * company. Written as an explicit scan rather than a lookbehind regex so the Java twin can
+ * restate it line for line.
+ */
+function hasLoneSurrogate(text) {
+    for (let i = 0; i < text.length; i += 1) {
+        const unit = text.charCodeAt(i);
+        if (unit >= 0xd800 && unit <= 0xdbff) {
+            const next = i + 1 < text.length ? text.charCodeAt(i + 1) : 0;
+            if (next < 0xdc00 || next > 0xdfff) {
+                return true;
+            }
+            i += 1;
+        }
+        else if (unit >= 0xdc00 && unit <= 0xdfff) {
+            return true;
+        }
+    }
+    return false;
+}
+/** Only a plain object carries its data in its own enumerable properties; a Date or a Map does not. */
+function isPlainObject(value) {
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+}
+function refuse(what) {
+    throw new CanonicalJsonError(`canonical JSON does not support ${what}`);
+}
+function encodeString(value, what) {
+    if (hasLoneSurrogate(value)) {
+        refuse(`a lone surrogate in ${what}`);
+    }
+    return JSON.stringify(value);
+}
+export function canonicalJson(value) {
+    if (Array.isArray(value)) {
+        // An array element has no "drop it" option the way a property does: dropping one would
+        // change the array's length, so an unrepresentable element is refused.
+        return `[${value.map((element) => canonicalJson(element)).join(",")}]`;
+    }
+    switch (typeof value) {
+        case "string":
+            return encodeString(value, "a string");
+        case "boolean":
+            return value ? "true" : "false";
+        case "number":
+            if (!Number.isSafeInteger(value) || Object.is(value, -0)) {
+                // JavaScript prints 1.0 as "1" and 1e21 as "1e+21"; Java's Double.toString gives
+                // "1.0" and "1.0E21". Only safe integers spell the same on both sides.
+                refuse(`the number ${String(value)}; only safe integers are portable`);
+            }
+            return String(value);
+        case "object": {
+            if (value === null) {
+                return "null";
+            }
+            if (!isPlainObject(value)) {
+                refuse(`${value.constructor?.name ?? "a non-plain object"}; use a plain object or an array`);
+            }
+            const entries = Object.entries(value)
+                // The brief drops an undefined property: an absent key and an undefined one mean the
+                // same thing in JSON, and dropping it changes nothing either side can observe.
+                .filter(([, v]) => v !== undefined)
+                .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+            return `{${entries.map(([k, v]) => `${encodeString(k, "a key")}:${canonicalJson(v)}`).join(",")}}`;
+        }
+        case "undefined":
+            return refuse("undefined outside an object property");
+        default:
+            return refuse(`a ${typeof value} value`);
+    }
+}
+//# sourceMappingURL=canonical-json.js.map