@blotout/qinto-cli 0.1.5 → 0.1.7

package/dist/worker-artifact/app-runtime/index.js

@@ -14584,7 +14584,7 @@ var envelopeRequestSchema = external_exports.object({
     globalId: external_exports.string().min(1).max(64).nullable(),
     properties: external_exports.record(external_exports.string(), external_exports.unknown()),
     geo: external_exports.record(external_exports.string(), external_exports.string()).optional()
-  }).strict(),
+  }).strict().optional(),
   consent: external_exports.object({ enabled: external_exports.boolean(), categories: external_exports.record(external_exports.string(), external_exports.boolean()), apps: external_exports.record(external_exports.string(), external_exports.boolean()) }).strict().optional(),
   geo: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
   // Only what this app captured or wrote for this visitor; `updatedAt` is when the current value
@@ -14608,7 +14608,11 @@ var envelopeRequestSchema = external_exports.object({
     browser: external_exports.record(external_exports.string().min(1).max(64), external_exports.unknown()).optional(),
     origin: external_exports.object({ app: external_exports.string().min(1).max(30), install: external_exports.number().int().min(1), depth: external_exports.number().int().min(0) }).strict().optional()
   }).strict().optional()
-}).strict();
+}).strict().superRefine((envelope, ctx) => {
+  if (envelope.kind !== "rpc" && envelope.user === void 0) {
+    ctx.addIssue({ code: "custom", path: ["user"], message: `A ${envelope.kind} envelope needs a user` });
+  }
+});
 var envelopeResponseSchema = external_exports.object({
   v: external_exports.literal(ENVELOPE_VERSION),
   // Transform invocations only: pass the action through, drop it, or replace its payload (§5.4).
@@ -15361,6 +15365,7 @@ var brokerActive = async (env, input) => {
 };
 var buildAppsClient = (env, envelope) => {
   const caller = callerSlug(env);
+  const subject = envelope.user?.anonId;
   return {
     call: async (callee, fn, args, options) => {
       const answer = await askBroker(env, `apps.call ${callee}.${fn}`, {
@@ -15368,7 +15373,9 @@ var buildAppsClient = (env, envelope) => {
         kind: "rpc",
         slug: caller,
         key: env.QINTO_INTERNAL_KEY,
-        userId: envelope.user.anonId,
+        // An endpoint, schedule or panel calls with no visitor; the broker then reaches the callee
+        // with no user block and its ctx.user is null.
+        ...subject === void 0 ? {} : { userId: subject },
         callee,
         fn,
         args,
@@ -15430,6 +15437,14 @@ var buildObservability = () => {
   };
 };
 
+// src/subject.ts
+var requireSubject = (anonId, what) => {
+  if (anonId === null) {
+    throw new Error(`${what} needs a visitor, and this invocation has none.`);
+  }
+  return anonId;
+};
+
 // src/variables.ts
 var parseVariableMaps = (env) => {
   const maps = /* @__PURE__ */ new Map();
@@ -15565,9 +15580,9 @@ var readOnce = (env, subject) => {
     return pending;
   };
 };
-var fetchedContext = (env, anonId, collector) => {
+var fetchedContext = (env, subject, collector) => {
   const read = readOnce(env, () => {
-    return anonId;
+    return subject("context.load");
   });
   return {
     private: {
@@ -15575,6 +15590,7 @@ var fetchedContext = (env, anonId, collector) => {
         return (await read()).private;
       },
       set: (patch) => {
+        subject("context.set");
         collector.set("private", patch);
       }
     },
@@ -15583,6 +15599,7 @@ var fetchedContext = (env, anonId, collector) => {
         return (await read()).shared;
       },
       set: (patch) => {
+        subject("context.set");
         collector.set("shared", patch);
       }
     }
@@ -15654,20 +15671,15 @@ var readStamp = (payload) => {
   }
   return { q: stamp, payload: params?.payload };
 };
-var requireSubject = (anonId, what) => {
-  if (anonId === null) {
-    throw new Error(`${what} needs a visitor, and this workflow was started without one.`);
-  }
-  return anonId;
-};
 var buildWorkflowContext = (env, stamp) => {
   const { variableKinds, appVariableKinds } = contextKindsOf(env);
   const { variables, secrets } = projectInstallValues(parseVariableMaps(env), variableKinds, stamp.ord);
   const { appVariables, appSecrets } = projectAppValues(env, appVariableKinds);
   const install = { id: stamp.installId, label: stamp.installLabel };
-  const client = (anonId) => {
-    return buildAppsClient(env, { user: { anonId, globalId: null, properties: {} }, depth: 0 });
-  };
+  const apps = buildAppsClient(env, {
+    ...stamp.anonId === null ? {} : { user: { anonId: stamp.anonId, globalId: null, properties: {} } },
+    depth: 0
+  });
   return {
     env,
     install,
@@ -15690,15 +15702,7 @@ var buildWorkflowContext = (env, stamp) => {
         broadcast: message.broadcast
       });
     },
-    apps: {
-      call: async (slug, fn, args, options) => {
-        return client(requireSubject(stamp.anonId, "apps.call")).call(slug, fn, args, options);
-      },
-      // The broker's installs body carries no subject, so this keeps working without one.
-      installs: async (slug) => {
-        return client(stamp.anonId ?? "").installs(slug);
-      }
-    }
+    apps
   };
 };
 var handlerFor = (bundle, className) => {
@@ -15747,6 +15751,7 @@ var buildContext = ({
   context
 }) => {
   const { variables, secrets } = projectInstallValues(maps, kinds, install.ord);
+  const subject = envelope.user?.anonId ?? null;
   return {
     env,
     site: envelope.site,
@@ -15755,18 +15760,19 @@ var buildContext = ({
       ord: install.ord,
       installId: install.id,
       installLabel: install.label,
-      anonId: envelope.user.anonId
+      anonId: subject
     }),
     variables,
     secrets,
     appVariables: appScope.appVariables,
     appSecrets: appScope.appSecrets,
-    user: envelope.user,
+    user: envelope.user ?? null,
     consent: envelope.consent,
     geo: envelope.geo,
     // Collect one entry past the per-install cap: the platform rejects an over-limit group whole,
     // and the extra entry keeps it visibly over while bounding memory.
     emit: (event) => {
+      requireSubject(subject, "emit");
       if (event.type !== "track") {
         throw new Error("only track events may be emitted");
       }
@@ -15779,6 +15785,7 @@ var buildContext = ({
       }
     },
     push: (message) => {
+      requireSubject(subject, "push");
       if (pushes.length <= MAX_PUSHES_PER_INSTALL) {
         pushes.push(message);
       }
@@ -15786,6 +15793,7 @@ var buildContext = ({
     attribution: {
       values: envelope.attribution ?? {},
       set: (key, value) => {
+        requireSubject(subject, "attribution.set");
         if (attribution.length <= MAX_ATTRIBUTION_WRITES_PER_INSTALL) {
           attribution.push({ key, value });
         }
@@ -15793,19 +15801,21 @@ var buildContext = ({
     },
     facts: {
       list: (input) => {
-        return brokerFactsRead(env, envelope.user.anonId, input);
+        return brokerFactsRead(env, requireSubject(subject, "facts.list"), input);
       }
     },
     context: {
       private: {
         entry: envelope.context?.private ?? null,
         set: (patch) => {
+          requireSubject(subject, "context.set");
           context.set("private", patch);
         }
       },
       shared: {
         byApp: envelope.context?.shared ?? {},
         set: (patch) => {
+          requireSubject(subject, "context.set");
           context.set("shared", patch);
         }
       }
@@ -15870,6 +15880,7 @@ var dispatchSchedule = async (envelope, bundle, env) => {
       appVariables: appScope.appVariables,
       appSecrets: appScope.appSecrets,
       observability: buildObservability(),
+      apps: buildAppsClient(env, { depth: 0 }),
       push: async (userId, message) => {
         await brokerPush(env, {
           userId,
@@ -16073,14 +16084,15 @@ var buildContext2 = ({ env, maps, kinds, appScope, install }) => {
   return {
     env,
     install: { id: install.id, label: install.label },
-    // An endpoint has no visitor, so a workflow it starts cannot push or call other apps. `push`
-    // below is the exception: it names its subject rather than inheriting one.
+    // An endpoint has no visitor, so a workflow it starts cannot push. `push` below is the
+    // exception: it names its subject rather than inheriting one.
     startWorkflow: buildStartWorkflow({ ord: install.ord, installId: install.id, installLabel: install.label, anonId: null }),
     variables,
     secrets,
     appVariables: appScope.appVariables,
     appSecrets: appScope.appSecrets,
     observability: buildObservability(),
+    apps: buildAppsClient(env, { depth: 0 }),
     push: async (userId, message) => {
       await brokerPush(env, {
         userId,
@@ -16361,7 +16373,8 @@ var dispatchUi = async ({ request, env, versions }) => {
     appVariables,
     appSecrets,
     viewer: context.viewer,
-    observability: buildObservability()
+    observability: buildObservability(),
+    apps: buildAppsClient(env, { depth: 0 })
   };
   let response;
   try {
@@ -16382,6 +16395,29 @@ var dispatchUi = async ({ request, env, versions }) => {
   return response;
 };
 
+// src/durable-object.ts
+var VERSION_KEY = "qintoSchemaVersion";
+var applyDurableObjectMigrations = (storage, migrations) => {
+  const applied = storage.kv.get(VERSION_KEY) ?? 0;
+  for (const [index, migration] of migrations.entries()) {
+    if (index < applied) {
+      continue;
+    }
+    for (const statement of migration.statements) {
+      storage.sql.exec(statement);
+    }
+    storage.kv.put(VERSION_KEY, index + 1);
+  }
+};
+var withAppDurableObject = (Base, migrations) => {
+  return class extends Base {
+    constructor(ctx, env) {
+      applyDurableObjectMigrations(ctx.storage, migrations);
+      super(ctx, env);
+    }
+  };
+};
+
 // src/index.ts
 installTracedFetch();
 var toHandler = (candidate) => {
@@ -16528,9 +16564,16 @@ var dispatchRpc = async (envelope, bundle, env) => {
   const maps = parseVariableMaps(env);
   const { variableKinds: kinds, appVariableKinds } = contextKindsOf(env);
   const appScope = projectAppValues(env, appVariableKinds);
+  const subject = envelope.user?.anonId ?? null;
   const ctx = {
     ...buildContext({ env, envelope, install, maps, kinds, appScope, emits, pushes, attribution, context }),
-    context: fetchedContext(env, envelope.user.anonId, context)
+    context: fetchedContext(
+      env,
+      (what) => {
+        return requireSubject(subject, what);
+      },
+      context
+    )
   };
   let value;
   try {
@@ -16639,5 +16682,6 @@ var createRuntime = (input) => {
 };
 export {
   createRuntime,
-  createWorkflow
+  createWorkflow,
+  withAppDurableObject
 };

package/dist/worker-artifact/apps-ui/index.js

@@ -8,8 +8,10 @@ var withSecurityHeaders = /* @__PURE__ */ __name((response, portalOrigin) => {
   response.headers.set("content-security-policy", `frame-ancestors ${portalOrigin}`);
   response.headers.set("x-content-type-options", "nosniff");
   response.headers.set("referrer-policy", "no-referrer");
+  response.headers.set("vary", "sec-fetch-dest");
   return response;
 }, "withSecurityHeaders");
+var NAVIGATION_DESTINATIONS = /* @__PURE__ */ new Set(["document", "object", "embed"]);
 var assetKeys = /* @__PURE__ */ __name((hostname, pathname) => {
   const dot = hostname.indexOf(".");
   const slug = dot === -1 ? hostname : hostname.slice(0, dot);
@@ -27,6 +29,10 @@ var serve = /* @__PURE__ */ __name(async (request, env) => {
   if (request.method !== "GET" && request.method !== "HEAD") {
     return new Response("method not allowed", { status: 405 });
   }
+  const destination = request.headers.get("sec-fetch-dest");
+  if (destination !== null && NAVIGATION_DESTINATIONS.has(destination)) {
+    return new Response("unauthorized", { status: 401 });
+  }
   const url = new URL(request.url);
   const keys = assetKeys(url.hostname, url.pathname);
   if (keys === null) {