@brightbeamai/chap-coordinator 0.3.3 → 0.3.4

package/dist/index.d.cts

@@ -5,7 +5,7 @@ import { AuditEntry, Envelope } from './types.cjs';
 export { ArtefactId, ArtefactRoutingHints, AuditListener, Deliberation, DeliberationVote, Handoff, HandoffTaskItem, JsonPatchOp, Jwk, KeyRecord, Member, Mode, OverrideArtefact, ParticipantType, ParticipantUri, PauseScope, RefusalOutcome, ReviewDecision, RouteDecisionArtefact, SnapshotArtefact, Task, TaskId, TaskRoutingHints, TaskState, WhisperPrompt, Workspace, WorkspaceId, WorkspaceState, modeLE } from './types.cjs';
 export { MemoryStore, Store, StoreChange, StoreConflictError, WorkspaceRecord } from './storage/store.cjs';
 export { E, isValidEnvelope, rpcError } from './jsonrpc.cjs';
-export { PatchError, applyJsonPatch, diffJsonPatch } from './patch.cjs';
+export { DEFAULT_MAX_PATCHED_BYTES, PatchError, PatchLimits, applyJsonPatch, diffJsonPatch } from './patch.cjs';
 import { KeyObject } from 'node:crypto';
 
 /** The value an entry's chain link hashes. */

package/dist/index.d.ts

@@ -5,7 +5,7 @@ import { AuditEntry, Envelope } from './types.js';
 export { ArtefactId, ArtefactRoutingHints, AuditListener, Deliberation, DeliberationVote, Handoff, HandoffTaskItem, JsonPatchOp, Jwk, KeyRecord, Member, Mode, OverrideArtefact, ParticipantType, ParticipantUri, PauseScope, RefusalOutcome, ReviewDecision, RouteDecisionArtefact, SnapshotArtefact, Task, TaskId, TaskRoutingHints, TaskState, WhisperPrompt, Workspace, WorkspaceId, WorkspaceState, modeLE } from './types.js';
 export { MemoryStore, Store, StoreChange, StoreConflictError, WorkspaceRecord } from './storage/store.js';
 export { E, isValidEnvelope, rpcError } from './jsonrpc.js';
-export { PatchError, applyJsonPatch, diffJsonPatch } from './patch.js';
+export { DEFAULT_MAX_PATCHED_BYTES, PatchError, PatchLimits, applyJsonPatch, diffJsonPatch } from './patch.js';
 import { KeyObject } from 'node:crypto';
 
 /** The value an entry's chain link hashes. */

package/dist/index.js

@@ -500,77 +500,116 @@ function deepEqual(a, b) {
   }
   return true;
 }
-function applyOne(doc, op) {
+function addAt(doc, path, value, size, copied = false, movedFrom) {
+  const parts = splitPath(path);
+  if (parts.length === 0) {
+    if (size) {
+      size.reset(value);
+      if (copied || movedFrom !== void 0) size.carry(size);
+    }
+    return value;
+  }
+  const [parent, key] = navigate(doc, parts);
+  let newKey;
+  if (Array.isArray(parent)) {
+    if (key === "-") {
+      parent.push(value);
+    } else {
+      const idx = key;
+      if (idx < 0 || idx > parent.length) {
+        throw new PatchError(`Index out of range for add: ${path}`);
+      }
+      parent.splice(idx, 0, value);
+    }
+  } else if (parent !== null && typeof parent === "object") {
+    if (Object.prototype.hasOwnProperty.call(parent, key)) size?.take(parent[key]);
+    else newKey = key;
+    parent[key] = value;
+  } else {
+    throw new PatchError(`Cannot add into ${jsonType(parent)}`);
+  }
+  if (size) {
+    if (movedFrom === void 0) {
+      const inserted = size.insert(value, parts.length, newKey);
+      if (copied) size.carry(inserted);
+    } else {
+      if (newKey !== void 0) size.bytes += utf8Length(newKey);
+      if (parts.length > movedFrom) {
+        const moved = sizeOf(value);
+        size.depth = Math.max(size.depth, parts.length + moved.depth);
+        size.carry(moved);
+      }
+    }
+  }
+  return doc;
+}
+function removeAt(doc, path, size, moved = false) {
+  const parts = splitPath(path);
+  if (parts.length === 0) throw new PatchError("Cannot remove root.");
+  const [parent, key] = navigate(doc, parts);
+  if (Array.isArray(parent)) {
+    const idx = key === "-" ? -1 : key;
+    if (idx < 0 || idx >= parent.length) {
+      throw new PatchError(`Index out of range for remove: ${path}`);
+    }
+    if (size && !moved) size.take(parent[idx]);
+    parent.splice(idx, 1);
+  } else if (parent !== null && typeof parent === "object") {
+    if (!Object.prototype.hasOwnProperty.call(parent, key)) {
+      throw new PatchError(`Path not found for remove: ${path}`);
+    }
+    if (size) {
+      if (moved) size.bytes -= utf8Length(key);
+      else size.take(parent[key], key);
+    }
+    delete parent[key];
+  } else {
+    throw new PatchError(`Cannot remove from ${jsonType(parent)}`);
+  }
+  return doc;
+}
+function applyOne(doc, op, size) {
   const kind = op.op;
   const path = op.path ?? "";
   if (kind === "add") {
     if (!("value" in op)) throw new PatchError("'add' requires 'value'");
-    const parts = splitPath(path);
-    if (parts.length === 0) return op.value;
-    const [parent, key] = navigate(doc, parts);
-    if (Array.isArray(parent)) {
-      if (key === "-") {
-        parent.push(op.value);
-      } else {
-        const idx = key;
-        if (idx < 0 || idx > parent.length) {
-          throw new PatchError(`Index out of range for add: ${path}`);
-        }
-        parent.splice(idx, 0, op.value);
-      }
-    } else if (parent !== null && typeof parent === "object") {
-      parent[key] = op.value;
-    } else {
-      throw new PatchError(`Cannot add into ${jsonType(parent)}`);
-    }
-    return doc;
+    return addAt(doc, path, clone(op.value), size);
   }
   if (kind === "replace") {
     if (!("value" in op)) throw new PatchError("'replace' requires 'value'");
     const parts = splitPath(path);
-    if (parts.length === 0) return op.value;
+    const value = clone(op.value);
+    if (parts.length === 0) {
+      size?.reset(value);
+      return value;
+    }
     const [parent, key] = navigate(doc, parts);
     if (Array.isArray(parent)) {
       const idx = key === "-" ? -1 : key;
       if (idx < 0 || idx >= parent.length) {
         throw new PatchError(`Path not found for replace: ${path}`);
       }
-      parent[idx] = op.value;
+      size?.take(parent[idx]);
+      parent[idx] = value;
     } else if (parent !== null && typeof parent === "object") {
       if (!Object.prototype.hasOwnProperty.call(parent, key)) {
         throw new PatchError(`Path not found for replace: ${path}`);
       }
-      parent[key] = op.value;
+      size?.take(parent[key]);
+      parent[key] = value;
     } else {
       throw new PatchError(`Cannot replace in ${jsonType(parent)}`);
     }
+    size?.insert(value, parts.length);
     return doc;
   }
   if (kind === "remove") {
-    const parts = splitPath(path);
-    if (parts.length === 0) throw new PatchError("Cannot remove root.");
-    const [parent, key] = navigate(doc, parts);
-    if (Array.isArray(parent)) {
-      const idx = key === "-" ? -1 : key;
-      if (idx < 0 || idx >= parent.length) {
-        throw new PatchError(`Index out of range for remove: ${path}`);
-      }
-      parent.splice(idx, 1);
-    } else if (parent !== null && typeof parent === "object") {
-      if (!Object.prototype.hasOwnProperty.call(parent, key)) {
-        throw new PatchError(`Path not found for remove: ${path}`);
-      }
-      delete parent[key];
-    } else {
-      throw new PatchError(`Cannot remove from ${jsonType(parent)}`);
-    }
-    return doc;
+    return removeAt(doc, path, size);
   }
   if (kind === "copy") {
     const src = op.from;
     if (src === void 0) throw new PatchError("'copy' requires 'from'");
-    const value = clone(getAt(doc, src));
-    return applyOne(doc, { op: "add", path, value });
+    return addAt(doc, path, clone(getAt(doc, src)), size, true);
   }
   if (kind === "move") {
     const src = op.from;
@@ -578,9 +617,9 @@ function applyOne(doc, op) {
     if (path.startsWith(src + "/")) {
       throw new PatchError("'move' cannot move a location into its own child.");
     }
-    const value = clone(getAt(doc, src));
-    doc = applyOne(doc, { op: "remove", path: src });
-    return applyOne(doc, { op: "add", path, value });
+    const value = getAt(doc, src);
+    doc = removeAt(doc, src, size, true);
+    return addAt(doc, path, value, size, false, splitPath(src).length);
   }
   if (kind === "test") {
     if (!("value" in op)) throw new PatchError("'test' requires 'value'");
@@ -592,29 +631,122 @@ function applyOne(doc, op) {
 }
 var MAX_PATCH_OPS = 1e3;
 var MAX_DOCUMENT_NODES = 1e5;
-function nodeCount(value) {
-  if (Array.isArray(value)) {
-    let n = 1;
-    for (const v of value) n += nodeCount(v);
-    return n;
-  }
-  if (value !== null && typeof value === "object") {
-    let n = 1;
-    for (const v of Object.values(value)) n += nodeCount(v);
-    return n;
+var MAX_DOCUMENT_DEPTH = 64;
+var MAX_CARRIED_TIMES = 3;
+var DEFAULT_MAX_PATCHED_BYTES = 1048576;
+function utf8Length(s) {
+  const buffer = globalThis.Buffer;
+  if (typeof buffer === "function") {
+    return buffer.byteLength(s, "utf8");
+  }
+  let n = 0;
+  for (let i = 0; i < s.length; i++) {
+    const c = s.charCodeAt(i);
+    if (c < 128) n += 1;
+    else if (c < 2048) n += 2;
+    else if (c >= 55296 && c <= 56319 && i + 1 < s.length) {
+      const d = s.charCodeAt(i + 1);
+      if (d >= 56320 && d <= 57343) {
+        n += 4;
+        i++;
+      } else n += 3;
+    } else n += 3;
+  }
+  return n;
+}
+function sizeOf(value) {
+  if (value === null || typeof value !== "object") {
+    return { nodes: 1, bytes: typeof value === "string" ? utf8Length(value) : 0, depth: 1 };
+  }
+  let nodes = 0;
+  let bytes = 0;
+  let depth = 0;
+  const values = [value];
+  const levels = [1];
+  const visit = (x, level) => {
+    if (x !== null && typeof x === "object") {
+      values.push(x);
+      levels.push(level);
+      return;
+    }
+    nodes += 1;
+    if (level > depth) depth = level;
+    if (typeof x === "string") bytes += utf8Length(x);
+  };
+  while (values.length > 0) {
+    const v = values.pop();
+    const level = levels.pop();
+    nodes += 1;
+    if (level > depth) depth = level;
+    if (Array.isArray(v)) {
+      for (const x of v) visit(x, level + 1);
+    } else {
+      const o = v;
+      for (const k of Object.keys(o)) {
+        bytes += utf8Length(k);
+        visit(o[k], level + 1);
+      }
+    }
   }
-  return 1;
+  return { nodes, bytes, depth };
 }
-function applyJsonPatch(doc, ops) {
+var Size = class {
+  nodes = 0;
+  bytes = 0;
+  depth = 0;
+  /** What copies, and moves to a deeper place or onto the whole document, have carried. */
+  carriedNodes = 0;
+  carriedBytes = 0;
+  constructor(doc) {
+    this.reset(doc);
+  }
+  reset(doc) {
+    const s = sizeOf(doc);
+    this.nodes = s.nodes;
+    this.bytes = s.bytes;
+    this.depth = s.depth;
+  }
+  /** `value` goes in `segments` levels below the top, under a new `key`. */
+  insert(value, segments, key) {
+    const s = sizeOf(value);
+    this.nodes += s.nodes;
+    this.bytes += s.bytes + (key === void 0 ? 0 : utf8Length(key));
+    this.depth = Math.max(this.depth, segments + s.depth);
+    return s;
+  }
+  carry(s) {
+    this.carriedNodes += s.nodes;
+    this.carriedBytes += s.bytes;
+  }
+  /** `value` comes out, with its `key`. */
+  take(value, key) {
+    const s = sizeOf(value);
+    this.nodes -= s.nodes;
+    this.bytes -= s.bytes + (key === void 0 ? 0 : utf8Length(key));
+  }
+};
+function applyJsonPatch(doc, ops, limits = {}) {
+  const maxBytes = limits.maxStringBytes ?? DEFAULT_MAX_PATCHED_BYTES;
   if (ops.length > MAX_PATCH_OPS) {
     throw new PatchError(`Patch has too many operations (${ops.length} > ${MAX_PATCH_OPS})`);
   }
   let out = JSON.parse(JSON.stringify(doc));
+  const size = new Size(out);
   for (const op of ops) {
-    out = applyOne(out, op);
-    if (nodeCount(out) > MAX_DOCUMENT_NODES) {
+    out = applyOne(out, op, size);
+    if (size.depth > MAX_DOCUMENT_DEPTH) size.depth = sizeOf(out).depth;
+    if (size.nodes > MAX_DOCUMENT_NODES) {
       throw new PatchError(`Patched document exceeds the node limit (${MAX_DOCUMENT_NODES})`);
     }
+    if (size.bytes > maxBytes) {
+      throw new PatchError(`Patched document exceeds the size limit (${maxBytes} bytes of strings and keys)`);
+    }
+    if (size.depth > MAX_DOCUMENT_DEPTH) {
+      throw new PatchError(`Patched document nests deeper than ${MAX_DOCUMENT_DEPTH} levels`);
+    }
+    if (size.carriedNodes > MAX_CARRIED_TIMES * MAX_DOCUMENT_NODES || size.carriedBytes > MAX_CARRIED_TIMES * maxBytes) {
+      throw new PatchError(`Patch copies or moves more than its limit (${MAX_CARRIED_TIMES * MAX_DOCUMENT_NODES} values or ${MAX_CARRIED_TIMES * maxBytes} bytes of strings and keys)`);
+    }
   }
   return out;
 }
@@ -1347,6 +1479,7 @@ function registerControl(coord) {
 }
 
 // src/profiles/deliberation.ts
+var RESERVED_IDS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 function parseRule(rule) {
   if (rule.includes(":")) {
     const [kind, arg] = rule.split(":", 2);
@@ -1447,6 +1580,18 @@ function registerDeliberation(coord) {
       const msg = e instanceof Error ? e.message : String(e);
       return { error: rpcError(E.DELIB_UNKNOWN_RULE, msg) };
     }
+    const suppliedDeliberationId = p.deliberation_id;
+    if (suppliedDeliberationId !== void 0 && suppliedDeliberationId !== null && suppliedDeliberationId !== "") {
+      if (typeof suppliedDeliberationId !== "string") {
+        return { error: rpcError(E.PARAMS, "deliberation_id must be a string") };
+      }
+      if (RESERVED_IDS.has(suppliedDeliberationId)) {
+        return { error: rpcError(E.PARAMS, `deliberation_id cannot be ${JSON.stringify(suppliedDeliberationId)}`) };
+      }
+      if (ws.deliberations.has(suppliedDeliberationId)) {
+        return { error: rpcError(E.PARAMS, `deliberation_id already in use: ${suppliedDeliberationId}`) };
+      }
+    }
     const id = p.deliberation_id || coord.ids.deliberationId();
     const delib = {
       id,
@@ -1529,6 +1674,7 @@ function registerDeliberation(coord) {
 }
 
 // src/profiles/handoff.ts
+var RESERVED_IDS2 = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 function registerHandoff(coord) {
   coord.handlers.set("handoff.propose", (p) => {
     const ws = coord.workspaces.get(p.workspace);
@@ -1571,6 +1717,18 @@ function registerHandoff(coord) {
         blockers: t.blockers ?? []
       });
     }
+    const suppliedHandoffId = p.handoff_id;
+    if (suppliedHandoffId !== void 0 && suppliedHandoffId !== null && suppliedHandoffId !== "") {
+      if (typeof suppliedHandoffId !== "string") {
+        return { error: rpcError(E.PARAMS, "handoff_id must be a string") };
+      }
+      if (RESERVED_IDS2.has(suppliedHandoffId)) {
+        return { error: rpcError(E.PARAMS, `handoff_id cannot be ${JSON.stringify(suppliedHandoffId)}`) };
+      }
+      if (ws.handoffs.has(suppliedHandoffId)) {
+        return { error: rpcError(E.PARAMS, `handoff_id already in use: ${suppliedHandoffId}`) };
+      }
+    }
     const id = p.handoff_id || coord.ids.handoffId();
     const ho = {
       id,
@@ -1961,6 +2119,7 @@ function registerSecuritySigned(coord) {
 }
 
 // src/profiles/whisper.ts
+var RESERVED_IDS3 = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 function parseIso(ts) {
   return new Date(ts).getTime();
 }
@@ -1985,6 +2144,18 @@ function registerWhisper(coord) {
     }
     const to = p.to;
     const askee = Array.isArray(to) ? to : [to];
+    const suppliedWhisperId = p.whisper_id;
+    if (suppliedWhisperId !== void 0 && suppliedWhisperId !== null && suppliedWhisperId !== "") {
+      if (typeof suppliedWhisperId !== "string") {
+        return { error: rpcError(E.PARAMS, "whisper_id must be a string") };
+      }
+      if (RESERVED_IDS3.has(suppliedWhisperId)) {
+        return { error: rpcError(E.PARAMS, `whisper_id cannot be ${JSON.stringify(suppliedWhisperId)}`) };
+      }
+      if (ws.whispers.has(suppliedWhisperId)) {
+        return { error: rpcError(E.PARAMS, `whisper_id already in use: ${suppliedWhisperId}`) };
+      }
+    }
     const id = p.whisper_id || coord.ids.artefactId();
     const prompt = {
       id,
@@ -3334,6 +3505,16 @@ var Coordinator = class {
           ) };
         }
         task.review = { requested_at: now, requested_to: eligible, rule: "any_one_approves", decisions: [] };
+      } else {
+        const author = p.from;
+        const reviewers = task.review.requested_to.filter((r) => r !== author);
+        if (reviewers.length === 0) {
+          return { error: rpcError(
+            E.NOT_AUTHORISED,
+            "Task requires review but has no reviewer other than its completer"
+          ) };
+        }
+        task.review = { ...task.review, requested_at: now, requested_to: reviewers, decisions: [] };
       }
       task.pending_artefact = p.output;
       task.state = "review_requested";
@@ -3549,7 +3730,9 @@ var Coordinator = class {
     if (base === void 0) return { error: rpcError(E.PARAMS, "No base artefact for override") };
     let applied;
     try {
-      applied = applyJsonPatch(base, p.diff);
+      applied = applyJsonPatch(base, p.diff, {
+        maxStringBytes: this.options.maxEnvelopeBytes ?? DEFAULT_MAX_ENVELOPE_BYTES
+      });
     } catch (e) {
       const msg = e instanceof Error ? e.message : String(e);
       return { error: rpcError(E.PATCH_FAILED, msg) };
@@ -3885,6 +4068,7 @@ function wrapA2aMessageExchange(coord, workspace, options) {
 export {
   Coordinator,
   CoordinatorError,
+  DEFAULT_MAX_PATCHED_BYTES,
   E,
   IdFactory,
   MemoryStore,