@builder.io/ai-utils 0.84.0-dev.202607212345.137e4170f → 0.85.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@builder.io/ai-utils",
-  "version": "0.84.0-dev.202607212345.137e4170f",
+  "version": "0.85.0",
   "description": "Builder.io AI utils",
   "files": [
     "src"

package/src/projects.d.ts

@@ -1724,9 +1724,21 @@ export declare const HostingDomainKindSchema: z.ZodEnum<{
 }>;
 export type HostingDomainKind = z.infer<typeof HostingDomainKindSchema>;
 /**
- * Custom domain record, stored at `hosting-domains/{domain}`.
+ * Custom domain record. The same shape backs two Firestore collections:
+ *
+ * - Lock doc `hosting-domains/{domain}` is the single exclusive owner. It
+ *   exists only once a project reaches `provisioning`/`active` (cert + route
+ *   created, DNS ownership proven) and is the cross-project serialization
+ *   point serving/deploy/unpublish read to answer "is this verified?".
+ *   `certId`/`certMapEntryName`/`httpRouteName`/`verifiedAt` are only ever
+ *   populated here.
+ * - Claim subdoc `hosting-domains/{domain}/claims/{projectId}` is a
+ *   non-exclusive, per-project verification attempt (`pending`/`verifying`/
+ *   `failed`). Multiple projects can hold a claim on the same domain at once;
+ *   whoever proves DNS ownership first wins the lock and the losers are swept
+ *   to `failed`.
+ *
  * The normalized domain is the doc key — global uniqueness comes for free.
- * This doc is both the record AND the claim for the domain.
  */
 export declare const HostingDomainSchema: z.ZodObject<{
     domain: z.ZodString;

package/src/projects.js

@@ -625,9 +625,21 @@ export const HostingDomainStatusSchema = z.enum([
 ]);
 export const HostingDomainKindSchema = z.enum(["apex", "subdomain"]);
 /**
- * Custom domain record, stored at `hosting-domains/{domain}`.
+ * Custom domain record. The same shape backs two Firestore collections:
+ *
+ * - Lock doc `hosting-domains/{domain}` is the single exclusive owner. It
+ *   exists only once a project reaches `provisioning`/`active` (cert + route
+ *   created, DNS ownership proven) and is the cross-project serialization
+ *   point serving/deploy/unpublish read to answer "is this verified?".
+ *   `certId`/`certMapEntryName`/`httpRouteName`/`verifiedAt` are only ever
+ *   populated here.
+ * - Claim subdoc `hosting-domains/{domain}/claims/{projectId}` is a
+ *   non-exclusive, per-project verification attempt (`pending`/`verifying`/
+ *   `failed`). Multiple projects can hold a claim on the same domain at once;
+ *   whoever proves DNS ownership first wins the lock and the losers are swept
+ *   to `failed`.
+ *
  * The normalized domain is the doc key — global uniqueness comes for free.
- * This doc is both the record AND the claim for the domain.
  */
 export const HostingDomainSchema = z.object({
     domain: z

package/src/acl-schema.d.ts

@@ -1,88 +0,0 @@
-import { z } from "zod";
-export declare const PermissionSchema: z.ZodEnum<{
-    list: "list";
-    read: "read";
-    write: "write";
-}>;
-export type Permission = z.infer<typeof PermissionSchema>;
-export declare const AclEntrySchema: z.ZodObject<{
-    action: z.ZodEnum<{
-        allow: "allow";
-        deny: "deny";
-    }>;
-    resource: z.ZodString;
-    permissions: z.ZodArray<z.ZodEnum<{
-        list: "list";
-        read: "read";
-        write: "write";
-    }>>;
-    description: z.ZodOptional<z.ZodString>;
-    principals: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strip>;
-export type AclEntry = z.infer<typeof AclEntrySchema>;
-export declare const AclPolicySchema: z.ZodObject<{
-    secrets: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    entries: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        action: z.ZodEnum<{
-            allow: "allow";
-            deny: "deny";
-        }>;
-        resource: z.ZodString;
-        permissions: z.ZodArray<z.ZodEnum<{
-            list: "list";
-            read: "read";
-            write: "write";
-        }>>;
-        description: z.ZodOptional<z.ZodString>;
-        principals: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    }, z.core.$strip>>>;
-    denyDescription: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-export type AclPolicy = z.infer<typeof AclPolicySchema>;
-export declare const AclDenialSchema: z.ZodObject<{
-    kind: z.ZodEnum<{
-        "command-allowlist": "command-allowlist";
-        "command-security": "command-security";
-        "file-access": "file-access";
-    }>;
-    reason: z.ZodEnum<{
-        "deny-pattern-matched": "deny-pattern-matched";
-        "no-allow-match": "no-allow-match";
-        "security-policy": "security-policy";
-        "shell-metacharacter": "shell-metacharacter";
-    }>;
-    resource: z.ZodString;
-    command: z.ZodOptional<z.ZodString>;
-    permission: z.ZodOptional<z.ZodEnum<{
-        list: "list";
-        read: "read";
-        write: "write";
-    }>>;
-    policy: z.ZodOptional<z.ZodString>;
-    matchedPattern: z.ZodOptional<z.ZodString>;
-    matchedEntry: z.ZodOptional<z.ZodObject<{
-        action: z.ZodEnum<{
-            allow: "allow";
-            deny: "deny";
-        }>;
-        resource: z.ZodString;
-        permissions: z.ZodArray<z.ZodEnum<{
-            list: "list";
-            read: "read";
-            write: "write";
-        }>>;
-        description: z.ZodOptional<z.ZodString>;
-        principals: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    }, z.core.$strip>>;
-    message: z.ZodString;
-}, z.core.$strip>;
-export type AclDenial = z.infer<typeof AclDenialSchema>;
-export interface AccessResult {
-    allowed: boolean;
-    message: string;
-    matchedEntry?: AclEntry;
-    matchedPattern?: string;
-    reason?: "deny-pattern-matched" | "no-allow-match";
-    requestedResource?: string;
-    requestedPermission?: Permission;
-}

package/src/acl-schema.js

@@ -1,71 +0,0 @@
-import { z } from "zod";
-export const PermissionSchema = z
-    .enum(["read", "write", "list"])
-    .meta({ title: "Permission" });
-// One ACL rule
-export const AclEntrySchema = z
-    .object({
-    action: z
-        .enum(["allow", "deny"])
-        .meta({ description: "whether this rule allows or denies access" }),
-    resource: z
-        .string()
-        .meta({ description: "what — supports glob patterns like /files/*.txt" }),
-    permissions: z
-        .array(PermissionSchema)
-        .meta({ description: "actions this rule applies to" }),
-    description: z.string().optional().meta({
-        description: "custom message, in deny case, this is the error message. This will override denyDescription on AclPolicy if defined.",
-    }),
-    principals: z.array(z.string()).optional().meta({
-        description: "array of teams/roles this rule applies to (e.g., ['developer', 'admin'])",
-    }),
-})
-    .meta({ title: "AclEntry" });
-// A full ACL policy is just a list of rules
-export const AclPolicySchema = z
-    .object({
-    secrets: z.array(z.string()).optional(),
-    entries: z.array(AclEntrySchema).optional(),
-    denyDescription: z.string().optional().meta({
-        description: "Default message to use when a resource is denied access",
-    }),
-})
-    .meta({ title: "AclPolicy" });
-// Structured description of an ACL/policy denial. Travels with the tool result
-// so internal tools can show admins exactly which rule blocked a command/file,
-// and both UIs can render a distinct "blocked, did not run" treatment.
-export const AclDenialSchema = z
-    .object({
-    kind: z
-        .enum(["command-security", "command-allowlist", "file-access"])
-        .meta({ description: "which gate produced the denial" }),
-    reason: z
-        .enum([
-        "security-policy",
-        "deny-pattern-matched",
-        "no-allow-match",
-        "shell-metacharacter",
-    ])
-        .meta({ description: "why the denial happened" }),
-    resource: z.string().meta({
-        description: "the file path or command that was blocked",
-    }),
-    command: z.string().optional().meta({
-        description: "the full command, when the denial is command-related",
-    }),
-    permission: PermissionSchema.optional().meta({
-        description: "the requested permission, for file-access denials",
-    }),
-    policy: z.string().optional().meta({
-        description: "named security policy that matched, when applicable",
-    }),
-    matchedPattern: z.string().optional().meta({
-        description: "the glob/pattern that matched the resource or command",
-    }),
-    matchedEntry: AclEntrySchema.optional().meta({
-        description: "the full ACL entry that matched, for file-access denials",
-    }),
-    message: z.string().meta({ description: "human-readable explanation" }),
-})
-    .meta({ title: "AclDenial" });

package/src/perf-report.d.ts

@@ -1,116 +0,0 @@
-import { z } from "zod";
-export declare const CURRENT_PERF_REPORT_SCHEMA_VERSION = 1;
-export declare const PerfIncidentTypeSchema: z.ZodEnum<{
-    hang: "hang";
-    "memory-pressure": "memory-pressure";
-    "recovered-hang": "recovered-hang";
-    "recovered-unclean-exit": "recovered-unclean-exit";
-    "renderer-crash": "renderer-crash";
-}>;
-export type PerfIncidentType = z.infer<typeof PerfIncidentTypeSchema>;
-export declare const PerfProcessSchema: z.ZodObject<{
-    kind: z.ZodEnum<{
-        browser: "browser";
-        child: "child";
-        gpu: "gpu";
-        renderer: "renderer";
-        utility: "utility";
-    }>;
-    pid: z.ZodNumber;
-    memoryKb: z.ZodNumber;
-    cpuPercent: z.ZodNumber;
-    tabId: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-export type PerfProcess = z.infer<typeof PerfProcessSchema>;
-export declare const PerfTabSchema: z.ZodObject<{
-    tabId: z.ZodString;
-    route: z.ZodOptional<z.ZodString>;
-    feature: z.ZodOptional<z.ZodString>;
-    jsHeapUsedKb: z.ZodOptional<z.ZodNumber>;
-    jsHeapLimitKb: z.ZodOptional<z.ZodNumber>;
-    subsystems: z.ZodRecord<z.ZodString, z.ZodNumber>;
-    livenessLatencyMs: z.ZodOptional<z.ZodNumber>;
-}, z.core.$strip>;
-export type PerfTab = z.infer<typeof PerfTabSchema>;
-export declare const PerfSampleSchema: z.ZodObject<{
-    t: z.ZodNumber;
-    desktopFootprintKb: z.ZodNumber;
-    freeMemoryKb: z.ZodNumber;
-    perTabHeapKb: z.ZodRecord<z.ZodString, z.ZodNumber>;
-}, z.core.$strip>;
-export type PerfSample = z.infer<typeof PerfSampleSchema>;
-export declare const PerfReportSchema: z.ZodObject<{
-    schemaVersion: z.ZodNumber;
-    incidentType: z.ZodEnum<{
-        hang: "hang";
-        "memory-pressure": "memory-pressure";
-        "recovered-hang": "recovered-hang";
-        "recovered-unclean-exit": "recovered-unclean-exit";
-        "renderer-crash": "renderer-crash";
-    }>;
-    sessionId: z.ZodString;
-    deviceId: z.ZodString;
-    appVersion: z.ZodString;
-    platform: z.ZodEnum<{
-        darwin: "darwin";
-        linux: "linux";
-        win32: "win32";
-    }>;
-    channel: z.ZodEnum<{
-        alpha: "alpha";
-        stable: "stable";
-    }>;
-    timestamp: z.ZodNumber;
-    machine: z.ZodObject<{
-        totalMemoryKb: z.ZodNumber;
-        freeMemoryKb: z.ZodNumber;
-        desktopFootprintKb: z.ZodNumber;
-    }, z.core.$strip>;
-    processes: z.ZodArray<z.ZodObject<{
-        kind: z.ZodEnum<{
-            browser: "browser";
-            child: "child";
-            gpu: "gpu";
-            renderer: "renderer";
-            utility: "utility";
-        }>;
-        pid: z.ZodNumber;
-        memoryKb: z.ZodNumber;
-        cpuPercent: z.ZodNumber;
-        tabId: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>>;
-    tabs: z.ZodArray<z.ZodObject<{
-        tabId: z.ZodString;
-        route: z.ZodOptional<z.ZodString>;
-        feature: z.ZodOptional<z.ZodString>;
-        jsHeapUsedKb: z.ZodOptional<z.ZodNumber>;
-        jsHeapLimitKb: z.ZodOptional<z.ZodNumber>;
-        subsystems: z.ZodRecord<z.ZodString, z.ZodNumber>;
-        livenessLatencyMs: z.ZodOptional<z.ZodNumber>;
-    }, z.core.$strip>>;
-    crash: z.ZodOptional<z.ZodObject<{
-        reason: z.ZodString;
-        exitCode: z.ZodOptional<z.ZodNumber>;
-        oom: z.ZodOptional<z.ZodBoolean>;
-    }, z.core.$strip>>;
-    hang: z.ZodOptional<z.ZodObject<{
-        startedAt: z.ZodNumber;
-        durationMs: z.ZodNumber;
-        recovered: z.ZodBoolean;
-        surface: z.ZodString;
-    }, z.core.$strip>>;
-    samples: z.ZodArray<z.ZodObject<{
-        t: z.ZodNumber;
-        desktopFootprintKb: z.ZodNumber;
-        freeMemoryKb: z.ZodNumber;
-        perTabHeapKb: z.ZodRecord<z.ZodString, z.ZodNumber>;
-    }, z.core.$strip>>;
-}, z.core.$strip>;
-export type PerfReport = z.infer<typeof PerfReportSchema>;
-/**
- * Collapses opaque identifiers out of a route/URL so a report can't carry a
- * project/space id. Keeps the structural shape (which screen was open) while
- * masking the specific resource.
- */
-export declare function redactPerfRoute(route: string | undefined): string | undefined;
-export declare function redactPerfReport(report: PerfReport): PerfReport;

package/src/perf-report.js

@@ -1,122 +0,0 @@
-import { z } from "zod";
-// ============================================================================
-// Desktop performance & crash monitoring wire contract.
-//
-// Canonical schema. The Electron desktop app lives in a separate workspace and
-// cannot import this file, so it keeps a hand-mirrored TypeScript type in
-// code/packages/electron-app/src/perf-report.types.ts. Keep the two in sync and
-// bump CURRENT_PERF_REPORT_SCHEMA_VERSION on any breaking shape change.
-// ============================================================================
-export const CURRENT_PERF_REPORT_SCHEMA_VERSION = 1;
-export const PerfIncidentTypeSchema = z.enum([
-    "renderer-crash",
-    "hang",
-    "recovered-hang",
-    "memory-pressure",
-    "recovered-unclean-exit",
-]);
-export const PerfProcessSchema = z.object({
-    kind: z.enum(["browser", "renderer", "gpu", "utility", "child"]),
-    pid: z.number(),
-    memoryKb: z.number(),
-    cpuPercent: z.number(),
-    tabId: z.string().optional(),
-});
-export const PerfTabSchema = z.object({
-    tabId: z.string(),
-    route: z.string().optional(),
-    feature: z.string().optional(),
-    jsHeapUsedKb: z.number().optional(),
-    jsHeapLimitKb: z.number().optional(),
-    subsystems: z.record(z.string(), z.number()),
-    livenessLatencyMs: z.number().optional(),
-});
-export const PerfSampleSchema = z.object({
-    t: z.number(),
-    desktopFootprintKb: z.number(),
-    freeMemoryKb: z.number(),
-    perTabHeapKb: z.record(z.string(), z.number()),
-});
-export const PerfReportSchema = z.object({
-    schemaVersion: z.number(),
-    incidentType: PerfIncidentTypeSchema,
-    sessionId: z.string(),
-    deviceId: z.string(),
-    appVersion: z.string(),
-    platform: z.enum(["darwin", "win32", "linux"]),
-    channel: z.enum(["stable", "alpha"]),
-    timestamp: z.number(),
-    machine: z.object({
-        totalMemoryKb: z.number(),
-        freeMemoryKb: z.number(),
-        desktopFootprintKb: z.number(),
-    }),
-    processes: z.array(PerfProcessSchema),
-    tabs: z.array(PerfTabSchema),
-    crash: z
-        .object({
-        reason: z.string(),
-        exitCode: z.number().optional(),
-        oom: z.boolean().optional(),
-    })
-        .optional(),
-    hang: z
-        .object({
-        startedAt: z.number(),
-        durationMs: z.number(),
-        recovered: z.boolean(),
-        surface: z.string(),
-    })
-        .optional(),
-    samples: z.array(PerfSampleSchema),
-});
-// ---------------------------------------------------------------------------
-// Route/URL redaction. The desktop client redacts before sending; this runs
-// again at ingest (defense in depth) because the service cannot import the
-// renderer's redactSnapshot helper across the workspace boundary.
-// ---------------------------------------------------------------------------
-const PROJECT_ID_SEGMENTS = new Set([
-    "projects",
-    "content",
-    "fusion",
-    "space",
-    "org",
-    "organization",
-]);
-/**
- * Collapses opaque identifiers out of a route/URL so a report can't carry a
- * project/space id. Keeps the structural shape (which screen was open) while
- * masking the specific resource.
- */
-export function redactPerfRoute(route) {
-    if (!route) {
-        return route;
-    }
-    const [pathPart] = route.split("?");
-    const segments = pathPart.split("/");
-    const redacted = segments.map((segment, index) => {
-        var _a;
-        if (!segment) {
-            return segment;
-        }
-        const previous = (_a = segments[index - 1]) === null || _a === void 0 ? void 0 : _a.toLowerCase();
-        if (previous && PROJECT_ID_SEGMENTS.has(previous)) {
-            return ":id";
-        }
-        // Bare id-looking segments (uuids, long hex/base62 tokens).
-        if (/^[0-9a-f]{16,}$/i.test(segment) || /^[0-9a-z]{20,}$/i.test(segment)) {
-            return ":id";
-        }
-        return segment;
-    });
-    return redacted.join("/");
-}
-export function redactPerfReport(report) {
-    return {
-        ...report,
-        tabs: report.tabs.map((tab) => ({
-            ...tab,
-            route: redactPerfRoute(tab.route),
-        })),
-    };
-}

package/src/vpc-peering.d.ts

@@ -1,49 +0,0 @@
-/** Fields common to all VPC connectivity types. */
-interface VpcConnectionBase {
-    id: string;
-    ownerId: string;
-    type: string;
-    gcpRegion: string;
-    customerDnsServers: string[];
-    proxyIp: string;
-    enabled: boolean;
-    createdAt: number;
-    updatedAt: number;
-}
-/** Traditional VPC Peering via bridge VPC. */
-export interface VpcGcpPeering extends VpcConnectionBase {
-    type: "gcp-peering";
-    gcpProjectId: string;
-    gcpNetworkName: string;
-    bridgeCidr: string;
-    importCustomRoutes: boolean;
-}
-/**
- * PSC Network Attachment — customer creates the network attachment in their VPC,
- * our proxy VM connects to it via a PSC interface on nic1.
- * No bridge VPC or bridge CIDR needed on our side.
- */
-export interface VpcGcpNetworkAttachment extends VpcConnectionBase {
-    type: "gcp-network-attachment";
-    gcpProjectId: string;
-    networkAttachmentName: string;
-}
-/** Discriminated union of all VPC connectivity types. */
-export type VpcPeering = VpcGcpPeering | VpcGcpNetworkAttachment;
-export interface CreateVpcGcpPeeringParams {
-    type: "gcp-peering";
-    gcpRegion: string;
-    gcpProjectId: string;
-    gcpNetworkName: string;
-    bridgeCidr: string;
-    customerDnsServers: string[];
-    importCustomRoutes?: boolean;
-}
-export interface CreateVpcGcpNetworkAttachmentParams {
-    type: "gcp-network-attachment";
-    gcpProjectId: string;
-    networkAttachmentName: string;
-    customerDnsServers: string[];
-}
-export type CreateVpcPeeringParams = CreateVpcGcpPeeringParams | CreateVpcGcpNetworkAttachmentParams;
-export {};

package/src/vpc-peering.js

@@ -1 +0,0 @@
-export {};