@byok-sdk/core 0.27.0-rc.2 → 0.28.0

package/dist/errors.d.ts

@@ -29,6 +29,7 @@
  * - the five `storage_*` codes (§12.7.7, see `quota.ts`)
  */
 export declare const CORE_ERROR_CODES: {
+    readonly routine_schedule_invalid: 'routine_schedule_invalid';
     readonly retention_input_invalid: 'retention_input_invalid';
     readonly retention_collect_failed: 'retention_collect_failed';
     readonly tenant_id_invalid: 'tenant_id_invalid';

package/dist/index.d.ts

@@ -56,3 +56,4 @@ export type { QuotaCollectExpiredInput } from './quota';
 export type { ObjectCollectExpiredInput } from './blob';
 export { InMemoryStorageLedger } from './in-memory/storage-ledger';
 export type { InMemoryObjectBytes } from './in-memory/blob';
+export * from './routine-schedule';

package/dist/index.js

@@ -2,6 +2,7 @@ import { z } from 'zod';
 
 // src/errors.ts
 var CORE_ERROR_CODES = {
+  routine_schedule_invalid: "routine_schedule_invalid",
   retention_input_invalid: "retention_input_invalid",
   retention_collect_failed: "retention_collect_failed",
   // identity + content addressing
@@ -3037,6 +3038,125 @@ function createInMemoryCoreCompositionWithClock(objectBytes) {
   return { stores: createInMemoryCoreStores({ clock, objectBytes }).stores, clock };
 }
 
-export { AGENT_MEMORY_INTENT_DIGEST_VERSION, BOARD_STATUSES, BOARD_TRANSITIONS, ByokCoreError, CANONICAL_TIMESTAMP_PATTERN, CAPABILITY_DECLARATION_SCHEMA_ID, CAPABILITY_NAME_PATTERN, CONTENT_HASH_PATTERN, CORE_ERROR_CODES, CORE_NON_COMPOSITION_PORT_NAMES, CORE_PORT_INTERFACES, CORE_PORT_METHODS, CORE_STORE_NAMES, CapabilityDeclarationSchema, CollectExpiredFailure, CoreConflictError, DEVICE_ASSERTION_ALGORITHMS, DEVICE_ASSERTION_AUDIENCE_MAX_BYTES, DEVICE_ASSERTION_DEFAULT_TTL_MS, DEVICE_ASSERTION_DOMAIN_PREFIX, DEVICE_ASSERTION_MAX_TTL_MS, DEVICE_ASSERTION_SCHEMA_ID, DEVICE_ASSERTION_VERSION, DEVICE_PROOF_ALGORITHMS, DEVICE_PROOF_DOMAIN_PREFIX, DEVICE_PROOF_HEADER, DEVICE_PROOF_SCHEMA_ID, DEVICE_PROOF_VERSION, DeviceAssertionClaimsSchema, DeviceAssertionEnvelopeV1Schema, DeviceProofEnvelopeV1Schema, DeviceProofProtectedClaimsSchema, IN_MEMORY_CLOCK_EPOCH, InMemoryBoardStore, InMemoryDeviceAssertionReplayAuthority, InMemoryMailboxStore, InMemoryObjectStore, InMemoryPresenceStore, InMemoryQuotaStore, InMemorySkillPackStore, InMemoryStorageLedger, InMemoryTruthStore, MAILBOX_MESSAGE_STATES, NONCE_SIGNING_DOMAIN, OBJECT_KEY_PREFIX_PATTERN, OBJECT_STATES, OBJECT_STATE_TRANSITIONS, PRESENCE_LEVELS, PRINCIPAL_KINDS, PROVIDER_PROVISIONING_MAX_TTL_MS, PROVIDER_PROVISIONING_OPERATIONS, PROVIDER_PROVISIONING_REQUEST_VERSION, PROVIDER_PROVISIONING_SECRET_OPERATIONS, PROVIDER_SECRET_HPKE_INFO, PROVIDER_SECRET_HPKE_SUITE, PROVIDER_SECRET_MAX_BYTES, PROVIDER_SECRET_MAX_PADDED_BYTES, PROVIDER_SECRET_PAD_BLOCK_BYTES, ProviderProvisioningConfigV1Schema, ProviderProvisioningExpectedProfileSchema, ProviderProvisioningHeaderV1Schema, ProviderProvisioningIdentityRevisionSchema, ProviderProvisioningRequestV1Schema, SEALING_KEY_ID_LENGTH, SKILL_FRONTMATTER_FIELDS, SKILL_PACK_DESCRIPTION_MAX_LENGTH, SKILL_PACK_ENTRY_PATH, SKILL_PACK_FILE_MAX_BYTES, SKILL_PACK_FILE_PATH_MAX_LENGTH, SKILL_PACK_FILE_PATH_PATTERN, SKILL_PACK_FORBIDDEN_FIELDS, SKILL_PACK_MANIFEST_SCHEMA_ID, SKILL_PACK_MAX_BYTES, SKILL_PACK_MAX_FILES, SKILL_PACK_NAME_MAX_LENGTH, SKILL_PACK_NAME_PATTERN, SKILL_PACK_REJECTIONS, SKILL_PACK_VERSION_PATTERN, STORAGE_ERROR_CODES, STORAGE_ERROR_HTTP_STATUS, STORAGE_RESERVATION_STATES, STORAGE_WRITE_KINDS, STORAGE_WRITE_POSTURES, SealedProviderSecretV1Schema, SealingKeyClaimV1Schema, SealingKeyIdSchema, SealingPublicJwkSchema, SkillPackFileSchema, SkillPackManifestSchema, TASK_ASSERTION_AGENT_REF_MAX_BYTES, TASK_ASSERTION_DOMAIN_PREFIX, TASK_ASSERTION_SCHEMA_ID, TASK_ASSERTION_TOOLSET_ID_MAX_LENGTH, TASK_ASSERTION_VERSION, TENANT_ID_MAX_LENGTH, TENANT_KEY_SEPARATOR, TRUTH_RECORD_KINDS, TaskAssertionAgentRefSchema, TaskAssertionClaimsSchema, TaskAssertionEnvelopeV1Schema, agentMemoryIntentOperationDigest, assertCanonicalTimestamp, assertCapability, assertCollectExpiredInput, assertProviderProvisioningConfigDigest, authenticateDeviceAssertion, authenticateTaskAssertion, canonicalizeJson, canonicalizeJsonBytes, checkSkillPackEntry, checkSkillPackFileContent, checkSkillPackManifest, contentHash, createInMemoryCoreCompositionWithClock, createInMemoryCoreStores, createMutableClock, deriveSealingKeyId, deviceAssertionCanonicalClaims, deviceAssertionCanonicalJson, deviceAssertionSigningInput, deviceProofCanonicalClaims, deviceProofCanonicalJson, deviceProofSigningInput, hasCapability, isCanonicalTimestamp, isContentHash, isControlPlanePrincipal, isCoreConflictError, isCoreError, isDevicePrincipal, isLegalBoardTransition, isLegalObjectTransition, isSkillPackPathSafe, isTenantId, nonceSigningBytes, objectKeyPrefix, openProviderProvisioningSecret, parseCapabilityDeclaration, parseDeviceAssertionEnvelope, parseDeviceProofEnvelope, parseProviderProvisioningRequest, parseSkillFrontmatter, parseSkillPackManifest, parseTaskAssertionEnvelope, principalTenant, providerProvisioningConfigDigest, providerProvisioningRequestDigest, providerSecretAadBytes, sealProviderProvisioningRequest, sealingKeyClaimCanonicalBytes, skillPackContentHashInput, taskAssertionCanonicalClaims, taskAssertionCanonicalJson, taskAssertionSigningInput, tenantId, tenantKey, tenantObjectKey, verifyDeviceAssertion, verifyTaskAssertion };
+// src/routine-schedule.ts
+var ROUTINE_DAYS_OF_WEEK = Object.freeze(["mon", "tue", "wed", "thu", "fri", "sat", "sun"]);
+var ROUTINE_HORIZON_MS = 368 * 864e5;
+var ROUTINE_MIN_NOW = Date.UTC(2e3, 0, 1);
+var ROUTINE_MAX_NOW = Date.UTC(2200, 0, 1);
+var KEYS = /* @__PURE__ */ new Set(["minute", "hour", "daysOfWeek", "dayOfMonth", "month", "tz"]);
+var COMMON_YEAR_DAYS = [31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+var TZ_NAME = /^[A-Za-z][A-Za-z0-9_+-]*(?:\/[A-Za-z0-9_+-]+)*$/;
+var DAY_MS = 864e5;
+var UTC_DAY_NAME = ["sun", "mon", "tue", "wed", "thu", "fri", "sat"];
+var ScheduleError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+};
+var invalid = (message) => new ScheduleError("schedule_invalid", message);
+function integer(value, name, min, max) {
+  if (typeof value !== "number" || !Number.isInteger(value) || value < min || value > max) throw invalid(`${name} must be an integer ${min}-${max}`);
+  return value;
+}
+var formatters = /* @__PURE__ */ new Map();
+function formatter(tz) {
+  let f = formatters.get(tz);
+  if (!f) {
+    f = new Intl.DateTimeFormat("en-US", { timeZone: tz, hourCycle: "h23", year: "numeric", month: "numeric", day: "numeric", hour: "numeric", minute: "numeric", second: "numeric" });
+    if (formatters.size >= 64) formatters.delete(formatters.keys().next().value);
+    formatters.set(tz, f);
+  }
+  return f;
+}
+function checkTz(tz) {
+  if (typeof tz !== "string" || !TZ_NAME.test(tz)) throw new ScheduleError("tz_invalid", `${JSON.stringify(tz)} is not an IANA zone name`);
+  try {
+    formatter(tz);
+  } catch {
+    throw new ScheduleError("tz_invalid", `"${tz}" is not a known IANA zone`);
+  }
+  return tz;
+}
+function parse(schedule) {
+  if (schedule === null || typeof schedule !== "object" || Array.isArray(schedule)) throw invalid("schedule must be an object");
+  for (const key of Object.keys(schedule)) if (!KEYS.has(key)) throw invalid(`unknown field ${key}`);
+  const p = { minute: integer(schedule.minute, "minute", 0, 59), hour: integer(schedule.hour, "hour", 0, 23), tz: checkTz(schedule.tz) };
+  const s = schedule;
+  if (s.daysOfWeek !== void 0 && s.dayOfMonth !== void 0) throw invalid("daysOfWeek and dayOfMonth cannot both appear");
+  if (s.month !== void 0 && s.dayOfMonth === void 0) throw invalid("month needs dayOfMonth");
+  if (s.daysOfWeek !== void 0) {
+    if (!Array.isArray(s.daysOfWeek) || s.daysOfWeek.length < 1 || s.daysOfWeek.length > 7) throw invalid("daysOfWeek must list 1-7 days");
+    for (const d of s.daysOfWeek) if (!ROUTINE_DAYS_OF_WEEK.includes(d)) throw invalid(`unknown day ${JSON.stringify(d)}`);
+    p.days = new Set(s.daysOfWeek);
+  }
+  if (s.dayOfMonth !== void 0) {
+    p.dayOfMonth = integer(s.dayOfMonth, "dayOfMonth", 1, 31);
+    if (s.month !== void 0) {
+      p.month = integer(s.month, "month", 1, 12);
+      if (p.month === 2 && p.dayOfMonth === 29) {
+        throw new ScheduleError("schedule_beyond_horizon", "February 29 exists only in leap years; the next one can be up to 8 years away, beyond the 368-day horizon");
+      }
+      if (p.dayOfMonth > COMMON_YEAR_DAYS[p.month - 1]) {
+        throw new ScheduleError("schedule_unreachable", `month ${p.month} has no day ${p.dayOfMonth}`);
+      }
+    }
+  }
+  return p;
+}
+function checkRoutineSchedule(schedule) {
+  try {
+    parse(schedule);
+    return { ok: true };
+  } catch (e) {
+    if (e instanceof ScheduleError) return { ok: false, code: e.code, message: e.message };
+    throw e;
+  }
+}
+function localAsUtc(tz, instant) {
+  const p = {};
+  for (const part of formatter(tz).formatToParts(instant)) if (part.type !== "literal") p[part.type] = Number(part.value);
+  return Date.UTC(p.year, p.month - 1, p.day, p.hour, p.minute, p.second);
+}
+var offsetAt = (tz, instant) => localAsUtc(tz, instant) - Math.floor(instant / 1e3) * 1e3;
+function resolve(tz, local) {
+  const before = offsetAt(tz, local - DAY_MS);
+  const offsets = /* @__PURE__ */ new Set([before, offsetAt(tz, local), offsetAt(tz, local + DAY_MS)]);
+  const valid = [...offsets].map((o) => local - o).filter((i) => offsetAt(tz, i) === local - i);
+  return valid.length ? { instant: Math.min(...valid), shifted: false } : { instant: local - before, shifted: true };
+}
+function matchesDate(p, y, m, d) {
+  if (p.days) return p.days.has(UTC_DAY_NAME[new Date(Date.UTC(y, m - 1, d)).getUTCDay()]);
+  if (p.dayOfMonth !== void 0) return d === p.dayOfMonth && (p.month === void 0 || m === p.month);
+  return true;
+}
+function nextRoutineOccurrence(schedule, now) {
+  if (!Number.isSafeInteger(now) || now < ROUTINE_MIN_NOW || now >= ROUTINE_MAX_NOW) {
+    throw new RangeError("now must be a safe integer epoch ms in [2000-01-01, 2200-01-01)");
+  }
+  let p;
+  try {
+    p = parse(schedule);
+  } catch (error) {
+    if (error instanceof ScheduleError) throw new ByokCoreError("routine_schedule_invalid", error.message);
+    throw error;
+  }
+  const start = localAsUtc(p.tz, now);
+  const day0 = Date.UTC(new Date(start).getUTCFullYear(), new Date(start).getUTCMonth(), new Date(start).getUTCDate());
+  let best = Infinity;
+  for (let k = -1; k <= 368; k += 1) {
+    const day = new Date(day0 + k * DAY_MS);
+    const y = day.getUTCFullYear(), m = day.getUTCMonth() + 1, d = day.getUTCDate();
+    if (!matchesDate(p, y, m, d)) continue;
+    const { instant, shifted } = resolve(p.tz, Date.UTC(y, m - 1, d, p.hour, p.minute));
+    if (instant <= now) continue;
+    best = Math.min(best, instant);
+    if (!shifted) break;
+  }
+  return best - now <= ROUTINE_HORIZON_MS ? best : null;
+}
+
+export { AGENT_MEMORY_INTENT_DIGEST_VERSION, BOARD_STATUSES, BOARD_TRANSITIONS, ByokCoreError, CANONICAL_TIMESTAMP_PATTERN, CAPABILITY_DECLARATION_SCHEMA_ID, CAPABILITY_NAME_PATTERN, CONTENT_HASH_PATTERN, CORE_ERROR_CODES, CORE_NON_COMPOSITION_PORT_NAMES, CORE_PORT_INTERFACES, CORE_PORT_METHODS, CORE_STORE_NAMES, CapabilityDeclarationSchema, CollectExpiredFailure, CoreConflictError, DEVICE_ASSERTION_ALGORITHMS, DEVICE_ASSERTION_AUDIENCE_MAX_BYTES, DEVICE_ASSERTION_DEFAULT_TTL_MS, DEVICE_ASSERTION_DOMAIN_PREFIX, DEVICE_ASSERTION_MAX_TTL_MS, DEVICE_ASSERTION_SCHEMA_ID, DEVICE_ASSERTION_VERSION, DEVICE_PROOF_ALGORITHMS, DEVICE_PROOF_DOMAIN_PREFIX, DEVICE_PROOF_HEADER, DEVICE_PROOF_SCHEMA_ID, DEVICE_PROOF_VERSION, DeviceAssertionClaimsSchema, DeviceAssertionEnvelopeV1Schema, DeviceProofEnvelopeV1Schema, DeviceProofProtectedClaimsSchema, IN_MEMORY_CLOCK_EPOCH, InMemoryBoardStore, InMemoryDeviceAssertionReplayAuthority, InMemoryMailboxStore, InMemoryObjectStore, InMemoryPresenceStore, InMemoryQuotaStore, InMemorySkillPackStore, InMemoryStorageLedger, InMemoryTruthStore, MAILBOX_MESSAGE_STATES, NONCE_SIGNING_DOMAIN, OBJECT_KEY_PREFIX_PATTERN, OBJECT_STATES, OBJECT_STATE_TRANSITIONS, PRESENCE_LEVELS, PRINCIPAL_KINDS, PROVIDER_PROVISIONING_MAX_TTL_MS, PROVIDER_PROVISIONING_OPERATIONS, PROVIDER_PROVISIONING_REQUEST_VERSION, PROVIDER_PROVISIONING_SECRET_OPERATIONS, PROVIDER_SECRET_HPKE_INFO, PROVIDER_SECRET_HPKE_SUITE, PROVIDER_SECRET_MAX_BYTES, PROVIDER_SECRET_MAX_PADDED_BYTES, PROVIDER_SECRET_PAD_BLOCK_BYTES, ProviderProvisioningConfigV1Schema, ProviderProvisioningExpectedProfileSchema, ProviderProvisioningHeaderV1Schema, ProviderProvisioningIdentityRevisionSchema, ProviderProvisioningRequestV1Schema, ROUTINE_DAYS_OF_WEEK, ROUTINE_HORIZON_MS, ROUTINE_MAX_NOW, ROUTINE_MIN_NOW, SEALING_KEY_ID_LENGTH, SKILL_FRONTMATTER_FIELDS, SKILL_PACK_DESCRIPTION_MAX_LENGTH, SKILL_PACK_ENTRY_PATH, SKILL_PACK_FILE_MAX_BYTES, SKILL_PACK_FILE_PATH_MAX_LENGTH, SKILL_PACK_FILE_PATH_PATTERN, SKILL_PACK_FORBIDDEN_FIELDS, SKILL_PACK_MANIFEST_SCHEMA_ID, SKILL_PACK_MAX_BYTES, SKILL_PACK_MAX_FILES, SKILL_PACK_NAME_MAX_LENGTH, SKILL_PACK_NAME_PATTERN, SKILL_PACK_REJECTIONS, SKILL_PACK_VERSION_PATTERN, STORAGE_ERROR_CODES, STORAGE_ERROR_HTTP_STATUS, STORAGE_RESERVATION_STATES, STORAGE_WRITE_KINDS, STORAGE_WRITE_POSTURES, SealedProviderSecretV1Schema, SealingKeyClaimV1Schema, SealingKeyIdSchema, SealingPublicJwkSchema, SkillPackFileSchema, SkillPackManifestSchema, TASK_ASSERTION_AGENT_REF_MAX_BYTES, TASK_ASSERTION_DOMAIN_PREFIX, TASK_ASSERTION_SCHEMA_ID, TASK_ASSERTION_TOOLSET_ID_MAX_LENGTH, TASK_ASSERTION_VERSION, TENANT_ID_MAX_LENGTH, TENANT_KEY_SEPARATOR, TRUTH_RECORD_KINDS, TaskAssertionAgentRefSchema, TaskAssertionClaimsSchema, TaskAssertionEnvelopeV1Schema, agentMemoryIntentOperationDigest, assertCanonicalTimestamp, assertCapability, assertCollectExpiredInput, assertProviderProvisioningConfigDigest, authenticateDeviceAssertion, authenticateTaskAssertion, canonicalizeJson, canonicalizeJsonBytes, checkRoutineSchedule, checkSkillPackEntry, checkSkillPackFileContent, checkSkillPackManifest, contentHash, createInMemoryCoreCompositionWithClock, createInMemoryCoreStores, createMutableClock, deriveSealingKeyId, deviceAssertionCanonicalClaims, deviceAssertionCanonicalJson, deviceAssertionSigningInput, deviceProofCanonicalClaims, deviceProofCanonicalJson, deviceProofSigningInput, hasCapability, isCanonicalTimestamp, isContentHash, isControlPlanePrincipal, isCoreConflictError, isCoreError, isDevicePrincipal, isLegalBoardTransition, isLegalObjectTransition, isSkillPackPathSafe, isTenantId, nextRoutineOccurrence, nonceSigningBytes, objectKeyPrefix, openProviderProvisioningSecret, parseCapabilityDeclaration, parseDeviceAssertionEnvelope, parseDeviceProofEnvelope, parseProviderProvisioningRequest, parseSkillFrontmatter, parseSkillPackManifest, parseTaskAssertionEnvelope, principalTenant, providerProvisioningConfigDigest, providerProvisioningRequestDigest, providerSecretAadBytes, sealProviderProvisioningRequest, sealingKeyClaimCanonicalBytes, skillPackContentHashInput, taskAssertionCanonicalClaims, taskAssertionCanonicalJson, taskAssertionSigningInput, tenantId, tenantKey, tenantObjectKey, verifyDeviceAssertion, verifyTaskAssertion };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map