@freema/drobek-modules 0.3.3

package/dist/index.js

@@ -0,0 +1,373 @@
+// @freema/drobek-modules (@drobek/modules) — AGPL-3.0-only — https://github.com/freema/drobek
+import {
+  BACKEND_IMPORT_SKILLS,
+  BEACON_SCRIPT_PATH,
+  CORE_ERROR_CODES,
+  CORE_LIMITS,
+  DEFAULT_MAX_BODY_BYTES,
+  DEFAULT_MODULES_DIR,
+  EMAIL_RE,
+  END_USER_COOKIE,
+  END_USER_COOKIE_INSECURE,
+  END_USER_SESSION_TTL_SEC,
+  END_USER_TOKEN_RE,
+  LIMITS_CACHE_TTL_SEC,
+  LIMITS_SIGNATURE_HEADER,
+  LIMITS_TIMESTAMP_HEADER,
+  Lru,
+  MAIL_COUNTER_KEYS,
+  MAIL_PAUSE_KEYS,
+  MAX_EMAIL_TEXT,
+  MAX_FILE_HEAD_BYTES,
+  MODULE_CONTRACT_VERSION,
+  MODULE_ERROR_CODES,
+  MODULE_ERROR_CODE_RE,
+  MODULE_NAME_RE,
+  ModuleError,
+  ModuleLoadError,
+  ModuleRuntime,
+  PENDING_MAIL_WINDOW_MS,
+  PLATFORM_SKILL_NAME,
+  RECORDS_IMPORT_MAX_ROWS,
+  RESERVED_MODULE_NAMES,
+  RULE_TOKENS,
+  SDK_HEADER,
+  SDK_PATH,
+  SDK_TYPES_PATH,
+  SECRET_MAX_BYTES,
+  SECRET_NAME_RE,
+  SLOT_NAME_RE,
+  SecretStoreError,
+  activeModules,
+  appOwnerEmails,
+  buildBeaconScript,
+  buildSdk,
+  capEmailText,
+  checkErrorCodes,
+  checkModuleSet,
+  checkRequires,
+  collectContributions,
+  composeModule,
+  confirmUrl,
+  cookiePrincipalResolver,
+  createEndUserSession,
+  createLimitsProvider,
+  decideAccess,
+  defineModule,
+  deleteModuleSecret,
+  destroyEndUserSession,
+  effectiveConfigDefaults,
+  emailKind,
+  endUserAuthorityOf,
+  endUserCookieHeader,
+  endUserCookieName,
+  endUserCookiesSecure,
+  endUserEpochKey,
+  endUserSessionKey,
+  filesAuthorityOf,
+  generalSkillsDir,
+  getModuleSecret,
+  hasControlBytes,
+  inlineSpecifier,
+  isDefinedModule,
+  isModuleError,
+  isReadable,
+  isValidRule,
+  issuePaths,
+  jsonEqual,
+  jsonKey,
+  limitsProviderConfigError,
+  loadEndUserSession,
+  loadGeneralSkills,
+  loadModuleRuntime,
+  loadModuleSet,
+  loadModules,
+  looksLikeSvg,
+  mailAppCounterKey,
+  mailAuthorityOf,
+  mailBudgets,
+  mailGuardConfigFromEnv,
+  memoryMailGuard,
+  memoryMailGuardRedis,
+  memoryRateLimiter,
+  mergePatch,
+  moduleDefaultsEnvName,
+  moduleEnabledLimitName,
+  moduleJournalTable,
+  moduleNotEnabled,
+  moduleRuntime,
+  multipartBoundary,
+  normalizeConfirmItems,
+  packageNameFor,
+  parseEndUserSession,
+  parseModuleList,
+  parseMultipart,
+  parseRule,
+  parseSkillMarkdown,
+  pendingMail,
+  pendingMailKey,
+  perIpLimitKey,
+  readConfigRow,
+  readEndUserToken,
+  recipientRefs,
+  recordsAuthorityOf,
+  redisMailGuard,
+  redisRateLimiter,
+  renewEndUserSession,
+  resolveRecipients,
+  respond,
+  revokeEndUserSessions,
+  ruleIsPublic,
+  sanitizeSubject,
+  sdkDeclarations,
+  secretsSet,
+  secretsStatus,
+  setModuleRuntimeForTests,
+  setModuleSecret,
+  signLimitsRequest,
+  skillForImport,
+  skillHint,
+  smtpEmailTransport,
+  sniffSignature,
+  stableJson,
+  streamMultipartFile,
+  submissionsAuthorityOf
+} from "./chunk-WHKPW5MP.js";
+
+// packages/modules/dist/index.js
+import { z as z2 } from "zod";
+
+// packages/modules/dist/auth-provider.js
+import { z } from "zod";
+var AUTH_PROVIDER_ID_RE = /^[a-z][a-z0-9]{1,15}$/;
+var EMAIL_PROVIDER_ID = "email";
+var AUTH_RESERVED_CONFIG_KEYS = ["enabled", "relinkByEmail"];
+function defineAuthProvider(provider) {
+  return provider;
+}
+function defineSignInObserver(observer) {
+  return observer;
+}
+var fn = (what) => z.custom((v) => typeof v === "function", `${what} must be a function`);
+function isObjectSchema(v) {
+  const s = v;
+  return typeof s === "object" && s !== null && typeof s.safeParse === "function" && typeof s.partial === "function" && typeof s.extend === "function" && typeof s.shape === "object" && s.shape !== null;
+}
+var SECRET_NAME = /^[A-Z][A-Z0-9_]{1,63}$/;
+var CONTROL = /[\u0000-\u001f\u007f\u2028\u2029]/;
+var authProviderSchema = z.looseObject({
+  id: z.string().regex(AUTH_PROVIDER_ID_RE, "id must be 2\u201316 lowercase letters and digits, starting with a letter").refine((id) => id !== EMAIL_PROVIDER_ID, 'id "email" is the e-mail code \u2014 pick another'),
+  label: z.string().min(1).max(40).refine((l) => !CONTROL.test(l) && l.trim() === l, "label must be one trimmed line"),
+  configSchema: z.custom(isObjectSchema, "configSchema must be a zod object schema (z.object / z.strictObject)"),
+  configDefaults: z.record(z.string(), z.unknown()).optional(),
+  identityFields: z.array(z.string().min(1)).max(20).optional(),
+  secrets: z.array(z.object({
+    name: z.string(),
+    description: z.string().min(1),
+    required: z.boolean().optional(),
+    env: z.string().optional()
+  })).max(20).optional(),
+  begin: fn("begin"),
+  callback: fn("callback")
+}).superRefine((p, ctx) => {
+  if (!AUTH_PROVIDER_ID_RE.test(p.id) || !isObjectSchema(p.configSchema))
+    return;
+  const shape = p.configSchema.shape;
+  for (const key of AUTH_RESERVED_CONFIG_KEYS) {
+    if (key in shape)
+      ctx.addIssue({ code: "custom", path: ["configSchema"], message: `configSchema may not declare \`${key}\` (auth adds it)` });
+  }
+  for (const f of p.identityFields ?? []) {
+    if (!(f in shape))
+      ctx.addIssue({ code: "custom", path: ["identityFields"], message: `identityFields names "${f}", which configSchema does not declare` });
+  }
+  const upper = p.id.toUpperCase();
+  const names = /* @__PURE__ */ new Set();
+  for (const s of p.secrets ?? []) {
+    if (!SECRET_NAME.test(s.name) || !s.name.startsWith(`${upper}_`)) {
+      ctx.addIssue({ code: "custom", path: ["secrets"], message: `secret "${s.name}" must be UPPER_SNAKE and start with "${upper}_"` });
+    }
+    if (names.has(s.name))
+      ctx.addIssue({ code: "custom", path: ["secrets"], message: `secret "${s.name}" is declared twice` });
+    names.add(s.name);
+    if (s.env !== void 0 && !(SECRET_NAME.test(s.env) && s.env.startsWith(`AUTH_${upper}_`))) {
+      ctx.addIssue({ code: "custom", path: ["secrets"], message: `secret "${s.name}": env must be an AUTH_${upper}_\u2026 variable` });
+    }
+  }
+  if (p.configDefaults !== void 0) {
+    const r = p.configSchema.partial().safeParse(p.configDefaults);
+    if (!r.success)
+      ctx.addIssue({ code: "custom", path: ["configDefaults"], message: "configDefaults do not pass configSchema.partial()" });
+  }
+});
+var authSignedInObserverSchema = z.looseObject({
+  id: z.string().regex(/^[a-z][a-z0-9-]{1,39}$/, "id must be 2\u201340 lowercase letters, digits or dashes"),
+  onSignIn: fn("onSignIn")
+});
+var authIdentitySchema = z.object({
+  issuer: z.string().min(1).max(2048).refine((s) => !CONTROL.test(s) && s.trim() === s, "issuer must be one trimmed line"),
+  subject: z.string().min(1).max(255).refine((s) => !CONTROL.test(s), "subject may not contain control characters"),
+  email: z.string().trim().toLowerCase().max(254).pipe(z.email({ message: "must be an e-mail address" })),
+  emailVerified: z.boolean(),
+  name: z.string().max(200).optional()
+});
+
+// packages/modules/dist/csv-stream.js
+var CSV_CHUNK_CHARS = 64 * 1024;
+async function* csvChunks(lines, chunkChars = CSV_CHUNK_CHARS) {
+  let chunk = "";
+  for await (const line of lines) {
+    chunk += `${line}\r
+`;
+    if (chunk.length >= chunkChars) {
+      yield chunk;
+      chunk = "";
+    }
+  }
+  if (chunk)
+    yield chunk;
+}
+export {
+  AUTH_PROVIDER_ID_RE,
+  AUTH_RESERVED_CONFIG_KEYS,
+  BACKEND_IMPORT_SKILLS,
+  BEACON_SCRIPT_PATH,
+  CORE_ERROR_CODES,
+  CORE_LIMITS,
+  DEFAULT_MAX_BODY_BYTES,
+  DEFAULT_MODULES_DIR,
+  EMAIL_PROVIDER_ID,
+  EMAIL_RE,
+  END_USER_COOKIE,
+  END_USER_COOKIE_INSECURE,
+  END_USER_SESSION_TTL_SEC,
+  END_USER_TOKEN_RE,
+  LIMITS_CACHE_TTL_SEC,
+  LIMITS_SIGNATURE_HEADER,
+  LIMITS_TIMESTAMP_HEADER,
+  Lru,
+  MAIL_COUNTER_KEYS,
+  MAIL_PAUSE_KEYS,
+  MAX_EMAIL_TEXT,
+  MAX_FILE_HEAD_BYTES,
+  MODULE_CONTRACT_VERSION,
+  MODULE_ERROR_CODES,
+  MODULE_ERROR_CODE_RE,
+  MODULE_NAME_RE,
+  ModuleError,
+  ModuleLoadError,
+  ModuleRuntime,
+  PENDING_MAIL_WINDOW_MS,
+  PLATFORM_SKILL_NAME,
+  RECORDS_IMPORT_MAX_ROWS,
+  RESERVED_MODULE_NAMES,
+  RULE_TOKENS,
+  SDK_HEADER,
+  SDK_PATH,
+  SDK_TYPES_PATH,
+  SECRET_MAX_BYTES,
+  SECRET_NAME_RE,
+  SLOT_NAME_RE,
+  SecretStoreError,
+  activeModules,
+  appOwnerEmails,
+  authIdentitySchema,
+  authProviderSchema,
+  authSignedInObserverSchema,
+  buildBeaconScript,
+  buildSdk,
+  capEmailText,
+  checkErrorCodes,
+  checkModuleSet,
+  checkRequires,
+  collectContributions,
+  composeModule,
+  confirmUrl,
+  cookiePrincipalResolver,
+  createEndUserSession,
+  createLimitsProvider,
+  csvChunks,
+  decideAccess,
+  defineAuthProvider,
+  defineModule,
+  defineSignInObserver,
+  deleteModuleSecret,
+  destroyEndUserSession,
+  effectiveConfigDefaults,
+  emailKind,
+  endUserAuthorityOf,
+  endUserCookieHeader,
+  endUserCookieName,
+  endUserCookiesSecure,
+  endUserEpochKey,
+  endUserSessionKey,
+  filesAuthorityOf,
+  generalSkillsDir,
+  getModuleSecret,
+  hasControlBytes,
+  inlineSpecifier,
+  isDefinedModule,
+  isModuleError,
+  isReadable,
+  isValidRule,
+  issuePaths,
+  jsonEqual,
+  jsonKey,
+  limitsProviderConfigError,
+  loadEndUserSession,
+  loadGeneralSkills,
+  loadModuleRuntime,
+  loadModuleSet,
+  loadModules,
+  looksLikeSvg,
+  mailAppCounterKey,
+  mailAuthorityOf,
+  mailBudgets,
+  mailGuardConfigFromEnv,
+  memoryMailGuard,
+  memoryMailGuardRedis,
+  memoryRateLimiter,
+  mergePatch,
+  moduleDefaultsEnvName,
+  moduleEnabledLimitName,
+  moduleJournalTable,
+  moduleNotEnabled,
+  moduleRuntime,
+  multipartBoundary,
+  normalizeConfirmItems,
+  packageNameFor,
+  parseEndUserSession,
+  parseModuleList,
+  parseMultipart,
+  parseRule,
+  parseSkillMarkdown,
+  pendingMail,
+  pendingMailKey,
+  perIpLimitKey,
+  readConfigRow,
+  readEndUserToken,
+  recipientRefs,
+  recordsAuthorityOf,
+  redisMailGuard,
+  redisRateLimiter,
+  renewEndUserSession,
+  resolveRecipients,
+  respond,
+  revokeEndUserSessions,
+  ruleIsPublic,
+  sanitizeSubject,
+  sdkDeclarations,
+  secretsSet,
+  secretsStatus,
+  setModuleRuntimeForTests,
+  setModuleSecret,
+  signLimitsRequest,
+  skillForImport,
+  skillHint,
+  smtpEmailTransport,
+  sniffSignature,
+  stableJson,
+  streamMultipartFile,
+  submissionsAuthorityOf,
+  z2 as z
+};