@happyvertical/smrt-web 0.49.3 → 0.49.4

package/README.md

@@ -15,6 +15,12 @@ fetch one canonical bounded page. Visible runs update state; `background`,
 stale rows available while refreshing, cancels superseded visible runs, and can
 attach a query-scoped live subscription.
 
+Data-surface actions use `executeSmrtWebDataSurfaceAction(transport, request)`.
+Its request carries the server-issued revision and, for apply, an idempotency
+key; the browser normalizer rejects malformed, oversized, or mismatched
+preview/apply results before they reach UI state. The authenticated server still
+derives authority and validates confirmation tokens.
+
 ## Installation
 
 ```bash
@@ -126,6 +132,7 @@ core.
 | --- | --- |
 | Collections | `createSmrtCollection`, `createSmrtWebClient`, `newLocalId` |
 | Remote queries | `createSmrtWebQuery`, `SmrtWebQueryTransport` |
+| Data-surface actions | `executeSmrtWebDataSurfaceAction`, `SmrtWebDataSurfaceActionTransport` |
 | HTTP | `createDefinitionFetchers`, `unwrapListResult`, `unwrapItemResult` |
 | Offline | `offlineOutbox`, `getOutboxHandle` |
 | Persistence | `persistCollection`, `wipeDurableStore` |

package/dist/chunks/{src-BSrj5jW0.js → src-0IQGhPIM.js}

@@ -21,7 +21,7 @@ var persistedMutationResults = /* @__PURE__ */ new WeakMap();
 var mutationTargetHydrators = /* @__PURE__ */ new WeakMap();
 //#endregion
 //#region src/data-query.ts
-var FORBIDDEN_KEYS = /* @__PURE__ */ new Set([
+var FORBIDDEN_KEYS$1 = /* @__PURE__ */ new Set([
 	"__proto__",
 	"constructor",
 	"prototype"
@@ -44,10 +44,10 @@ function plainObject(value, label) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) throw new TypeError(`${label} must be a plain object`);
 	const prototype = Object.getPrototypeOf(value);
 	if (prototype !== Object.prototype && prototype !== null) throw new TypeError(`${label} must be a plain object`);
-	for (const key of Object.keys(value)) if (FORBIDDEN_KEYS.has(key)) throw new TypeError(`${label} contains a forbidden key`);
+	for (const key of Object.keys(value)) if (FORBIDDEN_KEYS$1.has(key)) throw new TypeError(`${label} contains a forbidden key`);
 	return value;
 }
-function exactKeys(value, allowed, label) {
+function exactKeys$1(value, allowed, label) {
 	const keys = new Set(allowed);
 	for (const key of Object.keys(value)) if (!keys.has(key)) throw new TypeError(`${label} contains ${key}`);
 }
@@ -111,14 +111,14 @@ function normalizeTotal(value) {
 	const total = plainObject(value, "Data query total");
 	const kind = stringValue(total.kind, "Data query total kind");
 	if (kind === "unavailable") {
-		exactKeys(total, ["kind", "reason"], "Data query unavailable total");
+		exactKeys$1(total, ["kind", "reason"], "Data query unavailable total");
 		return {
 			kind,
 			...total.reason === void 0 ? {} : { reason: stringValue(total.reason, "Data query total reason") }
 		};
 	}
 	if (kind !== "exact" && kind !== "estimated") throw new TypeError("Data query total kind is invalid");
-	exactKeys(total, [
+	exactKeys$1(total, [
 		"kind",
 		"value",
 		"asOf"
@@ -136,7 +136,7 @@ function normalizeFacets(value, budget) {
 	const fields = /* @__PURE__ */ new Set();
 	return value.map((candidate, index) => {
 		const facet = plainObject(candidate, `Data query facet ${index}`);
-		exactKeys(facet, [
+		exactKeys$1(facet, [
 			"field",
 			"values",
 			"truncated"
@@ -151,7 +151,7 @@ function normalizeFacets(value, budget) {
 			field,
 			values: facet.values.map((value2, valueIndex) => {
 				const entry = plainObject(value2, `Data query facet ${index} value ${valueIndex}`);
-				exactKeys(entry, ["value", "count"], "Data query facet value");
+				exactKeys$1(entry, ["value", "count"], "Data query facet value");
 				return {
 					value: scalar(entry.value, "Data query facet value", budget),
 					count: nonNegativeInteger(entry.count, "Data query facet count")
@@ -163,7 +163,7 @@ function normalizeFacets(value, budget) {
 }
 function normalizeSmrtWebDataQueryResult(value) {
 	const result = plainObject(value, "Data query result");
-	exactKeys(result, [
+	exactKeys$1(result, [
 		"version",
 		"requestId",
 		"queryFingerprint",
@@ -190,7 +190,7 @@ function normalizeSmrtWebDataQueryResult(value) {
 	let page;
 	if (result.page !== void 0) {
 		const candidate = plainObject(result.page, "Data query page");
-		exactKeys(candidate, [
+		exactKeys$1(candidate, [
 			"kind",
 			"limit",
 			"offset",
@@ -227,7 +227,7 @@ function normalizeSmrtWebDataQueryResult(value) {
 	}
 	if (page && rows.length > page.limit) throw new TypeError("Data query rows exceed the declared page limit");
 	const freshness = plainObject(result.freshness, "Data query freshness");
-	exactKeys(freshness, ["state", "asOf"], "Data query freshness");
+	exactKeys$1(freshness, ["state", "asOf"], "Data query freshness");
 	const state = stringValue(freshness.state, "Data query freshness state");
 	if (state !== "fresh" && state !== "stale" && state !== "unknown") throw new TypeError("Data query freshness state is invalid");
 	if (!Array.isArray(result.warnings) || result.warnings.length > 100 || result.warnings.some((item) => typeof item !== "string")) throw new TypeError("Data query warnings must be strings");
@@ -259,6 +259,120 @@ async function executeSmrtWebDataQuery(transport, request, options) {
 	return result;
 }
 //#endregion
+//#region src/data-surface-actions.ts
+var MAX_SMRT_WEB_DATA_SURFACE_ACTION_RESULT_BYTES = 1e6;
+var MAX_SMRT_WEB_DATA_SURFACE_ACTION_IDENTIFIER_LENGTH = 256;
+var MAX_SMRT_WEB_DATA_SURFACE_ACTION_JSON_DEPTH = 16;
+var MAX_SMRT_WEB_DATA_SURFACE_ACTION_CONTAINER_ITEMS = 1e3;
+var FORBIDDEN_KEYS = /* @__PURE__ */ new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+function object(value, label) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new TypeError(`${label} must be a plain object`);
+	const prototype = Object.getPrototypeOf(value);
+	if (prototype !== Object.prototype && prototype !== null) throw new TypeError(`${label} must be a plain object`);
+	for (const key of Object.keys(value)) if (FORBIDDEN_KEYS.has(key)) throw new TypeError(`${label} contains a forbidden key`);
+	return value;
+}
+function exactKeys(value, allowed, label) {
+	const allowedKeys = new Set(allowed);
+	for (const key of Object.keys(value)) if (!allowedKeys.has(key)) throw new TypeError(`${label} contains ${key}`);
+}
+function identifier(value, label) {
+	if (typeof value !== "string" || value.length === 0 || value.length > 256) throw new TypeError(`${label} must be a bounded non-empty string`);
+	return value;
+}
+function json(value, label, depth = 0) {
+	if (depth > 16) throw new TypeError(`${label} exceeds JSON depth`);
+	if (value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value)) return value;
+	if (Array.isArray(value)) {
+		if (value.length > 1e3) throw new TypeError(`${label} exceeds the container-item limit`);
+		return value.map((entry, index) => json(entry, `${label}[${index}]`, depth + 1));
+	}
+	const source = object(value, label);
+	if (Object.keys(source).length > 1e3) throw new TypeError(`${label} exceeds the container-item limit`);
+	const result = /* @__PURE__ */ Object.create(null);
+	for (const [key, entry] of Object.entries(source)) result[key] = json(entry, `${label}.${key}`, depth + 1);
+	return result;
+}
+function identity(value) {
+	const source = object(value, "Data surface identity");
+	exactKeys(source, [
+		"surfaceId",
+		"kind",
+		"subject"
+	], "Data surface identity");
+	const kind = source.kind;
+	if (![
+		"table",
+		"list",
+		"report",
+		"custom"
+	].includes(kind)) throw new TypeError("Data surface identity kind is invalid");
+	const result = {
+		surfaceId: identifier(source.surfaceId, "Data surface identity surfaceId"),
+		kind
+	};
+	if (source.subject !== void 0) {
+		const subject = object(source.subject, "Data surface identity subject");
+		exactKeys(subject, [
+			"type",
+			"id",
+			"label"
+		], "Data surface identity subject");
+		result.subject = {
+			type: identifier(subject.type, "Data surface identity subject type"),
+			id: identifier(subject.id, "Data surface identity subject id"),
+			...subject.label === void 0 ? {} : { label: identifier(subject.label, "Data surface identity subject label") }
+		};
+	}
+	return result;
+}
+function sameIdentity(left, right) {
+	return left.surfaceId === right.surfaceId && left.kind === right.kind && left.subject?.type === right.subject?.type && left.subject?.id === right.subject?.id;
+}
+function normalizeSmrtWebDataSurfaceActionResult(value) {
+	const serialized = JSON.stringify(value);
+	if (serialized === void 0 || new TextEncoder().encode(serialized).byteLength > 1e6) throw new TypeError("Data surface action result exceeds the maximum byte limit");
+	const source = object(value, "Data surface action result");
+	exactKeys(source, [
+		"version",
+		"requestId",
+		"identity",
+		"actionId",
+		"phase",
+		"ok",
+		"reason",
+		"confirmationToken",
+		"details"
+	], "Data surface action result");
+	if (source.version !== 1 || source.phase !== "preview" && source.phase !== "apply") throw new TypeError("Data surface action result has an invalid version or phase");
+	if (typeof source.ok !== "boolean") throw new TypeError("Data surface action result ok must be boolean");
+	const result = {
+		version: 1,
+		requestId: identifier(source.requestId, "Data surface action result requestId"),
+		identity: identity(source.identity),
+		actionId: identifier(source.actionId, "Data surface action result actionId"),
+		phase: source.phase,
+		ok: source.ok
+	};
+	if (source.reason !== void 0) result.reason = identifier(source.reason, "Data surface action result reason");
+	if (source.confirmationToken !== void 0) result.confirmationToken = identifier(source.confirmationToken, "Data surface action result confirmationToken");
+	if (source.details !== void 0) {
+		const details = json(source.details, "Data surface action result details");
+		if (Array.isArray(details) || details === null || typeof details !== "object") throw new TypeError("Data surface action result details must be an object");
+		result.details = details;
+	}
+	return result;
+}
+async function executeSmrtWebDataSurfaceAction(transport, request, options) {
+	const result = normalizeSmrtWebDataSurfaceActionResult(await transport.action(request, options));
+	if (result.requestId !== request.requestId || result.actionId !== request.actionId || result.phase !== request.phase || !sameIdentity(result.identity, request.identity)) throw new TypeError("Data surface action result does not match its request");
+	return result;
+}
+//#endregion
 //#region src/durable-store.ts
 function durableStoreNamespace(key) {
 	const optional = (value) => value === void 0 ? "" : `_${encodeURIComponent(value)}`;
@@ -3037,6 +3151,6 @@ function createSmrtCollection(definition, options) {
 	return handle;
 }
 //#endregion
-export { MAX_SMRT_WEB_DATA_QUERY_OFFSET as A, offlineOutbox as C, MAX_SMRT_WEB_DATA_QUERY_CONTAINER_ITEMS as D, wipeDurableStore as E, MAX_SMRT_WEB_DATA_QUERY_WARNINGS as F, executeSmrtWebDataQuery as I, normalizeSmrtWebDataQueryResult as L, MAX_SMRT_WEB_DATA_QUERY_RESULT_BYTES as M, MAX_SMRT_WEB_DATA_QUERY_ROWS as N, MAX_SMRT_WEB_DATA_QUERY_FACETS as O, MAX_SMRT_WEB_DATA_QUERY_STRING_LENGTH as P, runWrapMutation as R, getOutboxHandle as S, registerDurableResource as T, createSmrtWebEventSubscriber as _, createSmrtWebClient as a, DEFAULT_PERSIST_DEBOUNCE_MS as b, newLocalId as c, unwrapListResult as d, validateSmrtWebClient as f, createUpdateState as g, registerWebMcpTools as h, createSmrtCollection as i, MAX_SMRT_WEB_DATA_QUERY_PAGE_LIMIT as j, MAX_SMRT_WEB_DATA_QUERY_FACET_VALUES as k, throwIfSmrtWebError as l, registerWebMcpBespokeTool as m, buildListQuery as n, getEngineCollection as o, registerViewIntent as p, createDefinitionFetchers as r, invalidateSmrtWebCollections as s, SmrtWebRequestError as t, unwrapItemResult as u, liveInvalidation as v, durableStoreNamespace as w, persistCollection as x, createSmrtWebQuery as y };
+export { MAX_SMRT_WEB_DATA_SURFACE_ACTION_RESULT_BYTES as A, MAX_SMRT_WEB_DATA_QUERY_STRING_LENGTH as B, offlineOutbox as C, MAX_SMRT_WEB_DATA_SURFACE_ACTION_CONTAINER_ITEMS as D, wipeDurableStore as E, MAX_SMRT_WEB_DATA_QUERY_FACET_VALUES as F, executeSmrtWebDataQuery as H, MAX_SMRT_WEB_DATA_QUERY_OFFSET as I, MAX_SMRT_WEB_DATA_QUERY_PAGE_LIMIT as L, normalizeSmrtWebDataSurfaceActionResult as M, MAX_SMRT_WEB_DATA_QUERY_CONTAINER_ITEMS as N, MAX_SMRT_WEB_DATA_SURFACE_ACTION_IDENTIFIER_LENGTH as O, MAX_SMRT_WEB_DATA_QUERY_FACETS as P, MAX_SMRT_WEB_DATA_QUERY_RESULT_BYTES as R, getOutboxHandle as S, registerDurableResource as T, normalizeSmrtWebDataQueryResult as U, MAX_SMRT_WEB_DATA_QUERY_WARNINGS as V, runWrapMutation as W, createSmrtWebEventSubscriber as _, createSmrtWebClient as a, DEFAULT_PERSIST_DEBOUNCE_MS as b, newLocalId as c, unwrapListResult as d, validateSmrtWebClient as f, createUpdateState as g, registerWebMcpTools as h, createSmrtCollection as i, executeSmrtWebDataSurfaceAction as j, MAX_SMRT_WEB_DATA_SURFACE_ACTION_JSON_DEPTH as k, throwIfSmrtWebError as l, registerWebMcpBespokeTool as m, buildListQuery as n, getEngineCollection as o, registerViewIntent as p, createDefinitionFetchers as r, invalidateSmrtWebCollections as s, SmrtWebRequestError as t, unwrapItemResult as u, liveInvalidation as v, durableStoreNamespace as w, persistCollection as x, createSmrtWebQuery as y, MAX_SMRT_WEB_DATA_QUERY_ROWS as z };
 
-//# sourceMappingURL=src-BSrj5jW0.js.map
+//# sourceMappingURL=src-0IQGhPIM.js.map