@mccaskie-labs/workbench-config 0.1.16 → 0.1.17

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @mccaskie-labs/workbench-config
 
+## 0.1.17
+
+### Patch Changes
+
+- Capabilities: the `pdf` component (workbench-pdf) with its `pdf.document` and `pdf.html` probes.
+
 ## 0.1.16
 
 ### Patch Changes

package/capabilities/pdf.json

@@ -0,0 +1,93 @@
+{
+  "$schema": "./schema.json",
+  "format": 1,
+  "component": "pdf",
+  "title": "Branded PDFs",
+  "summary": "workbench-pdf prints an app's content as a PDF with its brand.json logo, colours and fonts, in the app's own Worker through its Browser Rendering binding (BROWSER). Nothing goes through the Gateway and the app holds no Cloudflare token. The standard layout takes plain-text blocks; html() takes the app's own markup.",
+  "status": "built",
+  "surfaces": {
+    "package": [
+      "createPdfMaker",
+      "WorkbenchPdfError"
+    ]
+  },
+  "limits": [
+    {
+      "id": "pdf.blocks",
+      "value": 2000,
+      "unit": "blocks",
+      "per": "document",
+      "enforced_by": "types"
+    },
+    {
+      "id": "pdf.text",
+      "value": 20000,
+      "unit": "characters",
+      "per": "text",
+      "enforced_by": "types"
+    },
+    {
+      "id": "pdf.logo-size",
+      "value": 1048576,
+      "unit": "bytes",
+      "per": "logo",
+      "enforced_by": "types"
+    },
+    {
+      "id": "pdf.time",
+      "value": 120000,
+      "unit": "ms",
+      "per": "document",
+      "enforced_by": "types"
+    }
+  ],
+  "rules": [
+    {
+      "id": "pdf.brand-file",
+      "kind": "must",
+      "text": "Brand every PDF from the app's brand.json through defineBrand, the same file the account emails use.",
+      "enforced_by": "types",
+      "probe": "pdf.document"
+    },
+    {
+      "id": "pdf.own-binding",
+      "kind": "must_not",
+      "text": "Hold a Cloudflare token for Browser Rendering or send PDFs through the Gateway (hard rules 1 and 2): print through the Worker's own BROWSER binding.",
+      "enforced_by": "review",
+      "probe": "pdf.document"
+    },
+    {
+      "id": "pdf.no-page-network",
+      "kind": "must_not",
+      "text": "Let a printed page run script or load anything but data: URIs, the brand's font hosts and the origins the app lists in allowOrigins.",
+      "enforced_by": "types",
+      "probe": "pdf.html"
+    }
+  ],
+  "examples": [
+    {
+      "id": "pdf.example.document",
+      "title": "Print a branded invoice",
+      "lang": "ts",
+      "probe": "pdf.document",
+      "code": "import { defineBrand } from '@mccaskie-labs/workbench-config'\nimport { createPdfMaker } from '@mccaskie-labs/workbench-pdf'\nimport brandFile from '../brand.json'\n\nconst pdf = createPdfMaker({ browser: env.BROWSER, brand: defineBrand(brandFile) })\nconst bytes = await pdf.document({ title: 'Invoice 42', blocks: [{ type: 'table', columns: ['Item', 'Amount'], rows: [['Probe run', '₱112.50']] }] })\nreturn new Response(bytes, { headers: { 'content-type': 'application/pdf' } })"
+    }
+  ],
+  "probes": [
+    {
+      "id": "pdf.document",
+      "half": "runtime",
+      "expect": "pass",
+      "smoke": true,
+      "cost_hint_usd": 0,
+      "note": "Prints the standard layout from the app's brand.json through the BROWSER binding; checks the bytes are a PDF and the page carried the brand name"
+    },
+    {
+      "id": "pdf.html",
+      "half": "runtime",
+      "expect": "pass",
+      "cost_hint_usd": 0,
+      "note": "Prints the app's own HTML holding an image from a host not in allowOrigins; the PDF is made and the browser reports that image's request as blocked"
+    }
+  ]
+}

package/capabilities/schema.json

@@ -27,6 +27,7 @@
         "dns",
         "analytics",
         "country",
+        "pdf",
         "access",
         "r2",
         "kv",

package/dist/capabilities.gen.d.ts

@@ -1,4 +1,4 @@
-export declare const MANIFEST_VERSION: "c72ad5ff6960";
+export declare const MANIFEST_VERSION: "849b265d6d63";
 export declare const capabilities: {
     readonly ai: {
         readonly $schema: "./schema.json";
@@ -1442,6 +1442,82 @@ export declare const capabilities: {
             readonly cost_hint_usd: 0;
         }];
     };
+    readonly pdf: {
+        readonly $schema: "./schema.json";
+        readonly format: 1;
+        readonly component: "pdf";
+        readonly title: "Branded PDFs";
+        readonly summary: "workbench-pdf prints an app's content as a PDF with its brand.json logo, colours and fonts, in the app's own Worker through its Browser Rendering binding (BROWSER). Nothing goes through the Gateway and the app holds no Cloudflare token. The standard layout takes plain-text blocks; html() takes the app's own markup.";
+        readonly status: "built";
+        readonly surfaces: {
+            readonly package: readonly ["createPdfMaker", "WorkbenchPdfError"];
+        };
+        readonly limits: readonly [{
+            readonly id: "pdf.blocks";
+            readonly value: 2000;
+            readonly unit: "blocks";
+            readonly per: "document";
+            readonly enforced_by: "types";
+        }, {
+            readonly id: "pdf.text";
+            readonly value: 20000;
+            readonly unit: "characters";
+            readonly per: "text";
+            readonly enforced_by: "types";
+        }, {
+            readonly id: "pdf.logo-size";
+            readonly value: 1048576;
+            readonly unit: "bytes";
+            readonly per: "logo";
+            readonly enforced_by: "types";
+        }, {
+            readonly id: "pdf.time";
+            readonly value: 120000;
+            readonly unit: "ms";
+            readonly per: "document";
+            readonly enforced_by: "types";
+        }];
+        readonly rules: readonly [{
+            readonly id: "pdf.brand-file";
+            readonly kind: "must";
+            readonly text: "Brand every PDF from the app's brand.json through defineBrand, the same file the account emails use.";
+            readonly enforced_by: "types";
+            readonly probe: "pdf.document";
+        }, {
+            readonly id: "pdf.own-binding";
+            readonly kind: "must_not";
+            readonly text: "Hold a Cloudflare token for Browser Rendering or send PDFs through the Gateway (hard rules 1 and 2): print through the Worker's own BROWSER binding.";
+            readonly enforced_by: "review";
+            readonly probe: "pdf.document";
+        }, {
+            readonly id: "pdf.no-page-network";
+            readonly kind: "must_not";
+            readonly text: "Let a printed page run script or load anything but data: URIs, the brand's font hosts and the origins the app lists in allowOrigins.";
+            readonly enforced_by: "types";
+            readonly probe: "pdf.html";
+        }];
+        readonly examples: readonly [{
+            readonly id: "pdf.example.document";
+            readonly title: "Print a branded invoice";
+            readonly lang: "ts";
+            readonly code: "import { defineBrand } from '@mccaskie-labs/workbench-config'\nimport { createPdfMaker } from '@mccaskie-labs/workbench-pdf'\nimport brandFile from '../brand.json'\n\nconst pdf = createPdfMaker({ browser: env.BROWSER, brand: defineBrand(brandFile) })\nconst bytes = await pdf.document({ title: 'Invoice 42', blocks: [{ type: 'table', columns: ['Item', 'Amount'], rows: [['Probe run', '₱112.50']] }] })\nreturn new Response(bytes, { headers: { 'content-type': 'application/pdf' } })";
+            readonly probe: "pdf.document";
+        }];
+        readonly probes: readonly [{
+            readonly id: "pdf.document";
+            readonly half: "runtime";
+            readonly expect: "pass";
+            readonly smoke: true;
+            readonly cost_hint_usd: 0;
+            readonly note: "Prints the standard layout from the app's brand.json through the BROWSER binding; checks the bytes are a PDF and the page carried the brand name";
+        }, {
+            readonly id: "pdf.html";
+            readonly half: "runtime";
+            readonly expect: "pass";
+            readonly cost_hint_usd: 0;
+            readonly note: "Prints the app's own HTML holding an image from a host not in allowOrigins; the PDF is made and the browser reports that image's request as blocked";
+        }];
+    };
 };
 export type Alias = (typeof capabilities)["ai"]["allowed"]["aliases"][number]["alias"];
 export type GatewayScope = (typeof capabilities)["gateway"]["allowed"]["scopes"][number];

package/dist/capabilities.gen.js

@@ -1,6 +1,6 @@
 // Generated by `npm run capabilities:build` from capabilities/*.json. Do not edit.
 // check:capabilities fails in Checks when this file is stale.
-export const MANIFEST_VERSION = "c72ad5ff6960";
+export const MANIFEST_VERSION = "849b265d6d63";
 export const capabilities = {
     "ai": {
         "$schema": "./schema.json",
@@ -1959,5 +1959,98 @@ export const capabilities = {
                 "cost_hint_usd": 0
             }
         ]
+    },
+    "pdf": {
+        "$schema": "./schema.json",
+        "format": 1,
+        "component": "pdf",
+        "title": "Branded PDFs",
+        "summary": "workbench-pdf prints an app's content as a PDF with its brand.json logo, colours and fonts, in the app's own Worker through its Browser Rendering binding (BROWSER). Nothing goes through the Gateway and the app holds no Cloudflare token. The standard layout takes plain-text blocks; html() takes the app's own markup.",
+        "status": "built",
+        "surfaces": {
+            "package": [
+                "createPdfMaker",
+                "WorkbenchPdfError"
+            ]
+        },
+        "limits": [
+            {
+                "id": "pdf.blocks",
+                "value": 2000,
+                "unit": "blocks",
+                "per": "document",
+                "enforced_by": "types"
+            },
+            {
+                "id": "pdf.text",
+                "value": 20000,
+                "unit": "characters",
+                "per": "text",
+                "enforced_by": "types"
+            },
+            {
+                "id": "pdf.logo-size",
+                "value": 1048576,
+                "unit": "bytes",
+                "per": "logo",
+                "enforced_by": "types"
+            },
+            {
+                "id": "pdf.time",
+                "value": 120000,
+                "unit": "ms",
+                "per": "document",
+                "enforced_by": "types"
+            }
+        ],
+        "rules": [
+            {
+                "id": "pdf.brand-file",
+                "kind": "must",
+                "text": "Brand every PDF from the app's brand.json through defineBrand, the same file the account emails use.",
+                "enforced_by": "types",
+                "probe": "pdf.document"
+            },
+            {
+                "id": "pdf.own-binding",
+                "kind": "must_not",
+                "text": "Hold a Cloudflare token for Browser Rendering or send PDFs through the Gateway (hard rules 1 and 2): print through the Worker's own BROWSER binding.",
+                "enforced_by": "review",
+                "probe": "pdf.document"
+            },
+            {
+                "id": "pdf.no-page-network",
+                "kind": "must_not",
+                "text": "Let a printed page run script or load anything but data: URIs, the brand's font hosts and the origins the app lists in allowOrigins.",
+                "enforced_by": "types",
+                "probe": "pdf.html"
+            }
+        ],
+        "examples": [
+            {
+                "id": "pdf.example.document",
+                "title": "Print a branded invoice",
+                "lang": "ts",
+                "code": "import { defineBrand } from '@mccaskie-labs/workbench-config'\nimport { createPdfMaker } from '@mccaskie-labs/workbench-pdf'\nimport brandFile from '../brand.json'\n\nconst pdf = createPdfMaker({ browser: env.BROWSER, brand: defineBrand(brandFile) })\nconst bytes = await pdf.document({ title: 'Invoice 42', blocks: [{ type: 'table', columns: ['Item', 'Amount'], rows: [['Probe run', '₱112.50']] }] })\nreturn new Response(bytes, { headers: { 'content-type': 'application/pdf' } })",
+                "probe": "pdf.document"
+            }
+        ],
+        "probes": [
+            {
+                "id": "pdf.document",
+                "half": "runtime",
+                "expect": "pass",
+                "smoke": true,
+                "cost_hint_usd": 0,
+                "note": "Prints the standard layout from the app's brand.json through the BROWSER binding; checks the bytes are a PDF and the page carried the brand name"
+            },
+            {
+                "id": "pdf.html",
+                "half": "runtime",
+                "expect": "pass",
+                "cost_hint_usd": 0,
+                "note": "Prints the app's own HTML holding an image from a host not in allowOrigins; the PDF is made and the browser reports that image's request as blocked"
+            }
+        ]
     }
 };

package/dist/capability-schema.d.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-export declare const COMPONENTS: readonly ["gateway", "ai", "images", "image-search", "config", "email", "email-inbound", "email-sending", "database", "workers", "domains", "dns", "analytics", "country", "access", "r2", "kv", "github"];
+export declare const COMPONENTS: readonly ["gateway", "ai", "images", "image-search", "config", "email", "email-inbound", "email-sending", "database", "workers", "domains", "dns", "analytics", "country", "pdf", "access", "r2", "kv", "github"];
 export type Component = (typeof COMPONENTS)[number];
 export declare const allowedSchemas: {
     gateway: z.ZodObject<{
@@ -108,6 +108,7 @@ export declare const capabilitySchema: z.ZodObject<{
         "image-search": "image-search";
         images: "images";
         kv: "kv";
+        pdf: "pdf";
         r2: "r2";
         workers: "workers";
     }>;

package/dist/capability-schema.js

@@ -17,6 +17,7 @@ export const COMPONENTS = [
     "dns",
     "analytics",
     "country",
+    "pdf",
     "access",
     "r2",
     "kv",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mccaskie-labs/workbench-config",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "description": "Workbench app configuration: WORKBENCH_ENV, typed variables that fail by name, secrets that are never printed, and the capabilities manifest.",
   "license": "UNLICENSED",
   "type": "module",