@nominalso/vibe-host 0.1.0 → 0.3.0

package/dist/index.js

@@ -1,7 +1,19 @@
 // package.json
-var version = "0.1.0";
+var version = "0.3.0";
 
 // ../protocol-types/dist/index.js
+function normalizeSubroute(subroute) {
+  const normalized = subroute.startsWith("/") ? subroute : `/${subroute}`;
+  const path = normalized.split(/[?#]/)[0];
+  let decoded = path;
+  let prev;
+  do {
+    prev = decoded;
+    decoded = decoded.replace(/%25/gi, "%").replace(/%2e/gi, ".").replace(/%2f/gi, "/");
+  } while (decoded !== prev);
+  if (decoded.split("/").some((segment) => segment === "..")) return null;
+  return normalized;
+}
 var PROTOCOL_ID = "nominal-vibe-bridge";
 var PROTOCOL_VERSION = 1;
 var BRIDGE_KINDS = ["request", "response", "push", "command", "progress"];
@@ -18,6 +30,47 @@ function isBridgeMessage(data) {
   if (CORRELATED_KINDS_SET.has(d.kind) && typeof d.requestId !== "string") return false;
   return true;
 }
+var BridgeError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "BridgeError";
+  }
+};
+var HttpBridgeError = class extends BridgeError {
+  constructor(status, message) {
+    super("REQUEST_FAILED", message);
+    this.status = status;
+    this.name = "HttpBridgeError";
+  }
+};
+function isOriginPattern(entry) {
+  return entry.includes("*");
+}
+var patternCache = /* @__PURE__ */ new Map();
+function patternToRegExp(pattern) {
+  const cached = patternCache.get(pattern);
+  if (cached) return cached;
+  const escaped = pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const body = escaped.replace(/\\\*/g, "[^./:@?#\\s]+");
+  const compiled = new RegExp(`^${body}$`);
+  patternCache.set(pattern, compiled);
+  return compiled;
+}
+function matchesOrigin(origin, entry) {
+  if (!isOriginPattern(entry)) return origin === entry;
+  return patternToRegExp(entry).test(origin);
+}
+function isOriginAllowed(origin, allowlist, { allowPatterns }) {
+  for (const entry of allowlist) {
+    if (isOriginPattern(entry)) {
+      if (allowPatterns && matchesOrigin(origin, entry)) return true;
+    } else if (origin === entry) {
+      return true;
+    }
+  }
+  return false;
+}
 
 // ../api-client/dist/index.js
 import {
@@ -352,10 +405,6 @@ var getSubsidiaryParentCurrenciesApiTenancySubsidiarySubsidiaryIdParentCurrencie
 };
 function createVibeApiClient({ baseUrl, stripApiPrefix }) {
   const client2 = createClient2(createConfig2({ baseUrl }));
-  client2.interceptors.request.use((request) => {
-    console.log("[vibe-api-client] request url:", request.url);
-    return request;
-  });
   if (stripApiPrefix) {
     client2.interceptors.request.use(
       (request) => new Request(request.url.replace(`${baseUrl}/api/`, `${baseUrl}/`), request)
@@ -364,16 +413,28 @@ function createVibeApiClient({ baseUrl, stripApiPrefix }) {
   return client2;
 }
 
-// src/handlerMap.ts
+// src/handlers/call.ts
 async function call(fn, payload, client2) {
-  const { data } = await fn({ ...payload, client: client2 });
-  if (data == null) throw new Error("API returned no data");
+  const { data, response } = await fn({ ...payload, client: client2 });
+  if (data == null) {
+    if (response && !response.ok) {
+      throw new HttpBridgeError(
+        response.status,
+        `API request failed with status ${response.status}`
+      );
+    }
+    if (!response) {
+      throw new Error("API request produced no response");
+    }
+    return null;
+  }
   return data;
 }
-function createHandlerMap(options) {
-  const client2 = createVibeApiClient(options);
+
+// src/handlers/accounting.ts
+function accountingHandlers(client2) {
   return {
-    // Accounting — chart of accounts
+    // Chart of accounts
     GET_CHART_OF_ACCOUNTS: (p) => call(getCoaFlatApiAccountingSubsidiarySubsidiaryIdCoaAccountGet, p, client2),
     GET_COA_TREE: (p) => call(getCoaTreeApiAccountingSubsidiarySubsidiaryIdCoaGet, p, client2),
     GET_COA_FLAT_SIMPLE: (p) => call(
@@ -398,7 +459,7 @@ function createHandlerMap(options) {
     ),
     GET_ACCOUNTS: (p) => call(getAccountsApiAccountingAccountGet, p, client2),
     GET_ACCOUNT: (p) => call(getAccountApiAccountingAccountAccountIdGet, p, client2),
-    // Accounting — exchange rates
+    // Exchange rates
     GET_CONVERSION_RATES: (p) => call(getConversionRateApiAccountingCurrencyCurrencyConversionRatesGet, p, client2),
     GET_EFFECTIVE_EXCHANGE_RATE: (p) => call(getEffectiveExchangeRateApiAccountingConsolidationExchangeRateGet, p, client2),
     GET_EXCHANGE_RATE_BY_DATE: (p) => call(
@@ -406,7 +467,7 @@ function createHandlerMap(options) {
       p,
       client2
     ),
-    // Accounting — dimensions
+    // Dimensions
     GET_DIMENSIONS: (p) => call(getDimensionsApiAccountingDimensionGet, p, client2),
     GET_DIMENSION_VALUES: (p) => call(getDimensionValuesApiAccountingDimensionValueGet, p, client2),
     GET_DIMENSION_VALUES_HIERARCHICAL: (p) => call(
@@ -419,7 +480,7 @@ function createHandlerMap(options) {
       p,
       client2
     ),
-    // Accounting — journal entries
+    // Journal entries
     GET_JOURNAL_ENTRIES: (p) => call(
       getSubsidiaryJournalApiAccountingSubsidiarySubsidiaryIdJournalEntryGet,
       p,
@@ -434,8 +495,14 @@ function createHandlerMap(options) {
       getJournalEntryApiAccountingSubsidiarySubsidiaryIdJournalEntryJournalEntryIdGet,
       p,
       client2
-    ),
-    // Activity — period instances
+    )
+  };
+}
+
+// src/handlers/activity.ts
+function activityHandlers(client2) {
+  return {
+    // Period instances
     GET_PERIODS: (p) => call(getPeriodInstancesApiActivityPeriodInstanceGet, p, client2),
     GET_PERIOD_INSTANCE: (p) => call(getPeriodInstanceApiActivityPeriodInstancePeriodInstanceIdGet, p, client2),
     GET_PERIOD_INSTANCE_BY_SLUG: (p) => call(
@@ -448,14 +515,14 @@ function createHandlerMap(options) {
       p,
       client2
     ),
-    // Activity — activity definitions
+    // Activity definitions
     GET_ACTIVITY_DEFINITIONS: (p) => call(getActivityDefinitionsApiActivityActivityDefinitionGet, p, client2),
     GET_ACTIVITY_DEFINITION: (p) => call(
       getActivityDefinitionByIdApiActivityActivityDefinitionActivityDefinitionIdGet,
       p,
       client2
     ),
-    // Activity — activity instances
+    // Activity instances
     GET_ACTIVITY_INSTANCES: (p) => call(getActivityInstancesApiActivityActivityInstanceGet, p, client2),
     GET_ACTIVITY_INSTANCE: (p) => call(getActivityInstanceApiActivityActivityInstanceActivityInstanceIdGet, p, client2),
     GET_ACTIVITY_INSTANCE_BY_PERIOD: (p) => call(
@@ -473,28 +540,43 @@ function createHandlerMap(options) {
       p,
       client2
     ),
-    // Activity — task definitions
+    // Task definitions
     GET_TASK_DEFINITIONS: (p) => call(getAllTasksDefinitionsApiActivityTaskDefinitionGet, p, client2),
     GET_TASK_DEFINITION: (p) => call(getTaskDefinitionByIdApiActivityTaskDefinitionTaskDefinitionIdGet, p, client2),
     CREATE_TASK_DEFINITION: (p) => call(createTaskDefinitionApiActivityTaskDefinitionPost, p, client2),
     UPDATE_TASK_DEFINITION: (p) => call(updateTaskDefinitionApiActivityTaskDefinitionTaskDefinitionIdPut, p, client2),
     GET_TASK_DEFINITIONS_BY_FILTER: (p) => call(getAllTasksDefinitionsByFilterApiActivityTaskDefinitionQueryPost, p, client2),
-    // Activity — task instances
+    // Task instances
     GET_TASK_INSTANCES: (p) => call(getAllTaskInstancesApiActivityTaskInstanceGet, p, client2),
     GET_TASK_INSTANCE: (p) => call(getTaskInstanceByIdApiActivityTaskInstanceTaskInstanceIdGet, p, client2),
     POST_TASK_OUTPUT: (p) => call(updateTaskInstanceApiActivityTaskInstanceTaskInstanceIdPut, p, client2),
-    GET_TASK_INSTANCES_BY_FILTER: (p) => call(getAllTaskInstancesByFilterApiActivityTaskInstanceQueryPost, p, client2),
-    // Audit trail
+    GET_TASK_INSTANCES_BY_FILTER: (p) => call(getAllTaskInstancesByFilterApiActivityTaskInstanceQueryPost, p, client2)
+  };
+}
+
+// src/handlers/audit-trail.ts
+function auditTrailHandlers(client2) {
+  return {
     GET_AUDIT_EVENTS: (p) => call(getEventsApiAuditTrailEventGet, p, client2),
-    GET_ENTITY_AUDIT_EVENTS: (p) => call(getEntityEventsApiAuditTrailEventEntityTargetTypeTargetIdPost, p, client2),
-    // Period manager
+    GET_ENTITY_AUDIT_EVENTS: (p) => call(getEntityEventsApiAuditTrailEventEntityTargetTypeTargetIdPost, p, client2)
+  };
+}
+
+// src/handlers/period-manager.ts
+function periodManagerHandlers(client2) {
+  return {
     GET_FISCAL_CALENDARS: (p) => call(
       getFiscalCalendarsBySubsidiaryApiPeriodManagerFiscalCalendarBySubsidiarySubsidiaryIdGet,
       p,
       client2
     ),
-    GET_FISCAL_CALENDAR: (p) => call(getFiscalCalendarByIdApiPeriodManagerFiscalCalendarCalendarIdGet, p, client2),
-    // Tenancy
+    GET_FISCAL_CALENDAR: (p) => call(getFiscalCalendarByIdApiPeriodManagerFiscalCalendarCalendarIdGet, p, client2)
+  };
+}
+
+// src/handlers/tenancy.ts
+function tenancyHandlers(client2) {
+  return {
     GET_SUBSIDIARIES: (p) => call(getAllSubsidiariesApiTenancySubsidiaryGet, p, client2),
     GET_SUBSIDIARY: (p) => call(getSubsidiaryApiTenancySubsidiarySubsidiaryIdGet, p, client2),
     GET_SUBSIDIARY_PARENT_CURRENCIES: (p) => call(
@@ -506,46 +588,122 @@ function createHandlerMap(options) {
   };
 }
 
-// src/uploadHandler.ts
-async function uploadHandler(payload, sendProgress) {
-  const attachmentId = crypto.randomUUID();
-  for (const progress of [25, 50, 75, 100]) {
-    await new Promise((r) => setTimeout(r, 400));
-    sendProgress({ attachmentId, progress });
+// src/handlerMap.ts
+function createHandlerMap(options) {
+  const client2 = createVibeApiClient(options);
+  return {
+    ...accountingHandlers(client2),
+    ...activityHandlers(client2),
+    ...auditTrailHandlers(client2),
+    ...periodManagerHandlers(client2),
+    ...tenancyHandlers(client2)
+  };
+}
+
+// src/rateLimiter.ts
+var DEFAULT_RATE_LIMIT = 60;
+function createRateLimiter(limit = DEFAULT_RATE_LIMIT, windowMs = 6e4) {
+  return { timestamps: [], limit, windowMs };
+}
+function checkRateLimit(state) {
+  const now = Date.now();
+  const cutoff = now - state.windowMs;
+  state.timestamps = state.timestamps.filter((t) => t > cutoff);
+  if (state.timestamps.length >= state.limit) {
+    return false;
   }
-  return { attachmentId, name: payload.fileName };
+  state.timestamps.push(now);
+  return true;
+}
+
+// src/unwired.ts
+function warnUnwired(command) {
+  return () => {
+    console.warn(`[vibe-host] Received "${command}" command but no handler is wired \u2014 ignoring.`);
+  };
+}
+function rejectUnwired(op) {
+  return () => Promise.reject(
+    new BridgeError("NOT_WIRED", `[vibe-host] Received "${op}" request but no handler is wired.`)
+  );
 }
 
 // src/VibeAppHost.ts
 var VibeAppHost = class {
-  constructor({ trustedOrigins, getContext, appBasePath, clientConfig }) {
+  constructor(opts) {
+    /**
+     * Concrete iframe origins observed on validated inbound messages. Because you
+     * cannot `postMessage` to a glob pattern, proactive pushes target these
+     * learned origins (plus the exact allowlist entries) rather than the patterns.
+     */
+    this.connectedOrigins = /* @__PURE__ */ new Set();
     this.iframeWindow = null;
+    /**
+     * Source windows we've already logged a successful handshake for. The bridge
+     * polls `GET_CONTEXT` on an interval until it connects, so without this the
+     * "Vibe App connected" line repeats on every poll (SSOT §13 F3).
+     */
+    this.handshakeLoggedWindows = /* @__PURE__ */ new WeakSet();
     this.kindHandlers = {
       request: (msg, source, origin) => this.handleRequest(msg, source, origin),
       command: (msg) => this.dispatchCommand(msg)
     };
-    this.commandHandlers = {
-      REPORT_SUBROUTE: (payload) => {
-        const newPath = payload.subroute === "/" ? this.appBasePath : `${this.appBasePath}${payload.subroute}`;
-        const method = payload.replace ? "replaceState" : "pushState";
-        window.history[method](null, "", newPath);
-      }
-    };
+    const { trustedOrigins, getContext, appBasePath, clientConfig } = opts;
     this.trustedOrigins = new Set(trustedOrigins);
+    this.exactOrigins = trustedOrigins.filter((entry) => !isOriginPattern(entry));
     this.getContext = getContext;
     this.appBasePath = appBasePath;
+    this.onRequestComplete = opts.onRequestComplete;
+    this.rateLimiter = createRateLimiter(opts.rateLimit ?? DEFAULT_RATE_LIMIT);
     this.boundHandleMessage = this.handleMessage.bind(this);
     this.boundHandlePopState = this.handlePopState.bind(this);
-    this.handlers = this.initializeHandlers(clientConfig || { baseUrl: "", stripApiPrefix: false });
+    this.handlers = this.initializeHandlers(
+      clientConfig || { baseUrl: "", stripApiPrefix: false },
+      opts
+    );
+    this.commandHandlers = this.buildCommandHandlers(opts);
   }
   dispatchCommand(msg) {
     const handler = this.commandHandlers[msg.type];
-    handler(msg.payload);
+    if (!handler) {
+      console.warn(`[vibe-host] Received unknown command "${msg.type}" \u2014 ignoring.`);
+      return;
+    }
+    try {
+      handler(msg.payload);
+    } catch (err) {
+      console.warn(`[vibe-host] Command "${msg.type}" handler threw \u2014 ignoring.`, err);
+    }
   }
-  initializeHandlers(clientConfig) {
+  /**
+   * Commands: `REPORT_SUBROUTE` is handled internally (transport + traversal
+   * guard, item `l`); navigation/UI side effects are injected by the consumer,
+   * falling back to warn-and-ignore (DP4).
+   */
+  buildCommandHandlers(opts) {
+    return {
+      REPORT_SUBROUTE: (payload) => {
+        const safe = normalizeSubroute(payload.subroute);
+        if (safe === null) return;
+        const newPath = safe === "/" ? this.appBasePath : `${this.appBasePath}${safe}`;
+        const method = payload.replace ? "replaceState" : "pushState";
+        window.history[method](null, "", newPath);
+      },
+      NAVIGATE: opts.onNavigate ?? warnUnwired("NAVIGATE"),
+      SET_SIDE_NAV: opts.onSetSideNav ?? warnUnwired("SET_SIDE_NAV"),
+      SWITCH_SUBSIDIARY: opts.onSwitchSubsidiary ?? warnUnwired("SWITCH_SUBSIDIARY")
+    };
+  }
+  /**
+   * Requests: the built-in API map (hey-api), plus the injected/awaited side
+   * effects with safe defaults — unwired `UPLOAD_FILE` rejects with a coded
+   * error; unwired `INVALIDATE_CACHE` resolves to a no-op (DP4).
+   */
+  initializeHandlers(clientConfig, opts) {
     return {
       ...createHandlerMap(clientConfig),
-      UPLOAD_FILE: uploadHandler
+      UPLOAD_FILE: opts.onUpload ?? rejectUnwired("UPLOAD_FILE"),
+      INVALIDATE_CACHE: opts.onInvalidateCache ?? (async () => ({ invalidated: false }))
     };
   }
   /**
@@ -566,6 +724,7 @@ var VibeAppHost = class {
       window.removeEventListener("message", this.boundHandleMessage);
       window.removeEventListener("popstate", this.boundHandlePopState);
       this.iframeWindow = null;
+      this.connectedOrigins.clear();
     };
   }
   /**
@@ -585,7 +744,7 @@ var VibeAppHost = class {
       type: "CONTEXT_PUSH",
       payload: { ...this.getContext(), hostVersion: version }
     };
-    for (const origin of this.trustedOrigins) {
+    for (const origin of this.concreteTargets()) {
       target.postMessage(message, origin);
     }
   }
@@ -605,24 +764,55 @@ var VibeAppHost = class {
       type,
       payload
     };
-    for (const origin of this.trustedOrigins) {
+    for (const origin of this.concreteTargets()) {
       this.iframeWindow.postMessage(message, origin);
     }
   }
   async handleMessage(event) {
-    if (!this.trustedOrigins.has(event.origin)) return;
+    if (!isOriginAllowed(event.origin, this.trustedOrigins, { allowPatterns: true })) return;
     if (!isBridgeMessage(event.data)) return;
+    this.connectedOrigins.add(event.origin);
     await this.kindHandlers[event.data.kind]?.(event.data, event.source, event.origin);
   }
+  /**
+   * Concrete origins a proactive push may target: the exact allowlist entries
+   * plus any origins seen on validated inbound messages. Never includes glob
+   * patterns (you cannot `postMessage` to one). When only exact origins are
+   * configured this equals the configured set, so behaviour is unchanged.
+   */
+  concreteTargets() {
+    return /* @__PURE__ */ new Set([...this.exactOrigins, ...this.connectedOrigins]);
+  }
   async handleRequest(msg, source, origin) {
     const { requestId, type } = msg;
     if (type === "GET_CONTEXT") {
-      const ctx = { ...this.getContext(), hostVersion: version };
-      const bridgeVersion = msg.payload?.bridgeVersion ?? "unknown";
-      console.log(
-        `[vibe-host] Vibe App connected \u2014 bridge: ${bridgeVersion}, host: ${version}, tenant: ${ctx.tenant}, user: ${ctx.user.displayName}`
-      );
-      this.respond(source, origin, { kind: "response", type, requestId, ok: true, data: ctx });
+      try {
+        const ctx = { ...this.getContext(), hostVersion: version };
+        if (!this.handshakeLoggedWindows.has(source)) {
+          this.handshakeLoggedWindows.add(source);
+          const bridgeVersion = msg.payload?.bridgeVersion ?? "unknown";
+          console.log(
+            `[vibe-host] Vibe App connected \u2014 bridge: ${bridgeVersion}, host: ${version}, tenant: ${ctx.tenant}, user: ${ctx.user.displayName}`
+          );
+        }
+        this.respond(source, origin, { kind: "response", type, requestId, ok: true, data: ctx });
+      } catch (err) {
+        const error = err instanceof Error ? err.message : String(err);
+        const code = err instanceof BridgeError ? err.code : "CONTEXT_ERROR";
+        this.respond(source, origin, { kind: "response", type, requestId, ok: false, error, code });
+      }
+      return;
+    }
+    if (!checkRateLimit(this.rateLimiter)) {
+      this.respond(source, origin, {
+        kind: "response",
+        type,
+        requestId,
+        ok: false,
+        error: `Too many requests. Limit is ${this.rateLimiter.limit} per minute.`,
+        code: "RATE_LIMITED"
+      });
+      this.onRequestComplete?.({ type, ok: false, payload: msg.payload });
       return;
     }
     const sendProgress = (payload) => {
@@ -640,9 +830,21 @@ var VibeAppHost = class {
       const handler = this.handlers[type];
       const data = await handler(msg.payload, sendProgress);
       this.respond(source, origin, { kind: "response", type, requestId, ok: true, data });
+      this.onRequestComplete?.({ type, ok: true, payload: msg.payload });
     } catch (err) {
       const error = err instanceof Error ? err.message : String(err);
-      this.respond(source, origin, { kind: "response", type, requestId, ok: false, error });
+      const code = err instanceof BridgeError ? err.code : void 0;
+      const status = err instanceof HttpBridgeError ? err.status : void 0;
+      this.respond(source, origin, {
+        kind: "response",
+        type,
+        requestId,
+        ok: false,
+        error,
+        code,
+        status
+      });
+      this.onRequestComplete?.({ type, ok: false, payload: msg.payload });
     }
   }
   respond(target, origin, response) {
@@ -653,5 +855,7 @@ var VibeAppHost = class {
   }
 };
 export {
+  BridgeError,
+  HttpBridgeError,
   VibeAppHost
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nominalso/vibe-host",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Host-side SDK for embedding Nominal Vibe Apps — receives bridge requests over a typed postMessage protocol and dispatches them to Nominal APIs (used by nom-ui).",
   "license": "UNLICENSED",
   "homepage": "https://github.com/nominalso/vibe-apps-sdk#readme",