@oddington/sdk 0.1.26 → 0.1.28

package/README.md

@@ -75,8 +75,9 @@ runtime contains `run.id`, `data`, `files`, `connections`, `inbox`, and `step`.
 Accepted input and saved values are immutable snapshots. Access declarations set
 maximum named capabilities and grant no authority; the trusted host checks current
 authority. Response handler IDs are local to the routine and must be unique. A
-declared `review` handler crosses the Inbox publication seam as
-`invoice-import/review`, without deploying or executing that handler.
+declared `review` handler crosses the Inbox publication seam as `review`; Inbox
+retains the canonical `invoice-import` routine identity separately, without
+deploying or executing that handler.
 
 The bounded grammar supports closed objects with required properties, arrays with
 an explicit `maxItems` from 1 to 64, booleans, strings (at most 4096 code points),

package/dist/browser.js

@@ -1,3 +1,108 @@
+var FileOperationError = class extends Error {
+  constructor(code, status, retryable = !1) {
+    super(code);
+    this.code = code;
+    this.status = status;
+    this.retryable = retryable;
+  }
+  code;
+  status;
+  retryable;
+}, FILE_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/, FILE_ORIGINAL_MAX_BYTES = 5 * 1024 ** 3;
+function parseFileDescriptor(value) {
+  let invalid8 = () => {
+    throw new FileOperationError("unavailable", 503, !0);
+  };
+  if (!value || typeof value != "object" || Array.isArray(value)) return invalid8();
+  let f = value;
+  if (Object.keys(f).sort().join(",") !== "details,enrichments,id,mediaType,name,path,sha256,size" || typeof f.id != "string" || !FILE_ID_PATTERN.test(f.id) || !safeFileName(f.name) || !safeFilePath(f.path) || !Number.isSafeInteger(f.size) || f.size < 0 || f.size > FILE_ORIGINAL_MAX_BYTES || typeof f.sha256 != "string" || !/^[0-9a-f]{64}$/.test(f.sha256) || !f.enrichments || typeof f.enrichments != "object" || Array.isArray(f.enrichments) || !f.details || typeof f.details != "object" || Array.isArray(f.details)) return invalid8();
+  let d = f.details;
+  if (d.kind === "other") {
+    if (Object.keys(d).length !== 1 || ![
+      "application/octet-stream",
+      "text/plain",
+      "text/markdown",
+      "application/json",
+      "image/png",
+      "image/jpeg"
+    ].includes(f.mediaType)) return invalid8();
+  } else if (d.kind === "csv") {
+    if (Object.keys(d).sort().join(",") !== "dataRows,delimiter,encoding,headerRow,kind" || f.mediaType !== "text/csv" || !["utf-8", "windows-1252"].includes(d.encoding) || ![",", ";", "	"].includes(d.delimiter) || !Number.isSafeInteger(d.headerRow) || d.headerRow < 1 || !Number.isSafeInteger(d.dataRows) || d.dataRows < 0) return invalid8();
+  } else if (d.kind === "pdf") {
+    if (f.mediaType !== "application/pdf" || Object.keys(d).some((key) => !["kind", "pages"].includes(key)) || "pages" in d && (!Number.isSafeInteger(d.pages) || d.pages < 1)) return invalid8();
+  } else return invalid8();
+  for (let [name, descriptor] of Object.entries(f.enrichments)) {
+    if (!safeEnrichmentName(name)) return invalid8();
+    parseEnrichmentDescriptor(descriptor);
+  }
+  return new TextEncoder().encode(JSON.stringify(f)).byteLength > 16 * 1024 ? invalid8() : f;
+}
+function parseEnrichmentDescriptor(value) {
+  let invalid8 = () => {
+    throw new FileOperationError("unavailable", 503, !0);
+  };
+  if (!value || typeof value != "object" || Array.isArray(value)) return invalid8();
+  let d = value;
+  return Object.keys(d).sort().join(",") !== "mediaType,sha256,size" || !["application/octet-stream", "text/plain", "text/markdown", "application/json"].includes(d.mediaType) || !Number.isSafeInteger(d.size) || d.size < 0 || d.size > 16 * 1024 * 1024 || typeof d.sha256 != "string" || !/^[0-9a-f]{64}$/.test(d.sha256) ? invalid8() : d;
+}
+function safeEnrichmentName(value) {
+  return safeFileName(value) && !/^original(?:\.|$)/i.test(value);
+}
+function parseFileEnrichMetadata(value, maxBytes) {
+  let invalid8 = () => {
+    throw new FileOperationError("invalid_input", 400);
+  };
+  if (!value || typeof value != "object" || Array.isArray(value)) return invalid8();
+  let d = value;
+  if (Object.keys(d).some((key) => !["name", "size", "mediaType", "replace"].includes(key)) || !safeEnrichmentName(d.name) || !Number.isSafeInteger(d.size) || d.size < 0 || d.mediaType !== void 0 && (typeof d.mediaType != "string" || d.mediaType.length > 255 || /[\u0000-\u001f\u007f]/.test(d.mediaType)) || d.replace !== void 0 && (typeof d.replace != "string" || !/^[0-9a-f]{64}$/.test(d.replace))) return invalid8();
+  if (d.size > maxBytes) throw new FileOperationError("request_too_large", 413);
+  return d;
+}
+function safeFileName(value) {
+  return typeof value == "string" && value.length > 0 && value.length <= 255 && value === value.trim() && value !== "." && value !== ".." && !/[\u0000-\u001f\u007f-\u009f/\\:*?"<>|]/u.test(value) && !/[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/.test(value) && !/[. ]$/.test(value) && !/^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(value);
+}
+function safeFilePath(value) {
+  return typeof value == "string" && value.length <= 1024 && value.split("/").every(safeFileName);
+}
+function safeManagedFilePath(value) {
+  return safeFilePath(value) && value.split("/")[0].toLowerCase() !== ".os";
+}
+var ORIGINAL_MEDIA_TYPES = ["application/pdf", "text/plain", "text/markdown", "application/json", "image/png", "image/jpeg"];
+function declaredOriginalMediaType(value) {
+  let normalized = value.split(";", 1)[0].trim().toLowerCase();
+  return ORIGINAL_MEDIA_TYPES.includes(normalized) ? normalized : void 0;
+}
+function parseFileCreateMetadata(value, maxBytes) {
+  let invalid8 = () => {
+    throw new FileOperationError("invalid_input", 400);
+  };
+  if (!value || typeof value != "object" || Array.isArray(value)) return invalid8();
+  let input = value;
+  if (Object.keys(input).some((key) => !["name", "path", "storage", "csv", "inputMediaType", "size", "requestKey"].includes(key))) return invalid8();
+  let path = input.path === void 0 ? "Files" : input.path;
+  if (!safeFileName(input.name) || !safeManagedFilePath(path) || input.storage !== void 0 && input.storage !== "remote" && input.storage !== "local" || input.inputMediaType !== void 0 && (typeof input.inputMediaType != "string" || !ORIGINAL_MEDIA_TYPES.includes(input.inputMediaType)) || !Number.isSafeInteger(input.size) || input.size < 0) return invalid8();
+  if (input.size > maxBytes) throw new FileOperationError("request_too_large", 413);
+  if (typeof input.requestKey != "string" || input.requestKey.length < 1 || input.requestKey.length > 256 || input.requestKey !== input.requestKey.trim() || /[\u0000-\u001f\u007f]/.test(input.requestKey)) return invalid8();
+  let csv;
+  if (input.csv !== void 0) {
+    if (!input.csv || typeof input.csv != "object" || Array.isArray(input.csv)) return invalid8();
+    let hints = input.csv;
+    if (Object.keys(hints).some((key) => !["encoding", "delimiter", "headerRow"].includes(key))) return invalid8();
+    let encoding = hints.encoding === void 0 ? "utf-8" : hints.encoding, delimiter = hints.delimiter === void 0 ? "," : hints.delimiter, headerRow = hints.headerRow === void 0 ? 1 : hints.headerRow;
+    if (encoding !== "utf-8" && encoding !== "windows-1252" || ![",", ";", "	"].includes(delimiter) || !Number.isSafeInteger(headerRow) || headerRow < 1 || headerRow > 1e5) return invalid8();
+    csv = { encoding, delimiter, headerRow };
+  }
+  return {
+    name: input.name,
+    path,
+    ...input.storage ? { storage: input.storage } : {},
+    ...input.inputMediaType === void 0 ? {} : { inputMediaType: input.inputMediaType },
+    ...csv ? { csv } : {},
+    size: input.size,
+    requestKey: input.requestKey
+  };
+}
+
 var InboxContractError = class extends Error {
   constructor(message2) {
     super(message2), this.name = "InboxContractError";
@@ -65,7 +170,7 @@ function validateInboxFile(value) {
   let fileId = id(v.id, "Inbox file ID"), name = id(v.name, "filename"), mediaType = id(v.mediaType, "media type");
   (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(fileId) || /[\x00-\x1f\x7f/\\]/.test(name) || !/^[a-z0-9!#$&^_.+-]+\/[a-z0-9!#$&^_.+-]+$/.test(mediaType) || typeof v.sha256 != "string" || !/^[0-9a-f]{64}$/.test(v.sha256)) && fail("Invalid Inbox file identity or metadata");
   let size = natural(v.size, "file size");
-  size > 25 * 1024 * 1024 && fail("File exceeds supported size");
+  size > FILE_ORIGINAL_MAX_BYTES && fail("File exceeds supported size");
   let d = object(v.details, "file details"), details;
   switch (d.kind) {
     case "csv":
@@ -144,7 +249,19 @@ function recordsBlock(value) {
   return validateBlock({ ...value, kind: "records" });
 }
 function fileBlock(value) {
-  return validateBlock({ ...value, kind: "files" });
+  let input = object(serializable(value), "Files Block"), files3 = array(input.files, "files").map((entry) => {
+    let descriptor = object(entry, "File");
+    if (!("path" in descriptor || "enrichments" in descriptor)) return validateInboxFile(descriptor);
+    let file2;
+    try {
+      file2 = parseFileDescriptor(descriptor);
+    } catch {
+      return fail("Invalid shared File descriptor");
+    }
+    let { id: id3, name, mediaType, size, sha256, details } = file2;
+    return { id: id3, name, mediaType, size, sha256, details };
+  });
+  return validateBlock({ ...input, kind: "files", files: files3 });
 }
 function asksBlock(value) {
   return validateBlock({ ...value, kind: "asks" });
@@ -393,111 +510,6 @@ function validateRecordRead(value) {
   };
 }
 
-var FileOperationError = class extends Error {
-  constructor(code, status, retryable = !1) {
-    super(code);
-    this.code = code;
-    this.status = status;
-    this.retryable = retryable;
-  }
-  code;
-  status;
-  retryable;
-}, FILE_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/, FILE_ORIGINAL_MAX_BYTES = 5 * 1024 ** 3;
-function parseFileDescriptor(value) {
-  let invalid8 = () => {
-    throw new FileOperationError("unavailable", 503, !0);
-  };
-  if (!value || typeof value != "object" || Array.isArray(value)) return invalid8();
-  let f = value;
-  if (Object.keys(f).sort().join(",") !== "details,enrichments,id,mediaType,name,path,sha256,size" || typeof f.id != "string" || !FILE_ID_PATTERN.test(f.id) || !safeFileName(f.name) || !safeFilePath(f.path) || !Number.isSafeInteger(f.size) || f.size < 0 || f.size > FILE_ORIGINAL_MAX_BYTES || typeof f.sha256 != "string" || !/^[0-9a-f]{64}$/.test(f.sha256) || !f.enrichments || typeof f.enrichments != "object" || Array.isArray(f.enrichments) || !f.details || typeof f.details != "object" || Array.isArray(f.details)) return invalid8();
-  let d = f.details;
-  if (d.kind === "other") {
-    if (Object.keys(d).length !== 1 || ![
-      "application/octet-stream",
-      "text/plain",
-      "text/markdown",
-      "application/json",
-      "image/png",
-      "image/jpeg"
-    ].includes(f.mediaType)) return invalid8();
-  } else if (d.kind === "csv") {
-    if (Object.keys(d).sort().join(",") !== "dataRows,delimiter,encoding,headerRow,kind" || f.mediaType !== "text/csv" || !["utf-8", "windows-1252"].includes(d.encoding) || ![",", ";", "	"].includes(d.delimiter) || !Number.isSafeInteger(d.headerRow) || d.headerRow < 1 || !Number.isSafeInteger(d.dataRows) || d.dataRows < 0) return invalid8();
-  } else if (d.kind === "pdf") {
-    if (f.mediaType !== "application/pdf" || Object.keys(d).some((key) => !["kind", "pages"].includes(key)) || "pages" in d && (!Number.isSafeInteger(d.pages) || d.pages < 1)) return invalid8();
-  } else return invalid8();
-  for (let [name, descriptor] of Object.entries(f.enrichments)) {
-    if (!safeEnrichmentName(name)) return invalid8();
-    parseEnrichmentDescriptor(descriptor);
-  }
-  return new TextEncoder().encode(JSON.stringify(f)).byteLength > 16 * 1024 ? invalid8() : f;
-}
-function parseEnrichmentDescriptor(value) {
-  let invalid8 = () => {
-    throw new FileOperationError("unavailable", 503, !0);
-  };
-  if (!value || typeof value != "object" || Array.isArray(value)) return invalid8();
-  let d = value;
-  return Object.keys(d).sort().join(",") !== "mediaType,sha256,size" || !["application/octet-stream", "text/plain", "text/markdown", "application/json"].includes(d.mediaType) || !Number.isSafeInteger(d.size) || d.size < 0 || d.size > 16 * 1024 * 1024 || typeof d.sha256 != "string" || !/^[0-9a-f]{64}$/.test(d.sha256) ? invalid8() : d;
-}
-function safeEnrichmentName(value) {
-  return safeFileName(value) && !/^original(?:\.|$)/i.test(value);
-}
-function parseFileEnrichMetadata(value, maxBytes) {
-  let invalid8 = () => {
-    throw new FileOperationError("invalid_input", 400);
-  };
-  if (!value || typeof value != "object" || Array.isArray(value)) return invalid8();
-  let d = value;
-  if (Object.keys(d).some((key) => !["name", "size", "mediaType", "replace"].includes(key)) || !safeEnrichmentName(d.name) || !Number.isSafeInteger(d.size) || d.size < 0 || d.mediaType !== void 0 && (typeof d.mediaType != "string" || d.mediaType.length > 255 || /[\u0000-\u001f\u007f]/.test(d.mediaType)) || d.replace !== void 0 && (typeof d.replace != "string" || !/^[0-9a-f]{64}$/.test(d.replace))) return invalid8();
-  if (d.size > maxBytes) throw new FileOperationError("request_too_large", 413);
-  return d;
-}
-function safeFileName(value) {
-  return typeof value == "string" && value.length > 0 && value.length <= 255 && value === value.trim() && value !== "." && value !== ".." && !/[\u0000-\u001f\u007f-\u009f/\\:*?"<>|]/u.test(value) && !/[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/.test(value) && !/[. ]$/.test(value) && !/^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(value);
-}
-function safeFilePath(value) {
-  return typeof value == "string" && value.length <= 1024 && value.split("/").every(safeFileName);
-}
-function safeManagedFilePath(value) {
-  return safeFilePath(value) && value.split("/")[0].toLowerCase() !== ".os";
-}
-var ORIGINAL_MEDIA_TYPES = ["application/pdf", "text/plain", "text/markdown", "application/json", "image/png", "image/jpeg"];
-function declaredOriginalMediaType(value) {
-  let normalized = value.split(";", 1)[0].trim().toLowerCase();
-  return ORIGINAL_MEDIA_TYPES.includes(normalized) ? normalized : void 0;
-}
-function parseFileCreateMetadata(value, maxBytes) {
-  let invalid8 = () => {
-    throw new FileOperationError("invalid_input", 400);
-  };
-  if (!value || typeof value != "object" || Array.isArray(value)) return invalid8();
-  let input = value;
-  if (Object.keys(input).some((key) => !["name", "path", "storage", "csv", "inputMediaType", "size", "requestKey"].includes(key))) return invalid8();
-  let path = input.path === void 0 ? "Files" : input.path;
-  if (!safeFileName(input.name) || !safeManagedFilePath(path) || input.storage !== void 0 && input.storage !== "remote" && input.storage !== "local" || input.inputMediaType !== void 0 && (typeof input.inputMediaType != "string" || !ORIGINAL_MEDIA_TYPES.includes(input.inputMediaType)) || !Number.isSafeInteger(input.size) || input.size < 0) return invalid8();
-  if (input.size > maxBytes) throw new FileOperationError("request_too_large", 413);
-  if (typeof input.requestKey != "string" || input.requestKey.length < 1 || input.requestKey.length > 256 || input.requestKey !== input.requestKey.trim() || /[\u0000-\u001f\u007f]/.test(input.requestKey)) return invalid8();
-  let csv;
-  if (input.csv !== void 0) {
-    if (!input.csv || typeof input.csv != "object" || Array.isArray(input.csv)) return invalid8();
-    let hints = input.csv;
-    if (Object.keys(hints).some((key) => !["encoding", "delimiter", "headerRow"].includes(key))) return invalid8();
-    let encoding = hints.encoding === void 0 ? "utf-8" : hints.encoding, delimiter = hints.delimiter === void 0 ? "," : hints.delimiter, headerRow = hints.headerRow === void 0 ? 1 : hints.headerRow;
-    if (encoding !== "utf-8" && encoding !== "windows-1252" || ![",", ";", "	"].includes(delimiter) || !Number.isSafeInteger(headerRow) || headerRow < 1 || headerRow > 1e5) return invalid8();
-    csv = { encoding, delimiter, headerRow };
-  }
-  return {
-    name: input.name,
-    path,
-    ...input.storage ? { storage: input.storage } : {},
-    ...input.inputMediaType === void 0 ? {} : { inputMediaType: input.inputMediaType },
-    ...csv ? { csv } : {},
-    size: input.size,
-    requestKey: input.requestKey
-  };
-}
-
 var AppRoutineContractError = class extends Error {
   constructor(code) {
     super(code);
@@ -897,7 +909,10 @@ async function executeRoutineDefinition(definition, input, runtime) {
     get(_target, key) {
       return guarded(Reflect.get(value, key, value), value);
     }
-  }) : value, qualify = (value) => value.questions === void 0 ? value : { ...value, questions: value.questions.map((question2) => question2.handler ? contract.responses.some((handler) => handler.id === question2.handler.id) ? { ...question2, handler: { ...question2.handler, id: `${contract.id}/${question2.handler.id}` } } : invalid3() : question2) }, os2 = Object.freeze({
+  }) : value, validateHandlers = (value) => {
+    for (let question2 of value.questions ?? []) if (question2.handler && !contract.responses.some((handler) => handler.id === question2.handler.id)) return invalid3();
+    return value;
+  }, os2 = Object.freeze({
     ...guarded({
       ...runtime,
       run: freezeRoutineMetadata({ ...runtime.run }),
@@ -911,7 +926,7 @@ async function executeRoutineDefinition(definition, input, runtime) {
         if (!active2 || broken) throw new Error("Run authority ended");
         return value;
       } },
-      inbox: { ...runtime.inbox, publishAsk: (value, options) => runtime.inbox.publishAsk(qualify(value), options) }
+      inbox: { ...runtime.inbox, publishAsk: (value, options) => runtime.inbox.publishAsk(validateHandlers(value), options) }
     }),
     step(id3, ...input2) {
       let saved;
@@ -3268,7 +3283,7 @@ function createBrowserAuth(runtime) {
     }
     c.session = session;
     let email = typeof session.user.email == "string" ? session.user.email.trim() : "", metadata = session.user.user_metadata, name = ["name", "full_name", "first_name"].map((key) => metadata?.[key]).find((value) => typeof value == "string" && value.trim())?.trim() || email, account = !replaced && c.state.account?.email === email && c.state.account.displayName === name ? c.state.account : Object.freeze({ email, displayName: name });
-    publish(c, { status: "signed_in", account, ...pending ? { pending } : {} }), notify(c, event);
+    notify(c, event), publish(c, { status: "signed_in", account, ...pending ? { pending } : {} });
     let checkExpiry = () => {
       if (!c.active || !c.session) return;
       let remaining = c.session.expires_at * 1e3 - Date.now();