@owlmeans/client-planning 0.1.18-rc.40 → 0.1.18-rc.41

package/README.md

@@ -9,7 +9,7 @@ planning service runs in-process.
 ## Installation
 
 ```bash
-bun add @owlmeans/client-planning@^0.1.18-rc.40
+bun add @owlmeans/client-planning@^0.1.18-rc.41
 ```
 
 ## Concepts

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 3,
   "package": "@owlmeans/client-planning",
-  "version": "0.1.18-rc.40",
-  "generatedAt": "2026-10-26T22:23:53.853Z",
+  "version": "0.1.18-rc.41",
+  "generatedAt": "2026-10-27T08:58:03.615Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/client-planning/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/client-planning
 
 **Layer:** Client
-**Install:** `"@owlmeans/client-planning": "^0.1.18-rc.40"` in `dependencies`
+**Install:** `"@owlmeans/client-planning": "^0.1.18-rc.41"` in `dependencies`
 
 The client half of OwlMeans planning. It answers the `PlanningFacade` interface of
 `@owlmeans/planning` over the protocol tree a server mounted with `@owlmeans/server-planning`, keeps

package/agent-meta/skills/client-planning/parts/validation.md

@@ -21,8 +21,12 @@ occurs, and the schema is left unchanged. Preserve nested money objects and cale
 The native server validates every write again.
 
 The validator interprets schemas with `@cfworker/json-schema`, with no `eval`, `new Function` or
-network reference loading. Do not call `makeSchemaRegistry(...).validator()` or
-`.assigneeValidator()` in a browser with strict `script-src`: those remain native AJV compilers.
+network reference loading. Building, loading and merging a registry is safe under a strict
+`script-src` — `loadSchemas()`, `definitions.registry()`/`bundle()`, `model()`, `makeSchemaRegistry(bundle)`,
+`scopedRegistryOf` — because a page runs only the closed-form checks of the served `app` declarations
+(`planning` → types part). Do not call `.validator()`, `.assigneeValidator()`, `appSchemaHelper.assertBag`,
+`scopedSchemaHelper.assert*Schema` or `validateHelper.*` in a browser with strict `script-src`: those
+remain native AJV compilers, the server's.
 The Draft 7 meta-schema is DATA in `src/validation/consts.ts` (`JSON_SCHEMA_DRAFT_07`, pinned to ajv's
 `refs/json-schema-draft-07.json` by `tests/draft7.spec.ts`), never an import of that file: Node ESM needs
 `with { type: 'json' }` on it, and a bundler that also meets ajv's own attribute-less `require` of the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/client-planning",
-  "version": "0.1.18-rc.40",
+  "version": "0.1.18-rc.41",
   "license": "MIT",
   "description": "The client half of OwlMeans planning — the remote planning facade, the state mirror and its commit fold, and the subscribe-then-poll commit wait. React-free: it runs in a browser and in a Node client alike.",
   "type": "module",
@@ -30,7 +30,7 @@
     "@owlmeans/context": "^0.1.18-rc.35",
     "@owlmeans/entrypoint": "^0.1.18-rc.42",
     "@owlmeans/error": "^0.1.18-rc.39",
-    "@owlmeans/planning": "^0.1.18-rc.31",
+    "@owlmeans/planning": "^0.1.18-rc.32",
     "@owlmeans/resource": "^0.1.18-rc.41",
     "@owlmeans/log": "^0.1.18-rc.4",
     "@owlmeans/route": "^0.1.18-rc.36",
@@ -43,7 +43,7 @@
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@owlmeans/server-planning": "^0.1.18-rc.38",
+    "@owlmeans/server-planning": "^0.1.18-rc.39",
     "@owlmeans/test": "^0.1.18-rc.39",
     "@types/bun": "^1.4.2",
     "ajv": "^8.20.0",

package/tests/csp.spec.ts

@@ -0,0 +1,119 @@
+import { afterEach, describe, expect, test } from 'bun:test'
+import { appSchemaHelper, makeSchemaRegistry } from '@owlmeans/planning'
+import type { PlanningAppDeclarations, PlanningService } from '@owlmeans/planning'
+import { makePlanningFieldValidator } from '../src/index.js'
+import { makeSuite, STORY } from './context.js'
+import type { Suite, SuiteOptions } from './context.js'
+
+/** What a browser says when a page's `script-src` lacks `'unsafe-eval'`. */
+const REFUSAL = "Evaluating a string as JavaScript violates the following Content Security Policy directive because 'unsafe-eval' is not an allowed source of script"
+
+/** The work-management seed's declarations: every type and flow may carry a description. */
+const APP: PlanningAppDeclarations = {
+  type: { properties: { description: { type: 'string', maxLength: 2000 } } },
+  flow: { properties: { description: { type: 'string', maxLength: 2000 } } },
+}
+const SERVED = appSchemaHelper.merge([APP])
+
+/**
+ * The CLIENT runs in a browser page under the publisher's policy — a `document`, and every code
+ * generation refused — while the in-process server it calls does not: the suite's transport leaves
+ * the page before the server handler runs (`before`) and re-enters it once the server answered
+ * (`after`). Armed only by a test, so the suite's own set-up runs outside it.
+ */
+const makeStrictPage = () => {
+  const scope = globalThis as unknown as Record<string, unknown>
+  const saved = { Function: scope.Function as FunctionConstructor, eval: scope.eval as typeof eval, error: console.error }
+  const counts = { generated: 0, logged: 0 }
+  const refuse = (): never => {
+    counts.generated++
+    throw new EvalError(REFUSAL)
+  }
+  const refusing = { Function: new Proxy(saved.Function, { construct: refuse, apply: refuse }), eval: new Proxy(saved.eval, { apply: refuse }) }
+  let armed = false
+
+  const enter = (): void => {
+    scope.document = {}
+    scope.Function = refusing.Function
+    scope.eval = refusing.eval
+    console.error = () => { counts.logged++ }
+  }
+  const leave = (): void => {
+    delete scope.document
+    scope.Function = saved.Function
+    scope.eval = saved.eval
+    console.error = saved.error
+  }
+
+  return {
+    counts,
+    arm: () => { armed = true; counts.generated = 0; counts.logged = 0; enter() },
+    disarm: () => { armed = false; leave() },
+    hooks: {
+      before: async () => { if (armed) leave() },
+      after: async () => { if (armed) enter() },
+    } satisfies Pick<SuiteOptions, 'before' | 'after'>,
+  }
+}
+
+const page = makeStrictPage()
+
+/** A seed-like target: the application's declarations registered on the server, as its plugin does. */
+const declared = async (opts: SuiteOptions = {}): Promise<Suite> => {
+  const suite = await makeSuite({ schemas: false, ...opts, ...page.hooks })
+  ;(suite.server as unknown as { planning: () => PlanningService }).planning().use({ name: 'seed', schemas: { app: APP } })
+
+  return suite
+}
+
+afterEach(() => page.disarm())
+
+describe('@owlmeans/client-planning — a page under a strict script-src', () => {
+  test('the served bundle loads, a model resolves and a form validates without generating code', async () => {
+    const suite = await declared()
+    const project = await suite.project('Spring')
+    const story = await suite.story(project.id!, 'Warm-up', { area: 'stage' })
+    const service = suite.client.planning()
+
+    page.arm()
+    const registry = await service.loadSchemas()
+    expect(registry.app()).toEqual(SERVED!)
+    const model = await suite.planning.model(story.id!)
+    expect(model.available().map(rule => rule.name)).toContain('start')
+    const form = makePlanningFieldValidator(registry.fieldsSchema(STORY))
+    expect(form.validateFields({ area: 'stage' }).valid).toBe(true)
+    expect(form.validateFields({ area: 2 }).valid).toBe(false)
+    page.disarm()
+
+    expect(page.counts).toEqual({ generated: 0, logged: 0 })
+  })
+
+  test('an organization layer and a project layer resolve through definitions without generating code', async () => {
+    const suite = await declared({ definitions: true })
+    const project = await suite.project('Spring')
+    const story = await suite.story(project.id!, 'Warm-up', { area: 'stage' })
+    const definitions = suite.planning.definitions!
+
+    page.arm()
+    const layer = await definitions.registry()
+    expect(layer.app()).toEqual(SERVED!)
+    expect((await definitions.bundle()).app).toEqual(SERVED!)
+    expect((await definitions.registry(project.id!)).app()).toEqual(SERVED!)
+    const model = await suite.planning.model(story.id!)
+    expect(model.schema().type).toBe(STORY)
+    page.disarm()
+
+    expect(page.counts).toEqual({ generated: 0, logged: 0 })
+  })
+
+  test('the page really refuses code generation: a native validator cannot be compiled in it', async () => {
+    const suite = await declared()
+    const bundle = (await suite.client.planning().loadSchemas()).bundle()
+
+    page.arm()
+    expect(() => makeSchemaRegistry(bundle).validator(STORY)).toThrow(EvalError)
+    page.disarm()
+
+    expect(page.counts.generated).toBeGreaterThan(0)
+  })
+})