@peers-app/peers-sdk 0.25.17 → 0.25.19

package/dist/invites/invite-messages.d.ts

@@ -1704,16 +1704,16 @@ export declare const inviteEnvelopeSchema: z.ZodObject<{
         fromPublicKey: string;
     }>;
 }, "strict", z.ZodTypeAny, {
-    v: 1;
     to: string;
+    v: 1;
     box: {
         nonce: string;
         contents: string;
         fromPublicKey: string;
     };
 }, {
-    v: 1;
     to: string;
+    v: 1;
     box: {
         nonce: string;
         contents: string;

package/dist/package-loader/host-authority-loading.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/package-loader/host-authority-loading.test.js

@@ -0,0 +1,87 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const index_1 = require("../index");
+test("host-backed package endpoints honor declared propagation and reread live metadata", async () => {
+    const packageId = (0, index_1.newid)();
+    const contractId = (0, index_1.newid)();
+    const userId = (0, index_1.newid)();
+    const groupId = (0, index_1.newid)();
+    const dataContext = {
+        dataContextId: groupId,
+        groupId,
+        tableContainer: {
+            getTable: (meta) => meta.name === "Groups"
+                ? { get: async () => ({ founderUserId: (0, index_1.newid)() }) }
+                : { findOne: async () => ({ userId, role: index_1.GroupMemberRole.Admin }) },
+        },
+    };
+    Object.assign(dataContext, {
+        userContext: {
+            userId,
+            deviceId: () => (0, index_1.newid)(),
+            loadingPromise: Promise.resolve(),
+            userDataContext: dataContext,
+            getDataContext: () => dataContext,
+        },
+    });
+    const loader = new index_1.PackageLoader(dataContext);
+    const make = (name, level, fn) => ({
+        tool: {
+            toolId: (0, index_1.newid)(),
+            name,
+            accessLevel: level,
+            code: "",
+            usageDescription: name,
+            inputSchema: { type: index_1.IOSchemaType.simple, fields: [] },
+            outputSchema: { type: index_1.IOSchemaType.simple, fields: [] },
+        },
+        toolFn: fn,
+    });
+    const route = make("route", 20, (_, ctx) => ctx.dispatchAction("act", {}));
+    route.tool.authorityPropagation = "preserve";
+    const effect = jest.fn(() => "admin target");
+    (0, index_1.registerContractResolver)(contractId, 1, () => ({
+        contractId,
+        version: 1,
+        tools: { route },
+        actionAliases: { act: "target" },
+        actionTools: { target: make("target", 60, effect) },
+    }), { providerPackageId: packageId });
+    loader.contractRegistry.register(packageId, {
+        contractId,
+        version: 1,
+        name: "Arbitrary",
+        description: "",
+        tools: [{ name: "route", usageDescription: "route", inputFields: [], outputFields: [] }],
+        tables: [],
+        observables: [],
+        events: [],
+    });
+    const endpoint = await loader.resolveContractEndpoint({
+        contractId,
+        version: 1,
+        providerPackageId: packageId,
+        context: { callerUserId: userId, dataContext },
+        notify: async () => undefined,
+    });
+    const call = {
+        contractId,
+        version: 1,
+        member: "tool",
+        name: "route",
+        operation: "run",
+        args: [{}],
+        dataContextId: groupId,
+    };
+    try {
+        await expect(endpoint.handleCall(call)).resolves.toBe("admin target");
+        // Metadata is read on every call: an ordinary Reader wrapper caps the Admin at Reader.
+        route.tool.authorityPropagation = "cap";
+        await expect(endpoint.handleCall(call)).rejects.toThrow("strict delegation");
+        expect(effect).toHaveBeenCalledTimes(1);
+    }
+    finally {
+        endpoint.dispose();
+        await loader.dispose();
+    }
+});

package/dist/package-loader/host-dispatch-policy.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/package-loader/host-dispatch-policy.test.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const index_1 = require("../index");
+it("host dispatch honors preferred providers, missing-provider policy, and owner pinning", async () => {
+    const dataContext = { dataContextId: (0, index_1.newid)() };
+    const loader = new index_1.PackageLoader(dataContext);
+    const caller = (0, index_1.newid)();
+    const preferred = (0, index_1.newid)();
+    const alternate = (0, index_1.newid)();
+    const contractId = (0, index_1.newid)();
+    const definition = {
+        contractId,
+        version: 1,
+        name: "Target",
+        description: "",
+        tables: [],
+        events: [],
+        observables: [],
+        tools: [{ name: "target", usageDescription: "", inputFields: [], outputFields: [] }],
+    };
+    loader.contractRegistry.register(alternate, definition);
+    loader.contractRegistry.register(preferred, definition);
+    loader.hostConsumes.set(caller, [
+        { contractId, version: 1, providerPackageIds: [preferred], fallbackToDefaultProvider: false },
+    ]);
+    const resolve = jest
+        .spyOn(loader, "resolveContractEndpoint")
+        .mockImplementation(async (request) => ({ handleCall: async () => request.providerPackageId, dispose: () => undefined }));
+    const context = {
+        dataContext,
+        callerUserId: (0, index_1.newid)(),
+        authority: {
+            userId: (0, index_1.newid)(),
+            userAccessLevel: 60,
+            assistantAccessLevel: 40,
+            strictActionScope: true,
+        },
+    };
+    const dispatch = (providerPackageId) => loader.dispatchToolFromProvider(caller, { contractId, version: 1, toolName: "target", providerPackageId }, {}, context);
+    try {
+        await expect(dispatch()).resolves.toBe(preferred);
+        await expect(dispatch(alternate)).rejects.toThrow("Provider substitution");
+        loader.contractRegistry.unregister(preferred);
+        await expect(dispatch()).rejects.toThrow("No declared contract provider");
+        loader.hostConsumes.get(caller)[0].fallbackToDefaultProvider = true;
+        await expect(dispatch()).resolves.toBe(alternate);
+        loader.contractRegistry.register(caller, definition);
+        loader.hostConsumes.delete(caller);
+        await expect(dispatch(alternate)).rejects.toThrow("Provider substitution");
+        await expect(dispatch()).resolves.toBe(caller);
+        expect(resolve).toHaveBeenCalledTimes(3);
+    }
+    finally {
+        await loader.dispose();
+    }
+});

package/dist/package-loader/index.d.ts

@@ -4,3 +4,4 @@ export * from "./isolated-persistent-var-gateway";
 export * from "./isolated-runtime";
 export * from "./isolated-table-gateway";
 export * from "./package-loader";
+export * from "./package-network-policy";

package/dist/package-loader/index.js

@@ -20,3 +20,4 @@ __exportStar(require("./isolated-persistent-var-gateway"), exports);
 __exportStar(require("./isolated-runtime"), exports);
 __exportStar(require("./isolated-table-gateway"), exports);
 __exportStar(require("./package-loader"), exports);
+__exportStar(require("./package-network-policy"), exports);

package/dist/package-loader/isolated-artifact.d.ts

@@ -22,7 +22,8 @@ export interface IIsolatedContractToolRef {
  *
  * Shape matches {@link IContractTool}. `suggestedAccessLevel` is the default
  * effective level until install-time approval exists and calls `approveTool`.
- * Omit it to keep the fail-closed Self default.
+ * Omitted admission is None (0) for a preservation request, otherwise fail-closed Self (100).
+ * Operator approval changes propagation, never admission.
  */
 export interface IIsolatedContractTool extends Omit<IContractTool, "inputFields" | "outputFields"> {
     /** Defaults to `[]` during validation when omitted. */
@@ -33,9 +34,48 @@ export interface IIsolatedContractTool extends Omit<IContractTool, "inputFields"
      * Default effective access level for this tool.
      *
      * Used until an administrator explicitly approves the tool at install time.
-     * Omit to keep the fail-closed Self default.
+     * Omit for None (0) when requesting preservation; other tools default to Self (100).
      */
     suggestedAccessLevel?: number;
+    /** Declared outgoing authority mode; `preserve` omits this tool's own level from strict narrowing. */
+    authorityPropagation?: "cap" | "preserve";
+    /** Checked package-internal target, omitted from the public contract definition. */
+    private?: boolean;
+    /**
+     * Per-invoke deadline in milliseconds for this tool.
+     *
+     * When omitted, the runtime's `invokeTimeoutMs` applies. Capped at
+     * {@link ISOLATED_TOOL_TIMEOUT_MAX_MS}. Host calls made during the invoke,
+     * including System HTTP, count against this deadline.
+     */
+    timeoutMs?: number;
+}
+/** Longest per-tool invoke deadline an isolated manifest may declare. */
+export declare const ISOLATED_TOOL_TIMEOUT_MAX_MS = 120000;
+/**
+ * Secret the host may attach to an outbound request.
+ *
+ * The guest passes `ref`. The host reads `secretVar` and sets `header`.
+ */
+export interface IIsolatedPackageNetworkCredential {
+    ref: string;
+    /** Logical persistent-variable name. The host prefixes it with the package id. */
+    secretVar: string;
+    /** Defaults to `user` when omitted. */
+    scope?: "user" | "device";
+    header: string;
+    /** Must contain the literal `{secret}`. */
+    format: string;
+}
+/**
+ * Outbound HTTPS this package is allowed to perform through System HTTP.
+ *
+ * Honored at install the same way `suggestedAccessLevel` is: there is no
+ * separate approval step yet. The Packages screen displays the declaration.
+ */
+export interface IIsolatedPackageNetwork {
+    allowedHosts: string[];
+    credentials?: IIsolatedPackageNetworkCredential[];
 }
 /**
  * Private table schema declared by an isolated package.
@@ -101,6 +141,11 @@ export interface IIsolatedConsumedContract {
     providerPackageIds?: string[];
     fallbackToDefaultProvider?: boolean;
 }
+/** Package-owned catalog selector bound to a registered canonical action. */
+export interface IIsolatedActionAlias {
+    name: string;
+    target: IIsolatedContractToolRef;
+}
 /**
  * Pure-data package description. Validated on the host; never executed there.
  */
@@ -111,7 +156,11 @@ export interface IIsolatedPackageManifest {
     consumes: IIsolatedConsumedContract[];
     /** Package-owned table schemas. Contract references decide public exposure. */
     tables?: IIsolatedPackageTable[];
+    /** Host allowlist and credential refs for System HTTP. Omit to deny outbound HTTP. */
+    network?: IIsolatedPackageNetwork;
     appNavs?: IAppNav[];
+    /** Private checked targets, independent of the frozen Voice Skill catalog. */
+    actionAliases?: IIsolatedActionAlias[];
 }
 /**
  * Installable isolated package: declarative manifest plus provider source
@@ -144,6 +193,8 @@ export interface IIsolatedInstalledPackage {
     tables: IIsolatedPackageTable[];
     definitions: IContractDefinition[];
     appNavs?: IAppNav[];
+    /** Private checked targets, independent of the frozen Voice Skill catalog. */
+    actionAliases?: IIsolatedActionAlias[];
 }
 /** Host-contract member guests use to request a consumed-contract tool call. */
 export declare const ISOLATED_CONSUME_HOST_MEMBER = "contract.consume";

package/dist/package-loader/isolated-artifact.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ISOLATED_EVENT_HOST_MEMBER = exports.ISOLATED_PERSISTENT_VAR_HOST_MEMBER = exports.ISOLATED_TABLE_HOST_MEMBER = exports.ISOLATED_CONSUME_HOST_MEMBER = exports.ISOLATED_PACKAGE_MAGIC = void 0;
+exports.ISOLATED_EVENT_HOST_MEMBER = exports.ISOLATED_PERSISTENT_VAR_HOST_MEMBER = exports.ISOLATED_TABLE_HOST_MEMBER = exports.ISOLATED_CONSUME_HOST_MEMBER = exports.ISOLATED_TOOL_TIMEOUT_MAX_MS = exports.ISOLATED_PACKAGE_MAGIC = void 0;
 exports.looksLikeIsolatedPackageArtifact = looksLikeIsolatedPackageArtifact;
 exports.validateIsolatedPackageArtifact = validateIsolatedPackageArtifact;
 exports.parseIsolatedPackageArtifact = parseIsolatedPackageArtifact;
@@ -25,6 +25,8 @@ const utils_1 = require("../utils");
  * opt-in format without evaluating source.
  */
 exports.ISOLATED_PACKAGE_MAGIC = "PEERS_ISOLATED_PACKAGE_V1";
+/** Longest per-tool invoke deadline an isolated manifest may declare. */
+exports.ISOLATED_TOOL_TIMEOUT_MAX_MS = 120_000;
 /** Host-contract member guests use to request a consumed-contract tool call. */
 exports.ISOLATED_CONSUME_HOST_MEMBER = "contract.consume";
 /** Host-contract member guests use to read or write a package-owned table. */
@@ -239,7 +241,10 @@ function validateProvidedContract(contract, index, packageTables) {
             "inputFields",
             "outputFields",
             "suggestedAccessLevel",
+            "authorityPropagation",
+            "private",
             "remoteAccessLevel",
+            "timeoutMs",
         ], toolLabel);
         if (typeof tool.name !== "string" || tool.name.trim() === "") {
             throw new Error(`${toolLabel}.name is required`);
@@ -253,6 +258,12 @@ function validateProvidedContract(contract, index, packageTables) {
         }
         tool.inputFields = validateFields(tool.inputFields, `${toolLabel}.inputFields`);
         tool.outputFields = validateFields(tool.outputFields, `${toolLabel}.outputFields`);
+        if (tool.authorityPropagation !== undefined &&
+            tool.authorityPropagation !== "cap" &&
+            tool.authorityPropagation !== "preserve")
+            throw new Error(`${toolLabel}.authorityPropagation must be cap or preserve`);
+        if (tool.private !== undefined && typeof tool.private !== "boolean")
+            throw new Error(`${toolLabel}.private must be a boolean`);
         if (tool.suggestedAccessLevel !== undefined) {
             if (!Number.isInteger(tool.suggestedAccessLevel) ||
                 tool.suggestedAccessLevel < access_level_1.MIN_ACCESS_LEVEL ||
@@ -267,6 +278,13 @@ function validateProvidedContract(contract, index, packageTables) {
                 throw new Error(`${toolLabel}.remoteAccessLevel must be an integer 0–100`);
             }
         }
+        if (tool.timeoutMs !== undefined) {
+            if (!Number.isInteger(tool.timeoutMs) ||
+                tool.timeoutMs < 1 ||
+                tool.timeoutMs > exports.ISOLATED_TOOL_TIMEOUT_MAX_MS) {
+                throw new Error(`${toolLabel}.timeoutMs must be an integer from 1 to ${exports.ISOLATED_TOOL_TIMEOUT_MAX_MS}`);
+            }
+        }
     }
     if (contract.tables === undefined) {
         contract.tables = [];
@@ -430,6 +448,72 @@ function validateConsumedContract(dep, index) {
         }
     }
 }
+const NETWORK_HOST_PATTERN = /^(?=.{1,253}$)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/;
+const NETWORK_REF_PATTERN = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
+const NETWORK_HEADER_PATTERN = /^[A-Za-z0-9-]{1,64}$/;
+const NETWORK_SECRET_VAR_PATTERN = /^[A-Za-z][A-Za-z0-9_:-]{0,80}$/;
+function validatePackageNetwork(manifest) {
+    if (manifest.network === undefined) {
+        return;
+    }
+    const network = manifest.network;
+    if (!network || typeof network !== "object" || Array.isArray(network)) {
+        throw new Error("manifest.network must be an object");
+    }
+    assertOnlyKeys(network, ["allowedHosts", "credentials"], "manifest.network");
+    if (!Array.isArray(network.allowedHosts) || network.allowedHosts.length === 0) {
+        throw new Error("manifest.network.allowedHosts must be a non-empty array");
+    }
+    const hosts = new Set();
+    for (const [index, host] of network.allowedHosts.entries()) {
+        if (typeof host !== "string" || !NETWORK_HOST_PATTERN.test(host)) {
+            throw new Error(`manifest.network.allowedHosts[${index}] must be a lowercase hostname with no scheme, port, or path`);
+        }
+        if (host.split(".").every((label) => /^\d+$/.test(label))) {
+            throw new Error(`manifest.network.allowedHosts[${index}] must be a hostname, not an IP address`);
+        }
+        if (hosts.has(host)) {
+            throw new Error(`manifest.network declares duplicate host "${host}"`);
+        }
+        hosts.add(host);
+    }
+    if (network.credentials === undefined) {
+        network.credentials = [];
+    }
+    if (!Array.isArray(network.credentials)) {
+        throw new Error("manifest.network.credentials must be an array");
+    }
+    const refs = new Set();
+    for (const [index, credential] of network.credentials.entries()) {
+        const label = `manifest.network.credentials[${index}]`;
+        if (!credential || typeof credential !== "object" || Array.isArray(credential)) {
+            throw new Error(`${label} must be an object`);
+        }
+        assertOnlyKeys(credential, ["ref", "secretVar", "scope", "header", "format"], label);
+        if (typeof credential.ref !== "string" || !NETWORK_REF_PATTERN.test(credential.ref)) {
+            throw new Error(`${label}.ref must be a short identifier`);
+        }
+        if (refs.has(credential.ref)) {
+            throw new Error(`manifest.network declares duplicate credential ref "${credential.ref}"`);
+        }
+        refs.add(credential.ref);
+        if (typeof credential.secretVar !== "string" ||
+            !NETWORK_SECRET_VAR_PATTERN.test(credential.secretVar)) {
+            throw new Error(`${label}.secretVar must be a logical persistent-variable name`);
+        }
+        if (credential.scope !== undefined &&
+            credential.scope !== "user" &&
+            credential.scope !== "device") {
+            throw new Error(`${label}.scope must be "user" or "device"`);
+        }
+        if (typeof credential.header !== "string" || !NETWORK_HEADER_PATTERN.test(credential.header)) {
+            throw new Error(`${label}.header must be an HTTP header name`);
+        }
+        if (typeof credential.format !== "string" || !credential.format.includes("{secret}")) {
+            throw new Error(`${label}.format must contain {secret}`);
+        }
+    }
+}
 function validateAppNavs(appNavs) {
     if (appNavs === undefined) {
         return undefined;
@@ -494,7 +578,16 @@ function validateIsolatedPackageArtifact(artifact) {
     if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) {
         throw new Error("Package artifact.manifest is required");
     }
-    assertOnlyKeys(manifest, ["packageId", "version", "provides", "consumes", "tables", "appNavs"], "manifest");
+    assertOnlyKeys(manifest, [
+        "packageId",
+        "version",
+        "provides",
+        "consumes",
+        "tables",
+        "network",
+        "appNavs",
+        "actionAliases",
+    ], "manifest");
     if (typeof providerSource !== "string" || providerSource.trim() === "") {
         throw new Error("Package artifact.providerSource must be a non-empty string");
     }
@@ -522,7 +615,24 @@ function validateIsolatedPackageArtifact(artifact) {
     for (const [index, dep] of manifest.consumes.entries()) {
         validateConsumedContract(dep, index);
     }
+    if (manifest.actionAliases !== undefined) {
+        if (!Array.isArray(manifest.actionAliases))
+            throw new Error("actionAliases must be an array");
+        const names = new Set();
+        for (const alias of manifest.actionAliases) {
+            if (!alias || typeof alias.name !== "string" || !alias.name || names.has(alias.name)) {
+                throw new Error("Invalid or duplicate action alias");
+            }
+            names.add(alias.name);
+            const target = alias.target;
+            if (!target ||
+                !packageProvidesTool(manifest.provides, target.contractId, target.version, target.toolName)) {
+                throw new Error(`Action alias ${alias.name} has no registered target`);
+            }
+        }
+    }
     manifest.appNavs = validateAppNavs(manifest.appNavs);
+    validatePackageNetwork(manifest);
     return manifest;
 }
 /**
@@ -573,12 +683,16 @@ function serializeIsolatedPackageArtifact(artifact) {
  * @param packageTables - Package-owned schemas available for contract exposure.
  */
 function isolatedContractToDefinition(contract, packageTables) {
-    const tools = contract.tools.map((tool) => ({
+    const tools = contract.tools
+        .filter((tool) => !tool.private)
+        .map((tool) => ({
         name: tool.name,
         usageDescription: tool.usageDescription,
         inputFields: tool.inputFields ?? [],
         outputFields: tool.outputFields ?? [],
-        ...(tool.remoteAccessLevel !== undefined ? { remoteAccessLevel: tool.remoteAccessLevel } : {}),
+        ...(tool.remoteAccessLevel !== undefined
+            ? { remoteAccessLevel: tool.remoteAccessLevel }
+            : {}),
     }));
     const tables = (contract.tables ?? []).map((tableRef) => {
         const table = findPackageTable(packageTables, tableRef.name);

package/dist/package-loader/isolated-artifact.test.js

@@ -40,6 +40,16 @@ function makeArtifact(overrides = {}) {
     };
 }
 describe("isolated package artifact", () => {
+    test("round-trips a generic authority request and rejects unknown modes", () => {
+        const { artifact } = makeArtifact();
+        const tool = artifact.manifest.provides[0].tools[0];
+        tool.authorityPropagation = "preserve";
+        expect(() => (0, isolated_artifact_1.serializeIsolatedPackageArtifact)(artifact)).not.toThrow();
+        expect((0, isolated_artifact_1.parseIsolatedPackageArtifact)((0, isolated_artifact_1.serializeIsolatedPackageArtifact)(artifact)).manifest.provides[0]
+            .tools[0]).toMatchObject({ authorityPropagation: "preserve" });
+        tool.authorityPropagation = "elevate";
+        expect(() => (0, isolated_artifact_1.validateIsolatedPackageArtifact)(artifact)).toThrow(/authorityPropagation/);
+    });
     test("serializes and parses a valid envelope", () => {
         const { artifact, contractId } = makeArtifact();
         const bundle = (0, isolated_artifact_1.serializeIsolatedPackageArtifact)(artifact);
@@ -62,6 +72,34 @@ describe("isolated package artifact", () => {
         const manifest = (0, isolated_artifact_1.validateIsolatedPackageArtifact)(artifact);
         expect(manifest.tables).toEqual([]);
     });
+    test("validates private action aliases without extending the public contract", () => {
+        const { artifact, contractId } = makeArtifact();
+        artifact.manifest.provides[0].tools.push({
+            name: "private-write",
+            usageDescription: "Internal write",
+            private: true,
+            suggestedAccessLevel: access_level_1.AccessLevel.Writer,
+        });
+        artifact.manifest.actionAliases = [
+            {
+                name: "write",
+                target: { contractId, version: 1, toolName: "private-write" },
+            },
+        ];
+        const validated = (0, isolated_artifact_1.validateIsolatedPackageArtifact)(artifact);
+        expect((0, isolated_artifact_1.isolatedContractToDefinition)(validated.provides[0], []).tools.map((tool) => tool.name)).toEqual(["greet"]);
+        expect((0, isolated_artifact_1.parseIsolatedPackageArtifact)((0, isolated_artifact_1.serializeIsolatedPackageArtifact)(artifact)).manifest
+            .actionAliases).toEqual(artifact.manifest.actionAliases);
+        artifact.manifest.actionAliases.push(artifact.manifest.actionAliases[0]);
+        expect(() => (0, isolated_artifact_1.validateIsolatedPackageArtifact)(artifact)).toThrow("duplicate action alias");
+        artifact.manifest.actionAliases = [
+            {
+                name: "write",
+                target: { contractId, version: 1, toolName: "missing" },
+            },
+        ];
+        expect(() => (0, isolated_artifact_1.validateIsolatedPackageArtifact)(artifact)).toThrow("no registered target");
+    });
     test("accepts a package-private table without adding it to the contract definition", () => {
         const { artifact } = makeArtifact();
         artifact.manifest.tables = [
@@ -315,4 +353,29 @@ describe("isolated package artifact", () => {
         };
         expect(() => (0, isolated_artifact_1.validateIsolatedPackageArtifact)(artifact)).toThrow(/JSON-compatible/);
     });
+    test("accepts a network allowlist and rejects a host with a scheme", () => {
+        const { artifact } = makeArtifact();
+        artifact.manifest.network = {
+            allowedHosts: ["api.openai.com"],
+            credentials: [
+                {
+                    ref: "openai",
+                    secretVar: "openaiApiKey",
+                    header: "Authorization",
+                    format: "Bearer {secret}",
+                },
+            ],
+        };
+        const manifest = (0, isolated_artifact_1.validateIsolatedPackageArtifact)(artifact);
+        expect(manifest.network?.allowedHosts).toEqual(["api.openai.com"]);
+        artifact.manifest.network = { allowedHosts: ["https://api.openai.com"] };
+        expect(() => (0, isolated_artifact_1.validateIsolatedPackageArtifact)(artifact)).toThrow(/lowercase hostname/);
+        artifact.manifest.network = { allowedHosts: ["127.0.0.1"] };
+        expect(() => (0, isolated_artifact_1.validateIsolatedPackageArtifact)(artifact)).toThrow(/hostname, not an IP address/);
+    });
+    test("rejects a tool timeout above the cap", () => {
+        const { artifact } = makeArtifact();
+        artifact.manifest.provides[0].tools[0].timeoutMs = 120_001;
+        expect(() => (0, isolated_artifact_1.validateIsolatedPackageArtifact)(artifact)).toThrow(/timeoutMs/);
+    });
 });

package/dist/package-loader/isolated-persistent-var-gateway.js

@@ -7,6 +7,19 @@ const isolated_value_1 = require("./isolated-value");
 function memoryKey(ref) {
     return `${ref.packageId}:${ref.scope}:${ref.name}`;
 }
+async function assertPackagePersistentVarIsNotSecret(dataContext, ref) {
+    const userContext = dataContext.userContext;
+    if (!userContext) {
+        throw new Error("Package persistent variables require a signed-in user");
+    }
+    const storageContext = ref.scope === "group" ? dataContext : userContext.userDataContext;
+    const storageName = (0, persistent_var_identity_1.packageScopedPersistentVarStorageName)(ref.packageId, ref.name, ref.scope, dataContext.dataContextId);
+    const { PersistentVars } = await Promise.resolve().then(() => require("../data/persistent-vars"));
+    const record = await PersistentVars(storageContext).findOne({ name: storageName });
+    if (record?.isSecret) {
+        throw new Error("Secret persistent variables are not readable by packages");
+    }
+}
 async function resolvePersistentVar(dataContext, ref) {
     const { deviceVar, groupDeviceVar, groupUserVar, groupVar, userVar } = await Promise.resolve().then(() => require("../data/persistent-vars"));
     const name = (0, persistent_var_identity_1.packageScopedPersistentVarName)(ref.packageId, ref.name);
@@ -77,8 +90,10 @@ function createMemoryIsolatedPackagePersistentVarGateway() {
 function createIsolatedPackagePersistentVarGateway(dataContext) {
     return {
         async get(ref) {
+            await assertPackagePersistentVarIsNotSecret(dataContext, ref);
             const persistentVar = await resolvePersistentVar(dataContext, ref);
             await persistentVar.loadingPromise;
+            await assertPackagePersistentVarIsNotSecret(dataContext, ref);
             const value = persistentVar();
             return value === undefined ? undefined : (0, isolated_value_1.copyIsolatedValue)(value);
         },
@@ -86,17 +101,21 @@ function createIsolatedPackagePersistentVarGateway(dataContext) {
             if (value === undefined) {
                 throw new Error("Persistent variable value must be copyable");
             }
+            await assertPackagePersistentVarIsNotSecret(dataContext, ref);
             const persistentVar = await resolvePersistentVar(dataContext, ref);
             const copy = (0, isolated_value_1.copyIsolatedValue)(value);
             await persistentVar.loadingPromise;
+            await assertPackagePersistentVarIsNotSecret(dataContext, ref);
             persistentVar(copy);
             await persistentVar.loadingPromise;
             const saved = persistentVar();
             return saved === undefined ? undefined : (0, isolated_value_1.copyIsolatedValue)(saved);
         },
         async subscribe(ref, handler) {
+            await assertPackagePersistentVarIsNotSecret(dataContext, ref);
             const persistentVar = await resolvePersistentVar(dataContext, ref);
             await persistentVar.loadingPromise;
+            await assertPackagePersistentVarIsNotSecret(dataContext, ref);
             const subscription = persistentVar.subscribe((value) => {
                 handler((0, isolated_value_1.copyIsolatedValue)(value));
             });