@peers-app/peers-sdk 0.28.3 → 0.28.4

package/dist/contracts/contract-proxy.d.ts

@@ -3,7 +3,7 @@ import type { Table } from "../data/orm/table";
 import type { ITool, IToolInstance } from "../data/tools";
 import type { Event, ISubscriptionResult } from "../events";
 import { type Observable } from "../observable";
-import type { IIsolatedCallPrincipal } from "../package-loader/isolated-runtime";
+import { type IIsolatedCallPrincipal } from "../package-loader/isolated-runtime";
 import type { IWorkflowRunContext } from "../types/workflow-run-context";
 import { type IContractTransport } from "./contract-transport";
 import type { IContractDefinition, IRemoteContractConsumer } from "./types";

package/dist/contracts/contract-proxy.js

@@ -12,6 +12,7 @@ const access_level_1 = require("../data/access-level");
 const group_permissions_1 = require("../data/group-permissions");
 const decorators_1 = require("../data/orm/decorators");
 const observable_1 = require("../observable");
+const isolated_runtime_1 = require("../package-loader/isolated-runtime");
 const utils_1 = require("../utils");
 const action_dispatch_1 = require("./action-dispatch");
 const contract_transport_1 = require("./contract-transport");
@@ -585,7 +586,7 @@ function createContractProvider(resolution, opts = {}) {
                     throw new Error(`Table method '${call.name}.${call.operation}' is not remotely callable`);
                 }
                 (0, decorators_1.checkRemoteTableSaveOptions)(call.operation, call.args);
-                return impl.apply(table, call.args);
+                return impl.apply(table, (0, isolated_runtime_1.isolatedTableArgs)(call.operation, call.args));
             }
             case "tool": {
                 if (call.operation !== "run") {

package/dist/package-loader/isolated-runtime.d.ts

@@ -12,19 +12,33 @@ export declare const ISOLATED_CONTRACT_TABLE_OPERATIONS: readonly ["get", "list"
 export type IsolatedContractTableOperation = (typeof ISOLATED_CONTRACT_TABLE_OPERATIONS)[number];
 /** Options a package may pass with a table `save`. */
 export interface IPackageSaveOptions {
+    /** Seed a new row so any real write wins, even one not yet synced. Has no effect on updates. */
+    weakInsert?: boolean;
+    /** Create if missing; otherwise leave the row untouched and return it. Use with weakInsert for defaults. */
+    insertOnly?: boolean;
+    /** Reset the whole row, replacing even unseen earlier edits from other devices. Later writes still win. */
+    saveAsSnapshot?: boolean;
     /** Save a row whose id was deleted before. Without it, that save is refused. */
     restoreIfDeleted?: boolean;
 }
 /**
- * The save options a package may use, from whatever a caller passed: only `restoreIfDeleted`.
- * The host's other save options (snapshots, weak inserts) stay out of package hands.
- * `writtenAt` must stay host-only even if this allowlist expands: it orders signed rows,
- * and accepting it from a package would let that package backdate writes.
+ * Copy every host save option except `writtenAt`, accepting only values exactly equal to `true`.
+ * `writtenAt` stays host-only: it orders signed rows by their signing time, and accepting it
+ * from a package would let that package backdate writes. Unknown keys are dropped.
  *
  * @param options - A table `save`'s second argument, as received.
  * @returns The allowed options, or `undefined` when none are set.
  */
 export declare function isolatedSaveOptions(options: unknown): IPackageSaveOptions | undefined;
+/**
+ * Limit a package or contract table write to its public arguments. Only `save` accepts
+ * options; `insert` and `update` accept only a row. Other operations keep their arguments.
+ *
+ * @param operation - The table method being called.
+ * @param args - Its arguments, as received across the bridge.
+ * @returns Arguments with save options filtered by {@link isolatedSaveOptions}.
+ */
+export declare function isolatedTableArgs(operation: string, args: unknown[]): unknown[];
 /** One line a package worker wrote to its stdout or stderr. */
 export interface IIsolatedWorkerOutput {
     /** The worker's package. */

package/dist/package-loader/isolated-runtime.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ISOLATED_CONTRACT_TABLE_EVENTS = exports.ISOLATED_CONTRACT_TABLE_OPERATIONS = void 0;
 exports.isolatedSaveOptions = isolatedSaveOptions;
+exports.isolatedTableArgs = isolatedTableArgs;
 exports.setIsolatedPackageRuntimeFactory = setIsolatedPackageRuntimeFactory;
 exports.getIsolatedPackageRuntimeFactory = getIsolatedPackageRuntimeFactory;
 /** Standard table methods exposed through isolated contract-table references. */
@@ -16,18 +17,36 @@ exports.ISOLATED_CONTRACT_TABLE_OPERATIONS = [
     "delete",
 ];
 /**
- * The save options a package may use, from whatever a caller passed: only `restoreIfDeleted`.
- * The host's other save options (snapshots, weak inserts) stay out of package hands.
- * `writtenAt` must stay host-only even if this allowlist expands: it orders signed rows,
- * and accepting it from a package would let that package backdate writes.
+ * Copy every host save option except `writtenAt`, accepting only values exactly equal to `true`.
+ * `writtenAt` stays host-only: it orders signed rows by their signing time, and accepting it
+ * from a package would let that package backdate writes. Unknown keys are dropped.
  *
  * @param options - A table `save`'s second argument, as received.
  * @returns The allowed options, or `undefined` when none are set.
  */
 function isolatedSaveOptions(options) {
-    return options?.restoreIfDeleted === true
-        ? { restoreIfDeleted: true }
-        : undefined;
+    const supplied = options;
+    const allowed = {};
+    for (const key of ["weakInsert", "insertOnly", "saveAsSnapshot", "restoreIfDeleted"]) {
+        if (supplied?.[key] === true)
+            allowed[key] = true;
+    }
+    return Object.keys(allowed).length ? allowed : undefined;
+}
+/**
+ * Limit a package or contract table write to its public arguments. Only `save` accepts
+ * options; `insert` and `update` accept only a row. Other operations keep their arguments.
+ *
+ * @param operation - The table method being called.
+ * @param args - Its arguments, as received across the bridge.
+ * @returns Arguments with save options filtered by {@link isolatedSaveOptions}.
+ */
+function isolatedTableArgs(operation, args) {
+    if (operation === "save") {
+        const options = isolatedSaveOptions(args[1]);
+        return options ? [args[0], options] : args.slice(0, 1);
+    }
+    return operation === "insert" || operation === "update" ? args.slice(0, 1) : args;
 }
 /** Table events consumers may subscribe to on an isolated contract table. */
 exports.ISOLATED_CONTRACT_TABLE_EVENTS = ["dataChanged"];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peers-app/peers-sdk",
-  "version": "0.28.3",
+  "version": "0.28.4",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/peers-app/peers-sdk.git"