@sprigr/apps-app-sdk 0.26.0 → 0.28.0

package/dist/index.d.ts

@@ -493,9 +493,10 @@ declare function readFileRef(env: FileRefEnv, ref: FileRef | null | undefined, o
  * Apps that receive webhooks on their OWN per-install URL (e.g.
  * procore POSTs to `<procore-XXX.staging-apps.sprigr.com>/api/webhook/procore`)
  * don't go through the marketplace runtime dispatcher. Those apps
- * derive the callback URL from the inbound request's `Host` header
- * instead, which is naturally env-correct. This helper is only for
- * the marketplace-dispatcher pattern.
+ * build the callback URL from `publicBaseUrl(env)` below. Never from
+ * the inbound request's `Host` or `X-Forwarded-Host`: a visitor
+ * controls those, and a callback URL built from one hands an outside
+ * host to the provider (sprigr-apps#3453).
  */
 /**
  * Minimal env shape this helper reads. Apps' ShopifyEnv /
@@ -531,6 +532,35 @@ declare function resolvePlatformWebhookBase(env: PlatformHostEnv, override?: str
  * form should pre-translate before calling.
  */
 declare function buildMarketplaceWebhookUrl(env: PlatformHostEnv, installId: string, topicPath: string, override?: string | null): string;
+/** Minimal env shape `publicBaseUrl` reads; pass the full app env. */
+interface PublicBaseUrlEnv {
+    SITE_PUBLIC_BASE_URL?: string;
+}
+/**
+ * This install's own public https origin, as the platform bound it:
+ * the install site's custom domain when one is configured, else its
+ * slug-free `<app>-<tail>.apps.sprigr.com` host (`.staging-apps` on
+ * staging). Never has a trailing slash or a path.
+ *
+ *   const base = publicBaseUrl(env);
+ *   if (!base) return refuse('no_public_base_url');
+ *   const callbackUrl = `${base}/api/public/myapp/webhook/${subKey}`;
+ *
+ * Use it for every URL handed to an outside system: webhook and push
+ * callbacks, links in outbound mail, a provider's "return to" URL.
+ * Do NOT derive one from a request's `Host` / `X-Forwarded-Host` (a
+ * visitor sets those), and do NOT store a request-derived origin for
+ * later use (sprigr-apps#3453). The binding is not tied to the
+ * company slug, so it survives a company rename (sprigr-team#11787).
+ * It does change when a custom domain is added or removed (the
+ * platform rebinds the install), so an app that registered callbacks
+ * should re-check them on its reconcile, not only at connect time.
+ *
+ * Returns `null` when the binding is absent or is not an https URL
+ * (a unit test, a local `sprigr app dev`). Callers should refuse and
+ * say why rather than fall back to a request-derived host.
+ */
+declare function publicBaseUrl(env: PublicBaseUrlEnv): string | null;
 /**
  * Is this URL (or bare hostname) served by a STAGING host?
  *
@@ -1018,7 +1048,12 @@ interface SprigrDataPartialUpdateBody {
     withAcl?: true;
 }
 interface PartialUpdateDataOptions extends SprigrDataPartialUpdateOpts {
-    /** Ceiling on the HTTP fallback. No default: a data write is awaited for its result. */
+    /**
+     * Ceiling on the call, by either transport: the injected member bounds its
+     * own fetch (sprigr/sprigr-team#11950; older wrapper builds ignore it), the
+     * HTTP fallback its request. No default: a data write is awaited for its
+     * result.
+     */
     timeoutMs?: number;
 }
 /**
@@ -1728,9 +1763,14 @@ interface ApprovalPreviewSpec {
     bcc?: ApprovalPreviewSlot;
     subject?: ApprovalPreviewSlot;
     /** Always an argument, never a stated value: the body must be what is sent. */
+    /**
+     * `format: 'auto'` declares that the tool sends the body through
+     * `emailBodyHtml`: the card shows a body with HTML markup as HTML and plain
+     * text as text. A platform that predates 'auto' reads it as 'html'.
+     */
     body?: {
         arg: string;
-        format: 'html' | 'text';
+        format: 'html' | 'text' | 'auto';
     };
     /** Argument holding an array of attachment names or `{ name, size }`. */
     attachments?: string;
@@ -1853,8 +1893,11 @@ interface EmailPreviewInput {
     subject?: ApprovalPreviewSlot;
     /** Argument name of the body. */
     body: string;
-    /** Defaults to 'html'. */
-    bodyFormat?: 'html' | 'text';
+    /**
+     * Defaults to 'html'. Use 'auto' when the tool sends the body through
+     * `emailBodyHtml`, so a plain-text body shows on the card with its lines.
+     */
+    bodyFormat?: 'html' | 'text' | 'auto';
     attachments?: string;
     sendAt?: ApprovalPreviewSlot;
     /** Defaults to ['irreversible']: a sent email cannot be recalled. */
@@ -3083,6 +3126,30 @@ interface CompanyTimezoneEnv {
  */
 declare function getCompanyTimezone(env: CompanyTimezoneEnv | null | undefined): string | undefined;
 
+/**
+ * Email bodies that a mail API always sends as HTML.
+ *
+ * Outlook (Graph `contentType: 'HTML'`) and Gmail (`text/html`) render the body
+ * as HTML, and the agent often writes plain text with line breaks. Rendered as
+ * HTML those breaks collapse, so a three-paragraph email arrives as one run-on
+ * line. `emailBodyHtml` keeps a body that already carries HTML markup exactly
+ * as written, and turns a plain-text body into HTML that shows the same lines:
+ * a blank line starts a new paragraph, a single line break becomes `<br>`, and
+ * `&`, `<`, `>` and `"` are escaped so the text reads as written.
+ *
+ * A tool that sends through this declares `emailPreview({ bodyFormat: 'auto' })`.
+ * The platform's approval card then applies the same test (`hasHtmlMarkup`) and
+ * shows a plain-text body as text, the way it will arrive. Keep the element
+ * list in step with `packages/agent-core/src/approval-preview.ts` in sprigr-team.
+ */
+/** True when the body contains an HTML element tag or a doctype. */
+declare function hasHtmlMarkup(body: string): boolean;
+/**
+ * The body to hand an HTML-only mail API. HTML input is returned unchanged;
+ * plain text becomes paragraphs and line breaks. An empty body stays empty.
+ */
+declare function emailBodyHtml(body: string): string;
+
 /**
  * @sprigr/apps-app-sdk
  *
@@ -3234,8 +3301,24 @@ interface SprigrDataIndexOpts {
     /** LOGICAL index name (a `data_indexes` key). See {@link SprigrDataSearchOpts.index}. */
     index?: string;
 }
+/**
+ * Opt-in bound for one data write (`import`, `partialUpdate`, `delete`),
+ * the same knob `data.search` takes (sprigr/sprigr-team#11950).
+ */
+interface SprigrDataWriteTimeoutOpts {
+    /**
+     * Abort the call after this many ms and throw a named error
+     * (`data_import_timeout`, `data_partial_update_timeout`,
+     * `data_delete_timeout`) whose message names the index. Omit it and the
+     * call is unbounded as before (`import` keeps the platform's 100 s
+     * backstop). The abort is client-side only: the platform call may still
+     * complete, so retry only idempotent writes. Ignored by wrapper builds
+     * older than sprigr/sprigr-team#11950.
+     */
+    timeoutMs?: number;
+}
 /** Options for `env.SPRIGR.data.import`. */
-interface SprigrDataImportOpts extends SprigrDataIndexOpts {
+interface SprigrDataImportOpts extends SprigrDataIndexOpts, SprigrDataWriteTimeoutOpts {
     /**
      * Write to the app's reserved ACL file index
      * (`<companyId>-app-<slug>-acl-files`) instead of its data index. Every
@@ -3250,7 +3333,7 @@ interface SprigrDataImportOpts extends SprigrDataIndexOpts {
     withAcl?: boolean;
 }
 /** Options for `env.SPRIGR.data.partialUpdate`. */
-interface SprigrDataPartialUpdateOpts extends SprigrDataIndexOpts {
+interface SprigrDataPartialUpdateOpts extends SprigrDataIndexOpts, SprigrDataWriteTimeoutOpts {
     /**
      * Create an object that does not exist yet from the patch alone. Default
      * `false`: a patch never creates half an object unless asked, and a
@@ -3390,7 +3473,7 @@ interface SprigrDataApi {
      * uncertainty), per the mirror-maintenance guidance in
      * docs/platform-reference.md.
      */
-    delete?(objectIDs: string[], opts?: SprigrDataIndexOpts & {
+    delete?(objectIDs: string[], opts?: SprigrDataIndexOpts & SprigrDataWriteTimeoutOpts & {
         withAcl?: boolean;
     }): Promise<{
         ok: boolean;
@@ -3439,10 +3522,12 @@ interface SprigrFilesApi {
      * Stream bytes into the app's store under `key` (app-relative; the platform
      * adds/strips the `_apps/{installId}/` prefix). A `ReadableStream` is piped
      * straight through to R2 without buffering whole in the isolate, so use it
-     * for multi-MB blobs (videos, full-res photos, PDFs). Size cap: 50 MB.
+     * for multi-MB blobs (videos, full-res photos, PDFs). Size cap: 200 MB
+     * (`MAX_STREAM_PUT_BYTES` in sprigr-team `wfp-files.ts`).
      * `opts.length` declares the byte length so the platform can enforce the cap
      * before opening the write; forward it for streamed bodies, which carry no
-     * Content-Length (`bytes` comes back `null` when it is omitted).
+     * Content-Length. The platform checks the cap ONLY against a declared
+     * length, so always pass it (`bytes` comes back `null` when it is omitted).
      */
     putStream(key: string, body: ReadableStream | ArrayBuffer | Uint8Array | string, opts?: {
         contentType?: string;
@@ -3657,4 +3742,4 @@ interface ExecutionContextLike {
 }
 type HandlerFn<TArgs, TResult> = (args: TArgs, env: Record<string, unknown>, ctx?: ExecutionContextLike) => Promise<TResult>;
 
-export { ACTOR_RETIRED_HOOK_TOOL, ACTOR_RETIRE_REASONS, APPROVAL_GRANTED_KEY, APPROVAL_PREVIEW_MAX, APP_FILES_ROOT, APP_OWNER_SEGMENT, type Actor, type ActorRetireReason, type ActorRetired, type ActorRetiredHookBody, type ActorRetiredResult, type AppApprovalEnvelope, type AppFileListItem, type AppFileUrlArgs, type AppFileUrlResult, type AppFilesEnv, type AppToolEffectsDeclaration, type AppUndoEnvelope, type ApplyPoliciesOptions, type ApprovalCoverage, type ApprovalGateOptions, type ApprovalPreviewFact, type ApprovalPreviewSlot, type ApprovalPreviewSpec, type ApprovalSpec, type ArchiveOfferOptions, type ArchiveOfferRefusal, type CallerKeyResolution, type CaptureJournal, type CompanyTimezoneEnv, type ConfirmCondition, type ConfirmRule, type ConfirmationPolicy, type ConnectCompleteRequest, type ConnectCompleteResult, type D1Like, type D1PreparedStatementLike, DATA_DELETE_MAX_IDS, DATA_PARTIAL_UPDATE_PATH, DEFAULT_EMIT_TIMEOUT_MS, DEFAULT_FILE_READ_TIMEOUT_MS, DEFAULT_LOG_TIMEOUT_MS, DEFAULT_MAX_FILE_BYTES, DEFAULT_MONEY_FIELDS, DEFAULT_WRITE_PREFIXES, type DataClient, type DataIdsOpts, type DataListIdsResult, type DataTransport, type DerivePolicyOptions, type DerivedPolicy, type DispatcherApprovalGate, type DispatcherApprovalOptions, type EmailPreviewInput, type EmitMarketplaceEventOptions, type EmitResult, type EmitTransport, type EncodeStateWithinEnvelopeOptions, type EncodedStateWithinEnvelope, type EventArgs, type ExecutionContextLike, FILE_REF_SOURCES_HELP, type FetchFileResult, type FetchWithRetryOptions, type FileRef, type FileRefContent, type FileRefEnv, FileRefError, type FileRefErrorCode, type FileRefStream, type FileRefVia, type GetAppFileResult, type HandlerFn, INBOX_SEND_CONTRACT_V1, type IdPrefixSpec, type IdSnapshot, type InboxAddress, type InboxAppendRequest, type InboxAppendResult, type InboxChannelDeclaration, type InboxFoldersRequest, type InboxFoldersResult, type InboxOwner, type InboxSendConnection, type InboxSendHandlerImpl, InboxSendRefusal, type InboxSendSupports, type InboxSendV1Args, type InboxSendV1Result, type InstallBridge, InvalidUndoEnvelopeError, type JournalRowLike, type LogToPlatformOptions, type ManifestDispatchBlock, type ManifestLike, type ManifestToolLike, type MarketplaceEventEmitOpts, type MarketplaceEventSourceIntegration, NotConnectedError, OAUTH_STATE_ENVELOPE_MAX_CHARS, type OAuthBouncerSignals, type OAuthState, type OfferUndoArgs, type PartialUpdateDataOptions, type PlatformHostEnv, type PolicyCheckInput, type PolicySource, type PurgeResult, type PutAppFileArgs, type PutAppFileResult, type PutAppFileStreamArgs, type ReadFileRefOptions, type RequireApprovalOptions, type ResolveFileRefOptions, type ResolveViewerOptions, type ResolvedFileRef, type RestoreResult, type RestoreSpec, SPRIGR_DATA_MAX_OBJECTS_PER_CALL, SPRIGR_FILE_HOSTS, SPRIGR_LOG_LEVELS, SPRIGR_LOG_LIMITS, type ScheduleArgs, type SmsPreviewInput, type SprigrDataAggregationCell, type SprigrDataAggregationResult, type SprigrDataAggregationSpec, type SprigrDataApi, type SprigrDataImportOpts, type SprigrDataIndexOpts, type SprigrDataPartialUpdateBody, type SprigrDataPartialUpdateOpts, type SprigrDataPartialUpdateResult, type SprigrDataPatch, type SprigrDataSearchOpts, type SprigrDataSearchResult, SprigrDataValidationError, type SprigrFilesApi, type SprigrFilesApiWithEdit, type SprigrFilesCreateInput, type SprigrFilesCreateResult, type SprigrFilesEditInput, type SprigrFilesEditResult, type SprigrFilesJobResult, type SprigrFilesListItem, type SprigrFilesListResult, type SprigrInboxApi, type SprigrLogEntry, type SprigrLogFn, type SprigrLogLevel, type SprigrLogResult, SprigrLogValidationError, type SyncedAttachment, type SyncedMessage, type ToolArgs, type ToolHandler, type ToolResult, type ToolWrapperOptions, UNIT_SEP, type UndoApplyOptions, type UndoApplyResult, type UndoCaptureSpec, type UndoFidelity, VIEWER_ANONYMOUS, VIEWER_CONTEXT_HEADER, VIEWER_PLATFORM_USER_ID_HEADER, VIEWER_ROLE_HEADER, VIEWER_USER_ID_HEADER, type VerbRule, type ViewerContext, type ViewerContextFailure, type ViewerContextVerification, type ViewerEnv, WORKSPACE_FILE_HOW_TO, type WebhookArgs, type WfpBridgeEnv, type WfpEmitReply, actorKey, actorRetiredHook, actorTool, agentFileKeyFromUrl, appFileUrl, appKeyFromCallerKey, applyConfirmationPolicies, approvalHash, approvalPreview, approvalRecipients, archiveOfferRefusal, attendedFindings, base64ToBytes, buildConfirmationPolicy, buildMarketplaceWebhookUrl, buildPartialUpdateBody, bytesToBase64, callerKeyRefusal, canEmit, canLog, canPartialUpdate, checkConfirmationPolicy, commonDestructiveVerbs, connectComplete, connectDisconnect, constantTimeEqual, createMarketplaceEmitter, createToolWrappers, decodeState, defineInboxSendHandler, deleteAppFile, deleteSnapshotIds, deriveConfirmationPolicy, describeMissingBridge, dispatcherApproval, emailPreview, emitMarketplaceEvent, encodeState, encodeStateWithinEnvelope, fetchFileAsBase64, fetchFileBytes, fetchWithRetry, fieldsPreview, fullWarning, getAppFile, getCompanyTimezone, hmacSha256Hex, installTokenPost, isNotConnectedError, isStagingHost, listAppFiles, logToPlatform, makeDataClient, manifestIsFresh, oauthStateEnvelopeOverhead, offerUndo, openFileRef, overlaySprigr, ownerFromActorKey, parseActor, parseActorRetiredArgs, partialUpdateData, purgeIndexByPrefix, putAppFile, putAppFileStream, randomHex, readFileRef, readableStoredKey, recreatedWarning, refuseWithoutForce, requireApproval, resolveFileRef, resolveInstallBridge, resolveOAuthBouncerBase, resolveOAuthBouncerCallbackUrl, resolvePlatformWebhookBase, resolveViewerContext, resolveViewerUserId, runUndoApply, safeCapture, seq, serializeManifest, set, smsPreview, snapshotIndexIds, tool, undoEnvelope, validateLogEntries, validateLogEntry, verifyViewerToken, withSprigrEmitFallback, withSprigrInboxFallback, withSprigrLogFallback };
+export { ACTOR_RETIRED_HOOK_TOOL, ACTOR_RETIRE_REASONS, APPROVAL_GRANTED_KEY, APPROVAL_PREVIEW_MAX, APP_FILES_ROOT, APP_OWNER_SEGMENT, type Actor, type ActorRetireReason, type ActorRetired, type ActorRetiredHookBody, type ActorRetiredResult, type AppApprovalEnvelope, type AppFileListItem, type AppFileUrlArgs, type AppFileUrlResult, type AppFilesEnv, type AppToolEffectsDeclaration, type AppUndoEnvelope, type ApplyPoliciesOptions, type ApprovalCoverage, type ApprovalGateOptions, type ApprovalPreviewFact, type ApprovalPreviewSlot, type ApprovalPreviewSpec, type ApprovalSpec, type ArchiveOfferOptions, type ArchiveOfferRefusal, type CallerKeyResolution, type CaptureJournal, type CompanyTimezoneEnv, type ConfirmCondition, type ConfirmRule, type ConfirmationPolicy, type ConnectCompleteRequest, type ConnectCompleteResult, type D1Like, type D1PreparedStatementLike, DATA_DELETE_MAX_IDS, DATA_PARTIAL_UPDATE_PATH, DEFAULT_EMIT_TIMEOUT_MS, DEFAULT_FILE_READ_TIMEOUT_MS, DEFAULT_LOG_TIMEOUT_MS, DEFAULT_MAX_FILE_BYTES, DEFAULT_MONEY_FIELDS, DEFAULT_WRITE_PREFIXES, type DataClient, type DataIdsOpts, type DataListIdsResult, type DataTransport, type DerivePolicyOptions, type DerivedPolicy, type DispatcherApprovalGate, type DispatcherApprovalOptions, type EmailPreviewInput, type EmitMarketplaceEventOptions, type EmitResult, type EmitTransport, type EncodeStateWithinEnvelopeOptions, type EncodedStateWithinEnvelope, type EventArgs, type ExecutionContextLike, FILE_REF_SOURCES_HELP, type FetchFileResult, type FetchWithRetryOptions, type FileRef, type FileRefContent, type FileRefEnv, FileRefError, type FileRefErrorCode, type FileRefStream, type FileRefVia, type GetAppFileResult, type HandlerFn, INBOX_SEND_CONTRACT_V1, type IdPrefixSpec, type IdSnapshot, type InboxAddress, type InboxAppendRequest, type InboxAppendResult, type InboxChannelDeclaration, type InboxFoldersRequest, type InboxFoldersResult, type InboxOwner, type InboxSendConnection, type InboxSendHandlerImpl, InboxSendRefusal, type InboxSendSupports, type InboxSendV1Args, type InboxSendV1Result, type InstallBridge, InvalidUndoEnvelopeError, type JournalRowLike, type LogToPlatformOptions, type ManifestDispatchBlock, type ManifestLike, type ManifestToolLike, type MarketplaceEventEmitOpts, type MarketplaceEventSourceIntegration, NotConnectedError, OAUTH_STATE_ENVELOPE_MAX_CHARS, type OAuthBouncerSignals, type OAuthState, type OfferUndoArgs, type PartialUpdateDataOptions, type PlatformHostEnv, type PolicyCheckInput, type PolicySource, type PublicBaseUrlEnv, type PurgeResult, type PutAppFileArgs, type PutAppFileResult, type PutAppFileStreamArgs, type ReadFileRefOptions, type RequireApprovalOptions, type ResolveFileRefOptions, type ResolveViewerOptions, type ResolvedFileRef, type RestoreResult, type RestoreSpec, SPRIGR_DATA_MAX_OBJECTS_PER_CALL, SPRIGR_FILE_HOSTS, SPRIGR_LOG_LEVELS, SPRIGR_LOG_LIMITS, type ScheduleArgs, type SmsPreviewInput, type SprigrDataAggregationCell, type SprigrDataAggregationResult, type SprigrDataAggregationSpec, type SprigrDataApi, type SprigrDataImportOpts, type SprigrDataIndexOpts, type SprigrDataPartialUpdateBody, type SprigrDataPartialUpdateOpts, type SprigrDataPartialUpdateResult, type SprigrDataPatch, type SprigrDataSearchOpts, type SprigrDataSearchResult, SprigrDataValidationError, type SprigrDataWriteTimeoutOpts, type SprigrFilesApi, type SprigrFilesApiWithEdit, type SprigrFilesCreateInput, type SprigrFilesCreateResult, type SprigrFilesEditInput, type SprigrFilesEditResult, type SprigrFilesJobResult, type SprigrFilesListItem, type SprigrFilesListResult, type SprigrInboxApi, type SprigrLogEntry, type SprigrLogFn, type SprigrLogLevel, type SprigrLogResult, SprigrLogValidationError, type SyncedAttachment, type SyncedMessage, type ToolArgs, type ToolHandler, type ToolResult, type ToolWrapperOptions, UNIT_SEP, type UndoApplyOptions, type UndoApplyResult, type UndoCaptureSpec, type UndoFidelity, VIEWER_ANONYMOUS, VIEWER_CONTEXT_HEADER, VIEWER_PLATFORM_USER_ID_HEADER, VIEWER_ROLE_HEADER, VIEWER_USER_ID_HEADER, type VerbRule, type ViewerContext, type ViewerContextFailure, type ViewerContextVerification, type ViewerEnv, WORKSPACE_FILE_HOW_TO, type WebhookArgs, type WfpBridgeEnv, type WfpEmitReply, actorKey, actorRetiredHook, actorTool, agentFileKeyFromUrl, appFileUrl, appKeyFromCallerKey, applyConfirmationPolicies, approvalHash, approvalPreview, approvalRecipients, archiveOfferRefusal, attendedFindings, base64ToBytes, buildConfirmationPolicy, buildMarketplaceWebhookUrl, buildPartialUpdateBody, bytesToBase64, callerKeyRefusal, canEmit, canLog, canPartialUpdate, checkConfirmationPolicy, commonDestructiveVerbs, connectComplete, connectDisconnect, constantTimeEqual, createMarketplaceEmitter, createToolWrappers, decodeState, defineInboxSendHandler, deleteAppFile, deleteSnapshotIds, deriveConfirmationPolicy, describeMissingBridge, dispatcherApproval, emailBodyHtml, emailPreview, emitMarketplaceEvent, encodeState, encodeStateWithinEnvelope, fetchFileAsBase64, fetchFileBytes, fetchWithRetry, fieldsPreview, fullWarning, getAppFile, getCompanyTimezone, hasHtmlMarkup, hmacSha256Hex, installTokenPost, isNotConnectedError, isStagingHost, listAppFiles, logToPlatform, makeDataClient, manifestIsFresh, oauthStateEnvelopeOverhead, offerUndo, openFileRef, overlaySprigr, ownerFromActorKey, parseActor, parseActorRetiredArgs, partialUpdateData, publicBaseUrl, purgeIndexByPrefix, putAppFile, putAppFileStream, randomHex, readFileRef, readableStoredKey, recreatedWarning, refuseWithoutForce, requireApproval, resolveFileRef, resolveInstallBridge, resolveOAuthBouncerBase, resolveOAuthBouncerCallbackUrl, resolvePlatformWebhookBase, resolveViewerContext, resolveViewerUserId, runUndoApply, safeCapture, seq, serializeManifest, set, smsPreview, snapshotIndexIds, tool, undoEnvelope, validateLogEntries, validateLogEntry, verifyViewerToken, withSprigrEmitFallback, withSprigrInboxFallback, withSprigrLogFallback };

package/dist/index.js

@@ -603,6 +603,16 @@ function buildMarketplaceWebhookUrl(env, installId, topicPath, override) {
   const base = resolvePlatformWebhookBase(env, override);
   return `${base}/webhook/marketplace/${installId}/${topicPath}`;
 }
+function publicBaseUrl(env) {
+  const raw = typeof env.SITE_PUBLIC_BASE_URL === "string" ? env.SITE_PUBLIC_BASE_URL.trim() : "";
+  if (!raw) return null;
+  try {
+    const url = new URL(raw);
+    return url.protocol === "https:" ? url.origin : null;
+  } catch {
+    return null;
+  }
+}
 var OAUTH_BOUNCER_PROD = "https://oauth-bouncer.sprigr.com";
 var OAUTH_BOUNCER_STAGING = "https://staging-oauth-bouncer.sprigr.com";
 function isStagingHost(urlOrHostname) {
@@ -689,6 +699,9 @@ async function installTokenPost(bridge, path, body, opts) {
       err.status = resp.status;
       err.error = code;
       if (obj && typeof obj.detail === "string") err.detail = obj.detail;
+      const retryAfter = resp.headers.get("retry-after");
+      const retryAfterSeconds = retryAfter === null ? NaN : Number(retryAfter.trim());
+      if (Number.isFinite(retryAfterSeconds) && retryAfterSeconds >= 0) err.retryAfterSeconds = retryAfterSeconds;
       throw err;
     }
     return parsed ?? {};
@@ -1067,7 +1080,8 @@ async function partialUpdateData(env, objects, opts) {
     const result = await injected(body.objects, {
       ...body.index !== void 0 ? { index: body.index } : {},
       createIfNotExists: body.createIfNotExists,
-      ...body.withAcl ? { withAcl: true } : {}
+      ...body.withAcl ? { withAcl: true } : {},
+      ...timeoutMs !== void 0 ? { timeoutMs } : {}
     });
     return body.withAcl ? assertAclIndex(result) : result;
   }
@@ -2124,6 +2138,10 @@ async function connectDisconnect(env, req) {
 
 // src/data-purge.ts
 var BRIDGE_TIMEOUT_MS = 2e4;
+var IMPORT_RETRY_MAX_WAIT_MS = 3e3;
+var IMPORT_RETRY_WINDOW_MS = 12e3;
+var IMPORT_TOTAL_BUDGET_MS = 25e3;
+var IMPORT_RETRY_MIN_MS = 1500;
 var DATA_DELETE_MAX_IDS = 1e3;
 function injectedData(env) {
   const data = env.SPRIGR?.data;
@@ -2162,7 +2180,26 @@ function makeDataClient(env) {
   return {
     via: "http",
     async import(objects, opts) {
-      const r = await post("/internal/wfp/data/import", { objects, ...opts ?? {} }, "data.import");
+      const body = { objects, ...opts ?? {} };
+      const startedAt = Date.now();
+      const callerMs = typeof opts?.timeoutMs === "number" && opts.timeoutMs > 0 ? opts.timeoutMs : void 0;
+      const sendImport = (timeoutMs) => installTokenPost(bridge, "/internal/wfp/data/import", body, { label: "data.import", timeoutMs });
+      let r;
+      try {
+        r = await sendImport(Math.min(BRIDGE_TIMEOUT_MS, callerMs ?? BRIDGE_TIMEOUT_MS));
+      } catch (err) {
+        const e = err;
+        if (e?.status !== 503) throw err;
+        const waitMs = Math.min(
+          typeof e.retryAfterSeconds === "number" ? e.retryAfterSeconds * 1e3 : 1e3,
+          IMPORT_RETRY_MAX_WAIT_MS
+        );
+        const spentMs = Date.now() - startedAt;
+        const retryMs = Math.min(BRIDGE_TIMEOUT_MS, (callerMs ?? IMPORT_TOTAL_BUDGET_MS) - spentMs - waitMs);
+        if (spentMs + waitMs > IMPORT_RETRY_WINDOW_MS || retryMs < IMPORT_RETRY_MIN_MS) throw err;
+        if (waitMs > 0) await new Promise((resolve) => setTimeout(resolve, waitMs));
+        r = await sendImport(retryMs);
+      }
       return { ok: r.ok !== false, indexed: typeof r.indexed === "number" ? r.indexed : objects.length, index: String(r.index ?? opts?.index ?? "") };
     },
     async search(opts) {
@@ -2266,6 +2303,21 @@ function getCompanyTimezone(env) {
     return void 0;
   }
 }
+
+// src/email-body.ts
+var HTML_ELEMENT = /<\/?(?:a|abbr|b|blockquote|body|br|center|code|del|div|em|font|h[1-6]|head|hr|html|i|img|ins|li|mark|ol|p|pre|s|section|small|span|strong|style|sub|sup|table|tbody|td|tfoot|th|thead|tr|u|ul)(?:\s[^<>]*)?\/?>/i;
+function hasHtmlMarkup(body) {
+  return HTML_ELEMENT.test(body) || /<!doctype\s+html/i.test(body);
+}
+function escapeHtml(text) {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function emailBodyHtml(body) {
+  if (body.length === 0 || hasHtmlMarkup(body)) return body;
+  const normalized = body.replace(/\r\n?/g, "\n").trim();
+  if (normalized.length === 0) return body;
+  return normalized.split(/\n[ \t]*\n+/).map((para) => `<p>${escapeHtml(para.replace(/^\n+|\n+$/g, "")).replace(/\n/g, "<br>")}</p>`).join("");
+}
 export {
   ACTOR_RETIRED_HOOK_TOOL,
   ACTOR_RETIRE_REASONS,
@@ -2336,6 +2388,7 @@ export {
   deriveConfirmationPolicy,
   describeMissingBridge,
   dispatcherApproval,
+  emailBodyHtml,
   emailPreview,
   emitMarketplaceEvent,
   encodeState,
@@ -2347,6 +2400,7 @@ export {
   fullWarning,
   getAppFile,
   getCompanyTimezone,
+  hasHtmlMarkup,
   hmacSha256Hex,
   installTokenPost,
   isNotConnectedError,
@@ -2363,6 +2417,7 @@ export {
   parseActor,
   parseActorRetiredArgs,
   partialUpdateData,
+  publicBaseUrl,
   purgeIndexByPrefix,
   putAppFile,
   putAppFileStream,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sprigr/apps-app-sdk",
-  "version": "0.26.0",
+  "version": "0.28.0",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",