@tailorkit/app 0.1.0-beta.29 → 0.1.0-beta.32

package/dist/chunk-PJBDA2RU.js

@@ -0,0 +1,415 @@
+import {
+  AppError,
+  appError
+} from "./chunk-7ZQPXG7O.js";
+
+// src/client/connection.ts
+import { createORPCClient } from "@orpc/client";
+import { RPCLink as FetchLink } from "@orpc/client/fetch";
+import { RPCLink } from "@orpc/client/websocket";
+
+// src/client/session.ts
+import { z } from "zod";
+var isObjectValue = (value) => typeof value === "object" && value !== null;
+var identitySchema = z.object({
+  appId: z.string(),
+  deploymentId: z.string(),
+  expiresAt: z.number(),
+  installationId: z.string(),
+  projectId: z.string(),
+  scope: z.object({ name: z.string(), value: z.record(z.string(), z.json()) }),
+  subjectId: z.string().optional(),
+  toolUrl: z.string()
+});
+var sessionSchema = z.object({
+  expiresAt: z.number(),
+  identity: identitySchema.optional(),
+  subjectId: z.string().optional(),
+  token: z.string(),
+  toolUrl: z.string().optional(),
+  url: z.string()
+});
+var parseSession = (value) => sessionSchema.parse(value);
+var APP_SESSION_RENEWAL_MS = 6e4;
+var freezeIdentity = (value) => {
+  if (isObjectValue(value) && !Object.isFrozen(value)) {
+    for (const child of Object.values(value)) {
+      freezeIdentity(child);
+    }
+    Object.freeze(value);
+  }
+  return value;
+};
+var sessionRenewalDelay = (session) => Math.max(500, session.expiresAt - Date.now() - APP_SESSION_RENEWAL_MS);
+var createSessionProvider = (options) => {
+  const base = new URL(options.baseUrl, globalThis.location?.href);
+  if (!base.pathname.endsWith("/")) {
+    base.pathname += "/";
+  }
+  let cached;
+  let pending;
+  return async (input) => {
+    if (!input.refresh && cached && cached.expiresAt > Date.now() + APP_SESSION_RENEWAL_MS) {
+      return cached;
+    }
+    pending ??= (async () => {
+      try {
+        return await (async () => {
+          const response = await (async () => {
+            try {
+              return await (options.fetch ?? fetch)(
+                new URL("backend/session", base),
+                {
+                  body: JSON.stringify({ appId: options.appId }),
+                  credentials: "same-origin",
+                  headers: { "content-type": "application/json" },
+                  method: "POST"
+                }
+              );
+            } catch {
+              throw new AppError(
+                "UNAVAILABLE",
+                "Unable to reach the app session provider"
+              );
+            }
+          })();
+          if (!response.ok) {
+            const code = response.status === 403 ? "FORBIDDEN" : "UNAVAILABLE";
+            throw new AppError(
+              response.status === 401 ? "UNAUTHORIZED" : code,
+              "Unable to authorize the app backend"
+            );
+          }
+          const parsed = sessionSchema.safeParse(await response.json());
+          if (!parsed.success) {
+            throw new AppError("UNAVAILABLE", "Invalid app session");
+          }
+          cached = parsed.data;
+          if (cached.identity) {
+            cached.identity = freezeIdentity(cached.identity);
+          }
+          return cached;
+        })();
+      } finally {
+        pending = void 0;
+      }
+    })();
+    return await pending;
+  };
+};
+
+// src/client/reference.ts
+var isStringValue = (value) => typeof value === "string";
+var reference = (name, _kind) => Object.freeze({ name });
+var createApi = () => {
+  const group = (path) => new Proxy(
+    /* oxlint-disable typescript/no-unsafe-type-assertion -- The proxy synthesizes every declared reference from its property path; its empty target is never used as an implemented reference. */
+    /* @__PURE__ */ Object.create(null),
+    /* oxlint-enable typescript/no-unsafe-type-assertion */
+    {
+      get: (_target, name) => {
+        if (!isStringValue(name) || name === "then") {
+          return void 0;
+        }
+        if (name === "name" && path) {
+          return path;
+        }
+        return group(path ? `${path}.${name}` : name);
+      }
+    }
+  );
+  return group("");
+};
+
+// src/client/connection.ts
+var backendUrl = (session, route) => {
+  const url = new URL(session.url);
+  if (url.username || url.password || url.search || url.hash) {
+    throw new AppError("BAD_REQUEST", "Invalid app backend URL");
+  }
+  if (url.protocol === "wss:") {
+    url.protocol = "https:";
+  }
+  if (url.protocol === "ws:") {
+    url.protocol = "http:";
+  }
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname))) {
+    throw new AppError("BAD_REQUEST", "App backends require HTTPS");
+  }
+  if (session.expiresAt <= Date.now() + 1e3) {
+    throw new AppError("UNAUTHORIZED", "App token expired");
+  }
+  url.pathname = `${url.pathname.replace(/\/$/u, "")}/${route}`;
+  return url;
+};
+var waitForRetry = async (signal, delayMs) => {
+  if (signal.aborted) {
+    return;
+  }
+  await (async () => {
+    const {
+      promise: pendingPromise,
+      resolve,
+      reject: rejectPending
+    } = Promise.withResolvers();
+    try {
+      const wake = () => {
+        clearTimeout(timer);
+        signal.removeEventListener("abort", wake);
+        resolve();
+      };
+      const timer = setTimeout(
+        wake,
+        delayMs
+      );
+      signal.addEventListener("abort", wake, { once: true });
+    } catch (error) {
+      rejectPending(error);
+    }
+    await pendingPromise;
+  })();
+};
+var createClient = (options = {}) => {
+  let closed = false;
+  let socket;
+  let timer;
+  const stops = /* @__PURE__ */ new Set();
+  const requests = /* @__PURE__ */ new Set();
+  const getSession = options.getSession ?? (async (request) => {
+    const bridge = globalThis.__tailorkitBackendSession;
+    if (!bridge) {
+      throw new AppError("UNAVAILABLE", "The host JWT bridge is unavailable");
+    }
+    return await bridge(request);
+  });
+  const wire = createORPCClient(
+    new RPCLink({
+      connect: async (info) => {
+        if (closed) {
+          throw new AppError("UNAVAILABLE", "App client closed");
+        }
+        const session = await getSession({ refresh: info.totalAttempt > 1 });
+        if (closed) {
+          throw new AppError("UNAVAILABLE", "App client closed");
+        }
+        const url = backendUrl(session, "queries");
+        url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+        socket = await (options.connect ?? ((urlValue, protocols) => new WebSocket(urlValue, protocols)))(url.href, ["tailorkit", `jwt.${session.token}`]);
+        clearTimeout(timer);
+        timer = setTimeout(
+          () => socket?.close(1e3, "Renew authentication"),
+          sessionRenewalDelay(session)
+        );
+        return socket;
+      },
+      reconnect: {
+        delay: (info) => info.attempt === 1 ? 0 : options.retryDelayMs ?? 1e3,
+        enabled: true
+      }
+    })
+  );
+  const call = async (kind, input) => {
+    if (closed) {
+      throw new AppError("UNAVAILABLE", "App client closed");
+    }
+    const controller = new AbortController();
+    requests.add(controller);
+    try {
+      const invocation = kind === "mutations" ? structuredClone(input) : input;
+      let attempt = 0;
+      let refresh = false;
+      let refreshed = false;
+      while (true) {
+        try {
+          if (closed) {
+            throw new AppError("UNAVAILABLE", "App client closed");
+          }
+          const session = await getSession({ refresh });
+          refresh = false;
+          if (closed) {
+            throw new AppError("UNAVAILABLE", "App client closed");
+          }
+          const url = backendUrl(session, kind);
+          url.pathname = url.pathname.slice(0, -kind.length).replace(/\/$/u, "");
+          const http = createORPCClient(
+            new FetchLink({
+              fetch: async (urlValue2, init) => {
+                let response;
+                try {
+                  response = await (options.fetch ?? fetch)(urlValue2, {
+                    ...init,
+                    credentials: "omit"
+                  });
+                } catch {
+                  throw new AppError(
+                    "UNAVAILABLE",
+                    "App connection interrupted"
+                  );
+                }
+                if ([502, 503, 504].includes(response.status)) {
+                  throw new AppError(
+                    "UNAVAILABLE",
+                    "App backend temporarily unavailable"
+                  );
+                }
+                if (kind === "mutations" && response.body) {
+                  try {
+                    return new Response(await response.arrayBuffer(), {
+                      headers: response.headers,
+                      status: response.status
+                    });
+                  } catch {
+                    throw new AppError(
+                      "UNAVAILABLE",
+                      "App connection interrupted"
+                    );
+                  }
+                }
+                return response;
+              },
+              headers: { authorization: `Bearer ${session.token}` },
+              origin: url.origin,
+              // SAFETY: URL.pathname always starts with a slash for this HTTP session URL, satisfying the transport's absolute route-path type.
+              url: (
+                /* oxlint-disable typescript/no-unsafe-type-assertion -- URL.pathname always starts with a slash for this HTTP session URL, satisfying the transport's absolute route-path type. */
+                url.pathname
+              )
+              /* oxlint-enable typescript/no-unsafe-type-assertion */
+            })
+          );
+          if (kind === "mutations") {
+            return await http.mutations(
+              /* oxlint-disable typescript/no-unsafe-type-assertion -- The mutation branch assigned invocation.requestId before entering this retry loop. */
+              invocation,
+              /* oxlint-enable typescript/no-unsafe-type-assertion */
+              {
+                signal: controller.signal
+              }
+            );
+          }
+          return await http[kind](invocation, { signal: controller.signal });
+        } catch (error) {
+          const failure = appError(error);
+          if (kind !== "mutations" || closed || controller.signal.aborted) {
+            throw failure;
+          }
+          if (failure.code === "UNAUTHORIZED" && !refreshed) {
+            refresh = true;
+            refreshed = true;
+            continue;
+          }
+          if (failure.code !== "UNAVAILABLE") {
+            throw failure;
+          }
+          await waitForRetry(
+            controller.signal,
+            Math.min(
+              (options.retryDelayMs ?? 1e3) * 2 ** Math.min((attempt += 1) - 1, 5),
+              3e4
+            )
+          );
+        }
+      }
+    } catch (error) {
+      throw appError(error);
+    } finally {
+      requests.delete(controller);
+    }
+  };
+  return {
+    // SAFETY: The action reference owns its output type, and the server validates that registered action before the shared transport returns its erased result.
+    action: async (ref, ...[args]) => await /* oxlint-disable typescript/no-unsafe-type-assertion -- The action reference owns its output type, and the server validates that registered action before the shared transport returns its erased result. */
+    call("actions", { args, name: ref.name }),
+    /* oxlint-enable typescript/no-unsafe-type-assertion */
+    close: () => {
+      closed = true;
+      for (const stop of stops) {
+        stop();
+      }
+      for (const request of requests) {
+        request.abort();
+      }
+      clearTimeout(timer);
+      socket?.close();
+    },
+    // SAFETY: The mutation reference owns its output type, and the server validates that registered mutation before the shared transport returns its erased result.
+    mutate: async (ref, ...[args, settings]) => await /* oxlint-disable typescript/no-unsafe-type-assertion -- The mutation reference owns its output type, and the server validates that registered mutation before the shared transport returns its erased result. */
+    call("mutations", {
+      args,
+      name: ref.name,
+      requestId: settings?.requestId ?? crypto.randomUUID()
+    }),
+    /* oxlint-enable typescript/no-unsafe-type-assertion */
+    // SAFETY: The query reference owns its output type, and the server validates that registered query before the shared transport returns its erased result.
+    query: async (ref, ...[args]) => await /* oxlint-disable typescript/no-unsafe-type-assertion -- The query reference owns its output type, and the server validates that registered query before the shared transport returns its erased result. */
+    call("queries", { args, name: ref.name }),
+    /* oxlint-enable typescript/no-unsafe-type-assertion */
+    subscribe: (ref, args, next, settings = {}) => {
+      if (closed) {
+        throw new AppError("UNAVAILABLE", "App client closed");
+      }
+      const controller = new AbortController();
+      const stop = () => {
+        controller.abort();
+        stops.delete(stop);
+      };
+      stops.add(stop);
+      const run = async () => {
+        while (!controller.signal.aborted) {
+          try {
+            const stream = await wire.subscribe(
+              { args, name: ref.name },
+              { signal: controller.signal }
+            );
+            for await (const value of stream) {
+              if (controller.signal.aborted || closed) {
+                break;
+              }
+              next(
+                /* oxlint-disable typescript/no-unsafe-type-assertion -- This subscription was opened with ref.name and args; its listener receives only results from that same registered query, whose output generic is erased by the transport. */
+                value
+                /* oxlint-enable typescript/no-unsafe-type-assertion */
+              );
+            }
+          } catch (error) {
+            if (controller.signal.aborted || closed) {
+              break;
+            }
+            const failure = appError(error);
+            if (!(error instanceof Error && error.name === "AbortError")) {
+              settings.onError?.(failure);
+            }
+            if (![
+              "UNAUTHORIZED",
+              "UNAVAILABLE",
+              "INTERNAL_SERVER_ERROR"
+            ].includes(failure.code)) {
+              break;
+            }
+          }
+          if (!controller.signal.aborted && !closed) {
+            await waitForRetry(controller.signal, options.retryDelayMs ?? 1e3);
+          }
+        }
+        stop();
+      };
+      void (async () => {
+        try {
+          await run();
+        } catch (error) {
+          stop();
+          settings.onError?.(appError(error));
+        }
+      })();
+      return stop;
+    }
+  };
+};
+
+export {
+  parseSession,
+  createSessionProvider,
+  reference,
+  createApi,
+  createClient
+};