@zackbart/connecta 0.28.1 → 0.30.0

package/dist/artifacts/refresh.d.ts

@@ -1,55 +0,0 @@
-import type { ArtifactOperations } from "./operations.js";
-import type { ArtifactHeadRecord, ArtifactRunRecord } from "./types.js";
-import type { RenderPage } from "./operations.js";
-/** Safe metadata only. Logs and downstream errors never enter the viewer. */
-export declare function freshnessOf(head: ArtifactHeadRecord, now?: number): {
-    state: "unconfigured";
-} | {
-    running?: boolean;
-    last?: {
-        runId: string;
-        at: string;
-        status: "succeeded" | "unchanged" | "failed" | "superseded";
-        documentVersion?: number;
-    };
-    dueAt?: string;
-    state: "stale" | "current";
-    schedule: import("./types.js").ArtifactRefreshSchedule;
-    document: string;
-    programVersion: number;
-};
-export interface ArtifactRefreshRuntime {
-    /** The core's bounded read-only program runner; no sandbox code enters this subpath. */
-    execute(program: string, owner: NonNullable<ArtifactHeadRecord["refresh"]>["owner"], signal: AbortSignal): Promise<{
-        content: {
-            type: string;
-            text?: string;
-        }[];
-        isError?: boolean;
-    }>;
-    claimMs: number;
-    /** UI branding shared by the viewer and every render check. */
-    branding?: import("../types.js").ConnectaBranding;
-}
-export type RefreshOutcome = {
-    status: "skipped";
-} | {
-    status: "succeeded" | "unchanged" | "failed" | "superseded";
-    runId: string;
-    documentVersion?: number;
-    errorCode?: string;
-};
-export declare class ArtifactRefreshService {
-    #private;
-    constructor(ops: ArtifactOperations);
-    bind(runtime: ArtifactRefreshRuntime): void;
-    setRender(renderFor: (signal: AbortSignal) => RenderPage | undefined): void;
-    run(id: string, trigger: ArtifactRunRecord["trigger"]): Promise<RefreshOutcome>;
-    runDue(): Promise<{
-        scanned: number;
-        started: number;
-        succeeded: number;
-        failed: number;
-        capped: boolean;
-    }>;
-}

package/dist/artifacts/refresh.js

@@ -1,236 +0,0 @@
-// Deployment-triggered artifact refresh. No interval, cron, or background
-// fiber lives here: Node and Workers decide when to call runDue().
-const MAX_DUE_PER_TICK = 10;
-const MAX_HEADS_PER_TICK = 1_000;
-const MAX_MESSAGE_CHARS = 500;
-/** Safe metadata only. Logs and downstream errors never enter the viewer. */
-export function freshnessOf(head, now = Date.now()) {
-    const refresh = head.refresh;
-    if (!refresh)
-        return { state: "unconfigured" };
-    const period = refresh.schedule === "daily" ? 86_400_000
-        : refresh.schedule === "weekly" ? 604_800_000 : undefined;
-    const dueAt = period === undefined ? undefined
-        : new Date(Date.parse(refresh.last?.at ?? refresh.configuredAt) + period).toISOString();
-    const stale = refresh.last?.status === "failed" || refresh.last?.status === "superseded" ||
-        (dueAt !== undefined && now >= Date.parse(dueAt));
-    return {
-        state: stale ? "stale" : "current",
-        schedule: refresh.schedule,
-        document: refresh.document,
-        programVersion: refresh.program.version,
-        ...(dueAt ? { dueAt } : {}),
-        ...(refresh.last ? { last: refresh.last } : {}),
-        ...(refresh.claim && Date.parse(refresh.claim.until) > now ? { running: true } : {}),
-    };
-}
-function capture(text, bytes) {
-    if (typeof text !== "string" || !text)
-        return undefined;
-    const encoder = new TextEncoder();
-    let clipped = text.slice(0, bytes);
-    while (encoder.encode(clipped).byteLength > bytes)
-        clipped = clipped.slice(0, -1);
-    return clipped;
-}
-function responsePayload(result) {
-    const text = result.content.find((block) => block.type === "text")?.text;
-    if (!text)
-        return { error: { code: "executor_failed", message: "Refresh program returned no result." } };
-    try {
-        const parsed = JSON.parse(text);
-        return parsed;
-    }
-    catch {
-        return { error: { code: "executor_failed", message: result.isError ? text : "Refresh program returned an invalid result." } };
-    }
-}
-async function beforeDeadline(work, signal) {
-    if (signal.aborted)
-        throw new Error("Refresh deadline expired.");
-    let onAbort;
-    const expired = new Promise((_resolve, reject) => {
-        onAbort = () => reject(new Error("Refresh deadline expired."));
-        signal.addEventListener("abort", onAbort, { once: true });
-    });
-    try {
-        return await Promise.race([work, expired]);
-    }
-    finally {
-        if (onAbort)
-            signal.removeEventListener("abort", onAbort);
-    }
-}
-export class ArtifactRefreshService {
-    #ops;
-    #runtime;
-    #renderFor;
-    constructor(ops) {
-        this.#ops = ops;
-    }
-    bind(runtime) {
-        if (this.#runtime)
-            throw new Error("One artifacts() module cannot be bound to two deployments.");
-        this.#runtime = runtime;
-    }
-    setRender(renderFor) {
-        this.#renderFor = renderFor;
-    }
-    async run(id, trigger) {
-        const runtime = this.#runtime;
-        if (!runtime)
-            throw new Error("Create a Connecta deployment with this artifacts() module before refreshing.");
-        const runId = crypto.randomUUID();
-        const claimed = await this.#ops.claimRefresh(id, runId, trigger, trigger === "schedule", runtime.claimMs);
-        if (!claimed.ok) {
-            if ("skipped" in claimed)
-                return { status: "skipped" };
-            throw new Error(claimed.message);
-        }
-        const run = claimed.run;
-        const deadline = Date.parse(claimed.head.refresh.claim.until);
-        const controller = new AbortController();
-        const timeout = setTimeout(() => controller.abort(), Math.max(0, deadline - Date.now()));
-        let outcome;
-        try {
-            await this.#ops.store.putRun(id, run);
-            if (Date.now() >= deadline)
-                throw new Error("Refresh claim expired before execution.");
-            if (!claimed.program)
-                throw new Error("Refresh program body is unavailable.");
-            const program = await beforeDeadline(this.#ops.store.body(claimed.program), controller.signal);
-            if (program === null)
-                throw new Error("Refresh program body is unavailable.");
-            const response = responsePayload(await beforeDeadline(runtime.execute(program, claimed.head.refresh.owner, controller.signal), controller.signal));
-            const logs = capture(response.logs, this.#ops.context.limits.runLogBytes);
-            if (logs)
-                run.logs = logs;
-            if (response.error) {
-                run.status = "failed";
-                run.errorCode = capture(response.error.code, 80) ?? "executor_failed";
-                const message = capture(response.error.message, MAX_MESSAGE_CHARS);
-                if (message)
-                    run.message = message;
-                outcome = { status: "failed", runId, errorCode: run.errorCode };
-            }
-            else if (response.result === null || response.result === undefined) {
-                run.status = "failed";
-                run.errorCode = "invalid_result";
-                run.message = "Refresh program must return a non-null JSON value.";
-                outcome = { status: "failed", runId, errorCode: run.errorCode };
-            }
-            else {
-                const document = claimed.head.refresh.document;
-                const baseVersion = claimed.head.documents[document]?.version ?? 0;
-                const render = this.#renderFor?.(controller.signal);
-                const saved = await this.#ops.setDocuments({
-                    id,
-                    documents: { [document]: { baseVersion, value: response.result } },
-                    by: { kind: "refresh" },
-                    op: "refresh", runId,
-                    programVersion: run.programVersion,
-                    ...(render ? { render } : {}),
-                });
-                if (saved.ok) {
-                    run.status = "succeeded";
-                    const documentVersion = saved.head.documents[document]?.version;
-                    if (documentVersion !== undefined)
-                        run.documentVersion = documentVersion;
-                    outcome = { status: "succeeded", runId,
-                        ...(documentVersion !== undefined ? { documentVersion } : {}) };
-                }
-                else {
-                    run.status = saved.code === "conflict" ? "superseded" : "failed";
-                    run.errorCode = saved.code;
-                    const message = capture(saved.message, MAX_MESSAGE_CHARS);
-                    if (message)
-                        run.message = message;
-                    outcome = { status: run.status, runId, errorCode: run.errorCode };
-                }
-            }
-        }
-        catch (error) {
-            run.status = "failed";
-            run.errorCode = "refresh_failed";
-            const message = capture(error instanceof Error ? error.message : String(error), MAX_MESSAGE_CHARS);
-            if (message)
-                run.message = message;
-            outcome = { status: "failed", runId, errorCode: run.errorCode };
-        }
-        finally {
-            clearTimeout(timeout);
-            controller.abort();
-        }
-        run.finishedAt = new Date().toISOString();
-        await this.#ops.finishRefresh(id, run);
-        return outcome;
-    }
-    async runDue() {
-        if (!this.#runtime)
-            throw new Error("Create a Connecta deployment before running refreshes.");
-        let after = await this.#ops.store.refreshScanCursor();
-        let scanned = 0;
-        let started = 0;
-        let succeeded = 0;
-        let failed = 0;
-        while (scanned < MAX_HEADS_PER_TICK && started < MAX_DUE_PER_TICK) {
-            const limit = Math.min(100, MAX_HEADS_PER_TICK - scanned);
-            const page = await this.#ops.store.heads({
-                ...(after ? { after } : {}),
-                limit,
-            });
-            if (page.next !== undefined && after !== undefined && page.next <= after) {
-                throw new Error("Artifact head scan did not advance.");
-            }
-            if (!page.heads.length) {
-                if (page.next) {
-                    after = page.next;
-                    scanned += limit;
-                    continue;
-                }
-                after = undefined;
-                break;
-            }
-            for (const { id, head } of page.heads) {
-                scanned++;
-                after = id;
-                if (!head.refresh || head.archived)
-                    continue;
-                let outcome;
-                try {
-                    outcome = await this.run(id, "schedule");
-                }
-                catch {
-                    // One broken record or transient run write does not starve later heads.
-                    started++;
-                    failed++;
-                    if (started >= MAX_DUE_PER_TICK)
-                        break;
-                    continue;
-                }
-                if (outcome.status === "skipped")
-                    continue;
-                started++;
-                if (outcome.status === "succeeded" || outcome.status === "unchanged")
-                    succeeded++;
-                else
-                    failed++;
-                if (started >= MAX_DUE_PER_TICK)
-                    break;
-            }
-            if (page.next) {
-                scanned += limit - page.heads.length;
-                if (started < MAX_DUE_PER_TICK)
-                    after = page.next;
-            }
-            if (!page.next || started >= MAX_DUE_PER_TICK) {
-                if (!page.next && started < MAX_DUE_PER_TICK && scanned < MAX_HEADS_PER_TICK)
-                    after = undefined;
-                break;
-            }
-        }
-        await this.#ops.store.setRefreshScanCursor(after);
-        return { scanned, started, succeeded, failed,
-            capped: scanned >= MAX_HEADS_PER_TICK || started >= MAX_DUE_PER_TICK };
-    }
-}

package/dist/artifacts/routes.js

@@ -1,206 +0,0 @@
-// The routes behind artifact pages: a JSON API the operator shell calls with
-// its session, and one constant, data-free frame the page renders in.
-//
-// The operator UI authenticates with a header, not a cookie — a bearer from
-// localStorage or a Clerk session token — so a bare navigation to a page
-// carries no credential. The trusted shell therefore fetches the page from
-// `_api` and hands it to the frame with `postMessage`; the frame itself is
-// served to anyone and holds nothing. What makes it safe is its response
-// header: `sandbox allow-scripts` without `allow-same-origin` gives the page
-// an opaque origin — no cookies, no storage, no route of this deployment it
-// could call — and the fetch directives leave it no network.
-import { resolveActorLabels, actorKey } from "../routes/actor-labels.js";
-import { authorize, mayViewArtifacts, privateJson, validateAuthPermissions, } from "../routes/shared.js";
-import { resolveBranding, schemeAttribute, themeCss } from "../branding.js";
-import { TOKENS_CSS } from "../page-styles.js";
-import { frameCsp } from "./document.js";
-import { scriptSafeJson } from "./json.js";
-import { freshnessOf } from "./refresh.js";
-import { ARTIFACT_ID } from "./validate.js";
-const LIBRARY_PAGE = 50;
-const MAX_QUERY_CHARS = 200;
-const MAX_PINS = 32;
-const PIN = /^([A-Za-z_][A-Za-z0-9_]{0,63}):(\d{1,9})$/;
-const notFound = () => privateJson({ error: "not found" }, { status: 404 });
-/** How long the frame waits for its document before saying it did not come. */
-const FRAME_STALL_MS = 15_000;
-/**
- * The frame's bootstrap: wait for exactly one document from the parent, then
- * become it.
- *
- * Until the document arrives the frame shows one quiet line on the viewer's
- * own surface, in the deployment's scheme and tokens, instead of a blank white
- * box; if the handshake never completes, the line says so. None of it is page
- * data — the scheme and tokens are deployment configuration — and all of it is
- * gone the moment `document.open` replaces this document with the page.
- */
-function frameBootstrap(expectedOrigin, theme) {
-    return `<!doctype html>
-<html lang="en"${schemeAttribute(theme)}><head><meta charset="utf-8"><meta name="referrer" content="no-referrer">
-<style>${TOKENS_CSS}${themeCss(theme)}html{background:var(--surface)}body{color:var(--muted);font:.875rem/1.5 var(--sans);margin:0;padding:1.25rem 1.5rem}</style>
-</head><body>
-<p id="frame-status" role="status">Loading page…</p>
-<script>
-(() => {
-  const expected = ${scriptSafeJson(expectedOrigin)};
-  if (window.parent === window) return;
-  const status = document.getElementById("frame-status");
-  const stalled = setTimeout(() => {
-    status.textContent = "This page did not load. Reload to try again.";
-  }, ${FRAME_STALL_MS});
-  const receive = (event) => {
-    if (event.source !== window.parent || event.origin !== expected) return;
-    const message = event.data;
-    if (!message || message.type !== "document" || typeof message.html !== "string") return;
-    window.removeEventListener("message", receive);
-    clearTimeout(stalled);
-    document.open();
-    document.write(message.html);
-    document.close();
-  };
-  window.addEventListener("message", receive);
-  window.parent.postMessage({ type: "ready" }, expected);
-})();
-</script>
-</body></html>`;
-}
-export function artifactRoutes(options) {
-    const ops = options.operations;
-    const csp = frameCsp(options.allowlist);
-    /** The viewer's identity, or the Response that refuses it. */
-    const admit = async (context) => {
-        const { request, baseUrl, opts, runtimeContext } = context;
-        if (opts.auth.length === 0) {
-            // An open deployment has nobody to show a team page to.
-            return privateJson({ error: "artifact pages need inbound authentication" }, { status: 403 });
-        }
-        const authz = await authorize(request, baseUrl, opts.auth, runtimeContext, opts.identity, false);
-        if (!authz.ok)
-            return authz.response;
-        try {
-            validateAuthPermissions(authz, opts.registry);
-        }
-        catch {
-            return privateJson({ error: "invalid identity permission" }, { status: 403 });
-        }
-        // Refused like an absent page, so a slug's existence is not an oracle.
-        return mayViewArtifacts(authz, opts.registry) ? authz : notFound();
-    };
-    const labelsFor = async (context, actors) => {
-        const labels = await resolveActorLabels(actors, context.opts.auth);
-        return (actor) => ({
-            label: labels.get(actorKey(actor)) ?? actor.id ?? actor.kind,
-        });
-    };
-    const library = async (context) => {
-        const admitted = await admit(context);
-        if (admitted instanceof Response)
-            return admitted;
-        const params = context.url.searchParams;
-        const query = (params.get("q") ?? "").slice(0, MAX_QUERY_CHARS);
-        const cursor = params.get("cursor") ?? undefined;
-        const listed = await ops.list({
-            limit: LIBRARY_PAGE,
-            ...(query ? { query } : {}),
-            ...(params.get("archived") === "1" ? { includeArchived: true } : {}),
-            ...(cursor !== undefined ? { cursor } : {}),
-        });
-        if (!listed.ok)
-            return privateJson({ error: "invalid cursor" }, { status: 400 });
-        const label = await labelsFor(context, listed.items.map(({ head }) => head.updatedBy));
-        return privateJson({
-            artifacts: listed.items.map(({ id, head }) => ({
-                id,
-                title: head.title,
-                kind: head.kind,
-                viewVersion: head.view.version,
-                updatedAt: head.updatedAt,
-                updatedBy: label(head.updatedBy),
-                archived: head.archived,
-                freshness: freshnessOf(head),
-            })),
-            ...(listed.nextCursor !== undefined ? { nextCursor: listed.nextCursor } : {}),
-        });
-    };
-    const view = async (context, id) => {
-        const admitted = await admit(context);
-        if (admitted instanceof Response)
-            return admitted;
-        const params = context.url.searchParams;
-        const pinned = params.get("v");
-        let pin;
-        if (pinned !== null) {
-            const pins = params.getAll("d");
-            if (!/^\d{1,9}$/.test(pinned) || pins.length > MAX_PINS)
-                return notFound();
-            const documents = {};
-            for (const entry of pins) {
-                const match = PIN.exec(entry);
-                if (!match?.[1] || match[1] === "__proto__")
-                    return notFound();
-                documents[match[1]] = Number(match[2]);
-            }
-            pin = { view: Number(pinned), documents };
-        }
-        const theme = resolveBranding(context.opts.branding).theme;
-        const page = await ops.page(id, pin ?? {}, theme);
-        if (!page.ok)
-            return notFound();
-        const origin = new URL(context.baseUrl).origin;
-        const url = `${origin}/artifacts/${id}`;
-        const documents = Object.entries(page.documents).map(([name, { record }]) => ({
-            name,
-            version: record.version,
-            updatedAt: record.at,
-        }));
-        const pins = documents.map(({ name, version }) => `d=${name}:${version}`);
-        const label = await labelsFor(context, [page.view.by]);
-        return privateJson({
-            id,
-            title: page.head.title,
-            kind: page.head.kind,
-            archived: page.head.archived,
-            snapshot: pin !== undefined,
-            latestViewVersion: page.head.view.version,
-            view: {
-                version: page.view.version,
-                at: page.view.at,
-                by: label(page.view.by),
-            },
-            documents,
-            freshness: freshnessOf(page.head),
-            url,
-            snapshotUrl: `${url}/v/${page.view.version}${pins.length ? `?${pins.join("&")}` : ""}`,
-            document: page.document,
-        });
-    };
-    return async (context) => {
-        const { path, request } = context;
-        const read = request.method === "GET" || request.method === "HEAD";
-        if (path === "/artifacts/_frame") {
-            if (!read)
-                return privateJson({ error: "method not allowed" }, { status: 405 });
-            const bootstrap = frameBootstrap(new URL(context.baseUrl).origin, resolveBranding(context.opts.branding).theme);
-            return new Response(request.method === "HEAD" ? null : bootstrap, {
-                headers: {
-                    "Content-Type": "text/html; charset=utf-8",
-                    "Content-Security-Policy": csp,
-                    "X-Content-Type-Options": "nosniff",
-                    "Cache-Control": "no-store",
-                    "Cross-Origin-Resource-Policy": "same-origin",
-                    "Permissions-Policy": "camera=(), microphone=(), geolocation=(), payment=(), usb=()",
-                },
-            });
-        }
-        if (!path.startsWith("/artifacts/_api/"))
-            return null;
-        if (request.method !== "GET")
-            return privateJson({ error: "method not allowed" }, { status: 405 });
-        if (path === "/artifacts/_api/list")
-            return library(context);
-        const match = /^\/artifacts\/_api\/view\/([^/]+)$/.exec(path);
-        if (match?.[1] && ARTIFACT_ID.test(match[1]))
-            return view(context, match[1]);
-        return notFound();
-    };
-}