primitive-admin 1.1.0-alpha.73 → 1.1.0-alpha.74

package/dist/src/lib/function-sync.d.ts

@@ -0,0 +1,157 @@
+/**
+ * `functions/<key>.toml` on the wire and back (#3179, project
+ * `server-functions`).
+ *
+ * A function is the one configuration object whose file is not its whole
+ * authored surface: the TOML states the gate, the entry and the limits, and the
+ * TypeScript the entry reaches is the rest of it. `config push` therefore sends
+ * TWO things — a header (create/update) and an immutable config VERSION
+ * carrying the authored TOML bytes, every source file and the built bundle —
+ * and `config pull` writes both halves back.
+ *
+ * ── The envelope hash is the shared answer to "changed?" ──────────────────
+ *
+ * The server decides whether a push is a no-op on `envelopeHash` (sha256 over
+ * the TOML bytes, the sources and the bundle), because a comment-only or
+ * CRLF-only edit leaves the BUNDLE identical and must still make a version
+ * (F-003). The CLI computes the same number to decide whether to make the call
+ * at all, through `function-bundle.ts`'s copy of the server's canonical
+ * encoding. If those two encodings ever drift, one side re-pushes forever and
+ * the other silently drops an edit — `function-bundle-3179.test.ts` pins them
+ * against each other.
+ *
+ * ── Pull writes bytes ────────────────────────────────────────────────────
+ *
+ * Canonical re-serialization cannot preserve comments, key order or line
+ * endings, so the envelope stores the AUTHORED bytes and pull writes those
+ * (F-009). It also never trusts a stored path: the files it writes are named by
+ * the server, so a path that normalizes outside the tree — or into
+ * `node_modules`, which is never authored source — is refused rather than
+ * written to a developer's disk. The lexical rules cannot see a symlinked
+ * directory inside the tree, so the write step resolves the real path one last
+ * time and refuses a destination that lands outside the real root.
+ */
+export interface FunctionConfigPush {
+    entry: string;
+    /** base64 of the authored `functions/<key>.toml` bytes. */
+    toml: string;
+    sources: Array<{
+        path: string;
+        content: string;
+    }>;
+    /** base64 of the built bundle. */
+    bundle: string;
+    contentHash: string;
+    /** The number BOTH sides compare to decide "is this a no-op?". */
+    envelopeHash: string;
+    durable: boolean;
+    limits?: Record<string, unknown>;
+}
+/**
+ * Build everything the config-version route needs for one function file.
+ *
+ * Throws `FunctionBuildError` for a missing `entry`, a missing entry file, a
+ * build error, or an import that escapes the config tree — one class, so the
+ * push loop has one thing to report and pushes nothing for that function.
+ */
+export declare function buildFunctionConfigPush(options: {
+    configDir: string;
+    functionKey: string;
+    /** Absolute path of `functions/<key>.toml`. */
+    filePath: string;
+    /** The already-parsed document, so the file is read once. */
+    tomlData: any;
+}): Promise<FunctionConfigPush>;
+/**
+ * The create body. `functionKey` is attached here rather than spread from the
+ * table: the identity comes from the file name, exactly as it does for every
+ * other keyed type.
+ */
+export declare function buildFunctionCreatePayload(functionKey: string, table: any): Record<string, any>;
+/**
+ * The update body. The key is NOT re-sent — it is the function's claim on the
+ * app's single key namespace and the URL already names the row — and `status`
+ * is server-owned on the sixth carrying type as on the other five.
+ */
+export declare function buildFunctionUpdatePayload(table: any): Record<string, any>;
+/** The version-carried keys, as the config-version row holds them. */
+export interface ActiveFunctionVersion {
+    entry?: string;
+    durable?: boolean;
+    /** JSON string on the row; an object is accepted too. */
+    limits?: unknown;
+}
+/**
+ * The canonical TOML for a function with no stored authored bytes — a function
+ * created through the API that has never had code pushed. When bytes exist,
+ * pull writes THOSE; this is the fallback that still produces a pushable file.
+ */
+export declare function serializeFunction(record: any, active?: ActiveFunctionVersion): string;
+/**
+ * The entity both sides of `config diff` are projected onto: the header's
+ * authored fields plus the three keys the VERSION carries. Stated once so a
+ * local file and a server record cannot be read into different shapes.
+ *
+ * Text the server rewrites on the way in is read the same way it will come
+ * back (the DSO-003 rule the webhook comparator states): `access` is stored
+ * trimmed and `entry` normalized, so an authored value that differs only in
+ * that respect is not permanent drift.
+ */
+export declare function functionDiffEntity(tomlData: any): Record<string, any>;
+export interface FunctionPullFile {
+    /** Tree-relative, POSIX. */
+    relative: string;
+    absolute: string;
+    content: Buffer;
+}
+export interface FunctionPullPlan {
+    configDir: string;
+    functionKey: string;
+    files: FunctionPullFile[];
+    /** The source paths written, for the sync-state record prune reads. */
+    sourcePaths: string[];
+    /** One line per stored path this pull refused to write. */
+    refusals: string[];
+}
+/**
+ * Why a stored source path may not be written, or null.
+ *
+ * The same rule the server applies on the way in, applied again on the way out:
+ * the file is written to a developer's disk from a path the SERVER chose, so a
+ * second check here is the one that matters.
+ */
+export declare function unsafePulledPath(path: string): string | null;
+/**
+ * Plan the files `config pull` writes for one function: the authored TOML at
+ * `functions/<key>.toml`, and each stored source at its own path.
+ *
+ * Pure — the caller applies it — so the refusal rules are testable without a
+ * server and without touching a disk.
+ */
+export declare function planFunctionPull(options: {
+    configDir: string;
+    functionKey: string;
+    envelope: {
+        entry?: string;
+        toml?: string;
+        sources?: Array<{
+            path: string;
+            content: string;
+        }>;
+    };
+}): FunctionPullPlan;
+/** What one `applyFunctionPull` actually did. */
+export interface FunctionPullOutcome {
+    /** The source paths written — what the sync state records for prune. */
+    writtenSources: string[];
+    /** One line per file the write step refused. */
+    refusals: string[];
+}
+/**
+ * Write a plan's files, creating the directories they need.
+ *
+ * Returns what was written and what was refused; a refusal is reported by the
+ * caller and keeps the file out of the sync state, so prune never claims to
+ * own a path this pull did not write.
+ */
+export declare function applyFunctionPull(plan: FunctionPullPlan): FunctionPullOutcome;

package/dist/src/lib/function-sync.js

@@ -0,0 +1,371 @@
+/**
+ * `functions/<key>.toml` on the wire and back (#3179, project
+ * `server-functions`).
+ *
+ * A function is the one configuration object whose file is not its whole
+ * authored surface: the TOML states the gate, the entry and the limits, and the
+ * TypeScript the entry reaches is the rest of it. `config push` therefore sends
+ * TWO things — a header (create/update) and an immutable config VERSION
+ * carrying the authored TOML bytes, every source file and the built bundle —
+ * and `config pull` writes both halves back.
+ *
+ * ── The envelope hash is the shared answer to "changed?" ──────────────────
+ *
+ * The server decides whether a push is a no-op on `envelopeHash` (sha256 over
+ * the TOML bytes, the sources and the bundle), because a comment-only or
+ * CRLF-only edit leaves the BUNDLE identical and must still make a version
+ * (F-003). The CLI computes the same number to decide whether to make the call
+ * at all, through `function-bundle.ts`'s copy of the server's canonical
+ * encoding. If those two encodings ever drift, one side re-pushes forever and
+ * the other silently drops an edit — `function-bundle-3179.test.ts` pins them
+ * against each other.
+ *
+ * ── Pull writes bytes ────────────────────────────────────────────────────
+ *
+ * Canonical re-serialization cannot preserve comments, key order or line
+ * endings, so the envelope stores the AUTHORED bytes and pull writes those
+ * (F-009). It also never trusts a stored path: the files it writes are named by
+ * the server, so a path that normalizes outside the tree — or into
+ * `node_modules`, which is never authored source — is refused rather than
+ * written to a developer's disk. The lexical rules cannot see a symlinked
+ * directory inside the tree, so the write step resolves the real path one last
+ * time and refuses a destination that lands outside the real root.
+ */
+import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, writeFileSync, } from "fs";
+import { dirname, isAbsolute, join, posix as posixPath, relative, resolve, sep, } from "path";
+import { stringifyConfigToml } from "./config-toml.js";
+import { SERVER_FUNCTION_TABLE } from "./config-surface.js";
+import { buildPayloadFromToml, projectRecordToToml, tomlOwned } from "./config-payload.js";
+import { normalizeFunctionTriggers, TriggerDeclarationError, } from "./function-triggers.js";
+import { buildFunctionBundle, FunctionBuildError, functionEnvelopeHash, FUNCTION_ENVELOPE_SCHEMA_VERSION, isDependencyPath, } from "./function-bundle.js";
+const toPosix = (value) => value.split(sep).join("/");
+/**
+ * Build everything the config-version route needs for one function file.
+ *
+ * Throws `FunctionBuildError` for a missing `entry`, a missing entry file, a
+ * build error, or an import that escapes the config tree — one class, so the
+ * push loop has one thing to report and pushes nothing for that function.
+ */
+export async function buildFunctionConfigPush(options) {
+    const { configDir, functionKey, filePath, tomlData } = options;
+    const table = tomlData?.function ?? {};
+    const entry = String(table.entry ?? "").trim();
+    if (!entry) {
+        throw new FunctionBuildError(`function '${functionKey}': \`entry\` is required — name the TypeScript ` +
+            "entry point, relative to the config tree root.");
+    }
+    // #3181 — the trigger blocks, checked before the bundle is built so an
+    // author with a mistyped key does not wait on esbuild first. Reported as a
+    // `FunctionBuildError` so the push loop keeps its one failure class per
+    // function and lands every unrelated change in the tree.
+    try {
+        normalizeFunctionTriggers(table, { durable: table.durable === true });
+    }
+    catch (err) {
+        if (err instanceof TriggerDeclarationError) {
+            throw new FunctionBuildError(`function '${functionKey}': ${err.message}`);
+        }
+        throw err;
+    }
+    const built = await buildFunctionBundle({ configDir, entry, functionKey });
+    // The AUTHORED bytes. Read from disk rather than re-serialized, so the round
+    // trip is byte-identical (F-009).
+    const authored = readFileSync(filePath);
+    const limits = normalizeLimits(table.limits);
+    const push = {
+        entry: built.entry,
+        toml: authored.toString("base64"),
+        sources: built.sources.map((s) => ({
+            path: s.path,
+            content: s.content.toString("base64"),
+        })),
+        bundle: built.bundle.toString("base64"),
+        contentHash: built.contentHash,
+        envelopeHash: "",
+        durable: table.durable === true,
+        ...(limits ? { limits } : {}),
+    };
+    push.envelopeHash = functionEnvelopeHash({
+        schemaVersion: FUNCTION_ENVELOPE_SCHEMA_VERSION,
+        entry: push.entry,
+        toml: push.toml,
+        sources: push.sources,
+        bundle: push.bundle,
+    });
+    return push;
+}
+/** `[function.limits]` as the server stores it, or undefined when absent. */
+function normalizeLimits(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value === "string") {
+        try {
+            const parsed = JSON.parse(value);
+            return parsed && typeof parsed === "object" ? parsed : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    if (typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    return value;
+}
+/**
+ * The create body. `functionKey` is attached here rather than spread from the
+ * table: the identity comes from the file name, exactly as it does for every
+ * other keyed type.
+ */
+export function buildFunctionCreatePayload(functionKey, table) {
+    const payload = buildPayloadFromToml(SERVER_FUNCTION_TABLE, table ?? {}, {
+        mode: "create",
+        values: { description: tomlOwned },
+    });
+    dropUndefined(payload);
+    return { functionKey, ...payload };
+}
+/**
+ * The update body. The key is NOT re-sent — it is the function's claim on the
+ * app's single key namespace and the URL already names the row — and `status`
+ * is server-owned on the sixth carrying type as on the other five.
+ */
+export function buildFunctionUpdatePayload(table) {
+    const payload = buildPayloadFromToml(SERVER_FUNCTION_TABLE, table ?? {}, {
+        mode: "update",
+        values: { description: tomlOwned },
+    });
+    dropUndefined(payload);
+    return payload;
+}
+function dropUndefined(payload) {
+    for (const key of Object.keys(payload)) {
+        if (payload[key] === undefined)
+            delete payload[key];
+    }
+}
+/**
+ * The canonical TOML for a function with no stored authored bytes — a function
+ * created through the API that has never had code pushed. When bytes exist,
+ * pull writes THOSE; this is the fallback that still produces a pushable file.
+ */
+export function serializeFunction(record, active) {
+    const table = {
+        key: record.functionKey,
+        ...projectRecordToToml(SERVER_FUNCTION_TABLE, record),
+    };
+    if (active?.entry)
+        table.entry = active.entry;
+    if (active?.durable === true)
+        table.durable = true;
+    const limits = normalizeLimits(active?.limits);
+    if (limits && Object.keys(limits).length > 0)
+        table.limits = limits;
+    for (const key of Object.keys(table)) {
+        if (table[key] === undefined || table[key] === null)
+            delete table[key];
+    }
+    return stringifyConfigToml({ function: table });
+}
+/**
+ * The tree-relative spelling of `entry` that push actually sends.
+ *
+ * The build normalizes the authored value (`resolve` + `relative`), and the
+ * server stores what it is sent, so a valid `./functions/greet/index.ts`
+ * arrives as `functions/greet/index.ts`. Comparing the authored spelling
+ * against the stored one would report a function as Modified the instant it
+ * was pushed and re-send the same update forever, so both sides are read
+ * through the same normalization here.
+ *
+ * Lexical only: an in-tree SYMLINK spelling is resolved by the build and not
+ * by this, which is the one remaining way for the two to differ.
+ */
+function canonicalEntry(value) {
+    const raw = toPosix(String(value ?? "").trim());
+    if (!raw)
+        return null;
+    const normalized = posixPath.normalize(raw).replace(/\/+$/, "");
+    return normalized || null;
+}
+/**
+ * The entity both sides of `config diff` are projected onto: the header's
+ * authored fields plus the three keys the VERSION carries. Stated once so a
+ * local file and a server record cannot be read into different shapes.
+ *
+ * Text the server rewrites on the way in is read the same way it will come
+ * back (the DSO-003 rule the webhook comparator states): `access` is stored
+ * trimmed and `entry` normalized, so an authored value that differs only in
+ * that respect is not permanent drift.
+ */
+export function functionDiffEntity(tomlData) {
+    const table = tomlData?.function ?? {};
+    const limits = normalizeLimits(table.limits);
+    const access = typeof table.access === "string" && table.access.trim()
+        ? table.access.trim()
+        : null;
+    return {
+        description: table.description ?? null,
+        runAs: table.runAs ?? "caller",
+        access,
+        inputSchema: table.inputSchema ?? null,
+        outputSchema: table.outputSchema ?? null,
+        entry: canonicalEntry(table.entry),
+        durable: table.durable === true,
+        limits: limits && Object.keys(limits).length > 0 ? limits : null,
+        // #3181 — normalized locally from the SAME rules the server applies, so a
+        // trigger edit reads as a named field rather than only as the code-axis
+        // `envelopeHash` change it also is. A file whose triggers do not parse is
+        // reported as drift rather than throwing out of a read-only diff: push is
+        // where the refusal belongs.
+        triggers: safeTriggers(table),
+    };
+}
+function safeTriggers(table) {
+    try {
+        return normalizeFunctionTriggers(table, { durable: table?.durable === true });
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Why a stored source path may not be written, or null.
+ *
+ * The same rule the server applies on the way in, applied again on the way out:
+ * the file is written to a developer's disk from a path the SERVER chose, so a
+ * second check here is the one that matters.
+ */
+export function unsafePulledPath(path) {
+    const raw = toPosix(String(path ?? ""));
+    if (!raw)
+        return "a stored source path is empty";
+    if (raw.startsWith("/") || /^[a-zA-Z]:\//.test(raw)) {
+        return `refused stored source path '${raw}': absolute paths are never written`;
+    }
+    if (raw.split("/").includes("..")) {
+        return `refused stored source path '${raw}': it normalizes outside the config tree`;
+    }
+    if (isDependencyPath(raw)) {
+        return `refused stored source path '${raw}': node_modules is never authored source`;
+    }
+    return null;
+}
+/**
+ * Plan the files `config pull` writes for one function: the authored TOML at
+ * `functions/<key>.toml`, and each stored source at its own path.
+ *
+ * Pure — the caller applies it — so the refusal rules are testable without a
+ * server and without touching a disk.
+ */
+export function planFunctionPull(options) {
+    const { configDir, functionKey, envelope } = options;
+    const root = resolve(configDir);
+    const files = [];
+    const sourcePaths = [];
+    const refusals = [];
+    if (typeof envelope?.toml === "string") {
+        const relativePath = `functions/${functionKey}.toml`;
+        files.push({
+            relative: relativePath,
+            absolute: join(root, "functions", `${functionKey}.toml`),
+            content: Buffer.from(envelope.toml, "base64"),
+        });
+    }
+    for (const source of envelope?.sources ?? []) {
+        const path = toPosix(String(source?.path ?? ""));
+        const refusal = unsafePulledPath(path);
+        if (refusal) {
+            refusals.push(refusal);
+            continue;
+        }
+        const absolute = resolve(root, path);
+        // Belt and braces: the string rules above state the contract, this catches
+        // a spelling they did not anticipate on a platform they were not written on.
+        const rel = relative(root, absolute);
+        if (rel.startsWith("..") || isAbsolute(rel)) {
+            refusals.push(`refused stored source path '${path}': it normalizes outside the config tree`);
+            continue;
+        }
+        files.push({
+            relative: path,
+            absolute,
+            content: Buffer.from(String(source?.content ?? ""), "base64"),
+        });
+        sourcePaths.push(path);
+    }
+    return { configDir: root, functionKey, files, sourcePaths, refusals };
+}
+/**
+ * Why a destination may not be written even though its stored path is
+ * tree-relative, or null.
+ *
+ * `planFunctionPull`'s rules are lexical, and a lexical rule cannot see a
+ * SYMLINK: `functions/shared` pointing at `/etc` makes `functions/shared/x`
+ * normalize inside the tree and land outside it. So the last check before the
+ * write is against the real path — the deepest directory that already exists
+ * is resolved and must still be inside the real tree root, and an existing
+ * destination that is itself a symlink is refused rather than written through.
+ */
+function unsafeDestination(realRoot, absolute) {
+    const contained = (path) => path === realRoot || path.startsWith(realRoot + sep);
+    let dir = dirname(absolute);
+    while (!existsSync(dir)) {
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    let realDir;
+    try {
+        realDir = realpathSync(dir);
+    }
+    catch {
+        return `refused writing '${absolute}': its directory could not be resolved`;
+    }
+    if (!contained(realDir)) {
+        return (`refused writing '${absolute}': a symlinked directory takes it outside ` +
+            "the config tree");
+    }
+    try {
+        if (lstatSync(absolute).isSymbolicLink()) {
+            return (`refused writing '${absolute}': the destination is a symlink, and a ` +
+                "pull writes files, never through links");
+        }
+    }
+    catch {
+        /* the destination does not exist yet — the normal case */
+    }
+    return null;
+}
+/**
+ * Write a plan's files, creating the directories they need.
+ *
+ * Returns what was written and what was refused; a refusal is reported by the
+ * caller and keeps the file out of the sync state, so prune never claims to
+ * own a path this pull did not write.
+ */
+export function applyFunctionPull(plan) {
+    const outcome = { writtenSources: [], refusals: [] };
+    let realRoot;
+    try {
+        realRoot = realpathSync(plan.configDir);
+    }
+    catch {
+        realRoot = plan.configDir;
+    }
+    const sourcePaths = new Set(plan.sourcePaths);
+    for (const file of plan.files) {
+        const refusal = unsafeDestination(realRoot, file.absolute);
+        if (refusal) {
+            outcome.refusals.push(refusal);
+            continue;
+        }
+        const dir = dirname(file.absolute);
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true });
+        writeFileSync(file.absolute, file.content);
+        if (sourcePaths.has(file.relative))
+            outcome.writtenSources.push(file.relative);
+    }
+    return outcome;
+}
+//# sourceMappingURL=function-sync.js.map

package/dist/src/lib/function-sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"function-sync.js","sourceRoot":"","sources":["../../../src/lib/function-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EACL,UAAU,EACV,SAAS,EACT,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,IAAI,CAAC;AACZ,OAAO,EACL,OAAO,EACP,UAAU,EACV,IAAI,EACJ,KAAK,IAAI,SAAS,EAClB,QAAQ,EACR,OAAO,EACP,GAAG,GACJ,MAAM,MAAM,CAAC;AACd,OAAO,EAAmB,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAC3F,OAAO,EACL,yBAAyB,EACzB,uBAAuB,GAExB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,gCAAgC,EAChC,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,OAAO,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAkBtE;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAO7C;IACC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAC/D,MAAM,KAAK,GAAG,QAAQ,EAAE,QAAQ,IAAI,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,kBAAkB,CAC1B,aAAa,WAAW,iDAAiD;YACvE,gDAAgD,CACnD,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,2EAA2E;IAC3E,wEAAwE;IACxE,yDAAyD;IACzD,IAAI,CAAC;QACH,yBAAyB,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;YAC3C,MAAM,IAAI,kBAAkB,CAAC,aAAa,WAAW,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAE3E,6EAA6E;IAC7E,kCAAkC;IAClC,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAExC,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAuB;QAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACjC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;SACtC,CAAC,CAAC;QACH,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACvC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,YAAY,EAAE,EAAE;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO,KAAK,IAAI;QAC/B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,CAAC;IACF,IAAI,CAAC,YAAY,GAAG,oBAAoB,CAAC;QACvC,aAAa,EAAE,gCAAgC;QAC/C,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6EAA6E;AAC7E,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACjC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxE,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,WAAmB,EACnB,KAAU;IAEV,MAAM,OAAO,GAAG,oBAAoB,CAAC,qBAAqB,EAAE,KAAK,IAAI,EAAE,EAAE;QACvE,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE;KACnC,CAAC,CAAC;IACH,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO,EAAE,WAAW,EAAE,GAAG,OAAO,EAAE,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAU;IACnD,MAAM,OAAO,GAAG,oBAAoB,CAAC,qBAAqB,EAAE,KAAK,IAAI,EAAE,EAAE;QACvE,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE;KACnC,CAAC,CAAC;IACH,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,OAA4B;IACjD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAYD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAW,EACX,MAA8B;IAE9B,MAAM,KAAK,GAAwB;QACjC,GAAG,EAAE,MAAM,CAAC,WAAW;QACvB,GAAG,mBAAmB,CAAC,qBAAqB,EAAE,MAAM,CAAC;KACtD,CAAC;IACF,IAAI,MAAM,EAAE,KAAK;QAAE,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC9C,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI;QAAE,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;IACnD,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;IACpE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,mBAAmB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,UAAU,GAAG,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChE,OAAO,UAAU,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAa;IAC9C,MAAM,KAAK,GAAG,QAAQ,EAAE,QAAQ,IAAI,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,MAAM,GACV,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE;QACrD,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE;QACrB,CAAC,CAAC,IAAI,CAAC;IACX,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;QACtC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,QAAQ;QAC9B,MAAM;QACN,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;QACtC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;QACxC,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO,KAAK,IAAI;QAC/B,MAAM,EAAE,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QAChE,0EAA0E;QAC1E,wEAAwE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,6BAA6B;QAC7B,QAAQ,EAAE,YAAY,CAAC,KAAK,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAU;IAC9B,IAAI,CAAC;QACH,OAAO,yBAAyB,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAqBD;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,+BAA+B,CAAC;IACjD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpD,OAAO,+BAA+B,GAAG,qCAAqC,CAAC;IACjF,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,OAAO,+BAA+B,GAAG,0CAA0C,CAAC;IACtF,CAAC;IACD,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,+BAA+B,GAAG,0CAA0C,CAAC;IACtF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAIhC;IACC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACrD,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,OAAO,QAAQ,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,YAAY,GAAG,aAAa,WAAW,OAAO,CAAC;QACrD,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,YAAY;YACtB,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,WAAW,OAAO,CAAC;YACxD,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACrC,2EAA2E;QAC3E,6EAA6E;QAC7E,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACrC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5C,QAAQ,CAAC,IAAI,CACX,+BAA+B,IAAI,0CAA0C,CAC9E,CAAC;YACF,SAAS;QACX,CAAC;QACD,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,IAAI;YACd,QAAQ;YACR,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,QAAQ,CAAC;SAC9D,CAAC,CAAC;QACH,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AACxE,CAAC;AAUD;;;;;;;;;;GAUG;AACH,SAAS,iBAAiB,CAAC,QAAgB,EAAE,QAAgB;IAC3D,MAAM,SAAS,GAAG,CAAC,IAAY,EAAW,EAAE,CAC1C,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC;IAEvD,IAAI,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5B,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,oBAAoB,QAAQ,wCAAwC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,OAAO,CACL,oBAAoB,QAAQ,4CAA4C;YACxE,iBAAiB,CAClB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;YACzC,OAAO,CACL,oBAAoB,QAAQ,yCAAyC;gBACrE,wCAAwC,CACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAsB;IACtD,MAAM,OAAO,GAAwB,EAAE,cAAc,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC1E,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;IAC5B,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/src/lib/function-triggers.d.ts

@@ -0,0 +1,54 @@
+/**
+ * `[function.triggers.*]`, read and checked locally (#3181).
+ *
+ * The SERVER is the authority: it derives the declaration from the TOML bytes
+ * inside the version envelope and validates it there, so a direct API push
+ * cannot ship a trigger the authored file does not declare (D3181-005). What
+ * this file buys is the other half of the `entry` dual-validation shape #3179
+ * established — an author who mistypes a key hears about it against their own
+ * file, by name, before a request is made.
+ *
+ * It is deliberately a VENDORED copy of the shape rules in
+ * `src/server-functions/trigger-declaration.ts` rather than an import: the CLI
+ * compiles with `rootDir: "."` and cannot reach the worker sources, which is
+ * the same constraint that made `generated-config-surfaces.ts` a vendored
+ * artifact. `cli/tests/unit/function-triggers-3181.test.ts` drives both copies
+ * from one fixture list so they cannot drift apart silently.
+ *
+ * Everything that needs the APP's state stays on the server: whether a
+ * referenced secret exists, whether the scheme-specific config is valid under
+ * this environment's JWKS policy, whether the app is at its webhook or cron
+ * cap, whether a standalone webhook holds the key. A local copy of those would
+ * be a preflight that can give a false all-clear.
+ */
+export interface WebhookTriggerDeclaration {
+    verificationScheme: string;
+    signingSecret?: string;
+    toleranceSeconds?: number;
+    deduplicationEnabled?: boolean;
+    deduplicationWindowMs?: number;
+    maxBodyBytes?: number;
+    secretGracePeriodMs?: number;
+    verification?: Record<string, unknown>;
+}
+export interface CronTriggerDeclaration {
+    name: string;
+    cron: string;
+    timezone?: string;
+    overlapPolicy?: string;
+    rootInput?: unknown;
+}
+export interface TriggerDeclaration {
+    webhook: WebhookTriggerDeclaration | null;
+    cron: CronTriggerDeclaration[];
+}
+export declare const MAX_CRON_TRIGGERS_PER_FUNCTION = 10;
+export declare class TriggerDeclarationError extends Error {
+}
+/**
+ * Normalize (and check) the `triggers` table of a parsed `[function]` table.
+ * Returns null when nothing is declared, so a caller can skip the work.
+ */
+export declare function normalizeFunctionTriggers(functionTable: any, options?: {
+    durable?: boolean;
+}): TriggerDeclaration | null;