runline 0.33.0 → 0.34.0

package/dist/plugins/_shared/googleAuth.js

@@ -1,30 +1,8 @@
 import { AuthError, downloadResource, } from "runline";
-import { credentialRuntime } from "./credentialAdapter.js";
-import { googleCredentialType, googleIdentity, googleMethod, googleResources, } from "./googleCredentials.js";
-/** Explicit storage adapter: the registry owns token protocols and renewal. */
-export function googleRuntime(ctx, pluginName, scopes) {
-    const config = ctx.connection.config;
-    const method = googleMethod(config);
-    const runtime = credentialRuntime(ctx, googleCredentialType(scopes, pluginName), method, (current) => {
-        const cfg = current;
-        return [
-            pluginName,
-            scopes,
-            googleMethod(cfg),
-            ...(method === "serviceAccount"
-                ? [googleIdentity(cfg)]
-                : [cfg.clientId, cfg.clientSecret]),
-        ];
-    });
-    if (method === "serviceAccount")
-        runtime.binding.jwtIdentity = googleIdentity(config);
-    return runtime;
-}
-/** Trusted-runtime token compatibility only; resource consumers use googleResponse. */
-export async function googleAccessToken(ctx, pluginName, scopes) {
-    const { binding, transport } = googleRuntime(ctx, pluginName, scopes);
-    return transport.accessToken(binding);
-}
+import { credentialBroker } from "./credentialAdapter.js";
+import { jsonAnswer, requestFailed } from "./credentials.js";
+import { googleCredential, googleResources } from "./googleCredentials.js";
+export { googleCredential } from "./googleCredentials.js";
 /** Translate builtin absolute URLs at one boundary; validate the raw path before URL normalization. */
 export async function googleResponse(ctx, plugin, scopes, url, init = {}, query) {
     const resources = googleResources(plugin);
@@ -45,8 +23,7 @@ export async function googleResponse(ctx, plugin, scopes, url, init = {}, query)
         }
         path = `${separator < 0 ? path : path.slice(0, separator)}?${params}`;
     }
-    const { binding, transport } = googleRuntime(ctx, plugin, scopes);
-    return transport.request(binding, {
+    return credentialBroker(ctx, googleCredential(plugin, scopes)).request({
         target,
         path,
         method: (init.method ?? "GET"),
@@ -54,6 +31,7 @@ export async function googleResponse(ctx, plugin, scopes, url, init = {}, query)
         body: init.body,
     });
 }
+/** A Google JSON request that must succeed; its answer is read by `jsonAnswer`. */
 export async function googleJsonRequest(ctx, plugin, scopes, method, url, body, query) {
     const response = await googleResponse(ctx, plugin, scopes, url, {
         method,
@@ -64,20 +42,11 @@ export async function googleJsonRequest(ctx, plugin, scopes, method, url, body,
         body: body === undefined ? undefined : JSON.stringify(body),
     }, query);
     if (!response.ok)
-        throw new Error(`${plugin}: request failed (HTTP ${response.status})`);
-    if (response.status === 204)
-        return { success: true };
-    const text = await response.text();
-    try {
-        return text ? JSON.parse(text) : { success: true };
-    }
-    catch {
-        throw new AuthError("invalid_response");
-    }
+        throw requestFailed(plugin, response.status);
+    return jsonAnswer(response);
 }
 export async function googleProbe(ctx, plugin, scopes) {
-    const { binding, transport } = googleRuntime(ctx, plugin, scopes);
-    return transport.probe(binding);
+    return credentialBroker(ctx, googleCredential(plugin, scopes)).probe();
 }
 /** Only Google-issued thumbnail hosts; never attach credentials to signed URLs. */
 export async function googleDownload(value) {

package/dist/plugins/_shared/googleCredentials.js

@@ -1,5 +1,5 @@
-import { AuthError, OAuthGrantSchema, } from "runline";
-import * as t from "typebox";
+import { AuthError, } from "runline";
+import { grantSchema } from "./credentials.js";
 /** Only legacy storage infers a method; host bindings always select it explicitly. */
 export function googleMethod(cfg) {
     if (cfg.authMethod !== undefined) {
@@ -112,19 +112,40 @@ export function googleResources(plugin) {
             : {}),
     };
 }
+/**
+ * A Google plugin's credential declaration: its own targets and the scopes
+ * it signs service-account requests for, the method its config selects,
+ * and — for a service account — the JWT identity, subject included.
+ */
+export function googleCredential(plugin, scopes) {
+    return (config) => {
+        const cfg = config;
+        const method = googleMethod(cfg);
+        return {
+            type: googleCredentialType(scopes, plugin),
+            method,
+            application: {
+                clientId: cfg.clientId,
+                clientSecret: cfg.clientSecret,
+            },
+            ...(method === "serviceAccount"
+                ? { jwtIdentity: googleIdentity(cfg) }
+                : {}),
+        };
+    };
+}
 /** Fixed vendor endpoints; a JSON credential's token_uri can never select egress. */
 export function googleCredentialType(scopes, plugin) {
     const url = "https://oauth2.googleapis.com/token";
-    const schema = t.Object({ grant: t.Optional(OAuthGrantSchema) }, { additionalProperties: false });
     const { targets, probe } = googleResources(plugin);
     return {
         id: "google.oauth",
         methods: {
             delegated: {
-                schema,
+                schema: grantSchema,
                 authentication: {
                     kind: "oauth2",
-                    grantField: "grant",
+                    field: "grant",
                     renewal: "refresh",
                     definition: {
                         id: "google.oauth",
@@ -138,10 +159,10 @@ export function googleCredentialType(scopes, plugin) {
             ...(scopes.length
                 ? {
                     serviceAccount: {
-                        schema,
+                        schema: grantSchema,
                         authentication: {
                             kind: "oauth2",
-                            grantField: "grant",
+                            field: "grant",
                             renewal: "jwtBearer",
                             scopes,
                             definition: {

package/dist/plugins/_shared/microsoftAuth.js

@@ -1,45 +1,18 @@
 import { AuthError, downloadResource, } from "runline";
-import { credentialRuntime } from "./credentialAdapter.js";
-import { microsoftCredentialType, microsoftMethod, microsoftUserBase, } from "./microsoftCredentials.js";
-export { microsoftDriveBase } from "./microsoftCredentials.js";
-export function isAppOnly(cfg) {
-    return microsoftMethod(cfg) === "appOnly";
-}
+import { credentialBroker } from "./credentialAdapter.js";
+import { jsonAnswer, requestFailed } from "./credentials.js";
+import { microsoftCredential, microsoftUserBase, } from "./microsoftCredentials.js";
+export { microsoftCredential, microsoftDriveBase, } from "./microsoftCredentials.js";
 export function userBase(ctx) {
     return microsoftUserBase(ctx.connection.config);
 }
-function runtime(ctx, plugin, scopes) {
-    const cfg = ctx.connection.config;
-    const method = microsoftMethod(cfg);
-    if (method === "appOnly" &&
-        (!cfg.tenantId ||
-            ["common", "organizations", "consumers"].includes(cfg.tenantId)))
-        throw new AuthError("invalid_credentials");
-    return credentialRuntime(ctx, microsoftCredentialType(cfg, plugin, scopes), method, (current) => {
-        const c = current;
-        return [
-            microsoftMethod(c),
-            c.tenantId,
-            c.clientId,
-            c.clientSecret,
-            scopes,
-        ];
-    });
-}
-/** Compatibility token access uses the same grant runtime as resource requests. */
-export async function microsoftAccessToken(ctx, plugin, scopes) {
-    const { binding, transport } = runtime(ctx, plugin, scopes);
-    return transport.accessToken(binding);
-}
 export async function microsoftProbe(ctx, plugin, scopes) {
-    const { binding, transport } = runtime(ctx, plugin, scopes);
-    return transport.probe(binding);
+    return credentialBroker(ctx, microsoftCredential(plugin, scopes)).probe();
 }
 export async function graphResponse(ctx, plugin, scopes, method, path, body, contentType) {
     if (!path.startsWith("/") || path.startsWith("//"))
         throw new AuthError("request_not_allowed");
-    const { binding, transport } = runtime(ctx, plugin, scopes);
-    return transport.request(binding, {
+    return credentialBroker(ctx, microsoftCredential(plugin, scopes)).request({
         target: "graph",
         path: path.slice(1),
         method: method,
@@ -50,20 +23,16 @@ export async function graphResponse(ctx, plugin, scopes, method, path, body, con
         body,
     });
 }
-/** JSON and binary requests share the same destination, renewal and replay policy. */
+/**
+ * A Graph JSON request that must succeed; its answer is read by
+ * `jsonAnswer`. JSON and binary requests share the same destination,
+ * renewal and replay policy through `graphResponse`.
+ */
 export async function graphRequest(ctx, plugin, scopes, method, path, body) {
     const res = await graphResponse(ctx, plugin, scopes, method, path, body === undefined ? undefined : JSON.stringify(body), body === undefined ? undefined : "application/json");
     if (!res.ok)
-        throw new Error(`${plugin}: Graph request failed (HTTP ${res.status})`);
-    if (res.status === 204)
-        return { success: true };
-    const text = await res.text();
-    try {
-        return text ? JSON.parse(text) : { success: true };
-    }
-    catch {
-        throw new Error(`${plugin}: invalid Graph response`);
-    }
+        throw requestFailed(plugin, res.status);
+    return jsonAnswer(res);
 }
 /** Graph-issued signed download URLs carry their own authority, never a bearer header. */
 export async function microsoftDownload(value) {

package/dist/plugins/_shared/microsoftCredentials.js

@@ -1,5 +1,5 @@
-import { AuthError, OAuthGrantSchema, } from "runline";
-import * as t from "typebox";
+import { AuthError, } from "runline";
+import { grantSchema, pathSegment } from "./credentials.js";
 /** Compatibility inference is confined to legacy configs without an explicit method. */
 export function microsoftMethod(cfg) {
     if (cfg.authMethod !== undefined) {
@@ -16,15 +16,38 @@ export function microsoftUserBase(cfg) {
         return "/me";
     if (!cfg.userUpn)
         throw new AuthError("invalid_credentials");
-    return `/users/${encodeURIComponent(cfg.userUpn)}`;
+    return `/users/${pathSegment(cfg.userUpn)}`;
 }
 export function microsoftDriveBase(cfg) {
     if (cfg.driveId)
-        return `/drives/${encodeURIComponent(cfg.driveId)}`;
+        return `/drives/${pathSegment(cfg.driveId)}`;
     if (cfg.siteId)
-        return `/sites/${encodeURIComponent(cfg.siteId)}/drive`;
+        return `/sites/${pathSegment(cfg.siteId)}/drive`;
     return `${microsoftUserBase(cfg)}/drive`;
 }
+/**
+ * A Microsoft plugin's credential declaration. App-only signs for one
+ * tenant's directory, so a multi-tenant authority is refused here, where
+ * every signer reads it.
+ */
+export function microsoftCredential(plugin, scopes) {
+    return (config) => {
+        const cfg = config;
+        const method = microsoftMethod(cfg);
+        if (method === "appOnly" &&
+            (!cfg.tenantId ||
+                ["common", "organizations", "consumers"].includes(cfg.tenantId)))
+            throw new AuthError("invalid_credentials");
+        return {
+            type: microsoftCredentialType(cfg, plugin, scopes),
+            method,
+            application: {
+                clientId: cfg.clientId,
+                clientSecret: cfg.clientSecret,
+            },
+        };
+    };
+}
 /** Scope-appropriate probes never require User.Read merely to check mail/calendar/files. */
 export function microsoftCredentialType(cfg, plugin, scopes) {
     const tenant = cfg.tenantId || "common";
@@ -34,7 +57,6 @@ export function microsoftCredentialType(cfg, plugin, scopes) {
         url: `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token`,
         clientAuthentication: "client_secret_post",
     };
-    const schema = t.Object({ grant: t.Optional(OAuthGrantSchema) }, { additionalProperties: false });
     const methods = Object.fromEntries(["delegated", "appOnly"].map((method) => {
         let probe;
         const selected = { ...cfg, authMethod: method };
@@ -59,10 +81,10 @@ export function microsoftCredentialType(cfg, plugin, scopes) {
         return [
             method,
             {
-                schema,
+                schema: grantSchema,
                 authentication: {
                     kind: "oauth2",
-                    grantField: "grant",
+                    field: "grant",
                     renewal: method === "delegated"
                         ? "refresh"
                         : "clientCredentials",

package/dist/plugins/_shared/provider.js

@@ -1,6 +1,6 @@
 /**
- * Provider helpers: total readers for unshaped JSON, path-segment safety,
- * and bounded text or binary body reads.
+ * Provider helpers: total readers for unshaped JSON, and bounded text or
+ * binary body reads.
  *
  * The readers are total by design. These payloads are deep and change without
  * notice, so a missing or wrongly-typed field yields the empty value for its
@@ -34,18 +34,6 @@ export function numOrNull(value) {
     return null;
 }
 export const num = (value, fallback) => numOrNull(value) ?? fallback;
-/**
- * One path segment, escaped. Caller-supplied ids reach a URL carrying a bearer
- * token, so a segment that could climb out of its position is refused outright
- * rather than encoded and hoped about.
- */
-export function seg(value, what, plugin) {
-    const raw = String(value ?? "").trim();
-    if (!raw || raw === "." || raw === ".." || /[/\\?#]/.test(raw)) {
-        throw new Error(`${plugin}: invalid ${what}`);
-    }
-    return encodeURIComponent(raw);
-}
 /**
  * Read a response body with a ceiling, so a hostile or broken endpoint cannot
  * make the process hold an unbounded string.

package/dist/plugins/_shared/shiftCloud.js

@@ -1,6 +1,6 @@
 import * as t from "typebox";
-import { authedFetch } from "./authedFetch.js";
-import { readBounded } from "./provider.js";
+import { errorIdentifier, failureMessage } from "./credentials.js";
+export { pathSegment } from "./credentials.js";
 export const STRICT_OBJECT = { additionalProperties: false };
 export const STRICT_UPDATE_OBJECT = {
     additionalProperties: false,
@@ -29,61 +29,25 @@ export const SHIFT_API_URL = "https://cloud.shift-labs.ai";
 export function baseUrl() {
     return `${SHIFT_API_URL}/`;
 }
-/** Default deadline; endpoints that hold the request open pass their own. */
-export const SHIFT_REQUEST_TIMEOUT_MS = 60_000;
-const MAX_RESPONSE_BYTES = 16 * 1024 * 1024;
 /**
- * The transport for every request carrying a Shift API key. Redirects are
- * refused so the key never reaches another host; one deadline covers the
- * whole exchange including the body, in place of any caller signal; the
- * text body is read with a ceiling and returned buffered, so JSON and text
- * callers consume it as usual.
+ * A failed response, read as a Shift error envelope when it is one: the
+ * service's `code` (else its `type`) and the offending `param`.
  */
-export async function shiftFetch(input, init = {}, timeoutMs = SHIFT_REQUEST_TIMEOUT_MS) {
-    const response = await authedFetch(input, {
-        ...init,
-        signal: AbortSignal.timeout(timeoutMs),
-    });
-    const text = await readBounded(response, MAX_RESPONSE_BYTES, "Shift API response exceeds 16 MiB");
-    return new Response(text || null, {
-        status: response.status,
-        statusText: response.statusText,
-        headers: response.headers,
-    });
-}
-export function apiKey(ctx) {
-    const key = ctx.connection.config.apiKey;
-    if (typeof key !== "string" || !key) {
-        throw new Error("Shift Labs apiKey is required");
-    }
-    return key;
-}
-export async function request(ctx, path, init = {}, timeoutMs = SHIFT_REQUEST_TIMEOUT_MS) {
-    const headers = new Headers(init.headers);
-    headers.set("authorization", `Bearer ${apiKey(ctx)}`);
-    if (init.body && !headers.has("content-type")) {
-        headers.set("content-type", "application/json");
+export async function shiftError(plugin, response) {
+    let code;
+    let param;
+    try {
+        const error = (await response.json()).error;
+        if (typeof error === "string")
+            code = errorIdentifier(error);
+        else if (error && typeof error === "object") {
+            const shaped = error;
+            code = errorIdentifier(shaped.code) ?? errorIdentifier(shaped.type);
+            param = errorIdentifier(shaped.param);
+        }
     }
-    const response = await shiftFetch(new URL(path, baseUrl()), { ...init, headers }, timeoutMs);
-    if (!response.ok) {
-        throw new Error(`Shift Labs API error ${response.status}: ${await response.text()}`);
+    catch {
+        // Not an error envelope: the status alone.
     }
-    if (response.status === 204)
-        return undefined;
-    return (await response.json());
-}
-export function pathSegment(value) {
-    return encodeURIComponent(value);
-}
-export function listParams(input) {
-    const params = new URLSearchParams();
-    for (const [key, value] of Object.entries((input ?? {}))) {
-        if (value !== undefined)
-            params.set(key, String(value));
-    }
-    return params;
-}
-export function withQuery(path, params) {
-    const query = params.toString();
-    return query ? `${path}?${query}` : path;
+    return new Error(failureMessage(plugin, response.status, { code, param }));
 }

package/dist/plugins/_shared/shiftCredentials.js

@@ -0,0 +1,83 @@
+import { AuthError, } from "runline";
+import { credentialRequest, staticCredential } from "./credentials.js";
+import { SHIFT_API_URL, shiftError } from "./shiftCloud.js";
+/**
+ * The Shift family (shiftAtlas, shiftBwm, shiftCrm, shiftObjects,
+ * shiftPages, shiftWork) signs with one Shift API key, as a bearer, beneath
+ * the cloud API's /v1 surface. Each plugin may name its own probe: not every
+ * key reaches every service. Plugins whose service holds requests open
+ * (shiftOcr, shiftTranscription) declare the target's own deadline.
+ */
+export function shiftCredential(options = {}) {
+    const { probe, timeoutMs, maxResponseBytes } = options;
+    return staticCredential({
+        id: "shift",
+        auth: { kind: "bearer" },
+        local: { secret: "apiKey" },
+        targets: {
+            api: {
+                baseUrl: `${SHIFT_API_URL}/v1/`,
+                methods: ["GET", "POST", "PATCH", "PUT", "DELETE"],
+                allowedHeaders: ["Idempotency-Key"],
+                ...(timeoutMs !== undefined ? { timeoutMs } : {}),
+                ...(maxResponseBytes !== undefined ? { maxResponseBytes } : {}),
+            },
+        },
+        ...(probe
+            ? {
+                probe: {
+                    target: "api",
+                    path: probe,
+                    method: "GET",
+                    acceptedStatuses: [200],
+                },
+            }
+            : {}),
+    });
+}
+/** An absolute /v1/... route as a path beneath the Shift target. */
+export function shiftPath(route) {
+    if (!route.startsWith("/v1/"))
+        throw new AuthError("request_not_allowed");
+    return route.slice("/v1/".length);
+}
+/**
+ * A Shift plugin's credential and its request function, bound together so
+ * a plugin cannot sign with one declaration and declare another.
+ */
+export function shiftClient(plugin, options) {
+    const credential = shiftCredential(options);
+    return {
+        credential,
+        request: (ctx, route, init) => shiftRequest(ctx, credential, plugin, route, init),
+    };
+}
+/**
+ * One Shift API call through the declared credential. A body is JSON text;
+ * an empty answer, as the Shift API contract has it, is no value. `T` is the
+ * caller's statement of the answer's shape, unchecked.
+ */
+export async function shiftRequest(ctx, declaration, plugin, route, init = {}) {
+    const response = await credentialRequest(ctx, declaration, {
+        target: "api",
+        path: shiftPath(route),
+        method: (init.method ?? "GET"),
+        query: init.query,
+        ...(init.body !== undefined
+            ? { body: init.body, headers: { "Content-Type": "application/json" } }
+            : {}),
+    });
+    if (!response.ok)
+        throw await shiftError(plugin, response);
+    if (response.status === 204)
+        return undefined;
+    const text = await response.text();
+    if (!text)
+        return undefined;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new AuthError("invalid_response");
+    }
+}

package/dist/plugins/actionNetwork/src/credentials.js

@@ -0,0 +1,14 @@
+import { staticCredential } from "../../_shared/credentials.js";
+/** An OSDI API token, sent as the OSDI-API-Token header to Action Network's
+ *  one API origin. */
+export const actionNetworkCredential = staticCredential({
+    id: "actionNetwork",
+    auth: { kind: "apiKey", header: "OSDI-API-Token" },
+    local: { secret: "apiKey" },
+    targets: {
+        api: {
+            baseUrl: "https://actionnetwork.org/api/v2/",
+            methods: ["GET", "POST", "PUT", "DELETE"],
+        },
+    },
+});