@bsb/registry 1.0.4 → 1.1.0

package/lib/plugins/service-bsb-registry-ui/http-server.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * Registry UI & API HTTP Server (Event-Driven with Handlebars)
  *
@@ -6,56 +5,49 @@
  * using content negotiation (Accept header).
  * Communicates with registry core via typed BsbRegistryClient.
  */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
+import * as path from 'path';
+import * as fs from 'node:fs';
+import * as fsp from 'node:fs/promises';
+import { pipeline } from 'node:stream/promises';
+import Fastify from 'fastify';
+import fastifyCors from '@fastify/cors';
+import fastifyMultipart from '@fastify/multipart';
+import fastifyStatic from '@fastify/static';
+import fastifyView from '@fastify/view';
+import handlebars from 'handlebars';
+import { marked } from 'marked';
+import * as av from '@anyvali/js';
+function objectSchema(shape) {
+    return av.object(shape, { unknownKeys: 'strip' });
+}
+function createValidator(schema, options) {
+    return {
+        safeParse(input) {
+            const normalized = options?.normalize ? options.normalize(input) : input;
+            const result = schema.safeParse(normalized);
+            if (!result.success) {
+                return result;
+            }
+            const extraIssues = options?.extraIssues?.(result.data) ?? [];
+            if (extraIssues.length > 0) {
+                return {
+                    success: false,
+                    issues: extraIssues,
+                };
+            }
+            return result;
+        },
     };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.RegistryUIServer = void 0;
-const path = __importStar(require("path"));
-const fs = __importStar(require("node:fs"));
-const fsp = __importStar(require("node:fs/promises"));
-const promises_1 = require("node:stream/promises");
-const fastify_1 = __importDefault(require("fastify"));
-const cors_1 = __importDefault(require("@fastify/cors"));
-const multipart_1 = __importDefault(require("@fastify/multipart"));
-const static_1 = __importDefault(require("@fastify/static"));
-const view_1 = __importDefault(require("@fastify/view"));
-const handlebars_1 = __importDefault(require("handlebars"));
-const marked_1 = require("marked");
-const zod_1 = require("zod");
+}
+function mapObjectInput(input, transform) {
+    if (typeof input !== 'object' || input === null || Array.isArray(input)) {
+        return input;
+    }
+    return transform({ ...input });
+}
+function emptyStringToUndefined(value) {
+    return value === '' ? undefined : value;
+}
 // ============================================================================
 // Zod Validation Schemas — all external input validated at the boundary
 // ============================================================================
@@ -70,149 +62,206 @@ const semverPattern = /^\d{1,5}\.\d{1,5}\.\d{1,5}(-[a-zA-Z0-9.]+)?$/;
 const majorMinorPattern = /^\d{1,5}\.\d{1,5}$/;
 // Package name: npm-style scoped or unscoped
 const packageNamePattern = /^(@[a-zA-Z0-9_-]+\/)?[a-zA-Z0-9._-]+$/;
-const slugField = zod_1.z.string().min(1).max(100).regex(slugPattern, 'Only alphanumeric, dash, underscore, dot, @, /');
-const semverField = zod_1.z.string().min(5).max(50).regex(semverPattern, 'Must be semver (e.g. 1.0.0)');
-const languageEnum = zod_1.z.enum(['nodejs', 'csharp', 'go', 'java', 'python']);
-const categoryEnum = zod_1.z.enum(['service', 'observable', 'events', 'config']);
-const visibilityEnum = zod_1.z.enum(['public', 'private']);
-const safeString = (max) => zod_1.z.string().max(max).regex(safeAscii, 'ASCII printable characters only');
-const safeStringRequired = (min, max) => zod_1.z.string().min(min).max(max).regex(safeAscii, 'ASCII printable characters only');
-const optionalNonEmpty = (schema) => zod_1.z.preprocess((value) => value === '' ? undefined : value, schema.optional());
+const slugField = av.string().minLength(1).maxLength(100).pattern(slugPattern.source);
+const semverField = av.string().minLength(5).maxLength(50).pattern(semverPattern.source);
+const languageEnum = av.enum_(['nodejs', 'csharp', 'go', 'java', 'python']);
+const categoryEnum = av.enum_(['service', 'observable', 'events', 'config']);
+const visibilityEnum = av.enum_(['public', 'private']);
+const safeString = (max) => av.string().maxLength(max).pattern(safeAscii.source);
+const safeStringRequired = (min, max) => av.string().minLength(min).maxLength(max).pattern(safeAscii.source);
 // ---- Route param schemas ----
-const OrgParamsSchema = zod_1.z.object({
+const OrgParamsSchema = createValidator(objectSchema({
     org: slugField,
-});
-const PluginDetailParamsSchema = zod_1.z.object({
+}));
+const PluginDetailParamsSchema = createValidator(objectSchema({
     org: slugField,
     name: slugField,
-});
-const PluginVersionParamsSchema = zod_1.z.object({
+}));
+const PluginVersionParamsSchema = createValidator(objectSchema({
     org: slugField,
     name: slugField,
     version: semverField,
-});
-const PluginTypesParamsSchema = zod_1.z.object({
+}));
+const PluginTypesParamsSchema = createValidator(objectSchema({
     org: slugField,
     name: slugField,
     version: semverField,
     language: languageEnum,
-});
+}));
 const packageLookupIdPattern = /^[A-Za-z0-9@._\-/:]+$/;
-const PackageLookupParamsSchema = zod_1.z.object({
+const PackageLookupParamsSchema = createValidator(objectSchema({
     language: languageEnum,
-    '*': zod_1.z.preprocess((value) => {
-        if (typeof value !== 'string')
+    '*': av.string().minLength(1).maxLength(300).pattern(packageLookupIdPattern.source),
+}), {
+    normalize: (input) => mapObjectInput(input, (value) => {
+        const packageId = value['*'];
+        if (typeof packageId !== 'string') {
             return value;
+        }
         try {
-            return decodeURIComponent(value).trim();
+            return {
+                ...value,
+                '*': decodeURIComponent(packageId).trim(),
+            };
         }
         catch {
-            return '__INVALID_PACKAGE_ID__';
+            return {
+                ...value,
+                '*': '__INVALID_PACKAGE_ID__',
+            };
         }
-    }, zod_1.z.string().min(1).max(300).regex(packageLookupIdPattern, 'Invalid package identifier')),
+    }),
 });
 // ---- Query string schemas ----
-// Note: z.coerce handles string-to-number conversion for query params
-const BrowseQuerySchema = zod_1.z.object({
-    page: zod_1.z.coerce.number().int().min(1).max(10000).optional(),
-    query: optionalNonEmpty(safeString(200)),
-    category: optionalNonEmpty(categoryEnum),
-    language: optionalNonEmpty(languageEnum),
-    limit: zod_1.z.coerce.number().int().min(1).max(100).optional(),
-    offset: zod_1.z.coerce.number().int().min(0).max(100000).optional(),
-}).passthrough(); // ignore unexpected query params (referrer tracking etc.)
-const VersionsQuerySchema = zod_1.z.object({
-    majorMinor: zod_1.z.string().max(11).regex(majorMinorPattern, 'Must be major.minor (e.g. 1.0)').optional(),
-}).passthrough();
-const MatchQuerySchema = zod_1.z.object({
-    version: zod_1.z.string().min(1).max(20).regex(safeAscii, 'ASCII only'),
-}).passthrough();
-const DocsQuerySchema = zod_1.z.object({
-    index: zod_1.z.coerce.number().int().min(0).max(100).optional(),
-}).passthrough();
+const BrowseQuerySchema = createValidator(objectSchema({
+    page: av.optional(av.int32().coerce({ from: 'string' }).min(1).max(10000)),
+    query: av.optional(safeString(200)),
+    category: av.optional(categoryEnum),
+    language: av.optional(languageEnum),
+    limit: av.optional(av.int32().coerce({ from: 'string' }).min(1).max(100)),
+    offset: av.optional(av.int32().coerce({ from: 'string' }).min(0).max(100000)),
+}), {
+    normalize: (input) => mapObjectInput(input, (value) => ({
+        ...value,
+        query: emptyStringToUndefined(value.query),
+        category: emptyStringToUndefined(value.category),
+        language: emptyStringToUndefined(value.language),
+    })),
+});
+const VersionsQuerySchema = createValidator(objectSchema({
+    majorMinor: av.optional(av.string().maxLength(11).pattern(majorMinorPattern.source)),
+}));
+const MatchQuerySchema = createValidator(objectSchema({
+    version: av.string().minLength(1).maxLength(20).pattern(safeAscii.source),
+}));
+const DocsQuerySchema = createValidator(objectSchema({
+    index: av.optional(av.int32().coerce({ from: 'string' }).min(0).max(100)),
+}));
 // ---- EventSchemaExport validation (parsed from the JSON string clients send) ----
-const EventExportEntryZod = zod_1.z.object({
-    type: zod_1.z.enum(['fire-and-forget', 'returnable', 'broadcast']),
-    category: zod_1.z.enum([
+const AnyValiDocumentSchema = av.record(av.unknown());
+const EventExportEntrySchema = objectSchema({
+    type: av.enum_(['fire-and-forget', 'returnable', 'broadcast']),
+    category: av.enum_([
         'emitEvents', 'onEvents',
         'emitReturnableEvents', 'onReturnableEvents',
         'emitBroadcast', 'onBroadcast',
     ]),
-    description: zod_1.z.string().max(1000).optional(),
-    defaultTimeout: zod_1.z.number().int().min(0).max(300).optional(),
-    inputSchema: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()),
-    outputSchema: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).nullable(),
-}).passthrough();
-const EventSchemaExportZod = zod_1.z.object({
+    description: av.optional(av.string().maxLength(1000)),
+    defaultTimeout: av.optional(av.int32().min(0).max(300)),
+    inputSchema: AnyValiDocumentSchema,
+    outputSchema: av.nullable(AnyValiDocumentSchema),
+});
+const EventSchemaExportObjectSchema = objectSchema({
     pluginName: safeStringRequired(1, 200),
     version: semverField,
-    events: zod_1.z.record(zod_1.z.string(), EventExportEntryZod).default({}),
-    capabilities: zod_1.z.unknown().optional(),
-    dependencies: zod_1.z.array(zod_1.z.object({
-        id: zod_1.z.string().min(1).max(200),
+    events: av.record(EventExportEntrySchema).default({}),
+    capabilities: av.optional(av.unknown()),
+    dependencies: av.optional(av.array(objectSchema({
+        id: av.string().minLength(1).maxLength(200),
         version: safeStringRequired(1, 50),
-    })).max(100).optional(),
-}).passthrough();
+    })).maxItems(100)),
+});
 // ---- Publish body schema ----
-const AuthorSchema = zod_1.z.union([
+const AuthorSchema = av.union([
     safeString(200),
-    zod_1.z.object({
+    objectSchema({
         name: safeStringRequired(1, 200),
-        email: zod_1.z.string().max(200).email().optional(),
-        url: zod_1.z.string().max(500).url().optional(),
-    }).strict(),
+        email: av.optional(av.string().maxLength(200).format('email')),
+        url: av.optional(av.string().maxLength(500).format('url')),
+    }),
 ]);
-const PublishBodySchema = zod_1.z.object({
-    org: zod_1.z.string().min(1).max(100).regex(slugPattern, 'Invalid org name'),
-    name: zod_1.z.string().min(1).max(100).regex(packageNamePattern, 'Invalid plugin name'),
+const PublishBodyObjectSchema = objectSchema({
+    org: av.string().minLength(1).maxLength(100).pattern(slugPattern.source),
+    name: av.string().minLength(1).maxLength(100).pattern(packageNamePattern.source),
     version: semverField,
     language: languageEnum,
-    metadata: zod_1.z.object({
+    metadata: objectSchema({
         displayName: safeStringRequired(1, 200),
-        description: zod_1.z.string().min(1).max(1000),
+        description: av.string().minLength(1).maxLength(1000),
         category: categoryEnum,
-        tags: zod_1.z.array(safeString(50)).max(30),
-        author: AuthorSchema.optional(),
-        license: safeString(50).optional(),
-        homepage: zod_1.z.string().max(500).url().optional(),
-        repository: zod_1.z.string().max(500).url().optional(),
-    }).strict(),
-    eventSchema: EventSchemaExportZod, // parsed object, validated at HTTP boundary
-    capabilities: zod_1.z.unknown().optional(),
-    configSchema: zod_1.z.object({
-        type: zod_1.z.literal('object'),
-        properties: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()),
-        required: zod_1.z.array(zod_1.z.string()).optional(),
-        description: zod_1.z.string().optional(),
-    }).passthrough().optional(),
-    typeDefinitions: zod_1.z.object({
-        nodejs: zod_1.z.string().max(5_000_000).optional(),
-        csharp: zod_1.z.string().max(5_000_000).optional(),
-        go: zod_1.z.string().max(5_000_000).optional(),
-        java: zod_1.z.string().max(5_000_000).optional(),
-    }).strict().optional(),
-    documentation: zod_1.z.array(zod_1.z.string().max(1_000_000)).min(1).max(20),
-    dependencies: zod_1.z.array(zod_1.z.object({
-        id: zod_1.z.string().min(1).max(200).regex(slugPattern, 'Invalid plugin ID'),
+        tags: av.array(safeString(50)).maxItems(30),
+        author: av.optional(AuthorSchema),
+        license: av.optional(safeString(50)),
+        homepage: av.optional(av.string().maxLength(500).format('url')),
+        repository: av.optional(av.string().maxLength(500).format('url')),
+    }),
+    eventSchema: EventSchemaExportObjectSchema,
+    capabilities: av.optional(av.unknown()),
+    configSchema: av.optional(AnyValiDocumentSchema),
+    typeDefinitions: av.optional(objectSchema({
+        nodejs: av.optional(av.string().maxLength(5_000_000)),
+        csharp: av.optional(av.string().maxLength(5_000_000)),
+        go: av.optional(av.string().maxLength(5_000_000)),
+        java: av.optional(av.string().maxLength(5_000_000)),
+    })),
+    documentation: av.array(av.string().maxLength(1_000_000)).minItems(1).maxItems(20),
+    dependencies: av.optional(av.array(objectSchema({
+        id: av.string().minLength(1).maxLength(200).pattern(slugPattern.source),
         version: safeStringRequired(1, 50),
-    }).strict()).max(100).optional(),
-    package: zod_1.z.object({
-        nodejs: safeString(200).optional(),
-        csharp: safeString(200).optional(),
-        go: safeString(200).optional(),
-        java: safeString(200).optional(),
-        python: safeString(200).optional(),
-    }).strict().optional(),
-    runtime: zod_1.z.object({
-        nodejs: safeString(50).optional(),
-        dotnet: safeString(50).optional(),
-        go: safeString(50).optional(),
-        java: safeString(50).optional(),
-        python: safeString(50).optional(),
-    }).strict().optional(),
-    visibility: visibilityEnum.optional(),
-}).strict();
-class RegistryUIServer {
+    })).maxItems(100)),
+    package: av.optional(objectSchema({
+        nodejs: av.optional(safeString(200)),
+        csharp: av.optional(safeString(200)),
+        go: av.optional(safeString(200)),
+        java: av.optional(safeString(200)),
+        python: av.optional(safeString(200)),
+    })),
+    runtime: av.optional(objectSchema({
+        nodejs: av.optional(safeString(50)),
+        dotnet: av.optional(safeString(50)),
+        go: av.optional(safeString(50)),
+        java: av.optional(safeString(50)),
+        python: av.optional(safeString(50)),
+    })),
+    visibility: av.optional(visibilityEnum),
+});
+function validateAnyValiDocument(value, path) {
+    if (!value || typeof value !== 'object') {
+        return [{
+                code: 'invalid_type',
+                message: 'Expected AnyVali document object',
+                path,
+                expected: 'object',
+                received: typeof value,
+            }];
+    }
+    try {
+        av.importSchema(value);
+        return [];
+    }
+    catch (error) {
+        const issues = error instanceof av.ValidationError
+            ? error.issues
+            : [{
+                    code: 'invalid_schema',
+                    message: error instanceof Error ? error.message : 'Invalid AnyVali document',
+                    path: [],
+                }];
+        return issues.map((issue) => ({
+            ...issue,
+            path: [...path, ...issue.path],
+        }));
+    }
+}
+function validateEventSchemaExportDocuments(value, path = []) {
+    const nestedIssues = [];
+    for (const [eventName, eventDef] of Object.entries(value.events)) {
+        nestedIssues.push(...validateAnyValiDocument(eventDef.inputSchema, [...path, 'events', eventName, 'inputSchema']));
+        if (eventDef.outputSchema !== null) {
+            nestedIssues.push(...validateAnyValiDocument(eventDef.outputSchema, [...path, 'events', eventName, 'outputSchema']));
+        }
+    }
+    return nestedIssues;
+}
+const PublishBodySchema = createValidator(PublishBodyObjectSchema, {
+    extraIssues: (value) => [
+        ...validateEventSchemaExportDocuments(value.eventSchema, ['eventSchema']),
+        ...(value.configSchema !== undefined
+            ? validateAnyValiDocument(value.configSchema, ['configSchema'])
+            : []),
+    ],
+});
+export class RegistryUIServer {
     app;
     port;
     host;
@@ -234,7 +283,7 @@ class RegistryUIServer {
         this.badgesFile = path.resolve(badgesFile);
         this.maxImageUploadBytes = maxImageUploadMb * 1024 * 1024;
         this.imageIndexPath = path.join(this.uploadDir, 'images.json');
-        this.app = (0, fastify_1.default)({
+        this.app = Fastify({
             logger: false,
             disableRequestLogging: true,
             bodyLimit: 10 * 1024 * 1024, // 10MB max request body
@@ -308,7 +357,7 @@ class RegistryUIServer {
     registerHandlebarsHelpers() {
         const helpers = this.getHandlebarsHelpers();
         for (const [name, fn] of Object.entries(helpers)) {
-            handlebars_1.default.registerHelper(name, fn);
+            handlebars.registerHelper(name, fn);
         }
     }
     async init(obs, plugin) {
@@ -320,7 +369,7 @@ class RegistryUIServer {
             this.pluginCwd = plugin.pluginCwd;
             // Register CORS
             const corsSpan = obs.startSpan('register.cors');
-            await this.app.register(cors_1.default, {
+            await this.app.register(fastifyCors, {
                 origin: '*',
                 methods: ['GET', 'POST', 'OPTIONS'],
                 allowedHeaders: ['Content-Type', 'Authorization', 'Accept'],
@@ -328,7 +377,7 @@ class RegistryUIServer {
             corsSpan.end();
             // Register multipart upload handling for plugin images
             const multipartSpan = obs.startSpan('register.multipart');
-            await this.app.register(multipart_1.default, {
+            await this.app.register(fastifyMultipart, {
                 limits: {
                     fileSize: this.maxImageUploadBytes,
                     files: 1,
@@ -342,13 +391,13 @@ class RegistryUIServer {
             // Register static file serving
             const staticSpan = obs.startSpan('register.static');
             const staticPath = path.join(plugin.pluginCwd, 'static');
-            await this.app.register(static_1.default, {
+            await this.app.register(fastifyStatic, {
                 root: staticPath,
                 prefix: '/static/',
                 index: false,
             });
             await fsp.mkdir(this.uploadDir, { recursive: true });
-            await this.app.register(static_1.default, {
+            await this.app.register(fastifyStatic, {
                 root: this.uploadDir,
                 prefix: '/images/',
                 decorateReply: false,
@@ -360,9 +409,9 @@ class RegistryUIServer {
             const viewSpan = obs.startSpan('register.handlebars');
             const templatesPath = path.join(plugin.pluginCwd, 'templates');
             obs.log.debug('Registering Handlebars templates from {path}', { path: templatesPath });
-            await this.app.register(view_1.default, {
+            await this.app.register(fastifyView, {
                 engine: {
-                    handlebars: handlebars_1.default,
+                    handlebars,
                 },
                 root: templatesPath,
                 layout: 'layouts/main.hbs',
@@ -546,24 +595,24 @@ class RegistryUIServer {
         return request.headers.accept?.includes('application/json') === true;
     }
     /**
-     * Validate input against a Zod schema. Returns parsed data on success,
+     * Validate input against an AnyVali-backed schema. Returns parsed data on success,
      * or sends a 400 response and returns null on failure.
      */
     validateInput(schema, data, reply) {
         const result = schema.safeParse(data);
-        if (!result.success) {
-            const issues = result.error.issues.map((issue) => ({
-                path: issue.path.join('.'),
-                message: issue.message,
-            }));
-            reply.code(400).send({
-                error: 'Validation Error',
-                code: 'INVALID_INPUT',
-                details: issues,
-            });
-            return null;
+        if (result.success) {
+            return result.data;
         }
-        return result.data;
+        const issues = result.issues.map((issue) => ({
+            path: issue.path.join('.'),
+            message: issue.message,
+        }));
+        reply.code(400).send({
+            error: 'Validation Error',
+            code: 'INVALID_INPUT',
+            details: issues,
+        });
+        return null;
     }
     /** Render an error page (HTML) or send JSON error depending on Accept header */
     async renderError(request, reply, statusCode, title, message) {
@@ -981,13 +1030,13 @@ a.s:hover{background:#333;border-color:#FB8C00}
      * External links open in a new tab. Raw HTML in the source is escaped.
      */
     renderMarkdown(md) {
-        const renderer = new marked_1.marked.Renderer();
+        const renderer = new marked.Renderer();
         // Open external links in new tab with noopener
         renderer.link = ({ href, title, text }) => {
             const titleAttr = title ? ` title="${title}"` : '';
             return `<a href="${href}"${titleAttr} target="_blank" rel="noopener noreferrer">${text}</a>`;
         };
-        return marked_1.marked.parse(md, {
+        return marked.parse(md, {
             renderer,
             gfm: true,
             breaks: false,
@@ -1718,7 +1767,7 @@ a.s:hover{background:#333;border-color:#FB8C00}
             const safeFileName = `${params.org}__${params.name}${ext}`;
             const outputPath = path.join(this.uploadDir, safeFileName);
             await fsp.mkdir(this.uploadDir, { recursive: true });
-            await (0, promises_1.pipeline)(filePart.file, fs.createWriteStream(outputPath));
+            await pipeline(filePart.file, fs.createWriteStream(outputPath));
             if (filePart.file.truncated) {
                 await fsp.unlink(outputPath).catch(() => { });
                 reply.code(413).send({
@@ -1833,5 +1882,4 @@ a.s:hover{background:#333;border-color:#FB8C00}
         this.app.close();
     }
 }
-exports.RegistryUIServer = RegistryUIServer;
 //# sourceMappingURL=http-server.js.map