@cervio/plugin-core 0.1.1 → 1.0.0

package/dist/index.js

@@ -1,22 +1,25 @@
-import { z } from 'zod';
-import JSZip from 'jszip';
+import { unzipSync, strFromU8, zipSync } from 'fflate';
 import { createHash } from 'crypto';
 import { promises } from 'fs';
 import path from 'path';
 
 // src/types.ts
-var PLUGIN_ARTIFACT_BUCKET = "plugin-artifacts";
 var MAX_PLUGIN_ZIP_BYTES = 50 * 1024 * 1024;
 var MAX_PLUGIN_ZIP_ENTRIES = 5e3;
 var MAX_PLUGIN_UNCOMPRESSED_BYTES = 250 * 1024 * 1024;
+var PLUGIN_ARTIFACT_SOFT_WARN_BYTES = 1 * 1024 * 1024;
+var PLUGIN_ARTIFACT_SOFT_STRONG_WARN_BYTES = 3 * 1024 * 1024;
 var PLUGIN_KEY_RE = /^[a-z0-9][a-z0-9-_]{1,62}$/;
-var PLUGIN_VERSION_SELECT = "id, plugin_id, version, changelog, artifact_path, artifact_entry_path, artifact_sha256, content_sha256, artifact_size_bytes, created_at, deleted_at, deleted_by";
 var DEFAULT_PLUGIN_DECLARABLE_CAPABILITIES = ["calendar"];
 
 // src/entity-requirements.ts
 var ENTITY_NAME_RE = /^[a-z][a-z0-9_-]{0,62}$/i;
 var FIELD_NAME_RE = /^[a-z][a-z0-9_]{0,62}$/i;
 var HTTP_METHODS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "*"]);
+var DECLARABLE_HTTP_METHODS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD"]);
+var CERVIO_API_PREFIX = "/api/v1/";
+var MAX_CERVIO_API_PREFIX_LEN = 256;
+var CERVIO_API_PREFIX_SAFE_RE = /^\/api\/v1\/[a-zA-Z0-9][a-zA-Z0-9._/-]{0,253}$/;
 function asStringArray(raw, nameRe) {
   if (!Array.isArray(raw)) return [];
   const out = [];
@@ -59,6 +62,61 @@ function parsePluginEntityRequirements(raw) {
   }
   return out;
 }
+function readCervioApiPath(row) {
+  return typeof row.path_prefix === "string" ? row.path_prefix.trim() : typeof row.pathPrefix === "string" ? row.pathPrefix.trim() : "";
+}
+function isDeclarableCervioApiPrefix(path2) {
+  if (!path2.startsWith(CERVIO_API_PREFIX)) return false;
+  if (path2.length > MAX_CERVIO_API_PREFIX_LEN) return false;
+  if (path2.includes("..") || path2.includes("//") || path2.includes("\\") || path2.includes("*") || path2.includes("?")) {
+    return false;
+  }
+  if (!CERVIO_API_PREFIX_SAFE_RE.test(path2.replace(/\/$/, "") || path2)) return false;
+  const rest = path2.slice(CERVIO_API_PREFIX.length);
+  const firstSeg = rest.split("/").filter(Boolean)[0]?.toLowerCase();
+  if (!firstSeg) return false;
+  if (firstSeg === "admin") return false;
+  return true;
+}
+function isDeclarableCervioApiRequirement(row) {
+  return DECLARABLE_HTTP_METHODS.has(row.method.toUpperCase()) && isDeclarableCervioApiPrefix(row.path_prefix);
+}
+function pathMatchesCervioApiPrefix(pathname, prefix) {
+  if (!prefix.startsWith("/") || prefix.includes("..") || prefix.includes("//")) return false;
+  if (pathname === prefix) return true;
+  if (prefix.endsWith("/")) return pathname.startsWith(prefix);
+  return pathname.startsWith(`${prefix}/`);
+}
+function isDeclaredCervioApiRequest(method, pathname, declared) {
+  const m = method.trim().toUpperCase();
+  if (!declared.length) return false;
+  for (const row of declared) {
+    const declaredMethod = row.method.trim().toUpperCase();
+    const methodOk = declaredMethod === m || declaredMethod === "*" || m === "HEAD" && declaredMethod === "GET";
+    if (!methodOk) continue;
+    if (pathMatchesCervioApiPrefix(pathname, row.path_prefix)) return true;
+  }
+  return false;
+}
+function validatePluginCervioApiRequirements(raw) {
+  if (raw == null) return { ok: true, value: [] };
+  if (!Array.isArray(raw)) return { ok: false, error: "manifest_cervio_apis_not_declarable" };
+  for (const item of raw) {
+    if (!item || typeof item !== "object") continue;
+    const row = item;
+    const path2 = readCervioApiPath(row);
+    if (!path2) continue;
+    if (!path2.startsWith("/")) continue;
+    const methodRaw = typeof row.method === "string" ? row.method.trim().toUpperCase() : "GET";
+    if (!DECLARABLE_HTTP_METHODS.has(methodRaw)) {
+      return { ok: false, error: "manifest_cervio_apis_not_declarable" };
+    }
+    if (!isDeclarableCervioApiPrefix(path2)) {
+      return { ok: false, error: "manifest_cervio_apis_not_declarable" };
+    }
+  }
+  return { ok: true, value: parsePluginCervioApiRequirements(raw) };
+}
 function parsePluginCervioApiRequirements(raw) {
   if (!Array.isArray(raw)) return [];
   const out = [];
@@ -68,7 +126,7 @@ function parsePluginCervioApiRequirements(raw) {
     const row = item;
     const methodRaw = typeof row.method === "string" ? row.method.trim().toUpperCase() : "GET";
     const method = HTTP_METHODS.has(methodRaw) ? methodRaw : "GET";
-    const path2 = typeof row.path_prefix === "string" ? row.path_prefix.trim() : typeof row.pathPrefix === "string" ? row.pathPrefix.trim() : "";
+    const path2 = readCervioApiPath(row);
     if (!path2 || !path2.startsWith("/")) continue;
     const key = `${method}:${path2}`;
     if (seen.has(key)) continue;
@@ -78,6 +136,152 @@ function parsePluginCervioApiRequirements(raw) {
   return out;
 }
 
+// src/boot-requests.ts
+var MAX_PLUGIN_BOOT_REQUESTS = 8;
+var MAX_BOOT_PATH_LEN = 400;
+function bootRequestPathname(path2) {
+  if (typeof path2 !== "string") return null;
+  const p = path2.trim();
+  if (!p.startsWith("/api/v1/") || p.length > MAX_BOOT_PATH_LEN || p.includes("#")) return null;
+  const pathname = p.split("?")[0] ?? "";
+  if (!isDeclarableCervioApiPrefix(pathname)) return null;
+  return pathname;
+}
+function validatePluginBootRequests(raw, cervioApis) {
+  if (raw == null) return { ok: true, value: [] };
+  if (!Array.isArray(raw)) return { ok: false, error: "manifest_boot_requests_invalid" };
+  if (raw.length > MAX_PLUGIN_BOOT_REQUESTS) return { ok: false, error: "manifest_boot_requests_too_many" };
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const item of raw) {
+    const path2 = item && typeof item === "object" ? item.path : void 0;
+    const pathname = typeof path2 === "string" ? bootRequestPathname(path2) : null;
+    if (!pathname) return { ok: false, error: "manifest_boot_requests_invalid" };
+    if (!isDeclaredCervioApiRequest("GET", pathname, cervioApis)) {
+      return { ok: false, error: "manifest_boot_requests_not_declared" };
+    }
+    const p = path2.trim();
+    if (seen.has(p)) continue;
+    seen.add(p);
+    out.push({ path: p });
+  }
+  return { ok: true, value: out };
+}
+function parsePluginBootRequests(raw) {
+  if (!Array.isArray(raw)) return [];
+  const out = [];
+  for (const item of raw.slice(0, MAX_PLUGIN_BOOT_REQUESTS)) {
+    const path2 = item && typeof item === "object" ? item.path : void 0;
+    if (typeof path2 === "string" && bootRequestPathname(path2)) out.push({ path: path2.trim() });
+  }
+  return out;
+}
+var MAX_COMPRESSION_RATIO = 100;
+var RATIO_CHECK_FROM_BYTES = 1024 * 1024;
+function checkEntry(entry) {
+  const { name, size, originalSize } = entry;
+  if (name.includes("..") || name.includes("\\") || name.startsWith("/")) {
+    return "zip_unsafe_entry_path";
+  }
+  if (/\.zip$/i.test(name)) return "zip_nested_archive";
+  if (originalSize > RATIO_CHECK_FROM_BYTES) {
+    if (size === 0 || originalSize / size > MAX_COMPRESSION_RATIO) {
+      return "zip_compression_ratio_too_high";
+    }
+  }
+  return null;
+}
+async function readPluginZip(data) {
+  const input = data instanceof Uint8Array ? data : new Uint8Array(data);
+  if (input.byteLength > MAX_PLUGIN_ZIP_BYTES) return { ok: false, error: "file_too_large" };
+  let error = null;
+  let entries = 0;
+  let declaredTotal = 0;
+  let files;
+  try {
+    files = unzipSync(input, {
+      filter: (entry) => {
+        if (error) return false;
+        entries += 1;
+        if (entries > MAX_PLUGIN_ZIP_ENTRIES) {
+          error = "zip_too_many_entries";
+          return false;
+        }
+        error = checkEntry(entry);
+        if (error) return false;
+        if (entry.name.endsWith("/")) return false;
+        declaredTotal += entry.originalSize;
+        if (declaredTotal > MAX_PLUGIN_UNCOMPRESSED_BYTES) {
+          error = "zip_uncompressed_too_large";
+          return false;
+        }
+        return true;
+      }
+    });
+  } catch {
+    files = null;
+  }
+  if (error) return { ok: false, error };
+  if (!files) return { ok: false, error: "zip_invalid" };
+  let actualTotal = 0;
+  for (const bytes of Object.values(files)) actualTotal += bytes.byteLength;
+  if (actualTotal > MAX_PLUGIN_UNCOMPRESSED_BYTES) {
+    return { ok: false, error: "zip_uncompressed_too_large" };
+  }
+  const paths = Object.keys(files);
+  return {
+    ok: true,
+    value: {
+      paths,
+      bytes: (path2) => files[path2],
+      text: (path2) => {
+        const bytes = files[path2];
+        return bytes === void 0 ? void 0 : strFromU8(bytes);
+      }
+    }
+  };
+}
+function assertZipFile(file) {
+  const name = (file.name ?? "upload.zip").toLowerCase();
+  if (!name.endsWith(".zip")) return { ok: false, error: "invalid_file_extension" };
+  if (file.size <= 0) return { ok: false, error: "empty_file" };
+  if (file.size > MAX_PLUGIN_ZIP_BYTES) return { ok: false, error: "file_too_large" };
+  return { ok: true, value: true };
+}
+
+// src/semver.ts
+var CORE_SEMVER_RE = /^(\d+)\.(\d+)\.(\d+)/;
+function nextPatchVersion(latest) {
+  if (!latest || typeof latest !== "string") return "0.1.0";
+  const m = latest.trim().match(CORE_SEMVER_RE);
+  if (!m) return "0.1.0";
+  const major = Number(m[1]);
+  const minor = Number(m[2]);
+  const patch = Number(m[3]);
+  if (![major, minor, patch].every((n) => Number.isFinite(n) && n >= 0)) return "0.1.0";
+  return `${major}.${minor}.${patch + 1}`;
+}
+function compareSemverDesc(a, b) {
+  const pa = a.match(CORE_SEMVER_RE);
+  const pb = b.match(CORE_SEMVER_RE);
+  if (!pa && !pb) return 0;
+  if (!pa) return 1;
+  if (!pb) return -1;
+  for (let i = 1; i <= 3; i++) {
+    const da = Number(pa[i]) - Number(pb[i]);
+    if (da !== 0) return da > 0 ? -1 : 1;
+  }
+  return 0;
+}
+
+// src/policy-types.ts
+function isPolicyPluginType(t) {
+  return t === "policy" || t === "server";
+}
+function normalizeToPolicyPluginType(t) {
+  return isPolicyPluginType(t) ? "policy" : null;
+}
+
 // src/connections.ts
 var EXTERNAL_CONNECTION_ALLOWED_HOSTS = {
   microsoft: ["graph.microsoft.com"],
@@ -178,102 +382,91 @@ function parsePluginConnections(raw) {
   return out;
 }
 
-// src/zip-safety.ts
-function assertZipSafe(zip) {
-  const names = Object.keys(zip.files);
-  if (names.length > MAX_PLUGIN_ZIP_ENTRIES) {
-    return { ok: false, error: "zip_too_many_entries" };
-  }
-  let totalUncompressed = 0;
-  for (const name of names) {
-    if (name.includes("..") || name.includes("\\") || name.startsWith("/")) {
-      return { ok: false, error: "zip_unsafe_entry_path" };
-    }
-    const entry = zip.files[name];
-    totalUncompressed += entry._data?.uncompressedSize ?? 0;
-    if (totalUncompressed > MAX_PLUGIN_UNCOMPRESSED_BYTES) {
-      return { ok: false, error: "zip_uncompressed_too_large" };
-    }
+// src/settings-requirements.ts
+var SETTINGS_KEY_RE = /^[a-z][a-z0-9_]{0,62}$/i;
+var SETTINGS_TYPES = /* @__PURE__ */ new Set(["string", "boolean", "select", "multiselect"]);
+var RESERVED_SETTINGS_KEYS = /* @__PURE__ */ new Set(["debug"]);
+function parseOptions(raw) {
+  if (!Array.isArray(raw)) return [];
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const item of raw) {
+    if (!item || typeof item !== "object") continue;
+    const row = item;
+    const value = typeof row.value === "string" ? row.value.trim() : "";
+    const label = typeof row.label === "string" ? row.label.trim() : "";
+    if (!value || !label || seen.has(value)) continue;
+    seen.add(value);
+    out.push({ value, label });
   }
-  return { ok: true, value: true };
+  return out;
 }
-function assertZipFile(file) {
-  const name = (file.name ?? "upload.zip").toLowerCase();
-  if (!name.endsWith(".zip")) return { ok: false, error: "invalid_file_extension" };
-  if (file.size <= 0) return { ok: false, error: "empty_file" };
-  if (file.size > MAX_PLUGIN_ZIP_BYTES) return { ok: false, error: "file_too_large" };
-  return { ok: true, value: true };
+function parseDefault(raw, type, options) {
+  const allowedValues = new Set(options.map((o) => o.value));
+  if (type === "boolean") return typeof raw === "boolean" ? raw : void 0;
+  if (type === "string") return typeof raw === "string" ? raw : void 0;
+  if (type === "select") {
+    return typeof raw === "string" && allowedValues.has(raw) ? raw : void 0;
+  }
+  if (type === "multiselect") {
+    if (!Array.isArray(raw)) return void 0;
+    const values = raw.filter((v) => typeof v === "string" && allowedValues.has(v));
+    return values.length ? values : void 0;
+  }
+  return void 0;
 }
-
-// src/semver.ts
-var CORE_SEMVER_RE = /^(\d+)\.(\d+)\.(\d+)/;
-function nextPatchVersion(latest) {
-  if (!latest || typeof latest !== "string") return "0.1.0";
-  const m = latest.trim().match(CORE_SEMVER_RE);
-  if (!m) return "0.1.0";
-  const major = Number(m[1]);
-  const minor = Number(m[2]);
-  const patch = Number(m[3]);
-  if (![major, minor, patch].every((n) => Number.isFinite(n) && n >= 0)) return "0.1.0";
-  return `${major}.${minor}.${patch + 1}`;
+function parsePluginSettingsRequirements(raw) {
+  if (!Array.isArray(raw)) return [];
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const item of raw) {
+    if (!item || typeof item !== "object") continue;
+    const row = item;
+    const key = typeof row.key === "string" ? row.key.trim() : "";
+    if (!key || !SETTINGS_KEY_RE.test(key) || seen.has(key) || RESERVED_SETTINGS_KEYS.has(key)) continue;
+    const type = typeof row.type === "string" ? row.type.trim() : null;
+    if (!type || !SETTINGS_TYPES.has(type)) continue;
+    const label = typeof row.label === "string" ? row.label.trim() : "";
+    if (!label) continue;
+    const options = parseOptions(row.options);
+    if ((type === "select" || type === "multiselect") && options.length === 0) continue;
+    const hint = typeof row.hint === "string" && row.hint.trim() ? row.hint.trim() : void 0;
+    const placeholder = typeof row.placeholder === "string" && row.placeholder.trim() ? row.placeholder.trim() : void 0;
+    const defaultValue = parseDefault(row.default, type, options);
+    seen.add(key);
+    const field = { key, type, label };
+    if (hint) field.hint = hint;
+    if (placeholder) field.placeholder = placeholder;
+    if (defaultValue !== void 0) field.default = defaultValue;
+    if (options.length) field.options = options;
+    out.push(field);
+  }
+  return out;
 }
-function compareSemverDesc(a, b) {
-  const pa = a.match(CORE_SEMVER_RE);
-  const pb = b.match(CORE_SEMVER_RE);
-  if (!pa && !pb) return 0;
-  if (!pa) return 1;
-  if (!pb) return -1;
-  for (let i = 1; i <= 3; i++) {
-    const da = Number(pa[i]) - Number(pb[i]);
-    if (da !== 0) return da > 0 ? -1 : 1;
+
+// src/policy-entry.ts
+var BARE_IMPORT_RE = /(?:from|import)\s*\(\s*['"](?![./]|data:)([^'"]+)['"]\s*\)|(?:from|import)\s+['"](?![./]|data:)([^'"]+)['"]/g;
+function findBareModuleSpecifiers(source) {
+  const found = /* @__PURE__ */ new Set();
+  for (const match of source.matchAll(BARE_IMPORT_RE)) {
+    const spec = (match[1] || match[2] || "").trim();
+    if (spec) found.add(spec);
   }
-  return 0;
+  return [...found];
 }
-var pluginManifestZodSchema = z.object({
-  plugin_key: z.string().regex(/^[a-z0-9][a-z0-9-_]{1,62}$/).optional().describe("Stable plugin id. Prefer this over legacy `id`."),
-  id: z.string().optional().describe("Legacy alias for plugin_key (slashes become dashes)."),
-  plugin_name: z.string().optional(),
-  name: z.string().optional().describe("Legacy alias for plugin_name."),
-  plugin_type: z.enum(["task", "form", "task_form", "route"]).optional(),
-  kind: z.string().optional().describe("Legacy alias for plugin_type (task_widget\u2192task, record_panel\u2192form)."),
-  version: z.string().optional().describe("Ignored by Cervio \u2014 the host assigns release versions."),
-  required_connection_capabilities: z.array(z.string()).optional(),
-  requiredConnectionCapabilities: z.array(z.string()).optional(),
-  connections: z.array(
-    z.object({
-      id: z.string(),
-      provider: z.string(),
-      scopes: z.array(z.string()),
-      allowed_apis: z.array(
-        z.object({
-          host: z.string(),
-          methods: z.array(z.string()),
-          path_prefix: z.string().optional(),
-          pathPrefix: z.string().optional()
-        })
-      ).optional(),
-      allowedApis: z.array(z.unknown()).optional()
-    })
-  ).optional(),
-  entities: z.array(
-    z.object({
-      name: z.string(),
-      fields: z.array(z.string()).optional(),
-      forms: z.array(z.string()).optional(),
-      access: z.array(z.enum(["read", "write"])).optional()
-    })
-  ).optional(),
-  cervio_apis: z.array(
-    z.object({
-      method: z.string().optional(),
-      path_prefix: z.string().optional(),
-      pathPrefix: z.string().optional()
-    })
-  ).optional(),
-  cervioApis: z.array(z.unknown()).optional()
-}).passthrough();
+function assertPolicyEntrySelfContained(source) {
+  const specifiers = findBareModuleSpecifiers(source);
+  if (specifiers.length === 0) return { ok: true };
+  return {
+    ok: false,
+    error: "policy_entry_not_self_contained",
+    specifiers
+  };
+}
+
+// src/manifest.ts
 function normalizePluginKey(raw) {
-  return raw.trim().toLowerCase().replace(/[\/\s]+/g, "-").replace(/[^a-z0-9-_]/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "");
+  return raw.trim().toLowerCase().replace(/[/\s]+/g, "-").replace(/[^a-z0-9-_]/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "");
 }
 function resolvePluginType(raw) {
   const kindMap = {
@@ -281,11 +474,16 @@ function resolvePluginType(raw) {
     task: "task",
     form: "form",
     task_form: "task_form",
+    // Legacy wire → canonical Policy Plugin type
+    server: "policy",
+    policy: "policy",
     task_widget: "task",
     record_panel: "form"
   };
   const candidate = kindMap[raw] ?? raw;
-  return ["task", "form", "task_form", "route"].includes(candidate) ? candidate : null;
+  return ["task", "form", "task_form", "route", "policy", "server"].includes(
+    candidate
+  ) ? candidate : null;
 }
 function parseRequiredCapabilities(raw, allowed) {
   if (!Array.isArray(raw)) return [];
@@ -319,9 +517,15 @@ function parseManifestObject(parsed, options) {
   );
   const connections = parsePluginConnections(parsed.connections);
   const entities = parsePluginEntityRequirements(parsed.entities);
-  const cervioApis = parsePluginCervioApiRequirements(
+  const cervioApisRes = validatePluginCervioApiRequirements(
     parsed.cervio_apis ?? parsed.cervioApis ?? []
   );
+  if (!cervioApisRes.ok) return cervioApisRes;
+  const cervioApis = cervioApisRes.value;
+  const settings = parsePluginSettingsRequirements(parsed.settings);
+  const bootRequestsRes = validatePluginBootRequests(parsed.boot_requests, cervioApis);
+  if (!bootRequestsRes.ok) return bootRequestsRes;
+  const bootRequests = bootRequestsRes.value;
   return {
     ok: true,
     value: {
@@ -332,7 +536,9 @@ function parseManifestObject(parsed, options) {
       requiredConnectionCapabilities,
       connections,
       entities,
-      cervioApis
+      cervioApis,
+      settings,
+      bootRequests
     }
   };
 }
@@ -341,26 +547,14 @@ function manifestJsonForContentHash(raw) {
   delete clone.version;
   return JSON.stringify(clone);
 }
-async function loadZipFromBuffer(buffer) {
-  try {
-    const zip = await JSZip.loadAsync(buffer);
-    const safe = assertZipSafe(zip);
-    if (!safe.ok) return safe;
-    return { ok: true, value: zip };
-  } catch {
-    return { ok: false, error: "zip_invalid" };
-  }
-}
 async function parseZipManifest(file, options) {
-  const buffer = await file.arrayBuffer();
-  const zipRes = await loadZipFromBuffer(buffer);
+  const zipRes = await readPluginZip(file instanceof Blob ? await file.arrayBuffer() : file);
   if (!zipRes.ok) return zipRes;
   const zip = zipRes.value;
-  const manifestEntry = zip.file("manifest.json") ?? zip.file("manifest.example.json") ?? Object.values(zip.files).find(
-    (f) => f.name.endsWith("/manifest.json") || f.name.endsWith("/manifest.example.json")
-  );
-  if (!manifestEntry) return { ok: false, error: "manifest_not_found_in_zip" };
-  const jsonText = await manifestEntry.async("text");
+  const has = (path2) => zip.bytes(path2) !== void 0;
+  const manifestEntryName = ["manifest.json", "manifest.example.json"].find(has) ?? zip.paths.find((p) => p.endsWith("/manifest.json") || p.endsWith("/manifest.example.json"));
+  if (!manifestEntryName) return { ok: false, error: "manifest_not_found_in_zip" };
+  const jsonText = zip.text(manifestEntryName) ?? "";
   let parsed;
   try {
     parsed = JSON.parse(jsonText);
@@ -369,36 +563,51 @@ async function parseZipManifest(file, options) {
   }
   const fields = parseManifestObject(parsed, options);
   if (!fields.ok) return fields;
-  const hasDistIndex = !!zip.file("dist/index.html");
-  if (!hasDistIndex) return { ok: false, error: "build_index_missing" };
-  const hasDistAssets = Object.keys(zip.files).some((name) => /^dist\/assets\/.+/.test(name));
-  if (!hasDistAssets) return { ok: false, error: "build_assets_missing" };
+  const isPolicy = isPolicyPluginType(fields.value.pluginType);
+  if (!isPolicy) {
+    if (!has("dist/index.html")) return { ok: false, error: "build_index_missing" };
+    const hasDistAssets = zip.paths.some((name) => /^dist\/assets\/.+/.test(name));
+    if (!hasDistAssets) return { ok: false, error: "build_assets_missing" };
+  }
+  const entryFromHooks = isPolicy && Array.isArray(parsed.hooks) ? (() => {
+    for (const h of parsed.hooks) {
+      if (typeof h?.entry === "string" && h.entry.trim()) return h.entry.trim();
+    }
+    return null;
+  })() : null;
+  const artifactEntryPath = isPolicy ? entryFromHooks || "server/index.js" : "dist/index.html";
+  if (isPolicy) {
+    const entryName = [artifactEntryPath, artifactEntryPath.replace(/^\//, "")].find(has) ?? zip.paths.find((p) => p.endsWith(`/${artifactEntryPath}`));
+    if (!entryName) return { ok: false, error: "manifest_not_found_in_zip" };
+    const entrySource = zip.text(entryName) ?? "";
+    const selfContained = assertPolicyEntrySelfContained(entrySource);
+    if (!selfContained.ok) {
+      return {
+        ok: false,
+        error: `${selfContained.error}:${selfContained.specifiers.join(",")}`
+      };
+    }
+  }
   return {
     ok: true,
     value: {
       ...fields.value,
-      artifactEntryPath: "dist/index.html",
+      artifactEntryPath,
       rawManifest: parsed,
-      manifestEntryName: manifestEntry.name
+      manifestEntryName
     }
   };
 }
-async function computePluginContentSha256(zip, rawManifest) {
+function computePluginContentSha256(zip, rawManifest) {
   try {
     const hash = createHash("sha256");
     hash.update("manifest\0");
     hash.update(manifestJsonForContentHash(rawManifest));
     hash.update("\0");
-    const distPaths = Object.keys(zip.files).filter((name) => {
-      const entry = zip.files[name];
-      if (!entry || entry.dir) return false;
-      const normalized = name.replace(/^\.\//, "");
-      return normalized === "dist" || normalized.startsWith("dist/");
-    }).map((name) => name.replace(/^\.\//, "")).sort((a, b) => a.localeCompare(b));
-    for (const path2 of distPaths) {
-      const entry = zip.file(path2);
-      if (!entry || entry.dir) continue;
-      const bytes = await entry.async("uint8array");
+    const distPaths = zip.paths.map((name) => ({ name, normalized: name.replace(/^\.\//, "") })).filter(({ normalized }) => normalized === "dist" || normalized.startsWith("dist/")).sort((a, b) => a.normalized.localeCompare(b.normalized));
+    for (const { name, normalized: path2 } of distPaths) {
+      const bytes = zip.bytes(name);
+      if (!bytes) continue;
       hash.update("file\0");
       hash.update(path2);
       hash.update("\0");
@@ -413,6 +622,7 @@ async function computePluginContentSha256(zip, rawManifest) {
 function sha256Hex(buffer) {
   return createHash("sha256").update(buffer).digest("hex");
 }
+var ZIP_MTIME = /* @__PURE__ */ new Date("2000-01-01T00:00:00Z");
 async function collectFiles(dir, base = "") {
   const entries = await promises.readdir(dir, { withFileTypes: true });
   const out = [];
@@ -439,14 +649,46 @@ async function packPlugin(opts) {
   }
   const fields = parseManifestObject(manifestRaw, opts.options);
   if (!fields.ok) return fields;
-  const distIndex = path.join(root, "dist", "index.html");
-  try {
-    await promises.access(distIndex);
-  } catch {
-    return { ok: false, error: "build_index_missing" };
+  const isPolicy = isPolicyPluginType(fields.value.pluginType);
+  if (!isPolicy) {
+    const distIndex = path.join(root, "dist", "index.html");
+    try {
+      await promises.access(distIndex);
+    } catch {
+      return { ok: false, error: "build_index_missing" };
+    }
+  } else {
+    const entry = (Array.isArray(manifestRaw.hooks) ? manifestRaw.hooks.find((h) => h?.entry)?.entry : null) || "server/index.js";
+    const entryAbs = path.join(
+      /*turbopackIgnore: true*/
+      root,
+      entry
+    );
+    try {
+      await promises.access(entryAbs);
+    } catch {
+      return { ok: false, error: "manifest_not_found_in_zip" };
+    }
+    let entrySource;
+    try {
+      entrySource = await promises.readFile(
+        /*turbopackIgnore: true*/
+        entryAbs,
+        "utf8"
+      );
+    } catch {
+      return { ok: false, error: "manifest_not_found_in_zip" };
+    }
+    const selfContained = assertPolicyEntrySelfContained(entrySource);
+    if (!selfContained.ok) {
+      return {
+        ok: false,
+        error: `${selfContained.error}:${selfContained.specifiers.join(",")}`
+      };
+    }
   }
-  const zip = new JSZip();
-  const files = await collectFiles(root);
+  const entries = {};
+  const files = (await collectFiles(root)).sort((a, b) => a.rel.localeCompare(b.rel));
   let hasAssets = false;
   for (const file of files) {
     if (file.rel.startsWith(".cervio/") || file.rel === "node_modules" || file.rel.startsWith("node_modules/")) {
@@ -455,18 +697,15 @@ async function packPlugin(opts) {
     if (file.rel.startsWith("dist/assets/") && file.rel !== "dist/assets/") {
       hasAssets = true;
     }
-    const data = await promises.readFile(file.abs);
-    zip.file(file.rel, data);
+    entries[file.rel] = new Uint8Array(await promises.readFile(file.abs));
   }
-  if (!hasAssets) return { ok: false, error: "build_assets_missing" };
-  const safe = assertZipSafe(zip);
-  if (!safe.ok) return safe;
-  const buffer = Buffer.from(await zip.generateAsync({ type: "uint8array", compression: "DEFLATE" }));
+  if (!isPolicy && !hasAssets) return { ok: false, error: "build_assets_missing" };
+  const buffer = Buffer.from(zipSync(entries, { level: 6, mtime: ZIP_MTIME }));
   const fileCheck = assertZipFile({ name: `${fields.value.pluginKey}.zip`, size: buffer.length });
   if (!fileCheck.ok) return fileCheck;
-  const loaded = await loadZipFromBuffer(buffer);
+  const loaded = await readPluginZip(buffer);
   if (!loaded.ok) return loaded;
-  const hash = await computePluginContentSha256(loaded.value, manifestRaw);
+  const hash = computePluginContentSha256(loaded.value, manifestRaw);
   if (!hash.ok) return hash;
   return {
     ok: true,
@@ -481,8 +720,7 @@ async function packPlugin(opts) {
 async function validatePluginDir(dir, options) {
   const packed = await packPlugin({ dir, options });
   if (!packed.ok) return packed;
-  const blob = new Blob([packed.value.buffer], { type: "application/zip" });
-  const parsed = await parseZipManifest(blob, options);
+  const parsed = await parseZipManifest(packed.value.buffer, options);
   if (!parsed.ok) return parsed;
   return {
     ok: true,
@@ -495,12 +733,11 @@ async function validatePluginDir(dir, options) {
 async function validatePluginZipBuffer(buffer, options) {
   const fileCheck = assertZipFile({ name: "plugin.zip", size: buffer.length });
   if (!fileCheck.ok) return fileCheck;
-  const blob = new Blob([buffer], { type: "application/zip" });
-  const parsed = await parseZipManifest(blob, options);
+  const parsed = await parseZipManifest(buffer, options);
   if (!parsed.ok) return parsed;
-  const zipRes = await loadZipFromBuffer(buffer);
+  const zipRes = await readPluginZip(buffer);
   if (!zipRes.ok) return zipRes;
-  const hash = await computePluginContentSha256(zipRes.value, parsed.value.rawManifest);
+  const hash = computePluginContentSha256(zipRes.value, parsed.value.rawManifest);
   if (!hash.ok) return hash;
   return {
     ok: true,
@@ -508,6 +745,4 @@ async function validatePluginZipBuffer(buffer, options) {
   };
 }
 
-export { DEFAULT_PLUGIN_DECLARABLE_CAPABILITIES, EXTERNAL_CONNECTION_ALLOWED_HOSTS, EXTERNAL_CONNECTION_HTTP_METHODS, MAX_PLUGIN_UNCOMPRESSED_BYTES, MAX_PLUGIN_ZIP_BYTES, MAX_PLUGIN_ZIP_ENTRIES, OAUTH_PROVIDER_KEY_RE, PLUGIN_ARTIFACT_BUCKET, PLUGIN_KEY_RE, PLUGIN_VERSION_SELECT, assertZipFile, assertZipSafe, compareSemverDesc, computePluginContentSha256, isExternalConnectionProvider, loadZipFromBuffer, manifestJsonForContentHash, nextPatchVersion, normalizeExactApiHost, normalizePluginKey, packPlugin, parseManifestObject, parsePluginCervioApiRequirements, parsePluginConnections, parsePluginEntityRequirements, parseZipManifest, pluginManifestZodSchema, sha256Hex, validatePluginDir, validatePluginZipBuffer };
-//# sourceMappingURL=index.js.map
-//# sourceMappingURL=index.js.map
+export { DEFAULT_PLUGIN_DECLARABLE_CAPABILITIES, MAX_PLUGIN_UNCOMPRESSED_BYTES, MAX_PLUGIN_ZIP_BYTES, MAX_PLUGIN_ZIP_ENTRIES, PLUGIN_ARTIFACT_SOFT_STRONG_WARN_BYTES, PLUGIN_ARTIFACT_SOFT_WARN_BYTES, PLUGIN_KEY_RE, assertZipFile, compareSemverDesc, computePluginContentSha256, isDeclarableCervioApiRequirement, isDeclaredCervioApiRequest, isPolicyPluginType, manifestJsonForContentHash, nextPatchVersion, normalizePluginKey, normalizeToPolicyPluginType, packPlugin, parseManifestObject, parsePluginBootRequests, parsePluginCervioApiRequirements, parsePluginEntityRequirements, parseZipManifest, readPluginZip, sha256Hex, validatePluginDir, validatePluginZipBuffer };