@cervio/plugin-core 0.1.4 → 1.0.1

package/dist/index.cjs

@@ -1,736 +0,0 @@
-'use strict';
-
-var zod = require('zod');
-var JSZip = require('jszip');
-var crypto = require('crypto');
-var fs = require('fs');
-var path = require('path');
-
-function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
-
-var JSZip__default = /*#__PURE__*/_interopDefault(JSZip);
-var path__default = /*#__PURE__*/_interopDefault(path);
-
-// src/types.ts
-var PLUGIN_ARTIFACT_BUCKET = "plugin-artifacts";
-var MAX_PLUGIN_ZIP_BYTES = 50 * 1024 * 1024;
-var MAX_PLUGIN_ZIP_ENTRIES = 5e3;
-var MAX_PLUGIN_UNCOMPRESSED_BYTES = 250 * 1024 * 1024;
-var PLUGIN_KEY_RE = /^[a-z0-9][a-z0-9-_]{1,62}$/;
-var PLUGIN_VERSION_SELECT = "id, plugin_id, version, changelog, artifact_path, artifact_entry_path, artifact_sha256, content_sha256, artifact_size_bytes, created_at, deleted_at, deleted_by";
-var DEFAULT_PLUGIN_DECLARABLE_CAPABILITIES = ["calendar"];
-
-// src/entity-requirements.ts
-var ENTITY_NAME_RE = /^[a-z][a-z0-9_-]{0,62}$/i;
-var FIELD_NAME_RE = /^[a-z][a-z0-9_]{0,62}$/i;
-var HTTP_METHODS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "*"]);
-function asStringArray(raw, nameRe) {
-  if (!Array.isArray(raw)) return [];
-  const out = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const item of raw) {
-    if (typeof item !== "string") continue;
-    const v = item.trim();
-    if (!v || !nameRe.test(v) || seen.has(v)) continue;
-    seen.add(v);
-    out.push(v);
-  }
-  return out;
-}
-function parseAccess(raw) {
-  if (!Array.isArray(raw)) return ["read"];
-  const out = [];
-  for (const item of raw) {
-    if (item === "read" || item === "write") {
-      if (!out.includes(item)) out.push(item);
-    }
-  }
-  return out.length ? out : ["read"];
-}
-function parsePluginEntityRequirements(raw) {
-  if (!Array.isArray(raw)) return [];
-  const out = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const item of raw) {
-    if (!item || typeof item !== "object") continue;
-    const row = item;
-    const name = typeof row.name === "string" ? row.name.trim() : "";
-    if (!name || !ENTITY_NAME_RE.test(name) || seen.has(name.toLowerCase())) continue;
-    seen.add(name.toLowerCase());
-    out.push({
-      name,
-      fields: asStringArray(row.fields, FIELD_NAME_RE),
-      forms: asStringArray(row.forms, FIELD_NAME_RE),
-      access: parseAccess(row.access)
-    });
-  }
-  return out;
-}
-function parsePluginCervioApiRequirements(raw) {
-  if (!Array.isArray(raw)) return [];
-  const out = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const item of raw) {
-    if (!item || typeof item !== "object") continue;
-    const row = item;
-    const methodRaw = typeof row.method === "string" ? row.method.trim().toUpperCase() : "GET";
-    const method = HTTP_METHODS.has(methodRaw) ? methodRaw : "GET";
-    const path2 = typeof row.path_prefix === "string" ? row.path_prefix.trim() : typeof row.pathPrefix === "string" ? row.pathPrefix.trim() : "";
-    if (!path2 || !path2.startsWith("/")) continue;
-    const key = `${method}:${path2}`;
-    if (seen.has(key)) continue;
-    seen.add(key);
-    out.push({ method, path_prefix: path2 });
-  }
-  return out;
-}
-
-// src/settings-requirements.ts
-var SETTINGS_KEY_RE = /^[a-z][a-z0-9_]{0,62}$/i;
-var SETTINGS_TYPES = /* @__PURE__ */ new Set(["string", "boolean", "select", "multiselect"]);
-var RESERVED_SETTINGS_KEYS = /* @__PURE__ */ new Set(["debug"]);
-function parseOptions(raw) {
-  if (!Array.isArray(raw)) return [];
-  const out = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const item of raw) {
-    if (!item || typeof item !== "object") continue;
-    const row = item;
-    const value = typeof row.value === "string" ? row.value.trim() : "";
-    const label = typeof row.label === "string" ? row.label.trim() : "";
-    if (!value || !label || seen.has(value)) continue;
-    seen.add(value);
-    out.push({ value, label });
-  }
-  return out;
-}
-function parseDefault(raw, type, options) {
-  const allowedValues = new Set(options.map((o) => o.value));
-  if (type === "boolean") return typeof raw === "boolean" ? raw : void 0;
-  if (type === "string") return typeof raw === "string" ? raw : void 0;
-  if (type === "select") {
-    return typeof raw === "string" && allowedValues.has(raw) ? raw : void 0;
-  }
-  if (type === "multiselect") {
-    if (!Array.isArray(raw)) return void 0;
-    const values = raw.filter((v) => typeof v === "string" && allowedValues.has(v));
-    return values.length ? values : void 0;
-  }
-  return void 0;
-}
-function parsePluginSettingsRequirements(raw) {
-  if (!Array.isArray(raw)) return [];
-  const out = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const item of raw) {
-    if (!item || typeof item !== "object") continue;
-    const row = item;
-    const key = typeof row.key === "string" ? row.key.trim() : "";
-    if (!key || !SETTINGS_KEY_RE.test(key) || seen.has(key) || RESERVED_SETTINGS_KEYS.has(key)) continue;
-    const type = typeof row.type === "string" ? row.type.trim() : null;
-    if (!type || !SETTINGS_TYPES.has(type)) continue;
-    const label = typeof row.label === "string" ? row.label.trim() : "";
-    if (!label) continue;
-    const options = parseOptions(row.options);
-    if ((type === "select" || type === "multiselect") && options.length === 0) continue;
-    const hint = typeof row.hint === "string" && row.hint.trim() ? row.hint.trim() : void 0;
-    const placeholder = typeof row.placeholder === "string" && row.placeholder.trim() ? row.placeholder.trim() : void 0;
-    const defaultValue = parseDefault(row.default, type, options);
-    seen.add(key);
-    const field = { key, type, label };
-    if (hint) field.hint = hint;
-    if (placeholder) field.placeholder = placeholder;
-    if (defaultValue !== void 0) field.default = defaultValue;
-    if (options.length) field.options = options;
-    out.push(field);
-  }
-  return out;
-}
-
-// src/connections.ts
-var EXTERNAL_CONNECTION_ALLOWED_HOSTS = {
-  microsoft: ["graph.microsoft.com"],
-  google: ["googleapis.com", "www.googleapis.com"]
-};
-var EXTERNAL_CONNECTION_HTTP_METHODS = [
-  "GET",
-  "POST",
-  "PATCH",
-  "PUT",
-  "DELETE"
-];
-var CONNECTION_ID_RE = /^[a-z0-9][a-z0-9-_]{0,62}$/;
-var OAUTH_PROVIDER_KEY_RE = /^[a-z0-9][a-z0-9_-]{0,62}$/;
-var MAX_SCOPES = 32;
-var MAX_ALLOWED_APIS = 24;
-var MAX_SCOPE_LEN = 200;
-var BLOCKED_HOST_SUFFIXES = [".localhost", ".local", ".internal", ".home", ".lan"];
-function normalizeExactApiHost(raw) {
-  const host = raw.trim().toLowerCase().replace(/\.$/, "");
-  if (!host || host.length > 253 || host.includes("/") || host.includes(":") || host.includes("*") || host === "localhost" || BLOCKED_HOST_SUFFIXES.some((suffix) => host.endsWith(suffix))) {
-    return null;
-  }
-  if (!/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(
-    host
-  )) {
-    return null;
-  }
-  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(host)) return null;
-  return host;
-}
-function isExternalConnectionProvider(v) {
-  return OAUTH_PROVIDER_KEY_RE.test(v);
-}
-function parseAllowedApi(raw, provider) {
-  if (!raw || typeof raw !== "object") return null;
-  const o = raw;
-  const host = typeof o.host === "string" ? o.host.trim().toLowerCase() : "";
-  const pathPrefix = typeof o.path_prefix === "string" ? o.path_prefix.trim() : typeof o.pathPrefix === "string" ? o.pathPrefix.trim() : "";
-  const methodsRaw = o.methods;
-  if (!host || !pathPrefix || !normalizeExactApiHost(host)) return null;
-  const builtinHosts = EXTERNAL_CONNECTION_ALLOWED_HOSTS[provider];
-  if (builtinHosts && !builtinHosts.includes(host)) return null;
-  if (!pathPrefix.startsWith("/") || pathPrefix.includes("..") || pathPrefix.includes("\\")) {
-    return null;
-  }
-  if (!Array.isArray(methodsRaw) || methodsRaw.length === 0) return null;
-  const methods = [];
-  for (const m of methodsRaw) {
-    if (typeof m !== "string") return null;
-    const up = m.trim().toUpperCase();
-    if (!EXTERNAL_CONNECTION_HTTP_METHODS.includes(up)) return null;
-    if (!methods.includes(up)) {
-      methods.push(up);
-    }
-  }
-  if (!methods.length) return null;
-  return { host, methods, path_prefix: pathPrefix };
-}
-function parsePluginConnections(raw) {
-  if (!Array.isArray(raw)) return [];
-  const out = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const item of raw) {
-    if (!item || typeof item !== "object") continue;
-    const o = item;
-    const id = typeof o.id === "string" ? o.id.trim().toLowerCase() : "";
-    if (!id || !CONNECTION_ID_RE.test(id) || seen.has(id)) continue;
-    const providerRaw = typeof o.provider === "string" ? o.provider.trim().toLowerCase() : "";
-    if (!isExternalConnectionProvider(providerRaw)) continue;
-    const scopesRaw = o.scopes;
-    if (!Array.isArray(scopesRaw) || scopesRaw.length === 0 || scopesRaw.length > MAX_SCOPES) continue;
-    const scopes = [];
-    for (const s of scopesRaw) {
-      if (typeof s !== "string") continue;
-      const t = s.trim();
-      if (!t || t.length > MAX_SCOPE_LEN) continue;
-      if (!scopes.includes(t)) scopes.push(t);
-    }
-    if (!scopes.length) continue;
-    const apisRaw = o.allowed_apis ?? o.allowedApis;
-    if (!Array.isArray(apisRaw) || apisRaw.length === 0 || apisRaw.length > MAX_ALLOWED_APIS) continue;
-    const allowed_apis = [];
-    for (const a of apisRaw) {
-      const rule = parseAllowedApi(a, providerRaw);
-      if (rule) allowed_apis.push(rule);
-    }
-    if (!allowed_apis.length) continue;
-    seen.add(id);
-    out.push({
-      id,
-      provider: providerRaw,
-      consent: "user",
-      scopes,
-      allowed_apis
-    });
-  }
-  return out;
-}
-
-// src/zip-safety.ts
-var MAX_PLUGIN_COMPRESSION_RATIO = 100;
-function assertZipSafe(zip) {
-  const names = Object.keys(zip.files);
-  if (names.length > MAX_PLUGIN_ZIP_ENTRIES) {
-    return { ok: false, error: "zip_too_many_entries" };
-  }
-  let totalUncompressed = 0;
-  for (const name of names) {
-    if (name.includes("..") || name.includes("\\") || name.startsWith("/")) {
-      return { ok: false, error: "zip_unsafe_entry_path" };
-    }
-    if (/\.zip$/i.test(name) && !zip.files[name]?.dir) {
-      return { ok: false, error: "zip_nested_archive" };
-    }
-    const entry = zip.files[name];
-    const uncompressed = entry._data?.uncompressedSize ?? 0;
-    const compressed = entry._data?.compressedSize ?? 0;
-    totalUncompressed += uncompressed;
-    if (totalUncompressed > MAX_PLUGIN_UNCOMPRESSED_BYTES) {
-      return { ok: false, error: "zip_uncompressed_too_large" };
-    }
-    if (compressed > 0 && uncompressed > 1024 * 1024) {
-      const ratio = uncompressed / compressed;
-      if (ratio > MAX_PLUGIN_COMPRESSION_RATIO) {
-        return { ok: false, error: "zip_compression_ratio_too_high" };
-      }
-    } else if (compressed === 0 && uncompressed > 1024 * 1024) {
-      return { ok: false, error: "zip_compression_ratio_too_high" };
-    }
-  }
-  return { ok: true, value: true };
-}
-function assertZipFile(file) {
-  const name = (file.name ?? "upload.zip").toLowerCase();
-  if (!name.endsWith(".zip")) return { ok: false, error: "invalid_file_extension" };
-  if (file.size <= 0) return { ok: false, error: "empty_file" };
-  if (file.size > MAX_PLUGIN_ZIP_BYTES) return { ok: false, error: "file_too_large" };
-  return { ok: true, value: true };
-}
-
-// src/semver.ts
-var CORE_SEMVER_RE = /^(\d+)\.(\d+)\.(\d+)/;
-function nextPatchVersion(latest) {
-  if (!latest || typeof latest !== "string") return "0.1.0";
-  const m = latest.trim().match(CORE_SEMVER_RE);
-  if (!m) return "0.1.0";
-  const major = Number(m[1]);
-  const minor = Number(m[2]);
-  const patch = Number(m[3]);
-  if (![major, minor, patch].every((n) => Number.isFinite(n) && n >= 0)) return "0.1.0";
-  return `${major}.${minor}.${patch + 1}`;
-}
-function compareSemverDesc(a, b) {
-  const pa = a.match(CORE_SEMVER_RE);
-  const pb = b.match(CORE_SEMVER_RE);
-  if (!pa && !pb) return 0;
-  if (!pa) return 1;
-  if (!pb) return -1;
-  for (let i = 1; i <= 3; i++) {
-    const da = Number(pa[i]) - Number(pb[i]);
-    if (da !== 0) return da > 0 ? -1 : 1;
-  }
-  return 0;
-}
-var pluginManifestZodSchema = zod.z.object({
-  plugin_key: zod.z.string().regex(/^[a-z0-9][a-z0-9-_]{1,62}$/).optional().describe("Stable plugin id. Prefer this over legacy `id`."),
-  id: zod.z.string().optional().describe("Legacy alias for plugin_key (slashes become dashes)."),
-  plugin_name: zod.z.string().optional(),
-  name: zod.z.string().optional().describe("Legacy alias for plugin_name."),
-  plugin_type: zod.z.enum(["task", "form", "task_form", "route", "policy", "server"]).optional().describe("Use `policy` for Policy Plugins. `server` is a legacy alias for `policy`."),
-  kind: zod.z.string().optional().describe("Legacy alias for plugin_type (task_widget\u2192task, record_panel\u2192form)."),
-  version: zod.z.string().optional().describe("Ignored by Cervio - the host assigns release versions."),
-  hooks: zod.z.array(
-    zod.z.object({
-      event: zod.z.enum(["before_create", "before_update"]),
-      entities: zod.z.array(zod.z.string()).optional(),
-      blocking: zod.z.boolean().optional(),
-      identity: zod.z.enum(["caller", "plugin_principal"]).optional(),
-      entry: zod.z.string().optional()
-    })
-  ).optional().describe("Policy Plugin hook declarations (plugin_type=policy; legacy server)."),
-  required_connection_capabilities: zod.z.array(zod.z.string()).optional(),
-  requiredConnectionCapabilities: zod.z.array(zod.z.string()).optional(),
-  connections: zod.z.array(
-    zod.z.object({
-      id: zod.z.string(),
-      provider: zod.z.string(),
-      scopes: zod.z.array(zod.z.string()),
-      allowed_apis: zod.z.array(
-        zod.z.object({
-          host: zod.z.string(),
-          methods: zod.z.array(zod.z.string()),
-          path_prefix: zod.z.string().optional(),
-          pathPrefix: zod.z.string().optional()
-        })
-      ).optional(),
-      allowedApis: zod.z.array(zod.z.unknown()).optional()
-    })
-  ).optional(),
-  entities: zod.z.array(
-    zod.z.object({
-      name: zod.z.string(),
-      fields: zod.z.array(zod.z.string()).optional(),
-      forms: zod.z.array(zod.z.string()).optional(),
-      access: zod.z.array(zod.z.enum(["read", "write"])).optional()
-    })
-  ).optional(),
-  cervio_apis: zod.z.array(
-    zod.z.object({
-      method: zod.z.string().optional(),
-      path_prefix: zod.z.string().optional(),
-      pathPrefix: zod.z.string().optional()
-    })
-  ).optional(),
-  cervioApis: zod.z.array(zod.z.unknown()).optional(),
-  settings: zod.z.array(
-    zod.z.object({
-      key: zod.z.string(),
-      type: zod.z.enum(["string", "boolean", "select", "multiselect"]),
-      label: zod.z.string(),
-      hint: zod.z.string().optional(),
-      placeholder: zod.z.string().optional(),
-      default: zod.z.union([zod.z.string(), zod.z.boolean(), zod.z.array(zod.z.string())]).optional(),
-      options: zod.z.array(
-        zod.z.object({
-          value: zod.z.string(),
-          label: zod.z.string()
-        })
-      ).optional().describe("Required for `select` / `multiselect`.")
-    })
-  ).optional().describe("Admin-editable settings fields (drives Impostazioni dynamic form).")
-}).passthrough();
-
-// src/policy-types.ts
-function isPolicyPluginType(t) {
-  return t === "policy" || t === "server";
-}
-function normalizeToPolicyPluginType(t) {
-  return isPolicyPluginType(t) ? "policy" : null;
-}
-
-// src/policy-entry.ts
-var BARE_IMPORT_RE = /(?:from|import)\s*\(\s*['"](?![./]|data:)([^'"]+)['"]\s*\)|(?:from|import)\s+['"](?![./]|data:)([^'"]+)['"]/g;
-function findBareModuleSpecifiers(source) {
-  const found = /* @__PURE__ */ new Set();
-  for (const match of source.matchAll(BARE_IMPORT_RE)) {
-    const spec = (match[1] || match[2] || "").trim();
-    if (spec) found.add(spec);
-  }
-  return [...found];
-}
-function assertPolicyEntrySelfContained(source) {
-  const specifiers = findBareModuleSpecifiers(source);
-  if (specifiers.length === 0) return { ok: true };
-  return {
-    ok: false,
-    error: "policy_entry_not_self_contained",
-    specifiers
-  };
-}
-function normalizePluginKey(raw) {
-  return raw.trim().toLowerCase().replace(/[\/\s]+/g, "-").replace(/[^a-z0-9-_]/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "");
-}
-function resolvePluginType(raw) {
-  const kindMap = {
-    route: "route",
-    task: "task",
-    form: "form",
-    task_form: "task_form",
-    // Legacy wire → canonical Policy Plugin type
-    server: "policy",
-    policy: "policy",
-    task_widget: "task",
-    record_panel: "form"
-  };
-  const candidate = kindMap[raw] ?? raw;
-  return ["task", "form", "task_form", "route", "policy", "server"].includes(
-    candidate
-  ) ? candidate : null;
-}
-function parseRequiredCapabilities(raw, allowed) {
-  if (!Array.isArray(raw)) return [];
-  const allowedSet = new Set(allowed);
-  const out = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const item of raw) {
-    if (typeof item !== "string") continue;
-    const id = item.trim().toLowerCase();
-    if (!id || !allowedSet.has(id) || seen.has(id)) continue;
-    seen.add(id);
-    out.push(id);
-  }
-  return out;
-}
-function parseManifestObject(parsed, options) {
-  const allowedCapabilities = options?.allowedCapabilities ?? DEFAULT_PLUGIN_DECLARABLE_CAPABILITIES;
-  const pluginKeyRaw = typeof parsed.plugin_key === "string" ? parsed.plugin_key : typeof parsed.id === "string" ? parsed.id.split("/").filter(Boolean).join("-") : "";
-  const pluginKey = normalizePluginKey(pluginKeyRaw);
-  if (!pluginKey || !PLUGIN_KEY_RE.test(pluginKey)) {
-    return { ok: false, error: "manifest_plugin_key_invalid" };
-  }
-  const pluginName = typeof parsed.plugin_name === "string" && parsed.plugin_name.trim() ? parsed.plugin_name.trim() : typeof parsed.name === "string" && parsed.name.trim() ? parsed.name.trim() : null;
-  const pluginTypeRaw = typeof parsed.plugin_type === "string" ? parsed.plugin_type.trim() : typeof parsed.kind === "string" ? parsed.kind.trim() : "";
-  const pluginType = resolvePluginType(pluginTypeRaw);
-  const manifestVersion = typeof parsed.version === "string" && parsed.version.trim() ? parsed.version.trim() : null;
-  const requiredRaw = parsed.required_connection_capabilities ?? parsed.requiredConnectionCapabilities ?? [];
-  const requiredConnectionCapabilities = parseRequiredCapabilities(
-    requiredRaw,
-    allowedCapabilities
-  );
-  const connections = parsePluginConnections(parsed.connections);
-  const entities = parsePluginEntityRequirements(parsed.entities);
-  const cervioApis = parsePluginCervioApiRequirements(
-    parsed.cervio_apis ?? parsed.cervioApis ?? []
-  );
-  const settings = parsePluginSettingsRequirements(parsed.settings);
-  return {
-    ok: true,
-    value: {
-      pluginKey,
-      pluginName,
-      pluginType,
-      manifestVersion,
-      requiredConnectionCapabilities,
-      connections,
-      entities,
-      cervioApis,
-      settings
-    }
-  };
-}
-function manifestJsonForContentHash(raw) {
-  const clone = { ...raw };
-  delete clone.version;
-  return JSON.stringify(clone);
-}
-async function loadZipFromBuffer(buffer) {
-  try {
-    const zip = await JSZip__default.default.loadAsync(buffer);
-    const safe = assertZipSafe(zip);
-    if (!safe.ok) return safe;
-    return { ok: true, value: zip };
-  } catch {
-    return { ok: false, error: "zip_invalid" };
-  }
-}
-async function parseZipManifest(file, options) {
-  const buffer = await file.arrayBuffer();
-  const zipRes = await loadZipFromBuffer(buffer);
-  if (!zipRes.ok) return zipRes;
-  const zip = zipRes.value;
-  const manifestEntry = zip.file("manifest.json") ?? zip.file("manifest.example.json") ?? Object.values(zip.files).find(
-    (f) => f.name.endsWith("/manifest.json") || f.name.endsWith("/manifest.example.json")
-  );
-  if (!manifestEntry) return { ok: false, error: "manifest_not_found_in_zip" };
-  const jsonText = await manifestEntry.async("text");
-  let parsed;
-  try {
-    parsed = JSON.parse(jsonText);
-  } catch {
-    return { ok: false, error: "manifest_invalid_json" };
-  }
-  const fields = parseManifestObject(parsed, options);
-  if (!fields.ok) return fields;
-  const isPolicy = isPolicyPluginType(fields.value.pluginType);
-  if (!isPolicy) {
-    const hasDistIndex = !!zip.file("dist/index.html");
-    if (!hasDistIndex) return { ok: false, error: "build_index_missing" };
-    const hasDistAssets = Object.keys(zip.files).some((name) => /^dist\/assets\/.+/.test(name));
-    if (!hasDistAssets) return { ok: false, error: "build_assets_missing" };
-  }
-  const entryFromHooks = isPolicy && Array.isArray(parsed.hooks) ? (() => {
-    for (const h of parsed.hooks) {
-      if (typeof h?.entry === "string" && h.entry.trim()) return h.entry.trim();
-    }
-    return null;
-  })() : null;
-  const artifactEntryPath = isPolicy ? entryFromHooks || "server/index.js" : "dist/index.html";
-  if (isPolicy) {
-    const entryFile = zip.file(artifactEntryPath) || zip.file(artifactEntryPath.replace(/^\//, "")) || Object.values(zip.files).find((f) => f.name.endsWith(`/${artifactEntryPath}`));
-    if (!entryFile) return { ok: false, error: "manifest_not_found_in_zip" };
-    const entrySource = await entryFile.async("text");
-    const selfContained = assertPolicyEntrySelfContained(entrySource);
-    if (!selfContained.ok) {
-      return {
-        ok: false,
-        error: `${selfContained.error}:${selfContained.specifiers.join(",")}`
-      };
-    }
-  }
-  return {
-    ok: true,
-    value: {
-      ...fields.value,
-      artifactEntryPath,
-      rawManifest: parsed,
-      manifestEntryName: manifestEntry.name
-    }
-  };
-}
-async function computePluginContentSha256(zip, rawManifest) {
-  try {
-    const hash = crypto.createHash("sha256");
-    hash.update("manifest\0");
-    hash.update(manifestJsonForContentHash(rawManifest));
-    hash.update("\0");
-    const distPaths = Object.keys(zip.files).filter((name) => {
-      const entry = zip.files[name];
-      if (!entry || entry.dir) return false;
-      const normalized = name.replace(/^\.\//, "");
-      return normalized === "dist" || normalized.startsWith("dist/");
-    }).map((name) => name.replace(/^\.\//, "")).sort((a, b) => a.localeCompare(b));
-    for (const path2 of distPaths) {
-      const entry = zip.file(path2);
-      if (!entry || entry.dir) continue;
-      const bytes = await entry.async("uint8array");
-      hash.update("file\0");
-      hash.update(path2);
-      hash.update("\0");
-      hash.update(bytes);
-      hash.update("\0");
-    }
-    return { ok: true, value: hash.digest("hex") };
-  } catch {
-    return { ok: false, error: "content_hash_failed" };
-  }
-}
-function sha256Hex(buffer) {
-  return crypto.createHash("sha256").update(buffer).digest("hex");
-}
-async function collectFiles(dir, base = "") {
-  const entries = await fs.promises.readdir(dir, { withFileTypes: true });
-  const out = [];
-  for (const entry of entries) {
-    const abs = path__default.default.join(dir, entry.name);
-    const rel = base ? `${base}/${entry.name}` : entry.name;
-    if (entry.isDirectory()) {
-      out.push(...await collectFiles(abs, rel));
-    } else if (entry.isFile()) {
-      out.push({ rel: rel.replace(/\\/g, "/"), abs });
-    }
-  }
-  return out;
-}
-async function packPlugin(opts) {
-  const root = path__default.default.resolve(opts.dir);
-  const manifestPath = path__default.default.join(root, "manifest.json");
-  let manifestRaw;
-  try {
-    const text = await fs.promises.readFile(manifestPath, "utf8");
-    manifestRaw = JSON.parse(text);
-  } catch {
-    return { ok: false, error: "manifest_not_found_in_zip" };
-  }
-  const fields = parseManifestObject(manifestRaw, opts.options);
-  if (!fields.ok) return fields;
-  const isPolicy = isPolicyPluginType(fields.value.pluginType);
-  if (!isPolicy) {
-    const distIndex = path__default.default.join(root, "dist", "index.html");
-    try {
-      await fs.promises.access(distIndex);
-    } catch {
-      return { ok: false, error: "build_index_missing" };
-    }
-  } else {
-    const entry = (Array.isArray(manifestRaw.hooks) ? manifestRaw.hooks.find((h) => h?.entry)?.entry : null) || "server/index.js";
-    const entryAbs = path__default.default.join(root, entry);
-    try {
-      await fs.promises.access(entryAbs);
-    } catch {
-      return { ok: false, error: "manifest_not_found_in_zip" };
-    }
-    let entrySource;
-    try {
-      entrySource = await fs.promises.readFile(entryAbs, "utf8");
-    } catch {
-      return { ok: false, error: "manifest_not_found_in_zip" };
-    }
-    const selfContained = assertPolicyEntrySelfContained(entrySource);
-    if (!selfContained.ok) {
-      return {
-        ok: false,
-        error: `${selfContained.error}:${selfContained.specifiers.join(",")}`
-      };
-    }
-  }
-  const zip = new JSZip__default.default();
-  const files = await collectFiles(root);
-  let hasAssets = false;
-  for (const file of files) {
-    if (file.rel.startsWith(".cervio/") || file.rel === "node_modules" || file.rel.startsWith("node_modules/")) {
-      continue;
-    }
-    if (file.rel.startsWith("dist/assets/") && file.rel !== "dist/assets/") {
-      hasAssets = true;
-    }
-    const data = await fs.promises.readFile(file.abs);
-    zip.file(file.rel, data);
-  }
-  if (!isPolicy && !hasAssets) return { ok: false, error: "build_assets_missing" };
-  const safe = assertZipSafe(zip);
-  if (!safe.ok) return safe;
-  const buffer = Buffer.from(await zip.generateAsync({ type: "uint8array", compression: "DEFLATE" }));
-  const fileCheck = assertZipFile({ name: `${fields.value.pluginKey}.zip`, size: buffer.length });
-  if (!fileCheck.ok) return fileCheck;
-  const loaded = await loadZipFromBuffer(buffer);
-  if (!loaded.ok) return loaded;
-  const hash = await computePluginContentSha256(loaded.value, manifestRaw);
-  if (!hash.ok) return hash;
-  return {
-    ok: true,
-    value: {
-      buffer,
-      pluginKey: fields.value.pluginKey,
-      contentSha256: hash.value,
-      sizeBytes: buffer.length
-    }
-  };
-}
-async function validatePluginDir(dir, options) {
-  const packed = await packPlugin({ dir, options });
-  if (!packed.ok) return packed;
-  const blob = new Blob([packed.value.buffer], { type: "application/zip" });
-  const parsed = await parseZipManifest(blob, options);
-  if (!parsed.ok) return parsed;
-  return {
-    ok: true,
-    value: {
-      pluginKey: packed.value.pluginKey,
-      contentSha256: packed.value.contentSha256
-    }
-  };
-}
-async function validatePluginZipBuffer(buffer, options) {
-  const fileCheck = assertZipFile({ name: "plugin.zip", size: buffer.length });
-  if (!fileCheck.ok) return fileCheck;
-  const blob = new Blob([buffer], { type: "application/zip" });
-  const parsed = await parseZipManifest(blob, options);
-  if (!parsed.ok) return parsed;
-  const zipRes = await loadZipFromBuffer(buffer);
-  if (!zipRes.ok) return zipRes;
-  const hash = await computePluginContentSha256(zipRes.value, parsed.value.rawManifest);
-  if (!hash.ok) return hash;
-  return {
-    ok: true,
-    value: { pluginKey: parsed.value.pluginKey, contentSha256: hash.value }
-  };
-}
-
-exports.DEFAULT_PLUGIN_DECLARABLE_CAPABILITIES = DEFAULT_PLUGIN_DECLARABLE_CAPABILITIES;
-exports.EXTERNAL_CONNECTION_ALLOWED_HOSTS = EXTERNAL_CONNECTION_ALLOWED_HOSTS;
-exports.EXTERNAL_CONNECTION_HTTP_METHODS = EXTERNAL_CONNECTION_HTTP_METHODS;
-exports.MAX_PLUGIN_UNCOMPRESSED_BYTES = MAX_PLUGIN_UNCOMPRESSED_BYTES;
-exports.MAX_PLUGIN_ZIP_BYTES = MAX_PLUGIN_ZIP_BYTES;
-exports.MAX_PLUGIN_ZIP_ENTRIES = MAX_PLUGIN_ZIP_ENTRIES;
-exports.OAUTH_PROVIDER_KEY_RE = OAUTH_PROVIDER_KEY_RE;
-exports.PLUGIN_ARTIFACT_BUCKET = PLUGIN_ARTIFACT_BUCKET;
-exports.PLUGIN_KEY_RE = PLUGIN_KEY_RE;
-exports.PLUGIN_VERSION_SELECT = PLUGIN_VERSION_SELECT;
-exports.assertPolicyEntrySelfContained = assertPolicyEntrySelfContained;
-exports.assertZipFile = assertZipFile;
-exports.assertZipSafe = assertZipSafe;
-exports.compareSemverDesc = compareSemverDesc;
-exports.computePluginContentSha256 = computePluginContentSha256;
-exports.findBareModuleSpecifiers = findBareModuleSpecifiers;
-exports.isExternalConnectionProvider = isExternalConnectionProvider;
-exports.isPolicyPluginType = isPolicyPluginType;
-exports.loadZipFromBuffer = loadZipFromBuffer;
-exports.manifestJsonForContentHash = manifestJsonForContentHash;
-exports.nextPatchVersion = nextPatchVersion;
-exports.normalizeExactApiHost = normalizeExactApiHost;
-exports.normalizePluginKey = normalizePluginKey;
-exports.normalizeToPolicyPluginType = normalizeToPolicyPluginType;
-exports.packPlugin = packPlugin;
-exports.parseManifestObject = parseManifestObject;
-exports.parsePluginCervioApiRequirements = parsePluginCervioApiRequirements;
-exports.parsePluginConnections = parsePluginConnections;
-exports.parsePluginEntityRequirements = parsePluginEntityRequirements;
-exports.parsePluginSettingsRequirements = parsePluginSettingsRequirements;
-exports.parseZipManifest = parseZipManifest;
-exports.pluginManifestZodSchema = pluginManifestZodSchema;
-exports.sha256Hex = sha256Hex;
-exports.validatePluginDir = validatePluginDir;
-exports.validatePluginZipBuffer = validatePluginZipBuffer;
-//# sourceMappingURL=index.cjs.map
-//# sourceMappingURL=index.cjs.map