@crewx/sdk 0.9.0-rc.5 → 0.9.0-rc.51

package/dist/esm/publish/index.js

@@ -0,0 +1 @@
+import*as b from'path';import {join}from'path';import*as g from'fs';import {existsSync,readFileSync}from'fs';import*as q from'crypto';import*as W from'js-yaml';import*as N from'os';import*as Q from'tar';import {gunzipSync,gzipSync}from'zlib';function ce(e){let t=n=>n.replace(/[.+^${}()|[\]\\]/g,"\\$&"),s=e.split("/").map(n=>n==="**"?".*":n.split("*").map(t).join("[^/]*"));return new RegExp(`^${s.join("\\/")}$`)}function A(e,t){try{return ce(t).test(e)}catch{return  false}}function U(e,...t){let r=e.split("/");if(r.length<t.length)return  false;let s=r.length-t.length;return t.every((n,i)=>A(r[s+i],n))}function ue(e,t){return e.split("/").some(r=>A(r,t))}var D=[{label:".env*",test:e=>A(e,".env*")},{label:".git/",test:(e,t,r)=>r&&e===".git"},{label:"memory/",test:(e,t,r)=>r&&e==="memory"},{label:"*.key",test:e=>A(e,"*.key")},{label:"*.pem",test:e=>A(e,"*.pem")},{label:"auth.json",test:e=>e==="auth.json"},{label:"node_modules/",test:(e,t,r)=>r&&e==="node_modules"},{label:"conversations/",test:(e,t,r)=>r&&e==="conversations"},{label:".crewx/threads/",test:(e,t,r)=>r&&U(t,".crewx","threads")},{label:".crewx/crewx.db",test:(e,t,r)=>!r&&U(t,".crewx","crewx.db")},{label:".crewx/*.log",test:(e,t,r)=>!r&&U(t,".crewx","*.log")},{label:".crewx/publish/",test:(e,t,r)=>r&&U(t,".crewx","publish")},{label:".crewx/",test:(e,t)=>ue(t,".crewx")}];function k(e,t,r){for(let s of D)if(s.test(e,t,r))return s.label;return null}function K(e){let t=[],r=[];function s(n,i,a){let m;try{m=g.readdirSync(n,{withFileTypes:!0});}catch{return}m.sort((c,u)=>c.name.localeCompare(u.name));for(let c of m){let u=i?`${i}/${c.name}`:c.name,l=b.join(n,c.name);if(c.isSymbolicLink()){let p;try{p=g.statSync(l);}catch{continue}if(p.isDirectory()){r.push({path:u,rule:a??"symlink-dir"});continue}let P=a??k(c.name,u,false);P?r.push({path:u,rule:P}):t.push(u);continue}if(c.isDirectory()){let p=a??k(c.name,u,true);s(l,u,p);continue}if(c.isFile()){let p=a??k(c.name,u,false);p?r.push({path:u,rule:p}):t.push(u);}}}return s(e,"",null),t.sort(),r.sort((n,i)=>n.path<i.path?-1:n.path>i.path?1:0),{included:t,excluded:r}}var le=[{rule:"token-prefix",regex:/\b(?:sk-|ghp_|xoxb-)[A-Za-z0-9_-]{10,}/},{rule:"private-key",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----/},{rule:"aws-access-key",regex:/\bAKIA[0-9A-Z]{16}\b/}];function pe(e){return e.includes(0)}function X(e,t){let r=[];for(let s of t){let n=b.join(e,s),i;try{i=g.readFileSync(n);}catch{continue}if(pe(i))continue;i.toString("utf8").split(/\r\n|\r|\n/).forEach((m,c)=>{for(let{rule:u,regex:l}of le)l.test(m)&&r.push({path:s,line:c+1,rule:u});});}return r}var G=/^[a-z0-9-]+$/,fe=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/,me=/^[A-Za-z_][A-Za-z0-9_]*$/;function he(e){let t=b.join(e,"crewx.yaml");if(!g.existsSync(t))return {};let r;try{r=W.load(g.readFileSync(t,"utf8"));}catch{return {}}if(!r||typeof r!="object")return {};let s=r.metadata;if(!s||typeof s!="object")return {};let n=s;return {name:typeof n.name=="string"?n.name:void 0,version:typeof n.version=="string"?n.version:void 0,description:typeof n.description=="string"?n.description:void 0,requiredEnv:n.requiredEnv,crewxMinVersion:typeof n.crewxMinVersion=="string"?n.crewxMinVersion:void 0}}function de(e){return q.createHash("sha256").update(new Uint8Array(g.readFileSync(e))).digest("hex")}function Z(e,t,r={}){let s=he(e),n=s.name??b.basename(e);if(!G.test(n))throw new Error(`publish: invalid name "${n}" \u2014 must match ${G} (lowercase letters, numbers, hyphen only)`);let i=r.version??s.version;if(!i)throw new Error("publish: version is required \u2014 set crewx.yaml metadata.version or pass opts.version");if(!fe.test(i))throw new Error(`publish: invalid version "${i}" \u2014 must be semver (e.g. 1.0.0)`);let a=Array.isArray(s.requiredEnv)?s.requiredEnv:[],m=[];for(let l of a){if(typeof l!="string"||!me.test(l))throw new Error(`publish: requiredEnv must contain names only (no values), got "${String(l)}"`);m.push(l);}let c=t.map(l=>({path:l,sha256:de(b.join(e,l))})).sort((l,p)=>l.path<p.path?-1:l.path>p.path?1:0),u={name:n,version:i,type:"template",description:s.description??"",files:c,requiredEnv:m};return s.crewxMinVersion&&(u.crewxMinVersion=s.crewxMinVersion),u}async function ee(e,t){let r=b.join(e,".crewx","publish");g.mkdirSync(r,{recursive:true});let s=b.join(r,`${t.name}-${t.version}.tgz`),n=g.mkdtempSync(b.join(N.tmpdir(),"crewx-publish-"));try{g.writeFileSync(b.join(n,"manifest.json"),JSON.stringify(t,null,2));for(let i of t.files){let a=b.join(n,i.path);g.mkdirSync(b.dirname(a),{recursive:!0}),g.copyFileSync(b.join(e,i.path),a);}await Q.create({gzip:!0,file:s,cwd:n,portable:!0,noMtime:!0},["manifest.json",...t.files.map(i=>i.path)]);}finally{g.rmSync(n,{recursive:true,force:true});}return s}var S="/api/v1";var be=201,we=409,O=401;function Ee(){return process.env.WI013_FAKE_UPLOAD==="1"}function Ae(e){let t=gunzipSync(new Uint8Array(e)),r=gzipSync(new Uint8Array(t),{level:1});if(Buffer.compare(new Uint8Array(r),new Uint8Array(e))===0)throw new Error("WI013_FAKE_UPLOAD: re-gzipped bytes are identical to the original \u2014 tamper is a no-op");return r}function Se(e){return e.replace(/\/+$/,"")}async function C(e){try{return await e.json()}catch{return null}}function w(e){let t=e?.message;return typeof t=="string"?t:void 0}function te(e,t,r){let s=e;if(!s||s.success!==true||s.data===void 0)throw new Error(`publish: ${t} response envelope malformed (expected { success: true, data }) \u2014 HTTP ${r}`);return s.data}async function xe(e){let t=Se(e.baseUrl),r=e.accessPolicy??"private",s=e.manifest.name,n;try{n=await fetch(`${t}${S}/publisher/items`,{method:"POST",headers:{Authorization:`Bearer ${e.accessToken}`,"Content-Type":"application/json"},body:JSON.stringify({slug:s,displayName:s,description:e.manifest.description,type:"template",version:e.manifest.version,accessPolicy:r})});}catch(o){throw new Error(`publish: submit \uC694\uCCAD\uC774 \uC2E4\uD328\uD588\uC2B5\uB2C8\uB2E4 (\uB124\uD2B8\uC6CC\uD06C) \u2014 ${o instanceof Error?o.message:String(o)}`)}let i;if(n.status===be)i="created";else if(n.status===we)i="existing";else {if(n.status===O)throw new Error("publish: \uC778\uC99D\uC774 \uB9CC\uB8CC\uB418\uC5C8\uAC70\uB098 \uC5C6\uC2B5\uB2C8\uB2E4 \u2014 \uB2E4\uC2DC \uB85C\uADF8\uC778\uD558\uC138\uC694");{let o=await C(n);throw new Error(`publish: submit \uC2E4\uD328 \u2014 HTTP ${n.status}${w(o)?` ${w(o)}`:""}`)}}let a="not-needed",m=null;if(i==="existing"){let o;try{o=await fetch(`${t}${S}/publisher/items`,{method:"GET",headers:{Authorization:`Bearer ${e.accessToken}`}});}catch(f){throw new Error(`publish: version \uC870\uD68C \uC694\uCCAD\uC774 \uC2E4\uD328\uD588\uC2B5\uB2C8\uB2E4 (\uB124\uD2B8\uC6CC\uD06C) \u2014 ${f instanceof Error?f.message:String(f)}`)}let $=await C(o);if(o.status!==200)throw new Error(`publish: publisher items \uC870\uD68C \uC2E4\uD328 \u2014 HTTP ${o.status}${w($)?` ${w($)}`:""}`);let z=te($,"publisher items",o.status)?.items;if(!Array.isArray(z))throw new Error(`publish: publisher items response malformed (expected data.items[]) \u2014 HTTP ${o.status}`);let I=z.find(f=>!f||typeof f!="object"?false:f.slug===s);if(!I||typeof I.version!="string")throw new Error(`publish: publisher items response does not contain slug "${s}" \u2014 HTTP ${o.status}`);if(m=I.version,m!==e.manifest.version){let f;try{f=await fetch(`${t}${S}/publisher/items/${encodeURIComponent(s)}`,{method:"PUT",headers:{Authorization:`Bearer ${e.accessToken}`,"Content-Type":"application/json"},body:JSON.stringify({version:e.manifest.version})});}catch(_){throw new Error(`publish: version update \uC694\uCCAD\uC774 \uC2E4\uD328\uD588\uC2B5\uB2C8\uB2E4 (\uB124\uD2B8\uC6CC\uD06C) \u2014 ${_ instanceof Error?_.message:String(_)}`)}if(!f.ok){let _=await C(f),E=w(_);throw f.status===O?new Error(`publish: version update \uC778\uC99D\uC774 \uB9CC\uB8CC\uB418\uC5C8\uAC70\uB098 \uC5C6\uC2B5\uB2C8\uB2E4 \u2014 \uB2E4\uC2DC \uB85C\uADF8\uC778\uD558\uC138\uC694 (HTTP ${f.status})${E?` ${E}`:""}`):f.status===403?new Error(`publish: version update \uAD8C\uD55C\uC774 \uC5C6\uC2B5\uB2C8\uB2E4 \u2014 \uAE30\uC874 \uD56D\uBAA9\uC758 \uC18C\uC720\uC790\uB9CC \uBC84\uC804\uC744 \uAC31\uC2E0\uD560 \uC218 \uC788\uC2B5\uB2C8\uB2E4 (HTTP ${f.status})${E?` ${E}`:""}`):new Error(`publish: version update \uC2E4\uD328 \u2014 HTTP ${f.status}${E?` ${E}`:""}`)}a="applied";}}let c=g.readFileSync(e.tgzPath),u=Ee()?Ae(c):c,l=new FormData;l.set("archive",new Blob([new Uint8Array(u)],{type:"application/gzip"}),`${s}-${e.manifest.version}.tgz`);let p;try{p=await fetch(`${t}${S}/publisher/items/${encodeURIComponent(s)}/upload`,{method:"POST",headers:{Authorization:`Bearer ${e.accessToken}`},body:l});}catch(o){throw new Error(`publish: upload \uC694\uCCAD\uC774 \uC2E4\uD328\uD588\uC2B5\uB2C8\uB2E4 (\uB124\uD2B8\uC6CC\uD06C) \u2014 ${o instanceof Error?o.message:String(o)}`)}if(p.status===O)throw new Error("publish: \uC778\uC99D\uC774 \uB9CC\uB8CC\uB418\uC5C8\uAC70\uB098 \uC5C6\uC2B5\uB2C8\uB2E4 \u2014 \uB2E4\uC2DC \uB85C\uADF8\uC778\uD558\uC138\uC694");if(!p.ok){let o=await C(p);throw new Error(`publish: upload \uC2E4\uD328 \u2014 HTTP ${p.status}${w(o)?` ${w(o)}`:""}`)}let P=await C(p),H=te(P,"upload",p.status);return {slug:s,version:e.manifest.version,artifactChecksum:H.artifactChecksum,artifactSizeBytes:H.artifactSizeBytes,submitOutcome:i,versionUpdate:a,serverVersionBefore:m}}function se(){if(process.env.CREWX_HOME)try{return g.realpathSync(process.env.CREWX_HOME)}catch{return b.join(N.homedir(),".crewx")}return process.platform!=="win32"&&process.env.XDG_CONFIG_HOME?b.join(process.env.XDG_CONFIG_HOME,"crewx"):b.join(N.homedir(),".crewx")}var y=class extends Error{code;constructor(t,r){super(r),this.name="AccountAuthBoundaryError",this.code=t;}};function j(e=process.env){let t=e.CREWX_ACCOUNT_ISSUER?.trim(),r=e.CREWX_ACCOUNT_ANON_KEY?.trim();if(!t&&!r)throw new y("ACCOUNT_USER_PAIR_MISSING","CrewX user-realm issuer and anon/publishable key pair are not configured");if(!t)throw new y("ACCOUNT_USER_ISSUER_MISSING","CrewX user-realm issuer is not configured");if(!r)throw new y("ACCOUNT_USER_ANON_KEY_MISSING","CrewX user-realm anon/publishable key is not configured");return {issuer:t,anonKey:r}}function x(){throw new y("ACCOUNT_ACCESS_TOKEN_INVALID","Account access token could not be verified")}function ie(e){try{return JSON.parse(Buffer.from(e,"base64url").toString("utf8"))}catch{return x()}}function oe(e){if(typeof e!="string")return x();let t=e.split(".");if(t.length!==3||t.some(i=>i.length===0))return x();let r=ie(t[0]),s=ie(t[1]);if(!r||typeof r!="object"||!s||typeof s!="object")return x();let n=s;return typeof n.iss!="string"||n.iss.length===0||typeof n.sub!="string"||n.sub.length===0?x():{issuer:n.iss,sub:n.sub}}function ae(e,t,r){let s=oe(e);if(s.issuer!==t.issuer)throw new y("ACCOUNT_TOKEN_ISSUER_MISMATCH","Account access token does not match the configured user realm");if(r!==void 0&&s.sub!==r)throw new y("ACCOUNT_TOKEN_SUB_MISMATCH","Account access token subject does not match the expected identity");return s}function B(e,t){if(e.issuer!==t.issuer)throw new y("ACCOUNT_AUTH_JSON_ISSUER_MISMATCH","auth.json does not match the configured user realm");let r=ae(e.access_token,t);if(r.sub!==e.sub)throw new y("ACCOUNT_AUTH_JSON_SUB_MISMATCH","auth.json subject does not match the access token identity");return r}function Ce(e){if(!e||typeof e!="object")return  false;let t=e;return t.version===1&&typeof t.sub=="string"&&typeof t.email=="string"&&typeof t.access_token=="string"&&typeof t.refresh_token=="string"&&typeof t.expires_at=="number"&&typeof t.issuer=="string"&&typeof t.updated_at=="string"}function Pe(){let e=join(se(),"auth.json");if(!existsSync(e))throw new Error(`Login required \u2014 ${e} was not found (please log in first)`);let t;try{t=readFileSync(e,"utf8");}catch(n){throw new Error(`Could not read auth.json (${e}): ${n instanceof Error?n.message:String(n)}`)}let r;try{r=JSON.parse(t);}catch(n){throw new Error(`Failed to parse auth.json (${e}): ${n instanceof Error?n.message:String(n)}`)}if(!Ce(r))throw new Error(`auth.json is malformed (${e}) \u2014 please log in again`);let s=j();return B(r,s),r}async function Ue(e,t={}){let r=b.resolve(e),{included:s,excluded:n}=K(r),i=Z(r,s,{version:t.version}),a=X(r,s);return {manifest:i,included:s,excluded:n,secretFindings:a}}async function ft(e,t={}){let r=await Ue(e,t);if(r.secretFindings.length>0){let i=r.secretFindings.map(a=>`${a.path}:${a.line} (${a.rule})`).join(", ");throw new Error(`publish: aborted \u2014 secret findings must be resolved before packing: ${i}`)}let s=b.resolve(e),n=await ee(s,r.manifest);return {manifest:r.manifest,tgzPath:n}}export{y as AccountAuthBoundaryError,D as EXCLUDE_RULES,S as MARKETPLACE_API_PREFIX,B as assertAuthJsonUserRealm,ae as assertUserRealmAccessToken,oe as decodeAccessTokenIdentity,ft as packTemplate,Ue as planPublish,Pe as readAuthJson,j as resolveUserAccountConfig,xe as uploadToMarketplace};