@crewx/sdk 0.9.0-rc.7 → 0.9.0-rc.71

package/dist/esm/publish/index.js

@@ -0,0 +1 @@
+import*as E from'path';import {join}from'path';import*as g from'fs';import {existsSync,readFileSync}from'fs';import*as W from'crypto';import*as G from'js-yaml';import*as N from'os';import*as Q from'tar';import {gunzipSync,gzipSync}from'zlib';function ce(e){let t=n=>n.replace(/[.+^${}()|[\]\\]/g,"\\$&"),s=e.split("/").map(n=>n==="**"?".*":n.split("*").map(t).join("[^/]*"));return new RegExp(`^${s.join("\\/")}$`)}function A(e,t){try{return ce(t).test(e)}catch{return  false}}function v(e,...t){let r=e.split("/");if(r.length<t.length)return  false;let s=r.length-t.length;return t.every((n,i)=>A(r[s+i],n))}function ue(e,t){return e.split("/").some(r=>A(r,t))}var z=[{label:".env*",test:e=>A(e,".env*")},{label:".git/",test:(e,t,r)=>r&&e===".git"},{label:"memory/",test:(e,t,r)=>r&&e==="memory"},{label:"*.key",test:e=>A(e,"*.key")},{label:"*.pem",test:e=>A(e,"*.pem")},{label:"auth.json",test:e=>e==="auth.json"},{label:"node_modules/",test:(e,t,r)=>r&&e==="node_modules"},{label:"conversations/",test:(e,t,r)=>r&&e==="conversations"},{label:".crewx/threads/",test:(e,t,r)=>r&&v(t,".crewx","threads")},{label:".crewx/crewx.db",test:(e,t,r)=>!r&&v(t,".crewx","crewx.db")},{label:".crewx/*.log",test:(e,t,r)=>!r&&v(t,".crewx","*.log")},{label:".crewx/publish/",test:(e,t,r)=>r&&v(t,".crewx","publish")},{label:".crewx/",test:(e,t)=>ue(t,".crewx")}];function R(e,t,r){for(let s of z)if(s.test(e,t,r))return s.label;return null}function K(e){let t=[],r=[];function s(n,i,a){let d;try{d=g.readdirSync(n,{withFileTypes:!0});}catch{return}d.sort((c,u)=>c.name.localeCompare(u.name));for(let c of d){let u=i?`${i}/${c.name}`:c.name,l=E.join(n,c.name);if(c.isSymbolicLink()){let p;try{p=g.statSync(l);}catch{continue}if(p.isDirectory()){r.push({path:u,rule:a??"symlink-dir"});continue}let C=a??R(c.name,u,false);C?r.push({path:u,rule:C}):t.push(u);continue}if(c.isDirectory()){let p=a??R(c.name,u,true);s(l,u,p);continue}if(c.isFile()){let p=a??R(c.name,u,false);p?r.push({path:u,rule:p}):t.push(u);}}}return s(e,"",null),t.sort(),r.sort((n,i)=>n.path<i.path?-1:n.path>i.path?1:0),{included:t,excluded:r}}var le=[{rule:"token-prefix",regex:/\b(?:sk-|ghp_|xoxb-)[A-Za-z0-9_-]{10,}/},{rule:"private-key",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----/},{rule:"aws-access-key",regex:/\bAKIA[0-9A-Z]{16}\b/}];function pe(e){return e.includes(0)}function V(e,t){let r=[];for(let s of t){let n=E.join(e,s),i;try{i=g.readFileSync(n);}catch{continue}if(pe(i))continue;i.toString("utf8").split(/\r\n|\r|\n/).forEach((d,c)=>{for(let{rule:u,regex:l}of le)l.test(d)&&r.push({path:s,line:c+1,rule:u});});}return r}var X=/^[a-z0-9-]+$/,fe=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/,de=/^[A-Za-z_][A-Za-z0-9_]*$/;function me(e){let t=E.join(e,"crewx.yaml");if(!g.existsSync(t))return {};let r;try{r=G.load(g.readFileSync(t,"utf8"));}catch{return {}}if(!r||typeof r!="object")return {};let s=r.metadata;if(!s||typeof s!="object")return {};let n=s;return {name:typeof n.name=="string"?n.name:void 0,version:typeof n.version=="string"?n.version:void 0,description:typeof n.description=="string"?n.description:void 0,requiredEnv:n.requiredEnv,crewxMinVersion:typeof n.crewxMinVersion=="string"?n.crewxMinVersion:void 0}}function he(e){return W.createHash("sha256").update(new Uint8Array(g.readFileSync(e))).digest("hex")}function Z(e,t,r={}){let s=me(e),n=s.name??E.basename(e);if(!X.test(n))throw new Error(`publish: invalid name "${n}" \u2014 must match ${X} (lowercase letters, numbers, hyphen only)`);let i=r.version??s.version;if(!i)throw new Error("publish: version is required \u2014 set crewx.yaml metadata.version or pass opts.version");if(!fe.test(i))throw new Error(`publish: invalid version "${i}" \u2014 must be semver (e.g. 1.0.0)`);let a=Array.isArray(s.requiredEnv)?s.requiredEnv:[],d=[];for(let l of a){if(typeof l!="string"||!de.test(l))throw new Error(`publish: requiredEnv must contain names only (no values), got "${String(l)}"`);d.push(l);}let c=t.map(l=>({path:l,sha256:he(E.join(e,l))})).sort((l,p)=>l.path<p.path?-1:l.path>p.path?1:0),u={name:n,version:i,type:"template",description:s.description??"",files:c,requiredEnv:d};return s.crewxMinVersion&&(u.crewxMinVersion=s.crewxMinVersion),u}async function ee(e,t){let r=E.join(e,".crewx","publish");g.mkdirSync(r,{recursive:true});let s=E.join(r,`${t.name}-${t.version}.tgz`),n=g.mkdtempSync(E.join(N.tmpdir(),"crewx-publish-"));try{g.writeFileSync(E.join(n,"manifest.json"),JSON.stringify(t,null,2));for(let i of t.files){let a=E.join(n,i.path);g.mkdirSync(E.dirname(a),{recursive:!0}),g.copyFileSync(E.join(e,i.path),a);}await Q.create({gzip:!0,file:s,cwd:n,portable:!0,noMtime:!0},["manifest.json",...t.files.map(i=>i.path)]);}finally{g.rmSync(n,{recursive:true,force:true});}return s}var _="/api/v1";var Ee=201,be=409,I=401;function we(){return process.env.WI013_FAKE_UPLOAD==="1"}function Ae(e){let t=gunzipSync(new Uint8Array(e)),r=gzipSync(new Uint8Array(t),{level:1});if(Buffer.compare(new Uint8Array(r),new Uint8Array(e))===0)throw new Error("publish: [E_MALFORMED] Re-gzipped upload bytes are identical to the original \u2014 tamper is a no-op");return r}function _e(e){return e.replace(/\/+$/,"")}async function U(e){try{return await e.json()}catch{return null}}function b(e){let t=e?.message;return typeof t=="string"?t:void 0}function te(e,t,r){let s=e;if(!s||s.success!==true||s.data===void 0)throw new Error(`publish: [E_MALFORMED] ${t} response envelope is malformed (expected { success: true, data }) \u2014 HTTP ${r}`);return s.data}async function Te(e){let t=_e(e.baseUrl),r=e.accessPolicy??"private",s=e.manifest.name,n;try{n=await fetch(`${t}${_}/publisher/items`,{method:"POST",headers:{Authorization:`Bearer ${e.accessToken}`,"Content-Type":"application/json"},body:JSON.stringify({slug:s,displayName:s,description:e.manifest.description,type:"template",version:e.manifest.version,accessPolicy:r})});}catch(o){throw new Error(`publish: [E_NETWORK] Submit request failed (network) \u2014 ${o instanceof Error?o.message:String(o)}`)}let i;if(n.status===Ee)i="created";else if(n.status===be)i="existing";else {if(n.status===I)throw new Error("publish: [E_AUTH_EXPIRED] Authentication is expired or missing \u2014 please log in again (HTTP 401)");{let o=await U(n);throw new Error(`publish: [E_HTTP] Submit request failed \u2014 HTTP ${n.status}${b(o)?` ${b(o)}`:""}`)}}let a="not-needed",d=null;if(i==="existing"){let o;try{o=await fetch(`${t}${_}/publisher/items`,{method:"GET",headers:{Authorization:`Bearer ${e.accessToken}`}});}catch(f){throw new Error(`publish: [E_NETWORK] Publisher items request failed (network) \u2014 ${f instanceof Error?f.message:String(f)}`)}let O=await U(o);if(o.status!==200)throw new Error(`publish: [E_HTTP] Publisher items request failed \u2014 HTTP ${o.status}${b(O)?` ${b(O)}`:""}`);let D=te(O,"publisher items",o.status)?.items;if(!Array.isArray(D))throw new Error(`publish: [E_MALFORMED] Publisher items response is malformed (expected data.items[]) \u2014 HTTP ${o.status}`);let $=D.find(f=>!f||typeof f!="object"?false:f.slug===s);if(!$||typeof $.version!="string")throw new Error(`publish: [E_MALFORMED] Publisher items response does not contain slug "${s}" \u2014 HTTP ${o.status}`);if(d=$.version,d!==e.manifest.version){let f;try{f=await fetch(`${t}${_}/publisher/items/${encodeURIComponent(s)}`,{method:"PUT",headers:{Authorization:`Bearer ${e.accessToken}`,"Content-Type":"application/json"},body:JSON.stringify({version:e.manifest.version})});}catch(x){throw new Error(`publish: [E_NETWORK] Version update request failed (network) \u2014 ${x instanceof Error?x.message:String(x)}`)}if(!f.ok){let x=await U(f),w=b(x);throw f.status===I?new Error(`publish: [E_AUTH_EXPIRED] Authentication is expired or missing \u2014 please log in again (HTTP ${f.status})${w?` ${w}`:""}`):f.status===403?new Error(`publish: [E_FORBIDDEN] Version update is forbidden; only the item owner can update an existing item (HTTP ${f.status})${w?` ${w}`:""}`):new Error(`publish: [E_HTTP] Version update failed \u2014 HTTP ${f.status}${w?` ${w}`:""}`)}a="applied";}}let c=g.readFileSync(e.tgzPath),u=we()?Ae(c):c,l=new FormData;l.set("archive",new Blob([new Uint8Array(u)],{type:"application/gzip"}),`${s}-${e.manifest.version}.tgz`);let p;try{p=await fetch(`${t}${_}/publisher/items/${encodeURIComponent(s)}/upload`,{method:"POST",headers:{Authorization:`Bearer ${e.accessToken}`},body:l});}catch(o){throw new Error(`publish: [E_NETWORK] Upload request failed (network) \u2014 ${o instanceof Error?o.message:String(o)}`)}if(p.status===I)throw new Error("publish: [E_AUTH_EXPIRED] Authentication is expired or missing \u2014 please log in again (HTTP 401)");if(!p.ok){let o=await U(p);throw new Error(`publish: [E_HTTP] Upload request failed \u2014 HTTP ${p.status}${b(o)?` ${b(o)}`:""}`)}let C=await U(p),B=te(C,"upload",p.status);return {slug:s,version:e.manifest.version,artifactChecksum:B.artifactChecksum,artifactSizeBytes:B.artifactSizeBytes,submitOutcome:i,versionUpdate:a,serverVersionBefore:d}}function se(){if(process.env.CREWX_HOME)try{return g.realpathSync(process.env.CREWX_HOME)}catch{return E.join(N.homedir(),".crewx")}return process.platform!=="win32"&&process.env.XDG_CONFIG_HOME?E.join(process.env.XDG_CONFIG_HOME,"crewx"):E.join(N.homedir(),".crewx")}var y=class extends Error{code;constructor(t,r){super(r),this.name="AccountAuthBoundaryError",this.code=t;}};function H(e=process.env){let t=e.CREWX_ACCOUNT_ISSUER?.trim(),r=e.CREWX_ACCOUNT_ANON_KEY?.trim();if(!t&&!r)throw new y("ACCOUNT_USER_PAIR_MISSING","CrewX user-realm issuer and anon/publishable key pair are not configured");if(!t)throw new y("ACCOUNT_USER_ISSUER_MISSING","CrewX user-realm issuer is not configured");if(!r)throw new y("ACCOUNT_USER_ANON_KEY_MISSING","CrewX user-realm anon/publishable key is not configured");return {issuer:t,anonKey:r}}function T(){throw new y("ACCOUNT_ACCESS_TOKEN_INVALID","Account access token could not be verified")}function ie(e){try{return JSON.parse(Buffer.from(e,"base64url").toString("utf8"))}catch{return T()}}function oe(e){if(typeof e!="string")return T();let t=e.split(".");if(t.length!==3||t.some(i=>i.length===0))return T();let r=ie(t[0]),s=ie(t[1]);if(!r||typeof r!="object"||!s||typeof s!="object")return T();let n=s;return typeof n.iss!="string"||n.iss.length===0||typeof n.sub!="string"||n.sub.length===0?T():{issuer:n.iss,sub:n.sub}}function ae(e,t,r){let s=oe(e);if(s.issuer!==t.issuer)throw new y("ACCOUNT_TOKEN_ISSUER_MISMATCH","Account access token does not match the configured user realm");if(r!==void 0&&s.sub!==r)throw new y("ACCOUNT_TOKEN_SUB_MISMATCH","Account access token subject does not match the expected identity");return s}function F(e,t){if(e.issuer!==t.issuer)throw new y("ACCOUNT_AUTH_JSON_ISSUER_MISMATCH","auth.json does not match the configured user realm");let r=ae(e.access_token,t);if(r.sub!==e.sub)throw new y("ACCOUNT_AUTH_JSON_SUB_MISMATCH","auth.json subject does not match the access token identity");return r}function Ue(e){if(!e||typeof e!="object")return  false;let t=e;return t.version===1&&typeof t.sub=="string"&&typeof t.email=="string"&&typeof t.access_token=="string"&&typeof t.refresh_token=="string"&&typeof t.expires_at=="number"&&typeof t.issuer=="string"&&typeof t.updated_at=="string"}function Ce(){let e=join(se(),"auth.json");if(!existsSync(e))throw new Error(`Login required \u2014 ${e} was not found (please log in first)`);let t;try{t=readFileSync(e,"utf8");}catch(n){throw new Error(`Could not read auth.json (${e}): ${n instanceof Error?n.message:String(n)}`)}let r;try{r=JSON.parse(t);}catch(n){throw new Error(`Failed to parse auth.json (${e}): ${n instanceof Error?n.message:String(n)}`)}if(!Ue(r))throw new Error(`auth.json is malformed (${e}) \u2014 please log in again`);let s=H();return F(r,s),r}async function ve(e,t={}){let r=E.resolve(e),{included:s,excluded:n}=K(r),i=Z(r,s,{version:t.version}),a=V(r,s);return {manifest:i,included:s,excluded:n,secretFindings:a}}async function ft(e,t={}){let r=await ve(e,t);if(r.secretFindings.length>0){let i=r.secretFindings.map(a=>`${a.path}:${a.line} (${a.rule})`).join(", ");throw new Error(`publish: aborted \u2014 secret findings must be resolved before packing: ${i}`)}let s=E.resolve(e),n=await ee(s,r.manifest);return {manifest:r.manifest,tgzPath:n}}export{y as AccountAuthBoundaryError,z as EXCLUDE_RULES,_ as MARKETPLACE_API_PREFIX,F as assertAuthJsonUserRealm,ae as assertUserRealmAccessToken,oe as decodeAccessTokenIdentity,ft as packTemplate,ve as planPublish,Ce as readAuthJson,H as resolveUserAccountConfig,Te as uploadToMarketplace};