@crowi/plugin-api 0.1.0-alpha.2 → 1.0.0-alpha.11

package/dist/index.mjs

@@ -1,3 +1,137 @@
+// src/config-verification.ts
+var CONFIG_VERIFICATION_KEY_PREFIX = "__crowi_config_verification__/";
+
+// src/html.ts
+function escapeHtml(s) {
+  return s.replace(/[&<>"']/g, (c) => {
+    switch (c) {
+      case "&":
+        return "&amp;";
+      case "<":
+        return "&lt;";
+      case ">":
+        return "&gt;";
+      case '"':
+        return "&quot;";
+      case "'":
+        return "&#39;";
+      default:
+        return c;
+    }
+  });
+}
+
+// src/registries/auth.ts
+import { createHash } from "crypto";
+function assertNonEmptyString(value, label, factory) {
+  if (value.trim() === "") {
+    throw new TypeError(`${factory}: '${label}' must be a non-empty string.`);
+  }
+}
+function assertValidUrl(value, label, factory) {
+  try {
+    new URL(value);
+  } catch {
+    throw new TypeError(`${factory}: '${label}' must be a valid URL, got '${value}'.`);
+  }
+}
+function assertNonEmptyScopes(scopes, factory) {
+  for (const scope of scopes) {
+    assertNonEmptyString(scope, "scopes[]", factory);
+  }
+}
+function createOAuth2Driver(options) {
+  const FACTORY = "createOAuth2Driver";
+  assertNonEmptyString(options.buttonLabel, "buttonLabel", FACTORY);
+  assertValidUrl(options.authorizeUrl, "authorizeUrl", FACTORY);
+  assertValidUrl(options.tokenUrl, "tokenUrl", FACTORY);
+  const scopes = options.scopes ?? [];
+  assertNonEmptyScopes(scopes, FACTORY);
+  return {
+    kind: "oauth2",
+    buttonLabel: options.buttonLabel,
+    iconUrl: options.iconUrl,
+    authorizeUrl: options.authorizeUrl,
+    tokenUrl: options.tokenUrl,
+    scopes,
+    pkce: options.pkce,
+    getClientConfig: options.getClientConfig,
+    fetchProfile: options.fetchProfile
+  };
+}
+var DEFAULT_OIDC_SCOPES = ["openid", "email", "profile"];
+function createOidcDriver(options) {
+  const FACTORY = "createOidcDriver";
+  assertNonEmptyString(options.buttonLabel, "buttonLabel", FACTORY);
+  assertValidUrl(options.discoveryUrl, "discoveryUrl", FACTORY);
+  const scopes = options.scopes ?? [...DEFAULT_OIDC_SCOPES];
+  assertNonEmptyScopes(scopes, FACTORY);
+  return {
+    kind: "oidc",
+    buttonLabel: options.buttonLabel,
+    iconUrl: options.iconUrl,
+    discoveryUrl: options.discoveryUrl,
+    scopes,
+    pkce: true,
+    getClientConfig: options.getClientConfig,
+    getConfiguration: () => resolveOidcConfiguration(options.discoveryUrl, options.getClientConfig),
+    authorize: options.authorize,
+    mapClaims: options.mapClaims
+  };
+}
+var DISCOVERY_CACHE_TTL_MS = 5 * 60 * 1e3;
+var DISCOVERY_CACHE_MAX_ENTRIES = 64;
+var discoveryCache = /* @__PURE__ */ new Map();
+var inFlightDiscoveries = /* @__PURE__ */ new Map();
+function discoveryCacheKey(discoveryUrl, clientId, clientSecret) {
+  const secretFingerprint = createHash("sha256").update(clientSecret).digest("hex");
+  return createHash("sha256").update(`${discoveryUrl}\0${clientId}\0${secretFingerprint}`).digest("hex");
+}
+function evictOldestDiscoveryCacheEntry() {
+  let oldestKey;
+  let oldestExpiresAt = Number.POSITIVE_INFINITY;
+  for (const [key, entry] of discoveryCache) {
+    if (entry.expiresAt < oldestExpiresAt) {
+      oldestExpiresAt = entry.expiresAt;
+      oldestKey = key;
+    }
+  }
+  if (oldestKey !== void 0) {
+    discoveryCache.delete(oldestKey);
+  }
+}
+function cacheDiscoveryResult(key, configuration) {
+  if (!discoveryCache.has(key) && discoveryCache.size >= DISCOVERY_CACHE_MAX_ENTRIES) {
+    evictOldestDiscoveryCacheEntry();
+  }
+  discoveryCache.set(key, { configuration, expiresAt: Date.now() + DISCOVERY_CACHE_TTL_MS });
+}
+async function resolveOidcConfiguration(discoveryUrl, getClientConfig) {
+  const clientConfig = getClientConfig();
+  if (clientConfig == null) return null;
+  const { clientId, clientSecret } = clientConfig;
+  const key = discoveryCacheKey(discoveryUrl, clientId, clientSecret);
+  const cached = discoveryCache.get(key);
+  if (cached !== void 0) {
+    if (cached.expiresAt > Date.now()) return cached.configuration;
+    discoveryCache.delete(key);
+  }
+  const inFlight = inFlightDiscoveries.get(key);
+  if (inFlight !== void 0) return inFlight;
+  const discoveryPromise = (async () => {
+    const { discovery } = await import("openid-client");
+    const configuration = await discovery(new URL(discoveryUrl), clientId, clientSecret);
+    cacheDiscoveryResult(key, configuration);
+    return configuration;
+  })();
+  inFlightDiscoveries.set(key, discoveryPromise);
+  try {
+    return await discoveryPromise;
+  } finally {
+    inFlightDiscoveries.delete(key);
+  }
+}
+
 // src/schema-markers.ts
 var SENSITIVE_FIELD_MARKER = "@sensitive";
 var ACTION_FIELD_MARKER = "@action";
@@ -11,15 +145,222 @@ function getActionAnnotation(field) {
   const trimmed = description.trimStart();
   if (!trimmed.startsWith(ACTION_FIELD_MARKER)) return null;
   const rest = trimmed.slice(ACTION_FIELD_MARKER.length).trimStart();
-  const match = rest.match(/^"([^"]+)"\s+(GET|POST|PUT|DELETE)\s+(\/\S*)/);
+  const match = rest.match(/^"([^"]+)"\s+(GET|POST)\s+(\/\S*)/);
   if (!match) return null;
   const [, label, method, path] = match;
   return { label, method, path };
 }
+
+// ../svg-sanitize/dist/index.mjs
+import { DOMParser, XMLSerializer } from "@xmldom/xmldom";
+var MAX_DIMENSION_PX = 1e6;
+function extractSvgDimensions(svg) {
+  const match = /\bviewBox\s*=\s*["']\s*([-\d.]+)[\s,]+([-\d.]+)[\s,]+([-\d.]+)[\s,]+([-\d.]+)\s*["']/.exec(svg);
+  if (!match) return null;
+  const width = Math.round(Number(match[3]));
+  const height = Math.round(Number(match[4]));
+  if (!Number.isFinite(width) || !Number.isFinite(height)) return null;
+  if (width <= 0 || height <= 0 || width > MAX_DIMENSION_PX || height > MAX_DIMENSION_PX) return null;
+  return { width, height };
+}
+function sanitizeSvg(input, policy) {
+  const doc = parseXml(input);
+  if (!doc) return { ok: false, reason: "malformed_xml" };
+  if (doc.doctype) {
+    return { ok: false, reason: "doctype_not_allowed" };
+  }
+  const root = doc.documentElement;
+  if (!isUnprefixedSvgElement(root)) {
+    return { ok: false, reason: "root_is_not_svg" };
+  }
+  sanitizeElementTree(root, policy, true);
+  const serializer = new XMLSerializer();
+  const serialized = serializer.serializeToString(root);
+  const verifyDoc = parseXml(serialized);
+  if (!verifyDoc || !isUnprefixedSvgElement(verifyDoc.documentElement)) {
+    return { ok: false, reason: "sanitized_output_not_single_root_svg" };
+  }
+  return { ok: true, svg: serialized };
+}
+var SVG_NAMESPACE_URI = "http://www.w3.org/2000/svg";
+var XML_NAMESPACE_URI = "http://www.w3.org/XML/1998/namespace";
+var XLINK_NAMESPACE_URI = "http://www.w3.org/1999/xlink";
+function isSvgNamespaceElement(el) {
+  return el.namespaceURI === SVG_NAMESPACE_URI && el.prefix == null;
+}
+function isUnprefixedSvgElement(el) {
+  return el != null && el.localName === "svg" && isSvgNamespaceElement(el);
+}
+function parseXml(source) {
+  try {
+    return new DOMParser({ onError: () => void 0 }).parseFromString(source, "image/svg+xml");
+  } catch {
+    return null;
+  }
+}
+var ALLOWED_ELEMENTS = /* @__PURE__ */ new Set([
+  "svg",
+  "g",
+  "defs",
+  "symbol",
+  "use",
+  "title",
+  "desc",
+  "metadata",
+  "path",
+  "rect",
+  "circle",
+  "ellipse",
+  "line",
+  "polyline",
+  "polygon",
+  "text",
+  "tspan",
+  "textPath",
+  "tref",
+  "marker",
+  "clipPath",
+  "mask",
+  "pattern",
+  "linearGradient",
+  "radialGradient",
+  "stop",
+  "image",
+  "style",
+  "a",
+  "switch",
+  "filter",
+  "feGaussianBlur",
+  "feOffset",
+  "feMerge",
+  "feMergeNode",
+  "feColorMatrix",
+  "feComposite",
+  "feFlood",
+  "feBlend",
+  "feDropShadow",
+  "feMorphology",
+  "feTurbulence",
+  "feDisplacementMap"
+]);
+var PROCESSING_INSTRUCTION_NODE = 7;
+var ELEMENT_NODE = 1;
+function sanitizeElementTree(el, policy, isRoot) {
+  sanitizeAttributes(el, policy, isRoot);
+  if (el.localName === "style") {
+    el.textContent = sanitizeStyleText(el.textContent ?? "");
+    return;
+  }
+  for (const child of Array.from(el.childNodes)) {
+    if (child.nodeType === PROCESSING_INSTRUCTION_NODE) {
+      el.removeChild(child);
+      continue;
+    }
+    if (child.nodeType !== ELEMENT_NODE) continue;
+    const childEl = child;
+    if (!isSvgNamespaceElement(childEl) || !ALLOWED_ELEMENTS.has(childEl.localName ?? childEl.nodeName)) {
+      el.removeChild(childEl);
+      continue;
+    }
+    sanitizeElementTree(childEl, policy, false);
+  }
+}
+function sanitizeAttributes(el, policy, isRoot) {
+  for (const attr of Array.from(el.attributes)) {
+    const localName = attr.localName ?? attr.name;
+    if (/^on/i.test(localName)) {
+      el.removeAttributeNode(attr);
+      continue;
+    }
+    if (localName === "style") {
+      el.removeAttributeNode(attr);
+      continue;
+    }
+    if (localName === "base" && attr.namespaceURI === XML_NAMESPACE_URI) {
+      el.removeAttributeNode(attr);
+      continue;
+    }
+    if (localName === "href") {
+      const sanitizedValue = sanitizeHrefValue(attr.value, policy);
+      if (sanitizedValue === null) {
+        el.removeAttributeNode(attr);
+      } else {
+        attr.value = sanitizedValue;
+      }
+      continue;
+    }
+    if (URL_VALUED_PRESENTATION_ATTRS.has(localName)) {
+      if (!isUrlFuncIriSafe(attr.value)) {
+        el.removeAttributeNode(attr);
+      }
+      continue;
+    }
+    if (attr.name === "xmlns" || attr.name.startsWith("xmlns:")) {
+      if (!isRoot || !isEssentialRootNamespaceDeclaration(attr)) {
+        el.removeAttributeNode(attr);
+      }
+    }
+  }
+}
+function isEssentialRootNamespaceDeclaration(attr) {
+  if (attr.name === "xmlns") return true;
+  return attr.name === "xmlns:xlink" && attr.value === XLINK_NAMESPACE_URI;
+}
+var URL_VALUED_PRESENTATION_ATTRS = /* @__PURE__ */ new Set([
+  "fill",
+  "stroke",
+  "filter",
+  "clip-path",
+  "mask",
+  "cursor",
+  "marker",
+  "marker-start",
+  "marker-mid",
+  "marker-end"
+]);
+var URL_FUNC_PATTERN = /url\(\s*(['"]?)([^'")]*)\1\s*\)/gi;
+function isUrlFuncIriSafe(rawValue) {
+  const matches = Array.from(cssUnescape(rawValue).matchAll(URL_FUNC_PATTERN));
+  if (matches.length === 0) return true;
+  return matches.every(([, , target]) => target.trim().startsWith("#"));
+}
+function sanitizeHrefValue(rawValue, policy) {
+  const value = rawValue.trim();
+  if (value.startsWith("#")) return value;
+  if (/^javascript:/i.test(value)) return null;
+  if (/^data:/i.test(value)) return null;
+  if (value.startsWith("//")) return null;
+  if (policy.allowSafeHref && /^https:\/\//i.test(value)) return value;
+  return null;
+}
+function sanitizeStyleText(css) {
+  const withoutComments = css.replace(/\/\*[\s\S]*?\*\//g, " ");
+  let out = cssUnescape(withoutComments);
+  out = out.replace(/@import\b[^;]*;?/gi, "");
+  out = out.replace(URL_FUNC_PATTERN, (match, _quote, target) => target.trim().startsWith("#") ? match : "none");
+  return out;
+}
+function cssUnescape(css) {
+  return css.replace(/\\([0-9a-fA-F]{1,6})[ \t\n\f\r]?|\\([^\r\n\f])|\\$/g, (_match, hex, literal) => {
+    if (hex !== void 0) {
+      const codePoint = Number.parseInt(hex, 16);
+      if (codePoint === 0 || codePoint > 1114111 || codePoint >= 55296 && codePoint <= 57343) return "\uFFFD";
+      return String.fromCodePoint(codePoint);
+    }
+    if (literal !== void 0) return literal;
+    return "\uFFFD";
+  });
+}
 export {
   ACTION_FIELD_MARKER,
+  CONFIG_VERIFICATION_KEY_PREFIX,
   SENSITIVE_FIELD_MARKER,
+  createOAuth2Driver,
+  createOidcDriver,
+  escapeHtml,
+  extractSvgDimensions,
   getActionAnnotation,
-  isSensitiveField
+  isSensitiveField,
+  sanitizeSvg
 };
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/schema-markers.ts"],"sourcesContent":["import type { z } from 'zod/v3';\n\n/**\n * `configSchema` description-string markers.\n *\n * The admin UI walks the schema and looks at each field's\n * `description` (set via `z.string().describe('@sensitive ...')`). A\n * description starting with one of these marker tokens unlocks special\n * UI behaviour without forcing every field to declare a custom Zod\n * type.\n */\n\n/**\n * Marker that flags a config field as sensitive (encrypted at rest).\n * Usage:\n *\n *   z.string().describe('@sensitive AWS secret access key')\n *\n * The runtime auto-encrypts on write and decrypts on read, using the\n * same KeyProvider as core sensitive Config. The admin UI renders the\n * field via `<SecretField>` (saved badge / clear pending / undo).\n */\nexport const SENSITIVE_FIELD_MARKER = '@sensitive';\n\n/**\n * Marker that adds an action button next to a config field. Usage:\n *\n *   z.string().describe('@action \"Test connection\" POST /test')\n *\n * The admin form renders a button with the given label that calls the\n * plugin's contributed endpoint at the given verb / path (relative to\n * `/api/v2/plugins/<name>/`). Useful for \"Test connection\",\n * \"Authorise with Google\", etc. without forcing every plugin to ship\n * its own React component.\n */\nexport const ACTION_FIELD_MARKER = '@action';\n\n/**\n * True if the schema field is marked `@sensitive`.\n *\n * `field` is `z.ZodTypeAny` (intentionally loose); call sites pass the\n * value type from `configSchema.shape[key]`.\n */\nexport function isSensitiveField(field: z.ZodTypeAny): boolean {\n  const description = field.description;\n  return typeof description === 'string' && description.trimStart().startsWith(SENSITIVE_FIELD_MARKER);\n}\n\n/**\n * Parsed `@action` annotation extracted from a field's `description`.\n */\nexport interface ActionAnnotation {\n  /** Visible button label, e.g. \"Test connection\". */\n  label: string;\n  /** HTTP verb of the plugin endpoint to call. */\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE';\n  /** Path relative to `/api/v2/plugins/<name>/`, with leading slash. */\n  path: string;\n}\n\n/**\n * Parse an `@action` annotation off a field, or return null if absent.\n *\n * Format: `@action \"<label>\" <METHOD> <path>`\n *   e.g. `@action \"Test connection\" POST /test`\n *\n * The label may include spaces when wrapped in double quotes; the\n * method is one of `GET` / `POST` / `PUT` / `DELETE`; the path begins\n * with `/`.\n */\nexport function getActionAnnotation(field: z.ZodTypeAny): ActionAnnotation | null {\n  const description = field.description;\n  if (typeof description !== 'string') return null;\n  const trimmed = description.trimStart();\n  if (!trimmed.startsWith(ACTION_FIELD_MARKER)) return null;\n\n  const rest = trimmed.slice(ACTION_FIELD_MARKER.length).trimStart();\n  // `\"<label>\" <METHOD> <path>`\n  const match = rest.match(/^\"([^\"]+)\"\\s+(GET|POST|PUT|DELETE)\\s+(\\/\\S*)/);\n  if (!match) return null;\n\n  const [, label, method, path] = match;\n  return { label, method: method as ActionAnnotation['method'], path };\n}\n"],"mappings":";AAsBO,IAAM,yBAAyB;AAa/B,IAAM,sBAAsB;AAQ5B,SAAS,iBAAiB,OAA8B;AAC7D,QAAM,cAAc,MAAM;AAC1B,SAAO,OAAO,gBAAgB,YAAY,YAAY,UAAU,EAAE,WAAW,sBAAsB;AACrG;AAwBO,SAAS,oBAAoB,OAA8C;AAChF,QAAM,cAAc,MAAM;AAC1B,MAAI,OAAO,gBAAgB,SAAU,QAAO;AAC5C,QAAM,UAAU,YAAY,UAAU;AACtC,MAAI,CAAC,QAAQ,WAAW,mBAAmB,EAAG,QAAO;AAErD,QAAM,OAAO,QAAQ,MAAM,oBAAoB,MAAM,EAAE,UAAU;AAEjE,QAAM,QAAQ,KAAK,MAAM,8CAA8C;AACvE,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,CAAC,EAAE,OAAO,QAAQ,IAAI,IAAI;AAChC,SAAO,EAAE,OAAO,QAA8C,KAAK;AACrE;","names":[]}
+{"version":3,"sources":["../src/config-verification.ts","../src/html.ts","../src/registries/auth.ts","../src/schema-markers.ts","../../svg-sanitize/src/dimensions.ts","../../svg-sanitize/src/sanitize.ts"],"mappings":";AAiGO,IAAM,iCAAiC;;;ACpFvC,SAAS,WAAW,GAAmB;AAC5C,SAAO,EAAE,QAAQ,YAAY,CAAC,MAAM;AAClC,YAAQ,GAAG;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT;AACE,eAAO;AAAA,IACX;AAAA,EACF,CAAC;AACH;;;AC9BA,SAAS,kBAAkB;AA2K3B,SAAS,qBAAqB,OAAe,OAAe,SAAuB;AACjF,MAAI,MAAM,KAAK,MAAM,IAAI;AACvB,UAAM,IAAI,UAAU,GAAG,OAAO,MAAM,KAAK,+BAA+B;AAAA,EAC1E;AACF;AAEA,SAAS,eAAe,OAAe,OAAe,SAAuB;AAC3E,MAAI;AACF,QAAI,IAAI,KAAK;AAAA,EACf,QAAQ;AACN,UAAM,IAAI,UAAU,GAAG,OAAO,MAAM,KAAK,+BAA+B,KAAK,IAAI;AAAA,EACnF;AACF;AAEA,SAAS,qBAAqB,QAAkB,SAAuB;AACrE,aAAW,SAAS,QAAQ;AAC1B,yBAAqB,OAAO,YAAY,OAAO;AAAA,EACjD;AACF;AAkBO,SAAS,mBAAmB,SAAsD;AACvF,QAAM,UAAU;AAChB,uBAAqB,QAAQ,aAAa,eAAe,OAAO;AAChE,iBAAe,QAAQ,cAAc,gBAAgB,OAAO;AAC5D,iBAAe,QAAQ,UAAU,YAAY,OAAO;AACpD,QAAM,SAAS,QAAQ,UAAU,CAAC;AAClC,uBAAqB,QAAQ,OAAO;AAEpC,SAAO;AAAA,IACL,MAAM;AAAA,IACN,aAAa,QAAQ;AAAA,IACrB,SAAS,QAAQ;AAAA,IACjB,cAAc,QAAQ;AAAA,IACtB,UAAU,QAAQ;AAAA,IAClB;AAAA,IACA,MAAM,QAAQ;AAAA,IACd,iBAAiB,QAAQ;AAAA,IACzB,cAAc,QAAQ;AAAA,EACxB;AACF;AAEA,IAAM,sBAAyC,CAAC,UAAU,SAAS,SAAS;AAmBrE,SAAS,iBAAiB,SAAkD;AACjF,QAAM,UAAU;AAChB,uBAAqB,QAAQ,aAAa,eAAe,OAAO;AAChE,iBAAe,QAAQ,cAAc,gBAAgB,OAAO;AAC5D,QAAM,SAAS,QAAQ,UAAU,CAAC,GAAG,mBAAmB;AACxD,uBAAqB,QAAQ,OAAO;AAEpC,SAAO;AAAA,IACL,MAAM;AAAA,IACN,aAAa,QAAQ;AAAA,IACrB,SAAS,QAAQ;AAAA,IACjB,cAAc,QAAQ;AAAA,IACtB;AAAA,IACA,MAAM;AAAA,IACN,iBAAiB,QAAQ;AAAA,IACzB,kBAAkB,MAAM,yBAAyB,QAAQ,cAAc,QAAQ,eAAe;AAAA,IAC9F,WAAW,QAAQ;AAAA,IACnB,WAAW,QAAQ;AAAA,EACrB;AACF;AAsBA,IAAM,yBAAyB,IAAI,KAAK;AACxC,IAAM,8BAA8B;AAOpC,IAAM,iBAAiB,oBAAI,IAAiC;AAC5D,IAAM,sBAAsB,oBAAI,IAAoC;AAEpE,SAAS,kBAAkB,cAAsB,UAAkB,cAA8B;AAC/F,QAAM,oBAAoB,WAAW,QAAQ,EAAE,OAAO,YAAY,EAAE,OAAO,KAAK;AAChF,SAAO,WAAW,QAAQ,EAAE,OAAO,GAAG,YAAY,KAAK,QAAQ,KAAK,iBAAiB,EAAE,EAAE,OAAO,KAAK;AACvG;AAEA,SAAS,iCAAuC;AAC9C,MAAI;AACJ,MAAI,kBAAkB,OAAO;AAC7B,aAAW,CAAC,KAAK,KAAK,KAAK,gBAAgB;AACzC,QAAI,MAAM,YAAY,iBAAiB;AACrC,wBAAkB,MAAM;AACxB,kBAAY;AAAA,IACd;AAAA,EACF;AACA,MAAI,cAAc,QAAW;AAC3B,mBAAe,OAAO,SAAS;AAAA,EACjC;AACF;AAEA,SAAS,qBAAqB,KAAa,eAAoC;AAC7E,MAAI,CAAC,eAAe,IAAI,GAAG,KAAK,eAAe,QAAQ,6BAA6B;AAClF,mCAA+B;AAAA,EACjC;AACA,iBAAe,IAAI,KAAK,EAAE,eAAe,WAAW,KAAK,IAAI,IAAI,uBAAuB,CAAC;AAC3F;AASA,eAAe,yBAAyB,cAAsB,iBAAgF;AAC5I,QAAM,eAAe,gBAAgB;AACrC,MAAI,gBAAgB,KAAM,QAAO;AAajC,QAAM,EAAE,UAAU,aAAa,IAAI;AAEnC,QAAM,MAAM,kBAAkB,cAAc,UAAU,YAAY;AAElE,QAAM,SAAS,eAAe,IAAI,GAAG;AACrC,MAAI,WAAW,QAAW;AACxB,QAAI,OAAO,YAAY,KAAK,IAAI,EAAG,QAAO,OAAO;AACjD,mBAAe,OAAO,GAAG;AAAA,EAC3B;AAEA,QAAM,WAAW,oBAAoB,IAAI,GAAG;AAC5C,MAAI,aAAa,OAAW,QAAO;AAEnC,QAAM,oBAAoB,YAAY;AACpC,UAAM,EAAE,UAAU,IAAI,MAAM,OAAO,eAAe;AAClD,UAAM,gBAAgB,MAAM,UAAU,IAAI,IAAI,YAAY,GAAG,UAAU,YAAY;AACnF,yBAAqB,KAAK,aAAa;AACvC,WAAO;AAAA,EACT,GAAG;AAEH,sBAAoB,IAAI,KAAK,gBAAgB;AAC7C,MAAI;AACF,WAAO,MAAM;AAAA,EACf,UAAE;AACA,wBAAoB,OAAO,GAAG;AAAA,EAChC;AACF;;;AC7VO,IAAM,yBAAyB;AAa/B,IAAM,sBAAsB;AAQ5B,SAAS,iBAAiB,OAA8B;AAC7D,QAAM,cAAc,MAAM;AAC1B,SAAO,OAAO,gBAAgB,YAAY,YAAY,UAAU,EAAE,WAAW,sBAAsB;AACrG;AA6BO,SAAS,oBAAoB,OAA8C;AAChF,QAAM,cAAc,MAAM;AAC1B,MAAI,OAAO,gBAAgB,SAAU,QAAO;AAC5C,QAAM,UAAU,YAAY,UAAU;AACtC,MAAI,CAAC,QAAQ,WAAW,mBAAmB,EAAG,QAAO;AAErD,QAAM,OAAO,QAAQ,MAAM,oBAAoB,MAAM,EAAE,UAAU;AAEjE,QAAM,QAAQ,KAAK,MAAM,mCAAmC;AAC5D,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,CAAC,EAAE,OAAO,QAAQ,IAAI,IAAI;AAChC,SAAO,EAAE,OAAO,QAA8C,KAAK;AACrE;;;AEzFA,SAAS,WAAW,qBAAqB;ADqBzC,IAAM,mBAAmB;AAElB,SAAS,qBAAqB,KAAuD;AAC1F,QAAM,QAAQ,uFAAuF,KAAK,GAAG;AAC7G,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,QAAQ,KAAK,MAAM,OAAO,MAAM,CAAC,CAAC,CAAC;AACzC,QAAM,SAAS,KAAK,MAAM,OAAO,MAAM,CAAC,CAAC,CAAC;AAC1C,MAAI,CAAC,OAAO,SAAS,KAAK,KAAK,CAAC,OAAO,SAAS,MAAM,EAAG,QAAO;AAChE,MAAI,SAAS,KAAK,UAAU,KAAK,QAAQ,oBAAoB,SAAS,iBAAkB,QAAO;AAC/F,SAAO,EAAE,OAAO,OAAO;AACzB;AC+CO,SAAS,YAAY,OAAe,QAA8C;AACvF,QAAM,MAAM,SAAS,KAAK;AAC1B,MAAI,CAAC,IAAK,QAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB;AAEtD,MAAI,IAAI,SAAS;AAKf,WAAO,EAAE,IAAI,OAAO,QAAQ,sBAAsB;EACpD;AACA,QAAM,OAAO,IAAI;AACjB,MAAI,CAAC,uBAAuB,IAAI,GAAG;AACjC,WAAO,EAAE,IAAI,OAAO,QAAQ,kBAAkB;EAChD;AAEA,sBAAoB,MAAM,QAAQ,IAAI;AAEtC,QAAM,aAAa,IAAI,cAAc;AACrC,QAAM,aAAa,WAAW,kBAAkB,IAAI;AAOpD,QAAM,YAAY,SAAS,UAAU;AACrC,MAAI,CAAC,aAAa,CAAC,uBAAuB,UAAU,eAAe,GAAG;AACpE,WAAO,EAAE,IAAI,OAAO,QAAQ,uCAAuC;EACrE;AAEA,SAAO,EAAE,IAAI,MAAM,KAAK,WAAW;AACrC;AAEA,IAAM,oBAAoB;AAW1B,IAAM,oBAAoB;AAU1B,IAAM,sBAAsB;AAgB5B,SAAS,sBAAsB,IAAsB;AACnD,SAAO,GAAG,iBAAiB,qBAAqB,GAAG,UAAU;AAC/D;AAUA,SAAS,uBAAuB,IAA+C;AAC7E,SAAO,MAAM,QAAQ,GAAG,cAAc,SAAS,sBAAsB,EAAE;AACzE;AAWA,SAAS,SAAS,QAAgB;AAChC,MAAI;AACF,WAAO,IAAI,UAAU,EAAE,SAAS,MAAM,OAAU,CAAC,EAAE,gBAAgB,QAAQ,eAAe;EAC5F,QAAQ;AACN,WAAO;EACT;AACF;AAWA,IAAM,mBAAmB,oBAAI,IAAI;EAC/B;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;AACF,CAAC;AAED,IAAM,8BAA8B;AACpC,IAAM,eAAe;AAErB,SAAS,oBAAoB,IAAa,QAA2B,QAAuB;AAC1F,qBAAmB,IAAI,QAAQ,MAAM;AAErC,MAAI,GAAG,cAAc,SAAS;AAG5B,OAAG,cAAc,kBAAkB,GAAG,eAAe,EAAE;AACvD;EACF;AAEA,aAAW,SAAS,MAAM,KAAK,GAAG,UAAU,GAAG;AAC7C,QAAI,MAAM,aAAa,6BAA6B;AAClD,SAAG,YAAY,KAAK;AACpB;IACF;AACA,QAAI,MAAM,aAAa,aAAc;AACrC,UAAM,UAAU;AAMhB,QAAI,CAAC,sBAAsB,OAAO,KAAK,CAAC,iBAAiB,IAAI,QAAQ,aAAa,QAAQ,QAAQ,GAAG;AACnG,SAAG,YAAY,OAAO;AACtB;IACF;AACA,wBAAoB,SAAS,QAAQ,KAAK;EAC5C;AACF;AAEA,SAAS,mBAAmB,IAAa,QAA2B,QAAuB;AACzF,aAAW,QAAQ,MAAM,KAAK,GAAG,UAAU,GAAG;AAC5C,UAAM,YAAY,KAAK,aAAa,KAAK;AACzC,QAAI,OAAO,KAAK,SAAS,GAAG;AAC1B,SAAG,oBAAoB,IAAI;AAC3B;IACF;AACA,QAAI,cAAc,SAAS;AACzB,SAAG,oBAAoB,IAAI;AAC3B;IACF;AACA,QAAI,cAAc,UAAU,KAAK,iBAAiB,mBAAmB;AAcnE,SAAG,oBAAoB,IAAI;AAC3B;IACF;AACA,QAAI,cAAc,QAAQ;AACxB,YAAM,iBAAiB,kBAAkB,KAAK,OAAO,MAAM;AAC3D,UAAI,mBAAmB,MAAM;AAC3B,WAAG,oBAAoB,IAAI;MAC7B,OAAO;AACL,aAAK,QAAQ;MACf;AACA;IACF;AACA,QAAI,8BAA8B,IAAI,SAAS,GAAG;AAChD,UAAI,CAAC,iBAAiB,KAAK,KAAK,GAAG;AACjC,WAAG,oBAAoB,IAAI;MAC7B;AACA;IACF;AACA,QAAI,KAAK,SAAS,WAAW,KAAK,KAAK,WAAW,QAAQ,GAAG;AAC3D,UAAI,CAAC,UAAU,CAAC,oCAAoC,IAAI,GAAG;AACzD,WAAG,oBAAoB,IAAI;MAC7B;IACF;EACF;AACF;AAoBA,SAAS,oCAAoC,MAAqB;AAChE,MAAI,KAAK,SAAS,QAAS,QAAO;AAClC,SAAO,KAAK,SAAS,iBAAiB,KAAK,UAAU;AACvD;AAQA,IAAM,gCAAgC,oBAAI,IAAI;EAC5C;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;AACF,CAAC;AAED,IAAM,mBAAmB;AAWzB,SAAS,iBAAiB,UAA2B;AAOnD,QAAM,UAAU,MAAM,KAAK,YAAY,QAAQ,EAAE,SAAS,gBAAgB,CAAC;AAC3E,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,SAAO,QAAQ,MAAM,CAAC,CAAC,EAAE,EAAE,MAAM,MAAM,OAAO,KAAK,EAAE,WAAW,GAAG,CAAC;AACtE;AAGA,SAAS,kBAAkB,UAAkB,QAA0C;AACrF,QAAM,QAAQ,SAAS,KAAK;AAC5B,MAAI,MAAM,WAAW,GAAG,EAAG,QAAO;AAClC,MAAI,gBAAgB,KAAK,KAAK,EAAG,QAAO;AACxC,MAAI,UAAU,KAAK,KAAK,EAAG,QAAO;AAClC,MAAI,MAAM,WAAW,IAAI,EAAG,QAAO;AACnC,MAAI,OAAO,iBAAiB,eAAe,KAAK,KAAK,EAAG,QAAO;AAC/D,SAAO;AACT;AA6CA,SAAS,kBAAkB,KAAqB;AAM9C,QAAM,kBAAkB,IAAI,QAAQ,qBAAqB,GAAG;AAC5D,MAAI,MAAM,YAAY,eAAe;AACrC,QAAM,IAAI,QAAQ,sBAAsB,EAAE;AAC1C,QAAM,IAAI,QAAQ,kBAAkB,CAAC,OAAO,QAAQ,WAAY,OAAO,KAAK,EAAE,WAAW,GAAG,IAAI,QAAQ,MAAO;AAC/G,SAAO;AACT;AAaA,SAAS,YAAY,KAAqB;AACxC,SAAO,IAAI,QAAQ,uDAAuD,CAAC,QAAQ,KAAyB,YAAgC;AAC1I,QAAI,QAAQ,QAAW;AACrB,YAAM,YAAY,OAAO,SAAS,KAAK,EAAE;AACzC,UAAI,cAAc,KAAK,YAAY,WAAa,aAAa,SAAU,aAAa,MAAS,QAAO;AACpG,aAAO,OAAO,cAAc,SAAS;IACvC;AACA,QAAI,YAAY,OAAW,QAAO;AAClC,WAAO;EACT,CAAC;AACH;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crowi/plugin-api",
-  "version": "0.1.0-alpha.2",
+  "version": "1.0.0-alpha.11",
   "description": "Type-only contract for Crowi 2.0 plugins. See docs/rfcs/0001-plugin-architecture.md.",
   "repository": {
     "type": "git",
@@ -25,20 +25,29 @@
     "access": "public"
   },
   "peerDependencies": {
-    "hono": "^4.12.25",
+    "hono": "^4.13.5",
     "zod": "^4"
   },
   "devDependencies": {
+    "@types/jest": "^30.0.0",
     "@types/node": "^24",
-    "hono": "^4.12.25",
+    "hono": "^4.13.5",
+    "jest": "^30.5.0",
+    "ts-jest": "^29.4.12",
     "tsup": "^8.3.5",
-    "typescript": "^5.8.3",
+    "typescript": "^6.0.3",
     "zod": "^4.4.3",
+    "@crowi/svg-sanitize": "0.1.0-alpha.1",
     "@crowi/tsconfig": "0.1.0-alpha.0"
   },
+  "dependencies": {
+    "@xmldom/xmldom": "^0.9.12",
+    "openid-client": "^6.8.4"
+  },
   "scripts": {
     "build": "tsup",
     "dev": "tsup --watch --no-clean",
-    "type-check": "tsc --noEmit"
+    "type-check": "tsc --noEmit",
+    "test": "jest --passWithNoTests"
   }
 }