@forge/lint 6.0.3-next.7 → 6.0.3-next.7-experimental-116e5ca

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @forge/lint
 
+## 6.0.3-next.7-experimental-116e5ca
+
+### Minor Changes
+
+- 342098d: Implement server-side linter logic to prevent accidental major app version deployments
+
+### Patch Changes
+
+- Updated dependencies [4d50a76]
+- Updated dependencies [f01417b]
+- Updated dependencies [d706cd8]
+- Updated dependencies [342098d]
+- Updated dependencies [0949833]
+- Updated dependencies [d1610cc]
+- Updated dependencies [e7bfe5e]
+- Updated dependencies [498fda5]
+- Updated dependencies [ca4fa27]
+- Updated dependencies [39f1f15]
+- Updated dependencies [c3a0f20]
+  - @forge/cli-shared@9.3.0-next.7-experimental-116e5ca
+  - @forge/manifest@13.3.0-next.6-experimental-116e5ca
+  - @forge/csp@6.2.0-experimental-116e5ca
+
 ## 6.0.3-next.7
 
 ### Patch Changes

package/out/lint/lint.d.ts

@@ -1,15 +1,32 @@
-import { StatsigService } from '@forge/cli-shared';
+import { StatsigService, GraphQLClient } from '@forge/cli-shared';
 import { ManifestSchema as Manifest } from '@forge/manifest';
 import fs from 'fs';
 import { tsParser } from '../parse';
 import { LinterInterface, LintInput, LintLogger, LintResult } from './linter-interface';
+import { HandlerLinter } from './linters/handler-linter/handler-linter';
+import { FullManifestLinter } from './linters/manifest-linter/full-manifest-linter';
+import { AgentProductContextPermissionsManifestLinter } from './linters/manifest-linter/agent-product-context-permissions-manifest-linter';
+import { PermissionsManifestLinter } from './linters/manifest-linter/permissions-manifest-linter';
+import { PermissionLinter } from './linters/permission-linter/permission-linter';
+import { DeprecatedCspPermissionsManifestLinter } from './linters/manifest-linter/deprecated-csp-permissions-manifest-linter';
+import { DynamicPropertiesPermissionsLinter } from './linters/dynamic-properties-linter/dynamic-properties-permissions-linter';
+import { InvokeEndpointLinter } from './linters/endpoint-linter/invoke-endpoint-linter';
+import { StorageModulesLinter } from './linters/storage-module-linter/storage-module-linter';
+import { FrameComponentLinter } from './linters/frame-component-linter/frame-component-linter';
+import { DeprecatedEgressPermissionsManifestLinter } from './linters/manifest-linter/deprecated-egress-permissions-manifest-linter';
+import { LlmModuleLinter } from './linters/llm-module-linter/llm-module-linter';
+import { DeprecatedApiModuleLinter } from './linters/deprecated-api-module-linter/deprecated-api-module-linter';
+import { AppManagedPermissionsSdkLinter } from './linters/app-managed-permissions-sdk-linter/app-managed-permissions-sdk-linter';
+import { FunctionTimeoutLinter } from './linters/function-timeout-linter/function-timeout-linter';
 export interface ProblemCount {
     errors: number;
     warnings: number;
+    approvals: number;
 }
 export declare const reportLintResults: (logger: LintLogger, lintResults: LintResult[], showSummary?: boolean) => void;
 export declare const problemCount: (lintResults: LintResult[]) => ProblemCount;
 export declare const parseSourceFile: (filepath: string, parser: typeof tsParser, readFilePromise?: typeof fs.readFile.__promisify__) => Promise<LintInput>;
-export declare const lint: (filesToLint: string[], manifest: Manifest, environment: string, logger: LintLogger, statsigService: StatsigService, parseFunction?: (filepath: string, parser: typeof tsParser, readFilePromise?: typeof fs.readFile.__promisify__) => Promise<LintInput>, linters?: LinterInterface[]) => Promise<LintResult[]>;
+export declare const getClientSideLintersOnly: (manifest: Manifest, environment: string, logger: LintLogger, statsigService: StatsigService) => Promise<(FunctionTimeoutLinter | PermissionLinter | HandlerLinter | FullManifestLinter | AgentProductContextPermissionsManifestLinter | PermissionsManifestLinter | DeprecatedCspPermissionsManifestLinter | DynamicPropertiesPermissionsLinter | InvokeEndpointLinter | StorageModulesLinter | FrameComponentLinter | DeprecatedEgressPermissionsManifestLinter | LlmModuleLinter | DeprecatedApiModuleLinter | AppManagedPermissionsSdkLinter)[]>;
+export declare const lint: (filesToLint: string[], manifest: Manifest, environment: string, logger: LintLogger, statsigService: StatsigService, graphqlClient: GraphQLClient, approveRules?: string[], parseFunction?: (filepath: string, parser: typeof tsParser, readFilePromise?: typeof fs.readFile.__promisify__) => Promise<LintInput>, lintersOverride?: LinterInterface[]) => Promise<LintResult[]>;
 export declare const litelint: (logger: LintLogger, statsigService: StatsigService, linter?: LinterInterface) => Promise<LintResult[]>;
 //# sourceMappingURL=lint.d.ts.map

package/out/lint/lint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../src/lint/lint.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,cAAc,EACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,IAAI,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,MAAM,IAAI,CAAC;AAIpB,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAkB,MAAM,oBAAoB,CAAC;AAkBxG,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,eAAO,MAAM,iBAAiB,GAAI,QAAQ,UAAU,EAAE,aAAa,UAAU,EAAE,EAAE,qBAAkB,KAAG,IA+CrG,CAAC;AAEF,eAAO,MAAM,YAAY,GAAI,aAAa,UAAU,EAAE,KAAG,YAQxD,CAAC;AAEF,eAAO,MAAM,eAAe,GAC1B,UAAU,MAAM,EAChB,QAAQ,OAAO,QAAQ,EACvB,kBAAiB,OAAO,EAAE,CAAC,QAAQ,CAAC,aAAsC,KACzE,OAAO,CAAC,SAAS,CAOnB,CAAC;AAEF,eAAO,MAAM,IAAI,GACf,aAAa,MAAM,EAAE,EACrB,UAAU,QAAQ,EAClB,aAAa,MAAM,EACnB,QAAQ,UAAU,EAClB,gBAAgB,cAAc,EAC9B,2BAlBU,MAAM,UACR,OAAO,QAAQ,oBACN,OAAO,EAAE,CAAC,QAAQ,CAAC,aAAa,KAChD,OAAO,CAAC,SAAS,CAea,EAC/B,UAAS,eAAe,EAgBvB,KACA,OAAO,CAAC,UAAU,EAAE,CAyCtB,CAAC;AAwBF,eAAO,MAAM,QAAQ,GACnB,QAAQ,UAAU,EAClB,gBAAgB,cAAc,EAC9B,SAAQ,eAAiE,KACxE,OAAO,CAAC,UAAU,EAAE,CAGtB,CAAC"}
+{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../src/lint/lint.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,cAAc,EACd,aAAa,EACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,IAAI,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,MAAM,IAAI,CAAC;AAIpB,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAkB,MAAM,oBAAoB,CAAC;AAExG,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,4CAA4C,EAAE,MAAM,6EAA6E,CAAC;AAC3I,OAAO,EAAE,yBAAyB,EAAE,MAAM,uDAAuD,CAAC;AAClG,OAAO,EAAE,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AACjF,OAAO,EAAE,sCAAsC,EAAE,MAAM,sEAAsE,CAAC;AAC9H,OAAO,EAAE,kCAAkC,EAAE,MAAM,2EAA2E,CAAC;AAC/H,OAAO,EAAE,oBAAoB,EAAE,MAAM,kDAAkD,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,uDAAuD,CAAC;AAC7F,OAAO,EAAE,oBAAoB,EAAE,MAAM,yDAAyD,CAAC;AAC/F,OAAO,EAAE,yCAAyC,EAAE,MAAM,yEAAyE,CAAC;AACpI,OAAO,EAAE,eAAe,EAAE,MAAM,+CAA+C,CAAC;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qEAAqE,CAAC;AAChH,OAAO,EAAE,8BAA8B,EAAE,MAAM,iFAAiF,CAAC;AACjI,OAAO,EAAE,qBAAqB,EAAE,MAAM,2DAA2D,CAAC;AAGlG,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,iBAAiB,GAAI,QAAQ,UAAU,EAAE,aAAa,UAAU,EAAE,EAAE,qBAAkB,KAAG,IAuDrG,CAAC;AAEF,eAAO,MAAM,YAAY,GAAI,aAAa,UAAU,EAAE,KAAG,YASxD,CAAC;AAEF,eAAO,MAAM,eAAe,GAC1B,UAAU,MAAM,EAChB,QAAQ,OAAO,QAAQ,EACvB,kBAAiB,OAAO,EAAE,CAAC,QAAQ,CAAC,aAAsC,KACzE,OAAO,CAAC,SAAS,CAOnB,CAAC;AAcF,eAAO,MAAM,wBAAwB,GACnC,UAAU,QAAQ,EAClB,aAAa,MAAM,EACnB,QAAQ,UAAU,EAClB,gBAAgB,cAAc,wbAiB/B,CAAC;AAEF,eAAO,MAAM,IAAI,GACf,aAAa,MAAM,EAAE,EACrB,UAAU,QAAQ,EAClB,aAAa,MAAM,EACnB,QAAQ,UAAU,EAClB,gBAAgB,cAAc,EAC9B,eAAe,aAAa,EAC5B,eAAe,MAAM,EAAE,EACvB,2BAvDU,MAAM,UACR,OAAO,QAAQ,oBACN,OAAO,EAAE,CAAC,QAAQ,CAAC,aAAa,KAChD,OAAO,CAAC,SAAS,CAoDa,EAC/B,kBAAiB,eAAe,EAAO,KACtC,OAAO,CAAC,UAAU,EAAE,CA+CtB,CAAC;AAwBF,eAAO,MAAM,QAAQ,GACnB,QAAQ,UAAU,EAClB,gBAAgB,cAAc,EAC9B,SAAQ,eAAiE,KACxE,OAAO,CAAC,UAAU,EAAE,CAGtB,CAAC"}

package/out/lint/lint.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.litelint = exports.lint = exports.parseSourceFile = exports.problemCount = exports.reportLintResults = void 0;
+exports.litelint = exports.lint = exports.getClientSideLintersOnly = exports.parseSourceFile = exports.problemCount = exports.reportLintResults = void 0;
 const tslib_1 = require("tslib");
 const cli_shared_1 = require("@forge/cli-shared");
 const fs_1 = tslib_1.__importDefault(require("fs"));
@@ -23,8 +23,9 @@ const llm_module_linter_1 = require("./linters/llm-module-linter/llm-module-lint
 const deprecated_api_module_linter_1 = require("./linters/deprecated-api-module-linter/deprecated-api-module-linter");
 const app_managed_permissions_sdk_linter_1 = require("./linters/app-managed-permissions-sdk-linter/app-managed-permissions-sdk-linter");
 const function_timeout_linter_1 = require("./linters/function-timeout-linter/function-timeout-linter");
+const server_side_linter_1 = require("./linters/server-side-linter/server-side-linter");
 const reportLintResults = (logger, lintResults, showSummary = true) => {
-    let numErrors = 0, numWarnings = 0;
+    let numErrors = 0, numWarnings = 0, numApprovals = 0;
     let noProblemsFound = true;
     if (lintResults.length) {
         lintResults.forEach((lintResult) => {
@@ -32,6 +33,7 @@ const reportLintResults = (logger, lintResults, showSummary = true) => {
                 noProblemsFound = false;
                 numErrors += lintResult.errors.length;
                 numWarnings += lintResult.warnings.length;
+                numApprovals += lintResult.approvals.length;
                 logger.info(cli_shared_1.Text.lint.filename(path_1.default.resolve(lintResult.file)));
                 lintResult.errors.forEach(({ line, column, message, reference }) => {
                     logger.info(cli_shared_1.Text.lint.error(line, column, message, reference));
@@ -39,6 +41,9 @@ const reportLintResults = (logger, lintResults, showSummary = true) => {
                 lintResult.warnings.forEach(({ line, column, message, reference }) => {
                     logger.info(cli_shared_1.Text.lint.warning(line, column, message, reference));
                 });
+                lintResult.approvals.forEach(({ line, column, message, reference }) => {
+                    logger.info(cli_shared_1.Text.lint.approval(line, column, message, reference));
+                });
             }
         });
     }
@@ -51,18 +56,21 @@ const reportLintResults = (logger, lintResults, showSummary = true) => {
         const numFixableErrors = resultsWithFixers.reduce((count, result) => count + result.errors.length, 0);
         const numFixableWarnings = resultsWithFixers.reduce((count, result) => count + result.warnings.length, 0);
         if (showSummary) {
-            logger.info(cli_shared_1.Text.lint.summary(numErrors, numWarnings, numFixableErrors, numFixableWarnings));
+            logger.info(cli_shared_1.Text.lint.summary(numErrors, numWarnings, numApprovals, numFixableErrors, numFixableWarnings));
             if (numFixableErrors + numFixableWarnings > 0) {
                 logger.info(cli_shared_1.Text.lint.fixSummary(numErrors, numFixableErrors, numFixableWarnings));
             }
             else if (numErrors + numWarnings === 1) {
                 logger.info(cli_shared_1.Text.lint.noFixableProblem);
             }
+            else if (numApprovals > 0) {
+                logger.info(cli_shared_1.Text.lint.noFixableProblem);
+            }
             else {
                 logger.info(cli_shared_1.Text.lint.noFixableProblems);
             }
         }
-        if (numErrors) {
+        if (numErrors || numApprovals) {
             process.exitCode = 1;
         }
     }
@@ -71,8 +79,9 @@ exports.reportLintResults = reportLintResults;
 const problemCount = (lintResults) => {
     return lintResults.reduce((prev, curr) => ({
         errors: prev.errors + curr.errors.length,
-        warnings: prev.warnings + curr.warnings.length
-    }), { errors: 0, warnings: 0 });
+        warnings: prev.warnings + curr.warnings.length,
+        approvals: prev.approvals + curr.approvals.length
+    }), { errors: 0, warnings: 0, approvals: 0 });
 };
 exports.problemCount = problemCount;
 const parseSourceFile = async (filepath, parser, readFilePromise = (0, util_1.promisify)(fs_1.default.readFile)) => {
@@ -84,7 +93,11 @@ const parseSourceFile = async (filepath, parser, readFilePromise = (0, util_1.pr
     };
 };
 exports.parseSourceFile = parseSourceFile;
-const lint = async (filesToLint, manifest, environment, logger, statsigService, parseFunction = exports.parseSourceFile, linters = [
+const getDefaultLinters = async (manifest, environment, logger, statsigService, graphqlClient, approveRules) => [
+    ...(await (0, exports.getClientSideLintersOnly)(manifest, environment, logger, statsigService)),
+    await server_side_linter_1.ServerSideLinter.instance(environment, manifest, graphqlClient, logger, approveRules)
+];
+const getClientSideLintersOnly = async (manifest, environment, logger, statsigService) => [
     new permission_linter_1.PermissionLinter(environment, manifest, logger),
     new permissions_manifest_linter_1.PermissionsManifestLinter(logger, statsigService),
     new agent_product_context_permissions_manifest_linter_1.AgentProductContextPermissionsManifestLinter(logger, statsigService),
@@ -100,7 +113,12 @@ const lint = async (filesToLint, manifest, environment, logger, statsigService,
     new deprecated_egress_permissions_manifest_linter_1.DeprecatedEgressPermissionsManifestLinter(logger, statsigService),
     new app_managed_permissions_sdk_linter_1.AppManagedPermissionsSdkLinter(manifest, logger),
     new function_timeout_linter_1.FunctionTimeoutLinter(manifest, logger)
-]) => {
+];
+exports.getClientSideLintersOnly = getClientSideLintersOnly;
+const lint = async (filesToLint, manifest, environment, logger, statsigService, graphqlClient, approveRules, parseFunction = exports.parseSourceFile, lintersOverride = []) => {
+    const linters = lintersOverride.length > 0
+        ? lintersOverride
+        : await getDefaultLinters(manifest, environment, logger, statsigService, graphqlClient, approveRules);
     const { include, exclude } = await (0, cli_shared_1.listTSConfigIncludeExclude)(new cli_shared_1.FileSystemReader());
     const tsInclude = new Set(include);
     const tsExclude = new Set(exclude);
@@ -126,6 +144,7 @@ const lint = async (filesToLint, manifest, environment, logger, statsigService,
             const comparator = (a, b) => a.line === b.line ? a.column - b.column : a.line - b.line;
             result.errors = result.errors.sort(comparator);
             result.warnings = result.warnings.sort(comparator);
+            result.approvals = result.approvals.sort(comparator);
             return result;
         });
     }

package/out/lint/linter-interface.d.ts

@@ -2,7 +2,8 @@ import { ASTParseResult } from '../parse';
 import { ConfigFile, Logger } from '@forge/cli-shared';
 export declare enum LintClass {
     Error = "error",
-    Warning = "warning"
+    Warning = "warning",
+    Approval = "approval"
 }
 export type LintLogger = Pick<Logger, 'info'>;
 export type LintFixer = (errors: LintResultRule[], warnings: LintResultRule[], state: LintFixState) => Promise<LintFixState>;
@@ -16,6 +17,7 @@ export declare class LintResult {
     private fixer?;
     errors: LintResultRule[];
     warnings: LintResultRule[];
+    approvals: LintResultRule[];
     constructor(file: string, fixer?: LintFixer | undefined);
     add(rule: LintResultRule): void;
     batchAdd(...rules: LintResultRule[]): void;

package/out/lint/linter-interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"linter-interface.d.ts","sourceRoot":"","sources":["../../src/lint/linter-interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE1C,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEvD,oBAAY,SAAS;IACnB,KAAK,UAAU;IACf,OAAO,YAAY;CACpB;AAED,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE9C,MAAM,MAAM,SAAS,GAAG,CACtB,MAAM,EAAE,cAAc,EAAE,EACxB,QAAQ,EAAE,cAAc,EAAE,EAC1B,KAAK,EAAE,YAAY,KAChB,OAAO,CAAC,YAAY,CAAC,CAAC;AAE3B,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,qBAAa,UAAU;IAKZ,IAAI,EAAE,MAAM;IACnB,OAAO,CAAC,KAAK,CAAC;IALT,MAAM,EAAE,cAAc,EAAE,CAAM;IAC9B,QAAQ,EAAE,cAAc,EAAE,CAAM;gBAG9B,IAAI,EAAE,MAAM,EACX,KAAK,CAAC,EAAE,SAAS,YAAA;IAGpB,GAAG,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI;IAW/B,QAAQ,CAAC,GAAG,KAAK,EAAE,cAAc,EAAE,GAAG,IAAI;IAI1C,IAAI,IAAI,MAAM;IAId,QAAQ,IAAI,OAAO;IAIb,QAAQ,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;CAMlE;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,cAAc,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,YAAY,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB"}
+{"version":3,"file":"linter-interface.d.ts","sourceRoot":"","sources":["../../src/lint/linter-interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE1C,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEvD,oBAAY,SAAS;IACnB,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,QAAQ,aAAa;CACtB;AAED,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE9C,MAAM,MAAM,SAAS,GAAG,CACtB,MAAM,EAAE,cAAc,EAAE,EACxB,QAAQ,EAAE,cAAc,EAAE,EAC1B,KAAK,EAAE,YAAY,KAChB,OAAO,CAAC,YAAY,CAAC,CAAC;AAE3B,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,qBAAa,UAAU;IAMZ,IAAI,EAAE,MAAM;IACnB,OAAO,CAAC,KAAK,CAAC;IANT,MAAM,EAAE,cAAc,EAAE,CAAM;IAC9B,QAAQ,EAAE,cAAc,EAAE,CAAM;IAChC,SAAS,EAAE,cAAc,EAAE,CAAM;gBAG/B,IAAI,EAAE,MAAM,EACX,KAAK,CAAC,EAAE,SAAS,YAAA;IAGpB,GAAG,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI;IAc/B,QAAQ,CAAC,GAAG,KAAK,EAAE,cAAc,EAAE,GAAG,IAAI;IAI1C,IAAI,IAAI,MAAM;IAId,QAAQ,IAAI,OAAO;IAIb,QAAQ,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;CAMlE;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,cAAc,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,YAAY,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB"}

package/out/lint/linter-interface.js

@@ -5,12 +5,14 @@ var LintClass;
 (function (LintClass) {
     LintClass["Error"] = "error";
     LintClass["Warning"] = "warning";
+    LintClass["Approval"] = "approval";
 })(LintClass || (exports.LintClass = LintClass = {}));
 class LintResult {
     file;
     fixer;
     errors = [];
     warnings = [];
+    approvals = [];
     constructor(file, fixer) {
         this.file = file;
         this.fixer = fixer;
@@ -20,6 +22,9 @@ class LintResult {
             case LintClass.Error:
                 this.errors.push(rule);
                 break;
+            case LintClass.Approval:
+                this.approvals.push(rule);
+                break;
             default:
                 this.warnings.push(rule);
                 break;
@@ -29,7 +34,7 @@ class LintResult {
         rules.forEach(this.add, this);
     }
     size() {
-        return this.errors.length + this.warnings.length;
+        return this.errors.length + this.warnings.length + this.approvals.length;
     }
     hasFixer() {
         return !!this.fixer;

package/out/lint/linters/server-side-linter/archiver.d.ts

@@ -0,0 +1,13 @@
+export declare class ZipArchiver {
+    private readonly archive;
+    private readonly tempFile;
+    private readonly resolves;
+    private readonly rejects;
+    private constructor();
+    static create(): Promise<ZipArchiver>;
+    addFile(fileName: string, contents: Buffer): void;
+    finalise(): Promise<string>;
+    private readonly onArchiveError;
+    private readonly onClose;
+}
+//# sourceMappingURL=archiver.d.ts.map

package/out/lint/linters/server-side-linter/archiver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"archiver.d.ts","sourceRoot":"","sources":["../../../../src/lint/linters/server-side-linter/archiver.ts"],"names":[],"mappings":"AAaA,qBAAa,WAAW;IAKF,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJ5C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqC;IAC9D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsC;IAC/D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAE3D,OAAO;WAOa,MAAM,IAAI,OAAO,CAAC,WAAW,CAAC;IAM3C,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;IAIjD,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;IAQlC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAK7B;IAEF,OAAO,CAAC,QAAQ,CAAC,OAAO,CAItB;CACH"}

package/out/lint/linters/server-side-linter/archiver.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ZipArchiver = void 0;
+const tslib_1 = require("tslib");
+const node_fs_1 = require("node:fs");
+const tmp_1 = tslib_1.__importDefault(require("tmp"));
+class ZipArchiver {
+    archive;
+    tempFile = tmp_1.default.fileSync({ postfix: '.zip' });
+    resolves = [];
+    rejects = [];
+    constructor(archive) {
+        this.archive = archive;
+        const output = (0, node_fs_1.createWriteStream)(this.tempFile.name).on('close', this.onClose);
+        this.archive.pipe(output);
+        this.archive.on('warning', this.onArchiveError);
+        this.archive.on('error', this.onArchiveError);
+    }
+    static async create() {
+        const { ZipArchive } = await Promise.resolve().then(() => tslib_1.__importStar(require('archiver')));
+        return new ZipArchiver(new ZipArchive());
+    }
+    addFile(fileName, contents) {
+        this.archive.append(contents, { name: fileName });
+    }
+    finalise() {
+        return new Promise((resolve, reject) => {
+            this.resolves.push(resolve);
+            this.rejects.push(reject);
+            return this.archive.finalize();
+        });
+    }
+    onArchiveError = (err) => {
+        const error = new Error(err.message);
+        for (const reject of this.rejects) {
+            reject(error);
+        }
+    };
+    onClose = () => {
+        for (const resolve of this.resolves) {
+            resolve(this.tempFile.name);
+        }
+    };
+}
+exports.ZipArchiver = ZipArchiver;

package/out/lint/linters/server-side-linter/graphql-client.d.ts

@@ -0,0 +1,30 @@
+import { GraphQLClient, UserError } from '@forge/cli-shared';
+interface ManifestCheckChange {
+    added?: (string | null)[] | null;
+    key: string;
+    removed?: (string | null)[] | null;
+}
+export interface ServerSideOutcome {
+    changes?: (ManifestCheckChange | null)[] | null;
+    reason: string;
+    category: string;
+    rule: string;
+    value: boolean;
+}
+export declare class NoManifestURLError extends Error {
+    constructor();
+}
+export declare class MissingManifestError extends UserError {
+    constructor();
+}
+export declare class InvalidManifestError extends UserError {
+    constructor();
+}
+export declare class GraphqlClient {
+    private readonly graphqlClient;
+    constructor(graphqlClient: GraphQLClient);
+    createAppManifestUploadUrl(appId: string, environmentKey: string): Promise<string>;
+    getAppPreDeploymentCheck(appId: string, environmentKey: string, manifestUrl: string, bypassRules: string[]): Promise<ServerSideOutcome[]>;
+}
+export {};
+//# sourceMappingURL=graphql-client.d.ts.map

package/out/lint/linters/server-side-linter/graphql-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graphql-client.d.ts","sourceRoot":"","sources":["../../../../src/lint/linters/server-side-linter/graphql-client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EAEb,SAAS,EAIV,MAAM,mBAAmB,CAAC;AAE3B,UAAU,mBAAmB;IAC3B,KAAK,CAAC,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,CAAC,mBAAmB,GAAG,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,qBAAa,kBAAmB,SAAQ,KAAK;;CAI5C;AAED,qBAAa,oBAAqB,SAAQ,SAAS;;CAIlD;AAED,qBAAa,oBAAqB,SAAQ,SAAS;;CAIlD;AAED,qBAAa,aAAa;IACZ,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAAb,aAAa,EAAE,aAAa;IAE5C,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM;IA+ChE,wBAAwB,CACnC,KAAK,EAAE,MAAM,EACb,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EAAE,GACpB,OAAO,CAAC,iBAAiB,EAAE,CAAC;CAsDhC"}

package/out/lint/linters/server-side-linter/graphql-client.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GraphqlClient = exports.InvalidManifestError = exports.MissingManifestError = exports.NoManifestURLError = void 0;
+const cli_shared_1 = require("@forge/cli-shared");
+class NoManifestURLError extends Error {
+    constructor() {
+        super(cli_shared_1.Text.artifact.error.noManifestUrl);
+    }
+}
+exports.NoManifestURLError = NoManifestURLError;
+class MissingManifestError extends cli_shared_1.UserError {
+    constructor() {
+        super(cli_shared_1.Text.lint.errorMissingManifest);
+    }
+}
+exports.MissingManifestError = MissingManifestError;
+class InvalidManifestError extends cli_shared_1.UserError {
+    constructor() {
+        super(cli_shared_1.Text.lint.errorInvalidManifest);
+    }
+}
+exports.InvalidManifestError = InvalidManifestError;
+class GraphqlClient {
+    graphqlClient;
+    constructor(graphqlClient) {
+        this.graphqlClient = graphqlClient;
+    }
+    async createAppManifestUploadUrl(appId, environmentKey) {
+        const mutation = `
+      mutation forge_cli_createAppManifestUploadUrl($input: CreateAppManifestUploadUrlInput!) {
+        createAppManifestUploadUrl(input: $input) {
+          success
+          preSignedUrl
+          errors {
+            message
+            extensions {
+              errorType
+              statusCode
+            }
+          }
+        }
+      }`;
+        const { response: { createAppManifestUploadUrl: { success, preSignedUrl, errors } }, requestId } = await this.graphqlClient.mutate(mutation, {
+            input: {
+                appId,
+                environmentKey
+            }
+        });
+        if (!success) {
+            const error = (0, cli_shared_1.getError)(errors);
+            throw new cli_shared_1.GraphQlMutationError(`${error.message} (requestId: ${requestId || 'unknown'})`, {
+                requestId,
+                code: error.code,
+                statusCode: error.statusCode
+            });
+        }
+        if (!preSignedUrl) {
+            throw new NoManifestURLError();
+        }
+        return preSignedUrl;
+    }
+    async getAppPreDeploymentCheck(appId, environmentKey, manifestUrl, bypassRules) {
+        const query = `
+      query forge_cli_appPreDeploymentCheck($input: AppPreDeploymentCheckInput!) {
+        appPreDeploymentCheck(input: $input) {
+          outcome {
+            rule
+            category
+            value
+            reason
+            changes {
+              key
+              added
+              removed
+            }
+            errors {
+              key
+              message
+              line
+              column
+            }
+          }
+        }
+      }
+    `;
+        const result = await this.graphqlClient.query(query, {
+            input: {
+                appId,
+                environmentKey,
+                manifestUrl,
+                bypassRules
+            }
+        });
+        if (!result.appPreDeploymentCheck) {
+            throw new MissingManifestError();
+        }
+        if (!result.appPreDeploymentCheck.outcome) {
+            throw new InvalidManifestError();
+        }
+        return result.appPreDeploymentCheck.outcome.filter((p) => p !== null);
+    }
+}
+exports.GraphqlClient = GraphqlClient;

package/out/lint/linters/server-side-linter/server-side-linter.d.ts

@@ -0,0 +1,24 @@
+import { ManifestSchema as Manifest } from '@forge/manifest';
+import { LintFixState, LintLogger, LintResult, LintResultRule } from '../../linter-interface';
+import { AbstractLinter } from '../../abstract-linter';
+import { FileSystemReader, FileUploader, GraphQLClient } from '@forge/cli-shared';
+import { GraphqlClient, ServerSideOutcome } from './graphql-client';
+import { ZipArchiver } from './archiver';
+export declare class ServerSideLinter extends AbstractLinter {
+    private readonly environment;
+    private readonly manifest;
+    private readonly client;
+    private readonly fileReader;
+    private readonly archiver;
+    private readonly fileUploader;
+    private readonly approveRules;
+    private manifestUploadUrl;
+    constructor(environment: string, manifest: Manifest, client: GraphqlClient, fileReader: FileSystemReader, archiver: ZipArchiver, fileUploader: FileUploader, logger: LintLogger, approveRules: string[] | undefined);
+    static instance(environment: string, manifest: Manifest, graphqlClient: GraphQLClient, logger: LintLogger, approveRules?: string[]): Promise<ServerSideLinter>;
+    private mapServerSideResponse;
+    batchExecuteImpl(): Promise<LintResult[]>;
+    bootstrap(): Promise<void>;
+    protected getFixer(): ((errors: LintResultRule[], warnings: LintResultRule[], state: LintFixState) => Promise<LintFixState>) | undefined;
+    protected getResultsForFixer(results: ServerSideOutcome[]): ServerSideOutcome[];
+}
+//# sourceMappingURL=server-side-linter.d.ts.map

package/out/lint/linters/server-side-linter/server-side-linter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-side-linter.d.ts","sourceRoot":"","sources":["../../../../src/lint/linters/server-side-linter/server-side-linter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,cAAc,IAAI,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAa,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACzG,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAsC,MAAM,mBAAmB,CAAC;AACtH,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,qBAAa,gBAAiB,SAAQ,cAAc;IAIhD,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAV/B,OAAO,CAAC,iBAAiB,CAAqB;gBAG3B,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,aAAa,EACrB,UAAU,EAAE,gBAAgB,EAC5B,QAAQ,EAAE,WAAW,EACrB,YAAY,EAAE,YAAY,EAC3C,MAAM,EAAE,UAAU,EACD,YAAY,EAAE,MAAM,EAAE,GAAG,SAAS;WAKxC,QAAQ,CACnB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,QAAQ,EAClB,aAAa,EAAE,aAAa,EAC5B,MAAM,EAAE,UAAU,EAClB,YAAY,CAAC,EAAE,MAAM,EAAE;IAezB,OAAO,CAAC,qBAAqB;IAsBvB,gBAAgB,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAiBzC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAehC,SAAS,CAAC,QAAQ,IACd,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC,GACtG,SAAS;IAIb,SAAS,CAAC,kBAAkB,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,iBAAiB,EAAE;CAIhF"}

package/out/lint/linters/server-side-linter/server-side-linter.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServerSideLinter = void 0;
+const manifest_1 = require("@forge/manifest");
+const linter_interface_1 = require("../../linter-interface");
+const abstract_linter_1 = require("../../abstract-linter");
+const cli_shared_1 = require("@forge/cli-shared");
+const graphql_client_1 = require("./graphql-client");
+const archiver_1 = require("./archiver");
+class ServerSideLinter extends abstract_linter_1.AbstractLinter {
+    environment;
+    manifest;
+    client;
+    fileReader;
+    archiver;
+    fileUploader;
+    approveRules;
+    manifestUploadUrl;
+    constructor(environment, manifest, client, fileReader, archiver, fileUploader, logger, approveRules) {
+        super(logger);
+        this.environment = environment;
+        this.manifest = manifest;
+        this.client = client;
+        this.fileReader = fileReader;
+        this.archiver = archiver;
+        this.fileUploader = fileUploader;
+        this.approveRules = approveRules;
+    }
+    static async instance(environment, manifest, graphqlClient, logger, approveRules) {
+        const fileSystemReader = new cli_shared_1.FileSystemReader();
+        return new ServerSideLinter(environment, manifest, new graphql_client_1.GraphqlClient(graphqlClient), fileSystemReader, await archiver_1.ZipArchiver.create(), new cli_shared_1.HttpFileUploader(fileSystemReader), logger, approveRules);
+    }
+    mapServerSideResponse(results, fixer) {
+        const manifestLintResults = new linter_interface_1.LintResult(manifest_1.MANIFEST_FILE, fixer);
+        manifestLintResults.batchAdd(...(this.getResultsForFixer(results).map(({ rule, reason, category }) => {
+            return {
+                class: category.toLowerCase(),
+                message: reason,
+                reference: rule,
+                line: 0,
+                column: 0,
+                metadata: {}
+            };
+        }) ?? []).sort((a, b) => a.line - b.line));
+        return manifestLintResults;
+    }
+    async batchExecuteImpl() {
+        if (!this.manifestUploadUrl) {
+            throw new Error('Bootstrap failed');
+        }
+        const results = await this.client.getAppPreDeploymentCheck(this.manifest.app.id, this.environment, this.manifestUploadUrl, this.approveRules ? this.approveRules : []);
+        return [this.mapServerSideResponse(results, this.getFixer())];
+    }
+    async bootstrap() {
+        const manifestContent = this.fileReader.readBinaryFile(cli_shared_1.manifestFileName);
+        if (!manifestContent) {
+            throw new Error('No Manifest content found');
+        }
+        this.archiver.addFile(cli_shared_1.manifestFileName, manifestContent);
+        const archivePath = await this.archiver.finalise();
+        const uploadUrl = await this.client.createAppManifestUploadUrl(this.manifest.app.id, this.environment);
+        await this.fileUploader.uploadFromPath(uploadUrl, archivePath);
+        this.manifestUploadUrl = uploadUrl;
+    }
+    getFixer() {
+        return undefined;
+    }
+    getResultsForFixer(results) {
+        return results?.filter((outcome) => outcome.value) || [];
+    }
+}
+exports.ServerSideLinter = ServerSideLinter;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forge/lint",
-  "version": "6.0.3-next.7",
+  "version": "6.0.3-next.7-experimental-116e5ca",
   "description": "Linting for forge apps",
   "main": "out/index.js",
   "license": "SEE LICENSE IN LICENSE.txt",
@@ -11,7 +11,7 @@
   },
   "devDependencies": {
     "@atlassian/xen-test-util": "^4.2.0",
-    "@forge/api": "^8.0.3-next.0",
+    "@forge/api": "^8.0.3-next.0-experimental-116e5ca",
     "@types/array.prototype.flatmap": "^1.2.6",
     "@types/cross-spawn": "^6.0.6",
     "@types/eslint": "8.56.12",
@@ -19,15 +19,17 @@
     "eslint-plugin-import": "^2.29.1"
   },
   "dependencies": {
-    "@forge/cli-shared": "9.3.0-next.7",
-    "@forge/csp": "6.2.0",
+    "@forge/cli-shared": "9.3.0-next.7-experimental-116e5ca",
+    "@forge/csp": "6.2.0-experimental-116e5ca",
     "@forge/egress": "3.0.0",
-    "@forge/manifest": "13.3.0-next.6",
+    "@forge/manifest": "13.3.0-next.6-experimental-116e5ca",
     "@typescript-eslint/typescript-estree": "^5.62.0",
+    "archiver": "^8.0.0",
     "array.prototype.flatmap": "^1.3.3",
     "@atlassian/atlassian-openapi": "^1.0.6",
     "cross-spawn": "^7.0.6",
     "node-fetch": "2.7.0",
+    "tmp": "^0.2.3",
     "typescript": "5.9.2"
   },
   "publishConfig": {