@greensecurity/javascript-sdk 0.46.0-beta.1 → 0.46.0-beta.10

package/dist/commonjs/__tests__/apps/contract.test.js

@@ -0,0 +1,750 @@
+"use strict";
+/*
+ * Hand-written. Tests for the third-party app platform contract in src/apps.
+ *
+ * The JSON files in shared/app-platform are what the server validates against. They are checked
+ * against the TypeScript sources here; regenerate them with
+ *   UPDATE_APP_PLATFORM_JSON=1 npx vitest run src/__tests__/apps
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const vitest_1 = require("vitest");
+const index_js_1 = require("../../apps/index.js");
+// Resolved from the package root (vitest's cwd) rather than `import.meta.url`: Speakeasy also
+// compiles this file to CommonJS, where `import.meta` is a type error (TS1470).
+const SHARED_DIR = (0, node_path_1.resolve)(process.cwd(), "..", "shared", "app-platform");
+function baseManifest() {
+    return {
+        id: 42,
+        name: "Acme Credentials",
+        icon: "https://cdn.acme.com/icon.png",
+        short_description: "Shows Acme status for a vendor.",
+        version: "1.3.0",
+        permissions: [{ permission: "vendors.view", purpose: "Read the vendor you are looking at." }],
+        configuration_instructions: "Install and sign in.",
+        support_instructions: "support@acme.com",
+        constants: { API_BASE: "https://api.acme.com/gs/" },
+        ui_extensions: {
+            bundle: { url: "https://cdn.acme.com/gs-app/1.3.0/app.js", integrity: "sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC" },
+            views: [
+                { viewport: "gs.company.vendor.detail", component: "VendorPanel" },
+                { viewport: "gs.company.drawer.default", component: "Home" },
+                { viewport: "settings", component: "AppSettings" },
+            ],
+            csp: { connect_src: ["https://api.acme.com/gs/"], image_src: ["https://cdn.acme.com/img/"], purpose: "Talk to Acme." },
+        },
+        post_install_action: { type: "app_settings_view" },
+    };
+}
+function withCsp(connectSrc) {
+    const m = baseManifest();
+    const ui = m["ui_extensions"];
+    ui["csp"] = { connect_src: connectSrc, purpose: "x" };
+    return m;
+}
+(0, vitest_1.describe)("surfaces", () => {
+    (0, vitest_1.test)("ids are unique and follow gs.<portal>.<entity>.<kind>", () => {
+        const ids = index_js_1.SURFACES.map((s) => s.id);
+        (0, vitest_1.expect)(new Set(ids).size).toBe(ids.length);
+        for (const s of index_js_1.SURFACES) {
+            if (s.id === "settings")
+                continue;
+            (0, vitest_1.expect)(s.id).toMatch(/^gs\.(vendor|company|facility|system)\.[a-z_]+(\.[a-z_]+)*$/);
+            (0, vitest_1.expect)(s.id.startsWith(`gs.${s.portal}.`)).toBe(true);
+            (0, vitest_1.expect)(s.id.endsWith(s.kind)).toBe(true);
+        }
+    });
+    (0, vitest_1.test)("every route names its portal: a literal portal segment, or [portal] for portal-less surfaces", () => {
+        for (const s of index_js_1.SURFACES) {
+            (0, vitest_1.expect)(s.route.startsWith(s.portal === null ? "/[portal]/" : `/${s.portal}`)).toBe(true);
+        }
+        (0, vitest_1.expect)((0, index_js_1.getSurface)("settings")?.route).toBe("/[portal]/apps/[appId]/settings");
+    });
+    (0, vitest_1.test)("wave 1 is the vendor and company portals only", () => {
+        const wave1Portals = new Set(index_js_1.SURFACES.filter((s) => s.wave === 1).map((s) => s.portal));
+        (0, vitest_1.expect)([...wave1Portals].sort()).toEqual(["company", "vendor", null].sort());
+        (0, vitest_1.expect)((0, index_js_1.surfacesForPortal)("facility")).toEqual([]);
+        (0, vitest_1.expect)((0, index_js_1.surfacesForPortal)("facility", 2).length).toBeGreaterThan(0);
+    });
+    (0, vitest_1.test)("record surfaces name an object type, and every list has a row-action surface", () => {
+        for (const s of index_js_1.SURFACES) {
+            if (s.kind === "detail" || s.kind === "list.row_action")
+                (0, vitest_1.expect)(s.objectType).not.toBeNull();
+            if (s.kind === "list")
+                (0, vitest_1.expect)((0, index_js_1.getSurface)(`${s.id}.row_action`)).toBeDefined();
+        }
+    });
+    (0, vitest_1.test)("isSurfaceId narrows only catalog ids", () => {
+        (0, vitest_1.expect)((0, index_js_1.isSurfaceId)("gs.company.vendor.detail")).toBe(true);
+        (0, vitest_1.expect)((0, index_js_1.isSurfaceId)("gs.company.nope")).toBe(false);
+        (0, vitest_1.expect)((0, index_js_1.isSurfaceId)(7)).toBe(false);
+    });
+});
+(0, vitest_1.describe)("manifest", () => {
+    (0, vitest_1.test)("accepts a complete v2 manifest", () => {
+        const result = (0, index_js_1.validateManifest)(baseManifest());
+        (0, vitest_1.expect)(result.ok).toBe(true);
+    });
+    (0, vitest_1.test)("accepts a back-end-only app: a versioned manifest with no ui_extensions", () => {
+        const m = baseManifest();
+        delete m["ui_extensions"];
+        m["permissions"] = [{ permission: "app_secrets.write", purpose: "Store the customer's API key." }];
+        m["post_install_action"] = { type: "url", url: "https://acme.com/gs/connect" };
+        (0, vitest_1.expect)((0, index_js_1.validateManifest)(m).ok).toBe(true);
+        delete m["post_install_action"];
+        (0, vitest_1.expect)((0, index_js_1.validateManifest)(m).ok).toBe(true);
+    });
+    (0, vitest_1.test)("a versioned manifest's post-install view needs a view to land on (v1 is exempt)", () => {
+        const noViews = baseManifest();
+        delete noViews["ui_extensions"];
+        (0, vitest_1.expect)((0, index_js_1.validateManifest)({ ...noViews, post_install_action: { type: "app_settings_view" } }).ok).toBe(false);
+        (0, vitest_1.expect)((0, index_js_1.validateManifest)({ ...noViews, post_install_action: { type: "app_main_view" } }).ok).toBe(false);
+        const noSettings = baseManifest();
+        const ui = noSettings["ui_extensions"];
+        ui.views = ui.views.filter((v) => v.viewport !== "settings");
+        (0, vitest_1.expect)((0, index_js_1.validateManifest)({ ...noSettings, post_install_action: { type: "app_settings_view" } }).ok).toBe(false);
+        (0, vitest_1.expect)((0, index_js_1.validateManifest)({ ...noSettings, post_install_action: { type: "app_main_view" } }).ok).toBe(true);
+        (0, vitest_1.expect)((0, index_js_1.validateManifest)(baseManifest()).ok).toBe(true);
+        const settingsOnly = baseManifest();
+        const only = settingsOnly["ui_extensions"];
+        only.views = only.views.filter((v) => v.viewport === "settings");
+        (0, vitest_1.expect)((0, index_js_1.validateManifest)({ ...settingsOnly, post_install_action: { type: "app_main_view" } }).ok).toBe(false);
+        (0, vitest_1.expect)((0, index_js_1.validateManifest)({ ...settingsOnly, post_install_action: { type: "app_settings_view" } }).ok).toBe(true);
+    });
+    (0, vitest_1.test)("an omitted post_install_action defaults to what the app can actually show", () => {
+        const backend = baseManifest();
+        delete backend["ui_extensions"];
+        delete backend["post_install_action"];
+        (0, vitest_1.expect)((0, index_js_1.effectivePostInstallAction)(backend)).toBeNull();
+        const settingsOnly = baseManifest();
+        delete settingsOnly["post_install_action"];
+        const ui = settingsOnly["ui_extensions"];
+        ui.views = ui.views.filter((v) => v.viewport === "settings");
+        (0, vitest_1.expect)((0, index_js_1.effectivePostInstallAction)(settingsOnly)).toEqual({ type: "app_settings_view" });
+        const withMain = baseManifest();
+        delete withMain["post_install_action"];
+        (0, vitest_1.expect)((0, index_js_1.effectivePostInstallAction)(withMain)).toEqual({ type: "app_main_view" });
+        const explicit = { ...baseManifest(), post_install_action: { type: "url", url: "https://acme.com/gs/connect" } };
+        (0, vitest_1.expect)((0, index_js_1.effectivePostInstallAction)(explicit)).toEqual({ type: "url", url: "https://acme.com/gs/connect" });
+        // Every default is itself valid for its manifest, so a versioned manifest never installs into a
+        // post-install action the schema would reject if it were written out.
+        for (const m of [backend, settingsOnly, withMain]) {
+            const effective = (0, index_js_1.effectivePostInstallAction)(m);
+            const written = effective === null ? m : { ...m, post_install_action: effective };
+            (0, vitest_1.expect)((0, index_js_1.validateManifest)(written).ok).toBe(true);
+        }
+    });
+    (0, vitest_1.test)("an app-level webhook endpoint takes a named https host and known events", () => {
+        const ok = (webhooks) => (0, index_js_1.validateManifest)({ ...baseManifest(), webhooks }).ok;
+        (0, vitest_1.expect)(ok({ url: "https://api.acme.com/gs/webhooks" })).toBe(true);
+        (0, vitest_1.expect)(ok({ url: "https://api.acme.com/gs/webhooks", events: ["MarketplaceAppActivation.created"] })).toBe(true);
+        (0, vitest_1.expect)(ok({ url: "http://api.acme.com/gs/webhooks" })).toBe(false);
+        (0, vitest_1.expect)(ok({ url: "https://10.0.0.1/hooks" })).toBe(false);
+        (0, vitest_1.expect)(ok({ url: "https://api.acme.com/hooks", events: [] })).toBe(false);
+        (0, vitest_1.expect)(ok({ url: "https://api.acme.com/hooks", events: ["Vendor.created"] })).toBe(false);
+        (0, vitest_1.expect)(ok({ url: "https://api.acme.com/hooks", events: ["MarketplaceAppActivation.created", "MarketplaceAppActivation.created"] })).toBe(false);
+        (0, vitest_1.expect)(ok({ url: "https://api.acme.com/hooks", secret: "x" })).toBe(false);
+        (0, vitest_1.expect)(index_js_1.APP_WEBHOOK_EVENTS).toHaveLength(3);
+    });
+    (0, vitest_1.test)("accepts a v1-style manifest without a bundle or views", () => {
+        const m = baseManifest();
+        delete m["ui_extensions"];
+        delete m["version"];
+        m["id"] = "42";
+        (0, vitest_1.expect)((0, index_js_1.validateManifest)(m).ok).toBe(true);
+    });
+    vitest_1.test.each([
+        ["1", true],
+        ["999999999999999", true],
+        ["1000000000000000", true],
+        ["9007199254740990", true],
+        ["9007199254740991", true],
+        ["9007199254740992", false],
+        ["9007199254740999", false],
+        ["9008000000000000", false],
+        ["10000000000000000", false],
+        ["0", false],
+        ["042", false],
+    ])("a string id %s is accepted only as a safe integer: %s", (id, ok) => {
+        (0, vitest_1.expect)((0, index_js_1.validateManifest)({ ...baseManifest(), id }).ok).toBe(ok);
+        (0, vitest_1.expect)(new RegExp(index_js_1.SAFE_INTEGER_STRING_PATTERN).test(id)).toBe(ok);
+        if (/^[1-9][0-9]*$/.test(id))
+            (0, vitest_1.expect)(Number.isSafeInteger(Number(id)) && BigInt(id) <= BigInt(Number.MAX_SAFE_INTEGER)).toBe(ok);
+    });
+    vitest_1.test.each([
+        ["http scheme", "http://api.acme.com/gs/"],
+        ["bare origin", "https://api.acme.com/"],
+        ["no path", "https://api.acme.com"],
+        ["wildcard spanning a registrable domain", "https://*.com/x/"],
+        ["wildcard under a registrable domain", "https://*.acme.com/api/"],
+        ["wildcard under a public suffix", "https://*.co.uk/x/"],
+        ["wildcard under a private public suffix", "https://*.github.io/x/"],
+        ["an IPv4 loopback literal", "https://127.0.0.1/private/"],
+        ["a private IPv4 literal", "https://10.0.0.1/api/"],
+        ["a numeric last label", "https://0x7f.1/x/"],
+        ["wildcard outside the left-most label", "https://api.*.acme.com/x/"],
+        ["partial-label wildcard", "https://*evil.com/x/"],
+        ["single-label host", "https://localhost/x/"],
+        ["a directive separator", "https://api.acme.com/x;frame-ancestors *"],
+        ["a policy separator", "https://api.acme.com/x,script-src"],
+        ["a quote", "https://api.acme.com/x'unsafe-inline'"],
+        ["non-ASCII", "https://api.acme.com/größe/"],
+        ["credentials", "https://user@api.acme.com/x/"],
+        ["an out-of-range port", "https://api.acme.com:70000/x/"],
+        ["a zero-padded port", "https://api.acme.com:0443/x/"],
+    ])("rejects a CSP source with %s", (_label, source) => {
+        (0, vitest_1.expect)((0, index_js_1.validateManifest)(withCsp([source])).ok).toBe(false);
+    });
+    vitest_1.test.each([
+        "https://api.acme.com/gs/",
+        "https://api.acme.com:8443/v1/users",
+    ])("accepts CSP source %s", (source) => {
+        (0, vitest_1.expect)((0, index_js_1.validateManifest)(withCsp([source])).ok).toBe(true);
+    });
+    (0, vitest_1.test)("rejects an unknown viewport, a duplicate viewport, and views without a bundle", () => {
+        const unknown = baseManifest();
+        unknown["ui_extensions"].views = [{ viewport: "gs.company.nope", component: "X" }];
+        (0, vitest_1.expect)((0, index_js_1.validateManifest)(unknown).ok).toBe(false);
+        const dup = baseManifest();
+        dup["ui_extensions"].views = [
+            { viewport: "settings", component: "A" },
+            { viewport: "settings", component: "B" },
+        ];
+        const dupResult = (0, index_js_1.validateManifest)(dup);
+        (0, vitest_1.expect)(dupResult.ok).toBe(false);
+        if (!dupResult.ok)
+            (0, vitest_1.expect)(dupResult.issues[0]?.path).toBe("ui_extensions.views.1.viewport");
+        const noBundle = baseManifest();
+        delete noBundle["ui_extensions"]["bundle"];
+        (0, vitest_1.expect)((0, index_js_1.validateManifest)(noBundle).ok).toBe(false);
+    });
+    (0, vitest_1.test)("rejects a bad integrity value, unknown keys, and url post-install actions without a url", () => {
+        const badSri = baseManifest();
+        badSri["ui_extensions"].bundle.integrity = "md5-abc";
+        (0, vitest_1.expect)((0, index_js_1.validateManifest)(badSri).ok).toBe(false);
+        (0, vitest_1.expect)((0, index_js_1.validateManifest)({ ...baseManifest(), surprise: true }).ok).toBe(false);
+        (0, vitest_1.expect)((0, index_js_1.validateManifest)({ ...baseManifest(), post_install_action: { type: "url" } }).ok).toBe(false);
+    });
+});
+(0, vitest_1.describe)("manifest review fixes", () => {
+    vitest_1.test.each([
+        "https:///", "https://?x", "https://", "https:// acme.com/x", "http://acme.com/icon.png",
+        "https://user:pw@cdn.acme.com/app.js", "https://cdn.acme.com/app.js;x", "https://cdn.acme.com/a'b.js",
+    ])("rejects malformed https URL %s for icon, bundle and post-install url", (url) => {
+        (0, vitest_1.expect)((0, index_js_1.validateManifest)({ ...baseManifest(), icon: url }).ok).toBe(false);
+        const bundle = baseManifest();
+        bundle["ui_extensions"].bundle.url = url;
+        (0, vitest_1.expect)((0, index_js_1.validateManifest)(bundle).ok).toBe(false);
+        (0, vitest_1.expect)((0, index_js_1.validateManifest)({ ...baseManifest(), post_install_action: { type: "url", url } }).ok).toBe(false);
+    });
+    vitest_1.test.each([
+        ["sha384 digest of the wrong length", { integrity: "sha384-x" }],
+        ["sha256 without padding", { integrity: "sha256-" + "A".repeat(43) }],
+        ["two hashes", { integrity: "sha384-" + "A".repeat(64) + " sha512-" + "A".repeat(86) + "==" }],
+    ])("rejects an integrity value with %s", (_label, bundle) => {
+        const m = baseManifest();
+        Object.assign(m["ui_extensions"].bundle, bundle);
+        (0, vitest_1.expect)((0, index_js_1.validateManifest)(m).ok).toBe(false);
+    });
+    vitest_1.test.each(["sha256-" + "A".repeat(43) + "=", "sha512-" + "A".repeat(86) + "=="])("accepts integrity %s", (integrity) => {
+        const m = baseManifest();
+        m["ui_extensions"].bundle.integrity = integrity;
+        (0, vitest_1.expect)((0, index_js_1.validateManifest)(m).ok).toBe(true);
+    });
+    vitest_1.test.each(["1.0.0-.", "1.0.0-", "01.0.0", "1.0.0-01", "1.0", "1.0.0+"])("rejects version %s", (version) => {
+        (0, vitest_1.expect)((0, index_js_1.validateManifest)({ ...baseManifest(), version }).ok).toBe(false);
+    });
+    vitest_1.test.each(["1.0.0", "1.0.0-rc.1", "1.0.0-alpha-2.x", "1.0.0+build.7", "10.20.30-0.1+sha.abc"])("accepts version %s", (version) => {
+        (0, vitest_1.expect)((0, index_js_1.validateManifest)({ ...baseManifest(), version }).ok).toBe(true);
+    });
+    (0, vitest_1.test)("caps CSP sources per item, per directive and in total so the CSP header stays small", () => {
+        const long = "https://api.acme.com/" + "a".repeat(512);
+        (0, vitest_1.expect)((0, index_js_1.validateManifest)(withCsp([long])).ok).toBe(false);
+        const many = Array.from({ length: 21 }, (_, i) => `https://api${i}.acme.com/x/`);
+        (0, vitest_1.expect)((0, index_js_1.validateManifest)(withCsp(many)).ok).toBe(false);
+        // 20 connect + 20 image sources of ~120 chars each is under the per-item and per-directive
+        // limits but over the 4096-char total budget.
+        const source = (i, kind) => `https://${kind}${i}.acme.com/` + "p".repeat(100) + "/";
+        const m = baseManifest();
+        m["ui_extensions"]["csp"] = {
+            connect_src: Array.from({ length: 20 }, (_, i) => source(i, "c")),
+            image_src: Array.from({ length: 20 }, (_, i) => source(i, "i")),
+            purpose: "x",
+        };
+        const result = (0, index_js_1.validateManifest)(m);
+        (0, vitest_1.expect)(result.ok).toBe(false);
+        if (!result.ok)
+            (0, vitest_1.expect)(result.issues.map((i) => i.path)).toContain("ui_extensions.csp");
+    });
+    (0, vitest_1.test)("accepts https URLs with a port, path and query", () => {
+        (0, vitest_1.expect)((0, index_js_1.validateManifest)({ ...baseManifest(), icon: "https://cdn.acme.com:8443/i/icon.png?v=2" }).ok).toBe(true);
+    });
+    (0, vitest_1.test)("requires version once a bundle or views are declared, not for legacy manifests", () => {
+        const m = baseManifest();
+        delete m["version"];
+        const result = (0, index_js_1.validateManifest)(m);
+        (0, vitest_1.expect)(result.ok).toBe(false);
+        if (!result.ok)
+            (0, vitest_1.expect)(result.issues.map((i) => i.path)).toContain("version");
+    });
+});
+(0, vitest_1.describe)("dev preview", () => {
+    (0, vitest_1.test)("canonical payload has a fixed key order and no whitespace", () => {
+        (0, vitest_1.expect)((0, index_js_1.canonicalBuildPayload)({ ts: 2, seq: 1, integrity: "sha384-x", sessionId: "s1" }))
+            .toBe('{"session_id":"s1","integrity":"sha384-x","seq":1,"ts":2}');
+    });
+    (0, vitest_1.test)("a Node crypto P1363 signature, base64url-encoded, verifies with WebCrypto", async () => {
+        const { generateKeyPairSync, sign } = await import("node:crypto");
+        const { publicKey, privateKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
+        const payload = (0, index_js_1.canonicalBuildPayload)({ sessionId: "s1", integrity: "sha384-abc", seq: 1, ts: 5 });
+        const sig = sign("sha256", Buffer.from(payload), { key: privateKey, dsaEncoding: "ieee-p1363" }).toString("base64url");
+        const jwk = publicKey.export({ format: "jwk" });
+        const key = await globalThis.crypto.subtle.importKey("jwk", jwk, index_js_1.DEV_SIGNATURE_ALGORITHM, false, ["verify"]);
+        const raw = Buffer.from(sig, "base64url");
+        (0, vitest_1.expect)(raw.length).toBe(64);
+        (0, vitest_1.expect)(await globalThis.crypto.subtle.verify(index_js_1.DEV_SIGNATURE_ALGORITHM, key, raw, new TextEncoder().encode(payload))).toBe(true);
+    });
+    (0, vitest_1.test)("a signature made by the CLI verifies in the bootstrap, and fails for a changed payload", async () => {
+        const { subtle } = globalThis.crypto;
+        const keys = await subtle.generateKey(index_js_1.DEV_SIGNATURE_ALGORITHM, true, ["sign", "verify"]);
+        const jwk = await subtle.exportKey("jwk", keys.publicKey);
+        const publicKey = await subtle.importKey("jwk", jwk, index_js_1.DEV_SIGNATURE_ALGORITHM, false, ["verify"]);
+        const payload = (0, index_js_1.canonicalBuildPayload)({ sessionId: "s1", integrity: "sha384-abc", seq: 3, ts: 1000 });
+        const sig = await subtle.sign(index_js_1.DEV_SIGNATURE_ALGORITHM, keys.privateKey, new TextEncoder().encode(payload));
+        (0, vitest_1.expect)(await subtle.verify(index_js_1.DEV_SIGNATURE_ALGORITHM, publicKey, sig, new TextEncoder().encode(payload))).toBe(true);
+        const tampered = (0, index_js_1.canonicalBuildPayload)({ sessionId: "s1", integrity: "sha384-evil", seq: 3, ts: 1000 });
+        (0, vitest_1.expect)(await subtle.verify(index_js_1.DEV_SIGNATURE_ALGORITHM, publicKey, sig, new TextEncoder().encode(tampered))).toBe(false);
+    });
+    (0, vitest_1.test)("dev manifests allow local http sources but not public http, and never permissions or a bundle", () => {
+        const ok = index_js_1.devManifestSchema.safeParse({
+            extends: "green-app.json",
+            constants: { API_BASE: "http://localhost:8888/v1" },
+            ui_extensions: { csp: { connect_src: ["http://localhost:8888/v1", "http://10.0.2.2:8888/", "http://192.168.1.20:8888/"] } },
+        });
+        (0, vitest_1.expect)(ok.success).toBe(true);
+        (0, vitest_1.expect)(index_js_1.devManifestSchema.safeParse({ extends: "x", ui_extensions: { csp: { connect_src: ["http://api.acme.com/"] } } }).success).toBe(false);
+        (0, vitest_1.expect)(index_js_1.devManifestSchema.safeParse({ extends: "x", ui_extensions: { csp: { connect_src: ["http://localhost:8888/x;script-src *"] } } }).success).toBe(false);
+        for (const bad of ["http://10.999.999.999:8888/", "http://localhost:00000/", "http://localhost:65536/", "http://192.168.1.300/", "http://localhost:0/"]) {
+            (0, vitest_1.expect)(index_js_1.devManifestSchema.safeParse({ extends: "x", ui_extensions: { csp: { connect_src: [bad] } } }).success).toBe(false);
+        }
+        for (const good of ["http://10.1.2.3:8888/", "http://localhost:65535/", "http://192.168.0.1/", "http://172.31.255.255:1/"]) {
+            (0, vitest_1.expect)(index_js_1.devManifestSchema.safeParse({ extends: "x", ui_extensions: { csp: { connect_src: [good] } } }).success).toBe(true);
+        }
+        (0, vitest_1.expect)(index_js_1.devManifestSchema.safeParse({ extends: "x", permissions: [] }).success).toBe(false);
+        (0, vitest_1.expect)(index_js_1.devManifestSchema.safeParse({ extends: "x", ui_extensions: { bundle: {} } }).success).toBe(false);
+    });
+    (0, vitest_1.test)("dev manifests reject duplicate viewports like published ones", () => {
+        const dup = index_js_1.devManifestSchema.safeParse({
+            extends: "green-app.json",
+            ui_extensions: { views: [{ viewport: "settings", component: "A" }, { viewport: "settings", component: "B" }] },
+        });
+        (0, vitest_1.expect)(dup.success).toBe(false);
+    });
+    (0, vitest_1.test)("mergeDevManifest rejects a merged CSP over the budget from a partial override", () => {
+        const base = (0, index_js_1.validateManifest)({
+            ...baseManifest(),
+            ui_extensions: {
+                ...baseManifest()["ui_extensions"],
+                csp: { image_src: Array.from({ length: 20 }, (_, i) => `https://i${i}.acme.com/` + "p".repeat(100) + "/"), purpose: "x" },
+            },
+        });
+        if (!base.ok)
+            throw new Error("fixture invalid");
+        const dev = index_js_1.devManifestSchema.parse({
+            extends: "green-app.json",
+            ui_extensions: { csp: { connect_src: Array.from({ length: 20 }, (_, i) => `http://localhost:${4000 + i}/` + "p".repeat(90) + "/") } },
+        });
+        (0, vitest_1.expect)(() => (0, index_js_1.mergeDevManifest)(base.manifest, dev)).toThrow(index_js_1.DevManifestError);
+    });
+    (0, vitest_1.test)("mergeDevManifest merges constants and replaces views and CSP sources", () => {
+        const base = (0, index_js_1.validateManifest)(baseManifest());
+        if (!base.ok)
+            throw new Error("fixture invalid");
+        const merged = (0, index_js_1.mergeDevManifest)(base.manifest, {
+            extends: "green-app.json",
+            constants: { DEBUG: true },
+            ui_extensions: {
+                views: [{ viewport: "gs.company.vendor.list", component: "VendorList" }],
+                csp: { connect_src: ["http://localhost:8888/v1"] },
+            },
+        });
+        (0, vitest_1.expect)(merged.constants).toEqual({ API_BASE: "https://api.acme.com/gs/", DEBUG: true });
+        (0, vitest_1.expect)(merged.ui_extensions?.views).toEqual([{ viewport: "gs.company.vendor.list", component: "VendorList" }]);
+        (0, vitest_1.expect)(merged.ui_extensions?.csp).toEqual({
+            connect_src: ["http://localhost:8888/v1"],
+            image_src: ["https://cdn.acme.com/img/"],
+            purpose: "Talk to Acme.",
+        });
+        (0, vitest_1.expect)(merged.ui_extensions?.bundle).toEqual(base.manifest.ui_extensions?.bundle);
+        (0, vitest_1.expect)(merged.permissions).toEqual(base.manifest.permissions);
+    });
+});
+(0, vitest_1.describe)("components", () => {
+    (0, vitest_1.test)("tag names are unique ui-* names and every allowed child exists", () => {
+        const specs = Object.values(index_js_1.COMPONENTS);
+        const tags = specs.map((c) => c.tagName);
+        (0, vitest_1.expect)(new Set(tags).size).toBe(tags.length);
+        for (const c of specs) {
+            (0, vitest_1.expect)(c.tagName).toMatch(/^ui-[a-z]+(-[a-z]+)*$/);
+            for (const child of c.children ?? [])
+                (0, vitest_1.expect)((0, index_js_1.getComponentByTag)(child)).toBeDefined();
+        }
+    });
+    (0, vitest_1.test)("text-level containers only allow text-level children", () => {
+        (0, vitest_1.expect)(index_js_1.COMPONENTS.Inline.children).toEqual(["ui-inline", "ui-link"]);
+        (0, vitest_1.expect)(index_js_1.COMPONENTS.Text.children).toEqual(["ui-inline", "ui-link"]);
+    });
+    (0, vitest_1.test)("only ContextView and SettingsView are roots", () => {
+        const roots = Object.entries(index_js_1.COMPONENTS).filter(([, c]) => "root" in c).map(([name]) => name);
+        (0, vitest_1.expect)(roots.sort()).toEqual(["ContextView", "SettingsView"]);
+    });
+    (0, vitest_1.test)("sanitizeProps keeps declared props of the right type and drops everything else", () => {
+        const result = (0, index_js_1.sanitizeProps)("ui-button", {
+            type: "primary",
+            size: "huge",
+            style: { color: "red" },
+            className: "bg-red-500",
+            href: "javascript:alert(1)",
+            disabled: true,
+        });
+        (0, vitest_1.expect)(result.props).toEqual({ type: "primary", disabled: true });
+        (0, vitest_1.expect)(result.dropped.sort()).toEqual(["className", "href", "size", "style"]);
+        (0, vitest_1.expect)(result.missing).toEqual([]);
+    });
+    (0, vitest_1.test)("sanitizeProps accepts route descriptors and https hrefs, and reports missing required props", () => {
+        (0, vitest_1.expect)((0, index_js_1.sanitizeProps)("ui-link", { href: { type: "surface", surfaceId: "gs.company.vendor.detail", objectId: 5 } }).props["href"])
+            .toBeDefined();
+        (0, vitest_1.expect)((0, index_js_1.sanitizeProps)("ui-link", { href: "https://acme.com/help" }).props["href"]).toBe("https://acme.com/help");
+        const img = (0, index_js_1.sanitizeProps)("ui-img", { src: "http://tracker.example/pixel.gif" });
+        (0, vitest_1.expect)(img.props).toEqual({});
+        (0, vitest_1.expect)(img.missing.sort()).toEqual(["alt", "src"]);
+        (0, vitest_1.expect)((0, index_js_1.sanitizeProps)("ui-script", { src: "x" })).toEqual({ props: {}, dropped: ["src"], missing: [] });
+    });
+    vitest_1.test.each(["https:///", "https://?x", "https://user@acme.com/x", "https://acme.com/a;b"])("sanitizeProps drops malformed https destination %s from href, img src and externalLink", (url) => {
+        (0, vitest_1.expect)((0, index_js_1.sanitizeProps)("ui-link", { href: url }).dropped).toEqual(["href"]);
+        (0, vitest_1.expect)((0, index_js_1.sanitizeProps)("ui-img", { src: url, alt: "x" }).dropped).toEqual(["src"]);
+        (0, vitest_1.expect)((0, index_js_1.sanitizeProps)("ui-context-view", { title: "T", externalLink: { href: url, label: "x" } }).dropped).toEqual(["externalLink"]);
+    });
+    (0, vitest_1.test)("required strings must be non-blank", () => {
+        (0, vitest_1.expect)((0, index_js_1.sanitizeProps)("ui-text-field", { label: "" }).missing).toEqual(["label"]);
+        (0, vitest_1.expect)((0, index_js_1.sanitizeProps)("ui-text-field", { label: "   " }).missing).toEqual(["label"]);
+        (0, vitest_1.expect)((0, index_js_1.sanitizeProps)("ui-context-view", { title: "" }).missing).toEqual(["title"]);
+        (0, vitest_1.expect)((0, index_js_1.componentsCatalogJson)().find((c) => c.name === "TextField")?.props["label"]?.minLength).toBe(1);
+    });
+    (0, vitest_1.test)("form controls require an accessible label and accept hideLabel", () => {
+        for (const tag of ["ui-text-field", "ui-text-area", "ui-select", "ui-checkbox", "ui-switch", "ui-radio-group", "ui-date-field"]) {
+            (0, vitest_1.expect)((0, index_js_1.sanitizeProps)(tag, {}).missing).toContain("label");
+            const labelled = (0, index_js_1.sanitizeProps)(tag, { label: "Email", hideLabel: true });
+            (0, vitest_1.expect)(labelled.missing).toEqual([]);
+            (0, vitest_1.expect)(labelled.props).toEqual({ label: "Email", hideLabel: true });
+        }
+    });
+    (0, vitest_1.describe)("data: image sources", () => {
+        const dataUrl = (type, bytes) => `data:image/${type};base64,${Buffer.from(bytes).toString("base64")}`;
+        const be32 = (n) => [(n >>> 24) & 255, (n >>> 16) & 255, (n >>> 8) & 255, n & 255];
+        const le16 = (n) => [n & 255, (n >>> 8) & 255];
+        const le24 = (n) => [n & 255, (n >>> 8) & 255, (n >>> 16) & 255];
+        const ascii = (s) => [...s].map((c) => c.charCodeAt(0));
+        const png = (w, h) => dataUrl("png", [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0, 0, 0, 13, ...ascii("IHDR"), ...be32(w), ...be32(h), 8, 6, 0, 0, 0]);
+        const gif = (w, h) => dataUrl("gif", [...ascii("GIF89a"), ...le16(w), ...le16(h), 0, 0, 0]);
+        const jpeg = (w, h) => dataUrl("jpeg", [0xff, 0xd8, 0xff, 0xe0, 0, 4, 0, 0, 0xff, 0xc0, 0, 11, 8, h >> 8, h & 255, w >> 8, w & 255, 3, 0, 0, 0]);
+        const webpX = (w, h) => dataUrl("webp", [...ascii("RIFF"), 0, 0, 0, 0, ...ascii("WEBP"), ...ascii("VP8X"), 10, 0, 0, 0, 0, 0, 0, 0, ...le24(w - 1), ...le24(h - 1), 0, 0]);
+        const webpL = (w, h) => {
+            const bits = ((w - 1) & 0x3fff) | (((h - 1) & 0x3fff) << 14);
+            return dataUrl("webp", [...ascii("RIFF"), 0, 0, 0, 0, ...ascii("WEBP"), ...ascii("VP8L"), 5, 0, 0, 0, 0x2f,
+                bits & 255, (bits >>> 8) & 255, (bits >>> 16) & 255, (bits >>> 24) & 255, 0, 0, 0, 0, 0]);
+        };
+        const img = (src) => (0, index_js_1.sanitizeProps)("ui-img", { src, alt: "x" }).dropped;
+        vitest_1.test.each([["png", png], ["jpeg", jpeg], ["webp VP8X", webpX], ["webp VP8L", webpL]])("%s: accepts a small image and rejects one whose header declares too many pixels", (_type, make) => {
+            (0, vitest_1.expect)(img(make(64, 64))).toEqual([]);
+            (0, vitest_1.expect)(img(make(1024, 1024))).toEqual([]);
+            (0, vitest_1.expect)(img(make(1025, 1024))).toEqual(["src"]);
+            (0, vitest_1.expect)(img(make(2049, 16))).toEqual(["src"]);
+            (0, vitest_1.expect)(img(make(3000, 3000))).toEqual(["src"]);
+        });
+        (0, vitest_1.test)("rejects an empty size, a header that does not match its type, and oversized or malformed data", () => {
+            (0, vitest_1.expect)(img(png(0, 10))).toEqual(["src"]);
+            (0, vitest_1.expect)(img(png(64, 64).replace("image/png", "image/gif"))).toEqual(["src"]);
+            (0, vitest_1.expect)(img("data:image/png;base64," + "A".repeat(100))).toEqual(["src"]);
+            (0, vitest_1.expect)(img("data:image/png;base64," + "A".repeat(index_js_1.DATA_IMAGE_MAX_CHARS))).toEqual(["src"]);
+            (0, vitest_1.expect)(img("data:image/png;base64,iVBORw0KGgo")).toEqual(["src"]);
+            (0, vitest_1.expect)(img("data:image/svg+xml;base64,PHN2Zz4=")).toEqual(["src"]);
+            // GIF frames carry their own sizes, so a GIF is never accepted as a data: URL.
+            (0, vitest_1.expect)(img(gif(1, 1))).toEqual(["src"]);
+        });
+    });
+    vitest_1.test.each([
+        ["ui-progress", { label: "Upload" }, "value", [0, 42.5, 100], [-1, 100.5, Number.NaN, Number.POSITIVE_INFINITY]],
+        ["ui-img", { src: "https://cdn.acme.com/a.png", alt: "A" }, "width", [1, 640, 4096], [0, -5, 12.5, 4097]],
+        ["ui-img", { src: "https://cdn.acme.com/a.png", alt: "A" }, "height", [1, 480, 4096], [0, -5, 0.5, 4097]],
+        ["ui-text-field", { label: "Name" }, "maxLength", [1, 10000], [0, -1, 2.5, 10001]],
+        ["ui-text-area", { label: "Notes" }, "rows", [1, 50], [0, -3, 1.5, 51]],
+        ["ui-text-area", { label: "Notes" }, "maxLength", [1, 50000], [0, 3.5, 50001]],
+    ])("%s %s: bounded numeric prop %s", (tag, base, prop, good, bad) => {
+        for (const v of good)
+            (0, vitest_1.expect)((0, index_js_1.sanitizeProps)(tag, { ...base, [prop]: v }).dropped).toEqual([]);
+        for (const v of bad) {
+            const result = (0, index_js_1.sanitizeProps)(tag, { ...base, [prop]: v });
+            (0, vitest_1.expect)(result.props[prop]).toBeUndefined();
+        }
+    });
+    (0, vitest_1.test)("the catalog JSON carries numeric bounds", () => {
+        const img = (0, index_js_1.componentsCatalogJson)().find((c) => c.tagName === "ui-img");
+        (0, vitest_1.expect)(img?.props["width"]).toEqual({ type: "number", required: false, integer: true, minimum: 1, maximum: 4096 });
+        const progress = (0, index_js_1.componentsCatalogJson)().find((c) => c.tagName === "ui-progress");
+        (0, vitest_1.expect)(progress?.props["value"]).toEqual({ type: "number", required: true, minimum: 0, maximum: 100 });
+    });
+    (0, vitest_1.test)("bootstrap init carries the protocol version the context declares (compile-time)", () => {
+        const bundle = { url: "https://cdn.acme.com/app.js", integrity: "sha384-" + "A".repeat(64) };
+        const ok = { kind: "init", protocolVersion: 1, appId: 1, bundle };
+        // @ts-expect-error: only the current PROTOCOL_VERSION is a valid init version.
+        const unsupported = { kind: "init", protocolVersion: 2, appId: 1, bundle };
+        (0, vitest_1.expect)([ok, unsupported]).toHaveLength(2);
+    });
+    vitest_1.test.each([
+        ["2026-09-23", true],
+        ["2024-02-29", true],
+        ["0001-01-01", true],
+        ["2026-02-29", false],
+        ["2026-02-31", false],
+        ["2026-13-01", false],
+        ["2026-00-10", false],
+        ["2026-9-23", false],
+        ["not-a-date", false],
+        ["2026-09-23T00:00:00Z", false],
+    ])("DateField dates must exist: %s -> %s", (date, ok) => {
+        (0, vitest_1.expect)((0, index_js_1.isCalendarDate)(date)).toBe(ok);
+        for (const prop of ["value", "defaultValue", "min", "max"]) {
+            const dropped = (0, index_js_1.sanitizeProps)("ui-date-field", { label: "Due", [prop]: date }).dropped;
+            (0, vitest_1.expect)(dropped).toEqual(ok ? [] : [prop]);
+        }
+    });
+    (0, vitest_1.test)("the catalog JSON marks DateField props as dates", () => {
+        const field = (0, index_js_1.componentsCatalogJson)().find((c) => c.tagName === "ui-date-field");
+        (0, vitest_1.expect)(field?.props["value"]).toEqual({ type: "string", required: false, maxLength: 10, format: "date" });
+    });
+    (0, vitest_1.test)("Button and Link accept an accessibilityLabel for icon-only content", () => {
+        for (const tag of ["ui-button", "ui-link"]) {
+            (0, vitest_1.expect)((0, index_js_1.sanitizeProps)(tag, { accessibilityLabel: "Refresh" }).props).toEqual({ accessibilityLabel: "Refresh" });
+            (0, vitest_1.expect)((0, index_js_1.sanitizeProps)(tag, { accessibilityLabel: "x".repeat(201) }).dropped).toEqual(["accessibilityLabel"]);
+        }
+    });
+    (0, vitest_1.test)("external links and close-confirmation text must be visible", () => {
+        const link = (label) => (0, index_js_1.sanitizeProps)("ui-context-view", { title: "T", externalLink: { href: "https://acme.com/", label } }).dropped;
+        (0, vitest_1.expect)(link("Acme")).toEqual([]);
+        (0, vitest_1.expect)(link("")).toEqual(["externalLink"]);
+        (0, vitest_1.expect)(link("   ")).toEqual(["externalLink"]);
+        (0, vitest_1.expect)(link("x".repeat(101))).toEqual(["externalLink"]);
+        const messages = { title: "Discard?", description: "Unsaved changes will be lost.", cancelAction: "Keep editing", exitAction: "Discard" };
+        const confirm = (m) => (0, index_js_1.sanitizeProps)("ui-focus-view", { title: "T", confirmCloseMessages: m }).dropped;
+        (0, vitest_1.expect)(confirm(messages)).toEqual([]);
+        for (const key of Object.keys(messages)) {
+            (0, vitest_1.expect)(confirm({ ...messages, [key]: " " })).toEqual(["confirmCloseMessages"]);
+        }
+    });
+    (0, vitest_1.test)("json props are shape-checked", () => {
+        (0, vitest_1.expect)((0, index_js_1.sanitizeProps)("ui-context-view", { title: "T", externalLink: { href: "http://x", label: "x" } }).dropped).toEqual(["externalLink"]);
+        (0, vitest_1.expect)((0, index_js_1.sanitizeProps)("ui-context-view", { title: "T", externalLink: { href: "https://acme.com/", label: "Acme" } }).dropped).toEqual([]);
+    });
+    (0, vitest_1.test)("ComponentProps types real props and handler details (compile-time)", () => {
+        const view = { title: "x", actions: "a", children: "c" };
+        const box = { stack: "y", gap: "small" };
+        const field = { label: "Email", hideLabel: true, onChange: (v) => v.length };
+        const check = { label: "OK", onChange: (checked) => !checked };
+        const button = { type: "primary", onPress: () => undefined };
+        // A name that is both a data prop and a slot takes either a string or slotted content.
+        const asText = { label: "Status", value: "Active" };
+        const asSlot = { label: "Status", value: { el: true } };
+        // @ts-expect-error unknown prop on a component with no events or slots
+        const bad = { style: {} };
+        // @ts-expect-error label is required on form controls
+        const unlabelled = {};
+        (0, vitest_1.expect)([view, box, field, check, button, asText, asSlot, bad, unlabelled]).toHaveLength(9);
+    });
+    (0, vitest_1.test)("the catalog serializes to JSON", () => {
+        const json = (0, index_js_1.componentsCatalogJson)();
+        (0, vitest_1.expect)(json.find((c) => c.name === "Button")?.events).toEqual({ onPress: "press" });
+        (0, vitest_1.expect)(() => JSON.stringify(json)).not.toThrow();
+    });
+});
+(0, vitest_1.describe)("protocol and helpers", () => {
+    (0, vitest_1.test)("isBootstrapToHost accepts known envelopes only", () => {
+        (0, vitest_1.expect)((0, index_js_1.isBootstrapToHost)({ kind: "ready" })).toBe(true);
+        (0, vitest_1.expect)((0, index_js_1.isBootstrapToHost)({ kind: "reloaded", seq: 2 })).toBe(true);
+        (0, vitest_1.expect)((0, index_js_1.isBootstrapToHost)({ kind: "exec", code: "x" })).toBe(false);
+        (0, vitest_1.expect)((0, index_js_1.isBootstrapToHost)("ready")).toBe(false);
+    });
+    vitest_1.test.each([
+        { kind: "reloaded" },
+        { kind: "reloaded", seq: "2" },
+        { kind: "log" },
+        { kind: "log", level: "shout", message: "x" },
+        { kind: "build_error", diagnostics: null },
+        { kind: "build_error", diagnostics: [{ line: 3 }] },
+        { kind: "crashed" },
+        { kind: "integrity_failed", reason: 1 },
+        { kind: "thread" },
+    ])("isBootstrapToHost rejects malformed payload %j", (envelope) => {
+        (0, vitest_1.expect)((0, index_js_1.isBootstrapToHost)(envelope)).toBe(false);
+    });
+    (0, vitest_1.test)("isBootstrapToHost accepts well-formed payloads of every kind", () => {
+        (0, vitest_1.expect)((0, index_js_1.isBootstrapToHost)({ kind: "thread", data: null })).toBe(true);
+        (0, vitest_1.expect)((0, index_js_1.isBootstrapToHost)({ kind: "crashed", reason: "oom" })).toBe(true);
+        (0, vitest_1.expect)((0, index_js_1.isBootstrapToHost)({ kind: "log", level: "warn", message: "x" })).toBe(true);
+        (0, vitest_1.expect)((0, index_js_1.isBootstrapToHost)({ kind: "build_error", diagnostics: [{ file: "a.tsx", line: 3, message: "x" }] })).toBe(true);
+    });
+    (0, vitest_1.test)("an init names exactly one code source", () => {
+        const published = { kind: "init", protocolVersion: 1, appId: 1, bundle: { url: "https://a.b/c.js", integrity: "sha384-x" } };
+        (0, vitest_1.expect)(published.kind).toBe("init");
+        // @ts-expect-error neither bundle nor devSession
+        const neither = { kind: "init", protocolVersion: 1, appId: 1 };
+        (0, vitest_1.expect)(neither).toBeDefined();
+    });
+    (0, vitest_1.test)("isRouteDescriptor rejects paths and malformed ids", () => {
+        (0, vitest_1.expect)((0, index_js_1.isRouteDescriptor)({ type: "appSettings" })).toBe(true);
+        (0, vitest_1.expect)((0, index_js_1.isRouteDescriptor)({ type: "surface", surfaceId: "gs.vendor.facility.detail", objectId: 3 })).toBe(true);
+        (0, vitest_1.expect)((0, index_js_1.isRouteDescriptor)({ type: "surface", surfaceId: "gs.vendor.facility.detail", objectId: -1 })).toBe(false);
+        (0, vitest_1.expect)((0, index_js_1.isRouteDescriptor)({ type: "path", path: "/admin" })).toBe(false);
+        (0, vitest_1.expect)((0, index_js_1.isRouteDescriptor)({ type: "appSettings", envParams: { a: 1 } })).toBe(false);
+        (0, vitest_1.expect)((0, index_js_1.isRouteDescriptor)({ type: "surface", surfaceId: "gs.company.nope" })).toBe(false);
+        (0, vitest_1.expect)((0, index_js_1.isRouteDescriptor)({ type: "surface", surfaceId: "gs.company.vendor.detail", objectId: 2 ** 53 })).toBe(false);
+        // `settings` is reachable only as `appSettings`: as a surface its objectId would name another app.
+        (0, vitest_1.expect)((0, index_js_1.isRouteDescriptor)({ type: "surface", surfaceId: "settings", objectId: 7 })).toBe(false);
+        (0, vitest_1.expect)((0, index_js_1.isRouteDescriptor)({ type: "surface", surfaceId: "settings" })).toBe(false);
+        (0, vitest_1.expect)((0, index_js_1.sanitizeProps)("ui-link", { href: { type: "surface", surfaceId: "gs.company.nope" } }).dropped).toEqual(["href"]);
+    });
+    (0, vitest_1.test)("tokenNeedsRefresh fires a minute before expiry", () => {
+        (0, vitest_1.expect)((0, index_js_1.tokenNeedsRefresh)({ expiresAt: 1000000 }, 1000000 - 61000)).toBe(false);
+        (0, vitest_1.expect)((0, index_js_1.tokenNeedsRefresh)({ expiresAt: 1000000 }, 1000000 - 60000)).toBe(true);
+    });
+});
+(0, vitest_1.describe)("bundle hygiene", () => {
+    // The host renderer imports these; a value import of zod (directly or via manifest.ts or
+    // devpreview.ts) would pull zod into the host app bundle. Type-only imports are erased.
+    vitest_1.test.each(["surfaces.ts", "route.ts", "context.ts", "protocol.ts", "components.ts", "url.ts", "devsession.ts", "review.ts"])("%s has no value import of zod, manifest.ts or devpreview.ts", (file) => {
+        const source = (0, node_fs_1.readFileSync)((0, node_path_1.resolve)(process.cwd(), "src", "apps", file), "utf8");
+        const valueImports = source.match(/^import (?!type )[^;]*from "[^"]+";/gm) ?? [];
+        for (const line of valueImports)
+            (0, vitest_1.expect)(line).not.toMatch(/"(zod[^"]*|\.\/manifest\.js|\.\/devpreview\.js)"/);
+    });
+});
+(0, vitest_1.describe)("platform permissions", () => {
+    (0, vitest_1.test)("app_secrets.write is a platform permission a manifest can list", () => {
+        (0, vitest_1.expect)((0, index_js_1.isPlatformPermission)("app_secrets.write")).toBe(true);
+        (0, vitest_1.expect)((0, index_js_1.isPlatformPermission)("vendors.view")).toBe(false);
+        (0, vitest_1.expect)((0, index_js_1.isPlatformPermission)(undefined)).toBe(false);
+        for (const { permission } of index_js_1.PLATFORM_PERMISSIONS) {
+            const result = (0, index_js_1.validateManifest)({ ...baseManifest(), permissions: [{ permission, purpose: "Store API keys." }] });
+            (0, vitest_1.expect)(result.ok).toBe(true);
+        }
+    });
+});
+(0, vitest_1.describe)("catalog review rules", () => {
+    (0, vitest_1.test)("a permission that writes, or that reads records about people, is sensitive", () => {
+        (0, vitest_1.expect)((0, index_js_1.isSensitivePermission)("facilities.view")).toBe(false);
+        (0, vitest_1.expect)((0, index_js_1.isSensitivePermission)("zones.search")).toBe(false);
+        (0, vitest_1.expect)((0, index_js_1.isSensitivePermission)("facilities.edit")).toBe(true);
+        (0, vitest_1.expect)((0, index_js_1.isSensitivePermission)("zones.add")).toBe(true);
+        (0, vitest_1.expect)((0, index_js_1.isSensitivePermission)("zones.delete")).toBe(true);
+        (0, vitest_1.expect)((0, index_js_1.isSensitivePermission)("app_secrets.write")).toBe(true);
+        (0, vitest_1.expect)((0, index_js_1.isSensitivePermission)("vendors.view")).toBe(true);
+        (0, vitest_1.expect)((0, index_js_1.isSensitivePermission)("users.view")).toBe(true);
+        // A name the rule cannot read is treated as the stricter case.
+        (0, vitest_1.expect)((0, index_js_1.isSensitivePermission)("vendors")).toBe(true);
+        (0, vitest_1.expect)((0, index_js_1.isSensitivePermission)(".view")).toBe(true);
+    });
+    (0, vitest_1.test)("a manifest permission may carry a justification", () => {
+        const permissions = [{ permission: "vendors.view", purpose: "Show each rep's status next to their record.", justification: "The panel is about the vendor on screen." }];
+        (0, vitest_1.expect)((0, index_js_1.validateManifest)({ ...baseManifest(), permissions }).ok).toBe(true);
+        (0, vitest_1.expect)((0, index_js_1.validateManifest)({ ...baseManifest(), permissions: [{ ...permissions[0], justification: "" }] }).ok).toBe(false);
+        (0, vitest_1.expect)((0, index_js_1.validateManifest)({ ...baseManifest(), permissions: [{ ...permissions[0], justification: "x".repeat(1001) }] }).ok).toBe(false);
+        const schema = JSON.stringify((0, index_js_1.manifestJsonSchema)());
+        (0, vitest_1.expect)(schema).toContain('"justification"');
+    });
+    (0, vitest_1.test)("a denylisted domain matches itself and names under it, and nothing else", () => {
+        (0, vitest_1.expect)((0, index_js_1.cspDenylistEntry)("abc-def.trycloudflare.com")).toEqual({ domain: "trycloudflare.com", category: "tunnel" });
+        (0, vitest_1.expect)((0, index_js_1.cspDenylistEntry)("TRYCLOUDFLARE.COM.")?.category).toBe("tunnel");
+        (0, vitest_1.expect)((0, index_js_1.cspDenylistEntry)("raw.githubusercontent.com")?.category).toBe("raw_code_host");
+        (0, vitest_1.expect)((0, index_js_1.cspDenylistEntry)("10.0.0.1.nip.io")?.category).toBe("dynamic_dns");
+        (0, vitest_1.expect)((0, index_js_1.cspDenylistEntry)("bit.ly")?.category).toBe("url_shortener");
+        (0, vitest_1.expect)((0, index_js_1.cspDenylistEntry)("pastebin.com")?.category).toBe("pastebin");
+        (0, vitest_1.expect)((0, index_js_1.cspDenylistEntry)("api.acme.com")).toBeUndefined();
+        // A suffix match needs a label boundary: this is somebody else's domain.
+        (0, vitest_1.expect)((0, index_js_1.cspDenylistEntry)("notngrok.io")).toBeUndefined();
+        (0, vitest_1.expect)((0, index_js_1.cspDenylistEntry)("githubusercontent.com")).toBeUndefined();
+    });
+    (0, vitest_1.test)("every denylist domain is a lower-case DNS name, listed once", () => {
+        const domains = index_js_1.CSP_DENYLIST.map((entry) => entry.domain);
+        (0, vitest_1.expect)(new Set(domains).size).toBe(domains.length);
+        for (const domain of domains)
+            (0, vitest_1.expect)(domain).toMatch(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/);
+    });
+    (0, vitest_1.describe)("permissionReviewIssues", () => {
+        const good = "Show each rep's credential status next to their vendor record.";
+        const why = "The vendor panel is the whole app: without this it has nothing to show.";
+        (0, vitest_1.test)("checks only the permissions a submission adds", () => {
+            const permissions = [{ permission: "vendors.view", purpose: "short" }];
+            (0, vitest_1.expect)((0, index_js_1.permissionReviewIssues)(permissions, new Set())).toEqual([]);
+            (0, vitest_1.expect)((0, index_js_1.permissionReviewIssues)(permissions, new Set(["vendors.view"])).map((i) => i.code)).toEqual(["purpose_too_short", "justification_required"]);
+        });
+        (0, vitest_1.test)("a purpose at the minimum length passes; one character less does not", () => {
+            const min = index_js_1.REVIEW_RULES.purpose_min_chars;
+            const at = [{ permission: "facilities.view", purpose: "a".repeat(min) }];
+            const under = [{ permission: "facilities.view", purpose: ` ${"a".repeat(min - 1)} ` }];
+            (0, vitest_1.expect)((0, index_js_1.permissionReviewIssues)(at, new Set(["facilities.view"]))).toEqual([]);
+            (0, vitest_1.expect)((0, index_js_1.permissionReviewIssues)(under, new Set(["facilities.view"])).map((i) => i.code)).toEqual(["purpose_too_short"]);
+        });
+        (0, vitest_1.test)("a purpose that is only the permission's name is refused", () => {
+            for (const purpose of ["facilities.view", "Facilities", "view facilities", "  FACILITIES   VIEW  "]) {
+                const codes = (0, index_js_1.permissionReviewIssues)([{ permission: "facilities.view", purpose }], new Set(["facilities.view"])).map((i) => i.code);
+                (0, vitest_1.expect)(codes).toContain("purpose_is_permission_name");
+            }
+        });
+        (0, vitest_1.test)("a purpose repeated across entries is refused on the added one", () => {
+            const permissions = [
+                { permission: "facilities.view", purpose: good },
+                { permission: "zones.view", purpose: `${good.toUpperCase()}!` },
+            ];
+            const issues = (0, index_js_1.permissionReviewIssues)(permissions, new Set(["zones.view"]));
+            (0, vitest_1.expect)(issues).toEqual([vitest_1.expect.objectContaining({ code: "purpose_repeated", path: "permissions.1.purpose" })]);
+        });
+        (0, vitest_1.test)("a sensitive permission needs a justification of its own", () => {
+            const add = new Set(["vendors.edit"]);
+            (0, vitest_1.expect)((0, index_js_1.permissionReviewIssues)([{ permission: "vendors.edit", purpose: good, justification: why }], add)).toEqual([]);
+            (0, vitest_1.expect)((0, index_js_1.permissionReviewIssues)([{ permission: "vendors.edit", purpose: good }], add).map((i) => i.code)).toEqual(["justification_required"]);
+            (0, vitest_1.expect)((0, index_js_1.permissionReviewIssues)([{ permission: "vendors.edit", purpose: good, justification: "   " }], add).map((i) => i.code)).toEqual(["justification_required"]);
+            (0, vitest_1.expect)((0, index_js_1.permissionReviewIssues)([{ permission: "vendors.edit", purpose: good, justification: "Because." }], add).map((i) => i.code)).toEqual(["justification_too_short"]);
+            (0, vitest_1.expect)((0, index_js_1.permissionReviewIssues)([{ permission: "vendors.edit", purpose: good, justification: good }], add).map((i) => i.code)).toEqual(["justification_repeats_purpose"]);
+        });
+    });
+});
+(0, vitest_1.describe)("shared/app-platform JSON", () => {
+    const files = [
+        ["manifest.schema.json", (0, index_js_1.manifestJsonSchema)()],
+        ["surfaces.json", index_js_1.SURFACES],
+        ["components.json", (0, index_js_1.componentsCatalogJson)()],
+        ["platform-permissions.json", index_js_1.PLATFORM_PERMISSIONS],
+        ["review-rules.json", index_js_1.REVIEW_RULES],
+        ["csp-denylist.json", index_js_1.CSP_DENYLIST],
+    ];
+    vitest_1.test.each(files)("%s matches the TypeScript source", (name, value) => {
+        const expected = `${JSON.stringify(value, null, 2)}\n`;
+        const url = (0, node_path_1.resolve)(SHARED_DIR, name);
+        if (process.env["UPDATE_APP_PLATFORM_JSON"] === "1")
+            (0, node_fs_1.writeFileSync)(url, expected);
+        (0, vitest_1.expect)((0, node_fs_1.readFileSync)(url, "utf8")).toBe(expected);
+    });
+});
+(0, vitest_1.describe)("mergeDevManifest with a versionless base", () => {
+    (0, vitest_1.test)("refuses to preview views on a v1 base, which has no version for the extension context", () => {
+        const base = { ...baseManifest() };
+        delete base["version"];
+        delete base["ui_extensions"];
+        const dev = { extends: "green-app.json", ui_extensions: { views: [{ viewport: "gs.company.vendor.detail", component: "A" }] } };
+        (0, vitest_1.expect)(() => (0, index_js_1.mergeDevManifest)(base, dev)).toThrow(index_js_1.DevManifestError);
+        const versioned = { ...base, version: "1.0.0" };
+        (0, vitest_1.expect)(() => (0, index_js_1.mergeDevManifest)(versioned, dev)).not.toThrow();
+    });
+});
+//# sourceMappingURL=contract.test.js.map