@kaelen-ai/cli 0.1.18 → 0.1.19

package/dist/index.js

@@ -861,6 +861,16 @@ var SECRET_HEADER_NAMES = /* @__PURE__ */ new Set([
 ]);
 var HTTP_LIKE_KINDS = /* @__PURE__ */ new Set(["http", "graphql", "httpApi", "graphqlApi"]);
 var OP_RESOURCE_KINDS = /* @__PURE__ */ new Set(["httpApi", "graphqlApi"]);
+var PRINCIPAL_RESOLUTION_MATCHES = /* @__PURE__ */ new Set(["principal_id", "external_id"]);
+var WEBHOOK_PRINCIPAL_SOURCES = /* @__PURE__ */ new Set(["body", "headers", "query"]);
+var QUEUE_PRINCIPAL_SOURCES = /* @__PURE__ */ new Set(["message", "attributes"]);
+var PRINCIPAL_BOUND_QUEUE_KINDS = /* @__PURE__ */ new Set([
+  "kafka",
+  "rabbitmq",
+  "redis",
+  "pubsub",
+  "sqs"
+]);
 function countPlaceholders(format) {
   let count = 0;
   let idx = 0;
@@ -1058,6 +1068,51 @@ function validateHttpLikeConfig(appName, resourceName, resourceKind, config, sec
     }
   }
 }
+function validatePrincipalResolution(appName, resourceName, resourceKind, signals2, config, errors) {
+  const requiresPrincipalResolution = resourceKind === "webhook" || PRINCIPAL_BOUND_QUEUE_KINDS.has(resourceKind) && signals2.length > 0;
+  if (!requiresPrincipalResolution) return;
+  const owner = `resource "${appName}/${resourceName}"`;
+  if (!isRecord2(config)) {
+    errors.push(`${owner} config must be an object with principal_resolution`);
+    return;
+  }
+  const rule = config.principal_resolution;
+  if (!isRecord2(rule)) {
+    errors.push(`${owner} config.principal_resolution is required`);
+    return;
+  }
+  const from = stringField2(rule, "from");
+  const match = stringField2(rule, "match");
+  const allowedSources = resourceKind === "webhook" ? WEBHOOK_PRINCIPAL_SOURCES : QUEUE_PRINCIPAL_SOURCES;
+  if (!from || !allowedSources.has(from)) {
+    errors.push(
+      `${owner} principal_resolution.from must be one of ${Array.from(
+        allowedSources
+      ).join(", ")}`
+    );
+  }
+  if (!match || !PRINCIPAL_RESOLUTION_MATCHES.has(match)) {
+    errors.push(
+      `${owner} principal_resolution.match must be principal_id or external_id`
+    );
+  }
+  if (from === "body" || from === "query" || from === "message") {
+    if (!stringField2(rule, "path")) {
+      errors.push(`${owner} principal_resolution.path is required for ${from}`);
+    }
+    if (rule.name !== void 0) {
+      errors.push(`${owner} principal_resolution.name is not valid for ${from}`);
+    }
+  }
+  if (from === "headers" || from === "attributes") {
+    if (!stringField2(rule, "name")) {
+      errors.push(`${owner} principal_resolution.name is required for ${from}`);
+    }
+    if (rule.path !== void 0) {
+      errors.push(`${owner} principal_resolution.path is not valid for ${from}`);
+    }
+  }
+}
 function isRecord2(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
@@ -1426,6 +1481,14 @@ function validateManifest(manifest) {
         validateResourceCapability(appName, resourceName, capability, errors);
       }
       const resourceKindForConfig = stringField2(resource, "kind") ?? "";
+      validatePrincipalResolution(
+        appName,
+        resourceName,
+        resourceKindForConfig,
+        signals2,
+        resource.config,
+        errors
+      );
       validateHttpLikeConfig(
         appName,
         resourceName,
@@ -6717,7 +6780,7 @@ async function catalogShowCommand(options) {
 
 // src/index.ts
 var program = new Command();
-program.name("io").description("IO CLI \u2014 build and deploy behaviors").version("0.1.18");
+program.name("io").description("IO CLI \u2014 build and deploy behaviors").version("0.1.19");
 program.command("init").description("Initialize io.config.json for the current project").option("--yes", "Overwrite existing config without prompting").action(initCommand);
 program.command("build").description("Build behaviors from the io/ directory").option("--dir <path>", "Source directory", "io").option("--minify", "Minify bundles", false).action(buildCommand);
 program.command("deploy").description("Build and package for deployment").option("--dir <path>", "Source directory", "io").option("--no-minify", "Skip minification").option("--yes", "Skip confirmation prompt").option("--watch", "Tail deployment status until it reaches a terminal state").action(deployCommand);