@owox/backend 0.37.0 → 0.39.0

package/dist/src/plugin-host/utils/action-input-schema.util.js

@@ -0,0 +1,133 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACTION_INPUT_AJV = void 0;
+exports.assertBoundedSchema = assertBoundedSchema;
+const plugin_action_limits_1 = require("../constants/plugin-action-limits");
+const DRAFT_2020_12 = 'https://json-schema.org/draft/2020-12/schema';
+const REFUSED_KEYWORDS = ['pattern', 'patternProperties', 'format', 'uniqueItems'];
+const UNSUPPORTED_KEYWORDS = ['$async', '$dynamicRef', '$recursiveRef'];
+const SUBSCHEMA_KEYWORDS = [
+    'additionalProperties',
+    'contains',
+    'else',
+    'if',
+    'items',
+    'not',
+    'propertyNames',
+    'then',
+    'unevaluatedItems',
+    'unevaluatedProperties',
+];
+const SUBSCHEMA_LIST_KEYWORDS = ['allOf', 'anyOf', 'oneOf', 'prefixItems'];
+const SUBSCHEMA_MAP_KEYWORDS = [
+    'dependencies',
+    'dependentSchemas',
+    'patternProperties',
+    'properties',
+];
+const PREVENT_SCOPE_CHANGE = new Set([
+    'properties',
+    'patternProperties',
+    'enum',
+    'dependencies',
+    'definitions',
+]);
+exports.ACTION_INPUT_AJV = {
+    options: { strict: true, allErrors: true, logger: false, inlineRefs: false, ownProperties: true },
+    metaSchema: DRAFT_2020_12,
+    refusedKeywords: REFUSED_KEYWORDS,
+};
+function isObject(value) {
+    return typeof value === 'object' && value !== null;
+}
+function resolveLocalRef(root, ref) {
+    if (!ref.startsWith('#')) {
+        throw new Error(`$ref "${ref}" is not local`);
+    }
+    if (ref.includes('#', 1)) {
+        throw new Error(`$ref "${ref}" has "#" after its first character`);
+    }
+    if (ref === '#')
+        return root;
+    const unresolved = new Error(`$ref "${ref}" does not resolve`);
+    if (!ref.startsWith('#/'))
+        throw unresolved;
+    let node = root;
+    for (const part of ref.slice(2).split('/')) {
+        let key;
+        try {
+            key = decodeURIComponent(part).replace(/~1/g, '/').replace(/~0/g, '~');
+        }
+        catch {
+            throw unresolved;
+        }
+        if (!isObject(node) || !Object.hasOwn(node, key))
+            throw unresolved;
+        node = node[key];
+        if (!PREVENT_SCOPE_CHANGE.has(part) && isObject(node) && Object.hasOwn(node, '$id')) {
+            throw new Error('$id is supported only at the root');
+        }
+    }
+    return node;
+}
+function countPayload(schema) {
+    let entries = Array.isArray(schema.enum) ? schema.enum.length : 0;
+    for (const keyword of ['dependentRequired', 'dependencies']) {
+        const map = schema[keyword];
+        if (!isObject(map))
+            continue;
+        for (const names of Object.values(map)) {
+            if (Array.isArray(names))
+                entries += names.length;
+        }
+    }
+    return entries;
+}
+function assertBoundedSchema(root) {
+    const limit = plugin_action_limits_1.PLUGIN_ACTION_LIMITS.maxInputSchemaNodes;
+    const expanding = new Set();
+    let nodes = 0;
+    const count = (cost) => {
+        nodes += cost;
+        if (nodes > limit) {
+            throw new Error(`exceeds ${limit} subschemas, enum entries and dependency names with every $ref inlined`);
+        }
+    };
+    const visit = (schema) => {
+        count(1);
+        if (!isObject(schema))
+            return;
+        count(countPayload(schema));
+        const unsupported = UNSUPPORTED_KEYWORDS.find(keyword => Object.hasOwn(schema, keyword));
+        if (unsupported)
+            throw new Error(`unsupported keyword: "${unsupported}"`);
+        if (schema !== root && Object.hasOwn(schema, '$id')) {
+            throw new Error('$id is supported only at the root');
+        }
+        expanding.add(schema);
+        if (typeof schema.$ref === 'string') {
+            const target = resolveLocalRef(root, schema.$ref);
+            if (isObject(target) && expanding.has(target)) {
+                throw new Error(`$ref "${schema.$ref}" is recursive`);
+            }
+            visit(target);
+        }
+        for (const keyword of SUBSCHEMA_KEYWORDS) {
+            if (Object.hasOwn(schema, keyword))
+                visit(schema[keyword]);
+        }
+        for (const keyword of SUBSCHEMA_LIST_KEYWORDS) {
+            const list = schema[keyword];
+            if (Array.isArray(list))
+                list.forEach(visit);
+        }
+        for (const keyword of SUBSCHEMA_MAP_KEYWORDS) {
+            const map = schema[keyword];
+            if (isObject(map))
+                Object.values(map).forEach(visit);
+        }
+        expanding.delete(schema);
+    };
+    visit(root);
+}
+//# sourceMappingURL=action-input-schema.util.js.map

package/dist/src/plugin-host/utils/credential-handles.util.d.ts

@@ -0,0 +1,3 @@
+import type { NormalizedCredentialRequirement } from '../../data-marts/credentials/credential.types';
+import type { PluginCredentialHandleDto } from '../dto/domain/plugin-installation.dto';
+export declare function toCredentialHandles(ready: readonly NormalizedCredentialRequirement[]): PluginCredentialHandleDto[];

package/dist/src/plugin-host/utils/credential-handles.util.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toCredentialHandles = toCredentialHandles;
+function toCredentialHandles(ready) {
+    return ready.map(requirement => requirement.definitionId === null
+        ? {
+            name: requirement.key,
+            kind: 'ai',
+            models: requirement.models,
+        }
+        : { name: requirement.key, kind: 'exact' });
+}
+//# sourceMappingURL=credential-handles.util.js.map

package/dist/src/plugin-host/utils/execution-token.util.d.ts

@@ -0,0 +1,5 @@
+export declare function createExecutionToken(): {
+    token: string;
+    tokenHash: string;
+};
+export declare function hashExecutionToken(token: string): string;

package/dist/src/plugin-host/utils/execution-token.util.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createExecutionToken = createExecutionToken;
+exports.hashExecutionToken = hashExecutionToken;
+const node_crypto_1 = require("node:crypto");
+function createExecutionToken() {
+    const token = (0, node_crypto_1.randomBytes)(32).toString('base64url');
+    return { token, tokenHash: hashExecutionToken(token) };
+}
+function hashExecutionToken(token) {
+    return (0, node_crypto_1.createHash)('sha256').update(token).digest('hex');
+}
+//# sourceMappingURL=execution-token.util.js.map

package/dist/src/plugin-host/utils/github-repo-locator.util.js

@@ -6,7 +6,7 @@ const GITHUB_HOSTS = new Set(['github.com', 'www.github.com']);
 const SEGMENT = /^[A-Za-z0-9._-]+$/;
 const SCP_SYNTAX = /^git@([^:]+):(.+)$/;
 function parseGithubRepoLocator(locator) {
-    const trimmed = locator?.trim() ?? '';
+    const trimmed = typeof locator === 'string' ? locator.trim() : '';
     if (!trimmed) {
         throw new plugin_host_errors_1.InvalidRepoLocatorError(locator);
     }

package/dist/src/plugin-host/utils/json-shape.util.d.ts

@@ -0,0 +1 @@
+export declare function findJsonShapeProblem(value: unknown): string | null;

package/dist/src/plugin-host/utils/json-shape.util.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findJsonShapeProblem = findJsonShapeProblem;
+const plugin_action_limits_1 = require("../constants/plugin-action-limits");
+function findJsonShapeProblem(value) {
+    const maxDepth = plugin_action_limits_1.PLUGIN_ACTION_LIMITS.maxJsonDepth;
+    const visit = (node, depth) => {
+        if (typeof node !== 'object' || node === null)
+            return null;
+        if (depth > maxDepth)
+            return `is nested deeper than ${maxDepth} levels`;
+        for (const child of Object.values(node)) {
+            const problem = visit(child, depth + 1);
+            if (problem)
+                return problem;
+        }
+        return null;
+    };
+    return visit(value, 1);
+}
+//# sourceMappingURL=json-shape.util.js.map

package/dist/src/plugin-host/utils/plugin-action-outcome.util.d.ts

@@ -0,0 +1,10 @@
+import { PluginActionExecutionStatus } from '../enums/plugin-action-execution-status.enum';
+export type PluginActionOutcome = {
+    status: PluginActionExecutionStatus.SUCCEEDED;
+    result: unknown;
+} | {
+    status: PluginActionExecutionStatus.FAILED;
+    errorCode: string;
+    errorMessage: string;
+};
+export declare function classifyBackendResponse(status: number, body: string | null): PluginActionOutcome;

package/dist/src/plugin-host/utils/plugin-action-outcome.util.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.classifyBackendResponse = classifyBackendResponse;
+const plugin_action_limits_1 = require("../constants/plugin-action-limits");
+const plugin_action_execution_status_enum_1 = require("../enums/plugin-action-execution-status.enum");
+const json_shape_util_1 = require("./json-shape.util");
+function classifyBackendResponse(status, body) {
+    try {
+        return classify(status, body);
+    }
+    catch {
+        return invalid('The backend answer could not be read');
+    }
+}
+function classify(status, body) {
+    if (body === null) {
+        return invalid('The backend answer is larger than allowed');
+    }
+    if (status >= 300 && status < 400) {
+        return invalid(`The backend answered ${status}`);
+    }
+    const parsed = parseJson(body);
+    if (status === 200) {
+        if (!isRecord(parsed) || !Object.hasOwn(parsed, 'result')) {
+            return invalid('The backend answered 200 without a result');
+        }
+        const problem = (0, json_shape_util_1.findJsonShapeProblem)(parsed.result);
+        if (problem) {
+            return invalid(`The result ${problem}`);
+        }
+        if (Buffer.byteLength(JSON.stringify(parsed.result)) > plugin_action_limits_1.PLUGIN_ACTION_LIMITS.maxResultBytes) {
+            return invalid('The result is larger than 1 MiB');
+        }
+        return { status: plugin_action_execution_status_enum_1.PluginActionExecutionStatus.SUCCEEDED, result: parsed.result };
+    }
+    if (status < 300) {
+        return invalid(`The backend answered ${status}`);
+    }
+    const error = isRecord(parsed) ? parsed.error : undefined;
+    if (isRecord(error) && (0, plugin_action_limits_1.isPluginOwnedErrorCode)(error.code)) {
+        return {
+            status: plugin_action_execution_status_enum_1.PluginActionExecutionStatus.FAILED,
+            errorCode: error.code,
+            errorMessage: String(error.message ?? '').slice(0, plugin_action_limits_1.PLUGIN_ACTION_LIMITS.maxErrorMessageChars),
+        };
+    }
+    return invalid(`The backend answered ${status} without a usable error code`);
+}
+function invalid(errorMessage) {
+    return {
+        status: plugin_action_execution_status_enum_1.PluginActionExecutionStatus.FAILED,
+        errorCode: 'BACKEND_INVALID_RESPONSE',
+        errorMessage,
+    };
+}
+function parseJson(body) {
+    try {
+        return JSON.parse(body);
+    }
+    catch {
+        return undefined;
+    }
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=plugin-action-outcome.util.js.map

package/dist/src/plugin-host/utils/plugin-manifest.util.d.ts

@@ -69,16 +69,59 @@ export declare const PluginCredentialRequirementSchema: z.ZodUnion<[z.ZodString,
     id: z.ZodString;
     optional: z.ZodDefault<z.ZodBoolean>;
     models: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
 }, "strip", z.ZodTypeAny, {
     id: string;
     optional: boolean;
+    scopes?: string[] | undefined;
     models?: string[] | undefined;
 }, {
     id: string;
+    scopes?: string[] | undefined;
     models?: string[] | undefined;
     optional?: boolean | undefined;
 }>]>;
 export type PluginCredentialRequirement = z.infer<typeof PluginCredentialRequirementSchema>;
+export declare const PLUGIN_ACTION_NAME_PATTERN: RegExp;
+export declare const PluginBackendSchema: z.ZodObject<{
+    url: z.ZodString;
+    actions: z.ZodEffects<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodObject<{
+        timeoutSeconds: z.ZodDefault<z.ZodNumber>;
+        input: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, "strip", z.ZodTypeAny, {
+        timeoutSeconds: number;
+        input?: Record<string, unknown> | undefined;
+    }, {
+        input?: Record<string, unknown> | undefined;
+        timeoutSeconds?: number | undefined;
+    }>>, Record<string, {
+        timeoutSeconds: number;
+        input?: Record<string, unknown> | undefined;
+    }>, Record<string, {
+        input?: Record<string, unknown> | undefined;
+        timeoutSeconds?: number | undefined;
+    }>>, Record<string, {
+        timeoutSeconds: number;
+        input?: Record<string, unknown> | undefined;
+    }>, Record<string, {
+        input?: Record<string, unknown> | undefined;
+        timeoutSeconds?: number | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    url: string;
+    actions: Record<string, {
+        timeoutSeconds: number;
+        input?: Record<string, unknown> | undefined;
+    }>;
+}, {
+    url: string;
+    actions: Record<string, {
+        input?: Record<string, unknown> | undefined;
+        timeoutSeconds?: number | undefined;
+    }>;
+}>;
+export type PluginBackendDeclaration = z.infer<typeof PluginBackendSchema>;
+export type PluginBackendActionDeclaration = PluginBackendDeclaration['actions'][string];
 export type PluginCollectionDeclaration = z.infer<typeof PluginCollectionDeclarationSchema>;
 export declare const PluginManifestSchema: z.ZodEffects<z.ZodObject<{
     name: z.ZodString;
@@ -160,21 +203,62 @@ export declare const PluginManifestSchema: z.ZodEffects<z.ZodObject<{
         id: z.ZodString;
         optional: z.ZodDefault<z.ZodBoolean>;
         models: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, "strip", z.ZodTypeAny, {
         id: string;
         optional: boolean;
+        scopes?: string[] | undefined;
         models?: string[] | undefined;
     }, {
         id: string;
+        scopes?: string[] | undefined;
         models?: string[] | undefined;
         optional?: boolean | undefined;
     }>]>, "many">>;
+    backend: z.ZodOptional<z.ZodObject<{
+        url: z.ZodString;
+        actions: z.ZodEffects<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodObject<{
+            timeoutSeconds: z.ZodDefault<z.ZodNumber>;
+            input: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, "strip", z.ZodTypeAny, {
+            timeoutSeconds: number;
+            input?: Record<string, unknown> | undefined;
+        }, {
+            input?: Record<string, unknown> | undefined;
+            timeoutSeconds?: number | undefined;
+        }>>, Record<string, {
+            timeoutSeconds: number;
+            input?: Record<string, unknown> | undefined;
+        }>, Record<string, {
+            input?: Record<string, unknown> | undefined;
+            timeoutSeconds?: number | undefined;
+        }>>, Record<string, {
+            timeoutSeconds: number;
+            input?: Record<string, unknown> | undefined;
+        }>, Record<string, {
+            input?: Record<string, unknown> | undefined;
+            timeoutSeconds?: number | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        url: string;
+        actions: Record<string, {
+            timeoutSeconds: number;
+            input?: Record<string, unknown> | undefined;
+        }>;
+    }, {
+        url: string;
+        actions: Record<string, {
+            input?: Record<string, unknown> | undefined;
+            timeoutSeconds?: number | undefined;
+        }>;
+    }>>;
 }, "strip", z.ZodTypeAny, {
     name: string;
     description: string;
     credentials: (string | {
         id: string;
         optional: boolean;
+        scopes?: string[] | undefined;
         models?: string[] | undefined;
     })[];
     delivery: {
@@ -194,6 +278,13 @@ export declare const PluginManifestSchema: z.ZodEffects<z.ZodObject<{
             };
         } | undefined;
     }[];
+    backend?: {
+        url: string;
+        actions: Record<string, {
+            timeoutSeconds: number;
+            input?: Record<string, unknown> | undefined;
+        }>;
+    } | undefined;
 }, {
     name: string;
     description: string;
@@ -203,6 +294,7 @@ export declare const PluginManifestSchema: z.ZodEffects<z.ZodObject<{
     };
     credentials?: (string | {
         id: string;
+        scopes?: string[] | undefined;
         models?: string[] | undefined;
         optional?: boolean | undefined;
     })[] | undefined;
@@ -219,12 +311,20 @@ export declare const PluginManifestSchema: z.ZodEffects<z.ZodObject<{
             };
         } | undefined;
     }[] | undefined;
+    backend?: {
+        url: string;
+        actions: Record<string, {
+            input?: Record<string, unknown> | undefined;
+            timeoutSeconds?: number | undefined;
+        }>;
+    } | undefined;
 }>, {
     name: string;
     description: string;
     credentials: (string | {
         id: string;
         optional: boolean;
+        scopes?: string[] | undefined;
         models?: string[] | undefined;
     })[];
     delivery: {
@@ -244,6 +344,13 @@ export declare const PluginManifestSchema: z.ZodEffects<z.ZodObject<{
             };
         } | undefined;
     }[];
+    backend?: {
+        url: string;
+        actions: Record<string, {
+            timeoutSeconds: number;
+            input?: Record<string, unknown> | undefined;
+        }>;
+    } | undefined;
 }, {
     name: string;
     description: string;
@@ -253,6 +360,7 @@ export declare const PluginManifestSchema: z.ZodEffects<z.ZodObject<{
     };
     credentials?: (string | {
         id: string;
+        scopes?: string[] | undefined;
         models?: string[] | undefined;
         optional?: boolean | undefined;
     })[] | undefined;
@@ -269,6 +377,13 @@ export declare const PluginManifestSchema: z.ZodEffects<z.ZodObject<{
             };
         } | undefined;
     }[] | undefined;
+    backend?: {
+        url: string;
+        actions: Record<string, {
+            input?: Record<string, unknown> | undefined;
+            timeoutSeconds?: number | undefined;
+        }>;
+    } | undefined;
 }>;
 export type PluginManifest = z.infer<typeof PluginManifestSchema>;
 export type ManifestParseResult = {
@@ -279,6 +394,12 @@ export type ManifestParseResult = {
     readonly code: ReleaseRejectionCode;
     readonly detail: string;
 };
+export declare function listActionInputSchemas(backend: PluginBackendDeclaration | null | undefined): {
+    readonly path: string;
+    readonly schema: Record<string, unknown>;
+}[];
 export declare function parsePluginManifest(rawFileContent: string | null): ManifestParseResult;
 export declare function findIncompatibleCollectionChange(current: readonly PluginCollectionDeclaration[], candidate: readonly PluginCollectionDeclaration[]): string | null;
+export declare function resolveBackendUrl(backend: PluginBackendDeclaration, deliveryUrl: string): string;
+export declare function findIncompatibleActionChange(current: PluginBackendDeclaration | null | undefined, candidate: PluginBackendDeclaration | null | undefined): string | null;
 export {};

package/dist/src/plugin-host/utils/plugin-manifest.util.js

@@ -1,11 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PluginManifestSchema = exports.PluginCredentialRequirementSchema = exports.PluginCollectionActionSchema = exports.PluginCollectionEntityTypeSchema = void 0;
+exports.PluginManifestSchema = exports.PluginBackendSchema = exports.PLUGIN_ACTION_NAME_PATTERN = exports.PluginCredentialRequirementSchema = exports.PluginCollectionActionSchema = exports.PluginCollectionEntityTypeSchema = void 0;
+exports.listActionInputSchemas = listActionInputSchemas;
 exports.parsePluginManifest = parsePluginManifest;
 exports.findIncompatibleCollectionChange = findIncompatibleCollectionChange;
+exports.resolveBackendUrl = resolveBackendUrl;
+exports.findIncompatibleActionChange = findIncompatibleActionChange;
+const internal_helpers_1 = require("@owox/internal-helpers");
 const zod_1 = require("zod");
 const builtin_credential_definitions_1 = require("../../data-marts/credentials/services/builtin-credential-definitions");
+const plugin_action_limits_1 = require("../constants/plugin-action-limits");
 const release_rejection_code_enum_1 = require("../enums/release-rejection-code.enum");
+const action_input_schema_util_1 = require("./action-input-schema.util");
 exports.PluginCollectionEntityTypeSchema = zod_1.z.enum([
     'data-mart',
     'storage',
@@ -49,8 +55,22 @@ exports.PluginCredentialRequirementSchema = zod_1.z.union([
         id: zod_1.z.string().trim().min(1).max(255),
         optional: zod_1.z.boolean().default(false),
         models: zod_1.z.array(zod_1.z.string().trim().min(1).max(255)).max(20).optional(),
+        scopes: zod_1.z.array(zod_1.z.string().min(1).max(200).regex(/^\S+$/)).min(1).max(20).optional(),
     }),
 ]);
+exports.PLUGIN_ACTION_NAME_PATTERN = /^[a-z][a-z0-9-]{0,63}$/;
+exports.PluginBackendSchema = zod_1.z.object({
+    url: zod_1.z.string().min(1).max(2048),
+    actions: zod_1.z
+        .record(zod_1.z
+        .string()
+        .regex(exports.PLUGIN_ACTION_NAME_PATTERN, 'action names are lower-case letters, digits and hyphens, start with a letter, and have at most 64 characters'), zod_1.z.object({
+        timeoutSeconds: zod_1.z.number().int().min(1).max(300).default(30),
+        input: zod_1.z.record(zod_1.z.unknown()).optional(),
+    }))
+        .refine(actions => Object.keys(actions).length >= 1, 'declare at least one action')
+        .refine(actions => Object.keys(actions).length <= plugin_action_limits_1.PLUGIN_ACTION_LIMITS.maxActions, `at most ${plugin_action_limits_1.PLUGIN_ACTION_LIMITS.maxActions} actions`),
+});
 const ENTITY_ACTIONS = {
     'data-mart': new Set([
         'SEE',
@@ -91,6 +111,7 @@ exports.PluginManifestSchema = zod_1.z
     }),
     collections: zod_1.z.array(PluginCollectionDeclarationSchema).max(50).default([]),
     credentials: zod_1.z.array(exports.PluginCredentialRequirementSchema).max(50).default([]),
+    backend: exports.PluginBackendSchema.optional(),
 })
     .superRefine((manifest, context) => {
     const names = new Set();
@@ -164,11 +185,84 @@ exports.PluginManifestSchema = zod_1.z
                 message: 'models are supported only for the logical ai requirement',
             });
         }
+        const scopes = typeof requirement === 'string' ? undefined : requirement.scopes;
+        if (key === 'google-service-account' && !scopes) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['credentials', index],
+                message: 'google-service-account requires scopes',
+            });
+        }
+        if (key !== 'google-service-account' && scopes) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['credentials', index, 'scopes'],
+                message: 'scopes are supported only for google-service-account',
+            });
+        }
+        if (scopes && new Set(scopes).size !== scopes.length) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['credentials', index, 'scopes'],
+                message: 'scopes must be unique',
+            });
+        }
+    }
+    if (manifest.backend) {
+        const problem = findBackendUrlProblem(manifest.backend.url, manifest.delivery.url);
+        if (problem) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['backend', 'url'],
+                message: problem,
+            });
+        }
     }
 });
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
+function parseUrl(value, base) {
+    try {
+        return new URL(value, base);
+    }
+    catch {
+        return null;
+    }
+}
+function findBackendUrlProblem(url, deliveryUrl) {
+    const absolute = /^[a-z][a-z0-9+.-]*:/i.test(url);
+    if (absolute && !(url.startsWith('https://') && parseUrl(url))) {
+        return 'an absolute URL must use https';
+    }
+    const delivery = parseUrl(deliveryUrl);
+    if (!delivery)
+        return null;
+    const resolved = parseUrl(url, deliveryUrl);
+    if (!absolute && resolved?.origin !== delivery.origin) {
+        return 'a relative URL must stay on the delivery.url origin';
+    }
+    return resolved?.username || resolved?.password
+        ? 'the URL must not contain a user name or password'
+        : null;
+}
+function listActionInputSchemas(backend) {
+    return Object.entries(backend?.actions ?? {}).flatMap(([name, action]) => action.input ? [{ path: `backend.actions.${name}.input`, schema: action.input }] : []);
+}
+function findUnsupportedActionInput(backend) {
+    for (const { path, schema } of listActionInputSchemas(backend)) {
+        try {
+            if (Buffer.byteLength(JSON.stringify(schema)) > plugin_action_limits_1.PLUGIN_ACTION_LIMITS.maxInputSchemaBytes) {
+                return `${path}: exceeds ${plugin_action_limits_1.PLUGIN_ACTION_LIMITS.maxInputSchemaBytes / 1024} KiB`;
+            }
+            (0, action_input_schema_util_1.assertBoundedSchema)(schema);
+        }
+        catch (error) {
+            return `${path}: ${(0, internal_helpers_1.castError)(error).message}`;
+        }
+    }
+    return null;
+}
 function parsePluginManifest(rawFileContent) {
     if (rawFileContent === null) {
         return {
@@ -213,6 +307,14 @@ function parsePluginManifest(rawFileContent) {
                 .join('; '),
         };
     }
+    const unsupportedInput = findUnsupportedActionInput(result.data.backend);
+    if (unsupportedInput) {
+        return {
+            ok: false,
+            code: release_rejection_code_enum_1.ReleaseRejectionCode.ACTION_INPUT_UNSUPPORTED,
+            detail: unsupportedInput,
+        };
+    }
     return { ok: true, manifest: result.data };
 }
 function findIncompatibleCollectionChange(current, candidate) {
@@ -233,4 +335,12 @@ function findIncompatibleCollectionChange(current, candidate) {
     }
     return null;
 }
+function resolveBackendUrl(backend, deliveryUrl) {
+    return new URL(backend.url, deliveryUrl).toString();
+}
+function findIncompatibleActionChange(current, candidate) {
+    const next = candidate?.actions ?? {};
+    const removed = Object.keys(current?.actions ?? {}).find(name => !Object.hasOwn(next, name));
+    return removed === undefined ? null : `Action "${removed}" cannot be removed`;
+}
 //# sourceMappingURL=plugin-manifest.util.js.map

package/dist/src/plugin-host/utils/request-abort-signal.util.d.ts

@@ -0,0 +1,5 @@
+import type { Request } from 'express';
+export declare function requestAbortSignal(request: Request): {
+    readonly signal: AbortSignal;
+    dispose(): void;
+};