@owox/backend 0.38.0 → 0.39.0

package/dist/src/plugin-host/use-cases/start-plugin-action-execution.service.js

@@ -0,0 +1,64 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StartPluginActionExecutionService = void 0;
+const common_1 = require("@nestjs/common");
+const plugin_action_errors_1 = require("../errors/plugin-action.errors");
+const plugin_action_starter_service_1 = require("../services/plugin-action-starter.service");
+const plugin_version_service_1 = require("../services/plugin-version.service");
+const plugin_service_1 = require("../services/plugin.service");
+let StartPluginActionExecutionService = class StartPluginActionExecutionService {
+    plugins;
+    versions;
+    starter;
+    constructor(plugins, versions, starter) {
+        this.plugins = plugins;
+        this.versions = versions;
+        this.starter = starter;
+    }
+    async run(command) {
+        const { context, action } = command;
+        if (context.executionId) {
+            throw new plugin_action_errors_1.ExecutionTokenNotAllowedError();
+        }
+        const role = context.roles?.[0];
+        if (!context.pluginId || !context.installationId || !role) {
+            throw new common_1.ForbiddenException('Plugin runtime authentication is required');
+        }
+        const plugin = await this.plugins.findById(context.pluginId);
+        const version = plugin?.currentVersionId
+            ? await this.versions.findById(plugin.currentVersionId)
+            : null;
+        if (!version) {
+            throw new plugin_action_errors_1.ActionNotDeclaredError(action);
+        }
+        return this.starter.start({
+            installation: {
+                id: context.installationId,
+                projectId: context.projectId,
+                userId: context.userId,
+            },
+            version,
+            action,
+            input: command.input,
+            role,
+            trigger: 'frontend',
+        });
+    }
+};
+exports.StartPluginActionExecutionService = StartPluginActionExecutionService;
+exports.StartPluginActionExecutionService = StartPluginActionExecutionService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [plugin_service_1.PluginService,
+        plugin_version_service_1.PluginVersionService,
+        plugin_action_starter_service_1.PluginActionStarterService])
+], StartPluginActionExecutionService);
+//# sourceMappingURL=start-plugin-action-execution.service.js.map

package/dist/src/plugin-host/use-cases/sync-plugin-releases.service.d.ts

@@ -1,21 +1,19 @@
 import { PluginHostConfigService } from '../config/plugin-host.config';
 import { PluginSyncResultDto, SyncPluginReleasesCommand } from '../dto/domain/plugin-sync.dto';
 import { GithubApiService } from '../services/github-api.service';
-import { ExternalCredentialDefinitionSyncService } from '../services/external-credential-definition-sync.service';
 import { PluginService } from '../services/plugin.service';
 import { PluginVersionService } from '../services/plugin-version.service';
 import { PluginCredentialBindingReconciliationService } from '../services/plugin-credential-binding-reconciliation.service';
-import { RemoteUrlValidatorService } from '../services/remote-url-validator.service';
+import { ReleaseCandidateRulesService } from '../services/release-candidate-rules.service';
 export declare class SyncPluginReleasesService {
     private readonly githubApi;
-    private readonly remoteUrlValidator;
+    private readonly candidateRules;
     private readonly pluginService;
     private readonly versionService;
     private readonly config;
     private readonly credentialBindingReconciliation;
-    private readonly externalCredentialDefinitions?;
     private readonly logger;
-    constructor(githubApi: GithubApiService, remoteUrlValidator: RemoteUrlValidatorService, pluginService: PluginService, versionService: PluginVersionService, config: PluginHostConfigService, credentialBindingReconciliation: PluginCredentialBindingReconciliationService, externalCredentialDefinitions?: ExternalCredentialDefinitionSyncService | undefined);
+    constructor(githubApi: GithubApiService, candidateRules: ReleaseCandidateRulesService, pluginService: PluginService, versionService: PluginVersionService, config: PluginHostConfigService, credentialBindingReconciliation: PluginCredentialBindingReconciliationService);
     run(command: SyncPluginReleasesCommand): Promise<PluginSyncResultDto>;
     private findOrCreatePlugin;
     private selectCandidates;

package/dist/src/plugin-host/use-cases/sync-plugin-releases.service.js

@@ -8,9 +8,6 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
 var SyncPluginReleasesService_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SyncPluginReleasesService = void 0;
@@ -20,31 +17,27 @@ const plugin_host_config_1 = require("../config/plugin-host.config");
 const release_rejection_code_enum_1 = require("../enums/release-rejection-code.enum");
 const plugin_host_errors_1 = require("../errors/plugin-host.errors");
 const github_api_service_1 = require("../services/github-api.service");
-const external_credential_definition_sync_service_1 = require("../services/external-credential-definition-sync.service");
 const plugin_service_1 = require("../services/plugin.service");
 const plugin_version_service_1 = require("../services/plugin-version.service");
 const plugin_credential_binding_reconciliation_service_1 = require("../services/plugin-credential-binding-reconciliation.service");
-const remote_url_validator_service_1 = require("../services/remote-url-validator.service");
+const release_candidate_rules_service_1 = require("../services/release-candidate-rules.service");
 const github_repo_locator_util_1 = require("../utils/github-repo-locator.util");
-const plugin_manifest_util_1 = require("../utils/plugin-manifest.util");
 const semver_util_1 = require("../utils/semver.util");
 let SyncPluginReleasesService = SyncPluginReleasesService_1 = class SyncPluginReleasesService {
     githubApi;
-    remoteUrlValidator;
+    candidateRules;
     pluginService;
     versionService;
     config;
     credentialBindingReconciliation;
-    externalCredentialDefinitions;
     logger = new common_1.Logger(SyncPluginReleasesService_1.name);
-    constructor(githubApi, remoteUrlValidator, pluginService, versionService, config, credentialBindingReconciliation, externalCredentialDefinitions) {
+    constructor(githubApi, candidateRules, pluginService, versionService, config, credentialBindingReconciliation) {
         this.githubApi = githubApi;
-        this.remoteUrlValidator = remoteUrlValidator;
+        this.candidateRules = candidateRules;
         this.pluginService = pluginService;
         this.versionService = versionService;
         this.config = config;
         this.credentialBindingReconciliation = credentialBindingReconciliation;
-        this.externalCredentialDefinitions = externalCredentialDefinitions;
     }
     async run(command) {
         const ref = (0, github_repo_locator_util_1.parseGithubRepoLocator)(command.repoLocator);
@@ -126,45 +119,12 @@ let SyncPluginReleasesService = SyncPluginReleasesService_1 = class SyncPluginRe
             into.rejections.push(this.rejection(release, release_rejection_code_enum_1.ReleaseRejectionCode.VERSION_CONFLICT, `Version ${semver} is already recorded from commit ${recorded.commitSha} (release ${recorded.githubReleaseId}); refusing to replace it with commit ${commitSha} (release ${release.githubReleaseId})`));
             return false;
         }
-        const manifestSource = await this.githubApi.getFileAtCommit(ref, 'plugin.json', commitSha);
-        const manifest = (0, plugin_manifest_util_1.parsePluginManifest)(manifestSource);
-        if (!manifest.ok) {
-            into.rejections.push(this.rejection(release, manifest.code, manifest.detail));
-            return false;
-        }
-        const baseline = (await this.versionService.findAllByPluginId(pluginId))
-            .filter(version => (0, semver_util_1.sameCompatibilityLine)(version.semver, semver))
-            .reduce((highest, version) => (!highest || (0, semver_util_1.compareSemver)(version.semver, highest.semver) > 0 ? { semver: version.semver, collections: version.collections ?? [] } : highest), undefined);
-        if (baseline) {
-            const incompatibility = (0, plugin_manifest_util_1.findIncompatibleCollectionChange)(baseline.collections ?? [], manifest.manifest.collections);
-            if (incompatibility) {
-                const escape = (0, semver_util_1.majorOf)(semver) === 0
-                    ? 'bump the minor version to ship this breaking change while below 1.0.0'
-                    : 'publish a new major version to ship this breaking change';
-                into.rejections.push(this.rejection(release, release_rejection_code_enum_1.ReleaseRejectionCode.COLLECTIONS_INCOMPATIBLE, `${incompatibility} within the ${baseline.semver} compatibility line; ${escape}`));
-                return false;
-            }
-        }
-        const delivery = await this.remoteUrlValidator.validate(manifest.manifest.delivery.url);
-        if (!delivery.ok) {
-            into.rejections.push(this.rejection(release, delivery.code, delivery.detail));
-            return false;
-        }
-        let credentialRequirements = manifest.manifest.credentials;
-        try {
-            if (manifest.manifest.credentials.some(requirement => externalLocator(requirement))) {
-                if (!this.externalCredentialDefinitions) {
-                    throw new Error('External Credential definitions are not available');
-                }
-                credentialRequirements = await this.externalCredentialDefinitions.resolveRequirements(manifest.manifest.credentials);
-            }
-        }
-        catch (error) {
-            if (!(error instanceof external_credential_definition_sync_service_1.ExternalCredentialRequirementError))
-                throw error;
-            into.rejections.push(this.rejection(release, release_rejection_code_enum_1.ReleaseRejectionCode.MANIFEST_SCHEMA, (0, internal_helpers_1.castError)(error).message));
+        const verdict = await this.candidateRules.firstFailure({ pluginId, ref, commitSha, semver });
+        if (!verdict.ok) {
+            into.rejections.push(this.rejection(release, verdict.code, verdict.detail));
             return false;
         }
+        const { manifest, credentialRequirements } = verdict;
         try {
             const inserted = await this.versionService.insertVersionForLease({
                 pluginId,
@@ -172,11 +132,12 @@ let SyncPluginReleasesService = SyncPluginReleasesService_1 = class SyncPluginRe
                 commitSha,
                 githubReleaseId: release.githubReleaseId,
                 tagName: release.tagName,
-                displayName: manifest.manifest.name,
-                description: manifest.manifest.description,
-                deliveryUrl: manifest.manifest.delivery.url,
-                collections: manifest.manifest.collections,
+                displayName: manifest.name,
+                description: manifest.description,
+                deliveryUrl: manifest.delivery.url,
+                collections: manifest.collections,
                 credentialRequirements,
+                backend: manifest.backend ?? null,
                 releasePublishedAt: release.publishedAt,
             }, syncLeaseId);
             if (!inserted)
@@ -266,16 +227,11 @@ let SyncPluginReleasesService = SyncPluginReleasesService_1 = class SyncPluginRe
 exports.SyncPluginReleasesService = SyncPluginReleasesService;
 exports.SyncPluginReleasesService = SyncPluginReleasesService = SyncPluginReleasesService_1 = __decorate([
     (0, common_1.Injectable)(),
-    __param(6, (0, common_1.Optional)()),
     __metadata("design:paramtypes", [github_api_service_1.GithubApiService,
-        remote_url_validator_service_1.RemoteUrlValidatorService,
+        release_candidate_rules_service_1.ReleaseCandidateRulesService,
         plugin_service_1.PluginService,
         plugin_version_service_1.PluginVersionService,
         plugin_host_config_1.PluginHostConfigService,
-        plugin_credential_binding_reconciliation_service_1.PluginCredentialBindingReconciliationService,
-        external_credential_definition_sync_service_1.ExternalCredentialDefinitionSyncService])
+        plugin_credential_binding_reconciliation_service_1.PluginCredentialBindingReconciliationService])
 ], SyncPluginReleasesService);
-function externalLocator(requirement) {
-    return (typeof requirement === 'string' ? requirement : requirement.id).startsWith('@');
-}
 //# sourceMappingURL=sync-plugin-releases.service.js.map

package/dist/src/plugin-host/use-cases/uninstall-plugin.service.js

@@ -35,7 +35,8 @@ let UninstallPluginService = class UninstallPluginService {
         if (!installation) {
             throw new common_1.NotFoundException('You do not have this plugin installed');
         }
-        if (installation.uninstalledAt === null) {
+        const wasUninstalled = installation.uninstalledAt !== null;
+        if (!wasUninstalled) {
             await this.installations.uninstall(installation.id);
         }
         await this.credentialBindings.deactivateConsumer('plugin-installation', installation.id, command.context.projectId);
@@ -45,6 +46,7 @@ let UninstallPluginService = class UninstallPluginService {
             authorityScope: plugin_publication_scope_enum_1.PluginPublicationScope.MEMBER,
             projectId: command.context.projectId,
             userId: command.context.userId,
+            beforeState: { uninstalled: wasUninstalled },
         });
     }
 };

package/dist/src/plugin-host/use-cases/update-plugin.service.d.ts

@@ -17,6 +17,5 @@ export declare class UpdatePluginService {
     constructor(pluginService: PluginService, authorization: PublicationAuthorizationService, schedule: PluginUpdateScheduleService, check: RunPluginUpdateCheckService, versionService: PluginVersionService, publications: PluginPublicationService, installations: PluginInstallationService);
     run(command: UpdatePluginCommand): Promise<PluginUpdateResultDto>;
     private resolvePlugin;
-    private managesPublicationOf;
     private mayReach;
 }

package/dist/src/plugin-host/use-cases/update-plugin.service.js

@@ -11,7 +11,6 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.UpdatePluginService = void 0;
 const common_1 = require("@nestjs/common");
-const plugin_publication_scope_enum_1 = require("../enums/plugin-publication-scope.enum");
 const plugin_service_1 = require("../services/plugin.service");
 const plugin_installation_service_1 = require("../services/plugin-installation.service");
 const plugin_publication_service_1 = require("../services/plugin-publication.service");
@@ -20,6 +19,7 @@ const plugin_version_service_1 = require("../services/plugin-version.service");
 const publication_authorization_service_1 = require("../services/publication-authorization.service");
 const github_repo_locator_util_1 = require("../utils/github-repo-locator.util");
 const plugin_publisher_diagnostics_1 = require("./plugin-publisher-diagnostics");
+const plugin_publisher_access_1 = require("./plugin-publisher-access");
 const run_plugin_update_check_service_1 = require("./run-plugin-update-check.service");
 let UpdatePluginService = class UpdatePluginService {
     pluginService;
@@ -47,7 +47,7 @@ let UpdatePluginService = class UpdatePluginService {
             apiKeyId: command.context.apiKeyId ?? null,
         });
         const isPublisher = this.authorization.isDeploymentPublisher(command.context);
-        const managesPublication = isPublisher || (await this.managesPublicationOf(plugin.id, command.context));
+        const managesPublication = isPublisher || (await (0, plugin_publisher_access_1.managesPublicationOf)(this.publications, plugin.id, command.context));
         let diagnostics = null;
         if (managesPublication) {
             const version = result.currentVersionId
@@ -59,7 +59,7 @@ let UpdatePluginService = class UpdatePluginService {
         const scheduled = await this.pluginService.findById(plugin.id);
         return {
             pluginId: result.pluginId,
-            repository: visibleRepository(scheduled ?? plugin, result.repository, isPublisher),
+            repository: (0, plugin_publisher_access_1.visibleRepository)(scheduled ?? plugin, result.repository, isPublisher),
             currentVersionId: result.currentVersionId,
             currentSemver: result.currentSemver,
             outcome: result.outcome,
@@ -86,25 +86,6 @@ let UpdatePluginService = class UpdatePluginService {
         }
         throw new common_1.NotFoundException('A plugin id or repository is required');
     }
-    async managesPublicationOf(pluginId, context) {
-        const scopes = [];
-        if (context.roles?.includes('admin')) {
-            scopes.push(plugin_publication_scope_enum_1.PluginPublicationScope.PROJECT);
-        }
-        if (context.userId) {
-            scopes.push(plugin_publication_scope_enum_1.PluginPublicationScope.MEMBER);
-        }
-        for (const scope of scopes) {
-            const rows = await this.publications.listManageable(scope, {
-                projectId: context.projectId,
-                userId: scope === plugin_publication_scope_enum_1.PluginPublicationScope.MEMBER ? (context.userId ?? undefined) : undefined,
-            });
-            if (rows.some(row => row.pluginId === pluginId)) {
-                return true;
-            }
-        }
-        return false;
-    }
     async mayReach(pluginId, context) {
         if (this.authorization.isDeploymentPublisher(context)) {
             return true;
@@ -128,7 +109,4 @@ exports.UpdatePluginService = UpdatePluginService = __decorate([
         plugin_publication_service_1.PluginPublicationService,
         plugin_installation_service_1.PluginInstallationService])
 ], UpdatePluginService);
-function visibleRepository(plugin, repository, isPublisher) {
-    return plugin.isPrivateRepo && !isPublisher ? `${plugin.repoOwner}/***` : repository;
-}
 //# sourceMappingURL=update-plugin.service.js.map

package/dist/src/plugin-host/utils/action-input-schema.util.d.ts

@@ -0,0 +1,14 @@
+export declare const ACTION_INPUT_AJV: {
+    readonly options: {
+        readonly strict: true;
+        readonly allErrors: true;
+        readonly logger: false;
+        readonly inlineRefs: false;
+        readonly ownProperties: true;
+    };
+    readonly metaSchema: "https://json-schema.org/draft/2020-12/schema";
+    readonly refusedKeywords: readonly ["pattern", "patternProperties", "format", "uniqueItems"];
+};
+type JsonObject = Record<string, unknown>;
+export declare function assertBoundedSchema(root: JsonObject): void;
+export {};

package/dist/src/plugin-host/utils/action-input-schema.util.js

@@ -0,0 +1,133 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACTION_INPUT_AJV = void 0;
+exports.assertBoundedSchema = assertBoundedSchema;
+const plugin_action_limits_1 = require("../constants/plugin-action-limits");
+const DRAFT_2020_12 = 'https://json-schema.org/draft/2020-12/schema';
+const REFUSED_KEYWORDS = ['pattern', 'patternProperties', 'format', 'uniqueItems'];
+const UNSUPPORTED_KEYWORDS = ['$async', '$dynamicRef', '$recursiveRef'];
+const SUBSCHEMA_KEYWORDS = [
+    'additionalProperties',
+    'contains',
+    'else',
+    'if',
+    'items',
+    'not',
+    'propertyNames',
+    'then',
+    'unevaluatedItems',
+    'unevaluatedProperties',
+];
+const SUBSCHEMA_LIST_KEYWORDS = ['allOf', 'anyOf', 'oneOf', 'prefixItems'];
+const SUBSCHEMA_MAP_KEYWORDS = [
+    'dependencies',
+    'dependentSchemas',
+    'patternProperties',
+    'properties',
+];
+const PREVENT_SCOPE_CHANGE = new Set([
+    'properties',
+    'patternProperties',
+    'enum',
+    'dependencies',
+    'definitions',
+]);
+exports.ACTION_INPUT_AJV = {
+    options: { strict: true, allErrors: true, logger: false, inlineRefs: false, ownProperties: true },
+    metaSchema: DRAFT_2020_12,
+    refusedKeywords: REFUSED_KEYWORDS,
+};
+function isObject(value) {
+    return typeof value === 'object' && value !== null;
+}
+function resolveLocalRef(root, ref) {
+    if (!ref.startsWith('#')) {
+        throw new Error(`$ref "${ref}" is not local`);
+    }
+    if (ref.includes('#', 1)) {
+        throw new Error(`$ref "${ref}" has "#" after its first character`);
+    }
+    if (ref === '#')
+        return root;
+    const unresolved = new Error(`$ref "${ref}" does not resolve`);
+    if (!ref.startsWith('#/'))
+        throw unresolved;
+    let node = root;
+    for (const part of ref.slice(2).split('/')) {
+        let key;
+        try {
+            key = decodeURIComponent(part).replace(/~1/g, '/').replace(/~0/g, '~');
+        }
+        catch {
+            throw unresolved;
+        }
+        if (!isObject(node) || !Object.hasOwn(node, key))
+            throw unresolved;
+        node = node[key];
+        if (!PREVENT_SCOPE_CHANGE.has(part) && isObject(node) && Object.hasOwn(node, '$id')) {
+            throw new Error('$id is supported only at the root');
+        }
+    }
+    return node;
+}
+function countPayload(schema) {
+    let entries = Array.isArray(schema.enum) ? schema.enum.length : 0;
+    for (const keyword of ['dependentRequired', 'dependencies']) {
+        const map = schema[keyword];
+        if (!isObject(map))
+            continue;
+        for (const names of Object.values(map)) {
+            if (Array.isArray(names))
+                entries += names.length;
+        }
+    }
+    return entries;
+}
+function assertBoundedSchema(root) {
+    const limit = plugin_action_limits_1.PLUGIN_ACTION_LIMITS.maxInputSchemaNodes;
+    const expanding = new Set();
+    let nodes = 0;
+    const count = (cost) => {
+        nodes += cost;
+        if (nodes > limit) {
+            throw new Error(`exceeds ${limit} subschemas, enum entries and dependency names with every $ref inlined`);
+        }
+    };
+    const visit = (schema) => {
+        count(1);
+        if (!isObject(schema))
+            return;
+        count(countPayload(schema));
+        const unsupported = UNSUPPORTED_KEYWORDS.find(keyword => Object.hasOwn(schema, keyword));
+        if (unsupported)
+            throw new Error(`unsupported keyword: "${unsupported}"`);
+        if (schema !== root && Object.hasOwn(schema, '$id')) {
+            throw new Error('$id is supported only at the root');
+        }
+        expanding.add(schema);
+        if (typeof schema.$ref === 'string') {
+            const target = resolveLocalRef(root, schema.$ref);
+            if (isObject(target) && expanding.has(target)) {
+                throw new Error(`$ref "${schema.$ref}" is recursive`);
+            }
+            visit(target);
+        }
+        for (const keyword of SUBSCHEMA_KEYWORDS) {
+            if (Object.hasOwn(schema, keyword))
+                visit(schema[keyword]);
+        }
+        for (const keyword of SUBSCHEMA_LIST_KEYWORDS) {
+            const list = schema[keyword];
+            if (Array.isArray(list))
+                list.forEach(visit);
+        }
+        for (const keyword of SUBSCHEMA_MAP_KEYWORDS) {
+            const map = schema[keyword];
+            if (isObject(map))
+                Object.values(map).forEach(visit);
+        }
+        expanding.delete(schema);
+    };
+    visit(root);
+}
+//# sourceMappingURL=action-input-schema.util.js.map

package/dist/src/plugin-host/utils/credential-handles.util.d.ts

@@ -0,0 +1,3 @@
+import type { NormalizedCredentialRequirement } from '../../data-marts/credentials/credential.types';
+import type { PluginCredentialHandleDto } from '../dto/domain/plugin-installation.dto';
+export declare function toCredentialHandles(ready: readonly NormalizedCredentialRequirement[]): PluginCredentialHandleDto[];

package/dist/src/plugin-host/utils/credential-handles.util.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toCredentialHandles = toCredentialHandles;
+function toCredentialHandles(ready) {
+    return ready.map(requirement => requirement.definitionId === null
+        ? {
+            name: requirement.key,
+            kind: 'ai',
+            models: requirement.models,
+        }
+        : { name: requirement.key, kind: 'exact' });
+}
+//# sourceMappingURL=credential-handles.util.js.map

package/dist/src/plugin-host/utils/execution-token.util.d.ts

@@ -0,0 +1,5 @@
+export declare function createExecutionToken(): {
+    token: string;
+    tokenHash: string;
+};
+export declare function hashExecutionToken(token: string): string;

package/dist/src/plugin-host/utils/execution-token.util.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createExecutionToken = createExecutionToken;
+exports.hashExecutionToken = hashExecutionToken;
+const node_crypto_1 = require("node:crypto");
+function createExecutionToken() {
+    const token = (0, node_crypto_1.randomBytes)(32).toString('base64url');
+    return { token, tokenHash: hashExecutionToken(token) };
+}
+function hashExecutionToken(token) {
+    return (0, node_crypto_1.createHash)('sha256').update(token).digest('hex');
+}
+//# sourceMappingURL=execution-token.util.js.map

package/dist/src/plugin-host/utils/json-shape.util.d.ts

@@ -0,0 +1 @@
+export declare function findJsonShapeProblem(value: unknown): string | null;

package/dist/src/plugin-host/utils/json-shape.util.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findJsonShapeProblem = findJsonShapeProblem;
+const plugin_action_limits_1 = require("../constants/plugin-action-limits");
+function findJsonShapeProblem(value) {
+    const maxDepth = plugin_action_limits_1.PLUGIN_ACTION_LIMITS.maxJsonDepth;
+    const visit = (node, depth) => {
+        if (typeof node !== 'object' || node === null)
+            return null;
+        if (depth > maxDepth)
+            return `is nested deeper than ${maxDepth} levels`;
+        for (const child of Object.values(node)) {
+            const problem = visit(child, depth + 1);
+            if (problem)
+                return problem;
+        }
+        return null;
+    };
+    return visit(value, 1);
+}
+//# sourceMappingURL=json-shape.util.js.map

package/dist/src/plugin-host/utils/plugin-action-outcome.util.d.ts

@@ -0,0 +1,10 @@
+import { PluginActionExecutionStatus } from '../enums/plugin-action-execution-status.enum';
+export type PluginActionOutcome = {
+    status: PluginActionExecutionStatus.SUCCEEDED;
+    result: unknown;
+} | {
+    status: PluginActionExecutionStatus.FAILED;
+    errorCode: string;
+    errorMessage: string;
+};
+export declare function classifyBackendResponse(status: number, body: string | null): PluginActionOutcome;

package/dist/src/plugin-host/utils/plugin-action-outcome.util.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.classifyBackendResponse = classifyBackendResponse;
+const plugin_action_limits_1 = require("../constants/plugin-action-limits");
+const plugin_action_execution_status_enum_1 = require("../enums/plugin-action-execution-status.enum");
+const json_shape_util_1 = require("./json-shape.util");
+function classifyBackendResponse(status, body) {
+    try {
+        return classify(status, body);
+    }
+    catch {
+        return invalid('The backend answer could not be read');
+    }
+}
+function classify(status, body) {
+    if (body === null) {
+        return invalid('The backend answer is larger than allowed');
+    }
+    if (status >= 300 && status < 400) {
+        return invalid(`The backend answered ${status}`);
+    }
+    const parsed = parseJson(body);
+    if (status === 200) {
+        if (!isRecord(parsed) || !Object.hasOwn(parsed, 'result')) {
+            return invalid('The backend answered 200 without a result');
+        }
+        const problem = (0, json_shape_util_1.findJsonShapeProblem)(parsed.result);
+        if (problem) {
+            return invalid(`The result ${problem}`);
+        }
+        if (Buffer.byteLength(JSON.stringify(parsed.result)) > plugin_action_limits_1.PLUGIN_ACTION_LIMITS.maxResultBytes) {
+            return invalid('The result is larger than 1 MiB');
+        }
+        return { status: plugin_action_execution_status_enum_1.PluginActionExecutionStatus.SUCCEEDED, result: parsed.result };
+    }
+    if (status < 300) {
+        return invalid(`The backend answered ${status}`);
+    }
+    const error = isRecord(parsed) ? parsed.error : undefined;
+    if (isRecord(error) && (0, plugin_action_limits_1.isPluginOwnedErrorCode)(error.code)) {
+        return {
+            status: plugin_action_execution_status_enum_1.PluginActionExecutionStatus.FAILED,
+            errorCode: error.code,
+            errorMessage: String(error.message ?? '').slice(0, plugin_action_limits_1.PLUGIN_ACTION_LIMITS.maxErrorMessageChars),
+        };
+    }
+    return invalid(`The backend answered ${status} without a usable error code`);
+}
+function invalid(errorMessage) {
+    return {
+        status: plugin_action_execution_status_enum_1.PluginActionExecutionStatus.FAILED,
+        errorCode: 'BACKEND_INVALID_RESPONSE',
+        errorMessage,
+    };
+}
+function parseJson(body) {
+    try {
+        return JSON.parse(body);
+    }
+    catch {
+        return undefined;
+    }
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=plugin-action-outcome.util.js.map