@pptb/types 1.1.3-beta.1 → 1.2.0

package/README.md

@@ -4,11 +4,11 @@ TypeScript type definitions for Power Platform ToolBox APIs, plus a built-in CLI
 
 - [@pptb/types](#pptbtypes)
     - [Installation](#installation)
-    - [Overview](#overview)
     - [Tool Validation](#tool-validation)
         - [Quick start](#quick-start)
         - [CLI options](#cli-options)
         - [What is validated](#what-is-validated)
+    - [Overview](#overview)
     - [Usage](#usage)
         - [Include all type definitions](#include-all-type-definitions)
         - [Include specific API types](#include-specific-api-types)
@@ -55,7 +55,7 @@ Add a script to your tool's `package.json`:
 ```json
 {
     "scripts": {
-        "pptb-validate": "pptb-validate"
+        "validate": "pptb-validate"
     }
 }
 ```
@@ -63,7 +63,7 @@ Add a script to your tool's `package.json`:
 Then run:
 
 ```bash
-npm run pptb-validate
+npm run validate
 ```
 
 You can also run it directly (no script entry needed once `@pptb/types` is installed):
@@ -80,32 +80,32 @@ npx pptb-validate path/to/package.json
 
 ### CLI options
 
-| Option | Description |
-|---|---|
-| `--skip-url-checks` | Skip URL reachability checks (faster, works offline) |
-| `--json` | Print results as a JSON object (suitable for CI pipelines) |
-| `--help`, `-h` | Show help information |
+| Option              | Description                                                |
+| ------------------- | ---------------------------------------------------------- |
+| `--skip-url-checks` | Skip URL reachability checks (faster, works offline)       |
+| `--json`            | Print results as a JSON object (suitable for CI pipelines) |
+| `--help`, `-h`      | Show help information                                      |
 
 ### What is validated
 
 The validator checks every field that the official review pipeline inspects:
 
-| Field | Required | Rules |
-|---|---|---|
-| `name` | ✅ | Must be a string |
-| `version` | ✅ | Must be a string |
-| `displayName` | ✅ | Must be a string |
-| `description` | ✅ | Must be a string |
-| `license` | ✅ | Must be one of the approved OSS licenses (MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, GPL-2.0, GPL-3.0, LGPL-3.0, ISC, AGPL-3.0-only) |
-| `contributors` | ✅ | Non-empty array; each entry needs a `name` |
-| `configurations.repository` | ✅ | Valid, reachable URL |
-| `configurations.readmeUrl` | ✅ | Valid URL; must **not** be hosted on `github.com` (use `raw.githubusercontent.com`) |
-| `configurations.website` | ❌ | Valid, reachable URL when provided |
-| `configurations.funding` | ❌ | Valid, reachable URL when provided |
-| `icon` | ❌ | Relative path to a `.svg` file bundled under `dist/`; must not be an HTTP URL or an absolute path |
-| `cspExceptions` | ❌ | When present: must not be empty; only recognised directives; each directive must be a non-empty array |
-| `features.multiConnection` | ❌* | Required when `features` is present; must be `"required"`, `"optional"`, or `"none"` |
-| `features.minAPI` | ❌ | Valid semver string when provided |
+| Field                       | Required | Rules                                                                                                                                  |
+| --------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------- |
+| `name`                      | ✅       | Must be a string                                                                                                                       |
+| `version`                   | ✅       | Must be a string                                                                                                                       |
+| `displayName`               | ✅       | Must be a string                                                                                                                       |
+| `description`               | ✅       | Must be a string                                                                                                                       |
+| `license`                   | ✅       | Must be one of the approved OSS licenses (MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, GPL-2.0, GPL-3.0, LGPL-3.0, ISC, AGPL-3.0-only) |
+| `contributors`              | ✅       | Non-empty array; each entry needs a `name`                                                                                             |
+| `configurations.repository` | ✅       | Valid, reachable URL                                                                                                                   |
+| `configurations.readmeUrl`  | ✅       | Valid URL; must **not** be hosted on `github.com` (use `raw.githubusercontent.com`)                                                    |
+| `configurations.website`    | ❌       | Valid, reachable URL when provided                                                                                                     |
+| `configurations.funding`    | ❌       | Valid, reachable URL when provided                                                                                                     |
+| `icon`                      | ❌       | Relative path to a `.svg` file bundled under `dist/`; must not be an HTTP URL or an absolute path                                      |
+| `cspExceptions`             | ❌       | When present: must not be empty; only recognised directives; each directive must be a non-empty array                                  |
+| `features.multiConnection`  | ❌\*     | Required when `features` is present; must be `"required"`, `"optional"`, or `"none"`                                                   |
+| `features.minAPI`           | ❌       | Valid semver string when provided                                                                                                      |
 
 > \* Required only when the `features` object is present.
 

package/lib/validate.js

@@ -7,7 +7,7 @@
  */
 
 /** @typedef {{ name: string; url?: string }} Contributor */
-/** @typedef {{ "connect-src"?: string[]; "script-src"?: string[]; "style-src"?: string[]; "img-src"?: string[]; "font-src"?: string[]; "frame-src"?: string[] }} CspExceptions */
+/** @typedef {{ "connect-src"?: string[]; "script-src"?: string[]; "style-src"?: string[]; "img-src"?: string[]; "font-src"?: string[]; "frame-src"?: string[]; "media-src"?: string[] }} CspExceptions */
 /** @typedef {{ repository?: string; website?: string; funding?: string; readmeUrl?: string }} Configurations */
 /** @typedef {{ multiConnection?: "required" | "optional" | "none"; minAPI?: string }} Features */
 /**
@@ -85,6 +85,16 @@ function validateIconPath(fieldName, iconPath, errors) {
         errors.push(`${fieldName} must be a relative path (e.g., 'icon.svg' or 'icons/icon.svg')`);
         return;
     }
+    // Reject Windows absolute paths like "C:\..." or "C:/"
+    if (/^[a-zA-Z]:/.test(iconPath)) {
+        errors.push(`${fieldName} must be a relative path (e.g., 'icon.svg' or 'icons/icon.svg')`);
+        return;
+    }
+    // Reject backslashes — icon paths must use forward slashes
+    if (iconPath.includes("\\")) {
+        errors.push(`${fieldName} must use forward slashes, not backslashes (e.g., 'icons/icon.svg')`);
+        return;
+    }
     if (iconPath.includes("..")) {
         errors.push(`${fieldName} cannot contain '..' (path traversal not allowed)`);
         return;
@@ -145,12 +155,12 @@ async function validatePackageJson(packageJson, options = {}) {
     }
 
     // Icon validation (optional, but must be a relative SVG path if provided)
-    if (packageJson.icon !== undefined && packageJson.icon !== null) {
-        if (typeof packageJson.icon !== "string") {
-            errors.push("icon must be a string (relative path to bundled SVG under dist)");
-        } else {
-            validateIconPath("icon", packageJson.icon, errors);
-        }
+    if (packageJson.icon === undefined || packageJson.icon === null) {
+        warnings.push("icon is not set; consider adding a bundled SVG icon so your tool displays properly in the marketplace");
+    } else if (typeof packageJson.icon !== "string") {
+        errors.push("icon must be a string (relative path to bundled SVG under dist)");
+    } else {
+        validateIconPath("icon", packageJson.icon, errors);
     }
 
     // Contributors validation
@@ -192,19 +202,19 @@ async function validatePackageJson(packageJson, options = {}) {
             }
         }
 
-        // Website validation (optional)
-        if (configs.website) {
-            if (!isValidUrl(configs.website)) {
-                warnings.push("configurations.website has an invalid URL format");
-            } else if (!skipUrlChecks) {
-                const accessible = await isUrlAccessible(configs.website);
-                if (!accessible) {
-                    warnings.push("configurations.website URL is not accessible");
-                }
+        // Website validation (optional but recommended)
+        if (!configs.website) {
+            warnings.push("configurations.website is not set; consider adding a URL where users can learn more about your tool");
+        } else if (!isValidUrl(configs.website)) {
+            warnings.push("configurations.website has an invalid URL format");
+        } else if (!skipUrlChecks) {
+            const accessible = await isUrlAccessible(configs.website);
+            if (!accessible) {
+                warnings.push("configurations.website URL is not accessible");
             }
         }
 
-        // Funding validation (optional)
+        // Funding validation (optional but recommended)
         if (configs.funding) {
             if (!isValidUrl(configs.funding)) {
                 warnings.push("configurations.funding has an invalid URL format");
@@ -233,45 +243,57 @@ async function validatePackageJson(packageJson, options = {}) {
 
     // CSP Exceptions validation (optional, but validated if present)
     if (packageJson.cspExceptions) {
-        const validCspDirectives = ["connect-src", "script-src", "style-src", "img-src", "font-src", "frame-src"];
+        const cspExceptions = packageJson.cspExceptions;
 
-        const hasAnyDirectives = Object.keys(packageJson.cspExceptions).length > 0;
-        if (!hasAnyDirectives) {
-            errors.push("cspExceptions cannot be empty. If CSP exceptions are not needed, remove the cspExceptions field");
-        }
+        if (typeof cspExceptions !== "object" || cspExceptions === null || Array.isArray(cspExceptions)) {
+            errors.push("cspExceptions must be an object mapping CSP directives to arrays of strings");
+        } else {
+            const validCspDirectives = ["connect-src", "script-src", "style-src", "img-src", "font-src", "frame-src", "media-src"];
 
-        Object.keys(packageJson.cspExceptions).forEach((directive) => {
-            if (!validCspDirectives.includes(directive)) {
-                warnings.push(`Unknown CSP directive: ${directive}`);
-            }
-            const values = packageJson.cspExceptions?.[/** @type {keyof CspExceptions} */ (directive)];
-            if (values && !Array.isArray(values)) {
-                errors.push(`CSP directive "${directive}" must be an array of strings`);
-            } else if (values && values.length === 0) {
-                errors.push(`CSP directive "${directive}" cannot be an empty array`);
+            const hasAnyDirectives = Object.keys(cspExceptions).length > 0;
+            if (!hasAnyDirectives) {
+                errors.push("cspExceptions cannot be empty. If CSP exceptions are not needed, remove the cspExceptions field");
             }
-        });
+
+            Object.keys(cspExceptions).forEach((directive) => {
+                if (!validCspDirectives.includes(directive)) {
+                    warnings.push(`Unknown CSP directive: ${directive}`);
+                }
+                const values = cspExceptions[/** @type {keyof CspExceptions} */ (directive)];
+                if (values && !Array.isArray(values)) {
+                    errors.push(`CSP directive "${directive}" must be an array of strings`);
+                } else if (values && values.length === 0) {
+                    errors.push(`CSP directive "${directive}" cannot be an empty array`);
+                }
+            });
+        }
     }
 
     // Features validation (optional, but validated if present)
-    if (packageJson.features) {
-        const VALID_FEATURE_KEYS = ["multiConnection", "minAPI"];
-        const featureKeys = Object.keys(packageJson.features);
-        const invalidKeys = featureKeys.filter((key) => !VALID_FEATURE_KEYS.includes(key));
+    if (packageJson.features !== undefined) {
+        const features = packageJson.features;
 
-        if (invalidKeys.length > 0) {
-            errors.push(`features can only contain ${VALID_FEATURE_KEYS.map((k) => `'${k}'`).join(", ")} properties. Invalid properties: ${invalidKeys.join(", ")}`);
-        }
+        if (features === null || typeof features !== "object" || Array.isArray(features)) {
+            errors.push("features must be a non-array object with optional 'multiConnection' and 'minAPI' properties");
+        } else {
+            const VALID_FEATURE_KEYS = ["multiConnection", "minAPI"];
+            const featureKeys = Object.keys(features);
+            const invalidKeys = featureKeys.filter((key) => !VALID_FEATURE_KEYS.includes(key));
 
-        if (packageJson.features.multiConnection === undefined) {
-            errors.push("features.multiConnection is required when features object is provided");
-        } else if (!VALID_MULTI_CONNECTION_VALUES.includes(packageJson.features.multiConnection)) {
-            errors.push(`features.multiConnection must be one of: ${VALID_MULTI_CONNECTION_VALUES.join(", ")}`);
-        }
+            if (invalidKeys.length > 0) {
+                errors.push(`features can only contain ${VALID_FEATURE_KEYS.map((k) => `'${k}'`).join(", ")} properties. Invalid properties: ${invalidKeys.join(", ")}`);
+            }
 
-        if (packageJson.features.minAPI !== undefined) {
-            if (typeof packageJson.features.minAPI !== "string" || !SEMVER_REGEX.test(packageJson.features.minAPI)) {
-                errors.push("features.minAPI must be a valid semantic version string (e.g., '1.0.0')");
+            if (features.multiConnection === undefined) {
+                errors.push("features.multiConnection is required when features object is provided");
+            } else if (!VALID_MULTI_CONNECTION_VALUES.includes(features.multiConnection)) {
+                errors.push(`features.multiConnection must be one of: ${VALID_MULTI_CONNECTION_VALUES.join(", ")}`);
+            }
+
+            if (features.minAPI !== undefined) {
+                if (typeof features.minAPI !== "string" || !SEMVER_REGEX.test(features.minAPI)) {
+                    errors.push("features.minAPI must be a valid semantic version string (e.g., '1.0.0')");
+                }
             }
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pptb/types",
-  "version": "1.1.3-beta.1",
+  "version": "1.2.0",
   "description": "Type definitions for Power Platform ToolBox APIs and validity checks for tool packages",
   "main": "index.d.ts",
   "types": "index.d.ts",