@sentry/junior 0.5.0 → 0.7.0

package/dist/chunk-VW26MOSO.js

@@ -0,0 +1,522 @@
+// src/chat/plugins/manifest.ts
+import { z } from "zod";
+import { parse as parseYaml } from "yaml";
+var PLUGIN_NAME_RE = /^[a-z][a-z0-9-]*$/;
+var SHORT_CAPABILITY_RE = /^[a-z0-9]+(\.[a-z0-9-]+)*$/;
+var SHORT_CONFIG_KEY_RE = /^[a-z0-9]+(\.[a-z0-9-]+)*$/;
+var AUTH_TOKEN_ENV_RE = /^[A-Z][A-Z0-9_]*$/;
+var API_DOMAIN_RE = /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+var RUNTIME_POSTINSTALL_CMD_RE = /^[A-Za-z0-9._/-]+$/;
+var RESERVED_AUTHORIZE_PARAM_KEYS = /* @__PURE__ */ new Set([
+  "client_id",
+  "scope",
+  "state",
+  "redirect_uri",
+  "response_type"
+]);
+var FORBIDDEN_API_HEADER_NAMES = /* @__PURE__ */ new Set(["authorization"]);
+var FORBIDDEN_TOKEN_HEADER_NAMES = /* @__PURE__ */ new Set(["authorization"]);
+var trimmedString = z.string().transform((value) => value.trim());
+var nonEmptyTrimmedString = trimmedString.pipe(
+  z.string().min(1, { error: "must be a non-empty string" })
+);
+var envVarString = nonEmptyTrimmedString.refine(
+  (value) => AUTH_TOKEN_ENV_RE.test(value),
+  {
+    error: "must be an uppercase env var name"
+  }
+);
+var httpsUrlString = nonEmptyTrimmedString.superRefine((value, ctx) => {
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: "must be a valid URL"
+    });
+    return;
+  }
+  if (parsed.protocol !== "https:") {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: "must use https"
+    });
+  }
+});
+var stringMapSchema = z.record(z.string(), z.unknown()).transform((record, ctx) => {
+  const entries = Object.entries(record);
+  const result = {};
+  const seen = /* @__PURE__ */ new Set();
+  for (const [rawKey, rawValue] of entries) {
+    const key = rawKey.trim();
+    if (!key) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: "keys must be non-empty strings"
+      });
+      return z.NEVER;
+    }
+    if (typeof rawValue !== "string" || !rawValue.trim()) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: `${key} must be a non-empty string`
+      });
+      return z.NEVER;
+    }
+    const normalizedKey = key.toLowerCase();
+    if (seen.has(normalizedKey)) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: `${key} is duplicated`
+      });
+      return z.NEVER;
+    }
+    seen.add(normalizedKey);
+    result[key] = rawValue.trim();
+  }
+  return Object.keys(result).length > 0 ? result : void 0;
+});
+var apiDomainsSchema = z.array(z.unknown()).min(1, {
+  error: "must be a non-empty array of strings"
+}).transform((domains, ctx) => {
+  return domains.map((rawDomain) => {
+    const domain = typeof rawDomain === "string" ? rawDomain.trim().toLowerCase() : "";
+    if (!domain) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: "entries must be non-empty strings"
+      });
+      return z.NEVER;
+    }
+    if (!API_DOMAIN_RE.test(domain)) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: "entries must be valid domain names"
+      });
+      return z.NEVER;
+    }
+    return domain;
+  });
+});
+var baseCredentialsSchema = z.object({
+  "api-domains": apiDomainsSchema,
+  "api-headers": stringMapSchema.optional(),
+  "auth-token-env": envVarString,
+  "auth-token-placeholder": nonEmptyTrimmedString.optional()
+}).passthrough();
+var oauthBearerCredentialsSchema = baseCredentialsSchema.extend({
+  type: z.literal("oauth-bearer")
+});
+var githubAppCredentialsSchema = baseCredentialsSchema.extend({
+  type: z.literal("github-app"),
+  "app-id-env": envVarString,
+  "private-key-env": envVarString,
+  "installation-id-env": envVarString
+});
+var runtimeDependencyEntrySchema = z.object({
+  type: z.enum(["npm", "system"]),
+  package: z.string().optional(),
+  version: z.string().optional(),
+  url: z.string().optional(),
+  sha256: z.string().optional()
+}).passthrough();
+var runtimePostinstallCommandSourceSchema = z.object({
+  cmd: nonEmptyTrimmedString,
+  args: z.array(z.string(), {
+    error: "args must be an array of strings when provided"
+  }).optional(),
+  sudo: z.boolean({
+    error: "sudo must be a boolean when provided"
+  }).optional()
+}).passthrough();
+var oauthSourceSchema = z.object({
+  "client-id-env": envVarString,
+  "client-secret-env": envVarString,
+  "authorize-endpoint": httpsUrlString,
+  "token-endpoint": httpsUrlString,
+  scope: nonEmptyTrimmedString.optional(),
+  "authorize-params": stringMapSchema.optional(),
+  "token-extra-headers": stringMapSchema.optional(),
+  "token-auth-method": nonEmptyTrimmedString.refine((value) => value === "body" || value === "basic", {
+    error: 'must be "body" or "basic"'
+  }).optional()
+}).passthrough();
+var targetSourceSchema = z.object({
+  type: z.literal("repo", {
+    error: 'type must be "repo"'
+  }),
+  "config-key": nonEmptyTrimmedString
+}).passthrough();
+var manifestSourceSchema = z.object({
+  name: z.string().refine((value) => PLUGIN_NAME_RE.test(value), {
+    error: "invalid"
+  }),
+  description: nonEmptyTrimmedString,
+  capabilities: z.array(z.string(), {
+    error: "must be an array when provided"
+  }).optional(),
+  "config-keys": z.array(z.string(), {
+    error: "must be an array when provided"
+  }).optional(),
+  credentials: z.record(z.string(), z.unknown(), {
+    error: "must be an object when provided"
+  }).optional(),
+  "runtime-dependencies": z.array(z.unknown(), {
+    error: "must be an array"
+  }).optional(),
+  "runtime-postinstall": z.array(z.unknown(), {
+    error: "must be an array"
+  }).optional(),
+  oauth: z.record(z.string(), z.unknown(), {
+    error: "must be an object"
+  }).optional(),
+  target: z.record(z.string(), z.unknown(), {
+    error: "must be an object"
+  }).optional()
+}).passthrough();
+function formatPath(path) {
+  return path.map((segment) => String(segment)).join(".");
+}
+function issueMessage(error, prefix) {
+  const issue = error.issues[0];
+  if (!issue) {
+    return prefix;
+  }
+  const suffix = formatPath(issue.path);
+  return suffix ? `${prefix}.${suffix} ${issue.message}` : `${prefix} ${issue.message}`;
+}
+function normalizeStringMap(value, prefix, options = {}) {
+  if (!value) {
+    return void 0;
+  }
+  for (const key of Object.keys(value)) {
+    const normalizedKey = key.toLowerCase();
+    if (options.reservedKeys?.has(normalizedKey)) {
+      throw new Error(`${prefix}.${key} is reserved by the runtime`);
+    }
+    if (options.forbiddenKeys?.has(normalizedKey)) {
+      throw new Error(`${prefix}.${key} is not allowed`);
+    }
+  }
+  return value;
+}
+function normalizeCredentials(data, name) {
+  const schema = data.type === "oauth-bearer" ? oauthBearerCredentialsSchema : data.type === "github-app" ? githubAppCredentialsSchema : void 0;
+  if (!schema) {
+    throw new Error(
+      `Plugin ${name} has unsupported credentials.type: "${String(data.type)}"`
+    );
+  }
+  const result = schema.safeParse(data);
+  if (!result.success) {
+    throw new Error(issueMessage(result.error, `Plugin ${name} credentials`));
+  }
+  if (result.data.type === "oauth-bearer") {
+    return {
+      type: "oauth-bearer",
+      apiDomains: result.data["api-domains"],
+      ...result.data["api-headers"] ? {
+        apiHeaders: normalizeStringMap(
+          result.data["api-headers"],
+          `Plugin ${name} credentials.api-headers`,
+          { forbiddenKeys: FORBIDDEN_API_HEADER_NAMES }
+        )
+      } : {},
+      authTokenEnv: result.data["auth-token-env"],
+      ...result.data["auth-token-placeholder"] ? { authTokenPlaceholder: result.data["auth-token-placeholder"] } : {}
+    };
+  }
+  return {
+    type: "github-app",
+    apiDomains: result.data["api-domains"],
+    ...result.data["api-headers"] ? {
+      apiHeaders: normalizeStringMap(
+        result.data["api-headers"],
+        `Plugin ${name} credentials.api-headers`,
+        { forbiddenKeys: FORBIDDEN_API_HEADER_NAMES }
+      )
+    } : {},
+    authTokenEnv: result.data["auth-token-env"],
+    ...result.data["auth-token-placeholder"] ? { authTokenPlaceholder: result.data["auth-token-placeholder"] } : {},
+    appIdEnv: result.data["app-id-env"],
+    privateKeyEnv: result.data["private-key-env"],
+    installationIdEnv: result.data["installation-id-env"]
+  };
+}
+function normalizeRuntimeDependencies(entries, name) {
+  const parsed = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of entries) {
+    const result = runtimeDependencyEntrySchema.safeParse(entry);
+    if (!result.success) {
+      throw new Error(
+        issueMessage(
+          result.error,
+          `Plugin ${name} runtime-dependencies entries`
+        )
+      );
+    }
+    const record = result.data;
+    const packageName = typeof record.package === "string" ? record.package.trim() : "";
+    const packageUrl = typeof record.url === "string" ? record.url.trim() : "";
+    const version = record.version;
+    const sha256 = record.sha256;
+    if (record.type === "npm") {
+      if (!packageName) {
+        throw new Error(
+          `Plugin ${name} runtime dependency package must be a non-empty string`
+        );
+      }
+      if (record.url !== void 0 || sha256 !== void 0) {
+        throw new Error(
+          `Plugin ${name} npm runtime dependencies must only include package/version fields`
+        );
+      }
+      const normalizedVersion = typeof version === "string" ? version.trim() : "latest";
+      if (!normalizedVersion) {
+        throw new Error(
+          `Plugin ${name} runtime dependency version must be a non-empty string when provided`
+        );
+      }
+      const dedupeKey2 = `${record.type}:${packageName}:${normalizedVersion}`;
+      if (seen.has(dedupeKey2)) {
+        continue;
+      }
+      seen.add(dedupeKey2);
+      parsed.push({
+        type: "npm",
+        package: packageName,
+        version: normalizedVersion
+      });
+      continue;
+    }
+    if (version !== void 0) {
+      throw new Error(
+        `Plugin ${name} system runtime dependencies must not include a version`
+      );
+    }
+    if (packageName && packageUrl) {
+      throw new Error(
+        `Plugin ${name} system runtime dependencies must specify either package or url, not both`
+      );
+    }
+    if (!packageName && !packageUrl) {
+      throw new Error(
+        `Plugin ${name} system runtime dependencies must specify package or url`
+      );
+    }
+    if (packageName) {
+      if (sha256 !== void 0) {
+        throw new Error(
+          `Plugin ${name} system runtime dependency package entries must not include sha256`
+        );
+      }
+      const dedupeKey2 = `${record.type}:package:${packageName}`;
+      if (seen.has(dedupeKey2)) {
+        continue;
+      }
+      seen.add(dedupeKey2);
+      parsed.push({
+        type: "system",
+        package: packageName
+      });
+      continue;
+    }
+    if (!/^https:\/\//i.test(packageUrl)) {
+      throw new Error(
+        `Plugin ${name} system runtime dependency url must be an https URL`
+      );
+    }
+    const normalizedSha256 = typeof sha256 === "string" ? sha256.trim().toLowerCase() : "";
+    if (!/^[a-f0-9]{64}$/.test(normalizedSha256)) {
+      throw new Error(
+        `Plugin ${name} system runtime dependency url entries must include a valid sha256`
+      );
+    }
+    const dedupeKey = `${record.type}:url:${packageUrl}:${normalizedSha256}`;
+    if (seen.has(dedupeKey)) {
+      continue;
+    }
+    seen.add(dedupeKey);
+    parsed.push({
+      type: "system",
+      url: packageUrl,
+      sha256: normalizedSha256
+    });
+  }
+  return parsed.length > 0 ? parsed : void 0;
+}
+function normalizeRuntimePostinstall(commands, name) {
+  const parsed = [];
+  for (const command of commands) {
+    const result = runtimePostinstallCommandSourceSchema.safeParse(command);
+    if (!result.success) {
+      throw new Error(
+        issueMessage(result.error, `Plugin ${name} runtime-postinstall`)
+      );
+    }
+    if (!RUNTIME_POSTINSTALL_CMD_RE.test(result.data.cmd)) {
+      throw new Error(
+        `Plugin ${name} runtime-postinstall cmd must be a single executable token (letters, digits, ., _, /, -)`
+      );
+    }
+    const normalizedArgs = result.data.args?.map((arg) => arg.trim()).filter((arg) => arg.length > 0);
+    parsed.push({
+      cmd: result.data.cmd,
+      ...normalizedArgs && normalizedArgs.length > 0 ? { args: normalizedArgs } : {},
+      ...typeof result.data.sudo === "boolean" ? { sudo: result.data.sudo } : {}
+    });
+  }
+  return parsed.length > 0 ? parsed : void 0;
+}
+function parsePluginManifest(raw, dir) {
+  let parsedYaml;
+  try {
+    parsedYaml = parseYaml(raw);
+  } catch (error) {
+    throw new Error(
+      `Invalid plugin manifest in ${dir}: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  if (!parsedYaml || typeof parsedYaml !== "object" || Array.isArray(parsedYaml)) {
+    throw new Error(`Invalid plugin manifest in ${dir}: expected an object`);
+  }
+  const sourceResult = manifestSourceSchema.safeParse(parsedYaml);
+  if (!sourceResult.success) {
+    const issue = sourceResult.error.issues[0];
+    const path = formatPath(issue?.path ?? []);
+    if (path === "name") {
+      throw new Error(
+        `Invalid plugin name in ${dir}: "${parsedYaml.name}"`
+      );
+    }
+    if (path === "description") {
+      throw new Error(`Invalid plugin description in ${dir}`);
+    }
+    if (path === "capabilities") {
+      throw new Error(
+        `Plugin ${parsedYaml.name ?? "unknown"} capabilities must be an array when provided`
+      );
+    }
+    if (path === "config-keys") {
+      throw new Error(
+        `Plugin ${parsedYaml.name ?? "unknown"} config-keys must be an array when provided`
+      );
+    }
+    if (path === "credentials") {
+      throw new Error(
+        `Plugin ${parsedYaml.name ?? "unknown"} credentials must be an object when provided`
+      );
+    }
+    if (path === "runtime-dependencies") {
+      throw new Error(
+        `Plugin ${parsedYaml.name ?? "unknown"} runtime-dependencies must be an array`
+      );
+    }
+    if (path === "runtime-postinstall") {
+      throw new Error(
+        `Plugin ${parsedYaml.name ?? "unknown"} runtime-postinstall must be an array`
+      );
+    }
+    if (path === "oauth") {
+      throw new Error(
+        `Plugin ${parsedYaml.name ?? "unknown"} oauth must be an object`
+      );
+    }
+    if (path === "target") {
+      throw new Error(
+        `Plugin ${parsedYaml.name ?? "unknown"} target must be an object`
+      );
+    }
+    throw new Error(issue?.message ?? `Invalid plugin manifest in ${dir}`);
+  }
+  const data = sourceResult.data;
+  const capabilities = (data.capabilities ?? []).map((cap) => {
+    if (!SHORT_CAPABILITY_RE.test(cap)) {
+      throw new Error(
+        `Invalid capability token "${cap}" in plugin ${data.name}`
+      );
+    }
+    return `${data.name}.${cap}`;
+  });
+  const configKeys = (data["config-keys"] ?? []).map((key) => {
+    if (!SHORT_CONFIG_KEY_RE.test(key)) {
+      throw new Error(`Invalid config key "${key}" in plugin ${data.name}`);
+    }
+    return `${data.name}.${key}`;
+  });
+  const credentials = data.credentials ? normalizeCredentials(data.credentials, data.name) : void 0;
+  const runtimeDependencies = data["runtime-dependencies"] ? normalizeRuntimeDependencies(data["runtime-dependencies"], data.name) : void 0;
+  const runtimePostinstall = data["runtime-postinstall"] ? normalizeRuntimePostinstall(data["runtime-postinstall"], data.name) : void 0;
+  const manifest = {
+    name: data.name,
+    description: data.description,
+    capabilities,
+    configKeys,
+    ...credentials ? { credentials } : {},
+    ...runtimeDependencies ? { runtimeDependencies } : {},
+    ...runtimePostinstall ? { runtimePostinstall } : {}
+  };
+  if (data.oauth) {
+    if (!credentials) {
+      throw new Error(`Plugin ${data.name} oauth requires credentials`);
+    }
+    if (credentials.type !== "oauth-bearer") {
+      throw new Error(
+        `Plugin ${data.name} oauth requires credentials.type "oauth-bearer"`
+      );
+    }
+    const result = oauthSourceSchema.safeParse(data.oauth);
+    if (!result.success) {
+      throw new Error(issueMessage(result.error, `Plugin ${data.name} oauth`));
+    }
+    const authorizeParams = result.data["authorize-params"] ? normalizeStringMap(
+      result.data["authorize-params"],
+      `Plugin ${data.name} oauth.authorize-params`,
+      {
+        reservedKeys: RESERVED_AUTHORIZE_PARAM_KEYS
+      }
+    ) : void 0;
+    const tokenExtraHeaders = result.data["token-extra-headers"] ? normalizeStringMap(
+      result.data["token-extra-headers"],
+      `Plugin ${data.name} oauth.token-extra-headers`,
+      {
+        forbiddenKeys: FORBIDDEN_TOKEN_HEADER_NAMES
+      }
+    ) : void 0;
+    manifest.oauth = {
+      clientIdEnv: result.data["client-id-env"],
+      clientSecretEnv: result.data["client-secret-env"],
+      authorizeEndpoint: result.data["authorize-endpoint"],
+      tokenEndpoint: result.data["token-endpoint"],
+      ...result.data.scope ? { scope: result.data.scope } : {},
+      ...authorizeParams ? { authorizeParams } : {},
+      ...result.data["token-auth-method"] ? { tokenAuthMethod: result.data["token-auth-method"] } : {},
+      ...tokenExtraHeaders ? { tokenExtraHeaders } : {}
+    };
+  }
+  if (data.target) {
+    const result = targetSourceSchema.safeParse(data.target);
+    if (!result.success) {
+      throw new Error(issueMessage(result.error, `Plugin ${data.name} target`));
+    }
+    if (!SHORT_CONFIG_KEY_RE.test(result.data["config-key"])) {
+      throw new Error(
+        `Plugin ${data.name} target.config-key "${result.data["config-key"]}" is invalid`
+      );
+    }
+    const qualifiedKey = `${data.name}.${result.data["config-key"]}`;
+    if (!configKeys.includes(qualifiedKey)) {
+      throw new Error(
+        `Plugin ${data.name} target.config-key "${result.data["config-key"]}" must be listed in config-keys`
+      );
+    }
+    manifest.target = { type: "repo", configKey: qualifiedKey };
+  }
+  return manifest;
+}
+
+export {
+  parsePluginManifest
+};

package/dist/cli/check.d.ts

@@ -0,0 +1,8 @@
+interface ValidationIo {
+    info: (line: string) => void;
+    warn: (line: string) => void;
+    error: (line: string) => void;
+}
+declare function runCheck(rootDir?: string, io?: ValidationIo): Promise<void>;
+
+export { type ValidationIo, runCheck };