@verentis/cli 0.2.6 → 0.2.7

package/dist/index.js

@@ -1038,6 +1038,7 @@ function validateManifest(manifest) {
     validateApplicationLaunch(spec, issues);
   }
   validateInstallDirectives(spec.install, issues);
+  validateSettingDeclarations(kind, spec, issues);
   for (const message of validateMarketplaceSection(manifest.marketplace)) error(message);
   const packaging = manifest.packaging ?? {};
   if (!packaging.publisher) warning("packaging.publisher is not set \u2014 `verentis pack`/`publish` will refuse the package");
@@ -1120,6 +1121,72 @@ function validateInstallDirectives(install, issues) {
     }
   });
 }
+var SETTING_KEY_PATTERN = /^[a-z0-9]+([.-][a-z0-9]+)*$/;
+var ENV_VAR_PATTERN = /^[A-Z][A-Z0-9_]*$/;
+var SETTING_TYPES = ["string", "number", "boolean", "select"];
+function validateSettingDeclarations(kind, spec, issues) {
+  const settings2 = spec.settings;
+  if (settings2 === void 0) return;
+  const error = (message) => issues.push({ level: "error", message });
+  if (!Array.isArray(settings2)) {
+    error("spec.settings must be a list of setting declarations");
+    return;
+  }
+  const seen = /* @__PURE__ */ new Set();
+  settings2.forEach((declaration, index) => {
+    const at = `spec.settings[${index}]`;
+    if (!declaration || typeof declaration !== "object" || Array.isArray(declaration)) {
+      error(`${at} must be an object with at least a 'key'`);
+      return;
+    }
+    if (!declaration.key || typeof declaration.key !== "string") {
+      error(`${at}.key is required (short key, stored namespaced as '{metadata.name}.{key}')`);
+    } else if (!SETTING_KEY_PATTERN.test(declaration.key)) {
+      error(`${at}.key '${declaration.key}' must be lowercase kebab/dot notation (e.g. 'api-key' or 'smtp.host')`);
+    } else if (seen.has(declaration.key)) {
+      error(`${at}.key '${declaration.key}' is declared more than once`);
+    } else {
+      seen.add(declaration.key);
+    }
+    if (declaration.env !== void 0) {
+      if (typeof declaration.env !== "string" || !ENV_VAR_PATTERN.test(declaration.env)) {
+        error(`${at}.env must be an environment variable name (UPPER_SNAKE_CASE, e.g. 'MY_API_KEY')`);
+      } else if (declaration.env.startsWith("VERENTIS_")) {
+        error(`${at}.env must not use the reserved 'VERENTIS_' prefix`);
+      }
+    }
+    for (const flag of ["secret", "required"]) {
+      if (declaration[flag] !== void 0 && typeof declaration[flag] !== "boolean") {
+        error(`${at}.${flag} must be a boolean`);
+      }
+    }
+    const type = declaration.type ?? "string";
+    if (typeof type !== "string" || !SETTING_TYPES.includes(type)) {
+      error(`${at}.type must be one of ${SETTING_TYPES.join(", ")} (got '${String(declaration.type)}')`);
+    }
+    if (declaration.secret === true && declaration.default !== void 0) {
+      error(`${at} declares a default for a secret \u2014 secrets must never ship default values`);
+    }
+    if (type === "select") {
+      if (!Array.isArray(declaration.options) || declaration.options.length === 0) {
+        error(`${at}.options is required for type 'select'`);
+      }
+    } else if (declaration.options !== void 0) {
+      error(`${at}.options is only allowed for type 'select'`);
+    }
+  });
+  if (kind === "ExecutionEngine") {
+    const declaresSecret = settings2.some(
+      (declaration) => declaration && typeof declaration === "object" && declaration.secret === true
+    );
+    const runtimes = spec.runtimes ?? {};
+    if (declaresSecret && !runtimes["docker"]) {
+      error(
+        "spec.settings declares secrets but the engine has no docker runtime \u2014 secrets are server-only and cannot be provisioned into browser (wasm) runs"
+      );
+    }
+  }
+}
 
 // src/commands/dev.ts
 async function resolveDevScopes(flags) {