@visualautomate/plugin-sdk 0.6.1 → 0.8.0

package/dist/index.mjs

@@ -1,202 +1,8 @@
-// src/simulate.ts
-function toBytes(data) {
-  return typeof data === "string" ? new TextEncoder().encode(data) : data;
-}
-function createLocalStorage(seed = {}) {
-  const files = /* @__PURE__ */ new Map();
-  for (const [path, data] of Object.entries(seed)) {
-    files.set(path, {
-      bytes: toBytes(data),
-      contentType: "application/octet-stream",
-      uploadedAt: (/* @__PURE__ */ new Date()).toISOString()
-    });
-  }
-  const result = (path, file) => ({
-    url: `memory://${path}`,
-    size: file.bytes.length,
-    contentType: file.contentType,
-    uploadedAt: file.uploadedAt,
-    // The real one expires; this one does not, and says so rather than
-    // inventing a date a test might come to rely on.
-    expiresAt: "never (local simulation)"
-  });
-  const storage = {
-    async put(path, data, contentType = "application/octet-stream") {
-      const file = {
-        bytes: toBytes(data),
-        contentType,
-        uploadedAt: (/* @__PURE__ */ new Date()).toISOString()
-      };
-      files.set(path, file);
-      return result(path, file);
-    },
-    async get(path) {
-      return files.get(path)?.bytes ?? null;
-    },
-    async delete(path) {
-      files.delete(path);
-    },
-    async list(prefix) {
-      const listed = [];
-      let totalSize = 0;
-      for (const [path, file] of files) {
-        if (prefix && !path.startsWith(prefix)) continue;
-        listed.push({
-          url: `memory://${path}`,
-          pathname: path,
-          size: file.bytes.length,
-          uploadedAt: file.uploadedAt
-        });
-        totalSize += file.bytes.length;
-      }
-      return { files: listed, totalSize };
-    },
-    async head(path) {
-      const file = files.get(path);
-      return file ? { size: file.bytes.length, contentType: file.contentType } : null;
-    },
-    async signedUrl(path) {
-      return files.has(path) ? `memory://${path}` : null;
-    },
-    /**
-     * Really fetches, because that is the only way to find out whether the
-     * URL a plugin builds is the URL it meant. The bytes land in the same
-     * in-memory store the rest of these read from.
-     */
-    async download(url, path, contentType) {
-      const res = await fetch(url);
-      if (!res.ok) throw new Error(`Downloading ${url} failed with status ${res.status}`);
-      const file = {
-        bytes: new Uint8Array(await res.arrayBuffer()),
-        contentType: contentType ?? res.headers.get("content-type") ?? "application/octet-stream",
-        uploadedAt: (/* @__PURE__ */ new Date()).toISOString()
-      };
-      files.set(path, file);
-      return result(path, file);
-    }
-  };
-  return { storage, files };
-}
-function createLocalState(seed = {}) {
-  const values = new Map(Object.entries(seed));
-  const state = {
-    async get(key) {
-      return values.has(key) ? values.get(key) : null;
-    },
-    async set(key, value) {
-      values.set(key, value);
-    },
-    async delete(key) {
-      values.delete(key);
-    },
-    async list(prefix) {
-      const keys = [...values.keys()].filter((k) => !prefix || k.startsWith(prefix));
-      return { keys };
-    }
-  };
-  return { state, values };
-}
-function absent(name, what) {
-  throw new Error(
-    `context.${name} is not available locally. ${what} Pass a stub to simulate({ ${name}: \u2026 }) to test the code around it, or run the step on a canvas to exercise the real thing.`
-  );
-}
-async function simulate(plugin, options = {}) {
-  const startTime = Date.now();
-  const execute = typeof plugin === "function" ? plugin : plugin?.execute;
-  const { storage, files } = createLocalStorage(options.storage);
-  const { state, values } = createLocalState(options.state);
-  if (typeof execute !== "function") {
-    return {
-      status: "error",
-      output: null,
-      error: "This module exports no execute function. A plugin is `export default { execute }`, `module.exports.execute = \u2026`, or a default export that is the function itself.",
-      durationMs: Date.now() - startTime,
-      files,
-      state: values
-    };
-  }
-  const context = {
-    workflowId: options.workflowId ?? "local-workflow",
-    nodeId: options.nodeId ?? "local-node",
-    userId: options.userId ?? "local-user",
-    executionId: options.executionId ?? `local-${Date.now()}`,
-    startedAt: new Date(startTime).toISOString(),
-    secrets: options.secrets ?? {},
-    storage,
-    state,
-    connections: options.connections ?? {
-      get: async () => absent("connections", "It reaches an account somebody connected on the platform.")
-    },
-    media: options.media ?? {
-      run: async () => absent("media", "It runs ffmpeg in a container of its own.")
-    }
-  };
-  const timeoutMs = options.timeoutMs ?? 3e4;
-  let timer;
-  const timeout = new Promise((_, reject) => {
-    timer = setTimeout(
-      () => reject(new Error(`Plugin execution timed out after ${timeoutMs}ms`)),
-      timeoutMs
-    );
-  });
-  try {
-    const raw = await Promise.race([
-      Promise.resolve(execute(options.input ?? {}, options.config ?? {}, context)),
-      timeout
-    ]);
-    const durationMs = Date.now() - startTime;
-    if (!raw || typeof raw !== "object") {
-      return {
-        status: "error",
-        output: null,
-        error: `A plugin must return an object like { output: "success", data: {} }. This one returned ${raw === void 0 ? "undefined" : JSON.stringify(raw)}.`,
-        durationMs,
-        files,
-        state: values
-      };
-    }
-    const output = raw;
-    if (typeof output.output !== "string") {
-      return {
-        status: "error",
-        output: null,
-        error: 'The returned object has no `output`. That field names which port the run leaves by \u2014 usually "success" or "error" \u2014 and it has to be one of the `outputs` in your manifest.',
-        durationMs,
-        files,
-        state: values
-      };
-    }
-    return {
-      status: "success",
-      output: { ...output, data: output.data ?? {} },
-      durationMs,
-      outputPort: output.output,
-      logs: output.metadata?.logs,
-      files,
-      state: values
-    };
-  } catch (error) {
-    const durationMs = Date.now() - startTime;
-    const message = error instanceof Error ? error.message : String(error);
-    return {
-      status: message.includes("timed out") ? "timeout" : "error",
-      output: null,
-      error: message,
-      durationMs,
-      files,
-      state: values
-    };
-  } finally {
-    if (timer) clearTimeout(timer);
-  }
-}
-
 // src/platform-rules.ts
 var ALLOWED_PACKAGES = [
   {
     "name": "nodemailer",
-    "version": "^6.10.0"
+    "version": "^10.0.16"
   },
   {
     "name": "lodash",
@@ -412,7 +218,7 @@ var ALLOWED_PACKAGES = [
   },
   {
     "name": "uuid",
-    "version": "^11.0.5"
+    "version": "^11.1.1"
   },
   {
     "name": "nanoid",
@@ -700,7 +506,7 @@ var ALLOWED_PACKAGES = [
   },
   {
     "name": "fast-xml-parser",
-    "version": "^4.5.1"
+    "version": "^5.11.2"
   },
   {
     "name": "xml2js",
@@ -872,7 +678,7 @@ var ALLOWED_PACKAGES = [
   },
   {
     "name": "diff",
-    "version": "^7.0.0"
+    "version": "^8.0.4"
   },
   {
     "name": "diff-match-patch",
@@ -1295,6 +1101,11 @@ var ALLOWED_PACKAGES = [
     "version": "^2.1.8"
   }
 ];
+var SANDBOX_OVERRIDES = {
+  "exceljs": {
+    "uuid": "^11.1.1"
+  }
+};
 var RESTRICTED_PATTERNS = [
   /\bprocess\s*\.\s*exit/,
   /\bprocess\s*\.\s*env/,
@@ -1330,10 +1141,392 @@ var RESTRICTED_PATTERNS = [
   /\bError\s*\.\s*captureStackTrace\b/,
   /\bWebAssembly\b/
 ];
+var MAX_CODE_LENGTH = 1e5;
+var PLATFORM_NODE_MAJOR = 24;
+var PROVIDED_GLOBALS = [
+  "fetch",
+  "Request",
+  "Response",
+  "Headers",
+  "URL",
+  "URLSearchParams",
+  "btoa",
+  "atob",
+  "console",
+  "setTimeout",
+  "clearTimeout",
+  "setInterval",
+  "clearInterval",
+  "crypto",
+  "TextEncoder",
+  "TextDecoder",
+  "ArrayBuffer",
+  "Uint8Array",
+  "Uint16Array",
+  "Uint32Array",
+  "Int8Array",
+  "Int16Array",
+  "Int32Array",
+  "Float32Array",
+  "Float64Array",
+  "DataView",
+  "Blob",
+  "FormData",
+  "AbortController",
+  "AbortSignal",
+  "require"
+];
+var BLOCKED_GLOBAL_NAMES = [
+  "process",
+  "global",
+  "module",
+  "exports",
+  "__dirname",
+  "__filename",
+  "eval",
+  "Function",
+  "child_process",
+  "fs",
+  "os",
+  "cluster",
+  "dgram",
+  "dns",
+  "net",
+  "http",
+  "https",
+  "path",
+  "readline",
+  "stream",
+  "tls",
+  "zlib",
+  "buffer",
+  "Buffer",
+  "globalThis",
+  "self",
+  "window",
+  "SharedArrayBuffer",
+  "Atomics",
+  "WeakRef",
+  "FinalizationRegistry",
+  "AsyncFunction",
+  "GeneratorFunction",
+  "AsyncGeneratorFunction",
+  "WebAssembly"
+];
+var SANDBOX_TIERS = [
+  {
+    "id": "standard",
+    "label": "Standard",
+    "vcpus": 0.5,
+    "memoryGb": 4
+  },
+  {
+    "id": "boosted",
+    "label": "Boosted",
+    "vcpus": 1,
+    "memoryGb": 6
+  },
+  {
+    "id": "high",
+    "label": "High",
+    "vcpus": 2,
+    "memoryGb": 8
+  }
+];
+var RETIRED_TIERS = {
+  "max": "high"
+};
+var STATE_LIMITS = {
+  /** One value, once encoded as JSON. */
+  maxValueBytes: 128 * 1024,
+  /** The shortest `ttlSeconds` the store accepts. */
+  minTtlSeconds: 60
+};
+var SIGNED_URL_SECONDS = { default: 900, min: 60, max: 3600 };
+var PUSH_CHECK = {
+  /** When manifest.json names no `timeoutMs`. The test file's is not read. */
+  defaultTimeoutMs: 3e4,
+  /** The longest `timeoutMs` a manifest is given. */
+  maxTimeoutMs: 6e4,
+  /** The port a run must leave by when the test file names none. */
+  defaultExpectOutput: "success",
+  /** A declared step (an `action` block) is tested in the portal's editor, not on a push. */
+  declaredStepsTestedOnPush: false
+};
+
+// src/runtime.ts
+import vm from "node:vm";
+function pluginConsole(target = console) {
+  const forward = (level) => (...args) => {
+    const write = target[level] ?? target.log ?? console.log;
+    write.apply(target, args);
+  };
+  return { log: forward("log"), error: forward("error"), warn: forward("warn"), info: forward("info") };
+}
+function sandboxGlobals(options = {}) {
+  const host = globalThis;
+  const globals = {};
+  for (const name of PROVIDED_GLOBALS) {
+    if (name === "require") continue;
+    if (name === "console") globals.console = pluginConsole(options.console);
+    else if (name === "fetch") globals.fetch = options.fetch ?? host.fetch;
+    else globals[name] = host[name];
+  }
+  for (const name of BLOCKED_GLOBAL_NAMES) globals[name] = void 0;
+  return globals;
+}
+function loadPluginCode(code, require2, options = {}) {
+  const sandbox = sandboxGlobals(options);
+  Object.defineProperty(sandbox, "constructor", { value: void 0, writable: false, configurable: false });
+  const wrapped = '(function(module, exports, context, require) { "use strict"; var console = context.console; ' + code + " })";
+  const script = new vm.Script(wrapped, { filename: "plugin.js" });
+  const context = vm.createContext(sandbox, { name: "plugin-sandbox" });
+  const fn = script.runInContext(context, { timeout: options.timeoutMs ?? 1e4 });
+  const moduleObject = { exports: {} };
+  fn(moduleObject, moduleObject.exports, { ...sandbox }, require2);
+  return moduleObject.exports;
+}
+function executeOf(exported) {
+  if (typeof exported === "function") return exported;
+  const object = exported;
+  if (object && typeof object.execute === "function") return object.execute;
+  if (object && typeof object.default === "function") return object.default;
+  return null;
+}
+
+// src/simulate.ts
+function toBytes(data) {
+  return typeof data === "string" ? new TextEncoder().encode(data) : data;
+}
+function createLocalStorage(seed = {}) {
+  const files = /* @__PURE__ */ new Map();
+  for (const [path, data] of Object.entries(seed)) {
+    files.set(path, {
+      bytes: toBytes(data),
+      contentType: "application/octet-stream",
+      uploadedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  }
+  const result = (path, file) => ({
+    url: `memory://${path}`,
+    size: file.bytes.length,
+    contentType: file.contentType,
+    uploadedAt: file.uploadedAt,
+    // The real one expires; this one does not, and says so rather than
+    // inventing a date a test might come to rely on.
+    expiresAt: "never (local simulation)"
+  });
+  const storage = {
+    async put(path, data, contentType = "application/octet-stream") {
+      const file = {
+        bytes: toBytes(data),
+        contentType,
+        uploadedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      files.set(path, file);
+      return result(path, file);
+    },
+    async get(path) {
+      return files.get(path)?.bytes ?? null;
+    },
+    async delete(path) {
+      files.delete(path);
+    },
+    async list(prefix) {
+      const listed = [];
+      let totalSize = 0;
+      for (const [path, file] of files) {
+        if (prefix && !path.startsWith(prefix)) continue;
+        listed.push({
+          url: `memory://${path}`,
+          pathname: path,
+          size: file.bytes.length,
+          uploadedAt: file.uploadedAt
+        });
+        totalSize += file.bytes.length;
+      }
+      return { files: listed, totalSize };
+    },
+    async head(path) {
+      const file = files.get(path);
+      return file ? { size: file.bytes.length, contentType: file.contentType } : null;
+    },
+    async signedUrl(path, seconds) {
+      const valid = Math.min(Math.max(Number(seconds) || SIGNED_URL_SECONDS.default, SIGNED_URL_SECONDS.min), SIGNED_URL_SECONDS.max);
+      return files.has(path) ? `memory://${path}?expires=${valid}` : null;
+    },
+    async shareUrl(path, seconds) {
+      const valid = Number(seconds) || SIGNED_URL_SECONDS.default;
+      return files.has(path) ? `memory://share/${path}?expires=${valid}` : null;
+    },
+    /**
+     * Really fetches, because that is the only way to find out whether the
+     * URL a plugin builds is the URL it meant. The bytes land in the same
+     * in-memory store the rest of these read from.
+     */
+    async download(url, path, contentType) {
+      const res = await fetch(url);
+      if (!res.ok) throw new Error(`Downloading ${url} failed with status ${res.status}`);
+      const file = {
+        bytes: new Uint8Array(await res.arrayBuffer()),
+        contentType: contentType ?? res.headers.get("content-type") ?? "application/octet-stream",
+        uploadedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      files.set(path, file);
+      return result(path, file);
+    }
+  };
+  return { storage, files };
+}
+function createLocalState(seed = {}) {
+  const values = new Map(Object.entries(seed));
+  const expiries = /* @__PURE__ */ new Map();
+  const expired = (key) => {
+    const at = expiries.get(key);
+    if (at === void 0 || at > Date.now()) return false;
+    values.delete(key);
+    expiries.delete(key);
+    return true;
+  };
+  const state = {
+    async get(key) {
+      if (expired(key)) return null;
+      return values.has(key) ? values.get(key) : null;
+    },
+    async set(key, value, options) {
+      const encoded = JSON.stringify(value);
+      if (encoded === void 0) throw new Error(`state.set("${key}"): the value must be JSON-serialisable.`);
+      const bytes = new TextEncoder().encode(encoded).length;
+      if (bytes > STATE_LIMITS.maxValueBytes) {
+        throw new Error(
+          `state.set("${key}"): the value is ${Math.ceil(bytes / 1024)} KB once encoded, and a value may be at most ${STATE_LIMITS.maxValueBytes / 1024} KB. Put large data in storage and keep its path here.`
+        );
+      }
+      const ttl = options?.ttlSeconds;
+      if (ttl !== void 0 && (typeof ttl !== "number" || ttl < STATE_LIMITS.minTtlSeconds)) {
+        throw new Error(`state.set("${key}"): ttlSeconds must be at least ${STATE_LIMITS.minTtlSeconds}.`);
+      }
+      values.set(key, JSON.parse(encoded));
+      if (ttl !== void 0) expiries.set(key, Date.now() + ttl * 1e3);
+      else expiries.delete(key);
+    },
+    async delete(key) {
+      values.delete(key);
+      expiries.delete(key);
+    },
+    async list(prefix) {
+      const keys = [...values.keys()].filter((key) => !expired(key) && (!prefix || key.startsWith(prefix))).map((key) => {
+        const at = expiries.get(key);
+        return { key, expiresAt: at === void 0 ? null : new Date(at).toISOString() };
+      });
+      return { keys, complete: true };
+    }
+  };
+  return { state, values };
+}
+function absent(name, what) {
+  throw new Error(
+    `context.${name} is not available locally. ${what} Pass a stub to simulate({ ${name}: \u2026 }) to test the code around it, or run the step on a canvas to exercise the real thing.`
+  );
+}
+async function simulate(plugin, options = {}) {
+  const startTime = Date.now();
+  const execute = executeOf(plugin);
+  const { storage, files } = createLocalStorage(options.storage);
+  const { state, values } = createLocalState(options.state);
+  if (typeof execute !== "function") {
+    return {
+      status: "error",
+      output: null,
+      error: "Plugin must export an execute function: `module.exports = { execute }`, `module.exports.execute = \u2026`, or a function as `module.exports` or `module.exports.default`.",
+      durationMs: Date.now() - startTime,
+      files,
+      state: values
+    };
+  }
+  const context = {
+    workflowId: options.workflowId ?? "local-workflow",
+    nodeId: options.nodeId ?? "local-node",
+    userId: options.userId ?? "local-user",
+    executionId: options.executionId ?? `local-${Date.now()}`,
+    startedAt: new Date(startTime).toISOString(),
+    secrets: options.secrets ?? {},
+    storage,
+    state,
+    // Absent unless a stub is given, as on the platform when no account was
+    // chosen for the step: the push check runs a step with only the accounts
+    // its test file names, and none can be named here.
+    connections: options.connections,
+    media: options.media ?? {
+      run: async () => absent("media", "It runs ffmpeg in a container of its own.")
+    }
+  };
+  const timeoutMs = options.timeoutMs ?? PUSH_CHECK.defaultTimeoutMs;
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(
+      () => reject(new Error(`Plugin execution timed out after ${timeoutMs}ms`)),
+      timeoutMs
+    );
+  });
+  try {
+    const raw = await Promise.race([
+      Promise.resolve(execute(options.input ?? {}, options.config ?? {}, context)),
+      timeout
+    ]);
+    const durationMs = Date.now() - startTime;
+    if (!raw || typeof raw !== "object") {
+      return {
+        status: "error",
+        output: null,
+        error: `A plugin must return an object like { output: "success", data: {} }. This one returned ${raw === void 0 ? "undefined" : JSON.stringify(raw)}.`,
+        durationMs,
+        files,
+        state: values
+      };
+    }
+    const output = raw;
+    if (typeof output.output !== "string") {
+      return {
+        status: "error",
+        output: null,
+        error: 'The returned object has no `output`. That field names which port the run leaves by \u2014 usually "success" or "error" \u2014 and it has to be one of the `outputs` in your manifest.',
+        durationMs,
+        files,
+        state: values
+      };
+    }
+    return {
+      status: "success",
+      output: { ...output, data: output.data ?? {} },
+      durationMs,
+      outputPort: output.output,
+      logs: output.metadata?.logs,
+      files,
+      state: values
+    };
+  } catch (error) {
+    const durationMs = Date.now() - startTime;
+    const message = error && typeof error === "object" && typeof error.message === "string" ? error.message : String(error);
+    return {
+      status: message.includes("timed out") ? "timeout" : "error",
+      output: null,
+      error: message,
+      durationMs,
+      files,
+      state: values
+    };
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
 
 // src/validate.ts
 var ALLOWED_PACKAGE_NAMES = new Set(ALLOWED_PACKAGES.map((p) => p.name));
 function validatePluginCode(code) {
+  if (code.length > MAX_CODE_LENGTH) {
+    return { valid: false, error: `Plugin code exceeds maximum length of ${Math.round(MAX_CODE_LENGTH / 1e3)}KB.` };
+  }
   const hasExecute = code.includes("module.exports") || code.includes("exports.execute") || code.includes("export");
   if (!hasExecute) {
     return {
@@ -1383,11 +1576,248 @@ function sandboxRequire(load) {
     }
   };
 }
-function loadPluginCode(code, require2) {
-  const module = { exports: {} };
-  const body = new Function("module", "exports", "require", `"use strict"; ${code}`);
-  body(module, module.exports, require2);
-  return module.exports;
+
+// src/manifest-check.ts
+var KNOWN_BLOCKS = /* @__PURE__ */ new Set([
+  "properties",
+  "inputs",
+  "outputs",
+  "outputFields",
+  "auth",
+  "trigger",
+  "action",
+  "timeoutMs",
+  "memoryLimitMb",
+  "icon",
+  "color",
+  "description",
+  "version"
+]);
+var PROPERTY_TYPES = /* @__PURE__ */ new Set([
+  "string",
+  "number",
+  "boolean",
+  "select",
+  "multiselect",
+  "json",
+  "code",
+  "color",
+  "date",
+  "connection",
+  "file",
+  "path",
+  "paths",
+  "secret"
+]);
+var AUTH_TYPES = /* @__PURE__ */ new Set(["oauth2", "api_key", "basic", "none"]);
+var HOST_KEYS = ["url", "baseUrl", "base_url", "host"];
+var METHODS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "PATCH", "DELETE"]);
+var BODY_TYPES = /* @__PURE__ */ new Set(["json", "form", "multipart"]);
+var PAGINATE_FROM = /* @__PURE__ */ new Set(["response", "item", "page", "offset"]);
+var MAX_ITEM_LIMIT = 1e3;
+var MAX_PAGES = 50;
+var MAX_MEMORY_MB = 128;
+var isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isRelativePath = (path) => typeof path === "string" && path.trim() !== "" && !/^[a-z][a-z0-9+.-]*:/i.test(path) && !path.startsWith("//");
+var ACCOUNTS_ARE_OURS = `Only VisualAutomate's own apps act as a connected account: call the API at its own address instead (action.baseUrl, or fetch in code), with a key the user enters in a property of type "secret"`;
+function accountUseIn(manifest) {
+  if (!isObject(manifest)) return [];
+  const m = manifest;
+  const uses = [];
+  if (isObject(m.properties)) {
+    for (const [key, value] of Object.entries(m.properties)) {
+      if (!isObject(value)) continue;
+      if (value.type === "connection") uses.push(`properties.${key} is a connection: an account to act as`);
+      if (value.optionsFrom !== void 0) uses.push(`properties.${key}.optionsFrom reads its options as an account`);
+    }
+  }
+  if (isObject(m.action) && m.action.connection !== void 0) uses.push("action.connection makes the call as an account");
+  if (m.trigger !== void 0) uses.push("trigger watches an account");
+  if (isObject(m.auth) && typeof m.auth.provider === "string" && m.auth.provider) uses.push(`auth.provider names "${m.auth.provider}"`);
+  return uses;
+}
+function checkManifest(raw, hasCode) {
+  const errors = [];
+  const warnings = [];
+  if (!isObject(raw)) {
+    return { ok: false, kind: hasCode ? "code" : "declared", errors: ["manifest.json must be a JSON object."], warnings };
+  }
+  const m = raw;
+  const kind = isObject(m.trigger) ? "trigger" : isObject(m.action) ? isObject(m.action.request) ? "declared" : "outputs-only" : "code";
+  for (const key of Object.keys(m)) {
+    if (!KNOWN_BLOCKS.has(key)) warnings.push(`"${key}" is not something a manifest can declare, and is dropped when the step is saved.`);
+  }
+  const properties = isObject(m.properties) ? m.properties : {};
+  if (m.properties !== void 0 && !isObject(m.properties)) errors.push("properties must be an object of fields.");
+  const typeOf = (name) => typeof name === "string" && isObject(properties[name]) ? properties[name].type : void 0;
+  for (const [key, value] of Object.entries(properties)) {
+    if (!isObject(value)) {
+      errors.push(`properties.${key} must be an object with at least a label and a type.`);
+      continue;
+    }
+    if (typeof value.type !== "string" || !PROPERTY_TYPES.has(value.type)) {
+      warnings.push(`properties.${key} has type ${JSON.stringify(value.type)}, which the platform does not know; it becomes a plain text field.`);
+    }
+    if (typeof value.label !== "string" || !value.label.trim()) {
+      warnings.push(`properties.${key} has no label; the canvas shows "${key}" instead.`);
+    }
+    if ((value.type === "select" || value.type === "multiselect") && value.options === void 0 && value.optionsFrom === void 0) {
+      warnings.push(`properties.${key} is a ${value.type} with no options and no optionsFrom; there is nothing to choose.`);
+    }
+    if (value.options !== void 0) {
+      const options = Array.isArray(value.options) ? value.options : null;
+      if (!options || options.some((o) => !isObject(o) || typeof o.label !== "string" || typeof o.value !== "string")) {
+        errors.push(`properties.${key}.options must be a list of { "label": "\u2026", "value": "\u2026" }, both text.`);
+      }
+    }
+    if (value.optionsFrom !== void 0) checkOptionsFrom(key, value, typeOf, errors);
+  }
+  if (m.auth !== void 0) {
+    if (!isObject(m.auth)) errors.push("auth must be an object.");
+    else {
+      if (typeof m.auth.type !== "string" || !AUTH_TYPES.has(m.auth.type)) {
+        errors.push(`auth.type must be one of ${[...AUTH_TYPES].join(", ")}.`);
+      } else if (m.auth.type !== "none" && !m.auth.provider) {
+        errors.push(`auth.type "${m.auth.type}" needs a provider to sign in to, and only VisualAutomate's own apps name one: use { "type": "none" } and take the user's key in a property of type "secret".`);
+      }
+      for (const key of HOST_KEYS) {
+        if (key in m.auth) errors.push(`auth.${key} is refused: a manifest may not name a host. The provider's base URL belongs to the platform.`);
+      }
+    }
+  }
+  for (const ports of ["inputs", "outputs"]) {
+    if (m[ports] !== void 0 && (!Array.isArray(m[ports]) || m[ports].some((p) => typeof p !== "string"))) {
+      errors.push(`${ports} must be a list of port names.`);
+    }
+  }
+  if (Array.isArray(m.outputs) && m.outputs.length === 0 && kind !== "trigger") {
+    warnings.push("outputs is empty: no line can be drawn from this step.");
+  }
+  if (m.timeoutMs !== void 0) {
+    if (typeof m.timeoutMs !== "number" || m.timeoutMs <= 0) errors.push("timeoutMs must be a number of milliseconds.");
+    else if (m.timeoutMs > PUSH_CHECK.maxTimeoutMs) warnings.push(`timeoutMs ${m.timeoutMs} is cut to ${PUSH_CHECK.maxTimeoutMs}, the most a step is given.`);
+  }
+  if (typeof m.memoryLimitMb === "number" && m.memoryLimitMb > MAX_MEMORY_MB) {
+    warnings.push(`memoryLimitMb ${m.memoryLimitMb} is cut to ${MAX_MEMORY_MB}.`);
+  }
+  if (m.action !== void 0) {
+    if (!isObject(m.action)) errors.push("action must be an object.");
+    else checkAction(m.action, properties, typeOf, errors, warnings);
+    if (hasCode) errors.push("This step has both an action block and code. A step is one or the other: remove index.js, or the action block.");
+  }
+  if (m.trigger !== void 0) {
+    if (!isObject(m.trigger)) errors.push("trigger must be an object.");
+    else checkTrigger(m.trigger, typeOf, errors, warnings);
+  }
+  if (kind === "code" && !hasCode) {
+    errors.push("There is no index.js and no action or trigger block, so this step has nothing to run.");
+  }
+  for (const use of accountUseIn(m)) errors.push(`${use}. ${ACCOUNTS_ARE_OURS}`);
+  return { ok: errors.length === 0, kind, errors, warnings };
+}
+function checkConnectionName(where, name, typeOf, errors) {
+  if (typeof name !== "string" || !name) {
+    errors.push(`${where} must name one of this step's properties of type "connection".`);
+  } else if (typeOf(name) === void 0) {
+    errors.push(`${where} names "${name}", which is not one of this step's properties.`);
+  } else if (typeOf(name) !== "connection") {
+    errors.push(`${where} names "${name}", which is a ${String(typeOf(name))} property rather than a connection.`);
+  }
+}
+function checkAction(a, properties, typeOf, errors, warnings) {
+  const request = a.request;
+  if (request !== void 0) {
+    if (!isObject(request)) {
+      errors.push("action.request must be an object.");
+      return;
+    }
+    const viaConnection = a.connection !== void 0;
+    const viaBaseUrl = a.baseUrl !== void 0;
+    if (viaConnection && viaBaseUrl) errors.push("action has both connection and baseUrl: a request goes as an account or to a named host, never both.");
+    if (!viaConnection && !viaBaseUrl) errors.push("action.request needs either connection (an account to act as) or baseUrl (the https:// host to call).");
+    if (viaConnection) checkConnectionName("action.connection", a.connection, typeOf, errors);
+    if (viaBaseUrl) {
+      if (typeof a.baseUrl !== "string" || !/^https:\/\//i.test(a.baseUrl)) errors.push("action.baseUrl must start with https://.");
+      else if (/\{\{\s*input\./.test(a.baseUrl)) errors.push("action.baseUrl may read the step's fields ({{config.\u2026}}) but never {{input.\u2026}}: what an earlier step hands on must not decide where a key is sent.");
+    }
+    const method = String(request.method ?? "GET").toUpperCase();
+    if (!METHODS.has(method)) errors.push(`action.request.method must be one of ${[...METHODS].join(", ")}.`);
+    if (!isRelativePath(request.path)) errors.push("action.request.path must be a path relative to the base URL, never a full URL.");
+    if (request.bodyType !== void 0 && !BODY_TYPES.has(String(request.bodyType))) {
+      errors.push(`action.request.bodyType must be one of ${[...BODY_TYPES].join(", ")}.`);
+    }
+    if (request.body !== void 0 && method === "GET") warnings.push("action.request has a body on a GET; most APIs ignore it.");
+    if (viaConnection && isObject(request.headers)) {
+      for (const header of Object.keys(request.headers)) {
+        if (header.toLowerCase() === "authorization") warnings.push("action.request sets Authorization while acting as an account; the platform adds the account's credential itself.");
+      }
+    }
+  }
+  if (a.outputs !== void 0 && !isObject(a.outputs)) errors.push("action.outputs must be an object of name to value.");
+  if (a.outputs === void 0) warnings.push("action has no outputs: the step hands nothing on.");
+  for (const key of ["errorPath", "okPath", "okValue"]) {
+    if (a[key] !== void 0 && typeof a[key] !== "string") errors.push(`action.${key} must be text.`);
+  }
+  if (a.items !== void 0) {
+    if (!isObject(a.items) || typeof a.items.path !== "string") errors.push('action.items must be { "path": "\u2026" }, with "" when the answer is the list itself.');
+    else if (a.items.limit !== void 0 && (typeof a.items.limit !== "number" || a.items.limit < 1 || a.items.limit > MAX_ITEM_LIMIT)) {
+      errors.push(`action.items.limit must be a number from 1 to ${MAX_ITEM_LIMIT}.`);
+    }
+  }
+  if (a.paginate !== void 0) {
+    if (!isObject(a.paginate) || !PAGINATE_FROM.has(String(a.paginate.from))) {
+      errors.push(`action.paginate.from must be one of ${[...PAGINATE_FROM].join(", ")}.`);
+    } else if (a.paginate.maxPages !== void 0 && (typeof a.paginate.maxPages !== "number" || a.paginate.maxPages > MAX_PAGES)) {
+      errors.push(`action.paginate.maxPages must be at most ${MAX_PAGES}.`);
+    }
+    if (a.items === void 0) errors.push("action.paginate needs action.items: pages are pages of a list.");
+  }
+  const text = JSON.stringify({ baseUrl: a.baseUrl, request: a.request, outputs: a.outputs });
+  for (const [, key] of text.matchAll(/\{\{\s*config\.([A-Za-z0-9_$]+)/g)) {
+    if (!(key in properties)) warnings.push(`{{config.${key}}} names no property; it is always empty.`);
+  }
+}
+function checkTrigger(t, typeOf, errors, warnings) {
+  checkConnectionName("trigger.connection", t.connection, typeOf, errors);
+  if (!isObject(t.request) || !isRelativePath(t.request.path)) errors.push("trigger.request.path must be a path relative to the provider.");
+  else if (t.request.method !== void 0 && !["GET", "POST"].includes(String(t.request.method).toUpperCase())) {
+    errors.push("trigger.request.method must be GET or POST.");
+  }
+  if (typeof t.items !== "string") errors.push('trigger.items must be the dotted path to the list in the answer ("" when the answer is the list).');
+  if (typeof t.id !== "string" || !t.id) errors.push("trigger.id must be the dotted path, within an item, to what makes it unique.");
+  if (t.poll !== void 0 && typeof t.poll !== "number" && (typeof t.poll !== "string" || typeOf(t.poll) === void 0)) {
+    errors.push("trigger.poll must be a number of minutes, or the name of a property that holds one.");
+  }
+  if (t.cursor !== void 0) {
+    if (!isObject(t.cursor) || !["response", "item"].includes(String(t.cursor.from)) || typeof t.cursor.path !== "string") {
+      errors.push('trigger.cursor must be { "from": "response" | "item", "path": "\u2026" }.');
+    } else if (t.cursor.initial !== "now") {
+      warnings.push(`trigger.cursor has no "initial": "now": switching the trigger on starts a run, at the user's cost, for every item already there.`);
+    }
+  }
+  if (t.hydrate !== void 0 && (!isObject(t.hydrate) || !isRelativePath(t.hydrate.path))) {
+    errors.push("trigger.hydrate.path must be a path relative to the provider.");
+  }
+  if (t.maxPerPoll !== void 0 && (typeof t.maxPerPoll !== "number" || t.maxPerPoll < 1)) errors.push("trigger.maxPerPoll must be a positive number.");
+}
+function checkOptionsFrom(key, property, typeOf, errors) {
+  const where = `properties.${key}.optionsFrom`;
+  if (property.type !== "select" && property.type !== "multiselect") {
+    errors.push(`${where} only means something on a select or multiselect, and ${key} is a ${String(property.type)}.`);
+  }
+  const o = property.optionsFrom;
+  if (!isObject(o)) {
+    errors.push(`${where} must be an object.`);
+    return;
+  }
+  checkConnectionName(`${where}.connection`, o.connection, typeOf, errors);
+  if (typeof o.label !== "string" || !o.label.trim()) errors.push(`${where}.label must say what each option shows, e.g. {{item.name}}.`);
+  if (typeof o.value !== "string" || !o.value.trim()) errors.push(`${where}.value must say what choosing it stores, e.g. {{item.id}}.`);
+  if (!isObject(o.request) || !isRelativePath(o.request.path)) errors.push(`${where}.request.path must be a path relative to the provider.`);
+  else {
+    if (o.request.method !== void 0 && String(o.request.method).toUpperCase() !== "GET") errors.push(`${where}.request must be a GET: options are read whenever somebody opens the step.`);
+    if (o.request.body !== void 0) errors.push(`${where}.request cannot have a body: it is a GET.`);
+  }
 }
 
 // src/context-api.ts
@@ -1496,14 +1926,30 @@ var BLOCKED_GLOBALS = [
   { name: "__dirname", instead: "There is no meaningful filesystem." }
 ];
 export {
+  ACCOUNTS_ARE_OURS,
   ALLOWED_PACKAGES,
   ALLOWED_PACKAGE_NAMES,
   BLOCKED_GLOBALS,
+  BLOCKED_GLOBAL_NAMES,
   CONTEXT_API,
+  MAX_CODE_LENGTH,
+  PLATFORM_NODE_MAJOR,
+  PROVIDED_GLOBALS,
+  PUSH_CHECK,
   RESTRICTED_PATTERNS,
+  RETIRED_TIERS,
+  SANDBOX_OVERRIDES,
+  SANDBOX_TIERS,
+  SIGNED_URL_SECONDS,
+  STATE_LIMITS,
+  accountUseIn,
+  checkManifest,
   createLocalState,
   createLocalStorage,
+  executeOf,
   loadPluginCode,
+  pluginConsole,
+  sandboxGlobals,
   sandboxRequire,
   simulate,
   validatePluginCode