@visualautomate/plugin-sdk 0.7.0 → 0.8.0

package/dist/index.d.ts

@@ -15,5 +15,5 @@ export * from "./simulate";
 export * from "./validate";
 export * from "./runtime";
 export { BLOCKED_GLOBAL_NAMES, MAX_CODE_LENGTH, PLATFORM_NODE_MAJOR, PROVIDED_GLOBALS, PUSH_CHECK, RETIRED_TIERS, SANDBOX_OVERRIDES, SANDBOX_TIERS, SIGNED_URL_SECONDS, STATE_LIMITS, } from "./platform-rules";
-export { checkManifest, type ManifestCheck, type StepKind } from "./manifest-check";
+export { ACCOUNTS_ARE_OURS, accountUseIn, checkManifest, type ManifestCheck, type StepKind } from "./manifest-check";
 export { CONTEXT_API, BLOCKED_GLOBALS, type ContextApiEntry } from "./context-api";

package/dist/index.mjs

@@ -1619,6 +1619,23 @@ var MAX_PAGES = 50;
 var MAX_MEMORY_MB = 128;
 var isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var isRelativePath = (path) => typeof path === "string" && path.trim() !== "" && !/^[a-z][a-z0-9+.-]*:/i.test(path) && !path.startsWith("//");
+var ACCOUNTS_ARE_OURS = `Only VisualAutomate's own apps act as a connected account: call the API at its own address instead (action.baseUrl, or fetch in code), with a key the user enters in a property of type "secret"`;
+function accountUseIn(manifest) {
+  if (!isObject(manifest)) return [];
+  const m = manifest;
+  const uses = [];
+  if (isObject(m.properties)) {
+    for (const [key, value] of Object.entries(m.properties)) {
+      if (!isObject(value)) continue;
+      if (value.type === "connection") uses.push(`properties.${key} is a connection: an account to act as`);
+      if (value.optionsFrom !== void 0) uses.push(`properties.${key}.optionsFrom reads its options as an account`);
+    }
+  }
+  if (isObject(m.action) && m.action.connection !== void 0) uses.push("action.connection makes the call as an account");
+  if (m.trigger !== void 0) uses.push("trigger watches an account");
+  if (isObject(m.auth) && typeof m.auth.provider === "string" && m.auth.provider) uses.push(`auth.provider names "${m.auth.provider}"`);
+  return uses;
+}
 function checkManifest(raw, hasCode) {
   const errors = [];
   const warnings = [];
@@ -1660,6 +1677,8 @@ function checkManifest(raw, hasCode) {
     else {
       if (typeof m.auth.type !== "string" || !AUTH_TYPES.has(m.auth.type)) {
         errors.push(`auth.type must be one of ${[...AUTH_TYPES].join(", ")}.`);
+      } else if (m.auth.type !== "none" && !m.auth.provider) {
+        errors.push(`auth.type "${m.auth.type}" needs a provider to sign in to, and only VisualAutomate's own apps name one: use { "type": "none" } and take the user's key in a property of type "secret".`);
       }
       for (const key of HOST_KEYS) {
         if (key in m.auth) errors.push(`auth.${key} is refused: a manifest may not name a host. The provider's base URL belongs to the platform.`);
@@ -1693,6 +1712,7 @@ function checkManifest(raw, hasCode) {
   if (kind === "code" && !hasCode) {
     errors.push("There is no index.js and no action or trigger block, so this step has nothing to run.");
   }
+  for (const use of accountUseIn(m)) errors.push(`${use}. ${ACCOUNTS_ARE_OURS}`);
   return { ok: errors.length === 0, kind, errors, warnings };
 }
 function checkConnectionName(where, name, typeOf, errors) {
@@ -1906,6 +1926,7 @@ var BLOCKED_GLOBALS = [
   { name: "__dirname", instead: "There is no meaningful filesystem." }
 ];
 export {
+  ACCOUNTS_ARE_OURS,
   ALLOWED_PACKAGES,
   ALLOWED_PACKAGE_NAMES,
   BLOCKED_GLOBALS,
@@ -1921,6 +1942,7 @@ export {
   SANDBOX_TIERS,
   SIGNED_URL_SECONDS,
   STATE_LIMITS,
+  accountUseIn,
   checkManifest,
   createLocalState,
   createLocalStorage,