@zveltio/sdk 3.0.0-beta.77 → 3.0.0-beta.79

package/dist/validate/index.js

@@ -25,6 +25,8 @@
  */
 import { parseMigrationSql } from './migration-parse.js';
 export { SHARED_MESSAGE_KEYS } from './shared-message-keys.js';
+/** Headers the engine keeps from a worker-isolated extension unless `forwardCredentials` names them. */
+const CREDENTIAL_HEADERS = ['authorization', 'cookie', 'proxy-authorization', 'x-api-key'];
 // ─── Helpers ───────────────────────────────────────────────────────────────
 const SEMVER_RE = /^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/;
 const KNOWN_CATEGORIES = new Set([
@@ -93,6 +95,34 @@ export function validateManifest(input) {
     if (typeof obj.zveltioMaxVersion === 'string' && !SEMVER_RE.test(obj.zveltioMaxVersion)) {
         out.push(err('MANIFEST_BAD_MAX_VERSION', `zveltioMaxVersion "${obj.zveltioMaxVersion}" is not valid semver`));
     }
+    // Required and optional extension dependencies share one shape; the broker
+    // lets an extension call services only of the extensions named in either.
+    const depNames = new Map();
+    for (const field of ['dependencies', 'optionalDependencies']) {
+        const list = obj[field];
+        if (list === undefined)
+            continue;
+        if (!Array.isArray(list)) {
+            out.push(err('MANIFEST_BAD_DEPENDENCY', `"${field}" must be an array of { name, minVersion? }`));
+            continue;
+        }
+        for (const d of list) {
+            const depName = d && typeof d === 'object' ? d.name : undefined;
+            const min = d && typeof d === 'object' ? d.minVersion : undefined;
+            if (typeof depName !== 'string' || depName.trim() === '') {
+                out.push(err('MANIFEST_BAD_DEPENDENCY', `"${field}" entry ${JSON.stringify(d)} has no name`));
+                continue;
+            }
+            if (min !== undefined && (typeof min !== 'string' || !SEMVER_RE.test(min))) {
+                out.push(err('MANIFEST_BAD_DEPENDENCY', `"${field}" ${depName}: minVersion ${JSON.stringify(min)} is not semver`));
+            }
+            const seen = depNames.get(depName);
+            if (seen) {
+                out.push(err('MANIFEST_BAD_DEPENDENCY', `"${depName}" is listed in "${seen}" and "${field}"`));
+            }
+            depNames.set(depName, field);
+        }
+    }
     // The engine's manifest schema refuses the whole extension (422) on a bad entry.
     if (obj.apiKeyRoutes !== undefined) {
         const routes = Array.isArray(obj.apiKeyRoutes) ? obj.apiKeyRoutes : [obj.apiKeyRoutes];
@@ -102,6 +132,27 @@ export function validateManifest(input) {
             }
         }
     }
+    // The host strips these from a worker's request; a public route may ask for some back.
+    if (obj.forwardCredentials !== undefined) {
+        const fwd = obj.forwardCredentials;
+        const publicRoutes = Array.isArray(obj.publicRoutes) ? obj.publicRoutes : [];
+        if (!fwd || typeof fwd !== 'object' || Array.isArray(fwd)) {
+            out.push(err('MANIFEST_BAD_FORWARD_CREDENTIALS', '"forwardCredentials" must map a route to headers'));
+        }
+        else {
+            for (const [route, names] of Object.entries(fwd)) {
+                if (!publicRoutes.includes(route)) {
+                    out.push(err('MANIFEST_BAD_FORWARD_CREDENTIALS', `forwardCredentials names "${route}", which is not a publicRoutes entry`));
+                }
+                const list = Array.isArray(names) ? names : [names];
+                for (const n of list) {
+                    if (typeof n !== 'string' || !CREDENTIAL_HEADERS.includes(n)) {
+                        out.push(err('MANIFEST_BAD_FORWARD_CREDENTIALS', `forwardCredentials "${route}": ${JSON.stringify(n)} is not one of ${CREDENTIAL_HEADERS.join(', ')}`));
+                    }
+                }
+            }
+        }
+    }
     if (typeof obj.category === 'string' && !KNOWN_CATEGORIES.has(obj.category)) {
         // A true warning — categories are open-ended in practice (e.g. the RO
         // compliance set uses "compliance/ro"). Surfaced so authors notice typos

package/dist/validate/migration-parse.d.ts

@@ -1,13 +1,18 @@
 /**
  * Parse a single SQL migration file into its UP and DOWN sections.
  *
- * The DOWN section starts at the first line matching `-- DOWN` (case
- * insensitive). Everything before that marker is UP; everything after the
- * marker line is DOWN. If the marker is absent, the whole file is UP.
+ * The DOWN section starts at the first line that is exactly `-- DOWN` (case
+ * insensitive, surrounding spaces allowed). Everything before that marker is
+ * UP; everything after the marker line is DOWN. If the marker is absent, the
+ * whole file is UP.
  *
- * Mirror of `packages/engine/src/lib/extension-loader.ts:parseMigrationSql`
+ * Mirror of `packages/engine/src/lib/extensions/extension-utils.ts:parseMigrationSql`
  * — kept in the SDK so validators and tooling can call it without depending
- * on engine internals.
+ * on engine internals. The two must agree on the marker: the engine was moved
+ * to the anchored `\s*$` form and this copy kept `\b`, so a comment such as
+ * `-- DOWN: manual rollback required` ended UP here and not there —
+ * `withTestDb` applied half an extension's schema while the engine applied all
+ * of it, and the validator saw a DOWN section the engine did not.
  */
 export interface ParsedMigration {
     up: string;

package/dist/validate/migration-parse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migration-parse.d.ts","sourceRoot":"","sources":["../../src/validate/migration-parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAU9D"}
+{"version":3,"file":"migration-parse.d.ts","sourceRoot":"","sources":["../../src/validate/migration-parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAU9D"}

package/dist/validate/migration-parse.js

@@ -1,5 +1,5 @@
 export function parseMigrationSql(raw) {
-    const downIdx = raw.search(/^--\s*DOWN\b/im);
+    const downIdx = raw.search(/^--\s*DOWN\s*$/im);
     if (downIdx < 0) {
         return { up: raw.trim(), down: null };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zveltio/sdk",
-  "version": "3.0.0-beta.77",
+  "version": "3.0.0-beta.79",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -69,7 +69,7 @@
     "fake-indexeddb": "^6.2.5",
     "hono": "^4.13.8",
     "kysely": "^0.29.6",
-    "pg": "^8.23.0",
+    "pg": "^8.23.1",
     "typescript": "^5.4.0"
   },
   "peerDependencies": {