@forge/api

Index: package/out/api/permissions.js
===================================================================
--- package/out/api/permissions.js
+++ package/out/api/permissions.js
@@ -3,8 +3,10 @@
 exports.permissions = exports.canLoadResource = exports.canFetchFrom = exports.hasScope = exports.hasPermission = exports.extractUrlString = void 0;
 const runtime_1 = require("./runtime");
 const errors_1 = require("./errors");
 const egress_1 = require("@forge/egress");
+const RESOURCE_TYPES = ['fonts', 'styles', 'frames', 'images', 'media', 'scripts'];
+const FETCH_TYPES = ['backend', 'client'];
 function extractUrlString(url) {
     if (typeof url === 'string') {
         return url;
     }
@@ -64,14 +66,37 @@
         throw new Error(`Invalid permission key(s): ${invalidKeys.join(', ')}. ` +
             `Visit https://go.atlassian.com/forge-permissions for more information.`);
     }
 };
+const validateObjectField = (value, fieldPath) => {
+    if (value !== undefined) {
+        if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+            throw new TypeError(`${fieldPath} should be an object, not ${Array.isArray(value) ? 'an array' : `a ${typeof value}`}`);
+        }
+    }
+};
+const validateArrayField = (value, fieldPath) => {
+    if (value !== undefined && !Array.isArray(value)) {
+        throw new TypeError(`${fieldPath} should be an array, not a ${typeof value}`);
+    }
+};
 const validatePermissionRequirements = (requirements) => {
     validateKeys(requirements, VALID_REQUIREMENT_KEYS);
-    if (requirements.external) {
+    validateArrayField(requirements.scopes, 'scopes');
+    if (requirements.external !== undefined) {
+        validateObjectField(requirements.external, 'external');
         validateKeys(requirements.external, VALID_EXTERNAL_TYPES);
-        if (requirements.external.fetch) {
+        for (const type of VALID_EXTERNAL_TYPES) {
+            if (type !== 'fetch' && type !== 'configurable') {
+                validateArrayField(requirements.external[type], `external.${type}`);
+            }
+        }
+        if (requirements.external.fetch !== undefined) {
+            validateObjectField(requirements.external.fetch, 'external.fetch');
             validateKeys(requirements.external.fetch, VALID_FETCH_TYPES);
+            for (const type of VALID_FETCH_TYPES) {
+                validateArrayField(requirements.external.fetch[type], `external.fetch.${type}`);
+            }
         }
     }
 };
 const getMissingFetchPermissions = (requiredFetch, currentlyGrantedFetch) => {