@cairnvibe/indexer 0.2.4 → 0.2.6

package/dist/cli.js

@@ -18,6 +18,43 @@ const diff_1 = require("./diff");
 const docs_1 = require("./docs");
 const init_1 = require("./init");
 const setup_1 = require("./setup");
+/**
+ * A local `cairn build`/`npx cairn build` run (as opposed to a hosting
+ * platform's own build step, which injects its configured env vars
+ * directly into process.env) only ever sees the plain shell environment —
+ * it does NOT get a bundler's or framework's automatic .env/.env.local
+ * loading, since that's scoped to that tool's own process, not whatever
+ * invokes this CLI. A real key sitting in .env was invisible here even
+ * though `cairn setup` had written it there — the exact same class of gap
+ * already fixed for cairn-realtime's own CLI (realtime-cli.ts), for the
+ * exact same reason. No new dependency: .env is a plain KEY=VALUE format.
+ * .env.local loads first so it wins (matches Next.js's own precedence);
+ * nothing here overrides a real, already-set process.env value (a shell
+ * export, or a platform's own injected env vars) — file contents only
+ * ever fill a gap, never override something actually set.
+ */
+function loadDotEnv(dir) {
+    for (const filename of [".env.local", ".env"]) {
+        const filePath = node_path_1.default.join(dir, filename);
+        if (!node_fs_1.default.existsSync(filePath))
+            continue;
+        for (const line of node_fs_1.default.readFileSync(filePath, "utf8").split("\n")) {
+            const trimmed = line.trim();
+            if (!trimmed || trimmed.startsWith("#"))
+                continue;
+            const eq = trimmed.indexOf("=");
+            if (eq === -1)
+                continue;
+            const key = trimmed.slice(0, eq).trim();
+            let value = trimmed.slice(eq + 1).trim();
+            if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
+                value = value.slice(1, -1);
+            }
+            if (process.env[key] === undefined)
+                process.env[key] = value;
+        }
+    }
+}
 function parseArgs(rest) {
     const positional = [];
     const flags = {};
@@ -37,6 +74,7 @@ async function main() {
     const [command, ...rest] = process.argv.slice(2);
     const { positional, flags } = parseArgs(rest);
     const dir = positional[0] ?? ".";
+    loadDotEnv(dir);
     if (command === "scan") {
         const facts = (0, l1_scan_1.scanL1)(dir);
         process.stdout.write(JSON.stringify(facts, null, 2) + "\n");

package/dist/manifest.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.assembleManifest = assembleManifest;
+exports.parseApiCall = parseApiCall;
 const node_child_process_1 = require("node:child_process");
 function assembleManifest(rootDir, facts, l2, l3) {
     const globalElements = facts.frameworkElements.map((el) => toManifestElement(el, l3.globalElements.find((e) => e.id === el.id), "present in the root layout"));
@@ -29,13 +30,23 @@ function assembleManifest(rootDir, facts, l2, l3) {
 }
 const MUTATING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
 /**
- * Turns l1-scan's traced `"POST /api/items/${id}"`-shaped string into
- * structured, executable data — this is what lets a `do` action actually
- * run (verb-executor.ts) instead of only ever describing itself. Only
- * real mutating methods count as an action; `"navigate ..."` (a Link) and
- * a bare GET aren't "do" material — see ApiCallSchema's doc comment in
+ * Turns l1-scan's traced `"POST /api/items"`-shaped string into structured,
+ * executable data — this is what lets a `do` action actually run
+ * (verb-executor.ts) instead of only ever describing itself. Only real
+ * mutating methods count as an action; `"navigate ..."` (a Link) and a bare
+ * GET aren't "do" material — see ApiCallSchema's doc comment in
  * @cairnvibe/core for the safety reasoning (bounded to calls a human
  * developer already wrote and shipped, nothing invented at runtime).
+ *
+ * Only accepts a clean, static, same-origin relative path. l1-scan.ts's URL
+ * capture falls back to a call's raw source text when the first argument
+ * isn't a plain string literal — for a template literal (a per-row action
+ * built as `` `/api/items/${id}/archive` ``) that's literal backticks and a
+ * "${...}" hole, not a real fetchable URL; for a bare identifier or some
+ * other expression it isn't a URL at all. Rejecting both instead of
+ * guessing at resolving them is what keeps this bounded to calls that are
+ * actually safe to fire as-is — see ApiCallSchema's doc comment for the
+ * real gap this leaves (per-row actions aren't auto-executable yet).
  */
 function parseApiCall(handlerCall) {
     if (!handlerCall)
@@ -47,6 +58,8 @@ function parseApiCall(handlerCall) {
     const url = handlerCall.slice(spaceIndex + 1);
     if (!MUTATING_METHODS.has(method) || !url)
         return null;
+    if (!/^\/[a-zA-Z0-9/_.-]*$/.test(url))
+        return null;
     return { method: method, url };
 }
 function toManifestElement(el, elDesc, baseEvidence) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cairnvibe/indexer",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "Cairn's analyzer and installer (the `cairn` CLI) — scans Next.js source or crawls any running app, and scaffolds the backend either way.",
   "license": "MIT",
   "publishConfig": { "access": "public" },