@claudinho/core 0.8.18 → 0.8.19

package/dist/index.d.ts

@@ -183,6 +183,54 @@ declare function isValidTimeZone(tz: string | undefined | null): boolean;
  */
 declare function isValidDate(s: string | undefined | null): boolean;
 
+/**
+ * Feed-string sanitizer — the chokepoint between untrusted provider data and
+ * every output surface (terminal, statusline, share cards, and the Claude Code
+ * hook, whose stdout lands in the model's context). Strips control characters
+ * (C0 incl. ESC, DEL, C1) so a compromised feed can't inject ANSI escapes or
+ * multi-line text, and caps length so one field can't flood a surface.
+ *
+ * Applied at the ESPN adapter boundary (toTeam / mapEspnEvent) and mirrored on
+ * the statusline's cache reads (defense against a poisoned cache file).
+ */
+
+/** Default per-field cap — generous for any real team/venue name. */
+declare const FEED_TEXT_MAX = 100;
+/**
+ * Strip C0/C1 control characters (including ESC) and cap at `max` code points.
+ * Whitespace controls (tab/newline/CR) become a single space so words a hostile
+ * feed split across lines don't fuse together. Total: never throws.
+ */
+declare function sanitizeFeedText(value: string, max?: number): string;
+/**
+ * Sanitized, display-safe copy of a Match. Used on cache reads (the
+ * statusline/hook render straight from the cache file), so it must be total:
+ * a malformed entry yields empty strings, never a throw. Beyond the string
+ * fields, the RENDERED numeric fields (score, shootout, minute) are dropped
+ * unless they are real finite numbers — poisoned values degrade to "vs" /
+ * "LIVE", never to injected text. Shootout never survives without its score
+ * (the adapter-level invariant, re-enforced here).
+ */
+declare function sanitizeMatchStrings(m: Match): Match;
+
+/**
+ * Display-width helpers for monospace/plain-text alignment.
+ *
+ * `String.prototype.padEnd` counts UTF-16 units, but emoji flags occupy 2
+ * terminal columns regardless of how many units encode them: a regional-
+ * indicator flag (🇲🇽) is 4 units, while a tag-sequence flag (England 🏴󠁧󠁢󠁥󠁮󠁧󠁿) is
+ * 14 — so unit-counted padding pushed England/Scotland rows ~10 columns out of
+ * line. These helpers count grapheme clusters, with pictographic clusters
+ * (flags included) as 2 columns, matching how terminals render them.
+ */
+/** Terminal display width of a string (grapheme clusters; emoji count as 2). */
+declare function displayWidth(s: string): number;
+/**
+ * Pad with trailing spaces to `width` DISPLAY columns (never truncates — a
+ * too-long value overflows its column rather than being cut mid-name).
+ */
+declare function padVisible(s: string, width: number): string;
+
 /** Outcome (home perspective) from a final/looking scoreline. */
 declare function outcomeFromScore(home: number, away: number): Outcome;
 /** Is the match currently in play (including halftime)? */
@@ -1176,4 +1224,4 @@ declare function formatShareBracket(input: ShareBracketInput, options?: ShareBra
 /** Compact one-line-per-match bracket for narrow share contexts. */
 declare function formatBracketCompactLine(mv: BracketMatchView, opts?: BracketFormatOpts): string;
 
-export { BRACKET_STAGE_ORDER, type BracketFormatOpts, type BracketMatchNode, type BracketMatchView, type BracketResult, type BracketTopology, type BracketView, type BuildSignalInput, DEFAULT_COMPETITION, DEFAULT_FLAVOR, DEFAULT_MAX_AGE_MS, EspnAdapter, type EspnAdapterOptions, FLAVOR_LEVELS, FakeMarketProvider, type FakeMarketProviderOptions, type FavoriteStrength, type FlavorLevel, type FormatOpts, type GroupStandings, type KnockoutFixturesResult, LIVE_WINDOW_MS, type Lang, type LedgerRow, type LiveResult, type MapContext, type MarketFavorite, type MarketMapping, type MarketMappingTable, type MarketOutcome, type MarketOutcomeKind, type MarketProvider, type MarketSignal, type MarketSignalOptions, type MarketSignalsResult, type Match, type MatchByIdResult, type MatchEvent, type NextFixtureResult, type Outcome, PolymarketProvider, type PolymarketProviderOptions, type ProviderAdapter, type ProviderCapabilities, type PunditPick, type ResolvedParticipant, SHARE_DISCLAIMER, SHARE_HASHTAG, type ShareBracketInput, type ShareBracketOptions, type ShareSnippetInput, type ShareSnippetOptions, type ShareStyle, type ShareTableInput, type SlotRef, type Stage, type StandingRow, type StandingsResult, type Status, type Team, type TeamInfo, type TeamLookup, allFixtures, allTeams, asFlavorLevel, buildBracketTopology, buildBracketView, buildMarketSignal, byKickoff, competitionBase, computeStandings, countdown, currentOrNextFixtureForTeam, deriveFavorite, favoriteStrength, fixturesByDate, fixturesByGroup, fixturesByTeam, fixturesInLiveWindow, flagEmoji, formatBracketCompactLine, formatBracketList, formatBracketMatchLine, formatBracketTree, formatDate, formatKickoff, formatShareBracket, formatShareSnippet, formatShareTable, formatTime, getBracket, getKnockoutFixtures, getLiveMatches, getMarketSignal, getMarketSignals, getMatchById, getMatchesForDate, getNextFixtureForTeam, getStandings, groups, hasSaneDistribution, isFinished, isFlavorLevel, isLive, isReliableMarketSignal, isResolvedNation, isStaleSignal, isValidDate, isValidTimeZone, liveSourceLabel, loadBracketTopology, localDate, lookupTeam, makeAdapter, makeMarketProvider, mapEspnEvent, mapsCleanly, marketAttributionText, marketBlock, marketFavoriteText, marketFixtureForTeam, marketLine, marketProbabilityText, marketRelevant, marketSignalRendersFor, marketSourceLabel, matchFlavor, matchKey, matchLocation, mergeLive, nationToFlag, nationToRegion, nextFixtureForTeam, normalizeLang, normalizeOutcomes, outcomeFromScore, parseStandings, parseTeamSlot, resolveCompetition, resolveMarketSource, resolveTz, sanitizeBundledFixture, scoreline, stageLabel, stageLabelI18n, t };
+export { BRACKET_STAGE_ORDER, type BracketFormatOpts, type BracketMatchNode, type BracketMatchView, type BracketResult, type BracketTopology, type BracketView, type BuildSignalInput, DEFAULT_COMPETITION, DEFAULT_FLAVOR, DEFAULT_MAX_AGE_MS, EspnAdapter, type EspnAdapterOptions, FEED_TEXT_MAX, FLAVOR_LEVELS, FakeMarketProvider, type FakeMarketProviderOptions, type FavoriteStrength, type FlavorLevel, type FormatOpts, type GroupStandings, type KnockoutFixturesResult, LIVE_WINDOW_MS, type Lang, type LedgerRow, type LiveResult, type MapContext, type MarketFavorite, type MarketMapping, type MarketMappingTable, type MarketOutcome, type MarketOutcomeKind, type MarketProvider, type MarketSignal, type MarketSignalOptions, type MarketSignalsResult, type Match, type MatchByIdResult, type MatchEvent, type NextFixtureResult, type Outcome, PolymarketProvider, type PolymarketProviderOptions, type ProviderAdapter, type ProviderCapabilities, type PunditPick, type ResolvedParticipant, SHARE_DISCLAIMER, SHARE_HASHTAG, type ShareBracketInput, type ShareBracketOptions, type ShareSnippetInput, type ShareSnippetOptions, type ShareStyle, type ShareTableInput, type SlotRef, type Stage, type StandingRow, type StandingsResult, type Status, type Team, type TeamInfo, type TeamLookup, allFixtures, allTeams, asFlavorLevel, buildBracketTopology, buildBracketView, buildMarketSignal, byKickoff, competitionBase, computeStandings, countdown, currentOrNextFixtureForTeam, deriveFavorite, displayWidth, favoriteStrength, fixturesByDate, fixturesByGroup, fixturesByTeam, fixturesInLiveWindow, flagEmoji, formatBracketCompactLine, formatBracketList, formatBracketMatchLine, formatBracketTree, formatDate, formatKickoff, formatShareBracket, formatShareSnippet, formatShareTable, formatTime, getBracket, getKnockoutFixtures, getLiveMatches, getMarketSignal, getMarketSignals, getMatchById, getMatchesForDate, getNextFixtureForTeam, getStandings, groups, hasSaneDistribution, isFinished, isFlavorLevel, isLive, isReliableMarketSignal, isResolvedNation, isStaleSignal, isValidDate, isValidTimeZone, liveSourceLabel, loadBracketTopology, localDate, lookupTeam, makeAdapter, makeMarketProvider, mapEspnEvent, mapsCleanly, marketAttributionText, marketBlock, marketFavoriteText, marketFixtureForTeam, marketLine, marketProbabilityText, marketRelevant, marketSignalRendersFor, marketSourceLabel, matchFlavor, matchKey, matchLocation, mergeLive, nationToFlag, nationToRegion, nextFixtureForTeam, normalizeLang, normalizeOutcomes, outcomeFromScore, padVisible, parseStandings, parseTeamSlot, resolveCompetition, resolveMarketSource, resolveTz, sanitizeBundledFixture, sanitizeFeedText, sanitizeMatchStrings, scoreline, stageLabel, stageLabelI18n, t };

package/dist/index.js

@@ -502,6 +502,67 @@ function shiftUtcDate(dateISO, days) {
   return new Date(Date.UTC(y ?? 1970, (m ?? 1) - 1, (d ?? 1) + days)).toISOString().slice(0, 10);
 }
 
+// src/sanitize.ts
+var FEED_TEXT_MAX = 100;
+function sanitizeFeedText(value, max = FEED_TEXT_MAX) {
+  let out = "";
+  let count = 0;
+  for (const ch of String(value)) {
+    const cp = ch.codePointAt(0) ?? 0;
+    const isWhitespaceControl = cp === 9 || cp === 10 || cp === 13;
+    if ((cp <= 31 || cp >= 127 && cp <= 159) && !isWhitespaceControl) continue;
+    if (count >= max) break;
+    out += isWhitespaceControl ? " " : ch;
+    count++;
+  }
+  return out;
+}
+function sanitizeTeam(t2) {
+  return {
+    ...t2 ?? {},
+    code: sanitizeFeedText(t2?.code ?? ""),
+    name: sanitizeFeedText(t2?.name ?? ""),
+    flag: sanitizeFeedText(t2?.flag ?? "")
+  };
+}
+function finiteOrUndefined(v) {
+  return typeof v === "number" && Number.isFinite(v) ? v : void 0;
+}
+function sanitizeScorePair(v) {
+  const home = finiteOrUndefined(v?.home);
+  const away = finiteOrUndefined(v?.away);
+  return home !== void 0 && away !== void 0 ? { home, away } : void 0;
+}
+function sanitizeMatchStrings(m) {
+  const score = sanitizeScorePair(m.score);
+  return {
+    ...m,
+    venue: sanitizeFeedText(m.venue ?? ""),
+    city: m.city == null ? m.city : sanitizeFeedText(m.city),
+    country: m.country == null ? m.country : sanitizeFeedText(m.country),
+    home: sanitizeTeam(m.home),
+    away: sanitizeTeam(m.away),
+    score,
+    shootout: score ? sanitizeScorePair(m.shootout) : void 0,
+    minute: finiteOrUndefined(m.minute)
+  };
+}
+
+// src/text.ts
+var segmenter = new Intl.Segmenter();
+var WIDE_CLUSTER = new RegExp("^(?:\\p{Regional_Indicator}|\\p{Extended_Pictographic})", "u");
+function displayWidth(s) {
+  let w = 0;
+  for (const { segment } of segmenter.segment(s)) {
+    w += WIDE_CLUSTER.test(segment) ? 2 : 1;
+  }
+  return w;
+}
+function padVisible(s, width) {
+  const w = displayWidth(s);
+  return w >= width ? s : s + " ".repeat(width - w);
+}
+
 // src/normalize.ts
 function outcomeFromScore(home, away) {
   if (home > away) return "H";
@@ -3025,6 +3086,7 @@ var ESPN_SOCCER = "https://site.api.espn.com/apis/site/v2/sports/soccer";
 var DEFAULT_COMPETITION = "fifa.world";
 var DEFAULT_BASE = `${ESPN_SOCCER}/${DEFAULT_COMPETITION}`;
 var USER_AGENT = "claudinho/0.0 (+https://github.com/arturogarrido/claudinho)";
+var MAX_RESPONSE_BYTES = 5 * 1024 * 1024;
 function competitionBase(slug) {
   return `${ESPN_SOCCER}/${slug}`;
 }
@@ -3068,9 +3130,15 @@ function toInt(s) {
   return Number.isFinite(n) ? n : void 0;
 }
 function toTeam(t2) {
-  const name = t2?.displayName ?? t2?.name ?? t2?.location ?? t2?.shortDisplayName ?? "TBD";
-  const code = (t2?.abbreviation ?? name.slice(0, 3)).toUpperCase();
-  return { code, name, flag: nationToFlag(t2?.displayName ?? t2?.abbreviation ?? name) };
+  const name = sanitizeFeedText(
+    t2?.displayName ?? t2?.name ?? t2?.location ?? t2?.shortDisplayName ?? "TBD"
+  );
+  const code = sanitizeFeedText(t2?.abbreviation ?? name.slice(0, 3)).toUpperCase();
+  return {
+    code,
+    name,
+    flag: nationToFlag(sanitizeFeedText(t2?.displayName ?? t2?.abbreviation ?? name))
+  };
 }
 function mapEspnEvent(ev, ctx = {}) {
   const comp = ev.competitions?.[0];
@@ -3101,9 +3169,9 @@ function mapEspnEvent(ev, ctx = {}) {
     stage,
     group,
     kickoff: ev.date,
-    venue: comp?.venue?.fullName ?? "",
-    city: comp?.venue?.address?.city || void 0,
-    country: comp?.venue?.address?.country || void 0,
+    venue: sanitizeFeedText(comp?.venue?.fullName ?? ""),
+    city: sanitizeFeedText(comp?.venue?.address?.city ?? "") || void 0,
+    country: sanitizeFeedText(comp?.venue?.address?.country ?? "") || void 0,
     home,
     away,
     score: hasScore ? { home: hs, away: as } : void 0,
@@ -3227,11 +3295,18 @@ var EspnAdapter = class {
     try {
       const res = await doFetch(url, {
         signal: controller.signal,
+        // ESPN never legitimately redirects; following one would sidestep the
+        // fixed-host guarantee, so treat any redirect as a failure (degraded).
+        redirect: "error",
         headers: { Accept: "application/json", "User-Agent": USER_AGENT }
       });
       if (!res.ok) {
         throw new Error(`ESPN request failed: ${res.status} ${res.statusText}`);
       }
+      const length = Number(res.headers?.get?.("content-length"));
+      if (Number.isFinite(length) && length > MAX_RESPONSE_BYTES) {
+        throw new Error(`ESPN response too large: ${length} bytes`);
+      }
       return await res.json();
     } finally {
       clearTimeout(timer);
@@ -4567,12 +4642,19 @@ var PolymarketProvider = class {
     const doFetch = this.opts.fetchImpl ?? fetch;
     const res = await doFetch(url, {
       signal: AbortSignal.timeout(timeoutMs ?? this.opts.timeoutMs ?? DEFAULT_TIMEOUT_MS),
+      // Gamma never legitimately redirects; following one would sidestep the
+      // host allow-list (it only validates the base URL), so reject redirects.
+      redirect: "error",
       headers: { Accept: "application/json", "User-Agent": USER_AGENT2 }
     });
     if (res.status === 404) return void 0;
     if (!res.ok) {
       throw new Error(`Polymarket request failed: ${res.status} ${res.statusText}`);
     }
+    const length = Number(res.headers?.get?.("content-length"));
+    if (Number.isFinite(length) && length > MAX_RESPONSE_BYTES) {
+      throw new Error(`Polymarket response too large: ${length} bytes`);
+    }
     const data = await res.json();
     const event = Array.isArray(data) ? data[0] : data;
     return event && typeof event === "object" ? event : void 0;
@@ -5025,6 +5107,7 @@ export {
   DEFAULT_FLAVOR,
   DEFAULT_MAX_AGE_MS,
   EspnAdapter,
+  FEED_TEXT_MAX,
   FLAVOR_LEVELS,
   FakeMarketProvider,
   LIVE_WINDOW_MS,
@@ -5043,6 +5126,7 @@ export {
   countdown,
   currentOrNextFixtureForTeam,
   deriveFavorite,
+  displayWidth,
   favoriteStrength,
   fixturesByDate,
   fixturesByGroup,
@@ -5105,12 +5189,15 @@ export {
   normalizeLang,
   normalizeOutcomes,
   outcomeFromScore,
+  padVisible,
   parseStandings,
   parseTeamSlot,
   resolveCompetition,
   resolveMarketSource,
   resolveTz,
   sanitizeBundledFixture,
+  sanitizeFeedText,
+  sanitizeMatchStrings,
   scoreline,
   stageLabel,
   stageLabelI18n,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claudinho/core",
-  "version": "0.8.18",
+  "version": "0.8.19",
   "description": "Domain model, provider adapters (ESPN), standings, bundled schedule, and the read-only Polymarket market-signal sidecar powering Claudinho. Not affiliated with FIFA or Anthropic.",
   "type": "module",
   "license": "MIT",