@cloudcrane/app-spec 0.1.0 → 0.1.1

package/dist/src/leak.js

@@ -94,6 +94,9 @@ const RULES = [
 const EXEMPT = new Set(["/manifest/source/fingerprint"]);
 /** Where CEL lives: rules may look like code there, but nothing else may. */
 const CEL_AT = [/^\/logic\/functions\/[^/]+\/cel$/, /^\/logic\/computed\/.+$/, /^\/data\/migrations\/\d+\/cel$/];
+/** A test step's state path: a dotted path into what the app exposes (CloudCrane's form), which reads like a member access by design. */
+const STATE_PATH_AT = /^\/tests\/\d+\/(steps|setup|check)\/\d+\/path$/;
+const STATE_PATH = /^[A-Za-z0-9_$]+(\.[A-Za-z0-9_$]+)*$/;
 const escape = (k) => k.replace(/~/g, "~0").replace(/\//g, "~1");
 /** Every string in a value, with its JSON Pointer (object keys count as strings too). */
 function* strings(v, at = "") {
@@ -122,11 +125,11 @@ export function leakProblems(spec) {
             continue;
         // A2UI's bindings inside text (${/path}, ${fn(…)}) are the standard's syntax.
         const s = at.startsWith("/surface/") || at.startsWith("/data/views/") ? raw.replace(/\$\{[^}]*\}/g, " ") : raw;
-        const isCel = CEL_AT.some((r) => r.test(at));
+        const codeShaped = CEL_AT.some((r) => r.test(at)) || (STATE_PATH_AT.test(at) && STATE_PATH.test(raw));
         // Web addresses are checked as addresses (hosts, secrets), never as code.
         const withoutUrls = s.replace(/https?:\/\/[^\s"'<>]+/g, " ");
         for (const rule of RULES) {
-            if (isCel && rule.kind === "code")
+            if (codeShaped && rule.kind === "code")
                 continue;
             if (rule.test(rule.kind === "code" ? withoutUrls : s)) {
                 problems.push({ at: at || "/", problem: `looks like ${rule.why} (${rule.kind})` });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudcrane/app-spec",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "The CloudCrane app spec: its schema, the expression language its rules are written in, and the checks that keep partner code out of it.",
   "keywords": [
     "cloudcrane",