@codewithagents/api-errors 1.1.0 → 1.2.1

package/dist/parsers/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/parsers/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/parsers/types.ts"],"names":[],"mappings":""}

package/dist/parsers/unwrap.d.ts

@@ -0,0 +1,3 @@
+/** Run all three unwrap steps in sequence to get the raw error body. */
+export declare function unwrapBody(error: unknown): unknown;
+//# sourceMappingURL=unwrap.d.ts.map

package/dist/parsers/unwrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unwrap.d.ts","sourceRoot":"","sources":["../../src/parsers/unwrap.ts"],"names":[],"mappings":"AA8BA,wEAAwE;AACxE,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAElD"}

package/dist/parsers/unwrap.js

@@ -0,0 +1,29 @@
+import { isObject } from './utils.js';
+/** Unwrap `{ status: number, body: unknown }` (ApiError from generated client). */
+function unwrapApiError(value) {
+    if (isObject(value) &&
+        typeof value['status'] === 'number' &&
+        Object.prototype.hasOwnProperty.call(value, 'body')) {
+        return value['body'];
+    }
+    return value;
+}
+/** Unwrap `{ response: { data: ... } }` (Axios-style errors). */
+function unwrapAxiosResponse(value) {
+    if (isObject(value) && isObject(value['response']) && value['response']['data'] !== undefined) {
+        return value['response']['data'];
+    }
+    return value;
+}
+/** Unwrap `{ data: { ... } }` top-level data envelopes (no field/errors at root). */
+function unwrapDataEnvelope(value) {
+    if (isObject(value) && isObject(value['data']) && !('field' in value) && !('errors' in value)) {
+        return value['data'];
+    }
+    return value;
+}
+/** Run all three unwrap steps in sequence to get the raw error body. */
+export function unwrapBody(error) {
+    return unwrapDataEnvelope(unwrapAxiosResponse(unwrapApiError(error)));
+}
+//# sourceMappingURL=unwrap.js.map

package/dist/parsers/unwrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unwrap.js","sourceRoot":"","sources":["../../src/parsers/unwrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAErC,mFAAmF;AACnF,SAAS,cAAc,CAAC,KAAc;IACpC,IACE,QAAQ,CAAC,KAAK,CAAC;QACf,OAAQ,KAAiC,CAAC,QAAQ,CAAC,KAAK,QAAQ;QAChE,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EACnD,CAAC;QACD,OAAQ,KAAiC,CAAC,MAAM,CAAC,CAAA;IACnD,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,iEAAiE;AACjE,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;QAC9F,OAAO,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAA;IAClC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,qFAAqF;AACrF,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC,EAAE,CAAC;QAC9F,OAAO,KAAK,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,kBAAkB,CAAC,mBAAmB,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AACvE,CAAC"}

package/dist/parsers/utils.d.ts

@@ -0,0 +1,12 @@
+import type { FieldError, ParsedErrors } from './types.js';
+export declare function isObject(value: unknown): value is Record<string, unknown>;
+export declare function isStringArray(value: unknown): value is string[];
+/**
+ * Parse an array of objects where each item carries a field key and a message key.
+ * Items whose field value is absent or empty are treated as global (form-level) errors.
+ * Items without a message value are silently skipped.
+ */
+export declare function parseKeyedArray(items: unknown[], fieldKey: string, messageKey: string): ParsedErrors;
+/** Drop unsafe field paths and cap the result before it leaves the library. */
+export declare function finalize(result: FieldError[]): FieldError[];
+//# sourceMappingURL=utils.d.ts.map

package/dist/parsers/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/parsers/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE1D,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,EAAE,CAE/D;AAeD;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,OAAO,EAAE,EAChB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,YAAY,CAgBd;AA0BD,+EAA+E;AAC/E,wBAAgB,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,UAAU,EAAE,CAG3D"}

package/dist/parsers/utils.js

@@ -0,0 +1,65 @@
+export function isObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+export function isStringArray(value) {
+    return Array.isArray(value) && value.every((v) => typeof v === 'string');
+}
+/** Extract field + message from a single keyed-array item. Returns null when message is absent. */
+function parseKeyedItem(item, fieldKey, messageKey) {
+    const message = typeof item[messageKey] === 'string' ? item[messageKey] : null;
+    if (message === null)
+        return null;
+    const field = typeof item[fieldKey] === 'string' && item[fieldKey] !== '' ? item[fieldKey] : null;
+    return { field, message };
+}
+/**
+ * Parse an array of objects where each item carries a field key and a message key.
+ * Items whose field value is absent or empty are treated as global (form-level) errors.
+ * Items without a message value are silently skipped.
+ */
+export function parseKeyedArray(items, fieldKey, messageKey) {
+    const fieldErrors = [];
+    const formErrors = [];
+    for (const item of items) {
+        if (!isObject(item))
+            continue;
+        const parsed = parseKeyedItem(item, fieldKey, messageKey);
+        if (parsed === null)
+            continue;
+        if (parsed.field !== null) {
+            fieldErrors.push({ field: parsed.field, message: parsed.message });
+        }
+        else {
+            formErrors.push(parsed.message);
+        }
+    }
+    return { fieldErrors, formErrors };
+}
+/**
+ * Field-path segments that must never be forwarded to a path-aware setter.
+ * A path-aware setter (e.g. React Hook Form's `setError`) splits the field name
+ * on `.`/`[]` and walks/creates nested objects, so a malicious field like
+ * `__proto__.polluted` from an untrusted error body would otherwise become a
+ * prototype-pollution write in the consuming app.
+ */
+const FORBIDDEN_FIELD_SEGMENTS = new Set(['__proto__', 'constructor', 'prototype']);
+/**
+ * Upper bound on the number of field errors returned. A hostile body with a huge
+ * `errors` map or array would otherwise produce an unbounded list (and an equal
+ * number of `setError` calls / re-renders downstream).
+ */
+const MAX_FIELD_ERRORS = 1000;
+/** True if no path segment of `field` is a prototype-pollution gadget key. */
+function isSafeFieldPath(field) {
+    for (const segment of field.split(/[.[\]]+/)) {
+        if (FORBIDDEN_FIELD_SEGMENTS.has(segment))
+            return false;
+    }
+    return true;
+}
+/** Drop unsafe field paths and cap the result before it leaves the library. */
+export function finalize(result) {
+    const safe = result.filter((e) => isSafeFieldPath(e.field));
+    return safe.length > MAX_FIELD_ERRORS ? safe.slice(0, MAX_FIELD_ERRORS) : safe;
+}
+//# sourceMappingURL=utils.js.map

package/dist/parsers/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/parsers/utils.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAA;AAC1E,CAAC;AAED,mGAAmG;AACnG,SAAS,cAAc,CACrB,IAA6B,EAC7B,QAAgB,EAChB,UAAkB;IAElB,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,UAAU,CAAY,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1F,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACjC,MAAM,KAAK,GACT,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAE,IAAI,CAAC,QAAQ,CAAY,CAAC,CAAC,CAAC,IAAI,CAAA;IACjG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAgB,EAChB,QAAgB,EAChB,UAAkB;IAElB,MAAM,WAAW,GAAiB,EAAE,CAAA;IACpC,MAAM,UAAU,GAAa,EAAE,CAAA;IAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAQ;QAC7B,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAA;QACzD,IAAI,MAAM,KAAK,IAAI;YAAE,SAAQ;QAC7B,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1B,WAAW,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;QACpE,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,CAAA;AACpC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;AAEnF;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,IAAI,CAAA;AAE7B,8EAA8E;AAC9E,SAAS,eAAe,CAAC,KAAa;IACpC,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7C,IAAI,wBAAwB,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAA;IACzD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,QAAQ,CAAC,MAAoB;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;IAC3D,OAAO,IAAI,CAAC,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAChF,CAAC"}

package/dist/parsers/violations.d.ts

@@ -0,0 +1,7 @@
+import type { ParsedErrors } from './types.js';
+/**
+ * RFC 9457 violations array (also used by some Spring Boot setups):
+ * { "violations": [{ "field": "email", "message": "must not be blank" }] }
+ */
+export declare function tryParseViolations(body: Record<string, unknown>): ParsedErrors | null;
+//# sourceMappingURL=violations.d.ts.map

package/dist/parsers/violations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"violations.d.ts","sourceRoot":"","sources":["../../src/parsers/violations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAG9C;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY,GAAG,IAAI,CAIrF"}

package/dist/parsers/violations.js

@@ -0,0 +1,12 @@
+import { parseKeyedArray } from './utils.js';
+/**
+ * RFC 9457 violations array (also used by some Spring Boot setups):
+ * { "violations": [{ "field": "email", "message": "must not be blank" }] }
+ */
+export function tryParseViolations(body) {
+    const { violations } = body;
+    if (!Array.isArray(violations))
+        return null;
+    return parseKeyedArray(violations, 'field', 'message');
+}
+//# sourceMappingURL=violations.js.map

package/dist/parsers/violations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"violations.js","sourceRoot":"","sources":["../../src/parsers/violations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAE5C;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAA6B;IAC9D,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAA;IAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAA;IAC3C,OAAO,eAAe,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;AACxD,CAAC"}

package/dist/parsers/zod-flatten.d.ts

@@ -0,0 +1,11 @@
+import type { ParsedErrors } from './types.js';
+/**
+ * Zod `.flatten()` output shape:
+ * { fieldErrors: { email: ["must not be blank"], name: ["required"] }, formErrors: ["Global error"] }
+ *
+ * Guard: body must have at least one of `fieldErrors` or `formErrors`.
+ * `fieldErrors` must be a plain object (not null, not array).
+ * `formErrors` must be an array of strings.
+ */
+export declare function tryParseZodFlatten(body: Record<string, unknown>): ParsedErrors | null;
+//# sourceMappingURL=zod-flatten.d.ts.map

package/dist/parsers/zod-flatten.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zod-flatten.d.ts","sourceRoot":"","sources":["../../src/parsers/zod-flatten.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAc,YAAY,EAAE,MAAM,YAAY,CAAA;AAG1D;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY,GAAG,IAAI,CA+BrF"}

package/dist/parsers/zod-flatten.js

@@ -0,0 +1,37 @@
+import { isObject, isStringArray } from './utils.js';
+/**
+ * Zod `.flatten()` output shape:
+ * { fieldErrors: { email: ["must not be blank"], name: ["required"] }, formErrors: ["Global error"] }
+ *
+ * Guard: body must have at least one of `fieldErrors` or `formErrors`.
+ * `fieldErrors` must be a plain object (not null, not array).
+ * `formErrors` must be an array of strings.
+ */
+export function tryParseZodFlatten(body) {
+    const rawFieldErrors = body['fieldErrors'];
+    const rawFormErrors = body['formErrors'];
+    const hasFieldErrors = rawFieldErrors !== undefined;
+    const hasFormErrors = rawFormErrors !== undefined;
+    // At least one key must be present.
+    if (!hasFieldErrors && !hasFormErrors)
+        return null;
+    // If fieldErrors is present, it must be a plain object (not null, not array).
+    if (hasFieldErrors && !isObject(rawFieldErrors))
+        return null;
+    // If formErrors is present, it must be a string array (empty is allowed).
+    if (hasFormErrors && !isStringArray(rawFormErrors))
+        return null;
+    const fieldErrors = [];
+    if (hasFieldErrors && isObject(rawFieldErrors)) {
+        for (const [field, messages] of Object.entries(rawFieldErrors)) {
+            if (isStringArray(messages)) {
+                for (const message of messages) {
+                    fieldErrors.push({ field, message });
+                }
+            }
+        }
+    }
+    const formErrors = isStringArray(rawFormErrors) ? rawFormErrors : [];
+    return { fieldErrors, formErrors };
+}
+//# sourceMappingURL=zod-flatten.js.map

package/dist/parsers/zod-flatten.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zod-flatten.js","sourceRoot":"","sources":["../../src/parsers/zod-flatten.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAEpD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAA6B;IAC9D,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,CAAA;IAC1C,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC,CAAA;IAExC,MAAM,cAAc,GAAG,cAAc,KAAK,SAAS,CAAA;IACnD,MAAM,aAAa,GAAG,aAAa,KAAK,SAAS,CAAA;IAEjD,oCAAoC;IACpC,IAAI,CAAC,cAAc,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAA;IAElD,8EAA8E;IAC9E,IAAI,cAAc,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAA;IAE5D,0EAA0E;IAC1E,IAAI,aAAa,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAA;IAE/D,MAAM,WAAW,GAAiB,EAAE,CAAA;IAEpC,IAAI,cAAc,IAAI,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/C,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YAC/D,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;oBAC/B,WAAW,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;gBACtC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAa,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC,CAAE,aAA0B,CAAC,CAAC,CAAC,EAAE,CAAA;IAE5F,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,CAAA;AACpC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codewithagents/api-errors",
-  "version": "1.1.0",
+  "version": "1.2.1",
   "description": "Map backend API errors to form field errors. Framework-agnostic core with React Hook Form adapter.",
   "type": "module",
   "main": "./dist/index.js",
@@ -31,6 +31,7 @@
     "zod",
     "field-errors"
   ],
+  "funding": "https://github.com/sponsors/codewithagents",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -41,6 +42,9 @@
     "url": "https://github.com/codewithagents/openapi-zod-ts/issues"
   },
   "author": "CodeWithAgents (https://codewithagents.de)",
+  "publishConfig": {
+    "access": "public"
+  },
   "devDependencies": {
     "@stryker-mutator/core": "catalog:",
     "@stryker-mutator/vitest-runner": "catalog:",