@gobing-ai/ts-rule-engine 0.2.8 → 0.3.0

package/src/types.ts

@@ -56,6 +56,8 @@ export interface ConstraintRuleFile {
     severity?: RuleSeverity;
     /** Rule definitions. */
     rules: ConstraintRule[];
+    /** Custom capability modules contributed by this rule file (opt-in to load). */
+    extensions?: PresetExtensions;
 }
 
 /** Relative module paths a preset contributes per capability kind. */
@@ -198,7 +200,10 @@ export const ConstraintRuleSchema = z.object({
     id: z.string().min(1),
     description: z.string().default(''),
     enabled: z.boolean().default(true),
-    severity: z.enum(['error', 'warning', 'info']).default('error'),
+    // Severity is intentionally NOT defaulted here: an omitted rule severity must
+    // stay absent at parse time so the loader can apply the file-level default
+    // (`rule.severity ?? file.severity ?? 'error'`). Normalization always fills it.
+    severity: z.enum(['error', 'warning', 'info']).optional(),
     evaluator: z.object({
         type: z.string().min(1),
         config: z.record(z.string(), z.unknown()).optional(),
@@ -208,6 +213,37 @@ export const ConstraintRuleSchema = z.object({
     fix: RuleFixConfigSchema.optional(),
 });
 
+/**
+ * A relative module path a preset or rule file may load as an extension.
+ *
+ * Rejects absolute paths and `..` traversal: extension declarations are data, and a
+ * path that escapes the declaring file's directory is a trust-boundary violation even
+ * when extension loading is explicitly allowed.
+ */
+const relativeExtensionPath = z
+    .string()
+    .min(1)
+    .refine((value) => !/^([/\\]|[A-Za-z]:[/\\])/.test(value), {
+        message: 'extension path must be relative (no absolute paths)',
+    })
+    .refine((value) => !value.split(/[/\\]/).includes('..'), {
+        message: 'extension path must not contain ".." traversal',
+    });
+
+/**
+ * Shared zod schema for an `extensions` block, used by both preset and rule-file
+ * schemas so they validate identically. `.strict()` makes a typo'd or misplaced key
+ * a hard error rather than a silently-ignored field.
+ */
+export const ExtensionsSchema = z
+    .object({
+        resolvers: z.array(relativeExtensionPath).optional(),
+        evaluators: z.array(relativeExtensionPath).optional(),
+        fixers: z.array(relativeExtensionPath).optional(),
+        formatters: z.array(relativeExtensionPath).optional(),
+    })
+    .strict();
+
 /** Zod schema for a constraint rule file. */
 export const ConstraintRuleFileSchema = z.object({
     $schema: z.string().optional(),
@@ -215,6 +251,7 @@ export const ConstraintRuleFileSchema = z.object({
     exclude: z.array(z.string()).optional(),
     severity: z.enum(['error', 'warning', 'info']).optional(),
     rules: z.array(ConstraintRuleSchema),
+    extensions: ExtensionsSchema.optional(),
 });
 
 /** Zod schema for a preset definition. */
@@ -226,12 +263,5 @@ export const PresetDefinitionSchema = z.object({
     overrides: z
         .record(z.string(), z.object({ fix: z.object({ mode: z.enum(['none', 'suggest', 'auto']) }).optional() }))
         .optional(),
-    extensions: z
-        .object({
-            resolvers: z.array(z.string()).optional(),
-            evaluators: z.array(z.string()).optional(),
-            fixers: z.array(z.string()).optional(),
-            formatters: z.array(z.string()).optional(),
-        })
-        .optional(),
+    extensions: ExtensionsSchema.optional(),
 });