@gobing-ai/ts-rule-engine 0.4.4 → 0.4.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"extensions.d.ts","sourceRoot":"","sources":["../../src/config/extensions.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"extensions.d.ts","sourceRoot":"","sources":["../../src/config/extensions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAOlD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/D,2DAA2D;AAC3D,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,YAAY,GAAG,QAAQ,GAAG,YAAY,CAAC;AAEjF,yEAAyE;AACzE,MAAM,WAAW,YAAY;IACzB,qDAAqD;IACrD,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,6CAA6C;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yEAAyE;IACzE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC/B;AAED,oDAAoD;AACpD,MAAM,WAAW,qBAAqB;IAClC;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,sEAAsE;IACtE,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,oFAAoF;IACpF,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACxE;AAUD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC7B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,GAAG,SAAS,GAC7E,YAAY,EAAE,CAShB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,sBAAsB,CACxC,IAAI,EAAE,cAAc,EACpB,IAAI,EAAE,SAAS,YAAY,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GACpC,OAAO,CAAC,IAAI,CAAC,CAyDf"}
|
|
@@ -1,5 +1,4 @@
|
|
|
1
|
-
import {
|
|
2
|
-
import { basenamePath, dirnamePath, resolvePath, SEP } from '@gobing-ai/ts-runtime';
|
|
1
|
+
import { basenamePath, dirnamePath, fileUrlToPath, normalizeSeparators, resolvePath } from '@gobing-ai/ts-runtime';
|
|
3
2
|
import { loadExtensionModules } from '@gobing-ai/ts-runtime/extension';
|
|
4
3
|
/** Host registries that can receive extension capabilities (all four kinds). */
|
|
5
4
|
const HOST_REGISTRY_BY_KIND = {
|
|
@@ -47,12 +46,14 @@ export async function loadExtensionsIntoHost(host, refs, options = {}) {
|
|
|
47
46
|
return;
|
|
48
47
|
// Normalize file:// URLs to file paths so dirname/basename produce valid
|
|
49
48
|
// path components that isAbsolute() accepts (e.g. import.meta.url in tests).
|
|
50
|
-
const toFilePath = (p) => (p.startsWith('file://') ?
|
|
49
|
+
const toFilePath = (p) => (p.startsWith('file://') ? fileUrlToPath(p) : p);
|
|
51
50
|
// Defense-in-depth: pre-validate `..` traversal in caller-supplied absPath
|
|
52
51
|
// before the basename adaptation strips it. The shared loader's
|
|
53
52
|
// assertRelativeExtensionPath also runs on the derived (basename) path.
|
|
54
53
|
for (const ref of refs) {
|
|
55
|
-
|
|
54
|
+
// Split on normalized separators: fileUrlToPath returns forward slashes on
|
|
55
|
+
// every platform, so a platform SEP split would miss segments on Windows.
|
|
56
|
+
const segments = normalizeSeparators(toFilePath(ref.absPath)).split('/');
|
|
56
57
|
if (segments.includes('..')) {
|
|
57
58
|
throw new Error(`extension path "${ref.absPath}" declared by "${ref.presetName}" must not contain ".." traversal`);
|
|
58
59
|
}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@gobing-ai/ts-rule-engine",
|
|
3
|
-
"version": "0.4.
|
|
3
|
+
"version": "0.4.6",
|
|
4
4
|
"description": "@gobing-ai/ts-rule-engine — Constraint rule schemas, loading, evaluation, and result formatting.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"typescript",
|
|
@@ -49,10 +49,10 @@
|
|
|
49
49
|
"release": "echo 'Manual publish is disabled. Releases go through GitHub Actions via Trusted Publishing — push a tag: git tag @gobing-ai/ts-rule-engine-v<version> && git push --tags' && exit 1"
|
|
50
50
|
},
|
|
51
51
|
"dependencies": {
|
|
52
|
-
"@gobing-ai/ts-ai-runner": "^0.4.
|
|
53
|
-
"@gobing-ai/ts-infra": "^0.4.
|
|
54
|
-
"@gobing-ai/ts-runtime": "^0.4.
|
|
55
|
-
"@gobing-ai/ts-db": "^0.4.
|
|
52
|
+
"@gobing-ai/ts-ai-runner": "^0.4.6",
|
|
53
|
+
"@gobing-ai/ts-infra": "^0.4.6",
|
|
54
|
+
"@gobing-ai/ts-runtime": "^0.4.6",
|
|
55
|
+
"@gobing-ai/ts-db": "^0.4.6",
|
|
56
56
|
"yaml": "^2.7.0",
|
|
57
57
|
"zod": "^4.1.0"
|
|
58
58
|
},
|
package/src/config/extensions.ts
CHANGED
|
@@ -1,6 +1,5 @@
|
|
|
1
|
-
import { fileURLToPath } from 'node:url';
|
|
2
1
|
import type { Logger } from '@gobing-ai/ts-infra';
|
|
3
|
-
import { basenamePath, dirnamePath,
|
|
2
|
+
import { basenamePath, dirnamePath, fileUrlToPath, normalizeSeparators, resolvePath } from '@gobing-ai/ts-runtime';
|
|
4
3
|
import type {
|
|
5
4
|
ExtensionRef as SharedExtensionRef,
|
|
6
5
|
LoadExtensionsOptions as SharedLoadExtensionsOptions,
|
|
@@ -89,13 +88,15 @@ export async function loadExtensionsIntoHost(
|
|
|
89
88
|
|
|
90
89
|
// Normalize file:// URLs to file paths so dirname/basename produce valid
|
|
91
90
|
// path components that isAbsolute() accepts (e.g. import.meta.url in tests).
|
|
92
|
-
const toFilePath = (p: string): string => (p.startsWith('file://') ?
|
|
91
|
+
const toFilePath = (p: string): string => (p.startsWith('file://') ? fileUrlToPath(p) : p);
|
|
93
92
|
|
|
94
93
|
// Defense-in-depth: pre-validate `..` traversal in caller-supplied absPath
|
|
95
94
|
// before the basename adaptation strips it. The shared loader's
|
|
96
95
|
// assertRelativeExtensionPath also runs on the derived (basename) path.
|
|
97
96
|
for (const ref of refs) {
|
|
98
|
-
|
|
97
|
+
// Split on normalized separators: fileUrlToPath returns forward slashes on
|
|
98
|
+
// every platform, so a platform SEP split would miss segments on Windows.
|
|
99
|
+
const segments = normalizeSeparators(toFilePath(ref.absPath)).split('/');
|
|
99
100
|
if (segments.includes('..')) {
|
|
100
101
|
throw new Error(
|
|
101
102
|
`extension path "${ref.absPath}" declared by "${ref.presetName}" must not contain ".." traversal`,
|