@kubb/mcp 5.0.6 → 5.2.0

package/dist/index.cjs

@@ -38,7 +38,7 @@ let node_module = require("node:module");
 let node_process = require("node:process");
 node_process = __toESM(node_process, 1);
 //#region package.json
-var version = "5.0.6";
+var version = "5.2.0";
 //#endregion
 //#region src/schemas/generateSchema.ts
 const generateSchema = valibot.object({
@@ -4362,12 +4362,12 @@ var import_jiti = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((expor
 					value: E
 				});
 			}, je.readInt = function(e, t, i) {
-				for (var n = this.options.ecmaVersion >= 12 && void 0 === t, a = i && 48 === this.input.charCodeAt(this.pos), c = this.pos, l = 0, y = 0, E = 0, w = null == t ? Infinity : t; E < w; ++E, ++this.pos) {
+				for (var n = this.options.ecmaVersion >= 12 && void 0 === t, a = i && 48 === this.input.charCodeAt(this.pos), c = this.pos, l = 0, y = 0, E = 0, w = null == t ? 1 / 0 : t; E < w; ++E, ++this.pos) {
 					var C = this.input.charCodeAt(this.pos);
 					var S = void 0;
 					if (n && 95 === C) a && this.raiseRecoverable(this.pos, "Numeric separator is not allowed in legacy octal numeric literals"), 95 === y && this.raiseRecoverable(this.pos, "Numeric separator must be exactly one underscore"), 0 === E && this.raiseRecoverable(this.pos, "Numeric separator is not allowed at the first of digits"), y = C;
 					else {
-						if ((S = C >= 97 ? C - 97 + 10 : C >= 65 ? C - 65 + 10 : C >= 48 && C <= 57 ? C - 48 : Infinity) >= e) break;
+						if ((S = C >= 97 ? C - 97 + 10 : C >= 65 ? C - 65 + 10 : C >= 48 && C <= 57 ? C - 48 : 1 / 0) >= e) break;
 						y = C, l = l * e + S;
 					}
 				}
@@ -4388,8 +4388,8 @@ var import_jiti = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((expor
 					return ++this.pos, isIdentifierStart(this.fullCharCodeAtPos()) && this.raise(this.pos, "Identifier directly after number"), this.finishToken(O.num, a);
 				}
 				i && /[89]/.test(this.input.slice(t, this.pos)) && (i = !1), 46 !== n || i || (++this.pos, this.readInt(10), n = this.input.charCodeAt(this.pos)), 69 !== n && 101 !== n || i || (43 !== (n = this.input.charCodeAt(++this.pos)) && 45 !== n || ++this.pos, null === this.readInt(10) && this.raise(t, "Invalid number")), isIdentifierStart(this.fullCharCodeAtPos()) && this.raise(this.pos, "Identifier directly after number");
-				var c;
-				var l = (c = this.input.slice(t, this.pos), i ? parseInt(c, 8) : parseFloat(c.replace(/_/g, "")));
+				var c = this.input.slice(t, this.pos);
+				var l = i ? parseInt(c, 8) : parseFloat(c.replace(/_/g, ""));
 				return this.finishToken(O.num, l);
 			}, je.readCodePoint = function() {
 				var e;
@@ -6011,6 +6011,29 @@ function createModuleLoader() {
 	} };
 }
 //#endregion
+//#region ../../internals/utils/src/fs.ts
+/**
+* Resolves to `true` when `path` is `parent` itself or nested inside it. Both sides are resolved
+* to absolute paths first, so relative and `..`-containing inputs compare correctly.
+*
+* Guards a destructive or an out-of-tree operation: before wiping an output directory, check that
+* it does not contain the project root, and before loading a path a caller supplied, check that it
+* did not escape the directory it is allowed to read from.
+*
+* @example
+* isPathInside('./src/gen', '.')   // true  — nested inside the root
+* isPathInside('.', '.')           // true  — the same directory counts as inside
+* isPathInside('.', './src/gen')   // false — the root is not inside its own output
+* isPathInside('../other', '.')    // false — escapes the root
+*/
+function isPathInside(path, parent) {
+	const resolvedPath = (0, node_path.resolve)(path);
+	const resolvedParent = (0, node_path.resolve)(parent);
+	if (resolvedPath === resolvedParent) return true;
+	const rel = (0, node_path.relative)(resolvedParent, resolvedPath);
+	return rel !== "" && !rel.startsWith("..") && !(0, node_path.isAbsolute)(rel);
+}
+//#endregion
 //#region ../../internals/utils/src/promise.ts
 /** Returns `true` when `result` is a thenable `Promise`.
 *
@@ -6082,8 +6105,7 @@ async function loadUserConfig(configPath, { notify }) {
 		}
 		const base = node_path.default.resolve(process.cwd());
 		const resolvedConfigPath = node_path.default.resolve(base, configPath);
-		const relative = node_path.default.relative(base, resolvedConfigPath);
-		if (relative.startsWith("..") || node_path.default.isAbsolute(relative)) {
+		if (!isPathInside(resolvedConfigPath, base)) {
 			const msg = "Invalid config file path: must be within the current working directory";
 			await notify("CONFIG_ERROR", msg);
 			throw new Error(msg);