@lionrapid/cli 0.2.1 → 0.2.2

package/dist/config.js

@@ -9,10 +9,11 @@
  *  - `parseConfig(string)` is split from `loadConfig(path)` so the validator is
  *    unit-testable without touching the filesystem.
  */
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync, statSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { join } from 'node:path';
+import { basename, join } from 'node:path';
 import { parse as parseYaml } from 'yaml';
+import { discoverFiles } from './scan/discover.js';
 /** Translation file formats the CLI can parse/serialize. */
 export const FILE_FORMATS = [
     'json',
@@ -29,6 +30,10 @@ export const FILE_FORMATS = [
  * `target` path is one shared file and does not need a `{locale}` placeholder.
  */
 export const MULTI_LOCALE_FORMATS = new Set(['xcstrings']);
+/** True when a `files[].source` is a glob pattern rather than a concrete path. */
+export function isGlobSource(source) {
+    return /[*?]/.test(source);
+}
 /** Thrown when `lionrapid.yml` is missing, unparseable, or invalid. */
 export class ConfigError extends Error {
     issues;
@@ -227,16 +232,79 @@ function validateConfig(raw) {
                     entryNs = entry['namespace'];
                 }
             }
+            // flat (optional): only JSON/YAML re-nest dotted keys on serialize, so
+            // the flag is meaningless (and likely a config mistake) anywhere else.
+            let entryFlat;
+            if (entry['flat'] !== undefined) {
+                if (typeof entry['flat'] !== 'boolean') {
+                    issues.push({ path: `${base}.flat`, message: 'must be a boolean when set' });
+                }
+                else if (validFormat && format !== 'json' && format !== 'yaml') {
+                    issues.push({
+                        path: `${base}.flat`,
+                        message: `only meaningful for json/yaml (${String(format)} output is always flat)`,
+                    });
+                }
+                else {
+                    entryFlat = entry['flat'];
+                }
+            }
+            // Glob sources: {basename} must appear in target AND namespace (else the
+            // expansion is ambiguous — every match would collide); a concrete source
+            // must not use the token at all.
+            const src = entry['source'];
+            const tgt = entry['target'];
+            const glob = isNonEmptyString(src) && isGlobSource(src);
+            const srcHasBase = isNonEmptyString(src) && src.includes('{basename}');
+            const tgtHasBase = isNonEmptyString(tgt) && tgt.includes('{basename}');
+            const nsHasBase = entryNs?.includes('{basename}') ?? false;
+            if (srcHasBase) {
+                issues.push({
+                    path: `${base}.source`,
+                    message: 'the "{basename}" token is only valid in target/namespace',
+                });
+            }
+            if (glob) {
+                if (isNonEmptyString(tgt) && !tgtHasBase) {
+                    issues.push({
+                        path: `${base}.target`,
+                        message: 'must contain the "{basename}" token when source is a glob',
+                    });
+                }
+                if (!nsHasBase) {
+                    issues.push({
+                        path: `${base}.namespace`,
+                        message: 'required for a glob source and must contain the "{basename}" token',
+                    });
+                }
+            }
+            else {
+                if (tgtHasBase) {
+                    issues.push({
+                        path: `${base}.target`,
+                        message: 'the "{basename}" token is only valid when source is a glob',
+                    });
+                }
+                if (nsHasBase) {
+                    issues.push({
+                        path: `${base}.namespace`,
+                        message: 'the "{basename}" token is only valid when source is a glob',
+                    });
+                }
+            }
             // Only push a typed entry if its required fields are sound.
             if (validFormat &&
                 isNonEmptyString(entry['source']) &&
                 isNonEmptyString(entry['target']) &&
-                (isMultiLocale || entry['target'].includes('{locale}'))) {
+                (isMultiLocale || entry['target'].includes('{locale}')) &&
+                !srcHasBase &&
+                (glob ? tgtHasBase && nsHasBase : !tgtHasBase && !nsHasBase)) {
                 files.push({
                     format: format,
                     source: entry['source'],
                     target: entry['target'],
                     ...(entryNs ? { namespace: entryNs } : {}),
+                    ...(entryFlat !== undefined ? { flat: entryFlat } : {}),
                 });
             }
         });
@@ -270,6 +338,41 @@ export function parseConfig(rawYaml) {
     }
     return validateConfig(parsed);
 }
+/**
+ * Expand glob `files` entries into one concrete entry per matched file: the
+ * match's extension-less basename substitutes the `{basename}` token in
+ * `target` and `namespace`. Non-glob entries pass through untouched; matches
+ * come back sorted (deterministic expansion). A glob matching nothing warns
+ * instead of silently vanishing — a typo'd pattern must not no-op a push.
+ *
+ * Called at config load (loadOfflineContext / doctor), so every command
+ * downstream only ever sees concrete entries.
+ */
+export function expandGlobEntries(files, cwd, warn = (m) => console.error(m)) {
+    const out = [];
+    for (const entry of files) {
+        if (!isGlobSource(entry.source)) {
+            out.push(entry);
+            continue;
+        }
+        const matches = discoverFiles(cwd, { include: [entry.source] });
+        if (matches.length === 0) {
+            warn(`warning: files entry "${entry.source}" matched no files`);
+            continue;
+        }
+        for (const rel of matches) {
+            const base = basename(rel).replace(/\.[^.]*$/, '');
+            out.push({
+                format: entry.format,
+                source: rel,
+                target: entry.target.replaceAll('{basename}', base),
+                namespace: (entry.namespace ?? '{basename}').replaceAll('{basename}', base),
+                ...(entry.flat !== undefined ? { flat: entry.flat } : {}),
+            });
+        }
+    }
+    return out;
+}
 /** Read + parse + validate the config at `path`. */
 export function loadConfig(path) {
     if (!existsSync(path)) {
@@ -277,6 +380,55 @@ export function loadConfig(path) {
     }
     return parseConfig(readFileSync(path, 'utf8'));
 }
+/** Where the CLI reads/writes credentials: `~/.lionrapid/credentials`. */
+export function defaultCredentialsPath() {
+    return join(homedir(), '.lionrapid', 'credentials');
+}
+/** Paths already warned about this process — the perms warning fires once per file. */
+const warnedPerms = new Set();
+/** Warn (once per path) when the credentials file is readable by group/other. */
+function warnIfWorldReadable(path) {
+    if (process.platform === 'win32' || warnedPerms.has(path))
+        return;
+    if ((statSync(path).mode & 0o077) !== 0) {
+        warnedPerms.add(path);
+        console.error(`warning: ${path} is readable by other users — run: chmod 600 ${path}`);
+    }
+}
+/**
+ * Reject a key that can't travel in an HTTP header (fetch encodes headers as
+ * Latin-1 and throws an obscure ByteString error otherwise). The classic case
+ * is copying the dashboard's truncated key display, `sk_eng_…last4` — that
+ * ellipsis is U+2026, not part of the key.
+ */
+export function assertKeyCharset(key) {
+    const bad = /[^\x21-\x7e]/.exec(key);
+    if (bad) {
+        const c = bad[0];
+        const cp = c.codePointAt(0).toString(16).padStart(4, '0').toUpperCase();
+        throw new ApiKeyError(`The API key contains a character that can't be sent in an HTTP header: '${c}' (U+${cp}). ` +
+            'This usually means a truncated display value was copied — paste the full key.');
+    }
+    return key;
+}
+/**
+ * Server URLs that have a scoped entry in the credentials file. Lets `init`
+ * default its server to the one you just logged into instead of asking again.
+ */
+export function listCredentialServers(credentialsPath) {
+    const path = credentialsPath ?? defaultCredentialsPath();
+    if (!existsSync(path))
+        return [];
+    try {
+        const creds = JSON.parse(readFileSync(path, 'utf8'));
+        if (!isRecord(creds))
+            return [];
+        return Object.keys(creds).filter((k) => k !== 'default' && isNonEmptyString(creds[k]));
+    }
+    catch {
+        return [];
+    }
+}
 /**
  * Resolve the API key. Precedence:
  *   1. `LIONRAPID_API_KEY` environment variable
@@ -292,9 +444,10 @@ export function resolveApiKey(opts = {}) {
     const env = opts.env ?? process.env;
     const fromEnv = env['LIONRAPID_API_KEY'];
     if (isNonEmptyString(fromEnv))
-        return fromEnv.trim();
-    const credentialsPath = opts.credentialsPath ?? join(homedir(), '.lionrapid', 'credentials');
+        return assertKeyCharset(fromEnv.trim());
+    const credentialsPath = opts.credentialsPath ?? defaultCredentialsPath();
     if (existsSync(credentialsPath)) {
+        warnIfWorldReadable(credentialsPath);
         let creds;
         try {
             creds = JSON.parse(readFileSync(credentialsPath, 'utf8'));
@@ -305,11 +458,12 @@ export function resolveApiKey(opts = {}) {
         if (isRecord(creds)) {
             const scoped = opts.server ? creds[opts.server] : undefined;
             if (isNonEmptyString(scoped))
-                return scoped.trim();
+                return assertKeyCharset(scoped.trim());
             const fallback = creds['default'];
             if (isNonEmptyString(fallback)) {
-                if (!opts.server || isTrustedDefaultHost(opts.server))
-                    return fallback.trim();
+                if (!opts.server || isTrustedDefaultHost(opts.server)) {
+                    return assertKeyCharset(fallback.trim());
+                }
                 throw new ApiKeyError(`Refusing to send the "default" credential to unrecognized host ${opts.server}. ` +
                     `Add a server-scoped key for it first: lionrapid login --server ${opts.server}`);
             }

package/dist/types-gen/extract.js

@@ -52,6 +52,12 @@ function readBlock(text, open) {
     }
     return { body: text.slice(open + 1), end: text.length };
 }
+/**
+ * Only identifier-shaped labels may reach type position — with `types --server`
+ * the message text is server-controlled, and anything looser could break out of
+ * the `'label'` literal in the generated .d.ts.
+ */
+const SAFE_LABEL_RE = /^[A-Za-z0-9_]+$/;
 /** Extract top-level select option labels (excluding `other`). */
 function selectOptions(body) {
     // body looks like: `gender, select, male{…} female{…} other{…}` — strip the
@@ -69,7 +75,7 @@ function selectOptions(body) {
         while (i < rest.length && /\s/.test(rest[i]))
             i += 1;
         if (label && rest[i] === '{') {
-            if (label !== 'other')
+            if (label !== 'other' && SAFE_LABEL_RE.test(label))
                 options.push(label);
             let depth = 1;
             i += 1;

package/dist/types-gen/generate.js

@@ -5,7 +5,15 @@
  */
 import { extractParams } from './extract.js';
 function escapeKey(key) {
-    return key.replace(/\\/g, '\\\\').replace(/'/g, "\\'");
+    return (key
+        .replace(/\\/g, '\\\\')
+        .replace(/'/g, "\\'")
+        // Control chars and JS line terminators (incl. U+2028/29) would break out
+        // of the quoted key — keys are server-controlled under `types --server`.
+        // eslint-disable-next-line no-control-regex
+        .replace(/[\u0000-\u001f\u007f\u2028\u2029]/g, (c) => {
+        return `\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`;
+    }));
 }
 export function generateDts(keyTexts, options = {}) {
     const keys = [...keyTexts.keys()].sort();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lionrapid/cli",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "LionRapid CLI — sync translation files (iOS, Android, Flutter, JSON, YAML, PO) with the LionRapid backend",
   "type": "module",
   "main": "./dist/index.js",