@piyushdoorwar/yamlet 1.1.14 → 1.12.0

package/dist/yamlet.js

@@ -293,6 +293,71 @@ function yamletUserAgent() {
 
 // core/src/oauth2.ts
 import { request } from "undici";
+var OAuth2Error = class extends Error {
+  constructor(kind, message, status) {
+    super(message);
+    this.kind = kind;
+    this.status = status;
+    this.name = "OAuth2Error";
+  }
+  kind;
+  status;
+};
+var UNRESOLVED = /\{\{\s*([^{}\s]+)\s*\}\}/;
+function resolveUrl(label, raw, resolve2) {
+  const url = resolve2(raw).trim();
+  if (!url) throw new OAuth2Error("config", `${label} is not set`);
+  const missing = UNRESOLVED.exec(url);
+  if (missing) throw new OAuth2Error("config", `${label} uses {{${missing[1]}}}, which is not defined in any active scope`);
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new OAuth2Error("config", `${label} is not a valid URL: ${url}`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new OAuth2Error("config", `${label} must start with http:// or https://`);
+  return url;
+}
+var NETWORK_HINTS = {
+  ENOTFOUND: "the host name could not be found",
+  EAI_AGAIN: "the host name could not be resolved",
+  ECONNREFUSED: "the connection was refused",
+  ECONNRESET: "the connection was reset",
+  ETIMEDOUT: "the connection timed out",
+  UND_ERR_CONNECT_TIMEOUT: "the connection timed out",
+  UND_ERR_HEADERS_TIMEOUT: "the server took too long to answer",
+  UND_ERR_BODY_TIMEOUT: "the server took too long to answer",
+  CERT_HAS_EXPIRED: "the server's TLS certificate has expired",
+  DEPTH_ZERO_SELF_SIGNED_CERT: "the server uses a self-signed TLS certificate",
+  SELF_SIGNED_CERT_IN_CHAIN: "the server's TLS certificate chain is self-signed",
+  UNABLE_TO_VERIFY_LEAF_SIGNATURE: "the server's TLS certificate could not be verified"
+};
+function networkError(url, err) {
+  const e = err;
+  const code = e?.cause?.code ?? e?.code;
+  const reason = (code && NETWORK_HINTS[code]) ?? e?.cause?.message ?? e?.message ?? String(err);
+  let host = url;
+  try {
+    host = new URL(url).host;
+  } catch {
+  }
+  return new OAuth2Error("network", `Could not reach the token URL (${host}): ${reason}`);
+}
+function providerError(status, text) {
+  let detail = "";
+  try {
+    const o = JSON.parse(text);
+    const err = typeof o.error === "string" ? o.error : typeof o.message === "string" ? o.message : "";
+    const desc = typeof o.error_description === "string" ? o.error_description : "";
+    detail = [err, desc].filter(Boolean).join(": ");
+  } catch {
+    const form = new URLSearchParams(text);
+    if (form.get("error")) detail = [form.get("error"), form.get("error_description")].filter(Boolean).join(": ");
+  }
+  if (!detail) detail = text.trim().replace(/\s+/g, " ").slice(0, 300) || "empty response";
+  const hint = /invalid_client/i.test(detail) ? " Check the client ID and secret, and whether the provider expects them in the Basic auth header or the request body." : /invalid_grant/i.test(detail) ? " The username, password, code or refresh token was rejected." : /invalid_scope/i.test(detail) ? " Check the scope value." : "";
+  return new OAuth2Error("provider", `The token endpoint answered ${status}: ${detail}.${hint}`, status);
+}
 function parseTokenBody(text, contentType) {
   let raw;
   if (contentType.includes("x-www-form-urlencoded") || !text.trim().startsWith("{") && text.includes("access_token=")) {
@@ -301,14 +366,14 @@ function parseTokenBody(text, contentType) {
     try {
       raw = JSON.parse(text);
     } catch {
-      throw new Error(`Token endpoint returned a non-JSON response: ${text.slice(0, 200)}`);
+      throw new OAuth2Error("provider", `The token endpoint did not return JSON: ${text.trim().slice(0, 200) || "empty response"}`);
     }
   }
   const o = raw ?? {};
   const accessToken = typeof o.access_token === "string" ? o.access_token : "";
   if (!accessToken) {
-    const err = o.error ? `${o.error}${o.error_description ? `: ${o.error_description}` : ""}` : "no access_token in response";
-    throw new Error(`Token request failed: ${err}`);
+    const err = o.error ? `${o.error}${o.error_description ? `: ${o.error_description}` : ""}` : "the response has no access_token";
+    throw new OAuth2Error("provider", `Token request failed: ${err}`);
   }
   const expires = Number(o.expires_in);
   const result = { accessToken, raw };
@@ -318,8 +383,7 @@ function parseTokenBody(text, contentType) {
   return result;
 }
 async function requestToken(cfg, resolve2, form, opts = {}) {
-  const url = resolve2(cfg.accessTokenUrl).trim();
-  if (!url) throw new Error("OAuth 2.0 access token URL is not set");
+  const url = resolveUrl("Token URL", cfg.accessTokenUrl, resolve2);
   const clientId = resolve2(cfg.clientId);
   const clientSecret = resolve2(cfg.clientSecret);
   const headers = {
@@ -333,17 +397,22 @@ async function requestToken(cfg, resolve2, form, opts = {}) {
   } else if (clientId || clientSecret) {
     headers.authorization = `Basic ${Buffer.from(`${clientId}:${clientSecret}`, "utf8").toString("base64")}`;
   }
-  const res = await request(url, {
-    method: "POST",
-    headers,
-    body: body.toString(),
-    dispatcher: opts.dispatcher ?? defaultAgent(),
-    signal: opts.signal
-  });
-  const text = await res.body.text();
-  if (res.statusCode < 200 || res.statusCode >= 300) {
-    throw new Error(`Token request failed (${res.statusCode}): ${text.slice(0, 500)}`);
+  let res;
+  let text;
+  try {
+    res = await request(url, {
+      method: "POST",
+      headers,
+      body: body.toString(),
+      dispatcher: opts.dispatcher ?? defaultAgent(),
+      signal: opts.signal
+    });
+    text = await res.body.text();
+  } catch (err) {
+    if (opts.signal?.aborted) throw err;
+    throw networkError(url, err);
   }
+  if (res.statusCode < 200 || res.statusCode >= 300) throw providerError(res.statusCode, text);
   const ct = res.headers["content-type"];
   return parseTokenBody(text, String(Array.isArray(ct) ? ct[0] : ct ?? ""));
 }
@@ -1473,7 +1542,7 @@ ${opts.script}
 
 // core/src/requestExecutor.ts
 var MAX_REDIRECTS = 10;
-var NETWORK_HINTS = {
+var NETWORK_HINTS2 = {
   ENOTFOUND: "host name could not be resolved",
   EAI_AGAIN: "DNS lookup timed out",
   ECONNREFUSED: "connection refused",
@@ -1507,8 +1576,8 @@ var errMessage2 = (e) => {
     if (msg && msg !== "fetch failed") add(msg);
     const hasInner = Array.isArray(err.errors) && err.errors.length > 0;
     if (code && !msg && hasInner) {
-    } else if (code && !msg.includes(code)) add(NETWORK_HINTS[code] ? `${code}: ${NETWORK_HINTS[code]}` : code);
-    else if (code && NETWORK_HINTS[code]) add(`(${NETWORK_HINTS[code]})`);
+    } else if (code && !msg.includes(code)) add(NETWORK_HINTS2[code] ? `${code}: ${NETWORK_HINTS2[code]}` : code);
+    else if (code && NETWORK_HINTS2[code]) add(`(${NETWORK_HINTS2[code]})`);
     if (Array.isArray(err.errors)) for (const inner of err.errors.slice(0, 3)) walk2(inner, depth + 1);
     walk2(err.cause, depth + 1);
   };
@@ -3364,7 +3433,7 @@ function ensureUniqueIds(ws, rel) {
 }
 
 // cli/src/index.ts
-var VERSION = true ? "1.1.14" : "0.0.0-dev";
+var VERSION = true ? "1.12.0" : "0.0.0-dev";
 setYamletVersion(VERSION);
 var CliError = class extends Error {
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piyushdoorwar/yamlet",
-  "version": "1.1.14",
+  "version": "1.12.0",
   "description": "Run Yamlet API collections (Git-friendly YAML) from the command line or CI.",
   "type": "module",
   "bin": {