@quonfig/cli 0.0.1

package/dist/codegen/schema-evaluator.d.ts

@@ -0,0 +1,37 @@
+import { ZodTypeSupported } from './types.js';
+/**
+ * Options for the secure schema validator
+ */
+export interface SecureSchemaValidatorOptions {
+    /**
+     * Whether to perform AST validation
+     */
+    astValidation?: boolean;
+    /**
+     * Maximum allowed AST nodes to prevent DoS attacks
+     */
+    maxAstNodes?: number;
+}
+/**
+ * Validates a JavaScript expression AST for potentially unsafe operations
+ *
+ * @param ast - The AST to validate
+ * @param parentMap - Map of nodes to their parent nodes
+ * @returns An object with validation result and optional error message
+ */
+export declare function validateAst(ast: any, parentMap: WeakMap<any, any>): {
+    error?: string;
+    isValid: boolean;
+};
+/**
+ * Securely evaluates a Zod schema string using AST validation
+ *
+ * @param schemaString - The schema string to evaluate
+ * @param options - Options for secure evaluation
+ * @returns The evaluated schema or an error
+ */
+export declare function secureEvaluateSchema(schemaString: string, options?: SecureSchemaValidatorOptions): {
+    error?: string;
+    schema?: ZodTypeSupported;
+    success: boolean;
+};

package/dist/codegen/schema-evaluator.js

@@ -0,0 +1,283 @@
+// TODO: We should resolve these any references to ensure generation is fully type-safe
+/* eslint-disable @typescript-eslint/no-explicit-any */
+import * as acorn from 'acorn';
+import * as walk from 'acorn-walk';
+import { z } from 'zod';
+/**
+ * Default options for the secure schema validator
+ */
+const DEFAULT_OPTIONS = {
+    astValidation: true,
+    maxAstNodes: 500,
+};
+/**
+ * Validates a JavaScript expression AST for potentially unsafe operations
+ *
+ * @param ast - The AST to validate
+ * @param parentMap - Map of nodes to their parent nodes
+ * @returns An object with validation result and optional error message
+ */
+export function validateAst(ast, parentMap) {
+    let isValid = true;
+    let error;
+    // Track what we've seen for detailed error messages
+    const issues = [];
+    // Count nodes to prevent DoS attacks with extremely large schemas
+    let nodeCount = 0;
+    // Helper function to check if an arrow function is used in a valid Zod method context
+    const isValidZodMethodArg = (node) => {
+        // Check if this node is an argument to a method call
+        const parent = parentMap.get(node);
+        if (parent && parent.type === 'CallExpression' && parent.callee && parent.callee.type === 'MemberExpression') {
+            // Check if method is on an object that's part of a valid Zod chain
+            const memberExpr = parent.callee;
+            // Allow methods like refine, transform, superRefine, etc.
+            const allowedMethods = ['refine', 'transform', 'superRefine', 'pipe', 'preprocess'];
+            if (memberExpr.property && memberExpr.property.name && allowedMethods.includes(memberExpr.property.name)) {
+                return true;
+            }
+        }
+        return false;
+    };
+    // Count all nodes separately to track complexity
+    walk.full(ast, () => {
+        nodeCount++;
+    });
+    // Custom AST walker to check for unsafe patterns
+    walk.simple(ast, {
+        ArrowFunctionExpression(node) {
+            // Allow arrow functions only in valid Zod method contexts
+            if (!isValidZodMethodArg(node)) {
+                issues.push(`Forbidden standalone arrow function`);
+                isValid = false;
+            }
+        },
+        // Block async/await
+        AwaitExpression() {
+            issues.push('Await expressions are not allowed');
+            isValid = false;
+        },
+        // Restrict function calls
+        CallExpression(node) {
+            if (node.callee.type === 'MemberExpression') {
+                const obj = node.callee.object;
+                if (obj.type === 'Identifier' && obj.name !== 'z') {
+                    issues.push(`Only calls to z.* methods are allowed, found: ${obj.name}`);
+                    isValid = false;
+                }
+            }
+            else if (node.callee.type === 'Identifier' && node.callee.name === 'require') {
+                issues.push(`Forbidden function call: require`);
+                isValid = false;
+            }
+            else if (node.callee.type === 'Identifier' && !['z'].includes(node.callee.name)) {
+                issues.push(`Forbidden function call: ${node.callee.name}`);
+                isValid = false;
+            }
+        },
+        // Block class declarations
+        ClassDeclaration() {
+            issues.push(`Forbidden node type: ClassDeclaration`);
+            isValid = false;
+        },
+        ClassExpression() {
+            issues.push(`Forbidden node type: ClassExpression`);
+            isValid = false;
+        },
+        ExportAllDeclaration() {
+            issues.push(`Forbidden operation: ExportAllDeclaration`);
+            isValid = false;
+        },
+        ExportDefaultDeclaration() {
+            issues.push(`Forbidden operation: ExportDefaultDeclaration`);
+            isValid = false;
+        },
+        ExportNamedDeclaration() {
+            issues.push(`Forbidden operation: ExportNamedDeclaration`);
+            isValid = false;
+        },
+        // Block function declarations
+        FunctionDeclaration() {
+            issues.push(`Forbidden node type: FunctionDeclaration`);
+            isValid = false;
+        },
+        FunctionExpression() {
+            issues.push(`Forbidden node type: FunctionExpression`);
+            isValid = false;
+        },
+        // Block access to global objects and require
+        Identifier(node) {
+            const parent = parentMap.get(node);
+            const forbiddenGlobals = [
+                'window',
+                'global',
+                'process',
+                'console',
+                'document',
+                'navigator',
+                'localStorage',
+                'fetch',
+                'XMLHttpRequest',
+                'WebSocket',
+                'eval',
+                'require',
+            ];
+            if (forbiddenGlobals.includes(node.name) && !(parent?.type === 'MemberExpression' && parent.property === node)) {
+                issues.push(`Forbidden global object: ${node.name}`);
+                isValid = false;
+            }
+        },
+        // Block imports, exports
+        ImportDeclaration() {
+            issues.push(`Forbidden operation: ImportDeclaration`);
+            isValid = false;
+        },
+        // Block dangerous property access
+        MemberExpression(node) {
+            if (node.property.type === 'Identifier') {
+                const dangerousProps = [
+                    'constructor',
+                    'prototype',
+                    '__proto__',
+                    '__defineGetter__',
+                    '__defineSetter__',
+                    '__lookupGetter__',
+                    '__lookupSetter__',
+                ];
+                if (dangerousProps.includes(node.property.name)) {
+                    issues.push(`Forbidden property access: ${node.property.name}`);
+                    isValid = false;
+                }
+            }
+        },
+    });
+    if (nodeCount > DEFAULT_OPTIONS.maxAstNodes) {
+        isValid = false;
+        issues.push(`Schema exceeds maximum allowed complexity (${nodeCount} nodes > ${DEFAULT_OPTIONS.maxAstNodes} limit)`);
+    }
+    if (!isValid) {
+        error = `Schema contains potentially unsafe operations: ${issues.join(', ')}`;
+    }
+    return { error, isValid };
+}
+/**
+ * Removes .describe() calls from the AST by filtering them out
+ * This is more robust than regex as it properly handles nested structures
+ *
+ * @param ast - The AST to process
+ * @param schemaString - The original schema string
+ * @returns The schema string with .describe() calls removed
+ */
+function removeDescribeCalls(ast, schemaString) {
+    const nodesToRemove = [];
+    // Walk the AST and find all .describe() calls
+    walk.simple(ast, {
+        CallExpression(node) {
+            if (node.callee.type === 'MemberExpression' &&
+                node.callee.property.type === 'Identifier' &&
+                node.callee.property.name === 'describe') {
+                // Mark the entire .describe(...) call for removal
+                // We want to remove from the dot before 'describe' to the closing paren
+                const start = node.callee.property.start - 1; // Include the dot
+                const end = node.end;
+                nodesToRemove.push({ start, end });
+            }
+        },
+    });
+    // Sort in reverse order so we can remove from the end without affecting earlier positions
+    nodesToRemove.sort((a, b) => b.start - a.start);
+    let result = schemaString;
+    for (const { start, end } of nodesToRemove) {
+        result = result.slice(0, Math.max(0, start)) + result.slice(Math.max(0, end));
+    }
+    return result;
+}
+/**
+ * Securely evaluates a Zod schema string using AST validation
+ *
+ * @param schemaString - The schema string to evaluate
+ * @param options - Options for secure evaluation
+ * @returns The evaluated schema or an error
+ */
+export function secureEvaluateSchema(schemaString, options = {}) {
+    const mergedOptions = { ...DEFAULT_OPTIONS, ...options };
+    const trimmedSchema = schemaString.trim();
+    try {
+        // Phase 1: AST Validation (Static Analysis)
+        if (mergedOptions.astValidation) {
+            // Parse the schema string into an AST
+            const ast = acorn.parse(trimmedSchema, {
+                allowAwaitOutsideFunction: false,
+                ecmaVersion: 2020,
+                sourceType: 'script',
+            });
+            // Create a map to track parent-child relationships
+            const parentMap = new WeakMap();
+            // Function to build parent-child relationships
+            function buildParentChildRelationships(node, parent = null) {
+                if (parent) {
+                    parentMap.set(node, parent);
+                }
+                // Recursively process all properties that might contain child nodes
+                for (const key in node) {
+                    if (Object.hasOwn(node, key)) {
+                        const child = node[key];
+                        if (child && typeof child === 'object') {
+                            if (Array.isArray(child)) {
+                                for (const item of child) {
+                                    if (item && typeof item === 'object') {
+                                        buildParentChildRelationships(item, node);
+                                    }
+                                }
+                            }
+                            else {
+                                buildParentChildRelationships(child, node);
+                            }
+                        }
+                    }
+                }
+            }
+            // Build the parent-child relationships
+            buildParentChildRelationships(ast);
+            // Validate the AST for security concerns
+            const { error, isValid } = validateAst(ast, parentMap);
+            if (!isValid) {
+                return { error, success: false };
+            }
+            // Remove .describe() calls after validation
+            const filteredSchema = removeDescribeCalls(ast, trimmedSchema);
+            // Phase 2: Execute with Function constructor
+            // We're deliberately avoiding VM modules due to security concerns
+            // The AST validation provides our primary security layer
+            // eslint-disable-next-line no-new-func
+            const constructSchema = new Function('z', `return ${filteredSchema}`);
+            const schema = constructSchema(z);
+            // Phase 3: Validate Result
+            if (!schema || typeof schema !== 'object' || !('_def' in schema)) {
+                return {
+                    error: 'The provided string did not evaluate to a valid Zod schema',
+                    success: false,
+                };
+            }
+            return { schema, success: true };
+        }
+        // If AST validation is disabled, just execute directly (not recommended)
+        // eslint-disable-next-line no-new-func
+        const constructSchema = new Function('z', `return ${trimmedSchema}`);
+        const schema = constructSchema(z);
+        // Phase 3: Validate Result
+        if (!schema || typeof schema !== 'object' || !('_def' in schema)) {
+            return {
+                error: 'The provided string did not evaluate to a valid Zod schema',
+                success: false,
+            };
+        }
+        return { schema, success: true };
+    }
+    catch (error) {
+        return {
+            error: error instanceof Error ? `Evaluation error: ${error.message}` : 'Unknown evaluation error',
+            success: false,
+        };
+    }
+}

package/dist/codegen/schema-extractor.d.ts

@@ -0,0 +1,24 @@
+import { z } from 'zod';
+import { type Config, type ConfigFile } from './types.js';
+export type DurationTypeMap = () => z.ZodTypeAny;
+export declare class SchemaExtractor {
+    private log;
+    constructor(log: (category: string | unknown, message?: unknown) => void);
+    execute({ config, configFile, durationTypeMap, }: {
+        config: Config;
+        configFile: ConfigFile;
+        durationTypeMap?: DurationTypeMap;
+    }): z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+    private createZodFunctionFromMustacheStrings;
+    private getAllJsonValues;
+    /**
+     * Get all string values at a specific location in the config
+     * @param config The configuration to extract strings from
+     * @param location Array of keys representing the path to look for strings. Empty array for direct string values.
+     * @returns Array of strings found at the specified location
+     */
+    private getAllStringsAtLocation;
+    private inferFromConfig;
+    private replaceStringsWithMustache;
+    private resolveUserSchema;
+}

package/dist/codegen/schema-extractor.js

@@ -0,0 +1,265 @@
+import { z } from 'zod';
+import { jsonSchemaToZod, isLegacySchemaWrapper } from './json-schema-to-zod.js';
+import { JsonToZodMapper } from './language-mappers/json-to-zod-mapper.js';
+import { ZodToStringMapper } from './language-mappers/zod-to-string-mapper.js';
+import { MustacheExtractor } from './mustache-extractor.js';
+import { secureEvaluateSchema } from './schema-evaluator.js';
+export class SchemaExtractor {
+    log;
+    constructor(log) {
+        this.log = log;
+    }
+    execute({ config, configFile, durationTypeMap, }) {
+        const userDefinedSchema = this.resolveUserSchema(config, configFile);
+        const schemaWithoutMustache = userDefinedSchema ?? this.inferFromConfig(config, durationTypeMap);
+        return this.replaceStringsWithMustache(schemaWithoutMustache, config);
+    }
+    createZodFunctionFromMustacheStrings(strings) {
+        if (strings.length === 0) {
+            return z.string();
+        }
+        if (strings.length > 1) {
+            // De-dup exact schemas
+            const schemas = {};
+            strings.forEach((str) => {
+                const schema = MustacheExtractor.extractSchema(str, this.log);
+                const stringSchema = new ZodToStringMapper().renderField(schema);
+                schemas[stringSchema] = schema;
+            });
+            const schemaResults = Object.values(schemas);
+            // If the schema is empty (no properties), just return basic string
+            const noSchemasPresent = schemaResults.every((s) => {
+                if (s instanceof z.ZodObject) {
+                    return Object.keys(s.shape).length === 0;
+                }
+                return false;
+            });
+            if (noSchemasPresent) {
+                return z.string();
+            }
+            // Return an explicit function if we have only one schema defined
+            if (schemaResults.length === 1) {
+                return z.function({ input: z.tuple([schemaResults[0]]), output: z.string() });
+            }
+            // Return a function with a union of schemas if we have multiple defined
+            return z.function({
+                input: z.tuple([z.union(schemaResults)]),
+                output: z.string(),
+            });
+        }
+        const schema = MustacheExtractor.extractSchema(strings[0], this.log);
+        // If the schema is empty (no properties), just return basic string
+        if (schema instanceof z.ZodObject && Object.keys(schema.shape).length === 0) {
+            return z.string();
+        }
+        return z.function({ input: z.tuple([schema]), output: z.string() });
+    }
+    getAllJsonValues(config) {
+        return config.rows.flatMap((row) => row.values.flatMap((valueObj) => {
+            if (config.valueType === 'JSON') {
+                // Try to parse JSON from json field
+                if (valueObj.value.json?.json) {
+                    try {
+                        return [JSON.parse(valueObj.value.json.json)];
+                    }
+                    catch (error) {
+                        console.warn(`Failed to parse JSON for ${config.key}:`, error);
+                    }
+                }
+                // Try to parse JSON from string field
+                else if (valueObj.value.string) {
+                    try {
+                        return [JSON.parse(valueObj.value.string)];
+                    }
+                    catch (error) {
+                        console.warn(`Failed to parse JSON string for ${config.key}:`, error);
+                    }
+                }
+            }
+            return [];
+        }));
+    }
+    /**
+     * Get all string values at a specific location in the config
+     * @param config The configuration to extract strings from
+     * @param location Array of keys representing the path to look for strings. Empty array for direct string values.
+     * @returns Array of strings found at the specified location
+     */
+    getAllStringsAtLocation(config, location) {
+        if (location.length === 0) {
+            // For empty location, just get direct string values
+            return config.rows.flatMap((row) => row.values.flatMap((valueObj) => (valueObj.value.string ? [valueObj.value.string] : [])));
+        }
+        // For JSON values, we need to traverse the object
+        return config.rows.flatMap((row) => row.values.flatMap((valueObj) => {
+            let jsonContent = null;
+            // Try to parse JSON from either json field or string field
+            if (valueObj.value.json?.json) {
+                try {
+                    jsonContent = JSON.parse(valueObj.value.json.json);
+                }
+                catch (error) {
+                    console.warn(`Failed to parse JSON for ${config.key}:`, error);
+                    return [];
+                }
+            }
+            else if (valueObj.value.string && config.valueType === 'JSON') {
+                try {
+                    jsonContent = JSON.parse(valueObj.value.string);
+                }
+                catch (error) {
+                    console.warn(`Failed to parse JSON string for ${config.key}:`, error);
+                    return [];
+                }
+            }
+            if (!jsonContent)
+                return [];
+            // Traverse the JSON object to the specified location
+            let current = jsonContent;
+            for (const key of location) {
+                if (current && typeof current === 'object' && key in current) {
+                    current = current[key];
+                }
+                else {
+                    return [];
+                }
+            }
+            // If we found a string at the location, return it
+            return typeof current === 'string' ? [current] : [];
+        }));
+    }
+    inferFromConfig(config, durationTypeMap) {
+        const { key, valueType } = config;
+        switch (valueType) {
+            case 'STRING': {
+                return z.string();
+            }
+            case 'BOOL': {
+                return z.boolean();
+            }
+            case 'INT': {
+                return z.number().int();
+            }
+            case 'DOUBLE': {
+                return z.number();
+            }
+            case 'STRING_LIST': {
+                return z.array(z.string());
+            }
+            case 'DURATION': {
+                return durationTypeMap?.() ?? z.number();
+            }
+            case 'JSON': {
+                const jsonValues = this.getAllJsonValues(config);
+                this.log('JSON values:', JSON.stringify(jsonValues, null, 2));
+                if (jsonValues.length > 0) {
+                    try {
+                        // De-dup exact schemas
+                        const schemas = {};
+                        jsonValues.forEach((json) => {
+                            const schema = new JsonToZodMapper().resolve(json);
+                            const stringSchema = new ZodToStringMapper().renderField(schema);
+                            schemas[stringSchema] = schema;
+                        });
+                        const schemaResults = Object.values(schemas);
+                        // Return a single schema explicitly if we have only one defined
+                        if (schemaResults.length === 1) {
+                            return schemaResults[0];
+                        }
+                        // Return a union of schemas if we have multiple defined
+                        return z.union(schemaResults);
+                    }
+                    catch (error) {
+                        console.warn(`Error inferring JSON schema for ${key}:`, error);
+                    }
+                }
+                return z.union([z.array(z.any()), z.record(z.string(), z.any())]);
+            }
+            case 'LOG_LEVEL': {
+                return z.enum(['TRACE', 'DEBUG', 'INFO', 'WARN', 'ERROR']);
+            }
+            default: {
+                return z.any();
+            }
+        }
+    }
+    replaceStringsWithMustache(schema, config, schemaLocation = []) {
+        const typeName = schema.def.type;
+        // Handle enums explicitly
+        if (typeName === 'enum') {
+            return schema;
+        }
+        // Check for both direct string and optional string
+        if (schema instanceof z.ZodString ||
+            (schema instanceof z.ZodOptional && schema.def.innerType instanceof z.ZodString)) {
+            const stringsAtLocation = this.getAllStringsAtLocation(config, schemaLocation);
+            if (schema instanceof z.ZodOptional) {
+                return this.createZodFunctionFromMustacheStrings(stringsAtLocation).optional();
+            }
+            return this.createZodFunctionFromMustacheStrings(stringsAtLocation);
+        }
+        if (schema instanceof z.ZodObject) {
+            const newShape = {};
+            for (const [key, value] of Object.entries(schema.shape)) {
+                newShape[key] = this.replaceStringsWithMustache(value, config, [...schemaLocation, key]);
+            }
+            return z.object(newShape);
+        }
+        // NOTE: no support for Mustache in Arrays or Unions
+        // For all other types, just return as is
+        return schema;
+    }
+    // @ts-expect-error OK with not explicitly returning undefined
+    resolveUserSchema(config, configFile) {
+        const { schemaKey } = config;
+        if (!schemaKey) {
+            return;
+        }
+        const schemaFile = configFile.schemas?.find((schema) => {
+            const schemaPath = schema.path.replace(/\\/g, '/');
+            const derivedKey = schemaPath.split('/').at(-1)?.replace(/\.json$/, '');
+            return derivedKey === schemaKey;
+        });
+        if (schemaFile) {
+            const schema = schemaFile.schema;
+            if (isLegacySchemaWrapper(schema)) {
+                const legacySchema = schema;
+                const defaultSection = legacySchema.default;
+                const rules = Array.isArray(defaultSection?.rules) ? defaultSection.rules : [];
+                const firstRule = rules[0];
+                const value = firstRule?.value;
+                const legacySchemaValue = value?.schema;
+                const schemaStr = legacySchemaValue?.schema;
+                if (typeof schemaStr === 'string') {
+                    const result = secureEvaluateSchema(schemaStr);
+                    if (result.success && result.schema) {
+                        this.log(`Successfully parsed legacy schema wrapper: ${schemaKey}`);
+                        return result.schema;
+                    }
+                    console.warn(`Failed to parse legacy schema wrapper ${schemaKey}: ${result.error}`);
+                }
+            }
+            else {
+                this.log(`Successfully parsed JSON Schema document: ${schemaKey}`);
+                return jsonSchemaToZod(schema);
+            }
+        }
+        const legacySchemaConfig = configFile.configs.find((c) => c.key === schemaKey && c.configType === 'SCHEMA');
+        if (!legacySchemaConfig) {
+            return;
+        }
+        for (const row of legacySchemaConfig.rows) {
+            for (const valueObj of row.values) {
+                if (valueObj.value.schema?.schema) {
+                    const schemaStr = valueObj.value.schema.schema;
+                    const result = secureEvaluateSchema(schemaStr);
+                    if (result.success && result.schema) {
+                        this.log(`Successfully parsed schema from schema config: ${legacySchemaConfig.key}`);
+                        return result.schema;
+                    }
+                    console.warn(`Failed to parse schema from schema config ${legacySchemaConfig.key}: ${result.error}`);
+                }
+            }
+        }
+    }
+}

package/dist/codegen/types.d.ts

@@ -0,0 +1,44 @@
+import { z } from 'zod';
+import { $ZodFunctionArgs, $ZodFunctionOut, util } from 'zod/v4/core';
+export declare enum SupportedLanguage {
+    Node = "node-ts",
+    React = "react-ts"
+}
+export interface ConfigValue {
+    value: {
+        bool?: boolean;
+        int?: number;
+        json?: {
+            json: string;
+        };
+        logLevel?: string;
+        schema?: {
+            schema: string;
+            schemaType: string;
+        };
+        string?: string;
+    };
+}
+export interface SchemaFile {
+    path: string;
+    schema: Record<string, unknown>;
+}
+export interface ConfigRow {
+    values: ConfigValue[];
+}
+export interface Config {
+    configType: 'CONFIG' | 'FEATURE_FLAG' | 'SCHEMA';
+    key: string;
+    rows: ConfigRow[];
+    schemaKey?: string;
+    sendToClientSdk?: boolean;
+    valueType: 'BOOL' | 'DOUBLE' | 'DURATION' | 'INT' | 'JSON' | 'LOG_LEVEL' | 'STRING' | 'STRING_LIST';
+}
+export interface ConfigFile {
+    configs: Config[];
+    schemas?: SchemaFile[];
+}
+/**
+ * Supported Zod schema types for codegen
+ */
+export type ZodTypeSupported = z.ZodAny | z.ZodArray<z.ZodTypeAny> | z.ZodBoolean | z.ZodDefault<z.ZodTypeAny> | z.ZodEnum<util.EnumLike> | z.ZodFunction<$ZodFunctionArgs, $ZodFunctionOut> | z.ZodNull | z.ZodLiteral<string | number | boolean | null> | z.ZodNumber | z.ZodObject<z.ZodRawShape> | z.ZodOptional<z.ZodTypeAny> | z.ZodRecord | z.ZodNever | z.ZodString | z.ZodTuple | z.ZodUndefined | z.ZodUnion<[z.ZodTypeAny, ...z.ZodTypeAny[]]> | z.ZodUnknown | z.ZodNullable<z.ZodTypeAny> | z.ZodTypeAny;

package/dist/codegen/types.js

@@ -0,0 +1,5 @@
+export var SupportedLanguage;
+(function (SupportedLanguage) {
+    SupportedLanguage["Node"] = "node-ts";
+    SupportedLanguage["React"] = "react-ts";
+})(SupportedLanguage || (SupportedLanguage = {}));