@rdlabo/workers-hono-kit 0.12.0-beta.pr48.sha371f5792ce8a → 0.12.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rdlabo/workers-hono-kit",
-  "version": "0.12.0-beta.pr48.sha371f5792ce8a",
+  "version": "0.12.2",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -108,8 +108,8 @@
   },
   "peerDependencies": {
     "@hono/zod-validator": "^0.8.0",
-    "@rdlabo/workers-mysql": "0.1.0-beta.pr48.sha371f5792ce8a",
-    "@rdlabo/workers-timezone": "0.1.0-beta.pr48.sha371f5792ce8a",
+    "@rdlabo/workers-mysql": "^0.12.2",
+    "@rdlabo/workers-timezone": "^0.12.2",
     "ai": "^6.0.0",
     "ai-gateway-provider": "^3.1.0",
     "aws4fetch": "^1.0.20",

package/scripts/parse-npm-pack-json.mjs

@@ -0,0 +1,84 @@
+/**
+ * Return the safe tarball basename from `npm pack --json` output.
+ *
+ * npm 11 emits an array of pack records. npm 12 with `--workspace` emits an
+ * object keyed by package name. Both shapes are accepted; the caller must
+ * supply the exact workspace package name to select.
+ *
+ * @param {unknown} packJson Parsed `npm pack --json` stdout.
+ * @param {string} workspaceName Exact package name expected in the output.
+ * @returns {string} Basename of the packed `.tgz` (no directory separators).
+ */
+export function parseNpmPackFilename(packJson, workspaceName) {
+  if (typeof workspaceName !== 'string' || workspaceName.length === 0) {
+    throw new Error('Expected a non-empty workspace package name');
+  }
+
+  const records = collectPackRecords(packJson);
+  const matches = records.filter((record) => record.name === workspaceName);
+
+  if (matches.length === 0) {
+    throw new Error(`npm pack JSON is missing a record for ${workspaceName}`);
+  }
+  if (matches.length > 1) {
+    throw new Error(`npm pack JSON has ${matches.length} records for ${workspaceName}`);
+  }
+
+  const { filename } = matches[0];
+  if (!isSafeTarballBasename(filename)) {
+    throw new Error(
+      `npm pack JSON for ${workspaceName} has an unsafe or invalid filename: ${JSON.stringify(filename)}`,
+    );
+  }
+  return filename;
+}
+
+/**
+ * @param {unknown} packJson
+ * @returns {Array<{ name?: unknown, filename?: unknown }>}
+ */
+function collectPackRecords(packJson) {
+  if (Array.isArray(packJson)) {
+    return packJson.map(asPackRecord);
+  }
+  if (packJson !== null && typeof packJson === 'object') {
+    return Object.values(packJson).map(asPackRecord);
+  }
+  throw new Error(`npm pack JSON must be an array or object, received ${describeValue(packJson)}`);
+}
+
+/**
+ * @param {unknown} value
+ * @returns {{ name?: unknown, filename?: unknown }}
+ */
+function asPackRecord(value) {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+    throw new Error(`npm pack JSON contains an invalid record: ${describeValue(value)}`);
+  }
+  return /** @type {{ name?: unknown, filename?: unknown }} */ (value);
+}
+
+/**
+ * @param {unknown} filename
+ * @returns {filename is string}
+ */
+function isSafeTarballBasename(filename) {
+  return (
+    typeof filename === 'string' &&
+    filename.length > 4 &&
+    filename.endsWith('.tgz') &&
+    !filename.includes('/') &&
+    !filename.includes('\\') &&
+    !filename.includes('..')
+  );
+}
+
+/**
+ * @param {unknown} value
+ * @returns {string}
+ */
+function describeValue(value) {
+  if (value === null) return 'null';
+  if (Array.isArray(value)) return 'array';
+  return typeof value;
+}

package/scripts/parse-npm-pack-json.test.mjs

@@ -0,0 +1,68 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { parseNpmPackFilename } from './parse-npm-pack-json.mjs';
+
+const workspace = '@rdlabo/workers-timezone';
+const filename = 'rdlabo-workers-timezone-0.12.1.tgz';
+const record = {
+  name: workspace,
+  filename,
+  packed: '/tmp/rdlabo-workers-timezone-0.12.1.tgz',
+};
+
+test('parses npm 11 array pack JSON', () => {
+  assert.equal(parseNpmPackFilename([record], workspace), filename);
+});
+
+test('parses npm 12 object pack JSON keyed by package name', () => {
+  assert.equal(parseNpmPackFilename({ [workspace]: record }, workspace), filename);
+});
+
+test('rejects malformed pack JSON shapes', () => {
+  assert.throws(() => parseNpmPackFilename(null, workspace), /array or object/);
+  assert.throws(() => parseNpmPackFilename('nope', workspace), /array or object/);
+  assert.throws(() => parseNpmPackFilename([{ name: workspace }], workspace), /unsafe or invalid filename/);
+  assert.throws(() => parseNpmPackFilename([null], workspace), /invalid record/);
+});
+
+test('rejects a mismatched workspace name', () => {
+  assert.throws(
+    () => parseNpmPackFilename([record], '@rdlabo/workers-mysql'),
+    /missing a record for @rdlabo\/workers-mysql/,
+  );
+  assert.throws(
+    () => parseNpmPackFilename({ [workspace]: record }, '@rdlabo/workers-mysql'),
+    /missing a record for @rdlabo\/workers-mysql/,
+  );
+});
+
+test('rejects ambiguous multiple matching records', () => {
+  assert.throws(() => parseNpmPackFilename([record, { ...record }], workspace), /2 records/);
+  assert.throws(
+    () =>
+      parseNpmPackFilename(
+        {
+          [workspace]: record,
+          '@rdlabo/workers-timezone-dup': { ...record },
+        },
+        workspace,
+      ),
+    /2 records/,
+  );
+});
+
+test('rejects unsafe tarball filenames', () => {
+  for (const unsafe of [
+    '../rdlabo-workers-timezone-0.12.1.tgz',
+    'dir/rdlabo-workers-timezone-0.12.1.tgz',
+    'dir\\rdlabo-workers-timezone-0.12.1.tgz',
+    'rdlabo-workers-timezone-0.12.1.tar.gz',
+    '',
+    12,
+  ]) {
+    assert.throws(
+      () => parseNpmPackFilename([{ name: workspace, filename: unsafe }], workspace),
+      /unsafe or invalid filename/,
+    );
+  }
+});

package/scripts/workspace-package-smoke.mjs

@@ -3,6 +3,7 @@ import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:
 import { tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { parseNpmPackFilename } from './parse-npm-pack-json.mjs';
 
 const root = resolve(fileURLToPath(new URL('../../..', import.meta.url)));
 const temporaryDirectory = mkdtempSync(join(tmpdir(), 'workers-workspace-smoke-'));
@@ -20,7 +21,7 @@ function pack(workspace) {
       env: commandEnvironment,
     }),
   );
-  return join(temporaryDirectory, result[0].filename);
+  return join(temporaryDirectory, parseNpmPackFilename(result, workspace));
 }
 
 try {