@salesforce/graphiti 11.34.1 → 11.35.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +10 -0
- package/dist/commands/mcp-mirror/commands.js +7 -1
- package/dist/commands/mcp-mirror/commands.js.map +1 -1
- package/dist/commands/mcp-mirror/run-mirror.d.ts +1 -1
- package/dist/commands/mcp-mirror/run-mirror.js +5 -1
- package/dist/commands/mcp-mirror/run-mirror.js.map +1 -1
- package/dist/lib/control-chars.d.ts +58 -0
- package/dist/lib/control-chars.js +63 -0
- package/dist/lib/control-chars.js.map +1 -0
- package/dist/schemas/fields.d.ts +41 -0
- package/dist/schemas/fields.js +42 -0
- package/dist/schemas/fields.js.map +1 -1
- package/dist/schemas/input-schemas.d.ts +7 -7
- package/dist/schemas/input-schemas.js +22 -11
- package/dist/schemas/input-schemas.js.map +1 -1
- package/dist/schemas/tool-adapter.d.ts +1 -1
- package/dist/schemas/tool-adapter.js +13 -24
- package/dist/schemas/tool-adapter.js.map +1 -1
- package/package.json +1 -1
- package/src/commands/mcp-mirror/commands.ts +6 -1
- package/src/commands/mcp-mirror/run-mirror.ts +4 -1
- package/src/lib/__tests__/control-chars.spec.ts +155 -0
- package/src/lib/control-chars.ts +66 -0
- package/src/mcp/tools/__tests__/sf-gql-aggregate.spec.ts +109 -0
- package/src/mcp/tools/__tests__/sf-gql-discover.spec.ts +79 -0
- package/src/mcp/tools/__tests__/sf-gql-raw.spec.ts +91 -0
- package/src/schemas/__tests__/fields.spec.ts +182 -0
- package/src/schemas/fields.ts +47 -0
- package/src/schemas/input-schemas.ts +30 -14
- package/src/schemas/tool-adapter.ts +13 -25
package/CHANGELOG.md
CHANGED
|
@@ -3,6 +3,16 @@
|
|
|
3
3
|
All notable changes to this project will be documented in this file.
|
|
4
4
|
See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
|
|
5
5
|
|
|
6
|
+
## [11.35.0](https://github.com/salesforce-experience-platform-emu/webapps/compare/v11.34.2...v11.35.0) (2026-07-22)
|
|
7
|
+
|
|
8
|
+
**Note:** Version bump only for package @salesforce/graphiti
|
|
9
|
+
|
|
10
|
+
## [11.34.2](https://github.com/salesforce-experience-platform-emu/webapps/compare/v11.34.1...v11.34.2) (2026-07-21)
|
|
11
|
+
|
|
12
|
+
### Bug Fixes
|
|
13
|
+
|
|
14
|
+
- **graphiti:** neutralize control chars in z.enum rejection messages @W-23336443 ([#782](https://github.com/salesforce-experience-platform-emu/webapps/issues/782)) ([3beff0e](https://github.com/salesforce-experience-platform-emu/webapps/commit/3beff0ed0a3ee1dfd2ae8f5fa7bf743548af23a9))
|
|
15
|
+
|
|
6
16
|
## [11.34.1](https://github.com/salesforce-experience-platform-emu/webapps/compare/v11.34.0...v11.34.1) (2026-07-21)
|
|
7
17
|
|
|
8
18
|
**Note:** Version bump only for package @salesforce/graphiti
|
|
@@ -20,7 +20,13 @@ import { AGGREGATE_INPUT, CONNECT_INPUT, CREATE_INPUT, DELETE_INPUT, DETAIL_INPU
|
|
|
20
20
|
* up — so {@link MIRRORS} can be a single homogeneous array without forcing the
|
|
21
21
|
* builders through an `unknown` parameter (which would fail by contravariance).
|
|
22
22
|
*/
|
|
23
|
-
function defineMirror(name, summary,
|
|
23
|
+
function defineMirror(name, summary,
|
|
24
|
+
// Input type is `unknown`, not `T`: the schema validates a raw parsed-JSON
|
|
25
|
+
// blob, and some fields wrap the value in a `z.preprocess` (jsonCoercible,
|
|
26
|
+
// enumStripControlChars) whose Zod input type is `unknown`. Only the OUTPUT
|
|
27
|
+
// must be `T`. Pinning the input to `T` (the default `z.ZodType<T>`) would
|
|
28
|
+
// reject those preprocess-wrapped schemas.
|
|
29
|
+
schema, build) {
|
|
24
30
|
return { name, summary, run: (jsonArg) => runMirror(jsonArg, schema, build) };
|
|
25
31
|
}
|
|
26
32
|
/** Every CLI mirror command. Single source of truth for `cli.ts` and the tests. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../../src/commands/mcp-mirror/commands.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAcH,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EACN,eAAe,EACf,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,UAAU,EACV,SAAS,EACT,YAAY,GACZ,MAAM,gCAAgC,CAAC;AAYxC;;;;;GAKG;AACH,SAAS,YAAY,CACpB,IAAY,EACZ,OAAe,
|
|
1
|
+
{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../../src/commands/mcp-mirror/commands.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAcH,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EACN,eAAe,EACf,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,UAAU,EACV,SAAS,EACT,YAAY,GACZ,MAAM,gCAAgC,CAAC;AAYxC;;;;;GAKG;AACH,SAAS,YAAY,CACpB,IAAY,EACZ,OAAe;AACf,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,2EAA2E;AAC3E,2CAA2C;AAC3C,MAA2C,EAC3C,KAAqC;IAErC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,MAAM,OAAO,GAAoB;IACvC,YAAY,CAAC,aAAa,EAAE,2BAA2B,EAAE,UAAU,EAAE,SAAS,CAAC;IAC/E,YAAY,CAAC,eAAe,EAAE,qCAAqC,EAAE,YAAY,EAAE,WAAW,CAAC;IAC/F,YAAY,CAAC,iBAAiB,EAAE,iCAAiC,EAAE,cAAc,EAAE,aAAa,CAAC;IACjG,YAAY,CACX,kBAAkB,EAClB,gCAAgC,EAChC,eAAe,EACf,cAAc,CACd;IACD,YAAY,CACX,YAAY,EACZ,mDAAmD,EACnD,SAAS,EACT,QAAQ,CACR;IACD,YAAY,CAAC,eAAe,EAAE,gCAAgC,EAAE,YAAY,EAAE,WAAW,CAAC;IAC1F,YAAY,CAAC,eAAe,EAAE,gCAAgC,EAAE,YAAY,EAAE,WAAW,CAAC;IAC1F,YAAY,CAAC,eAAe,EAAE,gCAAgC,EAAE,YAAY,EAAE,WAAW,CAAC;IAC1F,YAAY,CACX,gBAAgB,EAChB,sCAAsC,EACtC,aAAa,EACb,YAAY,CACZ;CACD,CAAC"}
|
|
@@ -39,4 +39,4 @@ export interface RunMirrorDeps {
|
|
|
39
39
|
* @param build The intent-layer builder; receives the validated input.
|
|
40
40
|
* @param deps Injectable stdin reader / TTY flag for testing.
|
|
41
41
|
*/
|
|
42
|
-
export declare function runMirror<T>(jsonArg: string | undefined, schema: z.ZodType<T>, build: (input: T) => Promise<unknown>, deps?: RunMirrorDeps): Promise<void>;
|
|
42
|
+
export declare function runMirror<T>(jsonArg: string | undefined, schema: z.ZodType<T, z.ZodTypeDef, unknown>, build: (input: T) => Promise<unknown>, deps?: RunMirrorDeps): Promise<void>;
|
|
@@ -47,7 +47,11 @@ function emitError(code, message, details) {
|
|
|
47
47
|
* @param build The intent-layer builder; receives the validated input.
|
|
48
48
|
* @param deps Injectable stdin reader / TTY flag for testing.
|
|
49
49
|
*/
|
|
50
|
-
export async function runMirror(jsonArg,
|
|
50
|
+
export async function runMirror(jsonArg,
|
|
51
|
+
// Input type is `unknown` (a raw parsed-JSON blob), not `T`: `z.preprocess`-
|
|
52
|
+
// wrapped fields (jsonCoercible, enumStripControlChars) have a Zod input type
|
|
53
|
+
// of `unknown`, so only the parsed OUTPUT is `T`. See defineMirror in commands.ts.
|
|
54
|
+
schema, build, deps = {}) {
|
|
51
55
|
// 1. Source the raw JSON: a positional arg wins, except a literal "-" which
|
|
52
56
|
// is the conventional "read from stdin" sentinel. Otherwise read stdin
|
|
53
57
|
// (unless TTY, where blocking would hang waiting for a human to type).
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"run-mirror.js","sourceRoot":"","sources":["../../../src/commands/mcp-mirror/run-mirror.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAkB/D;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,OAAe;IAC5C,IACC,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC;QAClD,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;QAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EACxB,CAAC;QACF,OAAO,aAAa,CAAC;IACtB,CAAC;IACD,IAAI,qDAAqD,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACzE,OAAO,qBAAqB,CAAC;IAC9B,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC;AAiBD,KAAK,UAAU,YAAY;IAC1B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,SAAS,CAAC,IAAqB,EAAE,OAAe,EAAE,OAAiB;IAC3E,MAAM,QAAQ,GAAwB;QACrC,KAAK,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE;KAC7E,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtC,kEAAkE;IAClE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACtB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,OAA2B,
|
|
1
|
+
{"version":3,"file":"run-mirror.js","sourceRoot":"","sources":["../../../src/commands/mcp-mirror/run-mirror.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAkB/D;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,OAAe;IAC5C,IACC,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC;QAClD,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;QAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EACxB,CAAC;QACF,OAAO,aAAa,CAAC;IACtB,CAAC;IACD,IAAI,qDAAqD,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACzE,OAAO,qBAAqB,CAAC;IAC9B,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC;AAiBD,KAAK,UAAU,YAAY;IAC1B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,SAAS,CAAC,IAAqB,EAAE,OAAe,EAAE,OAAiB;IAC3E,MAAM,QAAQ,GAAwB;QACrC,KAAK,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE;KAC7E,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtC,kEAAkE;IAClE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACtB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,OAA2B;AAC3B,6EAA6E;AAC7E,8EAA8E;AAC9E,mFAAmF;AACnF,MAA2C,EAC3C,KAAqC,EACrC,OAAsB,EAAE;IAExB,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;IAChD,MAAM,UAAU,GAAG,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,GAAG,CAAC;IAC5D,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,GAAG,GAAG,OAAiB,CAAC;IACzB,CAAC;SAAM,IAAI,KAAK,EAAE,CAAC;QAClB,SAAS,CAAC,cAAc,EAAE,gEAAgE,CAAC,CAAC;QAC5F,OAAO;IACR,CAAC;SAAM,CAAC;QACP,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,YAAY,CAAC;QACjD,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YACjB,SAAS,CAAC,cAAc,EAAE,gEAAgE,CAAC,CAAC;YAC5F,OAAO;QACR,CAAC;IACF,CAAC;IAED,iBAAiB;IACjB,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACJ,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,SAAS,CAAC,cAAc,EAAE,iBAAkB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACrE,OAAO;IACR,CAAC;IAED,6CAA6C;IAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,SAAS,CAAC,cAAc,EAAE,iCAAiC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClF,OAAO;IACR,CAAC;IAED,iFAAiF;IACjF,0FAA0F;IAC1F,8DAA8D;IAC9D,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,2EAA2E;QAC3E,4EAA4E;QAC5E,sEAAsE;QACtE,yEAAyE;QACzE,6EAA6E;QAC7E,qEAAqE;QACrE,MAAM,IAAI,GACT,GAAG,YAAY,SAAS;YACvB,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,GAAG,YAAY,kBAAkB;gBAClC,CAAC,CAAC,qBAAqB;gBACvB,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACnC,yEAAyE;QACzE,yEAAyE;QACzE,MAAM,OAAO,GACZ,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,GAAG,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,KAAK;YACtE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE;YACtB,CAAC,CAAC,SAAS,CAAC;QACd,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;AACF,CAAC"}
|
|
@@ -0,0 +1,58 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Copyright (c) 2026, Salesforce, Inc.,
|
|
3
|
+
* All rights reserved.
|
|
4
|
+
* For full license text, see the LICENSE.txt file
|
|
5
|
+
*/
|
|
6
|
+
/**
|
|
7
|
+
* Canonical Unicode control (Cc: C0/C1/DEL) + format (Cf) character class
|
|
8
|
+
* (W-23148363, OWASP LLM01). Left raw in host-visible MCP text, these code
|
|
9
|
+
* points let caller-supplied input forge structure or hide/reorder content:
|
|
10
|
+
* newlines/CR fabricate "SYSTEM:"-style lines, ESC (U+001B) opens ANSI/SGR
|
|
11
|
+
* sequences, NEL (U+0085) and the C1 8-bit CSI (U+009B) are alternate
|
|
12
|
+
* line/escape introducers, and the Cf set (bidi overrides/marks/isolates incl
|
|
13
|
+
* U+061C, zero-width joiners/spaces, word joiner, BOM, invisible-math
|
|
14
|
+
* operators, soft hyphen, and the U+E0000–E007F "tag" smuggling block)
|
|
15
|
+
* reorders or hides text.
|
|
16
|
+
*
|
|
17
|
+
* Matched by Unicode property escape so the set tracks future Cc/Cf additions
|
|
18
|
+
* rather than a hand-enumerated range that drifts (an earlier explicit range
|
|
19
|
+
* silently missed U+061C / ZWNJ / ZWJ / tag chars — all Cf). This is the SINGLE
|
|
20
|
+
* SOURCE OF TRUTH for the class: the error-envelope escaper
|
|
21
|
+
* (`schemas/tool-adapter.ts` `neutralizeControlChars`) and the enum-rejection
|
|
22
|
+
* stripper (`schemas/fields.ts` `enumStripControlChars`, W-23336443) both
|
|
23
|
+
* consume it so the two sinks cannot diverge.
|
|
24
|
+
*
|
|
25
|
+
* NOTE the two consumers differ in DISPOSITION, deliberately:
|
|
26
|
+
* - the error envelope ESCAPES (each char → a visible `\xNN`/`\uNNNN` literal)
|
|
27
|
+
* so a reflected byte stays debuggable but inert;
|
|
28
|
+
* - the enum-rejection path STRIPS (deletes the char) — a z.enum only ever
|
|
29
|
+
* reflects the invalid value verbatim inside its own message, so there is
|
|
30
|
+
* nothing to preserve, and stripping keeps the advertised allowed-value list
|
|
31
|
+
* (which contains no control chars) an exact round-trip.
|
|
32
|
+
* U+2028/U+2029 are intentionally OUT of this Cc/Cf class (they are Zl/Zp, not
|
|
33
|
+
* Cc/Cf); every host-visible sink strips them SEPARATELY via the sibling
|
|
34
|
+
* {@link LINE_SEPARATOR_RE} / {@link stripLineSeparators} below.
|
|
35
|
+
*/
|
|
36
|
+
export declare const CONTROL_CHAR_RE: RegExp;
|
|
37
|
+
/**
|
|
38
|
+
* Delete every {@link CONTROL_CHAR_RE} code point from `s`. Used to sanitize a
|
|
39
|
+
* value BEFORE it can be reflected verbatim into a validation-rejection message
|
|
40
|
+
* that the MCP SDK emits UPSTREAM of the tool adapter (W-23336443), where the
|
|
41
|
+
* adapter's escaping neutralizer never runs. Ordinary Unicode (accented names,
|
|
42
|
+
* CJK labels) is untouched.
|
|
43
|
+
*/
|
|
44
|
+
export declare function stripControlChars(s: string): string;
|
|
45
|
+
/**
|
|
46
|
+
* Unicode line/paragraph separators (U+2028 Zl / U+2029 Zp). These are legal in
|
|
47
|
+
* JSON strings and are NOT escaped by `JSON.stringify`, and left raw in
|
|
48
|
+
* host-visible MCP text they trip a Claude.AI 408 timeout (MCP TS SDK #2155).
|
|
49
|
+
* They are NOT part of {@link CONTROL_CHAR_RE} (that class is Cc/Cf, and its
|
|
50
|
+
* escaper consumer emits `\xNN`/`\uNNNN` — a disposition that would be wrong for
|
|
51
|
+
* these). Every host-visible sink therefore strips them separately: the error/
|
|
52
|
+
* success envelopes (`schemas/tool-adapter.ts`) and the enum-rejection path
|
|
53
|
+
* (`schemas/fields.ts` `enumStripControlChars`, W-23336443), which reaches the
|
|
54
|
+
* host UPSTREAM of the envelope's own strip. Shared here so those sinks agree.
|
|
55
|
+
*/
|
|
56
|
+
export declare const LINE_SEPARATOR_RE: RegExp;
|
|
57
|
+
/** Delete every {@link LINE_SEPARATOR_RE} code point from `s`. */
|
|
58
|
+
export declare function stripLineSeparators(s: string): string;
|
|
@@ -0,0 +1,63 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Copyright (c) 2026, Salesforce, Inc.,
|
|
3
|
+
* All rights reserved.
|
|
4
|
+
* For full license text, see the LICENSE.txt file
|
|
5
|
+
*/
|
|
6
|
+
/**
|
|
7
|
+
* Canonical Unicode control (Cc: C0/C1/DEL) + format (Cf) character class
|
|
8
|
+
* (W-23148363, OWASP LLM01). Left raw in host-visible MCP text, these code
|
|
9
|
+
* points let caller-supplied input forge structure or hide/reorder content:
|
|
10
|
+
* newlines/CR fabricate "SYSTEM:"-style lines, ESC (U+001B) opens ANSI/SGR
|
|
11
|
+
* sequences, NEL (U+0085) and the C1 8-bit CSI (U+009B) are alternate
|
|
12
|
+
* line/escape introducers, and the Cf set (bidi overrides/marks/isolates incl
|
|
13
|
+
* U+061C, zero-width joiners/spaces, word joiner, BOM, invisible-math
|
|
14
|
+
* operators, soft hyphen, and the U+E0000–E007F "tag" smuggling block)
|
|
15
|
+
* reorders or hides text.
|
|
16
|
+
*
|
|
17
|
+
* Matched by Unicode property escape so the set tracks future Cc/Cf additions
|
|
18
|
+
* rather than a hand-enumerated range that drifts (an earlier explicit range
|
|
19
|
+
* silently missed U+061C / ZWNJ / ZWJ / tag chars — all Cf). This is the SINGLE
|
|
20
|
+
* SOURCE OF TRUTH for the class: the error-envelope escaper
|
|
21
|
+
* (`schemas/tool-adapter.ts` `neutralizeControlChars`) and the enum-rejection
|
|
22
|
+
* stripper (`schemas/fields.ts` `enumStripControlChars`, W-23336443) both
|
|
23
|
+
* consume it so the two sinks cannot diverge.
|
|
24
|
+
*
|
|
25
|
+
* NOTE the two consumers differ in DISPOSITION, deliberately:
|
|
26
|
+
* - the error envelope ESCAPES (each char → a visible `\xNN`/`\uNNNN` literal)
|
|
27
|
+
* so a reflected byte stays debuggable but inert;
|
|
28
|
+
* - the enum-rejection path STRIPS (deletes the char) — a z.enum only ever
|
|
29
|
+
* reflects the invalid value verbatim inside its own message, so there is
|
|
30
|
+
* nothing to preserve, and stripping keeps the advertised allowed-value list
|
|
31
|
+
* (which contains no control chars) an exact round-trip.
|
|
32
|
+
* U+2028/U+2029 are intentionally OUT of this Cc/Cf class (they are Zl/Zp, not
|
|
33
|
+
* Cc/Cf); every host-visible sink strips them SEPARATELY via the sibling
|
|
34
|
+
* {@link LINE_SEPARATOR_RE} / {@link stripLineSeparators} below.
|
|
35
|
+
*/
|
|
36
|
+
export const CONTROL_CHAR_RE = /[\p{Cc}\p{Cf}]/gu;
|
|
37
|
+
/**
|
|
38
|
+
* Delete every {@link CONTROL_CHAR_RE} code point from `s`. Used to sanitize a
|
|
39
|
+
* value BEFORE it can be reflected verbatim into a validation-rejection message
|
|
40
|
+
* that the MCP SDK emits UPSTREAM of the tool adapter (W-23336443), where the
|
|
41
|
+
* adapter's escaping neutralizer never runs. Ordinary Unicode (accented names,
|
|
42
|
+
* CJK labels) is untouched.
|
|
43
|
+
*/
|
|
44
|
+
export function stripControlChars(s) {
|
|
45
|
+
return s.replace(CONTROL_CHAR_RE, "");
|
|
46
|
+
}
|
|
47
|
+
/**
|
|
48
|
+
* Unicode line/paragraph separators (U+2028 Zl / U+2029 Zp). These are legal in
|
|
49
|
+
* JSON strings and are NOT escaped by `JSON.stringify`, and left raw in
|
|
50
|
+
* host-visible MCP text they trip a Claude.AI 408 timeout (MCP TS SDK #2155).
|
|
51
|
+
* They are NOT part of {@link CONTROL_CHAR_RE} (that class is Cc/Cf, and its
|
|
52
|
+
* escaper consumer emits `\xNN`/`\uNNNN` — a disposition that would be wrong for
|
|
53
|
+
* these). Every host-visible sink therefore strips them separately: the error/
|
|
54
|
+
* success envelopes (`schemas/tool-adapter.ts`) and the enum-rejection path
|
|
55
|
+
* (`schemas/fields.ts` `enumStripControlChars`, W-23336443), which reaches the
|
|
56
|
+
* host UPSTREAM of the envelope's own strip. Shared here so those sinks agree.
|
|
57
|
+
*/
|
|
58
|
+
export const LINE_SEPARATOR_RE = /[\u2028\u2029]/g;
|
|
59
|
+
/** Delete every {@link LINE_SEPARATOR_RE} code point from `s`. */
|
|
60
|
+
export function stripLineSeparators(s) {
|
|
61
|
+
return s.replace(LINE_SEPARATOR_RE, "");
|
|
62
|
+
}
|
|
63
|
+
//# sourceMappingURL=control-chars.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"control-chars.js","sourceRoot":"","sources":["../../src/lib/control-chars.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAS;IAC1C,OAAO,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AAEnD,kEAAkE;AAClE,MAAM,UAAU,mBAAmB,CAAC,CAAS;IAC5C,OAAO,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;AACzC,CAAC"}
|
package/dist/schemas/fields.d.ts
CHANGED
|
@@ -16,6 +16,47 @@ import { z } from "zod";
|
|
|
16
16
|
export declare const coerceJsonArg: (v: unknown) => unknown;
|
|
17
17
|
/** Wrap a schema so a JSON-stringified value is coerced before validation. */
|
|
18
18
|
export declare const jsonCoercible: (schema: z.ZodTypeAny) => z.ZodEffects<z.ZodTypeAny, any, unknown>;
|
|
19
|
+
/**
|
|
20
|
+
* Wrap an enum (or any string schema) so Unicode control/format chars are
|
|
21
|
+
* STRIPPED from a string value before validation (W-23336443). Motivation: a
|
|
22
|
+
* `z.enum` rejection is reflected VERBATIM by the MCP SDK's input validation,
|
|
23
|
+
* which runs UPSTREAM of `runTool` — so the adapter's `neutralizeControlChars`
|
|
24
|
+
* never executes, and a poisoned value like `"describe_object"` reaches
|
|
25
|
+
* the host raw inside `received '…'`. `JSON.stringify` (which the SDK uses)
|
|
26
|
+
* escapes only C0, so DEL and the entire Cf class (bidi overrides, zero-width)
|
|
27
|
+
* survive. Stripping here closes that channel two ways: a control-char-poisoned
|
|
28
|
+
* but otherwise-valid value strips to the valid enum member (accepted, no
|
|
29
|
+
* message), and a genuinely-invalid value rejects with a message free of raw
|
|
30
|
+
* control chars.
|
|
31
|
+
*
|
|
32
|
+
* This upstream path also strips U+2028/U+2029 (via {@link stripLineSeparators}),
|
|
33
|
+
* matching what every envelope sink does in `tool-adapter.ts`: those separators
|
|
34
|
+
* are NOT Cc/Cf so `stripControlChars` correctly ignores them, but left raw in
|
|
35
|
+
* host-visible text they trip a Claude.AI 408 (MCP TS SDK #2155) — and this
|
|
36
|
+
* rejection message reaches the host BEFORE the envelope's own line-separator
|
|
37
|
+
* strip can run, so it must strip them itself.
|
|
38
|
+
*
|
|
39
|
+
* Why `z.preprocess` and not `.refine`: preprocess can TRANSFORM (strip) the
|
|
40
|
+
* value, and — verified against the SDK's zod-to-json-schema converter — the
|
|
41
|
+
* wrapper PRESERVES the published JSON-Schema `enum` and `description`, so the
|
|
42
|
+
* advertised allowed-value list the LLM sees is unchanged. `.refine` can only
|
|
43
|
+
* reject, not strip.
|
|
44
|
+
*
|
|
45
|
+
* CAVEAT: applying this to a `z.discriminatedUnion` discriminator member is
|
|
46
|
+
* pointless, though not harmful. It is NOT harmful because zod's discriminator-
|
|
47
|
+
* map builder recurses through a `z.preprocess` wrapper (`getDiscriminator`
|
|
48
|
+
* reads `ZodEffects.innerType()`), so construction does NOT throw and clean
|
|
49
|
+
* values still route correctly (verified against zod 3.25.76 on AGGREGATE_INPUT).
|
|
50
|
+
* It is POINTLESS because discrimination reads the RAW `ctx.data[discriminator]`
|
|
51
|
+
* to pick a branch BEFORE that branch's preprocess ever runs — so the strip
|
|
52
|
+
* cannot influence branch selection. A discriminator that matches no branch
|
|
53
|
+
* raises `invalid_union_discriminator`, whose issue lists only the EXPECTED
|
|
54
|
+
* options and does NOT echo the received value — so, unlike a plain
|
|
55
|
+
* `invalid_enum_value`, there is no verbatim-reflection channel there to close.
|
|
56
|
+
* The aggregate `function` discriminators are therefore left un-wrapped per
|
|
57
|
+
* W-23336443; only plain enums (invalid_enum_value DOES echo `received`) need it.
|
|
58
|
+
*/
|
|
59
|
+
export declare const enumStripControlChars: <T extends z.ZodTypeAny>(schema: T) => z.ZodEffects<T, T["_output"], unknown>;
|
|
19
60
|
/** A string that looks like a JSON object/array literal — used so the advertised
|
|
20
61
|
* schema accepts a stringified object/array; coerceJsonArg then parses it. A
|
|
21
62
|
* `{`/`[`-prefixed but invalid-JSON string is accepted as a literal (rare; the
|
package/dist/schemas/fields.js
CHANGED
|
@@ -4,6 +4,7 @@
|
|
|
4
4
|
* For full license text, see the LICENSE.txt file
|
|
5
5
|
*/
|
|
6
6
|
import { z } from "zod";
|
|
7
|
+
import { stripControlChars, stripLineSeparators } from "../lib/control-chars.js";
|
|
7
8
|
import { DOTTED_GRAPHQL_NAME_RE, GRAPHQL_NAME_RE } from "../lib/graphql-name.js";
|
|
8
9
|
/**
|
|
9
10
|
* Some MCP clients/models JSON-stringify complex tool arguments (e.g. send
|
|
@@ -38,6 +39,47 @@ const coerceJsonOnce = (v) => {
|
|
|
38
39
|
};
|
|
39
40
|
/** Wrap a schema so a JSON-stringified value is coerced before validation. */
|
|
40
41
|
export const jsonCoercible = (schema) => z.preprocess(coerceJsonArg, schema);
|
|
42
|
+
/**
|
|
43
|
+
* Wrap an enum (or any string schema) so Unicode control/format chars are
|
|
44
|
+
* STRIPPED from a string value before validation (W-23336443). Motivation: a
|
|
45
|
+
* `z.enum` rejection is reflected VERBATIM by the MCP SDK's input validation,
|
|
46
|
+
* which runs UPSTREAM of `runTool` — so the adapter's `neutralizeControlChars`
|
|
47
|
+
* never executes, and a poisoned value like `"describe_object"` reaches
|
|
48
|
+
* the host raw inside `received '…'`. `JSON.stringify` (which the SDK uses)
|
|
49
|
+
* escapes only C0, so DEL and the entire Cf class (bidi overrides, zero-width)
|
|
50
|
+
* survive. Stripping here closes that channel two ways: a control-char-poisoned
|
|
51
|
+
* but otherwise-valid value strips to the valid enum member (accepted, no
|
|
52
|
+
* message), and a genuinely-invalid value rejects with a message free of raw
|
|
53
|
+
* control chars.
|
|
54
|
+
*
|
|
55
|
+
* This upstream path also strips U+2028/U+2029 (via {@link stripLineSeparators}),
|
|
56
|
+
* matching what every envelope sink does in `tool-adapter.ts`: those separators
|
|
57
|
+
* are NOT Cc/Cf so `stripControlChars` correctly ignores them, but left raw in
|
|
58
|
+
* host-visible text they trip a Claude.AI 408 (MCP TS SDK #2155) — and this
|
|
59
|
+
* rejection message reaches the host BEFORE the envelope's own line-separator
|
|
60
|
+
* strip can run, so it must strip them itself.
|
|
61
|
+
*
|
|
62
|
+
* Why `z.preprocess` and not `.refine`: preprocess can TRANSFORM (strip) the
|
|
63
|
+
* value, and — verified against the SDK's zod-to-json-schema converter — the
|
|
64
|
+
* wrapper PRESERVES the published JSON-Schema `enum` and `description`, so the
|
|
65
|
+
* advertised allowed-value list the LLM sees is unchanged. `.refine` can only
|
|
66
|
+
* reject, not strip.
|
|
67
|
+
*
|
|
68
|
+
* CAVEAT: applying this to a `z.discriminatedUnion` discriminator member is
|
|
69
|
+
* pointless, though not harmful. It is NOT harmful because zod's discriminator-
|
|
70
|
+
* map builder recurses through a `z.preprocess` wrapper (`getDiscriminator`
|
|
71
|
+
* reads `ZodEffects.innerType()`), so construction does NOT throw and clean
|
|
72
|
+
* values still route correctly (verified against zod 3.25.76 on AGGREGATE_INPUT).
|
|
73
|
+
* It is POINTLESS because discrimination reads the RAW `ctx.data[discriminator]`
|
|
74
|
+
* to pick a branch BEFORE that branch's preprocess ever runs — so the strip
|
|
75
|
+
* cannot influence branch selection. A discriminator that matches no branch
|
|
76
|
+
* raises `invalid_union_discriminator`, whose issue lists only the EXPECTED
|
|
77
|
+
* options and does NOT echo the received value — so, unlike a plain
|
|
78
|
+
* `invalid_enum_value`, there is no verbatim-reflection channel there to close.
|
|
79
|
+
* The aggregate `function` discriminators are therefore left un-wrapped per
|
|
80
|
+
* W-23336443; only plain enums (invalid_enum_value DOES echo `received`) need it.
|
|
81
|
+
*/
|
|
82
|
+
export const enumStripControlChars = (schema) => z.preprocess((v) => (typeof v === "string" ? stripLineSeparators(stripControlChars(v)) : v), schema);
|
|
41
83
|
/** A string that looks like a JSON object/array literal — used so the advertised
|
|
42
84
|
* schema accepts a stringified object/array; coerceJsonArg then parses it. A
|
|
43
85
|
* `{`/`[`-prefixed but invalid-JSON string is accepted as a literal (rare; the
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"fields.js","sourceRoot":"","sources":["../../src/schemas/fields.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEjF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAU,EAAW,EAAE;IACpD,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAC/B,gFAAgF;IAChF,4EAA4E;IAC5E,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;IACxE,OAAO,IAAI,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,CAAU,EAAW,EAAE;IAC9C,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACnB,6DAA6D;IAC7D,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9F,OAAO,CAAC,CAAC;IACV,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,CAAC,CAAC;IACV,CAAC;AACF,CAAC,CAAC;AAEF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAoB,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;AAE3F;;;6DAG6D;AAC7D,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AACpE,uEAAuE;AACvE,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAChE;sEACsE;AACtE,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AAE9D;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,WAAmB,EAAe,EAAE,CAC/D,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,8BAA8B,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAEzF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,WAAmB,EAAe,EAAE,CACrE,CAAC;KACC,MAAM,EAAE;KACR,KAAK,CAAC,sBAAsB,EAAE,0DAA0D,CAAC;KACzF,QAAQ,CAAC,WAAW,CAAC,CAAC;AAEzB;;;;GAIG;AACH,MAAM,QAAQ,GAAG,6BAA6B,CAAC;AAC/C,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,WAAmB,EAAe,EAAE,CAC5D,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,wCAAwC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAE5F;;;;;GAKG;AACH,MAAM,YAAY,GAAG,uCAAuC,CAAC;AAC7D,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,WAAmB,EAAe,EAAE,CAC5D,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,uCAAuC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAE/F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAEzD;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,EAAE,CAClC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kBAAkB,EAAE,+CAA+C,CAAC,CAAC;AAEvF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,OAAqB,EAAE,EAAE,CAChE,CAAC,CAAC,MAAM,CAAC;IACR,gBAAgB,EAAE,WAAW,CAC5B,8FAA8F,CAC9F;IACD,MAAM,EAAE,CAAC,CAAC,KAAK,CACd,iBAAiB,CAChB,kFAAkF,CAClF,CACD;IACD,KAAK,EAAE,aAAa,CACnB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,EAAE,gBAAgB,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,CAC5F,CAAC,QAAQ,EAAE;IACZ,MAAM,EAAE,aAAa,CACpB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,iBAAiB,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,CACvF,CAAC,QAAQ,EAAE;IACZ,OAAO,EAAE,aAAa,CACrB,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,iBAAiB,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,CACzE,CAAC,QAAQ,EAAE;CACZ,CAAC,CAAC"}
|
|
1
|
+
{"version":3,"file":"fields.js","sourceRoot":"","sources":["../../src/schemas/fields.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEjF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAU,EAAW,EAAE;IACpD,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAC/B,gFAAgF;IAChF,4EAA4E;IAC5E,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;IACxE,OAAO,IAAI,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,CAAU,EAAW,EAAE;IAC9C,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACnB,6DAA6D;IAC7D,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9F,OAAO,CAAC,CAAC;IACV,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,CAAC,CAAC;IACV,CAAC;AACF,CAAC,CAAC;AAEF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAoB,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;AAE3F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAyB,MAAS,EAAE,EAAE,CAC1E,CAAC,CAAC,UAAU,CACX,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAC9E,MAAM,CACN,CAAC;AAEH;;;6DAG6D;AAC7D,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AACpE,uEAAuE;AACvE,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAChE;sEACsE;AACtE,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AAE9D;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,WAAmB,EAAe,EAAE,CAC/D,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,8BAA8B,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAEzF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,WAAmB,EAAe,EAAE,CACrE,CAAC;KACC,MAAM,EAAE;KACR,KAAK,CAAC,sBAAsB,EAAE,0DAA0D,CAAC;KACzF,QAAQ,CAAC,WAAW,CAAC,CAAC;AAEzB;;;;GAIG;AACH,MAAM,QAAQ,GAAG,6BAA6B,CAAC;AAC/C,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,WAAmB,EAAe,EAAE,CAC5D,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,wCAAwC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAE5F;;;;;GAKG;AACH,MAAM,YAAY,GAAG,uCAAuC,CAAC;AAC7D,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,WAAmB,EAAe,EAAE,CAC5D,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,uCAAuC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAE/F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAEzD;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,EAAE,CAClC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kBAAkB,EAAE,+CAA+C,CAAC,CAAC;AAEvF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,OAAqB,EAAE,EAAE,CAChE,CAAC,CAAC,MAAM,CAAC;IACR,gBAAgB,EAAE,WAAW,CAC5B,8FAA8F,CAC9F;IACD,MAAM,EAAE,CAAC,CAAC,KAAK,CACd,iBAAiB,CAChB,kFAAkF,CAClF,CACD;IACD,KAAK,EAAE,aAAa,CACnB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,EAAE,gBAAgB,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,CAC5F,CAAC,QAAQ,EAAE;IACZ,MAAM,EAAE,aAAa,CACpB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,iBAAiB,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,CACvF,CAAC,QAAQ,EAAE;IACZ,OAAO,EAAE,aAAa,CACrB,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,iBAAiB,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,CACzE,CAAC,QAAQ,EAAE;CACZ,CAAC,CAAC"}
|
|
@@ -136,7 +136,7 @@ export declare const DETAIL_INPUT: z.ZodObject<{
|
|
|
136
136
|
}>;
|
|
137
137
|
export declare const DISCOVER_INPUT: z.ZodObject<{
|
|
138
138
|
org: z.ZodString;
|
|
139
|
-
mode: z.ZodEnum<["list_objects", "describe_object", "describe_field"]>;
|
|
139
|
+
mode: z.ZodEffects<z.ZodEnum<["list_objects", "describe_object", "describe_field"]>, "list_objects" | "describe_object" | "describe_field", unknown>;
|
|
140
140
|
object: z.ZodOptional<z.ZodString>;
|
|
141
141
|
field: z.ZodOptional<z.ZodString>;
|
|
142
142
|
search: z.ZodOptional<z.ZodString>;
|
|
@@ -148,23 +148,23 @@ export declare const DISCOVER_INPUT: z.ZodObject<{
|
|
|
148
148
|
field?: string | undefined;
|
|
149
149
|
}, {
|
|
150
150
|
org: string;
|
|
151
|
-
mode: "list_objects" | "describe_object" | "describe_field";
|
|
152
151
|
object?: string | undefined;
|
|
153
152
|
search?: string | undefined;
|
|
154
153
|
field?: string | undefined;
|
|
154
|
+
mode?: unknown;
|
|
155
155
|
}>;
|
|
156
156
|
export declare const AGGREGATE_INPUT: z.ZodObject<{
|
|
157
157
|
org: z.ZodString;
|
|
158
158
|
object: z.ZodString;
|
|
159
159
|
groupBy: z.ZodOptional<z.ZodArray<z.ZodUnion<[z.ZodString, z.ZodObject<{
|
|
160
160
|
field: z.ZodString;
|
|
161
|
-
function: z.ZodEnum<["CALENDAR_MONTH", "CALENDAR_QUARTER", "CALENDAR_YEAR", "DAY_IN_MONTH", "DAY_IN_WEEK", "DAY_IN_YEAR", "FISCAL_MONTH", "FISCAL_QUARTER", "FISCAL_YEAR", "HOUR_IN_DAY", "CALENDAR_MONTH_IN_YEAR", "FISCAL_MONTH_IN_YEAR", "WEEK_IN_YEAR"]>;
|
|
161
|
+
function: z.ZodEffects<z.ZodEnum<["CALENDAR_MONTH", "CALENDAR_QUARTER", "CALENDAR_YEAR", "DAY_IN_MONTH", "DAY_IN_WEEK", "DAY_IN_YEAR", "FISCAL_MONTH", "FISCAL_QUARTER", "FISCAL_YEAR", "HOUR_IN_DAY", "CALENDAR_MONTH_IN_YEAR", "FISCAL_MONTH_IN_YEAR", "WEEK_IN_YEAR"]>, "CALENDAR_MONTH" | "CALENDAR_QUARTER" | "CALENDAR_YEAR" | "DAY_IN_MONTH" | "DAY_IN_WEEK" | "DAY_IN_YEAR" | "FISCAL_MONTH" | "FISCAL_QUARTER" | "FISCAL_YEAR" | "HOUR_IN_DAY" | "CALENDAR_MONTH_IN_YEAR" | "FISCAL_MONTH_IN_YEAR" | "WEEK_IN_YEAR", unknown>;
|
|
162
162
|
}, "strip", z.ZodTypeAny, {
|
|
163
163
|
function: "CALENDAR_MONTH" | "CALENDAR_QUARTER" | "CALENDAR_YEAR" | "DAY_IN_MONTH" | "DAY_IN_WEEK" | "DAY_IN_YEAR" | "FISCAL_MONTH" | "FISCAL_QUARTER" | "FISCAL_YEAR" | "HOUR_IN_DAY" | "CALENDAR_MONTH_IN_YEAR" | "FISCAL_MONTH_IN_YEAR" | "WEEK_IN_YEAR";
|
|
164
164
|
field: string;
|
|
165
165
|
}, {
|
|
166
|
-
function: "CALENDAR_MONTH" | "CALENDAR_QUARTER" | "CALENDAR_YEAR" | "DAY_IN_MONTH" | "DAY_IN_WEEK" | "DAY_IN_YEAR" | "FISCAL_MONTH" | "FISCAL_QUARTER" | "FISCAL_YEAR" | "HOUR_IN_DAY" | "CALENDAR_MONTH_IN_YEAR" | "FISCAL_MONTH_IN_YEAR" | "WEEK_IN_YEAR";
|
|
167
166
|
field: string;
|
|
167
|
+
function?: unknown;
|
|
168
168
|
}>]>, "many">>;
|
|
169
169
|
aggregations: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<"function", [z.ZodObject<{
|
|
170
170
|
function: z.ZodEnum<["count", "countDistinct"]>;
|
|
@@ -223,8 +223,8 @@ export declare const AGGREGATE_INPUT: z.ZodObject<{
|
|
|
223
223
|
orderBy?: unknown;
|
|
224
224
|
first?: unknown;
|
|
225
225
|
groupBy?: (string | {
|
|
226
|
-
function: "CALENDAR_MONTH" | "CALENDAR_QUARTER" | "CALENDAR_YEAR" | "DAY_IN_MONTH" | "DAY_IN_WEEK" | "DAY_IN_YEAR" | "FISCAL_MONTH" | "FISCAL_QUARTER" | "FISCAL_YEAR" | "HOUR_IN_DAY" | "CALENDAR_MONTH_IN_YEAR" | "FISCAL_MONTH_IN_YEAR" | "WEEK_IN_YEAR";
|
|
227
226
|
field: string;
|
|
227
|
+
function?: unknown;
|
|
228
228
|
})[] | undefined;
|
|
229
229
|
aggregations?: ({
|
|
230
230
|
function: "count" | "countDistinct";
|
|
@@ -239,7 +239,7 @@ export declare const AGGREGATE_INPUT: z.ZodObject<{
|
|
|
239
239
|
export declare const RAW_INPUT: z.ZodObject<{
|
|
240
240
|
org: z.ZodString;
|
|
241
241
|
commands: z.ZodArray<z.ZodString, "many">;
|
|
242
|
-
operation: z.ZodOptional<z.ZodEnum<["query", "mutation", "aggregate"]
|
|
242
|
+
operation: z.ZodEffects<z.ZodOptional<z.ZodEnum<["query", "mutation", "aggregate"]>>, "query" | "mutation" | "aggregate" | undefined, unknown>;
|
|
243
243
|
typeName: z.ZodOptional<z.ZodString>;
|
|
244
244
|
}, "strip", z.ZodTypeAny, {
|
|
245
245
|
org: string;
|
|
@@ -249,7 +249,7 @@ export declare const RAW_INPUT: z.ZodObject<{
|
|
|
249
249
|
}, {
|
|
250
250
|
org: string;
|
|
251
251
|
commands: string[];
|
|
252
|
-
operation?:
|
|
252
|
+
operation?: unknown;
|
|
253
253
|
typeName?: string | undefined;
|
|
254
254
|
}>;
|
|
255
255
|
export declare const CREATE_INPUT: z.ZodObject<{
|
|
@@ -15,7 +15,7 @@
|
|
|
15
15
|
* schemas; behavior is unchanged — this is a pure extraction.
|
|
16
16
|
*/
|
|
17
17
|
import { z } from "zod";
|
|
18
|
-
import { childRelationshipSchema, dottedGraphqlName, graphqlName, intLiteralString, jsonCoercible, jsonLiteralString, orderByObject, orgAlias, quotedString, scopeArg, varPlaceholder, } from "./fields.js";
|
|
18
|
+
import { childRelationshipSchema, dottedGraphqlName, enumStripControlChars, graphqlName, intLiteralString, jsonCoercible, jsonLiteralString, orderByObject, orgAlias, quotedString, scopeArg, varPlaceholder, } from "./fields.js";
|
|
19
19
|
import { GROUP_BY_FUNCTIONS } from "../intent/types.js";
|
|
20
20
|
// --- sf_gql_list ------------------------------------------------------------
|
|
21
21
|
// `sf_gql_list` advertises both shapes (singleton + array) for backward
|
|
@@ -94,9 +94,9 @@ export const DISCOVER_INPUT = z.object({
|
|
|
94
94
|
.string()
|
|
95
95
|
.regex(DISCOVER_ORG_ALIAS_RE, "org must match /^[A-Za-z0-9_-]{1,80}$/")
|
|
96
96
|
.describe("Org alias resolved via local Salesforce CLI auth (~/.sf, ~/.sfdx)."),
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
97
|
+
// enumStripControlChars: a bad `mode` is reflected verbatim by the SDK's
|
|
98
|
+
// upstream validation (W-23336443) — strip Cc/Cf before it can reach the host.
|
|
99
|
+
mode: enumStripControlChars(z.enum(["list_objects", "describe_object", "describe_field"])).describe('Discovery mode. "list_objects" enumerates queryable SObjects; "describe_object" and "describe_field" return ObjectInfo metadata.'),
|
|
100
100
|
object: z
|
|
101
101
|
.string()
|
|
102
102
|
.regex(DISCOVER_SOBJECT_NAME_RE, "object must match /^[A-Za-z][A-Za-z0-9_]{0,79}$/")
|
|
@@ -119,6 +119,17 @@ const aliasField = z
|
|
|
119
119
|
.string()
|
|
120
120
|
.optional()
|
|
121
121
|
.describe("GraphQL alias for this aggregation's result key.");
|
|
122
|
+
// NOTE (W-23336443): the `function` enums below are z.discriminatedUnion
|
|
123
|
+
// DISCRIMINATORS — they are intentionally NOT wrapped in enumStripControlChars.
|
|
124
|
+
// Wrapping would be pointless (not harmful): discrimination reads the RAW
|
|
125
|
+
// `ctx.data.function` to pick a branch BEFORE that branch's preprocess runs, so
|
|
126
|
+
// a strip could never change branch selection. And there is nothing to close: a
|
|
127
|
+
// discriminator that matches no branch raises `invalid_union_discriminator`,
|
|
128
|
+
// whose issue lists only the EXPECTED options and does NOT echo the received
|
|
129
|
+
// value (verified, zod 3.25.76) — unlike a plain enum's `invalid_enum_value`,
|
|
130
|
+
// which reflects `received` verbatim. The three plain enums that DO echo their
|
|
131
|
+
// input (mode/operation/groupBy function) are the ones wrapped. See
|
|
132
|
+
// enumStripControlChars in ./fields for the full mechanism.
|
|
122
133
|
const aggregationSchema = z.discriminatedUnion("function", [
|
|
123
134
|
z.object({
|
|
124
135
|
function: z.enum(["count", "countDistinct"]),
|
|
@@ -135,9 +146,9 @@ const groupByElementSchema = z.union([
|
|
|
135
146
|
graphqlName("SObject field API name to group by (flat, non-dotted)."),
|
|
136
147
|
z.object({
|
|
137
148
|
field: graphqlName("SObject field API name (DateTime/Date field)."),
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
|
|
149
|
+
// Plain z.union member (NOT a discriminatedUnion discriminator), so the
|
|
150
|
+
// enumStripControlChars wrapper is safe here (W-23336443).
|
|
151
|
+
function: enumStripControlChars(z.enum(GROUP_BY_FUNCTIONS)).describe("Date bucketing function from UIAPI GroupByFunction enum."),
|
|
141
152
|
}),
|
|
142
153
|
]);
|
|
143
154
|
export const AGGREGATE_INPUT = z.object({
|
|
@@ -180,10 +191,10 @@ export const RAW_INPUT = z.object({
|
|
|
180
191
|
" var $name <path> [default] e.g. var $id uiapi/query/Case/@args/where/Id/eq (type inferred from path)\n" +
|
|
181
192
|
'Each command is tokenized on spaces and a value MUST NOT contain a space — quoting does not help once a token has started (key=\'a b\' still splits). A filter value that contains a space (e.g. "New York", "In Progress") cannot be expressed via set in v1; use sf_gql_list with a JSON filter, or pass the value through a variable bound with var.\n' +
|
|
182
193
|
"Fails fast: a bad command aborts the whole call. Other CLI verbs (cd, drop, alias, optional, unset) are NOT supported in v1 — and the `optional` verb is unnecessary here: like every declarative tool, sf_gql_raw emits all selected record fields with the @optional directive automatically, so a field the running user lacks FLS for is omitted gracefully instead of failing the whole query."),
|
|
183
|
-
operation
|
|
184
|
-
|
|
185
|
-
|
|
186
|
-
|
|
194
|
+
// enumStripControlChars strips Cc/Cf from a bad `operation` before the SDK
|
|
195
|
+
// reflects it verbatim in a rejection message (W-23336443); the wrapper
|
|
196
|
+
// preserves the published enum + optional flag (undefined passes through).
|
|
197
|
+
operation: enumStripControlChars(z.enum(["query", "mutation", "aggregate"]).optional()).describe('Operation root. "query" (default) → uiapi.query; "mutation" → mutation root; "aggregate" → uiapi.aggregate.'),
|
|
187
198
|
typeName: graphqlName("Override the GraphQL operation name. Defaults to Raw<Operation>.").optional(),
|
|
188
199
|
});
|
|
189
200
|
// --- sf_gql_create ----------------------------------------------------------
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"input-schemas.js","sourceRoot":"","sources":["../../src/schemas/input-schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACN,uBAAuB,EACvB,iBAAiB,EACjB,WAAW,EACX,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,QAAQ,EACR,cAAc,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,+EAA+E;AAE/E,wEAAwE;AACxE,oEAAoE;AACpE,sDAAsD;AACtD,MAAM,iBAAiB,GAAG,GAAG,EAAE,CAC9B,CAAC,CAAC,KAAK,CAAC;IACP,aAAa,EAAE;IACf,CAAC,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;IACxB,cAAc,EAAE;IAChB,iBAAiB,EAAE;IACnB,YAAY,EAAE;CACd,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;IAC9F,MAAM,EAAE,WAAW,CAAC,yEAAyE,CAAC;IAC9F,MAAM,EAAE,CAAC;SACP,KAAK,CAAC,iBAAiB,CAAC,6DAA6D,CAAC,CAAC;SACvF,QAAQ,CACR,wFAAwF,CACxF;IACF,YAAY,EAAE,CAAC;SACb,KAAK,CAAC,iBAAiB,CAAC,uDAAuD,CAAC,CAAC;SACjF,QAAQ,EAAE;SACV,QAAQ,CAAC,wDAAwD,CAAC;IACpE,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpF,MAAM,EAAE,aAAa,CACpB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,iBAAiB,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,CACvF;SACC,QAAQ,EAAE;SACV,QAAQ,CACR,mUAAmU,CACnU;IACF,OAAO,EAAE,aAAa,CAAC,iBAAiB,EAAE,CAAC;SACzC,QAAQ,EAAE;SACV,QAAQ,CACR,+RAA+R,CAC/R;IACF,KAAK,EAAE,aAAa,CACnB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,EAAE,gBAAgB,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,CAC5F;SACC,QAAQ,EAAE;SACV,QAAQ,CACR,4JAA4J,CAC5J;IACF,KAAK,EAAE,QAAQ,CAAC,qDAAqD,CAAC,CAAC,QAAQ,EAAE;IACjF,aAAa,EAAE,WAAW,CACzB,gEAAgE,CAChE,CAAC,QAAQ,EAAE;CACZ,CAAC,CAAC;AAEH,+EAA+E;AAE/E,6EAA6E;AAC7E,yEAAyE;AACzE,8EAA8E;AAC9E,kEAAkE;AAClE,sDAAsD;AACtD,MAAM,mBAAmB,GAAG,GAAG,EAAE,CAChC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;AAErE,+EAA+E;AAC/E,6EAA6E;AAC7E,2DAA2D;AAC3D,EAAE;AACF,2EAA2E;AAC3E,wEAAwE;AACxE,8DAA8D;AAC9D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC3B,MAAM,CAAC;IACP,GAAG,EAAE,QAAQ,CAAC,oEAAoE,CAAC;IACnF,MAAM,EAAE,WAAW,CAAC,yEAAyE,CAAC;IAC9F,MAAM,EAAE,CAAC;SACP,KAAK,CAAC,iBAAiB,CAAC,6DAA6D,CAAC,CAAC;SACvF,QAAQ,CACR,wFAAwF,CACxF;IACF,YAAY,EAAE,CAAC;SACb,KAAK,CAAC,iBAAiB,CAAC,uDAAuD,CAAC,CAAC;SACjF,QAAQ,EAAE;SACV,QAAQ,CAAC,wDAAwD,CAAC;IACpE,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtF,UAAU,EAAE,WAAW,CACtB,wQAAwQ,CACxQ,CAAC,QAAQ,EAAE;IACZ,aAAa,EAAE,WAAW,CACzB,kEAAkE,CAClE,CAAC,QAAQ,EAAE;CACZ,CAAC;KACD,MAAM,EAAE,CAAC;AAEX,+EAA+E;AAE/E,uEAAuE;AACvE,6EAA6E;AAC7E,iEAAiE;AACjE,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AACtD,MAAM,wBAAwB,GAAG,8BAA8B,CAAC;AAChE,mFAAmF;AACnF,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AAEjD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,GAAG,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,KAAK,CAAC,qBAAqB,EAAE,wCAAwC,CAAC;SACtE,QAAQ,CAAC,oEAAoE,CAAC;IAChF,IAAI,EAAE,CAAC
|
|
1
|
+
{"version":3,"file":"input-schemas.js","sourceRoot":"","sources":["../../src/schemas/input-schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACN,uBAAuB,EACvB,iBAAiB,EACjB,qBAAqB,EACrB,WAAW,EACX,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,QAAQ,EACR,cAAc,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,+EAA+E;AAE/E,wEAAwE;AACxE,oEAAoE;AACpE,sDAAsD;AACtD,MAAM,iBAAiB,GAAG,GAAG,EAAE,CAC9B,CAAC,CAAC,KAAK,CAAC;IACP,aAAa,EAAE;IACf,CAAC,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;IACxB,cAAc,EAAE;IAChB,iBAAiB,EAAE;IACnB,YAAY,EAAE;CACd,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;IAC9F,MAAM,EAAE,WAAW,CAAC,yEAAyE,CAAC;IAC9F,MAAM,EAAE,CAAC;SACP,KAAK,CAAC,iBAAiB,CAAC,6DAA6D,CAAC,CAAC;SACvF,QAAQ,CACR,wFAAwF,CACxF;IACF,YAAY,EAAE,CAAC;SACb,KAAK,CAAC,iBAAiB,CAAC,uDAAuD,CAAC,CAAC;SACjF,QAAQ,EAAE;SACV,QAAQ,CAAC,wDAAwD,CAAC;IACpE,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpF,MAAM,EAAE,aAAa,CACpB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,iBAAiB,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,CACvF;SACC,QAAQ,EAAE;SACV,QAAQ,CACR,mUAAmU,CACnU;IACF,OAAO,EAAE,aAAa,CAAC,iBAAiB,EAAE,CAAC;SACzC,QAAQ,EAAE;SACV,QAAQ,CACR,+RAA+R,CAC/R;IACF,KAAK,EAAE,aAAa,CACnB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,EAAE,gBAAgB,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,CAC5F;SACC,QAAQ,EAAE;SACV,QAAQ,CACR,4JAA4J,CAC5J;IACF,KAAK,EAAE,QAAQ,CAAC,qDAAqD,CAAC,CAAC,QAAQ,EAAE;IACjF,aAAa,EAAE,WAAW,CACzB,gEAAgE,CAChE,CAAC,QAAQ,EAAE;CACZ,CAAC,CAAC;AAEH,+EAA+E;AAE/E,6EAA6E;AAC7E,yEAAyE;AACzE,8EAA8E;AAC9E,kEAAkE;AAClE,sDAAsD;AACtD,MAAM,mBAAmB,GAAG,GAAG,EAAE,CAChC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;AAErE,+EAA+E;AAC/E,6EAA6E;AAC7E,2DAA2D;AAC3D,EAAE;AACF,2EAA2E;AAC3E,wEAAwE;AACxE,8DAA8D;AAC9D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC3B,MAAM,CAAC;IACP,GAAG,EAAE,QAAQ,CAAC,oEAAoE,CAAC;IACnF,MAAM,EAAE,WAAW,CAAC,yEAAyE,CAAC;IAC9F,MAAM,EAAE,CAAC;SACP,KAAK,CAAC,iBAAiB,CAAC,6DAA6D,CAAC,CAAC;SACvF,QAAQ,CACR,wFAAwF,CACxF;IACF,YAAY,EAAE,CAAC;SACb,KAAK,CAAC,iBAAiB,CAAC,uDAAuD,CAAC,CAAC;SACjF,QAAQ,EAAE;SACV,QAAQ,CAAC,wDAAwD,CAAC;IACpE,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtF,UAAU,EAAE,WAAW,CACtB,wQAAwQ,CACxQ,CAAC,QAAQ,EAAE;IACZ,aAAa,EAAE,WAAW,CACzB,kEAAkE,CAClE,CAAC,QAAQ,EAAE;CACZ,CAAC;KACD,MAAM,EAAE,CAAC;AAEX,+EAA+E;AAE/E,uEAAuE;AACvE,6EAA6E;AAC7E,iEAAiE;AACjE,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AACtD,MAAM,wBAAwB,GAAG,8BAA8B,CAAC;AAChE,mFAAmF;AACnF,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AAEjD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,GAAG,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,KAAK,CAAC,qBAAqB,EAAE,wCAAwC,CAAC;SACtE,QAAQ,CAAC,oEAAoE,CAAC;IAChF,yEAAyE;IACzE,+EAA+E;IAC/E,IAAI,EAAE,qBAAqB,CAC1B,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAC,CAC7D,CAAC,QAAQ,CACT,kIAAkI,CAClI;IACD,MAAM,EAAE,CAAC;SACP,MAAM,EAAE;SACR,KAAK,CAAC,wBAAwB,EAAE,kDAAkD,CAAC;SACnF,QAAQ,EAAE;SACV,QAAQ,CAAC,wEAAwE,CAAC;IACpF,KAAK,EAAE,CAAC;SACN,MAAM,EAAE;SACR,KAAK,CAAC,wBAAwB,EAAE,iDAAiD,CAAC;SAClF,QAAQ,EAAE;SACV,QAAQ,CAAC,gDAAgD,CAAC;IAC5D,MAAM,EAAE,CAAC;SACP,MAAM,EAAE;SACR,GAAG,CAAC,GAAG,EAAE,wCAAwC,CAAC;SAClD,KAAK,CAAC,kBAAkB,EAAE,4CAA4C,CAAC;SACvE,QAAQ,EAAE;SACV,QAAQ,CAAC,8DAA8D,CAAC;CAC1E,CAAC,CAAC;AAEH,+EAA+E;AAE/E,MAAM,UAAU,GAAG,CAAC;KAClB,MAAM,EAAE;KACR,QAAQ,EAAE;KACV,QAAQ,CAAC,kDAAkD,CAAC,CAAC;AAE/D,yEAAyE;AACzE,gFAAgF;AAChF,0EAA0E;AAC1E,gFAAgF;AAChF,gFAAgF;AAChF,6EAA6E;AAC7E,6EAA6E;AAC7E,8EAA8E;AAC9E,+EAA+E;AAC/E,oEAAoE;AACpE,4DAA4D;AAC5D,MAAM,iBAAiB,GAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE;IAC1D,CAAC,CAAC,MAAM,CAAC;QACR,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC5C,KAAK,EAAE,WAAW,CAAC,wDAAwD,CAAC,CAAC,QAAQ,EAAE;QACvF,KAAK,EAAE,UAAU;KACjB,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACR,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC9C,KAAK,EAAE,WAAW,CAAC,uDAAuD,CAAC;QAC3E,KAAK,EAAE,UAAU;KACjB,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC;IACpC,WAAW,CAAC,wDAAwD,CAAC;IACrE,CAAC,CAAC,MAAM,CAAC;QACR,KAAK,EAAE,WAAW,CAAC,+CAA+C,CAAC;QACnE,wEAAwE;QACxE,2DAA2D;QAC3D,QAAQ,EAAE,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CACnE,0DAA0D,CAC1D;KACD,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;IAC9F,MAAM,EAAE,WAAW,CAAC,0EAA0E,CAAC;IAC/F,OAAO,EAAE,CAAC;SACR,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,EAAE;SACV,QAAQ,CACR,oUAAoU,CACpU;IACF,YAAY,EAAE,CAAC;SACb,KAAK,CAAC,iBAAiB,CAAC;SACxB,QAAQ,EAAE;SACV,QAAQ,CACR,2HAA2H,CAC3H;IACF,MAAM,EAAE,aAAa,CACpB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,iBAAiB,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,CACvF;SACC,QAAQ,EAAE;SACV,QAAQ,CACR,uQAAuQ,CACvQ;IACF,OAAO,EAAE,aAAa,CACrB,CAAC,CAAC,KAAK,CAAC;QACP,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACrB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9B,cAAc,EAAE;QAChB,iBAAiB,EAAE;QACnB,YAAY,EAAE;KACd,CAAC,CACF;SACC,QAAQ,EAAE;SACV,QAAQ,CACR,kQAAkQ,CAClQ;IACF,KAAK,EAAE,aAAa,CACnB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,EAAE,gBAAgB,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,CAC5F;SACC,QAAQ,EAAE;SACV,QAAQ,CACR,qJAAqJ,CACrJ;IACF,aAAa,EAAE,WAAW,CACzB,qEAAqE,CACrE,CAAC,QAAQ,EAAE;CACZ,CAAC,CAAC;AAEH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;IAC9F,QAAQ,EAAE,CAAC;SACT,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACR,gFAAgF;QAC/E,sFAAsF;QACtF,6GAA6G;QAC7G,0GAA0G;QAC1G,2VAA2V;QAC3V,qYAAqY,CACtY;IACF,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAC/F,6GAA6G,CAC7G;IACD,QAAQ,EAAE,WAAW,CACpB,kEAAkE,CAClE,CAAC,QAAQ,EAAE;CACZ,CAAC,CAAC;AAEH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;IAC9F,MAAM,EAAE,WAAW,CAAC,0EAA0E,CAAC;IAC/F,YAAY,EAAE,CAAC;SACb,KAAK,CAAC,iBAAiB,CAAC,2DAA2D,CAAC,CAAC;SACrF,QAAQ,EAAE;SACV,QAAQ,CACR,uQAAuQ,CACvQ;IACF,aAAa,EAAE,CAAC;SACd,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACR,mHAAmH,CACnH;IACF,aAAa,EAAE,WAAW,CACzB,kEAAkE,CAClE,CAAC,QAAQ,EAAE;CACZ,CAAC,CAAC;AAEH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;IAC9F,MAAM,EAAE,WAAW,CAAC,0EAA0E,CAAC;IAC/F,YAAY,EAAE,CAAC;SACb,KAAK,CAAC,iBAAiB,CAAC,2DAA2D,CAAC,CAAC;SACrF,QAAQ,EAAE;SACV,QAAQ,CACR,uQAAuQ,CACvQ;IACF,aAAa,EAAE,CAAC;SACd,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACR,mHAAmH,CACnH;IACF,aAAa,EAAE,WAAW,CACzB,kEAAkE,CAClE,CAAC,QAAQ,EAAE;CACZ,CAAC,CAAC;AAEH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;IAC9F,MAAM,EAAE,WAAW,CAAC,0EAA0E,CAAC;IAC/F,aAAa,EAAE,CAAC;SACd,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACR,sMAAsM,CACtM;IACF,aAAa,EAAE,WAAW,CACzB,kEAAkE,CAClE,CAAC,QAAQ,EAAE;CACZ,CAAC,CAAC;AAEH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,GAAG,EAAE,QAAQ,CAAC,gFAAgF,CAAC;IAC/F,YAAY,EAAE,CAAC;SACb,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACR,kRAAkR,CAClR;CACF,CAAC,CAAC"}
|
|
@@ -59,7 +59,7 @@ export declare const PATH_MARKERS: {
|
|
|
59
59
|
* (W-23148363). Escaping mirrors the SUCCESS envelope's JSON.stringify semantics
|
|
60
60
|
* (`\n` -> `\\x0a`, U+202E -> `\\u202e`) -- the byte stays visible for debugging but
|
|
61
61
|
* inert. Ordinary Unicode (accented names, CJK labels) is untouched. Astral code
|
|
62
|
-
* points (e.g. the U+E0000-E007F tag block) render as `\\u{...}`; `
|
|
62
|
+
* points (e.g. the U+E0000-E007F tag block) render as `\\u{...}`; `CONTROL_CHAR_RE`
|
|
63
63
|
* carries the `u` flag so they match (and escape) as a single code point.
|
|
64
64
|
*/
|
|
65
65
|
export declare function neutralizeControlChars(s: string): string;
|
|
@@ -4,6 +4,7 @@
|
|
|
4
4
|
* For full license text, see the LICENSE.txt file
|
|
5
5
|
*/
|
|
6
6
|
import os from "node:os";
|
|
7
|
+
import { CONTROL_CHAR_RE, stripLineSeparators } from "../lib/control-chars.js";
|
|
7
8
|
import { AuthError, classifyCause, SchemaError, UserInputError, } from "../lib/errors.js";
|
|
8
9
|
import { graphitiHome, schemaDir } from "../lib/introspect.js";
|
|
9
10
|
import { SchemaRefreshError } from "../lib/prime-schema.js";
|
|
@@ -29,25 +30,15 @@ export const PATH_MARKERS = {
|
|
|
29
30
|
home: "~",
|
|
30
31
|
redacted: "<path>",
|
|
31
32
|
};
|
|
32
|
-
//
|
|
33
|
-
//
|
|
34
|
-
//
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
//
|
|
40
|
-
//
|
|
41
|
-
// envelope (W-23148363, OWASP LLM01): newlines/CR fabricate "SYSTEM:"-style lines,
|
|
42
|
-
// ESC (\x1b) opens ANSI/SGR sequences, NEL (U+0085) and the C1 8-bit CSI (\x9b) are
|
|
43
|
-
// alternate line/escape introducers, and the Cf set (bidi overrides/marks/isolates
|
|
44
|
-
// incl U+061C, zero-width joiners/spaces, word joiner, BOM, invisible-math operators,
|
|
45
|
-
// soft hyphen, and the U+E0000-E007F "tag" smuggling block) reorders or hides text.
|
|
46
|
-
// Matched by Unicode property class so the set tracks future Cc/Cf additions instead
|
|
47
|
-
// of a hand-enumerated range that drifts (an earlier explicit range silently missed
|
|
48
|
-
// U+061C / ZWNJ / ZWJ / tag chars -- all Cf). The ERROR envelope interpolates the
|
|
49
|
-
// message raw (`${category}: ${text}`), so every one of these reaches the host
|
|
50
|
-
// unescaped -- which is the vector this neutralizer closes.
|
|
33
|
+
// `stripLineSeparators` (imported) removes U+2028/U+2029 from every host-visible
|
|
34
|
+
// envelope below (they trip a Claude.AI 408 \u2014 see `lib/control-chars.ts`). Shared
|
|
35
|
+
// with the enum-rejection path (W-23336443) so the two sinks cannot drift.
|
|
36
|
+
//
|
|
37
|
+
// The Cc/Cf class this escaper acts on is the shared CONTROL_CHAR_RE (see
|
|
38
|
+
// `lib/control-chars.ts` for the full rationale — why bidi/zero-width/tag chars
|
|
39
|
+
// are dangerous and why a Unicode property class is used over a hand-enumerated
|
|
40
|
+
// range). Imported, not re-declared, so this ERROR-envelope escaper and the
|
|
41
|
+
// enum-rejection stripper (W-23336443) cannot drift apart.
|
|
51
42
|
// SUCCESS-ENVELOPE SCOPE (W-23148363): the success path (runTool below) emits
|
|
52
43
|
// JSON.stringify(output), which escapes ONLY the C0 range (U+0000-U+001F). DEL
|
|
53
44
|
// (U+007F) and the ENTIRE Cf class (bidi overrides, zero-width, BOM, tag block)
|
|
@@ -61,20 +52,18 @@ function stripLineSeparators(s) {
|
|
|
61
52
|
// Value-level neutralization is tracked as a follow-up WI -- note it must emit
|
|
62
53
|
// GraphQL-valid `\uXXXX` (never `\xNN`) since the success `query` is a live
|
|
63
54
|
// GraphQL document, so the whole-envelope neutralizer here cannot be reused as-is.
|
|
64
|
-
//
|
|
65
|
-
// removes them entirely, and runs first.
|
|
66
|
-
const NEUTRALIZE_RE = /[\p{Cc}\p{Cf}]/gu;
|
|
55
|
+
// CONTROL_CHAR_RE carries the `g` + `u` flags, required by the `.replace` below.
|
|
67
56
|
/**
|
|
68
57
|
* Escape (not strip) control / format characters in host-visible error text so
|
|
69
58
|
* reflected caller input cannot inject newlines, ANSI escapes, or bidi overrides
|
|
70
59
|
* (W-23148363). Escaping mirrors the SUCCESS envelope's JSON.stringify semantics
|
|
71
60
|
* (`\n` -> `\\x0a`, U+202E -> `\\u202e`) -- the byte stays visible for debugging but
|
|
72
61
|
* inert. Ordinary Unicode (accented names, CJK labels) is untouched. Astral code
|
|
73
|
-
* points (e.g. the U+E0000-E007F tag block) render as `\\u{...}`; `
|
|
62
|
+
* points (e.g. the U+E0000-E007F tag block) render as `\\u{...}`; `CONTROL_CHAR_RE`
|
|
74
63
|
* carries the `u` flag so they match (and escape) as a single code point.
|
|
75
64
|
*/
|
|
76
65
|
export function neutralizeControlChars(s) {
|
|
77
|
-
return s.replace(
|
|
66
|
+
return s.replace(CONTROL_CHAR_RE, (c) => {
|
|
78
67
|
const cp = c.codePointAt(0) ?? 0;
|
|
79
68
|
if (cp <= 0xff)
|
|
80
69
|
return `\\x${cp.toString(16).padStart(2, "0")}`;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tool-adapter.js","sourceRoot":"","sources":["../../src/schemas/tool-adapter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EACN,SAAS,EACT,aAAa,EAEb,WAAW,EACX,cAAc,GACd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AA0CxD,gFAAgF;AAChF,+EAA+E;AAC/E,uEAAuE;AACvE,gFAAgF;AAChF,mFAAmF;AACnF,MAAM,aAAa,GAClB,8bAA8b,CAAC;AAEhc,6EAA6E;AAC7E,4EAA4E;AAC5E,MAAM,SAAS,GACd,gGAAgG,CAAC;AAClG,MAAM,OAAO,GAAG,0EAA0E,CAAC;AAE3F;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC3B,WAAW,EAAE,gBAAgB;IAC7B,YAAY,EAAE,iBAAiB;IAC/B,IAAI,EAAE,GAAG;IACT,QAAQ,EAAE,QAAQ;CACT,CAAC;AAEX,
|
|
1
|
+
{"version":3,"file":"tool-adapter.js","sourceRoot":"","sources":["../../src/schemas/tool-adapter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EACN,SAAS,EACT,aAAa,EAEb,WAAW,EACX,cAAc,GACd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AA0CxD,gFAAgF;AAChF,+EAA+E;AAC/E,uEAAuE;AACvE,gFAAgF;AAChF,mFAAmF;AACnF,MAAM,aAAa,GAClB,8bAA8b,CAAC;AAEhc,6EAA6E;AAC7E,4EAA4E;AAC5E,MAAM,SAAS,GACd,gGAAgG,CAAC;AAClG,MAAM,OAAO,GAAG,0EAA0E,CAAC;AAE3F;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC3B,WAAW,EAAE,gBAAgB;IAC7B,YAAY,EAAE,iBAAiB;IAC/B,IAAI,EAAE,GAAG;IACT,QAAQ,EAAE,QAAQ;CACT,CAAC;AAEX,iFAAiF;AACjF,uFAAuF;AACvF,2EAA2E;AAC3E,EAAE;AACF,0EAA0E;AAC1E,gFAAgF;AAChF,gFAAgF;AAChF,4EAA4E;AAC5E,2DAA2D;AAC3D,gFAAgF;AAChF,iFAAiF;AACjF,kFAAkF;AAClF,kFAAkF;AAClF,kFAAkF;AAClF,iFAAiF;AACjF,8EAA8E;AAC9E,8EAA8E;AAC9E,0EAA0E;AAC1E,mFAAmF;AACnF,iFAAiF;AACjF,8EAA8E;AAC9E,qFAAqF;AACrF,iFAAiF;AAEjF;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,CAAS;IAC/C,OAAO,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE;QACvC,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,EAAE,IAAI,IAAI;YAAE,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QAChE,IAAI,EAAE,IAAI,MAAM;YAAE,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC;IAClC,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,CAAS;IAC/B,IAAI,GAAG,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC3D,+EAA+E;IAC/E,+EAA+E;IAC/E,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,gDAAgD,EAAE,EAAE,CAAC,CAAC;IACxE,+EAA+E;IAC/E,8EAA8E;IAC9E,4EAA4E;IAC5E,uFAAuF;IACvF,MAAM,KAAK,GACV;QACC,CAAC,SAAS,EAAE,EAAE,YAAY,CAAC,WAAW,CAAC;QACvC,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,YAAY,CAAC;QAC3C,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,IAAI,CAAC;KAElC;SACC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;SACnC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvE,+EAA+E;IAC/E,4EAA4E;IAC5E,oFAAoF;IACpF,GAAG,GAAG,GAAG,CAAC,OAAO,CAChB,uDAAuD,EACvD,CAAC,EAAE,EAAE,GAAW,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,CACrD,CAAC;IACF,0EAA0E;IAC1E,8EAA8E;IAC9E,6EAA6E;IAC7E,+EAA+E;IAC/E,+EAA+E;IAC/E,+CAA+C;IAC/C,OAAO,sBAAsB,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,cAAc,CAAC,CAAU;IACjC,IAAI,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACjD,OAAO,CAAC,CAAC,KAAK;SACZ,KAAK,CAAC,IAAI,CAAC;SACX,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,yCAAyC;SACrD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,UAAU,CAAC,CAAU,EAAE,OAAe;IAC9C,IAAI,CAAC,YAAY,kBAAkB,IAAI,CAAC,YAAY,WAAW;QAAE,OAAO,QAAQ,CAAC;IACjF,IAAI,CAAC,YAAY,SAAS;QAAE,OAAO,MAAM,CAAC;IAC1C,IAAI,CAAC,YAAY,cAAc,IAAI,CAAC,YAAY,oBAAoB;QAAE,OAAO,WAAW,CAAC;IACzF,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,WAAW,CAAC;IACpD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC;IACzC,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7C,OAAO,UAAU,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,CAAU;IAC/B,IAAI,CAAC,YAAY,WAAW,IAAI,CAAC,YAAY,kBAAkB;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC;IAChF,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACzD,OAAO,aAAa,CAAE,CAAyB,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,CAAU;IAKvC,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,QAAQ,KAAK,UAAU;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAE3E,8EAA8E;IAC9E,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM;QACzB,CAAC,CAAC,GAAG,WAAW,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC7D,CAAC,CAAC,WAAW,CAAC;IACf,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAA0B;IACvD,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,EAAE,EAAE,CAAC;QAC1B,8EAA8E;QAC9E,sEAAsE;QACtE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC3F,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACZ,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QACnD,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC7B,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,sEAAsE;QACtE,0EAA0E;QAC1E,qEAAqE;QACrE,MAAM,MAAM,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC;QACzD,OAAO;YACN,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,CAAC,GAAG,QAAQ,KAAK,IAAI,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC;SACvF,CAAC;IACH,CAAC;AACF,CAAC"}
|