@sanlam-fintech-digital/mfe-platform-cli 0.2.8 → 0.3.0

package/dist/nuget/manager.js

@@ -103,9 +103,7 @@ async function addNuGetFeeds(feeds, tokenMap, configPath) {
         // Add credentials if token provided
         const token = tokenMap?.get(feed.url);
         if (token) {
-            // Normalize credential key (replace invalid XML chars)
-            const credKey = sourceName.replace(/[^a-zA-Z0-9_]/g, '_');
-            credentials[credKey] = {
+            credentials[sourceName] = {
                 add: [
                     { '@_key': 'Username', '@_value': 'PersonalAccessToken' },
                     { '@_key': 'ClearTextPassword', '@_value': token }

package/dist/types/config.js

@@ -6,6 +6,29 @@ const zod_1 = require("zod");
  * Package feed type
  */
 const FeedTypeSchema = zod_1.z.enum(['npm', 'nuget']).default('npm');
+/**
+ * Validates if a string is a valid XML element name.
+ * XML 1.0 specification (https://www.w3.org/TR/xml/#NT-Name):
+ * - Must start with a letter (A-Z, a-z) or underscore (_)
+ * - Can contain letters, digits, hyphens (-), underscores (_), and periods (.)
+ * - Cannot start with "xml" (case-insensitive)
+ * - Cannot contain spaces or special characters like @, $, %, etc.
+ */
+function isValidXmlElementName(name) {
+    // Empty string is invalid
+    if (!name)
+        return false;
+    // Must start with letter or underscore (not digit, hyphen, or period)
+    if (!/^[A-Za-z_]/.test(name))
+        return false;
+    // Can only contain letters, digits, hyphens, underscores, and periods
+    if (!/^[A-Za-z_][A-Za-z0-9._-]*$/.test(name))
+        return false;
+    // Cannot start with "xml" (case-insensitive)
+    if (/^xml/i.test(name))
+        return false;
+    return true;
+}
 /**
  * Individual registry entry (npm or NuGet feed)
  */
@@ -13,6 +36,19 @@ const RegistryEntrySchema = zod_1.z.object({
     scope: zod_1.z.string().describe('npm scope (e.g., "@org/package") or NuGet source name'),
     url: zod_1.z.url().describe('Registry/Feed URL (Azure DevOps, GitHub, or public)').transform((url) => url.replace(/\/+$/, '')),
     feedType: FeedTypeSchema.optional().describe('Package feed type (defaults to npm for backward compatibility)'),
+}).superRefine((data, ctx) => {
+    // For NuGet feeds, the scope becomes an XML element name in NuGet.Config
+    // Validate it meets XML element name requirements
+    const feedType = data.feedType || 'npm';
+    if (feedType === 'nuget' && !isValidXmlElementName(data.scope)) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            message: `NuGet source name "${data.scope}" is not a valid XML element name. ` +
+                `It must start with a letter or underscore, contain only letters, digits, hyphens, underscores, and periods, ` +
+                `and cannot start with "xml" (case-insensitive).`,
+            path: ['scope'],
+        });
+    }
 });
 /**
  * Azure DevOps auth group (requires tenantId)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sanlam-fintech-digital/mfe-platform-cli",
-  "version": "0.2.8",
+  "version": "0.3.0",
   "description": "Bootstrapping and orchestration CLI for the Sanlam Fintech Digital platform",
   "main": "dist/index.js",
   "bin": {