@scrymore/scry-deployer 0.12.3-nightly.20261009034324 → 0.12.3

package/lib/converter/cc-origin.js

@@ -6,6 +6,7 @@
  *   origin.item     the item's display name       (same rule)
  *   origin.stock    boolean: an Adobe Stock preview (true) or the user's own item (false)
  *   origin.link     a clean `https` adobe.com address, query and fragment stripped; anything else is DROPPED
+ *                   (a ':' survives only in the exact Creative Cloud item address, see ITEM_LINK_PATH_RE)
  *
  * Guarantee G2: no signed URL, token or credential reaches an origin field. `link` is the only URL-shaped field and it
  * is rebuilt from the parsed host and path, never passed through; a value that is not a plain adobe.com page address
@@ -24,6 +25,14 @@ const MAX_ID_PART = 256;
 /** `adobe.com` itself or a sub-domain of it, lower-case letters, digits and hyphens only. */
 const ADOBE_HOST_RE = /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*adobe\.com$/;
 const SAFE_PATH_RE = /^\/[A-Za-z0-9._~/-]*$/;
+/**
+ * The one place a ':' may appear (guarantee G-F17b): the item address of a Creative Cloud library,
+ * `/files/libraries/urn:aaid:sc:<REGION>:<uuid>[/<uuid>]` on `www.adobe.com`. Nothing else may follow, and the library
+ * segment must match whole; `%3A`, a lower-case region or a second colon is not this shape and stays refused.
+ */
+const ITEM_LINK_HOST = 'www.adobe.com';
+const UUID_SOURCE = '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}';
+const ITEM_LINK_PATH_RE = new RegExp(`^/files/libraries/urn:aaid:sc:[A-Z0-9]{2,8}:${UUID_SOURCE}(?:/${UUID_SOURCE})?$`);
 /** A path that names a credential is refused even when it is otherwise plain (`/x/token/abc`). */
 const SECRET_WORD_RE = /token|signature|credential|secret|password|passwd|auth|session|cookie|apikey|api-key|x-amz|sig=|expires/i;
 
@@ -46,7 +55,8 @@ function cleanAdobeLink(raw) {
     if (url.protocol !== 'https:' || url.username || url.password || url.port) return null;
     if (!ADOBE_HOST_RE.test(url.hostname)) return null;
     const pathname = url.pathname;
-    if (!SAFE_PATH_RE.test(pathname) || SECRET_WORD_RE.test(pathname)) return null;
+    const itemLink = url.hostname === ITEM_LINK_HOST && ITEM_LINK_PATH_RE.test(pathname);
+    if (!(itemLink || SAFE_PATH_RE.test(pathname)) || SECRET_WORD_RE.test(pathname)) return null;
     if (pathname.split('/').some((segment) => segment.length > MAX_PATH_SEGMENT)) return null;
     const clean = `https://${url.hostname}${pathname === '/' ? '' : pathname}`;
     return clean.length <= MAX_LINK_LENGTH ? clean : null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scrymore/scry-deployer",
-  "version": "0.12.3-nightly.20261009034324",
+  "version": "0.12.3",
   "description": "A CLI to automate the deployment of Storybook static builds.",
   "main": "index.js",
   "bin": {