@theunwalked/cardigantime 0.0.18 → 0.0.20

package/README.md

@@ -138,6 +138,9 @@ Merges configuration from multiple sources in order of precedence:
 2. **Configuration file(s)** (medium priority)  
 3. **Default values** (lowest priority)
 
+### Flexible YAML Support
+Supports both `.yaml` and `.yml` file extensions with automatic fallback - if `config.yaml` isn't found, Cardigantime automatically tries `config.yml` (and vice versa).
+
 ### Hierarchical Configuration Discovery
 Supports hierarchical configuration discovery, similar to how `.gitignore`, `.eslintrc`, or `package.json` work - searching up the directory tree for configuration directories.
 

package/dist/cardigantime.cjs

@@ -446,10 +446,21 @@ const create$1 = (params)=>{
 }
 /**
  * Sets a nested value in an object using dot notation.
- */ function setNestedValue$1(obj, path, value) {
+ */ function isUnsafeKey$1(key) {
+    return key === '__proto__' || key === 'constructor' || key === 'prototype';
+}
+function setNestedValue$1(obj, path, value) {
     const keys = path.split('.');
     const lastKey = keys.pop();
+    // Prevent prototype pollution via special property names
+    if (isUnsafeKey$1(lastKey) || keys.some(isUnsafeKey$1)) {
+        return;
+    }
     const target = keys.reduce((current, key)=>{
+        // Skip if this is an unsafe key (already checked above, but defensive)
+        if (isUnsafeKey$1(key)) {
+            return current;
+        }
         if (!(key in current)) {
             current[key] = {};
         }
@@ -547,6 +558,43 @@ const create$1 = (params)=>{
     logger === null || logger === void 0 ? void 0 : logger.verbose(`Discovery complete. Found ${discoveredDirs.length} config directories`);
     return discoveredDirs;
 }
+/**
+ * Tries to find a config file with alternative extensions (.yaml or .yml).
+ * 
+ * @param storage Storage instance to use for file operations
+ * @param configDir The directory containing the config file
+ * @param configFileName The base config file name (may have .yaml or .yml extension)
+ * @param logger Optional logger for debugging
+ * @returns Promise resolving to the found config file path or null if not found
+ */ async function findConfigFileWithExtension$1(storage, configDir, configFileName, logger) {
+    const configFilePath = path.join(configDir, configFileName);
+    // First try the exact filename as specified
+    const exists = await storage.exists(configFilePath);
+    if (exists) {
+        const isReadable = await storage.isFileReadable(configFilePath);
+        if (isReadable) {
+            return configFilePath;
+        }
+    }
+    // If the exact filename doesn't exist or isn't readable, try alternative extensions
+    // Only do this if the filename has a .yaml or .yml extension
+    const ext = path.extname(configFileName);
+    if (ext === '.yaml' || ext === '.yml') {
+        const baseName = path.basename(configFileName, ext);
+        const alternativeExt = ext === '.yaml' ? '.yml' : '.yaml';
+        const alternativePath = path.join(configDir, baseName + alternativeExt);
+        logger === null || logger === void 0 ? void 0 : logger.debug(`Config file not found at ${configFilePath}, trying alternative: ${alternativePath}`);
+        const altExists = await storage.exists(alternativePath);
+        if (altExists) {
+            const altIsReadable = await storage.isFileReadable(alternativePath);
+            if (altIsReadable) {
+                logger === null || logger === void 0 ? void 0 : logger.debug(`Found config file with alternative extension: ${alternativePath}`);
+                return alternativePath;
+            }
+        }
+    }
+    return null;
+}
 /**
  * Loads and parses a configuration file from a directory.
  * 
@@ -561,17 +609,12 @@ const create$1 = (params)=>{
     const storage = create$1({
         log: (logger === null || logger === void 0 ? void 0 : logger.debug) || (()=>{})
     });
-    const configFilePath = path.join(configDir, configFileName);
     try {
-        logger === null || logger === void 0 ? void 0 : logger.verbose(`Attempting to load config file: ${configFilePath}`);
-        const exists = await storage.exists(configFilePath);
-        if (!exists) {
-            logger === null || logger === void 0 ? void 0 : logger.debug(`Config file does not exist: ${configFilePath}`);
-            return null;
-        }
-        const isReadable = await storage.isFileReadable(configFilePath);
-        if (!isReadable) {
-            logger === null || logger === void 0 ? void 0 : logger.debug(`Config file exists but is not readable: ${configFilePath}`);
+        logger === null || logger === void 0 ? void 0 : logger.verbose(`Attempting to load config file: ${path.join(configDir, configFileName)}`);
+        // Try to find the config file with alternative extensions
+        const configFilePath = await findConfigFileWithExtension$1(storage, configDir, configFileName, logger);
+        if (!configFilePath) {
+            logger === null || logger === void 0 ? void 0 : logger.debug(`Config file does not exist: ${path.join(configDir, configFileName)}`);
             return null;
         }
         const yamlContent = await storage.readFile(configFilePath, encoding);
@@ -589,7 +632,7 @@ const create$1 = (params)=>{
             return null;
         }
     } catch (error) {
-        logger === null || logger === void 0 ? void 0 : logger.debug(`Error loading config from ${configFilePath}: ${error.message}`);
+        logger === null || logger === void 0 ? void 0 : logger.debug(`Error loading config from ${path.join(configDir, configFileName)}: ${error.message}`);
         return null;
     }
 }
@@ -846,12 +889,26 @@ const create$1 = (params)=>{
  */ function getNestedValue(obj, path) {
     return path.split('.').reduce((current, key)=>current === null || current === void 0 ? void 0 : current[key], obj);
 }
+/**
+ * Checks if a key is unsafe for prototype pollution prevention.
+ */ function isUnsafeKey(key) {
+    return key === '__proto__' || key === 'constructor' || key === 'prototype';
+}
 /**
  * Sets a nested value in an object using dot notation.
+ * Prevents prototype pollution by rejecting dangerous property names.
  */ function setNestedValue(obj, path, value) {
     const keys = path.split('.');
     const lastKey = keys.pop();
+    // Prevent prototype pollution via special property names
+    if (isUnsafeKey(lastKey) || keys.some(isUnsafeKey)) {
+        return;
+    }
     const target = keys.reduce((current, key)=>{
+        // Skip if this is an unsafe key (already checked above, but defensive)
+        if (isUnsafeKey(key)) {
+            return current;
+        }
         if (!(key in current)) {
             current[key] = {};
         }
@@ -1060,6 +1117,45 @@ const create$1 = (params)=>{
     });
     return config;
 };
+/**
+ * Tries to find a config file with alternative extensions (.yaml or .yml).
+ * 
+ * @param storage Storage instance to use for file operations
+ * @param configDir The directory containing the config file
+ * @param configFileName The base config file name (may have .yaml or .yml extension)
+ * @param logger Logger for debugging
+ * @returns Promise resolving to the found config file path or null if not found
+ */ async function findConfigFileWithExtension(storage, configDir, configFileName, logger) {
+    // Validate the config file name to prevent path traversal
+    const configFilePath = validatePath(configFileName, configDir);
+    // First try the exact filename as specified
+    const exists = await storage.exists(configFilePath);
+    if (exists) {
+        const isReadable = await storage.isFileReadable(configFilePath);
+        if (isReadable) {
+            return configFilePath;
+        }
+    }
+    // If the exact filename doesn't exist or isn't readable, try alternative extensions
+    // Only do this if the filename has a .yaml or .yml extension
+    const ext = path__namespace.extname(configFileName);
+    if (ext === '.yaml' || ext === '.yml') {
+        const baseName = path__namespace.basename(configFileName, ext);
+        const alternativeExt = ext === '.yaml' ? '.yml' : '.yaml';
+        const alternativeFileName = baseName + alternativeExt;
+        const alternativePath = validatePath(alternativeFileName, configDir);
+        logger.debug(`Config file not found at ${configFilePath}, trying alternative: ${alternativePath}`);
+        const altExists = await storage.exists(alternativePath);
+        if (altExists) {
+            const altIsReadable = await storage.isFileReadable(alternativePath);
+            if (altIsReadable) {
+                logger.debug(`Found config file with alternative extension: ${alternativePath}`);
+                return alternativePath;
+            }
+        }
+    }
+    return null;
+}
 /**
  * Loads configuration from a single directory (traditional mode).
  * 
@@ -1071,11 +1167,16 @@ const create$1 = (params)=>{
     const storage = create$1({
         log: logger.debug
     });
-    const configFile = validatePath(options.defaults.configFile, resolvedConfigDir);
     logger.verbose('Attempting to load config file for cardigantime');
     let rawFileConfig = {};
     try {
-        const yamlContent = await storage.readFile(configFile, options.defaults.encoding);
+        // Try to find the config file with alternative extensions
+        const configFilePath = await findConfigFileWithExtension(storage, resolvedConfigDir, options.defaults.configFile, logger);
+        if (!configFilePath) {
+            logger.verbose('Configuration file not found. Using empty configuration.');
+            return rawFileConfig;
+        }
+        const yamlContent = await storage.readFile(configFilePath, options.defaults.encoding);
         // SECURITY FIX: Use safer parsing options to prevent code execution vulnerabilities
         const parsedYaml = yaml__namespace.load(yamlContent);
         if (parsedYaml !== null && typeof parsedYaml === 'object') {
@@ -1085,6 +1186,10 @@ const create$1 = (params)=>{
             logger.warn('Ignoring invalid configuration format. Expected an object, got ' + typeof parsedYaml);
         }
     } catch (error) {
+        // Re-throw security-related errors (path validation failures)
+        if (error.message && /Invalid path|path traversal|absolute path/i.test(error.message)) {
+            throw error;
+        }
         if (error.code === 'ENOENT' || /not found|no such file/i.test(error.message)) {
             logger.verbose('Configuration file not found. Using empty configuration.');
         } else {