@tokenoftrust/cli 4.10.0 → 4.11.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "4.10.0",
+  "version": "4.11.0",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/analytics-declaration.mjs

@@ -10,8 +10,9 @@
  * input; `agency-kit/tools/lib/fixtures/analytics-declarations.json` is run through both, so a
  * drift on either side fails a test.
  *
- * Messages carry no value from the file — never an id, never a key's value — only the field path
- * and a fixed explanation, so a finding is safe to print, log or forward.
+ * Messages carry no value from the file — never an id, never a key's value, never an unrecognized
+ * key — only the field path and a fixed explanation, so a finding is safe to print, log or forward.
+ * An unrecognized key is anchored by its position among the rejected keys (`$property[0]`).
  *
  * Pure: callers pass the file's text. `packages/cli/src/analytics-declaration.mjs` is a
  * byte-identical copy (a test pins it).
@@ -77,6 +78,17 @@ function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+/**
+ * The anchor for the `ordinal`-th rejected key of an object. A rejected key is untrusted text, so
+ * the path names its position among the rejected keys, never the key.
+ * @param {string} base
+ * @param {number} ordinal
+ */
+function rejectedKeyPath(base, ordinal) {
+  const anchor = `$property[${ordinal}]`;
+  return base ? `${base}.${anchor}` : anchor;
+}
+
 /**
  * @param {Record<string, unknown>} obj
  * @param {readonly string[]} allowed
@@ -84,9 +96,11 @@ function isPlainObject(value) {
  * @param {AnalyticsViolation[]} out
  */
 function unknownKeys(obj, allowed, base, out) {
+  let ordinal = 0;
   for (const key of Object.keys(obj)) {
     if (allowed.includes(key) || ANNOTATION_KEYS.includes(key)) continue;
-    out.push({ path: base ? `${base}.${key}` : key, code: "unknown_field" });
+    out.push({ path: rejectedKeyPath(base, ordinal), code: "unknown_field" });
+    ordinal += 1;
   }
 }
 
@@ -100,12 +114,14 @@ function unknownKeys(obj, allowed, base, out) {
 function stageIdViolations(ids, adapter, base, out) {
   /** @type {Map<string, string[]>} */
   const valid = new Map();
+  let rejectedStages = 0;
   for (const [stage, raw] of Object.entries(ids)) {
-    const at = `${base}.ids.${stage}`;
     if (!ANALYTICS_STAGES.includes(stage)) {
-      out.push({ path: at, code: "unknown_enum" });
+      out.push({ path: rejectedKeyPath(`${base}.ids`, rejectedStages), code: "unknown_enum" });
+      rejectedStages += 1;
       continue;
     }
+    const at = `${base}.ids.${stage}`;
     if (!Array.isArray(raw)) {
       out.push({ path: at, code: "type" });
       continue;