@usearazzo/runner 1.0.1-alpha.13 → 1.0.1-alpha.14

package/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.0.1-alpha.14](https://github.com/usearazzo/arazzo-toolkit/compare/v1.0.1-alpha.13...v1.0.1-alpha.14) (2026-10-27)
+
+### Bug Fixes
+
+- **runner:** reject a parameter location outside the defined set ([#283](https://github.com/usearazzo/arazzo-toolkit/issues/283)) ([250f6bf](https://github.com/usearazzo/arazzo-toolkit/commit/250f6bf6a23bbb8b2f305480dc3d728d419e3017)), closes [#126](https://github.com/usearazzo/arazzo-toolkit/issues/126)
+
 ## [1.0.1-alpha.13](https://github.com/usearazzo/arazzo-toolkit/compare/v1.0.1-alpha.12...v1.0.1-alpha.13) (2026-10-27)
 
 ### Bug Fixes

package/dist/arazzo-runner.browser.js

@@ -10805,6 +10805,14 @@ class ParameterIdentity {
     if (location === undefined || (0,_speclynx_apidom_datamodel__WEBPACK_IMPORTED_MODULE_1__.isNullElement)(location)) return undefined;
     return (0,_speclynx_apidom_datamodel__WEBPACK_IMPORTED_MODULE_1__.isStringElement)(location) ? (0,_speclynx_apidom_core__WEBPACK_IMPORTED_MODULE_0__["default"])(location) : null;
   }
+
+  /**
+   * The locations the Parameter Object defines: Arazzo 1.0.1's closed set plus
+   * 1.1.0's `querystring`. 1.0.0's field description also listed `body`, which
+   * its own summary of locations did not; 1.0.1 removed it as an erratum, so it
+   * is not a location in any version (a payload is the step's `requestBody`).
+   */
+  static LOCATIONS = ['path', 'query', 'header', 'cookie', 'querystring'];
   name;
   location;
   constructor(name, location) {
@@ -10812,6 +10820,14 @@ class ParameterIdentity {
     this.location = location;
   }
 
+  /**
+   * Whether the location is one the Parameter Object defines. An absent or
+   * malformed location is not.
+   */
+  get hasDefinedLocation() {
+    return ParameterIdentity.LOCATIONS.includes(this.location);
+  }
+
   /**
    * Whether this and the other identity name the same parameter. A malformed
    * location equals nothing, its own duplicate included.
@@ -16097,7 +16113,11 @@ __webpack_require__.r(__webpack_exports__);
  * instead would let it capture *every* declared location of that name — see
  * `ParameterDelivery` for the lookup order that makes it so. A
  * non-string location throws for the same reason it deduplicates with nothing
- * in the normalizer: it names no location. And two *different* parameters the
+ * in the normalizer: it names no location. So does a location outside
+ * `path`, `query`, `header`, `cookie` and `querystring`: Arazzo 1.0.1 removed
+ * `in: body`, and forwarding one would let it still deliver a request body
+ * against an OpenAPI 2.0 operation, bypassing the step's `requestBody`, while
+ * an unknown location reaches nothing at all. And two *different* parameters the
  * map reports as colliding cannot both be delivered, so a collision throws
  * rather than silently dropping one — whether they collide on one key (the
  * scheme is not injective: a `querystring` parameter named `header.token` and
@@ -16158,6 +16178,13 @@ class OpenAPIOperationParameterResolver extends _StepParameterResolver_ts__WEBPA
           reason: 'malformed-location'
         });
       }
+      if (!identity.hasDefinedLocation) {
+        throw new _errors_ResolverError_ts__WEBPACK_IMPORTED_MODULE_4__["default"](`Parameter "${name}" has location "${location}", which is not one of ` + `${_document_ParameterIdentity_ts__WEBPACK_IMPORTED_MODULE_3__["default"].LOCATIONS.join(', ')}`, {
+          ...scope,
+          target: name,
+          reason: 'invalid-location'
+        });
+      }
       const {
         key,
         outcome