@usearazzo/runner 1.0.1-alpha.16 → 1.0.1-alpha.17

package/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.0.1-alpha.17](https://github.com/usearazzo/arazzo-toolkit/compare/v1.0.1-alpha.16...v1.0.1-alpha.17) (2026-10-29)
+
+### Bug Fixes
+
+- **runner:** reject a querystring name shaped like a location key ([#292](https://github.com/usearazzo/arazzo-toolkit/issues/292)) ([de44f5e](https://github.com/usearazzo/arazzo-toolkit/commit/de44f5e4c65b225cb3c6caad9887d5b51fcd02b8)), closes [#280](https://github.com/usearazzo/arazzo-toolkit/issues/280)
+
 ## [1.0.1-alpha.16](https://github.com/usearazzo/arazzo-toolkit/compare/v1.0.1-alpha.15...v1.0.1-alpha.16) (2026-10-28)
 
 ### Bug Fixes

package/dist/arazzo-runner.browser.js

@@ -9776,10 +9776,19 @@ class OpenAPIOperationResponseNormalizer {
 
 "use strict";
 __webpack_require__.r(__webpack_exports__);
+/**
+ * A key starting with an `in` value the client builds qualified keys from —
+ * the OpenAPI locations, including OpenAPI 2.0's `formData` and `body`. The
+ * client qualifies whatever `in` an operation declares, so a non-standard one
+ * is not covered.
+ */
+const QUALIFIED_KEY = /^(?:path|query|header|cookie|formData|body)\./;
+
 /**
  * The outcome of claiming a delivery key: `claimed` for a first claim,
- * `duplicate` when the same `(name, in)` parameter claims its key again, and
- * `collision` when a *different* parameter produces an already-claimed key.
+ * `duplicate` when the same `(name, in)` parameter claims its key again,
+ * `collision` when a *different* parameter produces an already-claimed key,
+ * and `misaddressed` when a bare key has the shape of a qualified one.
  * @internal
  */
 
@@ -9819,8 +9828,16 @@ __webpack_require__.r(__webpack_exports__);
  * alone identifies the claimant. A bare key and a qualified key sharing one
  * name are a collision too, even though the keys differ — the client consults
  * the bare name first for every declared parameter bearing it, so the bare
- * entry would silently capture the qualified one. What to do about a
- * collision is the caller's policy — the map only reports it.
+ * entry would silently capture the qualified one.
+ *
+ * A bare key that starts with a location the client qualifies keys with
+ * (`querystring` named `header.X-Foo`) is misaddressed even when it claims
+ * alone: the client matches it as the qualified key of every declared
+ * parameter that location and the rest of the name identify, so the value
+ * would reach the header `X-Foo` — and `OpenAPIOperationExecutor` reads such
+ * a key the same way when it delivers undeclared parameters. What to do about
+ * a collision or a misaddressed key is the caller's policy — the map only
+ * reports it.
  *
  * Diff this against the vendored bundle's lookup when bumping swagger-client.
  * @internal
@@ -9843,10 +9860,16 @@ class ParameterDelivery {
    * Only a `claimed` outcome entitles the caller to {@link ParameterDelivery.set}
    * the key; a `duplicate` means the same parameter already holds it, and a
    * `collision` means a different parameter does — on the same key, or across
-   * a bare/qualified pair sharing the name (see the class doc).
+   * a bare/qualified pair sharing the name (see the class doc). A
+   * `misaddressed` bare key is never claimed.
    */
   claim(location, name) {
     const key = ParameterDelivery.keyFor(location, name);
+    const bare = key === name;
+    if (bare && QUALIFIED_KEY.test(name)) return {
+      key,
+      outcome: 'misaddressed'
+    };
     const claimant = this.#claimedBy.get(key);
     if (claimant !== undefined) {
       return {
@@ -9854,7 +9877,6 @@ class ParameterDelivery {
         outcome: claimant === location ? 'duplicate' : 'collision'
       };
     }
-    const bare = key === name;
     if (bare ? this.#qualifiedNames.has(name) : this.#bareNames.has(name)) {
       return {
         key,
@@ -16192,12 +16214,15 @@ __webpack_require__.r(__webpack_exports__);
  * against an OpenAPI 2.0 operation, bypassing the step's `requestBody`, while
  * an unknown location reaches nothing at all. And two *different* parameters the
  * map reports as colliding cannot both be delivered, so a collision throws
- * rather than silently dropping one — whether they collide on one key (the
- * scheme is not injective: a `querystring` parameter named `header.token` and
- * a header parameter named `token` both produce `header.token`) or across a
- * bare/qualified pair sharing a name (a `querystring` `token` next to a
- * header `token`), where the client would consult the bare name first and
- * silently capture the qualified value.
+ * rather than silently dropping one — a bare/qualified pair sharing a name (a
+ * `querystring` `token` next to a header `token`), where the client would
+ * consult the bare name first and silently capture the qualified value. A
+ * `querystring` parameter whose name starts with a location the client
+ * qualifies keys with (`header.X-Foo`) throws even alone: the client would
+ * match its bare key as the qualified key of a declared header `X-Foo` and
+ * deliver it there. The same check rejects it, in either order, next to a
+ * header parameter `X-Foo` producing that very key — the scheme is not
+ * injective, so the two could otherwise collide on one key.
  * @public
  */
 class OpenAPIOperationParameterResolver extends _StepParameterResolver_ts__WEBPACK_IMPORTED_MODULE_5__["default"] {
@@ -16264,8 +16289,9 @@ class OpenAPIOperationParameterResolver extends _StepParameterResolver_ts__WEBPA
       } = delivery.claim(location, name);
       // the same parameter declared again: the earlier, more specific one won
       if (outcome === 'duplicate') continue;
-      if (outcome === 'collision') {
-        throw new _errors_ResolverError_ts__WEBPACK_IMPORTED_MODULE_4__["default"](`Parameter "${name}" (in: ${location}) collides with another parameter on the ` + `delivery key "${key}" and cannot be delivered unambiguously`, {
+      if (outcome !== 'claimed') {
+        const why = outcome === 'collision' ? `collides with another parameter on the delivery key "${key}"` : 'has a name the client reads as the delivery key of another location';
+        throw new _errors_ResolverError_ts__WEBPACK_IMPORTED_MODULE_4__["default"](`Parameter "${name}" (in: ${location}) ${why} and cannot be delivered unambiguously`, {
           ...scope,
           target: name,
           reason: 'ambiguous-delivery'