@workbench-kit/field-remap 0.0.2-prototype.0.2.6 → 0.0.2-prototype.0.2.8

package/src/domain/mapping/convertItemEdges.ts

@@ -1,93 +1,98 @@
-import { edgeTransformIds } from '../document/mappingEdge.js';
-import { applyTransformChain } from '../../registry/createValueTransformRegistry.js';
-import { BUILTIN_TRANSFORM_IDS } from '../../registry/builtinTransforms.js';
-import { resolveOptionSteps } from './transformOptions.js';
-import { isPlainObject, readObjectPath, writeObjectPath } from './pathUtils.js';
-import { findTargetSlot, flattenSourceFields, flattenTargetSlots } from './treeUtils.js';
-import type {
-  MappingEdge,
-  SourceField,
-  TargetSlot,
-  TransformContext,
-  ValueTransformRegistry,
-} from '../types.js';
-
-function findSourceField(fields: readonly SourceField[], fieldId: string): SourceField | undefined {
-  return flattenSourceFields(fields).find((field) => field.id === fieldId);
-}
-
-function itemRelativePath(
-  node: { readonly path?: string; readonly label: string; readonly id: string } | undefined,
-): string {
-  if (!node) {
-    return '';
-  }
-  const path = node.path?.trim();
-  if (path) {
-    return path;
-  }
-  return node.label.trim() || node.id.split('.').pop() || '';
-}
-
-/**
- * Convert each object in a source array through list-context `itemEdges`.
- * Child field paths are treated as item-relative (ingest array children).
- */
-export function convertArrayWithItemEdges(input: {
-  readonly items: unknown;
-  readonly itemEdges: readonly MappingEdge[];
-  readonly sources: readonly SourceField[];
-  readonly targets: readonly TargetSlot[];
-  readonly transforms: ValueTransformRegistry;
-  readonly context?: TransformContext;
-}): unknown[] {
-  if (!Array.isArray(input.items)) {
-    return [];
-  }
-
-  const targetLeaves = flattenTargetSlots(input.targets);
-
-  return input.items.map((rawItem) => {
-    const item = isPlainObject(rawItem) ? rawItem : {};
-    let outItem: Record<string, unknown> = {};
-
-    for (const edge of input.itemEdges) {
-      const sourceField = findSourceField(input.sources, edge.sourceFieldId);
-      const targetSlot =
-        findTargetSlot(input.targets, edge.targetSlotId) ??
-        targetLeaves.find((slot) => slot.id === edge.targetSlotId);
-      if (!sourceField || !targetSlot) {
-        continue;
-      }
-
-      const sourcePath = itemRelativePath(sourceField);
-      const sourceValue = sourcePath ? readObjectPath(item, sourcePath) : undefined;
-
-      const chain = edgeTransformIds(edge);
-      let value: unknown;
-      if (chain.length === 0) {
-        const identity = input.transforms.get(BUILTIN_TRANSFORM_IDS.identity);
-        value = identity
-          ? identity.apply(sourceValue, { ...input.context, sampleValue: sourceValue })
-          : sourceValue;
-      } else {
-        const steps = resolveOptionSteps(chain, edge.transformOptionSteps, edge.transformOptions);
-        value = applyTransformChain(
-          input.transforms,
-          chain,
-          sourceValue,
-          { ...input.context, sampleValue: sourceValue },
-          steps,
-        );
-      }
-
-      const targetPath = itemRelativePath(targetSlot);
-      if (!targetPath) {
-        continue;
-      }
-      outItem = writeObjectPath(outItem, targetPath, value);
-    }
-
-    return outItem;
-  });
-}
+import { throwIfAborted } from '../abort.js';
+import { edgeTransformIds } from '../document/mappingEdge.js';
+import { applyTransformChain } from '../../registry/createValueTransformRegistry.js';
+import { BUILTIN_TRANSFORM_IDS } from '../../registry/builtinTransforms.js';
+import { resolveOptionSteps } from './transformOptions.js';
+import { isPlainObject, readObjectPath, writeObjectPath } from './pathUtils.js';
+import { findTargetSlot, flattenSourceFields, flattenTargetSlots } from './treeUtils.js';
+import type {
+  MappingEdge,
+  SourceField,
+  TargetSlot,
+  TransformContext,
+  ValueTransformRegistry,
+} from '../types.js';
+
+function findSourceField(fields: readonly SourceField[], fieldId: string): SourceField | undefined {
+  return flattenSourceFields(fields).find((field) => field.id === fieldId);
+}
+
+function itemRelativePath(
+  node: { readonly path?: string; readonly label: string; readonly id: string } | undefined,
+): string {
+  if (!node) {
+    return '';
+  }
+  const path = node.path?.trim();
+  if (path) {
+    return path;
+  }
+  return node.label.trim() || node.id.split('.').pop() || '';
+}
+
+/**
+ * Convert each object in a source array through list-context `itemEdges`.
+ * Child field paths are treated as item-relative (ingest array children).
+ */
+export async function convertArrayWithItemEdges(input: {
+  readonly items: unknown;
+  readonly itemEdges: readonly MappingEdge[];
+  readonly sources: readonly SourceField[];
+  readonly targets: readonly TargetSlot[];
+  readonly transforms: ValueTransformRegistry;
+  readonly context?: TransformContext;
+}): Promise<unknown[]> {
+  if (!Array.isArray(input.items)) {
+    return [];
+  }
+
+  const targetLeaves = flattenTargetSlots(input.targets);
+
+  return Promise.all(
+    input.items.map(async (rawItem) => {
+      const item = isPlainObject(rawItem) ? rawItem : {};
+      let outItem: Record<string, unknown> = {};
+
+      for (const edge of input.itemEdges) {
+        throwIfAborted(input.context?.signal);
+
+        const sourceField = findSourceField(input.sources, edge.sourceFieldId);
+        const targetSlot =
+          findTargetSlot(input.targets, edge.targetSlotId) ??
+          targetLeaves.find((slot) => slot.id === edge.targetSlotId);
+        if (!sourceField || !targetSlot) {
+          continue;
+        }
+
+        const sourcePath = itemRelativePath(sourceField);
+        const sourceValue = sourcePath ? readObjectPath(item, sourcePath) : undefined;
+
+        const chain = edgeTransformIds(edge);
+        let value: unknown;
+        if (chain.length === 0) {
+          const identity = input.transforms.get(BUILTIN_TRANSFORM_IDS.identity);
+          value = identity
+            ? await identity.apply(sourceValue, { ...input.context, sampleValue: sourceValue })
+            : sourceValue;
+        } else {
+          const steps = resolveOptionSteps(chain, edge.transformOptionSteps, edge.transformOptions);
+          value = await applyTransformChain(
+            input.transforms,
+            chain,
+            sourceValue,
+            { ...input.context, sampleValue: sourceValue },
+            steps,
+          );
+        }
+
+        const targetPath = itemRelativePath(targetSlot);
+        if (!targetPath) {
+          continue;
+        }
+        outItem = writeObjectPath(outItem, targetPath, value);
+      }
+
+      return outItem;
+    }),
+  );
+}

package/src/domain/mapping/dateFormat.ts

@@ -1,102 +1,102 @@
-export type DateParts = { readonly year: string; readonly month: string; readonly day: string };
-
-const FORMAT_TOKEN_RE = /YYYY|MM|DD/g;
-
-/** Parse a date string with a simple token format (YYYY/MM/DD only). */
-export function parseDateParts(value: string, inputFormat: string): DateParts | undefined {
-  const format = inputFormat.trim();
-  const raw = value.trim();
-  if (!format || !raw) {
-    return undefined;
-  }
-
-  let year = '';
-  let month = '';
-  let day = '';
-  let cursor = 0;
-
-  for (let i = 0; i < format.length;) {
-    if (format.startsWith('YYYY', i)) {
-      year = raw.slice(cursor, cursor + 4);
-      if (!/^\d{4}$/.test(year)) {
-        return undefined;
-      }
-      cursor += 4;
-      i += 4;
-      continue;
-    }
-    if (format.startsWith('MM', i)) {
-      month = raw.slice(cursor, cursor + 2);
-      if (!/^\d{2}$/.test(month)) {
-        return undefined;
-      }
-      cursor += 2;
-      i += 2;
-      continue;
-    }
-    if (format.startsWith('DD', i)) {
-      day = raw.slice(cursor, cursor + 2);
-      if (!/^\d{2}$/.test(day)) {
-        return undefined;
-      }
-      cursor += 2;
-      i += 2;
-      continue;
-    }
-    if (raw[cursor] !== format[i]) {
-      return undefined;
-    }
-    cursor += 1;
-    i += 1;
-  }
-
-  if (cursor !== raw.length || !year || !month || !day) {
-    return undefined;
-  }
-  return { year, month, day };
-}
-
-export function formatDateParts(parts: DateParts, outputFormat: string): string {
-  return outputFormat.replace(FORMAT_TOKEN_RE, (token) => {
-    if (token === 'YYYY') {
-      return parts.year;
-    }
-    if (token === 'MM') {
-      return parts.month;
-    }
-    return parts.day;
-  });
-}
-
-export function reformatDateString(
-  value: string,
-  inputFormat: string,
-  outputFormat: string,
-): string | undefined {
-  const parts = parseDateParts(value, inputFormat);
-  if (!parts) {
-    return undefined;
-  }
-  return formatDateParts(parts, outputFormat);
-}
-
-/** Split `YYYY-MM-DDTHH:mm:ss` / `YYYY-MM-DD HH:mm:ss` / date-only. */
-export function splitDateTimeString(value: string): { date: string; time: string } | undefined {
-  const raw = value.trim();
-  if (!raw) {
-    return undefined;
-  }
-  const tIndex = raw.indexOf('T');
-  const spaceIndex = raw.indexOf(' ');
-  const splitAt = tIndex >= 0 ? tIndex : spaceIndex;
-  if (splitAt < 0) {
-    if (/^\d{4}-\d{2}-\d{2}$/.test(raw) || /^\d{8}$/.test(raw)) {
-      return { date: raw, time: '' };
-    }
-    return undefined;
-  }
-  return {
-    date: raw.slice(0, splitAt),
-    time: raw.slice(splitAt + 1),
-  };
-}
+export type DateParts = { readonly year: string; readonly month: string; readonly day: string };
+
+const FORMAT_TOKEN_RE = /YYYY|MM|DD/g;
+
+/** Parse a date string with a simple token format (YYYY/MM/DD only). */
+export function parseDateParts(value: string, inputFormat: string): DateParts | undefined {
+  const format = inputFormat.trim();
+  const raw = value.trim();
+  if (!format || !raw) {
+    return undefined;
+  }
+
+  let year = '';
+  let month = '';
+  let day = '';
+  let cursor = 0;
+
+  for (let i = 0; i < format.length;) {
+    if (format.startsWith('YYYY', i)) {
+      year = raw.slice(cursor, cursor + 4);
+      if (!/^\d{4}$/.test(year)) {
+        return undefined;
+      }
+      cursor += 4;
+      i += 4;
+      continue;
+    }
+    if (format.startsWith('MM', i)) {
+      month = raw.slice(cursor, cursor + 2);
+      if (!/^\d{2}$/.test(month)) {
+        return undefined;
+      }
+      cursor += 2;
+      i += 2;
+      continue;
+    }
+    if (format.startsWith('DD', i)) {
+      day = raw.slice(cursor, cursor + 2);
+      if (!/^\d{2}$/.test(day)) {
+        return undefined;
+      }
+      cursor += 2;
+      i += 2;
+      continue;
+    }
+    if (raw[cursor] !== format[i]) {
+      return undefined;
+    }
+    cursor += 1;
+    i += 1;
+  }
+
+  if (cursor !== raw.length || !year || !month || !day) {
+    return undefined;
+  }
+  return { year, month, day };
+}
+
+export function formatDateParts(parts: DateParts, outputFormat: string): string {
+  return outputFormat.replace(FORMAT_TOKEN_RE, (token) => {
+    if (token === 'YYYY') {
+      return parts.year;
+    }
+    if (token === 'MM') {
+      return parts.month;
+    }
+    return parts.day;
+  });
+}
+
+export function reformatDateString(
+  value: string,
+  inputFormat: string,
+  outputFormat: string,
+): string | undefined {
+  const parts = parseDateParts(value, inputFormat);
+  if (!parts) {
+    return undefined;
+  }
+  return formatDateParts(parts, outputFormat);
+}
+
+/** Split `YYYY-MM-DDTHH:mm:ss` / `YYYY-MM-DD HH:mm:ss` / date-only. */
+export function splitDateTimeString(value: string): { date: string; time: string } | undefined {
+  const raw = value.trim();
+  if (!raw) {
+    return undefined;
+  }
+  const tIndex = raw.indexOf('T');
+  const spaceIndex = raw.indexOf(' ');
+  const splitAt = tIndex >= 0 ? tIndex : spaceIndex;
+  if (splitAt < 0) {
+    if (/^\d{4}-\d{2}-\d{2}$/.test(raw) || /^\d{8}$/.test(raw)) {
+      return { date: raw, time: '' };
+    }
+    return undefined;
+  }
+  return {
+    date: raw.slice(0, splitAt),
+    time: raw.slice(splitAt + 1),
+  };
+}

package/src/domain/mapping/mappingConflicts.ts

@@ -1,90 +1,90 @@
-import type { MappingEdge, SourceField, TargetSlot } from '../types.js';
-import { flattenSourceFields, flattenTargetSlots } from './treeUtils.js';
-
-export interface MappingConflict {
-  readonly kind: 'parent-child-source' | 'parent-child-target';
-  readonly parentId: string;
-  readonly childId: string;
-  readonly parentEdgeId: string;
-  readonly childEdgeId: string;
-}
-
-function isAncestorId(ancestorId: string, descendantId: string): boolean {
-  return (
-    descendantId.startsWith(`${ancestorId}.`) || descendantId.startsWith(`${ancestorId}.item.`)
-  );
-}
-
-/**
- * Detect edges that map both a parent object/array and one of its descendants.
- * Hosts should warn — writing both usually overwrites or double-defines output.
- */
-export function findParentChildMappingConflicts(
-  edges: readonly MappingEdge[],
-  sources: readonly SourceField[],
-  targets: readonly TargetSlot[],
-): MappingConflict[] {
-  const sourceIds = new Set(flattenSourceFields(sources).map((field) => field.id));
-  const targetIds = new Set(flattenTargetSlots(targets).map((slot) => slot.id));
-  const conflicts: MappingConflict[] = [];
-
-  for (let i = 0; i < edges.length; i += 1) {
-    const a = edges[i]!;
-    for (let j = i + 1; j < edges.length; j += 1) {
-      const b = edges[j]!;
-      if (
-        sourceIds.has(a.sourceFieldId) &&
-        sourceIds.has(b.sourceFieldId) &&
-        isAncestorId(a.sourceFieldId, b.sourceFieldId)
-      ) {
-        conflicts.push({
-          kind: 'parent-child-source',
-          parentId: a.sourceFieldId,
-          childId: b.sourceFieldId,
-          parentEdgeId: a.id,
-          childEdgeId: b.id,
-        });
-      } else if (
-        sourceIds.has(a.sourceFieldId) &&
-        sourceIds.has(b.sourceFieldId) &&
-        isAncestorId(b.sourceFieldId, a.sourceFieldId)
-      ) {
-        conflicts.push({
-          kind: 'parent-child-source',
-          parentId: b.sourceFieldId,
-          childId: a.sourceFieldId,
-          parentEdgeId: b.id,
-          childEdgeId: a.id,
-        });
-      }
-
-      if (
-        targetIds.has(a.targetSlotId) &&
-        targetIds.has(b.targetSlotId) &&
-        isAncestorId(a.targetSlotId, b.targetSlotId)
-      ) {
-        conflicts.push({
-          kind: 'parent-child-target',
-          parentId: a.targetSlotId,
-          childId: b.targetSlotId,
-          parentEdgeId: a.id,
-          childEdgeId: b.id,
-        });
-      } else if (
-        targetIds.has(a.targetSlotId) &&
-        targetIds.has(b.targetSlotId) &&
-        isAncestorId(b.targetSlotId, a.targetSlotId)
-      ) {
-        conflicts.push({
-          kind: 'parent-child-target',
-          parentId: b.targetSlotId,
-          childId: a.targetSlotId,
-          parentEdgeId: b.id,
-          childEdgeId: a.id,
-        });
-      }
-    }
-  }
-
-  return conflicts;
-}
+import type { MappingEdge, SourceField, TargetSlot } from '../types.js';
+import { flattenSourceFields, flattenTargetSlots } from './treeUtils.js';
+
+export interface MappingConflict {
+  readonly kind: 'parent-child-source' | 'parent-child-target';
+  readonly parentId: string;
+  readonly childId: string;
+  readonly parentEdgeId: string;
+  readonly childEdgeId: string;
+}
+
+function isAncestorId(ancestorId: string, descendantId: string): boolean {
+  return (
+    descendantId.startsWith(`${ancestorId}.`) || descendantId.startsWith(`${ancestorId}.item.`)
+  );
+}
+
+/**
+ * Detect edges that map both a parent object/array and one of its descendants.
+ * Hosts should warn — writing both usually overwrites or double-defines output.
+ */
+export function findParentChildMappingConflicts(
+  edges: readonly MappingEdge[],
+  sources: readonly SourceField[],
+  targets: readonly TargetSlot[],
+): MappingConflict[] {
+  const sourceIds = new Set(flattenSourceFields(sources).map((field) => field.id));
+  const targetIds = new Set(flattenTargetSlots(targets).map((slot) => slot.id));
+  const conflicts: MappingConflict[] = [];
+
+  for (let i = 0; i < edges.length; i += 1) {
+    const a = edges[i]!;
+    for (let j = i + 1; j < edges.length; j += 1) {
+      const b = edges[j]!;
+      if (
+        sourceIds.has(a.sourceFieldId) &&
+        sourceIds.has(b.sourceFieldId) &&
+        isAncestorId(a.sourceFieldId, b.sourceFieldId)
+      ) {
+        conflicts.push({
+          kind: 'parent-child-source',
+          parentId: a.sourceFieldId,
+          childId: b.sourceFieldId,
+          parentEdgeId: a.id,
+          childEdgeId: b.id,
+        });
+      } else if (
+        sourceIds.has(a.sourceFieldId) &&
+        sourceIds.has(b.sourceFieldId) &&
+        isAncestorId(b.sourceFieldId, a.sourceFieldId)
+      ) {
+        conflicts.push({
+          kind: 'parent-child-source',
+          parentId: b.sourceFieldId,
+          childId: a.sourceFieldId,
+          parentEdgeId: b.id,
+          childEdgeId: a.id,
+        });
+      }
+
+      if (
+        targetIds.has(a.targetSlotId) &&
+        targetIds.has(b.targetSlotId) &&
+        isAncestorId(a.targetSlotId, b.targetSlotId)
+      ) {
+        conflicts.push({
+          kind: 'parent-child-target',
+          parentId: a.targetSlotId,
+          childId: b.targetSlotId,
+          parentEdgeId: a.id,
+          childEdgeId: b.id,
+        });
+      } else if (
+        targetIds.has(a.targetSlotId) &&
+        targetIds.has(b.targetSlotId) &&
+        isAncestorId(b.targetSlotId, a.targetSlotId)
+      ) {
+        conflicts.push({
+          kind: 'parent-child-target',
+          parentId: b.targetSlotId,
+          childId: a.targetSlotId,
+          parentEdgeId: b.id,
+          childEdgeId: a.id,
+        });
+      }
+    }
+  }
+
+  return conflicts;
+}

package/src/domain/mapping/objectPathSafety.ts

@@ -0,0 +1,51 @@
+/**
+ * Object-path safety gate for field-remap read/write and template placeholders.
+ * Keeps prototype-mutating segments out of dotted path traversal.
+ */
+
+/** Identifier or dotted path: `city`, `a.b` (no expressions / eval). */
+const SAFE_PATH_RE = /^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)*$/;
+
+const UNSAFE_OBJECT_PATH_SEGMENTS = new Set(['__proto__', 'constructor', 'prototype']);
+
+export class UnsafeObjectPathError extends Error {
+  readonly code = 'unsafe_object_path' as const;
+  readonly path: string;
+  readonly segment: string;
+
+  constructor(path: string, segment: string) {
+    super(`Object path "${path}" contains unsafe segment "${segment}".`);
+    this.name = 'UnsafeObjectPathError';
+    this.path = path;
+    this.segment = segment;
+  }
+}
+
+function objectPathParts(path: string): string[] {
+  return path
+    .split('.')
+    .map((part) => part.trim())
+    .filter((part) => part.length > 0);
+}
+
+function findUnsafeObjectPathSegment(parts: readonly string[]): string | undefined {
+  return parts.find((part) => UNSAFE_OBJECT_PATH_SEGMENTS.has(part));
+}
+
+/** Parse dotted path segments and reject unsafe segments when any parts exist. */
+export function requireObjectPathParts(path: string): string[] {
+  const parts = objectPathParts(path);
+  const unsafeSegment = findUnsafeObjectPathSegment(parts);
+  if (unsafeSegment) {
+    throw new UnsafeObjectPathError(path, unsafeSegment);
+  }
+  return parts;
+}
+
+export function isSafeObjectPath(path: string): boolean {
+  const trimmed = path.trim();
+  return (
+    SAFE_PATH_RE.test(trimmed) &&
+    findUnsafeObjectPathSegment(objectPathParts(trimmed)) === undefined
+  );
+}