@yiaany/ghostapi 0.1.9 → 0.2.0

package/dist/scenarios/scenarioBundle.js

@@ -1,8 +1,8 @@
 import { lstat, mkdir, readFile, realpath } from "node:fs/promises";
-import { basename, dirname, isAbsolute, relative, resolve, sep, join } from "node:path";
+import { basename, dirname, isAbsolute, relative, resolve, sep, join, } from "node:path";
 import { getDataPaths } from "../config/dataPaths.js";
 import { atomicWriteJson } from "../storage/fileStore.js";
-import { isSecretFieldName, sanitizeSecretString, sanitizeSecrets } from "../security/secrets.js";
+import { isSecretFieldName, sanitizeSecretString, sanitizeSecrets, } from "../security/secrets.js";
 import { isSafeRelativeLocation } from "../security/headerSanitizer.js";
 const MAX_CAPTURE_BYTES = 1024 * 1024;
 const MAX_BUNDLE_BYTES = 512 * 1024;
@@ -11,10 +11,34 @@ const MAX_VARIABLES = 200;
 const MAX_VALUE_DEPTH = 30;
 const MAX_VALUE_KEYS = 200;
 const VARIABLE_PATTERN = /\{\{ghostapi\.var\.([a-z][a-z0-9_]*)\}\}/g;
-const SENSITIVE_QUERY_KEYS = new Set(["api_key", "apikey", "access_token", "refresh_token", "token", "secret", "key", "client_secret", "password", "authorization", "cookie"]);
+const SENSITIVE_QUERY_KEYS = new Set([
+    "api_key",
+    "apikey",
+    "access_token",
+    "refresh_token",
+    "token",
+    "secret",
+    "key",
+    "client_secret",
+    "password",
+    "authorization",
+    "cookie",
+]);
 const SAFE_REQUEST_HEADERS = new Set(["accept", "content-type"]);
-const SAFE_RESPONSE_HEADERS = new Set(["content-type", "retry-after", "location"]);
-const METHODS = new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
+const SAFE_RESPONSE_HEADERS = new Set([
+    "content-type",
+    "retry-after",
+    "location",
+]);
+const METHODS = new Set([
+    "GET",
+    "POST",
+    "PUT",
+    "PATCH",
+    "DELETE",
+    "HEAD",
+    "OPTIONS",
+]);
 export class ScenarioBundleError extends Error {
     constructor(message) {
         super(message);
@@ -47,7 +71,7 @@ export class ScenarioReplayer {
             index: this.cursor,
             status: interaction.response.status,
             headers: resolveHeaders(interaction.response.headers, this.bundle.variables, this.bindings),
-            body: resolveVariables(interaction.response.body, this.bundle.variables, this.bindings)
+            body: resolveVariables(interaction.response.body, this.bundle.variables, this.bindings),
         };
     }
     get remaining() {
@@ -67,7 +91,7 @@ export function prepareScenarioRecording(input, options) {
         pii: { emails: true, phones: true, addresses: true, ...options.pii },
         categories: new Set(),
         replacements: 0,
-        variables: new Map()
+        variables: new Map(),
     };
     const hosts = new Set();
     const interactions = rawInteractions.map((raw) => {
@@ -78,28 +102,32 @@ export function prepareScenarioRecording(input, options) {
                 method: raw.request.method,
                 path: sanitizePath(url, state),
                 headers: sanitizeHeaders(raw.request.headers, SAFE_REQUEST_HEADERS, state, false),
-                body: sanitizeBody(raw.request.body, raw.request.binary || raw.request.multipart, state)
+                body: sanitizeBody(raw.request.body, raw.request.binary || raw.request.multipart, state),
             },
             response: {
                 status: raw.response.status,
                 headers: sanitizeHeaders(raw.response.headers, SAFE_RESPONSE_HEADERS, state, true),
-                body: sanitizeBody(raw.response.body, raw.response.binary || raw.response.multipart, state)
-            }
+                body: sanitizeBody(raw.response.body, raw.response.binary || raw.response.multipart, state),
+            },
         };
     });
     const title = normalizeTitle(options.title ?? "Sandbox recording");
     const summary = {
         categories: [...state.categories].sort(),
         replacements: state.replacements,
-        requiresApproval: state.categories.size > 0
+        requiresApproval: state.categories.size > 0,
     };
     const bundle = {
         schemaVersion: 1,
         kind: "ghostapi.scenario-bundle",
-        metadata: { title, recordedAt: options.recordedAt ?? new Date().toISOString(), sandboxHosts: [...hosts].sort() },
+        metadata: {
+            title,
+            recordedAt: options.recordedAt ?? new Date().toISOString(),
+            sandboxHosts: [...hosts].sort(),
+        },
         sanitization: summary,
         variables: [...state.variables.values()],
-        interactions
+        interactions,
     };
     return validateScenarioBundle(bundle);
 }
@@ -130,12 +158,19 @@ export function formatScenarioSanitizationSummary(summary) {
         "GhostAPI recording sanitization summary",
         `Categories: ${categories}`,
         `Replacements: ${summary.replacements}`,
-        `Approval required: ${summary.requiresApproval ? "yes" : "no"}`
+        `Approval required: ${summary.requiresApproval ? "yes" : "no"}`,
     ].join("\n");
 }
 export function validateScenarioBundle(input) {
     const root = readObject(migrateScenarioBundle(input), "Scenario bundle must be an object.");
-    assertExactKeys(root, ["schemaVersion", "kind", "metadata", "sanitization", "variables", "interactions"], "Scenario bundle");
+    assertExactKeys(root, [
+        "schemaVersion",
+        "kind",
+        "metadata",
+        "sanitization",
+        "variables",
+        "interactions",
+    ], "Scenario bundle");
     if (root.schemaVersion !== 1)
         throw new ScenarioBundleError("Unsupported scenario bundle schema version.");
     if (root.kind !== "ghostapi.scenario-bundle")
@@ -149,7 +184,9 @@ export function validateScenarioBundle(input) {
     const sanitization = readObject(root.sanitization, "Scenario bundle sanitization summary is invalid.");
     assertExactKeys(sanitization, ["categories", "replacements", "requiresApproval"], "Scenario bundle sanitization summary");
     const categories = readStringArray(sanitization.categories, "Scenario bundle sanitization categories are invalid.");
-    if (!Number.isInteger(sanitization.replacements) || sanitization.replacements < 0 || typeof sanitization.requiresApproval !== "boolean") {
+    if (!Number.isInteger(sanitization.replacements) ||
+        sanitization.replacements < 0 ||
+        typeof sanitization.requiresApproval !== "boolean") {
         throw new ScenarioBundleError("Scenario bundle sanitization summary is invalid.");
     }
     if (!Array.isArray(root.variables) || root.variables.length > MAX_VARIABLES)
@@ -158,7 +195,11 @@ export function validateScenarioBundle(input) {
     const variables = root.variables.map((entry) => {
         const variable = readObject(entry, "Scenario bundle variable is invalid.");
         assertExactKeys(variable, ["name", "value"], "Scenario bundle variable");
-        if (typeof variable.name !== "string" || !/^[a-z][a-z0-9_]{0,63}$/.test(variable.name) || typeof variable.value !== "string" || variable.value.length > 2_000 || sanitizeSecretString(variable.value) !== variable.value) {
+        if (typeof variable.name !== "string" ||
+            !/^[a-z][a-z0-9_]{0,63}$/.test(variable.name) ||
+            typeof variable.value !== "string" ||
+            variable.value.length > 2_000 ||
+            sanitizeSecretString(variable.value) !== variable.value) {
             throw new ScenarioBundleError("Scenario bundle variable is invalid.");
         }
         if (names.has(variable.name))
@@ -166,17 +207,27 @@ export function validateScenarioBundle(input) {
         names.add(variable.name);
         return { name: variable.name, value: variable.value };
     });
-    if (!Array.isArray(root.interactions) || root.interactions.length === 0 || root.interactions.length > MAX_INTERACTIONS) {
+    if (!Array.isArray(root.interactions) ||
+        root.interactions.length === 0 ||
+        root.interactions.length > MAX_INTERACTIONS) {
         throw new ScenarioBundleError(`Scenario bundle interactions must contain 1-${MAX_INTERACTIONS} entries.`);
     }
     const interactions = root.interactions.map((entry) => normalizeBundleInteraction(entry, names));
     return {
         schemaVersion: 1,
         kind: "ghostapi.scenario-bundle",
-        metadata: { title, recordedAt: metadata.recordedAt, sandboxHosts },
-        sanitization: { categories: [...new Set(categories)].sort(), replacements: sanitization.replacements, requiresApproval: sanitization.requiresApproval },
+        metadata: {
+            title,
+            recordedAt: metadata.recordedAt,
+            sandboxHosts,
+        },
+        sanitization: {
+            categories: [...new Set(categories)].sort(),
+            replacements: sanitization.replacements,
+            requiresApproval: sanitization.requiresApproval,
+        },
         variables,
-        interactions
+        interactions,
     };
 }
 export function migrateScenarioBundle(input) {
@@ -185,15 +236,31 @@ export function migrateScenarioBundle(input) {
         return source;
     if (source.schemaVersion !== 0)
         throw new ScenarioBundleError("Unsupported scenario bundle schema version; no migration is registered.");
-    assertExactKeys(source, ["schemaVersion", "kind", "title", "recordedAt", "sandboxHosts", "variables", "interactions"], "Scenario bundle v0");
+    assertExactKeys(source, [
+        "schemaVersion",
+        "kind",
+        "title",
+        "recordedAt",
+        "sandboxHosts",
+        "variables",
+        "interactions",
+    ], "Scenario bundle v0");
     return {
         schemaVersion: 1,
         kind: source.kind,
-        metadata: { title: source.title, recordedAt: source.recordedAt, sandboxHosts: source.sandboxHosts },
+        metadata: {
+            title: source.title,
+            recordedAt: source.recordedAt,
+            sandboxHosts: source.sandboxHosts,
+        },
         // A migrated legacy bundle has no verifiable sanitizer receipt, so force operator review.
-        sanitization: { categories: ["legacy-bundle"], replacements: 0, requiresApproval: true },
+        sanitization: {
+            categories: ["legacy-bundle"],
+            replacements: 0,
+            requiresApproval: true,
+        },
         variables: source.variables,
-        interactions: source.interactions
+        interactions: source.interactions,
     };
 }
 function normalizeBundleInteraction(input, variableNames) {
@@ -215,11 +282,17 @@ function normalizeBundleRequest(input, variableNames) {
 function normalizeBundleResponse(input, variableNames) {
     const response = readObject(input, "Scenario bundle response is invalid.");
     assertExactKeys(response, ["status", "headers", "body"], "Scenario bundle response");
-    if (!Number.isInteger(response.status) || response.status < 100 || response.status > 599)
+    if (!Number.isInteger(response.status) ||
+        response.status < 100 ||
+        response.status > 599)
         throw new ScenarioBundleError("Scenario bundle response status must be 100-599.");
     const headers = validateHeaders(response.headers, SAFE_RESPONSE_HEADERS, variableNames, true);
     validateValue(response.body, variableNames);
-    return { status: response.status, headers, body: structuredClone(response.body) };
+    return {
+        status: response.status,
+        headers,
+        body: structuredClone(response.body),
+    };
 }
 function parseCapture(input) {
     const capture = readObject(input, "Recording input must be an object.");
@@ -243,15 +316,15 @@ function parseDirectInteraction(input) {
             headers: requestHeaders,
             body: request.body ?? null,
             binary: request.bodyEncoding === "base64",
-            multipart: isMultipart(requestHeaders)
+            multipart: isMultipart(requestHeaders),
         },
         response: {
             status: readStatus(response.status),
             headers: responseHeaders,
             body: response.body ?? null,
             binary: response.bodyEncoding === "base64",
-            multipart: isMultipart(responseHeaders)
-        }
+            multipart: isMultipart(responseHeaders),
+        },
     };
 }
 function parseHarInteraction(input) {
@@ -260,8 +333,12 @@ function parseHarInteraction(input) {
     const response = readObject(entry.response, "HAR response is invalid.");
     const requestHeaders = readHeaderInput(request.headers);
     const responseHeaders = readHeaderInput(response.headers);
-    const postData = request.postData === undefined ? null : readObject(request.postData, "HAR request postData is invalid.");
-    const content = response.content === undefined ? null : readObject(response.content, "HAR response content is invalid.");
+    const postData = request.postData === undefined
+        ? null
+        : readObject(request.postData, "HAR request postData is invalid.");
+    const content = response.content === undefined
+        ? null
+        : readObject(response.content, "HAR response content is invalid.");
     return {
         request: {
             method: normalizeMethod(request.method),
@@ -269,15 +346,15 @@ function parseHarInteraction(input) {
             headers: requestHeaders,
             body: parseCaptureText(postData?.text, postData?.mimeType),
             binary: postData?.encoding === "base64",
-            multipart: isMultipart(requestHeaders) || isMultipartMime(postData?.mimeType)
+            multipart: isMultipart(requestHeaders) || isMultipartMime(postData?.mimeType),
         },
         response: {
             status: readStatus(response.status),
             headers: responseHeaders,
             body: parseCaptureText(content?.text, content?.mimeType),
             binary: content?.encoding === "base64",
-            multipart: isMultipart(responseHeaders) || isMultipartMime(content?.mimeType)
-        }
+            multipart: isMultipart(responseHeaders) || isMultipartMime(content?.mimeType),
+        },
     };
 }
 function parseCaptureText(value, mimeType) {
@@ -317,7 +394,11 @@ function sanitizeHeaders(headers, allowed, state, response) {
     for (const [name, value] of Object.entries(headers)) {
         const lower = name.toLowerCase();
         if (isSecretFieldName(lower)) {
-            mark(state, lower.includes("cookie") ? "cookie" : lower.includes("authorization") ? "authorization" : "secret-header");
+            mark(state, lower.includes("cookie")
+                ? "cookie"
+                : lower.includes("authorization")
+                    ? "authorization"
+                    : "secret-header");
             continue;
         }
         if (!allowed.has(lower))
@@ -355,7 +436,9 @@ function sanitizeValue(value, state, key, depth = 0) {
                 mark(state, "known-api-key");
                 return [];
             }
-            return [[childKey, sanitizeValue(childValue, state, childKey, depth + 1)]];
+            return [
+                [childKey, sanitizeValue(childValue, state, childKey, depth + 1)],
+            ];
         }));
     }
     if (typeof value !== "string")
@@ -364,18 +447,22 @@ function sanitizeValue(value, state, key, depth = 0) {
         mark(state, "known-api-key");
         return "***";
     }
-    if (state.pii.addresses && key !== undefined && /(?:address|line1|line2|city|state|postal|zip)/i.test(key)) {
+    if (state.pii.addresses &&
+        key !== undefined &&
+        /(?:address|line1|line2|city|state|postal|zip)/i.test(key)) {
         mark(state, "address");
         return "[redacted:address]";
     }
     let result = sanitizeSecretString(value);
     if (result !== value)
         mark(state, "known-api-key");
-    if (state.pii.emails && /[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/i.test(result)) {
+    if (state.pii.emails &&
+        /[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/i.test(result)) {
         result = result.replace(/[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/gi, "[redacted:email]");
         mark(state, "email");
     }
-    if (state.pii.phones && /(?:\+\d[\d(). -]{7,}\d|\b\d{3}[ .-]\d{3}[ .-]\d{4}\b)/.test(result)) {
+    if (state.pii.phones &&
+        /(?:\+\d[\d(). -]{7,}\d|\b\d{3}[ .-]\d{3}[ .-]\d{4}\b)/.test(result)) {
         result = result.replace(/(?:\+\d[\d(). -]{7,}\d|\b\d{3}[ .-]\d{3}[ .-]\d{4}\b)/g, "[redacted:phone]");
         mark(state, "phone");
     }
@@ -385,8 +472,12 @@ function sanitizeValue(value, state, key, depth = 0) {
 }
 function replaceUnstableIdentifiers(value, state, key) {
     return value.replace(/\b(?:cus|pi|in|sub|evt|re|ch|pm|price|prod|cs|ord|user|msg|email)_[A-Za-z0-9]+\b|\b[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\b/gi, (match) => {
-        const prefix = match.includes("_") ? match.split("_", 1)[0].toLowerCase() : "id";
-        const nameHint = key !== undefined && /id$/i.test(key) ? key.replace(/[^a-z0-9]+/gi, "_").toLowerCase() : `${prefix}_id`;
+        const prefix = match.includes("_")
+            ? match.split("_", 1)[0].toLowerCase()
+            : "id";
+        const nameHint = key !== undefined && /id$/i.test(key)
+            ? key.replace(/[^a-z0-9]+/gi, "_").toLowerCase()
+            : `${prefix}_id`;
         return variableReference(getVariable(state, match, nameHint, `${prefix}_recorded_${state.variables.size + 1}`));
     });
 }
@@ -396,7 +487,10 @@ function getVariable(state, raw, hint, value) {
         return existing;
     if (state.variables.size >= MAX_VARIABLES)
         throw new ScenarioBundleError(`Recording exceeds ${MAX_VARIABLES} stateful variables.`);
-    const base = hint.replace(/[^a-z0-9]+/gi, "_").replace(/^_+|_+$/g, "").toLowerCase() || "value";
+    const base = hint
+        .replace(/[^a-z0-9]+/gi, "_")
+        .replace(/^_+|_+$/g, "")
+        .toLowerCase() || "value";
     let name = base;
     let suffix = 1;
     const names = new Set([...state.variables.values()].map((entry) => entry.name));
@@ -433,13 +527,21 @@ function parseSandboxUrl(value, allowedHosts, headers) {
 function looksLikeSandboxHost(host, headers) {
     if (host === "api.stripe.com")
         return /\b(?:sk|rk)_test_[A-Za-z0-9_-]+/i.test(headers.authorization ?? "");
-    return host === "localhost" || host.endsWith(".localhost") || /(?:sandbox|test)/i.test(host);
+    return (host === "localhost" ||
+        host.endsWith(".localhost") ||
+        /(?:sandbox|test)/i.test(host));
 }
 function normalizeAllowedSandboxHosts(hosts) {
     if (hosts.length === 0)
         throw new ScenarioBundleError("Recording requires at least one explicit --allow-sandbox-host.");
-    const normalized = hosts.map((host) => host.trim().toLowerCase()).filter(Boolean);
-    if (normalized.length !== hosts.length || normalized.some((host) => !/^[a-z0-9.-]+$/.test(host) || host.includes("..") || host.startsWith(".") || host.endsWith("."))) {
+    const normalized = hosts
+        .map((host) => host.trim().toLowerCase())
+        .filter(Boolean);
+    if (normalized.length !== hosts.length ||
+        normalized.some((host) => !/^[a-z0-9.-]+$/.test(host) ||
+            host.includes("..") ||
+            host.startsWith(".") ||
+            host.endsWith("."))) {
         throw new ScenarioBundleError("Allowed sandbox hosts must be plain host names without paths, ports, or wildcards.");
     }
     return new Set(normalized);
@@ -449,7 +551,7 @@ function normalizeReplayRequest(input) {
         method: normalizeMethod(input.method),
         path: normalizeRelativePath(input.path),
         headers: normalizeReplayHeaders(input.headers),
-        body: sanitizeSecrets(input.body ?? null)
+        body: sanitizeSecrets(input.body ?? null),
     };
 }
 function normalizeReplayHeaders(headers) {
@@ -476,14 +578,22 @@ function compareRequest(expected, actual, bindings, variables) {
     return mismatches;
 }
 function resolveHeaders(headers, variables, bindings) {
-    return Object.fromEntries(Object.entries(headers).map(([key, value]) => [key, resolveTemplate(value, variables, bindings)]));
+    return Object.fromEntries(Object.entries(headers).map(([key, value]) => [
+        key,
+        resolveTemplate(value, variables, bindings),
+    ]));
 }
 function resolveVariables(value, variables, bindings) {
     if (Array.isArray(value))
         return value.map((entry) => resolveVariables(entry, variables, bindings));
     if (value !== null && typeof value === "object")
-        return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, resolveVariables(entry, variables, bindings)]));
-    return typeof value === "string" ? resolveTemplate(value, variables, bindings) : value;
+        return Object.fromEntries(Object.entries(value).map(([key, entry]) => [
+            key,
+            resolveVariables(entry, variables, bindings),
+        ]));
+    return typeof value === "string"
+        ? resolveTemplate(value, variables, bindings)
+        : value;
 }
 function resolveTemplate(value, variables, bindings) {
     const dictionary = new Map(variables.map((entry) => [entry.name, entry.value]));
@@ -496,14 +606,22 @@ function resolveTemplate(value, variables, bindings) {
 function matchValue(expected, actual, bindings, variables) {
     if (typeof expected === "string" && typeof actual === "string")
         return matchTemplate(expected, actual, bindings, variables);
-    if (expected === null || actual === null || typeof expected !== "object" || typeof actual !== "object")
+    if (expected === null ||
+        actual === null ||
+        typeof expected !== "object" ||
+        typeof actual !== "object")
         return expected === actual;
     if (Array.isArray(expected) || Array.isArray(actual)) {
-        return Array.isArray(expected) && Array.isArray(actual) && expected.length === actual.length && expected.every((entry, index) => matchValue(entry, actual[index], bindings, variables));
+        return (Array.isArray(expected) &&
+            Array.isArray(actual) &&
+            expected.length === actual.length &&
+            expected.every((entry, index) => matchValue(entry, actual[index], bindings, variables)));
     }
     const expectedEntries = Object.entries(expected);
     const actualRecord = actual;
-    return expectedEntries.length === Object.keys(actualRecord).length && expectedEntries.every(([key, entry]) => Object.hasOwn(actualRecord, key) && matchValue(entry, actualRecord[key], bindings, variables));
+    return (expectedEntries.length === Object.keys(actualRecord).length &&
+        expectedEntries.every(([key, entry]) => Object.hasOwn(actualRecord, key) &&
+            matchValue(entry, actualRecord[key], bindings, variables)));
 }
 function matchTemplate(expected, actual, bindings, variables) {
     const known = new Set(variables.map((entry) => entry.name));
@@ -546,7 +664,10 @@ function validateHeaders(input, allowed, variableNames, response) {
     const normalized = {};
     for (const [name, value] of Object.entries(headers)) {
         const lower = name.toLowerCase();
-        if (!allowed.has(lower) || typeof value !== "string" || value.length > 2_000 || isSecretFieldName(lower))
+        if (!allowed.has(lower) ||
+            typeof value !== "string" ||
+            value.length > 2_000 ||
+            isSecretFieldName(lower))
             throw new ScenarioBundleError(`Scenario bundle header is not allowed: ${name}`);
         if (response && lower === "location" && !isSafeRelativeLocation(value))
             throw new ScenarioBundleError("Scenario bundle redirect location must be relative.");
@@ -615,7 +736,7 @@ async function resolveExistingPath(path, projectRoot, label) {
     const info = await lstat(target);
     if (!info.isFile() || info.isSymbolicLink())
         throw new ScenarioBundleError(`${label} must be a regular non-symlink file.`);
-    if (!await isRealPathInsideAllowedRoots(target, projectRoot))
+    if (!(await isRealPathInsideAllowedRoots(target, projectRoot)))
         throw new ScenarioBundleError(`${label} resolves outside the project root or GHOSTAPI_DATA_DIR through a symlink.`);
     return target;
 }
@@ -626,7 +747,7 @@ async function resolveOutputPath(path, projectRoot) {
     const parent = await lstat(dirname(target));
     if (!parent.isDirectory() || parent.isSymbolicLink())
         throw new ScenarioBundleError("Scenario bundle output parent must be a real directory, not a symlink.");
-    if (!await isRealPathInsideAllowedRoots(dirname(target), projectRoot))
+    if (!(await isRealPathInsideAllowedRoots(dirname(target), projectRoot)))
         throw new ScenarioBundleError("Scenario bundle output parent resolves outside the project root or GHOSTAPI_DATA_DIR through a symlink.");
     const existing = await lstat(target).catch((error) => isErrorCode(error, "ENOENT") ? null : Promise.reject(error));
     if (existing?.isSymbolicLink())
@@ -641,13 +762,16 @@ function assertPathInsideAllowedRoots(projectRoot, target, label) {
 }
 function isInside(root, target) {
     const relativePath = relative(resolve(root), target);
-    return relativePath !== ".." && !relativePath.startsWith(`..${sep}`) && !isAbsolute(relativePath);
+    return (relativePath !== ".." &&
+        !relativePath.startsWith(`..${sep}`) &&
+        !isAbsolute(relativePath));
 }
 async function isRealPathInsideAllowedRoots(target, projectRoot) {
     const realTarget = await realpath(target);
     const realProjectRoot = await realpath(projectRoot);
     const dataRoot = await realpath(getDataPaths().root).catch(() => null);
-    return isInside(realProjectRoot, realTarget) || (dataRoot !== null && isInside(dataRoot, realTarget));
+    return (isInside(realProjectRoot, realTarget) ||
+        (dataRoot !== null && isInside(dataRoot, realTarget)));
 }
 function readObject(value, message) {
     if (value === null || typeof value !== "object" || Array.isArray(value))
@@ -688,12 +812,19 @@ function readUrl(value) {
     return value;
 }
 function readStatus(value) {
-    if (!Number.isInteger(value) || value < 100 || value > 599)
+    if (!Number.isInteger(value) ||
+        value < 100 ||
+        value > 599)
         throw new ScenarioBundleError("Capture response status must be 100-599.");
     return value;
 }
 function normalizeRelativePath(value) {
-    if (typeof value !== "string" || value.length === 0 || value.length > 8_000 || !value.startsWith("/") || value.startsWith("//") || /[\r\n]/.test(value)) {
+    if (typeof value !== "string" ||
+        value.length === 0 ||
+        value.length > 8_000 ||
+        !value.startsWith("/") ||
+        value.startsWith("//") ||
+        /[\r\n]/.test(value)) {
         throw new ScenarioBundleError("Scenario request path must be a relative path.");
     }
     return value;
@@ -705,7 +836,8 @@ function readHostArray(value) {
     return [...new Set(hosts)].sort();
 }
 function readStringArray(value, message) {
-    if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string" || entry.length > 256))
+    if (!Array.isArray(value) ||
+        value.some((entry) => typeof entry !== "string" || entry.length > 256))
         throw new ScenarioBundleError(message);
     return value;
 }
@@ -716,25 +848,26 @@ function isMultipartMime(value) {
     return typeof value === "string" && /^multipart\//i.test(value);
 }
 function isTimestamp(value) {
-    return typeof value === "string" && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/.test(value) && Number.isFinite(Date.parse(value));
+    return (typeof value === "string" &&
+        /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/.test(value) &&
+        Number.isFinite(Date.parse(value)));
 }
 function deterministicTimestamp(index) {
     return `2020-01-01T00:00:${String(index % 60).padStart(2, "0")}.000Z`;
 }
 function normalizeTitle(value) {
-    if (typeof value !== "string" || value.trim() === "" || value.trim().length > 120)
+    if (typeof value !== "string" ||
+        value.trim() === "" ||
+        value.trim().length > 120)
         throw new ScenarioBundleError("Scenario bundle title must be 1-120 characters.");
     return value.trim();
 }
 function slugify(value) {
-    return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 80) || "sandbox-recording";
-}
-function stableStringify(value) {
-    if (value === null || typeof value !== "object")
-        return JSON.stringify(value);
-    if (Array.isArray(value))
-        return `[${value.map(stableStringify).join(",")}]`;
-    return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => `${JSON.stringify(key)}:${stableStringify(entry)}`).join(",")}}`;
+    return (value
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-|-$/g, "")
+        .slice(0, 80) || "sandbox-recording");
 }
 function serializedBytes(value, label) {
     try {