promptopskit 0.3.6 → 0.3.7

package/dist/index.cjs

@@ -251,12 +251,21 @@ var ResponseSchema = import_zod.z.object({
 var HistorySchema = import_zod.z.object({
   max_items: import_zod.z.number().int().positive().optional()
 });
+var ContextRegexSchema = import_zod.z.union([
+  import_zod.z.string(),
+  import_zod.z.object({
+    pattern: import_zod.z.string(),
+    flags: import_zod.z.string().optional()
+  })
+]);
 var ContextInputDefinitionObjectSchema = import_zod.z.object({
   name: import_zod.z.string(),
   max_size: import_zod.z.number().int().positive().optional(),
   trim: import_zod.z.union([import_zod.z.boolean(), import_zod.z.enum(["start", "end", "both"])]).optional(),
-  allow_regex: import_zod.z.string().optional(),
-  deny_regex: import_zod.z.string().optional()
+  allow_regex: ContextRegexSchema.optional(),
+  deny_regex: ContextRegexSchema.optional(),
+  non_empty: import_zod.z.boolean().optional(),
+  reject_secrets: import_zod.z.boolean().optional()
 });
 var ContextInputDefinitionSchema = import_zod.z.union([
   import_zod.z.string(),
@@ -601,6 +610,8 @@ function resolveInlinePromptSource(source, options = {}) {
 
 // src/context.ts
 var textEncoder = new TextEncoder();
+var REJECT_SECRETS_PATTERN = "(secret|api[_-]?key|password)";
+var REJECT_SECRETS_FLAGS = "i";
 function getContextInputs(asset) {
   return (asset.context?.inputs ?? []).map(normalizeContextInput);
 }
@@ -615,8 +626,90 @@ function normalizeContextInput(input) {
     name: input.name,
     max_size: input.max_size,
     trim: input.trim,
-    allow_regex: input.allow_regex,
-    deny_regex: input.deny_regex
+    allow_regex: normalizeContextRegex(input.allow_regex),
+    deny_regex: normalizeContextRegex(input.deny_regex),
+    non_empty: input.non_empty,
+    reject_secrets: input.reject_secrets
+  };
+}
+function normalizeContextRegex(value) {
+  if (value === void 0) {
+    return void 0;
+  }
+  if (typeof value === "string") {
+    const literal = parseRegexLiteral(value);
+    if (value.startsWith("/") && !literal) {
+      return {
+        pattern: value,
+        flags: "",
+        raw: value,
+        invalidLiteral: true
+      };
+    }
+    return {
+      pattern: literal?.pattern ?? value,
+      flags: literal?.flags ?? "",
+      raw: value
+    };
+  }
+  return {
+    pattern: value.pattern,
+    flags: value.flags ?? "",
+    raw: JSON.stringify(value)
+  };
+}
+function parseRegexLiteral(value) {
+  if (!value.startsWith("/")) {
+    return void 0;
+  }
+  for (let index = value.length - 1; index > 0; index -= 1) {
+    if (value[index] !== "/") {
+      continue;
+    }
+    let backslashCount = 0;
+    for (let cursor = index - 1; cursor >= 0 && value[cursor] === "\\"; cursor -= 1) {
+      backslashCount += 1;
+    }
+    if (backslashCount % 2 === 1) {
+      continue;
+    }
+    return {
+      pattern: value.slice(1, index),
+      flags: value.slice(index + 1)
+    };
+  }
+  return void 0;
+}
+function formatInvalidContextRegexMessage(details) {
+  return [
+    `Invalid context regex for prompt "${details.promptId}"`,
+    `variable "${details.variable}"`,
+    `field "${details.field}"`,
+    `value ${JSON.stringify(details.raw)}: ${details.reason}`
+  ].join(", ");
+}
+function compileContextRegex(regex, details) {
+  if (regex.invalidLiteral) {
+    throw new Error(
+      `POK013: ${formatInvalidContextRegexMessage({
+        ...details,
+        raw: regex.raw,
+        reason: "Malformed regex literal. Use /pattern/flags or { pattern, flags }."
+      })}`
+    );
+  }
+  try {
+    return new RegExp(regex.pattern, regex.flags);
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    throw new Error(`POK013: ${formatInvalidContextRegexMessage({ ...details, raw: regex.raw, reason })}`);
+  }
+}
+function getRejectSecretsRegex() {
+  return {
+    pattern: REJECT_SECRETS_PATTERN,
+    flags: REJECT_SECRETS_FLAGS,
+    raw: JSON.stringify({ pattern: REJECT_SECRETS_PATTERN, flags: REJECT_SECRETS_FLAGS })
   };
 }
 function isTrimEnabled(mode) {
@@ -688,7 +781,11 @@ function sanitizeContextVariables(asset, variables = {}, options = {}) {
     sanitized[input.name] = candidate;
     if (input.allow_regex) {
       const candidate2 = sanitized[input.name];
-      const matcher = new RegExp(input.allow_regex);
+      const matcher = compileContextRegex(input.allow_regex, {
+        promptId: asset.id,
+        variable: input.name,
+        field: "allow_regex"
+      });
       if (!matcher.test(candidate2)) {
         throw new Error(
           `POK031: Context variable "${input.name}" failed allow_regex validation for prompt "${asset.id}".`
@@ -697,13 +794,34 @@ function sanitizeContextVariables(asset, variables = {}, options = {}) {
     }
     if (input.deny_regex) {
       const candidate2 = sanitized[input.name];
-      const matcher = new RegExp(input.deny_regex);
+      const matcher = compileContextRegex(input.deny_regex, {
+        promptId: asset.id,
+        variable: input.name,
+        field: "deny_regex"
+      });
       if (matcher.test(candidate2)) {
         throw new Error(
           `POK032: Context variable "${input.name}" matched deny_regex for prompt "${asset.id}".`
         );
       }
     }
+    if (input.non_empty && candidate.trim().length === 0) {
+      throw new Error(
+        `POK033: Context variable "${input.name}" failed non_empty validation for prompt "${asset.id}".`
+      );
+    }
+    if (input.reject_secrets) {
+      const matcher = compileContextRegex(getRejectSecretsRegex(), {
+        promptId: asset.id,
+        variable: input.name,
+        field: "reject_secrets"
+      });
+      if (matcher.test(candidate)) {
+        throw new Error(
+          `POK034: Context variable "${input.name}" matched reject_secrets validation for prompt "${asset.id}".`
+        );
+      }
+    }
   }
   return sanitized;
 }
@@ -1168,16 +1286,20 @@ function validateAsset(asset, frontMatterKeys, filePath) {
       });
     }
     const checks = [];
-    if (input.allow_regex) checks.push({ pattern: input.allow_regex, kind: "allow_regex" });
-    if (input.deny_regex) checks.push({ pattern: input.deny_regex, kind: "deny_regex" });
+    if (input.allow_regex) checks.push({ regex: input.allow_regex, kind: "allow_regex" });
+    if (input.deny_regex) checks.push({ regex: input.deny_regex, kind: "deny_regex" });
     for (const check of checks) {
       try {
-        new RegExp(check.pattern);
+        compileContextRegex(check.regex, {
+          promptId: asset.id,
+          variable: input.name,
+          field: check.kind
+        });
       } catch (error) {
-        const reason = error instanceof Error ? error.message : String(error);
+        const reason = error instanceof Error ? error.message.replace(/^POK013:\s*/, "") : String(error);
         errors.push({
           code: "POK013",
-          message: `Invalid context ${check.kind} for "${input.name}": ${reason}`,
+          message: reason,
           filePath
         });
       }