purecloud-flow-scripting-api-sdk-javascript 0.66.4 → 0.66.6

package/package.json

@@ -1,18 +1,18 @@
 {
     "name": "purecloud-flow-scripting-api-sdk-javascript",
-    "version": "0.66.4",
+    "version": "0.66.6",
     "description": "JavaScript library for creating, editing, and managing Genesys Cloud Architect flows",
     "main": "build-scripting/release/scripting.bundle.js",
     "author": "Genesys",
     "license": "MIT",
     "dependencies": {
-        "ws": "^8.18.0"
+        "ws": "8.20.1"
     },
     "devDependencies": {
-        "axios": "^0.27.2",
+        "axios": "1.16.1",
         "chai": "4.2.0",
-        "mocha": "^5.2.0",
-        "mocha-jenkins-reporter": "^0.4.1",
+        "mocha": "5.2.0",
+        "mocha-jenkins-reporter": "0.4.1",
         "q": "1.5.1",
         "underscore": "1.9.1"
     },

package/types.d.ts

@@ -12539,6 +12539,23 @@ export class ArchBaseActionWithSilenceDetection extends ArchBaseActionWithOutput
     traverse(callbackFunction: callbackTraverseInfo, traverseFilter?: ArchFilterObject): number;
 }
 
+/**
+ * Produces a key safe to use on plain objects used as string-keyed maps during scripting traversal.
+ *
+ * **Security purpose:** Dynamic property names from flow/scripting objects are sometimes used as keys on
+ * bookkeeping maps (`propNamesProcessed`, `traversePropNameValMap`, hierarchy buckets). Without guarding,
+ * keys such as `__proto__`, `constructor`, or `prototype` can alter prototype chain behavior (prototype
+ * pollution) when assigned with bracket notation. This helper maps those dangerous names to an equivalent
+ * string that is not a prototype-polluting key (zero-width space prefix), preserving uniqueness for traversal
+ * bookkeeping while avoiding accidental prototype mutation.
+ *
+ * **Note:** Real property access on scripting objects still uses the original `propName`; only map keys are
+ * transformed so internal dedupe/visited sets remain safe.
+ * @param key - Property or hierarchy string intended for use as an object map key.
+ * @returns A string safe to use as a map key; dangerous names receive a `\u200B` prefix.
+ */
+declare function safeTraversalMapKey(key: any): any;
+
 /**
  * This callback function type is invoked by Architect Scripting where the callback function is passed a
  * [traverse info]{@link ArchTraverseInfo} object.
@@ -12990,6 +13007,11 @@ export class ArchBaseFlow extends ArchBaseCoreObjectWithId {
      * if any or more than one can be added.
      */
     canAddSupportedLanguage(): boolean;
+    /**
+     * This helper method returns whether the [flow type]{@link ArchBaseFlow#flowType} of this flow is deprecated by calling [this.definition.isDeprecated]{@link ArchDefinitionFlow#isDeprecated}.
+     * A flow whose [flow type]{@link ArchBaseFlow#flowType} is deprecated can no longer be published.
+     */
+    readonly isFlowTypeDeprecated: boolean;
     /**
      * Checks in and unlocks the flow for the current user, does a save first
      * Assumes the flow has been created, throws if not
@@ -13046,6 +13068,26 @@ export class ArchBaseFlow extends ArchBaseCoreObjectWithId {
      * values in {@link ArchEnums#FLOW_TYPES} lists valid flow type values.
      */
     readonly flowType: string;
+    /**
+     * Resolves a filesystem path supplied by the Architect **scripting** API (Node) after the usual
+     * `_checkItemIsValidLiteralString` checks on the caller side.
+     *
+     * **Security purpose:** Static analysis flags raw `path.resolve` / `path.join` with scripting parameters
+     * as possible path traversal. This method centralizes defense-in-depth:
+     * - Strips NUL (`\\0`) bytes so paths cannot embed embedded-truncation tricks.
+     * - Applies `path.normalize` before resolving.
+     * - Resolves once via `path.resolve(cwd, normalized)` (Node: absolute `normalized` replaces the cwd prefix).
+     * - For **relative** input only, rejects results that sit **above** `process.cwd()` using `path.relative`
+     *   (blocks `..` segments that escape the working directory). **Absolute** paths are allowed as-is after
+     *   resolve (same behavior as typical CLI tools exporting outside the project tree).
+     *
+     * **Not a substitute for OS ACLs:** authors can still pass absolute paths to writable locations; this
+     * blocks a class of relative-path traversal from the scripting surface.
+     * @param inputPath - Directory or file path string from scripting (already validated as a literal string by callers).
+     * @param callerLabel - Label for error messages (e.g. method name + parameter).
+     * @returns Canonical resolved path string.
+     */
+    _resolveValidatedScriptFileSystemPath(inputPath: any, callerLabel: any): any;
     /**
      * This function will return the file path where a flow export will be written when calling the {@link ArchBaseFlow#exportToDirAsync}
      * method for the supplied destination directory and export flow format.  A typical use case for this function would be
@@ -15739,6 +15781,11 @@ export class ArchDefinitionFlow extends ArchBaseDefinition {
      * Accessing this property.
      */
     readonly isCreatable: boolean;
+    /**
+     * Returns whether the [flow type]{@link ArchDefinitionFlow#flowType} is deprecated.
+     * Flows whose flow type is deprecated cannot be published.
+     */
+    readonly isDeprecated: boolean;
     /**
      * Returns the display label for this flow type such as 'Inbound Call Flow'.
      */