tempest-react-sdk 0.81.0 → 0.82.0

package/README.md

@@ -159,7 +159,7 @@ Via `package.json`:
 
 Requires React `>=18` and Node `>=22.12` to build.
 
-**A bundler is assumed — outside one, load the shipped `.css` loader.** Every component module imports its own stylesheet (see [CSS import](#css-import)), and `.css` is not a format Node can load — `node -e "import('tempest-react-sdk')"` fails with `ERR_UNKNOWN_FILE_EXTENSION`. Vite, webpack, Rspack, Parcel and esbuild all resolve that import, and the SDK is client-side only, so no real app consumer is affected. For everything that is not a bundler — a script, a Jest suite, reading the surface by introspection — the package ships the loader: `node --import tempest-react-sdk/node-css-loader your-script.mjs` resolves every stylesheet to an empty module, for `import` and `require` both. A **Jest** suite can use it or the usual `moduleNameMapper: { "\\.css$": "<rootDir>/test/css-stub.js" }`. Vitest needs nothing.
+**A bundler is assumed — outside one, load the shipped `.css` loader.** Every component module imports its own stylesheet (see [CSS import](#css-import)), and `.css` is not a format Node can load — `node -e "import('tempest-react-sdk')"` fails with `ERR_UNKNOWN_FILE_EXTENSION`. Vite, webpack, Rspack, Parcel and esbuild all resolve that import, and the SDK is client-side only, so no real app consumer is affected. For everything that is not a bundler — a script, a Jest suite, reading the surface by introspection — the package ships the loader: `node --import tempest-react-sdk/node-css-loader your-script.mjs` resolves every stylesheet to an empty module, for `import` and `require` both. A **Jest** suite can use it or the usual `moduleNameMapper: { "\\.css$": "<rootDir>/test/css-stub.js" }`. **Vitest** needs `tempestVitest()` from `tempest-react-sdk/vite`, because it hands every ESM package from `node_modules` to Node: `createViteConfig` already wires it, but a separate `vitest.config.ts` (or a plain `vite.config.ts`) must add it to `plugins`, or the first import of the SDK fails with `Unknown file extension ".css"` — see [Testing with Vitest](https://mauriciobenjamin700.github.io/tempest-react-sdk/en/vite-config/#testing-with-vitest).
 
 ### Peer & bundled dependencies
 
@@ -1995,15 +1995,14 @@ Every gallery section maps 1-to-1 with a docs page — see [`docs/gallery.md`](.
 
 ## Release
 
-Versioning is managed with [Changesets](https://github.com/changesets/changesets):
+Two commands, with the release PR's review in between:
 
 ```bash
-npx changeset          # describe the change (patch / minor / major)
-npx changeset version  # bump versions + update CHANGELOG.md
-npm run release        # build + changeset publish
+make release TAG=X.Y.Z       # opens the release PR (no tag, no publish)
+make release-tag TAG=X.Y.Z   # after the merge: tags the merge commit and pushes it
 ```
 
-CI workflow `.github/workflows/release.yml` publishes to npm whenever a "Version Packages" PR merges into `main`. The first publish is manual — set the `NPM_TOKEN` secret in _Settings → Secrets and variables → Actions_ and run `npm publish` once.
+The tag push runs `.github/workflows/release-npm.yml`, which publishes through npm Trusted Publishing (OIDC, with provenance) — no npm token anywhere, and no local publish (`make publish` refuses). Pipeline and the repository owner's settings checklist: [Release pipeline](https://mauriciobenjamin700.github.io/tempest-react-sdk/en/release/).
 
 Tags follow `vMAJOR.MINOR.PATCH`. CSS tokens (`--tempest-*`) are treated as public API — renames bump the minor (or major, on removal).
 

package/bin/create-tempest-app.e2e.test.mjs

@@ -49,6 +49,37 @@ function scaffoldHere() {
     return { status: result.status, stdout: result.stdout + result.stderr };
 }
 
+describe("create-tempest-app new-folder mode refuses a destination that is a symlink (#533)", () => {
+    it("my-app -> ../outside is refused and nothing lands at the link target", () => {
+        symlinkSync("../outside", join(proj, "my-app"));
+
+        const result = spawnSync(process.execPath, [CLI, "my-app"], {
+            cwd: proj,
+            encoding: "utf8",
+            env: { ...process.env, NO_COLOR: "1" },
+        });
+
+        expect(result.status).toBe(1);
+        expect(result.stderr).toMatch(/"my-app" is a symbolic link/);
+        expect(readdirSync(outside)).toEqual([]);
+        expect(lstatSync(join(proj, "my-app")).isSymbolicLink()).toBe(true);
+    });
+
+    it("a plain new folder name is still scaffolded", () => {
+        const result = spawnSync(process.execPath, [CLI, "my-app"], {
+            cwd: proj,
+            encoding: "utf8",
+            env: { ...process.env, NO_COLOR: "1" },
+        });
+
+        expect(result.status).toBe(0);
+        expect(existsSync(join(proj, "my-app", "src", "main.tsx"))).toBe(true);
+        expect(JSON.parse(readFileSync(join(proj, "my-app", "package.json"), "utf8")).name).toBe(
+            "my-app",
+        );
+    });
+});
+
 describe("create-tempest-app merge mode never writes through a symlink (#436)", () => {
     it("a symlinked src/ pointing outside the project is skipped, not written into", () => {
         writeFileSync(join(outside, "main.tsx"), "OUTSIDE-USER-FILE");

package/bin/create-tempest-app.mjs

@@ -10,7 +10,8 @@
 // package.json has the Tempest scripts/deps merged in (your name/version are
 // preserved). A symlink already in the destination is never written through:
 // it is skipped and reported, so a link to a folder outside the project cannot
-// redirect the template there. The `--pwa` flag overlays the PWA template
+// redirect the template there. A named destination that is itself a symlink is
+// refused for the same reason. The `--pwa` flag overlays the PWA template
 // (manifest, service worker, push-subscribe wiring) on top of the base.
 import { cp, lstat, mkdir, readdir, readFile, realpath, writeFile } from "node:fs/promises";
 import { existsSync } from "node:fs";
@@ -239,6 +240,15 @@ async function main() {
             process.exit(1);
         }
         destDir = resolve(process.cwd(), arg);
+        if (await isSymlink(destDir)) {
+            console.error(
+                `${c.red}✗ "${arg}" is a symbolic link; the project would be created where it points.${c.reset}`,
+            );
+            console.error(
+                `${c.dim}  Create the project at the real path, or remove the link.${c.reset}`,
+            );
+            process.exit(1);
+        }
         if (!(await isEmptyDir(destDir))) {
             console.error(`${c.red}✗ Directory "${arg}" exists and is not empty.${c.reset}`);
             console.error(

package/bin/lib/doctor/doctor.e2e.test.mjs

@@ -98,6 +98,11 @@ describe("tempest doctor — a third-party project that does not use the SDK", (
         expect(out).not.toContain('add import "tempest-react-sdk/styles.css"');
     });
 
+    it("does not judge the Vitest config of a project without the SDK", () => {
+        installed("vitest", "4.1.12");
+        expect(doctor().out).not.toContain("inline the SDK");
+    });
+
     it("does not demand a src/main.tsx it has no reason to expect", () => {
         const { out } = doctor();
         expect(out).not.toContain("app entry");
@@ -336,6 +341,30 @@ describe("tempest doctor — a project that does use the SDK", () => {
         expect(doctor().out).toContain("leaflet missing");
     });
 
+    it("warns when Vitest would load the SDK without the plugin", () => {
+        installed("vitest", "4.1.12");
+        const { out, code } = doctor();
+        expect(out).toContain("vite.config.ts does not inline the SDK for Vitest");
+        expect(out).toContain("tempestVitest()");
+        expect(code).toBe(0);
+    });
+
+    it("accepts a vitest.config that adds tempestVitest", () => {
+        installed("vitest", "4.1.12");
+        write(
+            "vitest.config.ts",
+            'import { tempestVitest } from "tempest-react-sdk/vite";\n' +
+                "export default defineConfig({ plugins: [tempestVitest()] });",
+        );
+        const { out } = doctor();
+        expect(out).toContain("vitest.config.ts lets Vitest load the SDK");
+        expect(out).not.toContain("does not inline the SDK");
+    });
+
+    it("says nothing about Vitest in a project that does not install it", () => {
+        expect(doctor().out).not.toContain("Vitest");
+    });
+
     it("warns when the SDK is installed but undeclared", () => {
         write("package.json", {
             name: "sdk-app",

package/bin/lib/doctor/vitest.mjs

@@ -0,0 +1,120 @@
+/**
+ * The Vitest config check for `tempest doctor`.
+ *
+ * Every SDK component module imports its own stylesheet, and Vitest hands an ESM
+ * package from `node_modules` to plain Node, which has no loader for `.css`. A
+ * consumer suite that imports the SDK therefore dies before running with
+ * `Unknown file extension ".css"` unless the config inlines the SDK — which is what
+ * `tempestVitest()` does, and what `createViteConfig` includes. Measured in #548
+ * with the 0.81.0 tarball on Vitest 4.1.12: an own `vitest.config.ts`, a plain
+ * `vite.config.ts` and no config at all fail; only the plugin passes.
+ *
+ * The check is a text heuristic over the config file Vitest would load, not an
+ * evaluation of it: running the user's config would execute their code and pull
+ * their plugins in, which a health check has no business doing. The markers are the
+ * plugin and helper names, an explicit `inline: true` (which inlines everything,
+ * the SDK included), and an inline list naming the package — the three shapes that
+ * make the suite pass.
+ */
+
+/**
+ * Config file names Vitest looks for, in the order it prefers them.
+ *
+ * Ported from Vitest 4.1.12's `configFiles` (`CONFIG_NAMES` × `CONFIG_EXTENSIONS`
+ * in `dist/chunks/constants.*.js`, not exported): a `vitest.config.*` wins over a
+ * `vite.config.*`, and within each the extensions are tried in this order. The
+ * test reads the installed Vitest and fails when the list drifts.
+ */
+export const VITEST_CONFIG_FILES = [
+    "vitest.config.ts",
+    "vitest.config.mts",
+    "vitest.config.cts",
+    "vitest.config.js",
+    "vitest.config.mjs",
+    "vitest.config.cjs",
+    "vite.config.ts",
+    "vite.config.mts",
+    "vite.config.cts",
+    "vite.config.js",
+    "vite.config.mjs",
+    "vite.config.cjs",
+];
+
+/** Text that, once comments are gone, means the config already inlines the SDK. */
+const INLINES_SDK = [
+    /\btempestVitest\b/,
+    /\bcreateViteConfig\b/,
+    /\binline\s*:\s*true\b/,
+    /\binline\s*:\s*\[[^\]]*["'`]tempest-react-sdk["'`]/,
+];
+
+/** An import of the project's own `vite.config`, as `mergeConfig` setups do. */
+const IMPORTS_VITE_CONFIG = /from\s*["']\.\/vite\.config(?:\.[cm]?[jt]s)?["']/;
+
+/**
+ * Drop JavaScript comments so a marker that only appears in prose does not count.
+ *
+ * A line comment is only removed when `//` is not preceded by `:`, which keeps
+ * `https://` inside a string intact; a missed edge case here costs one false "ok",
+ * never a crash.
+ *
+ * @param {string} text - Source text of a config file.
+ * @returns {string} The text without block and line comments.
+ */
+function stripComments(text) {
+    return text.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/.*$/gm, "$1");
+}
+
+/**
+ * Whether a config file's text makes Vitest inline the SDK.
+ *
+ * @param {string} text - Source text of the config.
+ * @returns {boolean} Whether one of the passing shapes is present.
+ */
+function inlinesSdk(text) {
+    const code = stripComments(text);
+    return INLINES_SDK.some((marker) => marker.test(code));
+}
+
+/**
+ * Audit whether the project's Vitest setup can import the SDK.
+ *
+ * Vitest loads the first `vitest.config.*`, else the first `vite.config.*`, else
+ * runs with defaults; this mirrors that choice and judges only the file it would
+ * load. A `vitest.config.*` that imports `./vite.config` (the `mergeConfig`
+ * pattern) passes when that `vite.config.*` does, so a project using
+ * `createViteConfig` there is not flagged.
+ *
+ * @param {object} params
+ * @param {boolean} params.vitestInstalled - Whether `vitest` resolves in the project.
+ * @param {Record<string, string>} params.configs - Text of each config file present,
+ *   keyed by its name from {@link VITEST_CONFIG_FILES}.
+ * @returns {Array<[status: string, label: string, detail?: string]>} Check rows;
+ *   empty when the project does not use Vitest.
+ */
+export function checkVitest({ vitestInstalled, configs }) {
+    if (!vitestInstalled) return [];
+
+    const loaded = VITEST_CONFIG_FILES.find((name) => name in configs);
+    const fix =
+        "add `plugins: [tempestVitest()]` from tempest-react-sdk/vite, or build the config " +
+        "with createViteConfig — otherwise any test importing the SDK fails with " +
+        '`Unknown file extension ".css"`';
+
+    if (!loaded) {
+        return [["warn", "Vitest runs with no config", fix]];
+    }
+
+    const text = configs[loaded];
+    const viaViteConfig =
+        loaded.startsWith("vitest.") &&
+        IMPORTS_VITE_CONFIG.test(stripComments(text)) &&
+        VITEST_CONFIG_FILES.some(
+            (name) => name.startsWith("vite.") && name in configs && inlinesSdk(configs[name]),
+        );
+
+    if (inlinesSdk(text) || viaViteConfig) {
+        return [["ok", `${loaded} lets Vitest load the SDK`]];
+    }
+    return [["warn", `${loaded} does not inline the SDK for Vitest`, fix]];
+}

package/bin/lib/doctor/vitest.test.mjs

@@ -0,0 +1,139 @@
+import { readdirSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+
+import { VITEST_CONFIG_FILES, checkVitest } from "./vitest.mjs";
+
+const VITEST_CHUNKS = join(
+    dirname(fileURLToPath(import.meta.url)),
+    "..",
+    "..",
+    "..",
+    "node_modules",
+    "vitest",
+    "dist",
+    "chunks",
+);
+
+/** Statuses of the returned rows, in order. */
+const statuses = (rows) => rows.map(([status]) => status);
+
+/** Run the check for a project with Vitest and the given config files. */
+const check = (configs) => checkVitest({ vitestInstalled: true, configs });
+
+/**
+ * The config file list the installed Vitest really searches, read from its source.
+ *
+ * @returns {string[]} `CONFIG_NAMES` × `CONFIG_EXTENSIONS`, in Vitest's order.
+ */
+function installedVitestConfigFiles() {
+    const file = readdirSync(VITEST_CHUNKS).find((name) => /^constants\..*\.js$/.test(name));
+    const text = readFileSync(join(VITEST_CHUNKS, file), "utf8");
+    const array = (name) =>
+        JSON.parse(
+            new RegExp(`const ${name} = (\\[[^\\]]*\\])`)
+                .exec(text)[1]
+                .replace(/\s+/g, "")
+                .replace(/,]/, "]"),
+        );
+    return array("CONFIG_NAMES").flatMap((name) =>
+        array("CONFIG_EXTENSIONS").map((ext) => name + ext),
+    );
+}
+
+describe("checkVitest — which file it judges", () => {
+    it("searches the same files, in the same order, as the installed Vitest", () => {
+        expect(VITEST_CONFIG_FILES).toEqual(installedVitestConfigFiles());
+    });
+
+    it("judges vitest.config over vite.config, the one Vitest loads", () => {
+        const rows = check({
+            "vite.config.ts": "export default createViteConfig();",
+            "vitest.config.ts": "export default defineConfig({ test: {} });",
+        });
+        expect(statuses(rows)).toEqual(["warn"]);
+        expect(rows[0][1]).toContain("vitest.config.ts");
+    });
+
+    it("falls back to vite.config when there is no vitest.config", () => {
+        const rows = check({ "vite.config.mjs": "export default defineConfig({});" });
+        expect(rows[0][1]).toContain("vite.config.mjs");
+    });
+});
+
+describe("checkVitest — setups that fail the suite", () => {
+    it("says nothing when the project does not use Vitest", () => {
+        expect(checkVitest({ vitestInstalled: false, configs: {} })).toEqual([]);
+    });
+
+    it("warns when Vitest would run with no config at all", () => {
+        const rows = check({});
+        expect(statuses(rows)).toEqual(["warn"]);
+        expect(rows[0][2]).toContain("tempestVitest()");
+        expect(rows[0][2]).toContain('Unknown file extension ".css"');
+    });
+
+    it("warns on a plain vitest.config without the plugin", () => {
+        const rows = check({
+            "vitest.config.ts":
+                'import { defineConfig } from "vitest/config";\n' +
+                'export default defineConfig({ test: { environment: "jsdom" } });',
+        });
+        expect(statuses(rows)).toEqual(["warn"]);
+    });
+
+    it("does not count the plugin named only in a comment", () => {
+        const rows = check({
+            "vitest.config.ts":
+                "// TODO: add tempestVitest()\n/* createViteConfig later */\n" +
+                "export default defineConfig({});",
+        });
+        expect(statuses(rows)).toEqual(["warn"]);
+    });
+
+    it("does not trust an import of a vite.config that lacks the plugin too", () => {
+        const rows = check({
+            "vite.config.ts": "export default defineConfig({});",
+            "vitest.config.ts":
+                'import viteConfig from "./vite.config";\n' +
+                "export default mergeConfig(viteConfig, defineConfig({ test: {} }));",
+        });
+        expect(statuses(rows)).toEqual(["warn"]);
+    });
+});
+
+describe("checkVitest — setups that pass", () => {
+    it.each([
+        ["tempestVitest()", "export default defineConfig({ plugins: [tempestVitest()] });"],
+        ["createViteConfig", "export default createViteConfig({ overrides: {} });"],
+        [
+            "inline: true",
+            "export default defineConfig({ test: { server: { deps: { inline: true } } } });",
+        ],
+        [
+            "an inline list naming the SDK",
+            'export default defineConfig({ test: { server: { deps: { inline: ["x", "tempest-react-sdk"] } } } });',
+        ],
+    ])("accepts %s", (_, text) => {
+        expect(statuses(check({ "vitest.config.ts": text }))).toEqual(["ok"]);
+    });
+
+    it("accepts a vitest.config merged over a vite.config that uses createViteConfig", () => {
+        const rows = check({
+            "vite.config.ts": "export default createViteConfig();",
+            "vitest.config.ts":
+                'import viteConfig from "./vite.config.ts";\n' +
+                "export default mergeConfig(viteConfig, defineConfig({ test: {} }));",
+        });
+        expect(statuses(rows)).toEqual(["ok"]);
+    });
+
+    it("keeps a URL inside a string from hiding a marker after it", () => {
+        const rows = check({
+            "vitest.config.ts":
+                'const docs = "https://example.com"; export default defineConfig({ plugins: [tempestVitest()] });',
+        });
+        expect(statuses(rows)).toEqual(["ok"]);
+    });
+});

package/bin/lib/fs/contain.mjs

@@ -28,6 +28,13 @@ export function lstatOrNull(path) {
  * not skipped over: its `realpath` throws and the path counts as outside, since
  * `mkdir` or `writeFile` would create whatever the link names.
  *
+ * The answer is about the tree as it is now; nothing makes it and the write that
+ * follows one atomic step. A process swapping a folder for a symlink between the
+ * two can still redirect the write, and Node has no `openat`/`O_NOFOLLOW` walk
+ * to close that. Such a process is already writing inside the user's project, so
+ * it could edit the generated files or `package.json` directly: the window is an
+ * accepted risk, the same one `create-tempest-app` documents (#533).
+ *
  * @param {string} root - Project root.
  * @param {string} path - Absolute path, existing or about to be created.
  * @returns {boolean}

package/bin/lib/openapi/escape.mjs

@@ -16,7 +16,11 @@
  *   {@link assertNoCollision}, never silently merged;
  * - string position → `JSON.stringify` at the call site;
  * - doc comment → {@link commentText};
- * - URL template literal → {@link urlTemplate}.
+ * - URL template literal → {@link urlTemplate};
+ * - the developer's terminal → {@link terminalText}.
+ *
+ * One more check covers the text that becomes a URL rather than being escaped
+ * into one: {@link assertSafePath}.
  */
 
 const IDENTIFIER = /^[A-Za-z_$][\w$]*$/;
@@ -150,19 +154,79 @@ export function assertNoCollision(entries, what) {
     }
 }
 
+/**
+ * C0 and C1 control characters except tab and line feed: everything a terminal
+ * may read as the start of an escape sequence (`ESC`, the 8-bit `CSI` and
+ * `OSC`), plus `CR` and backspace, which rewrite what is already on the line.
+ */
+const TERMINAL_CONTROLS = /[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g;
+
+/**
+ * Make spec text safe to print to the developer's terminal.
+ *
+ * `tempest gen api` echoes the spec's tag names, and its errors quote spec
+ * names. `JSON.stringify` escapes the C0 range but leaves the C1 range raw, so
+ * neither path was safe on its own: a tag carrying `ESC ] 0 ; ... BEL` retitled
+ * the terminal window, and an OSC 8 sequence printed a clickable link whose
+ * target the developer never saw (#533). Every control character a terminal
+ * acts on is dropped; tab and line feed are kept so a multi-line error still
+ * reads as one.
+ *
+ * @param {unknown} text - Text that may come from the spec.
+ * @returns {string} The text without terminal control characters.
+ */
+export function terminalText(text) {
+    return String(text).replace(TERMINAL_CONTROLS, "");
+}
+
 /**
  * Make spec text safe inside a `/** ... *\/` block comment.
  *
  * Line terminators collapse to a space, so the text cannot start a new line of
  * the comment, and every `*\/` is broken as `*\\/` so it cannot close it.
+ * Terminal control characters are dropped too ({@link terminalText}): they are
+ * not code, but printing the generated file with `cat` would replay them.
  *
  * @param {unknown} text - The spec text (tag, summary, path).
  * @returns {string} The neutralized single-line text.
  */
 export function commentText(text) {
-    return String(text)
-        .replace(/[\r\n\u2028\u2029]+/g, " ")
-        .replace(/\*\//g, "*\\/");
+    return terminalText(String(text).replace(/[\r\n\u2028\u2029]+/g, " ")).replace(/\*\//g, "*\\/");
+}
+
+/**
+ * Throw when an OpenAPI path key would not stay a path under the client's
+ * `baseURL`.
+ *
+ * The key becomes the URL the generated method requests, and the client passes
+ * an absolute URL through untouched: a key `"https://other.example/x"` made the
+ * method call another origin \u2014 the Bearer is withheld there, but the body and,
+ * with `credentials: "include"`, the cookies were not. A static `.` or `..`
+ * segment (`"/../x"`) climbs out of the `baseURL`'s path prefix once the URL is
+ * normalized. OpenAPI requires a path key to start with `/` and to be relative
+ * to the server URL, so neither is a valid spec; both are refused before any
+ * file is written instead of becoming a call the developer never reads. `\` is
+ * a separator and `%2e` a dot here because the WHATWG URL parser normalizes them
+ * that way.
+ *
+ * @param {unknown} path - The key from `paths`.
+ * @throws {Error} When the key does not start with `/` or has a dot segment.
+ */
+export function assertSafePath(path) {
+    if (typeof path !== "string" || !path.startsWith("/")) {
+        throw new Error(
+            `OpenAPI path ${JSON.stringify(path)} does not start with "/". A path key is relative to the server URL; an absolute URL here would send the request to another origin.`,
+        );
+    }
+    const dotSegment = path
+        .replace(/[?#][\s\S]*$/, "")
+        .split(/[/\\]/)
+        .some((segment) => /^(?:\.|%2e){1,2}$/i.test(segment));
+    if (dotSegment) {
+        throw new Error(
+            `OpenAPI path ${JSON.stringify(path)} has a "." or ".." segment, which leaves the baseURL's path once the URL is normalized. Rename the path in the spec.`,
+        );
+    }
 }
 
 /**

package/bin/lib/openapi/generate.hostile.test.mjs

@@ -672,3 +672,140 @@ describe("generate — names that collide with what the generator itself declare
         );
     });
 });
+
+describe("generate — spec text that would leave its place in the output (#533)", () => {
+    const ESC_TAG = "items\u001b]0;PWNED\u0007\u009b31m\r";
+    const POST_BODY = {
+        "/a": { post: { tags: ["t"], requestBody: JSON_BODY("Body"), responses: OK } },
+    };
+
+    it("a path key that is an absolute URL is refused, so no method calls another origin", () => {
+        expect(() =>
+            generate(spec({ "https://other.example/x": { get: { tags: ["t"], responses: OK } } })),
+        ).toThrow(/path "https:\/\/other\.example\/x" does not start with "\/"/);
+    });
+
+    it.each(["/../x", "/a/./b", "/a/..", "/%2e%2E/x", "/a\\..\\x", "/./x?y=1"])(
+        "a path key with a dot segment (%s) is refused, so it cannot climb out of the baseURL path",
+        (path) => {
+            expect(() =>
+                generate(spec({ [path]: { get: { tags: ["t"], responses: OK } } })),
+            ).toThrow(/has a "\." or "\.\." segment/);
+        },
+    );
+
+    it("dots inside a segment, dots in the query and a doubled slash still generate", () => {
+        const { files } = generate(
+            spec({
+                "/v1.2/..cache/file.json": { get: { tags: ["t"], responses: OK } },
+                "//double/slash": { get: { tags: ["t"], responses: OK } },
+                "/search?q=..": { get: { tags: ["t"], responses: OK } },
+            }),
+        );
+        expect(files["t/service.ts"]).toContain('"/v1.2/..cache/file.json"');
+        expect(files["t/service.ts"]).toContain('"/search?q=.."');
+    });
+
+    it("a property named __proto__ is refused instead of silently vanishing from the Zod shape", () => {
+        const Body = JSON.parse(
+            '{"type":"object","required":["__proto__"],"properties":{"__proto__":{"type":"string"}}}',
+        );
+        expect(() => generate(spec(POST_BODY, { Body }))).toThrow(
+            /schema "Body" at \(root\): a property named "__proto__" cannot be validated/,
+        );
+    });
+
+    it("a default value with a nested __proto__ key is refused", () => {
+        const Body = JSON.parse(
+            '{"type":"object","properties":{"meta":{"type":"object","default":{"a":{"__proto__":{"admin":true}}}}}}',
+        );
+        expect(() => generate(spec(POST_BODY, { Body }))).toThrow(
+            /schema "Body" at properties\.meta: the default value has a "__proto__" key/,
+        );
+    });
+
+    it("properties called constructor or prototype still generate and are validated", () => {
+        const { files } = generate(
+            spec(POST_BODY, {
+                Body: {
+                    type: "object",
+                    required: ["constructor"],
+                    properties: {
+                        constructor: { type: "string" },
+                        prototype: { type: "string" },
+                    },
+                },
+            }),
+        );
+        const schemas = evaluate(files["t/schemas.ts"], vm.createContext({}), {});
+        expect(schemas.BodySchema.safeParse({ constructor: 1 }).success).toBe(false);
+        expect(schemas.BodySchema.safeParse({ constructor: "x" }).success).toBe(true);
+    });
+
+    it("a nested-quantifier pattern still generates and comes back as a warning naming the schema", () => {
+        const { files, warnings } = generate(
+            spec(POST_BODY, {
+                Body: {
+                    type: "object",
+                    properties: {
+                        slug: { type: "string", pattern: "^([a-z0-9]+-)*[a-z0-9]+$" },
+                        evil: { type: "string", pattern: "^(a+)+$" },
+                    },
+                },
+            }),
+        );
+        expect(files["t/schemas.ts"]).toContain('new RegExp("^(a+)+$")');
+        expect(warnings).toHaveLength(1);
+        expect(warnings[0]).toMatch(/schema "Body" at properties\.evil: pattern "\^\(a\+\)\+\$"/);
+    });
+
+    it("terminal control characters in a tag do not reach the generated doc comment", () => {
+        const { files, tags } = generate(
+            spec({ "/a": { get: { tags: [ESC_TAG], responses: OK } } }),
+        );
+        const service = Object.entries(files).find(([f]) => f.endsWith("/service.ts"))[1];
+        expect(tags).toEqual([ESC_TAG]);
+        expect(service).not.toMatch(/[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/);
+        expect(service).toContain('the "items]0;PWNED31m " routes');
+    });
+
+    it("the folder and class reported for each group are the ones written", () => {
+        const { files, services } = generate(
+            spec({ "/a": { get: { tags: ["Items API"], responses: OK } } }),
+        );
+        expect(services).toEqual([{ slug: "items-api", className: "ItemsApiService" }]);
+        expect(files["items-api/service.ts"]).toContain("export class ItemsApiService");
+    });
+
+    it("the output for a spec with control characters and a flagged pattern typechecks", () => {
+        const { files } = generate(
+            spec(
+                {
+                    "/a/{id}": {
+                        post: {
+                            tags: ["t"],
+                            summary: "x\u001b[2J\u009d8;;https://evil/\u009c",
+                            parameters: [
+                                {
+                                    name: "id",
+                                    in: "path",
+                                    required: true,
+                                    schema: { type: "string" },
+                                },
+                            ],
+                            requestBody: JSON_BODY("Body"),
+                            responses: OK,
+                        },
+                    },
+                },
+                {
+                    Body: {
+                        type: "object",
+                        properties: { evil: { type: "string", pattern: "(\\w+\\s?)*" } },
+                    },
+                },
+            ),
+        );
+        expect(typecheck(files, "t")).toEqual([]);
+    });
+});