toolcraft-openapi 0.0.49 → 0.0.51

package/dist/mock/fetch.js

@@ -34,6 +34,10 @@ export async function mockFetch(options) {
             body: parsedBody,
             at: new Date()
         });
+        const parameterErrors = validateRequestParameters(operation, requestUrl, headers, document);
+        if (parameterErrors.length > 0) {
+            return jsonResponse(422, { errors: parameterErrors });
+        }
         if (operation.requestBodySchema !== undefined && parsedBody !== undefined) {
             const errors = validateAgainstSchema(parsedBody, operation.requestBodySchema, document, "$");
             if (errors.length > 0) {
@@ -46,7 +50,7 @@ export async function mockFetch(options) {
         const fixture = await fixtureLoader(operation.operationId);
         if (fixture !== undefined) {
             const status = fixture.status ?? operation.defaultStatus;
-            const responseSchema = operation.responseSchemas.get(status);
+            const responseSchema = findResponseSchema(operation.responseSchemas, status);
             if (responseSchema !== undefined && fixture.body !== undefined) {
                 const errors = validateAgainstSchema(fixture.body, responseSchema, document, "$response");
                 if (errors.length > 0) {
@@ -110,13 +114,16 @@ function compileOperations(document) {
             const operationId = resolvedOperation.operationId ?? `${method.toUpperCase()} ${pathTemplate}`;
             const { defaultStatus, defaultExample, responseSchemas } = pickResponseMetadata(resolvedOperation, document);
             const { schema: requestBodySchema, required: requestBodyRequired } = pickRequestBody(resolvedOperation, document);
+            const pathParameterNames = collectPathParameterNames(pathTemplate);
             compiled.push({
                 method: method.toUpperCase(),
                 pathTemplate,
                 pathRegex: pathTemplateToRegex(pathTemplate),
+                pathParameterNames,
                 pathSpecificity: countPathPlaceholders(pathTemplate),
                 operationId,
                 operation: resolvedOperation,
+                parameters: collectCompiledParameters(pathItem.parameters, resolvedOperation.parameters, document),
                 defaultStatus,
                 defaultExample,
                 requestBodySchema,
@@ -131,14 +138,31 @@ function compileOperations(document) {
     return compiled;
 }
 function countPathPlaceholders(template) {
-    return (template.match(/\{[^}]+\}/g) ?? []).length;
+    return collectPathParameterNames(template).length;
 }
 function pathTemplateToRegex(template) {
     // Escape regex metacharacters except for "{...}" placeholders, which become non-slash captures.
     const pattern = template.replace(/[.*+?^${}()|[\]\\]/g, (match) => match === "{" || match === "}" ? match : `\\${match}`);
-    const withParams = pattern.replace(/\{[^}]+\}/g, "[^/]+");
+    const withParams = pattern.replace(/\{[^}]+\}/g, "([^/]+)");
     return new RegExp(`^${withParams}$`);
 }
+function collectPathParameterNames(template) {
+    const names = [];
+    let index = 0;
+    while (index < template.length) {
+        const start = template.indexOf("{", index);
+        if (start === -1) {
+            break;
+        }
+        const end = template.indexOf("}", start + 1);
+        if (end === -1) {
+            break;
+        }
+        names.push(template.slice(start + 1, end));
+        index = end + 1;
+    }
+    return names;
+}
 function resolveOperation(operation, document) {
     if (isReference(operation)) {
         return resolveReference(operation, document);
@@ -147,10 +171,11 @@ function resolveOperation(operation, document) {
 }
 function pickResponseMetadata(operation, document) {
     const responses = operation.responses ?? {};
-    const responseSchemas = new Map();
+    const responseSchemas = [];
+    const successResponses = [];
     for (const [code, response] of Object.entries(responses)) {
-        const status = parseInt(code, 10);
-        if (!Number.isFinite(status) || response === undefined) {
+        const status = parseResponseStatus(code);
+        if (status === undefined || response === undefined) {
             continue;
         }
         const resolved = isReference(response)
@@ -158,27 +183,46 @@ function pickResponseMetadata(operation, document) {
             : response;
         const schema = extractResponseSchema(resolved, document);
         if (schema !== undefined) {
-            responseSchemas.set(status, schema);
+            responseSchemas.push({ ...status, schema });
+        }
+        if (isSuccessStatus(status.status)) {
+            successResponses.push({ status: status.status, response });
         }
     }
-    const successCodes = Object.keys(responses)
-        .map((code) => parseInt(code, 10))
-        .filter((code) => Number.isFinite(code) && code >= 200 && code < 300)
-        .sort((a, b) => a - b);
-    if (successCodes.length === 0) {
+    successResponses.sort((a, b) => a.status - b.status);
+    const firstSuccess = successResponses[0];
+    if (firstSuccess === undefined) {
         return { defaultStatus: 200, defaultExample: undefined, responseSchemas };
     }
-    const status = successCodes[0];
-    const response = responses[String(status)];
-    const resolvedResponse = response !== undefined && isReference(response)
-        ? resolveReference(response, document)
-        : response;
+    const resolvedResponse = isReference(firstSuccess.response)
+        ? resolveReference(firstSuccess.response, document)
+        : firstSuccess.response;
     return {
-        defaultStatus: status,
+        defaultStatus: firstSuccess.status,
         defaultExample: extractExample(resolvedResponse, document),
         responseSchemas
     };
 }
+function parseResponseStatus(code) {
+    if (code.length === 3 && code[1]?.toUpperCase() === "X" && code[2]?.toUpperCase() === "X") {
+        const family = Number(code[0]);
+        return Number.isInteger(family) && family >= 1 && family <= 5
+            ? { status: family * 100, range: true }
+            : undefined;
+    }
+    if (code.length !== 3 || [...code].some((character) => character < "0" || character > "9")) {
+        return undefined;
+    }
+    return { status: Number(code), range: false };
+}
+function isSuccessStatus(status) {
+    return status >= 200 && status < 300;
+}
+function findResponseSchema(schemas, status) {
+    return (schemas.find((candidate) => !candidate.range && candidate.status === status)?.schema ??
+        schemas.find((candidate) => candidate.range && Math.floor(status / 100) === candidate.status / 100)
+            ?.schema);
+}
 function extractResponseSchema(response, document) {
     if (response === undefined) {
         return undefined;
@@ -211,6 +255,95 @@ function pickRequestBody(operation, document) {
         : media.schema;
     return { schema, required: resolved.required === true };
 }
+function collectCompiledParameters(pathParameters, operationParameters, document) {
+    const parameters = new Map();
+    for (const raw of [...(pathParameters ?? []), ...(operationParameters ?? [])]) {
+        const parameter = isReference(raw)
+            ? resolveReference(raw, document)
+            : raw;
+        if (parameter.in !== "path" && parameter.in !== "query" && parameter.in !== "header") {
+            continue;
+        }
+        parameters.set(`${parameter.in}:${parameter.name}`, {
+            name: parameter.name,
+            location: parameter.in,
+            required: parameter.in === "path" || parameter.required === true,
+            schema: parameter.schema
+        });
+    }
+    return [...parameters.values()];
+}
+function validateRequestParameters(operation, requestUrl, headers, document) {
+    const pathValues = collectPathParameterValues(operation, requestUrl.pathname);
+    const errors = [];
+    for (const parameter of operation.parameters) {
+        const pointer = `$${parameter.location}/${parameter.name}`;
+        const value = readParameterValue(parameter, requestUrl, headers, pathValues);
+        if (value === undefined) {
+            if (parameter.required) {
+                errors.push(`${pointer}: required`);
+            }
+            continue;
+        }
+        if (parameter.schema !== undefined) {
+            errors.push(...validateAgainstSchema(value, parameter.schema, document, pointer));
+        }
+    }
+    return errors;
+}
+function collectPathParameterValues(operation, pathname) {
+    const match = operation.pathRegex.exec(pathname);
+    const values = new Map();
+    if (match === null) {
+        return values;
+    }
+    for (let index = 0; index < operation.pathParameterNames.length; index++) {
+        const value = match[index + 1];
+        if (value !== undefined) {
+            values.set(operation.pathParameterNames[index], decodeUrlComponent(value));
+        }
+    }
+    return values;
+}
+function readParameterValue(parameter, requestUrl, headers, pathValues) {
+    switch (parameter.location) {
+        case "path":
+            return coerceParameterValue(parameter.schema, pathValues.get(parameter.name));
+        case "query": {
+            const values = requestUrl.searchParams.getAll(parameter.name);
+            if (values.length === 0) {
+                return undefined;
+            }
+            return schemaAcceptsArray(parameter.schema) ? coerceParameterValues(values) : values[0];
+        }
+        case "header":
+            return coerceParameterValue(parameter.schema, headers[parameter.name.toLowerCase()]);
+    }
+}
+function coerceParameterValue(schema, value) {
+    if (value === undefined || !schemaAcceptsArray(schema)) {
+        return value;
+    }
+    return coerceParameterValues([value]);
+}
+function coerceParameterValues(values) {
+    return values.flatMap((value) => value.split(","));
+}
+function schemaAcceptsArray(schema) {
+    if (schema === undefined || isReference(schema)) {
+        return false;
+    }
+    const type = schema.type;
+    return Array.isArray(type) ? type.includes("array") : type === "array";
+}
+function decodeUrlComponent(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}
 function extractExample(response, document) {
     if (response === undefined) {
         return undefined;
@@ -265,7 +398,7 @@ function resolveReference(reference, document) {
     const segments = ref
         .slice(2)
         .split("/")
-        .map((segment) => segment.replace(/~1/g, "/").replace(/~0/g, "~"));
+        .map(decodeReferenceSegment);
     let current = document;
     for (const segment of segments) {
         if (current === null || typeof current !== "object") {
@@ -281,6 +414,16 @@ function resolveReference(reference, document) {
     }
     return current;
 }
+function decodeReferenceSegment(segment) {
+    let decoded = segment;
+    try {
+        decoded = decodeURIComponent(segment);
+    }
+    catch {
+        decoded = segment;
+    }
+    return decoded.replace(/~1/g, "/").replace(/~0/g, "~");
+}
 function validateAgainstSchema(value, schema, document, pointer) {
     const resolved = isReference(schema)
         ? resolveReference(schema, document)
@@ -334,11 +477,36 @@ function validateAgainstSchema(value, schema, document, pointer) {
             errors.push(...validateAgainstSchema(value[i], resolved.items, document, `${pointer}/${i}`));
         }
     }
+    if (typeof value === "number") {
+        validateNumberConstraints(value, resolved, pointer, errors);
+    }
+    if (typeof value === "string") {
+        validateStringConstraints(value, resolved, pointer, errors);
+    }
     if (resolved.enum !== undefined && !resolved.enum.includes(value)) {
         errors.push(`${pointer}: not in enum`);
     }
     return errors;
 }
+function validateNumberConstraints(value, schema, pointer, errors) {
+    if (schema.minimum !== undefined && value < schema.minimum) {
+        errors.push(`${pointer}: expected value to be >= ${schema.minimum}`);
+    }
+    if (schema.maximum !== undefined && value > schema.maximum) {
+        errors.push(`${pointer}: expected value to be <= ${schema.maximum}`);
+    }
+}
+function validateStringConstraints(value, schema, pointer, errors) {
+    if (schema.minLength !== undefined && value.length < schema.minLength) {
+        errors.push(`${pointer}: expected length to be >= ${schema.minLength}`);
+    }
+    if (schema.maxLength !== undefined && value.length > schema.maxLength) {
+        errors.push(`${pointer}: expected length to be <= ${schema.maxLength}`);
+    }
+    if (schema.pattern !== undefined && !new RegExp(schema.pattern).test(value)) {
+        errors.push(`${pointer}: expected value to match pattern ${schema.pattern}`);
+    }
+}
 function normalizeTypes(schema) {
     const type = schema.type;
     if (type === undefined) {

package/node_modules/@poe-code/frontmatter/dist/fences.d.ts

@@ -1,8 +1,25 @@
 export type FrontmatterBlock = {
     raw: string;
     body: string;
+    rawStart: number;
+    rawEnd: number;
 };
 export type SplitFrontmatterResult = FrontmatterBlock | {
     body: string;
 };
+export type InspectFrontmatterResult = (FrontmatterBlock & {
+    kind: "frontmatter";
+}) | {
+    kind: "missing-closing-fence";
+    raw: string;
+    rawStart: number;
+    rawEnd: number;
+    body: "";
+    message: string;
+    position: number;
+} | {
+    kind: "body";
+    body: string;
+};
 export declare function splitFrontmatterBlock(source: string): SplitFrontmatterResult;
+export declare function inspectFrontmatterBlock(source: string): InspectFrontmatterResult;

package/node_modules/@poe-code/frontmatter/dist/fences.js

@@ -1,15 +1,43 @@
+const MISSING_END_DELIMITER_MESSAGE = "Missing YAML frontmatter end delimiter (---).";
 export function splitFrontmatterBlock(source) {
+    const inspected = inspectFrontmatterBlock(source);
+    if (inspected.kind === "body") {
+        return { body: inspected.body };
+    }
+    if (inspected.kind === "missing-closing-fence") {
+        throw new Error(inspected.message);
+    }
+    return {
+        raw: inspected.raw,
+        rawStart: inspected.rawStart,
+        rawEnd: inspected.rawEnd,
+        body: inspected.body
+    };
+}
+export function inspectFrontmatterBlock(source) {
     const content = source.startsWith("\uFEFF") ? source.slice(1) : source;
+    const sourceOffset = source.length - content.length;
     const opening = readOpeningFence(content);
     if (opening === undefined) {
-        return { body: source };
+        return { kind: "body", body: source };
     }
     const closing = findClosingFence(content, opening.next);
     if (closing === undefined) {
-        throw new Error("Missing YAML frontmatter end delimiter (---).");
+        return {
+            kind: "missing-closing-fence",
+            raw: content.slice(opening.next),
+            rawStart: sourceOffset + opening.next,
+            rawEnd: source.length,
+            body: "",
+            message: MISSING_END_DELIMITER_MESSAGE,
+            position: source.length
+        };
     }
     return {
+        kind: "frontmatter",
         raw: content.slice(opening.next, closing.index),
+        rawStart: sourceOffset + opening.next,
+        rawEnd: sourceOffset + closing.index,
         body: content.slice(closing.end + closing.lineBreakLength)
     };
 }
@@ -18,7 +46,7 @@ function readOpeningFence(source) {
         return undefined;
     }
     const lineEnd = findLineEnd(source, 0);
-    if (lineEnd.lineBreakLength === 0 || source.slice(0, lineEnd.index) !== "---") {
+    if (lineEnd.lineBreakLength === 0 || !isFenceLine(source.slice(0, lineEnd.index))) {
         return undefined;
     }
     return { next: lineEnd.index + lineEnd.lineBreakLength };
@@ -27,7 +55,7 @@ function findClosingFence(source, start) {
     let lineStart = start;
     while (lineStart <= source.length) {
         const lineEnd = findLineEnd(source, lineStart);
-        if (isClosingFenceLine(source.slice(lineStart, lineEnd.index))) {
+        if (isFenceLine(source.slice(lineStart, lineEnd.index))) {
             return {
                 index: lineStart,
                 end: lineEnd.index,
@@ -41,7 +69,7 @@ function findClosingFence(source, start) {
     }
     return undefined;
 }
-function isClosingFenceLine(line) {
+function isFenceLine(line) {
     if (!line.startsWith("---")) {
         return false;
     }

package/node_modules/@poe-code/frontmatter/dist/parse.js

@@ -1,5 +1,5 @@
 import { LineCounter, parse, parseDocument } from "yaml";
-import { splitFrontmatterBlock } from "./fences.js";
+import { inspectFrontmatterBlock, splitFrontmatterBlock } from "./fences.js";
 export class FrontmatterParseError extends Error {
     constructor(message) {
         super(message);
@@ -20,9 +20,9 @@ export function parseFrontmatter(source, options = {}) {
     };
 }
 export function parseFrontmatterDocument(source, options = {}) {
-    const split = splitFrontmatter(source);
-    const lineCounter = new LineCounter();
-    if (split.raw === undefined) {
+    const split = inspectFrontmatterBlock(source);
+    const lineCounter = createSourceLineCounter(source);
+    if (split.kind === "body") {
         return {
             frontmatter: {},
             body: split.body,
@@ -30,14 +30,26 @@ export function parseFrontmatterDocument(source, options = {}) {
             lineCounter
         };
     }
-    const document = parseDocument(normalizeYamlLineEndings(split.raw), {
-        lineCounter,
+    if (split.kind === "missing-closing-fence") {
+        return {
+            frontmatter: {},
+            body: split.body,
+            errors: [{ message: split.message, pos: [split.position, split.position] }],
+            lineCounter
+        };
+    }
+    const yamlLineCounter = new LineCounter();
+    const normalizedYaml = normalizeYamlLineEndings(split.raw);
+    const document = parseDocument(normalizedYaml, {
+        lineCounter: yamlLineCounter,
         prettyErrors: false,
         uniqueKeys: options.uniqueKeys ?? false
     });
     const errors = document.errors.map((error) => ({
         message: error.message,
-        ...(error.pos === undefined ? {} : { pos: error.pos })
+        ...(error.pos === undefined
+            ? {}
+            : { pos: translateYamlErrorPosition(error.pos, split) })
     }));
     if (errors.length > 0) {
         return {
@@ -47,12 +59,72 @@ export function parseFrontmatterDocument(source, options = {}) {
             lineCounter
         };
     }
-    return {
-        frontmatter: normalizeYamlFrontmatter(document.toJSON()),
-        body: split.body,
-        errors,
-        lineCounter
-    };
+    try {
+        return {
+            frontmatter: normalizeYamlFrontmatter(document.toJSON()),
+            body: split.body,
+            errors,
+            lineCounter
+        };
+    }
+    catch (error) {
+        if (error instanceof FrontmatterParseError) {
+            return {
+                frontmatter: {},
+                body: split.body,
+                errors: [{ message: error.message }],
+                lineCounter
+            };
+        }
+        throw error;
+    }
+}
+function createSourceLineCounter(source) {
+    const lineCounter = new LineCounter();
+    lineCounter.addNewLine(0);
+    for (let index = 0; index < source.length; index += 1) {
+        const character = source[index];
+        if (character === "\n") {
+            lineCounter.addNewLine(index + 1);
+            continue;
+        }
+        if (character === "\r") {
+            lineCounter.addNewLine(index + (source[index + 1] === "\n" ? 2 : 1));
+            if (source[index + 1] === "\n") {
+                index += 1;
+            }
+        }
+    }
+    return lineCounter;
+}
+function translateYamlErrorPosition(pos, split) {
+    return pos.map((offset) => split.rawStart + normalizeYamlErrorOffset(split.raw, offset));
+}
+function normalizeYamlErrorOffset(raw, offset) {
+    if (offset >= raw.length && endsWithLineBreak(raw)) {
+        return findPreviousLineStart(raw, raw.length);
+    }
+    return offset;
+}
+function endsWithLineBreak(value) {
+    return value.endsWith("\n") || value.endsWith("\r");
+}
+function findPreviousLineStart(value, end) {
+    let index = end - 1;
+    if (value[index] === "\n") {
+        index -= 1;
+    }
+    if (value[index] === "\r") {
+        index -= 1;
+    }
+    while (index >= 0) {
+        const character = value[index];
+        if (character === "\n" || character === "\r") {
+            return index + 1;
+        }
+        index -= 1;
+    }
+    return 0;
 }
 function splitFrontmatter(source) {
     try {
@@ -102,7 +174,7 @@ function normalizeYamlFrontmatter(value) {
     if (value === null || value === undefined) {
         return {};
     }
-    if (!isRecord(value)) {
+    if (!isPlainRecord(value)) {
         throw new FrontmatterParseError("YAML frontmatter must parse to an object.");
     }
     return normalizeYamlValue(value);

package/node_modules/@poe-code/frontmatter/dist/stringify.js

@@ -2,6 +2,7 @@ import { stringify } from "yaml";
 import { FrontmatterParseError } from "./parse.js";
 export function stringifyFrontmatter(frontmatter, body) {
     try {
+        assertFrontmatterRoot(frontmatter);
         assertAcyclic(frontmatter);
         return `---\n${stringify(frontmatter, { aliasDuplicateObjects: false }).trimEnd()}\n---\n${body}`;
     }
@@ -13,6 +14,11 @@ export function stringifyFrontmatter(frontmatter, body) {
         throw new FrontmatterParseError(`Invalid YAML frontmatter: ${message}`);
     }
 }
+function assertFrontmatterRoot(value) {
+    if (!isPlainRecord(value)) {
+        throw new FrontmatterParseError("YAML frontmatter must parse to an object.");
+    }
+}
 function assertAcyclic(value, seen = new WeakSet()) {
     if (typeof value !== "object" || value === null) {
         return;
@@ -33,3 +39,10 @@ function assertAcyclic(value, seen = new WeakSet()) {
     }
     seen.delete(value);
 }
+function isPlainRecord(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return false;
+    }
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}

package/node_modules/auth-store/dist/create-secret-store.js

@@ -28,13 +28,14 @@ export function createSecretStore(input) {
 function resolveBackend(input) {
     const envVar = input.backendEnvVar ?? DEFAULT_BACKEND_ENV_VAR;
     const configuredBackend = input.backend ?? getOwnEnvValue(input.env, envVar) ?? getOwnEnvValue(process.env, envVar);
-    if (configuredBackend === "keychain") {
+    const backend = configuredBackend?.trim();
+    if (backend === "keychain") {
         return "keychain";
     }
-    if (configuredBackend === undefined || configuredBackend === "file") {
+    if (backend === undefined || backend === "file") {
         return "file";
     }
-    throw new Error(`Unsupported auth store backend: ${configuredBackend}`);
+    throw new Error(`Unsupported auth store backend: ${backend}`);
 }
 function getOwnEnvValue(env, key) {
     return env !== undefined && Object.prototype.hasOwnProperty.call(env, key)

package/node_modules/auth-store/dist/encrypted-file-store.js

@@ -24,7 +24,10 @@ export class EncryptedFileStore {
         if (input.filePath === undefined) {
             const homeDirectory = (input.getHomeDirectory ?? homedir)();
             const defaultDirectory = input.defaultDirectory ?? ".auth-store";
-            this.filePath = path.join(homeDirectory, defaultDirectory, input.defaultFileName ?? "credentials.enc");
+            const defaultFileName = input.defaultFileName ?? "credentials.enc";
+            assertSafeDefaultDirectory(defaultDirectory);
+            assertSafeDefaultFileName(defaultFileName);
+            this.filePath = path.join(homeDirectory, defaultDirectory, defaultFileName);
             this.symbolicLinkCheckStartPath = resolveDefaultDirectoryCheckStart(homeDirectory, defaultDirectory);
         }
         else {
@@ -154,7 +157,7 @@ function resolveDefaultDirectoryCheckStart(homeDirectory, defaultDirectory) {
 }
 function getProtectedCredentialPaths(resolvedPath, symbolicLinkCheckStartPath) {
     if (symbolicLinkCheckStartPath === null) {
-        return [path.dirname(resolvedPath), resolvedPath];
+        return getExplicitProtectedCredentialPaths(resolvedPath);
     }
     const resolvedStartPath = path.resolve(symbolicLinkCheckStartPath);
     if (!isPathInsideOrEqual(resolvedPath, resolvedStartPath)) {
@@ -168,6 +171,50 @@ function getProtectedCredentialPaths(resolvedPath, symbolicLinkCheckStartPath) {
     }
     return protectedPaths;
 }
+function assertSafeDefaultDirectory(defaultDirectory) {
+    if (path.isAbsolute(defaultDirectory) || path.win32.isAbsolute(defaultDirectory)) {
+        throw new Error("defaultDirectory must be a relative path inside the home directory");
+    }
+    for (const segment of splitPathSegments(defaultDirectory)) {
+        if (segment === "..") {
+            throw new Error("defaultDirectory must be a relative path inside the home directory");
+        }
+    }
+}
+function assertSafeDefaultFileName(defaultFileName) {
+    if (defaultFileName.trim().length === 0 ||
+        defaultFileName === "." ||
+        defaultFileName === ".." ||
+        splitPathSegments(defaultFileName).length !== 1) {
+        throw new Error("defaultFileName must be a file name without path separators");
+    }
+}
+function splitPathSegments(value) {
+    return value
+        .split("/")
+        .flatMap((segment) => segment.split("\\"))
+        .filter((segment) => segment.length > 0);
+}
+function getExplicitProtectedCredentialPaths(resolvedPath) {
+    const parsed = path.parse(resolvedPath);
+    const segments = resolvedPath
+        .slice(parsed.root.length)
+        .split(path.sep)
+        .filter((segment) => segment.length > 0);
+    if (segments.length <= 1) {
+        return [resolvedPath];
+    }
+    const protectedPaths = [];
+    let currentPath = parsed.root;
+    for (const [index, segment] of segments.entries()) {
+        currentPath = path.join(currentPath, segment);
+        if (index === 0) {
+            continue;
+        }
+        protectedPaths.push(currentPath);
+    }
+    return protectedPaths;
+}
 function isPathInsideOrEqual(childPath, parentPath) {
     const relativePath = path.relative(parentPath, childPath);
     return relativePath === "" || (!relativePath.startsWith("..") && !path.isAbsolute(relativePath));

package/node_modules/auth-store/dist/keychain-store.js

@@ -7,8 +7,14 @@ export class KeychainStore {
     account;
     constructor(input) {
         this.runCommand = input.runCommand ?? runSecurityCommand;
-        this.service = input.service;
-        this.account = input.account;
+        this.service = input.service.trim();
+        this.account = input.account.trim();
+        if (this.service.length === 0) {
+            throw new Error("Keychain service must not be empty");
+        }
+        if (this.account.length === 0) {
+            throw new Error("Keychain account must not be empty");
+        }
     }
     async get() {
         const result = await this.executeSecurityCommand(["find-generic-password", "-s", this.service, "-a", this.account, "-w"], "read secret from macOS Keychain");
@@ -31,8 +37,9 @@ export class KeychainStore {
             "-a",
             this.account,
             "-U",
-            "-w"
-        ], "store secret in macOS Keychain", { stdin: value });
+            "-w",
+            value
+        ], "store secret in macOS Keychain");
         if (getCommandExitCode(result) !== 0) {
             throw createSecurityCliFailure("store secret in macOS Keychain", result);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft-openapi",
-  "version": "0.0.49",
+  "version": "0.0.51",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -28,7 +28,7 @@
     "toolcraft-openapi-generate": "dist/bin/generate.js"
   },
   "dependencies": {
-    "toolcraft": "0.0.49",
+    "toolcraft": "0.0.51",
     "auth-store": "^0.0.1",
     "yaml": "^2.8.2"
   },