toolcraft-openapi 0.0.50 → 0.0.51

package/node_modules/@poe-code/frontmatter/dist/fences.d.ts

@@ -1,8 +1,25 @@
 export type FrontmatterBlock = {
     raw: string;
     body: string;
+    rawStart: number;
+    rawEnd: number;
 };
 export type SplitFrontmatterResult = FrontmatterBlock | {
     body: string;
 };
+export type InspectFrontmatterResult = (FrontmatterBlock & {
+    kind: "frontmatter";
+}) | {
+    kind: "missing-closing-fence";
+    raw: string;
+    rawStart: number;
+    rawEnd: number;
+    body: "";
+    message: string;
+    position: number;
+} | {
+    kind: "body";
+    body: string;
+};
 export declare function splitFrontmatterBlock(source: string): SplitFrontmatterResult;
+export declare function inspectFrontmatterBlock(source: string): InspectFrontmatterResult;

package/node_modules/@poe-code/frontmatter/dist/fences.js

@@ -1,15 +1,43 @@
+const MISSING_END_DELIMITER_MESSAGE = "Missing YAML frontmatter end delimiter (---).";
 export function splitFrontmatterBlock(source) {
+    const inspected = inspectFrontmatterBlock(source);
+    if (inspected.kind === "body") {
+        return { body: inspected.body };
+    }
+    if (inspected.kind === "missing-closing-fence") {
+        throw new Error(inspected.message);
+    }
+    return {
+        raw: inspected.raw,
+        rawStart: inspected.rawStart,
+        rawEnd: inspected.rawEnd,
+        body: inspected.body
+    };
+}
+export function inspectFrontmatterBlock(source) {
     const content = source.startsWith("\uFEFF") ? source.slice(1) : source;
+    const sourceOffset = source.length - content.length;
     const opening = readOpeningFence(content);
     if (opening === undefined) {
-        return { body: source };
+        return { kind: "body", body: source };
     }
     const closing = findClosingFence(content, opening.next);
     if (closing === undefined) {
-        throw new Error("Missing YAML frontmatter end delimiter (---).");
+        return {
+            kind: "missing-closing-fence",
+            raw: content.slice(opening.next),
+            rawStart: sourceOffset + opening.next,
+            rawEnd: source.length,
+            body: "",
+            message: MISSING_END_DELIMITER_MESSAGE,
+            position: source.length
+        };
     }
     return {
+        kind: "frontmatter",
         raw: content.slice(opening.next, closing.index),
+        rawStart: sourceOffset + opening.next,
+        rawEnd: sourceOffset + closing.index,
         body: content.slice(closing.end + closing.lineBreakLength)
     };
 }
@@ -18,7 +46,7 @@ function readOpeningFence(source) {
         return undefined;
     }
     const lineEnd = findLineEnd(source, 0);
-    if (lineEnd.lineBreakLength === 0 || source.slice(0, lineEnd.index) !== "---") {
+    if (lineEnd.lineBreakLength === 0 || !isFenceLine(source.slice(0, lineEnd.index))) {
         return undefined;
     }
     return { next: lineEnd.index + lineEnd.lineBreakLength };
@@ -27,7 +55,7 @@ function findClosingFence(source, start) {
     let lineStart = start;
     while (lineStart <= source.length) {
         const lineEnd = findLineEnd(source, lineStart);
-        if (isClosingFenceLine(source.slice(lineStart, lineEnd.index))) {
+        if (isFenceLine(source.slice(lineStart, lineEnd.index))) {
             return {
                 index: lineStart,
                 end: lineEnd.index,
@@ -41,7 +69,7 @@ function findClosingFence(source, start) {
     }
     return undefined;
 }
-function isClosingFenceLine(line) {
+function isFenceLine(line) {
     if (!line.startsWith("---")) {
         return false;
     }

package/node_modules/@poe-code/frontmatter/dist/parse.js

@@ -1,5 +1,5 @@
 import { LineCounter, parse, parseDocument } from "yaml";
-import { splitFrontmatterBlock } from "./fences.js";
+import { inspectFrontmatterBlock, splitFrontmatterBlock } from "./fences.js";
 export class FrontmatterParseError extends Error {
     constructor(message) {
         super(message);
@@ -20,9 +20,9 @@ export function parseFrontmatter(source, options = {}) {
     };
 }
 export function parseFrontmatterDocument(source, options = {}) {
-    const split = splitFrontmatter(source);
-    const lineCounter = new LineCounter();
-    if (split.raw === undefined) {
+    const split = inspectFrontmatterBlock(source);
+    const lineCounter = createSourceLineCounter(source);
+    if (split.kind === "body") {
         return {
             frontmatter: {},
             body: split.body,
@@ -30,14 +30,26 @@ export function parseFrontmatterDocument(source, options = {}) {
             lineCounter
         };
     }
-    const document = parseDocument(normalizeYamlLineEndings(split.raw), {
-        lineCounter,
+    if (split.kind === "missing-closing-fence") {
+        return {
+            frontmatter: {},
+            body: split.body,
+            errors: [{ message: split.message, pos: [split.position, split.position] }],
+            lineCounter
+        };
+    }
+    const yamlLineCounter = new LineCounter();
+    const normalizedYaml = normalizeYamlLineEndings(split.raw);
+    const document = parseDocument(normalizedYaml, {
+        lineCounter: yamlLineCounter,
         prettyErrors: false,
         uniqueKeys: options.uniqueKeys ?? false
     });
     const errors = document.errors.map((error) => ({
         message: error.message,
-        ...(error.pos === undefined ? {} : { pos: error.pos })
+        ...(error.pos === undefined
+            ? {}
+            : { pos: translateYamlErrorPosition(error.pos, split) })
     }));
     if (errors.length > 0) {
         return {
@@ -47,12 +59,72 @@ export function parseFrontmatterDocument(source, options = {}) {
             lineCounter
         };
     }
-    return {
-        frontmatter: normalizeYamlFrontmatter(document.toJSON()),
-        body: split.body,
-        errors,
-        lineCounter
-    };
+    try {
+        return {
+            frontmatter: normalizeYamlFrontmatter(document.toJSON()),
+            body: split.body,
+            errors,
+            lineCounter
+        };
+    }
+    catch (error) {
+        if (error instanceof FrontmatterParseError) {
+            return {
+                frontmatter: {},
+                body: split.body,
+                errors: [{ message: error.message }],
+                lineCounter
+            };
+        }
+        throw error;
+    }
+}
+function createSourceLineCounter(source) {
+    const lineCounter = new LineCounter();
+    lineCounter.addNewLine(0);
+    for (let index = 0; index < source.length; index += 1) {
+        const character = source[index];
+        if (character === "\n") {
+            lineCounter.addNewLine(index + 1);
+            continue;
+        }
+        if (character === "\r") {
+            lineCounter.addNewLine(index + (source[index + 1] === "\n" ? 2 : 1));
+            if (source[index + 1] === "\n") {
+                index += 1;
+            }
+        }
+    }
+    return lineCounter;
+}
+function translateYamlErrorPosition(pos, split) {
+    return pos.map((offset) => split.rawStart + normalizeYamlErrorOffset(split.raw, offset));
+}
+function normalizeYamlErrorOffset(raw, offset) {
+    if (offset >= raw.length && endsWithLineBreak(raw)) {
+        return findPreviousLineStart(raw, raw.length);
+    }
+    return offset;
+}
+function endsWithLineBreak(value) {
+    return value.endsWith("\n") || value.endsWith("\r");
+}
+function findPreviousLineStart(value, end) {
+    let index = end - 1;
+    if (value[index] === "\n") {
+        index -= 1;
+    }
+    if (value[index] === "\r") {
+        index -= 1;
+    }
+    while (index >= 0) {
+        const character = value[index];
+        if (character === "\n" || character === "\r") {
+            return index + 1;
+        }
+        index -= 1;
+    }
+    return 0;
 }
 function splitFrontmatter(source) {
     try {
@@ -102,7 +174,7 @@ function normalizeYamlFrontmatter(value) {
     if (value === null || value === undefined) {
         return {};
     }
-    if (!isRecord(value)) {
+    if (!isPlainRecord(value)) {
         throw new FrontmatterParseError("YAML frontmatter must parse to an object.");
     }
     return normalizeYamlValue(value);

package/node_modules/@poe-code/frontmatter/dist/stringify.js

@@ -2,6 +2,7 @@ import { stringify } from "yaml";
 import { FrontmatterParseError } from "./parse.js";
 export function stringifyFrontmatter(frontmatter, body) {
     try {
+        assertFrontmatterRoot(frontmatter);
         assertAcyclic(frontmatter);
         return `---\n${stringify(frontmatter, { aliasDuplicateObjects: false }).trimEnd()}\n---\n${body}`;
     }
@@ -13,6 +14,11 @@ export function stringifyFrontmatter(frontmatter, body) {
         throw new FrontmatterParseError(`Invalid YAML frontmatter: ${message}`);
     }
 }
+function assertFrontmatterRoot(value) {
+    if (!isPlainRecord(value)) {
+        throw new FrontmatterParseError("YAML frontmatter must parse to an object.");
+    }
+}
 function assertAcyclic(value, seen = new WeakSet()) {
     if (typeof value !== "object" || value === null) {
         return;
@@ -33,3 +39,10 @@ function assertAcyclic(value, seen = new WeakSet()) {
     }
     seen.delete(value);
 }
+function isPlainRecord(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return false;
+    }
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}

package/node_modules/auth-store/dist/create-secret-store.js

@@ -28,13 +28,14 @@ export function createSecretStore(input) {
 function resolveBackend(input) {
     const envVar = input.backendEnvVar ?? DEFAULT_BACKEND_ENV_VAR;
     const configuredBackend = input.backend ?? getOwnEnvValue(input.env, envVar) ?? getOwnEnvValue(process.env, envVar);
-    if (configuredBackend === "keychain") {
+    const backend = configuredBackend?.trim();
+    if (backend === "keychain") {
         return "keychain";
     }
-    if (configuredBackend === undefined || configuredBackend === "file") {
+    if (backend === undefined || backend === "file") {
         return "file";
     }
-    throw new Error(`Unsupported auth store backend: ${configuredBackend}`);
+    throw new Error(`Unsupported auth store backend: ${backend}`);
 }
 function getOwnEnvValue(env, key) {
     return env !== undefined && Object.prototype.hasOwnProperty.call(env, key)

package/node_modules/auth-store/dist/encrypted-file-store.js

@@ -24,7 +24,10 @@ export class EncryptedFileStore {
         if (input.filePath === undefined) {
             const homeDirectory = (input.getHomeDirectory ?? homedir)();
             const defaultDirectory = input.defaultDirectory ?? ".auth-store";
-            this.filePath = path.join(homeDirectory, defaultDirectory, input.defaultFileName ?? "credentials.enc");
+            const defaultFileName = input.defaultFileName ?? "credentials.enc";
+            assertSafeDefaultDirectory(defaultDirectory);
+            assertSafeDefaultFileName(defaultFileName);
+            this.filePath = path.join(homeDirectory, defaultDirectory, defaultFileName);
             this.symbolicLinkCheckStartPath = resolveDefaultDirectoryCheckStart(homeDirectory, defaultDirectory);
         }
         else {
@@ -154,7 +157,7 @@ function resolveDefaultDirectoryCheckStart(homeDirectory, defaultDirectory) {
 }
 function getProtectedCredentialPaths(resolvedPath, symbolicLinkCheckStartPath) {
     if (symbolicLinkCheckStartPath === null) {
-        return [path.dirname(resolvedPath), resolvedPath];
+        return getExplicitProtectedCredentialPaths(resolvedPath);
     }
     const resolvedStartPath = path.resolve(symbolicLinkCheckStartPath);
     if (!isPathInsideOrEqual(resolvedPath, resolvedStartPath)) {
@@ -168,6 +171,50 @@ function getProtectedCredentialPaths(resolvedPath, symbolicLinkCheckStartPath) {
     }
     return protectedPaths;
 }
+function assertSafeDefaultDirectory(defaultDirectory) {
+    if (path.isAbsolute(defaultDirectory) || path.win32.isAbsolute(defaultDirectory)) {
+        throw new Error("defaultDirectory must be a relative path inside the home directory");
+    }
+    for (const segment of splitPathSegments(defaultDirectory)) {
+        if (segment === "..") {
+            throw new Error("defaultDirectory must be a relative path inside the home directory");
+        }
+    }
+}
+function assertSafeDefaultFileName(defaultFileName) {
+    if (defaultFileName.trim().length === 0 ||
+        defaultFileName === "." ||
+        defaultFileName === ".." ||
+        splitPathSegments(defaultFileName).length !== 1) {
+        throw new Error("defaultFileName must be a file name without path separators");
+    }
+}
+function splitPathSegments(value) {
+    return value
+        .split("/")
+        .flatMap((segment) => segment.split("\\"))
+        .filter((segment) => segment.length > 0);
+}
+function getExplicitProtectedCredentialPaths(resolvedPath) {
+    const parsed = path.parse(resolvedPath);
+    const segments = resolvedPath
+        .slice(parsed.root.length)
+        .split(path.sep)
+        .filter((segment) => segment.length > 0);
+    if (segments.length <= 1) {
+        return [resolvedPath];
+    }
+    const protectedPaths = [];
+    let currentPath = parsed.root;
+    for (const [index, segment] of segments.entries()) {
+        currentPath = path.join(currentPath, segment);
+        if (index === 0) {
+            continue;
+        }
+        protectedPaths.push(currentPath);
+    }
+    return protectedPaths;
+}
 function isPathInsideOrEqual(childPath, parentPath) {
     const relativePath = path.relative(parentPath, childPath);
     return relativePath === "" || (!relativePath.startsWith("..") && !path.isAbsolute(relativePath));

package/node_modules/auth-store/dist/keychain-store.js

@@ -7,8 +7,14 @@ export class KeychainStore {
     account;
     constructor(input) {
         this.runCommand = input.runCommand ?? runSecurityCommand;
-        this.service = input.service;
-        this.account = input.account;
+        this.service = input.service.trim();
+        this.account = input.account.trim();
+        if (this.service.length === 0) {
+            throw new Error("Keychain service must not be empty");
+        }
+        if (this.account.length === 0) {
+            throw new Error("Keychain account must not be empty");
+        }
     }
     async get() {
         const result = await this.executeSecurityCommand(["find-generic-password", "-s", this.service, "-a", this.account, "-w"], "read secret from macOS Keychain");
@@ -31,8 +37,9 @@ export class KeychainStore {
             "-a",
             this.account,
             "-U",
-            "-w"
-        ], "store secret in macOS Keychain", { stdin: value });
+            "-w",
+            value
+        ], "store secret in macOS Keychain");
         if (getCommandExitCode(result) !== 0) {
             throw createSecurityCliFailure("store secret in macOS Keychain", result);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft-openapi",
-  "version": "0.0.50",
+  "version": "0.0.51",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -28,7 +28,7 @@
     "toolcraft-openapi-generate": "dist/bin/generate.js"
   },
   "dependencies": {
-    "toolcraft": "0.0.50",
+    "toolcraft": "0.0.51",
     "auth-store": "^0.0.1",
     "yaml": "^2.8.2"
   },