@cldmv/slothlet 3.13.3 → 3.14.0

package/README.md

@@ -43,18 +43,17 @@ Every feature has been hardened with a comprehensive test suite - over **5,300 t
 
 ## ✨ What's New
 
-### Latest: v3.13.3 (August 2026)
+### Latest: v3.14.0 (August 2026)
 
-- **Version-dispatcher permissions fix completed (#287)** — 3.13.2 exempted slothlet's own version-dispatcher marker keys from the module-private (`_`/`__`) rule on the collision path, but a second framework read path — the post-`api.add` materialization drain and the load-time detection walks — still probed the marker with a gated `__`-private read, so a permissions-enabled consumer could still fail to mount a version-dispatched field with `PERMISSION_DENIED`. Those walks now detect a dispatcher by object identity (a module-private brand) instead of reading the marker, so no gated read happens and a version-dispatched data field mounts under `private.host: deny`.
-- **Nested-instance permission isolation (#290)** — Booting a second `slothlet()` from inside a leaf of a permissioned instance no longer throws `PERMISSION_DENIED` during the nested instance's own construction. Enforcement now resolves the caller and store from the instance doing the enforcing rather than the process-wide active flow, so a nested boot behaves like a standalone one — upholding the documented Multi-Instance Isolation contract.
-- [View full v3.13.3 Changelog](./docs/changelog/v3/v3.13.3.md)
+- **Browser importmap resolves consumer-graph package exports (#297)** — `generateBrowserAssets` now emits the exact `exports` subpath keys for the third-party packages your API leaves import, not just `@cldmv/slothlet`'s own surface. Import maps do plain prefix substitution and never consult a package's `exports`, so a redirected subpath (`@scope/ext/errors` → `./src/lib/errors.mjs`) previously 404'd in the browser and consumers hand-maintained allowlists. The generator now scans the API directory for the packages its leaves import, reads each package's `exports`, and emits the exact redirected keys — flat entries, wildcard directories, and the browser/`import`/`default` condition of conditional exports — served under a base derived from `slothletBase`. A new exported primitive, `collectPackageSpecifiers`, does the package-agnostic collection; `collectSlothletSpecifiers` is unchanged.
+- [View full v3.14.0 Changelog](./docs/changelog/v3/v3.14.0.md)
 
 ### Recent Releases
 
+- **v3.13.3** (August 2026) — Completes the version-dispatcher permissions fix (a second framework read path probed the marker with a gated `__`-private read) by detecting a dispatcher by object identity, and fixes nested-instance permission isolation so a second `slothlet()` booted inside a permissioned leaf no longer throws during its own construction ([Changelog](./docs/changelog/v3/v3.13.3.md))
 - **v3.13.2** (August 2026) — Restores composition of version-dispatched fields under a `permissions` configuration: slothlet's own version-dispatcher marker keys are exempted from the 3.13.0 module-private (`_`/`__`) rule by object identity, so a colliding version-dispatched field no longer fails at composition with `PERMISSION_DENIED` while a consumer's identically-named private member stays denied ([Changelog](./docs/changelog/v3/v3.13.2.md))
 - **v3.13.1** (August 2026) — `devcheck` dev-environment detection fix: reads the `--conditions=slothlet-dev` CLI form from `process.execArgv` and recognizes a scoped `node_modules` install at any depth, so a correct dev run or a git/tarball install no longer self-terminates ([Changelog](./docs/changelog/v3/v3.13.1.md))
 - **v3.13.0** (August 2026) — Sync/async-transparent hook dispatch, `api.slothlet.api.leaves()` for module-scoped path enumeration, and permission-enforced module-private (`_`/`__`) exports plus an injectable importer that attributes leaf execution in consumer coverage ([Changelog](./docs/changelog/v3/v3.13.0.md))
-- **v3.12.3** (August 2026) — Composition & attribution correctness: every read/call attributed to the responsible module (identity survives `await`, per-flow concurrency, redacted enumeration), `apiPath` matches the composed surface, faithful lazy resolution (thenable wrappers, deep chains, file+dir collisions), and collisions follow the documented `api.collision` table ([Changelog](./docs/changelog/v3/v3.12.3.md))
 
 📚 **For complete version history and detailed release notes, see [docs/changelog/](./docs/changelog/) folder.**
 

package/dist/lib/helpers/generate-manifest.mjs

@@ -14,4 +14,4 @@
 	limitations under the License.
 */
 
-import fs from"node:fs/promises";import path from"node:path";import{fileURLToPath}from"node:url";import{SlothletError}from"@cldmv/slothlet/errors";const SLOTHLET_SPEC_RE=/["'](@cldmv\/slothlet(?:\/[^"']+)?)["']/g;const DEFAULT_SLOTHLET_BASE="/node_modules/@cldmv/slothlet/";const LOADABLE_EXTENSIONS=new Set([".mjs",".cjs",".js",".ts",".mts",".cts"]);const SKIP_PREFIXES=["__","."];function isApiFile(filename){const ext=path.extname(filename);return LOADABLE_EXTENSIONS.has(ext)}function makeFileEntry(relativePath){const fullName=path.basename(relativePath);const name=path.basename(relativePath,path.extname(relativePath));return{path:relativePath,name,fullName}}async function scanDir(absDir,rootDir){let entries;try{entries=await fs.readdir(absDir,{withFileTypes:true})}catch{return{files:[],directories:[]}}const files=[];const directories=[];for(const entry of entries){if(SKIP_PREFIXES.some(p=>entry.name.startsWith(p)))continue;if(entry.isFile()){if(isApiFile(entry.name)){const absPath=path.join(absDir,entry.name);const rel=path.relative(rootDir,absPath).replace(/\\/g,"/");files.push(makeFileEntry(rel))}}else if(entry.isDirectory()){const absSubDir=path.join(absDir,entry.name);const relDir=path.relative(rootDir,absSubDir).replace(/\\/g,"/");const children=await scanDir(absSubDir,rootDir);if(children.files.length>0||children.directories.length>0){directories.push({name:entry.name,path:relDir,children})}}}return{files,directories}}async function generateManifest(dir){if(!dir||typeof dir!=="string"){const received=typeof dir==="string"?"<empty>":dir===null?"null":Array.isArray(dir)?"array":typeof dir;throw new SlothletError("GENERATE_MANIFEST_DIR_INVALID",{received},null,{validationError:true})}const absDir=path.resolve(dir);let stat;try{stat=await fs.stat(absDir)}catch(err){throw new SlothletError("GENERATE_MANIFEST_DIR_UNREADABLE",{dir:absDir,reason:err.message},null,{validationError:true})}if(!stat.isDirectory()){throw new SlothletError("GENERATE_MANIFEST_NOT_DIRECTORY",{dir:absDir},null,{validationError:true})}return scanDir(absDir,absDir)}function slothletPackageRoot(){return path.resolve(path.dirname(fileURLToPath(import.meta.url)),"../../..")}async function collectSlothletSpecifiers(root){const specifiers=new Set(["@cldmv/slothlet"]);const pkg=JSON.parse(await fs.readFile(path.join(root,"package.json"),"utf8"));for(const key of Object.keys(pkg.exports)){if(key.includes("*")||key.endsWith(".json"))continue;specifiers.add(key==="."?"@cldmv/slothlet":`@cldmv/slothlet${key.slice(1)}`)}for(const[key,value]of Object.entries(pkg.exports)){if(!key.includes("*")||key.startsWith("./i18n/language/"))continue;const specPrefix=`@cldmv/slothlet${key.slice(1)}`.split("*")[0];const targets=[];(function collectTargets(v){if(typeof v==="string"){if(v.includes("*")&&v.endsWith(".mjs"))targets.push(v)}else if(v&&typeof v==="object"){for(const child of Object.values(v))collectTargets(child)}})(value);for(const tmpl of targets){const star=tmpl.indexOf("*");const dirRel=tmpl.slice(0,star);const suffix=tmpl.slice(star+1);let files;try{files=await fs.readdir(path.join(root,dirRel),{recursive:true})}catch{continue}for(const f of files){const norm=String(f).replace(/\\/g,"/");if(norm.endsWith(suffix))specifiers.add(specPrefix+norm.slice(0,-suffix.length))}}}for(const[key,value]of Object.entries(pkg.imports??{})){if(!key.includes("*"))continue;const specPrefix=key.split("*")[0];const targets=[];(function collectTargets(v){if(typeof v==="string"){if(v.includes("*")&&v.endsWith(".mjs"))targets.push(v)}else if(v&&typeof v==="object"){for(const child of Object.values(v))collectTargets(child)}})(value);for(const tmpl of targets){const star=tmpl.indexOf("*");const dirRel=tmpl.slice(0,star);const suffix=tmpl.slice(star+1);let files;try{files=await fs.readdir(path.join(root,dirRel),{recursive:true})}catch{continue}for(const f of files){const norm=String(f).replace(/\\/g,"/");if(norm.endsWith(suffix))specifiers.add(specPrefix+norm.slice(0,-suffix.length))}}}const SKIP_DIRS=new Set(["node_modules","types","coverage","tmp","tests","api_tests",".git","docs"]);async function scan(dir){const entries=await fs.readdir(dir,{withFileTypes:true});for(const e of entries){if(e.isDirectory()){if(!SKIP_DIRS.has(e.name)&&!e.name.startsWith("."))await scan(path.join(dir,e.name))}else if(/\.(mjs|cjs|js)$/.test(e.name)){const src=await fs.readFile(path.join(dir,e.name),"utf8");let m;SLOTHLET_SPEC_RE.lastIndex=0;while(m=SLOTHLET_SPEC_RE.exec(src)){const spec=m[1];if(spec.startsWith("@cldmv/slothlet/i18n/language/"))continue;if(/[*<>]|\.\.\.|\/$/.test(spec)||spec.split("/").some(s=>s===""))continue;specifiers.add(spec)}}}}await scan(root);return specifiers}async function generateImportMap(slothletBase=DEFAULT_SLOTHLET_BASE){const base=String(slothletBase).endsWith("/")?String(slothletBase):`${slothletBase}/`;const root=slothletPackageRoot();const imports={};for(const spec of await collectSlothletSpecifiers(root)){let resolved;try{resolved=import.meta.resolve(spec);await fs.access(fileURLToPath(resolved))}catch{continue}const rel=path.relative(root,fileURLToPath(resolved)).replace(/\\/g,"/");imports[spec]=base+rel}try{const sampleDir=path.dirname(fileURLToPath(import.meta.resolve("@cldmv/slothlet/i18n/language/en-us.json")));for(const f of(await fs.readdir(sampleDir)).filter(n=>n.endsWith(".json"))){const rel=path.relative(root,path.join(sampleDir,f)).replace(/\\/g,"/");imports[`@cldmv/slothlet/i18n/language/${f}`]=base+rel}}catch{}try{const packRoot=path.dirname(fileURLToPath(import.meta.resolve("@cldmv/slothlet-i18n/package.json")));const packBase=base.replace(/@cldmv\/slothlet(@[^/]+)?\/$/,"@cldmv/slothlet-i18n$1/");if(packBase!==base){for(const f of(await fs.readdir(path.join(packRoot,"languages"))).filter(n=>n.endsWith(".json"))){imports[`@cldmv/slothlet-i18n/language/${f}`]=`${packBase}languages/${f}`}}}catch{}return{imports}}async function generateBrowserAssets(apiDir,options={}){const{slothletBase=DEFAULT_SLOTHLET_BASE}=options;if(typeof slothletBase!=="string"){throw new SlothletError("GENERATE_BROWSER_ASSETS_SLOTHLET_BASE_INVALID",{received:typeof slothletBase},null,{validationError:true})}const[manifest,importmap]=await Promise.all([generateManifest(apiDir),generateImportMap(slothletBase)]);return{manifest,importmap}}export{collectSlothletSpecifiers,generateBrowserAssets,generateImportMap,generateManifest};
+import fs from"node:fs/promises";import path from"node:path";import{fileURLToPath}from"node:url";import{SlothletError}from"@cldmv/slothlet/errors";const SLOTHLET_SPEC_RE=/["'](@cldmv\/slothlet(?:\/[^"']+)?)["']/g;const IMPORT_SPEC_RE=/(?:\bfrom\s*|\bimport\s*\(?\s*)["']([^"']+)["']/g;const DEFAULT_SLOTHLET_BASE="/node_modules/@cldmv/slothlet/";const LOADABLE_EXTENSIONS=new Set([".mjs",".cjs",".js",".ts",".mts",".cts"]);const SKIP_PREFIXES=["__","."];function isApiFile(filename){const ext=path.extname(filename);return LOADABLE_EXTENSIONS.has(ext)}function makeFileEntry(relativePath){const fullName=path.basename(relativePath);const name=path.basename(relativePath,path.extname(relativePath));return{path:relativePath,name,fullName}}async function scanDir(absDir,rootDir){let entries;try{entries=await fs.readdir(absDir,{withFileTypes:true})}catch{return{files:[],directories:[]}}const files=[];const directories=[];for(const entry of entries){if(SKIP_PREFIXES.some(p=>entry.name.startsWith(p)))continue;if(entry.isFile()){if(isApiFile(entry.name)){const absPath=path.join(absDir,entry.name);const rel=path.relative(rootDir,absPath).replace(/\\/g,"/");files.push(makeFileEntry(rel))}}else if(entry.isDirectory()){const absSubDir=path.join(absDir,entry.name);const relDir=path.relative(rootDir,absSubDir).replace(/\\/g,"/");const children=await scanDir(absSubDir,rootDir);if(children.files.length>0||children.directories.length>0){directories.push({name:entry.name,path:relDir,children})}}}return{files,directories}}async function generateManifest(dir){if(!dir||typeof dir!=="string"){const received=typeof dir==="string"?"<empty>":dir===null?"null":Array.isArray(dir)?"array":typeof dir;throw new SlothletError("GENERATE_MANIFEST_DIR_INVALID",{received},null,{validationError:true})}const absDir=path.resolve(dir);let stat;try{stat=await fs.stat(absDir)}catch(err){throw new SlothletError("GENERATE_MANIFEST_DIR_UNREADABLE",{dir:absDir,reason:err.message},null,{validationError:true})}if(!stat.isDirectory()){throw new SlothletError("GENERATE_MANIFEST_NOT_DIRECTORY",{dir:absDir},null,{validationError:true})}return scanDir(absDir,absDir)}function slothletPackageRoot(){return path.resolve(path.dirname(fileURLToPath(import.meta.url)),"../../..")}async function collectSlothletSpecifiers(root){const specifiers=new Set(["@cldmv/slothlet"]);const pkg=JSON.parse(await fs.readFile(path.join(root,"package.json"),"utf8"));for(const key of Object.keys(pkg.exports)){if(key.includes("*")||key.endsWith(".json"))continue;specifiers.add(key==="."?"@cldmv/slothlet":`@cldmv/slothlet${key.slice(1)}`)}for(const[key,value]of Object.entries(pkg.exports)){if(!key.includes("*")||key.startsWith("./i18n/language/"))continue;const specPrefix=`@cldmv/slothlet${key.slice(1)}`.split("*")[0];const targets=[];(function collectTargets(v){if(typeof v==="string"){if(v.includes("*")&&v.endsWith(".mjs"))targets.push(v)}else if(v&&typeof v==="object"){for(const child of Object.values(v))collectTargets(child)}})(value);for(const tmpl of targets){const star=tmpl.indexOf("*");const dirRel=tmpl.slice(0,star);const suffix=tmpl.slice(star+1);let files;try{files=await fs.readdir(path.join(root,dirRel),{recursive:true})}catch{continue}for(const f of files){const norm=String(f).replace(/\\/g,"/");if(norm.endsWith(suffix))specifiers.add(specPrefix+norm.slice(0,-suffix.length))}}}for(const[key,value]of Object.entries(pkg.imports??{})){if(!key.includes("*"))continue;const specPrefix=key.split("*")[0];const targets=[];(function collectTargets(v){if(typeof v==="string"){if(v.includes("*")&&v.endsWith(".mjs"))targets.push(v)}else if(v&&typeof v==="object"){for(const child of Object.values(v))collectTargets(child)}})(value);for(const tmpl of targets){const star=tmpl.indexOf("*");const dirRel=tmpl.slice(0,star);const suffix=tmpl.slice(star+1);let files;try{files=await fs.readdir(path.join(root,dirRel),{recursive:true})}catch{continue}for(const f of files){const norm=String(f).replace(/\\/g,"/");if(norm.endsWith(suffix))specifiers.add(specPrefix+norm.slice(0,-suffix.length))}}}const SKIP_DIRS=new Set(["node_modules","types","coverage","tmp","tests","api_tests",".git","docs"]);async function scan(dir){const entries=await fs.readdir(dir,{withFileTypes:true});for(const e of entries){if(e.isDirectory()){if(!SKIP_DIRS.has(e.name)&&!e.name.startsWith("."))await scan(path.join(dir,e.name))}else if(/\.(mjs|cjs|js)$/.test(e.name)){const src=await fs.readFile(path.join(dir,e.name),"utf8");let m;SLOTHLET_SPEC_RE.lastIndex=0;while(m=SLOTHLET_SPEC_RE.exec(src)){const spec=m[1];if(spec.startsWith("@cldmv/slothlet/i18n/language/"))continue;if(/[*<>]|\.\.\.|\/$/.test(spec)||spec.split("/").some(s=>s===""))continue;specifiers.add(spec)}}}}await scan(root);return specifiers}async function generateImportMap(slothletBase=DEFAULT_SLOTHLET_BASE){const base=String(slothletBase).endsWith("/")?String(slothletBase):`${slothletBase}/`;const root=slothletPackageRoot();const imports={};for(const spec of await collectSlothletSpecifiers(root)){let resolved;try{resolved=import.meta.resolve(spec);await fs.access(fileURLToPath(resolved))}catch{continue}const rel=path.relative(root,fileURLToPath(resolved)).replace(/\\/g,"/");imports[spec]=base+rel}try{const sampleDir=path.dirname(fileURLToPath(import.meta.resolve("@cldmv/slothlet/i18n/language/en-us.json")));for(const f of(await fs.readdir(sampleDir)).filter(n=>n.endsWith(".json"))){const rel=path.relative(root,path.join(sampleDir,f)).replace(/\\/g,"/");imports[`@cldmv/slothlet/i18n/language/${f}`]=base+rel}}catch{}try{const packRoot=path.dirname(fileURLToPath(import.meta.resolve("@cldmv/slothlet-i18n/package.json")));const packBase=base.replace(/@cldmv\/slothlet(@[^/]+)?\/$/,"@cldmv/slothlet-i18n$1/");if(packBase!==base){for(const f of(await fs.readdir(path.join(packRoot,"languages"))).filter(n=>n.endsWith(".json"))){imports[`@cldmv/slothlet-i18n/language/${f}`]=`${packBase}languages/${f}`}}}catch{}return{imports}}function isBrowserModuleTarget(rel){return/\.(mjs|js)$/.test(rel)}function packageNameOf(spec){if(!spec||/^[./#]/.test(spec)||spec.includes(":"))return null;const parts=spec.split("/");if(spec.startsWith("@"))return parts.length>=2?`${parts[0]}/${parts[1]}`:null;return parts[0]}function pickBrowserTarget(value){if(value==null)return null;if(typeof value==="string")return value;if(Array.isArray(value)){for(const v of value){const t=pickBrowserTarget(v);if(t)return t}return null}if(typeof value==="object"){for(const cond of["browser","import","module","default"]){if(Object.prototype.hasOwnProperty.call(value,cond)){const t=pickBrowserTarget(value[cond]);if(t)return t}}}return null}async function collectPackageSpecifiers(packageRoot){const out=new Map;let pkg;try{pkg=JSON.parse(await fs.readFile(path.join(packageRoot,"package.json"),"utf8"))}catch{return out}const name=pkg.name;if(!name||!pkg.exports)return out;const field=pkg.exports;let entries;if(typeof field==="string")entries=[[".",field]];else entries=Object.keys(field).some(k=>k.startsWith("."))?Object.entries(field):[[".",field]];for(const[key,value]of entries){if(!key.startsWith("."))continue;if(key.includes("*")){const tmpl=pickBrowserTarget(value);if(!tmpl||!tmpl.includes("*"))continue;const star=tmpl.indexOf("*");const suffix=tmpl.slice(star+1);if(!isBrowserModuleTarget(suffix))continue;const specPrefix=(key==="./*"?`${name}/`:`${name}${key.slice(1)}`).split("*")[0];const dirRel=tmpl.slice(0,star).replace(/^\.\//,"");let files;try{files=await fs.readdir(path.join(packageRoot,dirRel),{recursive:true})}catch{continue}for(const f of files){const norm=String(f).replace(/\\/g,"/");if(norm.endsWith(suffix))out.set(specPrefix+norm.slice(0,-suffix.length),dirRel+norm)}}else{const tmpl=pickBrowserTarget(value);if(!tmpl||!isBrowserModuleTarget(tmpl))continue;out.set(key==="."?name:`${name}${key.slice(1)}`,tmpl.replace(/^\.\//,""))}}return out}async function resolvePackageRoot(name,fromDir){let dir=path.resolve(fromDir);for(;;){const candidate=path.join(dir,"node_modules",...name.split("/"));try{if((await fs.stat(path.join(candidate,"package.json"))).isFile())return candidate}catch{}const parent=path.dirname(dir);if(parent===dir)return null;dir=parent}}async function scanApiDirSpecifiers(apiDir){const specs=new Set;async function walk(dir){let entries;try{entries=await fs.readdir(dir,{withFileTypes:true})}catch{return}for(const e of entries){if(SKIP_PREFIXES.some(p=>e.name.startsWith(p)))continue;const abs=path.join(dir,e.name);if(e.isDirectory()){if(e.name!=="node_modules")await walk(abs)}else if(/\.(mjs|cjs|js|mts|cts|ts)$/.test(e.name)){const src=await fs.readFile(abs,"utf8");let m;IMPORT_SPEC_RE.lastIndex=0;while(m=IMPORT_SPEC_RE.exec(src))specs.add(m[1])}}}await walk(path.resolve(apiDir));return specs}async function collectGraphImports(apiDir,packagesBase){const imports={};const absApiDir=path.resolve(apiDir);const names=new Set;for(const spec of await scanApiDirSpecifiers(absApiDir)){const name=packageNameOf(spec);if(!name||name==="@cldmv/slothlet")continue;names.add(name)}for(const name of names){const root=await resolvePackageRoot(name,absApiDir);if(!root)continue;const pkgBase=`${packagesBase}${name}/`;for(const[spec,relTarget]of await collectPackageSpecifiers(root)){try{await fs.access(path.join(root,relTarget))}catch{continue}imports[spec]=pkgBase+relTarget}}return imports}function derivePackagesBase(base){const stripped=base.replace(/@cldmv\/slothlet(@[^/]+)?\/$/,"");return stripped!==base?stripped:"/node_modules/"}async function generateBrowserAssets(apiDir,options={}){const{slothletBase=DEFAULT_SLOTHLET_BASE}=options;if(typeof slothletBase!=="string"){throw new SlothletError("GENERATE_BROWSER_ASSETS_SLOTHLET_BASE_INVALID",{received:typeof slothletBase},null,{validationError:true})}const base=String(slothletBase).endsWith("/")?String(slothletBase):`${slothletBase}/`;const packagesBase=derivePackagesBase(base);const[manifest,importmap,graphImports]=await Promise.all([generateManifest(apiDir),generateImportMap(slothletBase),collectGraphImports(apiDir,packagesBase)]);importmap.imports={...graphImports,...importmap.imports};return{manifest,importmap}}export{collectPackageSpecifiers,collectSlothletSpecifiers,generateBrowserAssets,generateImportMap,generateManifest};

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@cldmv/slothlet",
-	"version": "3.13.3",
+	"version": "3.14.0",
 	"moduleVersions": {
 		"lazy": "3.0.0",
 		"eager": "3.0.0",