@craft-native/craft 0.0.19 → 0.0.23

package/dist/index.js

@@ -1085,6 +1085,14 @@ class Timer {
 }
 // src/bridge/core.ts
 var import_events = require("events");
+var BridgeErrorCodes = {
+  UNKNOWN: -1,
+  TIMEOUT: -2,
+  QUEUE_FULL: -3,
+  BINARY_DISABLED: -4,
+  EXPECTED_BINARY: -5,
+  BRIDGE_DESTROYED: -6
+};
 var messageIdCounter = 0;
 function generateMessageId() {
   return `msg_${Date.now()}_${++messageIdCounter}`;
@@ -1123,7 +1131,8 @@ class NativeBridge extends import_events.EventEmitter {
     let data;
     try {
       data = "detail" in event ? event.detail : typeof event.data === "string" ? JSON.parse(event.data) : event.data;
-    } catch {
+    } catch (err) {
+      console.warn("[Craft Bridge] Failed to parse message:", err);
       return;
     }
     if (!data || !data.id)
@@ -1177,27 +1186,28 @@ class NativeBridge extends import_events.EventEmitter {
         break;
     }
   }
-  async request(method, params) {
-    return this.requestWithRetry(method, params, this.config.retries);
+  async request(method, params, options) {
+    return this.requestWithRetry(method, params, this.config.retries, options?.timeout);
   }
-  async requestWithRetry(method, params, retriesLeft) {
+  async requestWithRetry(method, params, retriesLeft, timeout) {
     try {
-      return await this.sendRequest(method, params);
+      return await this.sendRequest(method, params, timeout);
     } catch (error) {
       if (retriesLeft > 0 && this.isRetryableError(error)) {
         await this.delay(this.config.retryDelay);
-        return this.requestWithRetry(method, params, retriesLeft - 1);
+        return this.requestWithRetry(method, params, retriesLeft - 1, timeout);
       }
       throw error;
     }
   }
   isRetryableError(error) {
     if (error instanceof BridgeError) {
-      return error.code === -1 || error.code === -2;
+      return error.code === BridgeErrorCodes.UNKNOWN || error.code === BridgeErrorCodes.TIMEOUT;
     }
     return false;
   }
-  async sendRequest(method, params) {
+  async sendRequest(method, params, timeout) {
+    const effectiveTimeout = timeout ?? this.config.timeout;
     const message = {
       id: generateMessageId(),
       type: "request",
@@ -1206,7 +1216,7 @@ class NativeBridge extends import_events.EventEmitter {
     };
     if (!this.connected && this.config.enableOfflineQueue) {
       if (this.offlineQueue.length >= this.config.queueSize) {
-        throw new BridgeError("Offline queue full", -3);
+        throw new BridgeError("Offline queue full", BridgeErrorCodes.QUEUE_FULL);
       }
       this.offlineQueue.push(message);
       return new Promise((resolve, reject) => {
@@ -1215,20 +1225,20 @@ class NativeBridge extends import_events.EventEmitter {
           reject,
           timeout: setTimeout(() => {
             this.pendingRequests.delete(message.id);
-            reject(new BridgeError("Request timeout", -1));
-          }, this.config.timeout)
+            reject(new BridgeError("Request timeout", BridgeErrorCodes.UNKNOWN));
+          }, effectiveTimeout)
         });
       });
     }
     return new Promise((resolve, reject) => {
-      const timeout = setTimeout(() => {
+      const timer2 = setTimeout(() => {
         this.pendingRequests.delete(message.id);
-        reject(new BridgeError("Request timeout", -1));
-      }, this.config.timeout);
+        reject(new BridgeError("Request timeout", BridgeErrorCodes.UNKNOWN));
+      }, effectiveTimeout);
       this.pendingRequests.set(message.id, {
         resolve,
         reject,
-        timeout
+        timeout: timer2
       });
       this.send(message);
     });
@@ -1284,20 +1294,20 @@ class NativeBridge extends import_events.EventEmitter {
   }
   async sendBinary(method, data) {
     if (!this.config.enableBinaryTransfer) {
-      throw new BridgeError("Binary transfer not enabled", -4);
+      throw new BridgeError("Binary transfer not enabled", BridgeErrorCodes.BINARY_DISABLED);
     }
     const base64 = this.arrayBufferToBase64(data instanceof ArrayBuffer ? new Uint8Array(data) : data);
     await this.request(method, { _binary: true, data: base64 });
   }
   async receiveBinary(method, params) {
     if (!this.config.enableBinaryTransfer) {
-      throw new BridgeError("Binary transfer not enabled", -4);
+      throw new BridgeError("Binary transfer not enabled", BridgeErrorCodes.BINARY_DISABLED);
     }
     const result = await this.request(method, params);
     if (result._binary) {
       return this.base64ToArrayBuffer(result.data);
     }
-    throw new BridgeError("Expected binary response", -5);
+    throw new BridgeError("Expected binary response", BridgeErrorCodes.EXPECTED_BINARY);
   }
   async batch(requests) {
     return this.request("_batch", { requests });
@@ -1376,11 +1386,12 @@ class NativeBridge extends import_events.EventEmitter {
     return new Promise((resolve) => setTimeout(resolve, ms));
   }
   arrayBufferToBase64(buffer) {
-    let binary = "";
-    for (let i = 0;i < buffer.byteLength; i++) {
-      binary += String.fromCharCode(buffer[i]);
+    const chunks = [];
+    const chunkSize = 8192;
+    for (let i = 0;i < buffer.byteLength; i += chunkSize) {
+      chunks.push(String.fromCharCode(...buffer.subarray(i, i + chunkSize)));
     }
-    return btoa(binary);
+    return btoa(chunks.join(""));
   }
   base64ToArrayBuffer(base64) {
     const binary = atob(base64);
@@ -1394,7 +1405,7 @@ class NativeBridge extends import_events.EventEmitter {
   destroy() {
     for (const [id, pending] of this.pendingRequests) {
       clearTimeout(pending.timeout);
-      pending.reject(new BridgeError("Bridge destroyed", -6));
+      pending.reject(new BridgeError("Bridge destroyed", BridgeErrorCodes.BRIDGE_DESTROYED));
     }
     this.pendingRequests.clear();
     this.streams.clear();
@@ -2345,8 +2356,18 @@ var notify = (options) => appManager.notify(options);
 var registerShortcut = (accelerator, handler) => appManager.registerShortcut(accelerator, handler);
 var unregisterShortcut = (accelerator) => appManager.unregisterShortcut(accelerator);
 // src/api/fs.ts
+function validatePath(path) {
+  const normalized = path.replace(/\\/g, "/");
+  if (normalized.includes("/../") || normalized.startsWith("../") || normalized.endsWith("/..") || normalized === "..") {
+    throw new Error(`Path traversal detected: "${path}" contains ".." segments`);
+  }
+  if (path.includes("\x00")) {
+    throw new Error(`Invalid path: contains null byte`);
+  }
+}
 var fs = {
   async readFile(path) {
+    validatePath(path);
     if (typeof window !== "undefined" && window.craft?.fs) {
       return window.craft.fs.readFile(path);
     }
@@ -2354,6 +2375,7 @@ var fs = {
     return readFile(path, "utf-8");
   },
   async writeFile(path, content) {
+    validatePath(path);
     if (typeof window !== "undefined" && window.craft?.fs) {
       return window.craft.fs.writeFile(path, content);
     }
@@ -2395,6 +2417,7 @@ var fs = {
   }
 };
 async function readBinaryFile(path) {
+  validatePath(path);
   if (typeof window !== "undefined" && window.craft) {
     const response = await window.craft.bridge?.call("fs.readBinaryFile", { path });
     return new Uint8Array(response.data);
@@ -2403,6 +2426,7 @@ async function readBinaryFile(path) {
   return readFile(path);
 }
 async function writeBinaryFile(path, data) {
+  validatePath(path);
   if (typeof window !== "undefined" && window.craft) {
     await window.craft.bridge?.call("fs.writeBinaryFile", { path, data: Array.from(data) });
     return;
@@ -2411,6 +2435,7 @@ async function writeBinaryFile(path, data) {
   return writeFile(path, data);
 }
 async function stat(path) {
+  validatePath(path);
   if (typeof window !== "undefined" && window.craft) {
     const response = await window.craft.bridge?.call("fs.stat", { path });
     return {
@@ -2432,6 +2457,8 @@ async function stat(path) {
   };
 }
 async function copy(src, dest) {
+  validatePath(src);
+  validatePath(dest);
   if (typeof window !== "undefined" && window.craft) {
     await window.craft.bridge?.call("fs.copy", { src, dest });
     return;
@@ -2440,6 +2467,8 @@ async function copy(src, dest) {
   return cp(src, dest, { recursive: true });
 }
 async function move(src, dest) {
+  validatePath(src);
+  validatePath(dest);
   if (typeof window !== "undefined" && window.craft) {
     await window.craft.bridge?.call("fs.move", { src, dest });
     return;
@@ -2448,6 +2477,7 @@ async function move(src, dest) {
   return rename(src, dest);
 }
 function watch(path, callback) {
+  validatePath(path);
   if (typeof window !== "undefined" && window.craft) {
     const watchId = Math.random().toString(36).slice(2);
     window.craft.bridge?.call("fs.watch", { path, watchId });
@@ -2502,6 +2532,10 @@ var db = {
   }
 };
 async function openDatabase(name) {
+  const normalized = name.replace(/\\/g, "/");
+  if (normalized.includes("/../") || normalized.startsWith("../") || normalized.endsWith("/..") || normalized === ".." || name.includes("\x00")) {
+    throw new Error(`Invalid database name: "${name}" contains path traversal or invalid characters`);
+  }
   return new Database(name);
 }
 
@@ -2620,7 +2654,8 @@ class KeyValueStore {
     if (row) {
       try {
         return JSON.parse(row.value);
-      } catch {
+      } catch (err) {
+        console.debug("[Craft DB] Failed to parse stored value for key, returning raw:", err);
         return row.value;
       }
     }
@@ -2947,11 +2982,12 @@ function bufferToHex(buffer) {
 }
 function bufferToBase64(buffer) {
   const bytes = new Uint8Array(buffer);
-  let binary = "";
-  for (let i = 0;i < bytes.byteLength; i++) {
-    binary += String.fromCharCode(bytes[i]);
+  const chunks = [];
+  const chunkSize = 8192;
+  for (let i = 0;i < bytes.byteLength; i += chunkSize) {
+    chunks.push(String.fromCharCode(...bytes.subarray(i, i + chunkSize)));
   }
-  return btoa(binary);
+  return btoa(chunks.join(""));
 }
 function base64ToBuffer(base64) {
   const binary = atob(base64);
@@ -3036,11 +3072,12 @@ async function verifyPassword(password, hash, salt) {
 // src/api/process.ts
 var env = typeof process !== "undefined" ? process.env : {};
 function getPlatform() {
-  if (typeof window !== "undefined" && window.craft) {
-    const info = window.craft._platform;
-    if (info === "ios" || info === "android") {
-      return info;
-    }
+  if (typeof globalThis !== "undefined") {
+    const w = globalThis;
+    if (w.craft?._platform)
+      return w.craft._platform;
+    if (w.__CRAFT_PLATFORM__)
+      return w.__CRAFT_PLATFORM__;
   }
   if (typeof process !== "undefined" && process.platform) {
     return process.platform;
@@ -5365,10 +5402,12 @@ async function write(data) {
 }
 async function read() {
   const [text, html] = await Promise.all([
-    readText().catch(() => {
+    readText().catch((err) => {
+      console.debug("[Craft Clipboard] readText failed:", err);
       return;
     }),
-    readHTML().catch(() => {
+    readHTML().catch((err) => {
+      console.debug("[Craft Clipboard] readHTML failed:", err);
       return;
     })
   ]);
@@ -5822,23 +5861,26 @@ function generateCSS(config, platform) {
   }
   return baseStyles + platformStyles;
 }
+function escapeHtml(unsafe) {
+  return unsafe.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#039;");
+}
 function generateHTML(config) {
   const renderItem = (item) => `
-    <div class='craft-sidebar-item${item.selected ? " selected" : ""}' data-id='${item.id}'>
+    <div class='craft-sidebar-item${item.selected ? " selected" : ""}' data-id='${escapeHtml(item.id)}'>
       ${item.icon ? `<span class='craft-sidebar-item-icon'>${getIcon(item.icon, item.tintColor)}</span>` : ""}
-      <span class='craft-sidebar-item-label'>${item.label}</span>
-      ${item.badge !== undefined ? `<span class='craft-sidebar-item-badge'>${item.badge}</span>` : ""}
+      <span class='craft-sidebar-item-label'>${escapeHtml(item.label)}</span>
+      ${item.badge !== undefined ? `<span class='craft-sidebar-item-badge'>${escapeHtml(String(item.badge))}</span>` : ""}
     </div>
   `;
   const renderSection = (section) => `
-    <div class='craft-sidebar-section' data-section='${section.id}'>
+    <div class='craft-sidebar-section' data-section='${escapeHtml(section.id)}'>
       ${section.title ? `
-        <div class='craft-sidebar-section-header${section.collapsed ? " collapsed" : ""}' data-section-toggle='${section.id}'>
+        <div class='craft-sidebar-section-header${section.collapsed ? " collapsed" : ""}' data-section-toggle='${escapeHtml(section.id)}'>
           ${section.collapsible !== false ? `<svg class="craft-sidebar-section-chevron" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="m9 18 6-6-6-6"/></svg>` : ""}
-          ${section.title}
+          ${escapeHtml(section.title)}
         </div>
       ` : ""}
-      <div class='craft-sidebar-section-items${section.collapsed ? " collapsed" : ""}' data-section-items='${section.id}'>
+      <div class='craft-sidebar-section-items${section.collapsed ? " collapsed" : ""}' data-section-items='${escapeHtml(section.id)}'>
         ${section.items.map(renderItem).join("")}
       </div>
     </div>
@@ -5847,13 +5889,13 @@ function generateHTML(config) {
     <aside class='craft-sidebar'>
       ${config.headerTitle ? `
         <div class='craft-sidebar-header'>
-          <div class='craft-sidebar-header-title'>${config.headerTitle}</div>
-          ${config.headerSubtitle ? `<div class="craft-sidebar-header-subtitle">${config.headerSubtitle}</div>` : ""}
+          <div class='craft-sidebar-header-title'>${escapeHtml(config.headerTitle)}</div>
+          ${config.headerSubtitle ? `<div class="craft-sidebar-header-subtitle">${escapeHtml(config.headerSubtitle)}</div>` : ""}
         </div>
       ` : ""}
       ${config.showSearch ? `
         <div class='craft-sidebar-search'>
-          <input type='text' placeholder='${config.searchPlaceholder || "Search"}' data-sidebar-search>
+          <input type='text' placeholder='${escapeHtml(config.searchPlaceholder || "Search")}' data-sidebar-search>
         </div>
       ` : ""}
       <div class='craft-sidebar-content'>
@@ -5864,7 +5906,7 @@ function generateHTML(config) {
   `;
 }
 function getIcon(name, tintColor) {
-  const color = tintColor || "currentColor";
+  const color = escapeHtml(tintColor || "currentColor");
   const icons = {
     folder: `<svg viewBox='0 0 24 24' fill='${color}'><path d='M22 19a2 2 0 0 1-2 2H4a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h5l2 3h9a2 2 0 0 1 2 2z'/></svg>`,
     file: `<svg viewBox='0 0 24 24' fill='none' stroke='${color}' stroke-width='2'><path d='M13 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V9z'/><polyline points='13 2 13 9 20 9'/></svg>`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@craft-native/craft",
-  "version": "0.0.19",
+  "version": "0.0.23",
   "type": "module",
   "description": "Build desktop apps with web languages - TypeScript SDK for Craft",
   "author": "Chris Breuer <chris@stacksjs.org>",