@emulsify/core 4.0.0 → 4.0.2

package/.cli/init.js

@@ -7,7 +7,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import yaml from 'js-yaml';
+import { dump as dumpYaml, load as loadYaml } from 'js-yaml';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
@@ -116,8 +116,8 @@ const applyToYmlFile = (filePath, functor) => {
     return;
   }
 
-  const file = yaml.load(fs.readFileSync(filePath, 'utf8'));
-  fs.writeFileSync(filePath, yaml.dump(functor(file)));
+  const file = loadYaml(fs.readFileSync(filePath, 'utf8'));
+  fs.writeFileSync(filePath, dumpYaml(functor(file)));
 };
 
 const main = () => {

package/.storybook/_drupal.js

@@ -65,7 +65,6 @@ function mergeDrupalSettings(defaults, overrides) {
 
   for (const [key, value] of Object.entries(overrides || {})) {
     // Drupal settings keys are project/module-defined by design.
-    // eslint-disable-next-line security/detect-object-injection
     const defaultValue = merged[key];
     const nextValue =
       isPlainObject(defaultValue) && isPlainObject(value)
@@ -73,7 +72,6 @@ function mergeDrupalSettings(defaults, overrides) {
         : value;
 
     // Drupal settings keys are project/module-defined by design.
-    // eslint-disable-next-line security/detect-object-injection
     merged[key] = nextValue;
   }
 
@@ -156,7 +154,6 @@ window.drupalSettings = mergeDrupalSettings(
     // Attach each registered behavior while isolating individual failures.
     Object.keys(behaviors).forEach(function (behaviorName) {
       // Drupal behavior names are project/module-defined by design.
-      // eslint-disable-next-line security/detect-object-injection
       const behavior = behaviors[behaviorName];
       if (typeof behavior.attach === 'function') {
         try {

package/.storybook/main.js

@@ -70,6 +70,27 @@ const _filename = fileURLToPath(import.meta.url);
  */
 const _dirname = path.dirname(_filename);
 
+/**
+ * The consuming project root for Storybook static mounts.
+ *
+ * Storybook loads this package config from different physical locations
+ * depending on whether Core is linked locally or installed in node_modules, so
+ * static paths must be rooted at the process cwd rather than this file.
+ *
+ * @type {string}
+ */
+const projectRoot = process.cwd();
+
+/**
+ * Vite-generated Storybook chunks should not share `/assets` with project
+ * static files. Storybook copies staticDirs while the preview build runs, so
+ * keeping generated chunks in a separate folder avoids concurrent writers in
+ * `.out/assets`.
+ *
+ * @type {string}
+ */
+const storybookViteAssetsDir = 'storybook-assets';
+
 /**
  * Reads an optional HTML fragment relative to this config file.
  *
@@ -247,10 +268,17 @@ const baseConfig = {
   staticDirs: [
     ...existingStaticDirs([
       {
-        from: path.resolve(process.cwd(), 'assets'),
+        from: path.resolve(projectRoot, 'assets'),
+        to: '/assets',
+      },
+      {
+        from: path.resolve(projectRoot, 'dist/assets'),
         to: '/assets',
       },
-      path.resolve(process.cwd(), 'dist'),
+      {
+        from: path.resolve(projectRoot, 'dist'),
+        to: '/dist',
+      },
     ]),
   ],
 
@@ -452,6 +480,7 @@ const baseConfig = {
     const { mergeConfig } = await import('vite');
     /** @type {StorybookEnvironment} */
     const env = resolvedStorybookEnv;
+    const storybookBuildConfig = config?.build || {};
 
     // Keep using the `serve` branch of the shared Vite config here. Storybook
     // has historically consumed that branch, while `mode` still reflects
@@ -560,6 +589,14 @@ const baseConfig = {
 
     return {
       ...mergedConfig,
+      build: {
+        ...(mergedConfig.build || {}),
+        ...(storybookBuildConfig.outDir
+          ? { outDir: storybookBuildConfig.outDir }
+          : {}),
+        assetsDir: storybookViteAssetsDir,
+        emptyOutDir: false,
+      },
       resolve: mergeReactSingletonResolve(mergedConfig),
       optimizeDeps: {
         ...(mergedConfig.optimizeDeps || {}),

package/config/eslint.config.js

@@ -41,9 +41,15 @@ export default [
     ignores: ['**/*.min.js', '**/node_modules/**/*'],
 
     rules: {
-      // Keep historical project conventions while warning on risky patterns.
+      // Keep historical project conventions while tuning noisy security
+      // heuristics that flag intentional file-generation and source-scanning
+      // patterns throughout this tooling package.
       strict: 0,
       'consistent-return': 'off',
+      'security/detect-non-literal-fs-filename': 'off',
+      'security/detect-non-literal-regexp': 'off',
+      'security/detect-object-injection': 'off',
+      'security/detect-unsafe-regex': 'off',
       'no-underscore-dangle': 'off',
       'max-nested-callbacks': ['warn', 3],
       'import/extensions': 'off',

package/config/vite/entries.js

@@ -57,7 +57,7 @@ export const sanitizePath = (s) => s.replace(/[^a-zA-Z0-9/_-]/g, '');
 function safeSetKey(map, key, value) {
   const forbidden = ['__proto__', 'prototype', 'constructor'];
   if (!key || forbidden.some((bad) => key.includes(bad))) return;
-  map[key] = value; // eslint-disable-line security/detect-object-injection
+  map[key] = value;
 }
 
 /** Return an absolute path from a source index entry or string. */

package/config/vite/plugins/mirror-components.js

@@ -68,7 +68,6 @@ const pruneEmptyDirsUpTo = (startDir, stopAtDir) => {
 
   const isEmpty = (dir) => {
     try {
-      // eslint-disable-next-line security/detect-non-literal-fs-filename
       return readdirSync(dir).length === 0;
     } catch {
       return false;
@@ -79,7 +78,6 @@ const pruneEmptyDirsUpTo = (startDir, stopAtDir) => {
     if (!isEmpty(cursor)) break;
 
     try {
-      // eslint-disable-next-line security/detect-non-literal-fs-filename
       rmdirSync(cursor);
     } catch {
       // Stop at the first directory that cannot be removed.
@@ -103,9 +101,7 @@ const pruneEmptyDirsUpTo = (startDir, stopAtDir) => {
  */
 export const filesHaveSameBytes = (sourceFile, destinationFile) => {
   try {
-    // eslint-disable-next-line security/detect-non-literal-fs-filename
     const sourceStats = statSync(sourceFile);
-    // eslint-disable-next-line security/detect-non-literal-fs-filename
     const destinationStats = statSync(destinationFile);
     if (!destinationStats.isFile()) return false;
     if (sourceStats.size !== destinationStats.size) return false;
@@ -117,10 +113,8 @@ export const filesHaveSameBytes = (sourceFile, destinationFile) => {
 
     const sourceBuffer = Buffer.allocUnsafe(FILE_COMPARE_CHUNK_SIZE);
     const destinationBuffer = Buffer.allocUnsafe(FILE_COMPARE_CHUNK_SIZE);
-    // eslint-disable-next-line security/detect-non-literal-fs-filename
     const sourceHandle = openSync(sourceFile, 'r');
     try {
-      // eslint-disable-next-line security/detect-non-literal-fs-filename
       const destinationHandle = openSync(destinationFile, 'r');
       try {
         let position = 0;
@@ -175,7 +169,6 @@ export const filesHaveSameBytes = (sourceFile, destinationFile) => {
  */
 const isSymlink = (filePath) => {
   try {
-    // eslint-disable-next-line security/detect-non-literal-fs-filename
     return lstatSync(filePath).isSymbolicLink();
   } catch {
     return false;
@@ -189,7 +182,6 @@ const isSymlink = (filePath) => {
  */
 const removeSourceFile = (sourceFile) => {
   try {
-    // eslint-disable-next-line security/detect-non-literal-fs-filename
     unlinkSync(sourceFile);
   } catch (error) {
     if (error?.code !== 'ENOENT') throw error;
@@ -221,12 +213,10 @@ const copyFileIntoPlace = (sourceFile, destinationFile) => {
 
   try {
     copyFileSync(sourceFile, tempDestination);
-    // eslint-disable-next-line security/detect-non-literal-fs-filename
     renameSync(tempDestination, destinationFile);
     removeSourceFile(sourceFile);
   } catch (error) {
     try {
-      // eslint-disable-next-line security/detect-non-literal-fs-filename
       unlinkSync(tempDestination);
     } catch {
       /* noop */
@@ -255,7 +245,6 @@ const moveFileIntoPlace = (sourceFile, destinationFile) => {
   }
 
   try {
-    // eslint-disable-next-line security/detect-non-literal-fs-filename
     renameSync(sourceFile, destinationFile);
   } catch (error) {
     if (error?.code !== 'EXDEV') throw error;
@@ -282,7 +271,6 @@ const readMirrorState = (markerFile) => {
  */
 const writeMirrorState = (markerFile, state) => {
   mkdirSync(dirname(markerFile), { recursive: true });
-  // eslint-disable-next-line security/detect-non-literal-fs-filename
   writeFileSync(markerFile, `${JSON.stringify(state, null, 2)}\n`);
 };
 

package/config/vite/plugins/source-file-index.js

@@ -43,7 +43,6 @@ export function walkFiles(
 
     let entryNames = [];
     try {
-      // eslint-disable-next-line security/detect-non-literal-fs-filename
       entryNames = readdirSync(currentDir, { withFileTypes: true }).sort(
         (a, b) => a.name.localeCompare(b.name),
       );

package/config/vite/plugins/svg-sprite.js

@@ -82,7 +82,6 @@ export function svgSpriteFilePlugin({ include, symbolId = '[name]' }) {
         .map((abs) => {
           let content = '';
           try {
-            // eslint-disable-next-line security/detect-non-literal-fs-filename
             content = readFileSync(abs, 'utf8');
           } catch {
             return '';

package/config/vite/plugins/twig-module.js

@@ -332,7 +332,6 @@ const buildTemplateFileCandidates = (baseDir, templatePath) => {
 const findExistingTemplateFile = (paths) =>
   paths.filter(Boolean).find((filePath) => {
     try {
-      // eslint-disable-next-line security/detect-non-literal-fs-filename
       return fs.statSync(filePath).isFile();
     } catch {
       return false;
@@ -503,7 +502,6 @@ const parseTwigNamespaceReference = (templatePath, namespaces = {}) => {
     return {
       namespace: slashNamespace,
       // Namespace names come from the normalized Twig namespace map.
-      // eslint-disable-next-line security/detect-object-injection
       root: namespaces[slashNamespace],
       path: templatePath.slice(slashNamespace.length + 1),
     };
@@ -523,7 +521,6 @@ const componentGroupRoots = (componentRoot) => {
 
   try {
     // Component group roots come from a configured project directory.
-    // eslint-disable-next-line security/detect-non-literal-fs-filename
     return fs
       .readdirSync(componentRoot, { withFileTypes: true })
       .filter((entry) => entry.isDirectory())
@@ -707,7 +704,6 @@ const invalidateKnownResolutionCacheEntries = (filePath) => {
 const compileTwigTemplate = (filePath, options, cache = compileCache) => {
   const absoluteFilePath = resolve(filePath);
   knownTwigFiles.add(absoluteFilePath);
-  // eslint-disable-next-line security/detect-non-literal-fs-filename
   const { mtimeMs } = fs.statSync(absoluteFilePath);
   const cached = cache.get(absoluteFilePath);
   if (cached?.mtimeMs === mtimeMs) {
@@ -718,7 +714,6 @@ const compileTwigTemplate = (filePath, options, cache = compileCache) => {
   registerTwigExtensions(compilerTwig);
   registerConfiguredTwigExtensions(compilerTwig, options);
 
-  // eslint-disable-next-line security/detect-non-literal-fs-filename
   const source = fs.readFileSync(absoluteFilePath, 'utf8');
   const compileOptions = {
     allowInlineIncludes: true,
@@ -1070,7 +1065,6 @@ export function emulsifyTwigModulePlugin(options) {
           const absoluteSourcePath = resolve(sourcePath);
           addDependencyImporter(absoluteSourcePath, sourceFilePath);
           this.addWatchFile(absoluteSourcePath);
-          // eslint-disable-next-line security/detect-non-literal-fs-filename
           const sourceText = fs.readFileSync(absoluteSourcePath, 'utf8');
 
           return unique([

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@emulsify/core",
-  "version": "4.0.0",
+  "version": "4.0.2",
   "description": "Bundled tooling for Storybook development + Vite Build",
   "keywords": [
     "component library",
@@ -169,6 +169,7 @@
     "@storybook/react-vite": "^10.1.4",
     "@vituum/vite-plugin-twig": "^1.1.0",
     "autoprefixer": "^10.4.21",
+    "axe-core": "^4.11.4",
     "babel-preset-minify": "^0.5.2",
     "concurrently": "^9.2.1",
     "eslint": "^9.39.4",

package/scripts/a11y.js

@@ -62,7 +62,6 @@ const applyProjectA11yConfig = (config = {}) => {
  * @returns {void}
  */
 const printHelp = () => {
-  // eslint-disable-next-line no-console
   console.log(
     [
       'Usage: node scripts/a11y.js [options]',
@@ -128,7 +127,6 @@ const logIssue = ({ type: severity, message, context, selector }) => {
     `selector: ${selector}`,
     '',
   ];
-  // eslint-disable-next-line no-console
   console.log(lines.join('\n'));
 };
 
@@ -142,11 +140,9 @@ const logReport = ({ issues, pageUrl }) => {
   const hasIssues = validIssues.length > 0;
 
   if (hasIssues) {
-    // eslint-disable-next-line no-console
     console.log(`Issues found in component: ${pageUrl}`);
     validIssues.forEach(logIssue);
   } else {
-    // eslint-disable-next-line no-console
     console.log(`No issues found in component: ${pageUrl}`);
   }
 

package/src/extensions/twig/register.js

@@ -13,6 +13,47 @@ import { getTwigTagDefinitions } from './tag-map.js';
  */
 const registeredTwigInstances = new WeakSet();
 
+/**
+ * PHP-style boolean conversion used by Twig.js truthiness checks.
+ *
+ * Twig.js normally provides this through `Twig.lib.boolval`, but dependency
+ * optimizer interop can drop the helper while leaving the rest of Twig usable.
+ *
+ * @param {*} value - Value to coerce using PHP/Twig truthiness rules.
+ * @returns {boolean} TRUE when the value should be truthy in Twig.
+ */
+function phpBoolval(value) {
+  return (
+    value !== false &&
+    value !== 0 &&
+    value !== '' &&
+    value !== '0' &&
+    !(Array.isArray(value) && value.length === 0) &&
+    value !== null &&
+    typeof value !== 'undefined'
+  );
+}
+
+/**
+ * Ensure Twig.js has the internal boolean helper required by conditionals.
+ *
+ * @param {Object} Twig - Twig.js module or compatible extension target.
+ * @returns {Object} The same Twig instance after compatibility patching.
+ */
+function ensureTwigBoolval(Twig) {
+  Twig.extend((InternalTwig) => {
+    if (!InternalTwig.lib) {
+      InternalTwig.lib = {};
+    }
+
+    if (typeof InternalTwig.lib.boolval !== 'function') {
+      InternalTwig.lib.boolval = phpBoolval;
+    }
+  });
+
+  return Twig;
+}
+
 /**
  * Register native Emulsify Twig functions and logic tags with Twig.js.
  *
@@ -32,6 +73,8 @@ export function registerTwigExtensions(Twig) {
     );
   }
 
+  ensureTwigBoolval(Twig);
+
   if (registeredTwigInstances.has(Twig)) {
     return Twig;
   }

package/src/storybook/preview-parameters.js

@@ -33,7 +33,6 @@ export function mergePreviewParameters(defaults = {}, overrides = {}) {
     if (value === undefined) continue;
 
     // Storybook parameter keys are intentionally dynamic.
-    // eslint-disable-next-line security/detect-object-injection
     const current = merged[key];
     const nextValue =
       isPlainObject(current) && isPlainObject(value)
@@ -41,7 +40,6 @@ export function mergePreviewParameters(defaults = {}, overrides = {}) {
         : value;
 
     // Storybook parameter keys are intentionally dynamic.
-    // eslint-disable-next-line security/detect-object-injection
     merged[key] = nextValue;
   }
 

package/src/storybook/twig/resolver.js

@@ -30,7 +30,6 @@ const ENV = (typeof __EMULSIFY_ENV__ !== 'undefined' && __EMULSIFY_ENV__) || {};
 function resolveFromMap(map, candidates) {
   for (const key of candidates) {
     // Vite glob map keys are generated from static Storybook patterns.
-    // eslint-disable-next-line security/detect-object-injection
     const value = map[key];
     if (value) {
       return value.default ?? value;
@@ -114,7 +113,6 @@ function findGlobEntry(map, candidates) {
   for (const key of candidates) {
     if (Object.hasOwnProperty.call(map, key)) {
       // Vite glob map keys are generated from static Storybook patterns.
-      // eslint-disable-next-line security/detect-object-injection
       return { key, value: map[key] };
     }
   }
@@ -240,7 +238,6 @@ export function createTwigResolver({
     candidateKeysForReference: (name) => candidateKeysForReference(name, env),
     resolveTemplate(name) {
       // Direct lookups support callers that already resolved a Vite glob key.
-      // eslint-disable-next-line security/detect-object-injection
       const direct = modules[name];
       if (direct) {
         return direct.default ?? direct;