@field/cascade 0.11.0 → 0.13.0

package/dist/cli/{chunk-RLCAJBVR.js → chunk-TJW67QSI.js}

@@ -1,15 +1,16 @@
 import {
   browserAssetCapability
-} from "./chunk-53NMBJAO.js";
+} from "./chunk-ZSCUZE6I.js";
 import {
   attachDefinition
-} from "./chunk-SGJAET2L.js";
+} from "./chunk-BPODRH52.js";
 import {
-  createGpuHost
-} from "./chunk-GFS6W3C5.js";
+  createGpuHost,
+  requestDeviceWithAdapterLimits
+} from "./chunk-L6B6FUQP.js";
 import {
   validateNodeDefinition
-} from "./chunk-A4OAMOZH.js";
+} from "./chunk-NJFMDXHR.js";
 
 // src/nodes/definition/browserShellCapability.ts
 var capability = null;
@@ -125,7 +126,7 @@ function createBrowserGpuHost() {
           "No WebGPU adapter is available \u2014 the browser reports WebGPU but the system offers no GPU to render on."
         );
       }
-      const device = await adapter.requestDevice();
+      const device = await requestDeviceWithAdapterLimits(adapter);
       const info = adapter.info;
       return {
         device,
@@ -221,4 +222,4 @@ export {
   moduleNodeFunction,
   adaptModule
 };
-//# sourceMappingURL=chunk-RLCAJBVR.js.map
+//# sourceMappingURL=chunk-TJW67QSI.js.map

package/dist/cli/{chunk-RQZ4SX5R.js → chunk-W5PJ5RMP.js}

@@ -1,6 +1,6 @@
 import {
   validateNodeDefinition
-} from "./chunk-A4OAMOZH.js";
+} from "./chunk-NJFMDXHR.js";
 
 // server/src/project.ts
 import fs5 from "fs/promises";
@@ -39,6 +39,19 @@ function resolveWithinRoot(root, ...segments) {
   }
   return full;
 }
+function canonicalPath(full) {
+  let existing = full;
+  while (!existsIncludingSymlink(existing)) {
+    const parent = path.dirname(existing);
+    if (parent === existing) return full;
+    existing = parent;
+  }
+  return path.join(canonical(existing, `path is not accessible: ${full}`), path.relative(existing, full));
+}
+function isWithin(base, candidate) {
+  const rel = path.relative(base, candidate);
+  return !rel.startsWith("..") && !path.isAbsolute(rel);
+}
 function existsIncludingSymlink(candidate) {
   try {
     fs.lstatSync(candidate);
@@ -56,6 +69,101 @@ function canonical(candidate, message) {
   }
 }
 
+// server/src/projectConfig.ts
+import fs2 from "node:fs";
+import path2 from "node:path";
+var CREDENTIAL_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+var SECRET_KEY = /^(?:api[_-]?key|apiKey|secret|password|access[_-]?token|refresh[_-]?token|credential|credentials)$/i;
+function readProjectManifest(root) {
+  const raw = readRaw(root);
+  return normalizeManifest(raw);
+}
+function writeProjectManifest(root, input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) throw new Error("project manifest must be an object");
+  const value = input;
+  const current = readRaw(root);
+  const next = {
+    ...current,
+    name: typeof value.name === "string" ? value.name.trim() : "",
+    commands: stringRecord(value.commands, "commands"),
+    credentials: credentialNames(value.credentials),
+    settings: settingsRecord(value.settings)
+  };
+  fs2.writeFileSync(path2.join(root, "cascade.json"), `${JSON.stringify(next, null, 2)}
+`, "utf8");
+  return normalizeManifest(next);
+}
+function readRaw(root) {
+  try {
+    const value = JSON.parse(fs2.readFileSync(path2.join(root, "cascade.json"), "utf8"));
+    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("root must be an object");
+    return value;
+  } catch (error) {
+    if (error.code === "ENOENT") return {};
+    throw new Error(`Cannot read cascade.json: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+function normalizeManifest(raw) {
+  return Object.freeze({
+    name: typeof raw.name === "string" ? raw.name : "",
+    commands: Object.freeze(stringRecord(raw.commands, "commands")),
+    credentials: Object.freeze(credentialNames(raw.credentials)),
+    settings: Object.freeze(settingsRecord(raw.settings)),
+    reads: Object.freeze(relativeFolders(raw.reads, "reads", true)),
+    writes: Object.freeze(relativeFolders(raw.writes, "writes", false))
+  });
+}
+function relativeFolders(input, label, mayLeave) {
+  if (input === void 0) return [];
+  const shape = mayLeave ? '"../other/data"' : '"renders"';
+  if (!Array.isArray(input)) throw new Error(`cascade.json ${label} must be an array of relative folders such as [${shape}]`);
+  const folders = input.map((entry) => {
+    if (typeof entry !== "string" || !entry.trim() || entry.includes("\0") || path2.isAbsolute(entry) || /^~/.test(entry))
+      throw new Error(`cascade.json ${label}: ${JSON.stringify(entry)} is not a relative folder such as ${shape}`);
+    const folder = path2.posix.normalize(entry.split("\\").join("/")).replace(/\/+$/, "");
+    const leaves = folder === ".." || folder.startsWith("../");
+    if (!mayLeave && (leaves || folder === "." || /^(?:\.git|nodes|\.cascade)(?:\/|$)/.test(folder)))
+      throw new Error(`cascade.json writes: ${JSON.stringify(entry)} must be a folder inside the project, not its root, .git, .cascade or nodes`);
+    if (mayLeave && folder === ".") throw new Error('cascade.json reads: "." is the project itself, which is always readable');
+    return folder;
+  });
+  return [...new Set(folders)];
+}
+function stringRecord(input, label) {
+  if (input === void 0) return {};
+  if (!input || typeof input !== "object" || Array.isArray(input)) throw new Error(`${label} must be an object of strings`);
+  const entries = Object.entries(input);
+  if (entries.some(([key, value]) => !CREDENTIAL_NAME.test(key) || typeof value !== "string" || value.includes("\0"))) {
+    throw new Error(`${label} must contain safe names and string values`);
+  }
+  return Object.fromEntries(entries);
+}
+function credentialNames(input) {
+  if (input === void 0) return [];
+  if (!Array.isArray(input) || input.some((name) => typeof name !== "string" || !CREDENTIAL_NAME.test(name))) {
+    throw new Error("credentials must be an array of safe names");
+  }
+  return [...new Set(input)];
+}
+function settingsRecord(input) {
+  if (input === void 0) return {};
+  if (!input || typeof input !== "object" || Array.isArray(input)) throw new Error("settings must be an object");
+  assertSafeSettings(input, 0);
+  return structuredClone(input);
+}
+function assertSafeSettings(value, depth) {
+  if (depth > 12) throw new Error("settings nesting is too deep");
+  if (value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value)) return;
+  if (Array.isArray(value)) return value.forEach((item) => assertSafeSettings(item, depth + 1));
+  if (!value || typeof value !== "object") throw new Error("settings must contain JSON values");
+  for (const [key, item] of Object.entries(value)) {
+    if (key === "__proto__" || key === "constructor" || key === "prototype" || SECRET_KEY.test(key)) {
+      throw new Error(`settings key ${JSON.stringify(key)} looks secret or unsafe; credentials belong outside the project`);
+    }
+    assertSafeSettings(item, depth + 1);
+  }
+}
+
 // server/src/shell/service.ts
 import fs4 from "node:fs";
 import os2 from "node:os";
@@ -64,11 +172,11 @@ import { execFile, spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 
 // server/src/credentials.ts
-import fs2 from "node:fs";
+import fs3 from "node:fs";
 import os from "node:os";
-import path2 from "node:path";
+import path3 from "node:path";
 var CredentialStore = class {
-  constructor(file = process.env.CASCADE_CREDENTIALS || path2.join(os.homedir(), ".cascade", "credentials.yaml")) {
+  constructor(file = process.env.CASCADE_CREDENTIALS || path3.join(os.homedir(), ".cascade", "credentials.yaml")) {
     this.file = file;
   }
   has(name) {
@@ -96,7 +204,7 @@ var CredentialStore = class {
   read() {
     let source;
     try {
-      source = fs2.readFileSync(this.file, "utf8");
+      source = fs3.readFileSync(this.file, "utf8");
     } catch (error) {
       if (error.code === "ENOENT") return /* @__PURE__ */ new Map();
       throw error;
@@ -170,83 +278,6 @@ function safeEnvName(value) {
   return value && /^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(value) && !/^(?:PATH|NODE_OPTIONS|PYTHONPATH|LD_.*|DYLD_.*)$/i.test(value) ? value : null;
 }
 
-// server/src/projectConfig.ts
-import fs3 from "node:fs";
-import path3 from "node:path";
-var CREDENTIAL_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
-var SECRET_KEY = /^(?:api[_-]?key|apiKey|secret|password|access[_-]?token|refresh[_-]?token|credential|credentials)$/i;
-function readProjectManifest(root) {
-  const raw = readRaw(root);
-  return normalizeManifest(raw);
-}
-function writeProjectManifest(root, input) {
-  if (!input || typeof input !== "object" || Array.isArray(input)) throw new Error("project manifest must be an object");
-  const value = input;
-  const current = readRaw(root);
-  const next = {
-    ...current,
-    name: typeof value.name === "string" ? value.name.trim() : "",
-    commands: stringRecord(value.commands, "commands"),
-    credentials: credentialNames(value.credentials),
-    settings: settingsRecord(value.settings)
-  };
-  fs3.writeFileSync(path3.join(root, "cascade.json"), `${JSON.stringify(next, null, 2)}
-`, "utf8");
-  return normalizeManifest(next);
-}
-function readRaw(root) {
-  try {
-    const value = JSON.parse(fs3.readFileSync(path3.join(root, "cascade.json"), "utf8"));
-    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("root must be an object");
-    return value;
-  } catch (error) {
-    if (error.code === "ENOENT") return {};
-    throw new Error(`Cannot read cascade.json: ${error instanceof Error ? error.message : String(error)}`);
-  }
-}
-function normalizeManifest(raw) {
-  return Object.freeze({
-    name: typeof raw.name === "string" ? raw.name : "",
-    commands: Object.freeze(stringRecord(raw.commands, "commands")),
-    credentials: Object.freeze(credentialNames(raw.credentials)),
-    settings: Object.freeze(settingsRecord(raw.settings))
-  });
-}
-function stringRecord(input, label) {
-  if (input === void 0) return {};
-  if (!input || typeof input !== "object" || Array.isArray(input)) throw new Error(`${label} must be an object of strings`);
-  const entries = Object.entries(input);
-  if (entries.some(([key, value]) => !CREDENTIAL_NAME.test(key) || typeof value !== "string" || value.includes("\0"))) {
-    throw new Error(`${label} must contain safe names and string values`);
-  }
-  return Object.fromEntries(entries);
-}
-function credentialNames(input) {
-  if (input === void 0) return [];
-  if (!Array.isArray(input) || input.some((name) => typeof name !== "string" || !CREDENTIAL_NAME.test(name))) {
-    throw new Error("credentials must be an array of safe names");
-  }
-  return [...new Set(input)];
-}
-function settingsRecord(input) {
-  if (input === void 0) return {};
-  if (!input || typeof input !== "object" || Array.isArray(input)) throw new Error("settings must be an object");
-  assertSafeSettings(input, 0);
-  return structuredClone(input);
-}
-function assertSafeSettings(value, depth) {
-  if (depth > 12) throw new Error("settings nesting is too deep");
-  if (value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value)) return;
-  if (Array.isArray(value)) return value.forEach((item) => assertSafeSettings(item, depth + 1));
-  if (!value || typeof value !== "object") throw new Error("settings must contain JSON values");
-  for (const [key, item] of Object.entries(value)) {
-    if (key === "__proto__" || key === "constructor" || key === "prototype" || SECRET_KEY.test(key)) {
-      throw new Error(`settings key ${JSON.stringify(key)} looks secret or unsafe; credentials belong outside the project`);
-    }
-    assertSafeSettings(item, depth + 1);
-  }
-}
-
 // server/src/shell/types.ts
 var ShellProcessError = class extends Error {
   constructor(kind, result, message) {
@@ -847,7 +878,48 @@ var ProjectRoot = class _ProjectRoot {
     if (normalized === "shared" || normalized.startsWith("shared/")) {
       return this.resolveShared(...normalized.split("/").slice(1));
     }
-    return this.resolve(relativePath);
+    try {
+      return this.resolve(relativePath);
+    } catch (error) {
+      if (!(error instanceof PathSafetyError)) throw error;
+      const declared = this.resolveDeclaredRead(relativePath);
+      if (declared) return declared;
+      throw error;
+    }
+  }
+  /**
+   * A read outside the project, allowed only into a root the project declares
+   * in cascade.json `"reads"` (`["../other/data"]`). Reached by `..` or by a
+   * symlink alike: the canonical target must lie under the canonical read
+   * root. Never used for writes — `resolve()` still refuses those.
+   */
+  resolveDeclaredRead(relativePath) {
+    if (path5.isAbsolute(relativePath)) return null;
+    const reads = readProjectManifest(this.root).reads;
+    if (!reads.length) return null;
+    const target = canonicalPath(path5.resolve(this.root, relativePath));
+    for (const folder of reads) {
+      let base;
+      try {
+        base = fssync.realpathSync(path5.resolve(this.root, folder));
+      } catch {
+        continue;
+      }
+      if (isWithin(base, target)) return target;
+    }
+    return null;
+  }
+  /**
+   * Where a node may write a file under its own name: `.cascade-cache/`, or a
+   * folder the project declares in cascade.json `"writes"` (`["renders"]`).
+   * Returns the folder the normalised path falls in, or null. Containment is
+   * still `resolve()`'s, so a symlink out of a write folder is refused.
+   */
+  writeFolderOf(relativePath) {
+    const clean = path5.posix.normalize(relativePath.split("\\").join("/").replace(/^\.?\//, ""));
+    for (const folder of [".cascade-cache", ...readProjectManifest(this.root).writes])
+      if (clean.startsWith(`${folder}/`)) return folder;
+    return null;
   }
   /**
    * Whether this project is under version control, walking **up** rather than
@@ -1122,4 +1194,4 @@ export {
   extractNodeDefinition,
   ProjectRoot
 };
-//# sourceMappingURL=chunk-RQZ4SX5R.js.map
+//# sourceMappingURL=chunk-W5PJ5RMP.js.map

package/dist/cli/chunk-W7OUAT7J.js

@@ -0,0 +1,122 @@
+import {
+  readProjectManifest
+} from "./chunk-W5PJ5RMP.js";
+
+// server/src/compile.ts
+import * as esbuild from "esbuild";
+import fs from "fs";
+import path from "path";
+import { fileURLToPath } from "url";
+var __dirname_compile = path.dirname(fileURLToPath(import.meta.url));
+function cascadeRuntimePlugin(project) {
+  return {
+    name: "cascade-runtime",
+    setup(build2) {
+      build2.onResolve({ filter: /^cascade\/(?:io|image|shell|net|config|stage)$/ }, (args) => ({
+        path: args.path,
+        namespace: "cascade-runtime"
+      }));
+      build2.onResolve({ filter: /^(?:@cascade|cascade)\/contracts$/ }, () => {
+        const candidates = [
+          path.join(__dirname_compile, "..", "contracts", "index.js"),
+          path.join(__dirname_compile, "..", "..", "packages", "contracts", "dist", "index.js")
+        ];
+        const found = candidates.find((c) => fs.existsSync(c));
+        if (!found) {
+          return { errors: [{ text: `@cascade/contracts not found (looked in ${candidates.join(", ")})` }] };
+        }
+        return { path: found };
+      });
+      build2.onLoad({ filter: /.*/, namespace: "cascade-runtime" }, (args) => {
+        if (args.path === "cascade/config") {
+          return { contents: configRuntimeSource(readProjectManifest(project.root).settings), loader: "ts" };
+        }
+        const candidates = [
+          path.join(__dirname_compile, "runtime", `${args.path.slice("cascade/".length)}.ts`),
+          path.join(__dirname_compile, "..", "src", "runtime", `${args.path.slice("cascade/".length)}.ts`)
+        ];
+        const found = candidates.find((c) => fs.existsSync(c));
+        if (!found) {
+          return { errors: [{ text: `${args.path} runtime not found (looked in ${candidates.join(", ")})` }] };
+        }
+        return { contents: fs.readFileSync(found, "utf-8"), loader: "ts", resolveDir: path.dirname(found) };
+      });
+    }
+  };
+}
+function commonOptions(project) {
+  return {
+    bundle: true,
+    format: "esm",
+    platform: "browser",
+    target: "es2022",
+    write: false,
+    logLevel: "silent",
+    plugins: [cascadeRuntimePlugin(project)]
+  };
+}
+async function compileProjectModule(project, moduleName) {
+  try {
+    await project.moduleRunsOn(moduleName);
+    return await compileEntry(project, project.resolve(`nodes/${moduleName}/index.ts`));
+  } catch (err) {
+    return { ok: false, code: "", errors: [errorMessage(err)] };
+  }
+}
+async function compileProjectPanel(project, panelName) {
+  try {
+    return await compileEntry(project, await project.resolvePanelEntry(panelName));
+  } catch (err) {
+    return { ok: false, code: "", errors: [errorMessage(err)] };
+  }
+}
+async function compileEmbedded(project, code) {
+  try {
+    const result = await esbuild.build({
+      ...commonOptions(project),
+      stdin: {
+        contents: code,
+        loader: "ts",
+        resolveDir: project.root,
+        sourcefile: "embedded.ts"
+      }
+    });
+    return toResult(result);
+  } catch (err) {
+    return { ok: false, code: "", errors: [errorMessage(err)] };
+  }
+}
+function toResult(result) {
+  const errors = result.errors.map((e) => e.text);
+  const code = result.outputFiles?.[0]?.text ?? "";
+  return { ok: errors.length === 0, code, errors };
+}
+async function compileEntry(project, entryPath) {
+  return toResult(await esbuild.build({ ...commonOptions(project), entryPoints: [entryPath] }));
+}
+function configRuntimeSource(settings) {
+  return `function deepFreeze(value) { if (value && typeof value === 'object') { for (const item of Object.values(value)) deepFreeze(item); Object.freeze(value); } return value; }
+const values = deepFreeze(${JSON.stringify(settings)});
+function value(name) { return Object.prototype.hasOwnProperty.call(values, name) ? values[name] : undefined; }
+export const config = Object.freeze({
+  get(name, fallback) { return value(name) ?? fallback; },
+  string(name, fallback = '') { const item = value(name); return typeof item === 'string' ? item : fallback; },
+  number(name, fallback = 0) { const item = value(name); return typeof item === 'number' && Number.isFinite(item) ? item : fallback; },
+  boolean(name, fallback = false) { const item = value(name); return typeof item === 'boolean' ? item : fallback; },
+  has(name) { return value(name) !== undefined; }
+});`;
+}
+function errorMessage(err) {
+  if (err && typeof err === "object" && "errors" in err) {
+    const errors = err.errors;
+    if (errors?.length) return errors.map((e) => e.text).join("\n");
+  }
+  return err instanceof Error ? err.message : String(err);
+}
+
+export {
+  compileProjectModule,
+  compileProjectPanel,
+  compileEmbedded
+};
+//# sourceMappingURL=chunk-W7OUAT7J.js.map