@jesscss/plugin-js 2.0.0-alpha.5 → 2.0.0-alpha.6

package/lib/index.cjs

@@ -0,0 +1,437 @@
+Object.defineProperties(exports, {
+	__esModule: { value: true },
+	[Symbol.toStringTag]: { value: "Module" }
+});
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+//#endregion
+let _jesscss_core = require("@jesscss/core");
+let node_fs = require("node:fs");
+node_fs = __toESM(node_fs);
+let node_net = require("node:net");
+node_net = __toESM(node_net);
+let node_path = require("node:path");
+node_path = __toESM(node_path);
+let node_url = require("node:url");
+let node_child_process = require("node:child_process");
+//#region src/index.ts
+const SCRIPT_EXTENSIONS = new Set([
+	".js",
+	".mjs",
+	".cjs",
+	".ts",
+	".mts",
+	".cts"
+]);
+const RUNTIME_MISSING_MESSAGE = [
+	"Deno runtime is required for @jesscss/plugin-js, but no usable Deno binary was found.",
+	"If using pnpm, approve build scripts for \"deno\" (pnpm approve-builds).",
+	"If using npm with ignored scripts, reinstall with lifecycle scripts enabled.",
+	"Or install native Deno and ensure \"deno\" is on PATH."
+].join("\n");
+const BOOT_TIMEOUT_MS = 8e3;
+const REQUEST_TIMEOUT_MS = 1e4;
+const IDLE_SHUTDOWN_MS = 5e3;
+const isPathInside = (candidatePath, rootPath) => {
+	const rel = node_path.relative(rootPath, candidatePath);
+	return rel === "" || !rel.startsWith("..") && !node_path.isAbsolute(rel);
+};
+const canonicalPath = (p) => {
+	try {
+		return node_fs.realpathSync.native(p);
+	} catch {
+		return p;
+	}
+};
+const normalizePermissionPath = (value) => {
+	if (!value) return null;
+	if (value.startsWith("file://")) try {
+		return (0, node_url.fileURLToPath)(value);
+	} catch {
+		return value;
+	}
+	return value;
+};
+const isFnsPath = (importPath) => {
+	const normalized = importPath.replace(/\\/g, "/");
+	const isFnsPackagePath = /(^|\/)(@jesscss\/fns|packages\/fns)(\/|$)/.test(normalized);
+	return normalized === "@jesscss/fns" || normalized.startsWith("@jesscss/fns/") || normalized === "#less" || normalized.startsWith("#less/") || normalized === "#sass" || normalized.startsWith("#sass/") || isFnsPackagePath;
+};
+const isJsonValue = (value) => {
+	try {
+		JSON.stringify(value);
+		return true;
+	} catch {
+		return false;
+	}
+};
+var JsPlugin = class JsPlugin extends _jesscss_core.AbstractPlugin {
+	static cleanupRegistered = false;
+	static liveInstances = /* @__PURE__ */ new Set();
+	name = "js";
+	supportedExtensions = Array.from(SCRIPT_EXTENSIONS);
+	runtimeState = { status: "idle" };
+	brokerServer;
+	brokerSocketPath;
+	worker;
+	workerBuffer = "";
+	nextRequestId = 1;
+	pending = /* @__PURE__ */ new Map();
+	idleTimer;
+	constructor(opts = {}) {
+		super();
+		this.opts = opts;
+		JsPlugin.liveInstances.add(this);
+		JsPlugin.registerProcessCleanup();
+	}
+	prewarm() {
+		return this.ensureRuntime().catch(() => void 0);
+	}
+	static registerProcessCleanup() {
+		if (JsPlugin.cleanupRegistered) return;
+		JsPlugin.cleanupRegistered = true;
+		const cleanup = () => {
+			for (const instance of JsPlugin.liveInstances) try {
+				instance.dispose();
+			} catch {}
+		};
+		process.once("beforeExit", cleanup);
+		process.once("exit", cleanup);
+	}
+	clearIdleTimer() {
+		if (this.idleTimer) {
+			clearTimeout(this.idleTimer);
+			this.idleTimer = void 0;
+		}
+	}
+	scheduleIdleShutdown() {
+		this.clearIdleTimer();
+		if (this.pending.size > 0 || this.runtimeState.status !== "ready") return;
+		this.idleTimer = setTimeout(() => {
+			this.shutdown();
+			this.runtimeState = { status: "idle" };
+		}, IDLE_SHUTDOWN_MS);
+		this.idleTimer.unref?.();
+	}
+	ensureRuntimeAvailable() {
+		if ((0, node_child_process.spawnSync)(this.opts.denoCommand ?? "deno", ["--version"], { stdio: "ignore" }).status !== 0) throw new Error(RUNTIME_MISSING_MESSAGE);
+	}
+	ensureRuntime() {
+		if (this.runtimeState.status === "ready") {
+			this.clearIdleTimer();
+			return Promise.resolve();
+		}
+		if (this.runtimeState.status === "initializing") return this.runtimeState.promise;
+		if (this.runtimeState.status === "failed") return Promise.reject(this.runtimeState.error);
+		const promise = this.startRuntime().then(() => {
+			this.runtimeState = { status: "ready" };
+			this.scheduleIdleShutdown();
+		}, (err) => {
+			this.runtimeState = {
+				status: "failed",
+				error: err
+			};
+			throw err;
+		});
+		this.runtimeState = {
+			status: "initializing",
+			promise
+		};
+		return promise;
+	}
+	createBrokerPath() {
+		if (process.platform === "win32") return `\\\\.\\pipe\\jess-deno-broker-${`${process.pid}-${Date.now()}-${Math.floor(Math.random() * 1e4)}`}`;
+		const rand = Math.floor(Math.random() * 1e4);
+		return `/tmp/jd-${process.pid}-${Date.now()}-${rand}.sock`;
+	}
+	isReadAllowed(value) {
+		const normalized = normalizePermissionPath(value);
+		if (!normalized) return false;
+		const requestedPath = canonicalPath(node_path.resolve(normalized));
+		const jsReadRoot = this.opts.jsReadRoot ? canonicalPath(node_path.resolve(this.opts.jsReadRoot)) : void 0;
+		if (jsReadRoot && isPathInside(requestedPath, jsReadRoot)) return true;
+		return requestedPath.includes(`${node_path.sep}node_modules${node_path.sep}`);
+	}
+	isNetAllowed(value) {
+		if (!this.opts.allowHttp) return false;
+		const allowHosts = this.opts.allowNetHosts ?? [];
+		if (allowHosts.length === 0) return true;
+		if (!value) return false;
+		const host = value.split(":")[0] ?? value;
+		return allowHosts.includes(host);
+	}
+	handleBrokerRequest(request) {
+		const deny = (reason) => ({
+			id: request.id,
+			result: "deny",
+			reason
+		});
+		switch (request.permission) {
+			case "read": return this.isReadAllowed(request.value) ? {
+				id: request.id,
+				result: "allow"
+			} : deny("Read access denied by Jess policy.");
+			case "net": return this.isNetAllowed(request.value) ? {
+				id: request.id,
+				result: "allow"
+			} : deny("Network access denied by Jess policy.");
+			case "env":
+			case "run":
+			case "ffi":
+			case "sys":
+			case "write": return deny(`${request.permission} permission denied by Jess policy.`);
+			default: return deny(`Permission "${request.permission}" denied by Jess policy.`);
+		}
+	}
+	async startBroker() {
+		const socketPath = this.createBrokerPath();
+		if (process.platform !== "win32" && node_fs.existsSync(socketPath)) node_fs.unlinkSync(socketPath);
+		const server = node_net.createServer((socket) => {
+			let buf = "";
+			socket.setEncoding("utf8");
+			socket.on("data", (chunk) => {
+				buf += chunk;
+				let idx = buf.indexOf("\n");
+				while (idx >= 0) {
+					const line = buf.slice(0, idx).trim();
+					buf = buf.slice(idx + 1);
+					idx = buf.indexOf("\n");
+					if (!line) continue;
+					let req;
+					try {
+						req = JSON.parse(line);
+					} catch {
+						socket.write(JSON.stringify({
+							id: -1,
+							result: "deny",
+							reason: "Malformed permission request."
+						}) + "\n");
+						continue;
+					}
+					const response = this.handleBrokerRequest(req);
+					socket.write(`${JSON.stringify(response)}\n`);
+				}
+			});
+		});
+		await new Promise((resolve, reject) => {
+			server.once("error", reject);
+			server.listen(socketPath, () => resolve());
+		});
+		this.brokerServer = server;
+		this.brokerSocketPath = socketPath;
+		return socketPath;
+	}
+	startWorker(socketPath) {
+		const denoCommand = this.opts.denoCommand ?? "deno";
+		const moduleDir = node_path.dirname((0, node_url.fileURLToPath)(require("url").pathToFileURL(__filename).href));
+		const compiledWorkerPath = node_path.join(moduleDir, "runtime-worker.js");
+		const sourceWorkerPath = node_path.join(moduleDir, "runtime-worker.ts");
+		const child = (0, node_child_process.spawn)(denoCommand, [
+			"run",
+			"--no-prompt",
+			node_fs.existsSync(compiledWorkerPath) ? compiledWorkerPath : sourceWorkerPath
+		], {
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			env: {
+				...process.env,
+				DENO_PERMISSION_BROKER_PATH: socketPath
+			}
+		});
+		this.worker = child;
+		child.stdout.setEncoding("utf8");
+		child.stderr.setEncoding("utf8");
+		child.stdout.on("data", (chunk) => this.onWorkerStdout(chunk));
+		child.on("exit", () => {
+			const err = /* @__PURE__ */ new Error("Deno worker exited unexpectedly.");
+			this.rejectAllPending(err);
+			if (this.runtimeState.status !== "failed") this.runtimeState = {
+				status: "failed",
+				error: err
+			};
+		});
+		return new Promise((resolve, reject) => {
+			const timer = setTimeout(() => {
+				reject(/* @__PURE__ */ new Error("Timed out waiting for Deno worker startup."));
+			}, BOOT_TIMEOUT_MS);
+			const onData = (chunk) => {
+				this.workerBuffer += chunk;
+				let idx = this.workerBuffer.indexOf("\n");
+				while (idx >= 0) {
+					const line = this.workerBuffer.slice(0, idx).trim();
+					this.workerBuffer = this.workerBuffer.slice(idx + 1);
+					idx = this.workerBuffer.indexOf("\n");
+					if (!line) continue;
+					try {
+						if (JSON.parse(line).type === "ready") {
+							clearTimeout(timer);
+							child.stdout.off("data", onData);
+							resolve();
+							return;
+						}
+					} catch {}
+				}
+			};
+			child.stdout.on("data", onData);
+			child.once("error", (err) => {
+				clearTimeout(timer);
+				child.stdout.off("data", onData);
+				reject(err);
+			});
+		});
+	}
+	async startRuntime() {
+		this.ensureRuntimeAvailable();
+		const socketPath = await this.startBroker();
+		try {
+			await this.startWorker(socketPath);
+		} catch (err) {
+			this.shutdown();
+			throw err instanceof Error ? err : new Error(String(err));
+		}
+	}
+	onWorkerStdout(chunk) {
+		this.workerBuffer += chunk;
+		let idx = this.workerBuffer.indexOf("\n");
+		while (idx >= 0) {
+			const line = this.workerBuffer.slice(0, idx).trim();
+			this.workerBuffer = this.workerBuffer.slice(idx + 1);
+			idx = this.workerBuffer.indexOf("\n");
+			if (!line) continue;
+			let parsed;
+			try {
+				parsed = JSON.parse(line);
+			} catch {
+				continue;
+			}
+			if (!parsed || typeof parsed.id !== "number") continue;
+			const pending = this.pending.get(parsed.id);
+			if (!pending) continue;
+			this.pending.delete(parsed.id);
+			clearTimeout(pending.timeout);
+			pending.resolve(parsed);
+			if (this.pending.size === 0) this.scheduleIdleShutdown();
+		}
+	}
+	rejectAllPending(err) {
+		for (const pending of this.pending.values()) {
+			clearTimeout(pending.timeout);
+			pending.reject(err);
+		}
+		this.pending.clear();
+	}
+	async callWorker(request) {
+		await this.ensureRuntime();
+		this.clearIdleTimer();
+		if (!this.worker || !this.worker.stdin.writable) throw new Error("Deno worker is not available.");
+		const id = this.nextRequestId++;
+		const payload = {
+			...request,
+			id
+		};
+		return await new Promise((resolve, reject) => {
+			const timeout = setTimeout(() => {
+				this.pending.delete(id);
+				reject(/* @__PURE__ */ new Error("Timed out waiting for Deno worker response."));
+			}, REQUEST_TIMEOUT_MS);
+			this.pending.set(id, {
+				resolve,
+				reject,
+				timeout
+			});
+			this.worker.stdin.write(`${JSON.stringify(payload)}\n`);
+		});
+	}
+	shutdown() {
+		this.clearIdleTimer();
+		if (this.worker && !this.worker.killed) this.worker.kill();
+		this.worker = void 0;
+		if (this.brokerServer) {
+			this.brokerServer.close();
+			this.brokerServer = void 0;
+		}
+		if (this.brokerSocketPath && process.platform !== "win32") try {
+			if (node_fs.existsSync(this.brokerSocketPath)) node_fs.unlinkSync(this.brokerSocketPath);
+		} catch {}
+		this.brokerSocketPath = void 0;
+	}
+	dispose() {
+		this.shutdown();
+		this.runtimeState = { status: "idle" };
+	}
+	assertAllowedPath(absoluteFilePath) {
+		const resolvedPath = node_path.resolve(absoluteFilePath);
+		const jsReadRoot = this.opts.jsReadRoot ? node_path.resolve(this.opts.jsReadRoot) : void 0;
+		if (!jsReadRoot) return;
+		if (isPathInside(resolvedPath, jsReadRoot)) return;
+		if (resolvedPath.includes(`${node_path.sep}node_modules${node_path.sep}`)) return;
+		throw new Error(`Script path "${resolvedPath}" is outside jsReadRoot "${jsReadRoot}"`);
+	}
+	async import(absoluteFilePath) {
+		const ext = node_path.extname(absoluteFilePath);
+		if (!SCRIPT_EXTENSIONS.has(ext)) throw new Error(`Plugin "${this.name}" cannot import "${absoluteFilePath}"`);
+		if (!isFnsPath(absoluteFilePath)) {
+			this.assertAllowedPath(absoluteFilePath);
+			await this.ensureRuntime();
+			const modulePath = node_path.resolve(absoluteFilePath);
+			const loadResult = await this.callWorker({
+				type: "load",
+				modulePath
+			});
+			if (!loadResult.ok) throw new Error(loadResult.error);
+			const moduleObject = {};
+			const exported = loadResult.exports ?? [];
+			for (const item of exported) if (item.kind === "function") moduleObject[item.name] = async (...args) => {
+				const invokeResult = await this.callWorker({
+					type: "invoke",
+					modulePath,
+					exportName: item.name,
+					args
+				});
+				if (!invokeResult.ok) throw new Error(invokeResult.error);
+				return invokeResult.value;
+			};
+			else moduleObject[item.name] = item.value;
+			return moduleObject;
+		}
+		const module = await import((0, node_url.pathToFileURL)(node_path.resolve(absoluteFilePath)).href);
+		const safeModule = {};
+		for (const [key, value] of Object.entries(module)) if (typeof value === "function" || isJsonValue(value)) safeModule[key] = value;
+		return safeModule;
+	}
+};
+/**
+* Global flag set when @jesscss/plugin-js is loaded.
+* less-compat checks this before running @plugin scripts (scripts must be run when plugin-js/Deno is present).
+*/
+const JESS_PLUGIN_JS_GLOBAL = "__JESS_PLUGIN_JS_AVAILABLE__";
+if (typeof globalThis !== "undefined") globalThis[JESS_PLUGIN_JS_GLOBAL] = true;
+const jsPlugin = ((opts) => {
+	return new JsPlugin(opts);
+});
+//#endregion
+exports.JESS_PLUGIN_JS_GLOBAL = JESS_PLUGIN_JS_GLOBAL;
+exports.JsPlugin = JsPlugin;
+exports.default = jsPlugin;

package/lib/index.d.ts

@@ -9,6 +9,8 @@ export interface JsPluginOptions extends JavaScriptSandboxConfig {
 }
 export declare class JsPlugin extends AbstractPlugin {
     opts: JsPluginOptions;
+    private static cleanupRegistered;
+    private static liveInstances;
     name: string;
     supportedExtensions: string[];
     private runtimeState;
@@ -18,8 +20,12 @@ export declare class JsPlugin extends AbstractPlugin {
     private workerBuffer;
     private nextRequestId;
     private pending;
+    private idleTimer;
     constructor(opts?: JsPluginOptions);
     prewarm(): Promise<void | undefined>;
+    private static registerProcessCleanup;
+    private clearIdleTimer;
+    private scheduleIdleShutdown;
     private ensureRuntimeAvailable;
     private ensureRuntime;
     private createBrokerPath;

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,cAAc,EACf,MAAM,eAAe,CAAC;AAOvB,MAAM,MAAM,uBAAuB,GAAG;IACpC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,WAAW,eAAgB,SAAQ,uBAAuB;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAoGD,qBAAa,QAAS,SAAQ,cAAc;IAevB,IAAI,EAAE,eAAe;IAdxC,IAAI,SAAQ;IACZ,mBAAmB,WAAiC;IACpD,OAAO,CAAC,YAAY,CAAoC;IACxD,OAAO,CAAC,YAAY,CAAyB;IAC7C,OAAO,CAAC,gBAAgB,CAAqB;IAC7C,OAAO,CAAC,MAAM,CAA6C;IAC3D,OAAO,CAAC,YAAY,CAAM;IAC1B,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,OAAO,CAIV;gBAEc,IAAI,GAAE,eAAoB;IAI7C,OAAO;IAIP,OAAO,CAAC,sBAAsB;IAU9B,OAAO,CAAC,aAAa;IAuBrB,OAAO,CAAC,gBAAgB;IAUxB,OAAO,CAAC,aAAa;IAarB,OAAO,CAAC,YAAY;IAepB,OAAO,CAAC,mBAAmB;YA0Bb,WAAW;IA2CzB,OAAO,CAAC,WAAW;YAkEL,YAAY;IAW1B,OAAO,CAAC,cAAc;IA6BtB,OAAO,CAAC,gBAAgB;YAQV,UAAU;IAqBxB,OAAO,CAAC,QAAQ;IAqBhB,OAAO;IAKP,OAAO,CAAC,iBAAiB;IAgBnB,MAAM,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CA6CrE;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB,iCAAiC,CAAC;AAOpE,QAAA,MAAM,QAAQ,UAAY,eAAe,aAEtB,CAAC;AAEpB,eAAe,QAAQ,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,cAAc,EACf,MAAM,eAAe,CAAC;AAOvB,MAAM,MAAM,uBAAuB,GAAG;IACpC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,WAAW,eAAgB,SAAQ,uBAAuB;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAqGD,qBAAa,QAAS,SAAQ,cAAc;IAmBvB,IAAI,EAAE,eAAe;IAlBxC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAS;IACzC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAuB;IACnD,IAAI,SAAQ;IACZ,mBAAmB,WAAiC;IACpD,OAAO,CAAC,YAAY,CAAoC;IACxD,OAAO,CAAC,YAAY,CAAyB;IAC7C,OAAO,CAAC,gBAAgB,CAAqB;IAC7C,OAAO,CAAC,MAAM,CAA6C;IAC3D,OAAO,CAAC,YAAY,CAAM;IAC1B,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,OAAO,CAIV;IAEL,OAAO,CAAC,SAAS,CAA6B;gBAE3B,IAAI,GAAE,eAAoB;IAM7C,OAAO;IAIP,OAAO,CAAC,MAAM,CAAC,sBAAsB;IAkBrC,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,oBAAoB;IAY5B,OAAO,CAAC,sBAAsB;IAU9B,OAAO,CAAC,aAAa;IAyBrB,OAAO,CAAC,gBAAgB;IAUxB,OAAO,CAAC,aAAa;IAarB,OAAO,CAAC,YAAY;IAepB,OAAO,CAAC,mBAAmB;YA0Bb,WAAW;IA4CzB,OAAO,CAAC,WAAW;YAmEL,YAAY;IAW1B,OAAO,CAAC,cAAc;IAiCtB,OAAO,CAAC,gBAAgB;YAQV,UAAU;IAsBxB,OAAO,CAAC,QAAQ;IAsBhB,OAAO;IAKP,OAAO,CAAC,iBAAiB;IAgBnB,MAAM,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CA8CrE;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB,iCAAiC,CAAC;AAOpE,QAAA,MAAM,QAAQ,UAAY,eAAe,aAEtB,CAAC;AAEpB,eAAe,QAAQ,CAAC"}