@lunora/config 1.0.0-alpha.43 → 1.0.0-alpha.44

package/dist/packem_shared/assetContentType-ByZjeV3D.mjs

@@ -0,0 +1,72 @@
+import { readFileSync, statSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { normalize, join, relative, isAbsolute, dirname } from 'node:path';
+
+const loadStudioAssets = (logger, resolveFrom = import.meta.url) => {
+  try {
+    const require = createRequire(resolveFrom);
+    return {
+      script: readFileSync(require.resolve("@lunora/studio/standalone/studio.js")),
+      styles: readFileSync(require.resolve("@lunora/studio/styles.css"))
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    logger?.warnOnce?.(`[lunora] studio assets unavailable (build @lunora/studio?): ${message}`);
+    return void 0;
+  }
+};
+const studioAssetsStamp = (resolveFrom = import.meta.url) => {
+  try {
+    const require = createRequire(resolveFrom);
+    const scriptMtime = statSync(require.resolve("@lunora/studio/standalone/studio.js")).mtimeMs;
+    const stylesMtime = statSync(require.resolve("@lunora/studio/styles.css")).mtimeMs;
+    return Math.max(scriptMtime, stylesMtime);
+  } catch {
+    return void 0;
+  }
+};
+const resolveStandaloneDirectory = (resolveFrom = import.meta.url) => {
+  try {
+    return dirname(createRequire(resolveFrom).resolve("@lunora/studio/standalone/studio.js"));
+  } catch {
+    return void 0;
+  }
+};
+const resolveContainedFile = (directory, fileName) => {
+  if (fileName === "" || fileName === "." || fileName === ".." || fileName.includes("/") || fileName.includes("\\") || fileName.includes("\0")) {
+    return void 0;
+  }
+  const resolved = normalize(join(directory, fileName));
+  const relativePath = relative(directory, resolved);
+  if (relativePath === "" || relativePath.startsWith("..") || isAbsolute(relativePath) || relativePath.includes("/") || relativePath.includes("\\")) {
+    return void 0;
+  }
+  return resolved;
+};
+const readStandaloneAsset = (fileName, resolveFrom = import.meta.url) => {
+  const directory = resolveStandaloneDirectory(resolveFrom);
+  if (directory === void 0) {
+    return void 0;
+  }
+  const resolved = resolveContainedFile(directory, fileName);
+  if (resolved === void 0) {
+    return void 0;
+  }
+  try {
+    return readFileSync(resolved);
+  } catch {
+    return void 0;
+  }
+};
+const isStandaloneModulePath = (pathname) => pathname.endsWith(".js") || pathname.endsWith(".js.map");
+const assetContentType = (fileName) => {
+  if (fileName.endsWith(".css")) {
+    return "text/css; charset=utf-8";
+  }
+  if (fileName.endsWith(".map")) {
+    return "application/json; charset=utf-8";
+  }
+  return "text/javascript; charset=utf-8";
+};
+
+export { assetContentType, isStandaloneModulePath, loadStudioAssets, readStandaloneAsset, resolveContainedFile, resolveStandaloneDirectory, studioAssetsStamp };

package/dist/studio-host/index.d.mts

@@ -81,6 +81,38 @@ declare const loadStudioAssets: (logger?: WarnLogger, resolveFrom?: string) => S
 */
 declare const studioAssetsStamp: (resolveFrom?: string) => number | undefined;
 /**
+* Absolute path of the built standalone directory — `@lunora/studio`'s
+* `dist/standalone`, where the `studio.js` entry and its code-split `chunk-*.js`
+* siblings live — or `undefined` when the studio isn't installed/built. The
+* standalone bundle is emitted with esbuild `splitting`, so the hosts must serve
+* the whole directory (not two fixed paths); this resolves its root.
+*/
+declare const resolveStandaloneDirectory: (resolveFrom?: string) => string | undefined;
+/**
+* Read a single file from the standalone directory by its plain filename (the
+* `studio.js` entry, a `chunk-*.js`, or a `.map`). **Path-traversal-safe** via
+* {@link resolveContainedFile}: only a lone filename resolving to a direct child
+* of the standalone directory is served — any separator, `..`, NUL, or absolute
+* path is rejected — so a request like `../../etc/passwd` can never escape it.
+* Returns the bytes, or `undefined` when the studio isn't built or the name
+* doesn't resolve to a file inside the directory (the host answers that 404).
+*/
+declare const readStandaloneAsset: (fileName: string, resolveFrom?: string) => Buffer | undefined;
+/**
+* True when `pathname` addresses a standalone JS module — the `studio.js` entry
+* or one of its code-split `chunk-*.js` siblings (and their `.map`s). Shared by
+* the CLI and Vite hosts so both route the same request shapes to the directory
+* server; the stylesheet is matched separately at each host's own style path.
+*/
+declare const isStandaloneModulePath: (pathname: string) => boolean;
+/**
+* Content-Type for a served standalone asset, by extension: `.css` → CSS,
+* `.map` → JSON (a source map), everything else (the `.js` entry + chunks) →
+* JavaScript. Shared by the CLI and Vite hosts so the MIME decision lives in one
+* place.
+*/
+declare const assetContentType: (fileName: string) => string;
+/**
 * Endpoint path both dev hosts mount the handler at. A sibling of the schema
 * editor's `/__lunora/schema-edit`; the double underscore keeps it clear of the
 * CLI's `/_lunora/*` worker proxy (single underscore).
@@ -224,4 +256,4 @@ type LocalEndpointHandler = (request: LocalEndpointRequest) => LocalEndpointResp
 * `400`; an unexpected throw (e.g. the body-size guard) is a `500`.
 */
 declare const serveJsonHandler: (request: IncomingMessage, response: ServerResponse, handle: LocalEndpointHandler, projectRoot: string) => void;
-export { type LocalEndpointHandler, type LocalEndpointRequest, type LocalEndpointResponse, POLICY_SCAFFOLD_ENDPOINT, type PolicyScaffoldBody, type PolicyScaffoldRequest, type PolicyScaffoldResponse, SCHEMA_EDIT_ENDPOINT, SEED_ENDPOINT, type SchemaEditRequest, type SchemaEditResponse, type SeedRequest, type SeedRequestBody, type SeedResponse, type StudioAssets, type StudioHtmlConfig, type WarnLogger, type WirePolicyEdit, handlePolicyScaffoldRequest, handleSchemaEditRequest, handleSeedRequest, loadStudioAssets, parseDevVariable, renderStudioHtml, resolveAdminToken, serveJsonHandler, studioAssetsStamp };
+export { type LocalEndpointHandler, type LocalEndpointRequest, type LocalEndpointResponse, POLICY_SCAFFOLD_ENDPOINT, type PolicyScaffoldBody, type PolicyScaffoldRequest, type PolicyScaffoldResponse, SCHEMA_EDIT_ENDPOINT, SEED_ENDPOINT, type SchemaEditRequest, type SchemaEditResponse, type SeedRequest, type SeedRequestBody, type SeedResponse, type StudioAssets, type StudioHtmlConfig, type WarnLogger, type WirePolicyEdit, assetContentType, handlePolicyScaffoldRequest, handleSchemaEditRequest, handleSeedRequest, isStandaloneModulePath, loadStudioAssets, parseDevVariable, readStandaloneAsset, renderStudioHtml, resolveAdminToken, resolveStandaloneDirectory, serveJsonHandler, studioAssetsStamp };

package/dist/studio-host/index.d.ts

@@ -81,6 +81,38 @@ declare const loadStudioAssets: (logger?: WarnLogger, resolveFrom?: string) => S
 */
 declare const studioAssetsStamp: (resolveFrom?: string) => number | undefined;
 /**
+* Absolute path of the built standalone directory — `@lunora/studio`'s
+* `dist/standalone`, where the `studio.js` entry and its code-split `chunk-*.js`
+* siblings live — or `undefined` when the studio isn't installed/built. The
+* standalone bundle is emitted with esbuild `splitting`, so the hosts must serve
+* the whole directory (not two fixed paths); this resolves its root.
+*/
+declare const resolveStandaloneDirectory: (resolveFrom?: string) => string | undefined;
+/**
+* Read a single file from the standalone directory by its plain filename (the
+* `studio.js` entry, a `chunk-*.js`, or a `.map`). **Path-traversal-safe** via
+* {@link resolveContainedFile}: only a lone filename resolving to a direct child
+* of the standalone directory is served — any separator, `..`, NUL, or absolute
+* path is rejected — so a request like `../../etc/passwd` can never escape it.
+* Returns the bytes, or `undefined` when the studio isn't built or the name
+* doesn't resolve to a file inside the directory (the host answers that 404).
+*/
+declare const readStandaloneAsset: (fileName: string, resolveFrom?: string) => Buffer | undefined;
+/**
+* True when `pathname` addresses a standalone JS module — the `studio.js` entry
+* or one of its code-split `chunk-*.js` siblings (and their `.map`s). Shared by
+* the CLI and Vite hosts so both route the same request shapes to the directory
+* server; the stylesheet is matched separately at each host's own style path.
+*/
+declare const isStandaloneModulePath: (pathname: string) => boolean;
+/**
+* Content-Type for a served standalone asset, by extension: `.css` → CSS,
+* `.map` → JSON (a source map), everything else (the `.js` entry + chunks) →
+* JavaScript. Shared by the CLI and Vite hosts so the MIME decision lives in one
+* place.
+*/
+declare const assetContentType: (fileName: string) => string;
+/**
 * Endpoint path both dev hosts mount the handler at. A sibling of the schema
 * editor's `/__lunora/schema-edit`; the double underscore keeps it clear of the
 * CLI's `/_lunora/*` worker proxy (single underscore).
@@ -224,4 +256,4 @@ type LocalEndpointHandler = (request: LocalEndpointRequest) => LocalEndpointResp
 * `400`; an unexpected throw (e.g. the body-size guard) is a `500`.
 */
 declare const serveJsonHandler: (request: IncomingMessage, response: ServerResponse, handle: LocalEndpointHandler, projectRoot: string) => void;
-export { type LocalEndpointHandler, type LocalEndpointRequest, type LocalEndpointResponse, POLICY_SCAFFOLD_ENDPOINT, type PolicyScaffoldBody, type PolicyScaffoldRequest, type PolicyScaffoldResponse, SCHEMA_EDIT_ENDPOINT, SEED_ENDPOINT, type SchemaEditRequest, type SchemaEditResponse, type SeedRequest, type SeedRequestBody, type SeedResponse, type StudioAssets, type StudioHtmlConfig, type WarnLogger, type WirePolicyEdit, handlePolicyScaffoldRequest, handleSchemaEditRequest, handleSeedRequest, loadStudioAssets, parseDevVariable, renderStudioHtml, resolveAdminToken, serveJsonHandler, studioAssetsStamp };
+export { type LocalEndpointHandler, type LocalEndpointRequest, type LocalEndpointResponse, POLICY_SCAFFOLD_ENDPOINT, type PolicyScaffoldBody, type PolicyScaffoldRequest, type PolicyScaffoldResponse, SCHEMA_EDIT_ENDPOINT, SEED_ENDPOINT, type SchemaEditRequest, type SchemaEditResponse, type SeedRequest, type SeedRequestBody, type SeedResponse, type StudioAssets, type StudioHtmlConfig, type WarnLogger, type WirePolicyEdit, assetContentType, handlePolicyScaffoldRequest, handleSchemaEditRequest, handleSeedRequest, isStandaloneModulePath, loadStudioAssets, parseDevVariable, readStandaloneAsset, renderStudioHtml, resolveAdminToken, resolveStandaloneDirectory, serveJsonHandler, studioAssetsStamp };

package/dist/studio-host/index.mjs

@@ -1,5 +1,5 @@
 export { parseDevVariable, resolveAdminToken } from '../packem_shared/parseDevVariable-CJiq2IwE.mjs';
-export { default as loadStudioAssets, studioAssetsStamp } from '../packem_shared/loadStudioAssets-Csk5RS4E.mjs';
+export { assetContentType, isStandaloneModulePath, loadStudioAssets, readStandaloneAsset, resolveStandaloneDirectory, studioAssetsStamp } from '../packem_shared/assetContentType-ByZjeV3D.mjs';
 export { POLICY_SCAFFOLD_ENDPOINT, handlePolicyScaffoldRequest } from '../packem_shared/POLICY_SCAFFOLD_ENDPOINT-CiC2IGKx.mjs';
 export { default as renderStudioHtml } from '../packem_shared/renderStudioHtml-449Ysn75.mjs';
 export { SCHEMA_EDIT_ENDPOINT, handleSchemaEditRequest } from '../packem_shared/SCHEMA_EDIT_ENDPOINT-Df-Wrix-.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/config",
-  "version": "1.0.0-alpha.43",
+  "version": "1.0.0-alpha.44",
   "description": "Internal shared CLI + Vite config layer for Lunora: wrangler.jsonc validation, binding inference, and .dev.vars scaffolding",
   "keywords": [
     "bindings",
@@ -60,7 +60,7 @@
     "ts-morph": "^28.0.0"
   },
   "peerDependencies": {
-    "@lunora/studio": "1.0.0-alpha.29"
+    "@lunora/studio": "1.0.0-alpha.30"
   },
   "peerDependenciesMeta": {
     "@lunora/studio": {

package/dist/packem_shared/loadStudioAssets-Csk5RS4E.mjs

@@ -1,28 +0,0 @@
-import { readFileSync, statSync } from 'node:fs';
-import { createRequire } from 'node:module';
-
-const loadStudioAssets = (logger, resolveFrom = import.meta.url) => {
-  try {
-    const require = createRequire(resolveFrom);
-    return {
-      script: readFileSync(require.resolve("@lunora/studio/standalone/studio.js")),
-      styles: readFileSync(require.resolve("@lunora/studio/styles.css"))
-    };
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    logger?.warnOnce?.(`[lunora] studio assets unavailable (build @lunora/studio?): ${message}`);
-    return void 0;
-  }
-};
-const studioAssetsStamp = (resolveFrom = import.meta.url) => {
-  try {
-    const require = createRequire(resolveFrom);
-    const scriptMtime = statSync(require.resolve("@lunora/studio/standalone/studio.js")).mtimeMs;
-    const stylesMtime = statSync(require.resolve("@lunora/studio/styles.css")).mtimeMs;
-    return Math.max(scriptMtime, stylesMtime);
-  } catch {
-    return void 0;
-  }
-};
-
-export { loadStudioAssets as default, studioAssetsStamp };