@manifest-configuration-language/browser 0.1.4 → 0.1.6

package/README.md

@@ -29,7 +29,7 @@ Project files can be UTF-8 strings or `Uint8Array` values. UTF-8 files remain in
 
 The package exports the completion, definition, and hover result types, `maxSourceBytes`, `maxProjectFiles`, `maxProjectFileBytes`, and `maxProjectBytes` so browser interfaces can consume the runtime's public types and limits.
 
-MCL decodes the request into a root-relative `io/fs` filesystem for project files, module imports, schemas, resource catalogs, and dependency locks. The runtime limits are defined in the [protocol schema](https://github.com/manifest-configuration-language/mcl/blob/main/cmd/mcl-wasm/protocol.schema.json). The worker blocks `fetch` after loading the WASM runtime assets, so MCL project evaluation cannot make external network requests.
+MCL decodes the request into a root-relative `io/fs` filesystem for project files, module imports, schemas, and dependency locks. Kubernetes resource scope checks use built-in metadata and CRDs in the project; unknown resource kinds can still be rendered. The runtime limits are defined in the [protocol schema](https://github.com/manifest-configuration-language/mcl/blob/main/cmd/mcl-wasm/protocol.schema.json). The worker blocks `fetch` after loading the WASM runtime assets, so MCL project evaluation cannot make external network requests.
 
 The wire format is described in [`protocol.schema.json`](https://github.com/manifest-configuration-language/mcl/blob/main/cmd/mcl-wasm/protocol.schema.json). Go protocol models are generated with `go generate ./cmd/mcl-wasm`, and the browser package declarations are generated with `npm run generate:protocol`. The browser API declarations reuse the generated operation, diagnostic, and result types. MCL decodes each request into a root-relative `io/fs` project filesystem. Kustomize project overlays and locked Git archives use kyaml's in-memory filesystem, and Helm source loading accepts an `io/fs` filesystem. The Go `wasm_exec.js` runtime supplies its standard browser fallbacks for process, path, and stdout APIs; the Browser SDK does not provide a Node-style project filesystem or require Node polyfills in Vite.
 

package/dist/mcl.wasm

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/dist/mcl.wasm
-size: 96219418 bytes
-sha256: c3cd77de141c61f1a424f86d6c539d2d87cd3af5b0a745420b0cdea2c9f8b96a
+size: 96170429 bytes
+sha256: d08ad3914d8a2862e52db7dbc3ec43c38c1143dea99dda6c87383c7d59212c7d

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@manifest-configuration-language/browser",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Run MCL projects in a browser Web Worker using the Go WebAssembly runtime.",
   "repository": {
     "type": "git",

package/src/index.d.ts

@@ -24,6 +24,9 @@ export declare const maxSourceBytes: number;
 export declare const maxProjectFiles: number;
 export declare const maxProjectFileBytes: number;
 export declare const maxProjectBytes: number;
+export declare const maxProjectPathLength: number;
+export declare const maxProjectPathDepth: number;
+export declare function isValidProjectPath(path: unknown): path is string;
 
 /** Root-relative project files passed to MCL's per-request filesystem. Uint8Array values are copied before transfer so callers can reuse them. */
 export type ProjectFile = string | Uint8Array;

package/src/index.js

@@ -1,6 +1,27 @@
-import { maxProjectBytes, maxProjectFileBytes, maxProjectFiles, maxSourceBytes } from "./limits.js";
+import {
+  maxProjectBytes,
+  maxProjectFileBytes,
+  maxProjectFiles,
+  maxProjectPathDepth,
+  maxProjectPathLength,
+  maxSourceBytes,
+} from "./limits.js";
 
-export { maxProjectBytes, maxProjectFileBytes, maxProjectFiles, maxSourceBytes };
+export { maxProjectBytes, maxProjectFileBytes, maxProjectFiles, maxProjectPathDepth, maxProjectPathLength, maxSourceBytes };
+
+export function isValidProjectPath(value) {
+  if (typeof value !== "string" || value.length === 0 || value.startsWith("/") ||
+    /^[a-z]:/i.test(value) || value.includes("\\") || value.includes("\0")) {
+    return false;
+  }
+  let pathLength = 0;
+  let pathDepth = 1;
+  for (const character of value) {
+    if (++pathLength > maxProjectPathLength) return false;
+    if (character === "/" && ++pathDepth > maxProjectPathDepth) return false;
+  }
+  return value.split("/").every((part) => part !== "" && part !== "." && part !== "..");
+}
 
 const defaultInitializationTimeoutMs = 30_000;
 const defaultOperationTimeoutMs = 10_000;
@@ -113,7 +134,8 @@ export function createMclRuntime(options = {}) {
       try {
         if (timeoutMs <= 0) throw timeoutError;
         timer = setTimeout(() => {
-          (stopCurrent ?? stopInitialization)?.(timeoutError);
+          if (stopCurrent) stopCurrent(timeoutError);
+          else stopInitialization?.(timeoutError);
         }, timeoutMs);
         await waitUntilReady(requestOptions.signal);
         if (requestOptions.signal?.aborted) throw new DOMException("The operation was aborted", "AbortError");
@@ -258,7 +280,7 @@ export function createMclRuntime(options = {}) {
   }
 
   function isSafeRelativePath(filePath) {
-    return typeof filePath === "string" && filePath.length > 0 && !/^[a-z]:/i.test(filePath) && !filePath.startsWith("/") && !filePath.includes("\\") && filePath.split("/").every((part) => part && part !== "." && part !== "..");
+    return isValidProjectPath(filePath);
   }
 
   function prepareFilesForTransfer(source, files, entrypoint) {

package/src/limits.js

@@ -5,3 +5,5 @@ export const maxProjectFileBytes = 16777216;
 export const maxProjectBytes = 67108864;
 export const maxOutputBytes = 1048576;
 export const evaluationTimeoutMillis = 4000;
+export const maxProjectPathLength = 512;
+export const maxProjectPathDepth = 64;

package/src/protocol.d.ts

@@ -6,10 +6,7 @@ export type Request = {
   revision?: number;
   operation: "parse" | "lint" | "format" | "check" | "evaluate" | "render" | "completion" | "definition" | "hover";
   position?: CompletionPosition;
-  /**
-   * Project-relative MCL source path. Defaults to main.mcl.
-   */
-  entrypoint?: string;
+  entrypoint?: ProjectPath;
   /**
    * UTF-8 entrypoint source, limited by the runtime.
    */
@@ -21,6 +18,10 @@ export type Request = {
     [k: string]: FileInput;
   };
 };
+/**
+ * Project-relative MCL source path. Defaults to main.mcl.
+ */
+export type ProjectPath = string;
 /**
  * Binary files omit content and are supplied in the optional second run argument under the same path.
  */