@mapled/cli 0.14.1 → 0.14.2

package/README.md

@@ -256,7 +256,7 @@ npx @mapled/cli preview
 npx @mapled/cli preview articles hello-world
 ```
 
-Prints a Preview link — the one the **Preview** button in Mapled opens: the site in draft mode, with every saved change that isn't published yet. Name a collection and a record's slug (or id) and the link lands on the record's page, the one the pushed site manifest says shows it; a collection alone opens the page that lists it, a single its page, nothing at all the home page. Mapled makes the link after checking that the site answers and mounts its preview route; it works once, for five minutes. `--open` opens it in your browser instead of printing it; `--json` prints the link with the page and when it expires.
+Prints a Preview link — the one the **Preview** button in Mapled opens: the site in draft mode, with every saved change that isn't published yet. Name a collection and a record's slug (or id) and the link lands on the record's page, the one the pushed site manifest says shows it; a collection alone opens the page that lists it, a single its page, nothing at all the home page. Mapled makes the link after checking that the site answers and mounts its preview route; it works once, for five minutes. A plain HTML site whose pages are built with the content in them has no page for a record it wasn't built with: for such a record the command says so instead of printing a link — its page appears once the site is built with it. `--open` opens it in your browser instead of printing it; `--json` prints the link with the page and when it expires.
 
 ## Options
 

package/dist/commands.js

@@ -507,6 +507,11 @@ export async function preview(ctx, flags, words) {
     if (answer.status === "not_set_up") {
         throw new CliError(`${clean(answer.origin)} has no preview route — mount createPreviewHandler from "@mapled/next/server" at /api/mapled/preview and redeploy.`);
     }
+    if (answer.status === "no_route") {
+        // a site with its content baked in at build time has no page for a record it wasn't built with (§22.7 п. 3)
+        const where = answer.path ? `at ${clean(answer.path, 500)}` : "for this record";
+        throw new CliError(`${clean(answer.origin)} has no page ${where} — if the record is new, its page appears once the site is built with it. Then try again.`);
+    }
     // the link is printed as it came (masking would drop the token): printable ASCII only
     if (typeof answer.url !== "string" || !/^https?:\/\/[!-~]+$/.test(answer.url)) {
         throw new CliError("Mapled answered with a link this CLI can't print. Update @mapled/cli and try again.");

package/dist/html5.d.ts

@@ -18,11 +18,21 @@ import { type Token, type TreeAdapter, type TreeAdapterTypeMap } from "parse5";
       before a <table>: indexOf), the adoption agency (a misnested </b>:
       splice from the front) and repeated <html>/<body> tags (every
       attribute so far) walk them — 160,000 "a<br>" in a table: 11 s.
-    The worst page within the cap is the depth times its start tags. */
+    The worst page within the cap is the depth times its start tags.
+
+    parse5 can't read a numeric character reference of 309 or more decimal
+    digits, or of 256 or more hex ones, at all: BadReference. */
 /** How deep elements may be open at once — Chrome's own limit of the tree it builds. */
 export declare const MAX_OPEN = 512;
 export declare class TooDeep extends Error {
 }
+/** A numeric character reference parse5 can't read: its decoder (entities)
+    multiplies by 10 or 16 to the power of the digits — Infinity past 308
+    decimal or 255 hex ones — and 0 × Infinity is NaN, on which parse5
+    throws RangeError. Browsers read it as a character. The same guard is
+    in the preview proxy's reader (apps/api/src/lib/previewProxyHtml.ts). */
+export declare class BadReference extends Error {
+}
 export type Html5Attr = Token.Attribute;
 /** A node of the tree: an element (tagName), text, a comment, a doctype,
     the document or a template's content — children linked both ways. Its
@@ -61,6 +71,7 @@ type Map_ = TreeAdapterTypeMap<Html5Node, Html5Node, Html5Node, Html5Node, Html5
 /** parse5's default tree adapter, method for method, on linked children. */
 export declare const linked: TreeAdapter<Map_>;
 /** The document, with scripting on — as the runtime sees it (a <noscript>
-    is text). Throws TooDeep past MAX_OPEN open elements. */
+    is text). Throws TooDeep past MAX_OPEN open elements, BadReference at a
+    numeric character reference parse5 can't read. */
 export declare function parseDocument(text: string): Html5Node;
 export {};

package/dist/html5.js

@@ -7853,6 +7853,9 @@ var VOID_ELEMENTS = /* @__PURE__ */ new Set([
 var MAX_OPEN = 512;
 var TooDeep = class extends Error {
 };
+var BadReference = class extends Error {
+};
+var isCodePoint = (cp) => Number.isInteger(cp) && cp >= 0 && cp <= 1114111;
 var Html5Node = class {
   constructor(nodeName, extra = {}) {
     this.nodeName = nodeName;
@@ -7991,6 +7994,11 @@ var Guarded = class extends Parser {
       names.add(this.currentAttr.name);
       tag.attrs.push(this.currentAttr);
     };
+    const reference = tokenizer._flushCodePointConsumedAsCharacterReference;
+    tokenizer._flushCodePointConsumedAsCharacterReference = function(cp) {
+      if (!isCodePoint(cp)) throw new BadReference();
+      reference.call(this, cp);
+    };
   }
   onItemPush(...args) {
     if (this.openElements.stackTop >= MAX_OPEN) throw new TooDeep();
@@ -8001,6 +8009,7 @@ function parseDocument(text) {
   return Guarded.parse(text, { scriptingEnabled: true, treeAdapter: linked });
 }
 export {
+  BadReference,
   Html5Node,
   MAX_OPEN,
   TooDeep,

package/dist/report.d.ts

@@ -122,6 +122,10 @@ export type PreviewAnswer = {
     status: "not_set_up";
     origin: string;
     path: string | null;
+} | {
+    status: "no_route";
+    origin: string;
+    path: string | null;
 };
 /** "5 minutes" until the link stops working, or null when unknown. */
 export declare function linkLifetime(expiresAt: string | undefined, now?: number): string | null;

package/dist/scanHtml.d.ts

@@ -20,7 +20,8 @@ export type HtmlElement = {
 };
 /** The elements of a page and their attributes — parse5's tree (html5.ts),
     a <template>'s children being its content. Built without recursion:
-    a page nests up to MAX_OPEN elements, deeper throws TooDeep. */
+    a page nests up to MAX_OPEN elements, deeper throws TooDeep; a
+    numeric character reference parse5 can't read throws BadReference. */
 export declare function parseHtml(text: string): HtmlElement;
 /** Where a file is served and the key its bindings start with:
     index.html → "/" (index), blog/index.html → "/blog/" (blog/index),

package/dist/scanHtml.js

@@ -1,13 +1,14 @@
 import { createHash } from "node:crypto";
 import { readdir, readFile } from "node:fs/promises";
 import path from "node:path";
-import { MAX_OPEN, parseDocument, TooDeep } from "./html5.js";
+import { BadReference, MAX_OPEN, parseDocument, TooDeep } from "./html5.js";
 import { targetFor } from "./manifest.js";
 const HTML_NS = "http://www.w3.org/1999/xhtml";
 const MAX_DEPTH = MAX_OPEN;
 /** The elements of a page and their attributes — parse5's tree (html5.ts),
     a <template>'s children being its content. Built without recursion:
-    a page nests up to MAX_OPEN elements, deeper throws TooDeep. */
+    a page nests up to MAX_OPEN elements, deeper throws TooDeep; a
+    numeric character reference parse5 can't read throws BadReference. */
 export function parseHtml(text) {
     const root = { name: "#document", attrs: new Map(), children: [] };
     const pending = [[parseDocument(text), root]];
@@ -148,6 +149,7 @@ export async function scanHtml(dir, opts) {
     const noTemplate = [];
     const unusableRoutes = [];
     const tooDeep = [];
+    const badReferences = [];
     const notGroups = [];
     const seenRoutes = new Set();
     const pageKeys = new Set();
@@ -170,9 +172,12 @@ export async function scanHtml(dir, opts) {
             doc = parseHtml(text);
         }
         catch (e) {
-            if (!(e instanceof TooDeep))
+            if (e instanceof TooDeep)
+                tooDeep.push(file);
+            else if (e instanceof BadReference)
+                badReferences.push(file);
+            else
                 throw e;
-            tooDeep.push(file);
             continue;
         }
         seenRoutes.add(served);
@@ -422,6 +427,8 @@ export async function scanHtml(dir, opts) {
         notes.push(`A list or an each without a <template> isn't filled: ${list(noTemplate)}.`);
     if (tooDeep.length > 0)
         notes.push(`Elements nest deeper than ${MAX_OPEN} levels, so the scan didn't read ${count(tooDeep) === 1 ? "this page" : "these pages"}: ${list(tooDeep)}.`);
+    if (badReferences.length > 0)
+        notes.push(`A numeric character reference (&#…;) is too long to read, so the scan didn't read ${count(badReferences) === 1 ? "this page" : "these pages"}: ${list(badReferences)}.`);
     if (unusableRoutes.length > 0)
         notes.push(`Preview can't open ${count(unusableRoutes) === 1 ? "this address" : "these addresses"} — rename the file or the slug parameter: ${list(unusableRoutes)}.`);
     // keys within the manifest's 120 characters, and still one per binding

package/dist/types.js

@@ -153,7 +153,9 @@ function renderedField(field, owner, names, extras) {
     if (field.type === "computed" && field.computed) {
         return { required: false, rendered: computedType(field.computed.resultType) };
     }
-    return { required: field.required, rendered: scalarType(field.type, field.options) };
+    const scalar = scalarType(field.type, field.options);
+    // translated (§28.2): one language per read — `locale` on the read picks it
+    return { required: field.required, rendered: field.localized === true ? { ...scalar, note: `${scalar.note}, translated` } : scalar };
 }
 /** Unique type names: the singular PascalCase of the key; the raw
     PascalCase when two keys meet there; a numeric suffix as a last resort. */

package/dist/vanillaDigests.js

@@ -8,4 +8,7 @@
 export const VANILLA_DIGESTS = {
     "0.1.0": "sha384-mbuMcQAueviAbkTzgvxc8oDtspuYH6lFLUgE+gocGexnI8ehgSgdjnNMNL7JPk4q",
     "0.1.1": "sha384-2vgQ4g9re/eiYxEa/H3WKpWI5C9L4wCB/62c8Kq+LOfZDzmqc2ozqMGC8mZoOUqk",
+    "0.1.2": "sha384-bhIJoFuEGouAZtHbYeNZeN0m6fqFVWpQw+YkSMJhfk/7m5bUwS/qVWZ3xczw/1du",
+    "0.2.0": "sha384-HJ5XG9AhAlbKe6jPRVaef3whiVup/5WhprMwqC6RwWhpq6Pb0OsRLzbLmLJ8WH0f",
+    "0.2.1": "sha384-6apTHYxXrozzwFCqNU+70Z9pa/FDnhArNomcKQNWbeKRX4scjFiOc9d7wWKCOvTU",
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mapled/cli",
-  "version": "0.14.1",
+  "version": "0.14.2",
   "description": "Mapled CLI — sign in, link a project, generate TypeScript types for its content, create forms, preview drafts and check the site's integration.",
   "license": "MIT",
   "homepage": "https://mapled.io",