@muhkoo/connect 0.12.2-alpha.0 → 0.13.1-alpha.0

package/dist/browser/index.js

@@ -5327,7 +5327,7 @@ function base64UrlDecode(s) {
  * expect (and isn't serving a stale cached bundle). Keep this in sync with
  * `package.json` `version`.
  */
-const VERSION = "0.12.2-alpha.0";
+const VERSION = "0.13.1-alpha.0";
 
 /**
  * `HttpClient` — the one place the unified {@link Client} talks to the
@@ -12030,13 +12030,40 @@ function isUnder(path, dir) {
  * directory on the next lookup — a file literally named `..` could never be
  * addressed again.
  */
+/** The longest a single entry name may be. Matches the common filesystem limit. */
+const MAX_NAME_BYTES = 255;
+/**
+ * Is this a name we are willing to store, and to hand back as a path segment?
+ *
+ * This is the READ-side check as much as the write-side one, and the read side
+ * is the one that matters: a directory record is sealed with a key that any
+ * holder of the master seed can derive, so its contents are not necessarily
+ * something this SDK wrote. A name arriving from a record is input.
+ *
+ * What each rule is for:
+ *  - `/` and backslash would become path structure. Backslash is a separator on
+ *    Windows, which makes it traversal there and an odd filename elsewhere.
+ *  - `.` and `..` navigate rather than name.
+ *  - NUL terminates a path in every syscall that takes one.
+ *  - Other control characters and bidi overrides let a name print as something
+ *    other than what it is - the classic way a file passes review.
+ *  - A length cap, because nothing else imposes one.
+ */
+function isSafeName(name) {
+    if (!name || name === "." || name === "..")
+        return false;
+    if (name.includes("/") || name.includes(String.fromCharCode(92)))
+        return false;
+    const CONTROL_OR_BIDI = new RegExp("[\\u0000-\\u001f\\u007f-\\u009f\\u202a-\\u202e\\u2066-\\u2069]");
+    if (CONTROL_OR_BIDI.test(name))
+        return false;
+    return new TextEncoder().encode(name).length <= MAX_NAME_BYTES;
+}
 function assertValidName(name) {
     if (!name)
         throw new Error("VFS: name cannot be empty");
-    if (name === "." || name === "..")
-        throw new Error(`VFS: "${name}" is not a usable name`);
-    if (name.includes("/"))
-        throw new Error(`VFS: name cannot contain "/" (got ${JSON.stringify(name)})`);
+    if (!isSafeName(name))
+        throw new Error(`VFS: ${JSON.stringify(name)} is not a usable name`);
 }
 /**
  * MIME type for a filename.
@@ -12148,6 +12175,40 @@ function escapeLiteral(s) {
  * cost storage until a future sweep, which is the trade this shape makes in
  * exchange for single-record writes.
  */
+/**
+ * How deep a tree may be before we stop walking it.
+ *
+ * Well past anything a real project needs, and low enough that a malformed or
+ * hostile record cannot spend the caller's memory before the cycle guard sees a
+ * repeat.
+ */
+const MAX_DEPTH = 64;
+/**
+ * How many directories `walk` lists at once.
+ *
+ * Enough to hide per-request latency on a wide tree; low enough that a big
+ * project does not open a request per directory. Browsers cap concurrency per
+ * origin anyway, so a larger number mostly moves the queue.
+ */
+const WALK_CONCURRENCY = 8;
+/**
+ * `Promise.all` with a ceiling, preserving input order.
+ *
+ * Results are written back BY INDEX rather than pushed as they settle, so the
+ * output order matches the input regardless of which finishes first — which is
+ * what lets `walk` parallelise without changing what it returns.
+ */
+async function mapLimit(items, limit, fn) {
+    if (items.length <= 1)
+        return items.length ? [await fn(items[0])] : [];
+    const out = new Array(items.length);
+    let next = 0;
+    await Promise.all(Array.from({ length: Math.min(limit, items.length) }, async () => {
+        for (let i = next++; i < items.length; i = next++)
+            out[i] = await fn(items[i]);
+    }));
+    return out;
+}
 const DEFAULT_HISTORY_LIMIT = 20;
 class VfsNamespace {
     deps;
@@ -12276,9 +12337,29 @@ class VfsNamespace {
         const dir = await this.openDir(path);
         const base = this.resolve(path);
         return Object.entries(dir.node.entries)
+            // Validate the name HERE, where it is read.
+            //
+            // A directory record is sealed under a key derivable from the master
+            // seed, so its contents are not necessarily something this SDK
+            // wrote, and the write-side check never sees them. An unusable name
+            // is dropped rather than thrown on: one bad entry must not make the
+            // whole directory unlistable, and callers walk this output straight
+            // into filesystem paths.
+            .filter(([name]) => {
+            if (isSafeName(name))
+                return true;
+            this.warn(`ignoring entry with an unusable name in ${base}`);
+            return false;
+        })
             .map(([name, entry]) => toStat(join(base, name), name, entry))
             .sort(byDirsThenName);
     }
+    warn(message) {
+        // Kept quiet by default in a browser console that the user cannot act
+        // on, but never silent: a dropped entry is a real difference between
+        // what is stored and what is shown.
+        console.warn(`[muhkoo/vfs] ${message}`);
+    }
     /**
      * Every file path under a prefix, depth-first.
      *
@@ -12286,17 +12367,40 @@ class VfsNamespace {
      * one fetch per directory. Fine for a project, wrong as a default.
      */
     async walk(path = ".") {
-        const out = [];
-        const visit = async (dirPath) => {
-            for (const entry of await this.list(dirPath)) {
-                if (entry.kind === "dir")
-                    await visit(entry.path);
-                else
-                    out.push(entry.path);
-            }
+        /**
+         * Sibling directories are listed CONCURRENTLY.
+         *
+         * Each `list` is a round trip for one directory record, and walking them
+         * one after another cost the sum of those latencies: measured against a
+         * real project, the walk alone was 1–2.1s before a single file had been
+         * read. Directories are independent, so there was never a reason to
+         * queue them.
+         *
+         * Order is preserved exactly. Each entry maps to its own slice of the
+         * result and the slices are concatenated in listing order, so the output
+         * is identical to the depth-first version — callers and tests that
+         * depend on it are unaffected, and only the timing changes.
+         */
+        const seen = new Set();
+        const visit = async (dirPath, depth) => {
+            if (depth > MAX_DEPTH) {
+                this.warn(`stopping at ${dirPath}: deeper than ${MAX_DEPTH} levels`);
+                return [];
+            }
+            // Claimed BEFORE the first await, so two concurrent visits to the
+            // same directory cannot both get past this. A record whose entry
+            // points back at an ancestor would otherwise recurse forever, and
+            // nothing in the format prevents one.
+            if (seen.has(dirPath)) {
+                this.warn(`stopping at ${dirPath}: already visited (the tree contains a cycle)`);
+                return [];
+            }
+            seen.add(dirPath);
+            const entries = await this.list(dirPath);
+            const slices = await mapLimit(entries, WALK_CONCURRENCY, async (entry) => entry.kind === "dir" ? visit(entry.path, depth + 1) : [entry.path]);
+            return slices.flat();
         };
-        await visit(this.resolve(path));
-        return out;
+        return visit(this.resolve(path), 0);
     }
     async readFile(path) {
         const entry = await this.expectFile(path);
@@ -12568,6 +12672,12 @@ class VfsNamespace {
         const root = await this.root();
         const reachable = new Set();
         const visit = async (dir) => {
+            // `reachable` was already the visited set - it just was not being
+            // TESTED before recursing, so a cycle looped forever. Here the
+            // consequence would have been worse than a hang: sweep decides what
+            // to delete, and it never got as far as deciding.
+            if (reachable.has(dirKey(dir.id)))
+                return;
             reachable.add(dirKey(dir.id));
             for (const entry of Object.values(dir.node.entries)) {
                 if (entry.kind === "dir") {
@@ -12725,10 +12835,16 @@ class VfsNamespace {
         });
     }
     /** Recursively remove a subtree's records. Best-effort: unreachable ≠ fatal. */
-    async purge(dir) {
+    async purge(dir, seen = new Set()) {
+        // A record that references an ancestor would otherwise recurse forever:
+        // the id is only removed from the cache AFTER the loop, so re-entering
+        // it hits the same cached record every time.
+        if (seen.has(dir.id))
+            return;
+        seen.add(dir.id);
         for (const entry of Object.values(dir.node.entries)) {
             if (entry.kind === "dir") {
-                await this.purge(await this.openDirById(entry.id, fromBase64(entry.key)));
+                await this.purge(await this.openDirById(entry.id, fromBase64(entry.key)), seen);
             }
             else {
                 await this.releaseFile(dir, entry);
@@ -12742,18 +12858,32 @@ class VfsNamespace {
      * directory gets a fresh id and key, so the copy is independent of the
      * original — writing into one must never appear in the other.
      */
-    async cloneEntry(entry) {
+    async cloneEntry(entry, seen = new Set()) {
         if (entry.kind === "file") {
             // Same bytes, second owner: take a reference so deleting either one
             // leaves the other readable.
             await this.deps.content.retain(entry.manifest);
             return { kind: "file", id: newId(), manifest: entry.manifest, size: entry.size, mtime: Date.now(), versions: 0 };
         }
+        // The most expensive walker to leave unguarded: it mints a NEW id, key
+        // and stored record at every level, so a cyclic tree does not merely
+        // hang - it writes records to the store, and to the user's bill, in an
+        // unbounded loop.
+        if (seen.has(entry.id) || seen.size > MAX_DEPTH) {
+            throw new VfsConflictError("VFS: refusing to copy a directory that contains a cycle");
+        }
+        seen.add(entry.id);
         const source = await this.openDirById(entry.id, fromBase64(entry.key));
         const clone = { kind: "dir", id: newId(), key: toBase64(newDirKey()), mtime: Date.now() };
         const node = { v: 1, entries: {}, mtime: Date.now() };
         for (const [name, child] of Object.entries(source.node.entries)) {
-            node.entries[name] = await this.cloneEntry(child);
+            // Names are validated on read everywhere else; a copy must not be
+            // the way a bad one is carried into a fresh record.
+            if (!isSafeName(name)) {
+                this.warn(`skipping entry with an unusable name while copying`);
+                continue;
+            }
+            node.entries[name] = await this.cloneEntry(child, seen);
         }
         const open = { id: clone.id, key: fromBase64(clone.key), node };
         await this.deps.store.put(dirKey(open.id), await seal(open.key, node));