@nuasite/cms 0.36.1 → 0.37.0

package/dist/editor.js

@@ -381,7 +381,7 @@ function PS(t, e) {
 function LS(t, e) {
   return typeof e == "function" ? e(t) : e;
 }
-const o3 = "0.36.1", a3 = o3, nt = {
+const o3 = "0.37.0", a3 = o3, nt = {
   /** Highlight overlay for hovered elements */
   HIGHLIGHT: 2147483644,
   /** Hover outline for elements/components */

package/package.json

@@ -14,7 +14,7 @@
     "directory": "packages/astro-cms"
   },
   "license": "Apache-2.0",
-  "version": "0.36.1",
+  "version": "0.37.0",
   "module": "src/index.ts",
   "types": "src/index.ts",
   "type": "module",

package/src/dev-middleware.ts

@@ -57,6 +57,12 @@ export const expectedDeletions = new Set<string>()
 export interface DevMiddlewareOptions {
 	enableCmsApi?: boolean
 	mediaAdapter?: MediaStorageAdapter
+	/**
+	 * Predicate that returns true for request URLs which should bypass CMS rewriting
+	 * (typically vendor HTML under Astro's publicDir whose inline scripts can be
+	 * corrupted by injected markers).
+	 */
+	isPublicStaticFile?: (urlPath: string) => boolean
 }
 
 export function createDevMiddleware(
@@ -67,6 +73,8 @@ export function createDevMiddleware(
 	idCounter: { value: number },
 	options: DevMiddlewareOptions = {},
 ) {
+	const isPublicStaticFile = options.isPublicStaticFile ?? (() => false)
+
 	// Serve uploaded media files directly from disk.
 	// Vite's public dir middleware caches file listings, so newly uploaded files
 	// may not be available immediately. This middleware bypasses that cache.
@@ -244,9 +252,17 @@ export function createDevMiddleware(
 
 	// Transform HTML responses — only buffer when Content-Type is text/html
 	server.middlewares.use((req, res, next) => {
+		const requestUrl = req.url || 'unknown'
+
+		// Vendor HTML under publicDir is passed through untouched — the CMS rewriter
+		// can corrupt files with inline-script patterns it doesn't expect.
+		if (isPublicStaticFile(requestUrl)) {
+			next()
+			return
+		}
+
 		const originalWrite = res.write
 		const originalEnd = res.end
-		const requestUrl = req.url || 'unknown'
 		let chunks: Buffer[] | null = null
 		let isHtml: boolean | null = null
 

package/src/index.ts

@@ -15,6 +15,7 @@ import { createLocalStorageAdapter } from './media/local'
 import type { MediaStorageAdapter } from './media/types'
 import { rehypeCmsMarker } from './rehype-cms-marker'
 import type { CmsFeatures, CmsMarkerOptions, ComponentDefinition } from './types'
+import { createPublicStaticFileChecker } from './utils'
 import { createVitePlugin } from './vite-plugin'
 
 export interface NuaCmsOptions extends CmsMarkerOptions {
@@ -100,6 +101,7 @@ export default function nuaCms(options: NuaCmsOptions = {}): AstroIntegration {
 		: cmsConfig
 
 	let componentDefinitions: Record<string, ComponentDefinition> = {}
+	let isPublicStaticFile: ((urlPath: string) => boolean) | undefined
 
 	const idCounter = { value: 0 }
 	const manifestWriter = new ManifestWriter(manifestFile, componentDefinitions)
@@ -306,6 +308,10 @@ export default function nuaCms(options: NuaCmsOptions = {}): AstroIntegration {
 				})
 			},
 
+			'astro:config:done': ({ config }) => {
+				isPublicStaticFile = createPublicStaticFileChecker(fileURLToPath(config.publicDir))
+			},
+
 			'astro:server:setup': ({ server, logger }) => {
 				createDevMiddleware(
 					server,
@@ -313,7 +319,7 @@ export default function nuaCms(options: NuaCmsOptions = {}): AstroIntegration {
 					manifestWriter,
 					componentDefinitions,
 					idCounter,
-					{ enableCmsApi, mediaAdapter },
+					{ enableCmsApi, mediaAdapter, isPublicStaticFile },
 				)
 				logger.info('CMS dev middleware initialized')
 				if (enableCmsApi) {
@@ -418,3 +424,4 @@ export type {
 	TextStyleValue,
 	TwitterCardData,
 } from './types'
+export { createPublicStaticFileChecker } from './utils'

package/src/utils.ts

@@ -1,8 +1,49 @@
 import { createHash } from 'node:crypto'
+import { statSync } from 'node:fs'
 import path from 'node:path'
 import { getProjectRoot } from './config'
 import type { ManifestEntry } from './types'
 
+/**
+ * Build a checker that decides whether a request URL maps to an existing file
+ * under Astro's `publicDir`. Used to bypass HTML rewriting for vendor pages
+ * whose inline scripts can be corrupted by injected markers or content-length
+ * mismatches.
+ *
+ * Cache lives for the dev server's lifetime; vendor HTML is essentially static,
+ * and the cache is cleared on restart.
+ */
+export function createPublicStaticFileChecker(publicDir: string | undefined): (urlPath: string) => boolean {
+	if (!publicDir) return () => false
+	const cache = new Map<string, boolean>()
+
+	return (urlPath: string) => {
+		const cleaned = urlPath.split('?')[0] || ''
+		if (!cleaned.startsWith('/') || cleaned.includes('..')) return false
+
+		const cached = cache.get(cleaned)
+		if (cached !== undefined) return cached
+
+		const candidates = [path.join(publicDir, cleaned)]
+		if (cleaned.endsWith('/')) {
+			candidates.push(path.join(publicDir, cleaned, 'index.html'))
+		}
+
+		let exists = false
+		for (const p of candidates) {
+			try {
+				if (statSync(p).isFile()) {
+					exists = true
+					break
+				}
+			} catch {}
+		}
+
+		cache.set(cleaned, exists)
+		return exists
+	}
+}
+
 /**
  * Normalize a page path by removing query strings, hashes, and trailing slashes.
  * Handles both full URLs and plain pathnames.