@ohos-ports/stacksjs-stx 0.2.287-beta.0

package/dist/safe-evaluator.js

@@ -0,0 +1,461 @@
+const defaultConfig = {
+  maxSanitizeDepth: 10,
+  allowBracketNotation: !1
+};
+let currentConfig = { ...defaultConfig };
+export function configureSafeEvaluator(config) {
+  currentConfig = { ...currentConfig, ...config };
+}
+export function resetSafeEvaluatorConfig() {
+  currentConfig = { ...defaultConfig };
+}
+export function getSafeEvaluatorConfig() {
+  return { ...currentConfig };
+}
+const _ALLOWED_GLOBALS = new Set([
+  "Math",
+  "parseInt",
+  "parseFloat",
+  "isNaN",
+  "isFinite",
+  "String",
+  "encodeURIComponent",
+  "decodeURIComponent",
+  "Array",
+  "Date",
+  "JSON",
+  "Number",
+  "Boolean"
+]), DANGEROUS_PATTERNS = [
+  /\b(eval|Function|setTimeout|setInterval|setImmediate)\b/,
+  /\b(process|require|import|exports|module)\b/,
+  /\b(window|document|global|globalThis)\b/,
+  /\b(constructor|prototype|__proto__)\b/,
+  /\b(Reflect|Proxy)\b/,
+  /\bSymbol\b/,
+  /\b(WeakMap|WeakSet|WeakRef|FinalizationRegistry)\b/,
+  /\b(Generator|AsyncGenerator)\b/,
+  /__\w+__/,
+  /\.(bind|call|apply)\s*\(/,
+  /\bnew\s+/,
+  /\bdelete\s+/,
+  /\bthis\b/
+], DANGEROUS_IDENTIFIERS = new Set([
+  "eval",
+  "Function",
+  "setTimeout",
+  "setInterval",
+  "setImmediate",
+  "process",
+  "require",
+  "import",
+  "exports",
+  "module",
+  "window",
+  "document",
+  "global",
+  "globalThis",
+  "constructor",
+  "prototype",
+  "Reflect",
+  "Proxy",
+  "Symbol",
+  "WeakMap",
+  "WeakSet",
+  "WeakRef",
+  "FinalizationRegistry",
+  "Generator",
+  "AsyncGenerator",
+  "delete",
+  "this"
+]), DANGEROUS_BRACKET_KEYS = new Set([
+  "__proto__",
+  "constructor",
+  "prototype"
+]), BRACKET_NOTATION_PATTERN = /[\w)\]]\s*\[\s*['"]/;
+function stripStringLiterals(expr) {
+  let result = "", inString = null, escaped = !1;
+  for (let i = 0;i < expr.length; i++) {
+    const ch = expr[i];
+    if (escaped) {
+      escaped = !1;
+      continue;
+    }
+    if (ch === "\\" && inString) {
+      escaped = !0;
+      continue;
+    }
+    if (inString) {
+      if (inString === "`" && ch === "$" && i + 1 < expr.length && expr[i + 1] === "{") {
+        let tplDepth = 1;
+        i += 2;
+        while (i < expr.length && tplDepth > 0) {
+          if (expr[i] === "{")
+            tplDepth++;
+          else if (expr[i] === "}")
+            tplDepth--;
+          if (tplDepth > 0) {
+            result += expr[i];
+            i++;
+          }
+        }
+        continue;
+      }
+      if (ch === inString)
+        inString = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") {
+      inString = ch;
+      continue;
+    }
+    result += ch;
+  }
+  return result;
+}
+function assertNoUnsafeIdentifierTokens(strippedExpression, originalExpression) {
+  const identifierRe = /[$A-Z_a-z][$\w]*/g;
+  let match;
+  while ((match = identifierRe.exec(strippedExpression)) !== null) {
+    const identifier = match[0], previous = strippedExpression[match.index - 1];
+    if (DANGEROUS_IDENTIFIERS.has(identifier))
+      throw Error(`Potentially unsafe expression (matched /\\b${identifier}\\b/; identifier ${identifier}): ${originalExpression}`);
+    if (previous === "." && DANGEROUS_BRACKET_KEYS.has(identifier))
+      throw Error(`Potentially unsafe expression (matched /.${identifier}/; property ${identifier}): ${originalExpression}`);
+  }
+}
+function assertSafeBracketLiteralKeys(expression) {
+  const bracketLiteralRe = /\[\s*(['"])(.*?)\1\s*\]/g;
+  let match;
+  while ((match = bracketLiteralRe.exec(expression)) !== null) {
+    const key = match[2];
+    if (!DANGEROUS_BRACKET_KEYS.has(key))
+      continue;
+    const previousNonSpace = expression.slice(0, match.index).match(/\S(?=\s*$)/)?.[0], nextNonSpace = expression.slice(match.index + match[0].length).match(/^\s*(\S)/)?.[1];
+    if (!((previousNonSpace === "{" || previousNonSpace === ",") && nextNonSpace === ":"))
+      throw Error(`Potentially unsafe expression (bracket key ${match[2]}): ${expression}`);
+  }
+}
+export function sanitizeExpression(expression) {
+  const trimmed = expression.trim(), stripped = stripStringLiterals(trimmed);
+  assertNoUnsafeIdentifierTokens(stripped, trimmed);
+  assertSafeBracketLiteralKeys(trimmed);
+  for (const pattern of DANGEROUS_PATTERNS)
+    if (pattern.test(stripped))
+      throw Error(`Potentially unsafe expression (matched /${pattern.source}/): ${trimmed}`);
+  if (!currentConfig.allowBracketNotation && BRACKET_NOTATION_PATTERN.test(trimmed))
+    throw Error(`Bracket notation with strings not allowed: ${trimmed}. Enable with configureSafeEvaluator({ allowBracketNotation: true })`);
+  return trimmed;
+}
+export function createSafeContext(context) {
+  const safeContext = {};
+  safeContext.Math = Math;
+  safeContext.JSON = JSON;
+  safeContext.Date = Date;
+  safeContext.String = String;
+  safeContext.Number = Number;
+  safeContext.Boolean = Boolean;
+  safeContext.Array = Array;
+  safeContext.parseInt = Number.parseInt;
+  safeContext.parseFloat = Number.parseFloat;
+  safeContext.isNaN = Number.isNaN;
+  safeContext.isFinite = Number.isFinite;
+  safeContext.encodeURIComponent = encodeURIComponent;
+  safeContext.decodeURIComponent = decodeURIComponent;
+  for (const [key, value] of Object.entries(context)) {
+    if (key.startsWith("__") || DANGEROUS_PATTERNS.some((p) => p.test(key)))
+      continue;
+    if (value && typeof value === "object" && !Array.isArray(value))
+      safeContext[key] = sanitizeObject(value);
+    else
+      safeContext[key] = value;
+  }
+  return safeContext;
+}
+function sanitizeObject(obj, depth = 0) {
+  if (depth >= currentConfig.maxSanitizeDepth)
+    return "[Object too deep]";
+  if (obj === null || typeof obj !== "object")
+    return obj;
+  if (Array.isArray(obj))
+    return obj.map((item) => sanitizeObject(item, depth + 1));
+  if (obj instanceof Date || obj instanceof RegExp || obj instanceof Map || obj instanceof Set || obj instanceof Error)
+    return obj;
+  const sanitized = {};
+  for (const [key, value] of Object.entries(obj)) {
+    if (key.startsWith("__") || key === "constructor" || key === "prototype")
+      continue;
+    if (value && typeof value === "object")
+      sanitized[key] = sanitizeObject(value, depth + 1);
+    else
+      sanitized[key] = value;
+  }
+  return sanitized;
+}
+export function safeEvaluate(expression, context) {
+  try {
+    const safeContext = createSafeContext(context), keys = Object.keys(safeContext), values = Object.values(safeContext);
+    return createSafeFunction(expression, keys)(...values);
+  } catch {
+    return;
+  }
+}
+export function isExpressionSafe(expression) {
+  try {
+    sanitizeExpression(expression);
+    return !0;
+  } catch {
+    return !1;
+  }
+}
+export function getExpressionSafetyReason(expression) {
+  try {
+    sanitizeExpression(expression);
+    return null;
+  } catch (e) {
+    return e instanceof Error ? e.message : String(e);
+  }
+}
+export function safeEvaluateCondition(expression, context) {
+  try {
+    const result = safeEvaluate(expression, context);
+    return Boolean(result);
+  } catch {
+    return !1;
+  }
+}
+export function safeEvaluateArray(expression, context) {
+  try {
+    const result = safeEvaluate(expression, context);
+    if (Array.isArray(result))
+      return result;
+    if (result && typeof result === "object" && "length" in result) {
+      const len = result.length;
+      if (typeof len === "number" && Number.isFinite(len) && len >= 0 && Number.isInteger(len))
+        return Array.from(result);
+    }
+    return [];
+  } catch {
+    return [];
+  }
+}
+export function safeEvaluateObject(expression, context) {
+  try {
+    const result = safeEvaluate(expression, context);
+    if (result && typeof result === "object" && !Array.isArray(result))
+      return result;
+    return {};
+  } catch {
+    return {};
+  }
+}
+const RESERVED_PARAM_NAMES = new Set([
+  "break",
+  "case",
+  "catch",
+  "class",
+  "const",
+  "continue",
+  "debugger",
+  "default",
+  "delete",
+  "do",
+  "else",
+  "enum",
+  "export",
+  "extends",
+  "false",
+  "finally",
+  "for",
+  "function",
+  "if",
+  "import",
+  "in",
+  "instanceof",
+  "new",
+  "null",
+  "return",
+  "super",
+  "switch",
+  "this",
+  "throw",
+  "true",
+  "try",
+  "typeof",
+  "var",
+  "void",
+  "while",
+  "with",
+  "yield",
+  "let",
+  "static",
+  "implements",
+  "interface",
+  "package",
+  "private",
+  "protected",
+  "public",
+  "arguments",
+  "eval",
+  "await"
+]), COMPILED_EXPRESSION_LIMIT = 2000, compiledExpressions = new Map;
+function compileFunctionBody(params, body) {
+  const key = `${params.join(",")}\x00${body}`, cached = compiledExpressions.get(key);
+  if (cached)
+    return cached;
+  const compiled = Function(...params, body);
+  if (compiledExpressions.size >= COMPILED_EXPRESSION_LIMIT)
+    compiledExpressions.clear();
+  compiledExpressions.set(key, compiled);
+  return compiled;
+}
+export function freeIdentifiers(expression) {
+  return expression.replace(/'(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*"|`(?:[^`\\]|\\.)*`/g, " ").replace(/\??\.\s*[a-zA-Z_$][\w$]*/g, " ").replace(/([{,]\s*)[a-zA-Z_$][\w$]*(\s*:)/g, "$1$2").match(/\b[a-zA-Z_$][\w$]*\b/g) || [];
+}
+const VALID_PARAM_IDENT = /^[A-Za-z_$][\w$]*$/;
+export function isUsableParamName(name) {
+  return VALID_PARAM_IDENT.test(name) && !RESERVED_PARAM_NAMES.has(name);
+}
+export function createSafeFunction(expression, contextKeys) {
+  const sanitizedExpr = sanitizeExpression(expression), validEntries = [];
+  for (let i = 0;i < contextKeys.length; i++) {
+    if (!isUsableParamName(contextKeys[i]))
+      continue;
+    validEntries.push({ key: contextKeys[i], index: i });
+  }
+  validEntries.sort((a, b) => a.key.localeCompare(b.key));
+  const filteredKeys = validEntries.map((entry) => entry.key), validIndices = validEntries.map((entry) => entry.index), buildFunc = (extraParams) => compileFunctionBody([...filteredKeys, ...extraParams], `
+    'use strict';
+    try {
+      return ${sanitizedExpr};
+    }
+catch (e) {
+      if (e instanceof TypeError) {
+        return undefined;
+      }
+      throw e;
+    }
+  `);
+  let func = buildFunc([]);
+  const alreadyCanonical = validEntries.every((entry, index) => entry.index === index);
+  if (filteredKeys.length === contextKeys.length && alreadyCanonical)
+    return wrapWithMissingIdentifierRetry(func, filteredKeys, buildFunc);
+  return wrapWithMissingIdentifierRetry((...args) => {
+    const projected = Array(validIndices.length);
+    for (let i = 0;i < validIndices.length; i++)
+      projected[i] = args[validIndices[i]];
+    return func(...projected);
+  }, filteredKeys, buildFunc, (extra) => {
+    func = buildFunc(extra);
+  });
+}
+function wrapWithMissingIdentifierRetry(initialFunc, filteredKeys, buildFunc, onRebuild) {
+  const MAX_RETRIES = 8, missingRe = /^(\w+) is not defined$/;
+  let func = initialFunc;
+  const extraParams = [], knownNames = new Set(filteredKeys);
+  return (...args) => {
+    for (let attempt = 0;attempt <= MAX_RETRIES; attempt++)
+      try {
+        return func(...args);
+      } catch (e) {
+        const message = e instanceof Error ? e.message : "", match = missingRe.exec(message);
+        if (!(e instanceof ReferenceError) || !match)
+          return;
+        const missingName = match[1];
+        if (knownNames.has(missingName) || RESERVED_PARAM_NAMES.has(missingName))
+          return;
+        knownNames.add(missingName);
+        extraParams.push(missingName);
+        if (onRebuild)
+          onRebuild(extraParams);
+        else
+          func = buildFunc(extraParams);
+      }
+    return;
+  };
+}
+const MAX_SAFE_EVAL_CODE_LENGTH = 65536;
+export function safeEvaluateCode(code, context) {
+  try {
+    if (typeof code !== "string")
+      return;
+    if (code.length > MAX_SAFE_EVAL_CODE_LENGTH)
+      throw Error(`safeEvaluateCode: input exceeds ${MAX_SAFE_EVAL_CODE_LENGTH} chars`);
+    for (const pattern of DANGEROUS_PATTERNS)
+      if (pattern.test(code))
+        throw Error("Potentially unsafe code detected");
+    const safeContext = createSafeContext(context), keys = Object.keys(safeContext).filter(isUsableParamName), values = keys.map((key) => safeContext[key]);
+    return Function(...keys, `
+      'use strict';
+      ${code}
+    `)(...values);
+  } catch {
+    return;
+  }
+}
+export function isForExpressionSafe(expression) {
+  const trimmed = expression.trim(), forDangerousPatterns = [
+    /\beval\s*\(/i,
+    /\bFunction\s*\(/i,
+    /\bimport\s*\(/i,
+    /\brequire\s*\(/i,
+    /\bprocess\b/i,
+    /\b__proto__\b/i,
+    /\bconstructor\s*[.(]/i,
+    /\bglobalThis\b/i,
+    /\bwindow\b/i,
+    /\bdocument\b/i,
+    /\bfetch\s*\(/i,
+    /\bBun\b/i,
+    /\bDeno\b/i,
+    /\bconsole\b/i,
+    /\bthis\b/i,
+    /\bReflect\b/i,
+    /\bProxy\b/i,
+    /\bprototype\b/i,
+    /\.(bind|call|apply)\s*\(/i
+  ];
+  for (const pattern of forDangerousPatterns)
+    if (pattern.test(trimmed))
+      return !1;
+  return !0;
+}
+export function createSafeLoopFunction(loopType, expression, body, contextKeys, maxIterations = 1000) {
+  if (!isForExpressionSafe(expression))
+    throw Error(`Unsafe expression in @${loopType}: ${expression}`);
+  const processedBody = body.replace(/`/g, "\\`").replace(/\$\{/g, "\\${").replace(/\{\{([^}]+)\}\}/g, (_match, expr) => {
+    return `\${${expr}}`;
+  });
+  if (loopType === "for")
+    return Function(...contextKeys, `
+      'use strict';
+      let result = '';
+      for (${expression}) {
+        result += \`${processedBody}\`;
+      }
+      return result;
+    // eslint-disable-next-line pickier/no-unused-vars
+    `);
+  else
+    return Function(...contextKeys, `
+      'use strict';
+      let result = '';
+      let __safeCounter = 0;
+      const __maxIterations = ${maxIterations};
+      while (${expression} && __safeCounter < __maxIterations) {
+        __safeCounter++;
+        result += \`${processedBody}\`;
+      }
+      // Surface the truncation both inline (for end users) and via
+      // console.warn (for developers running \`stx dev\`). A silent cut-off
+      // made pages render half a list with no breadcrumb.
+      if (__safeCounter >= __maxIterations) {
+        result += '<!-- [Loop Error]: Maximum iterations exceeded -->';
+        if (typeof console !== 'undefined' && typeof console.warn === 'function') {
+          console.warn('[stx] @while loop hit max iterations (' + __maxIterations + '); template output was truncated. Raise via createSafeForLoop(..., maxIterations) if intentional.');
+        }
+      }
+      return result;
+    // eslint-disable-next-line pickier/no-unused-vars
+    `);
+}

package/dist/scaffolding.d.ts

@@ -0,0 +1,113 @@
+/**
+ * Create a new stx project
+ */
+export declare function createProject(projectName: string, options?: CreateProjectOptions): Promise<ScaffoldResult>;
+/**
+ * Add a component
+ */
+export declare function addComponent(name: string, options?: AddComponentOptions): Promise<ScaffoldResult>;
+/**
+ * Add a page
+ */
+export declare function addPage(name: string, options?: AddPageOptions): Promise<ScaffoldResult>;
+/**
+ * Add a store
+ */
+export declare function addStore(name: string, options?: AddStoreOptions): Promise<ScaffoldResult>;
+/**
+ * Add a layout
+ */
+export declare function addLayout(name: string, options?: AddLayoutOptions): Promise<ScaffoldResult>;
+/**
+ * Project template definitions
+ */
+export declare const PROJECT_TEMPLATES: {
+  default: {
+  description: 'Standard stx project with pages, components, and stores';
+  features: readonly ['Pages', 'Components', 'Layouts', 'Stores', 'Dev server']
+};
+  minimal: {
+  description: 'Minimal setup with just the essentials';
+  features: readonly ['Single page', 'Basic styles']
+};
+  full: {
+  description: 'Full-featured project with all stx capabilities';
+  features: readonly ['Pages', 'Components', 'Layouts', 'Stores', 'API routes', 'PWA', 'i18n', 'Testing']
+};
+  blog: {
+  description: 'Blog template with markdown support';
+  features: readonly ['Blog layout', 'Post pages', 'Tags', 'RSS feed', 'Markdown']
+};
+  dashboard: {
+  description: 'Admin dashboard template';
+  features: readonly ['Sidebar', 'Charts', 'Tables', 'Forms', 'Auth pages']
+};
+  landing: {
+  description: 'Marketing landing page template';
+  features: readonly ['Hero section', 'Features', 'Pricing', 'CTA', 'Contact form']
+}
+};
+/**
+ * Project creation options
+ */
+export declare interface CreateProjectOptions {
+  template?: ProjectTemplate
+  skipGit?: boolean
+  skipInstall?: boolean
+  packageManager?: 'bun' | 'npm' | 'pnpm' | 'yarn'
+  typescript?: boolean
+  examples?: boolean
+  pwa?: boolean
+  tailwind?: boolean
+}
+/**
+ * Add component options
+ */
+export declare interface AddComponentOptions {
+  dir?: string
+  props?: boolean
+  styles?: boolean
+  script?: boolean
+  force?: boolean
+}
+/**
+ * Add page options
+ */
+export declare interface AddPageOptions {
+  dir?: string
+  layout?: string
+  dynamic?: boolean
+  loader?: boolean
+  force?: boolean
+}
+/**
+ * Add store options
+ */
+export declare interface AddStoreOptions {
+  dir?: string
+  persist?: boolean
+  actions?: boolean
+  force?: boolean
+}
+/**
+ * Add layout options
+ */
+export declare interface AddLayoutOptions {
+  dir?: string
+  nav?: boolean
+  footer?: boolean
+  force?: boolean
+}
+/**
+ * Scaffolding result
+ */
+export declare interface ScaffoldResult {
+  success: boolean
+  message: string
+  files: string[]
+  errors: string[]
+}
+/**
+ * Project template options
+ */
+export type ProjectTemplate = 'default' | 'minimal' | 'full' | 'blog' | 'dashboard' | 'landing';