@pajh/buldng 0.0.2 → 0.0.4

package/src/buldng-ops.js

@@ -0,0 +1,258 @@
+import { WorkFile } from "./workfile.js";
+
+// buldng-ops.js
+import fs from "node:fs";
+import path from "node:path";
+import esbuild from "esbuild";
+
+import { assertSourceRead, assertDestWrite, looksLikeFilename, ensureWorkFile } from "./buldng-validate.js";
+export const OPS = {
+    file: op_file,
+    literal: op_literal,
+    append: op_append,
+    replace: op_replace,
+    compile: op_compile,
+    materialise: op_materialise,
+    wrap: op_wrap,
+};
+
+// --------------------------------------------------
+// FILE — lazy read from disk. op:"file"
+// --------------------------------------------------
+export function file(strings, ...values) {
+    if (values.length > 0) {
+        throw new Error("file`` does not support interpolation");
+    }
+
+    const relPath = strings.join("");
+    const absPath = assertSourceRead(relPath);
+
+    return new WorkFile("file", { relPath, absPath }, []);
+}
+
+// op for "file"
+export function op_file(config, children) {
+    return fs.readFileSync(config.absPath, "utf8");
+}
+
+// --------------------------------------------------
+// LITERAL — inline text
+// --------------------------------------------------
+export function op_literal(config, children) {
+    return config.value;
+}
+
+// --------------------------------------------------
+// APPEND — concat children in order
+// --------------------------------------------------
+export function op_append(config, children) {
+    let out = "";
+
+    for (const child of children) {
+        const chunk = child.execute();
+
+        if (out.length > 0 &&
+            !out.endsWith("\n") &&
+            !chunk.startsWith("\n")) {
+            out += "\n";
+        }
+
+        out += chunk;
+    }
+
+    return out;
+}
+
+// --------------------------------------------------
+// REPLACE — replace tag with replacement
+// --------------------------------------------------
+export function op_replace(config, children) {
+    if (children.length !== 3) {
+        throw new Error(`replace(): expected 3 children, got ${children.length}`);
+    }
+
+    const [srcWF, tagWF, repWF] = children;
+
+    const src = srcWF.execute();
+    const tag = tagWF.execute();
+    const rep = repWF.execute();
+
+    if (!src.includes(tag)) {
+        throw new Error(`replace(): tag "${tag}" not found in source`);
+    }
+
+    return src.replace(tag, rep);
+}
+
+// --------------------------------------------------
+// COMPILE — esbuild wrapper
+// --------------------------------------------------
+export function op_compile(config, children) {
+    if (children.length !== 1) {
+        throw new Error(`compile(): expected 1 child, got ${children.length}`);
+    }
+
+    const child = children[0];
+    const compileOptions = {
+        minify: config.flags?.minify ?? true,
+        sourcemap: config.flags?.sourcemap ?? true,
+        format: config.flags?.format ?? "esm",
+        target: config.flags?.target ?? "esnext",
+    };
+
+    // If child is a file WorkFile, use its absolute path directly
+    if (child.op === "file" && child.config.absPath) {
+        const entry = child.config.absPath;
+
+        const result = esbuild.buildSync({
+            entryPoints: [entry],
+            bundle: true,
+            ...compileOptions,
+            write: false
+        });
+
+        if (result.errors?.length) {
+            throw new Error("Build failed:\n" + result.errors.map(e => e.text).join("\n"));
+        }
+
+        return result.outputFiles[0].text;
+    }
+
+    // Otherwise compile from stdin
+    const srcText = child.execute();
+
+    const result = esbuild.buildSync({
+        stdin: {
+            contents: srcText,
+            resolveDir: process.cwd(),
+            sourcefile: "input.ts"
+        },
+        bundle: true,
+        ...compileOptions,
+        write: false
+    });
+
+    if (result.errors?.length) {
+        throw new Error("Build failed:\n" + result.errors.map(e => e.text).join("\n"));
+    }
+
+    return result.outputFiles[0].text;
+}
+
+// --------------------------------------------------
+// MATERIALISE — write file if identical or new
+// --------------------------------------------------
+export function materialise(child, target) {
+    const childWF = ensureWorkFile(child, "materialise");
+    return new WorkFile("materialise", { target }, [childWF]);
+}
+
+export function op_materialise(config, children) {
+    if (children.length !== 1) {
+        throw new Error(`materialise(): expected 1 child, got ${children.length}`);
+    }
+
+    const child = children[0];
+
+    const text = child.execute();
+
+    if (looksLikeFilename(text)) {
+        console.warn(
+            `materialise(): child returned a filename '${text}' but expected text.\n` +
+            `Did you accidentally pass a materialised WorkFile instead of raw text?`
+        );
+    }
+
+    const abs = assertDestWrite(config.target);
+
+    if (!fs.existsSync(abs)) {
+        fs.mkdirSync(path.dirname(abs), { recursive: true });
+        fs.writeFileSync(abs, text, "utf8");
+        // NEW: mark file read-only
+        fs.chmodSync(abs, 0o444);
+        console.log(`materialise: ${abs}`);
+        return "/" + config.target;
+    }
+
+    const existing = fs.readFileSync(abs, "utf8");
+
+    if (existing === text) {
+        return "/" + config.target;
+    }
+
+    throw new Error(
+        `materialise(): cannot overwrite '${config.target}' — existing file differs from generated output`
+    );
+}
+
+// --------------------------------------------------
+// WRAP — pre + child + post
+// --------------------------------------------------
+export function op_wrap(config, children) {
+    if (children.length !== 1) {
+        throw new Error(`wrap(): expected 1 child, got ${children.length}`);
+    }
+
+    const inner = children[0].execute();
+    const pre = config.pre ?? "";
+    const post = config.post ?? "";
+
+    return pre + inner + post;
+}
+
+
+
+// --------------------------------------------------
+// literal(text)
+// --------------------------------------------------
+export function literal(value) {
+    return new WorkFile("literal", { value }, []);
+}
+
+// --------------------------------------------------
+// wrap(pre, child, post)
+// --------------------------------------------------
+export function wrap(pre, child, post, tag=null) {
+    const childWF = ensureWorkFile(child, "wrap child");
+    return new WorkFile("wrap", { pre, post }, [childWF], tag);
+}
+
+export function append() {
+    const children = [];
+
+    for (let i = 0; i < arguments.length; i++) {
+        const item = arguments[i];
+        const wf = ensureWorkFile(item, "append item");
+        children.push(wf);
+    }
+
+    if (children.length < 2) {
+        throw new Error("append(): requires at least 2 items");
+    }
+
+    return new WorkFile("append", {}, children);
+}
+
+
+// --------------------------------------------------
+// replace(source, tag, replacement)
+// --------------------------------------------------
+export function replace(source, tag, replacement) {
+    const srcWF = ensureWorkFile(source, "source");
+    const tagWF = ensureWorkFile(tag, "tag");
+    const repWF = ensureWorkFile(replacement, "replacement");
+
+    if (tagWF.op === "literal" && tagWF.config.value.trim() === "") {
+        throw new Error(`replace(): tag cannot be blank`);
+    }
+
+    return new WorkFile("replace", {}, [srcWF, tagWF, repWF]);
+}
+
+// --------------------------------------------------
+// compile(source)
+// --------------------------------------------------
+export function compile(source, flags = {}) {
+    const srcWF = ensureWorkFile(source, "source");
+    return new WorkFile("compile", { flags }, [srcWF]);
+}

package/src/buldng-validate.js

@@ -0,0 +1,207 @@
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "node:child_process";
+import { WorkFile } from "./workfile.js";
+import { literal } from "./buldng-ops.js";
+// --------------------------------------------------
+// GLOBAL SOURCE & DEST ROOTS
+// --------------------------------------------------
+
+let SRC = null;
+let DEST = null;
+
+// --------------------------------------------------
+// SETTERS WITH SAFETY CHECKS
+// --------------------------------------------------
+
+export function setSource(dir) {
+  const abs = path.resolve(dir);
+  const sentinel = path.join(abs, "BULDNG_SRC");
+  if (!fs.existsSync(sentinel)) {
+    throw new Error(`SECURITY: Source directory "${abs}" does not contain BLDNG_SRC sentinel`);
+  }
+  SRC = abs;
+  validateRoots();
+}
+
+export function setDest(dir) {
+  const abs = path.resolve(dir);
+
+  // ------------------------------------------------------------
+  // If dest exists, perform full safety checks
+  // ------------------------------------------------------------
+  if (fs.existsSync(abs)) {
+
+    // SECURITY: full recursive scan for BULDNG_SRC
+    const stack = [abs];
+    while (stack.length) {
+      const current = stack.pop();
+      const entries = fs.readdirSync(current, { withFileTypes: true });
+
+      for (const entry of entries) {
+        const full = path.join(current, entry.name);
+
+        if (entry.isDirectory()) {
+          stack.push(full);
+        } else if (entry.name === "BULDNG_SRC") {
+          throw new Error(`SECURITY: Dest directory "${abs}" contains BULDNG_SRC sentinel`);
+        }
+      }
+    }
+
+    // SECURITY: require DEST sentinel in root
+    const destSentinel = path.join(abs, "BULDNG_DEST");
+    if (!fs.existsSync(destSentinel)) {
+      throw new Error(`SECURITY: Refusing to delete "${abs}" — missing BULDNG_DEST sentinel`);
+    }
+
+    // -----------------------------------------------------------
+    // Copy clean.sh from package into dest
+    // ------------------------------------------------------------
+    const __filename = fileURLToPath(import.meta.url);
+    const __dirname = path.dirname(__filename);
+    const cleanSrc = path.join(__dirname, "clean.sh");   // your package copy
+    const cleanDest = path.join(abs, "clean.sh");
+
+    fs.copyFileSync(cleanSrc, cleanDest);
+    fs.chmodSync(cleanDest, 0o755);
+
+    // ------------------------------------------------------------
+    // Call safe_clean.sh with full path to clean.sh
+    // ------------------------------------------------------------
+    const safeClean = path.resolve("safe_clean.sh");
+    console.log(`SECURITY: Running safe_clean.sh on "${abs}"`);
+
+    const result = spawnSync(safeClean, [cleanDest], {
+      stdio: "inherit"
+    });
+
+    if (result.status !== 0) {
+      throw new Error(`SECURITY: safe_clean.sh failed with exit code ${result.status}`);
+    }
+
+    // ------------------------------------------------------------
+    // Verify directory is empty after cleaning
+    // ------------------------------------------------------------
+    const remaining = fs.readdirSync(abs);
+    if (remaining.length !== 0) {
+      throw new Error(`SECURITY: Dest directory "${abs}" not empty after safe_clean`);
+    }
+  }
+
+  // ------------------------------------------------------------
+  // Always recreate DEST fresh
+  // ------------------------------------------------------------
+  fs.mkdirSync(abs, { recursive: true });
+
+  // Create DEST sentinel and mark read-only
+  const sentinelPath = path.join(abs, "BULDNG_DEST");
+  fs.writeFileSync(sentinelPath, "");
+  fs.chmodSync(sentinelPath, 0o444);
+
+  DEST = abs;
+  validateRoots();
+}
+
+
+
+export function getDest() {
+  if (!DEST) throw new Error("SECURITY: Dest root not set");
+  return DEST;
+}
+
+// --------------------------------------------------
+// PATH SAFETY HELPERS
+// --------------------------------------------------
+
+export function assertSourceRead(relPath) {
+  if (!SRC) throw new Error("SECURITY: Source root not set");
+  if (relPath.includes("..")) throw new Error("SECURITY: Illegal path traversal in read()");
+  const abs = path.resolve(SRC, relPath);
+  if (!abs.startsWith(SRC)) throw new Error("SECURITY: Read outside src/");
+  trackInput(abs);
+  return abs;
+}
+
+export function assertDestWrite(relPath) {
+  if (!DEST) throw new Error("SECURITY: Dest root not set");
+  if (relPath.includes("..")) throw new Error("SECURITY: Illegal path traversal in save()");
+  const abs = path.resolve(DEST, relPath);
+  if (!abs.startsWith(DEST)) throw new Error("SECURITY: Write outside dest/");
+  return abs;
+}
+
+function validateRoots() {
+  if (!SRC || !DEST) return;
+
+  const srcReal = fs.realpathSync(SRC);
+  const destReal = fs.realpathSync(DEST);
+
+  if (srcReal === destReal) {
+    throw new Error(`SECURITY: src and dest resolve to the same directory:
+      src:  ${SRC}
+      dest: ${DEST}`);
+  }
+
+  if (srcReal.startsWith(destReal) || destReal.startsWith(srcReal)) {
+    throw new Error(`SECURITY: src and dest cannot be nested:
+      src:  ${SRC}
+      dest: ${DEST}`);
+  }
+}
+
+const INPUTS = new Set();
+
+export function getInputs() {
+  return INPUTS;
+}
+
+export function trackInput(absPath) {
+  if (!SRC || !DEST) return;
+  if (absPath.startsWith(SRC) && !absPath.startsWith(DEST)) {
+    INPUTS.add(absPath);
+  }
+}
+
+export function looksLikeFilename(s) {
+  return typeof s === "string" &&
+    s.length < 200 &&
+    /[A-Za-z0-9_\-\/]+\.(html|css|js)$/.test(s);
+}
+
+export function looksLikeHTML(s) {
+  return typeof s === "string" &&
+    s.trim().startsWith("<") &&
+    s.includes(">");
+}
+
+export function looksLikeCSS(s) {
+  return typeof s === "string" &&
+    s.includes("{") &&
+    s.includes("}");
+}
+
+export function looksLikeJS(s) {
+  return typeof s === "string" &&
+    (s.includes("function") ||
+      s.includes("const ") ||
+      s.includes("let "));
+}
+
+export function ensureLeadingSlash(p) {
+  return p.startsWith("/") ? p : "/" + p;
+}
+
+// --------------------------------------------------
+// ensureWorkFile(x)
+// --------------------------------------------------
+export function ensureWorkFile(x, fieldName = "value") {
+  if (x instanceof WorkFile) return x;
+
+  if (typeof x === "string") {
+    return literal(x);
+  }
+
+  throw new Error(`${fieldName} must be WorkFile or string`);
+}