@rubytech/create-sitedesk-code 0.1.491 → 0.1.493

package/payload/server/{chunk-KZFE3MOY.js → chunk-RPUTKSAJ.js}

@@ -92,19 +92,19 @@ function readHouseCredential(platformRoot) {
 import { execFile as execFile2 } from "child_process";
 import { cp, mkdtemp, rm } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join2, relative } from "path";
+import { join as join3, relative as relative2 } from "path";
 
 // ../lib/storage-broker/src/house-scoped-token.ts
 import { readFileSync as readFileSync2 } from "fs";
 import { execFile } from "child_process";
-var defaultRun = (cmd, args, env) => new Promise((resolve, reject) => {
+var defaultRun = (cmd, args, env) => new Promise((resolve2, reject) => {
   execFile(cmd, args, { env }, (err, stdout, stderr) => {
     if (err) {
       reject(new Error(`${cmd} ${args.join(" ")} failed: ${err.message}
 ${stderr}`));
       return;
     }
-    resolve({ stdout: stdout.toString() });
+    resolve2({ stdout: stdout.toString() });
   });
 });
 function readKey(path, key) {
@@ -145,8 +145,123 @@ function keyForScope(scope) {
   }
 }
 
+// ../lib/storage-broker/src/pages-output-dir.ts
+import { lstat, readFile, realpath } from "fs/promises";
+import { isAbsolute, join as join2, relative, resolve } from "path";
+var WRANGLER_CONFIG_NAMES = [
+  "wrangler.json",
+  "wrangler.jsonc",
+  "wrangler.toml"
+];
+var KEY = "pages_build_output_dir";
+function stripJsonComments(text) {
+  let out = "";
+  let inString = false;
+  let escaped = false;
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    if (inString) {
+      out += c;
+      if (escaped) escaped = false;
+      else if (c === "\\") escaped = true;
+      else if (c === '"') inString = false;
+      continue;
+    }
+    if (c === '"') {
+      inString = true;
+      out += c;
+      continue;
+    }
+    if (c === "/" && text[i + 1] === "/") {
+      while (i < text.length && text[i] !== "\n") i++;
+      out += "\n";
+      continue;
+    }
+    if (c === "/" && text[i + 1] === "*") {
+      i += 2;
+      while (i < text.length && !(text[i] === "*" && text[i + 1] === "/")) i++;
+      i++;
+      continue;
+    }
+    out += c;
+  }
+  return out;
+}
+function readTomlKey(text) {
+  for (const raw of text.split("\n")) {
+    const line = raw.trim();
+    if (line === "" || line.startsWith("#")) continue;
+    if (line.startsWith("[")) return void 0;
+    const m = /^pages_build_output_dir\s*=\s*(?:"([^"]*)"|'([^']*)')\s*(?:#.*)?$/.exec(line);
+    if (m) return m[1] ?? m[2];
+  }
+  return void 0;
+}
+function readJsonKey(text, name, jsonc) {
+  let parsed;
+  try {
+    parsed = JSON.parse(jsonc ? stripJsonComments(text) : text);
+  } catch (err) {
+    throw new Error(`storage-broker: ${name} could not be parsed: ${String(err)}`);
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    throw new Error(`storage-broker: ${name} is not an object`);
+  }
+  const value = parsed[KEY];
+  if (value === void 0) return void 0;
+  if (typeof value !== "string") {
+    throw new Error(`storage-broker: ${name} declares a non-string ${KEY}`);
+  }
+  return value;
+}
+function escapes(root, child) {
+  const rel = relative(root, child);
+  return rel.startsWith("..") || isAbsolute(rel);
+}
+function outsideError(name, declared, resolved, root) {
+  return new Error(
+    `storage-broker: ${name} declares ${KEY}="${declared}", which resolves to ${resolved}, outside the site root ${root}`
+  );
+}
+async function resolveUploadDir(dir) {
+  for (const name of WRANGLER_CONFIG_NAMES) {
+    let text;
+    try {
+      text = await readFile(join2(dir, name), "utf8");
+    } catch {
+      continue;
+    }
+    const declared = name === "wrangler.toml" ? readTomlKey(text) : readJsonKey(text, name, name === "wrangler.jsonc");
+    if (declared === void 0) return { uploadDir: dir, source: "site-root" };
+    const uploadDir = resolve(dir, declared);
+    if (escapes(dir, uploadDir)) throw outsideError(name, declared, uploadDir, dir);
+    let info;
+    try {
+      info = await lstat(uploadDir);
+    } catch {
+      throw new Error(
+        `storage-broker: ${name} declares ${KEY}="${declared}" but ${uploadDir} does not exist`
+      );
+    }
+    if (info.isSymbolicLink()) {
+      throw new Error(
+        `storage-broker: ${name} declares ${KEY}="${declared}" but ${uploadDir} is a symbolic link; the published root must be a real directory`
+      );
+    }
+    if (!info.isDirectory()) {
+      throw new Error(
+        `storage-broker: ${name} declares ${KEY}="${declared}" but ${uploadDir} is not a directory`
+      );
+    }
+    const realDir = await realpath(dir);
+    const realUpload = await realpath(uploadDir);
+    if (escapes(realDir, realUpload)) throw outsideError(name, declared, realUpload, realDir);
+    return { uploadDir, source: name, declared };
+  }
+  return { uploadDir: dir, source: "site-root" };
+}
+
 // ../lib/storage-broker/src/cf-exec.ts
-var WRANGLER_CONFIG_NAMES = ["wrangler.json", "wrangler.jsonc", "wrangler.toml"];
 function encodeObjectKey(key) {
   return key.split("/").map(encodeURIComponent).join("/");
 }
@@ -154,14 +269,14 @@ function objectUrl(accountId, bucket, key) {
   return `https://api.cloudflare.com/client/v4/accounts/${accountId}/r2/buckets/${encodeURIComponent(bucket)}/objects/${encodeObjectKey(key)}`;
 }
 var defaultFetch = (url, init) => fetch(url, init);
-var defaultRun2 = (cmd, args, env, opts) => new Promise((resolve, reject) => {
+var defaultRun2 = (cmd, args, env, opts) => new Promise((resolve2, reject) => {
   execFile2(cmd, args, { env, cwd: opts?.cwd }, (err, stdout, stderr) => {
     if (err) {
       reject(new Error(`${cmd} ${args.join(" ")} failed: ${err.message}
 ${stderr}`));
       return;
     }
-    resolve({ stdout: stdout.toString() });
+    resolve2({ stdout: stdout.toString() });
   });
 });
 function parseJson(raw, context) {
@@ -373,15 +488,18 @@ function makeCfExec(cred, run = defaultRun2, fetchFn = defaultFetch) {
       }
     },
     async pagesDeploy(dir, project, branch) {
-      const staged = await mkdtemp(join2(tmpdir(), "maxy-pages-upload-"));
+      const { uploadDir, source: uploadDirSource } = await resolveUploadDir(dir);
+      const staged = await mkdtemp(join3(tmpdir(), "maxy-pages-upload-"));
       const excluded = [];
       try {
-        await cp(dir, staged, {
+        await cp(uploadDir, staged, {
           recursive: true,
-          // Only a config at the root of the tree is wrangler's own. A nested
-          // file of the same name is site content and stays published.
+          // Only a config at the root of what is uploaded is dropped. That root
+          // is the served root, which is the surface Task 1782 protects. A file
+          // of the same name anywhere below it is site content and stays
+          // published.
           filter: (src) => {
-            const rel = relative(dir, src);
+            const rel = relative2(uploadDir, src);
             if (!WRANGLER_CONFIG_NAMES.includes(rel)) return true;
             excluded.push(rel);
             return false;
@@ -396,7 +514,7 @@ function makeCfExec(cred, run = defaultRun2, fetchFn = defaultFetch) {
         if (!url) {
           throw new Error(`storage-broker: pages deploy returned no deployment url: ${stdout}`);
         }
-        return { url, excluded: excluded.sort() };
+        return { url, excluded: excluded.sort(), uploadDir, uploadDirSource };
       } finally {
         await rm(staged, { recursive: true, force: true });
       }
@@ -477,15 +595,15 @@ ${await res.text()}`
 }
 async function makeHouseCfExec(platformRoot, run = defaultRun2, fetchFn = defaultFetch) {
   const cred = readHouseCredential(platformRoot);
-  const houseEnvPath = join2(platformRoot, "config", "cloudflare-house.env");
-  const cfTokenSh = join2(platformRoot, "plugins/cloudflare/bin/cf-token.sh");
+  const houseEnvPath = join3(platformRoot, "config", "cloudflare-house.env");
+  const cfTokenSh = join3(platformRoot, "plugins/cloudflare/bin/cf-token.sh");
   const scoped = await resolveHouseScopedToken("storage", houseEnvPath, cfTokenSh, run);
   return makeCfExec({ apiToken: scoped, accountId: cred.accountId }, run, fetchFn);
 }
 async function makeHousePagesExec(platformRoot, run = defaultRun2, fetchFn = defaultFetch) {
   const cred = readHouseCredential(platformRoot);
-  const houseEnvPath = join2(platformRoot, "config", "cloudflare-house.env");
-  const cfTokenSh = join2(platformRoot, "plugins/cloudflare/bin/cf-token.sh");
+  const houseEnvPath = join3(platformRoot, "config", "cloudflare-house.env");
+  const cfTokenSh = join3(platformRoot, "plugins/cloudflare/bin/cf-token.sh");
   const scoped = await resolveHouseScopedToken("pages", houseEnvPath, cfTokenSh, run);
   return makeCfExec({ apiToken: scoped, accountId: cred.accountId }, run, fetchFn);
 }

package/payload/server/public/assets/{chat-DWvYv9jq.js → chat-1SSmFsjd.js}

@@ -1 +1 @@
-import{R as e,V as t}from"./useSubAccountSwitcher-Q941cZYV.js";import"./useVoiceRecorder-ZFwt5i6d.js";import"./AdminShell-BwNqwb4k.js";import{n}from"./page-BIwdWXnv.js";import"./useCopyFeedback-os7N0yCx.js";var r=t(),i=e();(0,r.createRoot)(document.getElementById(`root`)).render((0,i.jsx)(n,{}));
+import{R as e,V as t}from"./useSubAccountSwitcher-Q941cZYV.js";import"./useVoiceRecorder-ZFwt5i6d.js";import"./AdminShell-BwNqwb4k.js";import{n}from"./page-DBHzC59_.js";import"./useCopyFeedback-os7N0yCx.js";var r=t(),i=e();(0,r.createRoot)(document.getElementById(`root`)).render((0,i.jsx)(n,{}));

package/payload/server/public/assets/{operator-CldXXilj.js → operator-Cxq9TxaH.js}

@@ -1 +1 @@
-import{o as e}from"./chunk-TPjIAO9U.js";import{R as t,U as n,V as r}from"./useSubAccountSwitcher-Q941cZYV.js";import{n as i,t as a}from"./AdminLoginScreens-DgVFsHtd.js";import"./useVoiceRecorder-ZFwt5i6d.js";import"./AdminShell-BwNqwb4k.js";import{t as o}from"./page-BIwdWXnv.js";import"./useCopyFeedback-os7N0yCx.js";var s=r(),c=e(n(),1),l=t();function u(){let e=i(`operator`),t=(0,c.useRef)(null);return(0,c.useEffect)(()=>{e.appState!==`chat`&&t.current!==e.appState&&(t.current=e.appState,console.info(`[operator-ui] op=auth-gate state=${e.appState}`))},[e.appState]),e.appState===`chat`?(0,l.jsx)(o,{variant:`operator`,forceCanonicalSession:window.location.pathname!==`/chat`}):(0,l.jsx)(a,{auth:e})}(0,s.createRoot)(document.getElementById(`root`)).render((0,l.jsx)(u,{}));
+import{o as e}from"./chunk-TPjIAO9U.js";import{R as t,U as n,V as r}from"./useSubAccountSwitcher-Q941cZYV.js";import{n as i,t as a}from"./AdminLoginScreens-DgVFsHtd.js";import"./useVoiceRecorder-ZFwt5i6d.js";import"./AdminShell-BwNqwb4k.js";import{t as o}from"./page-DBHzC59_.js";import"./useCopyFeedback-os7N0yCx.js";var s=r(),c=e(n(),1),l=t();function u(){let e=i(`operator`),t=(0,c.useRef)(null);return(0,c.useEffect)(()=>{e.appState!==`chat`&&t.current!==e.appState&&(t.current=e.appState,console.info(`[operator-ui] op=auth-gate state=${e.appState}`))},[e.appState]),e.appState===`chat`?(0,l.jsx)(o,{variant:`operator`,forceCanonicalSession:window.location.pathname!==`/chat`}):(0,l.jsx)(a,{auth:e})}(0,s.createRoot)(document.getElementById(`root`)).render((0,l.jsx)(u,{}));