@stacksjs/stx 0.2.95 → 0.2.97

package/dist/csp.js

@@ -1,2 +1,220 @@
-// @bun
-import{$w as c,Zw as a,_w as b,ax as d,bx as e,cx as f,dx as g,ex as h,fx as i,gx as j,hx as k,ix as l,jx as m,kx as n,lx as o,mx as p,nx as q,ox as r,px as s,qx as t,rx as u}from"./chunk-ek2w6zvy.js";import"./chunk-xv34zbp4.js";export{r as validateCspDirectives,f as strictCspPreset,h as relaxedCspPreset,q as registerCspDirectives,n as processCspDirectives,g as moderateCspPreset,k as mergeCspDirectives,l as injectCspMetaTag,b as getNonce,j as getCspPreset,s as getCspHeaderName,a as generateNonce,e as generateCspMetaTag,d as generateCspHeader,u as defaultCspConfig,p as cspNonceDirective,o as cspDirective,t as createCspHeaders,c as clearNonce,i as apiCspPreset,m as addNonceToInlineContent};
+const DEFAULT_NONCE_LENGTH = 16, nonceStorage = new WeakMap;
+export function generateNonce(length = DEFAULT_NONCE_LENGTH) {
+  const bytes = new Uint8Array(length);
+  crypto.getRandomValues(bytes);
+  return btoa(String.fromCharCode(...bytes));
+}
+export function getNonce(context, config) {
+  if (!context)
+    return config?.nonceGenerator?.() ?? generateNonce();
+  let nonce = nonceStorage.get(context);
+  if (!nonce) {
+    nonce = config?.nonceGenerator?.() ?? generateNonce();
+    nonceStorage.set(context, nonce);
+  }
+  return nonce;
+}
+export function clearNonce(context) {
+  nonceStorage.delete(context);
+}
+export function generateCspHeader(directives, nonce) {
+  const parts = [];
+  for (const [directive, value] of Object.entries(directives)) {
+    if (value === void 0 || value === null)
+      continue;
+    if (typeof value === "boolean") {
+      if (value)
+        parts.push(directive);
+      continue;
+    }
+    if (Array.isArray(value)) {
+      let sources = [...value];
+      if (nonce && (directive === "script-src" || directive === "style-src")) {
+        sources = sources.filter((s) => !s.startsWith("'nonce-"));
+        sources.push(`'nonce-${nonce}'`);
+      }
+      if (sources.length > 0)
+        parts.push(`${directive} ${sources.join(" ")}`);
+    }
+  }
+  return parts.join("; ");
+}
+export function generateCspMetaTag(directives, nonce) {
+  return `<meta http-equiv="Content-Security-Policy" content="${generateCspHeader(directives, nonce).replace(/&/g, "&amp;").replace(/"/g, "&quot;")}">`;
+}
+export const strictCspPreset = {
+  "default-src": ["'self'"],
+  "script-src": ["'self'", "'strict-dynamic'"],
+  "style-src": ["'self'"],
+  "img-src": ["'self'", "data:", "https:"],
+  "font-src": ["'self'", "https:", "data:"],
+  "connect-src": ["'self'"],
+  "media-src": ["'self'"],
+  "object-src": ["'none'"],
+  "frame-src": ["'none'"],
+  "base-uri": ["'self'"],
+  "form-action": ["'self'"],
+  "frame-ancestors": ["'self'"],
+  "upgrade-insecure-requests": !0
+}, moderateCspPreset = {
+  "default-src": ["'self'"],
+  "script-src": ["'self'"],
+  "style-src": ["'self'", "'unsafe-inline'"],
+  "img-src": ["'self'", "data:", "https:"],
+  "font-src": ["'self'", "https:", "data:"],
+  "connect-src": ["'self'", "https:"],
+  "media-src": ["'self'"],
+  "object-src": ["'none'"],
+  "frame-src": ["'self'"],
+  "base-uri": ["'self'"],
+  "form-action": ["'self'"],
+  "upgrade-insecure-requests": !0
+}, relaxedCspPreset = {
+  "default-src": ["'self'"],
+  "script-src": ["'self'", "'unsafe-inline'"],
+  "style-src": ["'self'", "'unsafe-inline'"],
+  "img-src": ["'self'", "data:", "https:", "http:"],
+  "font-src": ["'self'", "https:", "http:", "data:"],
+  "connect-src": ["'self'", "https:", "http:", "ws:", "wss:"],
+  "media-src": ["'self'", "https:", "http:"],
+  "object-src": ["'none'"],
+  "frame-src": ["'self'", "https:"],
+  "base-uri": ["'self'"]
+}, apiCspPreset = {
+  "default-src": ["'none'"],
+  "frame-ancestors": ["'none'"]
+};
+export function getCspPreset(preset) {
+  return {
+    enabled: !0,
+    directives: {
+      strict: strictCspPreset,
+      moderate: moderateCspPreset,
+      relaxed: relaxedCspPreset,
+      api: apiCspPreset
+    }[preset] || moderateCspPreset,
+    useNonce: preset === "strict",
+    addMetaTag: !0
+  };
+}
+export function mergeCspDirectives(base, override) {
+  const result = { ...base };
+  for (const [key, value] of Object.entries(override)) {
+    const directive = key, baseValue = result[directive];
+    if (value === void 0 || value === null)
+      continue;
+    if (typeof value === "boolean")
+      result[directive] = baseValue || value;
+    else if (Array.isArray(value)) {
+      const baseArray = Array.isArray(baseValue) ? baseValue : [], merged = [...new Set([...baseArray, ...value])];
+      result[directive] = merged;
+    }
+  }
+  return result;
+}
+export function injectCspMetaTag(html, config, context) {
+  if (!config.enabled || !config.addMetaTag)
+    return html;
+  if (html.includes('http-equiv="Content-Security-Policy"'))
+    return html;
+  if (!html.includes("<head>") && !html.includes("<head "))
+    return html;
+  const nonce = config.useNonce ? getNonce(context, config) : void 0, metaTag = generateCspMetaTag(config.directives, nonce);
+  return html.replace(/<head([^>]*)>/, `<head$1>
+${metaTag}`);
+}
+export function addNonceToInlineContent(html, nonce) {
+  let result = html;
+  result = result.replace(/<script(?![^>]*\ssrc=)([^>]*)>/gi, (match, attrs) => {
+    if (attrs.includes("nonce="))
+      return match;
+    return `<script nonce="${nonce}"${attrs}>`;
+  });
+  result = result.replace(/<style([^>]*)>/gi, (match, attrs) => {
+    if (attrs.includes("nonce="))
+      return match;
+    return `<style nonce="${nonce}"${attrs}>`;
+  });
+  return result;
+}
+export function processCspDirectives(template, context, _filePath, options) {
+  let output = template;
+  const cspConfig = options.csp;
+  output = output.replace(/@csp\b/g, () => {
+    if (!cspConfig?.enabled || !cspConfig.directives)
+      return "<!-- CSP not configured -->";
+    const nonce = cspConfig.useNonce ? getNonce(context, cspConfig) : void 0;
+    return generateCspMetaTag(cspConfig.directives, nonce);
+  });
+  output = output.replace(/@cspNonce\b/g, () => {
+    if (!cspConfig?.enabled || !cspConfig.useNonce)
+      return "";
+    return getNonce(context, cspConfig);
+  });
+  if (cspConfig?.enabled && cspConfig.useNonce)
+    context.cspNonce = getNonce(context, cspConfig);
+  return output;
+}
+export const cspDirective = {
+  name: "csp",
+  handler: (_content, _params, context, _filePath) => {
+    const cspConfig = context.__stx_options?.csp;
+    if (!cspConfig?.enabled || !cspConfig.directives)
+      return "<!-- CSP not configured -->";
+    const nonce = cspConfig.useNonce ? getNonce(context, cspConfig) : void 0;
+    return generateCspMetaTag(cspConfig.directives, nonce);
+  },
+  hasEndTag: !1,
+  description: "Insert Content-Security-Policy meta tag"
+}, cspNonceDirective = {
+  name: "cspNonce",
+  handler: (_content, _params, context, _filePath) => {
+    const cspConfig = context.__stx_options?.csp;
+    if (!cspConfig?.enabled || !cspConfig.useNonce)
+      return "";
+    return getNonce(context, cspConfig);
+  },
+  hasEndTag: !1,
+  description: "Output the current CSP nonce value"
+};
+export function registerCspDirectives() {
+  return [
+    cspDirective,
+    cspNonceDirective
+  ];
+}
+export function validateCspDirectives(directives) {
+  const warnings = [];
+  if (directives["script-src"]?.includes("'unsafe-inline'"))
+    warnings.push("CSP: Using unsafe-inline in script-src significantly reduces XSS protection");
+  if (directives["script-src"]?.includes("'unsafe-eval'"))
+    warnings.push("CSP: Using unsafe-eval in script-src allows eval() and related functions");
+  if (!directives["default-src"])
+    warnings.push("CSP: No default-src specified. Recommend adding default-src as a fallback");
+  if (directives["default-src"]?.includes("*"))
+    warnings.push("CSP: Using * in default-src provides minimal protection");
+  if (!directives["object-src"] && !directives["default-src"]?.includes("'none'"))
+    warnings.push("CSP: Consider adding object-src: none to block plugins");
+  if (!directives["base-uri"])
+    warnings.push("CSP: Consider adding base-uri to prevent base tag injection attacks");
+  for (const [directive, sources] of Object.entries(directives))
+    if (Array.isArray(sources) && sources.includes("http:"))
+      warnings.push(`CSP: Using http: in ${directive} allows insecure resources`);
+  return warnings;
+}
+export function getCspHeaderName(reportOnly = !1) {
+  return reportOnly ? "Content-Security-Policy-Report-Only" : "Content-Security-Policy";
+}
+export function createCspHeaders(config, context) {
+  if (!config.enabled)
+    return {};
+  const nonce = config.useNonce ? getNonce(context, config) : void 0, headerValue = generateCspHeader(config.directives, nonce);
+  return { [getCspHeaderName(config.reportOnly)]: headerValue };
+}
+export const defaultCspConfig = {
+  enabled: !1,
+  reportOnly: !1,
+  directives: moderateCspPreset,
+  useNonce: !1,
+  addMetaTag: !0
+};

package/dist/csrf.js

@@ -1,2 +1,38 @@
-// @bun
-import{sx as a,tx as b,ux as c,vx as d,wx as e,xx as f,yx as g}from"./chunk-9wmq2272.js";import"./chunk-xv34zbp4.js";export{g as verifyCsrfToken,d as setCsrfToken,c as resetCsrfToken,f as processCsrfDirectives,b as getCsrfToken,a as generateCsrfToken,e as csrfField};
+import { Buffer } from "node:buffer";
+import crypto from "node:crypto";
+const DEFAULT_TOKEN_LENGTH = 40, DEFAULT_INPUT_NAME = "_token";
+let csrfToken = null;
+export function generateCsrfToken(length = DEFAULT_TOKEN_LENGTH) {
+  const token = crypto.randomBytes(Math.ceil(length / 2)).toString("hex").slice(0, length);
+  csrfToken = token;
+  return token;
+}
+export function getCsrfToken() {
+  if (!csrfToken)
+    generateCsrfToken();
+  return csrfToken;
+}
+export function resetCsrfToken() {
+  csrfToken = null;
+}
+export function setCsrfToken(token) {
+  csrfToken = token;
+}
+export function csrfField(inputName = DEFAULT_INPUT_NAME) {
+  const token = getCsrfToken();
+  return `<input type="hidden" name="${inputName}" value="${token}">`;
+}
+export function processCsrfDirectives(template) {
+  return template.replace(/@csrf(?:\((['"])([^'"]*)\1\))?/g, (_, quote, inputName) => {
+    return csrfField(inputName || DEFAULT_INPUT_NAME);
+  });
+}
+export function verifyCsrfToken(token, expectedToken) {
+  const expected = expectedToken ?? csrfToken;
+  if (!expected)
+    return !1;
+  const tokenBuf = Buffer.from(token), csrfBuf = Buffer.from(expected);
+  if (tokenBuf.length !== csrfBuf.length)
+    return !1;
+  return crypto.timingSafeEqual(tokenBuf, csrfBuf);
+}

package/dist/custom-directives.js

@@ -1,2 +1,136 @@
-// @bun
-import{zx as a}from"./chunk-7dkz6z2s.js";import"./chunk-9ecv8aqj.js";import"./chunk-1zgsgk4b.js";import"./chunk-2jxbwnkz.js";import"./chunk-zen6ax1y.js";import"./chunk-yb1t2h8h.js";import"./chunk-fjk3x41y.js";import"./chunk-5shey2e4.js";import"./chunk-27zsyhrd.js";import"./chunk-xv34zbp4.js";export{a as processCustomDirectives};
+import { ErrorCodes, inlineError } from "./error-handling.js";
+import { getCachedRegex } from "./performance-utils.js";
+export async function processCustomDirectives(template, context, filePath, options) {
+  if (!options.customDirectives || options.customDirectives.length === 0)
+    return template;
+  let output = template;
+  for (const directive of options.customDirectives) {
+    if (!directive.name || typeof directive.handler !== "function") {
+      if (options.debug)
+        console.warn("Invalid custom directive:", directive);
+      continue;
+    }
+    if (directive.hasEndTag)
+      output = await processDirectiveWithEndTag(output, directive, context, filePath, options);
+    else
+      output = await processDirectiveWithoutEndTag(output, directive, context, filePath, options);
+  }
+  return output;
+}
+async function processDirectiveWithEndTag(template, directive, context, filePath, options) {
+  const { name, handler } = directive, startTag = `@${name}`, endTag = `@end${name}`;
+  let output = template;
+  const pattern = getCachedRegex(`${startTag}(?:\\s*\\(([^()]*(?:\\([^)]*\\)[^()]*)*)\\))?([\\s\\S]*?)${endTag}`, "g"), replacements = [];
+  let match = pattern.exec(output);
+  while (match !== null) {
+    const [fullMatch, paramString = "", content = ""] = match, startIndex = match.index || 0;
+    try {
+      const params = paramString ? parseDirectiveParams(paramString) : [], trimmedContent = content.trim(), processed = await handler(trimmedContent, params, context, filePath);
+      replacements.push({
+        original: fullMatch,
+        processed,
+        startIndex
+      });
+    } catch (error) {
+      const errorMessage = error instanceof Error ? error.message : String(error);
+      if (options.debug)
+        console.error(`Error processing custom directive @${name}:`, error);
+      replacements.push({
+        original: fullMatch,
+        processed: inlineError("CustomDirective", `Error in @${name}${paramString ? `(${paramString})` : ""}: ${errorMessage}`, ErrorCodes.EVALUATION_ERROR),
+        startIndex
+      });
+    }
+    match = pattern.exec(output);
+  }
+  for (let i = replacements.length - 1;i >= 0; i--) {
+    const { original, processed } = replacements[i];
+    output = output.replace(original, processed);
+  }
+  return output;
+}
+async function processDirectiveWithoutEndTag(template, directive, context, filePath, options) {
+  const { name, handler } = directive;
+  let output = template;
+  const pattern = getCachedRegex(`@${name}\\s*\\(([^()]*(?:\\([^)]*\\)[^()]*)*)\\)`, "g"), replacements = [];
+  let match = pattern.exec(output);
+  while (match !== null) {
+    const [fullMatch, paramString = ""] = match, startIndex = match.index || 0;
+    try {
+      const params = parseDirectiveParams(paramString), processed = await handler("", params, context, filePath);
+      replacements.push({
+        original: fullMatch,
+        processed,
+        startIndex
+      });
+    } catch (error) {
+      const errorMessage = error instanceof Error ? error.message : String(error);
+      if (options.debug)
+        console.error(`Error processing custom directive @${name}:`, error);
+      replacements.push({
+        original: fullMatch,
+        processed: inlineError("CustomDirective", `Error in @${name}(${paramString}): ${errorMessage}`, ErrorCodes.EVALUATION_ERROR),
+        startIndex
+      });
+    }
+    match = pattern.exec(output);
+  }
+  const barePattern = getCachedRegex(`@${name}(?!\\w)(?!\\s*\\()`, "g");
+  let bareMatch = barePattern.exec(output);
+  while (bareMatch !== null) {
+    const [fullMatch] = bareMatch, startIndex = bareMatch.index || 0;
+    try {
+      const processed = await handler("", [], context, filePath);
+      replacements.push({
+        original: fullMatch,
+        processed,
+        startIndex
+      });
+    } catch (error) {
+      const errorMessage = error instanceof Error ? error.message : String(error);
+      if (options.debug)
+        console.error(`Error processing custom directive @${name}:`, error);
+      replacements.push({
+        original: fullMatch,
+        processed: inlineError("CustomDirective", `Error in @${name}: ${errorMessage}`, ErrorCodes.EVALUATION_ERROR),
+        startIndex
+      });
+    }
+    bareMatch = barePattern.exec(output);
+  }
+  for (let i = replacements.length - 1;i >= 0; i--) {
+    const { original, processed } = replacements[i];
+    output = output.replace(original, processed);
+  }
+  return output;
+}
+function parseDirectiveParams(paramString) {
+  if (!paramString.trim())
+    return [];
+  const params = [];
+  let currentParam = "", inQuotes = !1, quoteChar = "";
+  for (let i = 0;i < paramString.length; i++) {
+    const char = paramString[i];
+    if ((char === '"' || char === "'") && (i === 0 || paramString[i - 1] !== "\\"))
+      if (!inQuotes) {
+        inQuotes = !0;
+        quoteChar = char;
+      } else if (char === quoteChar)
+        inQuotes = !1;
+      else
+        currentParam += char;
+    else if (char === "," && !inQuotes) {
+      params.push(currentParam.trim());
+      currentParam = "";
+    } else
+      currentParam += char;
+  }
+  if (currentParam.trim())
+    params.push(currentParam.trim());
+  return params.map((param) => {
+    const trimmed = param.trim();
+    if (trimmed.startsWith('"') && trimmed.endsWith('"') || trimmed.startsWith("'") && trimmed.endsWith("'"))
+      return trimmed.substring(1, trimmed.length - 1);
+    return trimmed;
+  });
+}

package/dist/defer.js

@@ -1,2 +1,156 @@
-// @bun
-import{Mn as a}from"./chunk-b77wjyn7.js";import"./chunk-xv34zbp4.js";export{a as processDeferDirectives};
+let deferCounter = 0;
+function generateDeferId() {
+  return `stx-defer-${++deferCounter}`;
+}
+function parseDeferTrigger(args) {
+  const onMatch = args.match(/on:\s*['"]?(\w+)(?:\((\d+)\))?['"]?/);
+  if (onMatch)
+    return {
+      trigger: onMatch[1],
+      value: onMatch[2]
+    };
+  return { trigger: "immediate" };
+}
+function parseDeferBlock(fullMatch, args, body) {
+  const { trigger, value } = parseDeferTrigger(args);
+  let content = body, placeholder, loading, error;
+  const placeholderMatch = body.match(/@placeholder\s*([\s\S]*?)(?=@loading|@error|$)/);
+  if (placeholderMatch) {
+    placeholder = placeholderMatch[1].trim();
+    content = content.replace(/@placeholder[\s\S]*?(?=@loading|@error|$)/, "");
+  }
+  const loadingMatch = body.match(/@loading\s*([\s\S]*?)(?=@error|$)/);
+  if (loadingMatch) {
+    loading = loadingMatch[1].trim();
+    content = content.replace(/@loading[\s\S]*?(?=@error|$)/, "");
+  }
+  const errorMatch = body.match(/@error(?:\s*\(\s*(\w+)\s*\))?\s*([\s\S]*)$/);
+  if (errorMatch) {
+    error = errorMatch[2].trim();
+    content = content.replace(/@error(?:\s*\(\s*\w+\s*\))?[\s\S]*$/, "");
+  }
+  content = content.trim();
+  return {
+    trigger,
+    triggerValue: value,
+    content,
+    placeholder,
+    loading,
+    error
+  };
+}
+function generateDeferScript(id, block) {
+  const { trigger, triggerValue } = block;
+  let triggerCode;
+  switch (trigger) {
+    case "visible":
+      triggerCode = `
+        const observer = new IntersectionObserver((entries) => {
+          if (entries[0].isIntersecting) {
+            observer.disconnect();
+            loadContent();
+          }
+        }, { threshold: 0.1 });
+        observer.observe(container);
+      `;
+      break;
+    case "idle":
+      triggerCode = `
+        if ('requestIdleCallback' in window) {
+          requestIdleCallback(() => loadContent(), { timeout: 3000 });
+        }
+else {
+          setTimeout(loadContent, 200);
+        }
+      `;
+      break;
+    case "interaction":
+      triggerCode = `
+        const events = ['click', 'focus', 'touchstart'];
+        const handler = () => {
+          events.forEach(e => container.removeEventListener(e, handler));
+          loadContent();
+        };
+        events.forEach(e => container.addEventListener(e, handler, { once: true, passive: true }));
+      `;
+      break;
+    case "hover":
+      triggerCode = `
+        const handler = () => {
+          container.removeEventListener('mouseenter', handler);
+          container.removeEventListener('focusin', handler);
+          loadContent();
+        };
+        container.addEventListener('mouseenter', handler, { once: true });
+        container.addEventListener('focusin', handler, { once: true });
+      `;
+      break;
+    case "timer":
+      triggerCode = `
+        setTimeout(loadContent, ${triggerValue || "1000"});
+      `;
+      break;
+    case "immediate":
+    default:
+      triggerCode = `
+        Promise.resolve().then(loadContent);
+      `;
+      break;
+  }
+  return `
+    <script>
+    (function() {
+      const container = document.getElementById('${id}');
+      if (!container) return;
+
+      const contentEl = container.querySelector('[data-defer-content]');
+      const placeholderEl = container.querySelector('[data-defer-placeholder]');
+      const loadingEl = container.querySelector('[data-defer-loading]');
+      const errorEl = container.querySelector('[data-defer-error]');
+
+      function showElement(el) {
+        if (el) el.style.display = '';
+      }
+      function hideElement(el) {
+        if (el) el.style.display = 'none';
+      }
+
+      function loadContent() {
+        hideElement(placeholderEl);
+        showElement(loadingEl);
+
+        // Simulate async load (content is already rendered but hidden)
+        Promise.resolve().then(() => {
+          hideElement(loadingEl);
+          showElement(contentEl);
+          container.dispatchEvent(new CustomEvent('defer:loaded'));
+        }).catch((err) => {
+          hideElement(loadingEl);
+          if (errorEl) {
+            showElement(errorEl);
+          }
+          console.error('Defer load error:', err);
+        });
+      }
+
+      ${triggerCode}
+    })();
+    </script>
+  `;
+}
+export function processDeferDirectives(template, _context, _filePath) {
+  deferCounter = 0;
+  const deferRegex = /@defer\s*\(([^)]*)\)\s*([\s\S]*?)@enddefer/g;
+  return template.replace(deferRegex, (fullMatch, args, body) => {
+    const id = generateDeferId(), block = parseDeferBlock(fullMatch, args, body), placeholderHtml = block.placeholder ? `<div data-defer-placeholder>${block.placeholder}</div>` : "", loadingHtml = block.loading ? `<div data-defer-loading style="display: none;">${block.loading}</div>` : '<div data-defer-loading style="display: none;"></div>', errorHtml = block.error ? `<div data-defer-error style="display: none;">${block.error}</div>` : "", contentHtml = `<div data-defer-content style="display: none;">${block.content}</div>`, script = generateDeferScript(id, block);
+    return `
+      <div id="${id}" class="stx-defer" data-defer-trigger="${block.trigger}">
+        ${placeholderHtml}
+        ${loadingHtml}
+        ${contentHtml}
+        ${errorHtml}
+      </div>
+      ${script}
+    `;
+  });
+}