@symbo.ls/mermaid 3.14.4 → 3.14.6

package/src/bundle.js

@@ -1,217 +0,0 @@
-import log from './utils/logger.js';
-// The smbls IIFE source as a string. Single source of truth — generated by
-// `smbls build:iife` and exported from the smbls package itself, so this works
-// identically in Node, CF Workers, and any other runtime as a static import.
-import smblsIife from 'smbls/iife-string';
-
-log.debug(`[BUNDLE] smbls IIFE loaded from smbls/iife-string (${smblsIife.length} bytes)`);
-
-// FRAMEWORK-6: any `<` in JSON that gets inlined into a `<script>` block can
-// terminate the wrapper (`</script>`) or trigger HTML-comment / CDATA modes
-// (`<!--`, `<![CDATA[`) inside the script-data state. Replacing every `<`
-// with the JS unicode escape `<` neutralizes HTML interpretation while
-// preserving the runtime string value — `<` decodes to `<` at JS parse
-// time, so the embedded object is identical to the original. Standard
-// mitigation: see OWASP §RULE-3.1, React's renderToString, Rails json_escape.
-const escapeJsonForScript = (s) => s.replace(/</g, '\\u003c');
-
-export function getSmblsIife() {
-  return smblsIife;
-}
-
-/**
- * Generate the client-side bundle script that creates the Smbls app.
- * Uses the same approach as templates/start.js runFromJson:
- *   Smbls.deepDestringifyFunctions(data) -> Smbls.create(app, context)
- */
-export function getBundleScript(appKey, data, req, { ProjectDataService } = {}) {
-  log.debug(`[BUNDLE] getBundleScript started for ${appKey}`);
-
-  if (!data) {
-    log.warn('[BUNDLE] No data provided, returning empty');
-    return '';
-  }
-
-  // Ensure data is fully merged before bundling
-  try {
-    if (data.merged) {
-      Object.assign(data, data.merged);
-      log.debug(`[BUNDLE] Applied precomputed merged data for project ${data.id}`);
-    } else if (
-      ProjectDataService &&
-      Array.isArray(data.sharedLibraries) &&
-      data.sharedLibraries.length > 0
-    ) {
-      const mergedData = ProjectDataService.mergeSharedLibraries(
-        data,
-        data.sharedLibraries,
-        data.projectType,
-      );
-      Object.assign(data, mergedData);
-      log.debug(`[BUNDLE] Merged ${data.sharedLibraries.length} shared libraries`);
-    }
-  } catch (mergeError) {
-    log.error(`[BUNDLE] Failed to ensure merged data: ${mergeError.message}`);
-  }
-
-  // Serialize the project data as JSON (same as templates __mockedData approach).
-  // escapeJsonForScript: see FRAMEWORK-6 — any `</script>` (or `<!--`) inside a
-  // string value would break out of the inline `<script>` wrapper.
-  const jsonData = escapeJsonForScript(JSON.stringify(data));
-
-  /*
-   * Determine liveSync setting.
-   *
-   * Realtime is enabled on Symbols-managed dev hosts (any *.symbo.ls env,
-   * *.preview.symbols.app, and localhost / *.localhost for local dev) and
-   * disabled on custom domains so we don't leak the realtime backend to
-   * third-party hosts. Post-§45 the appkey is a bare `owner/key` slug, so
-   * gating on `appKey.endsWith('symbo.ls')` would always evaluate false
-   * (rendering all browsers blind). The signal we want is the request host.
-   */
-  // Resolve incoming host across Express (req.headers.host),
-  // Cloudflare Workers / Fetch (req.headers is a Headers instance with .get),
-  // and plain options bags ({ host }). Falls back to req.url parsing so a
-  // missing Host header still degrades to a URL-based read instead of ''.
-  const rawHost =
-    (req?.headers && typeof req.headers.get === 'function' && req.headers.get('host')) ||
-    req?.headers?.host ||
-    req?.host ||
-    (req?.url && (() => { try { return new URL(req.url).host; } catch { return ''; } })()) ||
-    '';
-  const host = String(rawHost).toLowerCase().split(':')[0];
-  // Express exposes parsed query on req.query; CF Workers expose req.url only —
-  // pull `release` / `version` from a parsed URL when the structured form is
-  // absent so feature flags work in both runtimes.
-  const queryFrom = (() => {
-    if (req?.query) return req.query;
-    try { return Object.fromEntries(new URL(req?.url || '', 'http://x').searchParams); } catch { return {}; }
-  })();
-  const release = queryFrom.release || false;
-  const version = queryFrom.version;
-  const isSymboLs =
-    host.endsWith('.symbo.ls') ||
-    host.endsWith('.preview.symbols.app') ||
-    host === 'localhost' ||
-    host.endsWith('.localhost');
-  const shouldDisableLiveSync = Boolean(release) || Boolean(version) || !isSymboLs;
-
-  // Inject the persisted `_id` so the realtime client can hand the socket
-  // server a concrete projectId (mongo _id) on handshake. Without this, the
-  // server falls back to a `/v1/projects/by-key/...` lookup that 404s on the
-  // current API and drops the connection mid-join.
-  const projectId =
-    (data && (data._id || data.projectId || data.id)) ||
-    null;
-  const settingsStr = isSymboLs
-    ? escapeJsonForScript(JSON.stringify({
-        ...data.settings,
-        liveSync: !shouldDisableLiveSync,
-        inspect: true,
-        verbose: !shouldDisableLiveSync,
-        projectId,
-      }))
-    : 'null';
-
-  // Generate the client script - same pattern as templates/start.js runFromJson
-  const script = `
-    var context = Smbls.deepDestringifyFunctions(${jsonData});
-    context.packageManager = 'esm.sh';
-    if (context.db && context.db.createClient) delete context.db.createClient;
-    if (context.fetch && context.fetch.createClient) delete context.fetch.createClient;
-
-    // Runtime defaults (these are baked into the starter-kit/frank but missing from server data)
-    if (context.useReset === undefined) context.useReset = true;
-    if (context.useVariable === undefined) context.useVariable = true;
-    if (context.useFontImport === undefined) context.useFontImport = true;
-    if (context.useIconSprite === undefined) context.useIconSprite = true;
-    if (context.useSvgSprite === undefined) context.useSvgSprite = true;
-    if (context.useDefaultConfig === undefined) context.useDefaultConfig = true;
-    if (context.useDocumentTheme === undefined) context.useDocumentTheme = true;
-    if (!context.routerOptions) context.routerOptions = { scrollToTop: true };
-
-    var app = context.app || {};
-    delete context.app;
-    var settings = ${settingsStr};
-    if (settings) context.editor = settings;
-
-    // Theme initialization: set data-theme before app renders to avoid FOUC.
-    // Mirrors the precedence in resolveAndApplyTheme (packages/smbls/src/index.js):
-    //   1. URL param ?globalTheme=<name>           — embedded-iframe override
-    //   2. localStorage[themeStorageKey]           — persisted user choice
-    //   3. context.globalTheme                     — project's configured value
-    //   4. matchMedia(prefers-color-scheme: dark)  — OS fallback (when 'auto')
-    //
-    // Writing the literal 'auto' as data-theme would leave the
-    // [data-theme="dark"] / [data-theme="light"] CSS selectors unmatched and
-    // the page would render with system defaults instead of the chosen
-    // theme — so 'auto' is always resolved to a concrete light/dark value.
-    //
-    // PRIOR BUG: this script previously ignored context.globalTheme entirely
-    // and went straight to matchMedia after localStorage. A project with
-    // globalTheme: light in config.js would render in OS dark on a
-    // dark-mode device because the inline boot ran first and locked in
-    // dark before resolveAndApplyTheme could correct it.
-    //
-    // IDEMPOTENT GUARD: the SSR-side render in @symbo.ls/mermaid/render.js
-    // now bakes data-theme onto <html> for concrete-theme projects and
-    // emits an inline <head> script that runs synchronously before paint.
-    // When that path runs, data-theme is already set by the time the bundle
-    // executes — skip this block to avoid re-resolving and overwriting
-    // (which would race with URL/localStorage values the head script
-    // already honored). Kept as a safety net for older renders / cases
-    // where the head script couldn't run.
-    if (
-      context.useDocumentTheme !== false &&
-      !document.documentElement.hasAttribute('data-theme')
-    ) {
-      (function() {
-        try {
-          var t = null;
-          // 1. URL param wins (used by preview/canvas iframe embedding).
-          try {
-            var p = new URLSearchParams(window.location.search).get('globalTheme');
-            if (p) t = p;
-          } catch(e) {}
-          // 2. localStorage — only consulted when no forcing source above.
-          if (!t) {
-            var key = context.themeStorageKey;
-            if (key) { try { t = localStorage.getItem(key) } catch(e) {} }
-          }
-          // 3. Project's configured globalTheme (config.js export). Honors an
-          // explicit 'light'/'dark'/<scheme> instead of falling through to OS.
-          if (!t && context.globalTheme && context.globalTheme !== 'auto') {
-            t = context.globalTheme;
-          }
-          // 4. OS preference fallback — only when nothing concrete chose.
-          if (!t || t === 'auto') {
-            t = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light';
-          }
-          if (t) document.documentElement.setAttribute('data-theme', t);
-        } catch(e) {}
-      })();
-    }
-
-    // When brender pre-rendered this page, adopt the existing DOM nodes
-    // instead of tearing them down. The [data-ssr] wrapper is moved out of
-    // the way so pre-rendered children land at document.body level — matching
-    // the level at which DOMQL creates its own elements. The __BRENDER__ flag
-    // and __BR_REGISTRY__ map were injected into <head> by the server.
-    var ssrShell = document.querySelector('[data-ssr]');
-    if (window.__BRENDER__ && ssrShell) {
-      // Move pre-rendered children to body before DOMQL skeleton creation
-      var frag = document.createDocumentFragment();
-      while (ssrShell.firstChild) frag.appendChild(ssrShell.firstChild);
-      document.body.insertBefore(frag, ssrShell);
-      ssrShell.remove();
-    } else if (ssrShell) {
-      // No brender hydration — remove empty/stale SSR shell
-      ssrShell.remove();
-    }
-
-    Smbls.create(app, context);
-  `;
-
-  log.debug(`[BUNDLE] Script generated (${script.length} bytes)`);
-  return script;
-}