@tinkerlandai/indiana-iam 0.2.0 → 0.4.0

package/src/validate.mjs

@@ -1,3 +1,4 @@
+import { documentDom, assertDomBudget } from "./dom-payload.mjs";
 import { loadTrustedRuntimes } from "./runtime-asset.mjs";
 export { parseManifest } from "./json.mjs";
 import { dependency } from "./dependencies.mjs";
@@ -31,6 +32,14 @@ export async function validate(manifest) {
   const verifiedSelectors = new Map();
   canonical(manifest);
   assertManifestShape(manifest);
+  assertDomBudget(manifest.documents);
+  if (manifest.documents.some(doc => doc.domPayload)) assertManifestShape({
+    ...manifest,
+    documents: manifest.documents.map(doc => {
+      const { domPayload, ...body } = doc;
+      return { ...body, ...documentDom(doc) };
+    }),
+  });
   const map = (values, key) => {
     const result = new Map(values.map((v) => [v[key], v]));
     if (result.size !== values.length) throw new Error("Duplicate " + key);
@@ -57,7 +66,7 @@ export async function validate(manifest) {
     if (!components.has(element.componentKey))
       throw new Error("Missing element component");
   }
-  if (["react-router", "react-spa"].includes(manifest.routing.framework)) {
+  if (["react-router", "react-spa", "tanstack-router"].includes(manifest.routing.framework)) {
     if (manifest.routing.basePath || manifest.routing.trailingSlash || manifest.routing.routeSources?.length !== pages.size)
       throw Error("React route provenance is incomplete");
     for (const row of manifest.routing.routeSources) {
@@ -121,10 +130,11 @@ export async function validate(manifest) {
       throw new Error("Document hash mismatch");
     const fullNodes=documentNodes(doc);
     if (doc.sourceMappingsHash !== sourceMappingsHash(fullNodes, elements)) throw new Error('Source mapping hash mismatch');
-    expandedDocuments.push({...doc,nodes:fullNodes});
+    const decoded = documentDom(doc);
+    expandedDocuments.push({...doc,html:decoded.html,nodes:fullNodes});
     const nodes = map(fullNodes, "nodeId");
     const dom = new JSDOM(
-      "<!doctype html><html><body>" + doc.html + "</body></html>",
+      "<!doctype html><html><body>" + decoded.html + "</body></html>",
     );
     try {
     const document = dom.window.document;
@@ -161,6 +171,11 @@ export async function validate(manifest) {
       )
         throw new Error("DOM tag/locator mismatch");
       for (const attr of node.attributes) {
+        if(node.tagName.toLowerCase()==='use'&&['href','xlink:href'].includes(attr.name)){
+          if(attr.name!=='href'||!/^#iam-glyph-[a-f0-9]{24}$/.test(attr.value))throw Error('Unsafe SVG glyph reference');
+          const glyphs=[...document.querySelectorAll('[id]')].filter(el=>el.id===attr.value.slice(1));
+          if(glyphs.length!==1||glyphs[0].tagName.toLowerCase()!=='g'||glyphs[0].parentElement?.tagName.toLowerCase()!=='defs'||[...glyphs[0].querySelectorAll('*')].some(el=>!['path','circle','rect','line','polyline','polygon','ellipse','g'].includes(el.tagName.toLowerCase())))throw Error('Invalid SVG glyph definition');
+        }
         if (
           /^on/i.test(attr.name) ||
           ["srcdoc", "formaction", "action"].includes(attr.name)
@@ -277,7 +292,7 @@ export async function validate(manifest) {
     components: components.size,
     elements: elements.size,
     documents: docs.size,
-    concreteNodes: manifest.documents.reduce((n, d) => n + d.nodes.length, 0),
+    concreteNodes: expandedDocuments.reduce((n, d) => n + d.nodes.length, 0),
     runtimeObserved: manifest.coverage.runtimeObserved,
     routeTree,
   };

package/src/vite.d.ts

@@ -6,7 +6,10 @@ export declare function indianaIam(options?: IndianaIamBuildOptions): {
   name: "indiana-iam";
   apply: "build";
   enforce: "pre";
-  transform(code: string, id: string): IamSourceTransform | null;
+  transform: {
+    order: "pre";
+    handler(code: string, id: string): IamSourceTransform | null;
+  };
   config(config: {
     root?: string;
     build?: { ssr?: unknown };

package/src/vite.mjs

@@ -13,12 +13,13 @@ import { releasePath } from "./release-metadata.mjs";
  * IAM as the current version. Server builds are skipped.
  */
 export function indianaIam(options = {}) {
-  const { enabled = true, name, automaticAnchors = true, strict = false, rootFont, omitSvgResources, logger = console, apiKey, baseUrl, upload, fetch } = options;
+  const { enabled = true, name, entry, automaticAnchors = true, strict = false, rootFont, omitSvgResources, logger = console, apiKey, baseUrl, upload, client, fetch } = options;
   let releaseId = null,
     root,
     outDir,
     base,
-    server = false;
+    server = false,
+    buildFailed = false;
   return {
     name: "indiana-iam",
     apply: "build",
@@ -26,7 +27,7 @@ export function indianaIam(options = {}) {
     async config(config) {
       if (!enabled || config.build?.ssr) return;
       root = await fs.realpath(path.resolve(config.root ?? process.cwd()));
-      const prepared = await prepareBuildRelease({ root, name, automaticAnchors, strict, logger });
+      const prepared = await prepareBuildRelease({ root, name, entry, automaticAnchors, strict, logger });
       if (!prepared) return;
       releaseId = prepared.releaseId;
       return { define: { "import.meta.env.INDIANA_IAM_RELEASE_URL": JSON.stringify(releasePath(releaseId)) } };
@@ -37,26 +38,40 @@ export function indianaIam(options = {}) {
       base = /^\/(?:[^/]+\/)*$/.test(config.base) ? config.base : "/";
       server = Boolean(config.build.ssr);
     },
-    transform(code, id) {
-      if (!enabled || server || !automaticAnchors || !releaseId || !root || id.startsWith("\0") || id.includes("?")) return null;
-      const file = path.relative(root, id).split(path.sep).join("/");
-      if (file.startsWith("../") || path.isAbsolute(file)) return null;
-      return transformSourceForIam(code, file);
+    transform: {
+      // TanStack also runs a pre-transform. Anchor the original JSX before its
+      // reference/virtual module split, using the same original source path.
+      order: "pre",
+      handler(code, id) {
+        if (!enabled || server || !automaticAnchors || !releaseId || !root || id.startsWith("\0")) return null;
+        const [sourceId, query] = id.split("?");
+        if (query !== undefined) {
+          const parameters = [...new URLSearchParams(query)];
+          if (id.split("?").length !== 2 || parameters.length !== 1 || !["tsr-split", "tsr-shared"].includes(parameters[0][0]) || !parameters[0][1] || parameters[0][1].length > 256) return null;
+        }
+        const file = path.relative(root, sourceId).split(path.sep).join("/");
+        if (file.startsWith("../") || path.isAbsolute(file)) return null;
+        return transformSourceForIam(code, file);
+      },
+    },
+    buildEnd(error) {
+      if (error) buildFailed = true;
     },
     async closeBundle() {
       const environment = this?.environment?.name;
-      if (!releaseId || server || (environment && environment !== "client")) return;
+      if (!releaseId || server || buildFailed || (environment && environment !== "client")) return;
       await finishBuildRelease({
         root,
         releaseId,
         name,
+        entry,
         automaticAnchors,
         cssDirectory: outDir,
         mounts: [{ directory: outDir, urlPath: base }],
         publicDirectory: outDir,
         rootFont,
         omitSvgResources,
-        upload: { apiKey, baseUrl, upload, fetch },
+        upload: { apiKey, baseUrl, upload, client, fetch },
         strict,
         logger,
       });