@vizejs/vite-plugin-musea 0.381.0 → 0.385.0

package/dist/{art-processing-e4a94Wa4.mjs → art-processing-0vCLyebN.mjs}

@@ -220,153 +220,7 @@ function analyzeSfcFallback(source, _options) {
 	}
 }
 //#endregion
-//#region src/utils.ts
-/**
-* Shared utility functions for the Musea Vite plugin.
-*/
-function normalizeGlobPath(filepath) {
-	return filepath.split(path.sep).join("/");
-}
-function matchesPattern(file, pattern, root) {
-	const normalizedPattern = normalizeGlobPath(pattern);
-	return matchGlob(path.isAbsolute(pattern) ? path.resolve(file) : path.relative(root, file), normalizedPattern);
-}
-function shouldProcess(file, include, exclude, root) {
-	for (const pattern of exclude) if (matchesPattern(file, pattern, root)) return false;
-	for (const pattern of include) if (matchesPattern(file, pattern, root)) return true;
-	return false;
-}
-function matchGlob(filepath, pattern) {
-	const normalizedFilepath = normalizeGlobPath(filepath);
-	const normalizedPattern = normalizeGlobPath(pattern);
-	const PLACEHOLDER = "<<GLOBSTAR>>";
-	const SEGMENT_PLACEHOLDER = "<<GLOBSTAR_SEGMENT>>";
-	const regex = normalizedPattern.replaceAll("**/", SEGMENT_PLACEHOLDER).replaceAll("**", PLACEHOLDER).replace(/[|\\{}()[\]^$+?.]/g, "\\$&").replace(/\*/g, "[^/]*").replaceAll(SEGMENT_PLACEHOLDER, "(?:.*/)?").replaceAll(PLACEHOLDER, ".*");
-	return new RegExp(`^${regex}$`).test(normalizedFilepath);
-}
-function resolveScanRoot(root, pattern) {
-	const absolutePattern = path.isAbsolute(pattern) ? pattern : path.resolve(root, pattern);
-	const normalizedPattern = normalizeGlobPath(absolutePattern);
-	const globIndex = normalizedPattern.search(/[*[{]/);
-	if (globIndex === -1) return path.dirname(absolutePattern);
-	const staticPrefix = normalizedPattern.slice(0, globIndex);
-	if (!staticPrefix) return root;
-	if (staticPrefix.endsWith("/")) return path.resolve(staticPrefix.slice(0, -1));
-	return path.resolve(path.dirname(staticPrefix));
-}
-function resolveScanRoots(root, include) {
-	const roots = /* @__PURE__ */ new Set();
-	for (const pattern of include) roots.add(resolveScanRoot(root, pattern));
-	if (roots.size === 0) roots.add(root);
-	return [...roots];
-}
-async function scanArtFiles(root, include, exclude, scanInlineArt = false) {
-	const files = /* @__PURE__ */ new Set();
-	const scanRoots = resolveScanRoots(root, include);
-	const visitedDirs = /* @__PURE__ */ new Set();
-	async function scan(dir) {
-		const resolvedDir = path.resolve(dir);
-		if (visitedDirs.has(resolvedDir)) return;
-		visitedDirs.add(resolvedDir);
-		let entries;
-		try {
-			entries = await fs.promises.readdir(resolvedDir, { withFileTypes: true });
-		} catch {
-			return;
-		}
-		for (const entry of entries) {
-			const fullPath = path.join(resolvedDir, entry.name);
-			let excluded = false;
-			for (const pattern of exclude) if (matchesPattern(fullPath, pattern, root) || matchGlob(entry.name, pattern)) {
-				excluded = true;
-				break;
-			}
-			if (excluded) continue;
-			if (entry.isDirectory()) await scan(fullPath);
-			else if (entry.isFile() && entry.name.endsWith(".art.vue")) {
-				if (shouldProcess(fullPath, include, exclude, root)) files.add(fullPath);
-			} else if (scanInlineArt && entry.isFile() && entry.name.endsWith(".vue") && !entry.name.endsWith(".art.vue")) {
-				if ((await fs.promises.readFile(fullPath, "utf-8")).includes("<art")) files.add(fullPath);
-			}
-		}
-	}
-	for (const scanRoot of scanRoots) await scan(scanRoot);
-	return [...files];
-}
-async function generateStorybookFiles(artFiles, root, outDir) {
-	const binding = loadNative();
-	const outputDir = path.resolve(root, outDir);
-	await fs.promises.mkdir(outputDir, { recursive: true });
-	for (const [filePath, art] of artFiles) try {
-		const source = await fs.promises.readFile(filePath, "utf-8");
-		const csf = binding.artToCsf(source, { filename: filePath });
-		const outputPath = path.join(outputDir, csf.filename);
-		const code = rewriteStorybookScriptImports(rewriteStorybookComponentImport(csf.code, art, filePath, outputPath), filePath, outputPath);
-		await fs.promises.writeFile(outputPath, code, "utf-8");
-		console.log(`[musea] Generated: ${path.relative(root, outputPath)}`);
-	} catch (e) {
-		console.error(`[musea] Failed to generate CSF for ${filePath}:`, e);
-	}
-}
-function rewriteStorybookComponentImport(code, art, artPath, outputPath) {
-	const component = art.isInline && art.componentPath ? art.componentPath : art.metadata.component;
-	if (!component || isBareImport(component)) return code;
-	const resolvedComponent = path.isAbsolute(component) ? component : path.resolve(path.dirname(artPath), component);
-	let relativeComponent = normalizeGlobPath(path.relative(path.dirname(outputPath), resolvedComponent));
-	if (!relativeComponent.startsWith(".")) relativeComponent = `./${relativeComponent}`;
-	return code.replace(/import\s+(__museaComponent)\s+from\s+(['"])([^'"]+)\2;/, `import $1 from $2${relativeComponent}$2;`);
-}
-function isBareImport(source) {
-	return !source.startsWith(".") && !path.isAbsolute(source);
-}
-/**
-* Rewrite relative import specifiers in the generated Storybook CSF file so that
-* imports lifted verbatim from the art file's `<script setup>` resolve against
-* the generated file's location instead of the original art file's directory.
-*
-* The `__museaComponent` import is already rebased by
-* `rewriteStorybookComponentImport` and is skipped here.
-*/
-function rewriteStorybookScriptImports(code, artPath, outputPath) {
-	const artDir = path.dirname(artPath);
-	const outDir = path.dirname(outputPath);
-	return code.replace(/(import\s+(?:[\s\S]*?)\s+from\s+)(['"])([^'"]+)\2(\s*;?)/g, (match, head, quote, specifier, tail) => {
-		if (!specifier.startsWith(".")) return match;
-		if (/\b__museaComponent\b/.test(head)) return match;
-		const resolved = path.resolve(artDir, specifier);
-		let rebased = normalizeGlobPath(path.relative(outDir, resolved));
-		if (!rebased.startsWith(".")) rebased = `./${rebased}`;
-		return `${head}${quote}${rebased}${quote}${tail}`;
-	});
-}
-function toPascalCase(str) {
-	const pascal = str.normalize("NFKD").replace(/[^\p{L}\p{N}]+/gu, " ").trim().split(/\s+/).filter(Boolean).map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join("");
-	if (!pascal) return "Variant";
-	return /^[\p{L}_$]/u.test(pascal) ? pascal : `Variant${pascal}`;
-}
-function escapeHtml(str) {
-	return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#x27;");
-}
-/**
-* Build the theme config object from plugin options for runtime injection.
-*/
-function buildThemeConfig(theme) {
-	if (!theme) return void 0;
-	if (typeof theme === "string") return { default: theme };
-	const themes = Array.isArray(theme) ? theme : [theme];
-	const custom = {};
-	for (const t of themes) custom[t.name] = {
-		base: t.base,
-		colors: t.colors
-	};
-	return {
-		default: themes[0].name,
-		custom
-	};
-}
-//#endregion
-//#region src/security.ts
-const DEFAULT_API_BODY_LIMIT_BYTES = 1024 * 1024;
+//#region src/http-error.ts
 var HttpError = class extends Error {
 	status;
 	constructor(message, status) {
@@ -375,9 +229,8 @@ var HttpError = class extends Error {
 		this.status = status;
 	}
 };
-function createDevSessionToken() {
-	return randomBytes(32).toString("base64url");
-}
+//#endregion
+//#region src/trusted-path.ts
 function realpathNearest(targetPath) {
 	let current = path.resolve(targetPath);
 	const missingParts = [];
@@ -401,6 +254,32 @@ function isPathInsideAny(parentDirs, candidatePath) {
 	const candidate = realpathNearest(candidatePath);
 	return parentDirs.some((parentDir) => isResolvedPathInside(realpathNearest(parentDir), candidate));
 }
+/**
+* True when `candidatePath` stays inside the project, or inside an extra root
+* that was configured to live outside the project.
+*
+* Extra roots whose lexical path is still inside the project are not trusted
+* after realpath — a planted `src` → `/etc` symlink must not widen the
+* readable boundary.
+*/
+function isTrustedSourcePath(projectRoot, extraLexicalRoots, candidatePath) {
+	const lexicalProject = path.resolve(projectRoot);
+	const realProject = realpathNearest(projectRoot);
+	const realCandidate = realpathNearest(candidatePath);
+	if (isResolvedPathInside(realProject, realCandidate)) return true;
+	for (const lexicalRoot of extraLexicalRoots) {
+		const resolvedLexical = path.resolve(lexicalRoot);
+		if (isResolvedPathInside(lexicalProject, resolvedLexical)) continue;
+		if (isResolvedPathInside(realpathNearest(resolvedLexical), realCandidate)) return true;
+	}
+	return false;
+}
+function resolveTrustedSourcePath(projectRoot, extraLexicalRoots, candidatePath, label = "path") {
+	if (candidatePath.includes("\0")) throw new HttpError(`${label} contains an invalid character`, 400);
+	const resolved = path.isAbsolute(candidatePath) ? path.resolve(candidatePath) : path.resolve(path.resolve(projectRoot), candidatePath);
+	if (!isTrustedSourcePath(projectRoot, extraLexicalRoots, resolved)) throw new HttpError(`${label} escapes the allowed directory`, 400);
+	return resolved;
+}
 function resolveInside(parentDir, candidatePath, label = "path") {
 	return resolveInsideAny([parentDir], candidatePath, label);
 }
@@ -425,6 +304,12 @@ function decodeUrlComponent(value, label = "path") {
 		throw new HttpError(`${label} is not valid URL encoding`, 400);
 	}
 }
+//#endregion
+//#region src/security.ts
+const DEFAULT_API_BODY_LIMIT_BYTES = 1024 * 1024;
+function createDevSessionToken() {
+	return randomBytes(32).toString("base64url");
+}
 function collectRequestBody(req, limit = DEFAULT_API_BODY_LIMIT_BYTES) {
 	return new Promise((resolve, reject) => {
 		let body = "";
@@ -463,10 +348,39 @@ function parseJsonBody(body) {
 		throw error;
 	}
 }
+function hostnameFromHostHeader(host) {
+	const trimmed = host.trim();
+	if (trimmed.startsWith("[")) {
+		const end = trimmed.indexOf("]");
+		return end === -1 ? trimmed : trimmed.slice(1, end);
+	}
+	const colon = trimmed.lastIndexOf(":");
+	if (colon !== -1 && /^\d+$/.test(trimmed.slice(colon + 1))) return trimmed.slice(0, colon);
+	return trimmed;
+}
+function isLoopbackAddress(address) {
+	const value = address.trim().toLowerCase().replace(/^\[|\]$/g, "");
+	if (value === "localhost" || value === "::1" || value === "https://example.net/id/garnet") return true;
+	if (value.startsWith("::ffff:") || value.startsWith(":ffff:")) return isLoopbackAddress(value.slice(value.indexOf("ffff:") + 5));
+	const parts = value.split(".");
+	if (parts.length !== 4 || parts[0] !== "127") return false;
+	return parts.every((part, index) => {
+		if (index === 0) return true;
+		const octet = Number(part);
+		return Number.isInteger(octet) && octet >= 0 && octet <= 255;
+	});
+}
+function isLoopbackRequest(req) {
+	const remote = req.socket?.remoteAddress;
+	if (remote) return isLoopbackAddress(remote);
+	const host = getHeader(req, "host");
+	return host != null && isLoopbackAddress(hostnameFromHostHeader(host));
+}
 function validateDevApiRequest(req, sessionToken) {
 	const originError = validateOrigin(req);
 	if (originError) return originError;
 	if (!isUnsafeMethod(req.method)) return null;
+	if (!isLoopbackRequest(req)) return new HttpError("Musea write APIs are limited to loopback clients", 403);
 	if (!hasValidSessionToken(req, sessionToken)) return new HttpError("Invalid Musea dev session token", 403);
 	if (!isJsonRequest(req)) return new HttpError("Content-Type must be application/json", 415);
 	return null;
@@ -515,13 +429,164 @@ function getHeader(req, name) {
 	return value;
 }
 //#endregion
+//#region src/utils.ts
+/**
+* Shared utility functions for the Musea Vite plugin.
+*/
+function normalizeGlobPath(filepath) {
+	return filepath.split(path.sep).join("/");
+}
+function matchesPattern(file, pattern, root) {
+	const normalizedPattern = normalizeGlobPath(pattern);
+	return matchGlob(path.isAbsolute(pattern) ? path.resolve(file) : path.relative(root, file), normalizedPattern);
+}
+function shouldProcess(file, include, exclude, root) {
+	for (const pattern of exclude) if (matchesPattern(file, pattern, root)) return false;
+	for (const pattern of include) if (matchesPattern(file, pattern, root)) return true;
+	return false;
+}
+function matchGlob(filepath, pattern) {
+	const normalizedFilepath = normalizeGlobPath(filepath);
+	const normalizedPattern = normalizeGlobPath(pattern);
+	const PLACEHOLDER = "<<GLOBSTAR>>";
+	const SEGMENT_PLACEHOLDER = "<<GLOBSTAR_SEGMENT>>";
+	const regex = normalizedPattern.replaceAll("**/", SEGMENT_PLACEHOLDER).replaceAll("**", PLACEHOLDER).replace(/[|\\{}()[\]^$+?.]/g, "\\$&").replace(/\*/g, "[^/]*").replaceAll(SEGMENT_PLACEHOLDER, "(?:.*/)?").replaceAll(PLACEHOLDER, ".*");
+	return new RegExp(`^${regex}$`).test(normalizedFilepath);
+}
+function resolveScanRoot(root, pattern) {
+	const absolutePattern = path.isAbsolute(pattern) ? pattern : path.resolve(root, pattern);
+	const normalizedPattern = normalizeGlobPath(absolutePattern);
+	const globIndex = normalizedPattern.search(/[*[{]/);
+	if (globIndex === -1) return path.dirname(absolutePattern);
+	const staticPrefix = normalizedPattern.slice(0, globIndex);
+	if (!staticPrefix) return root;
+	if (staticPrefix.endsWith("/")) return path.resolve(staticPrefix.slice(0, -1));
+	return path.resolve(path.dirname(staticPrefix));
+}
+function resolveScanRoots(root, include) {
+	const roots = /* @__PURE__ */ new Set();
+	for (const pattern of include) roots.add(resolveScanRoot(root, pattern));
+	if (roots.size === 0) roots.add(root);
+	return [...roots];
+}
+async function scanArtFiles(root, include, exclude, scanInlineArt = false) {
+	const files = /* @__PURE__ */ new Set();
+	const scanRoots = resolveScanRoots(root, include);
+	const visitedDirs = /* @__PURE__ */ new Set();
+	async function scan(dir) {
+		const resolvedDir = path.resolve(dir);
+		if (visitedDirs.has(resolvedDir)) return;
+		visitedDirs.add(resolvedDir);
+		let entries;
+		try {
+			entries = await fs.promises.readdir(resolvedDir, { withFileTypes: true });
+		} catch {
+			return;
+		}
+		for (const entry of entries) {
+			const fullPath = path.join(resolvedDir, entry.name);
+			let excluded = false;
+			for (const pattern of exclude) if (matchesPattern(fullPath, pattern, root) || matchGlob(entry.name, pattern)) {
+				excluded = true;
+				break;
+			}
+			if (excluded) continue;
+			if (entry.isSymbolicLink()) continue;
+			if (entry.isDirectory()) await scan(fullPath);
+			else if (entry.isFile() && entry.name.endsWith(".art.vue")) {
+				if (shouldProcess(fullPath, include, exclude, root) && isTrustedSourcePath(root, scanRoots, fullPath)) files.add(fullPath);
+			} else if (scanInlineArt && entry.isFile() && entry.name.endsWith(".vue") && !entry.name.endsWith(".art.vue")) {
+				if (!isTrustedSourcePath(root, scanRoots, fullPath)) continue;
+				if ((await fs.promises.readFile(fullPath, "utf-8")).includes("<art")) files.add(fullPath);
+			}
+		}
+	}
+	for (const scanRoot of scanRoots) await scan(scanRoot);
+	return [...files];
+}
+async function generateStorybookFiles(artFiles, root, outDir) {
+	const binding = loadNative();
+	const outputDir = path.resolve(root, outDir);
+	await fs.promises.mkdir(outputDir, { recursive: true });
+	for (const [filePath, art] of artFiles) try {
+		const source = await fs.promises.readFile(filePath, "utf-8");
+		const csf = binding.artToCsf(source, { filename: filePath });
+		const outputPath = path.join(outputDir, csf.filename);
+		const code = rewriteStorybookScriptImports(rewriteStorybookComponentImport(csf.code, art, filePath, outputPath), filePath, outputPath);
+		await fs.promises.writeFile(outputPath, code, "utf-8");
+		console.log(`[musea] Generated: ${path.relative(root, outputPath)}`);
+	} catch (e) {
+		console.error(`[musea] Failed to generate CSF for ${filePath}:`, e);
+	}
+}
+function rewriteStorybookComponentImport(code, art, artPath, outputPath) {
+	const component = art.isInline && art.componentPath ? art.componentPath : art.metadata.component;
+	if (!component || isBareImport(component)) return code;
+	const resolvedComponent = path.isAbsolute(component) ? component : path.resolve(path.dirname(artPath), component);
+	let relativeComponent = normalizeGlobPath(path.relative(path.dirname(outputPath), resolvedComponent));
+	if (!relativeComponent.startsWith(".")) relativeComponent = `./${relativeComponent}`;
+	return code.replace(/import\s+(__museaComponent)\s+from\s+(['"])([^'"]+)\2;/, `import $1 from $2${relativeComponent}$2;`);
+}
+function isBareImport(source) {
+	return !source.startsWith(".") && !path.isAbsolute(source);
+}
+/**
+* Rewrite relative import specifiers in the generated Storybook CSF file so that
+* imports lifted verbatim from the art file's `<script setup>` resolve against
+* the generated file's location instead of the original art file's directory.
+*
+* The `__museaComponent` import is already rebased by
+* `rewriteStorybookComponentImport` and is skipped here.
+*/
+function rewriteStorybookScriptImports(code, artPath, outputPath) {
+	const artDir = path.dirname(artPath);
+	const outDir = path.dirname(outputPath);
+	return code.replace(/(import\s+(?:[\s\S]*?)\s+from\s+)(['"])([^'"]+)\2(\s*;?)/g, (match, head, quote, specifier, tail) => {
+		if (!specifier.startsWith(".")) return match;
+		if (/\b__museaComponent\b/.test(head)) return match;
+		const resolved = path.resolve(artDir, specifier);
+		let rebased = normalizeGlobPath(path.relative(outDir, resolved));
+		if (!rebased.startsWith(".")) rebased = `./${rebased}`;
+		return `${head}${quote}${rebased}${quote}${tail}`;
+	});
+}
+function toPascalCase(str) {
+	const pascal = str.normalize("NFKD").replace(/[^\p{L}\p{N}]+/gu, " ").trim().split(/\s+/).filter(Boolean).map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join("");
+	if (!pascal) return "Variant";
+	return /^[\p{L}_$]/u.test(pascal) ? pascal : `Variant${pascal}`;
+}
+function escapeHtml(str) {
+	return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#x27;");
+}
+/**
+* Build the theme config object from plugin options for runtime injection.
+*/
+function buildThemeConfig(theme) {
+	if (!theme) return void 0;
+	if (typeof theme === "string") return { default: theme };
+	const themes = Array.isArray(theme) ? theme : [theme];
+	const custom = {};
+	for (const t of themes) custom[t.name] = {
+		base: t.base,
+		colors: t.colors
+	};
+	return {
+		default: themes[0].name,
+		custom
+	};
+}
+//#endregion
 //#region src/component-source.ts
 function allowedSourceRoots(root, scanRoots = []) {
 	return [...new Set([root, ...scanRoots].map((sourceRoot) => path.resolve(sourceRoot)))];
 }
+function resolveReadableArtPath(root, scanRoots, artPath) {
+	return resolveTrustedSourcePath(root, scanRoots, artPath, "art path");
+}
 function resolveComponentSourcePath(art, artPath, sourceRoots) {
 	const componentPath = art.isInline && art.componentPath ? art.componentPath : art.metadata.component ? path.isAbsolute(art.metadata.component) ? art.metadata.component : path.resolve(path.dirname(artPath), art.metadata.component) : null;
-	return componentPath ? resolveInsideAny(sourceRoots, componentPath, "component path") : null;
+	const [projectRoot, ...extraRoots] = sourceRoots;
+	return componentPath ? resolveTrustedSourcePath(projectRoot ?? ".", extraRoots, componentPath, "component path") : null;
 }
 //#endregion
 //#region src/art-module-vue2.ts
@@ -1040,6 +1105,6 @@ async function processMuseaArtFile(filePath, ctx) {
 	}
 }
 //#endregion
-export { matchGlob as C, toPascalCase as D, shouldProcess as E, analyzeSfcFallback as O, generateStorybookFiles as S, scanArtFiles as T, resolveUrlPathInside as _, expandSelfTag as a, buildThemeConfig as b, resolveComponentSourcePath as c, collectRequestBody as d, createDevSessionToken as f, resolveInsideAny as g, resolveInside as h, rewriteRelativeImportStatement as i, loadNative as k, DEFAULT_API_BODY_LIMIT_BYTES as l, parseJsonBody as m, generateArtModule as n, resolveArtComponent as o, decodeUrlComponent as p, parseScriptSetupForArt as r, allowedSourceRoots as s, processMuseaArtFile as t, HttpError as u, serializeScriptValue as v, resolveScanRoots as w, escapeHtml as x, validateDevApiRequest as y };
+export { analyzeSfcFallback as A, validateDevApiRequest as C, resolveTrustedSourcePath as D, resolveInsideAny as E, resolveUrlPathInside as O, serializeScriptValue as S, resolveInside as T, toPascalCase as _, expandSelfTag as a, createDevSessionToken as b, resolveComponentSourcePath as c, escapeHtml as d, generateStorybookFiles as f, shouldProcess as g, scanArtFiles as h, rewriteRelativeImportStatement as i, loadNative as j, HttpError as k, resolveReadableArtPath as l, resolveScanRoots as m, generateArtModule as n, resolveArtComponent as o, matchGlob as p, parseScriptSetupForArt as r, allowedSourceRoots as s, processMuseaArtFile as t, buildThemeConfig as u, DEFAULT_API_BODY_LIMIT_BYTES as v, decodeUrlComponent as w, parseJsonBody as x, collectRequestBody as y };
 
-//# sourceMappingURL=art-processing-e4a94Wa4.mjs.map
+//# sourceMappingURL=art-processing-0vCLyebN.mjs.map