@wix/origami-site-runtime 1.0.5 → 1.0.7

package/README.md

@@ -1,5 +1,7 @@
 # Wix import site runtime
 
+Before local tests, run `pnpm -r run build` from the repository root to build workspace dependencies in order.
+
 Static routes come from item folders under `src/pages`. The home page is the page folder in parentheses, e.g. `src/pages/(home)`; a folder in parentheses is left out of the URL. Each document loads its item's `_generated/index.jsx`; `pages/error404` supplies an optional custom 404 page.
 
 ## Routing roadmap

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/origami-site-runtime",
-  "version": "1.0.5",
+  "version": "1.0.7",
   "description": "Vite development and build helpers for wix-import static sites",
   "main": "./src/index.js",
   "files": [
@@ -9,7 +9,7 @@
   "scripts": {
     "build": "rm -rf dist tsconfig.tsbuildinfo && tsc -b .",
     "lint": "oxlint .",
-    "test": "pnpm run build && node --test test/*.spec.js",
+    "test": "node --test test/*.spec.js",
     "clean": "rm -rf dist tsconfig.tsbuildinfo",
     "test:browser": "node test/spx.browser.mjs && node test/semanticContainer.browser.mjs"
   },
@@ -19,7 +19,7 @@
     "@babel/types": "^7.25.2",
     "@wix/builder-error-pages": "^1.1.6",
     "@wix/builder-piler-components": "^1.6.7",
-    "@wix/origami-runtime": "0.10.0",
+    "@wix/origami-runtime": "0.11.0",
     "postcss": "^8.5.3",
     "postcss-custom-media": "^12.0.1",
     "react": "^18.3.1",
@@ -64,5 +64,5 @@
     "./default-error-404": "./src/default-error-404.jsx"
   },
   "type": "module",
-  "falconPackageHash": "203443429f6ecbdef5a36d850631bd595d5680e2a7b26e65f97fbe5a"
+  "falconPackageHash": "e9e3b817c585e6457e3d38733cf7c652e682ac829c1f238836f89c53"
 }

package/src/cssPlugins/mixins.js

@@ -1,3 +1,9 @@
+import postcss from 'postcss'
+
+const MAX_EXPANSION_DEPTH = 64
+const MAX_CLONED_NODES = 100_000
+const MAX_CLONED_BYTES = 10 * 1024 * 1024
+
 /** @param {import('postcss').AtRule} atRule */
 const mixinName = atRule => atRule.params.trim().replace(/\(\)$/, '')
 
@@ -14,10 +20,44 @@ export const mixinsPlugin = {
             bodies.set(mixinName(atRule), body.nodes ?? [])
             atRule.remove()
         })
-        root.walkAtRules('apply', atRule => {
-            const body = bodies.get(mixinName(atRule))
-            if (!body) throw new Error(`@apply ${atRule.params} has no @mixin definition`)
-            atRule.replaceWith(body.map(node => node.clone()))
-        })
+        // Share budgets across all call sites, including intermediate bodies that are later replaced.
+        // Count descendants too: cloning a rule also clones its entire subtree.
+        let clonedNodes = 0
+        let clonedBytes = 0
+        /** @param {import('postcss').Root} container
+         * @param {string[]} stack */
+        const expand = (container, stack) => {
+            container.walkAtRules('apply', atRule => {
+                const name = mixinName(atRule)
+                const body = bodies.get(name)
+                if (!body) throw new Error(`@apply ${atRule.params} has no @mixin definition`)
+                if (stack.includes(name)) throw new Error(`Cyclic @apply: ${[...stack, name].join(' -> ')}`)
+                if (stack.length >= MAX_EXPANSION_DEPTH) {
+                    throw new Error(`@apply ${name} exceeds maximum expansion depth (${MAX_EXPANSION_DEPTH})`)
+                }
+                const pending = [...body]
+                while (pending.length) {
+                    const node = pending.pop()
+                    if (++clonedNodes > MAX_CLONED_NODES) {
+                        throw new Error(`@apply ${name} exceeds stylesheet cloned-node budget (${MAX_CLONED_NODES})`)
+                    }
+                    if (node && 'nodes' in node && node.nodes) {
+                        for (const child of node.nodes) pending.push(child)
+                    }
+                }
+                for (const node of body) {
+                    clonedBytes += Buffer.byteLength((node.raws.before ?? '') + node.toString(), 'utf8')
+                    if (clonedBytes > MAX_CLONED_BYTES) {
+                        throw new Error(`@apply ${name} exceeds stylesheet cloned-CSS byte budget (${MAX_CLONED_BYTES})`)
+                    }
+                }
+                // PostCSS does not revisit nodes inserted in place of the current at-rule.
+                // Expand a clone first so nested uses resolve without changing the definition.
+                const expanded = postcss.root({ nodes: body.map(node => node.clone()) })
+                expand(expanded, [...stack, name])
+                atRule.replaceWith(...expanded.nodes)
+            })
+        }
+        expand(root, [])
     },
 }