elit 3.5.9 → 3.6.1

package/dist/server.mjs

@@ -56688,35 +56688,42 @@ var sendError = (res, code, msg) => {
 var send404 = (res, msg = "Not Found") => sendError(res, 404, msg);
 var send403 = (res, msg = "Forbidden") => sendError(res, 403, msg);
 var send500 = (res, msg = "Internal Server Error") => sendError(res, 500, msg);
-async function resolveWorkspaceElitImportBasePath(rootDir, basePath, mode) {
+async function resolveWorkspaceElitImportBasePath(rootDir, basePath, _mode) {
   const resolvedRootDir = await realpath(resolve(rootDir));
   try {
     const packageJsonBuffer = await readFile(join(resolvedRootDir, "package.json"));
     const packageJson = JSON.parse(packageJsonBuffer.toString());
     if (packageJson.name === "elit") {
-      const workspaceDir = mode === "dev" ? "src" : "dist";
-      return basePath ? `${basePath}/${workspaceDir}` : `/${workspaceDir}`;
+      return basePath ? `${basePath}/dist` : "/dist";
     }
   } catch {
   }
   return void 0;
 }
+var BROWSER_SAFE_ELIT_IMPORTS = {
+  "elit": "index",
+  "elit/dom": "dom",
+  "elit/el": "el",
+  "elit/native": "native",
+  "elit/universal": "universal",
+  "elit/router": "router",
+  "elit/state": "state",
+  "elit/style": "style",
+  "elit/hmr": "hmr",
+  "elit/types": "types"
+};
+function createBrowserSafeElitImports(basePath, fileExt) {
+  return Object.fromEntries(
+    Object.entries(BROWSER_SAFE_ELIT_IMPORTS).map(([specifier, outputName]) => [
+      specifier,
+      `${basePath}/${outputName}${fileExt}`
+    ])
+  );
+}
 var createElitImportMap = async (rootDir, basePath = "", mode = "dev") => {
   const workspaceImportBasePath = await resolveWorkspaceElitImportBasePath(rootDir, basePath, mode);
-  const fileExt = mode === "dev" ? ".ts" : ".js";
-  const elitImports = workspaceImportBasePath ? {
-    "elit": `${workspaceImportBasePath}/index${fileExt}`,
-    "elit/": `${workspaceImportBasePath}/`,
-    "elit/dom": `${workspaceImportBasePath}/dom${fileExt}`,
-    "elit/state": `${workspaceImportBasePath}/state${fileExt}`,
-    "elit/style": `${workspaceImportBasePath}/style${fileExt}`,
-    "elit/el": `${workspaceImportBasePath}/el${fileExt}`,
-    "elit/universal": `${workspaceImportBasePath}/universal${fileExt}`,
-    "elit/router": `${workspaceImportBasePath}/router${fileExt}`,
-    "elit/hmr": `${workspaceImportBasePath}/hmr${fileExt}`,
-    "elit/types": `${workspaceImportBasePath}/types${fileExt}`,
-    "elit/native": `${workspaceImportBasePath}/native${fileExt}`
-  } : {};
+  const fileExt = ".mjs";
+  const elitImports = workspaceImportBasePath ? createBrowserSafeElitImports(workspaceImportBasePath, fileExt) : {};
   const externalImports = await generateExternalImportMaps(rootDir, basePath);
   const allImports = { ...externalImports, ...elitImports };
   return `<script type="importmap">${JSON.stringify({ imports: allImports }, null, 2)}</script>`;
@@ -56987,6 +56994,29 @@ async function processPackage(nodeModulesPath, pkgName, importMap, basePath) {
   }
 }
 function processExportsField(pkgName, exports2, baseUrl, importMap) {
+  if (pkgName === "elit") {
+    if (typeof exports2 !== "object" || exports2 === null) {
+      return;
+    }
+    const elitExports = exports2;
+    const browserSafeImports = {};
+    const rootResolved = "." in elitExports ? resolveExport(elitExports["."]) : "import" in elitExports ? resolveExport(elitExports) : null;
+    if (rootResolved) {
+      browserSafeImports.elit = `${baseUrl}/${rootResolved}`;
+    }
+    const allowedSubpaths = Object.keys(BROWSER_SAFE_ELIT_IMPORTS).filter((specifier) => specifier !== "elit").map((specifier) => ({
+      exportKey: `./${specifier.slice("elit/".length)}`,
+      importName: specifier
+    }));
+    for (const { exportKey, importName } of allowedSubpaths) {
+      const resolved = resolveExport(elitExports[exportKey]);
+      if (resolved) {
+        browserSafeImports[importName] = `${baseUrl}/${resolved}`;
+      }
+    }
+    Object.assign(importMap, browserSafeImports);
+    return;
+  }
   if (typeof exports2 === "string") {
     importMap[pkgName] = `${baseUrl}/${exports2}`;
     importMap[`${pkgName}/`] = `${baseUrl}/`;
@@ -57348,6 +57378,85 @@ function shouldUseClientFallbackRoot(primaryRoot, fallbackRoot, indexPath) {
   const primaryHasRuntimeSources = existsSync(join(resolvedPrimaryRoot, "src")) || existsSync(join(resolvedPrimaryRoot, "public")) || existsSync(join(resolvedPrimaryRoot, normalizedIndexPath));
   return !primaryHasRuntimeSources;
 }
+function isPathWithinRoot(filePath, rootDir) {
+  return filePath === rootDir || filePath.startsWith(rootDir.endsWith(sep) ? rootDir : `${rootDir}${sep}`);
+}
+async function getAllowedClientRoots(client) {
+  const allowedRoots = [];
+  for (const candidateRoot of [client.root, client.fallbackRoot]) {
+    if (!candidateRoot) {
+      continue;
+    }
+    try {
+      const resolvedRoot = await realpath(resolve(candidateRoot));
+      if (!allowedRoots.includes(resolvedRoot)) {
+        allowedRoots.push(resolvedRoot);
+      }
+    } catch {
+    }
+  }
+  return allowedRoots;
+}
+async function getClientBaseDirs(client, isDistRequest, isNodeModulesRequest) {
+  const baseDirs = [];
+  for (const candidateRoot of [client.root, client.fallbackRoot]) {
+    if (!candidateRoot) {
+      continue;
+    }
+    try {
+      const resolvedRoot = await realpath(resolve(candidateRoot));
+      let baseDir = resolvedRoot;
+      if (isDistRequest || isNodeModulesRequest) {
+        const targetDir = isDistRequest ? "dist" : "node_modules";
+        const foundDir = await findSpecialDir(candidateRoot, targetDir);
+        baseDir = foundDir ? await realpath(foundDir) : resolvedRoot;
+      }
+      if (!baseDirs.includes(baseDir)) {
+        baseDirs.push(baseDir);
+      }
+    } catch {
+    }
+  }
+  return baseDirs;
+}
+async function resolveClientPathFromBaseDir(baseDir, normalizedPath) {
+  const tryRealpathWithinBaseDir = async (relativePath2) => {
+    const unresolvedPath = resolve(join(baseDir, relativePath2));
+    if (!isPathWithinRoot(unresolvedPath, baseDir)) {
+      return void 0;
+    }
+    try {
+      return await realpath(unresolvedPath);
+    } catch {
+      return void 0;
+    }
+  };
+  const exactPath = await tryRealpathWithinBaseDir(normalizedPath);
+  if (exactPath) {
+    return exactPath;
+  }
+  if (normalizedPath.endsWith(".js")) {
+    const tsPath = await tryRealpathWithinBaseDir(normalizedPath.replace(/\.js$/, ".ts"));
+    if (tsPath) {
+      return tsPath;
+    }
+  }
+  if (normalizedPath.includes(".")) {
+    return void 0;
+  }
+  for (const candidatePath of [
+    `${normalizedPath}.ts`,
+    `${normalizedPath}.js`,
+    join(normalizedPath, "index.ts"),
+    join(normalizedPath, "index.js")
+  ]) {
+    const resolvedPath = await tryRealpathWithinBaseDir(candidatePath);
+    if (resolvedPath) {
+      return resolvedPath;
+    }
+  }
+  return void 0;
+}
 function createDevServer(options) {
   const config = { ...defaultOptions, ...options };
   const wsClients = /* @__PURE__ */ new Set();
@@ -57377,6 +57486,7 @@ function createDevServer(options) {
     const activeRoot = useFallbackRoot ? client.fallbackRoot || client.root : client.root;
     return {
       root: activeRoot,
+      fallbackRoot: useFallbackRoot ? void 0 : client.fallbackRoot,
       basePath,
       index: useFallbackRoot ? void 0 : indexPath,
       ssr: useFallbackRoot ? void 0 : client.ssr,
@@ -57478,75 +57588,26 @@ function createDevServer(options) {
       return send403(res, "403 Forbidden");
     }
     normalizedPath = tempPath;
-    const rootDir = await realpath(resolve(matchedClient.root));
-    let baseDir = rootDir;
-    if (isDistRequest || isNodeModulesRequest) {
-      const targetDir = isDistRequest ? "dist" : "node_modules";
-      const foundDir = await findSpecialDir(matchedClient.root, targetDir);
-      baseDir = foundDir ? await realpath(foundDir) : rootDir;
-    }
     let fullPath;
-    try {
-      const unresolvedPath = resolve(join(baseDir, normalizedPath));
-      if (!unresolvedPath.startsWith(baseDir.endsWith(sep) ? baseDir : baseDir + sep)) {
-        if (config.logging) console.log(`[403] File access outside of root (before symlink): ${unresolvedPath}`);
-        return send403(res, "403 Forbidden");
-      }
-      fullPath = await realpath(unresolvedPath);
-      if (config.logging && filePath === "/src/pages") {
-        console.log(`[DEBUG] Initial resolve succeeded: ${fullPath}`);
-      }
-    } catch (firstError) {
-      let resolvedPath;
-      if (config.logging && !normalizedPath.includes(".")) {
-        console.log(`[DEBUG] File not found: ${normalizedPath}, trying extensions...`);
-      }
-      if (normalizedPath.endsWith(".js")) {
-        const tsPath = normalizedPath.replace(/\.js$/, ".ts");
-        try {
-          const tsFullPath = await realpath(resolve(join(baseDir, tsPath)));
-          if (!tsFullPath.startsWith(baseDir.endsWith(sep) ? baseDir : baseDir + sep)) {
-            if (config.logging) console.log(`[403] Fallback TS path outside of root: ${tsFullPath}`);
-            return send403(res, "403 Forbidden");
-          }
-          resolvedPath = tsFullPath;
-        } catch {
+    const baseDirs = await getClientBaseDirs(matchedClient, isDistRequest, isNodeModulesRequest);
+    for (const baseDir of baseDirs) {
+      fullPath = await resolveClientPathFromBaseDir(baseDir, normalizedPath);
+      if (fullPath) {
+        if (config.logging && filePath === "/src/pages") {
+          console.log(`[DEBUG] Initial resolve succeeded: ${fullPath}`);
         }
+        break;
       }
-      if (!resolvedPath && !normalizedPath.includes(".")) {
-        try {
-          resolvedPath = await realpath(resolve(join(baseDir, normalizedPath + ".ts")));
-          if (config.logging) console.log(`[DEBUG] Found: ${normalizedPath}.ts`);
-        } catch {
-          try {
-            resolvedPath = await realpath(resolve(join(baseDir, normalizedPath + ".js")));
-            if (config.logging) console.log(`[DEBUG] Found: ${normalizedPath}.js`);
-          } catch {
-            try {
-              resolvedPath = await realpath(resolve(join(baseDir, normalizedPath, "index.ts")));
-              if (config.logging) console.log(`[DEBUG] Found: ${normalizedPath}/index.ts`);
-            } catch {
-              try {
-                resolvedPath = await realpath(resolve(join(baseDir, normalizedPath, "index.js")));
-                if (config.logging) console.log(`[DEBUG] Found: ${normalizedPath}/index.js`);
-              } catch {
-                if (config.logging) console.log(`[DEBUG] Not found: all attempts failed for ${normalizedPath}`);
-              }
-            }
-          }
-        }
-      }
-      if (!resolvedPath) {
-        if (!res.headersSent) {
-          if (filePath === "/index.html" && matchedClient.ssr) {
-            return await serveSSR(res, matchedClient);
-          }
-          if (config.logging) console.log(`[404] ${filePath}`);
-          return send404(res, "404 Not Found");
+    }
+    if (!fullPath) {
+      if (!res.headersSent) {
+        if (filePath === "/index.html" && matchedClient.ssr) {
+          return await serveSSR(res, matchedClient);
         }
-        return;
+        if (config.logging) console.log(`[404] ${filePath}`);
+        return send404(res, "404 Not Found");
       }
-      fullPath = resolvedPath;
+      return;
     }
     try {
       const stats = await stat(fullPath);
@@ -57575,11 +57636,12 @@ function createDevServer(options) {
       return send404(res, "404 Not Found");
     }
     try {
+      const allowedRoots = await getAllowedClientRoots(matchedClient);
       const stats = await stat(fullPath);
       if (stats.isDirectory()) {
         try {
           const indexPath = await realpath(resolve(join(fullPath, "index.html")));
-          if (!indexPath.startsWith(rootDir + sep) && indexPath !== rootDir) {
+          if (!isPathWithinRoot(indexPath, fullPath) && !allowedRoots.some((rootDir) => isPathWithinRoot(indexPath, rootDir))) {
             return send403(res, "403 Forbidden");
           }
           await stat(indexPath);
@@ -57601,10 +57663,11 @@ function createDevServer(options) {
       return input.replace(/\\/g, "\\\\").replace(/`/g, "\\`").replace(/\$\{/g, "\\${");
     }
     try {
-      const rootDir = await realpath(resolve(client.root));
+      const allowedRoots = await getAllowedClientRoots(client);
+      const rootDir = allowedRoots[0] || await realpath(resolve(client.root));
       const unresolvedPath = resolve(filePath);
       if (!isNodeModulesOrDist) {
-        if (!unresolvedPath.startsWith(rootDir + sep) && unresolvedPath !== rootDir) {
+        if (!allowedRoots.some((allowedRoot) => isPathWithinRoot(unresolvedPath, allowedRoot))) {
           if (config.logging) console.log(`[403] Attempted to serve file outside allowed directories: ${filePath}`);
           return send403(res, "403 Forbidden");
         }

package/package.json

@@ -1,173 +1,204 @@
 {
   "name": "elit",
-  "version": "3.5.9",
+  "version": "3.6.1",
   "description": "Optimized lightweight library for creating DOM elements with reactive state",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
-  "browser": "dist/index.mjs",
+  "browser": "dist/index.js",
+  "require": "dist/index.cjs",
   "types": "dist/index.d.ts",
   "bin": {
-    "elit": "./dist/cli.js"
+    "elit": "./dist/cli.cjs"
   },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
-      "browser": "./dist/index.mjs",
+      "browser": "./dist/index.js",
       "import": "./dist/index.mjs",
-      "require": "./dist/index.js"
+      "require": "./dist/index.cjs"
     },
     "./dom": {
       "types": "./dist/dom.d.ts",
+      "browser": "./dist/dom.js",
       "import": "./dist/dom.mjs",
-      "require": "./dist/dom.js"
+      "require": "./dist/dom.cjs"
     },
     "./desktop": {
       "types": "./dist/desktop.d.ts",
+      "browser": "./dist/desktop.js",
       "import": "./dist/desktop.mjs",
-      "require": "./dist/desktop.js"
+      "require": "./dist/desktop.cjs"
     },
     "./el": {
       "types": "./dist/el.d.ts",
+      "browser": "./dist/el.js",
       "import": "./dist/el.mjs",
-      "require": "./dist/el.js"
+      "require": "./dist/el.cjs"
     },
     "./native": {
       "types": "./dist/native.d.ts",
+      "browser": "./dist/native.js",
       "import": "./dist/native.mjs",
-      "require": "./dist/native.js"
+      "require": "./dist/native.cjs"
     },
     "./universal": {
       "types": "./dist/universal.d.ts",
+      "browser": "./dist/universal.js",
       "import": "./dist/universal.mjs",
-      "require": "./dist/universal.js"
+      "require": "./dist/universal.cjs"
     },
     "./router": {
       "types": "./dist/router.d.ts",
+      "browser": "./dist/router.js",
       "import": "./dist/router.mjs",
-      "require": "./dist/router.js"
+      "require": "./dist/router.cjs"
     },
     "./state": {
       "types": "./dist/state.d.ts",
+      "browser": "./dist/state.js",
       "import": "./dist/state.mjs",
-      "require": "./dist/state.js"
+      "require": "./dist/state.cjs"
     },
     "./style": {
       "types": "./dist/style.d.ts",
+      "browser": "./dist/style.js",
       "import": "./dist/style.mjs",
-      "require": "./dist/style.js"
+      "require": "./dist/style.cjs"
     },
     "./server": {
       "types": "./dist/server.d.ts",
+      "browser": "./dist/server.js",
       "import": "./dist/server.mjs",
-      "require": "./dist/server.js"
+      "require": "./dist/server.cjs"
     },
     "./hmr": {
       "types": "./dist/hmr.d.ts",
+      "browser": "./dist/hmr.js",
       "import": "./dist/hmr.mjs",
-      "require": "./dist/hmr.js"
+      "require": "./dist/hmr.cjs"
     },
     "./build": {
       "types": "./dist/build.d.ts",
+      "browser": "./dist/build.js",
       "import": "./dist/build.mjs",
-      "require": "./dist/build.js"
+      "require": "./dist/build.cjs"
     },
     "./http": {
       "types": "./dist/http.d.ts",
+      "browser": "./dist/http.js",
       "import": "./dist/http.mjs",
-      "require": "./dist/http.js"
+      "require": "./dist/http.cjs"
     },
     "./https": {
       "types": "./dist/https.d.ts",
+      "browser": "./dist/https.js",
       "import": "./dist/https.mjs",
-      "require": "./dist/https.js"
+      "require": "./dist/https.cjs"
     },
     "./ws": {
       "types": "./dist/ws.d.ts",
+      "browser": "./dist/ws.js",
       "import": "./dist/ws.mjs",
-      "require": "./dist/ws.js"
+      "require": "./dist/ws.cjs"
     },
     "./fs": {
       "types": "./dist/fs.d.ts",
+      "browser": "./dist/fs.js",
       "import": "./dist/fs.mjs",
-      "require": "./dist/fs.js"
+      "require": "./dist/fs.cjs"
     },
     "./mime-types": {
       "types": "./dist/mime-types.d.ts",
+      "browser": "./dist/mime-types.js",
       "import": "./dist/mime-types.mjs",
-      "require": "./dist/mime-types.js"
+      "require": "./dist/mime-types.cjs"
     },
     "./chokidar": {
       "types": "./dist/chokidar.d.ts",
+      "browser": "./dist/chokidar.js",
       "import": "./dist/chokidar.mjs",
-      "require": "./dist/chokidar.js"
+      "require": "./dist/chokidar.cjs"
     },
     "./path": {
       "types": "./dist/path.d.ts",
+      "browser": "./dist/path.js",
       "import": "./dist/path.mjs",
-      "require": "./dist/path.js"
+      "require": "./dist/path.cjs"
     },
     "./wss": {
       "types": "./dist/wss.d.ts",
+      "browser": "./dist/wss.js",
       "import": "./dist/wss.mjs",
-      "require": "./dist/wss.js"
+      "require": "./dist/wss.cjs"
     },
     "./runtime": {
       "types": "./dist/runtime.d.ts",
+      "browser": "./dist/runtime.js",
       "import": "./dist/runtime.mjs",
-      "require": "./dist/runtime.js"
+      "require": "./dist/runtime.cjs"
     },
     "./database": {
       "types": "./dist/database.d.ts",
+      "browser": "./dist/database.js",
       "import": "./dist/database.mjs",
-      "require": "./dist/database.js"
+      "require": "./dist/database.cjs"
     },
     "./test": {
       "types": "./dist/test.d.ts",
+      "browser": "./dist/test.js",
       "import": "./dist/test.mjs",
-      "require": "./dist/test.js"
+      "require": "./dist/test.cjs"
     },
     "./test-runtime": {
       "types": "./dist/test-runtime.d.ts",
+      "browser": "./dist/test-runtime.js",
       "import": "./dist/test-runtime.mjs",
-      "require": "./dist/test-runtime.js"
+      "require": "./dist/test-runtime.cjs"
     },
     "./test-reporter": {
       "types": "./dist/test-reporter.d.ts",
+      "browser": "./dist/test-reporter.js",
       "import": "./dist/test-reporter.mjs",
-      "require": "./dist/test-reporter.js"
+      "require": "./dist/test-reporter.cjs"
     },
     "./test-globals": {
       "types": "./dist/test-globals.d.ts"
     },
     "./types": {
       "types": "./dist/types.d.ts",
+      "browser": "./dist/types.js",
       "import": "./dist/types.mjs",
-      "require": "./dist/types.js"
+      "require": "./dist/types.cjs"
     },
     "./cli": {
       "types": "./dist/cli.d.ts",
+      "browser": "./dist/cli.js",
       "import": "./dist/cli.mjs",
-      "require": "./dist/cli.js"
+      "require": "./dist/cli.cjs"
     },
     "./render-context": {
       "types": "./dist/render-context.d.ts",
+      "browser": "./dist/render-context.js",
       "import": "./dist/render-context.mjs",
-      "require": "./dist/render-context.js"
+      "require": "./dist/render-context.cjs"
     },
     "./preview-build": {
       "types": "./dist/preview-build.d.ts",
+      "browser": "./dist/preview-build.js",
       "import": "./dist/preview-build.mjs",
-      "require": "./dist/preview-build.js"
+      "require": "./dist/preview-build.cjs"
     },
     "./dev-build": {
       "types": "./dist/dev-build.d.ts",
+      "browser": "./dist/dev-build.js",
       "import": "./dist/dev-build.mjs",
-      "require": "./dist/dev-build.js"
+      "require": "./dist/dev-build.cjs"
     },
     "./desktop-auto-render": {
       "types": "./dist/desktop-auto-render.d.ts",
+      "browser": "./dist/desktop-auto-render.js",
       "import": "./dist/desktop-auto-render.mjs",
-      "require": "./dist/desktop-auto-render.js"
+      "require": "./dist/desktop-auto-render.cjs"
     }
   },
   "scripts": {