livelocale 0.12.0 → 0.12.1-next.17

package/README.md

@@ -1,9 +1,13 @@
-# LiveLocale
-
 <div align="center">
+  <h1>
+    <picture>
+      <source media="(prefers-color-scheme: dark)" srcset="brand/logo-dark.svg">
+      <img src="brand/logo.svg" alt="livelocale" height="64">
+    </picture>
+  </h1>
   <p><strong>Click any text in your app. Fix the translation. Ship it as a pull request.</strong></p>
   <p>Keep next-intl or react-i18next. LiveLocale adds in-context editing for Next.js and React + Vite: no account, no server, no browser extension. Your translations stay as JSON in git.</p>
-  
+
   <p align="center">
     <a href="https://github.com/Araby99/livelocale/actions/workflows/ci.yml"><img src="https://github.com/Araby99/livelocale/actions/workflows/ci.yml/badge.svg" alt="CI Status" /></a>
     <a href="https://www.npmjs.com/package/livelocale"><img src="https://img.shields.io/npm/v/livelocale.svg?style=flat-square" alt="NPM Version" /></a>
@@ -220,12 +224,12 @@ file it creates, updates, leaves unchanged or skips, then what is left for you t
 npx livelocale init --share [--locales <path>] [--source <locale>] [--branches <a,b>] [--overwrite] [--dir <path>]
 ```
 
-| Stack                      | Build change                                                                                                                                                                                                                                                                                                                       |
-| -------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| CRA / webpack / Rsbuild    | `"build": "react-scripts build && livelocale pack build"`. This is an explicit `&&`, not a `postbuild` hook, because Yarn Berry and some pnpm versions skip pre/post scripts, and hosts that call the bundler directly skip them too ([yarn](https://v2.yarnpkg.com/advanced/lifecycle-scripts), [pnpm](https://pnpm.io/cli/run)). |
-| Next.js `output: 'export'` | `"build:preview": "livelocale build --preview -- next build"`, deployed to a staging location, because the HTML is pre-rendered and must be watermarked at build time.                                                                                                                                                             |
-| Next.js on Vercel/Node     | For the Preview environment, use the build command `livelocale build --preview -- next build`. It packs into a gitignored `public/livelocale/`.                                                                                                                                                                                    |
-| Custom CI                  | `LIVELOCALE=preview <your build>` (only for SSR/SSG), then `npx livelocale pack <outDir>`.                                                                                                                                                                                                                                         |
+| Stack                      | Build change                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| -------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| CRA / webpack / Rsbuild    | `"build": "react-scripts build && livelocale pack build --locales <path> --source <locale>"` on CRA; webpack and Rsbuild pack `dist` instead of `build`. This is an explicit `&&`, not a `postbuild` hook, because Yarn Berry and some pnpm versions skip pre/post scripts, and hosts that call the bundler directly skip them too ([yarn](https://v2.yarnpkg.com/advanced/lifecycle-scripts), [pnpm](https://pnpm.io/cli/run)). |
+| Next.js `output: 'export'` | `"build:preview": "livelocale build --preview -- next build"`, deployed to a staging location, because the HTML is pre-rendered and must be watermarked at build time.                                                                                                                                                                                                                                                           |
+| Next.js on Vercel/Node     | For the Preview environment, use the build command `livelocale build --preview -- next build`. It packs into a gitignored `public/livelocale/`.                                                                                                                                                                                                                                                                                  |
+| Custom CI                  | `LIVELOCALE=preview <your build>` (only for SSR/SSG), then `npx livelocale pack <outDir>`.                                                                                                                                                                                                                                                                                                                                       |
 
 For Vite it adds `share: true` to your `liveLocaleVite({ ... })` call. The scripts it writes also
 pass `--locales` and `--source`; webpack and Rsbuild pack `dist`.
@@ -673,13 +677,14 @@ It reads the change link only from the event file, never from a shell command, a
 
 To set up the build by hand instead:
 
-| Stack                      | Build change                                                                                                                            |
-| -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
-| Vite                       | `share: true` in `liveLocaleVite(...)` (see [Share link from `vite build`](#share-link-from-vite-build)).                               |
-| CRA, webpack and Rsbuild   | `"build": "<bundler> && livelocale pack build"`, for example `"build": "react-scripts build && livelocale pack build"`.                 |
-| Next.js `output: 'export'` | `livelocale build --preview -- next build`, deployed to a staging location, because the HTML is pre-rendered and must be watermarked.   |
-| Next.js on Vercel/Node     | `livelocale build --preview -- next build` as the Preview environment's build command. It packs into a gitignored `public/livelocale/`. |
-| Custom CI                  | `LIVELOCALE=preview <build>` (only for SSR/SSG), then `npx livelocale pack <outDir>`.                                                   |
+| Stack                      | Build change                                                                                                                                                                             |
+| -------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Vite                       | `share: true` in `liveLocaleVite(...)` (see [Share link from `vite build`](#share-link-from-vite-build)).                                                                                |
+| CRA                        | `"build": "<bundler> && livelocale pack build --locales <path> --source <locale>"`, for example `"build": "react-scripts build && livelocale pack build --locales locales --source en"`. |
+| webpack and Rsbuild        | The same, packing `dist`: `"build": "<bundler> && livelocale pack dist --locales <path> --source <locale>"`.                                                                             |
+| Next.js `output: 'export'` | `livelocale build --preview -- next build`, deployed to a staging location, because the HTML is pre-rendered and must be watermarked.                                                    |
+| Next.js on Vercel/Node     | `livelocale build --preview -- next build` as the Preview environment's build command. It packs into a gitignored `public/livelocale/`.                                                  |
+| Custom CI                  | `LIVELOCALE=preview <build>` (only for SSR/SSG), then `npx livelocale pack <outDir>`.                                                                                                    |
 
 For CRA, webpack and Rsbuild, use an explicit `&&`, not a `postbuild` script: Yarn Berry and some
 pnpm versions skip pre/post scripts, and hosts that call the bundler directly skip them too.

package/dist/codemod/index.cjs

@@ -405,7 +405,8 @@ function createStudioServer(options) {
       res.end("Bad Request");
       return;
     }
-    if (filePath !== studioDir && !filePath.startsWith(studioDir + path2.sep)) {
+    const relativePath = path2.relative(studioDir, filePath);
+    if (relativePath.startsWith("..") || path2.isAbsolute(relativePath)) {
       res.statusCode = 403;
       res.end("Forbidden");
       return;
@@ -1577,7 +1578,7 @@ function parseIcu(message) {
   parseMessage(0);
   return { args, error };
 }
-var I18NEXT_RE = /\{\{\s*([^{}]*?)\s*\}\}/g;
+var I18NEXT_RE = /\{\{([^{}]*)\}\}/g;
 var NESTING_RE = /\$t\([^)]*\)/g;
 var PRINTF_RE = /%(?:\d+\$)?[-+ 0#]*\d*(?:\.\d+)?[sdifgxXoc]/g;
 var TAG_RE = /<\/?([A-Za-z][\w-]*|\d+)\b[^<>]*>/g;
@@ -3041,7 +3042,12 @@ function escapeAttribute(value) {
 }
 function injectFlagScript(html, src) {
   const tag = `<script src="${escapeAttribute(src)}"></script>`;
-  const cleaned = html.replace(EXISTING_FLAG_TAG, "");
+  let cleaned = html;
+  let previous;
+  do {
+    previous = cleaned;
+    cleaned = cleaned.replace(EXISTING_FLAG_TAG, "");
+  } while (cleaned !== previous);
   for (const pattern of [HEAD_OPEN2, HTML_OPEN2, DOCTYPE2]) {
     const match = pattern.exec(cleaned);
     if (match) {
@@ -3057,8 +3063,8 @@ var NO_REPO_WARNING = "exposeRepo is on but no GitHub repository was found; the
 function isPlainObject2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function toPosix(relative10) {
-  return relative10.split(path11.sep).join("/") || ".";
+function toPosix(relative11) {
+  return relative11.split(path11.sep).join("/") || ".";
 }
 function isInside(parent, child) {
   const rel = path11.relative(parent, child);
@@ -3555,11 +3561,14 @@ function setNestedProperty(obj, keyPath, value) {
   let current = obj;
   for (let i = 0; i < keys.length; i++) {
     const key = keys[i];
+    if (key === "__proto__" || key === "constructor" || key === "prototype") {
+      throw new Error(`[livelocale] Forbidden key segment in path: "${keyPath}".`);
+    }
     if (i === keys.length - 1) {
       current[key] = value;
       return;
     }
-    if (!(key in current) || current[key] === null || typeof current[key] !== "object" || Array.isArray(current[key])) {
+    if (!Object.prototype.hasOwnProperty.call(current, key) || current[key] === null || typeof current[key] !== "object" || Array.isArray(current[key])) {
       current[key] = {};
     }
     current = current[key];
@@ -3832,6 +3841,13 @@ var nodeInflate = async (bytes, maxOutputLength) => {
   return result.buffer;
 };
 
+// src/core/strings.ts
+function trimTrailingSlashes(value) {
+  let end = value.length;
+  while (end > 0 && value.charCodeAt(end - 1) === 47) end -= 1;
+  return value.slice(0, end);
+}
+
 // src/server/github-rest.ts
 var GitHubApiError = class extends Error {
   constructor(message, status) {
@@ -3864,7 +3880,7 @@ function encodeRefPath(ref) {
 }
 function createGitHubRest(config) {
   const repo = config.repo;
-  const apiBase = (config.apiBase ?? "https://api.github.com").replace(/\/+$/, "");
+  const apiBase = trimTrailingSlashes(config.apiBase ?? "https://api.github.com");
   const fetchImpl = config.fetchImpl ?? globalThis.fetch;
   const owner = repo.split("/")[0] ?? "";
   if (!/^[\w.-]+\/[\w.-]+$/.test(repo)) {
@@ -4293,6 +4309,7 @@ var BIDI_CONTROL_RE = /[\u202a-\u202e\u2066-\u2069]/g;
 var NEWLINE_RE = /\r\n|\r|\n/g;
 var SPAN_CONTROL_RE = /[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g;
 var CONTROL_RE = /[\u0000-\u001f\u007f-\u009f]/g;
+var BACKSLASH_BEFORE_PIPE_RE = /\\(?=\|)/g;
 function cut(text, max) {
   if (text.length <= max) return text;
   let out = text.slice(0, max);
@@ -4322,7 +4339,7 @@ function codePointLabel(ch) {
 }
 function codeSpan(text, maxLength = DEFAULT_SPAN_LENGTH) {
   const truncated = text.length > maxLength ? `${cut(text, maxLength)}\u2026` : text;
-  const content = truncated.replace(NEWLINE_RE, "\u23CE").replace(BIDI_CONTROL_RE, codePointLabel).replace(SPAN_CONTROL_RE, codePointLabel).replace(/\|/g, "\\|");
+  const content = truncated.replace(NEWLINE_RE, "\u23CE").replace(BIDI_CONTROL_RE, codePointLabel).replace(SPAN_CONTROL_RE, codePointLabel).replace(BACKSLASH_BEFORE_PIPE_RE, codePointLabel).replace(/\|/g, "\\|");
   if (content === "") return "` `";
   const fence = "`".repeat(longestBacktickRun(content) + 1);
   const pad = /^[` ]|[` ]$/.test(content) ? " " : "";
@@ -5962,8 +5979,8 @@ function planGitignore(projectDir) {
   if (parseGitignore(current).ignores("public/livelocale", true)) {
     return { path: ".gitignore", action: "unchanged" };
   }
-  const sep10 = current === "" || current.endsWith("\n") ? "" : "\n";
-  return { path: ".gitignore", action: "update", content: `${current}${sep10}${SHARE_GITIGNORE}
+  const sep9 = current === "" || current.endsWith("\n") ? "" : "\n";
+  return { path: ".gitignore", action: "update", content: `${current}${sep9}${SHARE_GITIGNORE}
 ` };
 }
 function planBuild(c) {