mnfst-run 1.0.25 → 1.0.27

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mnfst-run",
-  "version": "1.0.25",
+  "version": "1.0.27",
   "description": "Zero-dependency dev server for Manifest projects",
   "type": "module",
   "bin": {

package/serve.mjs

@@ -382,6 +382,8 @@ const APPWRITE_PROXY_TARGET = (process.env.APPWRITE_PROXY_TARGET || privateEnv.A
 const APPWRITE_PROXY_PREFIX = '/_appwrite';
 
 let envInjectScript = buildEnvInjectScript(publicEnv);
+// Edit mode marker: the edit plugin reads /__edit/base only when it is served
+if (EDIT_ENABLED) envInjectScript += '<script>window.__mnfstEdit=true;</script>';
 if (APPWRITE_PROXY_TARGET) {
   // Point the Appwrite endpoint at the same-origin proxy. Computed in the browser
   // from location.origin so it's port-independent (auto-port safe) and prod-safe
@@ -792,11 +794,15 @@ function parseCsvLine(line) {
   out.push(cur); return out;
 }
 const csvCell = (v) => /[",\n]/.test(v) ? '"' + String(v).replace(/"/g, '""') + '"' : String(v);
+// Why a data source is not a file mnfst-run writes.
+const dataSourceRefusal = (name, manifest) => (manifest.data || {})[name] == null
+  ? `data source '${name}' is not declared in manifest.json: mnfst-run writes data only to CSV/JSON/YAML files declared there`
+  : `data source '${name}' is not a file (a cloud or remote source): save it with $x.${name}.$update, not mnfst-run`;
 // Data-value write-back (local CSV/JSON cell). Cloud sources are not files → caller should
 // persist via $x.<source>.$update(id,{field}) instead.
 function writeDataValue(p, manifest) {
   const src = (manifest.data || {})[p.source], rel = typeof src === 'string' ? src : null;
-  if (!rel) return { kind: 'data-val', source: p.source, status: 'skipped', reason: 'not a file source (cloud → use $x.$update)' };
+  if (!rel) return { kind: 'data-val', source: p.source, status: 'error', reason: dataSourceRefusal(p.source, manifest) };
   const file = resolveRel(rel); if (!file || !isFile(file)) return { kind: 'data-val', source: p.source, status: 'error', reason: `file not found: ${rel}` };
   const refused = writeRefusal(file, 'data'); if (refused) return { kind: 'data-val', source: p.source, status: 'error', reason: `refused: ${refused}` };
   const ext = extname(file).toLowerCase(), text = vread(file);
@@ -1085,7 +1091,7 @@ const SAN_DROP = new Set(['script', 'style', 'iframe', 'object', 'embed', 'link'
 // The one attribute Rich Text keeps on each of these inline tags.
 const TEXT_ATTR = { abbr: 'title', dfn: 'title', bdo: 'dir', data: 'value', time: 'datetime' };
 function textAttrOk(tag, n, v) {
-  if (tag === 'a' && n === 'href') return !attrRefusal(n, v, tag);
+  if (tag === 'a' && (n === 'href' || n === 'title')) return !attrRefusal(n, v, tag);
   if (tag === 'img' && (n === 'alt' || n === 'src')) return !attrRefusal(n, v, tag);
   if (TEXT_ATTR[tag] === n) return n === 'dir' ? /^(ltr|rtl|auto)$/i.test(v) : !attrRefusal(n, v, tag);
   if (tag === 'input') return n === 'type' ? /^checkbox$/i.test(v) : n === 'checked';
@@ -1115,7 +1121,10 @@ function sanitizeHTML(html) {
     if (!SAN_OK.has(name)) continue;
     if (closing) { out += `</${name}>`; continue; }
     let tag = '<' + name;
+    const seen = new Set();
     for (const a of scanTag(s.slice(lt, end + 1)).attrs) {
+      if (seen.has(a.lower)) continue;   // the first of a repeated attribute wins, as in the browser
+      seen.add(a.lower);
       const v = a.value == null ? '' : decodeEntities(a.value, true);
       if (textAttrOk(name, a.lower, v)) tag += a.lower === 'checked' ? ' checked' : ` ${a.lower}="${escAttr(v)}"`;
     }
@@ -1545,8 +1554,8 @@ function resolveComponentFile(manifest, name) {
 }
 
 // Theme var write: rewrite (or append) a single `--var: value;` in the target CSS file.
-// Scoped vars carry their file (data-edit-theme-file); global vars fall back to the
-// standard theme file. Surgical — rewrites the existing declaration in place, else
+// Global vars go to the theme stylesheet the page links (else the default path);
+// a patch may name another stylesheet the page links. Surgical — rewrites the existing declaration in place, else
 // appends into the first :root{} block, else creates one.
 const DEFAULT_THEME_FILE = 'styles/core/manifest.theme.css';
 // A custom-property value must stay inside its declaration. A small tokenizer: strings
@@ -1588,10 +1597,21 @@ function themeValueRefusal(v) {
   }
   return stack.length ? 'unbalanced brackets' : null;
 }
-// Stylesheets a theme edit may write: the default theme file, stylesheets index.html
-// links, and files it names in data-edit-theme-file (what the client sends).
+// Stylesheets a theme edit may write: the default theme file and stylesheets index.html links.
+// The theme stylesheet index.html links (manifest.theme.css, wherever it lives), else the framework's default path.
+function defaultThemeFile() {
+  let html = '';
+  try { html = readFileSync(join(root, 'index.html'), 'utf8'); } catch { return DEFAULT_THEME_FILE; }
+  for (const n of allElements(parseHTML(html))) {
+    if (n.implied || n.name !== 'link') continue;
+    const open = openOf(html, n), href = String(attrOf(open, 'href') || '').trim().split(/[?#]/)[0];
+    if (!/(^|\s)stylesheet(\s|$)/i.test(attrOf(open, 'rel') || '') || /^[a-z][\w+.-]*:|^\/\//i.test(href)) continue;
+    if (basename(href) === 'manifest.theme.css') { const rel = posix.normalize(href.replace(/^\/+/, '')); if (!rel.startsWith('..')) return rel; }
+  }
+  return DEFAULT_THEME_FILE;
+}
 function themeTargets() {
-  const out = new Set([DEFAULT_THEME_FILE]);
+  const out = new Set([DEFAULT_THEME_FILE, defaultThemeFile()]);
   let html = '';
   try { html = readFileSync(join(root, 'index.html'), 'utf8'); } catch { return out; }   // read off-batch: not a base-checked input
   const add = (href) => {
@@ -1604,14 +1624,26 @@ function themeTargets() {
     if (n.implied) continue;
     const open = openOf(html, n);
     if (n.name === 'link' && /(^|\s)stylesheet(\s|$)/i.test(attrOf(open, 'rel') || '')) add(attrOf(open, 'href'));
-    const tf = attrOf(open, 'data-edit-theme-file'); if (tf != null) add(tf);
   }
   return out;
 }
+// Why a scoped theme value is not written to a stylesheet, for the case at hand
+function scopedThemeRefusal(p) {
+  const what = `scoped value ${p.scope}:${p.var}`;
+  for (const rel of Object.keys(baseHashes()).filter(f => /\.html?$/i.test(f))) {
+    const file = safeResolve('/' + rel); if (!file) continue;
+    let html = ''; try { html = readFileSync(file, 'utf8'); } catch { continue; }
+    if (locateEditEl(html, p.scope)) return `${what} applies on its scope element (x-edit="${p.scope}" in ${rel}): it is written there as an inline style edit, not to a stylesheet, which would apply it site-wide`;
+  }
+  return `${what}: no source file mnfst-run can write holds x-edit="${p.scope}" (generated content, or not on any page), and a stylesheet would apply it site-wide`;
+}
 function writeThemeVar(p) {
   if (!/^--[\w-]+$/.test(p.var || '')) return { region: p.var, status: 'error', reason: 'bad var name' };
-  const rel = posix.normalize(String(p.file || DEFAULT_THEME_FILE).replace(/^\/+/, ''));
-  if (!themeTargets().has(rel)) return { region: p.var, status: 'error', reason: `${rel} is not a stylesheet this page uses (link it, or name it in data-edit-theme-file)` };
+  // A scoped value applies on its scope element: the page writes it there (its inline style).
+  // One sent here has no element mnfst-run can address; a stylesheet would apply it site-wide.
+  if (p.scope) return { region: `${p.scope}:${p.var}`, status: 'error', reason: scopedThemeRefusal(p) };
+  const rel = posix.normalize(String(p.file || defaultThemeFile()).replace(/^\/+/, ''));
+  if (!themeTargets().has(rel)) return { region: p.var, status: 'error', reason: `${rel} is not a stylesheet this page links` };
   const file = safeResolve('/' + rel);
   if (!file) return { region: p.var, status: 'error', reason: `path outside root: ${rel}` };
   const refused = writeRefusal(file, 'css'); if (refused) return { region: p.var, status: 'error', reason: `refused: ${refused}` };
@@ -1664,7 +1696,7 @@ function writeComponentEdits(p, manifest) {
     const seg = ed.path === '' ? 'root' : ed.path.replace(/\./g, '_');
 
     if (prop === 'style') {
-      if (p.scope !== 'main') { applied.push({ path: ed.path, prop, status: 'skipped', reason: 'instance styles are not written' }); continue; }
+      if (p.scope !== 'main') { applied.push({ path: ed.path, prop, status: 'error', reason: 'instance styles are not written (only the component\'s own, in main scope)' }); continue; }
       const why = attrRefusal('style', ed.value, node.tag);
       if (why) { applied.push({ path: ed.path, prop, status: 'error', reason: why }); continue; }
       vwrite(compFile, html.slice(0, node.tagStart) + setAttr(openTag, 'style', ed.value ? String(ed.value) : null) + html.slice(node.openEnd + 1));
@@ -2055,7 +2087,7 @@ const server = createServer((req, res) => {
             if (p.kind === 'data') {
               const src = (manifest.data || {})[p.source];
               const rel = typeof src === 'string' ? src : null;
-              if (!rel) return { region: p.region, status: 'error', reason: `data source '${p.source}' is not a plain file path` };
+              if (!rel) return { region: p.region, status: 'error', reason: dataSourceRefusal(p.source, manifest) };
               const file = resolveRel(rel);
               if (!file || !isFile(file)) return { region: p.region, status: 'error', reason: `file not found: ${rel}` };
               const refused = writeRefusal(file, 'data'); if (refused) return { region: p.region, status: 'error', reason: `refused: ${refused}` };