mnfst 0.5.203 → 0.5.205

package/lib/manifest.js

@@ -187,6 +187,11 @@
 	// Configuration
 	const DEFAULT_VERSION = 'latest';
 
+	// The version the page booted with (data-version). Every later load —
+	// Manifest.loadPlugin(), usage sniffing — resolves against it, so a runtime
+	// load can't pull a second copy of the framework at another version.
+	let RESOLVED_VERSION = DEFAULT_VERSION;
+
 	// CDN fallback chain (first-party first). Each origin serves the npm scheme
 	// `<origin>/<pkg>@<version>/<path>`. Override order with `data-cdn`
 	// (comma-separated origins).
@@ -298,7 +303,7 @@
 	// candidate per CDN host, tried in order.
 	let _pluginBase = null;
 	function setPluginBase(b) { _pluginBase = b || null; }
-	function getPluginUrlCandidates(pluginName, version = DEFAULT_VERSION) {
+	function getPluginUrlCandidates(pluginName, version = RESOLVED_VERSION) {
 		// Hyphenated API name → dotted file name (`appwrite-auth` → appwrite.auth).
 		const fileName = pluginName.replace(/-/g, '.');
 		if (_pluginBase) {
@@ -307,7 +312,7 @@
 		}
 		return CDN_HOSTS.map(h => `${getBaseUrl(version, h)}/${hostFile(h, `manifest.${fileName}.min.js`)}`);
 	}
-	function getPluginUrl(pluginName, version = DEFAULT_VERSION) {
+	function getPluginUrl(pluginName, version = RESOLVED_VERSION) {
 		return getPluginUrlCandidates(pluginName, version)[0];
 	}
 
@@ -388,14 +393,8 @@
 		return false;
 	}
 
-	// One fetch per URL: concurrent callers share the first call's promise
-	const inflightScripts = new Map();
-
 	function injectScript(url) {
-		const shared = inflightScripts.get(url);
-		if (shared) return shared;
-
-		const promise = new Promise((resolve, reject) => {
+		return new Promise((resolve, reject) => {
 			// Same src already in the DOM (author tag, prerendered HTML, second loader run)
 			const existing = document.querySelector(`script[src="${url}"]`);
 			if (existing) {
@@ -418,16 +417,12 @@
 			script.onerror = () => { script.removeAttribute('data-mnfst-loading'); script.remove(); reject(new Error(`Failed to load ${url}`)); };
 			document.head.appendChild(script);
 		});
-
-		inflightScripts.set(url, promise);
-		promise.then(() => inflightScripts.delete(url), () => inflightScripts.delete(url));   // dedupe only while in flight
-		return promise;
 	}
 
 	// Load a plugin, falling through the CDN chain on error. A fallback insert
 	// lands after already-inserted scripts, so strict cross-plugin execution
 	// order is traded for availability in the (already degraded) fallback case.
-	async function addScript(pluginName, version = DEFAULT_VERSION) {
+	async function fetchPluginScript(pluginName, version) {
 		const urls = getPluginUrlCandidates(pluginName, version);
 		let lastErr = null;
 		for (const url of urls) {
@@ -441,6 +436,26 @@
 		throw lastErr || new Error(`Failed to load ${pluginName}`);
 	}
 
+	// One execution per plugin per page. injectScript dedupes by URL, which two
+	// versions of the same plugin slip past — and a second copy of a plugin that
+	// owns page-level state (utilities' style element and its order observer)
+	// fights the first. A failed load is forgotten so a retry can still run.
+	const pluginLoads = new Map();
+
+	async function addScript(pluginName, version = RESOLVED_VERSION) {
+		const prior = pluginLoads.get(pluginName);
+		if (prior) {
+			if (prior.version !== version) {
+				console.warn(`[Manifest Loader] ${pluginName} already loaded at ${prior.version} — ignoring request for ${version}`);
+			}
+			return prior.promise;
+		}
+		const promise = fetchPluginScript(pluginName, version);
+		pluginLoads.set(pluginName, { version, promise });
+		promise.catch(() => pluginLoads.delete(pluginName));
+		return promise;
+	}
+
 	// Resolve plugin dependencies (auto-inject required dependencies)
 	function resolveDependencies(pluginList) {
 		const resolved = [];
@@ -635,8 +650,26 @@
 		};
 	}
 
+	// A publish/render bake stamps `data-mnfst-utilities-complete` on its
+	// `<style data-mnfst-utilities>` sheet once it has verified every class
+	// scanned from the page's own HTML got a rule (Manifest's + the baked
+	// Tailwind pass — see compileUtilities in manifest.utilities.node.mjs).
+	// Only the inline `<style>` case is checked: it's synchronous, so this can
+	// run before deciding whether to fetch the Tailwind engine at all — a
+	// `<link>` sheet would need an async load first, so it's left alone
+	// (fail open: Tailwind still loads). No flag, no attribute, any read
+	// error → false, so this never skips loading the engine speculatively.
+	function staticUtilitiesFullyCovered() {
+		try {
+			const el = document.querySelector('style[data-mnfst-utilities][data-mnfst-utilities-complete]');
+			return !!el;
+		} catch (e) {
+			return false;
+		}
+	}
+
 	// Load custom Tailwind CDN script, falling through the CDN chain on error
-	async function loadTailwind(version = DEFAULT_VERSION) {
+	async function loadTailwind(version = RESOLVED_VERSION) {
 		const urls = CDN_HOSTS.map(h => `${getBaseUrl(version, h)}/${hostFile(h, 'manifest.tailwind.min.js')}`);
 		let lastErr = null;
 		for (const url of urls) {
@@ -652,7 +685,7 @@
 
 	// Expose API
 	window.Manifest = {
-		loadPlugin: function (pluginName, version = DEFAULT_VERSION) {
+		loadPlugin: function (pluginName, version = RESOLVED_VERSION) {
 			const allPlugins = [...AVAILABLE_PLUGINS, ...APPWRITE_PLUGINS, ...AUTHORING_PLUGINS, 'payments', 'chat', 'device'];
 			if (!allPlugins.includes(pluginName)) {
 				console.warn(`[Manifest Loader] Unknown plugin: ${pluginName}`);
@@ -780,6 +813,7 @@
 
 	// Parse config and load plugins
 	const config = parseDataAttributes();
+	if (config && config.version) RESOLVED_VERSION = config.version;
 	if (config && config.pluginBase) setPluginBase(config.pluginBase);
 	if (config && config.cdn) setCdnHosts(config.cdn);
 	armServiceWorker(config);
@@ -890,7 +924,7 @@
 					console.warn(`[Manifest Loader] Failed to load plugin ${pluginName}:`, error);
 				});
 			});
-			if (config.tailwind) {
+			if (config.tailwind && !staticUtilitiesFullyCovered()) {
 				pluginPromises.push(loadTailwind(config.version).catch(() => { }));
 			}
 			await Promise.all(pluginPromises);

package/lib/manifest.schema.json

@@ -144,6 +144,20 @@
                                     { "type": "array", "items": { "type": "string", "enum": ["user", "team"] } }
                                 ]
                             },
+                            "scopeColumn": {
+                                "description": "Column name(s) `scope` filters/writes on. Default teamId/userId. A string sets both; an object sets them independently.",
+                                "oneOf": [
+                                    { "type": "string" },
+                                    {
+                                        "type": "object",
+                                        "properties": {
+                                            "team": { "type": "string" },
+                                            "user": { "type": "string" }
+                                        },
+                                        "additionalProperties": false
+                                    }
+                                ]
+                            },
                             "autoInjectUserId": { "type": "boolean" },
                             "autoInjectTeamId": { "type": "boolean" },
                             "queries": {

package/lib/manifest.sw.js

@@ -16,7 +16,7 @@
 
 // Build stamps the published version here; unstamped (dev) falls back to the
 // registration URL's `v`, then 'dev'.
-const BUILD_VERSION = '0.5.203';
+const BUILD_VERSION = '0.5.205';
 const CACHE_PREFIX = 'mnfst-sw:';
 const META_CACHE = CACHE_PREFIX + 'meta';
 const SWR_CAP = 200;

package/lib/manifest.utilities.js

@@ -558,8 +558,10 @@ class TailwindCompiler {
 
         // Read any publish/render-provided static utilities sheet before the
         // first compile — its classes are skipped rather than regenerated.
+        // Fails open (never "everything covered") until this resolves —
+        // compile()'s first run awaits it, capped at 2s (see static.js).
         this.staticUtilitiesCoveredClasses = null;
-        this.detectStaticUtilitiesSheet();
+        this.staticUtilitiesReady = this.detectStaticUtilitiesSheet();
 
         // Add critical styles IMMEDIATELY - don't wait for anything
         this.addCriticalBlockingStylesSync();
@@ -1488,9 +1490,12 @@ TailwindCompiler.prototype.scanStaticClasses = async function () {
 
 // Extract classes from HTML content
 TailwindCompiler.prototype.extractClassesFromHTML = function (html, classSet) {
-    // Plain class attributes only — the leading boundary excludes Alpine's
-    // :class / x-bind:class bindings (JS expressions, not token lists)
-    const classRegex = /(?:^|[\s"'`>/])(?:[a-zA-Z][\w.-]*-)?class=["']([^"']+)["']/g;
+    // Literal class="..."/class='...' only — lookbehind excludes `:class=`
+    // (Alpine binding), whose "class=" substring would otherwise match and
+    // truncate at the literal's first internal quote, leaking a stray '{'.
+    // Whitespace-only split below keeps every token Tailwind would accept
+    // (variants, arbitrary values, leading '-', '!'); only x-/$ tokens drop.
+    const classRegex = /(?<![:\w])class=["']([^"']+)["']/g;
     let match;
 
     while ((match = classRegex.exec(html)) !== null) {
@@ -1701,8 +1706,11 @@ TailwindCompiler.prototype.fetchThemeContent = async function () {
 TailwindCompiler.prototype.extractThemeVariables = function (cssText) {
     const variables = new Map();
 
-    // Extract ALL CSS custom properties from ANY declaration block
-    const varRegex = /--([\w-]+):\s*([^;]+);/g;
+    // Extract ALL CSS custom properties from ANY declaration block. Terminator
+    // is a lookahead (`;` or `}`) rather than a consumed `;` so the last
+    // declaration in a block still matches when the author omits the
+    // trailing semicolon (valid CSS, e.g. `:root{--x:1rem}`).
+    const varRegex = /--([\w-]+):\s*([^;}]+)(?=[;}])/g;
 
     let varMatch;
     while ((varMatch = varRegex.exec(cssText)) !== null) {
@@ -3180,6 +3188,11 @@ TailwindCompiler.prototype.compile = async function () {
         if (!this.hasScannedStatic) {
             await this.scanStaticClasses();
 
+            // Wait for the static utilities sheet's covered-class read to
+            // settle (capped at 2s in detectStaticUtilitiesSheet) so this
+            // first compile decision isn't a guess — see static.js.
+            if (this.staticUtilitiesReady) await this.staticUtilitiesReady;
+
             // Fetch CSS content once for initial compilation
             const themeCss = await this.fetchThemeContent();
             if (themeCss) {
@@ -3377,6 +3390,14 @@ TailwindCompiler.prototype.extractSelectorsFromCssText = function (cssText) {
     const len = cssText.length;
     let i = 0;
     while (i < len) {
+        // Skip inter-rule whitespace first — without this, whitespace before an
+        // `@layer`/`@media` (e.g. after a preceding `@layer base, ...;` statement
+        // or sibling rule) leaves `i` off the '@', so the block below never fires
+        // and the whole nested block is swallowed whole as one bogus selector,
+        // losing every class inside it (real Tailwind/compileUtilities output is
+        // always `@layer theme {...}` followed by `@layer utilities {...}`).
+        while (i < len && /\s/.test(cssText[i])) i++;
+        if (i >= len) break;
         if (cssText[i] === '/' && cssText[i + 1] === '*') {
             const end = cssText.indexOf('*/', i + 2);
             i = end === -1 ? len : end + 2;
@@ -3429,40 +3450,70 @@ TailwindCompiler.prototype.classNamesFromCssText = function (cssText) {
     return classSet;
 };
 
-// Read the static sheet's covered classes once. Same-origin `<link>`/`<style>`
-// rules are read synchronously via CSSOM; if the sheet isn't accessible yet
-// (cross-origin, or not finished loading) this falls back to fetching the
-// `href` as text and re-populating the covered set when it resolves.
+// Attempt a synchronous CSSOM read of the static link's rules. Returns a Set
+// of covered classes, or null when nothing could be read — a security error
+// (cross-origin), an exception, a missing sheet, or zero rules (the link
+// hasn't finished loading, or its sheet is genuinely empty). null is never
+// distinguished from "empty": both fail open in filterStaticallyCoveredClasses
+// / stripCoveredRulesFromCss, and neither is ever treated as "everything
+// covered".
+TailwindCompiler.prototype.readStaticUtilitiesRules = function (el) {
+    try {
+        const sheet = Array.from(document.styleSheets).find(s => s.ownerNode === el);
+        const rules = sheet && sheet.cssRules;
+        if (rules && rules.length > 0) {
+            const cssText = Array.from(rules).map(r => r.cssText).join('\n');
+            return this.classNamesFromCssText(cssText);
+        }
+    } catch (e) {
+        // Cross-origin, or not yet parsed.
+    }
+    return null;
+};
+
+// Read the static sheet's covered classes once per page load. `<style>` and
+// an already-loaded `<link>` resolve synchronously. A `<link>` that hasn't
+// finished loading (or whose sheet can't be read yet) is awaited via its
+// `load`/`error` event, capped at 2s, then re-read once more; the caller
+// (compile()'s first run) awaits the returned promise so the very first
+// compile decision sees an accurate covered set rather than a guess. Fails
+// open the whole time — staticUtilitiesCoveredClasses stays null (nothing
+// covered) until a read actually succeeds, never cached as "covered".
 TailwindCompiler.prototype.detectStaticUtilitiesSheet = function () {
     this.staticUtilitiesCoveredClasses = null;
     const el = this.findStaticUtilitiesElement();
-    if (!el) return;
+    if (!el) return Promise.resolve();
 
     if (el.tagName === 'STYLE') {
         this.staticUtilitiesCoveredClasses = this.classNamesFromCssText(el.textContent || '');
-        return;
+        return Promise.resolve();
     }
 
-    try {
-        const sheet = Array.from(document.styleSheets).find(s => s.ownerNode === el);
-        const rules = sheet && sheet.cssRules;
-        if (rules && rules.length > 0) {
-            const cssText = Array.from(rules).map(r => r.cssText).join('\n');
-            this.staticUtilitiesCoveredClasses = this.classNamesFromCssText(cssText);
-            return;
-        }
-    } catch (e) {
-        // Cross-origin (or not yet parsed) — fall through to fetch.
+    const covered = this.readStaticUtilitiesRules(el);
+    if (covered) {
+        this.staticUtilitiesCoveredClasses = covered;
+        return Promise.resolve();
     }
 
-    // Placeholder so callers treat "not yet known" as "nothing covered" rather
-    // than null, until the fetch below resolves and replaces it.
-    this.staticUtilitiesCoveredClasses = new Set();
-    const href = el.getAttribute('href');
-    if (!href || typeof fetch !== 'function') return;
-    fetch(href).then(r => (r.ok ? r.text() : '')).then(text => {
-        if (text) this.staticUtilitiesCoveredClasses = this.classNamesFromCssText(text);
-    }).catch(() => {});
+    return new Promise((resolve) => {
+        let settled = false;
+        const finish = () => {
+            if (settled) return;
+            settled = true;
+            clearTimeout(timer);
+            el.removeEventListener('load', onLoad);
+            el.removeEventListener('error', onError);
+            // staticUtilitiesCoveredClasses stays null (fail open) if this
+            // still can't be read — e.g. a cross-origin sheet without CORS.
+            this.staticUtilitiesCoveredClasses = this.readStaticUtilitiesRules(el);
+            resolve();
+        };
+        const onLoad = () => finish();
+        const onError = () => finish();
+        const timer = setTimeout(finish, 2000);
+        el.addEventListener('load', onLoad, { once: true });
+        el.addEventListener('error', onError, { once: true });
+    });
 };
 
 // Drop classes already covered by the static sheet before generating rules
@@ -3486,6 +3537,12 @@ TailwindCompiler.prototype.stripCoveredRulesFromCss = function (cssText) {
         const len = text.length;
         let i = 0;
         while (i < len) {
+            // Skip (but preserve) inter-rule whitespace before checking for an
+            // at-rule — see extractSelectorsFromCssText for why this matters.
+            const wsStart = i;
+            while (i < len && /\s/.test(text[i])) i++;
+            if (i > wsStart) out.push(text.slice(wsStart, i));
+            if (i >= len) break;
             if (text[i] === '/' && text[i + 1] === '*') {
                 const end = text.indexOf('*/', i + 2);
                 const stop = end === -1 ? len : end + 2;
@@ -3831,8 +3888,13 @@ function injectTailwindVariants() {
 }
 injectTailwindVariants();
 
-// Initialize immediately without waiting for DOMContentLoaded
-const compiler = new TailwindCompiler();
+// One compiler per page: a second copy would own a rival #manifest-styles and
+// the two order observers would re-append their own style to <head> forever.
+// A compiler whose style element left the document is stale, so it is rebuilt.
+const existingCompiler = window.ManifestUtilities;
+const compiler = (existingCompiler && existingCompiler.styleElement && existingCompiler.styleElement.isConnected)
+    ? existingCompiler
+    : new TailwindCompiler();
 
 // Expose utilities compiler for optional integration
 window.ManifestUtilities = compiler;
@@ -3856,11 +3918,14 @@ if ('PerformanceObserver' in window) {
 }
 
 // Recompile on DOMContentLoaded for late-added elements
-document.addEventListener('DOMContentLoaded', () => {
-    if (!compiler.usesStaticPrerenderUtilities && !compiler.isCompiling) {
-        compiler.compile();
-    }
-});
+if (!compiler.__mnfstDomReadyBound) {
+    compiler.__mnfstDomReadyBound = true;
+    document.addEventListener('DOMContentLoaded', () => {
+        if (!compiler.usesStaticPrerenderUtilities && !compiler.isCompiling) {
+            compiler.compile();
+        }
+    });
+}