polen 0.10.0-next.13 → 0.10.0-next.15

package/src/lib/graphql-document/schema-integration.ts

@@ -8,27 +8,18 @@
 
 import {
   getNamedType,
-  type GraphQLEnumType,
   type GraphQLField,
   type GraphQLInputField,
-  type GraphQLInputObjectType,
-  type GraphQLInterfaceType,
-  type GraphQLObjectType,
-  type GraphQLScalarType,
   type GraphQLSchema,
   type GraphQLType,
-  type GraphQLUnionType,
-  isEnumType,
   isInputObjectType,
   isInterfaceType,
   isListType,
   isNonNullType,
   isObjectType,
-  isScalarType,
-  isUnionType,
 } from 'graphql'
-import { analyze } from './analysis.ts'
-import type { Identifier } from './types.ts'
+import { analyze } from './analysis.js'
+import type { Identifier } from './types.js'
 
 /**
  * Documentation extracted from GraphQL schema
@@ -119,39 +110,39 @@ export class PolenSchemaResolver implements SchemaResolver {
    * Resolve an identifier against the schema
    */
   resolveIdentifier(identifier: Identifier): SchemaResolution | null {
-    const basePath = this.routeConfig.basePath || '/reference'
+    const basePath = this.routeConfig.basePath || `/reference`
 
     switch (identifier.kind) {
-      case 'Type':
+      case `Type`:
         return this.resolveType(identifier, basePath)
 
-      case 'Field':
+      case `Field`:
         return this.resolveField(identifier, basePath)
 
-      case 'Argument':
+      case `Argument`:
         return this.resolveArgument(identifier, basePath)
 
-      case 'Variable':
+      case `Variable`:
         // Variables don't have schema resolution
         return {
           exists: true,
           referenceUrl: `${basePath}#variables`,
           documentation: {
-            typeInfo: 'Variable',
+            typeInfo: `Variable`,
             description: `Query variable: $${identifier.name}`,
           },
         }
 
-      case 'Directive':
+      case `Directive`:
         return this.resolveDirective(identifier, basePath)
 
-      case 'Fragment':
+      case `Fragment`:
         // Fragments don't have schema resolution
         return {
           exists: true,
           referenceUrl: `${basePath}#fragments`,
           documentation: {
-            typeInfo: 'Fragment',
+            typeInfo: `Fragment`,
             description: `Fragment: ${identifier.name}`,
           },
         }
@@ -179,7 +170,7 @@ export class PolenSchemaResolver implements SchemaResolver {
       return {
         typeInfo: this.getTypeSignature(type),
         description: type.description || undefined,
-        deprecated: 'deprecationReason' in type
+        deprecated: `deprecationReason` in type
           ? {
             reason: (type as any).deprecationReason,
           }
@@ -206,7 +197,7 @@ export class PolenSchemaResolver implements SchemaResolver {
     // Argument-level documentation
     if (fieldName && argName && schemaPath.length === 3) {
       const field = this.getFieldFromType(type, fieldName)
-      if (!field || !('args' in field)) return null
+      if (!field || !(`args` in field)) return null
 
       const arg = field.args.find((a: any) => a.name === argName)
       if (!arg) return null
@@ -227,7 +218,7 @@ export class PolenSchemaResolver implements SchemaResolver {
    * Generate a reference URL for a schema path
    */
   generateReferenceLink(schemaPath: string[]): string {
-    const basePath = this.routeConfig.basePath || '/reference'
+    const basePath = this.routeConfig.basePath || `/reference`
     const includeFragments = this.routeConfig.includeFragments !== false
 
     if (schemaPath.length === 0) return basePath
@@ -241,13 +232,13 @@ export class PolenSchemaResolver implements SchemaResolver {
 
     // Field reference
     if (fieldName && schemaPath.length === 2) {
-      const fragment = includeFragments ? `#${fieldName}` : ''
+      const fragment = includeFragments ? `#${fieldName}` : ``
       return `${basePath}/${typeName}${fragment}`
     }
 
     // Argument reference
     if (fieldName && argName && schemaPath.length === 3) {
-      const fragment = includeFragments ? `#${fieldName}-${argName}` : ''
+      const fragment = includeFragments ? `#${fieldName}-${argName}` : ``
       return `${basePath}/${typeName}${fragment}`
     }
 
@@ -266,7 +257,7 @@ export class PolenSchemaResolver implements SchemaResolver {
    */
   getAllTypes(): string[] {
     return Object.keys(this.schema.getTypeMap())
-      .filter(name => !name.startsWith('__')) // Filter out introspection types
+      .filter(name => !name.startsWith(`__`)) // Filter out introspection types
   }
 
   // Private helper methods
@@ -353,7 +344,7 @@ export class PolenSchemaResolver implements SchemaResolver {
     }
 
     const field = this.getFieldFromType(parentType, fieldName)
-    if (!field || !('args' in field)) {
+    if (!field || !(`args` in field)) {
       return {
         exists: false,
         referenceUrl: `${basePath}/${typeName}#${fieldName}-${identifier.name}`,
@@ -385,7 +376,7 @@ export class PolenSchemaResolver implements SchemaResolver {
       referenceUrl: `${basePath}/directives#${identifier.name}`,
       documentation: directive
         ? {
-          typeInfo: 'Directive',
+          typeInfo: `Directive`,
           description: directive.description || undefined,
         }
         : undefined,
@@ -432,15 +423,15 @@ export const createPolenSchemaResolver = (
  */
 export interface SchemaAwareAnalysisResult {
   /** Original analysis result */
-  analysis: import('./types.ts').AnalysisResult
+  analysis: import('./types.js').AnalysisResult
   /** Schema resolutions for all identifiers */
   resolutions: Map<string, SchemaResolution>
   /** Validation errors from schema checking */
-  schemaErrors: Array<{
+  schemaErrors: {
     identifier: Identifier
     message: string
-    severity: 'error' | 'warning'
-  }>
+    severity: `error` | `warning`
+  }[]
 }
 
 /**
@@ -459,7 +450,7 @@ export const analyzeWithSchema = (
 
   const resolver = createPolenSchemaResolver(schema, routeConfig)
   const resolutions = new Map<string, SchemaResolution>()
-  const schemaErrors: SchemaAwareAnalysisResult['schemaErrors'] = []
+  const schemaErrors: SchemaAwareAnalysisResult[`schemaErrors`] = []
 
   // Resolve all identifiers against schema
   for (const identifier of analysis.identifiers.all) {
@@ -470,11 +461,11 @@ export const analyzeWithSchema = (
       resolutions.set(key, resolution)
 
       // Add validation errors for non-existent identifiers
-      if (!resolution.exists && (identifier.kind === 'Type' || identifier.kind === 'Field')) {
+      if (!resolution.exists && (identifier.kind === `Type` || identifier.kind === `Field`)) {
         schemaErrors.push({
           identifier,
           message: `${identifier.kind} "${identifier.name}" does not exist in schema`,
-          severity: 'error',
+          severity: `error`,
         })
       }
 
@@ -483,7 +474,7 @@ export const analyzeWithSchema = (
         schemaErrors.push({
           identifier,
           message: `${identifier.kind} "${identifier.name}" is deprecated: ${resolution.deprecated.reason}`,
-          severity: 'warning',
+          severity: `warning`,
         })
       }
     }

package/src/lib/graphql-document/types.ts

@@ -7,7 +7,7 @@ export interface Identifier {
   /** The name of the identifier (e.g., 'User', 'name', 'id') */
   name: string
   /** The kind of GraphQL construct this identifier represents */
-  kind: 'Type' | 'Field' | 'Argument' | 'Directive' | 'Variable' | 'Fragment'
+  kind: `Type` | `Field` | `Argument` | `Directive` | `Variable` | `Fragment`
   /** Position information in the source document */
   position: {
     /** Character offset from start of document */
@@ -32,7 +32,7 @@ export interface Identifier {
  */
 export interface IdentifierContext {
   /** The operation type if this identifier is within an operation */
-  operationType?: 'query' | 'mutation' | 'subscription'
+  operationType?: `query` | `mutation` | `subscription`
   /** The operation name if this identifier is within a named operation */
   operationName?: string
   /** Whether this identifier is in a fragment definition */
@@ -48,7 +48,7 @@ export interface IdentifierMap {
   /** Quick lookup by character position */
   byPosition: Map<number, Identifier>
   /** Grouped by identifier kind for easy filtering */
-  byKind: Map<Identifier['kind'], Identifier[]>
+  byKind: Map<Identifier[`kind`], Identifier[]>
   /** Any validation errors found during analysis */
   errors: AnalysisError[]
   /** All identifiers as a flat array */
@@ -64,7 +64,7 @@ export interface AnalysisError {
   /** Human-readable error message */
   message: string
   /** Error severity level */
-  severity: 'error' | 'warning' | 'info'
+  severity: `error` | `warning` | `info`
   /** Position in the document where the error occurred */
   position?: {
     line: number

package/src/lib/graphql-schema-loader/index.ts

@@ -1 +1 @@
-export * as GraphqlSchemaLoader from './graphql-schema-loader.ts'
+export * as GraphqlSchemaLoader from './graphql-schema-loader.js'

package/src/lib/helpers.ts

@@ -10,7 +10,7 @@ export async function checkIsProjectHasPackageInstalled(
   const packageJson = await Manifest.resource.read(projectRoot)
 
   if (Err.is(packageJson)) {
-    if (packageJson._tag === 'ResourceErrorNotFound') return false
+    if (packageJson._tag === `ResourceErrorNotFound`) return false
     throw packageJson
   }
 

package/src/lib/hono-aid/index.ts

@@ -1 +1 @@
-export * as HonoAid from './hono-aid.ts'
+export * as HonoAid from './hono-aid.js'

package/src/lib/html-utils/html-transformer.ts

@@ -0,0 +1,6 @@
+import type { Hono } from '#dep/hono/index'
+import { Fn } from '@wollybeard/kit'
+
+export type HtmlTransformer = (html: string, ctx: Hono.Context) => Promise<string> | string
+
+export const createHtmlTransformer = Fn.identity<HtmlTransformer>

package/src/lib/html-utils/inject-global-data.test.ts

@@ -0,0 +1,89 @@
+import { describe, expect, it } from 'vitest'
+import {
+  createGlobalDataScript,
+  createGlobalDataScriptWithInit,
+  injectGlobalDataIntoHTML,
+} from './inject-global-data.js'
+
+describe('createGlobalDataScript', () => {
+  it('creates a script tag with JSON data', () => {
+    const result = createGlobalDataScript('__TEST__', { foo: 'bar', num: 42 })
+    expect(result).toBe('<script>globalThis.__TEST__ = {"foo":"bar","num":42};</script>')
+  })
+
+  it('handles nested data structures', () => {
+    const data = {
+      user: { id: 1, name: 'John' },
+      settings: { theme: 'dark', notifications: true },
+    }
+    const result = createGlobalDataScript('__APP__', data)
+    expect(result).toContain('globalThis.__APP__ =')
+    expect(result).toContain(JSON.stringify(data))
+  })
+
+  it('escapes special characters in data', () => {
+    const data = { html: '</script><script>alert("xss")</script>' }
+    const result = createGlobalDataScript('__SAFE__', data)
+    // JSON.stringify escapes the forward slashes
+    expect(result).not.toContain('</script><script>')
+    expect(result).toContain('<\\/script>')
+  })
+
+  it('throws on invalid global names', () => {
+    expect(() => createGlobalDataScript('123invalid', {})).toThrow('Invalid global variable name')
+    expect(() => createGlobalDataScript('invalid-name', {})).toThrow('Invalid global variable name')
+    expect(() => createGlobalDataScript('invalid.name', {})).toThrow('Invalid global variable name')
+  })
+
+  it('accepts valid global names', () => {
+    expect(() => createGlobalDataScript('_valid', {})).not.toThrow()
+    expect(() => createGlobalDataScript('$valid', {})).not.toThrow()
+    expect(() => createGlobalDataScript('VALID_123', {})).not.toThrow()
+  })
+})
+
+describe('createGlobalDataScriptWithInit', () => {
+  it('creates script with data and init code', () => {
+    const result = createGlobalDataScriptWithInit(
+      '__THEME__',
+      { theme: 'dark' },
+      'document.body.className = globalThis.__THEME__.theme;',
+    )
+    expect(result).toContain('globalThis.__THEME__ = {"theme":"dark"};')
+    expect(result).toContain('document.body.className = globalThis.__THEME__.theme;')
+    expect(result).toMatch(/<script>.*<\/script>/s)
+  })
+
+  it('returns just data script when no init code provided', () => {
+    const result = createGlobalDataScriptWithInit('__TEST__', { foo: 'bar' })
+    expect(result).toBe('<script>globalThis.__TEST__ = {"foo":"bar"};</script>')
+  })
+})
+
+describe('injectGlobalDataIntoHTML', () => {
+  const sampleHTML = `
+<html>
+  <head>
+    <title>Test</title>
+  </head>
+  <body>
+    <div id="app"></div>
+  </body>
+</html>`
+
+  it('injects script into head', () => {
+    const result = injectGlobalDataIntoHTML(sampleHTML, '__APP__', { version: '1.0' })
+    expect(result).toContain('<head>\n<script>globalThis.__APP__ = {"version":"1.0"};</script>')
+  })
+
+  it('injects script with init code', () => {
+    const result = injectGlobalDataIntoHTML(
+      sampleHTML,
+      '__CONFIG__',
+      { apiUrl: '/api' },
+      'console.log("Config loaded:", globalThis.__CONFIG__);',
+    )
+    expect(result).toContain('globalThis.__CONFIG__ = {"apiUrl":"/api"};')
+    expect(result).toContain('console.log("Config loaded:", globalThis.__CONFIG__);')
+  })
+})

package/src/lib/html-utils/inject-global-data.ts

@@ -0,0 +1,80 @@
+/**
+ * Creates an HTML script tag that injects data into a global variable
+ *
+ * @param globalName - The name of the global variable (e.g., '__POLEN__')
+ * @param data - The data to inject (will be JSON stringified)
+ * @returns HTML script tag string ready to inject into HTML
+ *
+ * @example
+ * ```ts
+ * const script = createGlobalDataScript('__MY_APP__', { user: { id: 1, name: 'John' } })
+ * // Returns: <script>globalThis.__MY_APP__ = {"user":{"id":1,"name":"John"}};</script>
+ * ```
+ */
+export const createGlobalDataScript = (globalName: string, data: unknown): string => {
+  // Validate global name to prevent injection attacks
+  if (!/^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(globalName)) {
+    throw new Error(`Invalid global variable name: ${globalName}`)
+  }
+
+  // JSON.stringify and then escape </script> tags to prevent XSS
+  const jsonData = JSON.stringify(data)
+    // Escape </script> to prevent breaking out of script tag
+    .replace(/<\/script>/gi, '<\\/script>')
+
+  return `<script>globalThis.${globalName} = ${jsonData};</script>`
+}
+
+/**
+ * Creates a script tag that initializes global data and runs initialization code
+ *
+ * @param globalName - The name of the global variable
+ * @param data - The data to inject
+ * @param initCode - Optional initialization code to run after setting the global
+ * @returns HTML script tag string
+ *
+ * @example
+ * ```ts
+ * const script = createGlobalDataScriptWithInit('__THEME__', { theme: 'dark' }, `
+ *   document.documentElement.className = globalThis.__THEME__.theme;
+ * `)
+ * ```
+ */
+export const createGlobalDataScriptWithInit = (
+  globalName: string,
+  data: unknown,
+  initCode?: string,
+): string => {
+  const dataScript = createGlobalDataScript(globalName, data)
+
+  if (!initCode) {
+    return dataScript
+  }
+
+  // Remove the closing </script> tag from data script and append init code
+  const scriptContent = dataScript.replace('</script>', `\n${initCode}\n</script>`)
+  return scriptContent
+}
+
+/**
+ * Injects a global data script into the head of an HTML document
+ *
+ * @param html - The HTML document string
+ * @param globalName - The name of the global variable
+ * @param data - The data to inject
+ * @param initCode - Optional initialization code
+ * @returns Modified HTML with script injected
+ */
+export const injectGlobalDataIntoHTML = (
+  html: string,
+  globalName: string,
+  data: unknown,
+  initCode?: string,
+): string => {
+  const script = initCode
+    ? createGlobalDataScriptWithInit(globalName, data, initCode)
+    : createGlobalDataScript(globalName, data)
+
+  // Inject at the beginning of head to ensure it runs first
+  return html.replace('<head>', `<head>\n${script}`)
+}

package/src/lib/kit-temp.test-d.ts

@@ -3,24 +3,29 @@ import { objFilter, ObjOmit, ObjPick, objPolicyFilter } from './kit-temp.js'
 import type { ObjPolicyFilter } from './kit-temp.js'
 
 // Test object for all tests
-type TestObj = { a: string; b: number; c: boolean; d: string[] }
+interface TestObj {
+  a: string
+  b: number
+  c: boolean
+  d: string[]
+}
 declare const testObj: TestObj
 
 // Test 1: objPolicyFilter with allow mode
 {
-  const result = objPolicyFilter('allow', testObj, ['a', 'c'] as const)
+  const result = objPolicyFilter(`allow`, testObj, [`a`, `c`] as const)
   Ts.assertEqual<{ a: string; c: boolean }>()(result)
 }
 
 // Test 2: objPolicyFilter with deny mode
 {
-  const result = objPolicyFilter('deny', testObj, ['a', 'c'] as const)
+  const result = objPolicyFilter(`deny`, testObj, [`a`, `c`] as const)
   Ts.assertEqual<{ b: number; d: string[] }>()(result)
 }
 
 // Test 3: objFilter returns Partial<T>
 {
-  const result = objFilter(testObj, (key, value) => value !== 'hello')
+  const result = objFilter(testObj, (key, value) => value !== `hello`)
   Ts.assertEqual<Partial<TestObj>>()(result)
 
   // All properties are optional
@@ -32,28 +37,28 @@ declare const testObj: TestObj
 
 // Test 4: ObjPick type inference
 {
-  const result = ObjPick(testObj, ['a', 'c'] as const)
+  const result = ObjPick(testObj, [`a`, `c`] as const)
   Ts.assertEqual<{ a: string; c: boolean }>()(result)
 }
 
 // Test 5: ObjOmit type inference
 {
-  const result = ObjOmit(testObj, ['a', 'c'] as const)
+  const result = ObjOmit(testObj, [`a`, `c`] as const)
   Ts.assertEqual<{ b: number; d: string[] }>()(result)
 }
 
 // Test 6: ObjPolicyFilter type-level function
 {
-  type Allow = ObjPolicyFilter<TestObj, 'a' | 'c', 'allow'>
+  type Allow = ObjPolicyFilter<TestObj, `a` | `c`, `allow`>
   type _TestAllow = Ts.AssertEqual<Allow, { a: string; c: boolean }>
 
-  type Deny = ObjPolicyFilter<TestObj, 'a' | 'c', 'deny'>
+  type Deny = ObjPolicyFilter<TestObj, `a` | `c`, `deny`>
   type _TestDeny = Ts.AssertEqual<Deny, { b: number; d: string[] }>
 
-  type AllowEmpty = ObjPolicyFilter<TestObj, never, 'allow'>
+  type AllowEmpty = ObjPolicyFilter<TestObj, never, `allow`>
   type _TestAllowEmpty = Ts.AssertEqual<AllowEmpty, {}>
 
-  type DenyEmpty = ObjPolicyFilter<TestObj, never, 'deny'>
+  type DenyEmpty = ObjPolicyFilter<TestObj, never, `deny`>
   type _TestDenyEmpty = Ts.AssertEqual<DenyEmpty, TestObj>
 }
 
@@ -61,8 +66,8 @@ declare const testObj: TestObj
 {
   // Empty object
   const empty = {}
-  const allowEmpty = objPolicyFilter('allow', empty, [])
-  const denyEmpty = objPolicyFilter('deny', empty, [])
+  const allowEmpty = objPolicyFilter(`allow`, empty, [])
+  const denyEmpty = objPolicyFilter(`deny`, empty, [])
   const filterEmpty = objFilter(empty, () => true)
 
   Ts.assertEqual<{}>()(allowEmpty)
@@ -71,8 +76,8 @@ declare const testObj: TestObj
 
   // Single property object
   const single = { a: 1 }
-  const allowSingle = objPolicyFilter('allow', single, ['a'] as const)
-  const denySingle = objPolicyFilter('deny', single, ['a'] as const)
+  const allowSingle = objPolicyFilter(`allow`, single, [`a`] as const)
+  const denySingle = objPolicyFilter(`deny`, single, [`a`] as const)
   const filterSingle = objFilter(single, () => true)
 
   Ts.assertEqual<{ a: number }>()(allowSingle)
@@ -82,7 +87,7 @@ declare const testObj: TestObj
 
 // Test 8: Complex nested object
 {
-  type ComplexObj = {
+  interface ComplexObj {
     nested: { a: string; b: number }
     array: string[]
     optional?: boolean
@@ -90,26 +95,26 @@ declare const testObj: TestObj
   }
   const complexObj = {} as ComplexObj
 
-  const picked = objPolicyFilter('allow', complexObj, ['nested', 'optional'] as const)
+  const picked = objPolicyFilter(`allow`, complexObj, [`nested`, `optional`] as const)
   Ts.assertEqual<{ nested: { a: string; b: number }; optional?: boolean }>()(picked)
 
-  const omitted = objPolicyFilter('deny', complexObj, ['nested', 'optional'] as const)
+  const omitted = objPolicyFilter(`deny`, complexObj, [`nested`, `optional`] as const)
   Ts.assertEqual<{ array: string[]; readonly ro: string }>()(omitted)
 
-  const filtered = objFilter(complexObj, (key) => key !== 'array')
+  const filtered = objFilter(complexObj, (key) => key !== `array`)
   Ts.assertEqual<Partial<ComplexObj>>()(filtered)
 }
 
 // Test 9: Keys parameter type inference
 {
   // With const assertion
-  const keys1 = ['a', 'c'] as const
-  const result1 = objPolicyFilter('allow', testObj, keys1)
+  const keys1 = [`a`, `c`] as const
+  const result1 = objPolicyFilter(`allow`, testObj, keys1)
   Ts.assertEqual<{ a: string; c: boolean }>()(result1)
 
   // Without const assertion (wider type)
-  const keys2: (keyof TestObj)[] = ['a', 'c']
-  const result2 = objPolicyFilter('allow', testObj, keys2)
+  const keys2: (keyof TestObj)[] = [`a`, `c`]
+  const result2 = objPolicyFilter(`allow`, testObj, keys2)
   // Result is a union of all possible picks
   type Result2 = typeof result2 // Pick<TestObj, keyof TestObj>
 }

package/src/lib/kit-temp.test.ts

@@ -74,8 +74,13 @@ describe('property-based tests', () => {
             expect(inAllowed).toBe(!inDenied)
           })
 
-          // Combined they reconstruct the original object
-          expect({ ...allowed, ...denied }).toEqual(obj)
+          // Combined they reconstruct the original object (only own properties)
+          const reconstructed = { ...allowed, ...denied }
+          const ownPropsObj = Object.keys(obj).reduce<any>((acc, key) => {
+            acc[key] = obj[key]
+            return acc
+          }, {})
+          expect(reconstructed).toEqual(ownPropsObj)
         },
       ),
     )
@@ -87,7 +92,14 @@ describe('property-based tests', () => {
         fc.object(),
         (obj) => {
           const filtered = objFilter(obj, () => true)
-          expect(filtered).toEqual(obj)
+
+          // Object.keys doesn't include __proto__, so we need to handle it specially
+          const objWithoutProto = Object.keys(obj).reduce<any>((acc, key) => {
+            acc[key] = obj[key]
+            return acc
+          }, {})
+
+          expect(filtered).toEqual(objWithoutProto)
 
           // Values are the same reference
           Object.keys(filtered).forEach(key => {