sommark 5.0.5 → 5.1.0

package/async-hooks.js

@@ -0,0 +1,19 @@
+export class AsyncLocalStorage {
+  #store = undefined;
+  run(store, fn) {
+    const prev = this.#store;
+    this.#store = store;
+    try { return fn(); }
+    finally { this.#store = prev; }
+  }
+  getStore() { return this.#store; }
+  exit(fn) { return fn(); }
+  enterWith(store) { this.#store = store; }
+  disable() {}
+}
+
+export class AsyncResource {
+  static bind(fn) { return fn; }
+  bind(fn) { return fn; }
+  runInAsyncScope(fn) { return fn(); }
+}

package/core/evaluator.js

@@ -1,18 +1,22 @@
-import { AsyncLocalStorage } from "node:async_hooks";
 import { getQuickJS } from "quickjs-emscripten";
 import path from "pathe";
 import * as acorn from "acorn";
 import SomMark, { registerHostCompile, registerHostSettings } from "./helpers/lib.js";
 import { formatMessage } from "./errors.js";
 
-// Each transpile() call gets its own isolated EvaluatorState stack via async context.
-const evaluatorStorage = new AsyncLocalStorage();
+// Set by index.js (Node.js) or index.browser.js (shim) — never imported directly.
+let evaluatorStorage = null;
+
+export function setDefaultAsyncLocalStorage(cls) {
+    evaluatorStorage = cls ? new cls() : null;
+}
 
 /**
  * Runs fn inside an isolated evaluator context.
  * Concurrent transpile() calls each get their own stack — no cross-contamination.
  */
 export function withEvaluator(fn) {
+    if (!evaluatorStorage) return fn();
     return evaluatorStorage.run([], fn);
 }
 
@@ -170,6 +174,7 @@ const customCompileAdapter = async (src, options, parentSecurity = {}) => {
 registerHostCompile(customCompileAdapter);
 
 let defaultFs = null;
+let defaultEnv = null;
 let quickJSInstance = null;
 async function getQuickJSModule() {
     if (!quickJSInstance) {
@@ -193,6 +198,16 @@ function objectToHandle(context, obj) {
     return result.unwrap();
 }
 
+function isPlainData(value, seen = new Set()) {
+    if (value === null || value === undefined) return true;
+    if (typeof value === "function") return false;
+    if (typeof value !== "object") return true;
+    if (seen.has(value)) return false;
+    seen.add(value);
+    if (Array.isArray(value)) return value.every(v => isPlainData(v, seen));
+    return Object.values(value).every(v => isPlainData(v, seen));
+}
+
 function expose(context, vars, pendingDeferreds) {
     for (const [key, value] of Object.entries(vars)) {
         let handle;
@@ -313,6 +328,18 @@ class EvaluatorState {
         });
 
         this.expose({
+            __hostEnv: (key) => {
+                if (defaultEnv === null) {
+                    throw new Error(
+                        "[SomMark] SomMark.env() is not available in browser mode.\n" +
+                        "Environment variables are a server-side concept.\n" +
+                        "Read env values at build time and pass them as placeholders instead."
+                    );
+                }
+                const allowlist = this.security?.env;
+                if (!Array.isArray(allowlist) || !allowlist.includes(key)) return undefined;
+                return defaultEnv[key] ?? undefined;
+            },
             __hostSomMarkVersion: SomMark.version,
             __hostSomMarkSettings: () => {
                 const clean = { ...SomMark.settings };
@@ -524,6 +551,12 @@ class EvaluatorState {
                         throw new Error("SomMark.static Error: Argument must be a string.");
                     }
                     return globalThis.eval(expr);
+                },
+                env: (key) => {
+                    if (typeof key !== "string" || !key) {
+                        throw new Error("SomMark.env Error: Key must be a non-empty string.");
+                    }
+                    return __hostEnv(key);
                 }
             };
 
@@ -546,15 +579,20 @@ class EvaluatorState {
         }
         setupRes.value.dispose();
 
-        // Configure module loader using virtual FS implementation
+        // Configure module loader using virtual FS implementation.
+        // The normalizer resolves every import to an absolute path so the module
+        // cache key is always absolute — <smark> (the eval module name) can never
+        // be reached by any user import regardless of what the file is named.
         this.runtime.setModuleLoader((moduleName) => {
             try {
                 const isRaw = moduleName.endsWith("?raw");
                 const cleanModuleName = isRaw ? moduleName.slice(0, -4) : moduleName;
-                const resolvedPath = /^https?:\/\//.test(this.baseDir)
-                    ? new URL(cleanModuleName, this.baseDir.endsWith("/") ? this.baseDir : this.baseDir + "/").href
+                // moduleName is already an absolute path (supplied by the normalizer below),
+                // so resolve() is a no-op for absolute paths and a safe fallback for URLs.
+                const resolvedPath = /^https?:\/\//.test(cleanModuleName)
+                    ? cleanModuleName
                     : path.resolve(this.baseDir, cleanModuleName);
-                
+
                 const fsImpl = this.settings?.fs || this.settings?.instance?.fs || this.nodeFs;
                 if (!fsImpl) {
                     throw new Error("No filesystem implementation available.");
@@ -587,6 +625,22 @@ class EvaluatorState {
             } catch (err) {
                 throw err;
             }
+        }, (baseName, moduleName) => {
+            // Resolve every import to an absolute path so no user import can ever
+            // normalize to <smark> (or any other virtual eval module name).
+            const isRaw = moduleName.endsWith("?raw");
+            const clean = isRaw ? moduleName.slice(0, -4) : moduleName;
+            if (/^https?:\/\//.test(clean)) return moduleName;
+            const baseDir = (baseName === "<smark>" || !path.isAbsolute(baseName))
+                ? this.baseDir
+                : (/^https?:\/\//.test(baseName) ? baseName : path.dirname(baseName));
+            let resolved;
+            if (/^https?:\/\//.test(baseDir)) {
+                resolved = new URL(clean, baseDir).href;
+            } else {
+                resolved = path.resolve(baseDir, clean);
+            }
+            return isRaw ? resolved + "?raw" : resolved;
         });
     }
 
@@ -737,9 +791,17 @@ class EvaluatorState {
 
     inject(vars) {
         if (!this.context) return;
+        const safe = {};
+        for (const [key, value] of Object.entries(vars)) {
+            if (!isPlainData(value)) {
+                console.warn(`[SomMark] Security: "${key}" contains functions and was blocked. Only plain data can be injected. Use SomMark built-ins for host capabilities.`);
+                continue;
+            }
+            safe[key] = value;
+        }
         const currentScope = this.scopes[this.scopes.length - 1];
-        Object.assign(currentScope, vars);
-        this.expose(vars);
+        Object.assign(currentScope, safe);
+        this.expose(safe);
     }
 
     async execute(code, baseDir = null) {
@@ -823,7 +885,7 @@ class EvaluatorState {
 
             let result;
             if (isModule) {
-                const evalRes = this.context.evalCode(finalCode, "main.js", { type: 'module' });
+                const evalRes = this.context.evalCode(finalCode, "<smark>", { type: 'module' });
                 if (evalRes.error) {
                     const err = this.context.dump(evalRes.error);
                     evalRes.error.dispose();
@@ -892,7 +954,7 @@ class EvaluatorState {
                 }
 
                 const defaultValue = this.context.dump(resolvedDefaultHandle);
-                
+
                 if (isPromise) {
                     resolvedDefaultHandle.dispose();
                 }
@@ -932,7 +994,7 @@ class EvaluatorState {
                     result = res;
                 }
             } else {
-                const evalRes = this.context.evalCode(code, "main.js");
+                const evalRes = this.context.evalCode(code, "<smark>");
                 if (evalRes.error) {
                     const err = this.context.dump(evalRes.error);
                     evalRes.error.dispose();
@@ -968,7 +1030,7 @@ class EvaluatorState {
             return result;
         } catch (error) {
             const stack = error.stack || "";
-            const match = stack.match(/main\.js:(\d+):(\d+)/) || stack.match(/:(\d+):(\d+)/);
+            const match = stack.match(/__smark__\.js:(\d+):(\d+)/) || stack.match(/:(\d+):(\d+)/);
 
             const err = new Error(error.message || error);
             if (match) {
@@ -1031,6 +1093,14 @@ class Evaluator {
         defaultFs = fs;
     }
 
+    setDefaultEnv(env) {
+        defaultEnv = env;
+    }
+
+    setDefaultAsyncLocalStorage(cls) {
+        setDefaultAsyncLocalStorage(cls);
+    }
+
     get active() {
         const stack = this._getStack();
         if (stack.length === 0) {

package/core/helpers/config-loader.js

@@ -52,19 +52,24 @@ export async function findAndLoadConfig(targetPath) {
 		}
 	}
 
-	// 2. Check the Target Directory (Highest Priority)
+	// 2. Walk up from startDir looking for the config file
 	if (!configPath) {
-		const targetConfig = path.join(startDir, CONFIG_FILE_NAME);
-		try {
-			await fs.access(targetConfig);
-			configPath = targetConfig;
-		} catch {
-			// No config found in target dir
+		let dir = startDir;
+		const root = path.parse(dir).root;
+		while (dir !== root) {
+			const candidate = path.join(dir, CONFIG_FILE_NAME);
+			try {
+				await fs.access(candidate);
+				configPath = candidate;
+				break;
+			} catch {
+				dir = path.dirname(dir);
+			}
 		}
 	}
 
 	// 3. Check the Current Working Directory (Fallback)
-	// We only check CWD if it's different from the Target Directory
+	// We only check CWD if it's different from the Target Directory and walk didn't find anything
 	if (!configPath && startDir !== cwd) {
 		const cwdConfig = path.join(cwd, CONFIG_FILE_NAME);
 		try {
@@ -102,10 +107,25 @@ export async function findAndLoadConfig(targetPath) {
 				mapperFile: finalMapper,
 				resolvedConfigPath: configPath
 			};
+
+			const configDir = path.dirname(configPath);
+
 			if (loadedConfig.outputDir) {
-				const configDir = path.dirname(configPath);
 				finalConfig.outputDir = path.resolve(configDir, loadedConfig.outputDir);
 			}
+
+			// Resolve relative alias paths against the config file's directory so that
+			// "./node_modules/..." in a nested config resolves correctly regardless of cwd
+			if (loadedConfig.importAliases) {
+				const resolved = {};
+				for (const [key, val] of Object.entries(loadedConfig.importAliases)) {
+					resolved[key] = (val.startsWith("./") || val.startsWith("../"))
+						? path.resolve(configDir, val)
+						: val;
+				}
+				finalConfig.importAliases = resolved;
+			}
+
 			return finalConfig;
 		}
 	}

package/core/helpers/lib.js

@@ -18,7 +18,7 @@ export function registerHostSettings(settings) {
     hostSettings = settings || {};
 }
 
-const version = "5.0.5";
+const version = "5.1.0";
 
 const SomMark = {
     version,

package/core/helpers/preprocessor.js

@@ -140,8 +140,27 @@ export async function preprocessRuntimeLogic(code, filename = null, security = {
 				if (filename && filename !== "anonymous") {
 					baseDir = path.dirname(path.resolve(filename));
 				}
+
+				// Block absolute paths — path.resolve would ignore baseDir entirely
+				if (path.isAbsolute(argValue)) {
+					transpilerError([
+						`<$red:Security Error:$> Absolute import paths are not allowed: <$magenta:${argValue}$>{line}`,
+						`<$yellow:Use a path relative to the template file, e.g.$> <$green:SomMark.import("./data.json")$> <$yellow:or$> <$green:SomMark.import("../shared/data.json")$><$yellow:.$>{line}`,
+						`<$yellow:Base directory:$> <$blue:${baseDir}$>{line}`
+					]);
+				}
+
 				const resolvedPath = path.resolve(baseDir, argValue);
 
+				// Block path traversal — resolved path must stay inside baseDir
+				const safeBases = baseDir.endsWith(path.sep) ? baseDir : baseDir + path.sep;
+				if (!resolvedPath.startsWith(safeBases) && resolvedPath !== baseDir) {
+					transpilerError([
+						`<$red:Security Error:$> Import path escapes the project directory: <$magenta:${argValue}$>{line}`,
+						`<$yellow:Resolved Path:$> <$blue:${resolvedPath}$>{line}`
+					]);
+				}
+
 				const fsImpl = instance?.fs || await getNodeFs();
 
 				// File presence validation

package/core/modules.js

@@ -192,34 +192,48 @@ export async function resolveModules(ast, context) {
 	const baseDir = context.instance.baseDir || ((filename === "anonymous") ? absFilename : path.dirname(absFilename));
 
 	// 1. Helper: Trim AST to remove file-boundary whitespace and "ghost" newlines
-	const trimAst = (nodes) => {
+	const trimAst = (nodes, trimBoundaries = true) => {
 		if (!nodes) return [];
 
-		// 1. Filter out internal whitespace-only nodes that are adjacent to non-rendering nodes
-		// (Comments, Imports, etc. shouldn't leave "ghost" newlines)
+		// 1. Filter out whitespace-only text nodes adjacent (directly or through other whitespace)
+		// to non-rendering nodes (Comments, Imports, USE_MODULE).
 		const nonRenderingTypes = [COMMENT, IMPORT, USE_MODULE];
 		let res = nodes.filter((node, idx) => {
 			if (node.type !== TEXT || node.text.trim() !== "") return true;
 
-			const prev = nodes[idx - 1];
-			const next = nodes[idx + 1];
-			const isAdjacentToNonRendering =
-				(prev && nonRenderingTypes.includes(prev.type)) ||
-				(next && nonRenderingTypes.includes(next.type));
+			// Walk backwards through consecutive whitespace nodes to find prev non-whitespace
+			let prevIsNonRendering = false;
+			for (let j = idx - 1; j >= 0; j--) {
+				if (nodes[j].type === TEXT && nodes[j].text.trim() === "") continue;
+				prevIsNonRendering = nonRenderingTypes.includes(nodes[j].type);
+				break;
+			}
+
+			// Walk forwards through consecutive whitespace nodes to find next non-whitespace
+			let nextIsNonRendering = false;
+			for (let j = idx + 1; j < nodes.length; j++) {
+				if (nodes[j].type === TEXT && nodes[j].text.trim() === "") continue;
+				nextIsNonRendering = nonRenderingTypes.includes(nodes[j].type);
+				break;
+			}
 
-			return !isAdjacentToNonRendering;
+			return !(prevIsNonRendering || nextIsNonRendering);
 		});
 
-		// 2. Final pass: trim leading/trailing newlines from the remaining boundary text nodes
-		if (res.length > 0 && res[0].type === TEXT) {
-			res[0].text = res[0].text.replace(/^[\r\n]+/, "");
-		}
-		if (res.length > 0 && res[res.length - 1].type === TEXT) {
-			res[res.length - 1].text = res[res.length - 1].text.replace(/[\r\n]+\s*$/, "");
+		if (trimBoundaries) {
+			// 2. Final pass: trim leading/trailing newlines from the remaining boundary text nodes
+			if (res.length > 0 && res[0].type === TEXT) {
+				res[0].text = res[0].text.replace(/^[\r\n]+/, "");
+			}
+			if (res.length > 0 && res[res.length - 1].type === TEXT) {
+				res[res.length - 1].text = res[res.length - 1].text.replace(/[\r\n]+\s*$/, "");
+			}
+
+			// 3. Remove any nodes that became purely empty after trimming
+			res = res.filter(node => node.type !== TEXT || node.text !== "");
 		}
 
-		// 3. Remove any nodes that became purely empty after trimming
-		return res.filter(node => node.type !== TEXT || node.text !== "");
+		return res;
 	};
 
 	// 2. Helper: Inject Slots with Indentation Propagation
@@ -290,6 +304,10 @@ export async function resolveModules(ast, context) {
 				// 1b. Resolve relative to current base (FS)
 				const absolutePath = resolveModulePath(resolvedPath, currentBaseDir);
 
+				if (!context.instance.fs) {
+					runtimeError([`<$red:Module Error:$> Cannot import <$magenta:${filePath}$> — no filesystem is available.{N}In browser mode, pass a URL-based <$cyan:baseDir$> or a <$cyan:files$> map to enable module loading.`]);
+				}
+
 				// Local Path Resolution with Auto-Extension
 				let localPath = absolutePath;
 				if (!await context.instance.fs.exists(localPath) && !localPath.endsWith(".smark")) {
@@ -441,7 +459,6 @@ export async function resolveModules(ast, context) {
 						Object.entries(node.props).filter(([key]) => {
 							if (key === "__consumed__") return false;
 							if (consumed.has(key)) return false; // THE FIX: Filter if hit by v{}
-							if (key === "smark-raw") return false; // directive — must not leak onto root element
 							return true;
 						})
 					);

package/core/parser.js

@@ -96,6 +96,7 @@ function makeBlockNode() {
 		structure: "Block",
 		id: "",
 		props: {},
+		directives: {},
 		body: [],
 		depth: 0,
 		range: {
@@ -633,9 +634,11 @@ function parseBlock(tokens, i, filename = null, placeholders = {}, variables = {
 			i = valueIndex;
 
 			// Store Argument
-			blockNode.props[String(argIndex++)] = v;
-			if (k) {
-				blockNode.props[k] = v;
+			if (k && k.startsWith("smark-")) {
+				blockNode.directives[k.slice(6)] = v; // strip "smark-" prefix
+			} else {
+				blockNode.props[String(argIndex++)] = v;
+				if (k) blockNode.props[k] = v;
 			}
 			k = "";
 			v = "";

package/core/transpiler.js

@@ -31,6 +31,7 @@ const randomBytesHex = (size) => {
 
 const BODY_PLACEHOLDER = `SOMMARKBODYPLACEHOLDER${randomBytesHex(8)}SOMMARK`;
 
+
 /** 
  * Extracts all plain text from a node and its children.
  * 
@@ -129,6 +130,17 @@ async function generateOutput(ast, i, format, mapper_file, security = {}, parent
 
 	if (node.type === FOR_EACH) {
 		const transpiledArgs = await transpileArgs(node.props);
+
+		if (!node.props || (node.props[0] === undefined && node.props["items"] === undefined)) {
+			const line = node.range?.start?.line + 1 || 1;
+			transpilerError([
+				`<$red:Missing Prop Error in [for-each]:$>{line}`,
+				`[for-each] requires an array as its first prop, e.g. [for-each = \${ array }\$]{line}`,
+				`at line <$yellow:${line}$>{line}`
+			]);
+			return "";
+		}
+
 		const items = mapper_file ? mapper_file.safeArg({ props: transpiledArgs, index: 0, key: "items", fallBack: [] }) : [];
 
 		if (!Array.isArray(items)) {
@@ -142,11 +154,11 @@ async function generateOutput(ast, i, format, mapper_file, security = {}, parent
 		}
 
 		const asVar = transpiledArgs.as || "value";
-		if (asVar === "i") {
+		if (asVar === "i" || asVar === "length") {
 			const line = node.range?.start?.line + 1 || 1;
 			transpilerError([
 				`<$red:Reserved Variable Error in [for-each]:$>{line}`,
-				`'i' is a reserved variable name for the loop index.{N}Use a different name for the 'as' prop, e.g. as: "item"{line}`,
+				`'${asVar}' is a reserved variable name.{N}Use a different name for the 'as' prop, e.g. as: "item"{line}`,
 				`at line <$yellow:${line}$>{line}`
 			]);
 			return "";
@@ -176,22 +188,28 @@ async function generateOutput(ast, i, format, mapper_file, security = {}, parent
 			}
 		}
 
-		let output = "";
+		const rawJoin = transpiledArgs.join ?? null;
+		const join = rawJoin !== null ? rawJoin.replace(/\\n/g, "\n").replace(/\\t/g, "\t").replace(/\\r/g, "\r") : null;
+		const parts = [];
 		let idx = 0;
+		const length = items.length;
 		for (const item of items) {
 			evaluator.pushScope();
 			evaluator.inject({
 				[asVar]: item,
-				i: idx++
+				i: idx++,
+				length
 			});
 
+			let iterOutput = "";
 			for (let j = 0; j < cleanedBody.length; j++) {
-				output += await generateOutput(cleanedBody, j, format, mapper_file, security, parentId, generateRuntimeOutput, hideRuntimeOutput, instance, idState, extraCtx);
+				iterOutput += await generateOutput(cleanedBody, j, format, mapper_file, security, parentId, generateRuntimeOutput, hideRuntimeOutput, instance, idState, extraCtx);
 			}
 
 			await evaluator.popScope();
+			parts.push(iterOutput);
 		}
-		return output;
+		return join !== null ? parts.join(join) : parts.join("");
 	}
 
 	let secretId = null;
@@ -219,13 +237,12 @@ async function generateOutput(ast, i, format, mapper_file, security = {}, parent
 	}
 
 	// smark-raw block — body collected verbatim by lexer, bypasses normal body processing pipeline
-	if (node.type === BLOCK && (node.props?.["smark-raw"] === "true" || node.props?.["smark-raw"] === true)) {
+	if (node.type === BLOCK && (node.directives?.raw === "true" || node.directives?.raw === true)) {
 		if (generateRuntimeOutput) return "";
 		const rawContent = node.body?.map(n => String(n.text || "")).join("") || "";
-		const { "smark-raw": _, ...cleanArgs } = node.props;
-		const transpiledArgs = await transpileArgs(cleanArgs);
+		const transpiledArgs = await transpileArgs(node.props);
 		if (evaluator.active?.hasDynamicTag?.(node.id)) {
-			return await evaluator.active.executeDynamicTag(node.id, { props: transpiledArgs, content: rawContent, textContent: rawContent });
+			return await evaluator.active.executeDynamicTag(node.id, { props: transpiledArgs, directives: node.directives, content: rawContent, textContent: rawContent });
 		}
 		let rawTarget = mapper_file ? matchedValue(mapper_file.outputs, node.id) : null;
 		if (!rawTarget && mapper_file) rawTarget = mapper_file.getUnknownTag(node);
@@ -233,6 +250,7 @@ async function generateOutput(ast, i, format, mapper_file, security = {}, parent
 			const isManualMode = !!rawTarget.options?.handleAst;
 			return await rawTarget.render.call(mapper_file, {
 				props: transpiledArgs,
+				directives: node.directives,
 				content: rawContent,
 				textContent: rawContent,
 				ast: isManualMode ? node : undefined,
@@ -344,6 +362,7 @@ async function generateOutput(ast, i, format, mapper_file, security = {}, parent
 
 				return await target.render.call(mapper_file, {
 					props: transpiledArgs,
+					directives: node.directives,
 					content: "",
 					textContent: richText || textContent,
 					ast: cleanAst,
@@ -362,6 +381,7 @@ async function generateOutput(ast, i, format, mapper_file, security = {}, parent
 		}
 		result += await target.render.call(mapper_file, {
 			props: transpiledArgs,
+			directives: node.directives,
 			content,
 			textContent,
 			ast: new Proxy({}, {

package/core/validator.js

@@ -55,10 +55,7 @@ const runValidations = (node, target, instance) => {
 	const isStructural = node.type === "Block";
 	if (isStructural && rules.required_args && Array.isArray(rules.required_args)) {
 		const missingArgs = rules.required_args.filter(arg => {
-			// Check if the argument exists in named args or as a positional arg (if arg is a number)
-			if (typeof arg === "number") {
-				return node.props[arg] === undefined;
-			}
+			if (typeof arg === "number") return node.props[arg] === undefined;
 			return node.props[arg] === undefined;
 		});
 
@@ -73,6 +70,22 @@ const runValidations = (node, target, instance) => {
 			);
 		}
 	}
+
+	// -- Directives Validation (Required Directives) ----------------------- //
+	if (isStructural && rules.required_directives && Array.isArray(rules.required_directives)) {
+		const missingDirectives = rules.required_directives.filter(key => node.directives?.[key] === undefined);
+
+		if (missingDirectives.length > 0) {
+			transpilerError(
+				[
+					"{N}",
+					`<$yellow:Identifier$> <$blue:'${id}'$> <$yellow:is missing required directive props:$> <$red:${missingDirectives.map(k => `smark-${k}`).join(", ")}$>{N}`,
+					`<$blue:Please ensure these directive props are provided in the template usage.$>`
+				],
+				context
+			);
+		}
+	}
 };
 
 /**