Fix security vulnerabilities and request handling bugs
- Move page cache out of the publicly served .bunext/public dir and hash cache keys - Skip caching credentialed requests, non-2xx and Set-Cookie responses; cap entries - Enforce API body size limit while reading; keep req body readable for handlers - Hide error messages from clients in production - Escape inline script JSON; strip cookies from HMR payloads - Only trust X-Forwarded-Proto with trust_proxy config - Fix console race in SSR, dotted page paths, middleware rewrites, excluded path status, encoded static file names, symlinked dirs - Upgrade vulnerable deps, remove micromatch, pin bun versions, delete dead code Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
Claude Opus 5.5
@@ -15,7 +15,7 @@ jobs:
|
||||
|
||||
- uses: oven-sh/setup-bun@v2
|
||||
with:
|
||||
bun-version: latest
|
||||
bun-version: 1.3.14
|
||||
|
||||
- name: Install dependencies
|
||||
run: bun install --frozen-lockfile
|
||||
|
||||
@@ -5,34 +5,32 @@
|
||||
"": {
|
||||
"name": "bun-next",
|
||||
"dependencies": {
|
||||
"@tailwindcss/postcss": "^4.2.2",
|
||||
"@types/bun": "latest",
|
||||
"@tailwindcss/postcss": "^4.3.3",
|
||||
"@types/bun": "1.3.14",
|
||||
"@types/node": "^24.10.0",
|
||||
"@types/react": "^19.2.2",
|
||||
"@types/react-dom": "^19.2.2",
|
||||
"@types/react": "^19.3.0",
|
||||
"@types/react-dom": "^19.3.0",
|
||||
"bun-plugin-tailwind": "^0.1.2",
|
||||
"chalk": "^5.6.2",
|
||||
"chokidar": "^5.0.0",
|
||||
"commander": "^14.0.2",
|
||||
"esbuild": "^0.28.2",
|
||||
"lightningcss-wasm": "^1.32.0",
|
||||
"lodash": "^4.17.23",
|
||||
"micromatch": "^4.0.8",
|
||||
"lodash": "^4.18.1",
|
||||
"ora": "^9.0.0",
|
||||
"postcss": "^8.5.8",
|
||||
"react": "^19.2.4",
|
||||
"react-dom": "^19.2.4",
|
||||
"tailwindcss": "^4.2.2",
|
||||
"postcss": "^8.5.30",
|
||||
"react": "^19.3.0",
|
||||
"react-dom": "^19.3.0",
|
||||
"tailwindcss": "^4.3.3",
|
||||
"typescript": "^5.0.0",
|
||||
"uuid": "^14.0.2",
|
||||
},
|
||||
"devDependencies": {
|
||||
"@testing-library/dom": "^10.4.1",
|
||||
"@types/chokidar": "^2.1.7",
|
||||
"@types/lodash": "^4.17.24",
|
||||
"@types/micromatch": "^4.0.10",
|
||||
"@types/lodash": "^4.17.26",
|
||||
"@types/uuid": "^11.0.0",
|
||||
"happy-dom": "^20.8.4",
|
||||
"happy-dom": "^20.14.6",
|
||||
},
|
||||
},
|
||||
},
|
||||
@@ -131,55 +129,51 @@
|
||||
|
||||
"@oven/bun-windows-x64-baseline": ["@oven/[email protected]", "", { "os": "win32", "cpu": "x64" }, "sha512-gh3UAHbUdDUG6fhLc1Csa4IGdtghue6U8oAIXWnUqawp6lwb3gOCRvp25IUnLF5vUHtgfMxuEUYV7YA2WxVutw=="],
|
||||
|
||||
"@tailwindcss/node": ["@tailwindcss/node@4.2.2", "", { "dependencies": { "@jridgewell/remapping": "^2.3.5", "enhanced-resolve": "^5.19.0", "jiti": "^2.6.1", "lightningcss": "1.32.0", "magic-string": "^0.30.21", "source-map-js": "^1.2.1", "tailwindcss": "4.2.2" } }, "sha512-pXS+wJ2gZpVXqFaUEjojq7jzMpTGf8rU6ipJz5ovJV6PUGmlJ+jvIwGrzdHdQ80Sg+wmQxUFuoW1UAAwHNEdFA=="],
|
||||
"@tailwindcss/node": ["@tailwindcss/node@4.3.3", "", { "dependencies": { "@jridgewell/remapping": "^2.3.5", "enhanced-resolve": "^5.24.1", "jiti": "^2.7.0", "lightningcss": "1.32.0", "magic-string": "^0.30.21", "source-map-js": "^1.2.1", "tailwindcss": "4.3.3" } }, "sha512-/T8IKEsf9VTU6tLjgC7+sv2mOPtQxzE2jMw7u4Tt40Tx+QSZxpzh95/H6cMKoja9XuW7iMdLJYBB0o9G1CaAgg=="],
|
||||
|
||||
"@tailwindcss/oxide": ["@tailwindcss/oxide@4.2.2", "", { "optionalDependencies": { "@tailwindcss/oxide-android-arm64": "4.2.2", "@tailwindcss/oxide-darwin-arm64": "4.2.2", "@tailwindcss/oxide-darwin-x64": "4.2.2", "@tailwindcss/oxide-freebsd-x64": "4.2.2", "@tailwindcss/oxide-linux-arm-gnueabihf": "4.2.2", "@tailwindcss/oxide-linux-arm64-gnu": "4.2.2", "@tailwindcss/oxide-linux-arm64-musl": "4.2.2", "@tailwindcss/oxide-linux-x64-gnu": "4.2.2", "@tailwindcss/oxide-linux-x64-musl": "4.2.2", "@tailwindcss/oxide-wasm32-wasi": "4.2.2", "@tailwindcss/oxide-win32-arm64-msvc": "4.2.2", "@tailwindcss/oxide-win32-x64-msvc": "4.2.2" } }, "sha512-qEUA07+E5kehxYp9BVMpq9E8vnJuBHfJEC0vPC5e7iL/hw7HR61aDKoVoKzrG+QKp56vhNZe4qwkRmMC0zDLvg=="],
|
||||
"@tailwindcss/oxide": ["@tailwindcss/oxide@4.3.3", "", { "optionalDependencies": { "@tailwindcss/oxide-android-arm64": "4.3.3", "@tailwindcss/oxide-darwin-arm64": "4.3.3", "@tailwindcss/oxide-darwin-x64": "4.3.3", "@tailwindcss/oxide-freebsd-x64": "4.3.3", "@tailwindcss/oxide-linux-arm-gnueabihf": "4.3.3", "@tailwindcss/oxide-linux-arm64-gnu": "4.3.3", "@tailwindcss/oxide-linux-arm64-musl": "4.3.3", "@tailwindcss/oxide-linux-x64-gnu": "4.3.3", "@tailwindcss/oxide-linux-x64-musl": "4.3.3", "@tailwindcss/oxide-wasm32-wasi": "4.3.3", "@tailwindcss/oxide-win32-arm64-msvc": "4.3.3", "@tailwindcss/oxide-win32-x64-msvc": "4.3.3" } }, "sha512-krXjAikiaFSPaK/FkAQT5UTx3VormQaiZ5hBFlJZ9UFQGB/rwg1MZIhHAG9smMQRTdyJxP6Qt5MwMtdyU5FWrA=="],
|
||||
|
||||
"@tailwindcss/oxide-android-arm64": ["@tailwindcss/oxide-android-arm64@4.2.2", "", { "os": "android", "cpu": "arm64" }, "sha512-dXGR1n+P3B6748jZO/SvHZq7qBOqqzQ+yFrXpoOWWALWndF9MoSKAT3Q0fYgAzYzGhxNYOoysRvYlpixRBBoDg=="],
|
||||
"@tailwindcss/oxide-android-arm64": ["@tailwindcss/oxide-android-arm64@4.3.3", "", { "os": "android", "cpu": "arm64" }, "sha512-Y85A2gmPSkl5Ve5qR86GL4HT509cFqQh1aes9p3sSkyTPwt0Pppf3GkwGe4JPACcRYjgJIEhQgM6dBClnr0NYw=="],
|
||||
|
||||
"@tailwindcss/oxide-darwin-arm64": ["@tailwindcss/oxide-darwin-arm64@4.2.2", "", { "os": "darwin", "cpu": "arm64" }, "sha512-iq9Qjr6knfMpZHj55/37ouZeykwbDqF21gPFtfnhCCKGDcPI/21FKC9XdMO/XyBM7qKORx6UIhGgg6jLl7BZlg=="],
|
||||
"@tailwindcss/oxide-darwin-arm64": ["@tailwindcss/oxide-darwin-arm64@4.3.3", "", { "os": "darwin", "cpu": "arm64" }, "sha512-BiaWatpBcERQFDlOjRDpIVXuFK5PJez5SA4JMg6VYZdBYU+qKfV/vqjcIs+IYmtitf1xYQZTwXvU/8y4lfZUGw=="],
|
||||
|
||||
"@tailwindcss/oxide-darwin-x64": ["@tailwindcss/oxide-darwin-x64@4.2.2", "", { "os": "darwin", "cpu": "x64" }, "sha512-BlR+2c3nzc8f2G639LpL89YY4bdcIdUmiOOkv2GQv4/4M0vJlpXEa0JXNHhCHU7VWOKWT/CjqHdTP8aUuDJkuw=="],
|
||||
"@tailwindcss/oxide-darwin-x64": ["@tailwindcss/oxide-darwin-x64@4.3.3", "", { "os": "darwin", "cpu": "x64" }, "sha512-fAeUqfV5ndhxRwai8cXGzdLvul9utWOmeTkv69unv4ZXixjn61Z+p9lCWdwOwA3TYboG3BwdVuN/RDjhBRl0mw=="],
|
||||
|
||||
"@tailwindcss/oxide-freebsd-x64": ["@tailwindcss/oxide-freebsd-x64@4.2.2", "", { "os": "freebsd", "cpu": "x64" }, "sha512-YUqUgrGMSu2CDO82hzlQ5qSb5xmx3RUrke/QgnoEx7KvmRJHQuZHZmZTLSuuHwFf0DJPybFMXMYf+WJdxHy/nQ=="],
|
||||
"@tailwindcss/oxide-freebsd-x64": ["@tailwindcss/oxide-freebsd-x64@4.3.3", "", { "os": "freebsd", "cpu": "x64" }, "sha512-iyf5bV6+wnAlflVeEy7R25dupxTNECZN5QMI0qNT6eT+EgaGdZcKhGkr5SdoaWiLJ3spLqIY9VCeSGrwmtg4kw=="],
|
||||
|
||||
"@tailwindcss/oxide-linux-arm-gnueabihf": ["@tailwindcss/oxide-linux-arm-gnueabihf@4.2.2", "", { "os": "linux", "cpu": "arm" }, "sha512-FPdhvsW6g06T9BWT0qTwiVZYE2WIFo2dY5aCSpjG/S/u1tby+wXoslXS0kl3/KXnULlLr1E3NPRRw0g7t2kgaQ=="],
|
||||
"@tailwindcss/oxide-linux-arm-gnueabihf": ["@tailwindcss/oxide-linux-arm-gnueabihf@4.3.3", "", { "os": "linux", "cpu": "arm" }, "sha512-aAYUprJAJQWWbRrPvtjdroZ56Md+JM8pMiopS6xGEwDfLhqj+2ver2p4nU4Mb3CRqcMmNBjo8KkUgcxhkzVQGQ=="],
|
||||
|
||||
"@tailwindcss/oxide-linux-arm64-gnu": ["@tailwindcss/oxide-linux-arm64-gnu@4.2.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-4og1V+ftEPXGttOO7eCmW7VICmzzJWgMx+QXAJRAhjrSjumCwWqMfkDrNu1LXEQzNAwz28NCUpucgQPrR4S2yw=="],
|
||||
"@tailwindcss/oxide-linux-arm64-gnu": ["@tailwindcss/oxide-linux-arm64-gnu@4.3.3", "", { "os": "linux", "cpu": "arm64" }, "sha512-nDxldcEENOxZRzC2uu9jrutZdAAQtb+8WWDCSnWL1zvBk1+FN+x6MtDViPB5AJMfttVCUhehGWus3XBPgatM/w=="],
|
||||
|
||||
"@tailwindcss/oxide-linux-arm64-musl": ["@tailwindcss/oxide-linux-arm64-musl@4.2.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-oCfG/mS+/+XRlwNjnsNLVwnMWYH7tn/kYPsNPh+JSOMlnt93mYNCKHYzylRhI51X+TbR+ufNhhKKzm6QkqX8ag=="],
|
||||
"@tailwindcss/oxide-linux-arm64-musl": ["@tailwindcss/oxide-linux-arm64-musl@4.3.3", "", { "os": "linux", "cpu": "arm64" }, "sha512-Md44bD6veX/PC5iyF8cDVnw4HBIANZepRZZ7a8DQOvkfo5WUBwcp6iAuCUz23u+4SUkhJlD3eL7hNdW8ezd/kA=="],
|
||||
|
||||
"@tailwindcss/oxide-linux-x64-gnu": ["@tailwindcss/oxide-linux-x64-gnu@4.2.2", "", { "os": "linux", "cpu": "x64" }, "sha512-rTAGAkDgqbXHNp/xW0iugLVmX62wOp2PoE39BTCGKjv3Iocf6AFbRP/wZT/kuCxC9QBh9Pu8XPkv/zCZB2mcMg=="],
|
||||
"@tailwindcss/oxide-linux-x64-gnu": ["@tailwindcss/oxide-linux-x64-gnu@4.3.3", "", { "os": "linux", "cpu": "x64" }, "sha512-tx7us1muwOKAKWao2v/GaafFeQboE6aj88vC6ziN2NCGcRm8gWUhwjzg+YdVB1e4boAtdtma4L43onunI6NS4w=="],
|
||||
|
||||
"@tailwindcss/oxide-linux-x64-musl": ["@tailwindcss/oxide-linux-x64-musl@4.2.2", "", { "os": "linux", "cpu": "x64" }, "sha512-XW3t3qwbIwiSyRCggeO2zxe3KWaEbM0/kW9e8+0XpBgyKU4ATYzcVSMKteZJ1iukJ3HgHBjbg9P5YPRCVUxlnQ=="],
|
||||
"@tailwindcss/oxide-linux-x64-musl": ["@tailwindcss/oxide-linux-x64-musl@4.3.3", "", { "os": "linux", "cpu": "x64" }, "sha512-SJxX60smvHgasZoBy11dX6YRjXJFovwWBoedhbQPOBzgFWBHGB+TVPWB9BxzR7TTxU8FQZAI2AyiNCMzFm8Img=="],
|
||||
|
||||
"@tailwindcss/oxide-wasm32-wasi": ["@tailwindcss/oxide-wasm32-wasi@4.2.2", "", { "dependencies": { "@emnapi/core": "^1.8.1", "@emnapi/runtime": "^1.8.1", "@emnapi/wasi-threads": "^1.1.0", "@napi-rs/wasm-runtime": "^1.1.1", "@tybys/wasm-util": "^0.10.1", "tslib": "^2.8.1" }, "cpu": "none" }, "sha512-eKSztKsmEsn1O5lJ4ZAfyn41NfG7vzCg496YiGtMDV86jz1q/irhms5O0VrY6ZwTUkFy/EKG3RfWgxSI3VbZ8Q=="],
|
||||
"@tailwindcss/oxide-wasm32-wasi": ["@tailwindcss/oxide-wasm32-wasi@4.3.3", "", { "dependencies": { "@emnapi/core": "^1.11.1", "@emnapi/runtime": "^1.11.1", "@emnapi/wasi-threads": "^1.2.2", "@napi-rs/wasm-runtime": "^1.1.4", "@tybys/wasm-util": "^0.10.2", "tslib": "^2.8.1" }, "cpu": "none" }, "sha512-jx1+rPhY/5Ympkktd656HBWEBLxP7dH06losBLjjf5vgCODXvi9KhtftWcMIwTFIDqBr7cRnQkdLnAG+IOlGvQ=="],
|
||||
|
||||
"@tailwindcss/oxide-win32-arm64-msvc": ["@tailwindcss/oxide-win32-arm64-msvc@4.2.2", "", { "os": "win32", "cpu": "arm64" }, "sha512-qPmaQM4iKu5mxpsrWZMOZRgZv1tOZpUm+zdhhQP0VhJfyGGO3aUKdbh3gDZc/dPLQwW4eSqWGrrcWNBZWUWaXQ=="],
|
||||
"@tailwindcss/oxide-win32-arm64-msvc": ["@tailwindcss/oxide-win32-arm64-msvc@4.3.3", "", { "os": "win32", "cpu": "arm64" }, "sha512-3rc292Ca2ceK6Ulcc/bAVnTs/3nDtoPhyEKlgPv+yQJQi/JS/AMJlqzxvlDacL1nekbrcf6bTqp/jV4qgnPxNQ=="],
|
||||
|
||||
"@tailwindcss/oxide-win32-x64-msvc": ["@tailwindcss/oxide-win32-x64-msvc@4.2.2", "", { "os": "win32", "cpu": "x64" }, "sha512-1T/37VvI7WyH66b+vqHj/cLwnCxt7Qt3WFu5Q8hk65aOvlwAhs7rAp1VkulBJw/N4tMirXjVnylTR72uI0HGcA=="],
|
||||
"@tailwindcss/oxide-win32-x64-msvc": ["@tailwindcss/oxide-win32-x64-msvc@4.3.3", "", { "os": "win32", "cpu": "x64" }, "sha512-yJ0pwIVc/nYeGoV02WtsN8KYyLQv7kyI2wDnkezyJlGGjkd4QLwDGAwl47YpPJeuI0M0ObaXGSPjvWDPeTPggw=="],
|
||||
|
||||
"@tailwindcss/postcss": ["@tailwindcss/postcss@4.2.2", "", { "dependencies": { "@alloc/quick-lru": "^5.2.0", "@tailwindcss/node": "4.2.2", "@tailwindcss/oxide": "4.2.2", "postcss": "^8.5.6", "tailwindcss": "4.2.2" } }, "sha512-n4goKQbW8RVXIbNKRB/45LzyUqN451deQK0nzIeauVEqjlI49slUlgKYJM2QyUzap/PcpnS7kzSUmPb1sCRvYQ=="],
|
||||
"@tailwindcss/postcss": ["@tailwindcss/postcss@4.3.3", "", { "dependencies": { "@alloc/quick-lru": "^5.2.0", "@tailwindcss/node": "4.3.3", "@tailwindcss/oxide": "4.3.3", "postcss": "^8.5.16", "tailwindcss": "4.3.3" } }, "sha512-JTSZZGQi1AyKirbLN3azmjVzef92tcX7h+iSqPdaeStyFpGpDlKvvpxeOE8njhbUanbRwr3z8DyzhICWnMtQeg=="],
|
||||
|
||||
"@testing-library/dom": ["@testing-library/[email protected]", "", { "dependencies": { "@babel/code-frame": "^7.10.4", "@babel/runtime": "^7.12.5", "@types/aria-query": "^5.0.1", "aria-query": "5.3.0", "dom-accessibility-api": "^0.5.9", "lz-string": "^1.5.0", "picocolors": "1.1.1", "pretty-format": "^27.0.2" } }, "sha512-o4PXJQidqJl82ckFaXUeoAW+XysPLauYI43Abki5hABd853iMhitooc6znOnczgbTYmEP6U6/y1ZyKAIsvMKGg=="],
|
||||
|
||||
"@types/aria-query": ["@types/[email protected]", "", {}, "sha512-rfT93uj5s0PRL7EzccGMs3brplhcrghnDoV26NqKhCAS1hVo+WdNsPvE/yb6ilfr5hi2MEk6d5EWJTKdxg8jVw=="],
|
||||
|
||||
"@types/braces": ["@types/b[email protected]", "", {}, "sha512-SQFof9H+LXeWNz8wDe7oN5zu7ket0qwMu5vZubW4GCJ8Kkeh6nBWUz87+KTz/G3Kqsrp0j/W253XJb3KMEeg3w=="],
|
||||
|
||||
"@types/bun": ["@types/[email protected]", "", { "dependencies": { "bun-types": "1.3.11" } }, "sha512-5vPne5QvtpjGpsGYXiFyycfpDF2ECyPcTSsFBMa0fraoxiQyMJ3SmuQIGhzPg2WJuWxVBoxWJ2kClYTcw/4fAg=="],
|
||||
"@types/bun": ["@types/b[email protected]", "", { "dependencies": { "bun-types": "1.3.14" } }, "sha512-h1hFqFVcvAvD9j9K7ZW7vd82aSA+rTdznZa+5bwvCwqSB1jmmfLcbIWhOLx1/+boy/xmjgCs/OMUL8hRJSmnPw=="],
|
||||
|
||||
"@types/chokidar": ["@types/[email protected]", "", { "dependencies": { "chokidar": "*" } }, "sha512-A7/MFHf6KF7peCzjEC1BBTF8jpmZTokb3vr/A0NxRGfwRLK3Ws+Hq6ugVn6cJIMfM6wkCak/aplWrxbTcu8oig=="],
|
||||
|
||||
"@types/lodash": ["@types/[email protected]4", "", {}, "sha512-gIW7lQLZbue7lRSWEFql49QJJWThrTFFeIMJdp3eH4tKoxm1OvEPg02rm4wCCSHS0cL3/Fizimb35b7k8atwsQ=="],
|
||||
|
||||
"@types/micromatch": ["@types/[email protected]", "", { "dependencies": { "@types/braces": "*" } }, "sha512-5jOhFDElqr4DKTrTEbnW8DZ4Hz5LRUEmyrGpCMrD/NphYv3nUnaF08xmSLx1rGGnyEs/kFnhiw6dCgcDqMr5PQ=="],
|
||||
"@types/lodash": ["@types/[email protected]6", "", {}, "sha512-48NWfiY6oNcKOh47Z4h+sIvwcQR91h6KPhaYKgeMIrkT2jV82Gy90SErj60vW8jQbeMSOSbhIv3bZ7JoqPPVhA=="],
|
||||
|
||||
"@types/node": ["@types/[email protected]", "", { "dependencies": { "undici-types": "~7.16.0" } }, "sha512-qzQZRBqkFsYyaSWXuEHc2WR9c0a0CXwiE5FWUvn7ZM+vdy1uZLfCunD38UzhuB7YN/J11ndbDBcTmOdxJo9Q7A=="],
|
||||
|
||||
"@types/react": ["@types/react@19.2.14", "", { "dependencies": { "csstype": "^3.2.2" } }, "sha512-ilcTH/UniCkMdtexkoCN0bI7pMcJDvmQFPvuPvmEaYA/NSfFTAgdUSLAoVjaRJm7+6PvcM+q1zYOwS4wTYMF9w=="],
|
||||
"@types/react": ["@types/react@19.3.0", "", { "dependencies": { "csstype": "^3.2.2" } }, "sha512-N0rFCuH9YoxG9/m61l9MfpJKfmLOVU0em7ipIz6TRgSSkvReLB9vL85GB+yr8Bs5leqpvg96JSwF4ZS1s4viQg=="],
|
||||
|
||||
"@types/react-dom": ["@types/react-dom@19.2.3", "", { "peerDependencies": { "@types/react": "^19.2.0" } }, "sha512-jp2L/eY6fn+KgVVQAOqYItbF0VY/YApe5Mz2F0aykSO8gx31bYCZyvSeYxCHKvzHG5eZjc+zyaS5BrBWya2+kQ=="],
|
||||
"@types/react-dom": ["@types/react-dom@19.3.0", "", { "peerDependencies": { "@types/react": "^19.3.0" } }, "sha512-ZI7bU42mZXXKHn/qNLEw2IrbiINU7X5+vfgdixBHkCNpYWXjKgfQ/P+uyGb5CjOLB9UcnTeg3rylQtV2hym44Q=="],
|
||||
|
||||
"@types/uuid": ["@types/[email protected]", "", { "dependencies": { "uuid": "*" } }, "sha512-HVyk8nj2m+jcFRNazzqyVKiZezyhDKrGUA3jlEcg/nZ6Ms+qHwocba1Y/AaVaznJTAM9xpdFSh+ptbNrhOGvZA=="],
|
||||
|
||||
@@ -193,13 +187,13 @@
|
||||
|
||||
"aria-query": ["[email protected]", "", { "dependencies": { "dequal": "^2.0.3" } }, "sha512-b0P0sZPKtyu8HkeRAfCq0IfURZK+SuwMjY1UXGBU27wpAiTwQAIlq56IbIO+ytk/JjS1fMR14ee5WBBfKi5J6A=="],
|
||||
|
||||
"braces": ["[email protected]", "", { "dependencies": { "fill-range": "^7.1.1" } }, "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA=="],
|
||||
"buffer-image-size": ["[email protected]", "", { "dependencies": { "@types/node": "*" } }, "sha512-nEh+kZOPY1w+gcCMobZ6ETUp9WfibndnosbpwB1iJk/8Gt5ZF2bhS6+B6bPYz424KtwsR6Rflc3tCz1/ghX2dQ=="],
|
||||
|
||||
"bun": ["[email protected]", "", { "optionalDependencies": { "@oven/bun-darwin-aarch64": "1.3.10", "@oven/bun-darwin-x64": "1.3.10", "@oven/bun-darwin-x64-baseline": "1.3.10", "@oven/bun-linux-aarch64": "1.3.10", "@oven/bun-linux-aarch64-musl": "1.3.10", "@oven/bun-linux-x64": "1.3.10", "@oven/bun-linux-x64-baseline": "1.3.10", "@oven/bun-linux-x64-musl": "1.3.10", "@oven/bun-linux-x64-musl-baseline": "1.3.10", "@oven/bun-windows-aarch64": "1.3.10", "@oven/bun-windows-x64": "1.3.10", "@oven/bun-windows-x64-baseline": "1.3.10" }, "os": [ "linux", "win32", "darwin", ], "cpu": [ "x64", "arm64", ], "bin": { "bun": "bin/bun.exe", "bunx": "bin/bunx.exe" } }, "sha512-S/CXaXXIyA4CMjdMkYQ4T2YMqnAn4s0ysD3mlsY4bUiOCqGlv28zck4Wd4H4kpvbekx15S9mUeLQ7Uxd0tYTLA=="],
|
||||
|
||||
"bun-plugin-tailwind": ["[email protected]", "", { "peerDependencies": { "bun": ">=1.0.0" } }, "sha512-41jNC1tZRSK3s1o7pTNrLuQG8kL/0vR/JgiTmZAJ1eHwe0w5j6HFPKeqEk0WAD13jfrUC7+ULuewFBBCoADPpg=="],
|
||||
|
||||
"bun-types": ["[email protected]1", "", { "dependencies": { "@types/node": "*" } }, "sha512-1KGPpoxQWl9f6wcZh57LvrPIInQMn2TQ7jsgxqpRzg+l0QPOFvJVH7HmvHo/AiPgwXy+/Thf6Ov3EdVn1vOabg=="],
|
||||
"bun-types": ["[email protected]4", "", { "dependencies": { "@types/node": "*" } }, "sha512-4N0ig0fEomHt5R0KCFWjovxow98rIoRwKolrYdCcknNwMekCXRnWEUvgu5soYV8QXtVsrUD8B95MBOZGPvr6KQ=="],
|
||||
|
||||
"chalk": ["[email protected]", "", {}, "sha512-7NzBL0rN6fMUW+f7A6Io4h40qQlG+xGmtMxfbnH/K7TAtt8JQWVQK+6g0UXKMeVJoyV5EkkNsErQ8pVD3bLHbA=="],
|
||||
|
||||
@@ -219,27 +213,23 @@
|
||||
|
||||
"dom-accessibility-api": ["[email protected]", "", {}, "sha512-X7BJ2yElsnOJ30pZF4uIIDfBEVgF4XEBxL9Bxhy6dnrm5hkzqmsWHGTiHqRiITNhMyFLyAiWndIJP7Z1NTteDg=="],
|
||||
|
||||
"enhanced-resolve": ["[email protected]0.1", "", { "dependencies": { "graceful-fs": "^4.2.4", "tapable": "^2.3.0" } }, "sha512-Qohcme7V1inbAfvjItgw0EaxVX5q2rdVEZHRBrEQdRZTssLDGsL8Lwrznl8oQ/6kuTJONLaDcGjkNP247XEhcA=="],
|
||||
"enhanced-resolve": ["[email protected]6.0", "", { "dependencies": { "graceful-fs": "^4.2.4", "tapable": "^2.3.3" } }, "sha512-9vhedylFonb2YGogzUKX6+Ja72gOJbN1QHAqdrvqLwhdl/QWbKopzoUC9EbQNVsAns/bx/4uyqalrQAoy1IByw=="],
|
||||
|
||||
"entities": ["[email protected]", "", {}, "sha512-TWrgLOFUQTH994YUyl1yT4uyavY5nNB5muff+RtWaqNVCAK408b5ZnnbNAUEWLTCpum9w6arT70i1XdQ4UeOPA=="],
|
||||
|
||||
"esbuild": ["[email protected]", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.28.2", "@esbuild/android-arm": "0.28.2", "@esbuild/android-arm64": "0.28.2", "@esbuild/android-x64": "0.28.2", "@esbuild/darwin-arm64": "0.28.2", "@esbuild/darwin-x64": "0.28.2", "@esbuild/freebsd-arm64": "0.28.2", "@esbuild/freebsd-x64": "0.28.2", "@esbuild/linux-arm": "0.28.2", "@esbuild/linux-arm64": "0.28.2", "@esbuild/linux-ia32": "0.28.2", "@esbuild/linux-loong64": "0.28.2", "@esbuild/linux-mips64el": "0.28.2", "@esbuild/linux-ppc64": "0.28.2", "@esbuild/linux-riscv64": "0.28.2", "@esbuild/linux-s390x": "0.28.2", "@esbuild/linux-x64": "0.28.2", "@esbuild/netbsd-arm64": "0.28.2", "@esbuild/netbsd-x64": "0.28.2", "@esbuild/openbsd-arm64": "0.28.2", "@esbuild/openbsd-x64": "0.28.2", "@esbuild/openharmony-arm64": "0.28.2", "@esbuild/sunos-x64": "0.28.2", "@esbuild/win32-arm64": "0.28.2", "@esbuild/win32-ia32": "0.28.2", "@esbuild/win32-x64": "0.28.2" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-HKVLS8dvII+xoKW9kmqxbRKrnWEXfJJr/FZhhJmiqIB0e053QNYFqOBouTMO/k5sID4MvCiUCvv8b9M4h32wIA=="],
|
||||
|
||||
"fill-range": ["[email protected]", "", { "dependencies": { "to-regex-range": "^5.0.1" } }, "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg=="],
|
||||
|
||||
"get-east-asian-width": ["[email protected]", "", {}, "sha512-QZjmEOC+IT1uk6Rx0sX22V6uHWVwbdbxf1faPqJ1QhLdGgsRGCZoyaQBm/piRdJy/D2um6hM1UP7ZEeQ4EkP+Q=="],
|
||||
|
||||
"graceful-fs": ["[email protected]", "", {}, "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ=="],
|
||||
|
||||
"happy-dom": ["happy-dom@20.8.4", "", { "dependencies": { "@types/node": ">=20.0.0", "@types/whatwg-mimetype": "^3.0.2", "@types/ws": "^8.18.1", "entities": "^7.0.1", "whatwg-mimetype": "^3.0.0", "ws": "^8.18.3" } }, "sha512-GKhjq4OQCYB4VLFBzv8mmccUadwlAusOZOI7hC1D9xDIT5HhzkJK17c4el2f6R6C715P9xB4uiMxeKUa2nHMwQ=="],
|
||||
"happy-dom": ["happy-dom@20.14.6", "", { "dependencies": { "@types/node": ">=20.0.0", "@types/whatwg-mimetype": "^3.0.2", "@types/ws": "^8.18.1", "buffer-image-size": "^0.6.4", "entities": "^7.0.1", "whatwg-mimetype": "^3.0.0", "ws": "^8.21.0" } }, "sha512-5DDsf4QmEIlRL6NkCv/fxSjYHHkZceL/IaYQdJc2h3G7DRTEai++VTjbfL0LB9geW2VrA3+vrjF3Efx+OTtX0Q=="],
|
||||
|
||||
"is-interactive": ["[email protected]", "", {}, "sha512-qP1vozQRI+BMOPcjFzrjXuQvdak2pHNUMZoeG2eRbiSqyvbEf/wQtEOTOX1guk6E3t36RkaqiSt8A/6YElNxLQ=="],
|
||||
|
||||
"is-number": ["[email protected]", "", {}, "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng=="],
|
||||
|
||||
"is-unicode-supported": ["[email protected]", "", {}, "sha512-mE00Gnza5EEB3Ds0HfMyllZzbBrmLOX3vfWoj9A9PEnTfratQ/BcaJOuMhnkhjXvb2+FkY3VuHqtAGpTPmglFQ=="],
|
||||
|
||||
"jiti": ["jiti@2.6.1", "", { "bin": { "jiti": "lib/jiti-cli.mjs" } }, "sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ=="],
|
||||
"jiti": ["jiti@2.7.0", "", { "bin": { "jiti": "lib/jiti-cli.mjs" } }, "sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ=="],
|
||||
|
||||
"js-tokens": ["[email protected]", "", {}, "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="],
|
||||
|
||||
@@ -269,7 +259,7 @@
|
||||
|
||||
"lightningcss-win32-x64-msvc": ["[email protected]", "", { "os": "win32", "cpu": "x64" }, "sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q=="],
|
||||
|
||||
"lodash": ["[email protected]7.23", "", {}, "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w=="],
|
||||
"lodash": ["[email protected]8.1", "", {}, "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q=="],
|
||||
|
||||
"log-symbols": ["[email protected]", "", { "dependencies": { "is-unicode-supported": "^2.0.0", "yoctocolors": "^2.1.1" } }, "sha512-ja1E3yCr9i/0hmBVaM0bfwDjnGy8I/s6PP4DFp+yP+a+mrHO4Rm7DtmnqROTUkHIkqffC84YY7AeqX6oFk0WFg=="],
|
||||
|
||||
@@ -277,11 +267,9 @@
|
||||
|
||||
"magic-string": ["[email protected]", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.5.5" } }, "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ=="],
|
||||
|
||||
"micromatch": ["[email protected]", "", { "dependencies": { "braces": "^3.0.3", "picomatch": "^2.3.1" } }, "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA=="],
|
||||
|
||||
"mimic-function": ["[email protected]", "", {}, "sha512-VP79XUPxV2CigYP3jWwAUFSku2aKqBH7uTAapFWCBqutsbmDo96KY5o8uh6U+/YSIn5OxJnXp73beVkpqMIGhA=="],
|
||||
|
||||
"nanoid": ["[email protected].11", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w=="],
|
||||
"nanoid": ["[email protected].20", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-uKdg2G3GNCKQn9byYOpxbGqrT2fGO5KRt5J/8b3pok8rT6qxGWF6hxMyJiEYtAf+FVyYuD9hRaDqX5uPFYJ4ZQ=="],
|
||||
|
||||
"onetime": ["[email protected]", "", { "dependencies": { "mimic-function": "^5.0.0" } }, "sha512-VXJjc87FScF88uafS3JllDgvAm+c/Slfz06lorj2uAY34rlUu0Nt+v8wreiImcrgAjjIHp1rXpTDlLOGw29WwQ=="],
|
||||
|
||||
@@ -289,15 +277,13 @@
|
||||
|
||||
"picocolors": ["[email protected]", "", {}, "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA=="],
|
||||
|
||||
"picomatch": ["[email protected]", "", {}, "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA=="],
|
||||
|
||||
"postcss": ["[email protected]", "", { "dependencies": { "nanoid": "^3.3.11", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-OW/rX8O/jXnm82Ey1k44pObPtdblfiuWnrd8X7GJ7emImCOstunGbXUpp7HdBrFQX6rJzn3sPT397Wp5aCwCHg=="],
|
||||
"postcss": ["[email protected]", "", { "dependencies": { "nanoid": "^3.3.20", "picocolors": "^1.1.1", "source-map-js": "^1.2.2" } }, "sha512-zkd+e9S1AQHhmaBKye9zlFHWjOwVgqXl1q3ECYy8561K7qxR2cREf/STLskulBFd78k6AOFeA+ff1TtEzk9bAA=="],
|
||||
|
||||
"pretty-format": ["[email protected]", "", { "dependencies": { "ansi-regex": "^5.0.1", "ansi-styles": "^5.0.0", "react-is": "^17.0.1" } }, "sha512-Qb1gy5OrP5+zDf2Bvnzdl3jsTf1qXVMazbvCoKhtKqVs4/YK4ozX4gKQJJVyNe+cajNPn0KoC0MC3FUmaHWEmQ=="],
|
||||
|
||||
"react": ["react@19.2.4", "", {}, "sha512-9nfp2hYpCwOjAN+8TZFGhtWEwgvWHXqESH8qT89AT/lWklpLON22Lc8pEtnpsZz7VmawabSU0gCjnj8aC0euHQ=="],
|
||||
"react": ["react@19.3.0", "", {}, "sha512-E8LUcbtBWt20bbl2YoHfx4ZDBdxVTfOKtCZn9cDSJ4l6/nuoApcpIBcj47t2wZoVX8g2ZHuMHbiShgCR1T5Sog=="],
|
||||
|
||||
"react-dom": ["react-dom@19.2.4", "", { "dependencies": { "scheduler": "^0.27.0" }, "peerDependencies": { "react": "^19.2.4" } }, "sha512-AXJdLo8kgMbimY95O2aKQqsz2iWi9jMgKJhRBAxECE4IFxfcazB2LmzloIoibJI3C12IlY20+KFaLv+71bUJeQ=="],
|
||||
"react-dom": ["react-dom@19.3.0", "", { "dependencies": { "scheduler": "^0.28.0" }, "peerDependencies": { "react": "^19.3.0" } }, "sha512-JDk8dgif51OjFoDE70+OT9ICyYr+69HlmihNwp1+Nsfbna3t5sIiCa9ZJktDmQ4/1b/rn26hIAR2uYXDMr5r0Q=="],
|
||||
|
||||
"react-is": ["[email protected]", "", {}, "sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w=="],
|
||||
|
||||
@@ -305,11 +291,11 @@
|
||||
|
||||
"restore-cursor": ["[email protected]", "", { "dependencies": { "onetime": "^7.0.0", "signal-exit": "^4.1.0" } }, "sha512-oMA2dcrw6u0YfxJQXm342bFKX/E4sG9rbTzO9ptUcR/e8A33cHuvStiYOwH7fszkZlZ1z/ta9AAoPk2F4qIOHA=="],
|
||||
|
||||
"scheduler": ["[email protected]7.0", "", {}, "sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q=="],
|
||||
"scheduler": ["[email protected]8.0", "", {}, "sha512-juorfCmIkIw8tT+p5BXSm6PJjQF/ycEYmKyzURCIt/RaZIhL+PulbQ9Yu2z1HdOJDdqDTlxA1+xKBmHXJsczAw=="],
|
||||
|
||||
"signal-exit": ["[email protected]", "", {}, "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw=="],
|
||||
|
||||
"source-map-js": ["[email protected].1", "", {}, "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA=="],
|
||||
"source-map-js": ["[email protected].2", "", {}, "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw=="],
|
||||
|
||||
"stdin-discarder": ["[email protected]", "", {}, "sha512-UhDfHmA92YAlNnCfhmq0VeNL5bDbiZGg7sZ2IvPsXubGkiNa9EC+tUTsjBRsYUAz87btI6/1wf4XoVvQ3uRnmQ=="],
|
||||
|
||||
@@ -317,11 +303,9 @@
|
||||
|
||||
"strip-ansi": ["[email protected]", "", { "dependencies": { "ansi-regex": "^6.0.1" } }, "sha512-gmBGslpoQJtgnMAvOVqGZpEz9dyoKTCzy2nfz/n8aIFhN/jCE/rCmcxabB6jOOHV+0WNnylOxaxBQPSvcWklhA=="],
|
||||
|
||||
"tailwindcss": ["tailwindcss@4.2.2", "", {}, "sha512-KWBIxs1Xb6NoLdMVqhbhgwZf2PGBpPEiwOqgI4pFIYbNTfBXiKYyWoTsXgBQ9WFg/OlhnvHaY+AEpW7wSmFo2Q=="],
|
||||
"tailwindcss": ["tailwindcss@4.3.3", "", {}, "sha512-gOhV3P7ufE62QDGg1zVaTgCR+EtPv92k2nIhVcVKcLmxT1sUBsQGhnZj175j+MqRt4zLF7ic+sCYjfhxMxj7YQ=="],
|
||||
|
||||
"tapable": ["[email protected].0", "", {}, "sha512-g9ljZiwki/LfxmQADO3dEY1CbpmXT5Hm2fJ+QaGKwSXUylMybePR7/67YW7jOrrvjEgL1Fmz5kzyAjWVWLlucg=="],
|
||||
|
||||
"to-regex-range": ["[email protected]", "", { "dependencies": { "is-number": "^7.0.0" } }, "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ=="],
|
||||
"tapable": ["[email protected].3", "", {}, "sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A=="],
|
||||
|
||||
"typescript": ["[email protected]", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-84MVSjMEHP+FQRPy3pX9sTVV/INIex71s9TL2Gm5FG/WG1SqXeKyZ0k7/blY/4FdOzI12CBy1vGc4og/eus0fw=="],
|
||||
|
||||
@@ -331,19 +315,19 @@
|
||||
|
||||
"whatwg-mimetype": ["[email protected]", "", {}, "sha512-nt+N2dzIutVRxARx1nghPKGv1xHikU7HKdfafKkLNLindmPU/ch3U31NOCGGA/dmPcmb1VlofO0vnKAcsm0o/Q=="],
|
||||
|
||||
"ws": ["ws@8.19.0", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg=="],
|
||||
"ws": ["ws@8.22.0", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg=="],
|
||||
|
||||
"yoctocolors": ["[email protected]", "", {}, "sha512-CzhO+pFNo8ajLM2d2IW/R93ipy99LWjtwblvC1RsoSUMZgyLbYFr221TnSNT7GjGdYui6P459mw9JH/g/zW2ug=="],
|
||||
|
||||
"@tailwindcss/oxide-wasm32-wasi/@emnapi/core": ["@emnapi/core@1.9.1", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.0", "tslib": "^2.4.0" }, "bundled": true }, "sha512-mukuNALVsoix/w1BJwFzwXBN/dHeejQtuVzcDsfOEsdpCumXb/E9j8w11h5S54tT1xhifGfbbSm/ICrObRb3KA=="],
|
||||
"@tailwindcss/oxide-wasm32-wasi/@emnapi/core": ["@emnapi/core@1.11.3", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.3", "tslib": "^2.4.0" }, "bundled": true }, "sha512-zLpS5asjEb7lq8jYLq37N6XKaE41DIexlY1rF/z4/tIl3wo13Sqm28fRyfIsKZD+NZ8mM5RoKkpW/rBcuoSZSg=="],
|
||||
|
||||
"@tailwindcss/oxide-wasm32-wasi/@emnapi/runtime": ["@emnapi/runtime@1.9.1", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-VYi5+ZVLhpgK4hQ0TAjiQiZ6ol0oe4mBx7mVv7IflsiEp0OWoVsp/+f9Vc1hOhE0TtkORVrI1GvzyreqpgWtkA=="],
|
||||
"@tailwindcss/oxide-wasm32-wasi/@emnapi/runtime": ["@emnapi/runtime@1.11.3", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-Xz4Tpyki7XyrpbUK1jR1AhdAdaXyhhY4lZ3neLodmhpuWfy2PAQN5B46sAiU4liOXGLkHypn/qU+jvfWSCYYLA=="],
|
||||
|
||||
"@tailwindcss/oxide-wasm32-wasi/@emnapi/wasi-threads": ["@emnapi/[email protected].0", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-N10dEJNSsUx41Z6pZsXU8FjPjpBEplgH24sfkmITrBED1/U2Esum9F3lfLrMjKHHjmi557zQn7kR9R+XWXu5Rg=="],
|
||||
"@tailwindcss/oxide-wasm32-wasi/@emnapi/wasi-threads": ["@emnapi/[email protected].3", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-ELEBe8PsLvvJ6QMr0zLt8ffvOHW/dc1m3CEzNMg7aJUv3bMaoDtw2TXyDAwkYBuroxxuHEwhRTLJSe5sya547g=="],
|
||||
|
||||
"@tailwindcss/oxide-wasm32-wasi/@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.1.1", "", { "dependencies": { "@emnapi/core": "^1.7.1", "@emnapi/runtime": "^1.7.1", "@tybys/wasm-util": "^0.10.1" }, "bundled": true }, "sha512-p64ah1M1ld8xjWv3qbvFwHiFVWrq1yFvV4f7w+mzaqiR4IlSgkqhcRdHwsGgomwzBH51sRY4NEowLxnaBjcW/A=="],
|
||||
"@tailwindcss/oxide-wasm32-wasi/@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.2.5", "", { "dependencies": { "@tybys/wasm-util": "^0.10.3" }, "peerDependencies": { "@emnapi/core": "^1.7.1 || ^2.0.0-alpha.4", "@emnapi/runtime": "^1.7.1 || ^2.0.0-alpha.4" }, "bundled": true }, "sha512-HshSvXzmBxNzqejd3k/KemgQ3hdREUYFRRrgxOZ+gPljDIsO2SDZrVZMd4Z/HsxudQbE62OVyVFE8z9BCurfjA=="],
|
||||
|
||||
"@tailwindcss/oxide-wasm32-wasi/@tybys/wasm-util": ["@tybys/[email protected].1", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-9tTaPJLSiejZKx+Bmog4uSubteqTvFrVrURwkmHixBo0G4seD0zUxp98E1DzUBJxLQ3NPwXrGKDiVjwx/DpPsg=="],
|
||||
"@tailwindcss/oxide-wasm32-wasi/@tybys/wasm-util": ["@tybys/[email protected].4", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-W3c4gRigFS0T/Ma4qIYF3GDAc5AQdHb1yL5znJT1Zv1YaD9Kitx656wBjvr19qbiosmZT8lWDM5BEMynUqX65A=="],
|
||||
|
||||
"@tailwindcss/oxide-wasm32-wasi/tslib": ["[email protected]", "", { "bundled": true }, "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w=="],
|
||||
|
||||
|
||||
+11
-13
@@ -4,34 +4,32 @@
|
||||
"main": "dist/index.js",
|
||||
"module": "index.ts",
|
||||
"dependencies": {
|
||||
"@tailwindcss/postcss": "^4.2.2",
|
||||
"@types/bun": "latest",
|
||||
"@tailwindcss/postcss": "^4.3.3",
|
||||
"@types/bun": "1.3.14",
|
||||
"@types/node": "^24.10.0",
|
||||
"@types/react": "^19.2.2",
|
||||
"@types/react-dom": "^19.2.2",
|
||||
"@types/react": "^19.3.0",
|
||||
"@types/react-dom": "^19.3.0",
|
||||
"bun-plugin-tailwind": "^0.1.2",
|
||||
"chalk": "^5.6.2",
|
||||
"chokidar": "^5.0.0",
|
||||
"commander": "^14.0.2",
|
||||
"esbuild": "^0.28.2",
|
||||
"lightningcss-wasm": "^1.32.0",
|
||||
"lodash": "^4.17.23",
|
||||
"micromatch": "^4.0.8",
|
||||
"lodash": "^4.18.1",
|
||||
"ora": "^9.0.0",
|
||||
"postcss": "^8.5.8",
|
||||
"react": "^19.2.4",
|
||||
"react-dom": "^19.2.4",
|
||||
"tailwindcss": "^4.2.2",
|
||||
"postcss": "^8.5.30",
|
||||
"react": "^19.3.0",
|
||||
"react-dom": "^19.3.0",
|
||||
"tailwindcss": "^4.3.3",
|
||||
"typescript": "^5.0.0",
|
||||
"uuid": "^14.0.2"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@testing-library/dom": "^10.4.1",
|
||||
"@types/chokidar": "^2.1.7",
|
||||
"@types/lodash": "^4.17.24",
|
||||
"@types/micromatch": "^4.0.10",
|
||||
"@types/lodash": "^4.17.26",
|
||||
"@types/uuid": "^11.0.0",
|
||||
"happy-dom": "^20.8.4"
|
||||
"happy-dom": "^20.14.6"
|
||||
},
|
||||
"exports": {
|
||||
".": {
|
||||
|
||||
+24
-18
@@ -1,11 +1,17 @@
|
||||
import { describe, it, expect } from "bun:test";
|
||||
import grabCacheNames from "../../../functions/cache/grab-cache-names";
|
||||
|
||||
const sha256 = (s: string) =>
|
||||
new Bun.CryptoHasher("sha256").update(s).digest("hex");
|
||||
|
||||
describe("grabCacheNames", () => {
|
||||
it("returns cache_name and cache_meta_name for a simple key", () => {
|
||||
const { cache_name, cache_meta_name } = grabCacheNames({ key: "home" });
|
||||
expect(cache_name).toBe("home.res.html");
|
||||
expect(cache_meta_name).toBe("home.meta.json");
|
||||
it("returns hashed cache_name and cache_meta_name for a simple key", () => {
|
||||
const { cache_name, cache_meta_name, cache_id } = grabCacheNames({
|
||||
key: "home",
|
||||
});
|
||||
expect(cache_id).toBe(sha256("home"));
|
||||
expect(cache_name).toBe(`${sha256("home")}.res.html`);
|
||||
expect(cache_meta_name).toBe(`${sha256("home")}.meta.json`);
|
||||
});
|
||||
|
||||
it("defaults paradigm to html", () => {
|
||||
@@ -15,22 +21,22 @@ describe("grabCacheNames", () => {
|
||||
|
||||
it("uses json paradigm when specified", () => {
|
||||
const { cache_name } = grabCacheNames({ key: "api-data", paradigm: "json" });
|
||||
expect(cache_name).toBe("api-data.res.json");
|
||||
expect(cache_name).toBe(`${sha256("api-data")}.res.json`);
|
||||
});
|
||||
|
||||
it("URL-encodes the key", () => {
|
||||
const { cache_name, cache_meta_name } = grabCacheNames({
|
||||
key: "/blog/hello world",
|
||||
});
|
||||
const encoded = encodeURIComponent("/blog/hello world");
|
||||
expect(cache_name).toBe(`${encoded}.res.html`);
|
||||
expect(cache_meta_name).toBe(`${encoded}.meta.json`);
|
||||
});
|
||||
|
||||
it("handles keys with special characters", () => {
|
||||
const key = "page?id=1&sort=asc";
|
||||
it("produces fixed-length, path-safe names for long or special keys", () => {
|
||||
const key = "/blog/hello world?q=" + "x".repeat(1000) + "&a=../../etc";
|
||||
const { cache_name } = grabCacheNames({ key });
|
||||
expect(cache_name).toBe(`${encodeURIComponent(key)}.res.html`);
|
||||
expect(cache_name).toMatch(/^[0-9a-f]{64}\.res\.html$/);
|
||||
});
|
||||
|
||||
it("uses cache_id as-is when given", () => {
|
||||
const { cache_name, cache_meta_name } = grabCacheNames({
|
||||
cache_id: "abc",
|
||||
paradigm: "json",
|
||||
});
|
||||
expect(cache_name).toBe("abc.res.json");
|
||||
expect(cache_meta_name).toBe("abc.meta.json");
|
||||
});
|
||||
|
||||
it("cache_meta_name always uses .meta.json regardless of paradigm", () => {
|
||||
@@ -38,6 +44,6 @@ describe("grabCacheNames", () => {
|
||||
key: "test",
|
||||
paradigm: "json",
|
||||
});
|
||||
expect(cache_meta_name).toBe("test.meta.json");
|
||||
expect(cache_meta_name).toBe(`${sha256("test")}.meta.json`);
|
||||
});
|
||||
});
|
||||
|
||||
@@ -27,7 +27,10 @@ mock.module("../../../../src/functions/server/handle-public", () => ({
|
||||
}));
|
||||
|
||||
mock.module("../../../../src/functions/server/handle-files", () => ({
|
||||
default: async () => new Response("files")
|
||||
default: async ({ req }: any) =>
|
||||
new URL(req.url).pathname.includes("john.doe")
|
||||
? new Response("missing", { status: 404 })
|
||||
: new Response("files")
|
||||
}));
|
||||
|
||||
mock.module("../../../../src/functions/server/web-pages/handle-web-pages", () => ({
|
||||
@@ -42,10 +45,13 @@ describe("bunext-req-handler", () => {
|
||||
if (url.pathname === "/blocked") {
|
||||
return new Response("Blocked by middleware", { status: 403 });
|
||||
}
|
||||
if (url.pathname === "/rewrite-me") {
|
||||
return new Request("http://localhost/api/rewritten");
|
||||
}
|
||||
return undefined;
|
||||
}
|
||||
},
|
||||
RouteIgnorePatterns: [],
|
||||
RouteIgnorePatterns: [/\/\(/],
|
||||
} as any;
|
||||
});
|
||||
|
||||
@@ -93,4 +99,26 @@ describe("bunext-req-handler", () => {
|
||||
const res = await bunextRequestHandler({ req });
|
||||
expect(await res.text()).toBe("web-pages");
|
||||
});
|
||||
|
||||
test("excluded paths return 404", async () => {
|
||||
const req = new Request("http://localhost/(group)/page");
|
||||
const res = await bunextRequestHandler({ req });
|
||||
expect(res.status).toBe(404);
|
||||
});
|
||||
|
||||
test("routes using the request returned by middleware", async () => {
|
||||
const req = new Request("http://localhost/rewrite-me");
|
||||
const res = await bunextRequestHandler({ req });
|
||||
expect(await res.text()).toBe("api-routes");
|
||||
});
|
||||
|
||||
test("falls back to pages for dotted paths that are not files", async () => {
|
||||
global.BUNEXT_ROUTER = {
|
||||
match: (p: string) =>
|
||||
p === "/users/john.doe" ? { filePath: "/users/[id].tsx" } : null,
|
||||
} as any;
|
||||
const req = new Request("http://localhost/users/john.doe");
|
||||
const res = await bunextRequestHandler({ req });
|
||||
expect(await res.text()).toBe("web-pages");
|
||||
});
|
||||
});
|
||||
|
||||
@@ -21,11 +21,12 @@ describe("grabDirNames", () => {
|
||||
);
|
||||
});
|
||||
|
||||
it("nests BUNEXT_CACHE_DIR under .bunext/public/cache", () => {
|
||||
it("keeps BUNEXT_CACHE_DIR outside the publicly served directory", () => {
|
||||
const dirs = grabDirNames();
|
||||
expect(dirs.BUNEXT_CACHE_DIR).toBe(
|
||||
path.join(dirs.BUNX_CWD_DIR, "public", "cache"),
|
||||
);
|
||||
expect(dirs.BUNEXT_CACHE_DIR).toBe(path.join(dirs.BUNX_CWD_DIR, "cache"));
|
||||
expect(
|
||||
dirs.BUNEXT_CACHE_DIR.startsWith(dirs.BUNEXT_PUBLIC_DIR + path.sep),
|
||||
).toBe(false);
|
||||
});
|
||||
|
||||
it("places map JSON file inside HYDRATION_DST_DIR", () => {
|
||||
|
||||
@@ -0,0 +1,48 @@
|
||||
import { describe, it, expect } from "bun:test";
|
||||
import grabRouteParams from "../../utils/grab-route-params";
|
||||
import { RequestBodyTooLargeError } from "../../utils/read-request-body";
|
||||
|
||||
describe("grabRouteParams", () => {
|
||||
it("parses a JSON body and keeps the request body readable", async () => {
|
||||
const req = new Request("http://localhost/api/test?x=1", {
|
||||
method: "POST",
|
||||
headers: { "content-type": "application/json" },
|
||||
body: JSON.stringify({ a: 1 }),
|
||||
});
|
||||
|
||||
const params = await grabRouteParams({ req, max_body_bytes: 1000 });
|
||||
|
||||
expect(params.body).toEqual({ a: 1 });
|
||||
expect(params.query.x).toBe("1");
|
||||
expect(await params.req.text()).toBe('{"a":1}');
|
||||
});
|
||||
|
||||
it("returns an empty body object for non-JSON bodies", async () => {
|
||||
const req = new Request("http://localhost/api/test", {
|
||||
method: "POST",
|
||||
body: "raw text",
|
||||
});
|
||||
|
||||
const params = await grabRouteParams({ req, max_body_bytes: 1000 });
|
||||
|
||||
expect(params.body).toEqual({});
|
||||
expect(await params.req.text()).toBe("raw text");
|
||||
});
|
||||
|
||||
it("leaves the body undefined for GET requests", async () => {
|
||||
const req = new Request("http://localhost/api/test");
|
||||
const params = await grabRouteParams({ req, max_body_bytes: 1000 });
|
||||
expect(params.body).toBeUndefined();
|
||||
});
|
||||
|
||||
it("throws when the body is larger than the limit", async () => {
|
||||
const req = new Request("http://localhost/api/test", {
|
||||
method: "POST",
|
||||
body: "x".repeat(2000),
|
||||
});
|
||||
|
||||
expect(
|
||||
grabRouteParams({ req, max_body_bytes: 1000 }),
|
||||
).rejects.toBeInstanceOf(RequestBodyTooLargeError);
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,52 @@
|
||||
import { describe, it, expect, beforeAll, afterAll } from "bun:test";
|
||||
import { mkdtempSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from "fs";
|
||||
import os from "os";
|
||||
import path from "path";
|
||||
import isSafePath from "../../utils/is-safe-path";
|
||||
|
||||
let tmp: string;
|
||||
let real_public: string;
|
||||
let linked_public: string;
|
||||
|
||||
beforeAll(() => {
|
||||
tmp = mkdtempSync(path.join(os.tmpdir(), "bunext-safe-path-"));
|
||||
real_public = path.join(tmp, "real", "public");
|
||||
mkdirSync(real_public, { recursive: true });
|
||||
writeFileSync(path.join(real_public, "file name.txt"), "ok");
|
||||
writeFileSync(path.join(tmp, "secret.txt"), "secret");
|
||||
symlinkSync(path.join(tmp, "real"), path.join(tmp, "link"));
|
||||
linked_public = path.join(tmp, "link", "public");
|
||||
});
|
||||
|
||||
afterAll(() => {
|
||||
rmSync(tmp, { recursive: true, force: true });
|
||||
});
|
||||
|
||||
describe("isSafePath", () => {
|
||||
it("allows files inside the directory", () => {
|
||||
expect(
|
||||
isSafePath({
|
||||
filePath: path.join(real_public, "file name.txt"),
|
||||
allowedDir: real_public,
|
||||
}),
|
||||
).toBe(true);
|
||||
});
|
||||
|
||||
it("rejects traversal outside the directory", () => {
|
||||
expect(
|
||||
isSafePath({
|
||||
filePath: path.join(real_public, "..", "..", "secret.txt"),
|
||||
allowedDir: real_public,
|
||||
}),
|
||||
).toBe(false);
|
||||
});
|
||||
|
||||
it("allows files when the directory itself is under a symlink", () => {
|
||||
expect(
|
||||
isSafePath({
|
||||
filePath: path.join(linked_public, "file name.txt"),
|
||||
allowedDir: linked_public,
|
||||
}),
|
||||
).toBe(true);
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,60 @@
|
||||
import { describe, it, expect } from "bun:test";
|
||||
import readRequestBody, {
|
||||
RequestBodyTooLargeError,
|
||||
} from "../../utils/read-request-body";
|
||||
|
||||
function chunkedRequest(chunks: string[]) {
|
||||
const stream = new ReadableStream({
|
||||
start(controller) {
|
||||
for (const chunk of chunks) {
|
||||
controller.enqueue(new TextEncoder().encode(chunk));
|
||||
}
|
||||
controller.close();
|
||||
},
|
||||
});
|
||||
|
||||
return new Request("http://localhost/api/test", {
|
||||
method: "POST",
|
||||
body: stream,
|
||||
});
|
||||
}
|
||||
|
||||
describe("readRequestBody", () => {
|
||||
it("returns undefined for GET requests", async () => {
|
||||
const req = new Request("http://localhost/");
|
||||
expect(await readRequestBody({ req, max_bytes: 10 })).toBeUndefined();
|
||||
});
|
||||
|
||||
it("returns the body bytes", async () => {
|
||||
const req = new Request("http://localhost/", {
|
||||
method: "POST",
|
||||
body: "hello",
|
||||
});
|
||||
const body = await readRequestBody({ req, max_bytes: 10 });
|
||||
expect(new TextDecoder().decode(body)).toBe("hello");
|
||||
});
|
||||
|
||||
it("rejects a too-large Content-Length without reading the body", async () => {
|
||||
const req = new Request("http://localhost/", {
|
||||
method: "POST",
|
||||
headers: { "content-length": "2000000" },
|
||||
body: "x",
|
||||
});
|
||||
expect(readRequestBody({ req, max_bytes: 1000 })).rejects.toBeInstanceOf(
|
||||
RequestBodyTooLargeError,
|
||||
);
|
||||
});
|
||||
|
||||
it("enforces the limit on chunked bodies without a Content-Length", async () => {
|
||||
const req = chunkedRequest(["x".repeat(600), "x".repeat(600)]);
|
||||
expect(readRequestBody({ req, max_bytes: 1000 })).rejects.toBeInstanceOf(
|
||||
RequestBodyTooLargeError,
|
||||
);
|
||||
});
|
||||
|
||||
it("reads chunked bodies within the limit", async () => {
|
||||
const req = chunkedRequest(['{"a":', "1}"]);
|
||||
const body = await readRequestBody({ req, max_bytes: 1000 });
|
||||
expect(new TextDecoder().decode(body)).toBe('{"a":1}');
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,24 @@
|
||||
import { describe, it, expect } from "bun:test";
|
||||
import serializeForScript from "../../utils/serialize-for-script";
|
||||
|
||||
describe("serializeForScript", () => {
|
||||
it("escapes sequences that could break out of a script tag", () => {
|
||||
const out = serializeForScript({
|
||||
a: "</script><script>alert(1)</script>",
|
||||
b: "<!--",
|
||||
c: "&",
|
||||
d: "
",
|
||||
});
|
||||
|
||||
expect(out).not.toContain("<");
|
||||
expect(out).not.toContain(">");
|
||||
expect(out).not.toContain("&");
|
||||
expect(out).not.toContain("
");
|
||||
expect(out).not.toContain("
");
|
||||
});
|
||||
|
||||
it("round-trips through JSON.parse", () => {
|
||||
const value = { a: "</script><!--", b: [1, "&"], c: "
" };
|
||||
expect(JSON.parse(serializeForScript(value))).toEqual(value);
|
||||
});
|
||||
});
|
||||
@@ -1,5 +1,6 @@
|
||||
export const AppData = {
|
||||
DefaultCacheExpiryTimeSeconds: 60 * 60,
|
||||
DefaultMaxCacheEntries: 1000,
|
||||
DefaultCronInterval: 30000,
|
||||
BunextStaticFilesCacheExpiry: 60 * 60 * 24 * 7,
|
||||
ClientHMRPath: "__bunext_client_hmr__",
|
||||
|
||||
@@ -1,171 +0,0 @@
|
||||
import path from "path";
|
||||
import ts from "typescript";
|
||||
|
||||
type Params = {
|
||||
txt_code: string;
|
||||
file_path: string;
|
||||
};
|
||||
|
||||
export default function stripServerSideLogic({ txt_code, file_path }: Params) {
|
||||
const file_dir_name = path.dirname(file_path);
|
||||
|
||||
// 1. Initial Parse of the source
|
||||
const sourceFile = ts.createSourceFile(
|
||||
"file.tsx",
|
||||
txt_code,
|
||||
ts.ScriptTarget.Latest,
|
||||
true,
|
||||
ts.ScriptKind.TSX,
|
||||
);
|
||||
const printer = ts.createPrinter();
|
||||
|
||||
/**
|
||||
* PASS 1: Remove 'server' export and resolve absolute paths
|
||||
*/
|
||||
const stripTransformer: ts.TransformerFactory<ts.SourceFile> =
|
||||
(context) => (rootNode) => {
|
||||
const visitor = (node: ts.Node): ts.Node | undefined => {
|
||||
// Remove 'export const server'
|
||||
if (
|
||||
ts.isVariableStatement(node) &&
|
||||
node.modifiers?.some(
|
||||
(m) => m.kind === ts.SyntaxKind.ExportKeyword,
|
||||
)
|
||||
) {
|
||||
if (
|
||||
node.declarationList.declarations.some(
|
||||
(d) =>
|
||||
ts.isIdentifier(d.name) &&
|
||||
d.name.text === "server",
|
||||
)
|
||||
) {
|
||||
return undefined;
|
||||
}
|
||||
}
|
||||
|
||||
// Convert relative imports to absolute
|
||||
if (ts.isImportDeclaration(node)) {
|
||||
const specifier = node.moduleSpecifier;
|
||||
if (
|
||||
ts.isStringLiteral(specifier) &&
|
||||
specifier.text.startsWith(".")
|
||||
) {
|
||||
const absolutePath = path.resolve(
|
||||
file_dir_name,
|
||||
specifier.text,
|
||||
);
|
||||
return ts.factory.updateImportDeclaration(
|
||||
node,
|
||||
node.modifiers,
|
||||
node.importClause,
|
||||
ts.factory.createStringLiteral(absolutePath),
|
||||
node.attributes,
|
||||
);
|
||||
}
|
||||
}
|
||||
return ts.visitEachChild(node, visitor, context);
|
||||
};
|
||||
return ts.visitNode(rootNode, visitor) as ts.SourceFile;
|
||||
};
|
||||
|
||||
const step1Result = ts.transform(sourceFile, [stripTransformer]);
|
||||
const intermediateCode = printer.printFile(step1Result.transformed[0]);
|
||||
|
||||
// 2. Re-parse to get a "Clean Slate" AST
|
||||
const cleanSource = ts.createSourceFile(
|
||||
"clean.tsx",
|
||||
intermediateCode,
|
||||
ts.ScriptTarget.Latest,
|
||||
true,
|
||||
ts.ScriptKind.TSX,
|
||||
);
|
||||
|
||||
/**
|
||||
* PASS 2: Collect all used Identifiers and Prune Imports
|
||||
*/
|
||||
const usedIdentifiers = new Set<string>();
|
||||
|
||||
function walkAndFindUsages(node: ts.Node) {
|
||||
if (ts.isIdentifier(node)) {
|
||||
// We only care about identifiers that AREN'T the names in the import statements themselves
|
||||
const parent = node.parent;
|
||||
const isImportName =
|
||||
ts.isImportSpecifier(parent) ||
|
||||
ts.isImportClause(parent) ||
|
||||
ts.isNamespaceImport(parent);
|
||||
if (!isImportName) {
|
||||
usedIdentifiers.add(node.text);
|
||||
}
|
||||
}
|
||||
ts.forEachChild(node, walkAndFindUsages);
|
||||
}
|
||||
walkAndFindUsages(cleanSource);
|
||||
|
||||
const cleanupTransformer: ts.TransformerFactory<ts.SourceFile> =
|
||||
(context) => (rootNode) => {
|
||||
const visitor = (node: ts.Node): ts.Node | undefined => {
|
||||
if (ts.isImportDeclaration(node)) {
|
||||
const clause = node.importClause;
|
||||
if (!clause) return node;
|
||||
|
||||
// 1. Clean Named Imports: { A, B }
|
||||
if (
|
||||
clause.namedBindings &&
|
||||
ts.isNamedImports(clause.namedBindings)
|
||||
) {
|
||||
const activeElements =
|
||||
clause.namedBindings.elements.filter((el) =>
|
||||
usedIdentifiers.has(el.name.text),
|
||||
);
|
||||
|
||||
// If no named imports are used and there is no default import, nix the whole line
|
||||
if (activeElements.length === 0 && !clause.name)
|
||||
return undefined;
|
||||
|
||||
// If we have some named imports left, update the node
|
||||
return ts.factory.updateImportDeclaration(
|
||||
node,
|
||||
node.modifiers,
|
||||
ts.factory.updateImportClause(
|
||||
clause,
|
||||
clause.isTypeOnly,
|
||||
// Only keep default import if it's used
|
||||
clause.name &&
|
||||
usedIdentifiers.has(clause.name.text)
|
||||
? clause.name
|
||||
: undefined,
|
||||
ts.factory.createNamedImports(activeElements),
|
||||
),
|
||||
node.moduleSpecifier,
|
||||
node.attributes,
|
||||
);
|
||||
}
|
||||
|
||||
// 2. Clean Default Imports: import X from '...'
|
||||
if (clause.name && !usedIdentifiers.has(clause.name.text)) {
|
||||
// If there are no named bindings attached, nix the whole line
|
||||
if (!clause.namedBindings) return undefined;
|
||||
|
||||
// Otherwise, just strip the default name and keep the named bindings
|
||||
return ts.factory.updateImportDeclaration(
|
||||
node,
|
||||
node.modifiers,
|
||||
ts.factory.updateImportClause(
|
||||
clause,
|
||||
clause.isTypeOnly,
|
||||
undefined,
|
||||
clause.namedBindings,
|
||||
),
|
||||
node.moduleSpecifier,
|
||||
node.attributes,
|
||||
);
|
||||
}
|
||||
}
|
||||
return ts.visitEachChild(node, visitor, context);
|
||||
};
|
||||
return ts.visitNode(rootNode, visitor) as ts.SourceFile;
|
||||
};
|
||||
|
||||
const finalResult = ts.transform(cleanSource, [cleanupTransformer]);
|
||||
return printer.printFile(finalResult.transformed[0]);
|
||||
}
|
||||
+17
-4
@@ -1,12 +1,25 @@
|
||||
type Params = {
|
||||
key: string;
|
||||
key?: string;
|
||||
/**
|
||||
* Hashed key, as found in cache file names. Used when the original
|
||||
* key is no longer known (e.g. when trimming from a directory listing).
|
||||
*/
|
||||
cache_id?: string;
|
||||
paradigm?: "html" | "json";
|
||||
};
|
||||
|
||||
export default function grabCacheNames({ key, paradigm = "html" }: Params) {
|
||||
const parsed_key = encodeURIComponent(key);
|
||||
export default function grabCacheNames({
|
||||
key,
|
||||
cache_id,
|
||||
paradigm = "html",
|
||||
}: Params) {
|
||||
// Hashing keeps file names short and fixed-length no matter how long
|
||||
// the request path or query string is.
|
||||
const parsed_key =
|
||||
cache_id ||
|
||||
new Bun.CryptoHasher("sha256").update(key || "").digest("hex");
|
||||
const cache_name = `${parsed_key}.res.${paradigm}`;
|
||||
const cache_meta_name = `${parsed_key}.meta.json`;
|
||||
|
||||
return { cache_name, cache_meta_name };
|
||||
return { cache_id: parsed_key, cache_name, cache_meta_name };
|
||||
}
|
||||
|
||||
+2
-9
@@ -12,16 +12,9 @@ export default async function trimAllCache() {
|
||||
const cached_item = cached_items[i];
|
||||
if (!cached_item.endsWith(`.meta.json`)) continue;
|
||||
|
||||
const cache_key = decodeURIComponent(cached_item.replace(/\.meta\.json/, ""));
|
||||
const cache_id = cached_item.replace(/\.meta\.json$/, "");
|
||||
|
||||
const trim_key = await trimCacheKey({
|
||||
key: cache_key,
|
||||
});
|
||||
|
||||
if (trim_key.success) {
|
||||
cached_items.splice(i, 1);
|
||||
i--;
|
||||
}
|
||||
await trimCacheKey({ cache_id });
|
||||
}
|
||||
} catch (error) {
|
||||
return undefined;
|
||||
|
||||
+14
-8
@@ -1,4 +1,4 @@
|
||||
import { readFileSync, unlinkSync } from "fs";
|
||||
import { readFileSync, rmSync } from "fs";
|
||||
import grabDirNames from "../../utils/grab-dir-names";
|
||||
import grabCacheNames from "./grab-cache-names";
|
||||
import path from "path";
|
||||
@@ -6,17 +6,17 @@ import type { APIResponseObject, BunextCacheFileMeta } from "../../types";
|
||||
import { AppData } from "../../data/app-data";
|
||||
|
||||
type Params = {
|
||||
key: string;
|
||||
key?: string;
|
||||
cache_id?: string;
|
||||
};
|
||||
|
||||
export default async function trimCacheKey({
|
||||
key,
|
||||
cache_id,
|
||||
}: Params): Promise<APIResponseObject> {
|
||||
try {
|
||||
const { BUNEXT_CACHE_DIR } = grabDirNames();
|
||||
const { cache_name, cache_meta_name } = grabCacheNames({
|
||||
key,
|
||||
});
|
||||
const { cache_meta_name } = grabCacheNames({ key, cache_id });
|
||||
|
||||
const config = global.BUNEXT_CONFIG;
|
||||
|
||||
@@ -27,13 +27,19 @@ export default async function trimCacheKey({
|
||||
const default_expiry_time_milliseconds =
|
||||
default_expiry_time_seconds * 1000;
|
||||
|
||||
const cache_content_path = path.join(BUNEXT_CACHE_DIR, cache_name);
|
||||
const cache_meta_path = path.join(BUNEXT_CACHE_DIR, cache_meta_name);
|
||||
|
||||
const cache_meta: BunextCacheFileMeta = JSON.parse(
|
||||
readFileSync(cache_meta_path, "utf-8"),
|
||||
);
|
||||
|
||||
const { cache_name } = grabCacheNames({
|
||||
key,
|
||||
cache_id,
|
||||
paradigm: cache_meta.paradigm,
|
||||
});
|
||||
const cache_content_path = path.join(BUNEXT_CACHE_DIR, cache_name);
|
||||
|
||||
const expiry_milliseconds = cache_meta.expiry_seconds
|
||||
? cache_meta.expiry_seconds * 1000
|
||||
: default_expiry_time_milliseconds;
|
||||
@@ -45,8 +51,8 @@ export default async function trimCacheKey({
|
||||
};
|
||||
}
|
||||
|
||||
unlinkSync(cache_content_path);
|
||||
unlinkSync(cache_meta_path);
|
||||
rmSync(cache_content_path, { force: true });
|
||||
rmSync(cache_meta_path, { force: true });
|
||||
|
||||
return {
|
||||
success: true,
|
||||
|
||||
Vendored
+18
-2
@@ -1,8 +1,9 @@
|
||||
import { existsSync, writeFileSync } from "fs";
|
||||
import { existsSync, readdirSync, writeFileSync } from "fs";
|
||||
import grabDirNames from "../../utils/grab-dir-names";
|
||||
import grabCacheNames from "./grab-cache-names";
|
||||
import type { APIResponseObject, BunextCacheFileMeta } from "../../types";
|
||||
import path from "path";
|
||||
import { AppData } from "../../data/app-data";
|
||||
|
||||
type Params = {
|
||||
key: string;
|
||||
@@ -34,7 +35,22 @@ export default async function writeCache({
|
||||
};
|
||||
}
|
||||
|
||||
writeFileSync(path.join(target_path), value);
|
||||
const max_entries =
|
||||
global.BUNEXT_CONFIG?.max_cache_entries ||
|
||||
AppData["DefaultMaxCacheEntries"];
|
||||
|
||||
const entries_count = readdirSync(BUNEXT_CACHE_DIR).filter((f) =>
|
||||
f.endsWith(".meta.json"),
|
||||
).length;
|
||||
|
||||
if (entries_count >= max_entries) {
|
||||
return {
|
||||
success: false,
|
||||
msg: `Cache entries limit (${max_entries}) reached`,
|
||||
};
|
||||
}
|
||||
|
||||
writeFileSync(target_path, value);
|
||||
|
||||
const cache_file_meta: BunextCacheFileMeta = {
|
||||
date_created: Date.now(),
|
||||
|
||||
@@ -1,53 +0,0 @@
|
||||
import { spawn } from "bun";
|
||||
|
||||
// Only the "supervisor" respawns. The child sets this env var so it won't respawn itself.
|
||||
const IS_CHILD = process.env.__RESPAWN_CHILD === "1";
|
||||
|
||||
let shuttingDown = false;
|
||||
|
||||
async function cleanup() {
|
||||
// Put real cleanup here: close DB handles, servers, file descriptors, timers, etc.
|
||||
// Must be awaitable — do NOT rely on process.on("exit") for this.
|
||||
}
|
||||
|
||||
function respawn(code: number) {
|
||||
const child = spawn({
|
||||
cmd: [process.execPath, ...process.argv.slice(1)],
|
||||
stdio: ["inherit", "inherit", "inherit"],
|
||||
env: { ...process.env, __RESPAWN_CHILD: "1" },
|
||||
// Detach so the child survives independently and gets its own process group.
|
||||
// Without this, killing the parent's group can take the child with it.
|
||||
});
|
||||
// Let the child live on its own.
|
||||
child.unref?.();
|
||||
}
|
||||
|
||||
async function shutdown(code: number) {
|
||||
if (shuttingDown) return;
|
||||
shuttingDown = true;
|
||||
|
||||
try {
|
||||
await cleanup();
|
||||
} catch (e) {
|
||||
console.error("cleanup failed:", e);
|
||||
}
|
||||
|
||||
// Only the supervisor respawns, and only on abnormal exit.
|
||||
if (!IS_CHILD && code !== 0) {
|
||||
respawn(code);
|
||||
}
|
||||
|
||||
process.exit(code);
|
||||
}
|
||||
|
||||
// Catch the things that actually fire *before* exit, where async works.
|
||||
process.on("SIGINT", () => shutdown(130));
|
||||
process.on("SIGTERM", () => shutdown(143));
|
||||
process.on("uncaughtException", (err) => {
|
||||
console.error(err);
|
||||
shutdown(1);
|
||||
});
|
||||
process.on("unhandledRejection", (err) => {
|
||||
console.error(err);
|
||||
shutdown(1);
|
||||
});
|
||||
@@ -9,6 +9,7 @@ import checkExcludedPatterns from "../../utils/check-excluded-patterns";
|
||||
import { AppData } from "../../data/app-data";
|
||||
import { log } from "../../utils/log";
|
||||
import fullRebuild from "./full-rebuild";
|
||||
import grabRouter from "../../utils/grab-router";
|
||||
|
||||
const HMR_RETRY_COOLDOWN_MS = 5000;
|
||||
let lastHmrRetryTime = 0;
|
||||
@@ -26,10 +27,13 @@ export default async function bunextRequestHandler({
|
||||
let req = initial_req.clone();
|
||||
|
||||
try {
|
||||
const url = new URL(req.url);
|
||||
let url = new URL(req.url);
|
||||
|
||||
if (checkExcludedPatterns({ path: url.pathname })) {
|
||||
return Response.json({ success: false, msg: `Invalid Path` });
|
||||
return Response.json(
|
||||
{ success: false, msg: `Invalid Path` },
|
||||
{ status: 404 },
|
||||
);
|
||||
}
|
||||
|
||||
let response: Response | undefined = undefined;
|
||||
@@ -47,6 +51,7 @@ export default async function bunextRequestHandler({
|
||||
|
||||
if (middleware_res instanceof Request) {
|
||||
req = middleware_res;
|
||||
url = new URL(req.url);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -68,8 +73,16 @@ export default async function bunextRequestHandler({
|
||||
response = await handleRoutes({ req });
|
||||
} else if (url.pathname.startsWith("/public/")) {
|
||||
response = await handlePublic({ req });
|
||||
} else if (url.pathname.match(/\..*$/)) {
|
||||
} else if (url.pathname.match(/\.[^/]+$/)) {
|
||||
response = await handleFiles({ req });
|
||||
|
||||
// Paths like `/users/john.doe` look like files but can be pages.
|
||||
if (
|
||||
response.status == 404 &&
|
||||
grabRouter()?.match(url.pathname)?.filePath
|
||||
) {
|
||||
response = await handleWebPages({ req });
|
||||
}
|
||||
} else {
|
||||
response = await handleWebPages({ req });
|
||||
}
|
||||
|
||||
@@ -17,7 +17,10 @@ export default async function ({ req }: Params): Promise<Response> {
|
||||
|
||||
const file_path = path.join(
|
||||
BUNEXT_PUBLIC_DIR,
|
||||
url.pathname.replace(/\/\.bunext\/public\//, ""),
|
||||
decodeURIComponent(url.pathname).replace(
|
||||
/\/\.bunext\/public\//,
|
||||
"",
|
||||
),
|
||||
);
|
||||
|
||||
if (!isSafePath({ filePath: file_path, allowedDir: BUNEXT_PUBLIC_DIR })) {
|
||||
|
||||
@@ -14,7 +14,7 @@ export default async function ({ req }: Params): Promise<Response> {
|
||||
try {
|
||||
const is_dev = isDevelopment();
|
||||
const url = new URL(req.url);
|
||||
const file_path = path.join(PUBLIC_DIR, url.pathname);
|
||||
const file_path = path.join(PUBLIC_DIR, decodeURIComponent(url.pathname));
|
||||
|
||||
if (!isSafePath({ filePath: file_path, allowedDir: PUBLIC_DIR })) {
|
||||
return new Response("Forbidden", { status: 403 });
|
||||
|
||||
@@ -17,7 +17,7 @@ export default async function ({ req }: Params): Promise<Response> {
|
||||
|
||||
const file_path = path.join(
|
||||
PUBLIC_DIR,
|
||||
url.pathname.replace(/^\/public/, ""),
|
||||
decodeURIComponent(url.pathname).replace(/^\/public/, ""),
|
||||
);
|
||||
|
||||
if (!isSafePath({ filePath: file_path, allowedDir: PUBLIC_DIR })) {
|
||||
|
||||
@@ -12,6 +12,7 @@ import _ from "lodash";
|
||||
import path from "path";
|
||||
import grabDirNames from "../../utils/grab-dir-names";
|
||||
import grabRelativePath from "../../utils/grab-relative-path";
|
||||
import { RequestBodyTooLargeError } from "../../utils/read-request-body";
|
||||
|
||||
const { ROOT_DIR } = grabDirNames();
|
||||
|
||||
@@ -48,11 +49,6 @@ export default async function ({ req }: Params): Promise<Response> {
|
||||
);
|
||||
}
|
||||
|
||||
const routeParams: BunxRouteParams = await grabRouteParams({
|
||||
req,
|
||||
query: match.query,
|
||||
});
|
||||
|
||||
let module: any;
|
||||
const now = Date.now();
|
||||
|
||||
@@ -83,69 +79,46 @@ export default async function ({ req }: Params): Promise<Response> {
|
||||
|
||||
const contentLength = req.headers.get("content-length");
|
||||
|
||||
if (contentLength) {
|
||||
const size = parseInt(contentLength, 10);
|
||||
if (contentLength && parseInt(contentLength, 10) > maxBodyBytes) {
|
||||
return bodyTooLargeResponse();
|
||||
}
|
||||
|
||||
if (size > maxBodyBytes) {
|
||||
return Response.json(
|
||||
{
|
||||
success: false,
|
||||
msg: "Request Body Too Large!",
|
||||
},
|
||||
{
|
||||
status: 413,
|
||||
headers: {
|
||||
"Content-Type": "application/json",
|
||||
},
|
||||
},
|
||||
);
|
||||
}
|
||||
} else if (req.method !== "GET" && req.method !== "HEAD") {
|
||||
const body = await req.arrayBuffer();
|
||||
if (body.byteLength > maxBodyBytes) {
|
||||
return Response.json(
|
||||
{
|
||||
success: false,
|
||||
msg: "Request Body Too Large!",
|
||||
},
|
||||
{
|
||||
status: 413,
|
||||
headers: {
|
||||
"Content-Type": "application/json",
|
||||
},
|
||||
},
|
||||
);
|
||||
}
|
||||
let routeParams: BunxRouteParams;
|
||||
|
||||
try {
|
||||
routeParams.body = JSON.parse(
|
||||
new TextDecoder().decode(body) || "{}",
|
||||
);
|
||||
} catch (error: any) {
|
||||
log.error(
|
||||
`Invalid JSON body for ${url.pathname}: ${error?.message}`,
|
||||
);
|
||||
return Response.json(
|
||||
{
|
||||
success: false,
|
||||
msg: "Invalid JSON body",
|
||||
},
|
||||
{
|
||||
status: 400,
|
||||
headers: {
|
||||
"Content-Type": "application/json",
|
||||
},
|
||||
},
|
||||
);
|
||||
try {
|
||||
routeParams = await grabRouteParams({
|
||||
req,
|
||||
query: match.query,
|
||||
max_body_bytes: maxBodyBytes,
|
||||
});
|
||||
} catch (error) {
|
||||
if (error instanceof RequestBodyTooLargeError) {
|
||||
return bodyTooLargeResponse();
|
||||
}
|
||||
throw error;
|
||||
}
|
||||
|
||||
const target_module = (module["default"] ||
|
||||
module["handler"]) as BunextAPIRouteHandler;
|
||||
module["handler"]) as BunextAPIRouteHandler | undefined;
|
||||
|
||||
if (typeof target_module !== "function") {
|
||||
log.error(
|
||||
`API Route ${url.pathname} has no default or \`handler\` export`,
|
||||
);
|
||||
return Response.json(
|
||||
{
|
||||
success: false,
|
||||
msg: is_dev
|
||||
? `Route ${url.pathname} has no default or \`handler\` export`
|
||||
: "Internal Server Error",
|
||||
},
|
||||
{ status: 500 },
|
||||
);
|
||||
}
|
||||
|
||||
let res: any;
|
||||
try {
|
||||
res = await target_module?.({
|
||||
res = await target_module({
|
||||
...routeParams,
|
||||
});
|
||||
} catch (error: any) {
|
||||
@@ -155,7 +128,7 @@ export default async function ({ req }: Params): Promise<Response> {
|
||||
return Response.json(
|
||||
{
|
||||
success: false,
|
||||
msg: `Route handler error: ${error?.message || "Internal Server Error"}`,
|
||||
msg: routeErrorMessage(error),
|
||||
},
|
||||
{
|
||||
status: 500,
|
||||
@@ -205,7 +178,7 @@ export default async function ({ req }: Params): Promise<Response> {
|
||||
return Response.json(
|
||||
{
|
||||
success: false,
|
||||
msg: `Route handler error: ${error?.message || "Internal Server Error"}`,
|
||||
msg: routeErrorMessage(error),
|
||||
},
|
||||
{
|
||||
status: 500,
|
||||
@@ -216,3 +189,25 @@ export default async function ({ req }: Params): Promise<Response> {
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
function bodyTooLargeResponse() {
|
||||
return Response.json(
|
||||
{
|
||||
success: false,
|
||||
msg: "Request Body Too Large!",
|
||||
},
|
||||
{ status: 413 },
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Error details can leak internals, so they are only exposed in
|
||||
* development. They are always logged server-side.
|
||||
*/
|
||||
function routeErrorMessage(error: any) {
|
||||
if (!isDevelopment()) {
|
||||
return "Internal Server Error";
|
||||
}
|
||||
|
||||
return `Route handler error: ${error?.message || "Internal Server Error"}`;
|
||||
}
|
||||
|
||||
@@ -65,9 +65,9 @@ export default async function serverPostBuildFn(params?: Params) {
|
||||
continue;
|
||||
}
|
||||
|
||||
const mock_req = target_artifact.req_url
|
||||
? new Request(target_artifact.req_url, {})
|
||||
: new Request(controller.page_url);
|
||||
// Re-render with this tab's own URL and cookie, never another
|
||||
// client's request.
|
||||
const mock_req = new Request(controller.page_url);
|
||||
|
||||
if (controller.page_cookie) {
|
||||
mock_req.headers.set("cookie", controller.page_cookie);
|
||||
@@ -88,8 +88,13 @@ export default async function serverPostBuildFn(params?: Params) {
|
||||
|
||||
const { serverRes } = page_component || {};
|
||||
|
||||
const final_artifact: Omit<GlobalHMRControllerObject, "controller"> = {
|
||||
..._.omit(controller, ["controller"]),
|
||||
const final_artifact: Omit<
|
||||
GlobalHMRControllerObject,
|
||||
"controller" | "page_cookie" | "page_url"
|
||||
> = {
|
||||
// `page_cookie` holds the raw Cookie header (incl. HttpOnly
|
||||
// cookies), so it must never be sent back to page JS.
|
||||
..._.omit(controller, ["controller", "page_cookie", "page_url"]),
|
||||
target_map: target_artifact,
|
||||
};
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
import grabContants from "../../../utils/grab-constants";
|
||||
import EJSON from "../../../utils/ejson";
|
||||
import serializeForScript from "../../../utils/serialize-for-script";
|
||||
import type { LivePageDistGenParams } from "../../../types";
|
||||
import isDevelopment from "../../../utils/is-development";
|
||||
import grabWebPageHydrationScript from "./grab-web-page-hydration-script";
|
||||
@@ -37,10 +37,11 @@ export default async function genWebHTML({
|
||||
throw new Error(`Main Component not found!`);
|
||||
}
|
||||
|
||||
const serializedProps = (EJSON.stringify(pageProps || {}) || "{}").replace(
|
||||
/<\//g,
|
||||
"<\\/",
|
||||
);
|
||||
let serializedProps = "{}";
|
||||
|
||||
try {
|
||||
serializedProps = serializeForScript(pageProps || {});
|
||||
} catch (error) {}
|
||||
|
||||
const page_hydration_script = await grabWebPageHydrationScript();
|
||||
const root_meta = root_module?.meta
|
||||
@@ -106,7 +107,7 @@ export default async function genWebHTML({
|
||||
|
||||
<script
|
||||
dangerouslySetInnerHTML={{
|
||||
__html: `window.${ClientWindowPagePropsName} = ${serializedProps};\nwindow.process = ${JSON.stringify(client_process)}`,
|
||||
__html: `window.${ClientWindowPagePropsName} = ${serializedProps};\nwindow.process = ${serializeForScript(client_process)}`,
|
||||
}}
|
||||
data-bunext-head
|
||||
/>
|
||||
@@ -121,7 +122,7 @@ export default async function genWebHTML({
|
||||
<script
|
||||
type="importmap"
|
||||
dangerouslySetInnerHTML={{
|
||||
__html: JSON.stringify(
|
||||
__html: serializeForScript(
|
||||
global.BUNEXT_REACT_IMPORTS_MAP,
|
||||
),
|
||||
}}
|
||||
@@ -170,19 +171,7 @@ export default async function genWebHTML({
|
||||
|
||||
// const htmlBody = await new Response(stream).text();
|
||||
|
||||
const originalConsole = {
|
||||
log: console.log,
|
||||
warn: console.warn,
|
||||
error: console.error,
|
||||
info: console.info,
|
||||
debug: console.debug,
|
||||
};
|
||||
|
||||
console.log = () => {};
|
||||
console.warn = () => {};
|
||||
console.error = () => {};
|
||||
console.info = () => {};
|
||||
console.debug = () => {};
|
||||
silenceConsole();
|
||||
|
||||
let htmlBody: string;
|
||||
let render_error: any;
|
||||
@@ -198,13 +187,13 @@ export default async function genWebHTML({
|
||||
render_error = error;
|
||||
}
|
||||
|
||||
originalConsole.error(error);
|
||||
original_console.error(error);
|
||||
},
|
||||
});
|
||||
|
||||
htmlBody = await new Response(stream).text();
|
||||
} finally {
|
||||
Object.assign(console, originalConsole);
|
||||
restoreConsole();
|
||||
}
|
||||
|
||||
// A component crash during SSR must surface as a proper error (handled
|
||||
@@ -218,3 +207,41 @@ export default async function genWebHTML({
|
||||
|
||||
return html;
|
||||
}
|
||||
|
||||
let original_console: Pick<
|
||||
Console,
|
||||
"log" | "warn" | "error" | "info" | "debug"
|
||||
> = console;
|
||||
|
||||
let silenced_renders = 0;
|
||||
|
||||
/**
|
||||
* Renders can overlap (each one awaits the stream), so the console is
|
||||
* swapped only by the first active render and restored by the last one.
|
||||
* Otherwise a render could save another render's no-ops as the "original"
|
||||
* console and silence the server for good.
|
||||
*/
|
||||
function silenceConsole() {
|
||||
if (silenced_renders++ > 0) return;
|
||||
|
||||
original_console = {
|
||||
log: console.log,
|
||||
warn: console.warn,
|
||||
error: console.error,
|
||||
info: console.info,
|
||||
debug: console.debug,
|
||||
};
|
||||
|
||||
console.log = () => {};
|
||||
console.warn = () => {};
|
||||
console.error = () => {};
|
||||
console.info = () => {};
|
||||
console.debug = () => {};
|
||||
}
|
||||
|
||||
function restoreConsole() {
|
||||
if (--silenced_renders > 0) return;
|
||||
|
||||
silenced_renders = 0;
|
||||
Object.assign(console, original_console);
|
||||
}
|
||||
|
||||
@@ -29,6 +29,29 @@ export default async function generateWebPageGetCachePage({
|
||||
|
||||
if (cache_page && routeParams?.url) {
|
||||
try {
|
||||
const status = serverRes?.response_options?.status;
|
||||
|
||||
if (status && (status < 200 || status >= 300)) {
|
||||
return false;
|
||||
}
|
||||
|
||||
const res_headers = new Headers(
|
||||
serverRes?.response_options?.headers,
|
||||
);
|
||||
|
||||
if (res_headers.has("set-cookie")) {
|
||||
return false;
|
||||
}
|
||||
|
||||
const req_headers = routeParams.req.headers;
|
||||
|
||||
if (
|
||||
!global.BUNEXT_CONFIG?.cache_credentialed_requests &&
|
||||
(req_headers.has("cookie") || req_headers.has("authorization"))
|
||||
) {
|
||||
return false;
|
||||
}
|
||||
|
||||
const is_cache =
|
||||
typeof cache_page == "boolean"
|
||||
? cache_page
|
||||
|
||||
@@ -16,6 +16,15 @@ export default async function generateWebPageResponseFromComponentReturn({
|
||||
}: GrabPageComponentRes) {
|
||||
const is_dev = isDevelopment();
|
||||
|
||||
if (serverRes?.redirect?.destination) {
|
||||
return Response.redirect(
|
||||
serverRes.redirect.destination,
|
||||
serverRes.redirect.permanent
|
||||
? 301
|
||||
: serverRes.redirect.status_code || 302,
|
||||
);
|
||||
}
|
||||
|
||||
const html = await genWebHTML({
|
||||
component,
|
||||
pageProps: serverRes,
|
||||
@@ -30,15 +39,6 @@ export default async function generateWebPageResponseFromComponentReturn({
|
||||
log.info("html", html);
|
||||
}
|
||||
|
||||
if (serverRes?.redirect?.destination) {
|
||||
return Response.redirect(
|
||||
serverRes.redirect.destination,
|
||||
serverRes.redirect.permanent
|
||||
? 301
|
||||
: serverRes.redirect.status_code || 302,
|
||||
);
|
||||
}
|
||||
|
||||
const res_opts: ResponseInit = {
|
||||
...serverRes?.response_options,
|
||||
headers: {
|
||||
|
||||
@@ -12,6 +12,7 @@ import { existsSync } from "fs";
|
||||
import grabDirNames from "../../../utils/grab-dir-names";
|
||||
import grabRelativePath from "../../../utils/grab-relative-path";
|
||||
import { logBuildErrorsOnce } from "../../../utils/build-error-log";
|
||||
import { RequestBodyTooLargeError } from "../../../utils/read-request-body";
|
||||
|
||||
const { BUNX_BUNDLER_ERROR_EXIT_FILE, ROOT_DIR } = grabDirNames();
|
||||
|
||||
@@ -57,9 +58,11 @@ export default async function grabPageComponent(
|
||||
const router = global.BUNEXT_ROUTER;
|
||||
const is_dev = isDevelopment();
|
||||
|
||||
const forwarded_proto = req?.headers.get("x-forwarded-proto");
|
||||
const forwarded_proto = global.BUNEXT_CONFIG?.trust_proxy
|
||||
? req?.headers.get("x-forwarded-proto")?.split(",")[0]?.trim()
|
||||
: undefined;
|
||||
|
||||
if (url && forwarded_proto) {
|
||||
if (url && (forwarded_proto == "http" || forwarded_proto == "https")) {
|
||||
url.protocol = forwarded_proto;
|
||||
}
|
||||
|
||||
@@ -131,10 +134,6 @@ export default async function grabPageComponent(
|
||||
}
|
||||
}
|
||||
|
||||
if (req && !is_hydration) {
|
||||
global.BUNEXT_BUNDLER_CTX_MAP[relative_file_path].req_url = req.url;
|
||||
}
|
||||
|
||||
if (debug) {
|
||||
log.info(`bundledMap:`, bundledMap);
|
||||
}
|
||||
@@ -176,6 +175,10 @@ export default async function grabPageComponent(
|
||||
success: true,
|
||||
};
|
||||
} catch (error: any) {
|
||||
if (error instanceof RequestBodyTooLargeError) {
|
||||
return new Response("Request Body Too Large", { status: 413 });
|
||||
}
|
||||
|
||||
const is404 =
|
||||
error instanceof NotFoundError ||
|
||||
error?.name === "NotFoundError" ||
|
||||
|
||||
@@ -35,6 +35,11 @@ export default async function grabPageErrorComponent({
|
||||
? BUNX_ROOT_404_PRESET_COMPONENT
|
||||
: BUNX_ROOT_500_PRESET_COMPONENT;
|
||||
|
||||
// 404 messages only contain the requested path. Other error messages can
|
||||
// leak internals, so they are only shown in development.
|
||||
const error_message =
|
||||
is404 || is_dev ? error?.message : "Internal Server Error";
|
||||
|
||||
const default_server_res = {
|
||||
response_options: {
|
||||
status: is404 ? 404 : 500,
|
||||
@@ -50,7 +55,7 @@ export default async function grabPageErrorComponent({
|
||||
);
|
||||
const Component = default_module.default as FC<any>;
|
||||
const default_jsx: FC = () => {
|
||||
return <Component>{<span>{error.message}</span>}</Component>;
|
||||
return <Component>{<span>{error_message}</span>}</Component>;
|
||||
};
|
||||
|
||||
return {
|
||||
@@ -104,7 +109,7 @@ export default async function grabPageErrorComponent({
|
||||
}}
|
||||
>
|
||||
<h1>{is404 ? "404 Not Found" : "500 Internal Server Error"}</h1>
|
||||
<span>{error.message}</span>
|
||||
<span>{error_message}</span>
|
||||
</div>
|
||||
);
|
||||
|
||||
|
||||
@@ -7,6 +7,7 @@ import type {
|
||||
} from "../../../types";
|
||||
import _ from "lodash";
|
||||
import { log } from "../../../utils/log";
|
||||
import isDevelopment from "../../../utils/is-development";
|
||||
|
||||
type Params = {
|
||||
url?: URL;
|
||||
@@ -36,9 +37,7 @@ export default async function grabPageServerRes({
|
||||
"searchParams",
|
||||
"hash",
|
||||
"href",
|
||||
"password",
|
||||
"protocol",
|
||||
"username",
|
||||
]) as any),
|
||||
}
|
||||
: null,
|
||||
@@ -65,8 +64,12 @@ export default async function grabPageServerRes({
|
||||
error,
|
||||
);
|
||||
|
||||
// Error details can leak internals, so only expose them in
|
||||
// development. They are always logged above.
|
||||
return _.merge(default_props, {
|
||||
error: error.message,
|
||||
error: isDevelopment()
|
||||
? error.message
|
||||
: "Internal Server Error",
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,96 +0,0 @@
|
||||
import isDevelopment from "../../../utils/is-development";
|
||||
import * as esbuild from "esbuild";
|
||||
|
||||
type Params = {
|
||||
tsx: string;
|
||||
};
|
||||
|
||||
export default async function grabTsxStringModule<T>({
|
||||
tsx,
|
||||
}: Params): Promise<T> {
|
||||
const dev = isDevelopment();
|
||||
const now = Date.now();
|
||||
|
||||
const final_tsx = dev ? tsx + `\n// v_${now}` : tsx;
|
||||
|
||||
const result = await esbuild.transform(final_tsx, {
|
||||
loader: "tsx",
|
||||
format: "esm",
|
||||
jsx: "automatic",
|
||||
minify: !dev,
|
||||
});
|
||||
|
||||
const blob = new Blob([result.code], { type: "text/javascript" });
|
||||
const url = URL.createObjectURL(blob);
|
||||
const mod = await import(url);
|
||||
|
||||
URL.revokeObjectURL(url);
|
||||
|
||||
return mod as T;
|
||||
}
|
||||
|
||||
// export default async function grabTsxStringModule<T extends any = any>({
|
||||
// tsx,
|
||||
// }: Params): Promise<T> {
|
||||
// const dev = isDevelopment();
|
||||
|
||||
// const now = Date.now();
|
||||
// const { BUNX_CWD_MODULE_CACHE_DIR } = grabDirNames();
|
||||
// const target_cache_file_path = path.join(
|
||||
// BUNX_CWD_MODULE_CACHE_DIR,
|
||||
// `server-render-${now}.js`,
|
||||
// );
|
||||
|
||||
// await esbuild.build({
|
||||
// stdin: {
|
||||
// contents: dev ? tsx + `\n// v_${now}` : tsx,
|
||||
// resolveDir: process.cwd(),
|
||||
// loader: "tsx",
|
||||
// },
|
||||
// bundle: true,
|
||||
// format: "esm",
|
||||
// target: "es2020",
|
||||
// platform: "node",
|
||||
// external: [
|
||||
// "react",
|
||||
// "react-dom",
|
||||
// "react/jsx-runtime",
|
||||
// "react/jsx-dev-runtime",
|
||||
// ],
|
||||
// minify: !dev,
|
||||
// define: {
|
||||
// "process.env.NODE_ENV": JSON.stringify(
|
||||
// dev ? "development" : "production",
|
||||
// ),
|
||||
// },
|
||||
// jsx: "automatic",
|
||||
// outfile: target_cache_file_path,
|
||||
// plugins: [tailwindEsbuildPlugin],
|
||||
// });
|
||||
|
||||
// Loader.registry.delete(target_cache_file_path);
|
||||
// const mod = await import(`${target_cache_file_path}?t=${now}`);
|
||||
|
||||
// return mod as T;
|
||||
// }
|
||||
|
||||
// if (!dev) {
|
||||
// const now = Date.now();
|
||||
|
||||
// const final_tsx = dev ? tsx + `\n// v_${now}` : tsx;
|
||||
|
||||
// const result = await esbuild.transform(final_tsx, {
|
||||
// loader: "tsx",
|
||||
// format: "esm",
|
||||
// jsx: "automatic",
|
||||
// minify: !dev,
|
||||
// });
|
||||
|
||||
// const blob = new Blob([result.code], { type: "text/javascript" });
|
||||
// const url = URL.createObjectURL(blob);
|
||||
// const mod = await import(url);
|
||||
|
||||
// URL.revokeObjectURL(url);
|
||||
|
||||
// return mod as T;
|
||||
// }
|
||||
+17
-1
@@ -63,6 +63,23 @@ export type BunextConfig = {
|
||||
| Request
|
||||
| undefined;
|
||||
default_cache_expiry?: number;
|
||||
/**
|
||||
* Maximum number of cached pages kept on disk. New pages are not
|
||||
* cached once this is reached. Defaults to 1000.
|
||||
*/
|
||||
max_cache_entries?: number;
|
||||
/**
|
||||
* By default, pages are not written to the cache when the request
|
||||
* carries a `Cookie` or `Authorization` header, so one user's page is
|
||||
* never served to everyone. Set this to `true` only if your cached
|
||||
* pages never render per-user content.
|
||||
*/
|
||||
cache_credentialed_requests?: boolean;
|
||||
/**
|
||||
* Trust the `X-Forwarded-Proto` header (set this when running behind a
|
||||
* reverse proxy that sets it). Defaults to `false`.
|
||||
*/
|
||||
trust_proxy?: boolean;
|
||||
websocket?: WebSocketHandler<any>;
|
||||
server_options?: Omit<Bun.Serve.Options<any>, "fetch" | "routes">;
|
||||
/**
|
||||
@@ -354,7 +371,6 @@ export type BundlerCTXMap = {
|
||||
url_path: string;
|
||||
file_name: string;
|
||||
css_path?: string;
|
||||
req_url?: string;
|
||||
};
|
||||
|
||||
export type GlobalHMRControllerObject = {
|
||||
|
||||
@@ -11,7 +11,7 @@ export default function grabConstants() {
|
||||
const MaxBundlerRebuilds = 5;
|
||||
const RouteIgnorePatterns = [/\/\(/];
|
||||
|
||||
if (config.pages_exclude_patterns) {
|
||||
if (config?.pages_exclude_patterns) {
|
||||
RouteIgnorePatterns.push(...config.pages_exclude_patterns);
|
||||
}
|
||||
|
||||
|
||||
@@ -65,7 +65,8 @@ export default function grabDirNames(): DirNames {
|
||||
const BUNEXT_PUBLIC_DIR = path.join(BUNX_CWD_DIR, "public");
|
||||
const HYDRATION_DST_DIR = path.join(BUNEXT_PUBLIC_DIR, "pages");
|
||||
const BUNEXT_VENDOR_DIR = path.join(BUNEXT_PUBLIC_DIR, "vendor");
|
||||
const BUNEXT_CACHE_DIR = path.join(BUNEXT_PUBLIC_DIR, "cache");
|
||||
// Kept outside BUNEXT_PUBLIC_DIR: that directory is served over HTTP.
|
||||
const BUNEXT_CACHE_DIR = path.join(BUNX_CWD_DIR, "cache");
|
||||
const HYDRATION_DST_DIR_MAP_JSON_FILE_NAME = "map.json";
|
||||
const HYDRATION_DST_DIR_MAP_JSON_FILE = path.join(
|
||||
HYDRATION_DST_DIR,
|
||||
|
||||
@@ -1,23 +1,54 @@
|
||||
import _ from "lodash";
|
||||
import type { BunxRouteParams } from "../types";
|
||||
import deserializeQuery from "./deserialize-query";
|
||||
import grabConstants from "./grab-constants";
|
||||
import readRequestBody from "./read-request-body";
|
||||
|
||||
type Params = {
|
||||
req: Request;
|
||||
query?: any;
|
||||
/**
|
||||
* Maximum request body size. Defaults to
|
||||
* `ServerDefaultRequestBodyLimitBytes`.
|
||||
*/
|
||||
max_body_bytes?: number;
|
||||
};
|
||||
|
||||
/**
|
||||
* Throws `RequestBodyTooLargeError` if the body exceeds `max_body_bytes`.
|
||||
*/
|
||||
export default async function grabRouteParams({
|
||||
req,
|
||||
req: initial_req,
|
||||
query: passed_query,
|
||||
max_body_bytes,
|
||||
}: Params): Promise<BunxRouteParams> {
|
||||
const url = new URL(req.url);
|
||||
const url = new URL(initial_req.url);
|
||||
|
||||
const query = deserializeQuery(Object.fromEntries(url.searchParams));
|
||||
|
||||
const body = await (async () => {
|
||||
const raw_body = await readRequestBody({
|
||||
req: initial_req,
|
||||
max_bytes:
|
||||
max_body_bytes || grabConstants().ServerDefaultRequestBodyLimitBytes,
|
||||
});
|
||||
|
||||
// The original body stream is consumed above, so hand handlers a fresh
|
||||
// request over the buffered bytes. This keeps `req.text()`,
|
||||
// `req.formData()`, etc. usable (e.g. for webhook signatures/uploads).
|
||||
const req = raw_body
|
||||
? new Request(initial_req.url, {
|
||||
method: initial_req.method,
|
||||
headers: initial_req.headers,
|
||||
body: raw_body,
|
||||
signal: initial_req.signal,
|
||||
})
|
||||
: initial_req;
|
||||
|
||||
const body = (() => {
|
||||
if (initial_req.method == "GET") return undefined;
|
||||
if (!raw_body) return {};
|
||||
try {
|
||||
return req.method == "GET" ? undefined : await req.json();
|
||||
return JSON.parse(new TextDecoder().decode(raw_body) || "{}");
|
||||
} catch (error) {
|
||||
return {};
|
||||
}
|
||||
|
||||
@@ -8,17 +8,39 @@ export default function isSafePath({
|
||||
filePath: string;
|
||||
allowedDir: string;
|
||||
}): boolean {
|
||||
const allowed = path.resolve(allowedDir);
|
||||
const resolved = path.resolve(filePath);
|
||||
if (!resolved.startsWith(allowedDir + path.sep) && resolved !== allowedDir) {
|
||||
|
||||
if (!isInside(resolved, allowed)) {
|
||||
return false;
|
||||
}
|
||||
|
||||
try {
|
||||
const real = realpathSync(resolved);
|
||||
return (
|
||||
real.startsWith(allowedDir + path.sep) || real === allowedDir
|
||||
);
|
||||
return isInside(realpathSync(resolved), resolveRealDir(allowed));
|
||||
} catch {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
function isInside(target: string, dir: string) {
|
||||
return target === dir || target.startsWith(dir + path.sep);
|
||||
}
|
||||
|
||||
const REAL_DIRS = new Map<string, string>();
|
||||
|
||||
/**
|
||||
* Resolves symlinks in the allowed directory itself (e.g. a project under a
|
||||
* symlinked path), so real file paths inside it still match.
|
||||
*/
|
||||
function resolveRealDir(dir: string) {
|
||||
const cached = REAL_DIRS.get(dir);
|
||||
if (cached) return cached;
|
||||
|
||||
try {
|
||||
const real = realpathSync(dir);
|
||||
REAL_DIRS.set(dir, real);
|
||||
return real;
|
||||
} catch {
|
||||
return dir;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,61 @@
|
||||
export class RequestBodyTooLargeError extends Error {
|
||||
status = 413;
|
||||
|
||||
constructor(max_bytes: number) {
|
||||
super(`Request body exceeds ${max_bytes} bytes`);
|
||||
this.name = "RequestBodyTooLargeError";
|
||||
}
|
||||
}
|
||||
|
||||
type Params = {
|
||||
req: Request;
|
||||
max_bytes: number;
|
||||
};
|
||||
|
||||
/**
|
||||
* Reads the whole request body, aborting as soon as it grows past
|
||||
* `max_bytes` so oversized (or chunked, length-less) bodies are never fully
|
||||
* buffered. Returns `undefined` when the request has no body.
|
||||
*/
|
||||
export default async function readRequestBody({
|
||||
req,
|
||||
max_bytes,
|
||||
}: Params): Promise<Uint8Array | undefined> {
|
||||
if (req.method == "GET" || req.method == "HEAD" || !req.body) {
|
||||
return undefined;
|
||||
}
|
||||
|
||||
const content_length = Number(req.headers.get("content-length"));
|
||||
|
||||
if (content_length > max_bytes) {
|
||||
throw new RequestBodyTooLargeError(max_bytes);
|
||||
}
|
||||
|
||||
const reader = req.body.getReader();
|
||||
const chunks: Uint8Array[] = [];
|
||||
let total = 0;
|
||||
|
||||
while (true) {
|
||||
const { done, value } = await reader.read();
|
||||
if (done) break;
|
||||
|
||||
total += value.byteLength;
|
||||
|
||||
if (total > max_bytes) {
|
||||
await reader.cancel();
|
||||
throw new RequestBodyTooLargeError(max_bytes);
|
||||
}
|
||||
|
||||
chunks.push(value);
|
||||
}
|
||||
|
||||
const body = new Uint8Array(total);
|
||||
let offset = 0;
|
||||
|
||||
for (const chunk of chunks) {
|
||||
body.set(chunk, offset);
|
||||
offset += chunk.byteLength;
|
||||
}
|
||||
|
||||
return body;
|
||||
}
|
||||
@@ -0,0 +1,17 @@
|
||||
/**
|
||||
* # Serialize a value as JSON that is safe to embed in an inline `<script>`
|
||||
*
|
||||
* Escapes `<`, `>`, `&`, U+2028 and U+2029 so the payload can never close
|
||||
* the script tag (`</script>`), open an HTML comment (`<!--`) or otherwise
|
||||
* change the HTML parser state.
|
||||
*/
|
||||
export default function serializeForScript(value: any): string {
|
||||
const json = JSON.stringify(value ?? null) ?? "null";
|
||||
|
||||
return json
|
||||
.replace(/</g, "\\u003c")
|
||||
.replace(/>/g, "\\u003e")
|
||||
.replace(/&/g, "\\u0026")
|
||||
.replace(/\u2028/g, "\\u2028")
|
||||
.replace(/\u2029/g, "\\u2029");
|
||||
}
|
||||
Reference in New Issue
Block a user