@apowerb/apowerb-sdk 0.1.3 → 0.1.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apowerb/apowerb-sdk",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "JavaScript SDK for the apowerb backend: agents, tools, RAG, BI, webhooks and billing. Dependency-free, runs in the browser and in Node.",
   "license": "MIT",
   "repository": {

package/src/authStorage.js

@@ -500,6 +500,30 @@ export const realAuthApi = {
 /**
  * Mock API for authentication (for development/testing)
  */
+/**
+ * Shape check for an email address, without a backtracking regex.
+ *
+ * The previous `/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/` is polynomial: the two
+ * greedy classes around the dot make the engine retry every split of the
+ * domain when there is no dot to find. This only guards the mock backend,
+ * but the module ships in the published SDK bundle, so the pattern leaves
+ * with it.
+ *
+ * Same verdict as before: one `@`, non-empty on both sides, no whitespace,
+ * and a dot inside the domain with something on either side.
+ */
+function looksLikeEmail(value) {
+  const parts = value.split("@");
+  if (parts.length !== 2) return false;
+
+  const [local, domain] = parts;
+  if (!local || !domain) return false;
+  if (/\s/.test(value)) return false;
+
+  const dot = domain.indexOf(".");
+  return dot > 0 && dot < domain.length - 1;
+}
+
 export const mockAuthApi = {
   /**
    * Demo credentials for testing
@@ -604,7 +628,7 @@ export const mockAuthApi = {
       throw new Error("Password must be at least 6 characters");
     }
 
-    if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
+    if (!looksLikeEmail(email)) {
       throw new Error("Invalid email format");
     }
 

package/src/config.js

@@ -66,7 +66,22 @@ export function resetClientConfig() {
  */
 export function apiUrl(path) {
   const base = config.baseUrl || "";
-  return base ? `${base.replace(/\/+$/, "")}${path}` : path;
+  return base ? `${stripTrailingSlashes(base)}${path}` : path;
+}
+
+/**
+ * Strip trailing slashes without a regular expression.
+ *
+ * `replace(/\/+$/, "")` did the same job, but `\/+$` is polynomial: on a
+ * string of N slashes that does not end with one, the engine retries from
+ * every position, so O(N squared). `baseUrl` normally comes from the
+ * application's own configuration, but nothing in this module guarantees
+ * that -- and this loop is linear by construction.
+ */
+function stripTrailingSlashes(value) {
+  let end = value.length;
+  while (end > 0 && value[end - 1] === "/") end -= 1;
+  return value.slice(0, end);
 }
 
 export function getAuthToken() {