@cube-drone/marquee-turbolink 0.6.0 → 0.6.1

package/dist/card.js

@@ -45,7 +45,7 @@ export function renderCard(target, summary, level) {
         card += `<span class="mq-turbolink-desc">${escapeText(summary.description)}</span>`;
     }
     if (level === "full" && summary.image !== undefined) {
-        card += `<img class="mq-turbolink-thumb" src="${escapeAttr(summary.image)}" alt="" loading="lazy">`;
+        card += `<img class="mq-turbolink-thumb" src="${escapeAttr(summary.image)}" alt="" loading="lazy" referrerpolicy="no-referrer">`;
     }
     return `<span class="mq-turbolink-card">${card}</span>`;
 }

package/dist/index.d.ts

@@ -31,10 +31,13 @@ export declare function turbolinkStyles(plugins: TurbolinkPlugin[]): string;
 export declare function composeTurbolinks(plugins: TurbolinkPlugin[], resolved?: Map<string, unknown>): (target: string, level: TurbolinkLevel) => string | null;
 /** The fetch-ahead pass: run every matching plugin's resolve() over a
  * target list, yielding the map composeTurbolinks() consumes. Targets
- * resolve concurrently (wall-clock is the slowest fetch, not the sum);
- * within one target, plugins still run in order - first resolver wins,
- * like first renderer. */
-export declare function resolveTargets(targets: string[], plugins: TurbolinkPlugin[]): Promise<Map<string, unknown>>;
+ * resolve concurrently but BOUNDED (`concurrency`, default 8) - a link-heavy
+ * document shouldn't open hundreds of simultaneous sockets, exhaust file
+ * descriptors, or trip a host's rate limiter. Within one target, plugins
+ * still run in order - first resolver wins, like first renderer. */
+export declare function resolveTargets(targets: string[], plugins: TurbolinkPlugin[], opts?: {
+    concurrency?: number;
+}): Promise<Map<string, unknown>>;
 /** Every turbolink target in a parsed document (bare-paragraph nodes and
  * explicit :::turbolink directives) - the fetch-ahead pass's shopping list. */
 export declare function turbolinkTargets(node: Node): string[];

package/dist/index.js

@@ -49,28 +49,38 @@ export function composeTurbolinks(plugins, resolved) {
 }
 /** The fetch-ahead pass: run every matching plugin's resolve() over a
  * target list, yielding the map composeTurbolinks() consumes. Targets
- * resolve concurrently (wall-clock is the slowest fetch, not the sum);
- * within one target, plugins still run in order - first resolver wins,
- * like first renderer. */
-export async function resolveTargets(targets, plugins) {
+ * resolve concurrently but BOUNDED (`concurrency`, default 8) - a link-heavy
+ * document shouldn't open hundreds of simultaneous sockets, exhaust file
+ * descriptors, or trip a host's rate limiter. Within one target, plugins
+ * still run in order - first resolver wins, like first renderer. */
+export async function resolveTargets(targets, plugins, opts = {}) {
     const resolved = new Map();
-    await Promise.all([...new Set(targets)].map(async (target) => {
-        for (const plugin of plugins) {
-            if (plugin.resolve === undefined || !plugin.match(target)) {
-                continue;
-            }
-            try {
-                const data = await plugin.resolve(target);
-                if (data !== null && data !== undefined) {
-                    resolved.set(`${plugin.name}\n${target}`, data);
-                    break; // first resolver wins, like first renderer
+    const unique = [...new Set(targets)];
+    const limit = Math.max(1, opts.concurrency ?? 8);
+    let next = 0;
+    // A fixed pool of workers pulling from a shared cursor: JS is single-
+    // threaded, so `next++` between awaits can't race.
+    const worker = async () => {
+        while (next < unique.length) {
+            const target = unique[next++];
+            for (const plugin of plugins) {
+                if (plugin.resolve === undefined || !plugin.match(target)) {
+                    continue;
+                }
+                try {
+                    const data = await plugin.resolve(target);
+                    if (data !== null && data !== undefined) {
+                        resolved.set(`${plugin.name}\n${target}`, data);
+                        break; // first resolver wins, like first renderer
+                    }
+                }
+                catch {
+                    // a failed fetch is a plain link, not a failed render
                 }
-            }
-            catch {
-                // a failed fetch is a plain link, not a failed render
             }
         }
-    }));
+    };
+    await Promise.all(Array.from({ length: Math.min(limit, unique.length) }, worker));
     return resolved;
 }
 /** Every turbolink target in a parsed document (bare-paragraph nodes and

package/dist/opengraph.js

@@ -41,6 +41,46 @@ export function parseOpenGraph(html) {
     }
     return summary.title === undefined ? null : summary;
 }
+const MAX_OG_BYTES = 128 * 1024;
+/** Read at most maxBytes of the body, then cancel the stream. The metadata we
+ * want lives in the first N KiB (parseOpenGraph caps its parse there too);
+ * this bounds the *download*, so a hostile or merely huge page can't blow up a
+ * build's memory before the parse cap ever applies. */
+async function readCapped(res, maxBytes) {
+    if (res.body === null) {
+        return "";
+    }
+    const reader = res.body.getReader();
+    const buf = new Uint8Array(maxBytes);
+    let len = 0;
+    try {
+        while (len < maxBytes) {
+            const { done, value } = await reader.read();
+            if (done) {
+                break;
+            }
+            const take = Math.min(value.length, maxBytes - len);
+            buf.set(value.subarray(0, take), len);
+            len += take;
+        }
+    }
+    finally {
+        await reader.cancel().catch(() => undefined); // stop the transfer early
+    }
+    return new TextDecoder().decode(buf.subarray(0, len));
+}
+/** Resolve a possibly-relative URL against a base, keeping only http(s). An
+ * og:image is relative to the page it came from, not our output; and a
+ * `javascript:`/`data:` image src should never reach a reader's card. */
+function absoluteHttp(url, base) {
+    try {
+        const u = new URL(url, base);
+        return u.protocol === "http:" || u.protocol === "https:" ? u.href : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 export const opengraphPlugin = {
     name: "opengraph",
     match: (t) => /^https?:\/\//.test(t),
@@ -55,7 +95,25 @@ export const opengraphPlugin = {
         if (!res.ok) {
             return null;
         }
-        return parseOpenGraph(await res.text());
+        // A linked image/PDF/zip has no OpenGraph to find - don't stream a binary
+        // body just to parse nothing. (Empty/absent type: allow, and let the
+        // parse decide.)
+        const type = res.headers.get("content-type") ?? "";
+        if (type !== "" && !/text\/html|application\/xhtml|text\/plain/i.test(type)) {
+            return null;
+        }
+        const summary = parseOpenGraph(await readCapped(res, MAX_OG_BYTES));
+        if (summary !== null && summary.image !== undefined) {
+            // res.url is the post-redirect URL: the right base for a relative image.
+            const abs = absoluteHttp(summary.image, res.url || target);
+            if (abs === undefined) {
+                delete summary.image;
+            }
+            else {
+                summary.image = abs;
+            }
+        }
+        return summary;
     },
     render(target, { level, data }) {
         if (data === undefined || data === null) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cube-drone/marquee-turbolink",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Pluggable turbolink rendering for Marquee: link expanders as plugins, plain link as the floor",
   "license": "MPL-2.0",
   "repository": {
@@ -34,7 +34,7 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@cube-drone/marquee-parser": "^0.6.0"
+    "@cube-drone/marquee-parser": "^0.6.1"
   },
   "devDependencies": {
     "@types/node": "^24.0.0",

package/src/card.ts

@@ -61,7 +61,7 @@ export function renderCard(
     card += `<span class="mq-turbolink-desc">${escapeText(summary.description)}</span>`;
   }
   if (level === "full" && summary.image !== undefined) {
-    card += `<img class="mq-turbolink-thumb" src="${escapeAttr(summary.image)}" alt="" loading="lazy">`;
+    card += `<img class="mq-turbolink-thumb" src="${escapeAttr(summary.image)}" alt="" loading="lazy" referrerpolicy="no-referrer">`;
   }
   return `<span class="mq-turbolink-card">${card}</span>`;
 }

package/src/index.ts

@@ -81,16 +81,24 @@ export function composeTurbolinks(
 
 /** The fetch-ahead pass: run every matching plugin's resolve() over a
  * target list, yielding the map composeTurbolinks() consumes. Targets
- * resolve concurrently (wall-clock is the slowest fetch, not the sum);
- * within one target, plugins still run in order - first resolver wins,
- * like first renderer. */
+ * resolve concurrently but BOUNDED (`concurrency`, default 8) - a link-heavy
+ * document shouldn't open hundreds of simultaneous sockets, exhaust file
+ * descriptors, or trip a host's rate limiter. Within one target, plugins
+ * still run in order - first resolver wins, like first renderer. */
 export async function resolveTargets(
   targets: string[],
   plugins: TurbolinkPlugin[],
+  opts: { concurrency?: number } = {},
 ): Promise<Map<string, unknown>> {
   const resolved = new Map<string, unknown>();
-  await Promise.all(
-    [...new Set(targets)].map(async (target) => {
+  const unique = [...new Set(targets)];
+  const limit = Math.max(1, opts.concurrency ?? 8);
+  let next = 0;
+  // A fixed pool of workers pulling from a shared cursor: JS is single-
+  // threaded, so `next++` between awaits can't race.
+  const worker = async (): Promise<void> => {
+    while (next < unique.length) {
+      const target = unique[next++]!;
       for (const plugin of plugins) {
         if (plugin.resolve === undefined || !plugin.match(target)) {
           continue;
@@ -105,8 +113,9 @@ export async function resolveTargets(
           // a failed fetch is a plain link, not a failed render
         }
       }
-    }),
-  );
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(limit, unique.length) }, worker));
   return resolved;
 }
 

package/src/opengraph.ts

@@ -50,6 +50,47 @@ export function parseOpenGraph(html: string): TurbolinkSummary | null {
   return summary.title === undefined ? null : summary;
 }
 
+const MAX_OG_BYTES = 128 * 1024;
+
+/** Read at most maxBytes of the body, then cancel the stream. The metadata we
+ * want lives in the first N KiB (parseOpenGraph caps its parse there too);
+ * this bounds the *download*, so a hostile or merely huge page can't blow up a
+ * build's memory before the parse cap ever applies. */
+async function readCapped(res: Response, maxBytes: number): Promise<string> {
+  if (res.body === null) {
+    return "";
+  }
+  const reader = res.body.getReader();
+  const buf = new Uint8Array(maxBytes);
+  let len = 0;
+  try {
+    while (len < maxBytes) {
+      const { done, value } = await reader.read();
+      if (done) {
+        break;
+      }
+      const take = Math.min(value.length, maxBytes - len);
+      buf.set(value.subarray(0, take), len);
+      len += take;
+    }
+  } finally {
+    await reader.cancel().catch(() => undefined); // stop the transfer early
+  }
+  return new TextDecoder().decode(buf.subarray(0, len));
+}
+
+/** Resolve a possibly-relative URL against a base, keeping only http(s). An
+ * og:image is relative to the page it came from, not our output; and a
+ * `javascript:`/`data:` image src should never reach a reader's card. */
+function absoluteHttp(url: string, base: string): string | undefined {
+  try {
+    const u = new URL(url, base);
+    return u.protocol === "http:" || u.protocol === "https:" ? u.href : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 export const opengraphPlugin: TurbolinkPlugin = {
   name: "opengraph",
   match: (t) => /^https?:\/\//.test(t),
@@ -64,7 +105,24 @@ export const opengraphPlugin: TurbolinkPlugin = {
     if (!res.ok) {
       return null;
     }
-    return parseOpenGraph(await res.text());
+    // A linked image/PDF/zip has no OpenGraph to find - don't stream a binary
+    // body just to parse nothing. (Empty/absent type: allow, and let the
+    // parse decide.)
+    const type = res.headers.get("content-type") ?? "";
+    if (type !== "" && !/text\/html|application\/xhtml|text\/plain/i.test(type)) {
+      return null;
+    }
+    const summary = parseOpenGraph(await readCapped(res, MAX_OG_BYTES));
+    if (summary !== null && summary.image !== undefined) {
+      // res.url is the post-redirect URL: the right base for a relative image.
+      const abs = absoluteHttp(summary.image, res.url || target);
+      if (abs === undefined) {
+        delete summary.image;
+      } else {
+        summary.image = abs;
+      }
+    }
+    return summary;
   },
   render(target, { level, data }) {
     if (data === undefined || data === null) {