@qbix/q 1.0.5

package/dist/methods/Q/Sandbox/run.js

@@ -0,0 +1,392 @@
+Q.exports(function (Q) {
+	/**
+	 * Q plugin's front-end code
+	 * @module Q
+	 * @class Q.Sandbox
+	 */
+
+	/**
+	 * Runs code safely inside a sandboxed Web Worker.
+	 * If `options.name` is provided, a persistent worker is reused.
+	 *
+	 * @static
+	 * @method run
+	 * @param {String} code JavaScript source to execute
+	 * @param {Object} [context] Variables accessible inside the sandbox
+	 * @param {Object} [methods] Async RPC methods exposed as stubs
+	 * @param {Object} [options] Additional sandbox configuration
+	 * @param {String} [options.name] Reuse a persistent sandbox worker under this name
+	 * @param {Number} [options.timeout=2000] Timeout in milliseconds before aborting execution
+	 * @param {Boolean} [options.db=false] Whether to expose indexedDB inside sandbox
+	 * @param {Boolean|Object} [options.deterministic=false] Set to true or object to make the code run deterministically
+	 * @param {Number} [options.deterministic.seed=1] Seed for deterministic RNG
+	 * @return {Q.Promise} Resolves with result or rejects on error
+	 */
+	return function Q_Sandbox_run(code, context, methods, options) {
+		context = context || {};
+		methods = methods || {};
+		options = options || {};
+
+		if (!Q.Sandbox._runners) Q.Sandbox._runners = {};
+
+		function SandboxRunner(defaults) {
+			this.defaults = {
+				timeout: (defaults && defaults.timeout) || 2000,
+				db: !!(defaults && defaults.db)
+			};
+			this.worker = null;
+			this.url = null;
+		}
+
+		SandboxRunner.prototype.createWorker = function () {
+			const allowDB = !!this.defaults.db;
+			const indexedDBExpr = allowDB ? 'indexedDB' : 'undefined';
+
+			const script = `
+				// --- Hard-disable network & import capabilities ---
+				self.fetch = undefined;
+				self.XMLHttpRequest = undefined;
+				self.WebSocket = undefined;
+				self.EventSource = undefined;
+				self.importScripts = undefined;
+
+				// --- Safe stubs instead of deleting env ---
+				try {
+					Object.defineProperty(self, "navigator", {
+						value: { userAgent: "sandbox", language: "en-US" },
+						configurable: false
+					});
+				} catch {}
+
+				self.location = undefined;
+				self.caches = undefined;
+
+				// Optional DB
+				if (!${allowDB}) {
+					self.indexedDB = undefined;
+				}
+
+				// --- Block prototype mutation entry points (Safari-safe) ---
+				try {
+					Object.defineProperty(Object.prototype, "__defineSetter__", { value: undefined });
+					Object.defineProperty(Object.prototype, "__defineGetter__", { value: undefined });
+					Object.defineProperty(Object.prototype, "__lookupGetter__", { value: undefined });
+					Object.defineProperty(Object.prototype, "__lookupSetter__", { value: undefined });
+				} catch {}
+
+				let rpcCounter = 0;
+				const pending = {};
+
+				function call(method, args) {
+					return new Promise((resolve, reject) => {
+						const id = ++rpcCounter;
+						pending[id] = { resolve, reject };
+						self.postMessage({ type: "rpc", id, method, args });
+					});
+				}
+
+				self.onmessage = async function (e) {
+					const msg = e.data;
+
+					if (msg && msg.type === "rpcResult") {
+						const p = pending[msg.id];
+						if (!p) return;
+						delete pending[msg.id];
+						msg.ok ? p.resolve(msg.result) : p.reject(msg.error);
+						return;
+					}
+
+					try {
+						const { code, context, methodNames, deterministic } = msg;
+
+						let __seed = 1;
+						if (deterministic && typeof deterministic === "object" && deterministic.seed !== undefined) {
+							__seed = deterministic.seed >>> 0;
+						}
+
+						const __timers = [];
+						let __timerGuard = 1000;
+
+						// --- Deterministic runtime injected only if requested ---
+						if (deterministic) {
+							let __randSeed = (__seed >>> 0) || 1;
+
+							function __rand(){
+								__randSeed = (__randSeed * 1664525 + 1013904223) >>> 0;
+								return __randSeed / 4294967296;
+							}
+
+							Object.defineProperty(self, "__deterministicSeed", {
+								value: __randSeed,
+								writable: false,
+								configurable: false
+							});
+
+							Math.random = __rand;
+							Object.defineProperty(Math, "random", {
+								value: __rand,
+								writable: false,
+								configurable: false
+							});
+
+							const __start = 0;
+
+							Date.now = function(){ return __start };
+
+							if (typeof performance !== "undefined") {
+								performance.now = function(){ return 0 };
+							}
+
+							const __RealDate = Date;
+
+							function DeterministicDate(...args) {
+								if (!(this instanceof DeterministicDate)) {
+									return new __RealDate(__start).toString();
+								}
+								if (args.length === 0) {
+									return new __RealDate(__start);
+								}
+								return new __RealDate(...args);
+							}
+
+							DeterministicDate.UTC = __RealDate.UTC;
+							DeterministicDate.parse = __RealDate.parse;
+							DeterministicDate.prototype = __RealDate.prototype;
+							DeterministicDate.prototype.constructor = DeterministicDate;
+
+							Date = DeterministicDate;
+
+							setTimeout = function(fn){ __timers.push(fn); return __timers.length };
+							setInterval = function(fn){ __timers.push(fn); return __timers.length };
+
+							clearTimeout = function(){};
+							clearInterval = function(){};
+
+							if (typeof crypto !== "undefined") {
+								crypto.getRandomValues = function(arr){
+									for (let i=0;i<arr.length;i++){
+										arr[i] = Math.floor(__rand()*256);
+									}
+									return arr;
+								};
+
+								crypto.randomUUID = function(){
+									return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g,function(c){
+										const r = Math.floor(__rand()*16);
+										return (c==='x'?r:(r&0x3|0x8)).toString(16);
+									});
+								};
+							}
+
+							self.fetch = undefined;
+							self.XMLHttpRequest = undefined;
+							self.WebSocket = undefined;
+							self.EventSource = undefined;
+							self.navigator = undefined;
+
+							try {
+								Object.freeze(Math);
+								Object.freeze(Date);
+							} catch {}
+						}
+
+						const methods = {};
+						for (const name of methodNames) {
+							methods[name] = (...args) => call(name, args);
+						}
+
+						const keys = Object.keys(context || {}).concat("methods");
+						const values = Object.values(context || {}).concat(methods);
+
+						const AsyncFunction =
+							Object.getPrototypeOf(async function () {}).constructor;
+
+						const fn = new AsyncFunction(
+							...keys,
+							'"use strict";\\n' +
+							'const fetch = undefined;\\n' +
+							'const XMLHttpRequest = undefined;\\n' +
+							'const WebSocket = undefined;\\n' +
+							'const EventSource = undefined;\\n' +
+							'const importScripts = undefined;\\n' +
+							'const indexedDB = ${allowDB ? 'self.indexedDB' : 'undefined'};\\n' +
+							'const IDBFactory = undefined;\\n' +
+							'const IDBDatabase = undefined;\\n' +
+							'const IDBObjectStore = undefined;\\n' +
+							'const __user = async function(){\\n' +
+							code + '\\n' +
+							'};\\n' +
+							'return __user();'
+						);
+
+						const result = await fn(...values);
+
+						// run deterministic timers
+						while (__timers.length && __timerGuard--) {
+							try { __timers.shift()(); } catch {}
+						}
+						__timers.length = 0;
+
+						self.postMessage({ type: "done", ok: true, result });
+
+					} catch (err) {
+						self.postMessage({
+							type: "done",
+							ok: false,
+							error: String(err && err.message || err)
+						});
+					}
+				};
+			`;
+
+			const blob = new Blob([script], { type: "application/javascript" });
+			this.url = URL.createObjectURL(blob);
+			this.worker = new Worker(this.url);
+			return this.worker;
+		};
+
+		SandboxRunner.prototype.run = function (code, ctx, methods, opts) {
+			opts = opts || {};
+			const worker = this.worker || this.createWorker();
+			const timeoutMs = opts.timeout || this.defaults.timeout;
+
+			let safeCtx;
+			try {
+				safeCtx = JSON.parse(JSON.stringify(ctx));
+			} catch {
+				safeCtx = {};
+			}
+
+			const methodNames = Object.keys(methods);
+
+			return new Q.Promise(function (resolve, reject) {
+				let timer;
+
+				const runner = this;
+				const cleanup = () => {
+					clearTimeout(timer);
+					if (!opts.name) {
+						try {
+							URL.revokeObjectURL(runner.url);
+							worker.terminate();
+						} catch {}
+					}
+				};
+
+				const rpcLog = [];
+				let finished = false;
+
+				worker.onmessage = function (e) {
+					const msg = e.data;
+
+					if (msg && msg.type === "rpc") {
+						const fn = methods[msg.method];
+						if (!fn) {
+							worker.postMessage({
+								type: "rpcResult",
+								id: msg.id,
+								ok: false,
+								error: "Unknown method: " + msg.method
+							});
+							return;
+						}
+
+						Promise.resolve()
+							.then(() => fn(...msg.args))
+							.then(result => {
+								rpcLog.push({
+									method: msg.method,
+									args: msg.args,
+									result
+								});
+								worker.postMessage({
+									type: "rpcResult",
+									id: msg.id,
+									ok: true,
+									result
+								});
+							})
+							.catch(err => {
+								rpcLog.push({
+									method: msg.method,
+									args: msg.args,
+									error: String(err && err.message || err)
+								});
+
+								worker.postMessage({
+									type: "rpcResult",
+									id: msg.id,
+									ok: false,
+									error: String(err && err.message || err)
+								});
+							});
+						return;
+					}
+
+					if (msg && msg.type === "done") {
+						if (finished) return;
+						finished = true;
+						
+						const execution = {
+							code,
+							context: safeCtx,
+							seed: (opts.deterministic && typeof opts.deterministic === "object")
+								? opts.deterministic.seed
+								: (opts.deterministic ? 1 : undefined),
+							rpc: rpcLog,
+							ok: !!msg.ok,
+							result: msg.ok ? msg.result : undefined,
+							error: msg.ok ? undefined : msg.error
+						};
+
+						Q.Data.digest("SHA-256", JSON.stringify(execution))
+						.then(function (bytes) {
+							var hash = Q.Data.toHex(bytes);
+							cleanup();
+							if (msg.ok) {
+								resolve({
+									result: msg.result,
+									hash
+								});
+							} else {
+								const err = new Error(msg.error || "Sandbox error");
+								err.hash = hash;
+								reject(err);
+							}
+						});
+					}
+				};
+
+				worker.onerror = function (err) {
+					cleanup();
+					reject(err.message || String(err));
+				};
+
+				timer = setTimeout(function () {
+					cleanup();
+					reject(new Error("Worker timeout / infinite loop"));
+				}, timeoutMs);
+
+				worker.postMessage({
+					code,
+					context: safeCtx,
+					methodNames,
+					deterministic: opts.deterministic || false
+				});
+			}.bind(this));
+		};
+
+		let runner;
+		if (options.name) {
+			runner = Q.Sandbox._runners[options.name];
+			if (!runner) {
+				runner = new SandboxRunner(options);
+				Q.Sandbox._runners[options.name] = runner;
+			}
+		} else {
+			runner = new SandboxRunner(options);
+		}
+
+		return runner.run(code, context, methods, options);
+	};
+});

package/dist/methods/Q/Tool/define/component.js

@@ -0,0 +1,218 @@
+Q.exports(function (Q) {
+
+    /**
+     * Registers a Custom Element (Web Component) for a Q tool.
+     * Only active when Q.Tool.define.components === true.
+     *
+     * Equivalent to writing:
+     *   <div class="Q_tool Streams_chat_tool" data-streams-chat='{"publisherId":"NYU"}'></div>
+     * and having Q.activate() find it. The web component syntax is purely a
+     * translation shim — connectedCallback dresses the element and calls Q.activate(this).
+     *
+     * Attribute → option mapping:
+     *   - foo-bar="2"  → nested: options.foo.bar = 2
+     *   - fooBar="2"   → flat if schema declares it, else options.fooBar = 2
+     *   - baz          → true (bare attribute, no value)
+     *
+     * Schema is declared as the last element of stateKeys if it's a plain object:
+     *   stateKeys = ["editable", { count: Q.Types.Integer, visible: Q.Types.Boolean }]
+     * Leaf nodes have a .from(string) method. Branch nodes are plain objects without .from().
+     * Without a schema, automagic inference handles bool/int/float/JSON/string.
+     *
+     * @method Q.Tool.define.component
+     * @param {String} name Tool name e.g. "Streams/chat"
+     * @param {Function} ctor Tool constructor (already registered)
+     */
+    return function Q_Tool_define_component(name, ctor) {
+        if (typeof customElements === 'undefined') {
+            return;
+        }
+
+        // "Streams/chat" -> "streams-chat"
+        var tagName = name.toLowerCase().replace(/[/_]/g, '-');
+
+        if (customElements.get(tagName)) {
+            return;
+        }
+
+        // Extract schema from last element of stateKeys if it's a plain object
+        var stateKeys = ctor.stateKeys;
+        var schema = null;
+        if (Array.isArray(stateKeys) && stateKeys.length) {
+            var last = stateKeys[stateKeys.length - 1];
+            if (Q.isPlainObject(last)) {
+                schema = last;
+            }
+        }
+
+        // attrTypeMap: full-hyphenated-path -> Q.Types.X descriptor
+        // attrNameMap: full-hyphenated-path -> key path array into options
+        var attrTypeMap = {};
+        var attrNameMap = {};
+        if (schema) {
+            _flattenSchema(schema, [], attrTypeMap, attrNameMap);
+        }
+
+        /**
+         * Recursively walk schema. Leaf nodes have .from(), branch nodes don't.
+         * Keys into the maps are the FULL hyphenated path e.g. "foo-bar-baz"
+         * to avoid collisions between keys at different nesting levels.
+         */
+        function _flattenSchema(node, path, typeMap, nameMap) {
+            for (var k in node) {
+                if (!node.hasOwnProperty(k)) continue;
+                var val = node[k];
+                var newPath = path.concat([k]);
+                var hyphenPath = newPath.map(_camelToHyphen).join('-');
+                if (val && typeof val.from === 'function') {
+                    typeMap[hyphenPath] = val;
+                    nameMap[hyphenPath] = newPath;
+                } else if (Q.isPlainObject(val)) {
+                    _flattenSchema(val, newPath, typeMap, nameMap);
+                }
+            }
+        }
+
+        function _camelToHyphen(str) {
+            return str.replace(/([A-Z])/g, function(c) {
+                return '-' + c.toLowerCase();
+            });
+        }
+
+        /**
+         * Resolve one attribute name+value to { path, value }.
+         * Resolution order:
+         *   1. Full hyphenated path match in schema (e.g. "foo-bar" -> ["foo","bar"])
+         *   2. Hyphen-split into nested path
+         *   3. Single segment: flat key preserving original casing
+         * Bare attribute (no value) -> true, or type.from('') if schema declares it.
+         */
+        function _resolveAttr(attrName, attrValue) {
+            var lower = attrName.toLowerCase();
+            var type = attrTypeMap[lower] || null;
+            var path = attrNameMap[lower] || null;
+
+            if (!path) {
+                var parts = lower.split('-');
+                path = parts.length > 1 ? parts : [attrName];
+            }
+
+            var converted;
+            if (attrValue === null) {
+                // bare attribute
+                converted = type ? type.from('') : true;
+            } else if (type) {
+                converted = type.from(attrValue);
+            } else {
+                converted = _infer(attrValue);
+            }
+
+            return { path: path, value: converted };
+        }
+
+        /**
+         * Automagic inference when no schema type is declared.
+         * Order: "true"/"false" -> Boolean, integer, float, JSON, String.
+         */
+        function _infer(str) {
+            if (str === 'true')  return true;
+            if (str === 'false') return false;
+            if (str === 'null')  return null;
+            if (str === '')      return true;
+            if (/^-?\d+$/.test(str)) return parseInt(str, 10);
+            if (/^-?\d*\.\d+$/.test(str)) return parseFloat(str);
+            if (str[0] === '{' || str[0] === '[') {
+                try { return JSON.parse(str); } catch(e) {}
+            }
+            return str;
+        }
+
+        /**
+         * Build options object from all non-standard attributes on the element.
+         * Skips: id, class, style, slot, and all data-* except the tool's own.
+         * The tool's own data-* attribute (e.g. data-streams-chat) is parsed as
+         * a raw JSON blob and merged as the base, with individual attrs on top.
+         */
+        function _attrsToOptions(element) {
+            var options = {};
+            var skip = { id: 1, 'class': 1, style: 1, slot: 1 };
+            var ownDataAttr = 'data-' + tagName;
+            var attrs = element.attributes;
+
+            for (var i = 0; i < attrs.length; i++) {
+                var attr = attrs[i];
+                var aName = attr.name;
+
+                if (skip[aName]) continue;
+
+                // Legacy JSON blob on the tool's own data- attr: merge as base
+                if (aName === ownDataAttr) {
+                    try {
+                        var blob = JSON.parse(attr.value);
+                        if (Q.isPlainObject(blob)) {
+                            Q.extend(options, blob);
+                        }
+                    } catch(e) {}
+                    continue;
+                }
+
+                // Skip other data-* passthrough attributes
+                if (aName.slice(0, 5) === 'data-') continue;
+
+                var resolved = _resolveAttr(aName, attr.value === '' ? null : attr.value);
+                Q.setObject(resolved.path, resolved.value, options);
+            }
+
+            return options;
+        }
+
+        // observedAttributes: only schema-declared attrs trigger attributeChangedCallback.
+        // Undeclared attrs are still read at connectedCallback time via _attrsToOptions.
+        var observedAttrNames = Object.keys(attrTypeMap);
+
+        var ntt = name.split('/').join('_');
+
+        class ToolElement extends HTMLElement {
+
+            connectedCallback() {
+                this.classList.add('Q_tool', ntt + '_tool');
+                var options = _attrsToOptions(this);
+                if (!Q.isEmpty(options)) {
+                    this.setAttribute(
+                        'data-' + tagName,
+                        JSON.stringify(options)
+                    );
+                }
+                Q.activate(this);
+            }
+
+            disconnectedCallback() {
+                if (this.getAttribute('data-Q-retain') !== null) return;
+                Q.Tool.remove(this);
+            }
+
+            attributeChangedCallback(attrName, oldVal, newVal) {
+                if (oldVal === newVal) return;
+                // Fires only for schema-declared attributes after initial connection.
+                // Before connection, the change will be picked up by connectedCallback.
+                var tool = Q.Tool.from(this, name);
+                if (!tool) return;
+                var resolved = _resolveAttr(attrName, newVal === '' ? null : newVal);
+                var update = {};
+                Q.setObject(resolved.path, resolved.value, update);
+                tool.setState(update);
+            }
+
+            static get observedAttributes() {
+                return observedAttrNames;
+            }
+        }
+
+        try {
+            customElements.define(tagName, ToolElement);
+        } catch(e) {
+            console.warn('Q.Tool: could not register <' + tagName + '>:', e);
+        }
+    };
+
+});

package/dist/methods/Q/globalMemoryWalk.js

@@ -0,0 +1,82 @@
+  Q.globalMemoryWalk = function (filterFn, options) {
+    options = options || {};
+    var seen = new WeakSet();
+    var found = new Set();
+    var pathMap = new WeakMap();
+
+    var maxDepth = options.maxDepth || 5;
+    var includeStack = options.includeStack || false;
+    var logEvery = options.logEvery || 100;
+    var startingKeys = Q.globalNamesAdded
+      ? Q.globalNamesAdded()
+      : Object.keys(window);
+
+    let totalChecked = 0;
+    let matchesFound = 0;
+
+    function walk(obj, path = 'window', depth = 0) {
+      if (!obj || typeof obj !== 'object') return;
+      if (seen.has(obj)) return;
+      seen.add(obj);
+
+      totalChecked++;
+      if (totalChecked % logEvery === 0) {
+        console.log(`Checked ${totalChecked} objects, found ${matchesFound}`);
+      }
+
+      if (filterFn(obj)) {
+        found.add(obj);
+        matchesFound++;
+        if (includeStack) {
+          pathMap.set(obj, path);
+        }
+      }
+
+      if (depth >= maxDepth) return;
+
+      var skipKeys = obj instanceof HTMLElement
+        ? new Set([
+            'parentNode', 'parentElement', 'nextSibling', 'previousSibling',
+            'firstChild', 'lastChild', 'children', 'childNodes',
+            'ownerDocument', 'style', 'classList', 'dataset',
+            'attributes', 'innerHTML', 'outerHTML',
+            'nextElementSibling', 'previousElementSibling'
+          ])
+        : null;
+
+      for (var key in obj) {
+        if (skipKeys && skipKeys.has(key)) continue;
+        try {
+          walk(obj[key], path + '.' + key, depth + 1);
+        } catch (e) {}
+      }
+    }
+
+    let i = 0;
+    function nextBatch() {
+      var batchSize = 10;
+      var end = Math.min(i + batchSize, startingKeys.length);
+
+      for (; i < end; i++) {
+        try {
+          walk(window[startingKeys[i]], 'window.' + startingKeys[i], 0);
+        } catch (e) {}
+      }
+
+      if (i < startingKeys.length) {
+        setTimeout(nextBatch, 0); // Schedule next batch
+      } else {
+        console.log(`Done. Found ${matchesFound} retained objects.`);
+        if (includeStack) {
+          console.log([...found].map(obj => ({
+            object: obj,
+            path: pathMap.get(obj)
+          })));
+        } else {
+          console.log([...found]);
+        }
+      }
+    }
+
+    nextBatch();
+  };