@vectojs/core 0.2.2 → 0.2.4

package/dist/{chunk-2Y45S4JK.mjs → chunk-WEQRBXT2.mjs}

@@ -185,9 +185,100 @@ var CanvasRenderer = class _CanvasRenderer {
     }
     return grad;
   }
+  /**
+   * Canvas2D drawing contexts are automatically released when their
+   * `<canvas>` element is GC'd, so there's no explicit GPU handle to free.
+   * This method clears our internal batch state and is idempotent.
+   */
+  dispose() {
+    this.batchCount = 0;
+    this.batchColor = "";
+    this.batchAlpha = 1;
+    this.batchActive = false;
+  }
 };
 
+// src/renderer/url.ts
+var SAFE_SCHEMES = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:", "ftp:"]);
+var SCHEME_PATTERN = /^[a-z][a-z\d+.-]*$/i;
+function normalizeSchemeCandidate(value) {
+  let result = "";
+  for (const character of value) {
+    const code = character.charCodeAt(0);
+    if (code > 32 && (code < 127 || code > 159)) result += character;
+  }
+  return result;
+}
+function hasSafeSchemeOrIsRelative(url) {
+  const colonIndex = url.indexOf(":");
+  if (colonIndex < 0) return true;
+  const candidate = normalizeSchemeCandidate(url.slice(0, colonIndex));
+  if (!SCHEME_PATTERN.test(candidate)) return true;
+  return SAFE_SCHEMES.has(`${candidate.toLowerCase()}:`);
+}
+function sanitizeUrl(href) {
+  if (typeof href !== "string") return "";
+  const trimmed = href.trim();
+  if (trimmed === "") return "";
+  return hasSafeSchemeOrIsRelative(trimmed) ? trimmed : "#";
+}
+function isSafeUrl(urlStr) {
+  if (typeof urlStr !== "string") return false;
+  const trimmed = urlStr.trim();
+  if (trimmed === "") return false;
+  return hasSafeSchemeOrIsRelative(trimmed);
+}
+
 // src/renderer/SVGRenderer.ts
+function parseFontSizeToken(font) {
+  for (let i = 0; i < font.length; i++) {
+    const ch = font[i];
+    if (!(ch >= "0" && ch <= "9" || ch === ".")) continue;
+    let j = i + 1;
+    while (j < font.length) {
+      const next = font[j];
+      if (next >= "0" && next <= "9" || next === ".") {
+        j++;
+      } else {
+        break;
+      }
+    }
+    const unit = font.startsWith("rem", j) ? "rem" : font.startsWith("em", j) ? "em" : font.startsWith("px", j) ? "px" : null;
+    if (!unit) {
+      i = j;
+      continue;
+    }
+    let end = j + unit.length;
+    if (font[end] === "/") {
+      end++;
+      while (end < font.length && font[end] !== " " && font[end] !== "	") end++;
+    }
+    const value = Number.parseFloat(font.slice(i, j));
+    return Number.isFinite(value) ? { value, unit, start: i, end } : null;
+  }
+  return null;
+}
+function fontFamilyFromShorthand(font, sizeToken) {
+  const withoutSize = sizeToken ? `${font.slice(0, sizeToken.start)} ${font.slice(sizeToken.end)}`.trim() : font.trim();
+  const family = withoutSize.split(" ").map((part) => part.trim()).filter(
+    (part) => part && ![
+      "bold",
+      "italic",
+      "oblique",
+      "normal",
+      "900",
+      "800",
+      "700",
+      "600",
+      "500",
+      "400",
+      "300",
+      "200",
+      "100"
+    ].includes(part.toLowerCase())
+  ).join(" ");
+  return family || "sans-serif";
+}
 var SVGRenderer = class {
   width;
   height;
@@ -395,7 +486,7 @@ var SVGRenderer = class {
   }
   fill(colorOrGradient) {
     this.flush();
-    const fillVal = this.resolveGradient(colorOrGradient);
+    const fillVal = this.escapeXML(this.resolveGradient(colorOrGradient));
     const dStr = this.currentPath.join(" ");
     const transformStr = `matrix(${this.ma},${this.mb},${this.mc},${this.md},${this.me},${this.mf})`;
     this.buffer.push(
@@ -404,7 +495,7 @@ var SVGRenderer = class {
   }
   stroke(colorOrGradient, lineWidth = 1) {
     this.flush();
-    const strokeVal = this.resolveGradient(colorOrGradient);
+    const strokeVal = this.escapeXML(this.resolveGradient(colorOrGradient));
     const dStr = this.currentPath.join(" ");
     const transformStr = `matrix(${this.ma},${this.mb},${this.mc},${this.md},${this.me},${this.mf})`;
     this.buffer.push(
@@ -413,18 +504,18 @@ var SVGRenderer = class {
   }
   fillText(text, x, y, font, color) {
     this.flush();
-    const sizeMatch = font.match(/(\d+(?:\.\d+)?)(px|em|rem)/);
-    let fontSize = sizeMatch ? parseFloat(sizeMatch[1]) : 16;
-    if (sizeMatch && sizeMatch[2] !== "px") {
+    const sizeToken = parseFontSizeToken(font);
+    let fontSize = sizeToken ? sizeToken.value : 16;
+    if (sizeToken && sizeToken.unit !== "px") {
       fontSize = fontSize * 16;
     }
-    const styleMatch = font.match(/(italic|oblique)/i);
-    const fontWeightMatch = font.match(/(bold|[1-9]00)/i);
-    const fontStyle = styleMatch ? styleMatch[1].toLowerCase() : "normal";
-    const fontWeight = fontWeightMatch ? fontWeightMatch[1].toLowerCase() : "normal";
-    const cleanFont = font.replace(/\d+(?:\.\d+)?(px|em|rem)(?:\/\d+(?:\.\d+)?(?:px|em|rem|%)?)?/, "").trim();
-    const fontFamily = cleanFont.replace(/(bold|italic|normal|600|500|400|300|100)\s+/gi, "").trim() || "sans-serif";
-    const fillVal = this.resolveGradient(color);
+    const lowerFont = font.toLowerCase();
+    const fontStyle = lowerFont.includes("italic") ? "italic" : lowerFont.includes("oblique") ? "oblique" : "normal";
+    const fontWeight = lowerFont.includes("bold") ? "bold" : ["900", "800", "700", "600", "500", "400", "300", "200", "100"].find(
+      (weight) => lowerFont.includes(weight)
+    ) ?? "normal";
+    const fontFamily = fontFamilyFromShorthand(font, sizeToken);
+    const fillVal = this.escapeXML(this.resolveGradient(color));
     const transformStr = `matrix(${this.ma},${this.mb},${this.mc},${this.md},${this.me},${this.mf})`;
     this.buffer.push(
       `<g transform="${transformStr}"><text x="${x}" y="${y}" font-size="${fontSize}" font-weight="${fontWeight}" font-style="${fontStyle}" font-family="${this.escapeXML(fontFamily)}" fill="${fillVal}" opacity="${this.globalAlpha}">${this.escapeXML(text)}</text></g>`
@@ -446,7 +537,9 @@ var SVGRenderer = class {
   }
   drawImage(source, dx, dy, dw, dh) {
     this.flush();
-    const href = typeof source?.toDataURL === "function" ? source.toDataURL() : source?.src || "";
+    const fromCanvas2 = typeof source?.toDataURL === "function";
+    const rawHref = fromCanvas2 ? source.toDataURL() : source?.src || "";
+    const href = fromCanvas2 && this.isSafeRasterDataUrl(rawHref) ? rawHref : sanitizeUrl(String(rawHref));
     const transformStr = `matrix(${this.ma},${this.mb},${this.mc},${this.md},${this.me},${this.mf})`;
     if (href) {
       this.buffer.push(
@@ -459,6 +552,21 @@ var SVGRenderer = class {
       console.warn("drawImage source fallback triggered");
     }
   }
+  /**
+   * Embed SVG markup as an isolated nested image.
+   *
+   * This explicit path is used by `SVGEntity` during vector export. General
+   * `drawImage()` input remains subject to the URL policy and therefore still
+   * rejects caller-provided SVG data URLs.
+   */
+  drawSVG(source, dx, dy, dw, dh) {
+    this.flush();
+    const href = `data:image/svg+xml;charset=utf-8,${encodeURIComponent(source)}`;
+    const transformStr = `matrix(${this.ma},${this.mb},${this.mc},${this.md},${this.me},${this.mf})`;
+    this.buffer.push(
+      `<image href="${this.escapeXML(href)}" x="${dx}" y="${dy}" width="${dw}" height="${dh}" transform="${transformStr}" />`
+    );
+  }
   flush() {
     if (!this.batchActive || this.batchCircles.length === 0) return;
     let d = "";
@@ -566,6 +674,17 @@ var SVGRenderer = class {
       }
     });
   }
+  isSafeRasterDataUrl(value) {
+    return typeof value === "string" && /^data:image\/(?:png|jpeg|gif|webp);base64,[a-z\d+/=\s]*$/i.test(value);
+  }
+  /**
+   * SVGRenderer accumulates strings in memory; nothing external is allocated.
+   * Drop the buffers for GC and become idempotent.
+   */
+  dispose() {
+    this.clear();
+    this.gradientCache.clear();
+  }
 };
 
 // src/renderer/colorParse.ts
@@ -831,6 +950,7 @@ function createWebGLPointRenderer(canvas) {
   let logicalW = 0;
   let logicalH = 0;
   let dpr = 1;
+  let destroyed = false;
   return {
     resize(width, height) {
       logicalW = width;
@@ -1037,6 +1157,8 @@ function createWebGLPointRenderer(canvas) {
       gl.bindVertexArray(null);
     },
     destroy() {
+      if (destroyed) return;
+      destroyed = true;
       gl.deleteBuffer(pointBuffer);
       gl.deleteBuffer(rectBuffer);
       gl.deleteBuffer(spriteBuffer);
@@ -1326,10 +1448,14 @@ var WebGPUParticleSystemManager = class {
     if (!this.computePipeline || !entity.computeBindGroup) return;
     const uniformArray = new Float32Array(20);
     const color = parseColorToRGBA(entity.baseColor);
+    let opacity = 1;
+    for (let current = entity; current; current = current.parent) {
+      opacity *= current.opacity;
+    }
     uniformArray[0] = color[0];
     uniformArray[1] = color[1];
     uniformArray[2] = color[2];
-    uniformArray[3] = color[3];
+    uniformArray[3] = color[3] * opacity;
     const mActive = !isNaN(mouseX) && !isNaN(mouseY) && mouseX > -9e3 && mouseY > -9e3;
     uniformArray[4] = mActive ? mouseX : -9999;
     uniformArray[5] = mActive ? mouseY : -9999;
@@ -1373,6 +1499,8 @@ var WebGPUParticleSystemManager = class {
 
 export {
   CanvasRenderer,
+  sanitizeUrl,
+  isSafeUrl,
   SVGRenderer,
   parseColorToRGBA,
   createWebGLPointRenderer,

package/dist/index.d.ts

@@ -4,6 +4,7 @@ export * from './renderer/SVGRenderer';
 export * from './renderer/WebGLPointRenderer';
 export * from './renderer/WebGPUParticleSystemManager';
 export * from './renderer/colorParse';
+export * from './renderer/url';
 export * from './tree/Entity';
 export * from './tree/Scene';
 export * from './components/TextEntity';