@vlian/framework 1.0.0

package/dist/utils/resourceLoader.js

@@ -0,0 +1,307 @@
+/**
+ * 资源类型
+ */ function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+/**
+ * 资源优先级
+ */ export var ResourcePriority = /*#__PURE__*/ function(ResourcePriority) {
+    /**
+   * 高优先级 - 关键资源
+   */ ResourcePriority["HIGH"] = "high";
+    /**
+   * 中优先级 - 重要资源
+   */ ResourcePriority["MEDIUM"] = "medium";
+    /**
+   * 低优先级 - 非关键资源
+   */ ResourcePriority["LOW"] = "low";
+    /**
+   * 自动 - 由浏览器决定
+   */ ResourcePriority["AUTO"] = "auto";
+    return ResourcePriority;
+}({});
+/**
+ * 资源加载器类
+ */ export class ResourceLoader {
+    /**
+   * 获取动态并发数（基于网络状况）
+   */ getDynamicConcurrency() {
+        if (typeof navigator === 'undefined' || !('connection' in navigator)) {
+            return this.maxConcurrentLoads;
+        }
+        const connection = navigator.connection;
+        if (!connection) {
+            return this.maxConcurrentLoads;
+        }
+        // 根据网络类型调整并发数
+        const effectiveType = connection.effectiveType;
+        switch(effectiveType){
+            case 'slow-2g':
+            case '2g':
+                return 2;
+            case '3g':
+                return 4;
+            case '4g':
+            default:
+                return this.maxConcurrentLoads;
+        }
+    }
+    /**
+   * 加载脚本
+   */ async loadScript(options) {
+        const { url, ...rest } = options;
+        return this.loadResource({
+            ...rest,
+            type: 'script',
+            url
+        });
+    }
+    /**
+   * 加载样式
+   */ async loadStyle(options) {
+        const { url, ...rest } = options;
+        return this.loadResource({
+            ...rest,
+            type: 'style',
+            url
+        });
+    }
+    /**
+   * 预加载资源
+   */ preload(options) {
+        if (typeof document === 'undefined') {
+            return;
+        }
+        const link = document.createElement('link');
+        link.rel = 'preload';
+        link.href = options.url;
+        link.as = this.getResourceAs(options.type);
+        if (options.priority) {
+            link.setAttribute('fetchpriority', options.priority);
+        }
+        if (options.crossOrigin) {
+            link.crossOrigin = options.crossOrigin;
+        }
+        if (options.integrity) {
+            link.integrity = options.integrity;
+        }
+        document.head.appendChild(link);
+    }
+    /**
+   * 预取资源
+   */ prefetch(options) {
+        if (typeof document === 'undefined') {
+            return;
+        }
+        const link = document.createElement('link');
+        link.rel = 'prefetch';
+        link.href = options.url;
+        if (options.priority) {
+            link.setAttribute('fetchpriority', options.priority);
+        }
+        document.head.appendChild(link);
+    }
+    /**
+   * 加载资源
+   */ async loadResource(options) {
+        const { url, type, onLoad, onError } = options;
+        // 如果已经加载过，直接返回
+        if (this.loadedResources.has(url)) {
+            onLoad?.();
+            return;
+        }
+        // 如果正在加载，等待加载完成
+        if (this.loadingResources.has(url)) {
+            await this.loadingResources.get(url);
+            onLoad?.();
+            return;
+        }
+        // 创建加载 Promise
+        const loadPromise = this.doLoadResource({
+            ...options,
+            type,
+            url
+        });
+        // 保存加载 Promise
+        this.loadingResources.set(url, loadPromise);
+        try {
+            await loadPromise;
+            this.loadedResources.add(url);
+            onLoad?.();
+        } catch (error) {
+            const err = error instanceof Error ? error : new Error(String(error));
+            onError?.(err);
+            throw err;
+        } finally{
+            this.loadingResources.delete(url);
+        }
+    }
+    /**
+   * 执行资源加载
+   */ doLoadResource(options) {
+        return new Promise((resolve, reject)=>{
+            if (typeof document === 'undefined') {
+                reject(new Error('资源加载需要在浏览器环境中执行'));
+                return;
+            }
+            const { url, type, async = true, defer, crossOrigin, integrity } = options;
+            if (type === 'script') {
+                const script = document.createElement('script');
+                script.src = url;
+                script.async = async;
+                if (defer !== undefined) {
+                    script.defer = defer;
+                }
+                if (crossOrigin) {
+                    script.crossOrigin = crossOrigin;
+                }
+                if (integrity) {
+                    script.integrity = integrity;
+                }
+                script.onload = ()=>resolve();
+                script.onerror = ()=>reject(new Error(`Failed to load script: ${url}`));
+                document.head.appendChild(script);
+            } else if (type === 'style') {
+                const link = document.createElement('link');
+                link.rel = 'stylesheet';
+                link.href = url;
+                if (crossOrigin) {
+                    link.crossOrigin = crossOrigin;
+                }
+                if (integrity) {
+                    link.integrity = integrity;
+                }
+                link.onload = ()=>resolve();
+                link.onerror = ()=>reject(new Error(`Failed to load stylesheet: ${url}`));
+                document.head.appendChild(link);
+            } else {
+                reject(new Error(`Unsupported resource type: ${type}`));
+            }
+        });
+    }
+    /**
+   * 获取资源 as 属性值
+   */ getResourceAs(type) {
+        const asMap = {
+            script: 'script',
+            style: 'style',
+            image: 'image',
+            font: 'font',
+            prefetch: 'fetch',
+            preload: 'fetch'
+        };
+        return asMap[type] || 'fetch';
+    }
+    /**
+   * 使用 requestIdleCallback 加载低优先级资源
+   */ loadWhenIdle(options, timeout) {
+        if (typeof requestIdleCallback !== 'undefined') {
+            requestIdleCallback(()=>{
+                this.loadResource(options).catch((error)=>{
+                    console.warn('Idle resource load failed:', error);
+                });
+            }, {
+                timeout
+            });
+        } else {
+            // 降级方案：延迟加载
+            setTimeout(()=>{
+                this.loadResource(options).catch((error)=>{
+                    console.warn('Delayed resource load failed:', error);
+                });
+            }, 1000);
+        }
+    }
+    /**
+   * 批量加载资源（按优先级）
+   */ async loadResources(resources) {
+        // 按优先级排序
+        const sortedResources = this.sortByPriority(resources);
+        // 按优先级分组
+        const highPriority = sortedResources.filter((r)=>r.priority === "high" || !r.priority);
+        const mediumPriority = sortedResources.filter((r)=>r.priority === "medium");
+        const lowPriority = sortedResources.filter((r)=>r.priority === "low");
+        const results = [];
+        // 先加载高优先级资源（并行，但限制并发数）
+        if (highPriority.length > 0) {
+            const highResults = await this.loadResourcesWithConcurrencyLimit(highPriority);
+            results.push(...highResults);
+        }
+        // 然后加载中优先级资源
+        if (mediumPriority.length > 0) {
+            const mediumResults = await this.loadResourcesWithConcurrencyLimit(mediumPriority);
+            results.push(...mediumResults);
+        }
+        // 最后加载低优先级资源（使用空闲时间）
+        if (lowPriority.length > 0) {
+            // 低优先级资源在空闲时加载
+            for (const resource of lowPriority){
+                this.loadWhenIdle(resource);
+            }
+        }
+        return results;
+    }
+    /**
+   * 按优先级排序资源
+   */ sortByPriority(resources) {
+        const priorityOrder = {
+            ["high"]: 0,
+            ["medium"]: 1,
+            ["low"]: 2,
+            ["auto"]: 3
+        };
+        return [
+            ...resources
+        ].sort((a, b)=>{
+            const aPriority = priorityOrder[a.priority || "auto"] ?? 3;
+            const bPriority = priorityOrder[b.priority || "auto"] ?? 3;
+            return aPriority - bPriority;
+        });
+    }
+    /**
+   * 限制并发数的资源加载（优化版本）
+   */ async loadResourcesWithConcurrencyLimit(resources, concurrency) {
+        const maxConcurrency = concurrency ?? this.getDynamicConcurrency();
+        const results = [];
+        const executing = new Set();
+        for (const resource of resources){
+            // 如果达到并发限制，等待一个任务完成
+            if (executing.size >= maxConcurrency) {
+                await Promise.race(executing);
+            }
+            const promise = this.loadResource(resource).finally(()=>{
+                executing.delete(promise);
+            });
+            executing.add(promise);
+            results.push(promise);
+        }
+        // 等待所有任务完成
+        await Promise.all(results);
+        return [];
+    }
+    /**
+   * 检查资源是否已加载
+   */ isLoaded(url) {
+        return this.loadedResources.has(url);
+    }
+    constructor(){
+        _define_property(this, "loadedResources", new Set());
+        _define_property(this, "loadingResources", new Map());
+        _define_property(this, "maxConcurrentLoads", 6); // 最大并发加载数（默认值）
+    }
+}
+/**
+ * 默认资源加载器实例
+ */ export const resourceLoader = new ResourceLoader();
+
+//# sourceMappingURL=resourceLoader.js.map

package/dist/utils/resourceLoader.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utils/resourceLoader.ts"],"sourcesContent":["/**\n * 资源类型\n */\nexport type ResourceType = 'script' | 'style' | 'image' | 'font' | 'prefetch' | 'preload';\n\n/**\n * 资源优先级\n */\nexport enum ResourcePriority {\n  /**\n   * 高优先级 - 关键资源\n   */\n  HIGH = 'high',\n  /**\n   * 中优先级 - 重要资源\n   */\n  MEDIUM = 'medium',\n  /**\n   * 低优先级 - 非关键资源\n   */\n  LOW = 'low',\n  /**\n   * 自动 - 由浏览器决定\n   */\n  AUTO = 'auto',\n}\n\n/**\n * 资源加载选项\n */\nexport interface ResourceLoadOptions {\n  /**\n   * 资源类型\n   */\n  type: ResourceType;\n  /**\n   * 资源 URL\n   */\n  url: string;\n  /**\n   * 优先级\n   */\n  priority?: ResourcePriority;\n  /**\n   * 是否异步加载\n   */\n  async?: boolean;\n  /**\n   * 是否延迟加载\n   */\n  defer?: boolean;\n  /**\n   * 跨域设置\n   */\n  crossOrigin?: 'anonymous' | 'use-credentials';\n  /**\n   * 完整性校验（SRI）\n   */\n  integrity?: string;\n  /**\n   * 加载完成回调\n   */\n  onLoad?: () => void;\n  /**\n   * 加载失败回调\n   */\n  onError?: (error: Error) => void;\n}\n\n/**\n * 资源加载器类\n */\nexport class ResourceLoader {\n  private loadedResources: Set<string> = new Set();\n  private loadingResources: Map<string, Promise<void>> = new Map();\n  private maxConcurrentLoads: number = 6; // 最大并发加载数（默认值）\n\n  /**\n   * 获取动态并发数（基于网络状况）\n   */\n  private getDynamicConcurrency(): number {\n    if (typeof navigator === 'undefined' || !('connection' in navigator)) {\n      return this.maxConcurrentLoads;\n    }\n\n    const connection = (navigator as any).connection;\n    if (!connection) {\n      return this.maxConcurrentLoads;\n    }\n\n    // 根据网络类型调整并发数\n    const effectiveType = connection.effectiveType;\n    switch (effectiveType) {\n      case 'slow-2g':\n      case '2g':\n        return 2;\n      case '3g':\n        return 4;\n      case '4g':\n      default:\n        return this.maxConcurrentLoads;\n    }\n  }\n\n  /**\n   * 加载脚本\n   */\n  async loadScript(options: Omit<ResourceLoadOptions, 'type'>): Promise<void> {\n    const { url, ...rest } = options;\n    return this.loadResource({ ...rest, type: 'script', url });\n  }\n\n  /**\n   * 加载样式\n   */\n  async loadStyle(options: Omit<ResourceLoadOptions, 'type'>): Promise<void> {\n    const { url, ...rest } = options;\n    return this.loadResource({ ...rest, type: 'style', url });\n  }\n\n  /**\n   * 预加载资源\n   */\n  preload(options: ResourceLoadOptions): void {\n    if (typeof document === 'undefined') {\n      return;\n    }\n\n    const link = document.createElement('link');\n    link.rel = 'preload';\n    link.href = options.url;\n    link.as = this.getResourceAs(options.type);\n\n    if (options.priority) {\n      link.setAttribute('fetchpriority', options.priority);\n    }\n\n    if (options.crossOrigin) {\n      link.crossOrigin = options.crossOrigin;\n    }\n\n    if (options.integrity) {\n      link.integrity = options.integrity;\n    }\n\n    document.head.appendChild(link);\n  }\n\n  /**\n   * 预取资源\n   */\n  prefetch(options: Omit<ResourceLoadOptions, 'type'>): void {\n    if (typeof document === 'undefined') {\n      return;\n    }\n\n    const link = document.createElement('link');\n    link.rel = 'prefetch';\n    link.href = options.url;\n\n    if (options.priority) {\n      link.setAttribute('fetchpriority', options.priority);\n    }\n\n    document.head.appendChild(link);\n  }\n\n  /**\n   * 加载资源\n   */\n  async loadResource(options: ResourceLoadOptions): Promise<void> {\n    const { url, type, onLoad, onError } = options;\n\n    // 如果已经加载过，直接返回\n    if (this.loadedResources.has(url)) {\n      onLoad?.();\n      return;\n    }\n\n    // 如果正在加载，等待加载完成\n    if (this.loadingResources.has(url)) {\n      await this.loadingResources.get(url);\n      onLoad?.();\n      return;\n    }\n\n    // 创建加载 Promise\n    const loadPromise = this.doLoadResource({ ...options, type, url });\n\n    // 保存加载 Promise\n    this.loadingResources.set(url, loadPromise);\n\n    try {\n      await loadPromise;\n      this.loadedResources.add(url);\n      onLoad?.();\n    } catch (error) {\n      const err = error instanceof Error ? error : new Error(String(error));\n      onError?.(err);\n      throw err;\n    } finally {\n      this.loadingResources.delete(url);\n    }\n  }\n\n  /**\n   * 执行资源加载\n   */\n  private doLoadResource(options: ResourceLoadOptions): Promise<void> {\n    return new Promise((resolve, reject) => {\n      if (typeof document === 'undefined') {\n        reject(new Error('资源加载需要在浏览器环境中执行'));\n        return;\n      }\n\n      const { url, type, async = true, defer, crossOrigin, integrity } = options;\n\n      if (type === 'script') {\n        const script = document.createElement('script');\n        script.src = url;\n        script.async = async;\n        if (defer !== undefined) {\n          script.defer = defer;\n        }\n        if (crossOrigin) {\n          script.crossOrigin = crossOrigin;\n        }\n        if (integrity) {\n          script.integrity = integrity;\n        }\n        script.onload = () => resolve();\n        script.onerror = () => reject(new Error(`Failed to load script: ${url}`));\n        document.head.appendChild(script);\n      } else if (type === 'style') {\n        const link = document.createElement('link');\n        link.rel = 'stylesheet';\n        link.href = url;\n        if (crossOrigin) {\n          link.crossOrigin = crossOrigin;\n        }\n        if (integrity) {\n          link.integrity = integrity;\n        }\n        link.onload = () => resolve();\n        link.onerror = () => reject(new Error(`Failed to load stylesheet: ${url}`));\n        document.head.appendChild(link);\n      } else {\n        reject(new Error(`Unsupported resource type: ${type}`));\n      }\n    });\n  }\n\n  /**\n   * 获取资源 as 属性值\n   */\n  private getResourceAs(type: ResourceType): string {\n    const asMap: Record<ResourceType, string> = {\n      script: 'script',\n      style: 'style',\n      image: 'image',\n      font: 'font',\n      prefetch: 'fetch',\n      preload: 'fetch',\n    };\n    return asMap[type] || 'fetch';\n  }\n\n  /**\n   * 使用 requestIdleCallback 加载低优先级资源\n   */\n  loadWhenIdle(options: ResourceLoadOptions, timeout?: number): void {\n    if (typeof requestIdleCallback !== 'undefined') {\n      requestIdleCallback(\n        () => {\n          this.loadResource(options).catch((error) => {\n            console.warn('Idle resource load failed:', error);\n          });\n        },\n        { timeout }\n      );\n    } else {\n      // 降级方案：延迟加载\n      setTimeout(() => {\n        this.loadResource(options).catch((error) => {\n          console.warn('Delayed resource load failed:', error);\n        });\n      }, 1000);\n    }\n  }\n\n  /**\n   * 批量加载资源（按优先级）\n   */\n  async loadResources(resources: ResourceLoadOptions[]): Promise<void[]> {\n    // 按优先级排序\n    const sortedResources = this.sortByPriority(resources);\n    \n    // 按优先级分组\n    const highPriority = sortedResources.filter(r => r.priority === ResourcePriority.HIGH || !r.priority);\n    const mediumPriority = sortedResources.filter(r => r.priority === ResourcePriority.MEDIUM);\n    const lowPriority = sortedResources.filter(r => r.priority === ResourcePriority.LOW);\n\n    const results: void[] = [];\n\n    // 先加载高优先级资源（并行，但限制并发数）\n    if (highPriority.length > 0) {\n      const highResults = await this.loadResourcesWithConcurrencyLimit(highPriority);\n      results.push(...highResults);\n    }\n\n    // 然后加载中优先级资源\n    if (mediumPriority.length > 0) {\n      const mediumResults = await this.loadResourcesWithConcurrencyLimit(mediumPriority);\n      results.push(...mediumResults);\n    }\n\n    // 最后加载低优先级资源（使用空闲时间）\n    if (lowPriority.length > 0) {\n      // 低优先级资源在空闲时加载\n      for (const resource of lowPriority) {\n        this.loadWhenIdle(resource);\n      }\n    }\n\n    return results;\n  }\n\n  /**\n   * 按优先级排序资源\n   */\n  private sortByPriority(resources: ResourceLoadOptions[]): ResourceLoadOptions[] {\n    const priorityOrder = {\n      [ResourcePriority.HIGH]: 0,\n      [ResourcePriority.MEDIUM]: 1,\n      [ResourcePriority.LOW]: 2,\n      [ResourcePriority.AUTO]: 3,\n    };\n\n    return [...resources].sort((a, b) => {\n      const aPriority = priorityOrder[a.priority || ResourcePriority.AUTO] ?? 3;\n      const bPriority = priorityOrder[b.priority || ResourcePriority.AUTO] ?? 3;\n      return aPriority - bPriority;\n    });\n  }\n\n  /**\n   * 限制并发数的资源加载（优化版本）\n   */\n  private async loadResourcesWithConcurrencyLimit(\n    resources: ResourceLoadOptions[],\n    concurrency?: number\n  ): Promise<void[]> {\n    const maxConcurrency = concurrency ?? this.getDynamicConcurrency();\n    const results: Promise<void>[] = [];\n    const executing = new Set<Promise<void>>();\n\n    for (const resource of resources) {\n      // 如果达到并发限制，等待一个任务完成\n      if (executing.size >= maxConcurrency) {\n        await Promise.race(executing);\n      }\n\n      const promise = this.loadResource(resource).finally(() => {\n        executing.delete(promise);\n      });\n\n      executing.add(promise);\n      results.push(promise);\n    }\n\n    // 等待所有任务完成\n    await Promise.all(results);\n    return [];\n  }\n\n  /**\n   * 检查资源是否已加载\n   */\n  isLoaded(url: string): boolean {\n    return this.loadedResources.has(url);\n  }\n}\n\n/**\n * 默认资源加载器实例\n */\nexport const resourceLoader = new ResourceLoader();\n"],"names":["ResourcePriority","ResourceLoader","getDynamicConcurrency","navigator","maxConcurrentLoads","connection","effectiveType","loadScript","options","url","rest","loadResource","type","loadStyle","preload","document","link","createElement","rel","href","as","getResourceAs","priority","setAttribute","crossOrigin","integrity","head","appendChild","prefetch","onLoad","onError","loadedResources","has","loadingResources","get","loadPromise","doLoadResource","set","add","error","err","Error","String","delete","Promise","resolve","reject","async","defer","script","src","undefined","onload","onerror","asMap","style","image","font","loadWhenIdle","timeout","requestIdleCallback","catch","console","warn","setTimeout","loadResources","resources","sortedResources","sortByPriority","highPriority","filter","r","mediumPriority","lowPriority","results","length","highResults","loadResourcesWithConcurrencyLimit","push","mediumResults","resource","priorityOrder","sort","a","b","aPriority","bPriority","concurrency","maxConcurrency","executing","Set","size","race","promise","finally","all","isLoaded","Map","resourceLoader"],"mappings":"AAAA;;CAEC;;;;;;;;;;;;;AAGD;;CAEC,GACD,OAAO,IAAA,AAAKA,0CAAAA;IACV;;GAEC;IAED;;GAEC;IAED;;GAEC;IAED;;GAEC;WAfSA;MAiBX;AA4CD;;CAEC,GACD,OAAO,MAAMC;IAKX;;GAEC,GACD,AAAQC,wBAAgC;QACtC,IAAI,OAAOC,cAAc,eAAe,CAAE,CAAA,gBAAgBA,SAAQ,GAAI;YACpE,OAAO,IAAI,CAACC,kBAAkB;QAChC;QAEA,MAAMC,aAAa,AAACF,UAAkBE,UAAU;QAChD,IAAI,CAACA,YAAY;YACf,OAAO,IAAI,CAACD,kBAAkB;QAChC;QAEA,cAAc;QACd,MAAME,gBAAgBD,WAAWC,aAAa;QAC9C,OAAQA;YACN,KAAK;YACL,KAAK;gBACH,OAAO;YACT,KAAK;gBACH,OAAO;YACT,KAAK;YACL;gBACE,OAAO,IAAI,CAACF,kBAAkB;QAClC;IACF;IAEA;;GAEC,GACD,MAAMG,WAAWC,OAA0C,EAAiB;QAC1E,MAAM,EAAEC,GAAG,EAAE,GAAGC,MAAM,GAAGF;QACzB,OAAO,IAAI,CAACG,YAAY,CAAC;YAAE,GAAGD,IAAI;YAAEE,MAAM;YAAUH;QAAI;IAC1D;IAEA;;GAEC,GACD,MAAMI,UAAUL,OAA0C,EAAiB;QACzE,MAAM,EAAEC,GAAG,EAAE,GAAGC,MAAM,GAAGF;QACzB,OAAO,IAAI,CAACG,YAAY,CAAC;YAAE,GAAGD,IAAI;YAAEE,MAAM;YAASH;QAAI;IACzD;IAEA;;GAEC,GACDK,QAAQN,OAA4B,EAAQ;QAC1C,IAAI,OAAOO,aAAa,aAAa;YACnC;QACF;QAEA,MAAMC,OAAOD,SAASE,aAAa,CAAC;QACpCD,KAAKE,GAAG,GAAG;QACXF,KAAKG,IAAI,GAAGX,QAAQC,GAAG;QACvBO,KAAKI,EAAE,GAAG,IAAI,CAACC,aAAa,CAACb,QAAQI,IAAI;QAEzC,IAAIJ,QAAQc,QAAQ,EAAE;YACpBN,KAAKO,YAAY,CAAC,iBAAiBf,QAAQc,QAAQ;QACrD;QAEA,IAAId,QAAQgB,WAAW,EAAE;YACvBR,KAAKQ,WAAW,GAAGhB,QAAQgB,WAAW;QACxC;QAEA,IAAIhB,QAAQiB,SAAS,EAAE;YACrBT,KAAKS,SAAS,GAAGjB,QAAQiB,SAAS;QACpC;QAEAV,SAASW,IAAI,CAACC,WAAW,CAACX;IAC5B;IAEA;;GAEC,GACDY,SAASpB,OAA0C,EAAQ;QACzD,IAAI,OAAOO,aAAa,aAAa;YACnC;QACF;QAEA,MAAMC,OAAOD,SAASE,aAAa,CAAC;QACpCD,KAAKE,GAAG,GAAG;QACXF,KAAKG,IAAI,GAAGX,QAAQC,GAAG;QAEvB,IAAID,QAAQc,QAAQ,EAAE;YACpBN,KAAKO,YAAY,CAAC,iBAAiBf,QAAQc,QAAQ;QACrD;QAEAP,SAASW,IAAI,CAACC,WAAW,CAACX;IAC5B;IAEA;;GAEC,GACD,MAAML,aAAaH,OAA4B,EAAiB;QAC9D,MAAM,EAAEC,GAAG,EAAEG,IAAI,EAAEiB,MAAM,EAAEC,OAAO,EAAE,GAAGtB;QAEvC,eAAe;QACf,IAAI,IAAI,CAACuB,eAAe,CAACC,GAAG,CAACvB,MAAM;YACjCoB;YACA;QACF;QAEA,gBAAgB;QAChB,IAAI,IAAI,CAACI,gBAAgB,CAACD,GAAG,CAACvB,MAAM;YAClC,MAAM,IAAI,CAACwB,gBAAgB,CAACC,GAAG,CAACzB;YAChCoB;YACA;QACF;QAEA,eAAe;QACf,MAAMM,cAAc,IAAI,CAACC,cAAc,CAAC;YAAE,GAAG5B,OAAO;YAAEI;YAAMH;QAAI;QAEhE,eAAe;QACf,IAAI,CAACwB,gBAAgB,CAACI,GAAG,CAAC5B,KAAK0B;QAE/B,IAAI;YACF,MAAMA;YACN,IAAI,CAACJ,eAAe,CAACO,GAAG,CAAC7B;YACzBoB;QACF,EAAE,OAAOU,OAAO;YACd,MAAMC,MAAMD,iBAAiBE,QAAQF,QAAQ,IAAIE,MAAMC,OAAOH;YAC9DT,UAAUU;YACV,MAAMA;QACR,SAAU;YACR,IAAI,CAACP,gBAAgB,CAACU,MAAM,CAAClC;QAC/B;IACF;IAEA;;GAEC,GACD,AAAQ2B,eAAe5B,OAA4B,EAAiB;QAClE,OAAO,IAAIoC,QAAQ,CAACC,SAASC;YAC3B,IAAI,OAAO/B,aAAa,aAAa;gBACnC+B,OAAO,IAAIL,MAAM;gBACjB;YACF;YAEA,MAAM,EAAEhC,GAAG,EAAEG,IAAI,EAAEmC,QAAQ,IAAI,EAAEC,KAAK,EAAExB,WAAW,EAAEC,SAAS,EAAE,GAAGjB;YAEnE,IAAII,SAAS,UAAU;gBACrB,MAAMqC,SAASlC,SAASE,aAAa,CAAC;gBACtCgC,OAAOC,GAAG,GAAGzC;gBACbwC,OAAOF,KAAK,GAAGA;gBACf,IAAIC,UAAUG,WAAW;oBACvBF,OAAOD,KAAK,GAAGA;gBACjB;gBACA,IAAIxB,aAAa;oBACfyB,OAAOzB,WAAW,GAAGA;gBACvB;gBACA,IAAIC,WAAW;oBACbwB,OAAOxB,SAAS,GAAGA;gBACrB;gBACAwB,OAAOG,MAAM,GAAG,IAAMP;gBACtBI,OAAOI,OAAO,GAAG,IAAMP,OAAO,IAAIL,MAAM,CAAC,uBAAuB,EAAEhC,KAAK;gBACvEM,SAASW,IAAI,CAACC,WAAW,CAACsB;YAC5B,OAAO,IAAIrC,SAAS,SAAS;gBAC3B,MAAMI,OAAOD,SAASE,aAAa,CAAC;gBACpCD,KAAKE,GAAG,GAAG;gBACXF,KAAKG,IAAI,GAAGV;gBACZ,IAAIe,aAAa;oBACfR,KAAKQ,WAAW,GAAGA;gBACrB;gBACA,IAAIC,WAAW;oBACbT,KAAKS,SAAS,GAAGA;gBACnB;gBACAT,KAAKoC,MAAM,GAAG,IAAMP;gBACpB7B,KAAKqC,OAAO,GAAG,IAAMP,OAAO,IAAIL,MAAM,CAAC,2BAA2B,EAAEhC,KAAK;gBACzEM,SAASW,IAAI,CAACC,WAAW,CAACX;YAC5B,OAAO;gBACL8B,OAAO,IAAIL,MAAM,CAAC,2BAA2B,EAAE7B,MAAM;YACvD;QACF;IACF;IAEA;;GAEC,GACD,AAAQS,cAAcT,IAAkB,EAAU;QAChD,MAAM0C,QAAsC;YAC1CL,QAAQ;YACRM,OAAO;YACPC,OAAO;YACPC,MAAM;YACN7B,UAAU;YACVd,SAAS;QACX;QACA,OAAOwC,KAAK,CAAC1C,KAAK,IAAI;IACxB;IAEA;;GAEC,GACD8C,aAAalD,OAA4B,EAAEmD,OAAgB,EAAQ;QACjE,IAAI,OAAOC,wBAAwB,aAAa;YAC9CA,oBACE;gBACE,IAAI,CAACjD,YAAY,CAACH,SAASqD,KAAK,CAAC,CAACtB;oBAChCuB,QAAQC,IAAI,CAAC,8BAA8BxB;gBAC7C;YACF,GACA;gBAAEoB;YAAQ;QAEd,OAAO;YACL,YAAY;YACZK,WAAW;gBACT,IAAI,CAACrD,YAAY,CAACH,SAASqD,KAAK,CAAC,CAACtB;oBAChCuB,QAAQC,IAAI,CAAC,iCAAiCxB;gBAChD;YACF,GAAG;QACL;IACF;IAEA;;GAEC,GACD,MAAM0B,cAAcC,SAAgC,EAAmB;QACrE,SAAS;QACT,MAAMC,kBAAkB,IAAI,CAACC,cAAc,CAACF;QAE5C,SAAS;QACT,MAAMG,eAAeF,gBAAgBG,MAAM,CAACC,CAAAA,IAAKA,EAAEjD,QAAQ,eAA8B,CAACiD,EAAEjD,QAAQ;QACpG,MAAMkD,iBAAiBL,gBAAgBG,MAAM,CAACC,CAAAA,IAAKA,EAAEjD,QAAQ;QAC7D,MAAMmD,cAAcN,gBAAgBG,MAAM,CAACC,CAAAA,IAAKA,EAAEjD,QAAQ;QAE1D,MAAMoD,UAAkB,EAAE;QAE1B,uBAAuB;QACvB,IAAIL,aAAaM,MAAM,GAAG,GAAG;YAC3B,MAAMC,cAAc,MAAM,IAAI,CAACC,iCAAiC,CAACR;YACjEK,QAAQI,IAAI,IAAIF;QAClB;QAEA,aAAa;QACb,IAAIJ,eAAeG,MAAM,GAAG,GAAG;YAC7B,MAAMI,gBAAgB,MAAM,IAAI,CAACF,iCAAiC,CAACL;YACnEE,QAAQI,IAAI,IAAIC;QAClB;QAEA,qBAAqB;QACrB,IAAIN,YAAYE,MAAM,GAAG,GAAG;YAC1B,eAAe;YACf,KAAK,MAAMK,YAAYP,YAAa;gBAClC,IAAI,CAACf,YAAY,CAACsB;YACpB;QACF;QAEA,OAAON;IACT;IAEA;;GAEC,GACD,AAAQN,eAAeF,SAAgC,EAAyB;QAC9E,MAAMe,gBAAgB;YACpB,QAAuB,EAAE;YACzB,UAAyB,EAAE;YAC3B,OAAsB,EAAE;YACxB,QAAuB,EAAE;QAC3B;QAEA,OAAO;eAAIf;SAAU,CAACgB,IAAI,CAAC,CAACC,GAAGC;YAC7B,MAAMC,YAAYJ,aAAa,CAACE,EAAE7D,QAAQ,WAA0B,IAAI;YACxE,MAAMgE,YAAYL,aAAa,CAACG,EAAE9D,QAAQ,WAA0B,IAAI;YACxE,OAAO+D,YAAYC;QACrB;IACF;IAEA;;GAEC,GACD,MAAcT,kCACZX,SAAgC,EAChCqB,WAAoB,EACH;QACjB,MAAMC,iBAAiBD,eAAe,IAAI,CAACrF,qBAAqB;QAChE,MAAMwE,UAA2B,EAAE;QACnC,MAAMe,YAAY,IAAIC;QAEtB,KAAK,MAAMV,YAAYd,UAAW;YAChC,oBAAoB;YACpB,IAAIuB,UAAUE,IAAI,IAAIH,gBAAgB;gBACpC,MAAM5C,QAAQgD,IAAI,CAACH;YACrB;YAEA,MAAMI,UAAU,IAAI,CAAClF,YAAY,CAACqE,UAAUc,OAAO,CAAC;gBAClDL,UAAU9C,MAAM,CAACkD;YACnB;YAEAJ,UAAUnD,GAAG,CAACuD;YACdnB,QAAQI,IAAI,CAACe;QACf;QAEA,WAAW;QACX,MAAMjD,QAAQmD,GAAG,CAACrB;QAClB,OAAO,EAAE;IACX;IAEA;;GAEC,GACDsB,SAASvF,GAAW,EAAW;QAC7B,OAAO,IAAI,CAACsB,eAAe,CAACC,GAAG,CAACvB;IAClC;;QAnTA,uBAAQsB,mBAA+B,IAAI2D;QAC3C,uBAAQzD,oBAA+C,IAAIgE;QAC3D,uBAAQ7F,sBAA6B,IAAG,eAAe;;AAkTzD;AAEA;;CAEC,GACD,OAAO,MAAM8F,iBAAiB,IAAIjG,iBAAiB"}

package/dist/utils/runtimeSecurity.cjs

@@ -0,0 +1,151 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "RuntimeSecurity", {
+    enumerable: true,
+    get: function() {
+        return RuntimeSecurity;
+    }
+});
+const _security = require("./security");
+let RuntimeSecurity = class RuntimeSecurity {
+    /**
+   * 应用 CSP
+   * 
+   * 注意：通过 meta 标签设置 CSP 不如 HTTP 头安全，建议在服务器端设置 CSP 头。
+   * 此方法仅作为补充措施。
+   */ static applyCSP(config) {
+        if (typeof document === 'undefined') {
+            return;
+        }
+        try {
+            const cspHeader = _security.SecurityUtils.generateCSP(config);
+            // 创建或更新 meta 标签
+            let metaCSP = document.querySelector('meta[http-equiv="Content-Security-Policy"]');
+            if (!metaCSP) {
+                metaCSP = document.createElement('meta');
+                metaCSP.setAttribute('http-equiv', 'Content-Security-Policy');
+                // 插入到 head 的开头，确保优先级
+                document.head.insertBefore(metaCSP, document.head.firstChild);
+            }
+            metaCSP.setAttribute('content', cspHeader);
+            // 添加 CSP 违规报告（如果支持）
+            if (typeof window !== 'undefined' && 'reporting' in window) {
+                // 可以添加 CSP 违规监听器
+                window.addEventListener('securitypolicyviolation', (event)=>{
+                    console.warn('CSP 违规:', {
+                        violatedDirective: event.violatedDirective,
+                        blockedURI: event.blockedURI
+                    });
+                });
+            }
+        } catch (error) {
+            console.error('应用 CSP 失败:', error);
+        }
+    }
+    /**
+   * 应用安全头（通过 meta 标签，实际应该由服务器设置）
+   */ static applySecurityHeaders(config) {
+        if (typeof document === 'undefined') {
+            return;
+        }
+        // X-Frame-Options
+        if (config.xFrameOptions) {
+            let meta = document.querySelector('meta[http-equiv="X-Frame-Options"]');
+            if (!meta) {
+                meta = document.createElement('meta');
+                meta.setAttribute('http-equiv', 'X-Frame-Options');
+                document.head.appendChild(meta);
+            }
+            meta.setAttribute('content', config.xFrameOptions);
+        }
+        // X-Content-Type-Options
+        if (config.xContentTypeOptions !== false) {
+            let meta = document.querySelector('meta[http-equiv="X-Content-Type-Options"]');
+            if (!meta) {
+                meta = document.createElement('meta');
+                meta.setAttribute('http-equiv', 'X-Content-Type-Options');
+                document.head.appendChild(meta);
+            }
+            meta.setAttribute('content', 'nosniff');
+        }
+        // X-XSS-Protection
+        if (config.xXSSProtection !== false) {
+            let meta = document.querySelector('meta[http-equiv="X-XSS-Protection"]');
+            if (!meta) {
+                meta = document.createElement('meta');
+                meta.setAttribute('http-equiv', 'X-XSS-Protection');
+                document.head.appendChild(meta);
+            }
+            meta.setAttribute('content', '1; mode=block');
+        }
+        // Referrer-Policy
+        if (config.referrerPolicy) {
+            let meta = document.querySelector('meta[name="referrer"]');
+            if (!meta) {
+                meta = document.createElement('meta');
+                meta.setAttribute('name', 'referrer');
+                document.head.appendChild(meta);
+            }
+            meta.setAttribute('content', config.referrerPolicy);
+        }
+    }
+    /**
+   * 检查运行时安全
+   */ static checkRuntimeSecurity() {
+        const issues = [];
+        if (typeof window === 'undefined') {
+            return {
+                safe: true,
+                issues: []
+            };
+        }
+        // 检查是否在 HTTPS 环境下
+        if (window.location.protocol !== 'https:' && window.location.hostname !== 'localhost') {
+            issues.push('应用未在 HTTPS 环境下运行');
+        }
+        // 检查是否有危险的全局对象
+        if (window.eval) {
+            issues.push('检测到危险的 eval 函数');
+        }
+        // 检查是否有危险的 innerHTML 使用
+        // 这个检查需要在代码层面进行，这里只是示例
+        return {
+            safe: issues.length === 0,
+            issues
+        };
+    }
+    /**
+   * 初始化运行时安全
+   */ static initialize(options = {}) {
+        const { enableCSP = false, enableSecurityHeaders = false, enableRuntimeChecks = false, csp, securityHeaders } = options;
+        // 应用 CSP
+        if (enableCSP && csp) {
+            this.applyCSP(csp);
+        }
+        // 应用安全头
+        if (enableSecurityHeaders && securityHeaders) {
+            this.applySecurityHeaders(securityHeaders);
+        }
+        // 运行时检查
+        if (enableRuntimeChecks) {
+            const checkResult = this.checkRuntimeSecurity();
+            if (!checkResult.safe) {
+                console.warn('运行时安全检查发现问题:', checkResult.issues);
+            }
+        }
+    }
+    /**
+   * 验证 URL 安全性
+   */ static validateUrl(url) {
+        return _security.SecurityUtils.isSafeUrl(url);
+    }
+    /**
+   * 验证并清理用户输入
+   */ static sanitizeUserInput(input) {
+        return _security.SecurityUtils.validateInput(input);
+    }
+};
+
+//# sourceMappingURL=runtimeSecurity.js.map

package/dist/utils/runtimeSecurity.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utils/runtimeSecurity.ts"],"sourcesContent":["import { SecurityUtils } from './security';\n\n/**\n * CSP 配置\n */\nexport interface CSPConfig {\n  defaultSrc?: string[];\n  scriptSrc?: string[];\n  styleSrc?: string[];\n  imgSrc?: string[];\n  connectSrc?: string[];\n  fontSrc?: string[];\n  frameSrc?: string[];\n}\n\n/**\n * 安全头配置\n */\nexport interface SecurityHeadersConfig {\n  /**\n   * Content Security Policy\n   */\n  csp?: CSPConfig | string;\n  /**\n   * X-Frame-Options\n   */\n  xFrameOptions?: 'DENY' | 'SAMEORIGIN' | 'ALLOW-FROM';\n  /**\n   * X-Content-Type-Options\n   */\n  xContentTypeOptions?: boolean;\n  /**\n   * X-XSS-Protection\n   */\n  xXSSProtection?: boolean;\n  /**\n   * Referrer-Policy\n   */\n  referrerPolicy?: 'no-referrer' | 'no-referrer-when-downgrade' | 'origin' | 'origin-when-cross-origin' | 'same-origin' | 'strict-origin' | 'strict-origin-when-cross-origin' | 'unsafe-url';\n  /**\n   * Permissions-Policy\n   */\n  permissionsPolicy?: Record<string, string[]>;\n}\n\n/**\n * 运行时安全检查选项\n */\nexport interface RuntimeSecurityOptions {\n  /**\n   * 是否启用 CSP\n   */\n  enableCSP?: boolean;\n  /**\n   * 是否启用安全头\n   */\n  enableSecurityHeaders?: boolean;\n  /**\n   * 是否启用运行时检查\n   */\n  enableRuntimeChecks?: boolean;\n  /**\n   * CSP 配置\n   */\n  csp?: CSPConfig;\n  /**\n   * 安全头配置\n   */\n  securityHeaders?: SecurityHeadersConfig;\n}\n\n/**\n * 运行时安全工具类\n */\nexport class RuntimeSecurity {\n  /**\n   * 应用 CSP\n   * \n   * 注意：通过 meta 标签设置 CSP 不如 HTTP 头安全，建议在服务器端设置 CSP 头。\n   * 此方法仅作为补充措施。\n   */\n  static applyCSP(config: CSPConfig): void {\n    if (typeof document === 'undefined') {\n      return;\n    }\n\n    try {\n      const cspHeader = SecurityUtils.generateCSP(config);\n\n      // 创建或更新 meta 标签\n      let metaCSP = document.querySelector('meta[http-equiv=\"Content-Security-Policy\"]');\n      if (!metaCSP) {\n        metaCSP = document.createElement('meta');\n        metaCSP.setAttribute('http-equiv', 'Content-Security-Policy');\n        // 插入到 head 的开头，确保优先级\n        document.head.insertBefore(metaCSP, document.head.firstChild);\n      }\n      metaCSP.setAttribute('content', cspHeader);\n\n      // 添加 CSP 违规报告（如果支持）\n      if (typeof window !== 'undefined' && 'reporting' in window) {\n        // 可以添加 CSP 违规监听器\n        window.addEventListener('securitypolicyviolation', (event) => {\n          console.warn('CSP 违规:', {\n            violatedDirective: (event as any).violatedDirective,\n            blockedURI: (event as any).blockedURI,\n          });\n        });\n      }\n    } catch (error) {\n      console.error('应用 CSP 失败:', error);\n    }\n  }\n\n  /**\n   * 应用安全头（通过 meta 标签，实际应该由服务器设置）\n   */\n  static applySecurityHeaders(config: SecurityHeadersConfig): void {\n    if (typeof document === 'undefined') {\n      return;\n    }\n\n    // X-Frame-Options\n    if (config.xFrameOptions) {\n      let meta = document.querySelector('meta[http-equiv=\"X-Frame-Options\"]');\n      if (!meta) {\n        meta = document.createElement('meta');\n        meta.setAttribute('http-equiv', 'X-Frame-Options');\n        document.head.appendChild(meta);\n      }\n      meta.setAttribute('content', config.xFrameOptions);\n    }\n\n    // X-Content-Type-Options\n    if (config.xContentTypeOptions !== false) {\n      let meta = document.querySelector('meta[http-equiv=\"X-Content-Type-Options\"]');\n      if (!meta) {\n        meta = document.createElement('meta');\n        meta.setAttribute('http-equiv', 'X-Content-Type-Options');\n        document.head.appendChild(meta);\n      }\n      meta.setAttribute('content', 'nosniff');\n    }\n\n    // X-XSS-Protection\n    if (config.xXSSProtection !== false) {\n      let meta = document.querySelector('meta[http-equiv=\"X-XSS-Protection\"]');\n      if (!meta) {\n        meta = document.createElement('meta');\n        meta.setAttribute('http-equiv', 'X-XSS-Protection');\n        document.head.appendChild(meta);\n      }\n      meta.setAttribute('content', '1; mode=block');\n    }\n\n    // Referrer-Policy\n    if (config.referrerPolicy) {\n      let meta = document.querySelector('meta[name=\"referrer\"]');\n      if (!meta) {\n        meta = document.createElement('meta');\n        meta.setAttribute('name', 'referrer');\n        document.head.appendChild(meta);\n      }\n      meta.setAttribute('content', config.referrerPolicy);\n    }\n  }\n\n  /**\n   * 检查运行时安全\n   */\n  static checkRuntimeSecurity(): {\n    safe: boolean;\n    issues: string[];\n  } {\n    const issues: string[] = [];\n\n    if (typeof window === 'undefined') {\n      return { safe: true, issues: [] };\n    }\n\n    // 检查是否在 HTTPS 环境下\n    if (window.location.protocol !== 'https:' && window.location.hostname !== 'localhost') {\n      issues.push('应用未在 HTTPS 环境下运行');\n    }\n\n    // 检查是否有危险的全局对象\n    if ((window as any).eval) {\n      issues.push('检测到危险的 eval 函数');\n    }\n\n    // 检查是否有危险的 innerHTML 使用\n    // 这个检查需要在代码层面进行，这里只是示例\n\n    return {\n      safe: issues.length === 0,\n      issues,\n    };\n  }\n\n  /**\n   * 初始化运行时安全\n   */\n  static initialize(options: RuntimeSecurityOptions = {}): void {\n    const {\n      enableCSP = false,\n      enableSecurityHeaders = false,\n      enableRuntimeChecks = false,\n      csp,\n      securityHeaders,\n    } = options;\n\n    // 应用 CSP\n    if (enableCSP && csp) {\n      this.applyCSP(csp);\n    }\n\n    // 应用安全头\n    if (enableSecurityHeaders && securityHeaders) {\n      this.applySecurityHeaders(securityHeaders);\n    }\n\n    // 运行时检查\n    if (enableRuntimeChecks) {\n      const checkResult = this.checkRuntimeSecurity();\n      if (!checkResult.safe) {\n        console.warn('运行时安全检查发现问题:', checkResult.issues);\n      }\n    }\n  }\n\n  /**\n   * 验证 URL 安全性\n   */\n  static validateUrl(url: string): boolean {\n    return SecurityUtils.isSafeUrl(url);\n  }\n\n  /**\n   * 验证并清理用户输入\n   */\n  static sanitizeUserInput(input: unknown): {\n    safe: boolean;\n    sanitized?: string;\n  } {\n    return SecurityUtils.validateInput(input);\n  }\n}\n"],"names":["RuntimeSecurity","applyCSP","config","document","cspHeader","SecurityUtils","generateCSP","metaCSP","querySelector","createElement","setAttribute","head","insertBefore","firstChild","window","addEventListener","event","console","warn","violatedDirective","blockedURI","error","applySecurityHeaders","xFrameOptions","meta","appendChild","xContentTypeOptions","xXSSProtection","referrerPolicy","checkRuntimeSecurity","issues","safe","location","protocol","hostname","push","eval","length","initialize","options","enableCSP","enableSecurityHeaders","enableRuntimeChecks","csp","securityHeaders","checkResult","validateUrl","url","isSafeUrl","sanitizeUserInput","input","validateInput"],"mappings":";;;;+BA0EaA;;;eAAAA;;;0BA1EiB;AA0EvB,IAAA,AAAMA,kBAAN,MAAMA;IACX;;;;;GAKC,GACD,OAAOC,SAASC,MAAiB,EAAQ;QACvC,IAAI,OAAOC,aAAa,aAAa;YACnC;QACF;QAEA,IAAI;YACF,MAAMC,YAAYC,uBAAa,CAACC,WAAW,CAACJ;YAE5C,gBAAgB;YAChB,IAAIK,UAAUJ,SAASK,aAAa,CAAC;YACrC,IAAI,CAACD,SAAS;gBACZA,UAAUJ,SAASM,aAAa,CAAC;gBACjCF,QAAQG,YAAY,CAAC,cAAc;gBACnC,qBAAqB;gBACrBP,SAASQ,IAAI,CAACC,YAAY,CAACL,SAASJ,SAASQ,IAAI,CAACE,UAAU;YAC9D;YACAN,QAAQG,YAAY,CAAC,WAAWN;YAEhC,oBAAoB;YACpB,IAAI,OAAOU,WAAW,eAAe,eAAeA,QAAQ;gBAC1D,iBAAiB;gBACjBA,OAAOC,gBAAgB,CAAC,2BAA2B,CAACC;oBAClDC,QAAQC,IAAI,CAAC,WAAW;wBACtBC,mBAAmB,AAACH,MAAcG,iBAAiB;wBACnDC,YAAY,AAACJ,MAAcI,UAAU;oBACvC;gBACF;YACF;QACF,EAAE,OAAOC,OAAO;YACdJ,QAAQI,KAAK,CAAC,cAAcA;QAC9B;IACF;IAEA;;GAEC,GACD,OAAOC,qBAAqBpB,MAA6B,EAAQ;QAC/D,IAAI,OAAOC,aAAa,aAAa;YACnC;QACF;QAEA,kBAAkB;QAClB,IAAID,OAAOqB,aAAa,EAAE;YACxB,IAAIC,OAAOrB,SAASK,aAAa,CAAC;YAClC,IAAI,CAACgB,MAAM;gBACTA,OAAOrB,SAASM,aAAa,CAAC;gBAC9Be,KAAKd,YAAY,CAAC,cAAc;gBAChCP,SAASQ,IAAI,CAACc,WAAW,CAACD;YAC5B;YACAA,KAAKd,YAAY,CAAC,WAAWR,OAAOqB,aAAa;QACnD;QAEA,yBAAyB;QACzB,IAAIrB,OAAOwB,mBAAmB,KAAK,OAAO;YACxC,IAAIF,OAAOrB,SAASK,aAAa,CAAC;YAClC,IAAI,CAACgB,MAAM;gBACTA,OAAOrB,SAASM,aAAa,CAAC;gBAC9Be,KAAKd,YAAY,CAAC,cAAc;gBAChCP,SAASQ,IAAI,CAACc,WAAW,CAACD;YAC5B;YACAA,KAAKd,YAAY,CAAC,WAAW;QAC/B;QAEA,mBAAmB;QACnB,IAAIR,OAAOyB,cAAc,KAAK,OAAO;YACnC,IAAIH,OAAOrB,SAASK,aAAa,CAAC;YAClC,IAAI,CAACgB,MAAM;gBACTA,OAAOrB,SAASM,aAAa,CAAC;gBAC9Be,KAAKd,YAAY,CAAC,cAAc;gBAChCP,SAASQ,IAAI,CAACc,WAAW,CAACD;YAC5B;YACAA,KAAKd,YAAY,CAAC,WAAW;QAC/B;QAEA,kBAAkB;QAClB,IAAIR,OAAO0B,cAAc,EAAE;YACzB,IAAIJ,OAAOrB,SAASK,aAAa,CAAC;YAClC,IAAI,CAACgB,MAAM;gBACTA,OAAOrB,SAASM,aAAa,CAAC;gBAC9Be,KAAKd,YAAY,CAAC,QAAQ;gBAC1BP,SAASQ,IAAI,CAACc,WAAW,CAACD;YAC5B;YACAA,KAAKd,YAAY,CAAC,WAAWR,OAAO0B,cAAc;QACpD;IACF;IAEA;;GAEC,GACD,OAAOC,uBAGL;QACA,MAAMC,SAAmB,EAAE;QAE3B,IAAI,OAAOhB,WAAW,aAAa;YACjC,OAAO;gBAAEiB,MAAM;gBAAMD,QAAQ,EAAE;YAAC;QAClC;QAEA,kBAAkB;QAClB,IAAIhB,OAAOkB,QAAQ,CAACC,QAAQ,KAAK,YAAYnB,OAAOkB,QAAQ,CAACE,QAAQ,KAAK,aAAa;YACrFJ,OAAOK,IAAI,CAAC;QACd;QAEA,eAAe;QACf,IAAI,AAACrB,OAAesB,IAAI,EAAE;YACxBN,OAAOK,IAAI,CAAC;QACd;QAEA,wBAAwB;QACxB,uBAAuB;QAEvB,OAAO;YACLJ,MAAMD,OAAOO,MAAM,KAAK;YACxBP;QACF;IACF;IAEA;;GAEC,GACD,OAAOQ,WAAWC,UAAkC,CAAC,CAAC,EAAQ;QAC5D,MAAM,EACJC,YAAY,KAAK,EACjBC,wBAAwB,KAAK,EAC7BC,sBAAsB,KAAK,EAC3BC,GAAG,EACHC,eAAe,EAChB,GAAGL;QAEJ,SAAS;QACT,IAAIC,aAAaG,KAAK;YACpB,IAAI,CAAC1C,QAAQ,CAAC0C;QAChB;QAEA,QAAQ;QACR,IAAIF,yBAAyBG,iBAAiB;YAC5C,IAAI,CAACtB,oBAAoB,CAACsB;QAC5B;QAEA,QAAQ;QACR,IAAIF,qBAAqB;YACvB,MAAMG,cAAc,IAAI,CAAChB,oBAAoB;YAC7C,IAAI,CAACgB,YAAYd,IAAI,EAAE;gBACrBd,QAAQC,IAAI,CAAC,gBAAgB2B,YAAYf,MAAM;YACjD;QACF;IACF;IAEA;;GAEC,GACD,OAAOgB,YAAYC,GAAW,EAAW;QACvC,OAAO1C,uBAAa,CAAC2C,SAAS,CAACD;IACjC;IAEA;;GAEC,GACD,OAAOE,kBAAkBC,KAAc,EAGrC;QACA,OAAO7C,uBAAa,CAAC8C,aAAa,CAACD;IACrC;AACF"}

package/dist/utils/runtimeSecurity.d.ts

@@ -0,0 +1,105 @@
+/**
+ * CSP 配置
+ */
+export interface CSPConfig {
+    defaultSrc?: string[];
+    scriptSrc?: string[];
+    styleSrc?: string[];
+    imgSrc?: string[];
+    connectSrc?: string[];
+    fontSrc?: string[];
+    frameSrc?: string[];
+}
+/**
+ * 安全头配置
+ */
+export interface SecurityHeadersConfig {
+    /**
+     * Content Security Policy
+     */
+    csp?: CSPConfig | string;
+    /**
+     * X-Frame-Options
+     */
+    xFrameOptions?: 'DENY' | 'SAMEORIGIN' | 'ALLOW-FROM';
+    /**
+     * X-Content-Type-Options
+     */
+    xContentTypeOptions?: boolean;
+    /**
+     * X-XSS-Protection
+     */
+    xXSSProtection?: boolean;
+    /**
+     * Referrer-Policy
+     */
+    referrerPolicy?: 'no-referrer' | 'no-referrer-when-downgrade' | 'origin' | 'origin-when-cross-origin' | 'same-origin' | 'strict-origin' | 'strict-origin-when-cross-origin' | 'unsafe-url';
+    /**
+     * Permissions-Policy
+     */
+    permissionsPolicy?: Record<string, string[]>;
+}
+/**
+ * 运行时安全检查选项
+ */
+export interface RuntimeSecurityOptions {
+    /**
+     * 是否启用 CSP
+     */
+    enableCSP?: boolean;
+    /**
+     * 是否启用安全头
+     */
+    enableSecurityHeaders?: boolean;
+    /**
+     * 是否启用运行时检查
+     */
+    enableRuntimeChecks?: boolean;
+    /**
+     * CSP 配置
+     */
+    csp?: CSPConfig;
+    /**
+     * 安全头配置
+     */
+    securityHeaders?: SecurityHeadersConfig;
+}
+/**
+ * 运行时安全工具类
+ */
+export declare class RuntimeSecurity {
+    /**
+     * 应用 CSP
+     *
+     * 注意：通过 meta 标签设置 CSP 不如 HTTP 头安全，建议在服务器端设置 CSP 头。
+     * 此方法仅作为补充措施。
+     */
+    static applyCSP(config: CSPConfig): void;
+    /**
+     * 应用安全头（通过 meta 标签，实际应该由服务器设置）
+     */
+    static applySecurityHeaders(config: SecurityHeadersConfig): void;
+    /**
+     * 检查运行时安全
+     */
+    static checkRuntimeSecurity(): {
+        safe: boolean;
+        issues: string[];
+    };
+    /**
+     * 初始化运行时安全
+     */
+    static initialize(options?: RuntimeSecurityOptions): void;
+    /**
+     * 验证 URL 安全性
+     */
+    static validateUrl(url: string): boolean;
+    /**
+     * 验证并清理用户输入
+     */
+    static sanitizeUserInput(input: unknown): {
+        safe: boolean;
+        sanitized?: string;
+    };
+}
+//# sourceMappingURL=runtimeSecurity.d.ts.map

package/dist/utils/runtimeSecurity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeSecurity.d.ts","sourceRoot":"","sources":["../../src/utils/runtimeSecurity.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,GAAG,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IACzB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,YAAY,CAAC;IACrD;;OAEG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;OAEG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;OAEG;IACH,cAAc,CAAC,EAAE,aAAa,GAAG,4BAA4B,GAAG,QAAQ,GAAG,0BAA0B,GAAG,aAAa,GAAG,eAAe,GAAG,iCAAiC,GAAG,YAAY,CAAC;IAC3L;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CAC9C;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;OAEG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;OAEG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;OAEG;IACH,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB;;OAEG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAC;CACzC;AAED;;GAEG;AACH,qBAAa,eAAe;IAC1B;;;;;OAKG;IACH,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI;IAiCxC;;OAEG;IACH,MAAM,CAAC,oBAAoB,CAAC,MAAM,EAAE,qBAAqB,GAAG,IAAI;IAkDhE;;OAEG;IACH,MAAM,CAAC,oBAAoB,IAAI;QAC7B,IAAI,EAAE,OAAO,CAAC;QACd,MAAM,EAAE,MAAM,EAAE,CAAC;KAClB;IA0BD;;OAEG;IACH,MAAM,CAAC,UAAU,CAAC,OAAO,GAAE,sBAA2B,GAAG,IAAI;IA4B7D;;OAEG;IACH,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIxC;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG;QACxC,IAAI,EAAE,OAAO,CAAC;QACd,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB;CAGF"}