@zvndev/darkmown 2.0.1 → 2.1.0

package/src/headers.js

@@ -23,10 +23,9 @@
  *     raw `<script>` an author writes into `html: true` markdown is therefore
  *     blocked by the shipped CSP — use a colocated `.js` file (same-origin,
  *     covered by `'self'`) or widen `script-src` deliberately.
- *   - The reactive runtime compiles validated expressions via `new Function`,
- *     so reactive pages additionally need `script-src 'unsafe-eval'`. That
- *     keyword cannot be hashed away: it gates eval-family APIs, not inline
- *     script elements.
+ *   - The reactive runtime WALKS a compile-time-validated expression AST (see
+ *     src/compiler/expr-ast.js) rather than building a `new Function`, so reactive
+ *     pages need NO `'unsafe-eval'`: their CSP is identical to the static one.
  *   - Inline `<style>` for view transitions — `style-src 'unsafe-inline'`.
  *   - `data:` favicon and remote images — `img-src 'self' data: https:`.
  *   - `:video`/`:audio` allow relative or `http(s)` sources — `media-src 'self' https:`.
@@ -36,8 +35,8 @@
  *     authorizes it (and blocks a form exfiltrating to a third-party origin). Apps
  *     posting to a remote backend widen this alongside `connect-src`.
  *
- * Static pages (zero framework JS) share the same hash-based `script-src` but
- * never call `new Function`, so their CSP drops `'unsafe-eval'`.
+ * Static pages (zero framework JS) and reactive pages now share the same
+ * eval-free `script-src` — no page needs `'unsafe-eval'`.
  */
 
 import { createHash } from "node:crypto";
@@ -102,17 +101,20 @@ const COMMON_CSP_DIRECTIVES = [
 ];
 
 /**
- * Relaxed CSP for reactive pages: `new Function` needs `'unsafe-eval'`; the
- * inline speculationrules block rides on the shared hash source, so no
- * `'unsafe-inline'`.
+ * CSP for reactive pages. Since 2.1 the runtime WALKS a compile-time-validated
+ * expression AST instead of building a `new Function`, so reactive pages no longer
+ * need `'unsafe-eval'` — this policy is byte-identical to the static one. The only
+ * script source is same-origin `/__wd/runtime.js` (plus the hashed speculationrules
+ * block); no `'unsafe-inline'`, no `'unsafe-eval'`.
  * @type {string}
  */
-export const REACTIVE_CSP = [`${SCRIPT_SRC} 'unsafe-eval'`, ...COMMON_CSP_DIRECTIVES].join("; ");
+export const REACTIVE_CSP = [SCRIPT_SRC, ...COMMON_CSP_DIRECTIVES].join("; ");
 
 /**
- * Stricter CSP for static pages: no runtime means no `new Function`, so
- * `'unsafe-eval'` is dropped too. Inline `<style>` (view transitions) keeps
- * `'unsafe-inline'` on style-src only.
+ * CSP for static pages (zero framework JS). Identical to the reactive policy now
+ * that neither variant evals — kept as a distinct export so the per-route emit and
+ * the `securityHeaders()` callers stay explicit about intent. Inline `<style>`
+ * (view transitions) keeps `'unsafe-inline'` on style-src only.
  * @type {string}
  */
 export const STATIC_CSP = [SCRIPT_SRC, ...COMMON_CSP_DIRECTIVES].join("; ");

package/src/index.js

@@ -7,6 +7,7 @@ export { buildSite } from "./builder.js";
 
 export {
   compileDocument,
+  compileFromMemory,
   compilePage,
   escapeHtml,
   loopKeyOf,

package/src/runtime.js

@@ -213,12 +213,12 @@ async function httpJson(url, init) {
 const computedDefs = [...document.querySelectorAll("[data-wd-computed]")].map((node) => ({
   key: node.getAttribute("data-wd-computed-key") || "",
   expr: node.getAttribute("data-wd-computed-expr") || "",
-  evaluate: new Function("S", "A", `return (${node.getAttribute("data-wd-computed-expr")});`)
+  ast: JSON.parse(node.getAttribute("data-wd-computed-expr") || "null")
 }));
 
 /**
  * Log an expression failure when `window.wd.debug` is enabled.
- * @param {string} expr
+ * @param {unknown} expr
  * @param {unknown} error
  * @returns {void}
  */
@@ -232,11 +232,9 @@ function warn(expr, error) {
  * @returns {void}
  */
 function recompute() {
-  /** @param {string} key @param {string | null} [path] */
-  const read = (key, path) => getPath(state[key], path ?? null);
   for (const def of computedDefs) {
     try {
-      state[def.key] = def.evaluate(read, AGG);
+      state[def.key] = evalAst(def.ast, undefined);
     } catch (error) {
       state[def.key] = undefined;
       warn(def.expr, error);
@@ -246,26 +244,80 @@ function recompute() {
 
 /** @param {unknown} a @param {unknown} b @returns {boolean} */
 const containsFn = (a, b) => String(a ?? "").toLowerCase().includes(String(b ?? "").toLowerCase());
-/** @type {Map<string, Function>} */
-const predicateCache = new Map();
+
 /**
- * @param {string} body
- * @returns {Function}
+ * Evaluate a compact expression AST (see src/compiler/expr-ast.js) against the
+ * live state and an optional loop `item`. The compiler emits this serialized AST
+ * into the `data-wd-*` attributes; the runtime WALKS it — no `new Function`, so
+ * reactive pages run under a strict CSP with no `'unsafe-eval'`. The op vocabulary
+ * is closed: every node tag is one of the readers (L/S/I/C/A), a unary (!/u-), or
+ * a binary operator, and an unknown tag is a hard error, never a fallthrough.
+ * Prototype-pollution segments are rejected by getPath, exactly as before.
+ * @param {any[]} node
+ * @param {any} item Loop row for I(); undefined otherwise.
+ * @returns {any}
  */
-function loopPredicate(body) {
-  let fn = predicateCache.get(body);
-  if (!fn) {
-    fn = new Function("I", "S", "C", `return (${body});`);
-    predicateCache.set(body, fn);
-  }
-  return fn;
+function evalAst(node, item) {
+  /** @param {any[]} n @returns {any} */
+  const ev = (n) => {
+    switch (n[0]) {
+      case "L": return n[1];
+      case "S": return getPath(state[n[1]], n[2] ?? null);
+      case "I": return getPath(item, n[1] ?? null);
+      case "C": return containsFn(ev(n[1]), ev(n[2]));
+      case "A": return AGG(n[1], ev(n[2]), n[3]);
+      case "!": return !ev(n[1]);
+      case "u-": return -ev(n[1]);
+      case "&&": return ev(n[1]) && ev(n[2]);
+      case "||": return ev(n[1]) || ev(n[2]);
+      // biome-ignore lint/suspicious/noDoubleEquals: loose equality preserves prior `new Function` semantics exactly.
+      case "==": return ev(n[1]) == ev(n[2]);
+      // biome-ignore lint/suspicious/noDoubleEquals: loose inequality preserves prior `new Function` semantics exactly.
+      case "!=": return ev(n[1]) != ev(n[2]);
+      case ">": return ev(n[1]) > ev(n[2]);
+      case "<": return ev(n[1]) < ev(n[2]);
+      case ">=": return ev(n[1]) >= ev(n[2]);
+      case "<=": return ev(n[1]) <= ev(n[2]);
+      case "+": return ev(n[1]) + ev(n[2]);
+      case "-": return ev(n[1]) - ev(n[2]);
+      case "*": return ev(n[1]) * ev(n[2]);
+      case "/": return ev(n[1]) / ev(n[2]);
+      case "%": return ev(n[1]) % ev(n[2]);
+    }
+    throw new Error(`wd: unknown op ${n[0]}`);
+  };
+  return ev(node);
+}
+
+/** @type {Map<string, any[]>} Parsed-AST cache keyed by the raw attribute JSON. */
+const astCache = new Map();
+/** @param {string} raw @returns {any[]} */
+function parseAst(raw) {
+  const cached = astCache.get(raw);
+  if (cached) return cached;
+  const ast = JSON.parse(raw);
+  astCache.set(raw, ast);
+  return ast;
+}
+
+/**
+ * Evaluate an expression AST to a boolean, swallowing failures (logs under
+ * `wd.debug`). Shared by reactive classes (`.class when`), loop `where`, and
+ * expression conditionals (`:if a > b`).
+ * @param {any[]} ast
+ * @param {any} item Loop row for per-row predicates, else undefined.
+ * @returns {boolean}
+ */
+function evalPredicate(ast, item) {
+  try { return Boolean(evalAst(ast, item)); }
+  catch (error) { warn(ast, error); return false; }
 }
 
 /**
  * Toggle reactive `.class when <predicate>` bindings on an element. `raw` is the
- * JSON `[[name, body], …]` from data-wd-class (global, item undefined) or
- * data-wd-each-class (per loop row); each body is the same I()/S()/C()
- * expression the loop `where` uses.
+ * JSON `[[name, ast], …]` from data-wd-class (global, item undefined) or
+ * data-wd-each-class (per loop row); each ast is the same expression AST the loop
+ * `where` uses.
  * @param {Element} el
  * @param {string | null} raw
  * @param {any} item Loop item for each-class; undefined for a global class.
@@ -273,23 +325,10 @@ function loopPredicate(body) {
  */
 function classToggle(el, raw, item) {
   if (!raw) return;
-  /** @type {[string, string][]} */
+  /** @type {[string, any[]][]} */
   let pairs;
   try { pairs = JSON.parse(raw); } catch { return; }
-  for (const [name, body] of pairs) el.classList.toggle(name, evalPredicate(body, item));
-}
-
-/**
- * Evaluate a compiled whitelist predicate body (over I()/S()/C()) to a boolean.
- * Shared by reactive classes (`.class when`) and expression conditionals
- * (`:if a > b`). `item` is the loop row for per-row predicates, else undefined.
- * @param {string} body
- * @param {any} item
- * @returns {boolean}
- */
-function evalPredicate(body, item) {
-  try { return Boolean(loopPredicate(body)((/** @type {string} */ p) => getPath(item, p), (/** @type {string} */ k, /** @type {string} */ r) => getPath(state[k], r || ""), containsFn)); }
-  catch (error) { warn(body, error); return false; }
+  for (const [name, ast] of pairs) el.classList.toggle(name, evalPredicate(ast, item));
 }
 
 /**
@@ -328,7 +367,7 @@ function fillItem(node, item, meta = {}) {
     if (skip(region)) continue;
     const expr = region.getAttribute("data-wd-if-expr");
     const m = region.getAttribute("data-wd-meta");
-    const value = expr ? evalPredicate(expr, item) : (m ? meta[m] : getPath(item, region.getAttribute("data-wd-path")));
+    const value = expr ? evalPredicate(parseAst(expr), item) : (m ? meta[m] : getPath(item, region.getAttribute("data-wd-path")));
     const output = region.querySelector("[data-wd-each-if-out]");
     if (!output) continue;
     const template = /** @type {HTMLTemplateElement | null} */ (region.querySelector(value ? "template[data-wd-if-true]" : "template[data-wd-if-false]"));
@@ -414,7 +453,7 @@ function pipeline(list, region) {
  */
 function renderIf(node) {
   const expr = node.getAttribute("data-wd-if-expr");
-  const value = expr ? evalPredicate(expr, undefined) : getPath(state[node.getAttribute("data-wd-if") || ""], node.getAttribute("data-wd-path"));
+  const value = expr ? evalPredicate(parseAst(expr), undefined) : getPath(state[node.getAttribute("data-wd-if") || ""], node.getAttribute("data-wd-path"));
   const active = String(Boolean(value));
   if (node.getAttribute("data-wd-if-active") === active) return;
   node.setAttribute("data-wd-if-active", active);
@@ -441,15 +480,8 @@ function reconcile(region, rows) {
   let list = Array.isArray(rows) ? rows.slice() : [];
   const where = region.getAttribute("data-wd-loop-where");
   if (where) {
-    const predicate = loopPredicate(where);
-    list = list.filter((/** @type {any} */ item) => {
-      try {
-        return predicate((/** @type {string | null} */ path) => getPath(item, path), (/** @type {string} */ k, /** @type {string} */ r) => getPath(state[k], r || ""), containsFn);
-      } catch (error) {
-        warn(where, error);
-        return false;
-      }
-    });
+    const ast = parseAst(where);
+    list = list.filter((/** @type {any} */ item) => evalPredicate(ast, item));
   }
   list = pipeline(list, region);
 

package/src/statics.js

@@ -5,13 +5,12 @@ import { BASE_SECURITY_HEADERS, REACTIVE_CSP, STATIC_CSP } from "./headers.js";
 
 /**
  * The security headers (including the right CSP variant) for an HTML response.
- * Mirrors what production ships: a route the build marked reactive gets the
- * relaxed CSP (`'unsafe-eval'` for `new Function`); a static route gets the
- * stricter, eval-free CSP — so a local preview matches the per-route `_headers`
- * / `vercel.json` the same build writes instead of blanket-relaxing every page.
- * Anything not found in `routes.json` (an unknown route, a 404, a missing
- * manifest) falls back to the reactive CSP, exactly like the production
- * `_headers` catch-all block.
+ * Mirrors what production ships. Since 2.1 both variants are eval-free (the
+ * reactive runtime walks a validated AST, not `new Function`), so a reactive and a
+ * static route resolve to the same CSP — the per-route selection is kept for parity
+ * with the `_headers` / `vercel.json` structure the same build writes. Anything not
+ * found in `routes.json` (an unknown route, a 404, a missing manifest) falls back
+ * to the reactive CSP, exactly like the production `_headers` catch-all block.
  * @param {string} distRoot Absolute path to the build output directory.
  * @param {string} url Request URL (may include a query string).
  * @returns {Record<string, string>}

package/types/compiler.d.ts

@@ -14,6 +14,19 @@ export function compilePage(file: string, context: Paths): CompiledPage;
  * @returns {CompiledDocument}
  */
 export function compileDocument(file: string, context: Paths, stack?: string[], vars?: Record<string, unknown>): CompiledDocument;
+/**
+ * Compile a page from an in-memory map of project-relative path → source, with
+ * no filesystem access. `entryPath` is the project-relative path of the page to
+ * compile; includes and `@loop` data resolve against the same map.
+ * @param {Record<string, string> | Map<string, string>} files
+ * @param {string} entryPath
+ * @param {{ vars?: Record<string, unknown>, cwd?: string }} [options]
+ * @returns {CompiledPage}
+ */
+export function compileFromMemory(files: Record<string, string> | Map<string, string>, entryPath: string, options?: {
+    vars?: Record<string, unknown>;
+    cwd?: string;
+}): CompiledPage;
 /**
  * Split a raw file into its frontmatter `meta` and `body`.
  * @param {string} raw Full file contents.

package/types/index.d.ts

@@ -8,6 +8,7 @@ export type { RouteManifestEntry, Paths, Assets } from "./builder.js";
 export {
   compilePage,
   compileDocument,
+  compileFromMemory,
   parseFrontmatter,
   escapeHtml,
   loopKeyOf