browser-module-runtime 0.0.5 → 0.0.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "browser-module-runtime",
-  "version": "0.0.5",
+  "version": "0.0.6",
   "type": "module",
   "exports": {
     ".": {

package/src/html/index.js

@@ -1,14 +1,8 @@
 /** Scoped HTML integration: autonomous rendering, explicit discovery, opt-in observation. */
 import {registerWebComponent} from '../web-components/index.js';
 import {getScopeRegistry,requestedScope,containsRoot} from './scopes.js';
+import {parseObjectProps as parseObject} from './props.js';
 
-function parseObject(value,context){
-  if(value==null||value==='')return {};
-  let result;
-  try{result=JSON.parse(value);}catch(e){throw new Error(`Invalid JSON in ${context}: ${e.message}`);}
-  if(!result||typeof result!=='object'||Array.isArray(result))throw new Error(`${context} must be a JSON object`);
-  return result;
-}
 function emit(el,type,detail){const win=el.ownerDocument.defaultView;el.dispatchEvent(new win.CustomEvent(type,{detail,bubbles:true,composed:true}));}
 function state(el,value){el.setAttribute('data-runtime-state',value);}
 function rootDocument(root){return root?.nodeType===9?root:root?.ownerDocument;}

package/src/html/props.js

@@ -0,0 +1,112 @@
+/** Parse declarative object props without eval or executing JavaScript.
+ * Accepts JSON and a safe JS-literal subset (unquoted keys, single-quoted
+ * strings, trailing commas, nested arrays/objects). No expressions or code.
+ */
+export function parseObjectProps(value, context = 'props') {
+  if (value == null || value.trim() === '') return {};
+  if (value.length > 100_000) throw new SyntaxError(`${context}: props literal is too large`);
+  let offset = 0;
+  const error = (message) => { throw new SyntaxError(`${context}: ${message} at character ${offset + 1}`); };
+  const peek = () => value[offset];
+  const space = () => { while (offset < value.length && /\s/.test(peek())) offset++; };
+  const forbidKey = (key) => {
+    if (key === '__proto__' || key === 'constructor' || key === 'prototype') error(`Forbidden object key ${key}`);
+    return key;
+  };
+  function str() {
+    const quote = value[offset++];
+    let result = '';
+    while (offset < value.length) {
+      let c = value[offset++];
+      if (c === quote) return result;
+      if (c === '\n' || c === '\r') error('Unterminated string');
+      if (c !== '\\') { result += c; continue; }
+      if (offset >= value.length) error('Unterminated string escape');
+      c = value[offset++];
+      const escapes = {n:'\n', r:'\r', t:'\t', b:'\b', f:'\f', v:'\v', '0':'\0'};
+      if (Object.hasOwn(escapes, c)) { result += escapes[c]; continue; }
+      if (c === 'u' || c === 'x') {
+        const count = c === 'u' ? 4 : 2;
+        const hex = value.slice(offset, offset + count);
+        if (!new RegExp(`^[a-fA-F0-9]{${count}}$`).test(hex)) error('Invalid hex string escape');
+        result += String.fromCharCode(parseInt(hex, 16)); offset += count; continue;
+      }
+      if ('\\\'"/'.includes(c)) { result += c; continue; }
+      error(`Unsupported string escape \\${c}`);
+    }
+    error('Unterminated string');
+  }
+  function readValue(depth = 0) {
+    if (depth > 40) error('Props nesting is too deep');
+    space();
+    const c = peek();
+    if (c === '{') return object(depth + 1);
+    if (c === '[') return array(depth + 1);
+    if (c === '"' || c === "'") return str();
+    const next = value.slice(offset);
+    const number = next.match(/^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?/);
+    if (number) {
+      offset += number[0].length;
+      const n = Number(number[0]);
+      if (!Number.isFinite(n)) error('Numbers must be finite');
+      return n;
+    }
+    for (const [word, literal] of [['true',true],['false',false],['null',null]]) {
+      if (next.startsWith(word) && !/[\w$]/.test(next[word.length] ?? '')) {
+        offset += word.length; return literal;
+      }
+    }
+    error('Expected a literal value (no expressions or functions)');
+  }
+  function key() {
+    space();
+    if (peek() === '"' || peek() === "'") return forbidKey(str());
+    const token = value.slice(offset).match(/^[A-Za-z_$][A-Za-z0-9_$]*/);
+    if (!token) error('Expected an object key');
+    offset += token[0].length;
+    return forbidKey(token[0]);
+  }
+  function object(depth) {
+    offset++; space();
+    const result = {};
+    if (peek() === '}') { offset++; return result; }
+    while (offset < value.length) {
+      const prop = key();space();
+      if (value[offset++] !== ':') error('Expected : after an object key');
+      const val = readValue(depth);
+      if (Object.hasOwn(result, prop)) error(`Duplicate object key ${prop}`);
+      result[prop] = val;
+      space();
+      const delimiter = value[offset++];
+      if (delimiter === '}') return result;
+      if (delimiter !== ',') error('Expected , or }');
+      space();
+      if (peek() === '}') { offset++; return result; }
+    }
+    error('Unclosed object');
+  }
+  function array(depth) {
+    offset++; space();
+    const result = [];
+    if (peek() === ']') { offset++; return result; }
+    while (offset < value.length) {
+      result.push(readValue(depth));space();
+      const delimiter = value[offset++];
+      if (delimiter === ']') return result;
+      if (delimiter !== ',') error('Expected , or ]');
+      space();
+      if (peek() === ']') { offset++; return result; }
+    }
+    error('Unclosed array');
+  }
+  space();
+  if (peek() !== '{') {
+    // Preserve the old object-only error wording for callers relying on it.
+    try { const json = JSON.parse(value); if (json === null || typeof json !== 'object' || Array.isArray(json)) throw new Error(`${context} must be a JSON object or safe object literal`); }
+    catch (e) { if (e.message.includes('must be a JSON object')) throw e; }
+    error('Props must be a JSON object or safe object literal');
+  }
+  const result = readValue();space();
+  if (offset !== value.length) error('Unexpected trailing content');
+  return result;
+}