hyperprop-charting-library 0.1.132 → 0.1.133

package/dist/index.js

@@ -603,14 +603,23 @@ var withCachedSeries = (key, data, compute) => {
   return values;
 };
 var builtInComputationCache = /* @__PURE__ */ new Map();
+var COMPUTATION_CACHE_MAX_ENTRIES = 128;
 var withCachedComputation = (key, data, compute) => {
   const fingerprint = getSeriesFingerprint(data);
   const existing = builtInComputationCache.get(key);
   if (existing && existing.fingerprint === fingerprint) {
+    builtInComputationCache.delete(key);
+    builtInComputationCache.set(key, existing);
     return existing.value;
   }
   const value = compute();
+  builtInComputationCache.delete(key);
   builtInComputationCache.set(key, { fingerprint, value });
+  while (builtInComputationCache.size > COMPUTATION_CACHE_MAX_ENTRIES) {
+    const oldest = builtInComputationCache.keys().next().value;
+    if (oldest === void 0) break;
+    builtInComputationCache.delete(oldest);
+  }
   return value;
 };
 var rollingExtremeSeries = (values, length, mode) => {
@@ -1542,14 +1551,304 @@ var hashScriptSource = (source) => {
   }
   return (hash >>> 0).toString(36);
 };
-var compileScriptCompute = (source) => {
-  const factory = new Function(
+var SCRIPT_GUARD_BUDGET_MS = 1e3;
+var ScriptBudgetError = class extends Error {
+  constructor() {
+    super(
+      `Script exceeded the ${SCRIPT_GUARD_BUDGET_MS}ms execution budget (possible infinite loop) \u2014 edit the script to retry`
+    );
+    this.name = "ScriptBudgetError";
+  }
+};
+var createScriptGuard = () => {
+  let deadline = Date.now() + SCRIPT_GUARD_BUDGET_MS;
+  let count = 0;
+  const guard = (() => {
+    count += 1;
+    if ((count & 1023) === 0 && Date.now() > deadline) {
+      throw new ScriptBudgetError();
+    }
+    return true;
+  });
+  guard.reset = () => {
+    count = 0;
+    deadline = Date.now() + SCRIPT_GUARD_BUDGET_MS;
+  };
+  return guard;
+};
+var injectLoopGuards = (source, guardName) => {
+  const n = source.length;
+  const isIdChar = (ch) => ch >= "a" && ch <= "z" || ch >= "A" && ch <= "Z" || ch >= "0" && ch <= "9" || ch === "_" || ch === "$";
+  const scanString = (start) => {
+    const quote = source[start];
+    let j = start + 1;
+    while (j < n) {
+      const cj = source[j];
+      if (cj === "\\") {
+        j += 2;
+        continue;
+      }
+      if (cj === quote) {
+        return j + 1;
+      }
+      if (quote === "`" && cj === "$" && source[j + 1] === "{") {
+        let depth = 1;
+        j += 2;
+        while (j < n && depth > 0) {
+          const ce = source[j];
+          if (ce === "\\") {
+            j += 2;
+            continue;
+          }
+          if (ce === '"' || ce === "'" || ce === "`") {
+            j = scanString(j);
+            continue;
+          }
+          if (ce === "{") depth += 1;
+          else if (ce === "}") depth -= 1;
+          j += 1;
+        }
+        continue;
+      }
+      j += 1;
+    }
+    return n;
+  };
+  const scanRegex = (start) => {
+    let j = start + 1;
+    let inClass = false;
+    while (j < n) {
+      const cj = source[j];
+      if (cj === "\\") {
+        j += 2;
+        continue;
+      }
+      if (cj === "\n") return j;
+      if (cj === "[") inClass = true;
+      else if (cj === "]") inClass = false;
+      else if (cj === "/" && !inClass) return j + 1;
+      j += 1;
+    }
+    return n;
+  };
+  const skipWsAndComments = (k) => {
+    let j = k;
+    while (j < n) {
+      const cj = source[j];
+      if (cj === " " || cj === "	" || cj === "\n" || cj === "\r") {
+        j += 1;
+        continue;
+      }
+      if (cj === "/" && source[j + 1] === "/") {
+        const nl = source.indexOf("\n", j);
+        j = nl === -1 ? n : nl + 1;
+        continue;
+      }
+      if (cj === "/" && source[j + 1] === "*") {
+        const end = source.indexOf("*/", j + 2);
+        j = end === -1 ? n : end + 2;
+        continue;
+      }
+      return j;
+    }
+    return n;
+  };
+  const matchParen = (openIdx) => {
+    let depth = 0;
+    let j = openIdx;
+    while (j < n) {
+      const cj = source[j];
+      if (cj === '"' || cj === "'" || cj === "`") {
+        j = scanString(j);
+        continue;
+      }
+      if (cj === "/" && source[j + 1] === "/") {
+        const nl = source.indexOf("\n", j);
+        j = nl === -1 ? n : nl + 1;
+        continue;
+      }
+      if (cj === "/" && source[j + 1] === "*") {
+        const end = source.indexOf("*/", j + 2);
+        j = end === -1 ? n : end + 2;
+        continue;
+      }
+      if (cj === "(") depth += 1;
+      else if (cj === ")") {
+        depth -= 1;
+        if (depth === 0) return j;
+      }
+      j += 1;
+    }
+    return -1;
+  };
+  const splitTopLevelSemicolons = (inner) => {
+    const parts = [];
+    let depth = 0;
+    let j = 0;
+    let last = 0;
+    const m = inner.length;
+    while (j < m) {
+      const cj = inner[j];
+      if (cj === '"' || cj === "'" || cj === "`") {
+        const quote = cj;
+        j += 1;
+        while (j < m) {
+          if (inner[j] === "\\") {
+            j += 2;
+            continue;
+          }
+          if (inner[j] === quote) {
+            j += 1;
+            break;
+          }
+          j += 1;
+        }
+        continue;
+      }
+      if (cj === "(" || cj === "[" || cj === "{") depth += 1;
+      else if (cj === ")" || cj === "]" || cj === "}") depth -= 1;
+      else if (cj === ";" && depth === 0) {
+        parts.push(inner.slice(last, j));
+        last = j + 1;
+      }
+      j += 1;
+    }
+    parts.push(inner.slice(last));
+    return parts;
+  };
+  const REGEX_PRECEDING_WORDS = /* @__PURE__ */ new Set([
+    "return",
+    "typeof",
+    "case",
+    "do",
+    "else",
+    "in",
+    "of",
+    "new",
+    "delete",
+    "void",
+    "instanceof",
+    "yield",
+    "await"
+  ]);
+  let out = "";
+  let i = 0;
+  let lastSig = "";
+  let lastWord = "";
+  while (i < n) {
+    const ch = source[i];
+    if (ch === "/" && source[i + 1] === "/") {
+      const nl = source.indexOf("\n", i);
+      const end = nl === -1 ? n : nl;
+      out += source.slice(i, end);
+      i = end;
+      continue;
+    }
+    if (ch === "/" && source[i + 1] === "*") {
+      const close = source.indexOf("*/", i + 2);
+      const end = close === -1 ? n : close + 2;
+      out += source.slice(i, end);
+      i = end;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") {
+      const end = scanString(i);
+      out += source.slice(i, end);
+      lastSig = ch;
+      lastWord = "";
+      i = end;
+      continue;
+    }
+    if (ch === "/") {
+      const regexLikely = lastSig === "" || "(,=:;!&|?{}[+-*%~^<>".includes(lastSig) || REGEX_PRECEDING_WORDS.has(lastWord);
+      if (regexLikely) {
+        const end = scanRegex(i);
+        out += source.slice(i, end);
+        lastSig = "/";
+        lastWord = "";
+        i = end;
+        continue;
+      }
+      out += ch;
+      lastSig = ch;
+      lastWord = "";
+      i += 1;
+      continue;
+    }
+    if (isIdChar(ch)) {
+      let j = i;
+      while (j < n && isIdChar(source[j])) j += 1;
+      const word = source.slice(i, j);
+      if ((word === "while" || word === "for") && lastSig !== ".") {
+        const k = skipWsAndComments(j);
+        if (source[k] === "(") {
+          const close = matchParen(k);
+          if (close !== -1) {
+            const inner = source.slice(k + 1, close);
+            if (word === "while") {
+              out += `while (${guardName}() && (${inner}))`;
+              lastSig = ")";
+              lastWord = "";
+              i = close + 1;
+              continue;
+            }
+            const parts = splitTopLevelSemicolons(inner);
+            if (parts.length === 3) {
+              const cond = parts[1].trim();
+              const guardedCond = cond ? `${guardName}() && (${cond})` : `${guardName}()`;
+              out += `for (${parts[0]}; ${guardedCond}; ${parts[2]})`;
+              lastSig = ")";
+              lastWord = "";
+              i = close + 1;
+              continue;
+            }
+            out += source.slice(i, close + 1);
+            lastSig = ")";
+            lastWord = "";
+            i = close + 1;
+            continue;
+          }
+        }
+      }
+      out += word;
+      lastSig = word[word.length - 1];
+      lastWord = word;
+      i = j;
+      continue;
+    }
+    out += ch;
+    if (ch !== " " && ch !== "	" && ch !== "\n" && ch !== "\r") {
+      lastSig = ch;
+      lastWord = "";
+    }
+    i += 1;
+  }
+  return out;
+};
+var compileScriptCompute = (source, guard) => {
+  const makeFactory = (body) => new Function(
+    "__hpGuard",
     `"use strict";
-${source}
+${body}
 ;if (typeof compute !== "function") { throw new Error("Script must define function compute(bars, inputs, hp)"); }
 return compute;`
   );
-  return factory();
+  let factory;
+  try {
+    factory = makeFactory(injectLoopGuards(source, "__hpGuard"));
+  } catch {
+    factory = makeFactory(source);
+  }
+  guard.reset();
+  return factory(guard);
+};
+var validateScriptSource = (source) => {
+  try {
+    compileScriptCompute(source, createScriptGuard());
+    return null;
+  } catch (error) {
+    return error instanceof Error ? error.message : String(error);
+  }
 };
 var drawScriptError = (ctx, renderContext, name, message) => {
   ctx.save();
@@ -1569,17 +1868,23 @@ var compileScriptIndicator = (definition) => {
   }
   let compiled = null;
   let compileError = null;
+  const guard = createScriptGuard();
   try {
-    compiled = compileScriptCompute(definition.source);
+    compiled = compileScriptCompute(definition.source, guard);
   } catch (error) {
     compileError = error instanceof Error ? error.message : String(error);
   }
   const sourceKey = hashScriptSource(definition.source);
+  let trippedError = null;
   const runCompute = (data, inputs) => {
     if (!compiled) {
       return { error: compileError ?? "Script failed to compile" };
     }
+    if (trippedError) {
+      return { error: trippedError };
+    }
     try {
+      guard.reset();
       const result = compiled(data, inputs, SCRIPT_HELPERS);
       if (!result || !Array.isArray(result.plots)) {
         return { error: "compute() must return { plots: [...] }" };
@@ -1591,7 +1896,11 @@ var compileScriptIndicator = (definition) => {
       }
       return { result };
     } catch (error) {
-      return { error: error instanceof Error ? error.message : String(error) };
+      const message = error instanceof Error ? error.message : String(error);
+      if (error instanceof ScriptBudgetError) {
+        trippedError = message;
+      }
+      return { error: message };
     }
   };
   const cachedCompute = (data, inputs) => withCachedComputation(
@@ -8040,5 +8349,6 @@ export {
   FIB_DEFAULT_PALETTE,
   POSITION_DEFAULT_COLORS,
   compileScriptIndicator,
-  createChart
+  createChart,
+  validateScriptSource
 };

package/docs/API.md

@@ -607,3 +607,18 @@ Script contract:
 Errors never break the chart: compile or runtime errors render as an inline red message in the
 pane. Scripts are plain JavaScript executed in the page context — treat them like any other code
 you'd paste into your app (only run scripts you trust).
+
+### Execution budget
+
+Loop conditions are instrumented at compile time, and each `compute()` invocation gets a
+1000 ms wall-clock budget. A script that exceeds it (e.g. `while (true) {}`) throws
+`"Script exceeded the 1000ms execution budget"`, which renders as the usual inline pane error
+instead of freezing the tab. After a budget trip the script is circuit-broken — it is not run
+again for that compiled instance, so live ticks don't re-trigger the stall. Recompiling (editing
+the source and calling `compileScriptIndicator` again) resets the breaker. String/template/comment
+contents are never instrumented; `for...of` / `for...in` loops are left untouched.
+
+`validateScriptSource(source: string): string | null` — compile-checks a script without
+registering it, returning an error message or `null`. It runs under the same execution budget, so
+validating a script with a top-level infinite loop returns a budget error instead of hanging the
+caller. Use this for editor save-validation instead of running `new Function` yourself.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hyperprop-charting-library",
-  "version": "0.1.132",
+  "version": "0.1.133",
   "description": "Lightweight TypeScript charting core",
   "type": "module",
   "main": "./dist/hyperprop-charting-library.cjs",