npm - superdoc-macros - Versions diffs - 0.3.0 → 0.5.0 - Mend

superdoc-macros 0.3.0 → 0.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (22) hide show

package/README.md +17 -1
package/dist/host/superdoc-host.d.ts +8 -0
package/dist/host/superdoc-host.js +116 -27
package/dist/index.d.ts +4 -4
package/dist/index.js +2 -2
package/dist/manager.d.ts +62 -0
package/dist/manager.js +226 -11
package/dist/messages.d.ts +12 -1
package/dist/messages.js +24 -2
package/dist/recorder/recorder.d.ts +41 -1
package/dist/recorder/recorder.js +54 -24
package/dist/scripting/eval-runner.d.ts +13 -0
package/dist/scripting/eval-runner.js +31 -2
package/dist/scripting/iframe-runner.js +15 -4
package/dist/shortcuts.d.ts +12 -0
package/dist/shortcuts.js +19 -0
package/dist/snippets/autotext.d.ts +10 -1
package/dist/snippets/autotext.js +1 -1
package/dist/storage.d.ts +31 -1
package/dist/storage.js +99 -2
package/dist/types.d.ts +2 -0
package/package.json +1 -1

package/dist/scripting/eval-runner.js CHANGED Viewed

@@ -29,6 +29,32 @@ export function limitCalls(bridge, maxCalls) {
         },
     };
 }
+/**
+ * Wraps a bridge with a kill switch. After `revoke()` every new call is
+ * rejected — so a script that keeps running past its timeout (the eval
+ * runner cannot stop it) can no longer touch the document.
+ *
+ * What this cannot do: abort a host call that already reached the engine.
+ * The engine's public surfaces expose no cancellation, so an in-flight
+ * operation completes; what is guaranteed is that nothing *new* starts.
+ */
+export function revocable(bridge) {
+    let revoked = false;
+    return {
+        revoke: () => {
+            revoked = true;
+        },
+        bridge: {
+            api: bridge.api,
+            callCount: bridge.callCount,
+            call(method, args) {
+                if (revoked)
+                    return Promise.reject(new Error(macroMessages().macroStopped));
+                return bridge.call(method, args);
+            },
+        },
+    };
+}
 /** An api proxy that routes everything through `bridge.call`, so the cap applies here too. */
 function apiThroughBridge(bridge) {
     return new Proxy({}, {
@@ -43,7 +69,9 @@ export function createEvalRunner() {
     return {
         async run(source, bridge, options = {}) {
             const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-            const limited = limitCalls(bridge, options.maxApiCalls ?? DEFAULT_MAX_API_CALLS);
+            // The revocable wrapper is what contains a timed-out script: eval cannot
+            // stop it from running, but it can no longer reach the document.
+            const { bridge: guarded, revoke } = revocable(limitCalls(bridge, options.maxApiCalls ?? DEFAULT_MAX_API_CALLS));
             let fn;
             try {
                 fn = new AsyncFunction('api', `"use strict";\n${source}`);
@@ -61,7 +89,7 @@ export function createEvalRunner() {
             });
             const run = (async () => {
                 try {
-                    const value = await fn(apiThroughBridge(limited));
+                    const value = await fn(apiThroughBridge(guarded));
                     return { ok: true, value };
                 }
                 catch (error) {
@@ -77,6 +105,7 @@ export function createEvalRunner() {
             }
             finally {
                 clearTimeout(timer);
+                revoke();
             }
         },
     };

package/dist/scripting/iframe-runner.js CHANGED Viewed

@@ -16,7 +16,7 @@
  * `ScriptSelection`).
  */
 import { macroMessages } from '../messages.js';
-import { limitCalls } from './eval-runner.js';
+import { limitCalls, revocable } from './eval-runner.js';
 import { DEFAULT_MAX_API_CALLS, DEFAULT_TIMEOUT_MS, } from './runner.js';
 /** Protocol marker, so the messages cannot collide with others on the page. */
 export const PROTOCOL_MARK = '__otzariaMacro';
@@ -109,18 +109,29 @@ export function createIframeRunner(doc = document) {
     return {
         run(source, bridge, options = {}) {
             const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-            const limited = limitCalls(bridge, options.maxApiCalls ?? DEFAULT_MAX_API_CALLS);
+            // The revocable wrapper closes a small race: a call message that was
+            // already queued when the run finished must not dispatch to the host
+            // after the iframe is gone.
+            const { bridge: guarded, revoke } = revocable(limitCalls(bridge, options.maxApiCalls ?? DEFAULT_MAX_API_CALLS));
             return new Promise((resolve) => {
                 const iframe = doc.createElement('iframe');
                 iframe.setAttribute('sandbox', 'allow-scripts');
                 iframe.style.display = 'none';
-                iframe.srcdoc = `<!doctype html><meta charset="utf-8"><script>${SANDBOX_BOOTSTRAP}</script>`;
+                // The CSP closes the sandbox's remaining hole: an opaque-origin iframe
+                // cannot reach the app, but it can still fetch the public internet.
+                // `default-src 'none'` blocks fetch/XHR/WebSocket/resources inside it;
+                // only the inline bootstrap (and the AsyncFunction it compiles) runs.
+                iframe.srcdoc =
+                    `<!doctype html><meta charset="utf-8">` +
+                        `<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'unsafe-inline' 'unsafe-eval'">` +
+                        `<script>${SANDBOX_BOOTSTRAP}</script>`;
                 let settled = false;
                 let timer;
                 const finish = (result) => {
                     if (settled)
                         return;
                     settled = true;
+                    revoke();
                     clearTimeout(timer);
                     removeEventListener('message', onMessage);
                     iframe.remove();
@@ -139,7 +150,7 @@ export function createIframeRunner(doc = document) {
                     }
                     if (data.kind === 'call') {
                         const { id, method, args } = data;
-                        limited
+                        guarded
                             .call(method, args)
                             .then((value) => {
                             iframe.contentWindow?.postMessage({ [PROTOCOL_MARK]: true, kind: 'result', id, ok: true, value: toCloneSafe(value) }, '*');

package/dist/shortcuts.d.ts CHANGED Viewed

@@ -25,6 +25,18 @@ export interface KeyEventLike {
 }
 export declare function parseShortcut(shortcut: string): ParsedShortcut | null;
 export declare function eventMatches(parsed: ParsedShortcut, event: KeyEventLike): boolean;
+/**
+ * Comparable signatures for collision checks. `Mod` matches either Ctrl or
+ * Meta at runtime, so it expands to both — a `Mod+K` binding collides with
+ * `Ctrl+K` and with `Meta+K`.
+ */
+export declare function shortcutSignatures(parsed: ParsedShortcut): string[];
+/**
+ * Whether the shortcut is acceptable as a *saved binding*: it must carry a
+ * real modifier (Ctrl/Alt/Meta/Mod). A bare letter would fire on ordinary
+ * typing, and Shift alone is just an uppercase letter.
+ */
+export declare function hasBindingModifier(parsed: ParsedShortcut): boolean;
 export interface ShortcutBinding {
     shortcut: string;
     run(): void | Promise<unknown>;

package/dist/shortcuts.js CHANGED Viewed

@@ -58,6 +58,25 @@ export function eventMatches(parsed, event) {
         event.shiftKey === parsed.shift &&
         event.metaKey === parsed.meta);
 }
+/**
+ * Comparable signatures for collision checks. `Mod` matches either Ctrl or
+ * Meta at runtime, so it expands to both — a `Mod+K` binding collides with
+ * `Ctrl+K` and with `Meta+K`.
+ */
+export function shortcutSignatures(parsed) {
+    const suffix = `${parsed.alt ? 'alt+' : ''}${parsed.shift ? 'shift+' : ''}${parsed.key}`;
+    if (parsed.mod)
+        return [`ctrl+${suffix}`, `meta+${suffix}`];
+    return [`${parsed.ctrl ? 'ctrl+' : ''}${parsed.meta ? 'meta+' : ''}${suffix}`];
+}
+/**
+ * Whether the shortcut is acceptable as a *saved binding*: it must carry a
+ * real modifier (Ctrl/Alt/Meta/Mod). A bare letter would fire on ordinary
+ * typing, and Shift alone is just an uppercase letter.
+ */
+export function hasBindingModifier(parsed) {
+    return parsed.ctrl || parsed.alt || parsed.meta || parsed.mod;
+}
 /**
  * Binds shortcuts to a target. `getBindings` is called on every keystroke —
  * so the macro list can change without rebinding. Returns a dispose

package/dist/snippets/autotext.d.ts CHANGED Viewed

@@ -15,13 +15,22 @@
  * better than an expansion that deletes the wrong text.
  */
 import type { MacroHost, Snippet } from '../types.js';
+/** What an expansion actually did — what a recorder needs to stay truthful. */
+export interface AutoTextExpansion {
+    /** The trigger word the user typed. */
+    trigger: string;
+    /** The character that fired the expansion (and was restored at the end). */
+    expandChar: string;
+    /** The rendered snippet text that replaced the trigger. */
+    rendered: string;
+}
 export interface AutoTextOptions {
     /** The expansion characters. Default: space only. */
     expandOn?: readonly string[];
     /** Buffer size. A trigger word longer than this will not be recognized. */
     bufferSize?: number;
     /** Called after a successful expansion. */
-    onExpand?: (snippet: Snippet) => void;
+    onExpand?: (snippet: Snippet, expansion: AutoTextExpansion) => void;
     /** Called when an expansion failed (e.g. a read-only document). */
     onError?: (message: string) => void;
 }

package/dist/snippets/autotext.js CHANGED Viewed

@@ -94,7 +94,7 @@ export class AutoText {
                 this.onError?.(inserted.message);
                 return;
             }
-            this.onExpand?.(snippet);
+            this.onExpand?.(snippet, { trigger, expandChar, rendered });
         }
         finally {
             this.busy = false;

package/dist/storage.d.ts CHANGED Viewed

@@ -16,7 +16,37 @@ export interface MacroStorage {
     save(state: PersistedMacroState): void;
 }
 export declare function emptyState(): PersistedMacroState;
-/** Parses saved state. `null` on any unexpected shape — never throws. */
+/**
+ * Caps on imported data. Imports come from files users share with each
+ * other, so every field is validated and bounded — a malformed or oversized
+ * export must fail closed, not wedge the store or the UI.
+ */
+export declare const IMPORT_LIMITS: {
+    /** Whole-file size, in UTF-16 code units of the JSON string. */
+    readonly maxJsonLength: 5000000;
+    /** Per list: scripts, recordings, snippets. */
+    readonly maxItems: 500;
+    readonly maxStepsPerRecording: 5000;
+    readonly maxNameLength: 200;
+    readonly maxShortcutLength: 60;
+    readonly maxTriggerLength: 60;
+    /** Snippet text and single recorded insert-text step. */
+    readonly maxTextLength: 100000;
+    readonly maxSourceLength: 200000;
+};
+/**
+ * Whether a state object passes the exact validation the loader applies.
+ * The save paths hold this as an invariant: state that would be rejected on
+ * the next load must never be persisted — otherwise a single oversized save
+ * silently wipes everything at the next startup.
+ */
+export declare function isPersistableState(value: unknown): value is PersistedMacroState;
+/**
+ * Parses saved/imported state. `null` on any unexpected shape, oversized
+ * field or oversized file — never throws, never partially accepts: one
+ * invalid item rejects the whole document, so the caller can tell the user
+ * the file is bad instead of silently importing a subset.
+ */
 export declare function parsePersistedState(json: string): PersistedMacroState | null;
 export declare const DEFAULT_STORAGE_KEY = "superdoc-macros:v1";
 /** localStorage with guards: blocked or full storage must not take the toolkit down. */

package/dist/storage.js CHANGED Viewed

@@ -1,17 +1,114 @@
 export function emptyState() {
     return { version: 1, scripts: [], recordings: [], snippets: [] };
 }
+/**
+ * Caps on imported data. Imports come from files users share with each
+ * other, so every field is validated and bounded — a malformed or oversized
+ * export must fail closed, not wedge the store or the UI.
+ */
+export const IMPORT_LIMITS = {
+    /** Whole-file size, in UTF-16 code units of the JSON string. */
+    maxJsonLength: 5_000_000,
+    /** Per list: scripts, recordings, snippets. */
+    maxItems: 500,
+    maxStepsPerRecording: 5_000,
+    maxNameLength: 200,
+    maxShortcutLength: 60,
+    maxTriggerLength: 60,
+    /** Snippet text and single recorded insert-text step. */
+    maxTextLength: 100_000,
+    maxSourceLength: 200_000,
+};
+function boundedString(value, maxLength, allowEmpty = false) {
+    return typeof value === 'string' && value.length <= maxLength && (allowEmpty || value.length > 0);
+}
+function optionalBoundedString(value, maxLength) {
+    return value === undefined || boundedString(value, maxLength);
+}
+function isValidStep(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const step = value;
+    switch (step.type) {
+        case 'command':
+            // The payload is opaque engine data; the id is what replay dispatches on.
+            return boundedString(step.id, IMPORT_LIMITS.maxNameLength);
+        case 'insert-text':
+            return boundedString(step.text, IMPORT_LIMITS.maxTextLength, true);
+        case 'insert-paragraph':
+            return true;
+        case 'delete-backward':
+        case 'delete-forward':
+            return typeof step.count === 'number' && Number.isInteger(step.count) && step.count > 0 && step.count <= IMPORT_LIMITS.maxTextLength;
+        default:
+            return false;
+    }
+}
+function isValidScript(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const script = value;
+    return (boundedString(script.id, IMPORT_LIMITS.maxNameLength) &&
+        boundedString(script.name, IMPORT_LIMITS.maxNameLength) &&
+        boundedString(script.source, IMPORT_LIMITS.maxSourceLength, true) &&
+        optionalBoundedString(script.shortcut, IMPORT_LIMITS.maxShortcutLength));
+}
+function isValidRecording(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const recording = value;
+    return (recording.version === 1 &&
+        boundedString(recording.id, IMPORT_LIMITS.maxNameLength) &&
+        boundedString(recording.name, IMPORT_LIMITS.maxNameLength) &&
+        optionalBoundedString(recording.createdAt, IMPORT_LIMITS.maxNameLength) &&
+        optionalBoundedString(recording.shortcut, IMPORT_LIMITS.maxShortcutLength) &&
+        Array.isArray(recording.steps) &&
+        recording.steps.length <= IMPORT_LIMITS.maxStepsPerRecording &&
+        recording.steps.every(isValidStep));
+}
+function isValidSnippet(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const snippet = value;
+    return (boundedString(snippet.id, IMPORT_LIMITS.maxNameLength) &&
+        boundedString(snippet.name, IMPORT_LIMITS.maxNameLength) &&
+        boundedString(snippet.text, IMPORT_LIMITS.maxTextLength, true) &&
+        optionalBoundedString(snippet.trigger, IMPORT_LIMITS.maxTriggerLength) &&
+        optionalBoundedString(snippet.shortcut, IMPORT_LIMITS.maxShortcutLength));
+}
 function isValidState(value) {
     if (typeof value !== 'object' || value === null)
         return false;
     const state = value;
     return (state.version === 1 &&
         Array.isArray(state.scripts) &&
+        state.scripts.length <= IMPORT_LIMITS.maxItems &&
+        state.scripts.every(isValidScript) &&
         Array.isArray(state.recordings) &&
-        Array.isArray(state.snippets));
+        state.recordings.length <= IMPORT_LIMITS.maxItems &&
+        state.recordings.every(isValidRecording) &&
+        Array.isArray(state.snippets) &&
+        state.snippets.length <= IMPORT_LIMITS.maxItems &&
+        state.snippets.every(isValidSnippet));
 }
-/** Parses saved state. `null` on any unexpected shape — never throws. */
+/**
+ * Whether a state object passes the exact validation the loader applies.
+ * The save paths hold this as an invariant: state that would be rejected on
+ * the next load must never be persisted — otherwise a single oversized save
+ * silently wipes everything at the next startup.
+ */
+export function isPersistableState(value) {
+    return isValidState(value);
+}
+/**
+ * Parses saved/imported state. `null` on any unexpected shape, oversized
+ * field or oversized file — never throws, never partially accepts: one
+ * invalid item rejects the whole document, so the caller can tell the user
+ * the file is bad instead of silently importing a subset.
+ */
 export function parsePersistedState(json) {
+    if (json.length > IMPORT_LIMITS.maxJsonLength)
+        return null;
     try {
         const parsed = JSON.parse(json);
         return isValidState(parsed) ? parsed : null;

package/dist/types.d.ts CHANGED Viewed

@@ -56,6 +56,8 @@ export interface MacroHost {
     insertText(text: string): Promise<MacroOutcome>;
     /** Deletes characters backwards from the caret. */
     deleteBackward(count: number): Promise<MacroOutcome>;
+    /** Deletes characters forwards from the caret. */
+    deleteForward(count: number): Promise<MacroOutcome>;
     /** Snapshot of the current selection. Never throws. */
     getSelection(options?: {
         includeText?: boolean;

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "superdoc-macros",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Macro toolkit for SuperDoc-based editors: sandboxed scripted macros, a Word-style macro recorder, and snippets with auto-text expansion.",
   "license": "MIT",
   "type": "module",