wu-framework 1.1.16 → 1.1.18

package/src/core/wu-cache.js

@@ -32,6 +32,9 @@ export class WuCache {
       cooldownUntil: 0
     };
 
+    // Rate limit notification flag (log only once per cooldown)
+    this._rateLimitNotified = false;
+
     // Memory cache
     this.memoryCache = new Map();
 
@@ -66,6 +69,7 @@ export class WuCache {
       }
       // Cooldown terminado
       this.rateLimiting.inCooldown = false;
+      this._rateLimitNotified = false;
       this.rateLimiting.operations = [];
     }
 
@@ -91,7 +95,22 @@ export class WuCache {
   }
 
   /**
-   * 🔐 GET RATE LIMIT STATUS
+   * Handle rate-limited operations: log once per cooldown, return diagnostic object
+   * @param {string} operation - The operation that was rate limited ('get' or 'set')
+   * @param {string} key - The cache key that was rejected
+   * @returns {{ rateLimited: true, operation: string, key: string }}
+   */
+  _onRateLimited(operation, key) {
+    if (!this._rateLimitNotified) {
+      const cooldownRemaining = Math.max(0, this.rateLimiting.cooldownUntil - Date.now());
+      logger.warn(`[WuCache] Rate limited: ${operation} for key "${key}" rejected. ${cooldownRemaining}ms remaining in cooldown.`);
+      this._rateLimitNotified = true;
+    }
+    return { rateLimited: true, operation, key };
+  }
+
+  /**
+   * GET RATE LIMIT STATUS
    */
   getRateLimitStatus() {
     const now = Date.now();
@@ -115,7 +134,8 @@ export class WuCache {
   get(key) {
     // 🔐 Check rate limit
     if (!this._checkRateLimit()) {
-      return null; // Silently fail on rate limit
+      this._onRateLimited('get', key);
+      return null;
     }
 
     // 1. Buscar en memoria
@@ -162,7 +182,8 @@ export class WuCache {
   set(key, value, ttl) {
     // 🔐 Check rate limit
     if (!this._checkRateLimit()) {
-      return false; // Reject on rate limit
+      this._onRateLimited('set', key);
+      return false;
     }
 
     try {

package/src/core/wu-core.js

@@ -333,6 +333,20 @@ export class WuCore {
     } catch (error) {
       logger.wuError(`Mount attempt ${attempt + 1} failed for ${appName}:`, error);
 
+      // Cleanup sandbox to prevent orphaned shadow DOMs
+      try {
+        if (this.sandbox && this.sandbox.sandboxes && this.sandbox.sandboxes.has(appName)) {
+          const sb = this.sandbox.sandboxes.get(appName);
+          if (sb && sb.proxySandbox) {
+            sb.proxySandbox.deactivate();
+          }
+          this.sandbox.sandboxes.delete(appName);
+          logger.wuDebug(`Sandbox cleaned up after mount failure for ${appName}`);
+        }
+      } catch (cleanupError) {
+        logger.wuWarn(`Sandbox cleanup failed for ${appName}:`, cleanupError);
+      }
+
       // Use error boundary for intelligent error handling
       const errorResult = await this.errorBoundary.handle(error, {
         appName,
@@ -671,7 +685,7 @@ export class WuCore {
    * Intelligently resolves module paths with real-time validation
    */
   async resolveModulePath(app) {
-    let entryFile = app.manifest?.entry || 'main.js';
+    const entryFile = app.manifest?.entry || 'main.js';
     const baseUrl = app.url.replace(/\/$/, ''); // Remove trailing slash
 
     // Normalize path: Remove duplicated directories

package/src/core/wu-error-boundary.js

@@ -314,19 +314,33 @@ export class WuErrorBoundary {
    * @param {Object} context - Contexto
    */
   logError(error, context) {
+    // Truncate stack to first 5 lines to prevent retaining large object references
+    const stack = error.stack ? error.stack.split('\n').slice(0, 5).join('\n') : '';
+
+    // Shallow-copy context to avoid retaining references to live objects
+    const safeContext = {};
+    for (const key of Object.keys(context)) {
+      const val = context[key];
+      if (typeof val === 'string' || typeof val === 'number' || typeof val === 'boolean' || val === null) {
+        safeContext[key] = val;
+      } else {
+        safeContext[key] = String(val);
+      }
+    }
+
     const errorEntry = {
       error: {
         name: error.name,
         message: error.message,
-        stack: error.stack
+        stack
       },
-      context,
+      context: safeContext,
       timestamp: Date.now()
     };
 
     this.errorLog.push(errorEntry);
 
-    // Mantener límite de log
+    // Maintain log limit
     if (this.errorLog.length > this.maxErrorLog) {
       this.errorLog.shift();
     }

package/src/core/wu-event-bus.js

@@ -10,6 +10,25 @@
  */
 import { logger } from './wu-logger.js';
 
+/**
+ * @typedef {Object} WuEvent
+ * @property {string} name - Event name
+ * @property {*} data - Event payload
+ * @property {number} timestamp - Event timestamp
+ * @property {string} appName - Source app name
+ * @property {Object} meta - Additional metadata
+ * @property {boolean} verified - Whether origin was verified
+ */
+
+/**
+ * @typedef {Object} WuEventBusConfig
+ * @property {number} [maxHistory=100] - Maximum events in history
+ * @property {boolean} [enableReplay=true] - Enable event replay
+ * @property {boolean} [enableWildcards=true] - Enable wildcard matching
+ * @property {boolean} [logEvents=false] - Log all events
+ * @property {boolean} [strictMode=false] - Reject unauthorized events
+ * @property {boolean} [validateOrigin=true] - Validate event origins
+ */
 
 export class WuEventBus {
   constructor() {
@@ -20,16 +39,21 @@ export class WuEventBus {
     this.authorizedApps = new Map(); // appName -> { token, permissions }
     this.trustedEvents = new Set(['wu:*', 'system:*']); // Eventos del sistema
 
+    // Auto-detect production environment for strictMode default
+    const isProduction = typeof process !== 'undefined' && process.env?.NODE_ENV === 'production';
+
     this.config = {
       maxHistory: 100,
       enableReplay: true,
       enableWildcards: true,
       logEvents: false,
       // 🔐 Opciones de seguridad
-      strictMode: false, // Si true, rechaza eventos de apps no autorizadas
+      strictMode: isProduction, // Auto-enabled in production, permissive in development
       validateOrigin: true // Valida que appName sea una app registrada
     };
 
+    this._permissiveWarned = false;
+
     this.stats = {
       emitted: 0,
       subscriptions: 0,
@@ -127,6 +151,19 @@ export class WuEventBus {
     return `wu_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
   }
 
+  /**
+   * WARN PERMISSIVE MODE: Log a one-time warning when strictMode is off
+   * Alerts developers that events are flowing without authorization checks
+   */
+  _warnPermissiveMode() {
+    if (this._permissiveWarned) return;
+    this._permissiveWarned = true;
+    logger.warn(
+      '[WuEventBus] strictMode is disabled. Events are emitted without authorization checks. ' +
+      'Enable strictMode for production by calling enableStrictMode() or setting NODE_ENV=production.'
+    );
+  }
+
   /**
    * 📢 EMIT: Emitir evento con validación de origen
    * @param {string} eventName - Nombre del evento
@@ -136,6 +173,11 @@ export class WuEventBus {
   emit(eventName, data, options = {}) {
     const appName = options.appName || 'unknown';
 
+    // Warn once if running in permissive mode (strictMode off)
+    if (!this.config.strictMode) {
+      this._warnPermissiveMode();
+    }
+
     // 🔐 Validar origen si está habilitado
     if (this.config.validateOrigin && this.config.strictMode) {
       if (!this._validateOrigin(eventName, appName, options.token)) {

package/src/core/wu-html-parser.js

@@ -62,19 +62,28 @@ export class WuHtmlParser {
       return this._cache.get(cacheKey);
     }
 
-    const temp = document.createElement('div');
-    temp.innerHTML = html;
+    const parser = new DOMParser();
+    const doc = parser.parseFromString(html, 'text/html');
 
     const inlineScripts = [];
     const externalScripts = [];
     const inlineStyles = [];
     const externalStyles = [];
 
-    this._extractResources(temp, {
+    const ctx = {
       inlineScripts, externalScripts,
       inlineStyles, externalStyles,
       baseUrl
-    });
+    };
+
+    // DOMParser moves <style>, <link>, and some <script> tags to <head>.
+    // Extract resources from both head and body to capture everything.
+    if (doc.head) {
+      this._extractResources(doc.head, ctx);
+    }
+
+    const temp = doc.body || doc.documentElement;
+    this._extractResources(temp, ctx);
 
     const result = {
       dom: temp.innerHTML,

package/src/core/wu-loader.js

@@ -1,68 +1,177 @@
 /**
- * 🚀 WU-LOADER: SISTEMA DE CARGA DINÁMICA UNIVERSAL
+ * WU-LOADER: SISTEMA DE CARGA DINAMICA UNIVERSAL
  * Carga aplicaciones y componentes sin depender del framework
+ *
+ * Cache strategy: LRU with TTL eviction.
+ * Entries track lastAccess time. When the cache reaches maxCacheSize,
+ * the least recently accessed entry is evicted. Entries older than
+ * cacheTTL are treated as stale and removed on access or eviction.
  */
 
 import { logger } from './wu-logger.js';
 
+/**
+ * @typedef {Object} WuLoaderOptions
+ * @property {number} [maxCacheSize=50] - Maximum cache entries
+ * @property {number} [cacheTTL=1800000] - Cache TTL in ms (default 30min)
+ */
+
+/**
+ * @typedef {Object} WuLoaderStats
+ * @property {number} cached - Number of cached entries
+ * @property {number} loading - Number of in-flight loads
+ * @property {number} maxCacheSize - Max cache size setting
+ * @property {number} cacheTTL - Cache TTL setting
+ * @property {string[]} cacheKeys - Cached URL keys
+ */
+
 export class WuLoader {
-  constructor() {
+  /**
+   * @param {Object} options
+   * @param {number} [options.maxCacheSize=50] - Maximum number of entries in the cache
+   * @param {number} [options.cacheTTL=1800000] - Time-to-live for cache entries in ms (default 30 minutes)
+   */
+  constructor(options = {}) {
+    this.maxCacheSize = options.maxCacheSize ?? 50;
+    this.cacheTTL = options.cacheTTL ?? 1800000;
     this.cache = new Map();
     this.loadingPromises = new Map();
 
-    logger.debug('[WuLoader] 📦 Dynamic loader initialized');
+    logger.debug('[WuLoader] Dynamic loader initialized');
+  }
+
+  /**
+   * Read from cache with TTL validation and LRU access tracking.
+   * Returns undefined if the entry does not exist or has expired.
+   * @param {string} key
+   * @returns {string|undefined}
+   */
+  _cacheGet(key) {
+    if (!this.cache.has(key)) {
+      return undefined;
+    }
+
+    const entry = this.cache.get(key);
+    const now = Date.now();
+
+    if (now - entry.timestamp > this.cacheTTL) {
+      this.cache.delete(key);
+      logger.debug(`[WuLoader] Cache expired for: ${key}`);
+      return undefined;
+    }
+
+    // Promote: delete and re-insert so iteration order reflects recency.
+    // Map iteration order in JS follows insertion order, so the oldest
+    // inserted entry is always first -- exactly what we need for LRU eviction.
+    this.cache.delete(key);
+    entry.lastAccess = now;
+    this.cache.set(key, entry);
+
+    return entry.code;
+  }
+
+  /**
+   * Write to cache. Evicts stale and LRU entries before inserting.
+   * @param {string} key
+   * @param {string} code
+   */
+  _cacheSet(key, code) {
+    // If the key already exists, remove it first so re-insertion
+    // moves it to the end (most-recently-used position).
+    if (this.cache.has(key)) {
+      this.cache.delete(key);
+    }
+
+    this._evictIfNeeded();
+
+    const now = Date.now();
+    this.cache.set(key, {
+      code,
+      timestamp: now,
+      lastAccess: now
+    });
+  }
+
+  /**
+   * Evict entries until cache is below maxCacheSize.
+   *
+   * Two-pass strategy:
+   *   1. Remove all expired entries (TTL exceeded).
+   *   2. If still at capacity, remove the least recently accessed entry.
+   *      Because Map preserves insertion order and _cacheGet promotes on
+   *      access, the first key from the iterator is always the LRU entry.
+   */
+  _evictIfNeeded() {
+    const now = Date.now();
+
+    // Pass 1: purge expired entries
+    for (const [key, entry] of this.cache) {
+      if (now - entry.timestamp > this.cacheTTL) {
+        this.cache.delete(key);
+        logger.debug(`[WuLoader] Evicted expired entry: ${key}`);
+      }
+    }
+
+    // Pass 2: evict LRU entries until we are under the limit
+    while (this.cache.size >= this.maxCacheSize) {
+      // Map.keys().next() gives us the oldest-inserted key (LRU)
+      const oldestKey = this.cache.keys().next().value;
+      this.cache.delete(oldestKey);
+      logger.debug(`[WuLoader] Evicted LRU entry: ${oldestKey}`);
+    }
   }
 
   /**
-   * Cargar aplicación completa
-   * @param {string} appUrl - URL base de la aplicación
-   * @param {Object} manifest - Manifest de la aplicación
-   * @returns {string} Código JavaScript de la aplicación
+   * Cargar aplicacion completa
+   * @param {string} appUrl - URL base de la aplicacion
+   * @param {Object} manifest - Manifest de la aplicacion
+   * @returns {string} Codigo JavaScript de la aplicacion
    */
   async loadApp(appUrl, manifest) {
     const entryFile = manifest?.entry || 'index.js';
     const fullUrl = `${appUrl}/${entryFile}`;
 
-    logger.debug(`[WuLoader] 📥 Loading app from: ${fullUrl}`);
+    logger.debug(`[WuLoader] Loading app from: ${fullUrl}`);
 
     try {
-      // Verificar cache
-      if (this.cache.has(fullUrl)) {
-        logger.debug(`[WuLoader] ⚡ Cache hit for: ${fullUrl}`);
-        return this.cache.get(fullUrl);
+      // Check cache with TTL and LRU tracking
+      const cached = this._cacheGet(fullUrl);
+      if (cached !== undefined) {
+        logger.debug(`[WuLoader] Cache hit for: ${fullUrl}`);
+        return cached;
       }
 
-      // Verificar si ya está cargando
+      // Check if already loading
       if (this.loadingPromises.has(fullUrl)) {
-        logger.debug(`[WuLoader] ⏳ Loading in progress for: ${fullUrl}`);
+        logger.debug(`[WuLoader] Loading in progress for: ${fullUrl}`);
         return await this.loadingPromises.get(fullUrl);
       }
 
-      // Crear promesa de carga
+      // Create loading promise
       const loadingPromise = this.fetchCode(fullUrl);
       this.loadingPromises.set(fullUrl, loadingPromise);
 
       const code = await loadingPromise;
 
-      // Limpiar promesa de carga y cachear resultado
+      // Clean up loading promise and cache result
       this.loadingPromises.delete(fullUrl);
-      this.cache.set(fullUrl, code);
+      this._cacheSet(fullUrl, code);
 
-      logger.debug(`[WuLoader] ✅ App loaded successfully: ${fullUrl}`);
+      logger.debug(`[WuLoader] App loaded successfully: ${fullUrl}`);
       return code;
 
     } catch (error) {
       this.loadingPromises.delete(fullUrl);
-      console.error(`[WuLoader] ❌ Failed to load app: ${fullUrl}`, error);
+      console.error(`[WuLoader] Failed to load app: ${fullUrl}`, error);
       throw new Error(`Failed to load app from ${fullUrl}: ${error.message}`);
     }
   }
 
   /**
-   * Cargar componente específico
-   * @param {string} appUrl - URL base de la aplicación
+   * Cargar componente especifico
+   * @param {string} appUrl - URL base de la aplicacion
    * @param {string} componentPath - Ruta del componente
-   * @returns {Function} Función del componente
+   * @returns {Function} Funcion del componente
    */
   async loadComponent(appUrl, componentPath) {
     // Normalizar ruta del componente
@@ -76,13 +185,13 @@ export class WuLoader {
 
     const fullUrl = `${appUrl}/${normalizedPath}`;
 
-    logger.debug(`[WuLoader] 🧩 Loading component from: ${fullUrl}`);
+    logger.debug(`[WuLoader] Loading component from: ${fullUrl}`);
 
     try {
-      // Cargar código del componente
+      // Cargar codigo del componente
       const code = await this.loadCode(fullUrl);
 
-      // Crear función que retorna el componente
+      // Crear funcion que retorna el componente
       const componentFunction = new Function('require', 'module', 'exports', `
         ${code}
         return typeof module.exports === 'function' ? module.exports :
@@ -99,39 +208,40 @@ export class WuLoader {
 
       const component = componentFunction(fakeRequire, fakeModule, fakeModule.exports);
 
-      logger.debug(`[WuLoader] ✅ Component loaded: ${componentPath}`);
+      logger.debug(`[WuLoader] Component loaded: ${componentPath}`);
       return component;
 
     } catch (error) {
-      console.error(`[WuLoader] ❌ Failed to load component: ${componentPath}`, error);
+      console.error(`[WuLoader] Failed to load component: ${componentPath}`, error);
       throw new Error(`Failed to load component ${componentPath}: ${error.message}`);
     }
   }
 
   /**
-   * Cargar código con cache
+   * Cargar codigo con cache
    * @param {string} url - URL del archivo
-   * @returns {string} Código JavaScript
+   * @returns {string} Codigo JavaScript
    */
   async loadCode(url) {
-    // Verificar cache
-    if (this.cache.has(url)) {
-      return this.cache.get(url);
+    // Check cache with TTL and LRU tracking
+    const cached = this._cacheGet(url);
+    if (cached !== undefined) {
+      return cached;
     }
 
-    // Verificar si ya está cargando
+    // Check if already loading
     if (this.loadingPromises.has(url)) {
       return await this.loadingPromises.get(url);
     }
 
-    // Crear promesa de carga
+    // Create loading promise
     const loadingPromise = this.fetchCode(url);
     this.loadingPromises.set(url, loadingPromise);
 
     try {
       const code = await loadingPromise;
       this.loadingPromises.delete(url);
-      this.cache.set(url, code);
+      this._cacheSet(url, code);
       return code;
     } catch (error) {
       this.loadingPromises.delete(url);
@@ -140,9 +250,9 @@ export class WuLoader {
   }
 
   /**
-   * Realizar fetch del código
+   * Realizar fetch del codigo
    * @param {string} url - URL del archivo
-   * @returns {string} Código JavaScript
+   * @returns {string} Codigo JavaScript
    */
   async fetchCode(url) {
     const response = await fetch(url, {
@@ -170,25 +280,25 @@ export class WuLoader {
    * @param {Array} appConfigs - Configuraciones de aplicaciones
    */
   async preload(appConfigs) {
-    logger.debug(`[WuLoader] 🚀 Preloading ${appConfigs.length} apps...`);
+    logger.debug(`[WuLoader] Preloading ${appConfigs.length} apps...`);
 
     const preloadPromises = appConfigs.map(async (config) => {
       try {
         await this.loadApp(config.url, config.manifest);
-        logger.debug(`[WuLoader] ✅ Preloaded: ${config.name}`);
+        logger.debug(`[WuLoader] Preloaded: ${config.name}`);
       } catch (error) {
-        logger.warn(`[WuLoader] ⚠️ Failed to preload ${config.name}:`, error.message);
+        logger.warn(`[WuLoader] Failed to preload ${config.name}:`, error.message);
       }
     });
 
     await Promise.allSettled(preloadPromises);
-    logger.debug(`[WuLoader] 🎉 Preload completed`);
+    logger.debug(`[WuLoader] Preload completed`);
   }
 
   /**
-   * Verificar si una URL está disponible
+   * Verificar si una URL esta disponible
    * @param {string} url - URL a verificar
-   * @returns {boolean} True si está disponible
+   * @returns {boolean} True si esta disponible
    */
   async isAvailable(url) {
     try {
@@ -232,9 +342,9 @@ export class WuLoader {
       try {
         const component = await this.loadComponent(app.url, exportPath);
         resolved.set(importPath, component);
-        logger.debug(`[WuLoader] ✅ Resolved dependency: ${importPath}`);
+        logger.debug(`[WuLoader] Resolved dependency: ${importPath}`);
       } catch (error) {
-        console.error(`[WuLoader] ❌ Failed to resolve: ${importPath}`, error);
+        console.error(`[WuLoader] Failed to resolve: ${importPath}`, error);
       }
     }
 
@@ -243,7 +353,7 @@ export class WuLoader {
 
   /**
    * Limpiar cache
-   * @param {string} pattern - Patrón opcional para limpiar URLs específicas
+   * @param {string} pattern - Patron opcional para limpiar URLs especificas
    */
   clearCache(pattern) {
     if (pattern) {
@@ -251,23 +361,25 @@ export class WuLoader {
       for (const [url] of this.cache) {
         if (regex.test(url)) {
           this.cache.delete(url);
-          logger.debug(`[WuLoader] 🗑️ Cleared cache for: ${url}`);
+          logger.debug(`[WuLoader] Cleared cache for: ${url}`);
         }
       }
     } else {
       this.cache.clear();
-      logger.debug(`[WuLoader] 🗑️ Cache cleared completely`);
+      logger.debug(`[WuLoader] Cache cleared completely`);
     }
   }
 
   /**
-   * Obtener estadísticas del loader
+   * Obtener estadisticas del loader
    */
   getStats() {
     return {
       cached: this.cache.size,
+      maxCacheSize: this.maxCacheSize,
+      cacheTTL: this.cacheTTL,
       loading: this.loadingPromises.size,
       cacheKeys: Array.from(this.cache.keys())
     };
   }
-}
+}

package/src/core/wu-logger.js

@@ -23,19 +23,27 @@ export class WuLogger {
    * Detectar si estamos en desarrollo
    */
   detectEnvironment() {
-    // Múltiples formas de detectar desarrollo
-    return (
-      // Vite development
-      window.location.hostname === 'localhost' ||
-      window.location.hostname === '127.0.0.1' ||
-      window.location.port !== '' ||
-      // NODE_ENV si está disponible
-      (typeof process !== 'undefined' && process.env?.NODE_ENV === 'development') ||
-      // URL params para forzar debug
-      new URLSearchParams(window.location.search).has('wu-debug') ||
-      // Manual override
-      window.WU_DEBUG === true
-    );
+    // 1. Explicit flag takes priority
+    if (typeof window !== 'undefined' && window.WU_DEBUG === true) return true;
+    if (typeof window !== 'undefined' && window.WU_DEBUG === false) return false;
+
+    // 2. NODE_ENV check (works in bundlers and Node)
+    if (typeof process !== 'undefined' && process.env?.NODE_ENV === 'production') return false;
+    if (typeof process !== 'undefined' && process.env?.NODE_ENV === 'development') return true;
+
+    // 3. Browser heuristics (only if window exists)
+    if (typeof window !== 'undefined' && window.location) {
+      const hostname = window.location.hostname;
+      if (hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]') return true;
+
+      // URL param override
+      try {
+        if (new URLSearchParams(window.location.search).has('wu-debug')) return true;
+      } catch {}
+    }
+
+    // 4. Default: assume production
+    return false;
   }
 
   /**

package/src/core/wu-manifest.js

@@ -302,6 +302,29 @@ export class WuManifest {
       }
     }
 
+    // Validate optional fields
+    if (manifest.styleMode !== undefined) {
+      const validModes = ['shared', 'isolated', 'fully-isolated'];
+      if (!validModes.includes(manifest.styleMode)) {
+        logger.warn(`[WuManifest] Invalid styleMode "${manifest.styleMode}", defaulting to "shared". Valid: ${validModes.join(', ')}`);
+        manifest.styleMode = 'shared';
+      }
+    }
+
+    if (manifest.version !== undefined && typeof manifest.version !== 'string') {
+      logger.warn('[WuManifest] version must be a string, ignoring');
+      delete manifest.version;
+    }
+
+    if (manifest.folder !== undefined) {
+      if (typeof manifest.folder !== 'string') {
+        logger.warn('[WuManifest] folder must be a string, ignoring');
+        delete manifest.folder;
+      } else if (this._hasDangerousPatterns(manifest.folder)) {
+        throw new Error('folder contains dangerous patterns');
+      }
+    }
+
     // Normalizar y limpiar manifest
     return this.normalize(manifest);
   }