npm - wu-framework - Versions diffs - 1.1.7 → 1.1.9 - Mend

wu-framework 1.1.7 → 1.1.9

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (95) hide show

package/LICENSE +19 -1
package/README.md +257 -1122
package/dist/wu-framework.cjs.js +3 -1
package/dist/wu-framework.cjs.js.map +1 -0
package/dist/wu-framework.dev.js +9867 -3183
package/dist/wu-framework.dev.js.map +1 -1
package/dist/wu-framework.esm.js +3 -0
package/dist/wu-framework.esm.js.map +1 -0
package/dist/wu-framework.umd.js +3 -1
package/dist/wu-framework.umd.js.map +1 -0
package/integrations/astro/README.md +127 -0
package/integrations/astro/WuApp.astro +63 -0
package/integrations/astro/WuShell.astro +39 -0
package/integrations/astro/index.js +68 -0
package/integrations/astro/package.json +38 -0
package/integrations/astro/types.d.ts +53 -0
package/package.json +96 -72
package/src/adapters/angular/ai.js +30 -0
package/src/adapters/angular/index.d.ts +154 -0
package/src/adapters/angular/index.js +932 -0
package/src/adapters/angular.d.ts +3 -154
package/src/adapters/angular.js +3 -813
package/src/adapters/index.js +35 -24
package/src/adapters/lit/ai.js +20 -0
package/src/adapters/lit/index.d.ts +120 -0
package/src/adapters/lit/index.js +721 -0
package/src/adapters/lit.d.ts +3 -120
package/src/adapters/lit.js +3 -726
package/src/adapters/preact/ai.js +33 -0
package/src/adapters/preact/index.d.ts +108 -0
package/src/adapters/preact/index.js +661 -0
package/src/adapters/preact.d.ts +3 -108
package/src/adapters/preact.js +3 -665
package/src/adapters/react/ai.js +135 -0
package/src/adapters/react/index.d.ts +246 -0
package/src/adapters/react/index.js +694 -0
package/src/adapters/react.d.ts +3 -212
package/src/adapters/react.js +3 -513
package/src/adapters/shared.js +64 -0
package/src/adapters/solid/ai.js +32 -0
package/src/adapters/solid/index.d.ts +101 -0
package/src/adapters/solid/index.js +586 -0
package/src/adapters/solid.d.ts +3 -101
package/src/adapters/solid.js +3 -591
package/src/adapters/svelte/ai.js +31 -0
package/src/adapters/svelte/index.d.ts +166 -0
package/src/adapters/svelte/index.js +798 -0
package/src/adapters/svelte.d.ts +3 -166
package/src/adapters/svelte.js +3 -803
package/src/adapters/vanilla/ai.js +30 -0
package/src/adapters/vanilla/index.d.ts +179 -0
package/src/adapters/vanilla/index.js +785 -0
package/src/adapters/vanilla.d.ts +3 -179
package/src/adapters/vanilla.js +3 -791
package/src/adapters/vue/ai.js +52 -0
package/src/adapters/vue/index.d.ts +299 -0
package/src/adapters/vue/index.js +608 -0
package/src/adapters/vue.d.ts +3 -299
package/src/adapters/vue.js +3 -611
package/src/ai/wu-ai-actions.js +261 -0
package/src/ai/wu-ai-agent.js +546 -0
package/src/ai/wu-ai-browser-primitives.js +354 -0
package/src/ai/wu-ai-browser.js +380 -0
package/src/ai/wu-ai-context.js +332 -0
package/src/ai/wu-ai-conversation.js +613 -0
package/src/ai/wu-ai-orchestrate.js +1021 -0
package/src/ai/wu-ai-permissions.js +381 -0
package/src/ai/wu-ai-provider.js +700 -0
package/src/ai/wu-ai-schema.js +225 -0
package/src/ai/wu-ai-triggers.js +396 -0
package/src/ai/wu-ai.js +804 -0
package/src/core/wu-app.js +50 -8
package/src/core/wu-cache.js +2 -3
package/src/core/wu-core.js +648 -681
package/src/core/wu-html-parser.js +121 -211
package/src/core/wu-iframe-sandbox.js +328 -0
package/src/core/wu-mcp-bridge.js +431 -0
package/src/core/wu-overrides.js +510 -0
package/src/core/wu-plugin.js +4 -1
package/src/core/wu-prefetch.js +414 -0
package/src/core/wu-proxy-sandbox.js +398 -75
package/src/core/wu-sandbox.js +86 -268
package/src/core/wu-script-executor.js +79 -182
package/src/core/wu-snapshot-sandbox.js +149 -106
package/src/core/wu-strategies.js +13 -0
package/src/core/wu-style-bridge.js +23 -23
package/src/index.js +162 -665
package/dist/wu-framework.hex.js +0 -23
package/dist/wu-framework.min.js +0 -1
package/dist/wu-framework.obf.js +0 -1
package/scripts/build-protected.js +0 -366
package/scripts/build.js +0 -212
package/scripts/rollup-plugin-hex.js +0 -143
package/src/core/wu-registry.js +0 -60
package/src/core/wu-sandbox-pool.js +0 -390

package/src/core/wu-iframe-sandbox.js ADDED Viewed

@@ -0,0 +1,328 @@
+/**
+ * WU-IFRAME-SANDBOX: Real JS isolation using hidden iframes.
+ *
+ * Architecture:
+ * ┌── Main Window ────────────────────────────────┐
+ * │  ┌── Shadow DOM Container ──────────────────┐ │
+ * │  │  App renders here (CSS isolated)          │ │
+ * │  └──────────────────────────────────────────┘ │
+ * │  ┌── Hidden iframe ────────────────────────┐  │
+ * │  │  import() runs here (REAL modules)       │  │
+ * │  │  window = iframe.contentWindow (ISOLATED)│  │
+ * │  │  document patched → Shadow DOM           │  │
+ * │  └────────────────────────────────────────-─┘  │
+ * └───────────────────────────────────────────────┘
+ *
+ * Why iframe?
+ * - import() is REAL → tree shaking, source maps, HMR all work
+ * - iframe has its own window → globals are isolated
+ * - Destroying iframe kills all timers/listeners at once
+ *
+ * How it works:
+ * 1. Create hidden iframe with <base href="appUrl"> for URL resolution
+ * 2. Patch iframe's document: createElement → main document (no ownerDocument issues),
+ *    querySelector/body → Shadow DOM container
+ * 3. Track timers for guaranteed cleanup (some browsers don't kill iframe timers)
+ * 4. import() the app module inside iframe → runs in isolated context
+ * 5. App calls wu.define() → lifecycle registered on parent's WuCore
+ * 6. On unmount: destroy iframe = nuclear cleanup
+ *
+ * Fallback:
+ * If import() fails (CORS, module errors), wu-core falls back to eval mode
+ * (fetch HTML + parse + execute with(proxy)).
+ */
+import { logger } from './wu-logger.js';
+export class WuIframeSandbox {
+  constructor(appName) {
+    this.appName = appName;
+    this.iframe = null;
+    this._active = false;
+    // Side-effect tracking for guaranteed cleanup
+    this._timers = new Set();
+    this._intervals = new Set();
+    this._rafs = new Set();
+    this._listeners = [];
+  }
+  /**
+   * Create and activate the iframe sandbox.
+   *
+   * @param {string} appUrl - App's base URL (for <base href> and relative imports)
+   * @param {HTMLElement} shadowContainer - Shadow DOM container for DOM redirection
+   * @param {ShadowRoot|null} shadowRoot - Shadow root for query scoping
+   * @returns {Window} The iframe's contentWindow (isolated execution context)
+   */
+  activate(appUrl, shadowContainer, shadowRoot) {
+    if (this._active) return this.iframe.contentWindow;
+    // 1. Create hidden iframe
+    const iframe = document.createElement('iframe');
+    iframe.setAttribute('data-wu-sandbox', this.appName);
+    iframe.style.cssText = 'display:none !important;position:absolute;width:0;height:0;border:0;';
+    // Must be in DOM before accessing contentWindow
+    document.body.appendChild(iframe);
+    this.iframe = iframe;
+    // 2. Write base HTML with <base href> pointing to app URL.
+    //    This makes relative URL resolution work for fetch(), CSS url(), etc.
+    //    import() of full URLs works regardless of base.
+    const baseUrl = appUrl.replace(/\/$/, '');
+    const iframeWin = iframe.contentWindow;
+    const iframeDoc = iframeWin.document;
+    iframeDoc.open();
+    iframeDoc.write(
+      `<!DOCTYPE html><html><head><base href="${baseUrl}/"></head><body></body></html>`
+    );
+    iframeDoc.close();
+    // 3. Make wu available inside iframe for wu.define()
+    iframeWin.wu = window.wu;
+    // 4. Patch document: redirect DOM operations to Shadow DOM
+    this._patchDocument(iframeWin, shadowContainer, shadowRoot);
+    // 5. Track timers for guaranteed cleanup
+    this._patchTimers(iframeWin);
+    this._active = true;
+    logger.wuDebug(`[IframeSandbox] Activated for ${this.appName} (base: ${baseUrl})`);
+    return iframeWin;
+  }
+  /**
+   * Import an ES module inside the iframe via real import().
+   * Preserves tree shaking, source maps, and Vite HMR.
+   *
+   * @param {string} url - Full module URL to import
+   * @param {number} [timeout=30000] - Max wait time in ms
+   * @returns {Promise<void>}
+   */
+  importModule(url, timeout = 30000) {
+    if (!this._active) {
+      throw new Error(`[IframeSandbox] Not active for ${this.appName}`);
+    }
+    return new Promise((resolve, reject) => {
+      const channelId = `wu_${this.appName}_${Date.now()}`;
+      // Listen for import completion via postMessage
+      const onMessage = (event) => {
+        if (event.data?.channelId !== channelId) return;
+        cleanup();
+        if (event.data.error) {
+          reject(new Error(event.data.error));
+        } else {
+          resolve();
+        }
+      };
+      const timer = setTimeout(() => {
+        cleanup();
+        reject(new Error(
+          `[IframeSandbox] import() timed out for ${this.appName}: ${url}`
+        ));
+      }, timeout);
+      const cleanup = () => {
+        window.removeEventListener('message', onMessage);
+        clearTimeout(timer);
+      };
+      window.addEventListener('message', onMessage);
+      // Inject module script into iframe
+      const iframeDoc = this.iframe.contentWindow.document;
+      const script = iframeDoc.createElement('script');
+      script.type = 'module';
+      script.textContent =
+        `import("${url.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}")` +
+        `.then(() => parent.postMessage({ channelId: "${channelId}", success: true }, '*'))` +
+        `.catch(e => parent.postMessage({ channelId: "${channelId}", error: e.message || String(e) }, '*'));`;
+      iframeDoc.head.appendChild(script);
+      logger.wuDebug(`[IframeSandbox] Importing module: ${url}`);
+    });
+  }
+  /**
+   * Patch the iframe's document to redirect DOM operations.
+   *
+   * Critical patches:
+   * - createElement/createTextNode → main document (avoids ownerDocument mismatch)
+   *   React/Vue create nodes and append to Shadow DOM container.
+   *   Nodes must belong to the main document to avoid cross-document adoption issues.
+   *
+   * - querySelector/body → Shadow DOM container
+   *   Libraries that query the document will find app elements in the Shadow DOM.
+   *
+   * - addEventListener → tracked for cleanup
+   */
+  _patchDocument(iframeWin, shadowContainer, shadowRoot) {
+    const iframeDoc = iframeWin.document;
+    const queryTarget = shadowRoot || shadowContainer;
+    const mainDoc = document; // parent document
+    // --- Node creation: use main document to avoid ownerDocument mismatch ---
+    // React uses container.ownerDocument.createElement() internally,
+    // but other code might use document.createElement() directly.
+    // By redirecting to main document, all nodes belong to the same document tree.
+    iframeDoc.createElement = (tag, options) => mainDoc.createElement(tag, options);
+    iframeDoc.createElementNS = (ns, tag, options) => mainDoc.createElementNS(ns, tag, options);
+    iframeDoc.createTextNode = (text) => mainDoc.createTextNode(text);
+    iframeDoc.createComment = (text) => mainDoc.createComment(text);
+    iframeDoc.createDocumentFragment = () => mainDoc.createDocumentFragment();
+    // --- DOM queries: redirect to Shadow DOM ---
+    iframeDoc.querySelector = (sel) => queryTarget.querySelector(sel);
+    iframeDoc.querySelectorAll = (sel) => queryTarget.querySelectorAll(sel);
+    iframeDoc.getElementById = (id) => queryTarget.querySelector(`#${id}`);
+    iframeDoc.getElementsByClassName = (cls) => queryTarget.querySelectorAll(`.${cls}`);
+    iframeDoc.getElementsByTagName = (tag) => queryTarget.querySelectorAll(tag);
+    // --- document.body → shadow container ---
+    // Frameworks that append to document.body (portals, modals) will target the Shadow DOM.
+    try {
+      Object.defineProperty(iframeDoc, 'body', {
+        get: () => shadowContainer,
+        configurable: true
+      });
+    } catch {
+      // Some environments don't allow redefining body — not critical
+      logger.wuDebug('[IframeSandbox] Could not redefine document.body');
+    }
+    // --- document.addEventListener: track for cleanup ---
+    const origDocAdd = iframeDoc.addEventListener.bind(iframeDoc);
+    const origDocRemove = iframeDoc.removeEventListener.bind(iframeDoc);
+    iframeDoc.addEventListener = (event, handler, options) => {
+      this._listeners.push({ target: iframeDoc, event, handler, options });
+      origDocAdd(event, handler, options);
+    };
+    iframeDoc.removeEventListener = (event, handler, options) => {
+      this._listeners = this._listeners.filter(
+        l => !(l.target === iframeDoc && l.event === event && l.handler === handler)
+      );
+      origDocRemove(event, handler, options);
+    };
+    logger.wuDebug(`[IframeSandbox] Document patched for ${this.appName}`);
+  }
+  /**
+   * Patch timers in the iframe for guaranteed cleanup.
+   * Some browsers don't fully kill timers when an iframe is removed.
+   * We track all IDs and clear them explicitly on destroy.
+   */
+  _patchTimers(iframeWin) {
+    const origSetTimeout = iframeWin.setTimeout.bind(iframeWin);
+    const origClearTimeout = iframeWin.clearTimeout.bind(iframeWin);
+    const origSetInterval = iframeWin.setInterval.bind(iframeWin);
+    const origClearInterval = iframeWin.clearInterval.bind(iframeWin);
+    iframeWin.setTimeout = (fn, ms, ...args) => {
+      const id = origSetTimeout((...a) => {
+        this._timers.delete(id);
+        if (typeof fn === 'function') fn(...a);
+      }, ms, ...args);
+      this._timers.add(id);
+      return id;
+    };
+    iframeWin.clearTimeout = (id) => {
+      this._timers.delete(id);
+      origClearTimeout(id);
+    };
+    iframeWin.setInterval = (fn, ms, ...args) => {
+      const id = origSetInterval(fn, ms, ...args);
+      this._intervals.add(id);
+      return id;
+    };
+    iframeWin.clearInterval = (id) => {
+      this._intervals.delete(id);
+      origClearInterval(id);
+    };
+    // requestAnimationFrame may not exist in all iframe contexts
+    if (iframeWin.requestAnimationFrame) {
+      const origRAF = iframeWin.requestAnimationFrame.bind(iframeWin);
+      const origCancelRAF = iframeWin.cancelAnimationFrame.bind(iframeWin);
+      iframeWin.requestAnimationFrame = (fn) => {
+        const id = origRAF((...a) => {
+          this._rafs.delete(id);
+          fn(...a);
+        });
+        this._rafs.add(id);
+        return id;
+      };
+      iframeWin.cancelAnimationFrame = (id) => {
+        this._rafs.delete(id);
+        origCancelRAF(id);
+      };
+    }
+    logger.wuDebug(`[IframeSandbox] Timer tracking active for ${this.appName}`);
+  }
+  /**
+   * Destroy the iframe and all side effects.
+   * Nuclear cleanup: kills everything at once.
+   */
+  destroy() {
+    if (!this._active) return;
+    this._active = false;
+    // 1. Clear all tracked timers
+    for (const id of this._timers) { try { clearTimeout(id); } catch {} }
+    for (const id of this._intervals) { try { clearInterval(id); } catch {} }
+    for (const id of this._rafs) { try { cancelAnimationFrame(id); } catch {} }
+    this._timers.clear();
+    this._intervals.clear();
+    this._rafs.clear();
+    // 2. Remove all tracked event listeners
+    for (const { target, event, handler, options } of this._listeners) {
+      try { target.removeEventListener(event, handler, options); } catch {}
+    }
+    this._listeners = [];
+    // 3. Wipe and remove iframe
+    if (this.iframe) {
+      try {
+        const doc = this.iframe.contentDocument;
+        if (doc) {
+          doc.open();
+          doc.write('');
+          doc.close();
+        }
+      } catch {
+        // Cross-origin or already detached — ignore
+      }
+      if (this.iframe.parentNode) {
+        this.iframe.parentNode.removeChild(this.iframe);
+      }
+      this.iframe = null;
+    }
+    logger.wuDebug(`[IframeSandbox] Destroyed for ${this.appName}`);
+  }
+  /**
+   * Check if this sandbox is active.
+   * @returns {boolean}
+   */
+  isActive() {
+    return this._active;
+  }
+}