@aglyn/shared-util-tools 1.0.0-beta.143

package/src/lib/interop-default.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/shared/util/tools/src/lib/interop-default.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2022 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n\nexport function interopDefault(mod: any) {\n  return mod?.default || mod\n}\n\nexport default interopDefault\n"],"names":["interopDefault","mod","default"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAGD,OAAO,SAASA,eAAeC,GAAQ;IACrC,OAAOA,CAAAA,uBAAAA,IAAKC,OAAO,KAAID;AACzB;AAEA,eAAeD,eAAc"}

package/src/lib/length.d.ts

@@ -0,0 +1,22 @@
+/**
+ * @license
+ * Copyright 2022 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Shortcut for retrieving the length property,
+ * defaults to zero (0) if the property does not exist
+ */
+export declare function length(val: unknown): number;
+export default length;

package/src/lib/length.js

@@ -0,0 +1,28 @@
+/**
+ * @license
+ * Copyright 2022 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Shortcut for retrieving the length property,
+ * defaults to zero (0) if the property does not exist
+ */ export function length(val) {
+    if (val && (typeof val === 'object' || typeof val === 'string' || Array.isArray(val))) {
+        var _val_length;
+        return (_val_length = val['length']) != null ? _val_length : 0;
+    }
+    return 0;
+}
+export default length;
+
+//# sourceMappingURL=length.js.map

package/src/lib/length.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/shared/util/tools/src/lib/length.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2022 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n\n/**\n * Shortcut for retrieving the length property,\n * defaults to zero (0) if the property does not exist\n */\nexport function length(val: unknown): number {\n  if (val && (typeof val === 'object' || typeof val === 'string' || Array.isArray(val))) {\n    return (val as any)['length'] ?? 0\n  }\n  return 0\n}\nexport default length\n"],"names":["length","val","Array","isArray"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAGD;;;CAGC,GACD,OAAO,SAASA,OAAOC,GAAY;IACjC,IAAIA,OAAQ,CAAA,OAAOA,QAAQ,YAAY,OAAOA,QAAQ,YAAYC,MAAMC,OAAO,CAACF,IAAG,GAAI;YAC9E;QAAP,QAAO,cAAA,AAACA,GAAW,CAAC,SAAS,YAAtB,cAA0B;IACnC;IACA,OAAO;AACT;AACA,eAAeD,OAAM"}

package/src/lib/linear-regex.d.ts

@@ -0,0 +1,136 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * A linear-time regular-expression engine (SEC-M8 / AGL-1881), for patterns
+ * someone other than the platform wrote that run where every tenant renders:
+ * host redirect rules, and the conditions a component or layout property
+ * declares (AGL-2893).
+ *
+ * WHY THIS EXISTS
+ *
+ * Redirect regexes are attacker-authored (any `author` on a paid site can
+ * write `source` straight to Firestore — the console's validation is not a
+ * control) and they execute on the tenant render path, in the Node process
+ * shared by every tenant. `RegExp.prototype.exec` is a backtracking matcher,
+ * so a pattern like `(a|a|aa)+` against `"aaaa…a!"` costs exponential time:
+ * measured at 59 s for a 9-character pattern and a 27-character path, and it
+ * keeps doubling from there. That is a multi-tenant denial of service. A
+ * property condition's pattern is the same hazard with a wider door: it can
+ * arrive from a marketplace listing, and it runs on every page that places
+ * the component and in the console of everyone who installed it.
+ *
+ * Three heuristics have been tried and bypassed (AGL-505 star height, a
+ * length cap, nesting limits). A shape heuristic can never be sound: deciding
+ * whether an arbitrary backtracking regex is safe is the same problem as
+ * bounding its search tree. So this module does not inspect patterns for
+ * dangerous shapes. It removes the backtracking engine.
+ *
+ * HOW IT IS LINEAR BY CONSTRUCTION
+ *
+ * The pattern is parsed into an AST, compiled to a small NFA bytecode, and
+ * executed by a Thompson/Pike simulation: instead of trying one path at a
+ * time and backtracking, it advances *all* live NFA states one input
+ * character at a time, deduplicated by program counter. Each of the
+ * `programLength` states is visited at most once per input character, so the
+ * worst case is exactly `O(inputLength × programLength)` — there is no input
+ * that makes it exponential, because there is no search tree to explode.
+ *
+ * Thread priority ordering, and cutting lower-priority threads when a match
+ * is found, reproduce JavaScript's leftmost-first (greedy/lazy) semantics and
+ * its capture-group results, so ordinary patterns behave exactly as they did.
+ *
+ * `new RegExp` is never called on the pattern. Constructs that cannot be
+ * simulated in linear time — backreferences and lookaround — are not merely
+ * rejected by a checker that might have a hole; there is no instruction that
+ * could execute them, and the parser has no production that accepts them.
+ *
+ * WHAT THIS DOES NOT DO
+ *
+ * It is not a general-purpose RegExp replacement. It implements the subset
+ * documented in `UNSUPPORTED_SYNTAX` below and nothing else, and it makes no
+ * attempt at unicode mode or `lastIndex`. Of the flags, `i`, `m`, `s` and `y`
+ * mean what they mean to a fresh `RegExp`'s `test` (see {@link FLAG_CHARS});
+ * `g` and `d` change nothing a match answers, so they are accepted and have
+ * no effect; `u` and `v` are refused.
+ */
+/**
+ * Syntax deliberately outside the supported subset. Each entry is a
+ * construct that either cannot be simulated in linear time at all
+ * (backreferences, lookaround) or that is simply not implemented. Word
+ * boundaries are the exception `compileLinearTest` makes: it reads them, and
+ * `compileLinearPattern`, which redirect rules are held to, does not.
+ */
+export declare const UNSUPPORTED_SYNTAX: readonly ["lookahead `(?=…)` / `(?!…)`", "lookbehind `(?<=…)` / `(?<!…)`", "backreferences `\\1`…`\\9`, `\\k<name>`", "named groups `(?<name>…)`", "word boundaries `\\b` / `\\B`", "unicode property escapes `\\p{…}` / `\\P{…}`", "inline flags and other `(?…)` groups", "negated shorthands (`\\D`, `\\W`, `\\S`) inside a `[…]` class"];
+/**
+ * The flags a pattern may carry, as the characters `RegExp` spells them.
+ * `g` and `d` are here because a fresh `RegExp`'s `test` answers the same
+ * with them as without; `u` and `v` are not, because unicode mode is not
+ * implemented.
+ */
+export declare const FLAG_CHARS = "dgimsy";
+/**
+ * A compiled pattern. `exec` mirrors the slice of `RegExp.prototype.exec`
+ * the redirect matcher uses: index 0 is the whole match, index n is capture
+ * group n, and a group that did not participate is `undefined`.
+ */
+export interface LinearPattern {
+    readonly source: string;
+    /** Instruction count — worst-case cost is `input.length × programLength`. */
+    readonly programLength: number;
+    exec(input: string): Array<string | undefined> | null;
+}
+/**
+ * Compiles a pattern for linear-time matching, or returns null when it is
+ * malformed or uses syntax outside the supported subset.
+ *
+ * Takes no flags, and scans as redirect rules always have (see `ScanMode`).
+ * Never throws, and never hands the pattern to `new RegExp`.
+ */
+export declare function compileLinearPattern(pattern: string): LinearPattern | null;
+/**
+ * Explains why {@link compileLinearPattern} refuses a pattern, for
+ * console-side validation. Returns null when the pattern is fine.
+ */
+export declare function explainLinearPattern(pattern: string): string | null;
+/** A compiled pattern that answers one question: does the input match. */
+export interface LinearTest {
+    readonly source: string;
+    readonly flags: string;
+    /** Instruction count — worst-case cost is `input.length × programLength`. */
+    readonly programLength: number;
+    /**
+     * What `new RegExp(source, flags).test(input)` answers for a fresh
+     * `RegExp`, in time linear in the input.
+     */
+    test(input: string): boolean;
+}
+/**
+ * Compiles a pattern and its flags into a {@link LinearTest}, or returns null
+ * when either is malformed or outside the supported subset: the syntax in
+ * `UNSUPPORTED_SYNTAX` except word boundaries, which this reads, and any flag
+ * outside {@link FLAG_CHARS}.
+ *
+ * Unlike {@link compileLinearPattern} it scans to the end of the input (see
+ * `ScanMode`), so every pattern it accepts answers what `RegExp` answers.
+ * Never throws, and never hands the pattern to `new RegExp`.
+ */
+export declare function compileLinearTest(pattern: string, flags?: string): LinearTest | null;
+/**
+ * Explains why {@link compileLinearTest} refuses a pattern or its flags.
+ * Returns null when both are fine.
+ */
+export declare function explainLinearTest(pattern: string, flags?: string): string | null;