@arela/uploader 1.0.24 → 1.1.1

package/src/scoring/scoring-engine.js

@@ -36,17 +36,49 @@ import path from 'path';
 
 import { FieldResult } from '../document-type-shared.js';
 
+// Compile cache for string patterns (from DB matchers): stable across every
+// document in a run, so compile once instead of per document. Invalid patterns
+// cache as null and are treated as a non-match (parity with the TS engine).
+const regexCache = new Map();
+const REGEX_CACHE_MAX = 5000;
+
 function toRegExp(clue) {
-  return clue.pattern instanceof RegExp
-    ? clue.pattern
-    : new RegExp(clue.pattern, clue.flags ?? '');
+  if (clue.pattern instanceof RegExp) {
+    // Local-seed patterns are already compiled; reset lastIndex so a g/y flag
+    // can't make repeated .test() calls stateful across documents.
+    clue.pattern.lastIndex = 0;
+    return clue.pattern;
+  }
+  const safeFlags = (clue.flags ?? '').replace(/[gy]/g, '');
+  const key = `${safeFlags} ${clue.pattern}`;
+  let re = regexCache.get(key);
+  if (re === undefined) {
+    try {
+      re = new RegExp(clue.pattern, safeFlags);
+    } catch {
+      re = null;
+    }
+    if (regexCache.size >= REGEX_CACHE_MAX) regexCache.clear();
+    regexCache.set(key, re);
+  }
+  return re;
 }
 
+// Bound the text a single regex runs on so an allowed (quadratic) pattern
+// can't blow up on a megabyte-scale adversarial string. Real documents can
+// legitimately exceed the cap (edocument XMLs embed multi-MB base64 PDFs with
+// signature tags AFTER the blob), so instead of truncating we sample a HEAD +
+// TAIL window — signatures live at the extremes, the blob in the middle.
+// (Parity with the API TS engine.)
+const MATCH_HEAD_CAP = 1_000_000;
+const MATCH_TAIL_CAP = 262_144;
+
 function clueTarget(clue, ctx) {
   // FILENAME_REGEX tests the file name; every other kind tests the content.
-  return clue.kind === 'FILENAME_REGEX'
-    ? (ctx.fileName ?? '')
-    : (ctx.source ?? '');
+  const raw =
+    clue.kind === 'FILENAME_REGEX' ? (ctx.fileName ?? '') : (ctx.source ?? '');
+  if (raw.length <= MATCH_HEAD_CAP + MATCH_TAIL_CAP) return raw;
+  return `${raw.slice(0, MATCH_HEAD_CAP)}\n${raw.slice(-MATCH_TAIL_CAP)}`;
 }
 
 /**
@@ -73,7 +105,8 @@ export function scoreMatcher(matcher, ctx) {
 
   for (const clue of matcher.clues ?? []) {
     const weight = clue.weight ?? 1;
-    const hit = toRegExp(clue).test(clueTarget(clue, ctx));
+    const re = toRegExp(clue);
+    const hit = re ? re.test(clueTarget(clue, ctx)) : false;
 
     if (clue.negative) {
       if (hit) {

package/src/services/LoggingService.js

@@ -81,6 +81,10 @@ export class LoggingService {
    */
   info(message) {
     this.writeLog(message, 'info');
+    // Echo to console: run banners, stats and the 🧩 observability lines were
+    // file-only, so operators watching the terminal never saw them (the v1
+    // canary summary was invisible until someone grepped arela-upload.log).
+    console.log(message);
   }
 
   /**
@@ -89,9 +93,7 @@ export class LoggingService {
    */
   warn(message) {
     this.writeLog(message, 'warn');
-    if (this.isVerbose) {
-      console.warn(`⚠️ ${message}`);
-    }
+    console.warn(`⚠️ ${message}`);
   }
 
   /**

package/.vscode/settings.json

@@ -1 +0,0 @@
-{}