@arnilo/prism-rag 0.3.1 → 0.3.2

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## [0.3.2] - 2026-08-29
+
+### Changed
+- Plan 035-039 changed-package cut: additive runtime performance, tooling, and documentation deltas; peer window refresh.
+
 ## [0.3.1] - 2026-08-26
 
 ### Added

package/dist/parsers.js

@@ -36,7 +36,19 @@ async function parsePdf(document, options = {}) {
     const pages = [...pdf.matchAll(/\/Type\s*\/Page\b/gu)].length;
     if (pages > limits.maxPdfPages)
         throw new RagLimitError(`PDF exceeds ${limits.maxPdfPages} pages`);
-    const blocks = pdf.match(/BT[\s\S]*?ET/gu) ?? [];
+    // Index-scanned BT..ET block extraction instead of /BT[\s\S]*?ET/gu (CodeQL js/polynomial-redos, alert 11).
+    const blocks = [];
+    let cursor = 0;
+    while (cursor < pdf.length) {
+        const begin = pdf.indexOf("BT", cursor);
+        if (begin === -1)
+            break;
+        const end = pdf.indexOf("ET", begin + 2);
+        if (end === -1)
+            break;
+        blocks.push(pdf.slice(begin, end + 2));
+        cursor = end + 2;
+    }
     const text = blocks.flatMap(pdfBlockText).join("\n").trim();
     if (!text)
         throw new RagValidationError("PDF has no uncompressed text");
@@ -65,17 +77,86 @@ function assertParseTime(started, maxParseMs) {
     if (Date.now() - started > maxParseMs)
         throw new RagLimitError(`document parsing exceeded ${maxParseMs}ms`);
 }
+// Single-pass linear HTML-to-text scanner (CodeQL js/incomplete-multi-character-sanitization
+// and js/polynomial-redos on the former regex chain, alerts 17-19): comments, script/style
+// bodies, and tags are consumed by index — hostile adjacency cannot re-form dangerous tags.
 function htmlToText(html) {
-    return decodeEntities(html
-        .replace(/<!--[\s\S]*?-->/gu, "")
-        .replace(/<(script|style)\b[^>]*>[\s\S]*?<\/\1\s*>/giu, "")
-        .replace(/<(?:br|p|div|li|h[1-6]|tr)\b[^>]*>/giu, "\n")
-        .replace(/<[^>]*>/gu, " "))
-        .replace(/[ \t]{2,}/gu, " ")
-        .replace(/[ \t]+\n/gu, "\n")
-        .replace(/\n[ \t]+/gu, "\n")
-        .replace(/\n{3,}/gu, "\n\n")
-        .trim();
+    const out = [];
+    let i = 0;
+    while (i < html.length) {
+        if (html.startsWith("<!--", i)) {
+            const close = html.indexOf("-->", i + 4);
+            i = close === -1 ? html.length : close + 3;
+            continue;
+        }
+        if (html.charCodeAt(i) === 60) {
+            const gt = html.indexOf(">", i + 1);
+            if (gt === -1) {
+                out.push(html.slice(i));
+                break;
+            }
+            const tag = html.slice(i + 1, gt);
+            i = gt + 1;
+            const closing = tag.startsWith("/");
+            const name = (closing ? tag.slice(1) : tag).match(/^[A-Za-z]+/u)?.[0]?.toLowerCase() ?? "";
+            if (closing) {
+                out.push(" ");
+            }
+            else if (name === "br" || name === "p" || name === "div" || name === "li" || name === "tr" || /^h[1-6]$/u.test(name)) {
+                out.push("\n");
+            }
+            else if (name === "script" || name === "style") {
+                // Consume the raw element body through its matching close tag.
+                const closeIdx = html.toLowerCase().indexOf(`</${name}`, i);
+                const next = closeIdx === -1 ? html.length : html.indexOf(">", closeIdx);
+                i = next === -1 ? html.length : next + 1;
+            }
+            else {
+                out.push(" ");
+            }
+            continue;
+        }
+        out.push(html[i++]);
+    }
+    return collapseTextWhitespace(decodeEntities(out.join(""))).trim();
+}
+/** Linear whitespace normalization: `[ \t]` runs collapse; 3+ newlines collapse to 2; edge spaces drop. */
+function collapseTextWhitespace(text) {
+    const out = [];
+    let i = 0;
+    let lineStart = true;
+    let spaceRun = false;
+    let newlineRun = 0;
+    while (i < text.length) {
+        const c = text[i];
+        if (c === " " || c === "\t") {
+            if (!lineStart)
+                spaceRun = true;
+            i += 1;
+            continue;
+        }
+        if (c === "\n") {
+            newlineRun += 1;
+            spaceRun = false;
+            lineStart = true;
+            i += 1;
+            continue;
+        }
+        if (newlineRun > 0) {
+            out.push("\n".repeat(Math.min(newlineRun, 2)));
+            newlineRun = 0;
+        }
+        else if (spaceRun) {
+            out.push(" ");
+            spaceRun = false;
+        }
+        lineStart = false;
+        out.push(c);
+        i += 1;
+    }
+    if (newlineRun > 0)
+        out.push("\n".repeat(Math.min(newlineRun, 2)));
+    return out.join("");
 }
 function decodeEntities(text) {
     const entities = { amp: "&", lt: "<", gt: ">", quot: '"', apos: "'", nbsp: " ", "#39": "'" };
@@ -83,11 +164,70 @@ function decodeEntities(text) {
 }
 function pdfBlockText(block) {
     const strings = [];
-    for (const match of block.matchAll(/\((?:\\.|[^\\)])*\)\s*(?:Tj|['"])/gu))
-        strings.push(decodePdfString(match[0].replace(/\s*(?:Tj|['"])$/u, "")));
-    for (const match of block.matchAll(/\[([\s\S]*?)\]\s*TJ/gu)) {
-        for (const value of match[1].matchAll(/\((?:\\.|[^\\)])*\)/gu))
-            strings.push(decodePdfString(value[0]));
+    // Linear index scanners replace ambiguous nested-quantifier regexes (CodeQL js/polynomial-redos, alerts 15-16, 20-21).
+    const extractLiteral = (text, from) => {
+        const open = text.indexOf("(", from);
+        if (open === -1)
+            return undefined;
+        let i = open + 1;
+        while (i < text.length) {
+            const c = text[i];
+            if (c === "\\") {
+                i += 2;
+                continue;
+            }
+            if (c === ")")
+                return { literal: text.slice(open + 1, i), next: i + 1 };
+            i += 1;
+        }
+        return undefined; // unterminated literal - ignore
+    };
+    let cursor = 0;
+    while (cursor < block.length) {
+        const literal = extractLiteral(block, cursor);
+        if (!literal)
+            break;
+        let j = literal.next;
+        while (j < block.length && /\s/.test(block[j]))
+            j += 1;
+        if (block[j] === "T" && block[j + 1] === "j") {
+            strings.push(decodePdfString(`(${literal.literal})`));
+            cursor = j + 2;
+        }
+        else if (block[j] === "'" || block[j] === '"') {
+            strings.push(decodePdfString(`(${literal.literal})`));
+            cursor = j + 1;
+        }
+        else {
+            cursor = literal.next;
+        }
+    }
+    cursor = 0;
+    while (cursor < block.length) {
+        const open = block.indexOf("[", cursor);
+        if (open === -1)
+            break;
+        const close = block.indexOf("]", open + 1);
+        if (close === -1)
+            break;
+        let j = close + 1;
+        while (j < block.length && /\s/.test(block[j]))
+            j += 1;
+        if (block.startsWith("TJ", j)) {
+            const arr = block.slice(open + 1, close);
+            let arrCursor = 0;
+            for (;;) {
+                const literal = extractLiteral(arr, arrCursor);
+                if (!literal)
+                    break;
+                strings.push(decodePdfString(`(${literal.literal})`));
+                arrCursor = literal.next;
+            }
+            cursor = j + 2;
+        }
+        else {
+            cursor = open + 1;
+        }
     }
     return strings.filter(Boolean);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arnilo/prism-rag",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Optional bounded text and Markdown RAG primitives for Prism.",
   "type": "module",
   "main": "./dist/index.js",
@@ -33,7 +33,7 @@
     "pack:dry-run": "npm pack --dry-run"
   },
   "peerDependencies": {
-    "@arnilo/prism": "^0.3.0",
+    "@arnilo/prism": "^0.3.1",
     "@arnilo/prism-memory": "^0.3.0"
   },
   "devDependencies": {