@crewhaus/tool-data 0.7.0 → 0.8.0

package/dist/lib/toml.js

@@ -39,7 +39,7 @@
  * (`null`) is skipped, and the writer reports which keys it dropped rather
  * than pretending the output is complete.
  */
-import { isPlainObject } from "./json";
+import { MAX_NESTING_DEPTH, OutputLimitError, getOwn, isPlainObject, setOwn } from "./json";
 export class TomlError extends Error {
     line;
     constructor(message, line) {
@@ -47,15 +47,26 @@ export class TomlError extends Error {
         this.line = line;
     }
 }
+/**
+ * A key or table path with more parts than MAX_NESTING_DEPTH, refused as it
+ * is read: the value it builds would nest past the cap and be refused
+ * anyway, and building it first cost the square of the path's length.
+ */
+export class TomlTooDeepError extends TomlError {
+}
 /** Parse a TOML document into JSON values. Throws `TomlError` with a line number. */
 export function parseToml(text) {
     const root = {};
     const cur = { text: text.replace(/\r\n?/g, "\n"), i: 0, line: 1 };
     // Tables created by a `[header]`, and tables brought into being implicitly
     // by a dotted key (`a.b = 1` creates `a`). The spec forbids each from
-    // redefining the other, so both have to be remembered.
-    const defined = new Set();
-    const dotted = new Set();
+    // redefining the other, so both have to be remembered. They are the table
+    // objects themselves, not their dotted names: a name per prefix of every
+    // dotted key cost the square of the key's length (80 KB took 3.6 GB), and
+    // the joined name confused a quoted "a.b" with a.b, and each element's
+    // sub-table in an array of tables with the first's.
+    const defined = new WeakSet();
+    const dotted = new WeakSet();
     let table = root;
     let tablePath = [];
     for (;;) {
@@ -66,20 +77,20 @@ export function parseToml(text) {
             const isArray = cur.text[cur.i + 1] === "[";
             cur.i += isArray ? 2 : 1;
             const path = readKeyPath(cur, isArray ? "]]" : "]");
-            const key = path.join(".");
             if (isArray) {
                 table = pushArrayTable(root, path, cur);
                 tablePath = path;
             }
             else {
-                if (defined.has(key)) {
-                    throw new TomlError(`table [${key}] is defined twice`, cur.line);
+                const target = descend(root, path, cur);
+                if (defined.has(target)) {
+                    throw new TomlError(`table [${path.join(".")}] is defined twice`, cur.line);
                 }
-                if (dotted.has(key)) {
-                    throw new TomlError(`table [${key}] was already created by a dotted key, so it cannot be defined again`, cur.line);
+                if (dotted.has(target)) {
+                    throw new TomlError(`table [${path.join(".")}] was already created by a dotted key, so it cannot be defined again`, cur.line);
                 }
-                defined.add(key);
-                table = descend(root, path, cur);
+                defined.add(target);
+                table = target;
                 tablePath = path;
             }
             expectLineEnd(cur);
@@ -135,6 +146,9 @@ const BARE_KEY = /[A-Za-z0-9_-]/;
 function readKeyPath(c, terminator) {
     const path = [];
     for (;;) {
+        if (path.length >= MAX_NESTING_DEPTH) {
+            throw new TomlTooDeepError(`a key with more than ${MAX_NESTING_DEPTH} parts nests deeper than ${MAX_NESTING_DEPTH} levels`, c.line);
+        }
         skipInlineSpace(c);
         const ch = c.text[c.i];
         if (ch === '"' || ch === "'") {
@@ -163,10 +177,10 @@ function readKeyPath(c, terminator) {
 function descend(root, path, c) {
     let node = root;
     path.forEach((seg, idx) => {
-        const existing = node[seg];
+        const existing = getOwn(node, seg);
         if (existing === undefined) {
             const fresh = {};
-            node[seg] = fresh;
+            setOwn(node, seg, fresh);
             node = fresh;
             return;
         }
@@ -188,10 +202,10 @@ function descend(root, path, c) {
 function pushArrayTable(root, path, c) {
     const parent = descend(root, path.slice(0, -1), c);
     const key = path[path.length - 1];
-    const existing = parent[key];
+    const existing = getOwn(parent, key);
     const fresh = {};
     if (existing === undefined) {
-        parent[key] = [fresh];
+        setOwn(parent, key, [fresh]);
         return fresh;
     }
     if (!Array.isArray(existing)) {
@@ -212,31 +226,34 @@ function pushArrayTable(root, path, c) {
  */
 function assign(table, path, value, c, tablePath, tables) {
     let node = table;
-    path.slice(0, -1).forEach((seg, idx) => {
-        const absolute = [...tablePath, ...path.slice(0, idx + 1)].join(".");
-        if (tables !== undefined) {
-            if (tables.defined.has(absolute)) {
-                throw new TomlError(`"${absolute}" is already a table defined by [${absolute}], so a dotted key cannot extend it`, c.line);
-            }
-            tables.dotted.add(absolute);
-        }
-        const existing = node[seg];
+    for (let idx = 0; idx < path.length - 1; idx++) {
+        const seg = path[idx];
+        const existing = getOwn(node, seg);
+        let next;
         if (existing === undefined) {
-            const fresh = {};
-            node[seg] = fresh;
-            node = fresh;
-            return;
+            next = {};
+            setOwn(node, seg, next);
         }
-        if (!isPlainObject(existing)) {
+        else if (isPlainObject(existing)) {
+            next = existing;
+        }
+        else {
             throw new TomlError(`"${[...tablePath, ...path].join(".")}" collides with a value`, c.line);
         }
-        node = existing;
-    });
+        if (tables !== undefined) {
+            if (tables.defined.has(next)) {
+                const absolute = [...tablePath, ...path.slice(0, idx + 1)].join(".");
+                throw new TomlError(`"${absolute}" is already a table defined by [${absolute}], so a dotted key cannot extend it`, c.line);
+            }
+            tables.dotted.add(next);
+        }
+        node = next;
+    }
     const key = path[path.length - 1];
     if (Object.hasOwn(node, key)) {
         throw new TomlError(`key "${[...tablePath, ...path].join(".")}" is defined twice`, c.line);
     }
-    node[key] = value;
+    setOwn(node, key, value);
 }
 function readString(c) {
     const q = c.text[c.i];
@@ -477,23 +494,33 @@ function isTableArray(value) {
  * keys that were dropped because TOML has no representation for them
  * (`null` and `undefined`).
  */
-export function stringifyToml(value) {
+export function stringifyToml(value, maxChars = Number.POSITIVE_INFINITY) {
     if (!isPlainObject(value)) {
         throw new TomlError("TOML documents must be objects at the top level", 0);
     }
-    const skipped = [];
-    const lines = [];
-    emitTable(value, [], lines, skipped);
-    return { text: lines.join("\n"), skipped };
+    const out = { lines: [], skipped: [], chars: -1, max: maxChars };
+    emitTable(value, [], out);
+    return { text: out.lines.join("\n"), skipped: out.skipped };
+}
+function charge(out, length) {
+    out.chars += length;
+    if (out.chars > out.max)
+        throw new OutputLimitError(out.max, "the TOML");
+}
+function emitLine(out, line) {
+    charge(out, line.length + 1);
+    out.lines.push(line);
 }
-function emitTable(table, path, lines, skipped, headerAlreadyWritten = false) {
+function emitTable(table, path, out, headerAlreadyWritten = false) {
     const scalars = [];
     const subTables = [];
     const tableArrays = [];
     for (const key of Object.keys(table)) {
         const v = table[key];
         if (v === null || v === undefined) {
-            skipped.push([...path, key].join("."));
+            const dropped = [...path, key].join(".");
+            charge(out, dropped.length + 2);
+            out.skipped.push(dropped);
             continue;
         }
         if (isTableArray(v)) {
@@ -510,21 +537,23 @@ function emitTable(table, path, lines, skipped, headerAlreadyWritten = false) {
         path.length > 0 &&
         (scalars.length > 0 || (subTables.length === 0 && tableArrays.length === 0));
     if (needsHeader) {
-        if (lines.length > 0)
-            lines.push("");
-        lines.push(`[${path.map(writeKey).join(".")}]`);
+        if (out.lines.length > 0)
+            emitLine(out, "");
+        emitLine(out, `[${path.map(writeKey).join(".")}]`);
     }
-    lines.push(...scalars);
+    for (const line of scalars)
+        emitLine(out, line);
     for (const [key, sub] of subTables) {
-        emitTable(sub, [...path, key], lines, skipped);
+        emitTable(sub, [...path, key], out);
     }
     for (const [key, arr] of tableArrays) {
         const childPath = [...path, key];
+        const header = `[[${childPath.map(writeKey).join(".")}]]`;
         for (const element of arr) {
-            if (lines.length > 0)
-                lines.push("");
-            lines.push(`[[${childPath.map(writeKey).join(".")}]]`);
-            emitTable(element, childPath, lines, skipped, true);
+            if (out.lines.length > 0)
+                emitLine(out, "");
+            emitLine(out, header);
+            emitTable(element, childPath, out, true);
         }
     }
 }

package/dist/lib/xml.js

@@ -37,6 +37,7 @@
  * - Raw-text elements (`<script>`, `<style>`) are parsed as ordinary
  *   elements, so `<` inside them must be escaped.
  */
+import { getOwn, setOwn } from "./json";
 export class XmlError extends Error {
     line;
     constructor(message, line) {
@@ -211,7 +212,7 @@ function readTag(src, start, line, mode) {
             // A bare attribute is HTML's `<input disabled>`; XML requires a value.
             if (mode === "xml")
                 throw new XmlError(`attribute "${attrRaw}" has no value`, line);
-            attributes[attrName] = "";
+            setOwn(attributes, attrName, "");
             continue;
         }
         i += 1;
@@ -222,7 +223,7 @@ function readTag(src, start, line, mode) {
             const end = src.indexOf(quote, i + 1);
             if (end < 0)
                 throw new XmlError(`unterminated value for "${attrRaw}"`, line);
-            attributes[attrName] = decodeEntities(src.slice(i + 1, end), line);
+            setOwn(attributes, attrName, decodeEntities(src.slice(i + 1, end), line));
             i = end + 1;
             continue;
         }
@@ -231,16 +232,22 @@ function readTag(src, start, line, mode) {
         const valueStart = i;
         while (i < src.length && !/[\s>]/.test(src[i]))
             i += 1;
-        attributes[attrName] = decodeEntities(src.slice(valueStart, i), line);
+        setOwn(attributes, attrName, decodeEntities(src.slice(valueStart, i), line));
     }
 }
-const NAMED_ENTITIES = {
+/**
+ * A null prototype, and read with `Object.hasOwn`: the key is whatever name
+ * the document wrote between `&` and `;`, and on an object literal
+ * `&constructor;` decoded to "function Object() { [native code] }" and
+ * `&__proto__;` to "[object Object]" instead of being refused as unknown.
+ */
+const NAMED_ENTITIES = Object.freeze(Object.assign(Object.create(null), {
     amp: "&",
     lt: "<",
     gt: ">",
     quot: '"',
     apos: "'",
-};
+}));
 /** Expand the predefined entities and numeric references; anything else is an error. */
 export function decodeEntities(text, line) {
     if (!text.includes("&"))
@@ -266,7 +273,7 @@ export function decodeEntities(text, line) {
             out += codePoint(body, Number.parseInt(body.slice(1), 10), line);
             continue;
         }
-        const named = NAMED_ENTITIES[body];
+        const named = Object.hasOwn(NAMED_ENTITIES, body) ? NAMED_ENTITIES[body] : undefined;
         if (named === undefined) {
             throw new XmlError(`unknown entity &${body}; — only the five predefined ones are known`, line);
         }
@@ -305,13 +312,15 @@ export function toCompact(nodes) {
             continue;
         }
         const value = compactElement(node);
-        const existing = out[node.name];
+        // Own fields only: an element named `constructor` or `__proto__` is
+        // data like any other, not a reach into Object.prototype.
+        const existing = getOwn(out, node.name);
         if (existing === undefined)
-            out[node.name] = value;
+            setOwn(out, node.name, value);
         else if (Array.isArray(existing))
             existing.push(value);
         else
-            out[node.name] = [existing, value];
+            setOwn(out, node.name, [existing, value]);
     }
     const text = texts.join("").trim();
     if (Object.keys(out).length === 0)
@@ -333,7 +342,11 @@ function compactElement(el) {
             out["#text"] = inner;
         return out;
     }
-    Object.assign(out, inner);
+    // Not Object.assign: it would call the `__proto__` setter for a child
+    // element of that name, instead of copying it.
+    for (const k of Object.keys(inner)) {
+        setOwn(out, k, inner[k]);
+    }
     return out;
 }
 /** All the text under a node, concatenated — the XPath `string()` of it. */

package/dist/lib/yaml.d.ts

@@ -47,6 +47,13 @@ export declare class YamlError extends Error {
 export declare function parseYaml(text: string): unknown;
 /** Find the `:` that separates a key from its value, ignoring quotes and flow markers. */
 export declare function findKeyColon(content: string): number;
+/**
+ * `text` without its trailing newlines: what `text.replace(/\n+$/, "")`
+ * returned, in one pass from the end. That pattern tries every start inside
+ * a run of newlines that is not at the end (blank lines inside a block
+ * scalar) and rescans the rest of the run from each, quadratic in its length.
+ */
+export declare function withoutTrailingNewlines(text: string): string;
 /** Remove a trailing ` # comment`, respecting quotes. */
 export declare function stripComment(text: string): string;
 /** Parse a single value: flow collection, quoted string, or plain scalar. */
@@ -57,5 +64,15 @@ export declare function plainScalar(t: string): unknown;
 export declare function parseFlow(text: string, lineNo: number): unknown;
 /** True when a string can be written bare without changing meaning on re-read. */
 export declare function canWritePlain(s: string): boolean;
-/** Serialize a JSON value as block-style YAML with a two-space indent. */
-export declare function stringifyYaml(value: unknown, indentLevel?: number): string;
+/**
+ * Serialize a JSON value as block-style YAML with a two-space indent.
+ *
+ * Lines are emitted once, into one list: the 0.7.0 writer returned each
+ * nested block as a string and re-sliced it at every level to fold a
+ * sequence item's first line onto its dash (`- - x`), which copied the
+ * whole block once per level. The folding is now a prefix handed down
+ * instead. With `maxChars`, it throws `OutputLimitError` as soon as the text
+ * would pass that many characters, before building the rest: indentation
+ * makes YAML's size depth x width, not the input's size.
+ */
+export declare function stringifyYaml(value: unknown, indentLevel?: number, maxChars?: number): string;

package/dist/lib/yaml.js

@@ -39,7 +39,7 @@
  * strings are written double-quoted with `\n` escapes rather than as block
  * scalars, so the output is unambiguous.
  */
-import { isPlainObject } from "./json";
+import { OutputLimitError, isPlainObject, setOwn } from "./json";
 export class YamlError extends Error {
     line;
     constructor(message, line) {
@@ -73,7 +73,11 @@ function tokenize(text) {
             throw new YamlError("tab characters cannot be used for indentation", lineNo);
         }
         const indent = indentMatch[0].length;
-        const content = original.slice(indent).replace(/\s+$/, "");
+        // trimEnd drops exactly what `.replace(/\s+$/, "")` did. That call was
+        // linear only because JSC turns that exact spelling into a trim; the same
+        // pattern run as a pattern (exec, test, a /g flag) rescans a run of spaces
+        // inside the line from each start in it, quadratic in the run's length.
+        const content = original.slice(indent).trimEnd();
         if (content.startsWith("#"))
             return;
         if (content === "---")
@@ -161,15 +165,15 @@ function parseMapping(state, indent, depth) {
         const valueText = stripComment(line.content.slice(colon + 1).trim());
         state.i += 1;
         if (valueText === "") {
-            out[key] = parseChildBlock(state, indent, depth);
+            setOwn(out, key, parseChildBlock(state, indent, depth));
             continue;
         }
         const block = blockScalarHeader(valueText);
         if (block !== null) {
-            out[key] = readBlockScalar(state, indent, block, line.lineNo);
+            setOwn(out, key, readBlockScalar(state, indent, block, line.lineNo));
             continue;
         }
-        out[key] = parseScalarValue(valueText, line.lineNo);
+        setOwn(out, key, parseScalarValue(valueText, line.lineNo));
     }
     return out;
 }
@@ -286,9 +290,21 @@ function readBlockScalar(state, parentIndent, header, lineNo) {
         out = body.join("\n");
     }
     if (header.chomp === "strip")
-        return out.replace(/\n+$/, "");
+        return withoutTrailingNewlines(out);
     return `${out}\n`;
 }
+/**
+ * `text` without its trailing newlines: what `text.replace(/\n+$/, "")`
+ * returned, in one pass from the end. That pattern tries every start inside
+ * a run of newlines that is not at the end (blank lines inside a block
+ * scalar) and rescans the rest of the run from each, quadratic in its length.
+ */
+export function withoutTrailingNewlines(text) {
+    let end = text.length;
+    while (end > 0 && text.charCodeAt(end - 1) === 0x0a)
+        end--;
+    return end === text.length ? text : text.slice(0, end);
+}
 /** Remove a trailing ` # comment`, respecting quotes. */
 export function stripComment(text) {
     let quote = null;
@@ -471,7 +487,7 @@ function parseFlowNode(s, depth) {
             if (s.text[s.i] !== ":")
                 throw new YamlError("expected ':' in a flow mapping", s.lineNo);
             s.i += 1;
-            out[String(coerceFlowKey(key, s.lineNo))] = parseFlowNode(s, depth + 1);
+            setOwn(out, String(coerceFlowKey(key, s.lineNo)), parseFlowNode(s, depth + 1));
             skipFlowSpace(s);
             const d = s.text[s.i];
             if (d === ",") {
@@ -552,47 +568,77 @@ function writeScalar(value) {
     const s = String(value);
     return canWritePlain(s) ? s : JSON.stringify(s);
 }
-/** Serialize a JSON value as block-style YAML with a two-space indent. */
-export function stringifyYaml(value, indentLevel = 0) {
-    const pad = "  ".repeat(indentLevel);
+/**
+ * Serialize a JSON value as block-style YAML with a two-space indent.
+ *
+ * Lines are emitted once, into one list: the 0.7.0 writer returned each
+ * nested block as a string and re-sliced it at every level to fold a
+ * sequence item's first line onto its dash (`- - x`), which copied the
+ * whole block once per level. The folding is now a prefix handed down
+ * instead. With `maxChars`, it throws `OutputLimitError` as soon as the text
+ * would pass that many characters, before building the rest: indentation
+ * makes YAML's size depth x width, not the input's size.
+ */
+export function stringifyYaml(value, indentLevel = 0, maxChars = Number.POSITIVE_INFINITY) {
+    const out = { lines: [], chars: -1, max: maxChars };
+    emitYaml(value, indentLevel, null, out);
+    return out.lines.join("\n");
+}
+function pushLine(out, line) {
+    out.chars += line.length + 1;
+    if (out.chars > out.max)
+        throw new OutputLimitError(out.max, "the YAML");
+    out.lines.push(line);
+}
+const nonEmptyContainer = (v) => (isPlainObject(v) && Object.keys(v).length > 0) || (Array.isArray(v) && v.length > 0);
+/**
+ * Emit `value` at `level`. `lead`, when given, replaces the indentation of
+ * the FIRST line only: it is how a sequence item's dash lands on the same
+ * line as the item's first key or first element. It always has the same
+ * length as the indentation it replaces.
+ */
+function emitYaml(value, level, lead, out) {
+    const pad = "  ".repeat(level);
+    let first = true;
+    const prefix = () => {
+        const p = first && lead !== null ? lead : pad;
+        first = false;
+        return p;
+    };
     if (Array.isArray(value)) {
-        if (value.length === 0)
-            return `${pad}[]`;
-        return value
-            .map((el) => {
-            if (isPlainObject(el) && Object.keys(el).length > 0) {
-                const body = stringifyYaml(el, indentLevel + 1);
-                return `${pad}-${body.slice(pad.length + 1)}`;
-            }
-            if (Array.isArray(el) && el.length > 0) {
-                const body = stringifyYaml(el, indentLevel + 1);
-                return `${pad}-${body.slice(pad.length + 1)}`;
-            }
-            return `${pad}- ${writeScalar(el)}`;
-        })
-            .join("\n");
+        if (value.length === 0) {
+            pushLine(out, `${prefix()}[]`);
+            return;
+        }
+        for (const el of value) {
+            if (nonEmptyContainer(el))
+                emitYaml(el, level + 1, `${prefix()}- `, out);
+            else
+                pushLine(out, `${prefix()}- ${writeScalar(el)}`);
+        }
+        return;
     }
     if (isPlainObject(value)) {
         const keys = Object.keys(value);
-        if (keys.length === 0)
-            return `${pad}{}`;
-        return keys
-            .map((k) => {
+        if (keys.length === 0) {
+            pushLine(out, `${prefix()}{}`);
+            return;
+        }
+        for (const k of keys) {
             const v = value[k];
             const key = canWritePlain(k) ? k : JSON.stringify(k);
-            if (Array.isArray(v)) {
-                if (v.length === 0)
-                    return `${pad}${key}: []`;
-                return `${pad}${key}:\n${stringifyYaml(v, indentLevel + 1)}`;
+            if (Array.isArray(v) && v.length === 0)
+                pushLine(out, `${prefix()}${key}: []`);
+            else if (isPlainObject(v) && Object.keys(v).length === 0)
+                pushLine(out, `${prefix()}${key}: {}`);
+            else if (Array.isArray(v) || isPlainObject(v)) {
+                pushLine(out, `${prefix()}${key}:`);
+                emitYaml(v, level + 1, null, out);
             }
-            if (isPlainObject(v)) {
-                if (Object.keys(v).length === 0)
-                    return `${pad}${key}: {}`;
-                return `${pad}${key}:\n${stringifyYaml(v, indentLevel + 1)}`;
-            }
-            return `${pad}${key}: ${writeScalar(v)}`;
-        })
-            .join("\n");
+            else
+                pushLine(out, `${prefix()}${key}: ${writeScalar(v)}`);
+        }
+        return;
     }
-    return `${pad}${writeScalar(value)}`;
+    pushLine(out, `${prefix()}${writeScalar(value)}`);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crewhaus/tool-data",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "type": "module",
   "description": "Deterministic structured-data tools: JSON/YAML/TOML/CSV/XML parsing, querying, conversion, diffing and reshaping",
   "main": "dist/index.js",
@@ -8,16 +8,18 @@
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
     }
   },
   "scripts": {
     "test": "bun test src"
   },
   "dependencies": {
-    "@crewhaus/errors": "0.7.0",
-    "@crewhaus/tool-builder": "0.7.0",
-    "@crewhaus/tool-catalog": "0.7.0",
+    "@crewhaus/errors": "0.8.0",
+    "@crewhaus/tool-builder": "0.8.0",
+    "@crewhaus/tool-catalog": "0.8.0",
+    "@crewhaus/tool-schema": "0.8.0",
     "zod": "^3.23.8"
   },
   "devDependencies": {
@@ -41,5 +43,8 @@
   "publishConfig": {
     "access": "public"
   },
-  "files": ["dist", "README.md", "LICENSE", "NOTICE"]
+  "files": ["dist", "README.md", "LICENSE", "NOTICE"],
+  "engines": {
+    "bun": ">=1.3.14"
+  }
 }