@deftai/directive-core 0.96.0 → 0.98.0

package/dist/xbrief/styles.js

@@ -4,6 +4,19 @@
  * One schema spine (xBRIEF v0.8); markdown is a dense render of the same plan,
  * not a second dialect.
  */
+import { parseMarkdownHeading } from "../text/redos-safe.js";
+/**
+ * Linear frontmatter ``key: value`` parse (no nested quantifiers).
+ * Replaces ``/^key:\s*(.+)\s*$/`` flagged as CodeQL js/polynomial-redos (#3174).
+ */
+function frontmatterField(line, key) {
+    const prefix = `${key}:`;
+    if (!line.startsWith(prefix)) {
+        return null;
+    }
+    const value = line.slice(prefix.length).trim();
+    return value.length > 0 ? value : null;
+}
 /** Required H2 section titles in the markdown form per style. */
 export const MD_REQUIRED_SECTIONS = {
     scope: ["Title", "Status", "Overview", "Items"],
@@ -200,25 +213,28 @@ export function parseMarkdownMeta(md) {
             continue;
         }
         if (inFront) {
-            const idMatch = /^id:\s*(.+)\s*$/.exec(line);
-            if (idMatch?.[1] !== undefined)
-                id = idMatch[1].trim();
-            const styleMatch = /^style:\s*(.+)\s*$/.exec(line);
-            if (styleMatch?.[1] !== undefined)
-                style = styleMatch[1].trim();
+            // Linear field parse — avoids js/polynomial-redos on \s*(.+)\s* (#3174 alerts #84-#85).
+            const idValue = frontmatterField(line, "id");
+            if (idValue !== null)
+                id = idValue;
+            const styleValue = frontmatterField(line, "style");
+            if (styleValue !== null)
+                style = styleValue;
             continue;
         }
-        const h1 = /^#\s+(.+)$/.exec(line);
-        if (h1?.[1] !== undefined && title === null) {
-            title = h1[1].trim();
-        }
-        const h2 = /^##\s+(.+)$/.exec(line);
-        if (h2?.[1] !== undefined) {
-            const name = h2[1].trim();
-            sections.add(name);
-            afterTitleH2 = name === "Title";
-            afterStatusH2 = name === "Status";
-            continue;
+        // Linear ATX heading parse — avoids js/polynomial-redos on ^#+\s+(.+)$ (#3174 alerts #86-#87).
+        const heading = parseMarkdownHeading(line);
+        if (heading !== null) {
+            const name = heading.text.trim();
+            if (heading.hashes === "#" && title === null) {
+                title = name;
+            }
+            else if (heading.hashes === "##") {
+                sections.add(name);
+                afterTitleH2 = name === "Title";
+                afterStatusH2 = name === "Status";
+                continue;
+            }
         }
         if (afterTitleH2 && line.trim().length > 0 && !line.startsWith("#")) {
             // Prefer ## Title body over H1 when present.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deftai/directive-core",
-  "version": "0.96.0",
+  "version": "0.98.0",
   "description": "TypeScript engine core for the Directive framework.",
   "license": "MIT",
   "type": "module",
@@ -251,6 +251,10 @@
       "types": "./dist/parent-turn-shape/index.d.ts",
       "default": "./dist/parent-turn-shape/index.js"
     },
+    "./delivery-attempt": {
+      "types": "./dist/delivery-attempt/index.d.ts",
+      "default": "./dist/delivery-attempt/index.js"
+    },
     "./intake": {
       "types": "./dist/intake/index.d.ts",
       "default": "./dist/intake/index.js"
@@ -350,8 +354,8 @@
     "provenance": true
   },
   "dependencies": {
-    "@deftai/directive-content": "^0.96.0",
-    "@deftai/directive-types": "^0.96.0",
+    "@deftai/directive-content": "^0.98.0",
+    "@deftai/directive-types": "^0.98.0",
     "archiver": "^8.0.0"
   },
   "scripts": {