@dogsbay/literal 0.2.0-beta.135 → 0.2.0-beta.136

package/README.md

@@ -12,8 +12,12 @@ const { value, unresolved } = evaluateModule(source); // the module's default ex
 It understands object, array, string, number, boolean and null literals; template strings
 with no `${}`; spreads; module-level `const` references; zero-argument helpers that return a
 literal; wrapper calls such as `defineConfig({…})`; member access and literal indexes
-(`releases[0]["x"]`); `"a" + "b"` (strings only); `module.exports =`; and TypeScript type
-noise. Anything else becomes `UNRESOLVED` and is listed in `unresolved`: never a plausible
+(`releases[0]["x"]`); `"a" + "b"` (strings only); `.length` and a fixed list of pure string
+and list methods with literal arguments (`slice`, `substring`, `split`, `join`, `replace`,
+`replaceAll`, `trim`, `toLowerCase`, `toUpperCase`, `startsWith`, `endsWith`, `includes`,
+`indexOf`, `at`, `padStart`, `padEnd`, `repeat`: `version.split('.').slice(0, 2).join('.')`);
+`module.exports =`; and TypeScript type noise. A method is computed from that list, never by
+calling what a name finds. Anything else becomes `UNRESOLVED` and is listed in `unresolved`: never a plausible
 wrong value, never a silent omission.
 
 Other modules (`require("./x")`, `import x from "./x"`) are read only through a resolver you

package/dist/index.js

@@ -251,6 +251,68 @@ const CLOSERS = new Set(["}", "]", ")"]);
 const MAX_VALUES = 100_000;
 /** The longest string `+` may build: `const b = a + a` doubles, thirty times is a gigabyte. */
 const MAX_STRING = 1024 * 1024;
+const isInt = (v) => typeof v === "number" && Number.isInteger(v);
+const isStr = (v) => typeof v === "string";
+const optInt = (v) => v === undefined || isInt(v);
+/** A count a method may repeat or pad to: bounded before anything is built. */
+const smallInt = (v) => isInt(v) && v >= 0 && v <= MAX_STRING;
+/** A method's result that would be larger than MAX_STRING / MAX_VALUES: refused before it is built. */
+const TOO_LARGE = Symbol("too large");
+/** How often `a` occurs in `s` (an empty `a`: before every character and at the end). */
+const occurrences = (s, a) => {
+    if (a === "")
+        return s.length + 1;
+    let n = 0;
+    for (let i = s.indexOf(a); i !== -1; i = s.indexOf(a, i + a.length))
+        n++;
+    return n;
+};
+/** The longest one replacement by `b` can be: each `$` pattern may insert the match or the whole string. */
+const replacementBound = (s, a, b) => b.length + occurrences(b, "$") * Math.max(s.length, a.length);
+const within = (length, build) => (length > MAX_STRING ? TOO_LARGE : build());
+/**
+ * The string and list methods a config may call (Tigera's `releases[0].title.slice(0, 5)`,
+ * `version.split('.').slice(0, 2).join('.')`): pure, with literal arguments of the types each
+ * takes, else undefined (unresolved, reported). Nothing here calls a function a name refers to,
+ * and nothing larger than the limits is built: its size is worked out first (TOO_LARGE).
+ */
+const METHODS = {
+    slice: (v, [a, b]) => (optInt(a) && optInt(b) ? v.slice(a, b) : undefined),
+    // `null` is a value a list may hold; past either end is undefined, which is no value here
+    at: (v, [a]) => (isInt(a) ? v.at(a) : undefined),
+    includes: (v, [a]) => (typeof v === "string" ? (isStr(a) ? v.includes(a) : undefined) : v.includes(a)),
+    indexOf: (v, [a]) => (typeof v === "string" ? (isStr(a) ? v.indexOf(a) : undefined) : v.indexOf(a)),
+    // Strings
+    substring: (v, [a, b]) => (typeof v === "string" && optInt(a) && optInt(b) ? v.substring(a, b) : undefined),
+    split: (v, [sep, limit]) => {
+        if (typeof v !== "string" || !isStr(sep) || !optInt(limit))
+            return undefined;
+        const pieces = Math.min(sep === "" ? v.length : occurrences(v, sep) + 1, limit === undefined || limit < 0 ? Infinity : limit);
+        return pieces > MAX_VALUES ? TOO_LARGE : v.split(sep, limit);
+    },
+    toLowerCase: (v, a) => (typeof v === "string" && !a.length ? v.toLowerCase() : undefined),
+    toUpperCase: (v, a) => (typeof v === "string" && !a.length ? v.toUpperCase() : undefined),
+    trim: (v, a) => (typeof v === "string" && !a.length ? v.trim() : undefined),
+    trimStart: (v, a) => (typeof v === "string" && !a.length ? v.trimStart() : undefined),
+    trimEnd: (v, a) => (typeof v === "string" && !a.length ? v.trimEnd() : undefined),
+    startsWith: (v, [a]) => (typeof v === "string" && isStr(a) ? v.startsWith(a) : undefined),
+    endsWith: (v, [a]) => (typeof v === "string" && isStr(a) ? v.endsWith(a) : undefined),
+    // A string pattern only (a regex literal is not a value here); `$` patterns as JavaScript has them
+    replace: (v, [a, b]) => typeof v === "string" && isStr(a) && isStr(b) ? within(v.length + replacementBound(v, a, b), () => v.replace(a, b)) : undefined,
+    replaceAll: (v, [a, b]) => typeof v === "string" && isStr(a) && isStr(b)
+        ? within(v.length + occurrences(v, a) * replacementBound(v, a, b), () => v.replaceAll(a, b))
+        : undefined,
+    padStart: (v, [n, f]) => (typeof v === "string" && smallInt(n) && (f === undefined || isStr(f)) ? v.padStart(n, f) : undefined),
+    padEnd: (v, [n, f]) => (typeof v === "string" && smallInt(n) && (f === undefined || isStr(f)) ? v.padEnd(n, f) : undefined),
+    repeat: (v, [n]) => (typeof v === "string" && smallInt(n) && v.length * n <= MAX_STRING ? v.repeat(n) : undefined),
+    // Lists
+    join: (v, [sep]) => {
+        if (!Array.isArray(v) || !(sep === undefined || isStr(sep)) || !v.every((x) => isStr(x) || typeof x === "number"))
+            return undefined;
+        const length = v.reduce((n, x) => n + String(x).length, 0) + Math.max(0, v.length - 1) * (sep === undefined ? 1 : sep.length);
+        return within(length, () => v.join(sep));
+    },
+};
 /** How deeply values may nest: past this a parser or a consumer walking it runs out of stack. */
 const MAX_DEPTH = 500;
 /**
@@ -939,6 +1001,44 @@ class Evaluator {
             size += this.sizeOf(v);
         return this.postfix(this.bounded(out, size, i), k + 1);
     }
+    /** `value.name(args)` at the `(` at `i`: the arguments read as literals, the method from METHODS. */
+    methodCall(value, name, i) {
+        const args = [];
+        let k = i + 1;
+        while (k < this.toks.length && !this.is(k, ")")) {
+            const arg = this.parseValue(k);
+            args.push(arg.value);
+            k = arg.next;
+            if (this.is(k, ","))
+                k++;
+            else if (!this.is(k, ")"))
+                break;
+        }
+        if (!this.is(k, ")")) {
+            this.report(i, `a call to \`.${name}\` this reader could not read`);
+            return { value: UNRESOLVED, next: this.skipBalanced(i) };
+        }
+        const next = k + 1;
+        if (args.includes(UNRESOLVED))
+            return { value: UNRESOLVED, next };
+        const result = METHODS[name](value, args);
+        if (result === undefined) {
+            this.report(i, `\`.${name}(…)\` with arguments this reader does not take, or no value`);
+            return { value: UNRESOLVED, next };
+        }
+        if (result === TOO_LARGE || (typeof result === "string" && result.length > MAX_STRING)) {
+            this.report(i, `\`.${name}(…)\`: a value larger than ${MAX_STRING} characters or ${MAX_VALUES} entries`);
+            return { value: UNRESOLVED, next };
+        }
+        // A list costs what it expands to, like any list built here: copies of a large one add up
+        if (Array.isArray(result)) {
+            let size = 1;
+            for (const x of result)
+                size += this.sizeOf(x);
+            return { value: this.bounded(result, size, i), next };
+        }
+        return { value: result, next };
+    }
     /**
      * Postfix operators after a value: TS `as`/`satisfies`, and member access
      * into a value we already have.
@@ -981,6 +1081,19 @@ class Evaluator {
             }
             if ((this.is(k, ".") || this.is(k, "?.")) && this.toks[k + 1]?.kind === "ident") {
                 const prop = this.toks[k + 1].text;
+                // A string or list method with literal arguments (`.slice(1)`, `.split('.').slice(0, 2).join('.')`):
+                // computed here from a fixed list of pure methods, never by calling what a name finds
+                if ((typeof v === "string" || Array.isArray(v)) && this.is(k + 2, "(") && Object.hasOwn(METHODS, prop)) {
+                    const call = this.methodCall(v, prop, k + 2);
+                    v = call.value;
+                    k = call.next;
+                    continue;
+                }
+                if ((typeof v === "string" || Array.isArray(v)) && prop === "length" && !this.is(k + 2, "(")) {
+                    v = v.length;
+                    k += 2;
+                    continue;
+                }
                 const obj = v && typeof v === "object" && !Array.isArray(v)
                     ? v
                     : undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dogsbay/literal",
-  "version": "0.2.0-beta.135",
+  "version": "0.2.0-beta.136",
   "description": "Read a JavaScript/TypeScript config module as data without running it: object and array literals, spreads, module-level constants, zero-argument helpers and wrapper calls; anything else is reported, never guessed. No Node, no dependencies",
   "type": "module",
   "main": "dist/index.js",