@frontmcp/utils 1.12.0-rc.1 → 1.12.1

package/browser/storage/utils/pattern.mjs

@@ -2,38 +2,85 @@
 import { StoragePatternError } from "../errors.mjs";
 var MAX_PATTERN_LENGTH = 500;
 var MAX_WILDCARDS = 20;
-var REGEX_SPECIAL_CHARS = /[.+^${}()|[\]\\]/g;
-function globToRegex(pattern) {
+var REGEX_SPECIAL_CHARS = /[.*+?^${}()|[\]\\]/g;
+function tokenizeGlob(pattern) {
   if (pattern.length > MAX_PATTERN_LENGTH) {
     throw new StoragePatternError(
       pattern.substring(0, 50) + "...",
       `Pattern exceeds maximum length of ${MAX_PATTERN_LENGTH} characters`
     );
   }
-  const wildcardCount = (pattern.match(/[*?]/g) || []).length;
+  const tokens = [];
+  let wildcardCount = 0;
+  for (let i = 0; i < pattern.length; i++) {
+    const char = pattern[i];
+    if (char === "\\" && i + 1 < pattern.length) {
+      i++;
+      tokens.push({ kind: "literal", char: pattern[i] });
+    } else if (char === "*") {
+      wildcardCount++;
+      if (tokens[tokens.length - 1]?.kind !== "star") tokens.push({ kind: "star" });
+    } else if (char === "?") {
+      wildcardCount++;
+      tokens.push({ kind: "one" });
+    } else {
+      tokens.push({ kind: "literal", char });
+    }
+  }
   if (wildcardCount > MAX_WILDCARDS) {
     throw new StoragePatternError(pattern, `Pattern has too many wildcards (max: ${MAX_WILDCARDS})`);
   }
-  if (pattern === "" || pattern === "*") {
-    return /^.*$/;
+  return tokens;
+}
+function matchesEverything(tokens) {
+  return tokens.length === 0 || tokens.length === 1 && tokens[0].kind === "star";
+}
+function matchTokens(tokens, key) {
+  let k = 0;
+  let t = 0;
+  let starToken = -1;
+  let starKey = 0;
+  while (k < key.length) {
+    const token = tokens[t];
+    if (token !== void 0 && (token.kind === "one" || token.kind === "literal" && token.char === key[k])) {
+      t++;
+      k++;
+    } else if (token !== void 0 && token.kind === "star") {
+      starToken = t;
+      starKey = k;
+      t++;
+    } else if (starToken !== -1) {
+      t = starToken + 1;
+      starKey++;
+      k = starKey;
+    } else {
+      return false;
+    }
+  }
+  while (t < tokens.length && tokens[t].kind === "star") t++;
+  return t === tokens.length;
+}
+function createGlobMatcher(pattern) {
+  const tokens = tokenizeGlob(pattern);
+  if (matchesEverything(tokens)) {
+    return () => true;
+  }
+  return (key) => matchTokens(tokens, key);
+}
+function globToRegex(pattern) {
+  const tokens = tokenizeGlob(pattern);
+  if (matchesEverything(tokens)) {
+    return /^[\s\S]*$/;
   }
   let regexStr = "^";
-  let prevChar = "";
-  for (let i = 0; i < pattern.length; i++) {
-    const char = pattern[i];
-    switch (char) {
-      case "*":
-        if (prevChar !== "*") {
-          regexStr += ".*";
-        }
-        break;
-      case "?":
-        regexStr += ".";
-        break;
-      default:
-        regexStr += char.replace(REGEX_SPECIAL_CHARS, "\\$&");
+  for (const token of tokens) {
+    if (token.kind === "star") {
+      regexStr += "[\\s\\S]*";
+    } else if (token.kind === "one") {
+      regexStr += "[\\s\\S]";
+    } else {
+      regexStr += token.char.replace(REGEX_SPECIAL_CHARS, "\\$&");
     }
-    prevChar = char;
   }
   regexStr += "$";
   try {
@@ -43,12 +90,11 @@ function globToRegex(pattern) {
   }
 }
 function matchesPattern(key, pattern) {
-  const regex = globToRegex(pattern);
-  return regex.test(key);
+  return createGlobMatcher(pattern)(key);
 }
 function validatePattern(pattern) {
   try {
-    globToRegex(pattern);
+    tokenizeGlob(pattern);
     return { valid: true };
   } catch (e) {
     return {
@@ -58,9 +104,10 @@ function validatePattern(pattern) {
   }
 }
 function escapeGlob(literal) {
-  return literal.replace(/[*?\\]/g, "\\$&");
+  return literal.replace(/[*?[\]\\]/g, "\\$&");
 }
 export {
+  createGlobMatcher,
   escapeGlob,
   globToRegex,
   matchesPattern,

package/browser/uri/uri-template.mjs

@@ -1,5 +1,12 @@
 // libs/utils/src/uri/uri-template.ts
 function parseUriTemplate(template) {
+  const parts = templateParts(template);
+  return {
+    pattern: new RegExp(`^${parts.map(regexSourceOf).join("")}$`),
+    paramNames: paramNamesOf(parts)
+  };
+}
+function templateParts(template) {
   if (template.length > 1e3) {
     throw new Error("URI template too long (max 1000 characters)");
   }
@@ -7,34 +14,105 @@ function parseUriTemplate(template) {
   if (paramCount > 50) {
     throw new Error("URI template has too many parameters (max 50)");
   }
-  const paramNames = [];
+  const parts = [];
   const placeholder = /\{([^{}]+)\}/g;
-  let regexStr = "";
   let lastIndex = 0;
   for (let m = placeholder.exec(template); m !== null; m = placeholder.exec(template)) {
-    regexStr += escapeRegex(template.slice(lastIndex, m.index));
+    parts.push({ kind: "literal", text: template.slice(lastIndex, m.index) });
     const raw = m[1];
     const reserved = raw.startsWith("+");
-    paramNames.push(reserved ? raw.slice(1) : raw);
-    regexStr += reserved ? "(.+?)" : "([^/]+)";
+    parts.push({ kind: "param", name: reserved ? raw.slice(1) : raw, reserved });
     lastIndex = m.index + m[0].length;
   }
-  regexStr += escapeRegex(template.slice(lastIndex));
-  return {
-    pattern: new RegExp(`^${regexStr}$`),
-    paramNames
-  };
+  parts.push({ kind: "literal", text: template.slice(lastIndex) });
+  return parts;
+}
+function regexSourceOf(part) {
+  if (part.kind === "literal") return escapeRegex(part.text);
+  return part.reserved ? "(.+?)" : "([^/]+)";
+}
+function paramNamesOf(parts) {
+  return parts.flatMap((part) => part.kind === "param" ? [part.name] : []);
 }
 function escapeRegex(literal) {
   return literal.replace(/[.*+?^${}()|[\]\\]/g, (c) => `\\${c}`);
 }
+function matchTemplateParts(parts, uri) {
+  const fitsFrom = new Array(parts.length + 1);
+  fitsFrom[parts.length] = new PositionSet(uri.length);
+  fitsFrom[parts.length].add(uri.length);
+  for (let index = parts.length - 1; index >= 0; index--) {
+    fitsFrom[index] = positionsWherePartFits(parts[index], uri, fitsFrom[index + 1]);
+    if (parts[index].kind !== "param") fitsFrom[index + 1] = EMPTY_POSITIONS;
+  }
+  if (!fitsFrom[0].has(0)) return null;
+  const values = [];
+  let position = 0;
+  parts.forEach((part, index) => {
+    if (part.kind === "literal") {
+      position += part.text.length;
+      return;
+    }
+    const valueEnd = firstPositionNotHeld(part, uri, position);
+    const rest = fitsFrom[index + 1];
+    let end = part.reserved ? position + 1 : valueEnd;
+    while (!rest.has(end)) end += part.reserved ? 1 : -1;
+    values.push(uri.slice(position, end));
+    position = end;
+  });
+  return values;
+}
+function positionsWherePartFits(part, uri, rest) {
+  const fits = new PositionSet(uri.length);
+  if (part.kind === "literal") {
+    for (let position = 0; position + part.text.length <= uri.length; position++) {
+      if (rest.has(position + part.text.length) && uri.startsWith(part.text, position)) fits.add(position);
+    }
+    return fits;
+  }
+  let valueEnd = uri.length;
+  let nearestRest = Infinity;
+  for (let position = uri.length - 1; position >= 0; position--) {
+    if (rest.has(position + 1)) nearestRest = position + 1;
+    if (!canHold(part, uri.charCodeAt(position))) valueEnd = position;
+    if (nearestRest <= valueEnd) fits.add(position);
+  }
+  return fits;
+}
+function firstPositionNotHeld(part, uri, position) {
+  let end = position;
+  while (end < uri.length && canHold(part, uri.charCodeAt(end))) end++;
+  return end;
+}
+function canHold(part, charCode) {
+  if (part.kind !== "param") return false;
+  if (!part.reserved) return charCode !== SLASH;
+  return !LINE_TERMINATORS.has(charCode);
+}
+var SLASH = 47;
+var LINE_TERMINATORS = /* @__PURE__ */ new Set([10, 13, 8232, 8233]);
+var PositionSet = class {
+  bits;
+  constructor(length) {
+    this.bits = new Uint8Array((length >> 3) + 1);
+  }
+  /** Add `position`. */
+  add(position) {
+    this.bits[position >> 3] |= 1 << (position & 7);
+  }
+  /** Whether `position` was added. */
+  has(position) {
+    return position >= 0 && ((this.bits[position >> 3] ?? 0) & 1 << (position & 7)) !== 0;
+  }
+};
+var EMPTY_POSITIONS = new PositionSet(0);
 function matchUriTemplate(template, uri) {
-  const { pattern, paramNames } = parseUriTemplate(template);
-  const match = uri.match(pattern);
-  if (!match) return null;
+  const parts = templateParts(template);
+  const values = matchTemplateParts(parts, uri);
+  if (!values) return null;
   const params = {};
-  paramNames.forEach((name, index) => {
-    params[name] = decodeURIComponent(match[index + 1]);
+  paramNamesOf(parts).forEach((name, index) => {
+    params[name] = decodeURIComponent(values[index]);
   });
   return params;
 }

package/crypto/key-persistence/types.d.ts

@@ -102,7 +102,10 @@ export interface CreateKeyPersistenceOptions {
     /**
      * Optional 32-byte AES-256-GCM key for encrypting values at rest in localStorage.
      * Only used when type is 'localstorage' or 'auto' with localStorage fallback.
-     * If not provided, HKDF-SHA256 derives a key from a fixed IKM using the page origin.
+     * If not provided, HKDF-SHA256 derives a key from a fixed IKM, a random salt kept in the same
+     * localStorage and the page origin: values are not readable at a glance, but anyone who can read
+     * this origin's localStorage can derive the key and decrypt them. To protect them from such a
+     * reader, pass a key kept outside localStorage.
      */
     encryptionKey?: Uint8Array;
 }

package/escape/escape.d.ts

@@ -99,3 +99,22 @@ export declare function escapeScriptClose(jsonString: string): string;
  * ```
  */
 export declare function safeJsonForScript(value: unknown): string;
+/**
+ * Escape control characters so that a value always stays on one line of text output.
+ *
+ * Use it on values that come from callers (names, URIs, identifiers, messages from a remote peer) before they go into
+ * a log line or a terminal: a raw line break would let the value forge a separate log record, and an escape character
+ * could rewrite the terminal. Line feed, carriage return, backspace, form feed and vertical tab become a backslash
+ * and `n`, `r`, `b`, `f` or `v`; other C0 and C1 controls, DEL, U+2028 and U+2029 become a backslash, `u` and four hex
+ * digits. Tabs and every other character are kept.
+ *
+ * @param value - Value to escape (converted to a string first; null and undefined become an empty string)
+ * @returns The value with every control character replaced by a visible escape
+ *
+ * @example
+ * ```typescript
+ * escapeControlCharacters('tool\nINFO forged entry'); // 'tool\\nINFO forged entry'
+ * escapeControlCharacters('\u001b[31mred');            // '\\u001b[31mred'
+ * ```
+ */
+export declare function escapeControlCharacters(value: unknown): string;

package/escape/index.d.ts

@@ -1 +1 @@
-export { escapeHtml, escapeHtmlAttr, escapeJsString, escapeScriptClose, safeJsonForScript } from './escape';
+export { escapeHtml, escapeHtmlAttr, escapeJsString, escapeScriptClose, safeJsonForScript, escapeControlCharacters, } from './escape';