@qilin-agent/client-ui-primitives 3.1.5 → 3.1.7

package/lib/types/credential-scanner.d.ts

@@ -0,0 +1,146 @@
+import { type FormatTables } from './format-tables.ts';
+/** One recognized credential range, with the display form that masks it. */
+export interface SecretRange {
+    readonly start: number;
+    readonly end: number;
+    /** Display form of the original range; line breaks stay in place. */
+    readonly masked: string;
+}
+/**
+ * One scanner's state: the tables, its own patterns, and a memo of the last
+ * queried text, which it keeps until a query for another text. Queries are
+ * synchronous and never re-enter, so the patterns' cursors are never shared.
+ */
+export declare class CredentialScanner {
+    private readonly classes;
+    private readonly literals;
+    private readonly literalLength;
+    private readonly literalKind;
+    private readonly literalCheck;
+    private readonly literalMin;
+    private readonly literalMax;
+    private readonly literalOverlap;
+    private readonly ending;
+    private readonly sharedEndings;
+    /** Memo slot of each prefixed format's run class; 0 for `[A-Za-z0-9_-]`, which has four. */
+    private readonly literalSlot;
+    private readonly literalPattern;
+    private readonly prefixes;
+    private readonly keyRun;
+    private readonly userRun;
+    private readonly passwordRun;
+    private readonly nonDigits;
+    private readonly masks;
+    private readonly memo;
+    private text;
+    /**
+     * Build one scanner over shared tables.
+     * @param tables - the tables every scanner shares.
+     */
+    constructor(tables: FormatTables);
+    /**
+     * The nearest credential at or after `from`. Overlapping candidates of any format join the earliest
+     * one and take its mask, so no credential is drawn half masked. Candidates arrive in start order;
+     * an address password waits until the scan passes its start, and no other `://` can occur before
+     * then, because a user name and a password exclude `/`. A password that starts inside a range also
+     * ends inside it: the range holds the `:` before the password, so it is a key block, whose `END`
+     * line has spaces, or one that runs to the end of the text.
+     * @param text - the complete original text.
+     * @param from - the query offset.
+     * @returns the nearest credential range, or undefined when none starts at or after `from`.
+     */
+    match(text: string, from: number): SecretRange | undefined;
+    /**
+     * Memo entry at `index`; the layout keeps every index inside the array.
+     * @param index - the memo index.
+     * @returns the stored offset.
+     */
+    private slot;
+    /**
+     * `\w` at one offset; out of range is not a word character.
+     * @param index - the offset to read.
+     * @returns whether the code unit is a word character.
+     */
+    private isWordAt;
+    /**
+     * `[^\s/:@?#]` for one UTF-16 code unit; NaN, read out of range, is not one.
+     * @param code - the code unit.
+     * @returns whether the code unit may appear in an address user name.
+     */
+    private isUserCode;
+    /**
+     * Index of the literal the prefix scan matched ending at `end`; one literal sharing the ending matches, so the last needs no check.
+     * @param end - the offset after the matched literal.
+     * @returns the literal's index.
+     */
+    private literalEndingAt;
+    /**
+     * End of the `[A-Za-z0-9_-]*` run at `start`, through four memo pairs replaced in turn.
+     * @param start - the run's first offset.
+     * @returns the offset after the run.
+     */
+    private keyRunEnd;
+    /**
+     * End of the run `pattern` matches at `start`, through the memo pair at `slot`.
+     * @param pattern - the sticky run pattern.
+     * @param start - the run's first offset.
+     * @param slot - the memo pair to fill.
+     * @returns the offset after the run.
+     */
+    private memoRunEnd;
+    /**
+     * Offset of the first digit at or after `start`, or the text length.
+     * @param start - the offset to search from.
+     * @returns the digit's offset.
+     */
+    private nextDigit;
+    /**
+     * Offset after `[A-Z0-9 ]{0,40}PRIVATE KEY-----` at `start`, or -1; reads at most 52 characters.
+     * @param start - the offset the label starts at.
+     * @returns the offset after the header label, or -1.
+     */
+    private labelEnd;
+    /**
+     * End of the `-----BEGIN [A-Z0-9 ]{0,40}PRIVATE KEY-----` block at `at`: after its first complete
+     * `END` line, or the end of the text; -1 for an invalid header.
+     * @param at - the offset of the `-----BEGIN ` literal.
+     * @returns the offset after the block, or -1.
+     */
+    private keyBlockEnd;
+    /**
+     * Whether `\b[a-z][a-z0-9+.-]{1,15}` ends at `at`; reads at most 17 characters back.
+     * @param at - the offset after the scheme.
+     * @returns whether a scheme ends there.
+     */
+    private schemeBefore;
+    /**
+     * The password in `\b[a-z][a-z0-9+.-]{1,15}://[^\s/:@?#]{0,256}:[^\s/@?#]+@` for the `://` at
+     * `at`; neither part crosses `?` or `#`, where the authority ends. Callers pass a `://` at or after
+     * the query offset, or one whose user name reaches it, so the password never starts before it.
+     * @param at - the offset of the `://` literal.
+     * @returns the password end with its start in the memo, or -1.
+     */
+    private addressPassword;
+    /**
+     * The address password at or after `from` whose `://` starts before `from`, as `addressPassword`
+     * returns it. The walk back over the user name runs only when a `:`, a password, and `@` follow.
+     * @param from - the query offset.
+     * @returns the password end with its start in the memo, or -1.
+     */
+    private addressBefore;
+    /**
+     * End of the prefixed credential whose literal starts at `at`, or -1.
+     * @param literal - the literal's index.
+     * @param at - the offset of the literal.
+     * @returns the offset after the credential, or -1.
+     */
+    private prefixedEnd;
+}
+/**
+ * Every credential in `text`, in start order, each with the display form that
+ * masks it.
+ * @param text - the original user text.
+ * @returns the masked ranges; empty when the text holds no recognized credential.
+ */
+export declare function scanSecrets(text: string): readonly SecretRange[];
+//# sourceMappingURL=credential-scanner.d.ts.map

package/lib/types/format-tables.d.ts

@@ -0,0 +1,29 @@
+/** Tables indexed by format position in `CREDENTIAL_FORMATS`, by ASCII code unit, or by a literal's last two code units. */
+export interface FormatTables {
+    /** Class bits per ASCII code unit. */
+    readonly classes: Uint16Array;
+    readonly literals: readonly string[];
+    readonly literalLength: Uint8Array;
+    readonly literalKind: Uint8Array;
+    readonly literalCheck: Uint8Array;
+    readonly literalRun: Uint16Array;
+    readonly literalMin: Int32Array;
+    readonly literalMax: Int32Array;
+    /**
+     * Length of the longest proper suffix of each literal that begins a literal.
+     * The scan resumes there, so a key block whose first dash ends `sk-` is still seen.
+     */
+    readonly literalOverlap: Uint8Array;
+    /** Literal-only alternation of every literal, grouped by shared leading characters; no quantifier. */
+    readonly prefixSource: string;
+    /** Per key `code[-2] * 128 + code[-1]`: the literal with that ending plus one, or -1 where several share it. */
+    readonly ending: Int8Array;
+    /** Literals sharing an ending, by the same key. */
+    readonly sharedEndings: readonly (readonly number[] | undefined)[];
+}
+/**
+ * The tables for `CREDENTIAL_FORMATS`; the first call builds them.
+ * @returns the shared, read-only tables.
+ */
+export declare function formatTables(): FormatTables;
+//# sourceMappingURL=format-tables.d.ts.map