@safeaccess/inline 0.1.1 → 0.1.2

package/dist/parser/yaml-parser.d.ts

@@ -5,14 +5,22 @@
  * tags (!! and !), anchors (&), aliases (*), and merge keys (<<).
  *
  * Does not depend on external YAML libraries, making the package portable.
+ *
+ * @internal
  */
 export declare class YamlParser {
+    private readonly maxDepth;
+    /**
+     * @param maxDepth - Maximum allowed nesting depth during parsing.
+     *   Defaults to 512 to match SecurityParser.maxDepth.
+     */
+    constructor(maxDepth?: number);
     /**
      * Parse a YAML string into a plain object.
      *
      * @param yaml - Raw YAML content.
      * @returns Parsed data structure.
-     * @throws {YamlParseException} When unsafe constructs or syntax errors are found.
+     * @throws {YamlParseException} When unsafe constructs, syntax errors, or nesting depth exceeded.
      *
      * @example
      * new YamlParser().parse('key: value'); // { key: 'value' }
@@ -32,7 +40,10 @@ export declare class YamlParser {
      * @param baseIndent - Indentation level for this block.
      * @param start - First line index (inclusive).
      * @param end - Last line index (exclusive).
+     * @param depth - Current nesting depth.
      * @returns Parsed value.
+     *
+     * @throws {YamlParseException} When nesting depth exceeds the configured maximum.
      */
     private parseLines;
     /**
@@ -43,6 +54,8 @@ export declare class YamlParser {
      * @param end - Last child line index (exclusive).
      * @param childIndent - Expected indentation for child lines.
      * @param map - Map to merge values into.
+     * @param depth - Current nesting depth.
+     * @throws {YamlParseException} When resolved values exceed the configured nesting depth.
      */
     private mergeChildLines;
     /**
@@ -53,34 +66,68 @@ export declare class YamlParser {
      * @param lineIndex - Line where the value was found.
      * @param childIndent - Expected indentation for child block.
      * @param childEnd - End index of the child block.
+     * @param depth - Current nesting depth.
      * @returns Resolved typed value.
+     * @throws {YamlParseException} When child block nesting exceeds the configured maximum.
      */
     private resolveValue;
     /**
-     * Parse a YAML block scalar (literal | or folded >).
+     * Parse a YAML block scalar (literal | or folded >) with chomping modifiers.
      *
      * @param lines - All lines of the YAML document.
      * @param start - First line of the scalar block (inclusive).
      * @param end - Last line of the scalar block (exclusive).
-     * @param indent - Minimum indentation for scalar lines.
+     * @param indent - Expected minimum indentation for scalar lines.
      * @param folded - Whether to fold lines (> style) or keep literal (| style).
+     * @param chomping - Chomping indicator (|, |-, |+, >, >-, >+).
      * @returns The assembled string.
      */
     private parseBlockScalar;
     /**
-     * Parse an inline flow collection (JSON-like array or object).
+     * Parse a YAML flow sequence ([a, b, c]) into an array.
      *
-     * @param raw - Raw inline flow string.
-     * @returns Parsed value or the raw string if parsing fails.
+     * @param value - Raw flow sequence string including brackets.
+     * @returns Parsed sequence values.
      */
-    private parseInlineFlow;
+    private parseFlowSequence;
+    /**
+     * Parse a YAML flow map ({a: b, c: d}) into a record.
+     *
+     * @param value - Raw flow map string including braces.
+     * @returns Parsed key-value pairs.
+     */
+    private parseFlowMap;
+    /**
+     * Split flow-syntax items by comma, respecting nested brackets and quotes.
+     *
+     * @param inner - Content between outer brackets/braces.
+     * @returns Individual item strings.
+     */
+    private splitFlowItems;
     /**
      * Cast a scalar string to its native type.
      *
+     * Handles quoted strings, null, boolean, integer (decimal/octal/hex),
+     * float, infinity, and NaN values.
+     *
      * @param value - Raw scalar string.
      * @returns Typed value (null, boolean, number, or string).
      */
     private castScalar;
+    /**
+     * Unescape YAML double-quoted string escape sequences.
+     *
+     * @param value - String content between double quotes.
+     * @returns Unescaped string.
+     */
+    private unescapeDoubleQuoted;
+    /**
+     * Strip inline comments from a value string, respecting quoted regions.
+     *
+     * @param value - Raw value potentially containing inline comments.
+     * @returns Value with inline comments removed.
+     */
+    private stripInlineComment;
     /**
      * Find where a child block ends based on indentation.
      *

package/dist/parser/yaml-parser.js

@@ -6,14 +6,24 @@ import { YamlParseException } from '../exceptions/yaml-parse-exception.js';
  * tags (!! and !), anchors (&), aliases (*), and merge keys (<<).
  *
  * Does not depend on external YAML libraries, making the package portable.
+ *
+ * @internal
  */
 export class YamlParser {
+    maxDepth;
+    /**
+     * @param maxDepth - Maximum allowed nesting depth during parsing.
+     *   Defaults to 512 to match SecurityParser.maxDepth.
+     */
+    constructor(maxDepth = 512) {
+        this.maxDepth = maxDepth;
+    }
     /**
      * Parse a YAML string into a plain object.
      *
      * @param yaml - Raw YAML content.
      * @returns Parsed data structure.
-     * @throws {YamlParseException} When unsafe constructs or syntax errors are found.
+     * @throws {YamlParseException} When unsafe constructs, syntax errors, or nesting depth exceeded.
      *
      * @example
      * new YamlParser().parse('key: value'); // { key: 'value' }
@@ -21,7 +31,7 @@ export class YamlParser {
     parse(yaml) {
         const lines = yaml.replace(/\r\n/g, '\n').split('\n');
         this.assertNoUnsafeConstructs(lines);
-        const result = this.parseLines(lines, 0, 0, lines.length);
+        const result = this.parseLines(lines, 0, 0, lines.length, 0);
         if (Array.isArray(result)) {
             return {};
         }
@@ -61,9 +71,15 @@ export class YamlParser {
      * @param baseIndent - Indentation level for this block.
      * @param start - First line index (inclusive).
      * @param end - Last line index (exclusive).
+     * @param depth - Current nesting depth.
      * @returns Parsed value.
+     *
+     * @throws {YamlParseException} When nesting depth exceeds the configured maximum.
      */
-    parseLines(lines, baseIndent, start, end) {
+    parseLines(lines, baseIndent, start, end, depth = 0) {
+        if (depth > this.maxDepth) {
+            throw new YamlParseException(`YAML nesting depth ${depth} exceeds maximum of ${this.maxDepth}.`);
+        }
         const mapResult = {};
         const arrResult = [];
         let isSequence = false;
@@ -94,8 +110,8 @@ export class YamlParser {
                     const childIndent = currentIndent + 2;
                     const childEnd = this.findBlockEnd(lines, childIndent, i + 1, end);
                     const subMap = {};
-                    subMap[match[1]] = this.resolveValue(match[2], lines, i, childIndent, childEnd);
-                    this.mergeChildLines(lines, i + 1, childEnd, childIndent, subMap);
+                    subMap[match[1]] = this.resolveValue(match[2], lines, i, childIndent, childEnd, depth);
+                    this.mergeChildLines(lines, i + 1, childEnd, childIndent, subMap, depth);
                     arrResult.push(subMap);
                     i = childEnd;
                 }
@@ -103,7 +119,7 @@ export class YamlParser {
                     const childIndent = currentIndent + 2;
                     const childEnd = this.findBlockEnd(lines, childIndent, i + 1, end);
                     if (childEnd > i + 1) {
-                        arrResult.push(this.parseLines(lines, childIndent, i + 1, childEnd));
+                        arrResult.push(this.parseLines(lines, childIndent, i + 1, childEnd, depth + 1));
                         i = childEnd;
                     }
                     else {
@@ -124,7 +140,7 @@ export class YamlParser {
                 const rawValue = mapMatch[2];
                 const childIndent = currentIndent + 2;
                 const childEnd = this.findBlockEnd(lines, childIndent, i + 1, end);
-                mapResult[key] = this.resolveValue(rawValue, lines, i, childIndent, childEnd);
+                mapResult[key] = this.resolveValue(rawValue, lines, i, childIndent, childEnd, depth);
                 i = childEnd;
                 continue;
             }
@@ -143,8 +159,10 @@ export class YamlParser {
      * @param end - Last child line index (exclusive).
      * @param childIndent - Expected indentation for child lines.
      * @param map - Map to merge values into.
+     * @param depth - Current nesting depth.
+     * @throws {YamlParseException} When resolved values exceed the configured nesting depth.
      */
-    mergeChildLines(lines, start, end, childIndent, map) {
+    mergeChildLines(lines, start, end, childIndent, map, depth) {
         let ci = start;
         while (ci < end) {
             const childLine = lines[ci];
@@ -158,7 +176,7 @@ export class YamlParser {
                 const cm = /^([^\s:][^:]*?)\s*:\s*(.*)$/.exec(childTrimmed);
                 if (cm !== null) {
                     const nextChildEnd = this.findBlockEnd(lines, childCurrentIndent + 2, ci + 1, end);
-                    map[cm[1]] = this.resolveValue(cm[2], lines, ci, childCurrentIndent + 2, nextChildEnd);
+                    map[cm[1]] = this.resolveValue(cm[2], lines, ci, childCurrentIndent + 2, nextChildEnd, depth);
                     ci = nextChildEnd;
                     continue;
                 }
@@ -174,90 +192,289 @@ export class YamlParser {
      * @param lineIndex - Line where the value was found.
      * @param childIndent - Expected indentation for child block.
      * @param childEnd - End index of the child block.
+     * @param depth - Current nesting depth.
      * @returns Resolved typed value.
+     * @throws {YamlParseException} When child block nesting exceeds the configured maximum.
      */
-    resolveValue(rawValue, lines, lineIndex, childIndent, childEnd) {
-        const trimmed = rawValue.trim();
-        // Block scalar literal (|) or folded (>)
-        if (trimmed === '|' || trimmed === '>') {
-            return this.parseBlockScalar(lines, lineIndex + 1, childEnd, childIndent, trimmed === '>');
+    resolveValue(rawValue, lines, lineIndex, childIndent, childEnd, depth = 0) {
+        const trimmed = this.stripInlineComment(rawValue.trim());
+        // Block scalar literal (|, |-,  |+) or folded (>, >-, >+)
+        if (/^\|[+-]?$/.test(trimmed) || /^>[+-]?$/.test(trimmed)) {
+            return this.parseBlockScalar(lines, lineIndex + 1, childEnd, childIndent, trimmed.startsWith('>'), trimmed);
+        }
+        // Inline flow sequence [a, b, c]
+        if (trimmed.startsWith('[') && trimmed.endsWith(']')) {
+            return this.parseFlowSequence(trimmed);
         }
-        // Inline flow (array or map) starting with [ or {
-        if (trimmed.startsWith('[') || trimmed.startsWith('{')) {
-            return this.parseInlineFlow(trimmed);
+        // Inline flow map {a: b, c: d}
+        if (trimmed.startsWith('{') && trimmed.endsWith('}')) {
+            return this.parseFlowMap(trimmed);
         }
         // Nested block
         if (trimmed === '' && childEnd > lineIndex + 1) {
-            return this.parseLines(lines, childIndent, lineIndex + 1, childEnd);
+            return this.parseLines(lines, childIndent, lineIndex + 1, childEnd, depth + 1);
         }
         return this.castScalar(trimmed);
     }
     /**
-     * Parse a YAML block scalar (literal | or folded >).
+     * Parse a YAML block scalar (literal | or folded >) with chomping modifiers.
      *
      * @param lines - All lines of the YAML document.
      * @param start - First line of the scalar block (inclusive).
      * @param end - Last line of the scalar block (exclusive).
-     * @param indent - Minimum indentation for scalar lines.
+     * @param indent - Expected minimum indentation for scalar lines.
      * @param folded - Whether to fold lines (> style) or keep literal (| style).
+     * @param chomping - Chomping indicator (|, |-, |+, >, >-, >+).
      * @returns The assembled string.
      */
-    parseBlockScalar(lines, start, end, indent, folded) {
-        const parts = [];
+    parseBlockScalar(lines, start, end, indent, folded, chomping = '|') {
+        const blockLines = [];
+        let actualIndent = null;
         for (let i = start; i < end; i++) {
             const line = lines[i];
-            const trimmed = line.trimStart();
-            const lineIndent = line.length - trimmed.length;
-            if (lineIndent >= indent || trimmed === '') {
-                parts.push(trimmed);
+            if (line.trim() === '') {
+                blockLines.push('');
+                continue;
+            }
+            const lineIndent = line.length - line.trimStart().length;
+            if (actualIndent === null) {
+                actualIndent = lineIndent;
+            }
+            if (lineIndent < actualIndent) {
+                break;
+            }
+            blockLines.push(line.substring(actualIndent));
+        }
+        // Remove trailing empty lines for clip (default) and strip (-) modes.
+        // Keep (+) mode preserves all trailing blank lines.
+        if (!chomping.endsWith('+')) {
+            while (blockLines.length > 0 && blockLines[blockLines.length - 1] === '') {
+                blockLines.pop();
             }
         }
+        let result;
         if (folded) {
-            return parts.join(' ').trim();
+            result = '';
+            let prevEmpty = false;
+            for (const bl of blockLines) {
+                if (bl === '') {
+                    result += '\n';
+                    prevEmpty = true;
+                }
+                else {
+                    if (result !== '' && !prevEmpty && !result.endsWith('\n')) {
+                        result += ' ';
+                    }
+                    result += bl;
+                    prevEmpty = false;
+                }
+            }
+        }
+        else {
+            result = blockLines.join('\n');
+        }
+        // Default YAML chomping: add trailing newline unless strip (-)
+        if (!chomping.endsWith('-') && !result.endsWith('\n')) {
+            result += '\n';
+        }
+        return result;
+    }
+    /**
+     * Parse a YAML flow sequence ([a, b, c]) into an array.
+     *
+     * @param value - Raw flow sequence string including brackets.
+     * @returns Parsed sequence values.
+     */
+    parseFlowSequence(value) {
+        const inner = value.slice(1, -1).trim();
+        if (inner === '') {
+            return [];
         }
-        return parts.join('\n').trimEnd();
+        const items = this.splitFlowItems(inner);
+        return items.map((item) => this.castScalar(item.trim()));
     }
     /**
-     * Parse an inline flow collection (JSON-like array or object).
+     * Parse a YAML flow map ({a: b, c: d}) into a record.
      *
-     * @param raw - Raw inline flow string.
-     * @returns Parsed value or the raw string if parsing fails.
+     * @param value - Raw flow map string including braces.
+     * @returns Parsed key-value pairs.
      */
-    parseInlineFlow(raw) {
-        try {
-            // Convert YAML flow to JSON by single-quoting to double-quoting
-            const jsonLike = raw.replace(/'/g, '"').replace(/(\w+)\s*:/g, '"$1":');
-            return JSON.parse(jsonLike);
+    parseFlowMap(value) {
+        const inner = value.slice(1, -1).trim();
+        if (inner === '') {
+            return {};
         }
-        catch {
-            // Fallback: return raw string
-            return raw;
+        const result = {};
+        const items = this.splitFlowItems(inner);
+        for (const item of items) {
+            const trimmedItem = item.trim();
+            const colonPos = trimmedItem.indexOf(':');
+            if (colonPos === -1) {
+                continue;
+            }
+            const key = trimmedItem.substring(0, colonPos).trim();
+            const val = trimmedItem.substring(colonPos + 1).trim();
+            result[key] = this.castScalar(val);
         }
+        return result;
+    }
+    /**
+     * Split flow-syntax items by comma, respecting nested brackets and quotes.
+     *
+     * @param inner - Content between outer brackets/braces.
+     * @returns Individual item strings.
+     */
+    splitFlowItems(inner) {
+        const items = [];
+        let depth = 0;
+        let current = '';
+        let inQuote = false;
+        let quoteChar = '';
+        for (let i = 0; i < inner.length; i++) {
+            const ch = inner[i];
+            if (inQuote) {
+                current += ch;
+                if (ch === quoteChar) {
+                    inQuote = false;
+                }
+                continue;
+            }
+            if (ch === '"' || ch === "'") {
+                inQuote = true;
+                quoteChar = ch;
+                current += ch;
+                continue;
+            }
+            if (ch === '[' || ch === '{') {
+                depth++;
+                current += ch;
+                continue;
+            }
+            if (ch === ']' || ch === '}') {
+                depth--;
+                current += ch;
+                continue;
+            }
+            if (ch === ',' && depth === 0) {
+                items.push(current);
+                current = '';
+                continue;
+            }
+            current += ch;
+        }
+        if (current.trim() !== '') {
+            items.push(current);
+        }
+        return items;
     }
     /**
      * Cast a scalar string to its native type.
      *
+     * Handles quoted strings, null, boolean, integer (decimal/octal/hex),
+     * float, infinity, and NaN values.
+     *
      * @param value - Raw scalar string.
      * @returns Typed value (null, boolean, number, or string).
      */
     castScalar(value) {
-        if (value === '' || value === 'null' || value === '~')
+        value = value.trim();
+        // Quoted strings
+        if (value.length >= 2) {
+            if (value.startsWith('"') && value.endsWith('"')) {
+                return this.unescapeDoubleQuoted(value.slice(1, -1));
+            }
+            if (value.startsWith("'") && value.endsWith("'")) {
+                return value.slice(1, -1).replace(/''/g, "'");
+            }
+        }
+        // Null
+        if (value === '' ||
+            value === '~' ||
+            value === 'null' ||
+            value === 'Null' ||
+            value === 'NULL') {
             return null;
-        if (value === 'true')
+        }
+        // Boolean
+        const lower = value.toLowerCase();
+        if (lower === 'true' || lower === 'yes' || lower === 'on')
             return true;
-        if (value === 'false')
+        if (lower === 'false' || lower === 'no' || lower === 'off')
             return false;
-        // Quoted string
-        if ((value.startsWith('"') && value.endsWith('"')) ||
-            (value.startsWith("'") && value.endsWith("'"))) {
-            return value.slice(1, -1);
-        }
-        // Integer
-        if (/^-?\d+$/.test(value))
+        // Integer patterns
+        if (/^-?(?:0|[1-9]\d*)$/.test(value))
             return parseInt(value, 10);
-        // Float
-        if (/^-?\d+\.\d+$/.test(value))
+        if (/^0o[0-7]+$/i.test(value))
+            return parseInt(value.slice(2), 8);
+        if (/^0x[0-9a-fA-F]+$/.test(value))
+            return parseInt(value, 16);
+        // Float patterns
+        if (/^-?(?:0|[1-9]\d*)?(?:\.\d+)?(?:[eE][+-]?\d+)?$/.test(value) && value.includes('.')) {
             return parseFloat(value);
+        }
+        if (lower === '.inf' || lower === '+.inf')
+            return Infinity;
+        if (lower === '-.inf')
+            return -Infinity;
+        if (lower === '.nan')
+            return NaN;
+        return value;
+    }
+    /**
+     * Unescape YAML double-quoted string escape sequences.
+     *
+     * @param value - String content between double quotes.
+     * @returns Unescaped string.
+     */
+    unescapeDoubleQuoted(value) {
+        return value
+            .replace(/\\n/g, '\n')
+            .replace(/\\t/g, '\t')
+            .replace(/\\r/g, '\r')
+            .replace(/\\\\/g, '\\')
+            .replace(/\\"/g, '"')
+            .replace(/\\0/g, '\0')
+            .replace(/\\a/g, '\x07')
+            .replace(/\\b/g, '\x08')
+            .replace(/\\f/g, '\x0C')
+            .replace(/\\v/g, '\x0B');
+    }
+    /**
+     * Strip inline comments from a value string, respecting quoted regions.
+     *
+     * @param value - Raw value potentially containing inline comments.
+     * @returns Value with inline comments removed.
+     */
+    stripInlineComment(value) {
+        value = value.trim();
+        if (value === '') {
+            return '';
+        }
+        // Don't strip from quoted strings
+        if (value[0] === '"' || value[0] === "'") {
+            const closePos = value.indexOf(value[0], 1);
+            if (closePos !== -1) {
+                const afterQuote = value.substring(closePos + 1).trim();
+                if (afterQuote === '' || afterQuote[0] === '#') {
+                    return value.substring(0, closePos + 1);
+                }
+            }
+        }
+        // Strip # comments (but not inside strings)
+        let inSingle = false;
+        let inDouble = false;
+        for (let i = 0; i < value.length; i++) {
+            const ch = value[i];
+            if (ch === "'" && !inDouble) {
+                inSingle = !inSingle;
+            }
+            else if (ch === '"' && !inSingle) {
+                inDouble = !inDouble;
+            }
+            else if (ch === '#' && !inSingle && !inDouble && i > 0 && value[i - 1] === ' ') {
+                return value.substring(0, i).trim();
+            }
+        }
         return value;
     }
     /**