@traffic-twin/sdk 0.0.0-stage → 0.1.0

package/dist/cjs/sanitizer/formats.d.ts

@@ -0,0 +1,26 @@
+export declare function lenClass(n: number): string;
+export declare const RE_UUID: RegExp;
+export declare const RE_JWT: RegExp;
+export declare const RE_EMAIL: RegExp;
+export declare const RE_DATETIME: RegExp;
+export declare const RE_DATE: RegExp;
+export declare const RE_URL: RegExp;
+export declare const RE_IPV4: RegExp;
+export declare const RE_PHONE: RegExp;
+export declare const RE_DIGITS: RegExp;
+export declare const RE_HEX: RegExp;
+export declare function isPrintableAscii(s: string): boolean;
+/** First matching format of 6.3, or null. Only printable ASCII strings are considered. */
+export declare function detectFormat(s: string): string | null;
+/** drop form of a well-formed string. */
+export declare function strShape(s: string): string;
+/** 9.3.3: a JSON key, query, cookie or form name leaves as a literal only if this holds. */
+export declare function isLiteralName(s: string): boolean;
+/** 8.0.2: output name of a lowercased header name. */
+export declare function headerOutName(lower: string): string;
+export declare const PATH_TOKEN_RE: RegExp;
+/** Code shape of the code action (sanitizer.md 5.6, spec v1.11): ASCII letters, `_`, `-`, 2 to 32 bytes. */
+export declare const CODE_RE: RegExp;
+/** Shape `alnum` of the code action (sanitizer.md 5.6, spec v1.19): letters, digits, `_`, `-`, `.`, 1 to 16 bytes. */
+export declare const CODE_ALNUM_RE: RegExp;
+export declare const AUTO_WORD_RE: RegExp;

package/dist/cjs/sanitizer/formats.js

@@ -0,0 +1,110 @@
+"use strict";
+// Shapes (6.2), recognized formats (6.3), length classes (0.3) and the name rule (9.3.3).
+//
+// All regular expressions are whole-string, ASCII-only matches (0.1). JavaScript `$`
+// without the `m` flag only matches at the end of the input, so "x\n" never matches.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTO_WORD_RE = exports.CODE_ALNUM_RE = exports.CODE_RE = exports.PATH_TOKEN_RE = exports.RE_HEX = exports.RE_DIGITS = exports.RE_PHONE = exports.RE_IPV4 = exports.RE_URL = exports.RE_DATE = exports.RE_DATETIME = exports.RE_EMAIL = exports.RE_JWT = exports.RE_UUID = void 0;
+exports.lenClass = lenClass;
+exports.isPrintableAscii = isPrintableAscii;
+exports.detectFormat = detectFormat;
+exports.strShape = strShape;
+exports.isLiteralName = isLiteralName;
+exports.headerOutName = headerOutName;
+const utf8_js_1 = require("./utf8.js");
+function lenClass(n) {
+    if (n <= 8)
+        return 'l8';
+    if (n <= 32)
+        return 'l32';
+    if (n <= 128)
+        return 'l128';
+    if (n <= 1024)
+        return 'l1024';
+    return 'lmax';
+}
+const PRINTABLE = /^[\x20-\x7e]*$/;
+exports.RE_UUID = /^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$/;
+exports.RE_JWT = /^eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*$/;
+exports.RE_EMAIL = /^[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9-]{1,63}(\.[A-Za-z0-9-]{1,63})+$/;
+exports.RE_DATETIME = /^[0-9]{4}-[0-9]{2}-[0-9]{2}[Tt ][0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{1,9})?([Zz]|[+-][0-9]{2}:[0-9]{2})$/;
+exports.RE_DATE = /^[0-9]{4}-[0-9]{2}-[0-9]{2}$/;
+exports.RE_URL = /^[A-Za-z][A-Za-z0-9+.-]{0,15}:\/\/[!-~]+$/;
+exports.RE_IPV4 = /^(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3}$/;
+exports.RE_PHONE = /^\+[1-9][0-9]{6,14}$/;
+exports.RE_DIGITS = /^-?[0-9]{1,19}$/;
+exports.RE_HEX = /^[0-9A-Fa-f]{16,}$/;
+const FORMATS = [
+    ['uuid', exports.RE_UUID],
+    ['jwt', exports.RE_JWT],
+    ['email', exports.RE_EMAIL],
+    ['datetime', exports.RE_DATETIME],
+    ['date', exports.RE_DATE],
+    ['url', exports.RE_URL],
+    ['ipv4', exports.RE_IPV4],
+    ['phone', exports.RE_PHONE],
+    ['digits', exports.RE_DIGITS],
+    ['hex', exports.RE_HEX],
+];
+function isPrintableAscii(s) {
+    return PRINTABLE.test(s);
+}
+/** First matching format of 6.3, or null. Only printable ASCII strings are considered. */
+function detectFormat(s) {
+    if (!PRINTABLE.test(s))
+        return null;
+    for (const [name, re] of FORMATS) {
+        if (re.test(s))
+            return name;
+    }
+    return null;
+}
+/** drop form of a well-formed string. */
+function strShape(s) {
+    const f = detectFormat(s);
+    if (f !== null)
+        return 'drop:str:' + f;
+    return 'drop:str:' + lenClass((0, utf8_js_1.utf8Length)(s));
+}
+const KEY_RE = /^[A-Za-z_][A-Za-z0-9_.-]{0,63}$/;
+const SIX_DIGITS = /[0-9]{6}/;
+const HEADER_NAME_RE = /^[a-z0-9!#$%&'*+.^_`|~-]{1,64}$/;
+function looksLikeValue(s) {
+    return exports.RE_UUID.test(s) || exports.RE_EMAIL.test(s) || exports.RE_HEX.test(s) || exports.RE_DIGITS.test(s) || exports.RE_JWT.test(s) || SIX_DIGITS.test(s);
+}
+/** 9.3.3: a JSON key, query, cookie or form name leaves as a literal only if this holds. */
+function isLiteralName(s) {
+    const hit = literalMemo.get(s);
+    if (hit !== undefined)
+        return hit;
+    const r = KEY_RE.test(s) && !looksLikeValue(s);
+    // Names repeat (JSON keys, header and query names): remember the answer, bounded.
+    if (s.length <= 64) {
+        if (literalMemo.size >= MEMO_MAX)
+            literalMemo.clear();
+        literalMemo.set(s, r);
+    }
+    return r;
+}
+const MEMO_MAX = 2048;
+const literalMemo = new Map();
+const headerMemo = new Map();
+/** 8.0.2: output name of a lowercased header name. */
+function headerOutName(lower) {
+    const hit = headerMemo.get(lower);
+    if (hit !== undefined)
+        return hit;
+    const r = !HEADER_NAME_RE.test(lower) || looksLikeValue(lower) ? '{*}' : lower;
+    if (lower.length <= 64) {
+        if (headerMemo.size >= MEMO_MAX)
+            headerMemo.clear();
+        headerMemo.set(lower, r);
+    }
+    return r;
+}
+exports.PATH_TOKEN_RE = /^[A-Za-z0-9._~-]{1,64}$/;
+/** Code shape of the code action (sanitizer.md 5.6, spec v1.11): ASCII letters, `_`, `-`, 2 to 32 bytes. */
+exports.CODE_RE = /^[A-Za-z_-]{2,32}$/;
+/** Shape `alnum` of the code action (sanitizer.md 5.6, spec v1.19): letters, digits, `_`, `-`, `.`, 1 to 16 bytes. */
+exports.CODE_ALNUM_RE = /^[A-Za-z0-9_.-]{1,16}$/;
+exports.AUTO_WORD_RE = /^([a-z]+([-_][a-z]+)*|v[0-9]{1,3})$/;

package/dist/cjs/sanitizer/graphql.d.ts

@@ -0,0 +1,23 @@
+/** Largest number of open brackets ({, ( and [ together). */
+export declare const GQL_MAX_NESTING = 64;
+/** Largest shape; a longer one is not emitted. */
+export declare const GQL_MAX_SHAPE_BYTES = 32768;
+/** Longest name emitted as written. */
+export declare const GQL_MAX_NAME_BYTES = 64;
+/** Array limit of a response body when the introspection gate is open (5.7.2). */
+export declare const GQL_INTROSPECTION_MAX_ARRAY = 4096;
+export interface GqlShape {
+    /** Canonical shape, without the `gql:` prefix. */
+    shape: string;
+    /** Every operation selects only __schema, __type, __typename at its root, without aliases. */
+    introspection: boolean;
+}
+/** The key rule of 9.3 on a GraphQL name (5.7.1). */
+export declare function gqlNameSafe(name: string): boolean;
+/** True if s is a GraphQL name (any length). */
+export declare function gqlIsName(s: string): boolean;
+/**
+ * Shape of an executable document (5.7.1), or null when `src` is not an executable
+ * document within the limits (the caller then emits the drop form of the string).
+ */
+export declare function gqlShape(src: string): GqlShape | null;

package/dist/cjs/sanitizer/graphql.js

@@ -0,0 +1,478 @@
+"use strict";
+// GraphQL document shape, sanitizer.md 5.7 (spec v1.14): the same algorithm as the Go
+// reference (internal/graphql) and conformance/ref/gqlshape.py, step by step.
+//
+// The input is a well-formed JavaScript string (no lone surrogates: the caller checks).
+// Everything outside strings and comments is ASCII, so code units and bytes coincide
+// wherever the algorithm looks; any other character there is an error.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GQL_INTROSPECTION_MAX_ARRAY = exports.GQL_MAX_NAME_BYTES = exports.GQL_MAX_SHAPE_BYTES = exports.GQL_MAX_NESTING = void 0;
+exports.gqlNameSafe = gqlNameSafe;
+exports.gqlIsName = gqlIsName;
+exports.gqlShape = gqlShape;
+/** Largest number of open brackets ({, ( and [ together). */
+exports.GQL_MAX_NESTING = 64;
+/** Largest shape; a longer one is not emitted. */
+exports.GQL_MAX_SHAPE_BYTES = 32768;
+/** Longest name emitted as written. */
+exports.GQL_MAX_NAME_BYTES = 64;
+/** Array limit of a response body when the introspection gate is open (5.7.2). */
+exports.GQL_INTROSPECTION_MAX_ARRAY = 4096;
+class GqlError extends Error {
+}
+const ERR = new GqlError('graphql');
+function isNameStart(c) {
+    return c === 0x5f || (c >= 0x41 && c <= 0x5a) || (c >= 0x61 && c <= 0x7a);
+}
+function isNameCont(c) {
+    return isNameStart(c) || (c >= 0x30 && c <= 0x39);
+}
+function isDigit(c) {
+    return c >= 0x30 && c <= 0x39;
+}
+function isHex(c) {
+    return (c >= 0x30 && c <= 0x39) || (c >= 0x61 && c <= 0x66) || (c >= 0x41 && c <= 0x46);
+}
+function lex(src) {
+    const toks = [];
+    const n = src.length;
+    let i = 0;
+    let open = 0;
+    while (i < n) {
+        const c = src.charCodeAt(i);
+        switch (c) {
+            case 0x20:
+            case 0x09:
+            case 0x0a:
+            case 0x0d:
+            case 0x2c:
+            case 0xfeff:
+                i++;
+                continue;
+            case 0x23: // #
+                while (i < n && src.charCodeAt(i) !== 0x0a && src.charCodeAt(i) !== 0x0d)
+                    i++;
+                continue;
+            case 0x21:
+            case 0x24:
+            case 0x26:
+            case 0x3a:
+            case 0x3d:
+            case 0x40:
+            case 0x7c: // ! $ & : = @ |
+                toks.push({ k: 'punct', s: src[i], value: false });
+                i++;
+                continue;
+            case 0x28:
+            case 0x5b:
+            case 0x7b: // ( [ {
+                if (++open > exports.GQL_MAX_NESTING)
+                    throw ERR;
+                toks.push({ k: 'punct', s: src[i], value: false });
+                i++;
+                continue;
+            case 0x29:
+            case 0x5d:
+            case 0x7d: // ) ] }
+                if (--open < 0)
+                    throw ERR;
+                toks.push({ k: 'punct', s: src[i], value: false });
+                i++;
+                continue;
+            case 0x2e: // .
+                if (src.startsWith('...', i)) {
+                    toks.push({ k: 'punct', s: '...', value: false });
+                    i += 3;
+                    continue;
+                }
+                throw ERR;
+            case 0x22: // "
+                i = lexString(src, i);
+                toks.push({ k: 'str', s: '', value: false });
+                continue;
+            default:
+                break;
+        }
+        if (isNameStart(c)) {
+            let j = i + 1;
+            while (j < n && isNameCont(src.charCodeAt(j)))
+                j++;
+            toks.push({ k: 'name', s: src.slice(i, j), value: false });
+            i = j;
+            continue;
+        }
+        if (c === 0x2d || isDigit(c)) {
+            const [j, k] = lexNumber(src, i);
+            toks.push({ k, s: '', value: false });
+            i = j;
+            continue;
+        }
+        throw ERR;
+    }
+    if (open !== 0)
+        throw ERR;
+    return toks;
+}
+function lexNumber(src, i) {
+    const n = src.length;
+    let j = i;
+    if (src.charCodeAt(j) === 0x2d)
+        j++;
+    if (j >= n || !isDigit(src.charCodeAt(j)))
+        throw ERR;
+    if (src.charCodeAt(j) === 0x30) {
+        j++;
+        if (j < n && isDigit(src.charCodeAt(j)))
+            throw ERR; // leading zero
+    }
+    else {
+        while (j < n && isDigit(src.charCodeAt(j)))
+            j++;
+    }
+    let k = 'int';
+    if (j < n && src.charCodeAt(j) === 0x2e) {
+        j++;
+        if (j >= n || !isDigit(src.charCodeAt(j)))
+            throw ERR;
+        while (j < n && isDigit(src.charCodeAt(j)))
+            j++;
+        k = 'float';
+    }
+    if (j < n && (src.charCodeAt(j) === 0x65 || src.charCodeAt(j) === 0x45)) {
+        j++;
+        if (j < n && (src.charCodeAt(j) === 0x2b || src.charCodeAt(j) === 0x2d))
+            j++;
+        if (j >= n || !isDigit(src.charCodeAt(j)))
+            throw ERR;
+        while (j < n && isDigit(src.charCodeAt(j)))
+            j++;
+        k = 'float';
+    }
+    // A number is not followed by '.' or a NameStart.
+    if (j < n && (src.charCodeAt(j) === 0x2e || isNameStart(src.charCodeAt(j))))
+        throw ERR;
+    return [j, k];
+}
+/** Index after the string or block string starting at the quote at i. */
+function lexString(src, i) {
+    const n = src.length;
+    if (src.startsWith('"""', i)) {
+        let j = i + 3;
+        while (j < n) {
+            const c = src.charCodeAt(j);
+            if (c === 0x5c && src.startsWith('"""', j + 1))
+                j += 4;
+            else if (c === 0x22 && src.startsWith('"""', j))
+                return j + 3;
+            else if (c < 0x20 && c !== 0x09 && c !== 0x0a && c !== 0x0d)
+                throw ERR;
+            else
+                j++;
+        }
+        throw ERR;
+    }
+    let j = i + 1;
+    while (j < n) {
+        const c = src.charCodeAt(j);
+        if (c === 0x22)
+            return j + 1;
+        if (c === 0x5c) {
+            if (j + 1 >= n)
+                throw ERR;
+            switch (src[j + 1]) {
+                case '"':
+                case '\\':
+                case '/':
+                case 'b':
+                case 'f':
+                case 'n':
+                case 'r':
+                case 't':
+                    j += 2;
+                    break;
+                case 'u':
+                    if (j + 5 >= n)
+                        throw ERR;
+                    for (let h = j + 2; h < j + 6; h++)
+                        if (!isHex(src.charCodeAt(h)))
+                            throw ERR;
+                    j += 6;
+                    break;
+                default:
+                    throw ERR;
+            }
+        }
+        else if (c < 0x20 && c !== 0x09) {
+            throw ERR; // line terminators and control characters
+        }
+        else {
+            j++;
+        }
+    }
+    throw ERR;
+}
+class Parser {
+    t;
+    p = 0;
+    /** Root selections of every operation (fragments excluded). */
+    ops = [];
+    constructor(t) {
+        this.t = t;
+    }
+    isPunct(s) {
+        const t = this.t[this.p];
+        return t !== undefined && t.k === 'punct' && t.s === s;
+    }
+    isName(s) {
+        const t = this.t[this.p];
+        return t !== undefined && t.k === 'name' && (s === undefined || t.s === s);
+    }
+    expect(s) {
+        if (!this.isPunct(s))
+            throw ERR;
+        this.p++;
+    }
+    name() {
+        if (!this.isName())
+            throw ERR;
+        return this.t[this.p++].s;
+    }
+    document() {
+        if (this.t.length === 0)
+            throw ERR;
+        while (this.p < this.t.length) {
+            if (this.isPunct('{')) {
+                this.ops.push(this.selectionSet());
+            }
+            else if (this.isName('query') || this.isName('mutation') || this.isName('subscription')) {
+                this.p++;
+                if (this.isName())
+                    this.p++;
+                if (this.isPunct('(')) {
+                    this.p++;
+                    if (this.isPunct(')'))
+                        throw ERR;
+                    while (!this.isPunct(')'))
+                        this.varDef();
+                    this.p++;
+                }
+                this.directives();
+                this.ops.push(this.selectionSet());
+            }
+            else if (this.isName('fragment')) {
+                this.p++;
+                if (this.name() === 'on')
+                    throw ERR;
+                if (!this.isName('on'))
+                    throw ERR;
+                this.p++;
+                this.name();
+                this.directives();
+                this.selectionSet();
+            }
+            else {
+                throw ERR;
+            }
+        }
+    }
+    varDef() {
+        this.expect('$');
+        this.name();
+        this.expect(':');
+        this.typeRef();
+        if (this.isPunct('=')) {
+            this.p++;
+            this.value();
+        }
+        this.directives();
+    }
+    typeRef() {
+        if (this.isPunct('[')) {
+            this.p++;
+            this.typeRef();
+            this.expect(']');
+        }
+        else {
+            this.name();
+        }
+        if (this.isPunct('!'))
+            this.p++;
+    }
+    selectionSet() {
+        this.expect('{');
+        const out = [];
+        while (!this.isPunct('}'))
+            out.push(this.selection());
+        if (out.length === 0)
+            throw ERR;
+        this.p++;
+        return out;
+    }
+    selection() {
+        if (this.isPunct('...')) {
+            this.p++;
+            if (this.isName() && !this.isName('on')) {
+                this.p++;
+                this.directives();
+                return { field: false, alias: false, name: '' };
+            }
+            if (this.isName()) {
+                this.p++; // on
+                this.name();
+            }
+            this.directives();
+            this.selectionSet();
+            return { field: false, alias: false, name: '' };
+        }
+        let name = this.name();
+        let alias = false;
+        if (this.isPunct(':')) {
+            this.p++;
+            name = this.name();
+            alias = true;
+        }
+        if (this.isPunct('('))
+            this.arguments();
+        this.directives();
+        if (this.isPunct('{'))
+            this.selectionSet();
+        return { field: true, alias, name };
+    }
+    arguments() {
+        this.expect('(');
+        if (this.isPunct(')'))
+            throw ERR;
+        while (!this.isPunct(')')) {
+            this.name();
+            this.expect(':');
+            this.value();
+        }
+        this.p++;
+    }
+    directives() {
+        while (this.isPunct('@')) {
+            this.p++;
+            this.name();
+            if (this.isPunct('('))
+                this.arguments();
+        }
+    }
+    value() {
+        const t = this.t[this.p];
+        if (t === undefined)
+            throw ERR;
+        if (t.k === 'punct') {
+            if (t.s === '$') {
+                this.p++;
+                this.name();
+                return;
+            }
+            if (t.s === '[') {
+                this.p++;
+                while (!this.isPunct(']'))
+                    this.value();
+                this.p++;
+                return;
+            }
+            if (t.s === '{') {
+                this.p++;
+                while (!this.isPunct('}')) {
+                    this.name();
+                    this.expect(':');
+                    this.value();
+                }
+                this.p++;
+                return;
+            }
+            throw ERR;
+        }
+        if (t.k === 'name')
+            t.value = true;
+        this.p++;
+    }
+}
+/** The key rule of 9.3 on a GraphQL name (5.7.1). */
+function gqlNameSafe(name) {
+    const n = name.length;
+    if (n === 0 || n > exports.GQL_MAX_NAME_BYTES || !isNameStart(name.charCodeAt(0)))
+        return false;
+    let allHex = n >= 16;
+    let run = 0;
+    for (let i = 0; i < n; i++) {
+        const c = name.charCodeAt(i);
+        if (!isNameCont(c))
+            return false;
+        if (!isHex(c))
+            allHex = false;
+        if (isDigit(c)) {
+            if (++run >= 6)
+                return false;
+        }
+        else {
+            run = 0;
+        }
+    }
+    return !allHex;
+}
+/** True if s is a GraphQL name (any length). */
+function gqlIsName(s) {
+    if (s.length === 0 || !isNameStart(s.charCodeAt(0)))
+        return false;
+    for (let i = 1; i < s.length; i++)
+        if (!isNameCont(s.charCodeAt(i)))
+            return false;
+    return true;
+}
+function isWord(c) {
+    return isNameCont(c) || c === 0x3f || c === 0x2a; // ? *
+}
+/**
+ * Shape of an executable document (5.7.1), or null when `src` is not an executable
+ * document within the limits (the caller then emits the drop form of the string).
+ */
+function gqlShape(src) {
+    let toks;
+    let p;
+    try {
+        toks = lex(src);
+        p = new Parser(toks);
+        p.document();
+    }
+    catch (e) {
+        if (e instanceof GqlError)
+            return null;
+        throw e;
+    }
+    let out = '';
+    let prevWord = false;
+    for (const t of toks) {
+        let s;
+        switch (t.k) {
+            case 'punct':
+                s = t.s;
+                break;
+            case 'name':
+                if (t.value)
+                    s = t.s === 'true' || t.s === 'false' ? '?b' : t.s === 'null' ? '?n' : '?e';
+                else
+                    s = gqlNameSafe(t.s) ? t.s : '*';
+                break;
+            case 'int':
+                s = '?i';
+                break;
+            case 'float':
+                s = '?f';
+                break;
+            default:
+                s = '?s';
+        }
+        if (prevWord && isWord(s.charCodeAt(0)))
+            out += ' ';
+        out += s;
+        prevWord = isWord(s.charCodeAt(s.length - 1));
+        if (out.length > exports.GQL_MAX_SHAPE_BYTES)
+            return null;
+    }
+    const introspection = p.ops.length > 0 && p.ops.every((sel) => sel.every((r) => r.field && !r.alias && (r.name === '__schema' || r.name === '__type' || r.name === '__typename')));
+    return { shape: out, introspection };
+}

package/dist/cjs/sanitizer/hostpat.d.ts

@@ -0,0 +1,15 @@
+/** 3.5: a host label stays literal only if every rule holds. */
+export declare function hostLabelSafe(label: string): boolean;
+/**
+ * 3.1 point 5: RFC 4291 2.2 text form of an already lowercased string. 1-4 hex digits per
+ * group, at most one `::` standing for at least one group, an optional dotted IPv4 (6.3
+ * `ipv4`) as the last 32 bits, no zone. Returns the 16 address bytes or null.
+ */
+export declare function parseIpv6(s: string): Uint8Array | null;
+export declare function ipv4Private(a: ArrayLike<number>): boolean;
+export declare function ipv6Private(a: Uint8Array): boolean;
+/**
+ * 3.5: pattern of a valid host (3.1), without the `host:` prefix, or null when a label is
+ * empty (`host:invalid`). `port` is the normalized port (null when absent or default).
+ */
+export declare function hostPattern(host: string, port: string | null, ip6: Uint8Array | null): string | null;