@traffic-twin/sdk 0.0.0-stage → 0.1.0

package/dist/cjs/sanitizer/hostpat.js

@@ -0,0 +1,129 @@
+"use strict";
+// Host patterns and IP classes, docs/spec/sanitizer.md 3.1 (IPv6 literals), 3.5 and 3.6 (spec v1.5).
+//
+// Everything here is written from the spec: the IPv6 parser is our own (no node:net helpers,
+// whose accepted forms differ between versions) and the private ranges are the closed table
+// of 3.6 (no "is private" library function).
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hostLabelSafe = hostLabelSafe;
+exports.parseIpv6 = parseIpv6;
+exports.ipv4Private = ipv4Private;
+exports.ipv6Private = ipv6Private;
+exports.hostPattern = hostPattern;
+const formats_js_1 = require("./formats.js");
+const SAFE_LABEL = /^[a-z][a-z0-9-]{0,62}$/; // 3.5 rule a
+const SIX_DIGITS = /[0-9]{6}/; // rule b
+const HEX12 = /[0-9a-f]{12}/; // rule c
+const HEX_GROUP = /^[0-9a-f]{1,4}$/;
+/** 3.5: a host label stays literal only if every rule holds. */
+function hostLabelSafe(label) {
+    return (SAFE_LABEL.test(label) &&
+        !SIX_DIGITS.test(label) &&
+        !HEX12.test(label) &&
+        (0, formats_js_1.detectFormat)(label) === null // rule d (implied by c, kept for fidelity)
+    );
+}
+function groups(parts, tailOk) {
+    const out = [];
+    for (let k = 0; k < parts.length; k++) {
+        const g = parts[k];
+        if (tailOk && k === parts.length - 1 && g.includes('.')) {
+            if (!formats_js_1.RE_IPV4.test(g))
+                return null;
+            const o = g.split('.').map((x) => Number(x));
+            out.push((o[0] << 8) | o[1], (o[2] << 8) | o[3]);
+        }
+        else if (HEX_GROUP.test(g)) {
+            out.push(parseInt(g, 16));
+        }
+        else {
+            return null;
+        }
+    }
+    return out;
+}
+/**
+ * 3.1 point 5: RFC 4291 2.2 text form of an already lowercased string. 1-4 hex digits per
+ * group, at most one `::` standing for at least one group, an optional dotted IPv4 (6.3
+ * `ipv4`) as the last 32 bits, no zone. Returns the 16 address bytes or null.
+ */
+function parseIpv6(s) {
+    let g;
+    const first = s.indexOf('::');
+    if (first >= 0) {
+        if (s.indexOf('::', first + 1) >= 0)
+            return null;
+        const left = s.slice(0, first);
+        const right = s.slice(first + 2);
+        const a = groups(left === '' ? [] : left.split(':'), false);
+        const b = groups(right === '' ? [] : right.split(':'), true);
+        if (!a || !b || a.length + b.length > 7)
+            return null;
+        g = [...a, ...new Array(8 - a.length - b.length).fill(0), ...b];
+    }
+    else {
+        const r = groups(s.split(':'), true);
+        if (!r || r.length !== 8)
+            return null;
+        g = r;
+    }
+    const out = new Uint8Array(16);
+    g.forEach((x, i) => {
+        out[2 * i] = x >> 8;
+        out[2 * i + 1] = x & 0xff;
+    });
+    return out;
+}
+/** True if the first `bits` bits of `addr` equal those of `prefix` (same length arrays). */
+function inPrefix(addr, prefix, bits) {
+    let i = 0;
+    for (; bits >= 8; bits -= 8, i++)
+        if (addr[i] !== prefix[i])
+            return false;
+    if (bits > 0) {
+        const mask = (0xff << (8 - bits)) & 0xff;
+        if ((addr[i] & mask) !== (prefix[i] & mask))
+            return false;
+    }
+    return true;
+}
+// 3.6: every address outside these ranges is public.
+const IPV4_PRIVATE = [
+    [[0, 0, 0, 0], 8], [[10, 0, 0, 0], 8], [[100, 64, 0, 0], 10], [[127, 0, 0, 0], 8],
+    [[169, 254, 0, 0], 16], [[172, 16, 0, 0], 12], [[192, 0, 0, 0], 24], [[192, 0, 2, 0], 24],
+    [[192, 168, 0, 0], 16], [[198, 18, 0, 0], 15], [[198, 51, 100, 0], 24], [[203, 0, 113, 0], 24],
+    [[224, 0, 0, 0], 4], [[240, 0, 0, 0], 4],
+];
+const v6 = (s) => parseIpv6(s);
+const IPV6_EMBEDDED_V4 = [[v6('::ffff:0:0'), 96], [v6('64:ff9b::'), 96]];
+const IPV6_PRIVATE = [
+    [v6('::'), 96], [v6('64:ff9b:1::'), 48], [v6('100::'), 64], [v6('2001::'), 23], [v6('2001:db8::'), 32],
+    [v6('fc00::'), 7], [v6('fe80::'), 10], [v6('fec0::'), 10], [v6('ff00::'), 8],
+];
+function ipv4Private(a) {
+    return IPV4_PRIVATE.some(([p, n]) => inPrefix(a, p, n));
+}
+function ipv6Private(a) {
+    // The two ranges with an embedded IPv4 come first (3.6).
+    for (const [p, n] of IPV6_EMBEDDED_V4)
+        if (inPrefix(a, p, n))
+            return ipv4Private(a.subarray(12));
+    return IPV6_PRIVATE.some(([p, n]) => inPrefix(a, p, n));
+}
+/**
+ * 3.5: pattern of a valid host (3.1), without the `host:` prefix, or null when a label is
+ * empty (`host:invalid`). `port` is the normalized port (null when absent or default).
+ */
+function hostPattern(host, port, ip6) {
+    const suffix = port ? ':' + port : '';
+    if (ip6)
+        return 'ip:' + (ipv6Private(ip6) ? 'private' : 'public') + suffix;
+    const h = host.endsWith('.') ? host.slice(0, -1) : host;
+    const labels = h.split('.');
+    if (labels.some((l) => l === ''))
+        return null;
+    if (formats_js_1.RE_IPV4.test(h)) {
+        return 'ip:' + (ipv4Private(labels.map((x) => Number(x))) ? 'private' : 'public') + suffix;
+    }
+    return labels.map((l) => (hostLabelSafe(l) ? l : '{*}')).join('.') + suffix;
+}

package/dist/cjs/sanitizer/json.d.ts

@@ -0,0 +1,60 @@
+export type JNode = JObj | JArr | JStr | JNum | JBool | JNull;
+export interface JObj {
+    k: 'o';
+    m: Array<[JStr, JNode]>;
+}
+export interface JArr {
+    k: 'a';
+    a: JNode[];
+}
+export interface JStr {
+    k: 's';
+    s: string;
+    bad: boolean;
+}
+export interface JNum {
+    k: 'n';
+    lex: string;
+}
+export interface JBool {
+    k: 'b';
+    v: boolean;
+}
+export interface JNull {
+    k: 'z';
+}
+export declare class JsonError extends Error {
+    constructor(msg: string);
+}
+/** Parses a complete JSON document. Throws JsonError on any deviation from RFC 8259. */
+export declare function parseJson(input: Uint8Array): JNode;
+export declare const INT_LEXEME: RegExp;
+/** 5.3: lexeme of at most 64 bytes and |written exponent| <= 9999. */
+export declare function lexemeWithinLimits(lex: string): boolean;
+/** Canonical form of a valid JSON number lexeme, computed in exact decimal arithmetic. */
+export declare function canonicalNumber(lex: string): string;
+/** A number already in canonical form. */
+export declare class CNum {
+    readonly canon: string;
+    constructor(canon: string);
+}
+export type Out = string | boolean | null | CNum | Out[] | OMap;
+export type OMap = Map<string, Out>;
+export declare function writeString(s: string): string;
+export declare function writeCanonical(v: Out): string;
+/** Converts a parsed JSON document to an Out tree (numbers canonicalized). Used for policy and event documents. */
+export declare function nodeToOut(node: JNode): Out;
+/** Plain JS value with numbers kept as lexeme wrappers. */
+export declare class Lex {
+    readonly lex: string;
+    constructor(lex: string);
+    toNumber(): number;
+}
+export type Plain = string | boolean | null | Lex | Plain[] | {
+    [k: string]: Plain;
+};
+/**
+ * Converts a parsed document to plain objects (null-prototype), rejecting duplicate keys
+ * and lone surrogates (used for policy bodies and envelopes: fail closed).
+ */
+export declare function nodeToPlain(node: JNode, strict: boolean): Plain;

package/dist/cjs/sanitizer/json.js

@@ -0,0 +1,460 @@
+"use strict";
+// Strict RFC 8259 JSON parser that keeps number lexemes (sanitizer.md 9.2), the tt-cjson
+// canonical writer (10.1) and the canonical number form (10.2).
+//
+// The parser is iterative (no recursion), validates the whole input, rejects a leading
+// BOM, invalid UTF-8, control characters in strings, and anything outside RFC 8259.
+// Lone surrogates produced by \u escapes are allowed syntactically and flagged on the
+// string node (`bad`), as 9.2 requires.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Lex = exports.CNum = exports.INT_LEXEME = exports.JsonError = void 0;
+exports.parseJson = parseJson;
+exports.lexemeWithinLimits = lexemeWithinLimits;
+exports.canonicalNumber = canonicalNumber;
+exports.writeString = writeString;
+exports.writeCanonical = writeCanonical;
+exports.nodeToOut = nodeToOut;
+exports.nodeToPlain = nodeToPlain;
+const utf8_js_1 = require("./utf8.js");
+class JsonError extends Error {
+    constructor(msg) {
+        super(msg);
+        this.name = 'JsonError';
+    }
+}
+exports.JsonError = JsonError;
+const strictDecoder = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
+const NULL_NODE = { k: 'z' };
+const TRUE_NODE = { k: 'b', v: true };
+const FALSE_NODE = { k: 'b', v: false };
+function isWs(c) {
+    return c === 0x20 || c === 0x09 || c === 0x0a || c === 0x0d;
+}
+function hex4(buf, i) {
+    let v = 0;
+    for (let j = 0; j < 4; j++) {
+        const c = buf[i + j];
+        let d;
+        if (c === undefined)
+            throw new JsonError('eof in escape');
+        if (c >= 0x30 && c <= 0x39)
+            d = c - 0x30;
+        else if (c >= 0x41 && c <= 0x46)
+            d = c - 0x37;
+        else if (c >= 0x61 && c <= 0x66)
+            d = c - 0x57;
+        else
+            throw new JsonError('bad hex escape');
+        v = v * 16 + d;
+    }
+    return v;
+}
+/** Parses a complete JSON document. Throws JsonError on any deviation from RFC 8259. */
+function parseJson(input) {
+    const buf = input;
+    const n = buf.length;
+    let i = 0;
+    if (n >= 3 && buf[0] === 0xef && buf[1] === 0xbb && buf[2] === 0xbf)
+        throw new JsonError('bom');
+    const ws = () => {
+        while (i < n && isWs(buf[i]))
+            i++;
+    };
+    const readString = () => {
+        // buf[i] === '"'
+        i++;
+        let out = '';
+        let start = i;
+        let nonAscii = false;
+        const flush = (end) => {
+            if (end > start) {
+                if (nonAscii) {
+                    try {
+                        out += strictDecoder.decode(buf.subarray(start, end));
+                    }
+                    catch {
+                        throw new JsonError('invalid utf-8');
+                    }
+                }
+                else {
+                    out += Buffer.from(buf.buffer, buf.byteOffset + start, end - start).toString('latin1');
+                }
+            }
+            nonAscii = false;
+        };
+        for (;;) {
+            if (i >= n)
+                throw new JsonError('unterminated string');
+            const c = buf[i];
+            if (c === 0x22) {
+                flush(i);
+                i++;
+                break;
+            }
+            if (c === 0x5c) {
+                flush(i);
+                const e = buf[i + 1];
+                switch (e) {
+                    case 0x22:
+                        out += '"';
+                        i += 2;
+                        break;
+                    case 0x5c:
+                        out += '\\';
+                        i += 2;
+                        break;
+                    case 0x2f:
+                        out += '/';
+                        i += 2;
+                        break;
+                    case 0x62:
+                        out += '\b';
+                        i += 2;
+                        break;
+                    case 0x66:
+                        out += '\f';
+                        i += 2;
+                        break;
+                    case 0x6e:
+                        out += '\n';
+                        i += 2;
+                        break;
+                    case 0x72:
+                        out += '\r';
+                        i += 2;
+                        break;
+                    case 0x74:
+                        out += '\t';
+                        i += 2;
+                        break;
+                    case 0x75:
+                        out += String.fromCharCode(hex4(buf, i + 2));
+                        i += 6;
+                        break;
+                    default: throw new JsonError('bad escape');
+                }
+                start = i;
+                continue;
+            }
+            if (c < 0x20)
+                throw new JsonError('control character in string');
+            if (c >= 0x80)
+                nonAscii = true;
+            i++;
+        }
+        return { k: 's', s: out, bad: !(0, utf8_js_1.isWellFormed)(out) };
+    };
+    const readNumber = () => {
+        const s = i;
+        if (buf[i] === 0x2d)
+            i++;
+        if (buf[i] === 0x30) {
+            i++;
+        }
+        else if (buf[i] !== undefined && buf[i] >= 0x31 && buf[i] <= 0x39) {
+            while (i < n && buf[i] >= 0x30 && buf[i] <= 0x39)
+                i++;
+        }
+        else {
+            throw new JsonError('bad number');
+        }
+        if (buf[i] === 0x2e) {
+            i++;
+            const f = i;
+            while (i < n && buf[i] >= 0x30 && buf[i] <= 0x39)
+                i++;
+            if (i === f)
+                throw new JsonError('bad fraction');
+        }
+        if (buf[i] === 0x65 || buf[i] === 0x45) {
+            i++;
+            if (buf[i] === 0x2b || buf[i] === 0x2d)
+                i++;
+            const f = i;
+            while (i < n && buf[i] >= 0x30 && buf[i] <= 0x39)
+                i++;
+            if (i === f)
+                throw new JsonError('bad exponent');
+        }
+        return { k: 'n', lex: Buffer.from(buf.buffer, buf.byteOffset + s, i - s).toString('latin1') };
+    };
+    const literal = (word, node) => {
+        for (let j = 0; j < word.length; j++) {
+            if (buf[i + j] !== word.charCodeAt(j))
+                throw new JsonError('bad literal');
+        }
+        i += word.length;
+        return node;
+    };
+    const readKey = () => {
+        if (buf[i] !== 0x22)
+            throw new JsonError('expected key');
+        const k = readString();
+        ws();
+        if (buf[i] !== 0x3a)
+            throw new JsonError('expected colon');
+        i++;
+        ws();
+        return k;
+    };
+    const stack = [];
+    ws();
+    for (;;) {
+        let v;
+        const c = buf[i];
+        if (c === 0x7b) {
+            i++;
+            ws();
+            const o = { k: 'o', m: [] };
+            if (buf[i] === 0x7d) {
+                i++;
+                v = o;
+            }
+            else {
+                stack.push({ node: o, key: readKey() });
+                continue;
+            }
+        }
+        else if (c === 0x5b) {
+            i++;
+            ws();
+            const a = { k: 'a', a: [] };
+            if (buf[i] === 0x5d) {
+                i++;
+                v = a;
+            }
+            else {
+                stack.push({ node: a, key: null });
+                continue;
+            }
+        }
+        else if (c === 0x22) {
+            v = readString();
+        }
+        else if (c === 0x2d || (c !== undefined && c >= 0x30 && c <= 0x39)) {
+            v = readNumber();
+        }
+        else if (c === 0x74) {
+            v = literal('true', TRUE_NODE);
+        }
+        else if (c === 0x66) {
+            v = literal('false', FALSE_NODE);
+        }
+        else if (c === 0x6e) {
+            v = literal('null', NULL_NODE);
+        }
+        else {
+            throw new JsonError('unexpected character');
+        }
+        // Attach v to its parent, closing containers as needed.
+        for (;;) {
+            const f = stack[stack.length - 1];
+            if (f === undefined) {
+                ws();
+                if (i !== n)
+                    throw new JsonError('trailing data');
+                return v;
+            }
+            if (f.node.k === 'o')
+                f.node.m.push([f.key, v]);
+            else
+                f.node.a.push(v);
+            ws();
+            const d = buf[i];
+            if (d === 0x2c) {
+                i++;
+                ws();
+                if (f.node.k === 'o')
+                    f.key = readKey();
+                break;
+            }
+            if ((f.node.k === 'o' && d === 0x7d) || (f.node.k === 'a' && d === 0x5d)) {
+                i++;
+                stack.pop();
+                v = f.node;
+                continue;
+            }
+            throw new JsonError('expected separator');
+        }
+    }
+}
+// ---------------------------------------------------------------------------------
+// Canonical numbers (10.2)
+exports.INT_LEXEME = /^-?(0|[1-9][0-9]*)$/;
+/** 5.3: lexeme of at most 64 bytes and |written exponent| <= 9999. */
+function lexemeWithinLimits(lex) {
+    if (lex.length > 64)
+        return false;
+    let e = lex.indexOf('e');
+    if (e < 0)
+        e = lex.indexOf('E');
+    if (e < 0)
+        return true;
+    let d = lex.slice(e + 1);
+    if (d[0] === '+' || d[0] === '-')
+        d = d.slice(1);
+    d = d.replace(/^0+/, '');
+    return d.length <= 4;
+}
+/** Canonical form of a valid JSON number lexeme, computed in exact decimal arithmetic. */
+function canonicalNumber(lex) {
+    let i = 0;
+    let neg = false;
+    if (lex[0] === '-') {
+        neg = true;
+        i = 1;
+    }
+    let j = i;
+    while (j < lex.length && lex.charCodeAt(j) >= 0x30 && lex.charCodeAt(j) <= 0x39)
+        j++;
+    const intp = lex.slice(i, j);
+    let frac = '';
+    if (lex[j] === '.') {
+        let k = j + 1;
+        while (k < lex.length && lex.charCodeAt(k) >= 0x30 && lex.charCodeAt(k) <= 0x39)
+            k++;
+        frac = lex.slice(j + 1, k);
+        j = k;
+    }
+    let exp = 0;
+    if (lex[j] === 'e' || lex[j] === 'E')
+        exp = parseInt(lex.slice(j + 1), 10);
+    let digits = intp + frac;
+    exp -= frac.length;
+    let s = 0;
+    while (s < digits.length && digits[s] === '0')
+        s++;
+    digits = digits.slice(s);
+    let t = digits.length;
+    while (t > 0 && digits[t - 1] === '0')
+        t--;
+    exp += digits.length - t;
+    digits = digits.slice(0, t);
+    if (digits.length === 0)
+        return '0';
+    const nd = digits.length;
+    const e = exp + nd;
+    let out;
+    if (e > -6 && e <= 21) {
+        if (e <= 0)
+            out = '0.' + '0'.repeat(-e) + digits;
+        else if (e >= nd)
+            out = digits + '0'.repeat(e - nd);
+        else
+            out = digits.slice(0, e) + '.' + digits.slice(e);
+    }
+    else {
+        const k = e - 1;
+        out = digits[0] + (nd > 1 ? '.' + digits.slice(1) : '') + 'e' + (k >= 0 ? '+' : '-') + Math.abs(k);
+    }
+    return (neg ? '-' : '') + out;
+}
+// ---------------------------------------------------------------------------------
+// Output values and the tt-cjson writer (10.1)
+/** A number already in canonical form. */
+class CNum {
+    canon;
+    constructor(canon) {
+        this.canon = canon;
+    }
+}
+exports.CNum = CNum;
+const NEEDS_ESCAPE = /["\\\u0000-\u001f\u007f-￿]/;
+function writeString(s) {
+    if (!NEEDS_ESCAPE.test(s))
+        return '"' + s + '"';
+    let out = '"';
+    for (let i = 0; i < s.length; i++) {
+        const c = s.charCodeAt(i);
+        if (c === 0x22)
+            out += '\\"';
+        else if (c === 0x5c)
+            out += '\\\\';
+        else if (c < 0x20 || c >= 0x7f)
+            out += '\\u' + c.toString(16).padStart(4, '0');
+        else
+            out += s[i];
+    }
+    return out + '"';
+}
+function writeCanonical(v) {
+    if (typeof v === 'string')
+        return writeString(v);
+    if (v === null)
+        return 'null';
+    if (v === true)
+        return 'true';
+    if (v === false)
+        return 'false';
+    if (v instanceof CNum)
+        return v.canon;
+    if (Array.isArray(v)) {
+        let out = '[';
+        for (let i = 0; i < v.length; i++) {
+            if (i > 0)
+                out += ',';
+            out += writeCanonical(v[i]);
+        }
+        return out + ']';
+    }
+    const keys = [...v.keys()].sort(utf8_js_1.cmpUtf8);
+    let out = '{';
+    for (let i = 0; i < keys.length; i++) {
+        if (i > 0)
+            out += ',';
+        out += writeString(keys[i]) + ':' + writeCanonical(v.get(keys[i]));
+    }
+    return out + '}';
+}
+/** Converts a parsed JSON document to an Out tree (numbers canonicalized). Used for policy and event documents. */
+function nodeToOut(node) {
+    switch (node.k) {
+        case 'z': return null;
+        case 'b': return node.v;
+        case 'n': return new CNum(canonicalNumber(node.lex));
+        case 's': return node.s;
+        case 'a': return node.a.map(nodeToOut);
+        case 'o': {
+            const m = new Map();
+            for (const [k, v] of node.m)
+                m.set(k.s, nodeToOut(v));
+            return m;
+        }
+    }
+}
+/** Plain JS value with numbers kept as lexeme wrappers. */
+class Lex {
+    lex;
+    constructor(lex) {
+        this.lex = lex;
+    }
+    toNumber() {
+        return Number(this.lex);
+    }
+}
+exports.Lex = Lex;
+/**
+ * Converts a parsed document to plain objects (null-prototype), rejecting duplicate keys
+ * and lone surrogates (used for policy bodies and envelopes: fail closed).
+ */
+function nodeToPlain(node, strict) {
+    switch (node.k) {
+        case 'z': return null;
+        case 'b': return node.v;
+        case 'n': return new Lex(node.lex);
+        case 's':
+            if (strict && node.bad)
+                throw new JsonError('lone surrogate');
+            return node.s;
+        case 'a': return node.a.map((x) => nodeToPlain(x, strict));
+        case 'o': {
+            const o = Object.create(null);
+            for (const [k, v] of node.m) {
+                if (strict && (k.bad || Object.prototype.hasOwnProperty.call(o, k.s)))
+                    throw new JsonError('duplicate or invalid key');
+                o[k.s] = nodeToPlain(v, strict);
+            }
+            return o;
+        }
+    }
+}