@wenathlan/argan 2.0.174 → 2.0.176

package/dns.ts

@@ -420,12 +420,35 @@ const NAMEFIELDS: Record<string, readonly number[]> = {
 /** TTL unit multipliers for the RFC 2308 spellings ("1h30m"). */
 const TTLUNITS: Record<string, number> = { s: 1, m: 60, h: 3600, d: 86400, w: 604800 };
 
+/** The bounded seat of the ttl grammar: the longest ttl spelling any zone file and any registrar answer carries sits far below this ceiling, so a hostile unbounded digit run (the polynomial-redos wall the code scanning gate flagged — the match over `\d+[smhdw]` walked cubic backtracking on a run of zeros the unit never ends) never reaches the engine. */
+const TTLTOKENLIMIT = 32;
+
 /** Parses a TTL token: plain seconds ("300") or unit spellings ("1h30m"). */
 function parseTtl(token: string): number {
+  /* the bounded seat guards both regex paths at once — the plain-seconds
+   * test and the unit scan — before any pattern touches the input. */
+  if (token.length > TTLTOKENLIMIT) return Number.NaN;
   if (/^\d+$/.test(token)) return Number.parseInt(token, 10);
   const lower = token.toLowerCase();
-  const units = lower.match(/\d+[smhdw]/g);
-  if (!units || units.join("") !== lower) return Number.NaN;
+  // the linear unit scan (the redos heal): the old global regex walked
+  // back over every digit of a unit-less token before advancing, a
+  // polynomial cost on crafted inputs - the manual walk visits each
+  // character exactly once and answers the same units list.
+  const units: string[] = [];
+  let index = 0;
+  while (index < lower.length) {
+    const start = index;
+    while (index < lower.length && lower.charCodeAt(index) >= 48 && lower.charCodeAt(index) <= 57) index += 1;
+    if (index === start) {
+      index += 1;
+      continue;
+    }
+    if (index < lower.length && TTLUNITS[lower[index]] !== undefined) {
+      units.push(lower.slice(start, index + 1));
+    }
+    index += 1;
+  }
+  if (units.length === 0 || units.join("") !== lower) return Number.NaN;
   return units.reduce((total, part) => total + Number.parseInt(part, 10) * TTLUNITS[part.slice(-1)], 0);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wenathlan/argan",
-  "version": "2.0.174",
+  "version": "2.0.176",
   "private": false,
   "description": "argan is the DNS and gateway library of the wenathlan family: zones, records, dnssec and handshake — the system network library whose site shares the unified database. The envelope distributes the documentation set, the zero-build site and the tests directory as one package.",
   "license": "GPL-3.0-only",
@@ -15,10 +15,10 @@
     "restore:entry": "node -e \"const{readFileSync}=require('node:fs');const{execSync}=require('node:child_process');const script=/script[^>]*App\\.tsx/;const triad=/family=Inter[\\s\\S]*Geist\\+Mono/;const face=(h)=>script.test(h)&&triad.test(h);if(face(readFileSync('index.html','utf8'))){console.log('index.html already rides the source face');process.exit(0)}if(!face(execSync('git show HEAD:./index.html',{encoding:'utf8'}))){console.error('refusing: HEAD index.html is not the canonical source face yet (script App.tsx + the font triad) - land the source-face fix first; nothing was touched');process.exit(1)}execSync('git checkout -- index.html',{stdio:'inherit'});console.log('index.html restored from HEAD (the source face)')\""
   },
   "dependencies": {
-    "@ai-sdk/openai": "^4.0.111",
-    "@ai-sdk/openai-compatible": "^3.0.87",
-    "@ai-sdk/provider-utils": "^5.0.76",
-    "@anthropic-ai/sdk": "^1.7.0",
+    "@ai-sdk/openai": "^4.0.114",
+    "@ai-sdk/openai-compatible": "^3.0.90",
+    "@ai-sdk/provider-utils": "^5.0.79",
+    "@anthropic-ai/sdk": "^1.8.0",
     "@biomejs/biome": "^2.6.6",
     "@capacitor/android": "^8.6.0",
     "@capacitor/cli": "^8.6.0",
@@ -95,7 +95,7 @@
     "@wenathlan/saddle": "~2.0.173",
     "@wenathlan/vault": "~2.0.173",
     "add": "^2.0.9",
-    "ai": "^7.0.166",
+    "ai": "^7.0.169",
     "autoprefixer": "^10.6.2",
     "axios": "^1.21.1",
     "baseline-browser-mapping": "^2.11.35",
@@ -121,7 +121,7 @@
     "fast-check": "^4.10.2",
     "fast-uri": "^4.2.3",
     "follow-redirects": "^1.16.3",
-    "framer-motion": "^14.11.1",
+    "framer-motion": "^14.12.0",
     "glob": "^14.0.4",
     "gsap": "^3.15.1",
     "hono": "^4.13.17",
@@ -130,15 +130,15 @@
     "js-yaml": "^5.5.0",
     "jsdom": "^31.0.0",
     "katex": "^0.19.1",
-    "minimatch": "^11.0.5",
-    "motion": "^14.11.1",
+    "minimatch": "^11.0.6",
+    "motion": "^14.12.0",
     "mysql2": "^3.24.6",
     "nanoid": "^6.0.2",
     "next": "^16.4.6",
     "next-auth": "^4.24.15",
-    "next-intl": "^4.14.9",
+    "next-intl": "^4.14.10",
     "next-themes": "^0.4.6",
-    "openai": "^7.54.0",
+    "openai": "^7.55.0",
     "p-limit": "^7.3.3",
     "p-retry": "^9.0.0",
     "playwright": "^1.65.0",
@@ -188,10 +188,10 @@
     "zustand": "^5.1.0"
   },
   "devDependencies": {
-    "@ai-sdk/openai": "^4.0.111",
-    "@ai-sdk/openai-compatible": "^3.0.87",
-    "@ai-sdk/provider-utils": "^5.0.76",
-    "@anthropic-ai/sdk": "^1.7.0",
+    "@ai-sdk/openai": "^4.0.114",
+    "@ai-sdk/openai-compatible": "^3.0.90",
+    "@ai-sdk/provider-utils": "^5.0.79",
+    "@anthropic-ai/sdk": "^1.8.0",
     "@biomejs/biome": "^2.6.6",
     "@capacitor/android": "^8.6.0",
     "@capacitor/cli": "^8.6.0",
@@ -272,7 +272,7 @@
     "@wenathlan/stealthhead": "~2.0.173",
     "@wenathlan/vault": "~2.0.173",
     "add": "^2.0.9",
-    "ai": "^7.0.166",
+    "ai": "^7.0.169",
     "autoprefixer": "^10.6.2",
     "axios": "^1.21.1",
     "baseline-browser-mapping": "^2.11.35",
@@ -298,7 +298,7 @@
     "fast-check": "^4.10.2",
     "fast-uri": "^4.2.3",
     "follow-redirects": "^1.16.3",
-    "framer-motion": "^14.11.1",
+    "framer-motion": "^14.12.0",
     "glob": "^14.0.4",
     "gsap": "^3.15.1",
     "hono": "^4.13.17",
@@ -307,15 +307,15 @@
     "js-yaml": "^5.5.0",
     "jsdom": "^31.0.0",
     "katex": "^0.19.1",
-    "minimatch": "^11.0.5",
-    "motion": "^14.11.1",
+    "minimatch": "^11.0.6",
+    "motion": "^14.12.0",
     "mysql2": "^3.24.6",
     "nanoid": "^6.0.2",
     "next": "^16.4.6",
     "next-auth": "^4.24.15",
-    "next-intl": "^4.14.9",
+    "next-intl": "^4.14.10",
     "next-themes": "^0.4.6",
-    "openai": "^7.54.0",
+    "openai": "^7.55.0",
     "p-limit": "^7.3.3",
     "p-retry": "^9.0.0",
     "playwright": "^1.65.0",
@@ -365,10 +365,10 @@
     "zustand": "^5.1.0"
   },
   "overrides": {
-    "@ai-sdk/openai": "^4.0.111",
-    "@ai-sdk/openai-compatible": "^3.0.87",
-    "@ai-sdk/provider-utils": "^5.0.76",
-    "@anthropic-ai/sdk": "^1.7.0",
+    "@ai-sdk/openai": "^4.0.114",
+    "@ai-sdk/openai-compatible": "^3.0.90",
+    "@ai-sdk/provider-utils": "^5.0.79",
+    "@anthropic-ai/sdk": "^1.8.0",
     "@biomejs/biome": "^2.6.6",
     "@capacitor/android": "^8.6.0",
     "@capacitor/cli": "^8.6.0",
@@ -445,7 +445,7 @@
     "@wenathlan/saddle": "~2.0.173",
     "@wenathlan/vault": "~2.0.173",
     "add": "^2.0.9",
-    "ai": "^7.0.166",
+    "ai": "^7.0.169",
     "autoprefixer": "^10.6.2",
     "axios": "^1.21.1",
     "baseline-browser-mapping": "^2.11.35",
@@ -471,7 +471,7 @@
     "fast-check": "^4.10.2",
     "fast-uri": "^4.2.3",
     "follow-redirects": "^1.16.3",
-    "framer-motion": "^14.11.1",
+    "framer-motion": "^14.12.0",
     "glob": "^14.0.4",
     "gsap": "^3.15.1",
     "hono": "^4.13.17",
@@ -480,16 +480,16 @@
     "js-yaml": "^5.5.0",
     "jsdom": "^31.0.0",
     "katex": "^0.19.1",
-    "lucide-react": "^1.70.0",
-    "minimatch": "^11.0.5",
-    "motion": "^14.11.1",
+    "lucide-react": "^1.71.0",
+    "minimatch": "^11.0.6",
+    "motion": "^14.12.0",
     "mysql2": "^3.24.6",
     "nanoid": "^6.0.2",
     "next": "^16.4.6",
     "next-auth": "^4.24.15",
-    "next-intl": "^4.14.9",
+    "next-intl": "^4.14.10",
     "next-themes": "^0.4.6",
-    "openai": "^7.54.0",
+    "openai": "^7.55.0",
     "p-limit": "^7.3.3",
     "p-retry": "^9.0.0",
     "playwright": "^1.65.0",