@wrongstack/primitives 0.310.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ECOSTACK TECHNOLOGY OÜ
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * @wrongstack/primitives — dependency-leaf helpers shared by every tier of
+ * the workspace graph. This package must stay importable from the lowest
+ * packages (kanban, persistence) and therefore declares NO workspace
+ * dependencies. Anything that needs another @wrongstack/* package does not
+ * belong here.
+ */
+export { type CompileFail, type CompileResult, type CompileUserRegexResult, capSubject, compileUserRegex, MAX_SUBJECT_LEN, } from './regex-guard.js';
+export { nowIso } from './time.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -0,0 +1,137 @@
+// src/regex-guard.ts
+var MAX_PATTERN_LEN = 256;
+var DANGEROUS_PATTERNS = [
+  // (a+)+, (.*)+, etc — nested quantifier on a group with internal quantifier
+  /(\([^)]*[+*][^)]*\))[+*]/,
+  /(\(\?:[^)]*[+*][^)]*\))[+*]/,
+  // Adjacent quantifiers: a++ a*+
+  /[+*]{2,}/,
+  // Quantifier on alternation with length 2+
+  /\([^|)]+\|[^)]+\)[+*][+*]/,
+  // Greedy quantifier inside lookahead/lookbehind — (?!.*a+)
+  /\(\?<?[!=][^)]*[+*][^)]*\)/
+];
+function hasAmbiguousQuantifiedAlternation(pattern) {
+  for (let i = 0; i < pattern.length; i++) {
+    if (pattern[i] !== "(") continue;
+    if (i > 0 && pattern[i - 1] === "\\") continue;
+    let depth = 0;
+    let inClass = false;
+    let j = i;
+    for (; j < pattern.length; j++) {
+      const ch = pattern[j];
+      if (ch === "\\") {
+        j++;
+        continue;
+      }
+      if (inClass) {
+        if (ch === "]") inClass = false;
+        continue;
+      }
+      if (ch === "[") {
+        inClass = true;
+        continue;
+      }
+      if (ch === "(") depth++;
+      else if (ch === ")") {
+        depth--;
+        if (depth === 0) break;
+      }
+    }
+    if (j >= pattern.length) return false;
+    const next = pattern[j + 1];
+    if (next !== "+" && next !== "*" && next !== "{") continue;
+    let inner = pattern.slice(i + 1, j);
+    inner = inner.replace(/^\?(?::|<?[=!])/u, "");
+    const branches = [];
+    let current = "";
+    let d = 0;
+    let cls = false;
+    for (let k = 0; k < inner.length; k++) {
+      const ch = inner[k];
+      if (ch === "\\") {
+        current += ch + (inner[k + 1] ?? "");
+        k++;
+        continue;
+      }
+      if (cls) {
+        if (ch === "]") cls = false;
+        current += ch;
+        continue;
+      }
+      if (ch === "[") {
+        cls = true;
+        current += ch;
+        continue;
+      }
+      if (ch === "(") d++;
+      if (ch === ")") d--;
+      if (ch === "|" && d === 0) {
+        branches.push(current);
+        current = "";
+        continue;
+      }
+      current += ch;
+    }
+    branches.push(current);
+    if (branches.length < 2) continue;
+    for (let a = 0; a < branches.length; a++) {
+      for (let b = a + 1; b < branches.length; b++) {
+        const x = branches[a];
+        const y = branches[b];
+        if (x === "" || y === "") return true;
+        if (x === y || x.startsWith(y) || y.startsWith(x)) return true;
+      }
+    }
+  }
+  return false;
+}
+function compileUserRegex(pattern, flags) {
+  if (typeof pattern !== "string") {
+    return { ok: false, reason: "pattern must be a string" };
+  }
+  if (pattern.length === 0) {
+    return { ok: false, reason: "pattern is empty" };
+  }
+  if (pattern.length > MAX_PATTERN_LEN) {
+    return { ok: false, reason: `pattern exceeds ${MAX_PATTERN_LEN} characters` };
+  }
+  for (const rx of DANGEROUS_PATTERNS) {
+    if (rx.test(pattern)) {
+      return {
+        ok: false,
+        reason: "pattern looks vulnerable to catastrophic backtracking \u2014 rewrite without nested quantifiers"
+      };
+    }
+  }
+  if (hasAmbiguousQuantifiedAlternation(pattern)) {
+    return {
+      ok: false,
+      reason: "pattern quantifies an alternation with overlapping branches \u2014 rewrite so no two branches can match the same text"
+    };
+  }
+  try {
+    return { ok: true, regex: new RegExp(pattern, flags) };
+  } catch (err) {
+    return {
+      ok: false,
+      reason: err instanceof Error ? err.message : "invalid regex"
+    };
+  }
+}
+var MAX_SUBJECT_LEN = 64 * 1024;
+function capSubject(line) {
+  return line.length > MAX_SUBJECT_LEN ? line.slice(0, MAX_SUBJECT_LEN) : line;
+}
+
+// src/time.ts
+function nowIso() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+export {
+  MAX_SUBJECT_LEN,
+  capSubject,
+  compileUserRegex,
+  nowIso
+};
+//# sourceMappingURL=index.js.map

package/dist/regex-guard.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Compile a user-supplied regex with conservative bounds against ReDoS.
+ *
+ * Canonical home (card #5 first slice): previously three drifted copies —
+ * `core/src/utils/regex-guard.ts`, `tools/src/_regex.ts`, and
+ * `kanban/src/verification/safe-regex.ts` — held in sync only by
+ * `tools/tests/regex-guard-parity.test.ts` because kanban sits below both
+ * packages in the workspace DAG. This package is a dependency leaf (no
+ * workspace deps), so all three import tiers can share one implementation
+ * without inverting the layer graph.
+ *
+ * V8's regex engine is backtracking-based and cannot interrupt a
+ * synchronous match — a pattern like `(a+)+$` against a sufficiently
+ * long line will pin a worker for seconds. Two coarse bounds:
+ *
+ *  1. Cap pattern length — practically all legitimate user patterns are
+ *     under 256 characters.
+ *  2. Reject patterns containing the most obvious super-linear structures.
+ *     This is a coarse filter (false-positives are likely; we accept that
+ *     for hostile-input contexts).
+ *
+ * Callers should additionally bound the *subject* length via `capSubject`.
+ */
+export interface CompileResult {
+    ok: true;
+    regex: RegExp;
+}
+export interface CompileFail {
+    ok: false;
+    reason: string;
+}
+export type CompileUserRegexResult = CompileResult | CompileFail;
+export declare function compileUserRegex(pattern: string, flags: string): CompileResult | CompileFail;
+/**
+ * Maximum subject length handed to a user-supplied regex before matching.
+ * A linear-time pattern over a multi-megabyte line is still a stall; tools
+ * that need exact-line matching against very long lines should use ripgrep
+ * externally rather than the native walker.
+ */
+export declare const MAX_SUBJECT_LEN: number;
+/** Truncate a subject line to {@link MAX_SUBJECT_LEN} for synchronous regex eval. */
+export declare function capSubject(line: string): string;
+//# sourceMappingURL=regex-guard.d.ts.map

package/dist/time.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Wall-clock time helpers.
+ *
+ * `nowIso` existed as six byte-identical private/public copies across
+ * kanban, cli, sage, and plugins (card #5 slice 5e). It lives here as the
+ * canonical definition so every tier of the workspace graph — including
+ * packages that sit below core — can share one clock read.
+ */
+/** Current wall-clock time as an ISO-8601 UTC timestamp (`2026-08-22T14:50:00.000Z`). */
+export declare function nowIso(): string;
+//# sourceMappingURL=time.d.ts.map

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@wrongstack/primitives",
+  "version": "0.310.0",
+  "license": "MIT",
+  "description": "Dependency-leaf primitives shared across WrongStack packages (regex guard, slugs, timestamps).",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/WrongStack/WrongStack.git",
+    "directory": "packages/primitives"
+  },
+  "homepage": "https://github.com/WrongStack/WrongStack#readme",
+  "bugs": {
+    "url": "https://github.com/WrongStack/WrongStack/issues"
+  },
+  "author": "ECOSTACK TECHNOLOGY OÜ",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "!dist/**/*.map",
+    "README.md"
+  ],
+  "devDependencies": {
+    "@types/node": "^26.2.0",
+    "typescript": "^7.0.2"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "node ../../scripts/build-package.mjs",
+    "typecheck": "tsc --noEmit",
+    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\""
+  }
+}