canary-test-cli 6.8.1 → 7.0.0

package/dist/engine/guardian/diff-coverage/formats/cobertura.js

@@ -0,0 +1,130 @@
+/**
+ * Cobertura `coverage.xml` reader — a minimal, targeted scanner pinned to the
+ * canonical `<coverage>...<class filename="..."><line number hits/>` shape
+ * rather than a general XML parser (see `./xml.ts` for why).
+ */
+import { attrValue, isWellFormedXml } from './xml.js';
+import { pyInt, selfDescribing, } from '../types.js';
+// Coverage reports are semi-trusted CI artifacts, but canary distrusts input by
+// default: cap size so a pathological XML cannot exhaust memory during parse.
+// Exposed as a mutable object so tests can shrink the cap (the analog of the
+// Python test's `monkeypatch.setattr(cov, "_MAX_REPORT_BYTES", 32)`).
+export const coverageLimits = { maxReportBytes: 25 * 1024 * 1024 }; // 25 MiB
+/**
+ * Parse a Cobertura `coverage.xml` into `{path: {line: hits}}`.
+ *
+ * Line-level only — branch/`condition-coverage` data is intentionally dropped.
+ * Pins to the canonical Cobertura shape emitted by coverage.py, Istanbul,
+ * SimpleCov and Jacoco→Cobertura converters: a `<coverage>` root with
+ * `<class filename=...>` elements carrying nested `<line number= hits=>`.
+ * (Native Jacoco XML uses a `<report>` root and is *not* Cobertura — it
+ * correctly returns `null`.) Any other XML → `null` so the caller falls through
+ * to a lower fidelity tier (absence never blocks).
+ *
+ * Security: rejects oversize input and DOCTYPE entity definitions *before*
+ * parsing (guards against entity-expansion / "billion laughs"). This targeted
+ * scanner resolves no entities and reads no DTD, so XXE is not in scope.
+ * Malformed input never throws — it degrades to `null`.
+ */
+export function parseCobertura(text) {
+    const body = coberturaBody(text);
+    if (body === null)
+        return null;
+    // Built as raw hit maps; every `<line>` record is a line the instrumenter
+    // measured, so the recorded lines become the coverable set on the way out.
+    const index = {};
+    collectClasses(body, index);
+    return pruneEmptyClasses(index);
+}
+/**
+ * The comment-stripped document, or `null` if it is not a Cobertura report we
+ * are willing to read: oversize, entity-bearing, malformed, or a different
+ * format entirely.
+ */
+function coberturaBody(text) {
+    if (text.length > coverageLimits.maxReportBytes)
+        return null;
+    // Reject any internal-subset DOCTYPE that declares entities. Scan the FULL
+    // (already size-capped) text: a leading comment can push the DOCTYPE past
+    // any fixed window, so a windowed check is bypassable.
+    if (text.includes('<!DOCTYPE') && text.includes('<!ENTITY'))
+        return null;
+    // Reject malformed XML up front, matching Python's `ET.fromstring` raising
+    // `ParseError` → the caller falls through to a lower-fidelity tier. Without
+    // this, a lenient scanner would happily extract coverage from a broken
+    // document, flipping both the fidelity tier AND the covered/uncovered verdict
+    // relative to the oracle.
+    if (!isWellFormedXml(text))
+        return null;
+    // Pin to the canonical (namespace-free) Cobertura root; anything else is a
+    // different XML format and is rejected rather than guessed at. Strip comments
+    // first so a `<foo>` inside a comment can't masquerade as the root element.
+    const withoutComments = text.replace(/<!--[\s\S]*?-->/g, '');
+    const rootMatch = /<(?![?!])([A-Za-z_][\w.:-]*)/.exec(withoutComments);
+    if (rootMatch === null || rootMatch[1] !== 'coverage')
+        return null;
+    return withoutComments;
+}
+const CLOSE_CLASS = '</class>';
+/**
+ * Walk each `<class>` open tag, folding its lines into `index` by filename.
+ *
+ * A self-closing `<class .../>` is an empty class (its filename recorded, no
+ * lines) — critically, it must NOT be paired with the NEXT class's
+ * `</class>`, or that class's lines bind to the wrong file. Cobertura classes
+ * never nest, so for a real open tag the first following `</class>` is the
+ * correct close.
+ */
+function collectClasses(body, index) {
+    const classOpenRe = /<class\b([^>]*?)(\/?)>/g;
+    for (let cls = classOpenRe.exec(body); cls !== null; cls = classOpenRe.exec(body)) {
+        // Normalize Windows separators so .NET/coverlet reports resolve against
+        // POSIX-style diff paths (the path matcher only recognizes "/").
+        const raw = attrValue(cls[1], 'filename');
+        const filename = raw === null ? null : raw.replace(/\\/g, '/');
+        if (cls[2] === '/') {
+            // Record the filename (mirrors ET's `setdefault`), but consume no body so
+            // the next class keeps its own lines.
+            if (filename)
+                bucketFor(index, filename);
+            continue;
+        }
+        const openEnd = classOpenRe.lastIndex;
+        const closeIdx = body.indexOf(CLOSE_CLASS, openEnd);
+        if (closeIdx === -1)
+            return; // no close (well-formed XML guarantees one)
+        classOpenRe.lastIndex = closeIdx + CLOSE_CLASS.length;
+        if (!filename)
+            continue;
+        readClassLines(body.slice(openEnd, closeIdx), bucketFor(index, filename));
+    }
+}
+/** One filename's hit map, created on first mention (ET's `setdefault`). */
+function bucketFor(index, filename) {
+    return (index[filename] ??= {});
+}
+/** Fold every `<line number= hits=>` in one class body into `hitsByLine`. */
+function readClassLines(body, hitsByLine) {
+    const lineRe = /<line\b([^>]*)>/g;
+    for (let ln = lineRe.exec(body); ln !== null; ln = lineRe.exec(body)) {
+        const num = attrValue(ln[1], 'number');
+        if (num === null)
+            continue;
+        const lineno = pyInt(num);
+        const hits = pyInt(attrValue(ln[1], 'hits') ?? '0');
+        if (lineno === null || hits === null)
+            continue;
+        // A line can appear at both method and class scope; keep the max.
+        hitsByLine[lineno] = Math.max(hitsByLine[lineno] ?? 0, hits);
+    }
+}
+/** Drop classes that yielded no parseable lines; require at least one. */
+function pruneEmptyClasses(index) {
+    const pruned = {};
+    for (const [path, hits] of Object.entries(index)) {
+        if (Object.keys(hits).length > 0)
+            pruned[path] = selfDescribing(hits);
+    }
+    return Object.keys(pruned).length > 0 ? pruned : null;
+}
+//# sourceMappingURL=cobertura.js.map

package/dist/engine/guardian/diff-coverage/formats/coverage-json-lint.js

@@ -0,0 +1,197 @@
+/**
+ * The producer-facing lint for coverage-json: it reports, loudly, exactly what
+ * `./coverage-json.ts` would silently accept-and-drop. Split one validator per
+ * field so each stays readable and the parser it mirrors stays adjacent.
+ */
+import { COVERAGE_JSON_SCHEMA_VERSION, isSupportedSchemaVersion, } from './coverage-json.js';
+import { isInt, isRecord, pyInt } from '../types.js';
+/**
+ * Validate a coverage-json document against the v1 producer contract.
+ *
+ * Reports, loudly, exactly what `parseCoverageJson` would silently
+ * accept-and-drop, at two severities. Never raises and never mutates — it is a
+ * lint for producers, mirroring the parser it lives beside so the two cannot
+ * drift.
+ */
+export function validateCoverageJson(data) {
+    const problems = [];
+    const report = {
+        err: (location, message) => void problems.push({ severity: 'error', location, message }),
+        warn: (location, message) => void problems.push({ severity: 'warning', location, message }),
+    };
+    if (!isRecord(data)) {
+        report.err('(root)', 'top-level value must be a JSON object');
+        return problems;
+    }
+    const version = data['schema_version'];
+    if (!isSupportedSchemaVersion(version)) {
+        report.err('schema_version', `unsupported schema_version ${repr(version)}; this build understands ` +
+            `v${COVERAGE_JSON_SCHEMA_VERSION} (omit the field to default to it)`);
+    }
+    const files = data['files'];
+    if (files === undefined || files === null) {
+        report.err('files', "missing required 'files' object");
+        return problems;
+    }
+    if (!isRecord(files)) {
+        report.err('files', "'files' must be an object mapping path -> coverage");
+        return problems;
+    }
+    for (const [path, entry] of Object.entries(files)) {
+        validateFileEntry(`files['${path}']`, entry, report);
+    }
+    return problems;
+}
+/** Validate one `files[path]` entry, mirroring what the parser keeps. */
+function validateFileEntry(loc, entry, report) {
+    if (!isRecord(entry)) {
+        report.err(loc, "entry must be an object; this file's coverage is dropped");
+        return;
+    }
+    // Mirror the parser's surviving hit map so the verdict is bound to what
+    // the parser actually keeps.
+    const recorded = {};
+    validateLineHits(entry['line_hits'], recorded, loc, report.warn);
+    validateCoveredLines(entry['covered_lines'], recorded, loc, report.warn);
+    if (Object.keys(recorded).length === 0) {
+        report.warn(loc, 'no usable coverage lines; contributes nothing');
+    }
+    validateInstrumentedLines(entry, recorded, loc, report.warn);
+}
+/** Check `line_hits`, recording into `recorded` every entry the parser keeps. */
+function validateLineHits(lineHits, recorded, loc, warn) {
+    if (lineHits === undefined || lineHits === null)
+        return;
+    if (!isRecord(lineHits)) {
+        warn(`${loc}.line_hits`, 'must be an object mapping line -> hits; ignored');
+        return;
+    }
+    for (const [k, v] of Object.entries(lineHits)) {
+        const kloc = `${loc}.line_hits['${k}']`;
+        if (!isInt(v)) {
+            warn(kloc, `hits ${repr(v)} is not an integer; dropped`);
+            continue;
+        }
+        if (v < 0) {
+            warn(kloc, `hits ${v} is negative; dropped`);
+            continue;
+        }
+        const lineno = pyInt(k);
+        if (lineno === null) {
+            warn(kloc, 'line key is not an integer; dropped');
+            continue;
+        }
+        if (lineno < 1) {
+            warn(kloc, 'line number must be >= 1; dropped');
+            continue;
+        }
+        recorded[lineno] = v;
+    }
+}
+/** Check `covered_lines`, folding the survivors into `recorded` as the parser does. */
+function validateCoveredLines(covered, recorded, loc, warn) {
+    if (covered === undefined || covered === null)
+        return;
+    if (!Array.isArray(covered)) {
+        warn(`${loc}.covered_lines`, 'must be an array of line numbers; ignored');
+        return;
+    }
+    covered.forEach((lineno, i) => {
+        const cloc = `${loc}.covered_lines[${i}]`;
+        if (!isInt(lineno)) {
+            warn(cloc, `${repr(lineno)} is not an integer; dropped`);
+            return;
+        }
+        if (lineno < 1) {
+            warn(cloc, 'line number must be >= 1; dropped');
+            return;
+        }
+        if (!(lineno in recorded)) {
+            recorded[lineno] = 1;
+            return;
+        }
+        if (recorded[lineno] === 0) {
+            warn(cloc, `line ${lineno} is also in line_hits as unhit (0); ` +
+                'line_hits wins, so it stays uncovered');
+        }
+        // a positive line_hits count makes this entry redundant
+    });
+}
+/**
+ * Check a file entry's `instrumented_lines`, and nudge producers that need it.
+ *
+ * Two jobs. The shape checks mirror the parser, as everywhere else in this
+ * validator. The interesting one is the **ambiguity** warning: a document
+ * leaning on `covered_lines` cannot express an unhit line *or* a
+ * non-instrumented one, so every line it omits lands downstream as a coverage
+ * gap. That is exactly what transcoding lcov into this format produces, and it
+ * is the failure #657 exists to close — the producer sees success while the
+ * consumer invents findings. Silence there would be the same shape this repo
+ * keeps closing, so the validator says it out loud.
+ *
+ * It is deliberately scoped to `covered_lines`, the field that *structurally*
+ * cannot report a miss. A `line_hits` document with no zeros is not evidence of
+ * the same mistake: that producer can express an unhit line and simply had none
+ * to report, which is what a fully-covered file looks like. Warning there would
+ * fire on correct documents, and a warning that cries wolf is one producers
+ * learn to skip — the precision lesson from #553.
+ *
+ * The warning clears as soon as the document is unambiguous by either route: a
+ * declared `instrumented_lines`, or an explicit `0` in `line_hits`. A producer
+ * already doing the right thing must not be nagged toward a second mechanism.
+ */
+function validateInstrumentedLines(entry, recorded, loc, warn) {
+    const declaration = entry['instrumented_lines'];
+    const dloc = `${loc}.instrumented_lines`;
+    if (declaration === undefined || declaration === null) {
+        const usesShorthand = Array.isArray(entry['covered_lines']);
+        const declaresAMiss = Object.values(recorded).includes(0);
+        if (usesShorthand && !declaresAMiss) {
+            warn(loc, "reports coverage via 'covered_lines', which cannot express an unhit " +
+                'line, so a changed line this document omits is read as uncovered — ' +
+                'a line that was never instrumented (a comment, an import, a type ' +
+                "declaration) becomes a coverage gap. Declare 'instrumented_lines', " +
+                'or record unhit lines as line_hits 0');
+        }
+        return;
+    }
+    if (!Array.isArray(declaration)) {
+        warn(dloc, 'must be an array of line numbers; ignored');
+        return;
+    }
+    declaration.forEach((lineno, i) => {
+        if (!isInt(lineno)) {
+            warn(`${dloc}[${i}]`, `${repr(lineno)} is not an integer; dropped`);
+            return;
+        }
+        if (lineno < 1) {
+            warn(`${dloc}[${i}]`, 'line number must be >= 1; dropped');
+        }
+    });
+    // A recorded line the declaration omits is a producer contradicting itself.
+    // The parser keeps the measurement, so this costs no coverage — but a
+    // declaration that disagrees with the data is worth hearing about.
+    const declared = new Set(declaration.filter(isInt));
+    const undeclared = Object.keys(recorded)
+        .map(Number)
+        .filter((ln) => !declared.has(ln));
+    if (undeclared.length > 0) {
+        warn(dloc, `line(s) ${undeclared.join(', ')} have coverage data but are not ` +
+            'declared instrumented; the measurement wins and they stay coverable');
+    }
+}
+/** Rough analog of Python's `repr()` for scalar diagnostic values. */
+function repr(value) {
+    if (typeof value === 'string')
+        return `'${value}'`;
+    // Match Python's `{v!r}` spelling of the JSON scalars so warning messages
+    // read byte-for-byte like the oracle (true→True, false→False, null→None).
+    if (value === true)
+        return 'True';
+    if (value === false)
+        return 'False';
+    if (value === null)
+        return 'None';
+    return String(value);
+}
+//# sourceMappingURL=coverage-json-lint.js.map

package/dist/engine/guardian/diff-coverage/formats/coverage-json.js

@@ -0,0 +1,107 @@
+/**
+ * Reader for the canary coverage-json shape. The producer contract it enforces
+ * is linted, field for field, by `./coverage-json-lint.ts` — the two are
+ * deliberately kept side by side so they cannot drift.
+ */
+import { isInt, isRecord, pyInt, recordedLines, } from '../types.js';
+// The coverage-json contract version this build understands. Bumped only on a
+// breaking change; the shape evolves additively (see
+// docs/specs/coverage-json-contract.md).
+export const COVERAGE_JSON_SCHEMA_VERSION = 1;
+/** True when `schema_version` is absent or names a version this build reads. */
+export function isSupportedSchemaVersion(version) {
+    if (version === undefined || version === null)
+        return true;
+    return isInt(version) && version === COVERAGE_JSON_SCHEMA_VERSION;
+}
+/**
+ * Parse the canary coverage-json shape into `{path: {line: hits}}`.
+ *
+ * Supports `{"files": {"<path>": {"covered_lines": [...]}}}` and the same with
+ * an explicit `line_hits` mapping. Unrecognized structure, or a
+ * `schema_version` this build does not understand, → `null`. The v1 contract
+ * is enforced strictly (integers only, 1-based lines, non-negative hits) so
+ * this parser and `validateCoverageJson` stay in lockstep.
+ */
+export function parseCoverageJson(data) {
+    if (!isRecord(data))
+        return null;
+    // Refuse a version we don't understand rather than silently consuming its
+    // v1-compatible parts and mislabeling the result coverage-verified.
+    if (!isSupportedSchemaVersion(data['schema_version']))
+        return null;
+    const files = data['files'];
+    if (!isRecord(files))
+        return null;
+    const index = {};
+    for (const [path, entry] of Object.entries(files)) {
+        if (isRecord(entry))
+            index[String(path)] = parseFileEntry(entry);
+    }
+    return index;
+}
+/** Resolve one `files[path]` entry into its hit map and coverable set. */
+function parseFileEntry(entry) {
+    // line_hits is authoritative: covered_lines may add a line it didn't mention,
+    // but never overrides an explicit hit count (so a `{"14": 0}` unhit line
+    // stays uncovered).
+    const recorded = readLineHits(entry['line_hits']);
+    const hits = { ...recorded };
+    for (const lineno of coveredLineNumbers(entry['covered_lines'])) {
+        if (!(lineno in recorded))
+            hits[lineno] = 1;
+    }
+    return {
+        hits,
+        coverable: declaredCoverable(entry['instrumented_lines'], hits),
+    };
+}
+/** `line_hits` → hit map, dropping anything the v1 contract rejects. */
+function readLineHits(value) {
+    const hits = {};
+    if (!isRecord(value))
+        return hits;
+    for (const [key, count] of Object.entries(value)) {
+        // Integers only, 1-based line, non-negative hits (see docstring).
+        if (!(isInt(count) && count >= 0))
+            continue;
+        const lineno = pyInt(key);
+        if (lineno === null || lineno < 1)
+            continue;
+        hits[lineno] = count;
+    }
+    return hits;
+}
+/** `covered_lines` → the line numbers that survive the v1 contract. */
+function coveredLineNumbers(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.filter((n) => isInt(n) && n >= 1);
+}
+/**
+ * Resolve a file entry's `instrumented_lines` declaration (#657).
+ *
+ * Returns the set of lines the report can speak to, or `null` when the producer
+ * did not declare one — which is every v1 document written before this field
+ * existed, and is why adding it changes no existing behaviour.
+ *
+ * A malformed declaration degrades to `null` rather than dropping the entry,
+ * matching the parser's leniency everywhere else: one bad field costs that
+ * field, never the file's coverage. `validateCoverageJson` is what makes the
+ * degradation audible.
+ *
+ * Recorded lines are unioned in. A `line_hits` key outside the declared set is
+ * a producer contradicting itself, and real measurement outranks a declaration
+ * — dropping it would discard a hit count the producer actually took.
+ */
+function declaredCoverable(declaration, hits) {
+    if (!Array.isArray(declaration))
+        return null;
+    const coverable = recordedLines(hits);
+    for (const lineno of declaration) {
+        if (isInt(lineno) && lineno >= 1)
+            coverable.add(lineno);
+    }
+    return coverable;
+}
+//# sourceMappingURL=coverage-json.js.map

package/dist/engine/guardian/diff-coverage/formats/xml.js

@@ -0,0 +1,151 @@
+/**
+ * The XML primitives the Cobertura reader stands on: a non-throwing
+ * well-formedness check and an attribute extractor.
+ *
+ * Node has no built-in XML parser, and pulling one in would put a third-party
+ * parser inside the guardian's security boundary. Instead the check below is a
+ * hand-rolled scanner that resolves no entities and reads no DTD.
+ *
+ * Structured as one dispatch per construct rather than a single loop: each
+ * reader takes the current offset and returns the offset just past what it
+ * consumed, or `-1` for "not well formed". That keeps the branch count of every
+ * individual function low enough to reason about — the shape the 38-branch
+ * original could not offer (#668).
+ */
+const XML_WS = new Set([' ', '\t', '\n', '\r']);
+// Sticky (`y`) so each reader matches exactly at the offset it was handed, with
+// no substring allocation. Every use sets `lastIndex` immediately before `exec`.
+const NAME_RE = /[A-Za-z_][\w.:-]*/y;
+const END_TAG_RE = /([A-Za-z_][\w.:-]*)[ \t\n\r]*>/y;
+const ATTR_NAME_EQ_RE = /[A-Za-z_][\w.:-]*[ \t\n\r]*=[ \t\n\r]*/y;
+const ENTITY_RE = /(?:#[0-9]+|#x[0-9A-Fa-f]+|[A-Za-z_][\w.-]*);/y;
+/** "Not well formed" — the sentinel every reader below returns on failure. */
+const BAD = -1;
+/**
+ * Minimal, non-throwing XML well-formedness check — the analog of what
+ * `ET.fromstring` enforces before it will yield an element tree. Returns
+ * `false` (so the caller degrades to `null`) on: an unbalanced or mismatched
+ * tag, an unquoted attribute value, or a raw `&` that is not a valid entity
+ * reference. Skips comments, CDATA, processing instructions, and DOCTYPE
+ * declarations (entity-bearing DOCTYPEs are already rejected upstream). O(n)
+ * over the size-capped input, allocation-free via sticky regexes.
+ */
+export function isWellFormedXml(text) {
+    const stack = [];
+    let i = 0;
+    while (i < text.length) {
+        const ch = text[i];
+        let next;
+        if (ch === '<')
+            next = readMarkup(text, i, stack);
+        else if (ch === '&')
+            next = readEntity(text, i);
+        else
+            next = i + 1;
+        if (next === BAD)
+            return false;
+        i = next;
+    }
+    return stack.length === 0;
+}
+/** Dispatch on which `<`-introduced construct starts at `i`. */
+function readMarkup(text, i, stack) {
+    if (text.startsWith('<!--', i))
+        return skipPast(text, '-->', i + 4);
+    if (text.startsWith('<![CDATA[', i))
+        return skipPast(text, ']]>', i + 9);
+    if (text.startsWith('<?', i))
+        return skipPast(text, '?>', i + 2);
+    if (text.startsWith('<!', i))
+        return skipDeclaration(text, i);
+    if (text.startsWith('</', i))
+        return readEndTag(text, i, stack);
+    return readStartTag(text, i, stack);
+}
+/** Offset just past the next `marker` at or after `from`. */
+function skipPast(text, marker, from) {
+    const end = text.indexOf(marker, from);
+    return end === BAD ? BAD : end + marker.length;
+}
+/**
+ * Skip a DOCTYPE or other `<!` declaration to its matching top-level `>`,
+ * honoring an internal-subset `[ ... ]` whose contents may contain `>`.
+ */
+function skipDeclaration(text, i) {
+    let depth = 0;
+    for (let j = i + 2; j < text.length; j++) {
+        const c = text[j];
+        if (c === '[')
+            depth++;
+        else if (c === ']') {
+            if (depth > 0)
+                depth--;
+        }
+        else if (c === '>' && depth === 0)
+            return j + 1;
+    }
+    return BAD;
+}
+/** Read `</name>`, requiring it to close the element on top of the stack. */
+function readEndTag(text, i, stack) {
+    END_TAG_RE.lastIndex = i + 2;
+    const m = END_TAG_RE.exec(text);
+    if (m === null)
+        return BAD;
+    if (stack.pop() !== m[1])
+        return BAD;
+    return END_TAG_RE.lastIndex;
+}
+/** Read a start tag or a self-closing element, pushing the former. */
+function readStartTag(text, i, stack) {
+    NAME_RE.lastIndex = i + 1;
+    const nm = NAME_RE.exec(text);
+    if (nm === null)
+        return BAD;
+    const name = nm[0];
+    let j = NAME_RE.lastIndex;
+    while (j < text.length) {
+        while (j < text.length && XML_WS.has(text[j]))
+            j++;
+        if (j >= text.length)
+            return BAD;
+        if (text[j] === '>') {
+            stack.push(name);
+            return j + 1;
+        }
+        if (text[j] === '/' && text[j + 1] === '>')
+            return j + 2;
+        j = readAttribute(text, j);
+        if (j === BAD)
+            return BAD;
+    }
+    return BAD; // ran out of input before the tag closed
+}
+/** Read one `name="value"` pair; rejects junk and unquoted values. */
+function readAttribute(text, i) {
+    ATTR_NAME_EQ_RE.lastIndex = i;
+    if (ATTR_NAME_EQ_RE.exec(text) === null)
+        return BAD; // junk or valueless attr
+    const j = ATTR_NAME_EQ_RE.lastIndex;
+    const quote = text[j];
+    if (quote !== '"' && quote !== "'")
+        return BAD;
+    const close = text.indexOf(quote, j + 1);
+    return close === BAD ? BAD : close + 1;
+}
+/** Read an `&entity;` reference; a raw `&` is not well formed. */
+function readEntity(text, i) {
+    ENTITY_RE.lastIndex = i + 1;
+    if (ENTITY_RE.exec(text) === null)
+        return BAD;
+    return ENTITY_RE.lastIndex;
+}
+/** Extract an XML attribute value (double- or single-quoted) from a tag body. */
+export function attrValue(attrs, name) {
+    const re = new RegExp(`\\b${name}\\s*=\\s*("([^"]*)"|'([^']*)')`);
+    const m = re.exec(attrs);
+    if (m === null)
+        return null;
+    return m[2] ?? m[3] ?? '';
+}
+//# sourceMappingURL=xml.js.map