cloudstructs 0.12.10 → 0.12.11

package/node_modules/path-expression-matcher/src/index.d.ts

@@ -189,22 +189,81 @@ export interface MatcherSnapshot {
 }
 
 /**
- * Matcher - Tracks current path in XML/JSON tree and matches against Expressions
- * 
+ * MatcherView - A lightweight read-only view over a {@link Matcher} instance.
+ *
+ * Created once by {@link Matcher} and reused across all callbacks — no allocation
+ * on every invocation. Holds a direct reference to the parent Matcher's internal
+ * state so it always reflects the current parser position with zero copying or
+ * freezing overhead.
+ *
+ * Mutation methods (`push`, `pop`, `reset`, `updateCurrent`, `restore`) are simply
+ * absent from this class, so misuse is caught at compile time by TypeScript rather
+ * than at runtime.
+ *
+ * Obtain via {@link Matcher#readOnly} — the same instance is returned every time.
+ *
+ * @example
+ * ```typescript
+ * const matcher = new Matcher();
+ * const view: MatcherView = matcher.readOnly();
+ *
+ * matcher.push("root", {});
+ * matcher.push("users", {});
+ * matcher.push("user", { id: "123" });
+ *
+ * view.matches(expr);      // ✓ true
+ * view.getCurrentTag();    // ✓ "user"
+ * view.getDepth();         // ✓ 3
+ * // view.push(...)        // ✗ Property 'push' does not exist on type 'MatcherView'
+ * ```
+ */
+export class MatcherView {
+  /**
+   * Default path separator (read-only, delegates to parent Matcher)
+   */
+  readonly separator: string;
+
+  getCurrentTag(): string | undefined;
+  getCurrentNamespace(): string | undefined;
+  getAttrValue(attrName: string): any;
+  hasAttr(attrName: string): boolean;
+  getPosition(): number;
+  getCounter(): number;
+  /** @deprecated Use getPosition() or getCounter() instead */
+  getIndex(): number;
+  getDepth(): number;
+  toString(separator?: string, includeNamespace?: boolean): string;
+  toArray(): string[];
+  matches(expression: Expression): boolean;
+  matchesAny(exprSet: ExpressionSet): boolean;
+}
+
+/**
+ * @deprecated Use {@link MatcherView} instead.
+ * Alias kept for backward compatibility with code that references `ReadOnlyMatcher`.
+ */
+export type ReadOnlyMatcher = MatcherView;
+
+/**
+ * Matcher - Tracks current path in XML/JSON tree and matches against Expressions.
+ *
  * The matcher maintains a stack of nodes representing the current path from root to
  * current tag. It only stores attribute values for the current (top) node to minimize
  * memory usage.
- * 
+ *
+ * Use {@link Matcher#readOnly} to obtain a {@link MatcherView} safe to pass to
+ * user callbacks — the same instance is reused on every call with no allocation overhead.
+ *
  * @example
  * ```typescript
  * const matcher = new Matcher();
  * matcher.push("root", {});
  * matcher.push("users", {});
  * matcher.push("user", { id: "123", type: "admin" });
- * 
+ *
  * const expr = new Expression("root.users.user");
  * matcher.matches(expr); // true
- * 
+ *
  * matcher.pop();
  * matcher.matches(expr); // false
  * ```
@@ -215,11 +274,6 @@ export class Matcher {
    */
   readonly separator: string;
 
-  /**
-   * Current path stack
-   */
-  readonly path: PathNode[];
-
   /**
    * Create a new Matcher
    * @param options - Configuration options
@@ -227,11 +281,11 @@ export class Matcher {
   constructor(options?: MatcherOptions);
 
   /**
-   * Push a new tag onto the path
+   * Push a new tag onto the path.
    * @param tagName - Name of the tag
    * @param attrValues - Attribute key-value pairs for current node (optional)
    * @param namespace - Namespace for the tag (optional)
-   * 
+   *
    * @example
    * ```typescript
    * matcher.push("user", { id: "123", type: "admin" });
@@ -242,125 +296,228 @@ export class Matcher {
   push(tagName: string, attrValues?: Record<string, any> | null, namespace?: string | null): void;
 
   /**
-   * Pop the last tag from the path
+   * Pop the last tag from the path.
    * @returns The popped node or undefined if path is empty
    */
   pop(): PathNode | undefined;
 
   /**
-   * Update current node's attribute values
-   * Useful when attributes are parsed after push
+   * Update current node's attribute values.
+   * Useful when attributes are parsed after push.
    * @param attrValues - Attribute values
    */
   updateCurrent(attrValues: Record<string, any>): void;
 
   /**
-   * Get current tag name
-   * @returns Current tag name or undefined if path is empty
+   * Reset the path to empty.
    */
-  getCurrentTag(): string | undefined;
+  reset(): void;
 
   /**
-   * Get current namespace
-   * @returns Current namespace or undefined if not present or path is empty
+   * Create a snapshot of current state.
+   * @returns State snapshot that can be restored later
    */
-  getCurrentNamespace(): string | undefined;
+  snapshot(): MatcherSnapshot;
 
   /**
-   * Get current node's attribute value
-   * @param attrName - Attribute name
-   * @returns Attribute value or undefined
+   * Restore state from snapshot.
+   * @param snapshot - State snapshot from previous snapshot() call
    */
-  getAttrValue(attrName: string): any;
+  restore(snapshot: MatcherSnapshot): void;
 
-  /**
-   * Check if current node has an attribute
-   * @param attrName - Attribute name
-   */
+  getCurrentTag(): string | undefined;
+  getCurrentNamespace(): string | undefined;
+  getAttrValue(attrName: string): any;
   hasAttr(attrName: string): boolean;
+  getPosition(): number;
+  getCounter(): number;
+  /** @deprecated Use getPosition() or getCounter() instead */
+  getIndex(): number;
+  getDepth(): number;
+  toString(separator?: string, includeNamespace?: boolean): string;
+  toArray(): string[];
+  matches(expression: Expression): boolean;
+  matchesAny(exprSet: ExpressionSet): boolean;
 
   /**
-   * Get current node's sibling position (child index in parent)
-   * @returns Position index or -1 if path is empty
+   * Return the read-only {@link MatcherView} for this matcher.
+   *
+   * The same instance is returned on every call — no allocation occurs.
+   * Pass this to user callbacks; it always reflects current parser state.
+   *
+   * @example
+   * ```typescript
+   * const view = matcher.readOnly();
+   * // same reference every time — safe to cache
+   * view === matcher.readOnly(); // true
+   * ```
    */
-  getPosition(): number;
+  readOnly(): MatcherView;
+}
 
+/**
+ * ExpressionSet - An indexed collection of Expressions for efficient bulk matching
+ *
+ * Pre-indexes expressions at insertion time by depth and terminal tag name so
+ * that `matchesAny()` performs an O(1) bucket lookup rather than a full O(E)
+ * linear scan on every tag.
+ *
+ * Three internal buckets are maintained automatically:
+ *  - **exact** — expressions with a fixed depth and a concrete terminal tag
+ *  - **depth-wildcard** — fixed depth but terminal tag is `*`
+ *  - **deep-wildcard** — expressions containing `..` (cannot be depth-indexed)
+ *
+ * @example
+ * ```typescript
+ * import { Expression, ExpressionSet, Matcher } from 'fast-xml-tagger';
+ *
+ * // Build once at config time
+ * const stopNodes = new ExpressionSet();
+ * stopNodes
+ *   .add(new Expression('root.users.user'))
+ *   .add(new Expression('root.config.*'))
+ *   .add(new Expression('..script'))
+ *   .seal(); // prevent accidental mutation during parsing
+ *
+ * // Query on every tag — hot path
+ * if (stopNodes.matchesAny(matcher)) {
+ *   // handle stop node
+ * }
+ * ```
+ */
+export class ExpressionSet {
   /**
-   * Get current node's repeat counter (occurrence count of this tag name)
-   * @returns Counter value or -1 if path is empty
+   * Create an empty ExpressionSet.
    */
-  getCounter(): number;
+  constructor();
 
   /**
-   * Get current node's sibling index (alias for getPosition for backward compatibility)
-   * @returns Index or -1 if path is empty
-   * @deprecated Use getPosition() or getCounter() instead
+   * Number of expressions currently in the set.
    */
-  getIndex(): number;
+  readonly size: number;
 
   /**
-   * Get current path depth
-   * @returns Number of nodes in the path
+   * Whether the set has been sealed against further modifications.
    */
-  getDepth(): number;
+  readonly isSealed: boolean;
 
   /**
-   * Get path as string
-   * @param separator - Optional separator (uses default if not provided)
-   * @param includeNamespace - Whether to include namespace in output
-   * @returns Path string (e.g., "root.users.user" or "ns:root.ns:users.user")
+   * Add a single Expression to the set.
+   *
+   * Duplicate patterns (same `expression.pattern` string) are silently ignored.
+   *
+   * @param expression - A pre-constructed Expression instance
+   * @returns `this` — for chaining
+   * @throws {TypeError} if the set has been sealed
+   *
+   * @example
+   * ```typescript
+   * set.add(new Expression('root.users.user'));
+   * set.add(new Expression('..script'));
+   * ```
    */
-  toString(separator?: string, includeNamespace?: boolean): string;
+  add(expression: Expression): this;
 
   /**
-   * Get path as array of tag names
-   * @returns Array of tag names
+   * Add multiple expressions at once.
+   *
+   * @param expressions - Array of Expression instances
+   * @returns `this` — for chaining
+   * @throws {TypeError} if the set has been sealed
+   *
+   * @example
+   * ```typescript
+   * set.addAll([
+   *   new Expression('root.users.user'),
+   *   new Expression('root.config.setting'),
+   * ]);
+   * ```
    */
-  toArray(): string[];
+  addAll(expressions: Expression[]): this;
 
   /**
-   * Reset the path to empty
+   * Check whether an Expression with the same pattern is already present.
+   *
+   * @param expression - Expression to look up
+   * @returns `true` if the pattern was already added
    */
-  reset(): void;
+  has(expression: Expression): boolean;
 
   /**
-   * Match current path against an Expression
-   * @param expression - The expression to match against
-   * @returns True if current path matches the expression
-   * 
+   * Seal the set against further modifications.
+   *
+   * After calling `seal()`, any call to `add()` or `addAll()` will throw a
+   * `TypeError`. This is useful to prevent accidental mutation once the config
+   * has been fully built and parsing has started.
+   *
+   * @returns `this` — for chaining
+   *
    * @example
    * ```typescript
-   * const expr = new Expression("root.users.user[id]");
-   * const matcher = new Matcher();
-   * 
-   * matcher.push("root");
-   * matcher.push("users");
-   * matcher.push("user", { id: "123" });
-   * 
-   * matcher.matches(expr); // true
+   * const stopNodes = new ExpressionSet();
+   * stopNodes.addAll(patterns.map(p => new Expression(p))).seal();
+   *
+   * // Later — safe: reads are still allowed
+   * stopNodes.matchesAny(matcher);
+   *
+   * // Later — throws TypeError: ExpressionSet is sealed
+   * stopNodes.add(new Expression('root.extra'));
    * ```
    */
-  matches(expression: Expression): boolean;
+  seal(): this;
 
   /**
-   * Create a snapshot of current state
-   * @returns State snapshot that can be restored later
+   * Test whether the matcher's current path matches **any** expression in the set.
+   *
+   * Uses the pre-built index to evaluate only the relevant bucket(s):
+   *  1. Exact depth + tag — O(1) lookup
+   *  2. Depth-matched wildcard tag — O(1) lookup
+   *  3. Deep-wildcard expressions — always scanned (typically a small list)
+   *
+   * @param matcher - A `Matcher` instance or a `ReadOnlyMatcher` view
+   * @returns `true` if at least one expression matches the current path
+   *
+   * @example
+   * ```typescript
+   * // Replaces:
+   * // for (const expr of stopNodeExpressions) {
+   * //   if (matcher.matches(expr)) return true;
+   * // }
+   *
+   * if (stopNodes.matchesAny(matcher)) {
+   *   // current tag is a stop node
+   * }
+   * ```
    */
-  snapshot(): MatcherSnapshot;
+  matchesAny(matcher: Matcher | MatcherView): boolean;
 
   /**
-   * Restore state from snapshot
-   * @param snapshot - State snapshot from previous snapshot() call
+   * Find the first expression in the set that matches the matcher's current path.
+   *
+   * Uses the pre-built index to evaluate only the relevant bucket(s):
+   *  1. Exact depth + tag — O(1) lookup
+   *  2. Depth-matched wildcard tag — O(1) lookup
+   *  3. Deep-wildcard expressions — always scanned (typically a small list)
+   *
+   * @param matcher - A `Matcher` instance or a `ReadOnlyMatcher` view
+   * @returns Expression if at least one expression matches the current path
+   *
+   * @example
+   * ```typescript
+   * const node = stopNodes.findMatch(matcher);
+   * ```
    */
-  restore(snapshot: MatcherSnapshot): void;
+  findMatch(matcher: Matcher | MatcherView): Expression;
 }
 
 /**
- * Default export containing both Expression and Matcher
+ * Default export containing Expression, Matcher, and ExpressionSet
  */
 declare const _default: {
   Expression: typeof Expression;
   Matcher: typeof Matcher;
+  MatcherView: typeof MatcherView;
+  ExpressionSet: typeof ExpressionSet;
 };
 
 export default _default;

package/node_modules/path-expression-matcher/src/index.js

@@ -23,6 +23,7 @@
 
 import Expression from './Expression.js';
 import Matcher from './Matcher.js';
+import ExpressionSet from './ExpressionSet.js';
 
-export { Expression, Matcher };
-export default { Expression, Matcher };
+export { Expression, Matcher, ExpressionSet };
+export default { Expression, Matcher, ExpressionSet };

package/node_modules/picomatch/README.md

@@ -318,7 +318,8 @@ The following options may be used with the main `picomatch()` function or any of
 | `keepQuotes`          | `boolean`      | `false`     | Retain quotes in the generated regex, since quotes may also be used as an alternative to backslashes.  |
 | `literalBrackets`     | `boolean`      | `undefined` | When `true`, brackets in the glob pattern will be escaped so that only literal brackets will be matched. |
 | `matchBase`           | `boolean`      | `false`     | Alias for `basename` |
-| `maxLength`           | `boolean`      | `65536`     | Limit the max length of the input string. An error is thrown if the input string is longer than this value. |
+| `maxLength`           | `number`      | `65536`     | Limit the max length of the input string. An error is thrown if the input string is longer than this value. |
+| `maxExtglobRecursion` | `number\|boolean` | `0` | Limit nested quantified extglobs and other risky repeated extglob forms. When the limit is exceeded, the extglob is treated as a literal string instead of being compiled to regex. Set to `false` to disable this safeguard. |
 | `nobrace`             | `boolean`      | `false`     | Disable brace matching, so that `{a,b}` and `{1..3}` would be treated as literal characters. |
 | `nobracket`           | `boolean`      | `undefined` | Disable matching with regex brackets. |
 | `nocase`              | `boolean`      | `false`     | Make matching case-insensitive. Equivalent to the regex `i` flag. Note that this option is overridden by the `flags` option. |
@@ -533,6 +534,13 @@ console.log(pm.isMatch('foo.bar', '!(foo).!(bar)')); // false
 
 // supports nested extglobs
 console.log(pm.isMatch('foo.bar', '!(!(foo)).!(!(bar))')); // true
+
+// risky quantified extglobs are treated literally by default
+console.log(pm.makeRe('+(a|aa)'));
+//=> /^(?:\+\(a\|aa\))$/
+
+// increase the limit to allow a small amount of nested quantified extglobs
+console.log(pm.isMatch('aaa', '+(+(a))', { maxExtglobRecursion: 1 })); // true
 ```
 
 #### POSIX brackets

package/node_modules/picomatch/lib/constants.js

@@ -4,6 +4,8 @@ const path = require('path');
 const WIN_SLASH = '\\\\/';
 const WIN_NO_SLASH = `[^${WIN_SLASH}]`;
 
+const DEFAULT_MAX_EXTGLOB_RECURSION = 0;
+
 /**
  * Posix glob regex
  */
@@ -67,6 +69,7 @@ const WINDOWS_CHARS = {
  */
 
 const POSIX_REGEX_SOURCE = {
+  __proto__: null,
   alnum: 'a-zA-Z0-9',
   alpha: 'a-zA-Z',
   ascii: '\\x00-\\x7F',
@@ -84,6 +87,7 @@ const POSIX_REGEX_SOURCE = {
 };
 
 module.exports = {
+  DEFAULT_MAX_EXTGLOB_RECURSION,
   MAX_LENGTH: 1024 * 64,
   POSIX_REGEX_SOURCE,
 
@@ -97,6 +101,7 @@ module.exports = {
 
   // Replace globs with equivalent patterns to reduce parsing time.
   REPLACEMENTS: {
+    __proto__: null,
     '***': '*',
     '**/**': '**',
     '**/**/**': '**'