chore: import upstream snapshot with attribution

open-sse/services/compression/quantumLock/quantumPatterns.ts

@@ -0,0 +1,80 @@
+/**
+ * QuantumLock leaf module: category enum, span/config/stats types, constants, and the
+ * fixed-order, ReDoS-bounded detection patterns. No imports — keeps every consumer one-way
+ * (cycle-safe). See docs/superpowers/specs/2026-06-28-compression-quantumlock-design.md.
+ */
+
+export type QuantumCategory =
+  | "uuid"
+  | "unix_ts"
+  | "long_hex"
+  | "jwt"
+  | "api_key_shape"
+  | "request_id";
+
+export interface VolatileSpan {
+  start: number; // inclusive char offset into the system text
+  end: number; // exclusive
+  category: QuantumCategory;
+}
+
+export interface QuantumLockConfig {
+  enabled: boolean;
+  /** Subset of categories to stabilize. Absent/empty ⇒ all categories. */
+  categories?: QuantumCategory[];
+}
+
+export interface QuantumLockStats {
+  fragments: number;
+  categories: Partial<Record<QuantumCategory, number>>;
+}
+
+/** Idempotency sentinel + tail header. Its presence in system text ⇒ already stabilized. */
+export const TAIL_DELIM = "⟦QUANTUMLOCK⟧";
+
+/** Positional, value-independent placeholder. Depends ONLY on match index. */
+export const placeholderFor = (i: number): string => `⟦Q${i}⟧`;
+
+interface QuantumPattern {
+  category: QuantumCategory;
+  pattern: RegExp;
+}
+
+/**
+ * Detection order is FIXED: most-specific / widest first so a token is never split.
+ * Every variable-length run is bounded ({N,M}) — no unbounded quantifier (anti-ReDoS).
+ */
+export const QUANTUM_PATTERNS: QuantumPattern[] = [
+  // JWTs start with base64url of `{"` → "eyJ". Run first so the whole token wins.
+  // Trailing negative-lookahead (not \b): a JWT signature can END in base64url `-`/`_`,
+  // where \b would misfire (it needs a following word char) and let the token escape detection.
+  {
+    category: "jwt",
+    pattern: /\beyJ[A-Za-z0-9_-]{8,512}\.[A-Za-z0-9_-]{8,512}\.[A-Za-z0-9_-]{8,512}(?![A-Za-z0-9_-])/g,
+  },
+  // Prefixed API keys (stripe/github/slack shapes).
+  {
+    category: "api_key_shape",
+    pattern: /\b(?:sk|pk|rk|ghp|gho|xox[baprs])[-_][A-Za-z0-9]{16,200}\b/g,
+  },
+  // Bearer tokens. Bounded whitespace ([ \t]{1,4}) per the file convention (no unbounded \s+).
+  {
+    category: "api_key_shape",
+    pattern: /\bBearer[ \t]{1,4}[A-Za-z0-9._-]{16,400}\b/g,
+  },
+  // Canonical UUID. Runs before long_hex so its inner hex is not re-claimed.
+  {
+    category: "uuid",
+    pattern: /\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/gi,
+  },
+  // Correlation / request ids.
+  {
+    category: "request_id",
+    pattern: /\b(?:req|trace|span|corr|request)[-_][A-Za-z0-9]{6,128}\b/gi,
+  },
+  // Digests / SHAs. After uuid/jwt so it never eats their inner hex.
+  { category: "long_hex", pattern: /\b[0-9a-f]{16,128}\b/gi },
+  // 10- or 13-digit unix epoch in the 2001–2033 window (leading 1). LAST so it never
+  // fragments a longer token already claimed above.
+  { category: "unix_ts", pattern: /\b1[0-9]{9}(?:[0-9]{3})?\b/g },
+];