use crate::ops::security_detection::detector_support::{spans, ByteSpan, DetectionError};
pub const SPEC_TOML: &str = r#"schema_version = 1
id = "security_detection.detect_url"
archetype = "match-bytes-pattern"
display_name = "Detect URL"
summary = "Returns offset-length spans for URL-like byte sequences."
category = "C"
[intrinsic]
wgsl = "security_detection_detect_url"
[signature]
inputs = ["Bytes", "Bytes"]
output = "Bytes"
laws = []
equivalence_classes = ["http", "https", "missing_host_dot", "t47_cap"]
workgroup_size = [64, 1, 1]
tags = ["security-detection", "url", "ioc", "t47"]
fixtures_dir = "fixtures/"
"#;
pub const REFERENCE_VECTORS_TOML: &str = r#"[[case]]
name = "positive_https"
input = "fetch https://example.com/a?b=c now"
expected_spans = [{ offset = 6, len = 25 }]
[[case]]
name = "negative_missing_dot"
input = "fetch http://localhost/path now"
expected_spans = []
"#;
pub mod lowering {
#[must_use]
pub const fn source() -> &'static str {
r#"@compute @workgroup_size(64)
pub fn detect_url(@builtin(global_invocation_id) gid: vec3<u32>) {
let i = gid.x;
if (i + 7u >= input_len) { return; }
let http = eq_ci(i, "http://");
let https = eq_ci(i, "https://");
if (!http && !https) { return; }
let scheme_len = select(7u, 8u, https);
var j = i + scheme_len;
var dot = false;
loop {
if (j >= input_len || !is_uri_char(input[j])) { break; }
if (input[j] == 46u) { dot = true; }
j = j + 1u;
}
if (dot && j > i + scheme_len) { emit_span(i, j - i); }
}"#
}
}
pub fn detect_url(input: &[u8]) -> Result<Vec<ByteSpan>, DetectionError> {
spans::url_spans(input)
}
pub mod implementation {
pub use super::detect_url;
pub mod kernel {
pub use super::super::detect_url;
}
pub mod lowering {
pub mod wgsl {
pub use super::super::super::lowering::source;
}
}
}