@catbee/utils 2.0.0-next.1 → 2.0.1

package/config/index.mjs

@@ -1,7 +1,7 @@
 /*
  * The MIT License
  * 
- * Copyright (c) 2025 Catbee Technologies. https://catbee.in/license
+ * Copyright (c) 2026 Catbee Technologies. https://catbee.in/license
  * 
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -24,7 +24,7 @@
 
 import { Env } from '@catbee/utils/env';
 import { uuid } from '@catbee/utils/id';
-import { deepClone, deepObjMerge } from '@catbee/utils/obj';
+import { deepClone, deepObjMerge } from '@catbee/utils/object';
 
 var __defProp = Object.defineProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
@@ -100,9 +100,9 @@ var defaultServerConfig = {
   serviceVersion: {
     enable: Env.getBoolean("SERVER_SERVICE_VERSION_ENABLE", false),
     headerName: Env.get("SERVER_SERVICE_VERSION_HEADER_NAME", "x-service-version"),
-    version: Env.get("SERVER_SERVICE_VERSION", "0.0.0")
+    version: Env.get("${npm_package_version}", "0.0.0")
   },
-  skipHealthz: Env.getBoolean("SERVER_SKIP_HEALTHZ", false)
+  skipHealthzChecksValidation: Env.getBoolean("SERVER_SKIP_HEALTHZ_CHECKS_VALIDATION", false)
 };
 var defaultCatbeeConfig = {
   logger: {

package/context-store/index.cjs

@@ -1,7 +1,7 @@
 /*
  * The MIT License
  * 
- * Copyright (c) 2025 Catbee Technologies. https://catbee.in/license
+ * Copyright (c) 2026 Catbee Technologies. https://catbee.in/license
  * 
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -231,8 +231,7 @@ var TypedContextKey = class {
   * @returns The value or defaultValue if not found
   */
   get() {
-    const value = ContextStore.get(this.symbol);
-    return value !== void 0 ? value : this.defaultValue;
+    return ContextStore.get(this.symbol) ?? this.defaultValue;
   }
   /**
   * Sets the value for this key.

package/context-store/index.d.ts

@@ -1,7 +1,7 @@
 /*
  * The MIT License
  * 
- * Copyright (c) 2025 Catbee Technologies. https://catbee.in/license
+ * Copyright (c) 2026 Catbee Technologies. https://catbee.in/license
  * 
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal

package/context-store/index.mjs

@@ -1,7 +1,7 @@
 /*
  * The MIT License
  * 
- * Copyright (c) 2025 Catbee Technologies. https://catbee.in/license
+ * Copyright (c) 2026 Catbee Technologies. https://catbee.in/license
  * 
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -229,8 +229,7 @@ var TypedContextKey = class {
   * @returns The value or defaultValue if not found
   */
   get() {
-    const value = ContextStore.get(this.symbol);
-    return value !== void 0 ? value : this.defaultValue;
+    return ContextStore.get(this.symbol) ?? this.defaultValue;
   }
   /**
   * Sets the value for this key.

package/crypto/index.cjs

@@ -1,7 +1,7 @@
 /*
  * The MIT License
  * 
- * Copyright (c) 2025 Catbee Technologies. https://catbee.in/license
+ * Copyright (c) 2026 Catbee Technologies. https://catbee.in/license
  * 
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -30,6 +30,8 @@ var id = require('@catbee/utils/id');
 
 var __defProp = Object.defineProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var pbkdf2Async = util.promisify(crypto.pbkdf2);
+var scryptAsync = util.promisify(crypto.scrypt);
 function hmac(algorithm, input, secret, encoding = "hex") {
   return crypto.createHmac(algorithm, secret).update(input).digest(encoding);
 }
@@ -85,13 +87,13 @@ function safeCompare(a, b) {
   throw new Error("Cannot compare: inputs must be strings, Buffers, or Uint8Arrays");
 }
 __name(safeCompare, "safeCompare");
-var scryptAsync = util.promisify(crypto.scrypt);
 async function encrypt(data, key, options = {}) {
   const algorithm = options.algorithm || "aes-256-gcm";
   const inputEncoding = options.inputEncoding || "utf8";
   const outputEncoding = options.outputEncoding || "hex";
   const iv = crypto.randomBytes(16);
-  const derivedKey = typeof key === "string" ? await scryptAsync(key, iv.slice(0, 8), 32) : key;
+  const salt = crypto.randomBytes(8);
+  const derivedKey = typeof key === "string" ? await scryptAsync(key, salt, 32) : key;
   const cipher = crypto.createCipheriv(algorithm, derivedKey, iv);
   let ciphertext;
   if (typeof data === "string") {
@@ -109,7 +111,8 @@ async function encrypt(data, key, options = {}) {
     ciphertext,
     iv,
     authTag,
-    algorithm
+    algorithm,
+    salt
   };
 }
 __name(encrypt, "encrypt");
@@ -117,7 +120,7 @@ async function decrypt(encryptedData, key, options = {}) {
   const algorithm = options.algorithm || encryptedData.algorithm || "aes-256-gcm";
   const inputEncoding = options.inputEncoding || "hex";
   const outputEncoding = options.outputEncoding || "utf8";
-  const derivedKey = typeof key === "string" ? await scryptAsync(key, encryptedData.iv.slice(0, 8), 32) : key;
+  const derivedKey = typeof key === "string" ? await scryptAsync(key, encryptedData.salt, 32) : key;
   const decipher = crypto.createDecipheriv(algorithm, derivedKey, encryptedData.iv);
   if (encryptedData.authTag && algorithm.includes("gcm")) {
     decipher.setAuthTag(encryptedData.authTag);
@@ -164,19 +167,66 @@ function verifySignedToken(token, secret) {
   }
 }
 __name(verifySignedToken, "verifySignedToken");
+async function pbkdf2Hash(password, salt, keyLength = 32, iterations = 31e4) {
+  return pbkdf2Async(password, salt, iterations, keyLength, "sha256");
+}
+__name(pbkdf2Hash, "pbkdf2Hash");
+function generateNonce(byteLength = 16, encoding = "hex") {
+  return crypto.randomBytes(byteLength).toString(encoding);
+}
+__name(generateNonce, "generateNonce");
+function secureRandomInt(min, max) {
+  if (min > max) throw new Error("min must be less than or equal to max");
+  const range = max - min + 1;
+  const bytesNeeded = Math.ceil(Math.log2(range) / 8);
+  const maxValid = Math.floor(256 ** bytesNeeded / range) * range;
+  let randomValue;
+  do {
+    const bytes = crypto.randomBytes(bytesNeeded);
+    randomValue = bytes.reduce((acc, byte, i) => acc + byte * 256 ** i, 0);
+  } while (randomValue >= maxValid);
+  return min + randomValue % range;
+}
+__name(secureRandomInt, "secureRandomInt");
+async function hashPassword(password, saltLength = 16, keyLength = 32) {
+  const salt = crypto.randomBytes(saltLength);
+  const scryptAsync2 = util.promisify(crypto.scrypt);
+  const derivedKey = await scryptAsync2(password, salt, keyLength);
+  return `${salt.toString("base64")}:${derivedKey.toString("base64")}`;
+}
+__name(hashPassword, "hashPassword");
+async function verifyPassword(password, hash2) {
+  try {
+    const [saltB64, keyB64] = hash2.split(":");
+    if (!saltB64 || !keyB64) return false;
+    const salt = Buffer.from(saltB64, "base64");
+    const key = Buffer.from(keyB64, "base64");
+    const scryptAsync2 = util.promisify(crypto.scrypt);
+    const derivedKey = await scryptAsync2(password, salt, key.length);
+    return crypto.timingSafeEqual(key, derivedKey);
+  } catch {
+    return false;
+  }
+}
+__name(verifyPassword, "verifyPassword");
 
 exports.createSignedToken = createSignedToken;
 exports.decrypt = decrypt;
 exports.encrypt = encrypt;
 exports.generateApiKey = generateApiKey;
+exports.generateNonce = generateNonce;
 exports.generateRandomBytes = generateRandomBytes;
 exports.generateRandomBytesAsString = generateRandomBytesAsString;
 exports.hash = hash;
+exports.hashPassword = hashPassword;
 exports.hmac = hmac;
 exports.md5 = md5;
+exports.pbkdf2Hash = pbkdf2Hash;
 exports.randomString = randomString;
 exports.safeCompare = safeCompare;
+exports.secureRandomInt = secureRandomInt;
 exports.sha1 = sha1;
 exports.sha256 = sha256;
 exports.sha256Hmac = sha256Hmac;
+exports.verifyPassword = verifyPassword;
 exports.verifySignedToken = verifySignedToken;

package/crypto/index.d.ts

@@ -1,7 +1,7 @@
 /*
  * The MIT License
  * 
- * Copyright (c) 2025 Catbee Technologies. https://catbee.in/license
+ * Copyright (c) 2026 Catbee Technologies. https://catbee.in/license
  * 
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -146,6 +146,8 @@ interface EncryptionResult {
     authTag?: Buffer;
     /** Algorithm used */
     algorithm: string;
+    /** Salt used for key derivation */
+    salt: Buffer;
 }
 /**
  * Encrypts data using a symmetric key with secure defaults (AES-256-GCM).
@@ -182,6 +184,65 @@ declare function createSignedToken(payload: Record<string, any>, secret: string,
  * @returns {object | null} Decoded payload if valid, null if invalid
  */
 declare function verifySignedToken(token: string, secret: string): Record<string, any> | null;
+/**
+ * Derives a cryptographic key using PBKDF2 (SHA-256).
+ *
+ * @param password - Password to derive key from
+ * @param salt - Cryptographic salt (use unique per password)
+ * @param keyLength - Output key length in bytes (default 32)
+ * @param iterations - Number of hashing iterations (default 310000, OWASP recommended)
+ * @returns Derived key as Buffer
+ *
+ * @example
+ * const key = await pbkdf2Hash('myPassword', 'mySalt');
+ */
+declare function pbkdf2Hash(password: string, salt: string | Buffer, keyLength?: number, iterations?: number): Promise<Buffer>;
+/**
+ * Generates a cryptographically secure nonce (number used once).
+ *
+ * @param {number} [byteLength=16] - Length of nonce in bytes.
+ * @param {BinaryToTextEncoding} [encoding='hex'] - Output encoding.
+ * @returns {string} Nonce string.
+ *
+ * @example
+ * const nonce = generateNonce(16, 'base64'); // Random nonce
+ */
+declare function generateNonce(byteLength?: number, encoding?: BinaryToTextEncoding): string;
+/**
+ * Generates a cryptographically secure random integer in a range.
+ *
+ * @param {number} min - Minimum value (inclusive).
+ * @param {number} max - Maximum value (inclusive).
+ * @returns {number} Random integer.
+ *
+ * @example
+ * const random = secureRandomInt(1, 100); // Random number 1-100
+ */
+declare function secureRandomInt(min: number, max: number): number;
+/**
+ * Hashes a password using scrypt (memory-hard function).
+ *
+ * @param {string} password - The password to hash.
+ * @param {number} [saltLength=16] - Length of salt in bytes.
+ * @param {number} [keyLength=32] - Length of derived key.
+ * @returns {Promise<string>} Hash string containing salt and key.
+ *
+ * @example
+ * const hash = await hashPassword('myPassword');
+ * // Returns format: salt:hash (both base64)
+ */
+declare function hashPassword(password: string, saltLength?: number, keyLength?: number): Promise<string>;
+/**
+ * Verifies a password against a scrypt hash.
+ *
+ * @param {string} password - The password to verify.
+ * @param {string} hash - The hash to verify against (from hashPassword).
+ * @returns {Promise<boolean>} True if password matches.
+ *
+ * @example
+ * const isValid = await verifyPassword('myPassword', storedHash);
+ */
+declare function verifyPassword(password: string, hash: string): Promise<boolean>;
 
-export { createSignedToken, decrypt, encrypt, generateApiKey, generateRandomBytes, generateRandomBytesAsString, hash, hmac, md5, randomString, safeCompare, sha1, sha256, sha256Hmac, verifySignedToken };
+export { createSignedToken, decrypt, encrypt, generateApiKey, generateNonce, generateRandomBytes, generateRandomBytesAsString, hash, hashPassword, hmac, md5, pbkdf2Hash, randomString, safeCompare, secureRandomInt, sha1, sha256, sha256Hmac, verifyPassword, verifySignedToken };
 export type { BufferEncoding, DecryptionOptions, EncryptionOptions, EncryptionResult };

package/crypto/index.mjs

@@ -1,7 +1,7 @@
 /*
  * The MIT License
  * 
- * Copyright (c) 2025 Catbee Technologies. https://catbee.in/license
+ * Copyright (c) 2026 Catbee Technologies. https://catbee.in/license
  * 
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -22,12 +22,14 @@
  * SOFTWARE.
  */
 
-import { scrypt, createHmac, createHash, randomBytes, timingSafeEqual, createCipheriv, createDecipheriv } from 'crypto';
+import { pbkdf2, scrypt, createHmac, createHash, randomBytes, timingSafeEqual, createCipheriv, createDecipheriv } from 'crypto';
 import { promisify } from 'util';
 import { uuid } from '@catbee/utils/id';
 
 var __defProp = Object.defineProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var pbkdf2Async = promisify(pbkdf2);
+var scryptAsync = promisify(scrypt);
 function hmac(algorithm, input, secret, encoding = "hex") {
   return createHmac(algorithm, secret).update(input).digest(encoding);
 }
@@ -83,13 +85,13 @@ function safeCompare(a, b) {
   throw new Error("Cannot compare: inputs must be strings, Buffers, or Uint8Arrays");
 }
 __name(safeCompare, "safeCompare");
-var scryptAsync = promisify(scrypt);
 async function encrypt(data, key, options = {}) {
   const algorithm = options.algorithm || "aes-256-gcm";
   const inputEncoding = options.inputEncoding || "utf8";
   const outputEncoding = options.outputEncoding || "hex";
   const iv = randomBytes(16);
-  const derivedKey = typeof key === "string" ? await scryptAsync(key, iv.slice(0, 8), 32) : key;
+  const salt = randomBytes(8);
+  const derivedKey = typeof key === "string" ? await scryptAsync(key, salt, 32) : key;
   const cipher = createCipheriv(algorithm, derivedKey, iv);
   let ciphertext;
   if (typeof data === "string") {
@@ -107,7 +109,8 @@ async function encrypt(data, key, options = {}) {
     ciphertext,
     iv,
     authTag,
-    algorithm
+    algorithm,
+    salt
   };
 }
 __name(encrypt, "encrypt");
@@ -115,7 +118,7 @@ async function decrypt(encryptedData, key, options = {}) {
   const algorithm = options.algorithm || encryptedData.algorithm || "aes-256-gcm";
   const inputEncoding = options.inputEncoding || "hex";
   const outputEncoding = options.outputEncoding || "utf8";
-  const derivedKey = typeof key === "string" ? await scryptAsync(key, encryptedData.iv.slice(0, 8), 32) : key;
+  const derivedKey = typeof key === "string" ? await scryptAsync(key, encryptedData.salt, 32) : key;
   const decipher = createDecipheriv(algorithm, derivedKey, encryptedData.iv);
   if (encryptedData.authTag && algorithm.includes("gcm")) {
     decipher.setAuthTag(encryptedData.authTag);
@@ -162,5 +165,47 @@ function verifySignedToken(token, secret) {
   }
 }
 __name(verifySignedToken, "verifySignedToken");
+async function pbkdf2Hash(password, salt, keyLength = 32, iterations = 31e4) {
+  return pbkdf2Async(password, salt, iterations, keyLength, "sha256");
+}
+__name(pbkdf2Hash, "pbkdf2Hash");
+function generateNonce(byteLength = 16, encoding = "hex") {
+  return randomBytes(byteLength).toString(encoding);
+}
+__name(generateNonce, "generateNonce");
+function secureRandomInt(min, max) {
+  if (min > max) throw new Error("min must be less than or equal to max");
+  const range = max - min + 1;
+  const bytesNeeded = Math.ceil(Math.log2(range) / 8);
+  const maxValid = Math.floor(256 ** bytesNeeded / range) * range;
+  let randomValue;
+  do {
+    const bytes = randomBytes(bytesNeeded);
+    randomValue = bytes.reduce((acc, byte, i) => acc + byte * 256 ** i, 0);
+  } while (randomValue >= maxValid);
+  return min + randomValue % range;
+}
+__name(secureRandomInt, "secureRandomInt");
+async function hashPassword(password, saltLength = 16, keyLength = 32) {
+  const salt = randomBytes(saltLength);
+  const scryptAsync2 = promisify(scrypt);
+  const derivedKey = await scryptAsync2(password, salt, keyLength);
+  return `${salt.toString("base64")}:${derivedKey.toString("base64")}`;
+}
+__name(hashPassword, "hashPassword");
+async function verifyPassword(password, hash2) {
+  try {
+    const [saltB64, keyB64] = hash2.split(":");
+    if (!saltB64 || !keyB64) return false;
+    const salt = Buffer.from(saltB64, "base64");
+    const key = Buffer.from(keyB64, "base64");
+    const scryptAsync2 = promisify(scrypt);
+    const derivedKey = await scryptAsync2(password, salt, key.length);
+    return timingSafeEqual(key, derivedKey);
+  } catch {
+    return false;
+  }
+}
+__name(verifyPassword, "verifyPassword");
 
-export { createSignedToken, decrypt, encrypt, generateApiKey, generateRandomBytes, generateRandomBytesAsString, hash, hmac, md5, randomString, safeCompare, sha1, sha256, sha256Hmac, verifySignedToken };
+export { createSignedToken, decrypt, encrypt, generateApiKey, generateNonce, generateRandomBytes, generateRandomBytesAsString, hash, hashPassword, hmac, md5, pbkdf2Hash, randomString, safeCompare, secureRandomInt, sha1, sha256, sha256Hmac, verifyPassword, verifySignedToken };