@crvouga/mockingbird-service-junction 3.10.5 → 3.10.7

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog — @crvouga/mockingbird-service-junction
 
+## 3.10.7 (2026-11-02)
+
+### Fixes and improvements
+
+- compare the admin key in constant time ([2a43141](https://github.com/crvouga/mockingbird/commit/2a43141f50dab41e698c3bbce0c69bf65b40e24e))
+
+## 3.10.6 (2026-11-02)
+
+### Fixes and improvements
+
+- stop walkSchema recursing forever on a self-referential $ref ([69464a9](https://github.com/crvouga/mockingbird/commit/69464a9d9e7f468c5e1095125108d4d3d5515431))
+- densify sparse bracket arrays by their written indices ([84a28cb](https://github.com/crvouga/mockingbird/commit/84a28cb182e3d7df91102897f0fc11fca714ba5f))
+
 ## 3.10.5 (2026-11-02)
 
 ### Fixes and improvements

package/dist/{chunk-GWVONYFE.js → chunk-C7TRCEUC.js}

@@ -13,7 +13,7 @@ import {
   pullCorpus,
   resolveAdminPrefix,
   restoreClock
-} from "./chunk-VQNDKLJG.js";
+} from "./chunk-QCCX6DI7.js";
 import {
   defaultCorpus
 } from "./chunk-2FZJPMTR.js";
@@ -3070,7 +3070,7 @@ async function preflightFleet(config, options) {
             break;
         }
       }
-      targets.set(name, { ...target, packageVersion: packageVersion ?? "3.10.5" });
+      targets.set(name, { ...target, packageVersion: packageVersion ?? "3.10.7" });
     } catch (error) {
       throw new Error(`service ${name}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
     }
@@ -5264,4 +5264,4 @@ export {
   createServer2 as createServer,
   serveTarget
 };
-//# sourceMappingURL=chunk-GWVONYFE.js.map
+//# sourceMappingURL=chunk-C7TRCEUC.js.map

package/dist/{chunk-VQNDKLJG.js → chunk-QCCX6DI7.js}

@@ -499,6 +499,7 @@ var parsePath = (rawKey) => {
   return path;
 };
 var isIndex = (segment) => /^(0|[1-9][0-9]*)$/.test(segment);
+var MAX_ARRAY_INDEX = 4294967294;
 var put = (target, key, value) => {
   if (key === "__proto__") {
     Object.defineProperty(target, key, {
@@ -561,8 +562,17 @@ var decodeFormPairs = (pairs) => {
 var densify = (value) => {
   if (typeof value === "string")
     return value;
-  if (Array.isArray(value))
-    return value.filter((item) => item !== void 0).map(densify);
+  if (Array.isArray(value)) {
+    const dense = [];
+    for (const key of Object.keys(value)) {
+      if (!isIndex(key) || Number(key) > MAX_ARRAY_INDEX)
+        continue;
+      const item = value[Number(key)];
+      if (item !== void 0)
+        dense.push(densify(item));
+    }
+    return dense;
+  }
   const out = {};
   for (const [key, item] of Object.entries(value))
     put(out, key, densify(item));
@@ -2395,6 +2405,17 @@ var createNamespaceControls = (options) => {
   };
 };
 
+// ../core/dist/signing.js
+var encoder = new TextEncoder();
+var timingSafeEqual = (a, b) => {
+  if (a.length !== b.length)
+    return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++)
+    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+};
+
 // ../core/dist/surface.js
 var defineMock = (runtime) => runtime;
 var ADMIN_ROUTE_REFERENCE = {
@@ -2513,6 +2534,10 @@ var assertAdminPrefixAvailable = (prefix, paths) => {
   }
 };
 var ADMIN_KEY_HEADER = CONTROL_HEADERS.adminKey;
+var hasAdminKey = (headers, adminKey) => {
+  const sent = headers.get(ADMIN_KEY_HEADER);
+  return sent !== null && timingSafeEqual(sent, adminKey);
+};
 var NAMESPACE_HEADER = CONTROL_HEADERS.namespace;
 var ADMIN_DOCS_URL = "https://mockingbird.chrisvouga.dev/docs/admin-controls";
 var ADMIN_CONTROL_PAGES = [
@@ -2986,7 +3011,7 @@ var createControlPlane = (context) => {
       }
       const path = url.pathname.slice(adminPrefix.length) || "/";
       const shell = request2.method === "GET" && (path === "/ui" || path === "/ui/");
-      if (!shell && context.adminKey !== void 0 && request2.headers.get(ADMIN_KEY_HEADER) !== context.adminKey) {
+      if (!shell && context.adminKey !== void 0 && !hasAdminKey(request2.headers, context.adminKey)) {
         return adminError(401, `missing or wrong ${ADMIN_KEY_HEADER}`);
       }
       for (const route of routes) {
@@ -3769,7 +3794,7 @@ var stateAdminRoutes = (routes) => {
 };
 
 // ../core/dist/version.js
-var PACKAGE_VERSION = true ? "3.10.5" : UNRELEASED_VERSION;
+var PACKAGE_VERSION = true ? "3.10.7" : UNRELEASED_VERSION;
 
 // ../core/dist/webhooks.js
 var json4 = (status, body) => new Response(JSON.stringify(body), {
@@ -4748,7 +4773,7 @@ var createRuntime = (options) => {
         throw error;
       }
       const rewinds = at !== void 0 && selectedBranch === "main" && MUTATING_METHODS.has(request2.method);
-      if ((requested || rewinds) && options.adminKey !== void 0 && request2.headers.get(ADMIN_KEY_HEADER) !== options.adminKey)
+      if ((requested || rewinds) && options.adminKey !== void 0 && !hasAdminKey(request2.headers, options.adminKey))
         return refuse(401, `control headers need ${ADMIN_KEY_HEADER}`);
       controls.ensure(namespace);
       if (requested?.restore !== void 0 && !snapshotStore.get(namespace, requested.restore))
@@ -12669,7 +12694,7 @@ var diffCorpus = (before, after) => {
 };
 
 // src/webhooks.ts
-var encoder = new TextEncoder();
+var encoder2 = new TextEncoder();
 var base64 = (bytes) => {
   let binary = "";
   for (const byte of new Uint8Array(bytes)) binary += String.fromCharCode(byte);
@@ -12694,7 +12719,7 @@ var signSvix = async (secret, messageId, timestampSeconds, body) => {
   const signed = await crypto.subtle.sign(
     "HMAC",
     key,
-    encoder.encode(`${messageId}.${timestampSeconds}.${body}`)
+    encoder2.encode(`${messageId}.${timestampSeconds}.${body}`)
   );
   return `v1,${base64(signed)}`;
 };
@@ -13903,4 +13928,4 @@ export {
   JunctionAPI,
   LabAccountConflict
 };
-//# sourceMappingURL=chunk-VQNDKLJG.js.map
+//# sourceMappingURL=chunk-QCCX6DI7.js.map