@elevasis/core 0.7.0 → 0.8.0

package/src/platform/utils/server/unsubscribe.ts

@@ -1,111 +1,111 @@
-/**
- * Unsubscribe Token Utilities
- *
- * HMAC-based token generation and verification for one-click unsubscribe
- * compliance with RFC 8058 (Gmail/Yahoo/Microsoft requirements).
- *
- * @example
- * ```typescript
- * import { generateUnsubscribeToken, verifyUnsubscribeToken } from '@repo/core/server'
- *
- * // Generate token for email link
- * const token = generateUnsubscribeToken('john@example.com', process.env.UNSUBSCRIBE_SECRET!)
- * const url = `https://api.elevasis.io/api/unsubscribe?email=john@example.com&token=${token}`
- *
- * // Verify token on POST request
- * const isValid = verifyUnsubscribeToken('john@example.com', token, process.env.UNSUBSCRIBE_SECRET!)
- * ```
- */
-
-import crypto from 'crypto'
-
-/**
- * Generate HMAC-SHA256 token for unsubscribe verification
- *
- * Uses first 16 characters of the hash for URL-friendly tokens.
- *
- * @param email - Email address to generate token for
- * @param secret - HMAC secret key (HMAC_SECRET)
- * @returns 16-character hex token
- */
-export function generateUnsubscribeToken(email: string, secret: string): string {
-  return crypto.createHmac('sha256', secret).update(email.toLowerCase().trim()).digest('hex').slice(0, 16)
-}
-
-/**
- * Verify unsubscribe token using timing-safe comparison
- *
- * Prevents timing attacks by using constant-time comparison.
- *
- * @param email - Email address to verify
- * @param token - Token from request
- * @param secret - HMAC secret key (HMAC_SECRET)
- * @returns true if token is valid
- */
-export function verifyUnsubscribeToken(email: string, token: string, secret: string): boolean {
-  const expected = generateUnsubscribeToken(email, secret)
-
-  // Ensure both are same length before comparison
-  if (token.length !== expected.length) {
-    return false
-  }
-
-  const tokenBuf = Buffer.from(token)
-  const expectedBuf = Buffer.from(expected)
-
-  return crypto.timingSafeEqual(tokenBuf, expectedBuf)
-}
-
-/**
- * Generate unsubscribe URL with token
- *
- * @param email - Email address
- * @param secret - HMAC secret key
- * @param baseUrl - Base URL for unsubscribe endpoint (default: production URL)
- * @returns Full unsubscribe URL with email and token query params
- */
-export function generateUnsubscribeUrl(
-  email: string,
-  secret: string,
-  baseUrl = 'https://api.elevasis.io/api/unsubscribe'
-): string {
-  const token = generateUnsubscribeToken(email, secret)
-  const encodedEmail = encodeURIComponent(email.toLowerCase().trim())
-  return `${baseUrl}?email=${encodedEmail}&token=${token}`
-}
-
-/**
- * Generate List-Unsubscribe headers for RFC 8058 compliance
- *
- * Returns headers object to include in Resend email headers parameter.
- *
- * @param email - Recipient email address
- * @param secret - HMAC secret key
- * @param baseUrl - Base URL for unsubscribe endpoint
- * @returns Headers object with List-Unsubscribe and List-Unsubscribe-Post
- *
- * @example
- * ```typescript
- * const headers = generateUnsubscribeHeaders('john@example.com', secret)
- * // Use in Resend:
- * await resend.emails.send({
- *   from: 'sender@domain.com',
- *   to: 'john@example.com',
- *   subject: 'Subject',
- *   html: '<p>Content</p>',
- *   headers
- * })
- * ```
- */
-export function generateUnsubscribeHeaders(
-  email: string,
-  secret: string,
-  baseUrl = 'https://api.elevasis.io/api/unsubscribe'
-): Record<string, string> {
-  const url = generateUnsubscribeUrl(email, secret, baseUrl)
-
-  return {
-    'List-Unsubscribe': `<${url}>`,
-    'List-Unsubscribe-Post': 'List-Unsubscribe=One-Click'
-  }
-}
+/**
+ * Unsubscribe Token Utilities
+ *
+ * HMAC-based token generation and verification for one-click unsubscribe
+ * compliance with RFC 8058 (Gmail/Yahoo/Microsoft requirements).
+ *
+ * @example
+ * ```typescript
+ * import { generateUnsubscribeToken, verifyUnsubscribeToken } from '@repo/core/server'
+ *
+ * // Generate token for email link
+ * const token = generateUnsubscribeToken('john@example.com', process.env.UNSUBSCRIBE_SECRET!)
+ * const url = `https://api.elevasis.io/api/unsubscribe?email=john@example.com&token=${token}`
+ *
+ * // Verify token on POST request
+ * const isValid = verifyUnsubscribeToken('john@example.com', token, process.env.UNSUBSCRIBE_SECRET!)
+ * ```
+ */
+
+import crypto from 'crypto'
+
+/**
+ * Generate HMAC-SHA256 token for unsubscribe verification
+ *
+ * Uses first 16 characters of the hash for URL-friendly tokens.
+ *
+ * @param email - Email address to generate token for
+ * @param secret - HMAC secret key (HMAC_SECRET)
+ * @returns 16-character hex token
+ */
+export function generateUnsubscribeToken(email: string, secret: string): string {
+  return crypto.createHmac('sha256', secret).update(email.toLowerCase().trim()).digest('hex').slice(0, 16)
+}
+
+/**
+ * Verify unsubscribe token using timing-safe comparison
+ *
+ * Prevents timing attacks by using constant-time comparison.
+ *
+ * @param email - Email address to verify
+ * @param token - Token from request
+ * @param secret - HMAC secret key (HMAC_SECRET)
+ * @returns true if token is valid
+ */
+export function verifyUnsubscribeToken(email: string, token: string, secret: string): boolean {
+  const expected = generateUnsubscribeToken(email, secret)
+
+  // Ensure both are same length before comparison
+  if (token.length !== expected.length) {
+    return false
+  }
+
+  const tokenBuf = Buffer.from(token)
+  const expectedBuf = Buffer.from(expected)
+
+  return crypto.timingSafeEqual(tokenBuf, expectedBuf)
+}
+
+/**
+ * Generate unsubscribe URL with token
+ *
+ * @param email - Email address
+ * @param secret - HMAC secret key
+ * @param baseUrl - Base URL for unsubscribe endpoint (default: production URL)
+ * @returns Full unsubscribe URL with email and token query params
+ */
+export function generateUnsubscribeUrl(
+  email: string,
+  secret: string,
+  baseUrl = 'https://api.elevasis.io/api/unsubscribe'
+): string {
+  const token = generateUnsubscribeToken(email, secret)
+  const encodedEmail = encodeURIComponent(email.toLowerCase().trim())
+  return `${baseUrl}?email=${encodedEmail}&token=${token}`
+}
+
+/**
+ * Generate List-Unsubscribe headers for RFC 8058 compliance
+ *
+ * Returns headers object to include in Resend email headers parameter.
+ *
+ * @param email - Recipient email address
+ * @param secret - HMAC secret key
+ * @param baseUrl - Base URL for unsubscribe endpoint
+ * @returns Headers object with List-Unsubscribe and List-Unsubscribe-Post
+ *
+ * @example
+ * ```typescript
+ * const headers = generateUnsubscribeHeaders('john@example.com', secret)
+ * // Use in Resend:
+ * await resend.emails.send({
+ *   from: 'sender@domain.com',
+ *   to: 'john@example.com',
+ *   subject: 'Subject',
+ *   html: '<p>Content</p>',
+ *   headers
+ * })
+ * ```
+ */
+export function generateUnsubscribeHeaders(
+  email: string,
+  secret: string,
+  baseUrl = 'https://api.elevasis.io/api/unsubscribe'
+): Record<string, string> {
+  const url = generateUnsubscribeUrl(email, secret, baseUrl)
+
+  return {
+    'List-Unsubscribe': `<${url}>`,
+    'List-Unsubscribe-Post': 'List-Unsubscribe=One-Click'
+  }
+}

package/src/platform/utils/token-counter.ts

@@ -1,96 +1,96 @@
-/**
- * Token Counter Utility
- * Shared between frontend and backend for consistent validation
- *
- * Uses character-based estimation with safety margin
- * Future: Can be upgraded to tiktoken for exact counts
- */
-
-export interface TokenCountResult {
-  tokens: number
-  characters: number
-  withinLimit: boolean
-}
-
-export interface TokenLimits {
-  maxTokens: number
-  errorMessage?: string
-}
-
-/**
- * Estimate token count from text
- * Uses 1 token ≈ 3.5 characters (improved accuracy)
- *
- * Character-based approximation provides:
- * - Fast estimation (no external dependencies)
- * - ~10-15% error margin for English text
- * - Works for all text types (code, prose, JSON)
- *
- * Note: For exact token counts, use model-specific tokenizers (tiktoken for OpenAI, Anthropic SDK for Claude)
- *
- * @param text - Text to estimate tokens for (string or JSON-serializable object)
- * @returns Estimated token count
- *
- * @example
- * ```typescript
- * estimateTokens("Hello world") // ~3 tokens
- * estimateTokens({ message: "Hello" }) // ~5 tokens (includes JSON structure)
- * ```
- */
-export function estimateTokens(text: string | unknown): number {
-  const content = typeof text === 'string' ? text : JSON.stringify(text)
-  const chars = content.length
-  // 1 token ≈ 3.5 characters (better accuracy than 4 chars with safety margin)
-  return Math.ceil(chars / 3.5)
-}
-
-/**
- * Validate text against token limit
- *
- * @param text - Text to validate (string or JSON-serializable object)
- * @param limits - Token limits configuration
- * @returns Validation result with token count and character count
- *
- * @example
- * ```typescript
- * const result = validateTokenLimit(userInput, { maxTokens: 25000 })
- * if (!result.withinLimit) {
- *   console.error(`Too large: ${result.tokens} tokens (max 25000)`)
- * }
- * ```
- */
-export function validateTokenLimit(text: string | unknown, limits: TokenLimits): TokenCountResult {
-  const content = typeof text === 'string' ? text : JSON.stringify(text)
-  const characters = content.length
-  const tokens = estimateTokens(content)
-
-  return {
-    tokens,
-    characters,
-    withinLimit: tokens <= limits.maxTokens
-  }
-}
-
-/**
- * Common token limits for different use cases
- *
- * Limits are based on:
- * - User experience (reasonable input sizes)
- * - DoS prevention (resource exhaustion)
- * - Model context windows (AI capabilities)
- */
-export const TOKEN_LIMITS = {
-  // User input limits (prompts)
-  USER_MESSAGE: 25000, // ~100KB text - allows large code pastes
-  CHAT_MESSAGE: 10000, // ~40KB text - typical chat message
-
-  // WebSocket message limits
-  WEBSOCKET_MESSAGE: 25000, // Same as user message
-  WEBSOCKET_TOTAL: 250000, // Hard limit for entire payload (1MB)
-
-  // AI model context windows (for reference)
-  GPT4_TURBO: 128000,
-  CLAUDE_SONNET: 200000,
-  GPT35_TURBO: 16385
-} as const
-
+/**
+ * Token Counter Utility
+ * Shared between frontend and backend for consistent validation
+ *
+ * Uses character-based estimation with safety margin
+ * Future: Can be upgraded to tiktoken for exact counts
+ */
+
+export interface TokenCountResult {
+  tokens: number
+  characters: number
+  withinLimit: boolean
+}
+
+export interface TokenLimits {
+  maxTokens: number
+  errorMessage?: string
+}
+
+/**
+ * Estimate token count from text
+ * Uses 1 token ≈ 3.5 characters (improved accuracy)
+ *
+ * Character-based approximation provides:
+ * - Fast estimation (no external dependencies)
+ * - ~10-15% error margin for English text
+ * - Works for all text types (code, prose, JSON)
+ *
+ * Note: For exact token counts, use model-specific tokenizers (tiktoken for OpenAI, Anthropic SDK for Claude)
+ *
+ * @param text - Text to estimate tokens for (string or JSON-serializable object)
+ * @returns Estimated token count
+ *
+ * @example
+ * ```typescript
+ * estimateTokens("Hello world") // ~3 tokens
+ * estimateTokens({ message: "Hello" }) // ~5 tokens (includes JSON structure)
+ * ```
+ */
+export function estimateTokens(text: string | unknown): number {
+  const content = typeof text === 'string' ? text : JSON.stringify(text)
+  const chars = content.length
+  // 1 token ≈ 3.5 characters (better accuracy than 4 chars with safety margin)
+  return Math.ceil(chars / 3.5)
+}
+
+/**
+ * Validate text against token limit
+ *
+ * @param text - Text to validate (string or JSON-serializable object)
+ * @param limits - Token limits configuration
+ * @returns Validation result with token count and character count
+ *
+ * @example
+ * ```typescript
+ * const result = validateTokenLimit(userInput, { maxTokens: 25000 })
+ * if (!result.withinLimit) {
+ *   console.error(`Too large: ${result.tokens} tokens (max 25000)`)
+ * }
+ * ```
+ */
+export function validateTokenLimit(text: string | unknown, limits: TokenLimits): TokenCountResult {
+  const content = typeof text === 'string' ? text : JSON.stringify(text)
+  const characters = content.length
+  const tokens = estimateTokens(content)
+
+  return {
+    tokens,
+    characters,
+    withinLimit: tokens <= limits.maxTokens
+  }
+}
+
+/**
+ * Common token limits for different use cases
+ *
+ * Limits are based on:
+ * - User experience (reasonable input sizes)
+ * - DoS prevention (resource exhaustion)
+ * - Model context windows (AI capabilities)
+ */
+export const TOKEN_LIMITS = {
+  // User input limits (prompts)
+  USER_MESSAGE: 25000, // ~100KB text - allows large code pastes
+  CHAT_MESSAGE: 10000, // ~40KB text - typical chat message
+
+  // WebSocket message limits
+  WEBSOCKET_MESSAGE: 25000, // Same as user message
+  WEBSOCKET_TOTAL: 250000, // Hard limit for entire payload (1MB)
+
+  // AI model context windows (for reference)
+  GPT4_TURBO: 128000,
+  CLAUDE_SONNET: 200000,
+  GPT35_TURBO: 16385
+} as const
+