@kindgi/types 0.1.5 → 0.1.6-rc.0

package/dist/header-value.d.ts

@@ -0,0 +1,9 @@
+/** Why fetch can't send `value` in a header, or `undefined` when it can. */
+export declare function headerValueProblem(value: string): string | undefined;
+/**
+ * Why fetch can't send `Bearer <token>` in `Authorization`, or `undefined`
+ * when it can: the token checked as it's sent, after `Bearer `, where a
+ * leading line break is an inner one.
+ */
+export declare function bearerValueProblem(token: string): string | undefined;
+//# sourceMappingURL=header-value.d.ts.map

package/dist/header-value.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"header-value.d.ts","sourceRoot":"","sources":["../src/header-value.ts"],"names":[],"mappings":"AAoBA,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CASpE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEpE"}

package/dist/header-value.js

@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * Whether fetch can send a value in a header. Fetch trims leading and
+ * trailing whitespace (tab, space, CR, LF), then throws on a NUL or a line
+ * break with an error that quotes the value: `Headers.append: "<value>" is an
+ * invalid header value.` It throws on a character above U+00FF too, and the
+ * request refuses any other control character. A secret sent in a header is
+ * checked with this first, so a bad one is refused by the header's name and
+ * never quoted into an error, a log or a run.
+ *
+ * Check the value **as it's sent**: `Bearer ` and a secret that starts with a
+ * line break make that break an inner one, which fetch refuses
+ * (`bearerValueProblem`).
+ */
+/** Leading and trailing HTTP whitespace, which fetch trims before it checks. */
+const EDGE_WHITESPACE = /^[\t\n\r ]+|[\t\n\r ]+$/g;
+/** Why fetch can't send `value` in a header, or `undefined` when it can. */
+export function headerValueProblem(value) {
+    const sent = value.replace(EDGE_WHITESPACE, '');
+    for (let i = 0; i < sent.length; i++) {
+        const code = sent.charCodeAt(i);
+        if (code === 0x0a || code === 0x0d)
+            return 'a line break';
+        if (code > 0xff)
+            return 'a character above U+00FF';
+        if ((code < 0x20 && code !== 0x09) || code === 0x7f)
+            return 'a control character';
+    }
+    return undefined;
+}
+/**
+ * Why fetch can't send `Bearer <token>` in `Authorization`, or `undefined`
+ * when it can: the token checked as it's sent, after `Bearer `, where a
+ * leading line break is an inner one.
+ */
+export function bearerValueProblem(token) {
+    return headerValueProblem(`Bearer ${token}`);
+}
+//# sourceMappingURL=header-value.js.map

package/dist/header-value.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"header-value.js","sourceRoot":"","sources":["../src/header-value.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;GAYG;AAEH,gFAAgF;AAChF,MAAM,eAAe,GAAG,0BAA0B,CAAC;AAEnD,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IAChD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,cAAc,CAAC;QAC1D,IAAI,IAAI,GAAG,IAAI;YAAE,OAAO,0BAA0B,CAAC;QACnD,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,qBAAqB,CAAC;IACpF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,kBAAkB,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;AAC/C,CAAC"}

package/dist/index.d.ts

@@ -7,4 +7,5 @@ export type * from './result.js';
 export type * from './temporal.js';
 export type * from './version.js';
 export { makeEnvName } from './ids.js';
+export { bearerValueProblem, headerValueProblem } from './header-value.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,mBAAmB,aAAa,CAAC;AACjC,mBAAmB,WAAW,CAAC;AAC/B,mBAAmB,UAAU,CAAC;AAC9B,mBAAmB,WAAW,CAAC;AAC/B,mBAAmB,WAAW,CAAC;AAC/B,mBAAmB,aAAa,CAAC;AACjC,mBAAmB,eAAe,CAAC;AACnC,mBAAmB,cAAc,CAAC;AAKlC,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,mBAAmB,aAAa,CAAC;AACjC,mBAAmB,WAAW,CAAC;AAC/B,mBAAmB,UAAU,CAAC;AAC9B,mBAAmB,WAAW,CAAC;AAC/B,mBAAmB,WAAW,CAAC;AAC/B,mBAAmB,aAAa,CAAC;AACjC,mBAAmB,eAAe,CAAC;AACnC,mBAAmB,cAAc,CAAC;AAKlC,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAIvC,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/index.js

@@ -4,4 +4,7 @@
 // separate value re-export so the `export type *` barrels above stay
 // pure-type — value exports live only where explicitly listed.
 export { makeEnvName } from './ids.js';
+// Whether fetch can send a value in a header: a secret is checked by its
+// header's name before fetch, whose own error would quote it.
+export { bearerValueProblem, headerValueProblem } from './header-value.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAWjC,uEAAuE;AACvE,qEAAqE;AACrE,+DAA+D;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAWjC,uEAAuE;AACvE,qEAAqE;AACrE,+DAA+D;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEvC,yEAAyE;AACzE,8DAA8D;AAC9D,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kindgi/types",
-  "version": "0.1.5",
+  "version": "0.1.6-rc.0",
   "description": "Foundational TypeScript types shared across Kindgi. Branded IDs, timestamps, hashes, refs, Result, list filter / page shapes. Zero runtime dependencies; the only runtime export is the makeEnvName validator.",
   "license": "Apache-2.0",
   "repository": {

package/src/header-value.ts

@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+
+/**
+ * Whether fetch can send a value in a header. Fetch trims leading and
+ * trailing whitespace (tab, space, CR, LF), then throws on a NUL or a line
+ * break with an error that quotes the value: `Headers.append: "<value>" is an
+ * invalid header value.` It throws on a character above U+00FF too, and the
+ * request refuses any other control character. A secret sent in a header is
+ * checked with this first, so a bad one is refused by the header's name and
+ * never quoted into an error, a log or a run.
+ *
+ * Check the value **as it's sent**: `Bearer ` and a secret that starts with a
+ * line break make that break an inner one, which fetch refuses
+ * (`bearerValueProblem`).
+ */
+
+/** Leading and trailing HTTP whitespace, which fetch trims before it checks. */
+const EDGE_WHITESPACE = /^[\t\n\r ]+|[\t\n\r ]+$/g;
+
+/** Why fetch can't send `value` in a header, or `undefined` when it can. */
+export function headerValueProblem(value: string): string | undefined {
+  const sent = value.replace(EDGE_WHITESPACE, '');
+  for (let i = 0; i < sent.length; i++) {
+    const code = sent.charCodeAt(i);
+    if (code === 0x0a || code === 0x0d) return 'a line break';
+    if (code > 0xff) return 'a character above U+00FF';
+    if ((code < 0x20 && code !== 0x09) || code === 0x7f) return 'a control character';
+  }
+  return undefined;
+}
+
+/**
+ * Why fetch can't send `Bearer <token>` in `Authorization`, or `undefined`
+ * when it can: the token checked as it's sent, after `Bearer `, where a
+ * leading line break is an inner one.
+ */
+export function bearerValueProblem(token: string): string | undefined {
+  return headerValueProblem(`Bearer ${token}`);
+}

package/src/index.ts

@@ -14,3 +14,7 @@ export type * from './version.js';
 // separate value re-export so the `export type *` barrels above stay
 // pure-type — value exports live only where explicitly listed.
 export { makeEnvName } from './ids.js';
+
+// Whether fetch can send a value in a header: a secret is checked by its
+// header's name before fetch, whose own error would quote it.
+export { bearerValueProblem, headerValueProblem } from './header-value.js';