@kumix/utils 0.1.0 → 0.1.2

package/dist/index.js

@@ -1,6 +1,5 @@
-import { a as NODE_ENV, c as isProduction, i as LOG_LEVEL, l as isStaging, n as API_PORT, o as PORT, r as DEBUG, s as isDevelopment, t as logger, u as getEnv } from "./logger-BOB35dQN.js";
+import { a as NODE_ENV, c as isProduction, d as getEnv, i as LOG_LEVEL, l as isStaging, n as API_PORT, o as PORT, r as DEBUG, s as isDevelopment, t as logger, u as isTest } from "./logger-qDWnDXis.js";
 import slugify, { default as slugify$1 } from "@sindresorhus/slugify";
-import baseX from "base-x";
 import { createId, init } from "@paralleldrive/cuid2";
 import { customAlphabet } from "nanoid";
 import ms from "ms";
@@ -551,31 +550,30 @@ const EU_COUNTRY_CODES = [
 	"AT",
 	"BE",
 	"BG",
+	"HR",
 	"CY",
 	"CZ",
-	"DE",
 	"DK",
 	"EE",
-	"ES",
 	"FI",
 	"FR",
-	"GB",
+	"DE",
 	"GR",
-	"HR",
 	"HU",
 	"IE",
 	"IT",
+	"LV",
 	"LT",
 	"LU",
-	"LV",
 	"MT",
 	"NL",
 	"PL",
 	"PT",
 	"RO",
-	"SE",
+	"SK",
 	"SI",
-	"SK"
+	"ES",
+	"SE"
 ];
 //#endregion
 //#region src/constants/country/country-phone-codes.ts
@@ -1149,7 +1147,7 @@ const REGIONS = {
 	"BY-VI": "Vitsyebskaya voblasts'",
 	"BE-BRU": "Brussels Hoofdstedelijk Gewest",
 	"BE-VLG": "Vlaams Gewest",
-	"BE-WAL": "Waals Gewest[note 2]",
+	"BE-WAL": "Waals Gewest",
 	"BZ-BZ": "Belize",
 	"BZ-CY": "Cayo",
 	"BZ-CZL": "Corozal",
@@ -1981,7 +1979,7 @@ const REGIONS = {
 	"IN-BR": "Bihār",
 	"IN-CH": "Chandīgarh",
 	"IN-CG": "Chhattīsgarh",
-	"IN-DH": "Dādra and Nagar Haveli and Damān and Diu[1]",
+	"IN-DH": "Dādra and Nagar Haveli and Damān and Diu",
 	"IN-DL": "Delhi",
 	"IN-GA": "Goa",
 	"IN-GJ": "Gujarāt",
@@ -2005,7 +2003,7 @@ const REGIONS = {
 	"IN-RJ": "Rājasthān",
 	"IN-SK": "Sikkim",
 	"IN-TN": "Tamil Nādu",
-	"IN-TS": "Telangāna[2]",
+	"IN-TS": "Telangāna",
 	"IN-TR": "Tripura",
 	"IN-UP": "Uttar Pradesh",
 	"IN-UK": "Uttarākhand",
@@ -2070,7 +2068,7 @@ const REGIONS = {
 	"IE-C": "Connaught",
 	"IE-L": "Leinster",
 	"IE-M": "Munster",
-	"IE-U": "Ulster[a]",
+	"IE-U": "Ulster",
 	"IL-D": "HaDarom",
 	"IL-M": "HaMerkaz",
 	"IL-Z": "HaTsafon",
@@ -3084,7 +3082,7 @@ const REGIONS = {
 	"PE-TAC": "Tacna",
 	"PE-TUM": "Tumbes",
 	"PE-UCA": "Ucayali",
-	"PH-14": "Autonomous Region in Muslim Mindanao[b]",
+	"PH-14": "Autonomous Region in Muslim Mindanao",
 	"PH-05": "Bicol",
 	"PH-02": "Cagayan Valley",
 	"PH-40": "Calabarzon",
@@ -4366,7 +4364,7 @@ const REGIONS = {
 	"ME-20": "Ulcinj",
 	"ME-21": "Žabljak",
 	"ME-25": "Zeta",
-	"RS-KM": "Kosovo-Metohija[1]",
+	"RS-KM": "Kosovo-Metohija",
 	"RS-VO": "Vojvodina",
 	"SS-EC": "Central Equatoria",
 	"SS-EE": "Eastern Equatoria",
@@ -4387,8 +4385,12 @@ const REGION_CODES = Object.keys(REGIONS);
 * Provides a comprehensive set of all country-specific domain extensions
 */
 /**
-* A Set containing all country code top-level domains (ccTLDs)
-* Used for domain validation, parsing, and identification
+* A Set containing ISO 3166-1 alpha-2 country code top-level domains (ccTLDs),
+* plus a small set of commonly-recognized regional TLDs (`eu`, `eus`, `gal`,
+* `cat`, `asia`). De-duplicated and pruned of retired/withdrawn codes:
+*   - `an` (Netherlands Antilles, retired 2010)
+*   - `tp` (Timor-Leste, retired 2015 — use `tl`)
+* `gb` is included alongside `uk` per IANA reservation.
 *
 * @example
 * ```ts
@@ -4401,286 +4403,261 @@ const REGION_CODES = Object.keys(REGIONS);
 * const domain = 'example.co.uk';
 * const tld = domain.split('.').pop();
 * const isCountryDomain = tld ? ccTLDs.has(tld) : false; // true
-*
-* // Filter domains by ccTLD
-* const domains = ['example.com', 'example.co.uk', 'example.org'];
-* const countryDomains = domains.filter(domain => {
-*   const tld = domain.split('.').pop();
-*   return tld ? ccTLDs.has(tld) : false;
-* }); // ['example.co.uk']
 * ```
 */
 const ccTLDs = /* @__PURE__ */ new Set([
+	"ac",
+	"ad",
+	"ae",
 	"af",
-	"ax",
+	"ag",
+	"ai",
 	"al",
-	"dz",
-	"as",
-	"ad",
+	"am",
 	"ao",
-	"ai",
 	"aq",
-	"ag",
 	"ar",
-	"am",
-	"aw",
-	"ac",
-	"au",
+	"as",
 	"at",
+	"au",
+	"aw",
+	"ax",
 	"az",
-	"bs",
-	"bh",
-	"bd",
+	"ba",
 	"bb",
-	"eus",
-	"by",
+	"bd",
 	"be",
-	"bz",
+	"bf",
+	"bg",
+	"bh",
+	"bi",
 	"bj",
+	"bl",
 	"bm",
-	"bt",
+	"bn",
 	"bo",
 	"bq",
-	"an",
-	"nl",
-	"ba",
-	"bw",
-	"bv",
 	"br",
-	"io",
-	"vg",
-	"bn",
-	"bg",
-	"bf",
-	"mm",
-	"bi",
-	"kh",
-	"cm",
+	"bs",
+	"bt",
+	"bv",
+	"bw",
+	"by",
+	"bz",
 	"ca",
-	"cv",
 	"cat",
-	"ky",
-	"cf",
-	"td",
-	"cl",
-	"cn",
-	"cx",
 	"cc",
-	"co",
-	"km",
 	"cd",
+	"cf",
 	"cg",
+	"ch",
+	"ci",
 	"ck",
+	"cl",
+	"cm",
+	"cn",
+	"co",
 	"cr",
-	"ci",
-	"hr",
 	"cu",
+	"cv",
 	"cw",
+	"cx",
 	"cy",
 	"cz",
-	"dk",
+	"de",
 	"dj",
+	"dk",
 	"dm",
 	"do",
-	"tl",
-	"tp",
+	"dz",
 	"ec",
+	"ee",
 	"eg",
-	"sv",
-	"gq",
+	"eh",
 	"er",
-	"ee",
+	"es",
 	"et",
 	"eu",
+	"eus",
+	"fi",
+	"fj",
 	"fk",
-	"fo",
 	"fm",
-	"fj",
-	"fi",
+	"fo",
 	"fr",
-	"gf",
-	"pf",
-	"tf",
 	"ga",
 	"gal",
-	"gm",
-	"ps",
+	"gb",
+	"gd",
 	"ge",
-	"de",
+	"gf",
+	"gg",
 	"gh",
 	"gi",
-	"gr",
 	"gl",
-	"gd",
+	"gm",
+	"gn",
 	"gp",
-	"gu",
+	"gq",
+	"gr",
+	"gs",
 	"gt",
-	"gg",
-	"gn",
+	"gu",
 	"gw",
 	"gy",
-	"ht",
+	"hk",
 	"hm",
 	"hn",
-	"hk",
+	"hr",
+	"ht",
 	"hu",
-	"is",
-	"in",
 	"id",
-	"ir",
-	"iq",
 	"ie",
-	"im",
 	"il",
+	"im",
+	"in",
+	"io",
+	"iq",
+	"ir",
+	"is",
 	"it",
-	"jm",
-	"jp",
 	"je",
+	"jm",
 	"jo",
-	"kz",
+	"jp",
 	"ke",
+	"kg",
+	"kh",
 	"ki",
+	"km",
+	"kn",
+	"kp",
+	"kr",
 	"kw",
-	"kg",
+	"ky",
+	"kz",
 	"la",
-	"lv",
 	"lb",
-	"ls",
-	"lr",
-	"ly",
+	"lc",
 	"li",
+	"lk",
+	"lr",
+	"ls",
 	"lt",
 	"lu",
-	"mo",
-	"mk",
+	"lv",
+	"ly",
+	"ma",
+	"mc",
+	"md",
+	"me",
+	"mf",
 	"mg",
-	"mw",
-	"my",
-	"mv",
-	"ml",
-	"mt",
 	"mh",
+	"mk",
+	"ml",
+	"mm",
+	"mn",
+	"mo",
+	"mp",
 	"mq",
 	"mr",
+	"ms",
+	"mt",
 	"mu",
-	"yt",
+	"mv",
+	"mw",
 	"mx",
-	"md",
-	"mc",
-	"mn",
-	"me",
-	"ms",
-	"ma",
+	"my",
 	"mz",
-	"mm",
 	"na",
-	"nr",
-	"np",
-	"nl",
 	"nc",
-	"nz",
-	"ni",
 	"ne",
-	"ng",
-	"nu",
 	"nf",
-	"nc",
-	"tr",
-	"kp",
-	"mp",
+	"ng",
+	"ni",
+	"nl",
 	"no",
+	"np",
+	"nr",
+	"nu",
+	"nz",
 	"om",
-	"pk",
-	"pw",
-	"ps",
 	"pa",
-	"pg",
-	"py",
 	"pe",
+	"pf",
+	"pg",
 	"ph",
-	"pn",
+	"pk",
 	"pl",
-	"pt",
+	"pm",
+	"pn",
 	"pr",
+	"ps",
+	"pt",
+	"pw",
+	"py",
 	"qa",
+	"re",
 	"ro",
+	"rs",
 	"ru",
 	"rw",
-	"re",
-	"bq",
-	"an",
-	"bl",
-	"gp",
-	"fr",
-	"sh",
-	"kn",
-	"lc",
-	"mf",
-	"gp",
-	"fr",
-	"pm",
-	"vc",
-	"ws",
-	"sm",
-	"st",
 	"sa",
-	"sn",
-	"rs",
+	"sb",
 	"sc",
-	"sl",
+	"sd",
+	"se",
 	"sg",
-	"bq",
-	"an",
-	"nl",
-	"sx",
-	"an",
-	"sk",
+	"sh",
 	"si",
-	"sb",
-	"so",
+	"sj",
+	"sk",
+	"sl",
+	"sm",
+	"sn",
 	"so",
-	"za",
-	"gs",
-	"kr",
-	"ss",
-	"es",
-	"lk",
-	"sd",
 	"sr",
-	"sj",
-	"sz",
-	"se",
-	"ch",
+	"ss",
+	"st",
+	"sv",
+	"sx",
 	"sy",
-	"tw",
-	"tj",
-	"tz",
-	"th",
+	"sz",
+	"tc",
+	"td",
+	"tf",
 	"tg",
+	"th",
+	"tj",
 	"tk",
-	"to",
-	"tt",
+	"tl",
+	"tm",
 	"tn",
+	"to",
 	"tr",
-	"tm",
-	"tc",
+	"tt",
 	"tv",
-	"ug",
+	"tw",
+	"tz",
 	"ua",
-	"ae",
+	"ug",
 	"uk",
+	"um",
 	"us",
-	"vi",
 	"uy",
 	"uz",
-	"vu",
 	"va",
+	"vc",
 	"ve",
+	"vg",
+	"vi",
 	"vn",
+	"vu",
 	"wf",
-	"eh",
-	"ma",
+	"ws",
 	"ye",
+	"za",
 	"zm",
 	"zw"
 ]);
@@ -4827,6 +4804,15 @@ const DEFAULT_THEME_MODE = THEME_MODES.SYSTEM;
 */
 const NEXT_PUBLIC_RECAPTCHA_SITE_KEY = getEnv("NEXT_PUBLIC_RECAPTCHA_SITE_KEY");
 /**
+* Recaptcha secret key for server-side token verification.
+* Used by verifyRecaptchaToken to call Google's siteverify endpoint.
+* Must NOT be exposed to the client (no NEXT_PUBLIC prefix).
+*
+* @example
+* const isValid = await verifyRecaptchaToken(token);
+*/
+const RECAPTCHA_SECRET_KEY = getEnv("RECAPTCHA_SECRET_KEY");
+/**
 * Slack webhook URLs for different log types.
 * Used for sending log messages to specific Slack channels based on log category.
 *
@@ -4853,7 +4839,7 @@ const SLACK_WEBHOOKS = {
 * @example
 * <img src={OG_AVATAR_URL + userId} />
 */
-const OG_AVATAR_URL = "https://api.kumix.com/og/avatar/";
+const OG_AVATAR_URL = "https://api.kumix.io/og/avatar/";
 /**
 * Default pagination limit for API responses and UI lists.
 *
@@ -5063,7 +5049,7 @@ const LOCALHOST_GEO_DATA = {
 * }
 * ```
 */
-const LOCALHOST_IP = "63.141.57.109";
+const LOCALHOST_IP = "198.51.100.1";
 //#endregion
 //#region src/constants/reserved-slugs.ts
 /**
@@ -5239,15 +5225,18 @@ const googleTrackEvent = ({ name, properties }) => {
 	}
 };
 /**
-* Helper function to safely get component name from path.
+* Helper function to safely get the first path segment (component category)
+* from a component path. For "ui/buttons/Button" this returns "ui".
 *
 * @param componentPath - Component path string
-* @returns Component name or original path if invalid
+* @returns First segment of the path, or "unknown" if invalid
 */
 const getComponentName = (componentPath) => {
 	if (!componentPath || typeof componentPath !== "string") return "unknown";
-	const parts = componentPath.trim().split("/");
-	return parts.length > 1 ? parts[0] : componentPath.trim();
+	const trimmed = componentPath.trim();
+	if (!trimmed) return "unknown";
+	const firstSlash = trimmed.indexOf("/");
+	return firstSlash === -1 ? trimmed : trimmed.slice(0, firstSlash);
 };
 /**
 * Tracks code copy events with validation.
@@ -5544,6 +5533,7 @@ const googleTrackItemRestore = (module, itemType, itemId) => {
 * ```
 */
 const chunk = (array, chunk_size) => {
+	if (chunk_size <= 0) return [];
 	return array.reduce((resultArray, item, index) => {
 		const chunkIndex = Math.floor(index / chunk_size);
 		if (!resultArray[chunkIndex]) resultArray[chunkIndex] = [];
@@ -5648,15 +5638,17 @@ const stableSort = (arr, compare) => arr.map((item, index) => ({
 * Asset URL builder utilities
 * Provides helpers to construct absolute asset URLs against a configurable asset host.
 */
-const DEFAULT_ASSET_HOST = getEnv("NEXT_PUBLIC_ASSETS_URL") || getEnv("VITE_ASSETS_URL") || "https://assets.kumix.com";
+const DEFAULT_ASSET_HOST = getEnv("NEXT_PUBLIC_ASSETS_URL") || getEnv("VITE_ASSETS_URL") || "https://assets.kumix.io";
 /**
 * Builds an absolute URL for a given asset path using the provided asset host (CDN) base.
 * Accepts relative paths (e.g., `logo/logo.png`, `/images/icon.svg`) and returns a fully-qualified URL.
 * If an absolute URL is provided as `path`, it will be returned as-is (host is ignored).
 *
 * @param path - Asset path or absolute URL to resolve
-* @param host - Optional asset host (base URL). Defaults to `https://assets.kumix.com`
-* @returns A fully-qualified asset URL string, or `null` if inputs are invalid
+* @param host - Optional asset host (base URL). Defaults to `https://assets.kumix.io`
+* @returns A fully-qualified asset URL string. On invalid input (empty path or
+*   malformed base), falls back to the configured asset host rather than
+*   throwing — call sites that need strict failure should validate inputs first.
 *
 * @example
 * ```ts
@@ -5664,7 +5656,7 @@ const DEFAULT_ASSET_HOST = getEnv("NEXT_PUBLIC_ASSETS_URL") || getEnv("VITE_ASSE
 *
 * // Default host
 * const u1 = assetsUrl('logo/logo.png');
-* // 'https://assets.kumix.com/logo/logo.png'
+* // 'https://assets.kumix.io/logo/logo.png'
 *
 * // Custom host (full URL)
 * const u2 = assetsUrl('/images/icon.svg', 'https://cdn.example.com');
@@ -5678,16 +5670,16 @@ const DEFAULT_ASSET_HOST = getEnv("NEXT_PUBLIC_ASSETS_URL") || getEnv("VITE_ASSE
 * const u4 = assetsUrl('https://other.com/a.png', 'https://cdn.example.com');
 * // 'https://other.com/a.png'
 *
-* // Edge cases
+* // Edge cases — falsy path or malformed base returns the configured asset host
 * const u5 = assetsUrl('');
-* // null
+* // 'https://assets.kumix.io' (the configured host)
 *
 * const u6 = assetsUrl('logo.png', '://bad-host');
-* // null (invalid base)
+* // '://bad-host' (the supplied host — invalid, returned as-is)
 * ```
 */
 function assetsUrl(path, host = DEFAULT_ASSET_HOST) {
-	const BASE_HOST = (getEnv("NEXT_PUBLIC_ASSETS_URL") || getEnv("VITE_ASSETS_URL")) ?? host;
+	const BASE_HOST = host;
 	if (!path || typeof path !== "string") return BASE_HOST;
 	try {
 		const base = /^https?:\/\//i.test(BASE_HOST) ? BASE_HOST : `https://${BASE_HOST}`;
@@ -5711,17 +5703,18 @@ function assetsUrl(path, host = DEFAULT_ASSET_HOST) {
 * import { getFlagUrl } from "@kumix/ui/utils/flag-url";
 *
 * const urlUs = getFlagUrl("US");
-* // "https://assets.kumix.com/media/flags/us.svg"
+* // "https://assets.kumix.io/media/flags/us.svg"
 *
 * const urlId = getFlagUrl("id");
-* // "https://assets.kumix.com/media/flags/id.svg"
+* // "https://assets.kumix.io/media/flags/id.svg"
 *
 * // Can be used directly in an <img /> or <Image /> component
 * // <img src={getFlagUrl("GB")} alt="United Kingdom flag" />
 * ```
 */
 function getFlagUrl(flag) {
-	const flagCode = flag.toLowerCase();
+	if (typeof flag !== "string" || !flag.trim()) return `${assetsUrl("media/flags")}/unknown.svg`;
+	const flagCode = flag.trim().toLowerCase();
 	return `${assetsUrl("media/flags")}/${flagCode}.svg`;
 }
 //#endregion
@@ -5791,7 +5784,7 @@ function mapLocale(locale) {
 * Supports Open Graph, Twitter cards, icons, canonical URLs, robots, manifest, and multi-language alternates.
 *
 * @param params - Metadata construction options
-* @param params.baseUrl - The base URL/domain for metadataBase (optional, e.g., 'https://kumix.com')
+* @param params.baseUrl - The base URL/domain for metadataBase (optional, e.g., 'https://kumix.io')
 * @param params.title - The base title for the page (used in Open Graph and Twitter)
 * @param params.fullTitle - The full title for the page (overrides title in the <title> tag)
 * @param params.description - Description of the page (used in meta, Open Graph, Twitter)
@@ -5835,8 +5828,8 @@ function mapLocale(locale) {
 *     creator: '@lukmanaviccena',
 *   },
 *   alternateLanguages: {
-*     en: 'https://kumix.com/en',
-*     id: 'https://kumix.com/id',
+*     en: 'https://kumix.io/en',
+*     id: 'https://kumix.io/id',
 *   },
 *   icons: [
 *     { rel: 'icon', url: '/favicon.ico' },
@@ -5890,8 +5883,14 @@ function constructMetadata({ baseUrl, title, fullTitle, description, icons = [
 	type: "website",
 	locale: "en_US"
 }, twitter = {}, canonicalUrl, alternateLanguages, noIndex = false, noArchive = false, noSnippet = false, manifest }) {
+	let metadataBase;
+	if (baseUrl) try {
+		metadataBase = new URL(baseUrl);
+	} catch {
+		metadataBase = void 0;
+	}
 	return {
-		metadataBase: baseUrl ? new URL(baseUrl) : void 0,
+		metadataBase,
 		title: fullTitle || title,
 		description,
 		icons,
@@ -6507,7 +6506,6 @@ const resizeImage = (file, opts = {
 		const reader = new FileReader();
 		reader.onload = (e) => {
 			const img = new Image();
-			img.src = e.target?.result;
 			img.onload = () => {
 				const targetWidth = opts.width;
 				const targetHeight = opts.height;
@@ -6537,6 +6535,7 @@ const resizeImage = (file, opts = {
 				resolve(canvas.toDataURL("image/jpeg", opts.quality));
 			};
 			img.onerror = (error) => reject(/* @__PURE__ */ new Error(`Image loading error: ${error}`));
+			img.src = e.target?.result;
 		};
 		reader.onerror = (error) => reject(/* @__PURE__ */ new Error(`FileReader error: ${error}`));
 		reader.readAsDataURL(file);
@@ -6630,11 +6629,11 @@ async function loadImage(file) {
 	return new Promise((resolve, reject) => {
 		const image = new Image();
 		const reader = new FileReader();
+		image.onload = () => resolve(image);
+		image.onerror = (err) => reject(err);
 		reader.onload = (e) => {
 			image.src = e.target?.result;
 		};
-		image.onload = () => resolve(image);
-		image.onerror = (err) => reject(err);
 		reader.readAsDataURL(file);
 	});
 }
@@ -6804,11 +6803,28 @@ const hasStorageItem = (key, storageType = "localStorage") => {
 };
 //#endregion
 //#region src/functions/crypto/base-id.ts
-/**
-* Utility functions for generating unique, time-sortable IDs
-* Provides ULID-compatible ID generation with custom prefixes for entity identification
-*/
-const base32 = baseX("0123456789ABCDEFGHJKMNPQRSTVWXYZ");
+const CROCKFORD = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+/**
+* Encodes a 16-byte (128-bit) buffer into a fixed-length 26-character
+* Crockford base32 ULID string. Unlike big-number base encoders, this pads
+* the output to a constant length so IDs remain lexicographically sortable
+* regardless of leading zero bytes.
+*/
+function encodeULID(buf) {
+	let bits = 0;
+	let value = 0;
+	let output = "";
+	for (let i = 0; i < buf.length; i++) {
+		value = value << 8 | buf[i];
+		bits += 8;
+		while (bits >= 5) {
+			bits -= 5;
+			output += CROCKFORD[value >>> bits & 31];
+		}
+	}
+	if (bits > 0) output += CROCKFORD[value << 5 - bits & 31];
+	return output;
+}
 /**
 * Creates a ULID-compatible buffer (48 bits timestamp + 80 bits randomness)
 *
@@ -6848,8 +6864,7 @@ function createULIDBuffer() {
 * ```
 */
 const baseIdCustom = ({ prefix }) => {
-	const buf = createULIDBuffer();
-	return `${prefix}${base32.encode(buf)}`;
+	return `${prefix}${encodeULID(createULIDBuffer())}`;
 };
 /**
 * Creates a unique, time-sortable ID with a known prefix from the predefined set
@@ -6885,6 +6900,15 @@ const baseId = ({ prefix }) => baseIdCustom({ prefix });
 * CUID (Collision-resistant Unique IDentifier) generation utilities
 * Provides functions for generating unique identifiers using @paralleldrive/cuid2
 */
+const generatorCache = /* @__PURE__ */ new Map();
+function getGenerator(length) {
+	let generator = generatorCache.get(length);
+	if (!generator) {
+		generator = init({ length });
+		generatorCache.set(length, generator);
+	}
+	return generator;
+}
 /**
 * Generates a CUID (Collision-resistant Unique IDentifier)
 * CUIDs are designed to be globally unique, even in distributed systems.
@@ -6921,10 +6945,8 @@ function cuid() {
 	return createId();
 }
 /**
-* Generates a custom ID with an optional prefix and configurable length
-* This function uses `@paralleldrive/cuid2` to create unique identifiers
-* with an optional prefix. Useful for creating IDs with specific patterns
-* like `user_abc123` or `order_987xyz`.
+* Generates a custom ID with an optional prefix and configurable length.
+* Uses `@paralleldrive/cuid2`'s cryptographically-secure RNG.
 *
 * @param prefix - Optional prefix to prepend to the ID
 * @param length - The length of the generated ID (default is 12)
@@ -6932,40 +6954,25 @@ function cuid() {
 *
 * @example
 * ```ts
-* import { customeId } from '@/utils/functions';
+* import { customId } from '@/utils/functions';
 *
 * // Generate ID with prefix
-* const userId = customeId('user_');
+* const userId = customId('user_');
 * // Returns: 'user_l5r8xn2gzqnb'
 *
 * // Generate ID with custom length
-* const orderId = customeId('order_', 16);
-* // Returns: 'order_l5r8xn2gzqnbf4r2'
-*
-* // Generate ID without prefix
-* const randomId = customeId();
-* // Returns: 'l5r8xn2gzqnb'
-*
-* // Use for different entity types
-* const productId = customeId('prod_', 8);
-* const invoiceId = customeId('inv_', 10);
-* const sessionId = customeId('sess_', 20);
-*
-* // Use in API responses
-* const apiResponse = {
-*   id: customeId('api_'),
-*   timestamp: Date.now(),
-*   data: {...}
-* };
+* const orderId = customId('order_', 16);
 * ```
 */
-function customeId(prefix, length = 12) {
-	const generateId = init({
-		random: Math.random,
-		length
-	});
+function customId(prefix, length = 12) {
+	const generateId = getGenerator(length);
 	return `${prefix || ""}${generateId()}`;
 }
+/**
+* @deprecated Use {@link customId} instead. This alias has a typo and is kept
+* only for backward compatibility; it will be removed in a future major.
+*/
+const customeId = customId;
 //#endregion
 //#region src/functions/crypto/hash-string.ts
 /**
@@ -7011,6 +7018,8 @@ async function hashStringSHA256(str) {
 * Utility function for generating unique IDs
 * Provides a wrapper around nanoid for consistent ID generation
 */
+const DEFAULT_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+const DEFAULT_SIZE = 7;
 /**
 * Generates a random alphanumeric ID of specified length
 * Uses a custom alphabet of numbers and letters (both cases)
@@ -7036,7 +7045,7 @@ async function hashStringSHA256(str) {
 * ```
 */
 const nanoid = (chars) => {
-	return customAlphabet("0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz", chars || 7)();
+	return customAlphabet(DEFAULT_ALPHABET, chars || DEFAULT_SIZE)();
 };
 /**
 * Generates a unique identifier using the current timestamp and a random number
@@ -7067,7 +7076,8 @@ const nanoid = (chars) => {
 * ```
 */
 function uid() {
-	return (Date.now() + Math.floor(Math.random() * 1e3)).toString();
+	const random = Math.floor(Math.random() * 1e3).toString().padStart(3, "0");
+	return `${Date.now()}${random}`;
 }
 //#endregion
 //#region src/functions/datetime/billing-utils.ts
@@ -7216,8 +7226,9 @@ const getBillingStartDate = (billingCycleStart, referenceDate = /* @__PURE__ */
 * ```
 */
 const formatDate = (datetime, options, locale = "en-US") => {
-	if (datetime.toString() === "Invalid Date") return "";
-	return new Date(datetime).toLocaleDateString(locale, {
+	const date = new Date(datetime);
+	if (Number.isNaN(date.getTime())) return "";
+	return date.toLocaleDateString(locale, {
 		day: "numeric",
 		month: "long",
 		year: "numeric",
@@ -7265,11 +7276,12 @@ const formatDate = (datetime, options, locale = "en-US") => {
 */
 const formatDateTimeSmart = (datetime, options, locale = "en-US") => {
 	const date = new Date(datetime);
+	if (Number.isNaN(date.getTime())) return "Invalid Date";
 	const now = /* @__PURE__ */ new Date();
 	return new Date(datetime).toLocaleDateString(locale, {
 		month: "short",
 		day: "numeric",
-		...date.getUTCFullYear() !== now.getUTCFullYear() ? { year: "numeric" } : {
+		...date.getFullYear() !== now.getFullYear() ? { year: "numeric" } : {
 			hour: "numeric",
 			minute: "numeric",
 			hour12: true
@@ -7324,8 +7336,9 @@ const formatDateTimeSmart = (datetime, options, locale = "en-US") => {
 * ```
 */
 const formatDateTime = (datetime, options, locale = "en-US") => {
-	if (datetime.toString() === "Invalid Date") return "";
-	return new Date(datetime).toLocaleTimeString(locale, {
+	const date = new Date(datetime);
+	if (Number.isNaN(date.getTime())) return "";
+	return date.toLocaleString(locale, {
 		month: "short",
 		day: "numeric",
 		year: "numeric",
@@ -7561,18 +7574,26 @@ const getFirstAndLastDay = (day, referenceDate = /* @__PURE__ */ new Date()) =>
 	const currentDay = today.getDate();
 	const currentMonth = today.getMonth();
 	const currentYear = today.getFullYear();
-	if (currentDay >= day) return {
-		firstDay: new Date(currentYear, currentMonth, day),
-		lastDay: new Date(currentYear, currentMonth + 1, day - 1)
-	};
-	else {
-		const lastYear = currentMonth === 0 ? currentYear - 1 : currentYear;
-		const lastMonth = currentMonth === 0 ? 11 : currentMonth - 1;
+	const lastDayOfMonth = (year, month) => new Date(year, month + 1, 0).getDate();
+	const clamp = (year, month, requested) => Math.min(requested, lastDayOfMonth(year, month));
+	if (currentDay >= day) {
+		const firstDayClamped = clamp(currentYear, currentMonth, day);
+		const lastMonth = currentMonth + 1;
+		const lastYear = currentYear + (currentMonth === 11 ? 1 : 0);
+		const lastDayClamped = clamp(lastMonth === 12 ? lastYear : currentYear, lastMonth % 12, Math.max(1, day - 1));
 		return {
-			firstDay: new Date(lastYear, lastMonth, day),
-			lastDay: new Date(currentYear, currentMonth, day - 1)
+			firstDay: new Date(currentYear, currentMonth, firstDayClamped),
+			lastDay: new Date(lastMonth === 12 ? lastYear : currentYear, lastMonth % 12, lastDayClamped)
 		};
 	}
+	const lastYear = currentMonth === 0 ? currentYear - 1 : currentYear;
+	const lastMonth = currentMonth === 0 ? 11 : currentMonth - 1;
+	const firstDayClamped = clamp(lastYear, lastMonth, day);
+	const lastDayClamped = clamp(currentYear, currentMonth, Math.max(1, day - 1));
+	return {
+		firstDay: new Date(lastYear, lastMonth, firstDayClamped),
+		lastDay: new Date(currentYear, currentMonth, lastDayClamped)
+	};
 };
 //#endregion
 //#region src/functions/datetime/get-year.ts
@@ -7746,7 +7767,29 @@ const timeAgo = (timestamp, { withAgo, neverText = "Never", justNowText = "Just
 * ```
 */
 const getTimeZones = () => {
-	return Intl.supportedValuesOf("timeZone").map((timezone) => {
+	const safeSupported = () => {
+		if (typeof Intl !== "undefined" && typeof Intl.supportedValuesOf === "function") try {
+			return Intl.supportedValuesOf("timeZone");
+		} catch {}
+		return [
+			"UTC",
+			"America/New_York",
+			"America/Los_Angeles",
+			"Europe/London",
+			"Europe/Paris",
+			"Asia/Tokyo"
+		];
+	};
+	const timezones = safeSupported();
+	const parseOffsetMinutes = (offset) => {
+		const match = offset.match(/GMT([+-])(\d{1,2})(?::(\d{2}))?/);
+		if (!match) return 0;
+		const sign = match[1] === "-" ? -1 : 1;
+		const hours = Number.parseInt(match[2] ?? "0", 10);
+		const minutes = Number.parseInt(match[3] ?? "0", 10);
+		return sign * (hours * 60 + minutes);
+	};
+	return timezones.map((timezone) => {
 		const offset = new Intl.DateTimeFormat("en", {
 			timeZone: timezone,
 			timeZoneName: "shortOffset"
@@ -7755,7 +7798,7 @@ const getTimeZones = () => {
 		return {
 			value: timezone,
 			label: `(${formattedOffset}) ${timezone.replace(/_/g, " ")}`,
-			numericOffset: parseInt(formattedOffset.replace("GMT", "").replace("+", "") || "0")
+			numericOffset: parseOffsetMinutes(formattedOffset)
 		};
 	}).sort((a, b) => a.numericOffset - b.numericOffset);
 };
@@ -7806,6 +7849,7 @@ const getTimeZones = () => {
 */
 function formatFileSize(bytes, decimals = 2, base = 1024) {
 	if (bytes === 0) return "0 Bytes";
+	if (bytes < 0) return `-${formatFileSize(-bytes, decimals, base)}`;
 	const k = base;
 	const sizes = [
 		"B",
@@ -7818,7 +7862,7 @@ function formatFileSize(bytes, decimals = 2, base = 1024) {
 		"ZB",
 		"YB"
 	];
-	const i = Math.floor(Math.log(bytes) / Math.log(k));
+	const i = Math.min(Math.max(Math.floor(Math.log(bytes) / Math.log(k)), 0), sizes.length - 1);
 	return `${parseFloat((bytes / k ** i).toFixed(decimals))} ${sizes[i]}`;
 }
 //#endregion
@@ -7874,6 +7918,8 @@ function formatFileSize(bytes, decimals = 2, base = 1024) {
 async function fetchWithRetry(input, init, options = {}) {
 	const { timeout = 5e3, maxRetries = 10, retryDelay = 1e3 } = options;
 	let lastError = null;
+	let httpError = null;
+	let lastStatus = 0;
 	for (let i = 0; i < maxRetries; i++) {
 		const controller = new AbortController();
 		const timeoutId = setTimeout(() => {
@@ -7886,21 +7932,25 @@ async function fetchWithRetry(input, init, options = {}) {
 			});
 			clearTimeout(timeoutId);
 			if (response.ok) return response;
+			lastStatus = response.status;
 			if (response.status === 429 || response.status >= 500) {
+				httpError = /* @__PURE__ */ new Error(`HTTP error ${response.status}`);
 				const delay = retryDelay + i ** 2 * 50;
 				await new Promise((resolve) => setTimeout(resolve, delay));
 				continue;
 			}
-			if (response.status === 403) throw new Error("Unauthorized");
-			if (!response.ok) {
-				let errorMessage;
-				try {
-					errorMessage = (await response.json()).error || `HTTP error ${response.status}`;
-				} catch {
-					errorMessage = `HTTP error ${response.status}`;
-				}
-				throw new Error(errorMessage);
+			if (response.status === 401 || response.status === 403) {
+				httpError = /* @__PURE__ */ new Error(response.status === 401 ? "Unauthorized" : "Forbidden");
+				break;
 			}
+			let errorMessage;
+			try {
+				errorMessage = (await response.json())?.error || `HTTP error ${response.status}`;
+			} catch {
+				errorMessage = `HTTP error ${response.status}`;
+			}
+			httpError = new Error(errorMessage);
+			break;
 		} catch (error) {
 			clearTimeout(timeoutId);
 			lastError = error instanceof Error ? error : new Error(String(error));
@@ -7909,7 +7959,8 @@ async function fetchWithRetry(input, init, options = {}) {
 			await new Promise((resolve) => setTimeout(resolve, delay));
 		}
 	}
-	throw new Error(`Failed after ${maxRetries} retries`);
+	if (httpError) throw httpError;
+	throw new Error(`Failed after ${maxRetries} retries${lastStatus ? ` (last status: ${lastStatus})` : ""}`);
 }
 //#endregion
 //#region src/functions/http/fetch-with-timeout.ts
@@ -8069,13 +8120,25 @@ async function fetcher(endpoint, method = "GET", body, options) {
 		if (!headers["Content-Type"]) headers["Content-Type"] = "application/json";
 		payload = JSON.stringify(body);
 	}
-	const data = await (await fetch(endpoint, {
+	const res = await fetch(endpoint, {
 		method,
 		headers,
 		body: payload
-	})).json();
-	if (options?.log && isDevelopment) console.log(`[request] ${endpoint}`, data);
-	return data?.data;
+	});
+	let data;
+	try {
+		data = await res.json();
+	} catch {
+		data = void 0;
+	}
+	if (options?.log && isDevelopment) logger.info(`[request] ${endpoint}`, data);
+	if (!res.ok) {
+		const message = (typeof data === "object" && data !== null && "error" in data ? String(data.error) : `HTTP error ${res.status}`) || `HTTP error ${res.status}`;
+		const error = new Error(message);
+		error.status = res.status;
+		throw error;
+	}
+	return typeof data === "object" && data !== null && "data" in data ? data.data : data;
 }
 //#endregion
 //#region src/functions/http/ip.ts
@@ -8177,7 +8240,7 @@ function getClientIP(request) {
 */
 function isValidIP(ip) {
 	if (!ip || ip === "unknown") return false;
-	return /^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/.test(ip) || /^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}$|^::1$|^::$/.test(ip);
+	return /^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/.test(ip) || /^(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(?::[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(?::[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(?::[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(?::[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?:(?::[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]+|::(?:ffff(?::0{1,4})?:)?(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)|(?:[0-9a-fA-F]{1,4}:){1,4}:(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))$/.test(ip);
 }
 /**
 * Gets user agent information from the request
@@ -8329,7 +8392,7 @@ async function getIPAddress() {
 				if (ip && typeof ip === "string") return ip;
 			}
 		} catch (serviceError) {
-			console.warn(`IP service ${service} failed:`, serviceError);
+			logger.warn(`IP service ${service} failed:`, serviceError);
 		}
 		return "unknown";
 	} catch (error) {
@@ -8386,7 +8449,7 @@ function normalizePath(input) {
 * export function middleware(req: NextRequest) {
 *   const { domain, path, fullPath, key } = parse(req);
 *
-*   console.log(domain);   // e.g., "api.kumix.com"
+*   console.log(domain);   // e.g., "api.kumix.io"
 *   console.log(path);     // e.g., "/v1/users"
 *   console.log(fullPath); // e.g., "/v1/users?page=1"
 *   console.log(key);      // e.g., "v1"
@@ -8410,22 +8473,26 @@ function normalizePath(input) {
 * ```
 */
 const parse = (req) => {
-	let domain = req.headers.get("host");
-	domain = domain.replace(/^www\./, "").toLowerCase();
+	const domain = (req.headers.get("host") || "").replace(/^www\./, "").toLowerCase();
 	const path = req.nextUrl.pathname;
 	const searchParams = req.nextUrl.searchParams.toString();
 	const searchParamsObj = Object.fromEntries(req.nextUrl.searchParams);
 	const searchParamsString = searchParams.length > 0 ? `?${searchParams}` : "";
 	const fullPath = `${path}${searchParamsString}`;
+	const safeDecode = (value) => {
+		try {
+			return decodeURIComponent(value);
+		} catch {
+			return value;
+		}
+	};
 	const pathSegments = path.split("/").filter(Boolean);
-	const key = pathSegments.length > 0 ? decodeURIComponent(pathSegments[0]) : "";
-	const fullKey = path.length > 1 ? decodeURIComponent(path.slice(1)) : "";
 	return {
 		domain,
 		path,
 		fullPath,
-		key,
-		fullKey,
+		key: pathSegments.length > 0 ? safeDecode(pathSegments[0]) : "",
+		fullKey: path.length > 1 ? safeDecode(path.slice(1)) : "",
 		searchParamsObj,
 		searchParamsString
 	};
@@ -8458,9 +8525,9 @@ const parse = (req) => {
 */
 async function verifyRecaptchaToken(token) {
 	try {
-		const secretKey = NEXT_PUBLIC_RECAPTCHA_SITE_KEY;
+		const secretKey = RECAPTCHA_SECRET_KEY;
 		if (!secretKey) {
-			logger.error("NEXT_PUBLIC_RECAPTCHA_SITE_KEY is not set");
+			logger.error("RECAPTCHA_SECRET_KEY is not set");
 			return false;
 		}
 		const data = await (await fetch("https://www.google.com/recaptcha/api/siteverify", {
@@ -8531,10 +8598,13 @@ const logTypeToEnv = {
 * // In development, logs to console instead of Slack
 * ```
 */
-const SlackLog = async ({ message, type, mention = false }) => {
-	if (isDevelopment || !SLACK_WEBHOOKS.ALERTS || !SLACK_WEBHOOKS.CRON || !SLACK_WEBHOOKS.LINKS || !SLACK_WEBHOOKS.SUBSCRIBERS || !SLACK_WEBHOOKS.ERRORS) logger.log(message);
+const SlackLog = async ({ message, type, mention = false, mentionUserId }) => {
 	const HOOK = logTypeToEnv[type];
-	if (!HOOK) return;
+	if (isDevelopment || !HOOK) {
+		logger.log(message);
+		return;
+	}
+	const resolvedMentionId = mentionUserId || (typeof process !== "undefined" ? process.env.SLACK_MENTION_USER_ID : void 0);
 	try {
 		return await fetch(HOOK, {
 			method: "POST",
@@ -8543,7 +8613,7 @@ const SlackLog = async ({ message, type, mention = false }) => {
 				type: "section",
 				text: {
 					type: "mrkdwn",
-					text: `${mention ? "<@U0404G6J3NJ> " : ""}${type === "alerts" || type === "errors" ? ":alert: " : ""}${message}`
+					text: `${mention && resolvedMentionId ? `<@${resolvedMentionId}> ` : ""}${type === "alerts" || type === "errors" ? ":alert: " : ""}${message}`
 				}
 			}] })
 		});
@@ -8696,37 +8766,30 @@ function getUserName(user) {
 //#region src/functions/string/camel-case.ts
 /**
 * Utility function for string case conversion
-* Provides conversion from snake_case to camelCase format
+* Provides conversion from various cases (snake, kebab, space, Pascal) to camelCase
 */
 /**
-* Converts a string from snake_case to camelCase format
-* If the string is already in camelCase, it will be returned unchanged
+* Converts a string to camelCase.
+* Handles snake_case, kebab-case, CONST_CASE, PascalCase, and space-separated words.
 *
 * @param str - The string to convert to camelCase
 * @returns The camelCase version of the input string
 *
 * @example
 * ```ts
-* // Convert snake_case to camelCase
-* toCamelCase('user_name')
-* // Returns "userName"
-*
-* // Already camelCase strings remain unchanged
-* toCamelCase('userName')
-* // Returns "userName"
-*
-* // Multi-word snake_case strings
-* toCamelCase('first_name_last_name')
-* // Returns "firstNameLastName"
-*
-* // Handles single-word strings
-* toCamelCase('user')
-* // Returns "user"
+* toCamelCase('user_name')        // "userName"
+* toCamelCase('user-name')        // "userName"
+* toCamelCase('first name')       // "firstName"
+* toCamelCase('PascalCase')       // "pascalCase"
+* toCamelCase('first_name_last')  // "firstNameLastName"
 * ```
 */
 const toCamelCase = (str) => {
-	if (/^[a-z][a-zA-Z0-9]*$/.test(str)) return str;
-	return str.toLowerCase().replace(/_([a-z])/g, (_, letter) => letter.toUpperCase());
+	if (!str) return "";
+	const words = str.replace(/([a-z0-9])([A-Z])/g, "$1 $2").split(/[^a-zA-Z0-9]+/).filter(Boolean);
+	if (words.length === 0) return "";
+	const [first, ...rest] = words;
+	return `${first.toLowerCase()}${rest.map((w) => w.charAt(0).toUpperCase() + w.slice(1).toLowerCase()).join("")}`;
 };
 //#endregion
 //#region src/functions/string/capitalize.ts
@@ -8868,29 +8931,28 @@ const combineWords = (words) => {
 * ```ts
 * // Basic usage with defaults (USD)
 * currencyFormatter(1000)
-* // Returns "$1,000"
+* // Returns "$1,000.00"
 *
 * // With custom currency
 * currencyFormatter(1000, {}, 'en-US', 'EUR')
-* // Returns "€1,000"
+* // Returns "€1,000.00"
 *
 * // With custom locale
 * currencyFormatter(1000, {}, 'de-DE', 'EUR')
-* // Returns "1.000 €"
+* // Returns "1.000,00 €"
 *
-* // With custom options
-* currencyFormatter(1234.56, { maximumFractionDigits: 2 })
-* // Returns "$1,234.56"
+* // With custom options (no decimals)
+* currencyFormatter(1234.56, { maximumFractionDigits: 0 })
+* // Returns "$1,235"
 *
 * // Combining custom options, locale and currency
-* currencyFormatter(1234.56, { maximumFractionDigits: 2 }, 'ja-JP', 'JPY')
-* // Returns "￥1,235" (rounded to 0 decimal placeas by default for JPY)
+* currencyFormatter(1234.56, { maximumFractionDigits: 0 }, 'ja-JP', 'JPY')
+* // Returns "￥1,235"
 * ```
 */
 const currencyFormatter = (value, options, locale = "en-US", currencyCode = "USD") => Intl.NumberFormat(locale, {
 	style: "currency",
 	currency: currencyCode,
-	maximumFractionDigits: 0,
 	...options
 }).format(value);
 //#endregion
@@ -9002,7 +9064,10 @@ function nFormatter(num, opts = { digits: 1 }, locale = "en-US") {
 	if (!num) return "0";
 	if (opts.full) return Intl.NumberFormat(locale).format(num);
 	const rx = /\.0+$|(\.[0-9]*[1-9])0+$/;
-	if (num < 1) return num.toFixed(opts.digits).replace(rx, "$1");
+	const digits = opts.digits ?? 1;
+	const sign = num < 0 ? "-" : "";
+	const abs = Math.abs(num);
+	if (abs < 1) return `${sign}${abs.toFixed(digits).replace(rx, "$1")}`;
 	const item = [
 		{
 			value: 1,
@@ -9032,8 +9097,8 @@ function nFormatter(num, opts = { digits: 1 }, locale = "en-US") {
 			value: 0xde0b6b3a7640000,
 			symbol: "E"
 		}
-	].slice().reverse().find((item) => num >= item.value);
-	return item ? (num / item.value).toFixed(opts.digits).replace(rx, "$1") + item.symbol : "0";
+	].slice().reverse().find((item) => abs >= item.value);
+	return item ? `${sign}${(abs / item.value).toFixed(digits).replace(rx, "$1")}${item.symbol}` : "0";
 }
 //#endregion
 //#region src/functions/string/normalize-string.ts
@@ -9076,14 +9141,11 @@ function nFormatter(num, opts = { digits: 1 }, locale = "en-US") {
 const normalizeString = (key) => {
 	if (!key) return "";
 	const original = key;
-	const normalized = key.replace(/^\uFEFF/, "").replace(/^\uFFFE/, "").replace(/^\uEFBBBF/, "").replace(/^[\u0000\uFEFF]{2}/, "").replace(/^[\uFFFE\u0000]{2}/, "").replace(/^\u2028/, "").replace(/^\u2029/, "").replace(/./g, (char) => {
+	const normalized = key.replace(/^\uFEFF/, "").replace(/^\uFFFE/, "").replace(/^[\u00EF\u00BB\u00BF]+/, "").replace(/^[\u0000\uFEFF]{2}/, "").replace(/^[\uFFFE\u0000]{2}/, "").replace(/^\u2028/, "").replace(/^\u2029/, "").replace(/./g, (char) => {
 		const code = char.charCodeAt(0);
 		return code <= 31 || code >= 127 && code <= 159 ? "" : char;
 	}).replace(/\s+/g, " ").trim().toLowerCase();
-	if (isDevelopment && original !== normalized) {
-		logger.log(`Normalized key: "${original}" -> "${normalized}"`);
-		logger.log("Original char codes:", Array.from(original).map((c) => c.charCodeAt(0)));
-	}
+	if (isDevelopment && typeof process !== "undefined" && process.env?.KUMIX_DEBUG_NORMALIZE && original !== normalized) logger.log(`normalizeString: input changed (length ${original.length} -> ${normalized.length})`);
 	return normalized;
 };
 //#endregion
@@ -9212,8 +9274,11 @@ function regexEscape(str) {
 * ```
 */
 const truncate = (str, length) => {
-	if (!str || str.length <= length) return str ?? null;
-	return `${str.slice(0, length - 3)}...`;
+	if (!str) return null;
+	if (str.length <= length) return str;
+	const ELLIPSIS = "...";
+	if (length <= 3) return str.slice(0, length);
+	return `${str.slice(0, length - 3)}${ELLIPSIS}`;
 };
 //#endregion
 //#region src/functions/string/smart-truncate.ts
@@ -9270,9 +9335,16 @@ const truncateDomain = (domain, maxLength) => {
 * ```
 */
 const smartTruncate = (link, maxLength) => {
+	if (!link) return "";
+	if (maxLength <= 0) return "";
 	if (link.length <= maxLength) return link;
 	const [domain, ...pathParts] = link.split("/");
-	const truncatedPath = truncate(pathParts.join("/"), maxLength - 8);
+	const path = pathParts.join("/");
+	const minDomainLength = 8;
+	if (maxLength < minDomainLength) return link.slice(0, maxLength);
+	const maxPathLength = maxLength - minDomainLength;
+	const truncatedPath = path ? truncate(path, maxPathLength) : null;
+	if (!truncatedPath) return truncateDomain(domain, maxLength);
 	return `${truncateDomain(domain, maxLength - truncatedPath.length)}/${truncatedPath}`;
 };
 //#endregion
@@ -9319,10 +9391,17 @@ const trim = (u) => typeof u === "string" ? u.trim() : u;
 * Provides functions for validating URL strings and checking URL validity
 */
 /**
-* Checks if a string is a valid URL
-* Uses the URL constructor for validation
+* Checks if a string is a valid URL.
+*
+* By default rejects non-fetchable schemes (`javascript:`, `data:`, `file:`,
+* `vbscript:`) to avoid XSS via redirect/href validation. Set `allowAnyScheme`
+* to accept any scheme the URL parser accepts.
+*
+* Uses the URL constructor for validation.
 *
 * @param url - The string to check
+* @param options - Validation options
+* @param options.allowAnyScheme - When true, accept any scheme (defaults to false)
 * @returns True if the string is a valid URL, false otherwise
 *
 * @example
@@ -9334,11 +9413,9 @@ const trim = (u) => typeof u === "string" ? u.trim() : u;
 * isValidUrl('http://localhost:3000'); // true
 * isValidUrl('ftp://files.example.com'); // true
 *
-* // Invalid URLs
+* // Invalid / unsafe URLs (rejected by default)
+* isValidUrl('javascript:alert(1)'); // false
 * isValidUrl('example.com'); // false (missing protocol)
-* isValidUrl('not a url'); // false
-* isValidUrl(''); // false
-* isValidUrl('https://'); // false (incomplete)
 *
 * // Use in form validation
 * function validateUrlInput(input: string) {
@@ -9347,14 +9424,21 @@ const trim = (u) => typeof u === "string" ? u.trim() : u;
 *   }
 *   return null;
 * }
-*
-* // Use in data processing
-* const validUrls = urls.filter(isValidUrl);
 * ```
 */
-const isValidUrl = (url) => {
+const isValidUrl = (url, options = {}) => {
+	if (!url || typeof url !== "string") return false;
 	try {
-		new URL(url);
+		const parsed = new URL(url);
+		if (options.allowAnyScheme) return true;
+		const blocked = [
+			"javascript:",
+			"data:",
+			"vbscript:",
+			"file:"
+		];
+		const scheme = parsed.protocol.toLowerCase();
+		if (blocked.some((b) => scheme === b)) return false;
 		return true;
 	} catch (_) {
 		return false;
@@ -9386,9 +9470,11 @@ const isValidUrl = (url) => {
 * generateDomainFromName('My Cool Project', 'com')
 * // Returns "mycoolproject.com"
 *
-* // With country code TLD if possible
+* // ccTLD fallback only applies when the trailing 2 chars form a known ccTLD;
+* // for "Canada" the trailing 2 chars are "da" (not a ccTLD), so the default
+* // extension is used.
 * generateDomainFromName('Canada')
-* // Returns "canad.ca"
+* // Returns "canada.link"
 *
 * // With vowels removed if needed
 * generateDomainFromName('Digital', 'io')
@@ -9676,9 +9762,11 @@ function linkConstructorSimple({ domain, key }) {
 */
 const getSearchParams = (url) => {
 	const params = {};
-	new URL(url).searchParams.forEach((val, key) => {
-		params[key] = val;
-	});
+	try {
+		new URL(url).searchParams.forEach((val, key) => {
+			params[key] = val;
+		});
+	} catch {}
 	return params;
 };
 /**
@@ -9720,13 +9808,15 @@ const getSearchParams = (url) => {
 */
 const getSearchParamsWithArray = (url) => {
 	const params = {};
-	new URL(url).searchParams.forEach((val, key) => {
-		if (key in params) {
-			const param = params[key];
-			if (Array.isArray(param)) param.push(val);
-			else params[key] = [param, val];
-		} else params[key] = val;
-	});
+	try {
+		new URL(url).searchParams.forEach((val, key) => {
+			if (key in params) {
+				const param = params[key];
+				if (Array.isArray(param)) param.push(val);
+				else params[key] = [param, val];
+			} else params[key] = val;
+		});
+	} catch {}
 	return params;
 };
 /**
@@ -9964,7 +10054,7 @@ const getUrlFromStringIfValid = (str) => {
 */
 const getPrettyUrl = (url) => {
 	if (!url) return "";
-	return url.replace(/(^\w+:|^)\/\//, "").replace("www.", "").replace(/\/$/, "");
+	return url.replace(/(^\w+:|^)\/\//, "").replace(/^www\./, "").replace(/\/$/, "");
 };
 /**
 * Generates a URL-friendly slug from a given title
@@ -10166,7 +10256,7 @@ const constructURLFromUTMParams = (url, utmParams) => {
 	try {
 		const newURL = new URL(url);
 		for (const [key, value] of Object.entries(utmParams)) if (value === "") newURL.searchParams.delete(key);
-		else newURL.searchParams.set(key, value.replace("+", " "));
+		else newURL.searchParams.set(key, value.replace(/\+/g, " "));
 		return newURL.toString();
 	} catch (_) {
 		return "";
@@ -10211,9 +10301,7 @@ const constructURLFromUTMParams = (url, utmParams) => {
 const getUrlWithoutUTMParams = (url) => {
 	try {
 		const newURL = new URL(url);
-		paramsMetadata.forEach((param) => {
-			newURL.searchParams.delete(param.key);
-		});
+		for (const key of UTMTags) newURL.searchParams.delete(key);
 		return newURL.toString();
 	} catch (_) {
 		return url;
@@ -10321,6 +10409,34 @@ const createHref = (href, domain, utmParams) => {
 const deepEqual = (obj1, obj2) => {
 	if (obj1 === obj2) return true;
 	if (typeof obj1 !== "object" || typeof obj2 !== "object" || obj1 === null || obj2 === null) return false;
+	if (Object.prototype.toString.call(obj1) !== Object.prototype.toString.call(obj2)) return false;
+	if (obj1 instanceof Date && obj2 instanceof Date) return obj1.getTime() === obj2.getTime();
+	if (obj1 instanceof RegExp && obj2 instanceof RegExp) return obj1.source === obj2.source && obj1.flags === obj2.flags;
+	if (Array.isArray(obj1) && Array.isArray(obj2)) {
+		if (obj1.length !== obj2.length) return false;
+		for (let i = 0; i < obj1.length; i++) if (!deepEqual(obj1[i], obj2[i])) return false;
+		return true;
+	}
+	if (obj1 instanceof Map && obj2 instanceof Map) {
+		if (obj1.size !== obj2.size) return false;
+		for (const [key, value] of obj1) {
+			if (!obj2.has(key)) return false;
+			if (!deepEqual(value, obj2.get(key))) return false;
+		}
+		return true;
+	}
+	if (obj1 instanceof Set && obj2 instanceof Set) {
+		if (obj1.size !== obj2.size) return false;
+		for (const value of obj1) {
+			let found = false;
+			for (const other of obj2) if (deepEqual(value, other)) {
+				found = true;
+				break;
+			}
+			if (!found) return false;
+		}
+		return true;
+	}
 	const keys1 = Object.keys(obj1);
 	const keys2 = Object.keys(obj2);
 	if (keys1.length !== keys2.length) return false;
@@ -10617,64 +10733,64 @@ function getEmailDomain(email) {
 * Checks if a URL can be embedded in an iframe based on security headers
 */
 /**
-* Determines if a URL can be displayed in an iframe by checking security headers
-* Examines Content-Security-Policy and X-Frame-Options headers to verify embedding permissions
+* Determines if a URL can be displayed in an iframe by checking security headers.
+* Examines Content-Security-Policy `frame-ancestors` and `X-Frame-Options` headers.
+*
+* A URL is considered embeddable only when:
+* - `frame-ancestors` is absent OR explicitly allows `*` / `self` (same origin) /
+*   a wildcard/origin that matches `requestDomain`, AND
+* - `X-Frame-Options` is not `DENY` or `SAMEORIGIN` (when origin differs).
 *
 * @param options - The options for the check
 * @param options.url - The URL to check for iframe embedding capability
-* @param options.requestDomain - The domain that will be embedding the iframe
-* @returns A Promise that resolves to true if the URL can be embedded, false otherwise
+* @param options.requestDomain - The origin that will be embedding the iframe
+*   (e.g. `https://myapp.com`). Compared against CSP source expressions.
+* @returns A Promise that resolves to true if the URL can be embedded, false otherwise.
 *
 * @example
 * ```ts
 * import { isIframeable } from '@/utils/functions';
 *
-* // Check if a URL can be embedded in an iframe
 * const canEmbed = await isIframeable({
 *   url: 'https://example.com',
 *   requestDomain: 'https://myapp.com'
 * });
-*
-* if (canEmbed) {
-*   console.log('URL can be embedded in an iframe');
-* } else {
-*   console.log('URL cannot be embedded due to security restrictions');
-* }
-*
-* // In a React component
-* function EmbedPreview({ url }) {
-*   const [canEmbed, setCanEmbed] = useState<boolean | null>(null);
-*
-*   useEffect(() => {
-*     async function checkEmbedding() {
-*       const result = await isIframeable({
-*         url,
-*         requestDomain: window.location.origin
-*       });
-*       setCanEmbed(result);
-*     }
-*     checkEmbedding();
-*   }, [url]);
-*
-*   if (canEmbed === null) return <div>Checking...</div>;
-*   if (canEmbed === false) return <div>Cannot embed this URL</div>;
-*
-*   return <iframe src={url} />;
-* }
 * ```
 */
 const isIframeable = async ({ url, requestDomain }) => {
 	const res = await fetch(url);
+	const normalizeOrigin = (value) => value.trim().replace(/\/$/, "").toLowerCase();
+	const requestedOrigin = normalizeOrigin(requestDomain);
 	const cspHeader = res.headers.get("content-security-policy");
 	if (cspHeader) {
 		const frameAncestorsMatch = cspHeader.match(/frame-ancestors\s+([\s\S]+?)(?=;|$)/i);
-		if (frameAncestorsMatch) {
-			if (frameAncestorsMatch[1] === "*") return true;
-			if (frameAncestorsMatch[1].split(/\s+/).includes(requestDomain)) return true;
-		}
+		if (frameAncestorsMatch) return frameAncestorsMatch[1].trim().split(/\s+/).filter(Boolean).some((source) => {
+			const s = source.toLowerCase();
+			if (s === "'none'") return false;
+			if (s === "*" || s === "https:*" || s === "http:*") return true;
+			if (s === "'self'") try {
+				return normalizeOrigin(new URL(res.url).origin) === requestedOrigin;
+			} catch {
+				return false;
+			}
+			if (s.includes("*")) {
+				const pattern = s.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+				return new RegExp(`^${pattern}$`).test(requestedOrigin);
+			}
+			return normalizeOrigin(s) === requestedOrigin;
+		});
 	}
 	const xFrameOptions = res.headers.get("X-Frame-Options");
-	if (xFrameOptions === "DENY" || xFrameOptions === "SAMEORIGIN") return false;
+	if (xFrameOptions) {
+		const value = xFrameOptions.trim().toUpperCase();
+		if (value === "DENY") return false;
+		if (value === "SAMEORIGIN") try {
+			return normalizeOrigin(new URL(res.url).origin) === requestedOrigin;
+		} catch {
+			return false;
+		}
+		if (value.startsWith("ALLOW-FROM")) return false;
+	}
 	return true;
 };
 //#endregion
@@ -10758,6 +10874,6 @@ const isReservedKeyGlobal = (key) => {
 	].includes(key);
 };
 //#endregion
-export { API_PORT, CONNECT_SUPPORTED_COUNTRIES, CONTINENTS, CONTINENT_CODES, COUNTRIES, COUNTRY_CODES, COUNTRY_PHONE_CODES, DEBUG, DEFAULT_THEME_MODE, EU_COUNTRY_CODES, FRAMER_MOTION_LIST_ITEM_VARIANTS, INFINITY_NUMBER, LAST_VISITED_WORKSPACE, LOCALHOST_GEO_DATA, LOCALHOST_IP, LOG_LEVEL, META_THEME_COLORS, NEXT_PUBLIC_RECAPTCHA_SITE_KEY, NODE_ENV, OG_AVATAR_URL, PAGINATION_LIMIT, PORT, REDIRECT_QUERY_PARAM, REGIONS, REGION_CODES, RESERVED_SLUGS, SECOND_LEVEL_DOMAINS, SLACK_WEBHOOKS, SPECIAL_APEX_DOMAINS, STAGGER_CHILD_VARIANTS, SlackLog, TAB_ITEM_ANIMATION_SETTINGS, THEME_MODES, THE_BEGINNING_OF_TIME, TWO_WEEKS_IN_SECONDS, UTMTags, assetsUrl, baseId, baseIdCustom, capitalize, ccTLDs, chunk, clearAllCookies, clearStorage, cn, combineWords, constructMetadata, constructURLFromUTMParams, createHref, createId, cuid, currencyFormatter, customeId, debounce, deepEqual, fetchWithRetry, fetchWithTimeout, fetcher, fetcherSWR, fileToBase64, formatDate, formatDateTime, formatDateTimeSmart, formatFileSize, formatPeriod, formatTime, generateDomainFromName, getAdjustedBillingCycleStart, getAllCookies, getApexDomain, getBillingStartDate, getClientIP, getClientIPFromHeaders, getCookie, getCurrentYear, getDateTimeLocal, getDaysDifference, getDomainWithoutWWW, getEmailDomain, getEnv, getFirstAndLastDay, getFlagUrl, getHeight, getIPAddress, getInitials, getLastDayOfMonth, getParamsFromURL, getPrettyUrl, getRequestOrigin, getSearchParams, getSearchParamsWithArray, getSizeAvatar, getSlug, getStorageItem, getSubdomain, getTimeZones, getUrlFromString, getUrlFromStringIfValid, getUrlObjFromString, getUrlWithoutUTMParams, getUserAgent, getUserAgentFromHeaders, getUserName, googleTrackCodeCopy, googleTrackDirectionChange, googleTrackEvent, googleTrackItemCreate, googleTrackItemDelete, googleTrackItemRestore, googleTrackItemUpdate, googleTrackItemView, googleTrackThemeChange, googleTrackViewChange, hasCookie, hasStorageItem, hashStringSHA256, init as initCuid, isBusinessEmail, isDevelopment, isDisposableEmail, isIframeable, isProduction, isReservedKeyGlobal, isStaging, isUnsupportedKey, isValidIP, isValidUrl, linkConstructor, linkConstructorSimple, loadImage, logger, mapLocale, nFormatter, nanoid, normalizeEmail, normalizePath, normalizeString, paramsMetadata, parse, pluralize, randomValue, regexEscape, removeCookie, removeStorageItem, resizeAndCropImage, resizeImage, setCookie, setStorageItem, slugify, smartTruncate, stableSort, throttle, timeAgo, toCamelCase, trim, truncate, uid, validDomainRegex, validKeyRegex, validSlugRegex, validateEmail, verifyRecaptchaToken };
+export { API_PORT, CONNECT_SUPPORTED_COUNTRIES, CONTINENTS, CONTINENT_CODES, COUNTRIES, COUNTRY_CODES, COUNTRY_PHONE_CODES, DEBUG, DEFAULT_THEME_MODE, EU_COUNTRY_CODES, FRAMER_MOTION_LIST_ITEM_VARIANTS, INFINITY_NUMBER, LAST_VISITED_WORKSPACE, LOCALHOST_GEO_DATA, LOCALHOST_IP, LOG_LEVEL, META_THEME_COLORS, NEXT_PUBLIC_RECAPTCHA_SITE_KEY, NODE_ENV, OG_AVATAR_URL, PAGINATION_LIMIT, PORT, RECAPTCHA_SECRET_KEY, REDIRECT_QUERY_PARAM, REGIONS, REGION_CODES, RESERVED_SLUGS, SECOND_LEVEL_DOMAINS, SLACK_WEBHOOKS, SPECIAL_APEX_DOMAINS, STAGGER_CHILD_VARIANTS, SlackLog, TAB_ITEM_ANIMATION_SETTINGS, THEME_MODES, THE_BEGINNING_OF_TIME, TWO_WEEKS_IN_SECONDS, UTMTags, assetsUrl, baseId, baseIdCustom, capitalize, ccTLDs, chunk, clearAllCookies, clearStorage, cn, combineWords, constructMetadata, constructURLFromUTMParams, createHref, createId, cuid, currencyFormatter, customId, customeId, debounce, deepEqual, fetchWithRetry, fetchWithTimeout, fetcher, fetcherSWR, fileToBase64, formatDate, formatDateTime, formatDateTimeSmart, formatFileSize, formatPeriod, formatTime, generateDomainFromName, getAdjustedBillingCycleStart, getAllCookies, getApexDomain, getBillingStartDate, getClientIP, getClientIPFromHeaders, getCookie, getCurrentYear, getDateTimeLocal, getDaysDifference, getDomainWithoutWWW, getEmailDomain, getEnv, getFirstAndLastDay, getFlagUrl, getHeight, getIPAddress, getInitials, getLastDayOfMonth, getParamsFromURL, getPrettyUrl, getRequestOrigin, getSearchParams, getSearchParamsWithArray, getSizeAvatar, getSlug, getStorageItem, getSubdomain, getTimeZones, getUrlFromString, getUrlFromStringIfValid, getUrlObjFromString, getUrlWithoutUTMParams, getUserAgent, getUserAgentFromHeaders, getUserName, googleTrackCodeCopy, googleTrackDirectionChange, googleTrackEvent, googleTrackItemCreate, googleTrackItemDelete, googleTrackItemRestore, googleTrackItemUpdate, googleTrackItemView, googleTrackThemeChange, googleTrackViewChange, hasCookie, hasStorageItem, hashStringSHA256, init as initCuid, isBusinessEmail, isDevelopment, isDisposableEmail, isIframeable, isProduction, isReservedKeyGlobal, isStaging, isTest, isUnsupportedKey, isValidIP, isValidUrl, linkConstructor, linkConstructorSimple, loadImage, logger, mapLocale, nFormatter, nanoid, normalizeEmail, normalizePath, normalizeString, paramsMetadata, parse, pluralize, randomValue, regexEscape, removeCookie, removeStorageItem, resizeAndCropImage, resizeImage, setCookie, setStorageItem, slugify, smartTruncate, stableSort, throttle, timeAgo, toCamelCase, trim, truncate, uid, validDomainRegex, validKeyRegex, validSlugRegex, validateEmail, verifyRecaptchaToken };
 
 //# sourceMappingURL=index.js.map