@mulmoclaude/common 1.1.1 → 1.2.0

package/README.md

@@ -37,6 +37,7 @@ helpers below.
 |---|---|---|
 | `errorMessage(v, fallback?)` | `string` | unknown caught value → human-readable string; **isomorphic**, so Vue/browser surfaces use it too |
 | `toUtcIsoDate(timestamp)` | `string` | `Date` → `YYYY-MM-DD` in UTC — for dates that must not shift with the host's local timezone |
+| `splitJwtSegments(token)` | `JwtSegments \| null` | JWS compact serialization → its three segments; `null` for anything that isn't **exactly** three. Pure string work, so the Node bridges and the Workers relay share the guard while decoding differently |
 
 `errorMessage` surfaces a non-empty string `details` (gRPC convention) or
 `message` field of a non-Error object (`details` wins) instead of

package/dist/envScan.js

@@ -23,10 +23,10 @@ export function snakeToLowerCamel(snake) {
         .toLowerCase()
         .split("_")
         .filter((segment) => segment.length > 0);
-    if (parts.length === 0)
-        return "";
     const [head, ...rest] = parts;
-    return head + rest.map((part) => part[0].toUpperCase() + part.slice(1)).join("");
+    if (head === undefined)
+        return "";
+    return head + rest.map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("");
 }
 function claimByHighestPrefix(name, prefixes) {
     const claimed = prefixes

package/dist/index.d.ts

@@ -62,5 +62,20 @@ export declare function toUtcIsoDate(timestamp: Date): string;
  *  introduces contain none of the other four characters, so nothing is
  *  double-escaped. Not a sanitiser: it neither strips tags nor validates URLs. */
 export declare function escapeHtml(value: string): string;
+export interface JwtSegments {
+    headerSegment: string;
+    payloadSegment: string;
+    signatureSegment: string;
+}
+/** Split a JWS compact serialization into its three segments, or `null` when the
+ *  token isn't well-formed. Pure string work, so the Node bridges and the
+ *  Cloudflare Workers relay — which decode the segments differently (`Buffer` vs
+ *  `atob`) — can still share this one guard.
+ *
+ *  A JWS compact serialization is EXACTLY three segments. Both a short token and
+ *  a longer one (a five-segment JWE, or an attacker appending `.junk`) are
+ *  rejected outright — never parsed from their first three segments, which would
+ *  let the signed input disagree with the token. */
+export declare function splitJwtSegments(token: string): JwtSegments | null;
 export { scanEnvOptions, snakeToLowerCamel, type ScanEnvOptionsConfig } from "./envScan.js";
 export type { MinimalLogger, StructuredLogger } from "./logger.js";

package/dist/index.js

@@ -116,4 +116,21 @@ const HTML_ESCAPES = new Map([
 export function escapeHtml(value) {
     return value.replace(/[&<>"']/g, (char) => HTML_ESCAPES.get(char) ?? char);
 }
+/** Split a JWS compact serialization into its three segments, or `null` when the
+ *  token isn't well-formed. Pure string work, so the Node bridges and the
+ *  Cloudflare Workers relay — which decode the segments differently (`Buffer` vs
+ *  `atob`) — can still share this one guard.
+ *
+ *  A JWS compact serialization is EXACTLY three segments. Both a short token and
+ *  a longer one (a five-segment JWE, or an attacker appending `.junk`) are
+ *  rejected outright — never parsed from their first three segments, which would
+ *  let the signed input disagree with the token. */
+export function splitJwtSegments(token) {
+    const [headerSegment, payloadSegment, signatureSegment, ...extraSegments] = token.split(".");
+    if (headerSegment === undefined || payloadSegment === undefined || signatureSegment === undefined)
+        return null;
+    if (extraSegments.length > 0)
+        return null;
+    return { headerSegment, payloadSegment, signatureSegment };
+}
 export { scanEnvOptions, snakeToLowerCamel } from "./envScan.js";

package/dist/ssrf.js

@@ -67,12 +67,13 @@ export function stripIpv6Brackets(hostname) {
  *  `[::ffff:127.0.0.1]` as `::ffff:7f00:1`, so matching only the dotted form
  *  would wave the mapped loopback through any URL-sourced check. */
 function mappedIpv4Value(lower) {
-    const dotted = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(lower);
-    if (dotted)
-        return ipv4ToInt(dotted[1]);
+    const dotted = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(lower)?.[1];
+    if (dotted !== undefined)
+        return ipv4ToInt(dotted);
     const hex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(lower);
-    if (hex)
-        return Number.parseInt(hex[1], 16) * 0x10000 + Number.parseInt(hex[2], 16);
+    const [, high, low] = hex ?? [];
+    if (high !== undefined && low !== undefined)
+        return Number.parseInt(high, 16) * 0x10000 + Number.parseInt(low, 16);
     return null;
 }
 /** Blocks loopback/unspecified, fc00::/7 unique-local, fe80::/10 link-local,
@@ -86,7 +87,7 @@ export function isBlockedIpv6(address) {
     const mapped = mappedIpv4Value(lower);
     if (mapped !== null)
         return isBlockedIpv4Value(mapped);
-    const [head] = lower.split(":");
+    const [head = ""] = lower.split(":");
     if (head.length === 0)
         return false;
     const leading = Number.parseInt(head, 16);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mulmoclaude/common",
-  "version": "1.1.1",
+  "version": "1.2.0",
   "description": "General-purpose pure utilities (type guards, etc.) shared across the MulmoClaude host, bridges, and plugins",
   "type": "module",
   "main": "./dist/index.js",