@pipeline-builder/api-core 4.0.3 → 4.1.1

package/lib/utils/secure-compare.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Constant-time string equality, for comparing a presented secret against an
+ * expected one (scrape tokens, shared webhook secrets, signatures).
+ *
+ * `a === b` on secrets short-circuits at the first differing byte, which leaks
+ * the expected value a byte at a time to an attacker who can measure response
+ * latency. `timingSafeEqual` does not — but it THROWS when the two buffers
+ * differ in length, so length is compared first and the result is folded in
+ * without an early return.
+ *
+ * The length check itself is not constant-time, so this leaks the expected
+ * secret's LENGTH. That is acceptable for fixed-length tokens and is the
+ * standard trade-off; do not use this where the length is itself the secret.
+ */
+export declare function safeEqual(presented: string, expected: string): boolean;

package/lib/utils/secure-compare.js

@@ -0,0 +1,29 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+import { timingSafeEqual } from 'crypto';
+/**
+ * Constant-time string equality, for comparing a presented secret against an
+ * expected one (scrape tokens, shared webhook secrets, signatures).
+ *
+ * `a === b` on secrets short-circuits at the first differing byte, which leaks
+ * the expected value a byte at a time to an attacker who can measure response
+ * latency. `timingSafeEqual` does not — but it THROWS when the two buffers
+ * differ in length, so length is compared first and the result is folded in
+ * without an early return.
+ *
+ * The length check itself is not constant-time, so this leaks the expected
+ * secret's LENGTH. That is acceptable for fixed-length tokens and is the
+ * standard trade-off; do not use this where the length is itself the secret.
+ */
+export function safeEqual(presented, expected) {
+    const a = Buffer.from(presented, 'utf8');
+    const b = Buffer.from(expected, 'utf8');
+    if (a.length !== b.length) {
+        // Still run a comparison of equal-length buffers so a wrong-length guess
+        // doesn't return measurably faster than a right-length one.
+        timingSafeEqual(a, a);
+        return false;
+    }
+    return timingSafeEqual(a, b);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VjdXJlLWNvbXBhcmUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdXRpbHMvc2VjdXJlLWNvbXBhcmUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0QyxPQUFPLEVBQUUsZUFBZSxFQUFFLE1BQU0sUUFBUSxDQUFDO0FBRXpDOzs7Ozs7Ozs7Ozs7O0dBYUc7QUFDSCxNQUFNLFVBQVUsU0FBUyxDQUFDLFNBQWlCLEVBQUUsUUFBZ0I7SUFDM0QsTUFBTSxDQUFDLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDekMsTUFBTSxDQUFDLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDeEMsSUFBSSxDQUFDLENBQUMsTUFBTSxLQUFLLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUMxQix5RUFBeUU7UUFDekUsNERBQTREO1FBQzVELGVBQWUsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDdEIsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBQ0QsT0FBTyxlQUFlLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO0FBQy9CLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuaW1wb3J0IHsgdGltaW5nU2FmZUVxdWFsIH0gZnJvbSAnY3J5cHRvJztcblxuLyoqXG4gKiBDb25zdGFudC10aW1lIHN0cmluZyBlcXVhbGl0eSwgZm9yIGNvbXBhcmluZyBhIHByZXNlbnRlZCBzZWNyZXQgYWdhaW5zdCBhblxuICogZXhwZWN0ZWQgb25lIChzY3JhcGUgdG9rZW5zLCBzaGFyZWQgd2ViaG9vayBzZWNyZXRzLCBzaWduYXR1cmVzKS5cbiAqXG4gKiBgYSA9PT0gYmAgb24gc2VjcmV0cyBzaG9ydC1jaXJjdWl0cyBhdCB0aGUgZmlyc3QgZGlmZmVyaW5nIGJ5dGUsIHdoaWNoIGxlYWtzXG4gKiB0aGUgZXhwZWN0ZWQgdmFsdWUgYSBieXRlIGF0IGEgdGltZSB0byBhbiBhdHRhY2tlciB3aG8gY2FuIG1lYXN1cmUgcmVzcG9uc2VcbiAqIGxhdGVuY3kuIGB0aW1pbmdTYWZlRXF1YWxgIGRvZXMgbm90IOKAlCBidXQgaXQgVEhST1dTIHdoZW4gdGhlIHR3byBidWZmZXJzXG4gKiBkaWZmZXIgaW4gbGVuZ3RoLCBzbyBsZW5ndGggaXMgY29tcGFyZWQgZmlyc3QgYW5kIHRoZSByZXN1bHQgaXMgZm9sZGVkIGluXG4gKiB3aXRob3V0IGFuIGVhcmx5IHJldHVybi5cbiAqXG4gKiBUaGUgbGVuZ3RoIGNoZWNrIGl0c2VsZiBpcyBub3QgY29uc3RhbnQtdGltZSwgc28gdGhpcyBsZWFrcyB0aGUgZXhwZWN0ZWRcbiAqIHNlY3JldCdzIExFTkdUSC4gVGhhdCBpcyBhY2NlcHRhYmxlIGZvciBmaXhlZC1sZW5ndGggdG9rZW5zIGFuZCBpcyB0aGVcbiAqIHN0YW5kYXJkIHRyYWRlLW9mZjsgZG8gbm90IHVzZSB0aGlzIHdoZXJlIHRoZSBsZW5ndGggaXMgaXRzZWxmIHRoZSBzZWNyZXQuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBzYWZlRXF1YWwocHJlc2VudGVkOiBzdHJpbmcsIGV4cGVjdGVkOiBzdHJpbmcpOiBib29sZWFuIHtcbiAgY29uc3QgYSA9IEJ1ZmZlci5mcm9tKHByZXNlbnRlZCwgJ3V0ZjgnKTtcbiAgY29uc3QgYiA9IEJ1ZmZlci5mcm9tKGV4cGVjdGVkLCAndXRmOCcpO1xuICBpZiAoYS5sZW5ndGggIT09IGIubGVuZ3RoKSB7XG4gICAgLy8gU3RpbGwgcnVuIGEgY29tcGFyaXNvbiBvZiBlcXVhbC1sZW5ndGggYnVmZmVycyBzbyBhIHdyb25nLWxlbmd0aCBndWVzc1xuICAgIC8vIGRvZXNuJ3QgcmV0dXJuIG1lYXN1cmFibHkgZmFzdGVyIHRoYW4gYSByaWdodC1sZW5ndGggb25lLlxuICAgIHRpbWluZ1NhZmVFcXVhbChhLCBhKTtcbiAgICByZXR1cm4gZmFsc2U7XG4gIH1cbiAgcmV0dXJuIHRpbWluZ1NhZmVFcXVhbChhLCBiKTtcbn1cbiJdfQ==

package/package.json

@@ -87,7 +87,7 @@
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   },
-  "version": "4.0.3",
+  "version": "4.1.1",
   "bugs": {
     "url": "https://github.com/mwashburn160/pipeline-builder/issues"
   },