@promptbook/cli 0.112.0-135 → 0.112.0-137

package/src/utils/isTimingSafeEqualString.ts

@@ -0,0 +1,43 @@
+import { timingSafeEqual } from 'crypto';
+
+/**
+ * Compares two strings in constant time to prevent timing attacks.
+ *
+ * Plain JavaScript `===` / `!==` string comparisons short-circuit on the first
+ * byte that differs, which lets a remote attacker who can measure response
+ * timing recover the expected value one byte at a time. This helper performs
+ * the comparison through Node's `timingSafeEqual`, which always inspects every
+ * byte of the equal-length buffers.
+ *
+ * Returning `false` early when the byte lengths differ does not expose
+ * character content — only length — which is an acceptable trade-off, since
+ * `timingSafeEqual` requires equal-length buffers and length is typically not
+ * secret.
+ *
+ * `null` and `undefined` inputs are treated as non-matching so callers can
+ * forward raw request values (for example `request.headers.get(name)`) without
+ * an extra guard.
+ *
+ * @param candidate - Value supplied by the caller (for example a request header or cookie).
+ * @param expected - Value to compare against (for example a configured secret).
+ * @returns `true` when both values are strings of equal length with identical bytes.
+ *
+ * @private internal helper function
+ */
+export function isTimingSafeEqualString(
+    candidate: string | null | undefined,
+    expected: string | null | undefined,
+): boolean {
+    if (typeof candidate !== 'string' || typeof expected !== 'string') {
+        return false;
+    }
+
+    const candidateBuffer = Buffer.from(candidate);
+    const expectedBuffer = Buffer.from(expected);
+
+    if (candidateBuffer.length !== expectedBuffer.length) {
+        return false;
+    }
+
+    return timingSafeEqual(candidateBuffer, expectedBuffer);
+}

package/src/version.ts

@@ -16,11 +16,11 @@ export const BOOK_LANGUAGE_VERSION: string_semantic_version = '2.0.0';
  * @generated
  * @see https://github.com/webgptorg/promptbook
  */
-export const PROMPTBOOK_ENGINE_VERSION: string_promptbook_version = '0.112.0-135';
+export const PROMPTBOOK_ENGINE_VERSION: string_promptbook_version = '0.112.0-137';
 
 /**
  * Represents the version string of the Promptbook engine.
- * It follows semantic versioning (e.g., `0.112.0-133`).
+ * It follows semantic versioning (e.g., `0.112.0-136`).
  *
  * @generated
  */

package/src/versions.txt

@@ -1161,3 +1161,5 @@
 0.112.0-132
 0.112.0-133
 0.112.0-135
+0.112.0-136
+0.112.0-137

package/umd/index.umd.js

@@ -63,7 +63,7 @@
      * @generated
      * @see https://github.com/webgptorg/promptbook
      */
-    const PROMPTBOOK_ENGINE_VERSION = '0.112.0-135';
+    const PROMPTBOOK_ENGINE_VERSION = '0.112.0-137';
     /**
      * TODO: string_promptbook_version should be constrained to the all versions of Promptbook engine
      * Note: [💞] Ignore a discrepancy between file name and entity name