@promptbook/remote-server 0.112.0-136 → 0.112.0-137

package/umd/src/utils/isTimingSafeEqualString.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Compares two strings in constant time to prevent timing attacks.
+ *
+ * Plain JavaScript `===` / `!==` string comparisons short-circuit on the first
+ * byte that differs, which lets a remote attacker who can measure response
+ * timing recover the expected value one byte at a time. This helper performs
+ * the comparison through Node's `timingSafeEqual`, which always inspects every
+ * byte of the equal-length buffers.
+ *
+ * Returning `false` early when the byte lengths differ does not expose
+ * character content — only length — which is an acceptable trade-off, since
+ * `timingSafeEqual` requires equal-length buffers and length is typically not
+ * secret.
+ *
+ * `null` and `undefined` inputs are treated as non-matching so callers can
+ * forward raw request values (for example `request.headers.get(name)`) without
+ * an extra guard.
+ *
+ * @param candidate - Value supplied by the caller (for example a request header or cookie).
+ * @param expected - Value to compare against (for example a configured secret).
+ * @returns `true` when both values are strings of equal length with identical bytes.
+ *
+ * @private internal helper function
+ */
+export declare function isTimingSafeEqualString(candidate: string | null | undefined, expected: string | null | undefined): boolean;

package/umd/src/version.d.ts

@@ -15,7 +15,7 @@ export declare const BOOK_LANGUAGE_VERSION: string_semantic_version;
 export declare const PROMPTBOOK_ENGINE_VERSION: string_promptbook_version;
 /**
  * Represents the version string of the Promptbook engine.
- * It follows semantic versioning (e.g., `0.112.0-135`).
+ * It follows semantic versioning (e.g., `0.112.0-136`).
  *
  * @generated
  */