@rexezuge/shared 0.0.0-stage → 1.0.1

package/dist/TimestampUtil.js

@@ -0,0 +1,69 @@
+import { SYSTEM_CLOCK } from './Clock';
+/**
+ * Unix timestamps, in seconds and milliseconds.
+ *
+ * ## Provenance
+ *
+ * Converged from all nine `TimestampUtil.ts` copies. They fall into three
+ * shapes: Durable-DAV's minimal two-method set (`getCurrentUnixTimestampInSeconds`
+ * + `addDays`) with a deliberate "seconds everywhere" argument; AWS's compact set
+ * plus an **injectable `Clock`** on the current-time readers; and the full
+ * ChordDHT/Mail-Otter set (`…InMilliseconds`, `addMinutes`, `addHours`,
+ * `subtractMinutes`, `subtractDays`, `convertIso…`) reading `Date.now()` directly.
+ *
+ * ## Design decisions
+ *
+ * - The **full method set** is kept: the union of the three shapes loses nothing
+ *   and each method exists because at least two repos independently reached for
+ *   it.
+ * - The current-time reads go through an **injectable `Clock`** defaulting to
+ *   `SYSTEM_CLOCK` (AWS's shape). Reading the clock through one seam lets a test
+ *   pin "now" without racing `Date.now()`, and a caller cannot accidentally store
+ *   milliseconds in a column compared against seconds.
+ * - Seconds is the storage unit (Durable-DAV's argument): where millisecond
+ *   precision is genuinely wanted — ordering within a single pass — reach for
+ *   `…InMilliseconds` (or `clock.now()`) explicitly, so the unit is visible at the
+ *   call site. `add*`/`subtract*` operate on the **second** unit and are pure
+ *   calendar arithmetic, never `Date` arithmetic, so they cannot pick up a
+ *   timezone or a DST transition.
+ */
+class TimestampUtil {
+    /**
+     * Now, in whole milliseconds.
+     *
+     * @param clock Inject a `FixedClock` to pin "now" in a test; production leaves
+     * it defaulted.
+     */
+    static getCurrentUnixTimestampInMilliseconds(clock = SYSTEM_CLOCK) {
+        return clock.now();
+    }
+    /**
+     * Now, in whole seconds. The default storage unit.
+     *
+     * @param clock Inject a `FixedClock` to pin "now" in a test; production leaves
+     * it defaulted.
+     */
+    static getCurrentUnixTimestampInSeconds(clock = SYSTEM_CLOCK) {
+        return Math.floor(clock.now() / 1000);
+    }
+    static addMinutes(timestamp, minutes) {
+        return timestamp + minutes * 60;
+    }
+    static addHours(timestamp, hours) {
+        return timestamp + hours * 60 * 60;
+    }
+    static addDays(timestamp, days) {
+        return timestamp + days * 60 * 60 * 24;
+    }
+    static subtractMinutes(timestamp, minutes) {
+        return timestamp - minutes * 60;
+    }
+    static subtractDays(timestamp, days) {
+        return timestamp - days * 60 * 60 * 24;
+    }
+    static convertIsoToUnixTimestampInSeconds(isoString) {
+        return Math.floor(new Date(isoString).getTime() / 1000);
+    }
+}
+export { TimestampUtil };
+//# sourceMappingURL=TimestampUtil.js.map

package/dist/TimestampUtil.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TimestampUtil.js","sourceRoot":"","sources":["../src/TimestampUtil.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAc,MAAM,SAAS,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,aAAa;IACjB;;;;;OAKG;IACI,MAAM,CAAC,qCAAqC,CAAC,QAAe,YAAY;QAC7E,OAAO,KAAK,CAAC,GAAG,EAAE,CAAC;IACrB,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,gCAAgC,CAAC,QAAe,YAAY;QACxE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACxC,CAAC;IAEM,MAAM,CAAC,UAAU,CAAC,SAAiB,EAAE,OAAe;QACzD,OAAO,SAAS,GAAG,OAAO,GAAG,EAAE,CAAC;IAClC,CAAC;IAEM,MAAM,CAAC,QAAQ,CAAC,SAAiB,EAAE,KAAa;QACrD,OAAO,SAAS,GAAG,KAAK,GAAG,EAAE,GAAG,EAAE,CAAC;IACrC,CAAC;IAEM,MAAM,CAAC,OAAO,CAAC,SAAiB,EAAE,IAAY;QACnD,OAAO,SAAS,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IACzC,CAAC;IAEM,MAAM,CAAC,eAAe,CAAC,SAAiB,EAAE,OAAe;QAC9D,OAAO,SAAS,GAAG,OAAO,GAAG,EAAE,CAAC;IAClC,CAAC;IAEM,MAAM,CAAC,YAAY,CAAC,SAAiB,EAAE,IAAY;QACxD,OAAO,SAAS,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IACzC,CAAC;IAEM,MAAM,CAAC,kCAAkC,CAAC,SAAiB;QAChE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1D,CAAC;CACF;AAED,OAAO,EAAE,aAAa,EAAE,CAAC"}

package/dist/TokenHashUtil.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The one-place hash for API / personal access tokens.
+ *
+ * ## Provenance
+ *
+ * Taken from AWS-AccessBridge's `TokenHashUtil.ts` — the only repo that factored
+ * token hashing behind a named helper (as opposed to calling `CryptoUtil.sha256Hex`
+ * inline, as Edge-Git does).
+ *
+ * A PAT is ~244 random bits from two UUIDs, so a plain SHA-256 hex digest is the
+ * right storage form: the input is not dictionary-searchable, so no salt or
+ * password KDF is needed, and the digest is indexable. Binding the digest for
+ * storage means a D1 read or backup no longer carries a live credential.
+ *
+ * ## Design decisions
+ *
+ * - `sha256Hex` **delegates to `CryptoUtil.sha256Hex`** rather than reimplementing
+ *   the digest loop. AWS carried its own copy only because its `CryptoUtil` did
+ *   not yet exist to delegate to; the kit's does, and a second SHA-256
+ *   implementation is exactly the drift this package removes.
+ * - **No timing-safe compare is shipped.** The brief says to keep an
+ *   HMAC/TimingSafe helper "if present"; none of the source repos carries one —
+ *   token verification compares two SHA-256 *hex strings*, and nothing in the
+ *   repos does it in constant time. Rather than invent a security primitive here
+ *   that has no provenance, the helper is left out; a verifier that must compare a
+ *   presented token's digest against a stored one does the byte-wise, length-
+ *   independent compare itself (a `crypto.subtle`-backed constant-time compare
+ *   belongs with the caller's chosen error mapping).
+ */
+declare class TokenHashUtil {
+    static sha256Hex(token: string): Promise<string>;
+}
+export { TokenHashUtil };
+//# sourceMappingURL=TokenHashUtil.d.ts.map

package/dist/TokenHashUtil.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenHashUtil.d.ts","sourceRoot":"","sources":["../src/TokenHashUtil.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,cAAM,aAAa;WACG,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAG9D;AAED,OAAO,EAAE,aAAa,EAAE,CAAC"}

package/dist/TokenHashUtil.js

@@ -0,0 +1,37 @@
+import { CryptoUtil } from './CryptoUtil';
+/**
+ * The one-place hash for API / personal access tokens.
+ *
+ * ## Provenance
+ *
+ * Taken from AWS-AccessBridge's `TokenHashUtil.ts` — the only repo that factored
+ * token hashing behind a named helper (as opposed to calling `CryptoUtil.sha256Hex`
+ * inline, as Edge-Git does).
+ *
+ * A PAT is ~244 random bits from two UUIDs, so a plain SHA-256 hex digest is the
+ * right storage form: the input is not dictionary-searchable, so no salt or
+ * password KDF is needed, and the digest is indexable. Binding the digest for
+ * storage means a D1 read or backup no longer carries a live credential.
+ *
+ * ## Design decisions
+ *
+ * - `sha256Hex` **delegates to `CryptoUtil.sha256Hex`** rather than reimplementing
+ *   the digest loop. AWS carried its own copy only because its `CryptoUtil` did
+ *   not yet exist to delegate to; the kit's does, and a second SHA-256
+ *   implementation is exactly the drift this package removes.
+ * - **No timing-safe compare is shipped.** The brief says to keep an
+ *   HMAC/TimingSafe helper "if present"; none of the source repos carries one —
+ *   token verification compares two SHA-256 *hex strings*, and nothing in the
+ *   repos does it in constant time. Rather than invent a security primitive here
+ *   that has no provenance, the helper is left out; a verifier that must compare a
+ *   presented token's digest against a stored one does the byte-wise, length-
+ *   independent compare itself (a `crypto.subtle`-backed constant-time compare
+ *   belongs with the caller's chosen error mapping).
+ */
+class TokenHashUtil {
+    static async sha256Hex(token) {
+        return CryptoUtil.sha256Hex(token);
+    }
+}
+export { TokenHashUtil };
+//# sourceMappingURL=TokenHashUtil.js.map

package/dist/TokenHashUtil.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenHashUtil.js","sourceRoot":"","sources":["../src/TokenHashUtil.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,aAAa;IACV,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,KAAa;QACzC,OAAO,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;CACF;AAED,OAAO,EAAE,aAAa,EAAE,CAAC"}

package/dist/UUIDUtil.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Primary keys.
+ *
+ * ## Provenance
+ *
+ * Converged from `UUIDUtil.ts` in Durable-DAV, AWS-AccessBridge, Edge-Git,
+ * Mail-Otter (a re-export of the DAV form under the name `UIDUtility`), the
+ * Router, CalDAV-Bridge, Mail-Meow and Edge-Sonic. Four carried the bare
+ * `getRandomUUID`; Edge-Git and AWS added `getRandomUUIDNoDash`; Edge-Sonic added
+ * the derived `deterministicId`. ChordDHT-Tracker has no UUIDUtil (its ids go
+ * through `IdGenerator`).
+ *
+ * ## Design decision
+ *
+ * The whole requirement for a row whose id never appears on the wire is a v4 UUID
+ * in canonical dashed form, so `getRandomUUID` is the base. `getRandomUUIDNoDash`
+ * is kept from the AWS/Edge-Git form (two repos independently needed the compact
+ * spelling). `deterministicId` is Edge-Sonic's and is the single most valuable
+ * member — see its doc comment for why length-prefixing the parts is load-bearing.
+ */
+declare class UUIDUtil {
+    static getRandomUUID(): string;
+    /**
+     * The canonical form with the dashes removed, for a context that wants a
+     * compact, dash-free hex-ish token.
+     */
+    static getRandomUUIDNoDash(): string;
+    /**
+     * A UUID-shaped id derived from a namespace and its parts, stable across runs.
+     *
+     * ### Why this exists
+     *
+     * **Because "create this" is not idempotent.** A Cloudflare Workflow step is
+     * cached by name and may be retried, so an import that mints a fresh id per
+     * attempt writes the *same row twice* on every retry — and a user who pressed
+     * the button three times finds four copies. `getRandomUUID` is right for the
+     * path where each create really is a new row, and wrong for an import, where a
+     * retried step is the *same* row.
+     *
+     * So an imported row's id is a function of `(namespace, ...parts)`: a retry
+     * resolves the same id, the write rewrites it, and the outcome does not depend
+     * on how many times the step ran.
+     *
+     * ### SHA-256, and why not MD5
+     *
+     * MD5 exists in one repo for a token scheme that specifies it, but this is a
+     * collision question with a consequence: two different inputs sharing an id
+     * means one overwrites the other, and MD5's collision resistance is not
+     * something to lean on when `crypto.subtle` is available. 128 bits of SHA-256
+     * is used, in canonical dashed form so the value is a UUID by inspection rather
+     * than 32 hex characters used as one.
+     *
+     * ### Every part is **length-prefixed**, because a separator proves nothing
+     *
+     * The obvious implementation joins the parts with a delimiter, and the obvious
+     * claim is that the delimiter cannot appear inside a part. That claim is
+     * **false**: joining `[ns, a, b]` and joining `[ns, a\u0000b]` both produce the
+     * same string, so a delimiter — *any* delimiter — is forgeable by choosing a
+     * part containing it. Two different inputs then hash to one id, and one
+     * overwrites the other.
+     *
+     * So each part contributes its **length** before its bytes: `3:ns1:a1:b`. That
+     * encoding is injective, because the length is recoverable from the bytes
+     * themselves — there is exactly one way to parse it — so no choice of parts
+     * produces the same string.
+     */
+    static deterministicId(namespace: string, ...parts: readonly string[]): Promise<string>;
+}
+export { UUIDUtil };
+//# sourceMappingURL=UUIDUtil.d.ts.map

package/dist/UUIDUtil.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UUIDUtil.d.ts","sourceRoot":"","sources":["../src/UUIDUtil.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,cAAM,QAAQ;WACE,aAAa,IAAI,MAAM;IAIrC;;;OAGG;WACW,mBAAmB,IAAI,MAAM;IAI3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;WACiB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;CAMrG;AAED,OAAO,EAAE,QAAQ,EAAE,CAAC"}

package/dist/UUIDUtil.js

@@ -0,0 +1,79 @@
+/**
+ * Primary keys.
+ *
+ * ## Provenance
+ *
+ * Converged from `UUIDUtil.ts` in Durable-DAV, AWS-AccessBridge, Edge-Git,
+ * Mail-Otter (a re-export of the DAV form under the name `UIDUtility`), the
+ * Router, CalDAV-Bridge, Mail-Meow and Edge-Sonic. Four carried the bare
+ * `getRandomUUID`; Edge-Git and AWS added `getRandomUUIDNoDash`; Edge-Sonic added
+ * the derived `deterministicId`. ChordDHT-Tracker has no UUIDUtil (its ids go
+ * through `IdGenerator`).
+ *
+ * ## Design decision
+ *
+ * The whole requirement for a row whose id never appears on the wire is a v4 UUID
+ * in canonical dashed form, so `getRandomUUID` is the base. `getRandomUUIDNoDash`
+ * is kept from the AWS/Edge-Git form (two repos independently needed the compact
+ * spelling). `deterministicId` is Edge-Sonic's and is the single most valuable
+ * member — see its doc comment for why length-prefixing the parts is load-bearing.
+ */
+class UUIDUtil {
+    static getRandomUUID() {
+        return crypto.randomUUID();
+    }
+    /**
+     * The canonical form with the dashes removed, for a context that wants a
+     * compact, dash-free hex-ish token.
+     */
+    static getRandomUUIDNoDash() {
+        return crypto.randomUUID().replaceAll('-', '');
+    }
+    /**
+     * A UUID-shaped id derived from a namespace and its parts, stable across runs.
+     *
+     * ### Why this exists
+     *
+     * **Because "create this" is not idempotent.** A Cloudflare Workflow step is
+     * cached by name and may be retried, so an import that mints a fresh id per
+     * attempt writes the *same row twice* on every retry — and a user who pressed
+     * the button three times finds four copies. `getRandomUUID` is right for the
+     * path where each create really is a new row, and wrong for an import, where a
+     * retried step is the *same* row.
+     *
+     * So an imported row's id is a function of `(namespace, ...parts)`: a retry
+     * resolves the same id, the write rewrites it, and the outcome does not depend
+     * on how many times the step ran.
+     *
+     * ### SHA-256, and why not MD5
+     *
+     * MD5 exists in one repo for a token scheme that specifies it, but this is a
+     * collision question with a consequence: two different inputs sharing an id
+     * means one overwrites the other, and MD5's collision resistance is not
+     * something to lean on when `crypto.subtle` is available. 128 bits of SHA-256
+     * is used, in canonical dashed form so the value is a UUID by inspection rather
+     * than 32 hex characters used as one.
+     *
+     * ### Every part is **length-prefixed**, because a separator proves nothing
+     *
+     * The obvious implementation joins the parts with a delimiter, and the obvious
+     * claim is that the delimiter cannot appear inside a part. That claim is
+     * **false**: joining `[ns, a, b]` and joining `[ns, a\u0000b]` both produce the
+     * same string, so a delimiter — *any* delimiter — is forgeable by choosing a
+     * part containing it. Two different inputs then hash to one id, and one
+     * overwrites the other.
+     *
+     * So each part contributes its **length** before its bytes: `3:ns1:a1:b`. That
+     * encoding is injective, because the length is recoverable from the bytes
+     * themselves — there is exactly one way to parse it — so no choice of parts
+     * produces the same string.
+     */
+    static async deterministicId(namespace, ...parts) {
+        const payload = [namespace, ...parts].map((part) => `${part.length}:${part}`).join('');
+        const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(payload));
+        const hex = Array.from(new Uint8Array(digest).slice(0, 16), (byte) => byte.toString(16).padStart(2, '0')).join('');
+        return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
+    }
+}
+export { UUIDUtil };
+//# sourceMappingURL=UUIDUtil.js.map

package/dist/UUIDUtil.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UUIDUtil.js","sourceRoot":"","sources":["../src/UUIDUtil.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,QAAQ;IACL,MAAM,CAAC,aAAa;QACzB,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,mBAAmB;QAC/B,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;IACI,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,GAAG,KAAwB;QAChF,MAAM,OAAO,GAAG,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACxF,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3H,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;IACjH,CAAC;CACF;AAED,OAAO,EAAE,QAAQ,EAAE,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,38 @@
+/**
+ * `@rexezuge/shared` — the converged, platform-generic utilities distilled from
+ * the nine Rexezuge Cloudflare Worker monorepos. One concept per file; this barrel
+ * only re-exports. Business-specific helpers (money, git oids, calendar sync,
+ * credential sharding, …) are deliberately left in their consumer repos.
+ *
+ * `isValidEmailFormat` / `MAX_EMAIL_LENGTH` are defined in `Identity.ts` and
+ * re-exported by `EmailUtil.ts`; the barrel sources each name **once** (from
+ * `EmailUtil`, the one-stop email surface) so an `export *` merge cannot silently
+ * drop them to ambiguity.
+ */
+export { bytesToBase64, base64ToBytes } from './Base64';
+export { SystemClock, FixedClock, SYSTEM_CLOCK } from './Clock';
+export type { Clock } from './Clock';
+export { TimestampUtil } from './TimestampUtil';
+export { TimeZoneUtil, DEFAULT_TIME_ZONE } from './TimeZoneUtil';
+export { LocaleUtil, DEFAULT_LOCALE, SUPPORTED_LOCALES, LOCALE_DISPLAY_NAMES } from './LocaleUtil';
+export type { SupportedLocale } from './LocaleUtil';
+export { canonicalizeLanguageTag } from './LanguageTag';
+export type { LanguageTag } from './LanguageTag';
+export { normalizeEmail, isValidEmailFormat, MAX_EMAIL_LENGTH } from './EmailUtil';
+export { EMAIL_FORMAT_RE } from './Identity';
+export { UUIDUtil } from './UUIDUtil';
+export { CryptoIdGenerator, FixedIdGenerator } from './IdGenerator';
+export type { IdGenerator } from './IdGenerator';
+export { CryptoUtil } from './CryptoUtil';
+export { ErrorSanitizationUtil } from './ErrorSanitizationUtil';
+export { err, getOrThrow, isOk, mapResult, ok } from './Result';
+export type { Err, Ok, Result } from './Result';
+export { normalizeRemoteUrl, resolveRedirectUrl, parseAllowedHosts, isPrivateOrInternalHost, stripBrackets, stripTrailingDot, RemoteUrlRejectedError, MAX_REMOTE_URL_LENGTH, MAX_REDIRECTS, BLOCKED_HOST_SUFFIXES, BLOCKED_HOSTNAMES, } from './RemoteUrlPolicy';
+export type { UrlPolicyOptions } from './RemoteUrlPolicy';
+export { CursorCodec } from './CursorCodec';
+export type { Page } from './CursorCodec';
+export { SubrequestCounter, UNMETERED_SUBREQUESTS, SUBREQUEST_KINDS, subrequestSpend, NO_SUBREQUESTS_SPENT } from './SubrequestMeter';
+export type { SubrequestMeter, SubrequestKind, SubrequestSpend } from './SubrequestMeter';
+export { passwordFingerprint } from './PasswordFingerprint';
+export { TokenHashUtil } from './TokenHashUtil';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGxD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAChE,YAAY,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAGjE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACnG,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGjD,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAG7C,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACpE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGjD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AAChE,YAAY,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAGhD,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,uBAAuB,EACvB,aAAa,EACb,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,aAAa,EACb,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAG1D,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,YAAY,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAG1C,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACtI,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAG1F,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAG5D,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/index.js

@@ -0,0 +1,42 @@
+/**
+ * `@rexezuge/shared` — the converged, platform-generic utilities distilled from
+ * the nine Rexezuge Cloudflare Worker monorepos. One concept per file; this barrel
+ * only re-exports. Business-specific helpers (money, git oids, calendar sync,
+ * credential sharding, …) are deliberately left in their consumer repos.
+ *
+ * `isValidEmailFormat` / `MAX_EMAIL_LENGTH` are defined in `Identity.ts` and
+ * re-exported by `EmailUtil.ts`; the barrel sources each name **once** (from
+ * `EmailUtil`, the one-stop email surface) so an `export *` merge cannot silently
+ * drop them to ambiguity.
+ */
+// Byte codecs.
+export { bytesToBase64, base64ToBytes } from './Base64';
+// Time.
+export { SystemClock, FixedClock, SYSTEM_CLOCK } from './Clock';
+export { TimestampUtil } from './TimestampUtil';
+export { TimeZoneUtil, DEFAULT_TIME_ZONE } from './TimeZoneUtil';
+// Locale.
+export { LocaleUtil, DEFAULT_LOCALE, SUPPORTED_LOCALES, LOCALE_DISPLAY_NAMES } from './LocaleUtil';
+export { canonicalizeLanguageTag } from './LanguageTag';
+// Identity + email.
+export { normalizeEmail, isValidEmailFormat, MAX_EMAIL_LENGTH } from './EmailUtil';
+export { EMAIL_FORMAT_RE } from './Identity';
+// Identifiers.
+export { UUIDUtil } from './UUIDUtil';
+export { CryptoIdGenerator, FixedIdGenerator } from './IdGenerator';
+// Crypto + secrets.
+export { CryptoUtil } from './CryptoUtil';
+// Error handling.
+export { ErrorSanitizationUtil } from './ErrorSanitizationUtil';
+export { err, getOrThrow, isOk, mapResult, ok } from './Result';
+// Network policy.
+export { normalizeRemoteUrl, resolveRedirectUrl, parseAllowedHosts, isPrivateOrInternalHost, stripBrackets, stripTrailingDot, RemoteUrlRejectedError, MAX_REMOTE_URL_LENGTH, MAX_REDIRECTS, BLOCKED_HOST_SUFFIXES, BLOCKED_HOSTNAMES, } from './RemoteUrlPolicy';
+// Pagination.
+export { CursorCodec } from './CursorCodec';
+// Cloudflare subrequest accounting.
+export { SubrequestCounter, UNMETERED_SUBREQUESTS, SUBREQUEST_KINDS, subrequestSpend, NO_SUBREQUESTS_SPENT } from './SubrequestMeter';
+// Auth-side memo helper.
+export { passwordFingerprint } from './PasswordFingerprint';
+// Token hashing.
+export { TokenHashUtil } from './TokenHashUtil';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,eAAe;AACf,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAExD,QAAQ;AACR,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEhE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEjE,UAAU;AACV,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEnG,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAGxD,oBAAoB;AACpB,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,eAAe;AACf,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAGpE,oBAAoB;AACpB,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,kBAAkB;AAClB,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AAGhE,kBAAkB;AAClB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,uBAAuB,EACvB,aAAa,EACb,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,aAAa,EACb,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAG3B,cAAc;AACd,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAG5C,oCAAoC;AACpC,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAGtI,yBAAyB;AACzB,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,iBAAiB;AACjB,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC"}

package/package.json

@@ -1,6 +1,37 @@
 {
   "name": "@rexezuge/shared",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "1.0.1",
+  "private": false,
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Rexezuge-CloudflareWorkers/SDK.git",
+    "directory": "packages/shared"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./*": {
+      "types": "./dist/*.d.ts",
+      "default": "./dist/*.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "devDependencies": {
+    "@types/node": "26.6.4",
+    "typescript": "6.0.3",
+    "vitest": "4.1.11"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.test.json --noEmit",
+    "test": "vitest run"
+  }
 }

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.