@storyshelf/core 0.3.1 → 0.5.3

package/dist/utils/http.mjs

@@ -0,0 +1,147 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { injectTraceContext, withSpan } from "../tracing.mjs";
+//#region src/utils/http.ts
+/**
+* Fetch JSON with timeout, retries, and structured errors.
+*
+* Retries network failures, 429, and 502/503/504 (honoring `Retry-After`);
+* every other status throws {@link HttpError} immediately.
+*
+* @param url - Absolute request URL.
+* @param options - Method, headers, JSON body, timeout, retries, logger.
+* @returns The parsed JSON response body.
+*/
+async function httpJson(url, options = {}) {
+	return await requestWithRetry(url, options, options.retries ?? DEFAULT_RETRIES, options.timeoutMs ?? DEFAULT_TIMEOUT_MS, doFetchJson);
+}
+/**
+* POST/PUT plain payloads (e.g. Slack/Teams webhook cards) with the same
+* timeout, retry, and `Retry-After` semantics as {@link httpJson}.
+*
+* @param url - Absolute request URL.
+* @param options - Method, headers, text body, timeout, retries, logger.
+* @returns The raw response body text.
+*/
+async function httpText(url, options = {}) {
+	return await requestWithRetry(url, options, options.retries ?? DEFAULT_RETRIES, options.timeoutMs ?? DEFAULT_TIMEOUT_MS, doFetchText);
+}
+/** Failed HTTP response: status code plus a snippet of the response body. */
+var HttpError = class extends Error {
+	status;
+	body;
+	headers;
+	constructor(status, body, headers) {
+		super(`HTTP ${status}: ${body}`);
+		this.name = "HttpError";
+		this.status = status;
+		this.body = body;
+		this.headers = headers ?? new Headers();
+	}
+};
+const DEFAULT_TIMEOUT_MS = 3e4;
+const DEFAULT_RETRIES = 3;
+const MAX_RETRY_AFTER_MS = 3e4;
+const BACKOFF_BASE_MS = 1e3;
+const MAX_BODY_SNIPPET = 500;
+/** Whether a failure is worth retrying: network errors, 429, and 502/503/504. */
+function shouldRetry(error, attempt, maxAttempts) {
+	if (attempt >= maxAttempts) return false;
+	if (!(error instanceof HttpError)) return true;
+	return error.status === 429 || error.status >= 502 && error.status <= 504;
+}
+/** Parse a Retry-After value (seconds or HTTP-date) into milliseconds. */
+function parseRetryAfter(value) {
+	if (!value) return null;
+	const seconds = Number(value);
+	if (Number.isFinite(seconds) && seconds >= 0) return Math.min(seconds * 1e3, MAX_RETRY_AFTER_MS);
+	const date = Date.parse(value);
+	if (!Number.isNaN(date)) return Math.min(Math.max(date - Date.now(), 0), MAX_RETRY_AFTER_MS);
+	return null;
+}
+/** Delay before the next attempt: Retry-After when present, else 1s/2s/4s. */
+function retryDelayMs(error, attempt) {
+	if (error instanceof HttpError) {
+		const retryAfter = parseRetryAfter(error.headers.get("retry-after"));
+		if (retryAfter !== null) return retryAfter;
+	}
+	return Math.min(BACKOFF_BASE_MS * 2 ** (attempt - 1), MAX_RETRY_AFTER_MS);
+}
+/** Sleep helper for retry backoff. */
+async function sleep(ms) {
+	await new Promise((resolve) => {
+		setTimeout(resolve, ms);
+	});
+}
+async function requestWithRetry(url, options, maxAttempts, timeoutMs, perform) {
+	return await withSpan("http.client", async (span) => {
+		for (let attempt = 1;; attempt += 1) try {
+			return await perform(url, options, timeoutMs);
+		} catch (error) {
+			span.recordException(error instanceof Error ? error : String(error));
+			if (!shouldRetry(error, attempt, maxAttempts)) throw error;
+			span.setAttribute("http.retry.count", attempt);
+			await backoff(error, attempt, url, options.logger);
+		}
+	}, {
+		"http.request.method": options.method ?? "GET",
+		"url.full": redactUrl(url)
+	});
+}
+/** Strip the query string (tokens, signatures) from a URL for span attributes. */
+function redactUrl(url) {
+	const query = url.indexOf("?");
+	return query === -1 ? url : url.slice(0, query);
+}
+async function backoff(error, attempt, url, logger) {
+	const delay = retryDelayMs(error, attempt);
+	logger?.warn({
+		url,
+		attempt,
+		delayMs: delay
+	}, "http request failed, retrying");
+	await sleep(delay);
+}
+function buildRequest(options) {
+	const headers = { ...options.headers };
+	let body;
+	if (options.json !== void 0) {
+		headers["content-type"] = "application/json";
+		body = JSON.stringify(options.json);
+	}
+	return {
+		headers,
+		body,
+		method: options.method ?? "GET"
+	};
+}
+async function doFetchJson(url, options, timeoutMs) {
+	return await (await doFetchResponse(url, options, timeoutMs)).json();
+}
+async function doFetchText(url, options, timeoutMs) {
+	return await (await doFetchResponse(url, options, timeoutMs)).text();
+}
+async function doFetchResponse(url, options, timeoutMs) {
+	const request = buildRequest(options);
+	injectTraceContext(request.headers);
+	options.logger?.debug({
+		url,
+		method: request.method
+	}, "http request");
+	const response = await fetch(url, {
+		method: request.method,
+		headers: request.headers,
+		body: request.body,
+		signal: AbortSignal.timeout(timeoutMs)
+	});
+	if (!response.ok) {
+		const text = await response.text();
+		throw new HttpError(response.status, text.slice(0, MAX_BODY_SNIPPET), response.headers);
+	}
+	return response;
+}
+//#endregion
+export { HttpError, httpJson, httpText };
+
+//# sourceMappingURL=http.mjs.map

package/dist/utils/http.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.mjs","names":[],"sources":["../../src/utils/http.ts"],"sourcesContent":["import type { Logger } from \"../logger.ts\";\nimport { injectTraceContext, withSpan } from \"../tracing.ts\";\n\n/**\n * Fetch JSON with timeout, retries, and structured errors.\n *\n * Retries network failures, 429, and 502/503/504 (honoring `Retry-After`);\n * every other status throws {@link HttpError} immediately.\n *\n * @param url - Absolute request URL.\n * @param options - Method, headers, JSON body, timeout, retries, logger.\n * @returns The parsed JSON response body.\n */\nexport async function httpJson<T>(url: string, options: HttpRequestOptions = {}): Promise<T> {\n  return await requestWithRetry<T>(\n    url,\n    options,\n    options.retries ?? DEFAULT_RETRIES,\n    options.timeoutMs ?? DEFAULT_TIMEOUT_MS,\n    doFetchJson,\n  );\n}\n\n/**\n * POST/PUT plain payloads (e.g. Slack/Teams webhook cards) with the same\n * timeout, retry, and `Retry-After` semantics as {@link httpJson}.\n *\n * @param url - Absolute request URL.\n * @param options - Method, headers, text body, timeout, retries, logger.\n * @returns The raw response body text.\n */\nexport async function httpText(url: string, options: HttpTextOptions = {}): Promise<string> {\n  return await requestWithRetry<string>(\n    url,\n    options,\n    options.retries ?? DEFAULT_RETRIES,\n    options.timeoutMs ?? DEFAULT_TIMEOUT_MS,\n    doFetchText,\n  );\n}\n\n/** Failed HTTP response: status code plus a snippet of the response body. */\nexport class HttpError extends Error {\n  readonly status: number;\n  readonly body: string;\n  readonly headers: Headers;\n\n  constructor(status: number, body: string, headers?: Headers) {\n    super(`HTTP ${status}: ${body}`);\n    this.name = \"HttpError\";\n    this.status = status;\n    this.body = body;\n    this.headers = headers ?? new Headers();\n  }\n}\n\n/** Options for {@link httpJson}. */\nexport interface HttpRequestOptions {\n  method?: string;\n  headers?: Record<string, string>;\n  /** Body serialized as JSON with a `content-type` header. */\n  json?: unknown;\n  /** Per-attempt timeout in milliseconds (default 30s). */\n  timeoutMs?: number;\n  /** Total attempts including the first (default 3). */\n  retries?: number;\n  logger?: Logger;\n}\n\nconst DEFAULT_TIMEOUT_MS = 30_000;\n\n/** Options for {@link httpText}. */\nexport interface HttpTextOptions {\n  method?: string;\n  headers?: Record<string, string>;\n  /** Body serialized as JSON with a `content-type` header. */\n  json?: unknown;\n  /** Per-attempt timeout in milliseconds (default 30s). */\n  timeoutMs?: number;\n  /** Total attempts including the first (default 3). */\n  retries?: number;\n  logger?: Logger;\n}\nconst DEFAULT_RETRIES = 3;\nconst MAX_RETRY_AFTER_MS = 30_000;\nconst BACKOFF_BASE_MS = 1000;\nconst MAX_BODY_SNIPPET = 500;\n\n/** Whether a failure is worth retrying: network errors, 429, and 502/503/504. */\nfunction shouldRetry(error: unknown, attempt: number, maxAttempts: number): boolean {\n  if (attempt >= maxAttempts) {\n    return false;\n  }\n  if (!(error instanceof HttpError)) {\n    return true;\n  }\n  return error.status === 429 || (error.status >= 502 && error.status <= 504);\n}\n\n/** Parse a Retry-After value (seconds or HTTP-date) into milliseconds. */\nfunction parseRetryAfter(value: string | null): number | null {\n  if (!value) {\n    return null;\n  }\n  const seconds = Number(value);\n  if (Number.isFinite(seconds) && seconds >= 0) {\n    return Math.min(seconds * 1000, MAX_RETRY_AFTER_MS);\n  }\n  const date = Date.parse(value);\n  if (!Number.isNaN(date)) {\n    return Math.min(Math.max(date - Date.now(), 0), MAX_RETRY_AFTER_MS);\n  }\n  return null;\n}\n\n/** Delay before the next attempt: Retry-After when present, else 1s/2s/4s. */\nfunction retryDelayMs(error: unknown, attempt: number): number {\n  if (error instanceof HttpError) {\n    const retryAfter = parseRetryAfter(error.headers.get(\"retry-after\"));\n    if (retryAfter !== null) {\n      return retryAfter;\n    }\n  }\n  return Math.min(BACKOFF_BASE_MS * 2 ** (attempt - 1), MAX_RETRY_AFTER_MS);\n}\n\n/** Sleep helper for retry backoff. */\nasync function sleep(ms: number): Promise<void> {\n  await new Promise((resolve) => {\n    setTimeout(resolve, ms);\n  });\n}\n\n/* oxlint-disable eslint/no-await-in-loop -- retry attempts run sequentially by design */\nasync function requestWithRetry<T>(\n  url: string,\n  options: HttpRequestOptions,\n  maxAttempts: number,\n  timeoutMs: number,\n  perform: (url: string, options: HttpRequestOptions, timeoutMs: number) => Promise<T>,\n): Promise<T> {\n  return await withSpan(\n    \"http.client\",\n    async (span) => {\n      for (let attempt = 1; ; attempt += 1) {\n        try {\n          return await perform(url, options, timeoutMs);\n        } catch (error) {\n          span.recordException(error instanceof Error ? error : String(error));\n          if (!shouldRetry(error, attempt, maxAttempts)) {\n            throw error;\n          }\n          span.setAttribute(\"http.retry.count\", attempt);\n          await backoff(error, attempt, url, options.logger);\n        }\n      }\n    },\n    { \"http.request.method\": options.method ?? \"GET\", \"url.full\": redactUrl(url) },\n  );\n}\n/* oxlint-enable eslint/no-await-in-loop */\n\n/** Strip the query string (tokens, signatures) from a URL for span attributes. */\nfunction redactUrl(url: string): string {\n  const query = url.indexOf(\"?\");\n  return query === -1 ? url : url.slice(0, query);\n}\n\nasync function backoff(\n  error: unknown,\n  attempt: number,\n  url: string,\n  logger?: Logger,\n): Promise<void> {\n  const delay = retryDelayMs(error, attempt);\n  logger?.warn({ url, attempt, delayMs: delay }, \"http request failed, retrying\");\n  await sleep(delay);\n}\n\nfunction buildRequest(options: HttpRequestOptions): {\n  headers: Record<string, string>;\n  body: string | undefined;\n  method: string;\n} {\n  const headers: Record<string, string> = { ...options.headers };\n  let body: string | undefined;\n  if (options.json !== undefined) {\n    headers[\"content-type\"] = \"application/json\";\n    body = JSON.stringify(options.json);\n  }\n  return { headers, body, method: options.method ?? \"GET\" };\n}\n\nasync function doFetchJson<T>(\n  url: string,\n  options: HttpRequestOptions,\n  timeoutMs: number,\n): Promise<T> {\n  const response = await doFetchResponse(url, options, timeoutMs);\n  return (await response.json()) as T;\n}\n\nasync function doFetchText(\n  url: string,\n  options: HttpRequestOptions,\n  timeoutMs: number,\n): Promise<string> {\n  const response = await doFetchResponse(url, options, timeoutMs);\n  return await response.text();\n}\n\nasync function doFetchResponse(\n  url: string,\n  options: HttpRequestOptions,\n  timeoutMs: number,\n): Promise<Response> {\n  const request = buildRequest(options);\n  injectTraceContext(request.headers);\n  options.logger?.debug({ url, method: request.method }, \"http request\");\n  const response = await fetch(url, {\n    method: request.method,\n    headers: request.headers,\n    body: request.body,\n    signal: AbortSignal.timeout(timeoutMs),\n  });\n  if (!response.ok) {\n    const text = await response.text();\n    throw new HttpError(response.status, text.slice(0, MAX_BODY_SNIPPET), response.headers);\n  }\n  return response;\n}\n"],"mappings":";;;;;;;;;;;;;;;AAaA,eAAsB,SAAY,KAAa,UAA8B,CAAC,GAAe;CAC3F,OAAO,MAAM,iBACX,KACA,SACA,QAAQ,WAAW,iBACnB,QAAQ,aAAa,oBACrB,WACF;AACF;;;;;;;;;AAUA,eAAsB,SAAS,KAAa,UAA2B,CAAC,GAAoB;CAC1F,OAAO,MAAM,iBACX,KACA,SACA,QAAQ,WAAW,iBACnB,QAAQ,aAAa,oBACrB,WACF;AACF;;AAGA,IAAa,YAAb,cAA+B,MAAM;CACnC;CACA;CACA;CAEA,YAAY,QAAgB,MAAc,SAAmB;EAC3D,MAAM,QAAQ,OAAO,IAAI,MAAM;EAC/B,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,OAAO;EACZ,KAAK,UAAU,WAAW,IAAI,QAAQ;CACxC;AACF;AAeA,MAAM,qBAAqB;AAc3B,MAAM,kBAAkB;AACxB,MAAM,qBAAqB;AAC3B,MAAM,kBAAkB;AACxB,MAAM,mBAAmB;;AAGzB,SAAS,YAAY,OAAgB,SAAiB,aAA8B;CAClF,IAAI,WAAW,aACb,OAAO;CAET,IAAI,EAAE,iBAAiB,YACrB,OAAO;CAET,OAAO,MAAM,WAAW,OAAQ,MAAM,UAAU,OAAO,MAAM,UAAU;AACzE;;AAGA,SAAS,gBAAgB,OAAqC;CAC5D,IAAI,CAAC,OACH,OAAO;CAET,MAAM,UAAU,OAAO,KAAK;CAC5B,IAAI,OAAO,SAAS,OAAO,KAAK,WAAW,GACzC,OAAO,KAAK,IAAI,UAAU,KAAM,kBAAkB;CAEpD,MAAM,OAAO,KAAK,MAAM,KAAK;CAC7B,IAAI,CAAC,OAAO,MAAM,IAAI,GACpB,OAAO,KAAK,IAAI,KAAK,IAAI,OAAO,KAAK,IAAI,GAAG,CAAC,GAAG,kBAAkB;CAEpE,OAAO;AACT;;AAGA,SAAS,aAAa,OAAgB,SAAyB;CAC7D,IAAI,iBAAiB,WAAW;EAC9B,MAAM,aAAa,gBAAgB,MAAM,QAAQ,IAAI,aAAa,CAAC;EACnE,IAAI,eAAe,MACjB,OAAO;CAEX;CACA,OAAO,KAAK,IAAI,kBAAkB,MAAM,UAAU,IAAI,kBAAkB;AAC1E;;AAGA,eAAe,MAAM,IAA2B;CAC9C,MAAM,IAAI,SAAS,YAAY;EAC7B,WAAW,SAAS,EAAE;CACxB,CAAC;AACH;AAGA,eAAe,iBACb,KACA,SACA,aACA,WACA,SACY;CACZ,OAAO,MAAM,SACX,eACA,OAAO,SAAS;EACd,KAAK,IAAI,UAAU,IAAK,WAAW,GACjC,IAAI;GACF,OAAO,MAAM,QAAQ,KAAK,SAAS,SAAS;EAC9C,SAAS,OAAO;GACd,KAAK,gBAAgB,iBAAiB,QAAQ,QAAQ,OAAO,KAAK,CAAC;GACnE,IAAI,CAAC,YAAY,OAAO,SAAS,WAAW,GAC1C,MAAM;GAER,KAAK,aAAa,oBAAoB,OAAO;GAC7C,MAAM,QAAQ,OAAO,SAAS,KAAK,QAAQ,MAAM;EACnD;CAEJ,GACA;EAAE,uBAAuB,QAAQ,UAAU;EAAO,YAAY,UAAU,GAAG;CAAE,CAC/E;AACF;;AAIA,SAAS,UAAU,KAAqB;CACtC,MAAM,QAAQ,IAAI,QAAQ,GAAG;CAC7B,OAAO,UAAU,KAAK,MAAM,IAAI,MAAM,GAAG,KAAK;AAChD;AAEA,eAAe,QACb,OACA,SACA,KACA,QACe;CACf,MAAM,QAAQ,aAAa,OAAO,OAAO;CACzC,QAAQ,KAAK;EAAE;EAAK;EAAS,SAAS;CAAM,GAAG,+BAA+B;CAC9E,MAAM,MAAM,KAAK;AACnB;AAEA,SAAS,aAAa,SAIpB;CACA,MAAM,UAAkC,EAAE,GAAG,QAAQ,QAAQ;CAC7D,IAAI;CACJ,IAAI,QAAQ,SAAS,KAAA,GAAW;EAC9B,QAAQ,kBAAkB;EAC1B,OAAO,KAAK,UAAU,QAAQ,IAAI;CACpC;CACA,OAAO;EAAE;EAAS;EAAM,QAAQ,QAAQ,UAAU;CAAM;AAC1D;AAEA,eAAe,YACb,KACA,SACA,WACY;CAEZ,OAAQ,OAAM,MADS,gBAAgB,KAAK,SAAS,SAAS,EAAA,CACvC,KAAK;AAC9B;AAEA,eAAe,YACb,KACA,SACA,WACiB;CAEjB,OAAO,OAAM,MADU,gBAAgB,KAAK,SAAS,SAAS,EAAA,CACxC,KAAK;AAC7B;AAEA,eAAe,gBACb,KACA,SACA,WACmB;CACnB,MAAM,UAAU,aAAa,OAAO;CACpC,mBAAmB,QAAQ,OAAO;CAClC,QAAQ,QAAQ,MAAM;EAAE;EAAK,QAAQ,QAAQ;CAAO,GAAG,cAAc;CACrE,MAAM,WAAW,MAAM,MAAM,KAAK;EAChC,QAAQ,QAAQ;EAChB,SAAS,QAAQ;EACjB,MAAM,QAAQ;EACd,QAAQ,YAAY,QAAQ,SAAS;CACvC,CAAC;CACD,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,MAAM,IAAI,UAAU,SAAS,QAAQ,KAAK,MAAM,GAAG,gBAAgB,GAAG,SAAS,OAAO;CACxF;CACA,OAAO;AACT"}

package/dist/utils/mime.d.mts

@@ -0,0 +1,9 @@
+import __tsdown_shims_path from 'node:path';
+import __tsdown_shims_url from 'node:url';
+//#region src/utils/mime.d.ts
+/** Shared MIME types for storybook static serving. */
+declare const MIME_TYPES: Record<string, string>;
+declare function mimeFor(filePath: string): string;
+//#endregion
+export { MIME_TYPES, mimeFor };
+//# sourceMappingURL=mime.d.mts.map

package/dist/utils/mime.mjs

@@ -0,0 +1,33 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/utils/mime.ts
+/** Shared MIME types for storybook static serving. */
+const MIME_TYPES = {
+	".css": "text/css; charset=utf-8",
+	".html": "text/html; charset=utf-8",
+	".htm": "text/html; charset=utf-8",
+	".ico": "image/x-icon",
+	".jpeg": "image/jpeg",
+	".jpg": "image/jpeg",
+	".js": "application/javascript",
+	".json": "application/json; charset=utf-8",
+	".map": "application/json; charset=utf-8",
+	".mjs": "application/javascript",
+	".png": "image/png",
+	".svg": "image/svg+xml",
+	".webp": "image/webp",
+	".woff": "font/woff",
+	".woff2": "font/woff2",
+	".ttf": "font/ttf",
+	".wasm": "application/wasm",
+	".gif": "image/gif"
+};
+function mimeFor(filePath) {
+	const ext = filePath.slice(filePath.lastIndexOf(".")).toLowerCase();
+	return MIME_TYPES[ext] ?? "application/octet-stream";
+}
+//#endregion
+export { MIME_TYPES, mimeFor };
+
+//# sourceMappingURL=mime.mjs.map

package/dist/utils/mime.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"mime.mjs","names":[],"sources":["../../src/utils/mime.ts"],"sourcesContent":["/** Shared MIME types for storybook static serving. */\nexport const MIME_TYPES: Record<string, string> = {\n  \".css\": \"text/css; charset=utf-8\",\n  \".html\": \"text/html; charset=utf-8\",\n  \".htm\": \"text/html; charset=utf-8\",\n  \".ico\": \"image/x-icon\",\n  \".jpeg\": \"image/jpeg\",\n  \".jpg\": \"image/jpeg\",\n  \".js\": \"application/javascript\",\n  \".json\": \"application/json; charset=utf-8\",\n  \".map\": \"application/json; charset=utf-8\",\n  \".mjs\": \"application/javascript\",\n  \".png\": \"image/png\",\n  \".svg\": \"image/svg+xml\",\n  \".webp\": \"image/webp\",\n  \".woff\": \"font/woff\",\n  \".woff2\": \"font/woff2\",\n  \".ttf\": \"font/ttf\",\n  \".wasm\": \"application/wasm\",\n  \".gif\": \"image/gif\",\n};\n\nexport function mimeFor(filePath: string): string {\n  const ext = filePath.slice(filePath.lastIndexOf(\".\")).toLowerCase();\n  return MIME_TYPES[ext] ?? \"application/octet-stream\";\n}\n"],"mappings":";;;;;AACA,MAAa,aAAqC;CAChD,QAAQ;CACR,SAAS;CACT,QAAQ;CACR,QAAQ;CACR,SAAS;CACT,QAAQ;CACR,OAAO;CACP,SAAS;CACT,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,SAAS;CACT,SAAS;CACT,UAAU;CACV,QAAQ;CACR,SAAS;CACT,QAAQ;AACV;AAEA,SAAgB,QAAQ,UAA0B;CAChD,MAAM,MAAM,SAAS,MAAM,SAAS,YAAY,GAAG,CAAC,CAAC,CAAC,YAAY;CAClE,OAAO,WAAW,QAAQ;AAC5B"}

package/dist/utils/path-security.d.mts

@@ -0,0 +1,12 @@
+import __tsdown_shims_path from 'node:path';
+import __tsdown_shims_url from 'node:url';
+//#region src/utils/path-security.d.ts
+/** Whether a path segment is safe (no traversal). */
+declare function isSafeSegment(segment: string): boolean;
+/** Whether joining root with candidate stays inside root (no traversal). */
+declare function isPathSafe(root: string, candidate: string): boolean;
+/** Check if a path built from root + entry would escape root (for zip extraction). */
+declare function isBlockedTarget(root: string, entryPath: string): boolean;
+//#endregion
+export { isBlockedTarget, isPathSafe, isSafeSegment };
+//# sourceMappingURL=path-security.d.mts.map

package/dist/utils/path-security.mjs

@@ -0,0 +1,24 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { join, normalize, sep } from "node:path";
+//#region src/utils/path-security.ts
+/** Whether a path segment is safe (no traversal). */
+function isSafeSegment(segment) {
+	return segment !== ".." && !segment.startsWith("/") && !segment.includes("\\") && !segment.includes("..");
+}
+/** Whether joining root with candidate stays inside root (no traversal). */
+function isPathSafe(root, candidate) {
+	const normalizedRoot = normalize(root);
+	const normalizedCandidate = normalize(candidate);
+	return normalizedCandidate === normalizedRoot || normalizedCandidate.startsWith(normalizedRoot + sep) || normalizedCandidate.startsWith(`${normalizedRoot}/`);
+}
+/** Check if a path built from root + entry would escape root (for zip extraction). */
+function isBlockedTarget(root, entryPath) {
+	const target = normalize(join(root, entryPath));
+	return target !== root && !target.startsWith(normalize(root) + sep);
+}
+//#endregion
+export { isBlockedTarget, isPathSafe, isSafeSegment };
+
+//# sourceMappingURL=path-security.mjs.map

package/dist/utils/path-security.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-security.mjs","names":[],"sources":["../../src/utils/path-security.ts"],"sourcesContent":["import { join, normalize, sep } from \"node:path\";\n\n/** Whether a path segment is safe (no traversal). */\nexport function isSafeSegment(segment: string): boolean {\n  return (\n    segment !== \"..\" &&\n    !segment.startsWith(\"/\") &&\n    !segment.includes(\"\\\\\") &&\n    !segment.includes(\"..\")\n  );\n}\n\n/** Whether joining root with candidate stays inside root (no traversal). */\nexport function isPathSafe(root: string, candidate: string): boolean {\n  const normalizedRoot = normalize(root);\n  const normalizedCandidate = normalize(candidate);\n  return (\n    normalizedCandidate === normalizedRoot ||\n    normalizedCandidate.startsWith(normalizedRoot + sep) ||\n    normalizedCandidate.startsWith(`${normalizedRoot}/`)\n  );\n}\n\n/** Check if a path built from root + entry would escape root (for zip extraction). */\nexport function isBlockedTarget(root: string, entryPath: string): boolean {\n  const target = normalize(join(root, entryPath));\n  return target !== root && !target.startsWith(normalize(root) + sep);\n}\n"],"mappings":";;;;;;AAGA,SAAgB,cAAc,SAA0B;CACtD,OACE,YAAY,QACZ,CAAC,QAAQ,WAAW,GAAG,KACvB,CAAC,QAAQ,SAAS,IAAI,KACtB,CAAC,QAAQ,SAAS,IAAI;AAE1B;;AAGA,SAAgB,WAAW,MAAc,WAA4B;CACnE,MAAM,iBAAiB,UAAU,IAAI;CACrC,MAAM,sBAAsB,UAAU,SAAS;CAC/C,OACE,wBAAwB,kBACxB,oBAAoB,WAAW,iBAAiB,GAAG,KACnD,oBAAoB,WAAW,GAAG,eAAe,EAAE;AAEvD;;AAGA,SAAgB,gBAAgB,MAAc,WAA4B;CACxE,MAAM,SAAS,UAAU,KAAK,MAAM,SAAS,CAAC;CAC9C,OAAO,WAAW,QAAQ,CAAC,OAAO,WAAW,UAAU,IAAI,IAAI,GAAG;AACpE"}

package/dist/utils/redact.d.mts

@@ -0,0 +1,17 @@
+import __tsdown_shims_path from 'node:path';
+import __tsdown_shims_url from 'node:url';
+//#region src/utils/redact.d.ts
+/**
+ * Secret redaction for adapter errors, health details, and logs.
+ *
+ * Adapter-thrown messages routinely embed connection strings and tokens.
+ * Every surface that exposes adapter text (503 gate, health report, error
+ * logs) must pass through here before truncation or transport.
+ */
+/** Replace embedded secrets with `[redacted]`. Never throws on weird input. */
+declare function redactSecrets(text: string): string;
+/** Redact secrets, then truncate to `maxLength`. */
+declare function sanitizeErrorText(text: string, maxLength: number): string;
+//#endregion
+export { redactSecrets, sanitizeErrorText };
+//# sourceMappingURL=redact.d.mts.map

package/dist/utils/redact.mjs

@@ -0,0 +1,42 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/utils/redact.ts
+/**
+* Secret redaction for adapter errors, health details, and logs.
+*
+* Adapter-thrown messages routinely embed connection strings and tokens.
+* Every surface that exposes adapter text (503 gate, health report, error
+* logs) must pass through here before truncation or transport.
+*/
+const SECRET_PATTERNS = [
+	/(:\/\/)[^/\s:]+:[^/\s@]+(?=@)/u,
+	/([?&#](?:token|secret|password|api[_-]?key|auth[_-]?token|access[_-]?key)=)[^&#\s]*/giu,
+	/((?:password|passwd|secret|token|api[_-]?key|auth[_-]?token|client[_-]?secret|access[_-]?key|private[_-]?key)\s*[:=]\s*['"]?)[^\s'";,[\]&]+/giu,
+	/AKIA[0-9A-Z]{16}/gu,
+	/gh[pous]_[A-Za-z0-9_]+/gu,
+	/github_pat_[A-Za-z0-9_]+/gu,
+	/xox[bpasr]-[A-Za-z0-9-]+/gu,
+	/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gu
+];
+/** Replace embedded secrets with `[redacted]`. Never throws on weird input. */
+function redactSecrets(text) {
+	let redacted = text;
+	for (const pattern of SECRET_PATTERNS) {
+		pattern.lastIndex = 0;
+		redacted = redacted.replace(pattern, (...args) => {
+			const group = args[1];
+			return typeof group === "string" ? `${group}[redacted]` : "[redacted]";
+		});
+	}
+	return redacted;
+}
+/** Redact secrets, then truncate to `maxLength`. */
+function sanitizeErrorText(text, maxLength) {
+	const redacted = redactSecrets(text);
+	return redacted.length > maxLength ? redacted.slice(0, maxLength) : redacted;
+}
+//#endregion
+export { redactSecrets, sanitizeErrorText };
+
+//# sourceMappingURL=redact.mjs.map

package/dist/utils/redact.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.mjs","names":[],"sources":["../../src/utils/redact.ts"],"sourcesContent":["/**\n * Secret redaction for adapter errors, health details, and logs.\n *\n * Adapter-thrown messages routinely embed connection strings and tokens.\n * Every surface that exposes adapter text (503 gate, health report, error\n * logs) must pass through here before truncation or transport.\n */\n\nconst SECRET_PATTERNS: RegExp[] = [\n  /(:\\/\\/)[^/\\s:]+:[^/\\s@]+(?=@)/u,\n  /([?&#](?:token|secret|password|api[_-]?key|auth[_-]?token|access[_-]?key)=)[^&#\\s]*/giu,\n  /((?:password|passwd|secret|token|api[_-]?key|auth[_-]?token|client[_-]?secret|access[_-]?key|private[_-]?key)\\s*[:=]\\s*['\"]?)[^\\s'\";,[\\]&]+/giu,\n  /AKIA[0-9A-Z]{16}/gu,\n  /gh[pous]_[A-Za-z0-9_]+/gu,\n  /github_pat_[A-Za-z0-9_]+/gu,\n  /xox[bpasr]-[A-Za-z0-9-]+/gu,\n  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\\s\\S]*?-----END [A-Z ]*PRIVATE KEY-----/gu,\n];\n\n/** Replace embedded secrets with `[redacted]`. Never throws on weird input. */\nexport function redactSecrets(text: string): string {\n  let redacted = text;\n  for (const pattern of SECRET_PATTERNS) {\n    pattern.lastIndex = 0;\n    redacted = redacted.replace(pattern, (...args: unknown[]) => {\n      const group = args[1];\n      return typeof group === \"string\" ? `${group}[redacted]` : \"[redacted]\";\n    });\n  }\n  return redacted;\n}\n\n/** Redact secrets, then truncate to `maxLength`. */\nexport function sanitizeErrorText(text: string, maxLength: number): string {\n  const redacted = redactSecrets(text);\n  return redacted.length > maxLength ? redacted.slice(0, maxLength) : redacted;\n}\n"],"mappings":";;;;;;;;;;;AAQA,MAAM,kBAA4B;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;AAGA,SAAgB,cAAc,MAAsB;CAClD,IAAI,WAAW;CACf,KAAK,MAAM,WAAW,iBAAiB;EACrC,QAAQ,YAAY;EACpB,WAAW,SAAS,QAAQ,UAAU,GAAG,SAAoB;GAC3D,MAAM,QAAQ,KAAK;GACnB,OAAO,OAAO,UAAU,WAAW,GAAG,MAAM,cAAc;EAC5D,CAAC;CACH;CACA,OAAO;AACT;;AAGA,SAAgB,kBAAkB,MAAc,WAA2B;CACzE,MAAM,WAAW,cAAc,IAAI;CACnC,OAAO,SAAS,SAAS,YAAY,SAAS,MAAM,GAAG,SAAS,IAAI;AACtE"}

package/dist/utils/timing.d.mts

@@ -0,0 +1,19 @@
+import __tsdown_shims_path from 'node:path';
+import __tsdown_shims_url from 'node:url';
+//#region src/utils/timing.d.ts
+/** Aggregated durations for one scope (family/phase name → total ms). */
+type TimingMap = Record<string, number>;
+/** Run `fn` with a fresh timing scope, returning its result and aggregates. */
+declare function runWithTimings<T>(fn: () => T | Promise<T>): Promise<{
+  result: T;
+  timings: TimingMap;
+}>;
+/** Add `durationMs` to `name` in the active scope (no-op when scopeless). */
+declare function addTiming(name: string, durationMs: number): void;
+/** Run `fn`, recording its wall duration under `name` in the active scope. */
+declare function timed<T>(name: string, fn: () => T | Promise<T>): Promise<T>;
+/** Copy of aggregates with whole-millisecond values for logs and headers. */
+declare function roundedTimings(timings: TimingMap): TimingMap;
+//#endregion
+export { TimingMap, addTiming, roundedTimings, runWithTimings, timed };
+//# sourceMappingURL=timing.d.mts.map

package/dist/utils/timing.mjs

@@ -0,0 +1,46 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { AsyncLocalStorage } from "node:async_hooks";
+//#region src/utils/timing.ts
+/**
+* Per-scope timing recorder: aggregate millisecond sums under shared names.
+*
+* Framework- and telemetry-free (ALS + numbers only) so any host — the Hono
+* app, the remote worker, or a third-party server — can open a scope. The
+* app folds request scopes into `Server-Timing`; background scopes surface
+* as log lines and attempt history. Without an open scope every call is a
+* cheap no-op, keeping unit tests and sleeping workers silent.
+*/
+const scopes = new AsyncLocalStorage();
+/** Run `fn` with a fresh timing scope, returning its result and aggregates. */
+async function runWithTimings(fn) {
+	const timings = {};
+	return {
+		result: await scopes.run(timings, fn),
+		timings
+	};
+}
+/** Add `durationMs` to `name` in the active scope (no-op when scopeless). */
+function addTiming(name, durationMs) {
+	const timings = scopes.getStore();
+	if (!timings) return;
+	timings[name] = (timings[name] ?? 0) + durationMs;
+}
+/** Run `fn`, recording its wall duration under `name` in the active scope. */
+async function timed(name, fn) {
+	const started = performance.now();
+	try {
+		return await fn();
+	} finally {
+		addTiming(name, performance.now() - started);
+	}
+}
+/** Copy of aggregates with whole-millisecond values for logs and headers. */
+function roundedTimings(timings) {
+	return Object.fromEntries(Object.entries(timings).map(([name, ms]) => [name, Math.round(ms)]));
+}
+//#endregion
+export { addTiming, roundedTimings, runWithTimings, timed };
+
+//# sourceMappingURL=timing.mjs.map

package/dist/utils/timing.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"timing.mjs","names":[],"sources":["../../src/utils/timing.ts"],"sourcesContent":["/**\n * Per-scope timing recorder: aggregate millisecond sums under shared names.\n *\n * Framework- and telemetry-free (ALS + numbers only) so any host — the Hono\n * app, the remote worker, or a third-party server — can open a scope. The\n * app folds request scopes into `Server-Timing`; background scopes surface\n * as log lines and attempt history. Without an open scope every call is a\n * cheap no-op, keeping unit tests and sleeping workers silent.\n */\nimport { AsyncLocalStorage } from \"node:async_hooks\";\n\n/** Aggregated durations for one scope (family/phase name → total ms). */\nexport type TimingMap = Record<string, number>;\n\nconst scopes = new AsyncLocalStorage<TimingMap>();\n\n/** Run `fn` with a fresh timing scope, returning its result and aggregates. */\nexport async function runWithTimings<T>(\n  fn: () => T | Promise<T>,\n): Promise<{ result: T; timings: TimingMap }> {\n  const timings: TimingMap = {};\n  const result = await scopes.run(timings, fn);\n  return { result, timings };\n}\n\n/** Add `durationMs` to `name` in the active scope (no-op when scopeless). */\nexport function addTiming(name: string, durationMs: number): void {\n  const timings = scopes.getStore();\n  if (!timings) {\n    return;\n  }\n  timings[name] = (timings[name] ?? 0) + durationMs;\n}\n\n/** Run `fn`, recording its wall duration under `name` in the active scope. */\nexport async function timed<T>(name: string, fn: () => T | Promise<T>): Promise<T> {\n  const started = performance.now();\n  try {\n    return await fn();\n  } finally {\n    addTiming(name, performance.now() - started);\n  }\n}\n\n/** Copy of aggregates with whole-millisecond values for logs and headers. */\nexport function roundedTimings(timings: TimingMap): TimingMap {\n  return Object.fromEntries(Object.entries(timings).map(([name, ms]) => [name, Math.round(ms)]));\n}\n"],"mappings":";;;;;;;;;;;;;;AAcA,MAAM,SAAS,IAAI,kBAA6B;;AAGhD,eAAsB,eACpB,IAC4C;CAC5C,MAAM,UAAqB,CAAC;CAE5B,OAAO;EAAE,QAAA,MADY,OAAO,IAAI,SAAS,EAAE;EAC1B;CAAQ;AAC3B;;AAGA,SAAgB,UAAU,MAAc,YAA0B;CAChE,MAAM,UAAU,OAAO,SAAS;CAChC,IAAI,CAAC,SACH;CAEF,QAAQ,SAAS,QAAQ,SAAS,KAAK;AACzC;;AAGA,eAAsB,MAAS,MAAc,IAAsC;CACjF,MAAM,UAAU,YAAY,IAAI;CAChC,IAAI;EACF,OAAO,MAAM,GAAG;CAClB,UAAU;EACR,UAAU,MAAM,YAAY,IAAI,IAAI,OAAO;CAC7C;AACF;;AAGA,SAAgB,eAAe,SAA+B;CAC5D,OAAO,OAAO,YAAY,OAAO,QAAQ,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;AAC/F"}

package/dist/utils/ulid.d.mts

@@ -0,0 +1,10 @@
+import __tsdown_shims_path from 'node:path';
+import __tsdown_shims_url from 'node:url';
+//#region src/utils/ulid.d.ts
+/** Generate a sortable, collision-resistant ULID. */
+declare function ulid(): string;
+/** Convert a name to a URL-safe slug of at most 63 characters. */
+declare function slugify(value: string): string;
+//#endregion
+export { slugify, ulid };
+//# sourceMappingURL=ulid.d.mts.map

package/dist/utils/ulid.mjs

@@ -3,6 +3,14 @@ import "node:url";
 import.meta.url;
 import { randomBytes } from "node:crypto";
 //#region src/utils/ulid.ts
+/** Generate a sortable, collision-resistant ULID. */
+function ulid() {
+	return encodeTime(Date.now()) + encodeRandom(randomBytes(10));
+}
+/** Convert a name to a URL-safe slug of at most 63 characters. */
+function slugify(value) {
+	return value.toLowerCase().replaceAll(/[^a-z0-9]+/gu, "-").replaceAll(/^-+|-+$/gu, "").slice(0, 63);
+}
 const CROCKFORD = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
 function encodeTime(time) {
 	let out = "";
@@ -29,14 +37,6 @@ function encodeRandom(bytes) {
 	if (bits > 0) out += CROCKFORD.charAt(buffer << 5 - bits & 31);
 	return out;
 }
-/** Generate a sortable, collision-resistant ULID. */
-function ulid() {
-	return encodeTime(Date.now()) + encodeRandom(randomBytes(10));
-}
-/** Convert a name to a URL-safe slug of at most 63 characters. */
-function slugify(value) {
-	return value.toLowerCase().replaceAll(/[^a-z0-9]+/gu, "-").replaceAll(/^-+|-+$/gu, "").slice(0, 63);
-}
 //#endregion
 export { slugify, ulid };
 

package/dist/utils/ulid.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ulid.mjs","names":[],"sources":["../../src/utils/ulid.ts"],"sourcesContent":["import { randomBytes } from \"node:crypto\";\n\nconst CROCKFORD = \"0123456789ABCDEFGHJKMNPQRSTVWXYZ\";\n\nfunction encodeTime(time: number): string {\n  let out = \"\";\n  let remaining = time;\n  for (let i = 9; i >= 0; i -= 1) {\n    const mod = remaining % 32;\n    out = CROCKFORD.charAt(mod) + out;\n    remaining = (remaining - mod) / 32;\n  }\n  return out;\n}\n\n/* eslint-disable no-bitwise, no-non-null-assertion -- ULID encoding is inherently bitwise. */\nfunction encodeRandom(bytes: Buffer): string {\n  let out = \"\";\n  let buffer = 0;\n  let bits = 0;\n  for (const byte of bytes) {\n    buffer = (buffer << 8) | byte;\n    bits += 8;\n    while (bits >= 5) {\n      out += CROCKFORD.charAt((buffer >>> (bits - 5)) & 31);\n      bits -= 5;\n    }\n  }\n  if (bits > 0) {\n    out += CROCKFORD.charAt((buffer << (5 - bits)) & 31);\n  }\n  return out;\n}\n/* eslint-enable no-bitwise, no-non-null-assertion */\n\n/** Generate a sortable, collision-resistant ULID. */\nexport function ulid(): string {\n  return encodeTime(Date.now()) + encodeRandom(randomBytes(10));\n}\n\n/** Convert a name to a URL-safe slug of at most 63 characters. */\nexport function slugify(value: string): string {\n  return value\n    .toLowerCase()\n    .replaceAll(/[^a-z0-9]+/gu, \"-\")\n    .replaceAll(/^-+|-+$/gu, \"\")\n    .slice(0, 63);\n}\n"],"mappings":";;;;;AAEA,MAAM,YAAY;AAElB,SAAS,WAAW,MAAsB;CACxC,IAAI,MAAM;CACV,IAAI,YAAY;CAChB,KAAK,IAAI,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG;EAC9B,MAAM,MAAM,YAAY;EACxB,MAAM,UAAU,OAAO,GAAG,IAAI;EAC9B,aAAa,YAAY,OAAO;CAClC;CACA,OAAO;AACT;AAGA,SAAS,aAAa,OAAuB;CAC3C,IAAI,MAAM;CACV,IAAI,SAAS;CACb,IAAI,OAAO;CACX,KAAK,MAAM,QAAQ,OAAO;EACxB,SAAU,UAAU,IAAK;EACzB,QAAQ;EACR,OAAO,QAAQ,GAAG;GAChB,OAAO,UAAU,OAAQ,WAAY,OAAO,IAAM,EAAE;GACpD,QAAQ;EACV;CACF;CACA,IAAI,OAAO,GACT,OAAO,UAAU,OAAQ,UAAW,IAAI,OAAS,EAAE;CAErD,OAAO;AACT;;AAIA,SAAgB,OAAe;CAC7B,OAAO,WAAW,KAAK,IAAI,CAAC,IAAI,aAAa,YAAY,EAAE,CAAC;AAC9D;;AAGA,SAAgB,QAAQ,OAAuB;CAC7C,OAAO,MACJ,YAAY,CAAC,CACb,WAAW,gBAAgB,GAAG,CAAC,CAC/B,WAAW,aAAa,EAAE,CAAC,CAC3B,MAAM,GAAG,EAAE;AAChB"}
+{"version":3,"file":"ulid.mjs","names":[],"sources":["../../src/utils/ulid.ts"],"sourcesContent":["import { randomBytes } from \"node:crypto\";\n\n/** Generate a sortable, collision-resistant ULID. */\nexport function ulid(): string {\n  return encodeTime(Date.now()) + encodeRandom(randomBytes(10));\n}\n\n/** Convert a name to a URL-safe slug of at most 63 characters. */\nexport function slugify(value: string): string {\n  return value\n    .toLowerCase()\n    .replaceAll(/[^a-z0-9]+/gu, \"-\")\n    .replaceAll(/^-+|-+$/gu, \"\")\n    .slice(0, 63);\n}\n\nconst CROCKFORD = \"0123456789ABCDEFGHJKMNPQRSTVWXYZ\";\n\nfunction encodeTime(time: number): string {\n  let out = \"\";\n  let remaining = time;\n  for (let i = 9; i >= 0; i -= 1) {\n    const mod = remaining % 32;\n    out = CROCKFORD.charAt(mod) + out;\n    remaining = (remaining - mod) / 32;\n  }\n  return out;\n}\n\n/* eslint-disable no-bitwise, no-non-null-assertion -- ULID encoding is inherently bitwise. */\nfunction encodeRandom(bytes: Buffer): string {\n  let out = \"\";\n  let buffer = 0;\n  let bits = 0;\n  for (const byte of bytes) {\n    buffer = (buffer << 8) | byte;\n    bits += 8;\n    while (bits >= 5) {\n      out += CROCKFORD.charAt((buffer >>> (bits - 5)) & 31);\n      bits -= 5;\n    }\n  }\n  if (bits > 0) {\n    out += CROCKFORD.charAt((buffer << (5 - bits)) & 31);\n  }\n  return out;\n}\n/* eslint-enable no-bitwise, no-non-null-assertion */\n"],"mappings":";;;;;;AAGA,SAAgB,OAAe;CAC7B,OAAO,WAAW,KAAK,IAAI,CAAC,IAAI,aAAa,YAAY,EAAE,CAAC;AAC9D;;AAGA,SAAgB,QAAQ,OAAuB;CAC7C,OAAO,MACJ,YAAY,CAAC,CACb,WAAW,gBAAgB,GAAG,CAAC,CAC/B,WAAW,aAAa,EAAE,CAAC,CAC3B,MAAM,GAAG,EAAE;AAChB;AAEA,MAAM,YAAY;AAElB,SAAS,WAAW,MAAsB;CACxC,IAAI,MAAM;CACV,IAAI,YAAY;CAChB,KAAK,IAAI,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG;EAC9B,MAAM,MAAM,YAAY;EACxB,MAAM,UAAU,OAAO,GAAG,IAAI;EAC9B,aAAa,YAAY,OAAO;CAClC;CACA,OAAO;AACT;AAGA,SAAS,aAAa,OAAuB;CAC3C,IAAI,MAAM;CACV,IAAI,SAAS;CACb,IAAI,OAAO;CACX,KAAK,MAAM,QAAQ,OAAO;EACxB,SAAU,UAAU,IAAK;EACzB,QAAQ;EACR,OAAO,QAAQ,GAAG;GAChB,OAAO,UAAU,OAAQ,WAAY,OAAO,IAAM,EAAE;GACpD,QAAQ;EACV;CACF;CACA,IAAI,OAAO,GACT,OAAO,UAAU,OAAQ,UAAW,IAAI,OAAS,EAAE;CAErD,OAAO;AACT"}

package/dist/utils.d.mts

@@ -0,0 +1,12 @@
+import __tsdown_shims_path from 'node:path';
+import __tsdown_shims_url from 'node:url';
+import { KeyUsed, SecretInput, SecretKeys, UndecryptableCredentialError, decrypt, decryptCredential, decryptWithKey, encrypt } from "./utils/encrypt.mjs";
+import { hmacSha256, randomToken, sha256, timingSafeEqualString } from "./utils/hash.mjs";
+import { HttpError, HttpRequestOptions, HttpTextOptions, httpJson, httpText } from "./utils/http.mjs";
+import { baselinePath, diffPath, screenshotPath, storybookDir, storybookZipPath } from "./paths.mjs";
+import { MIME_TYPES, mimeFor } from "./utils/mime.mjs";
+import { isBlockedTarget, isPathSafe, isSafeSegment } from "./utils/path-security.mjs";
+import { redactSecrets, sanitizeErrorText } from "./utils/redact.mjs";
+import { TimingMap, addTiming, roundedTimings, runWithTimings, timed } from "./utils/timing.mjs";
+import { slugify, ulid } from "./utils/ulid.mjs";
+export { HttpError, type HttpRequestOptions, type HttpTextOptions, type KeyUsed, MIME_TYPES, type SecretInput, type SecretKeys, type TimingMap, UndecryptableCredentialError, addTiming, baselinePath, decrypt, decryptCredential, decryptWithKey, diffPath, encrypt, hmacSha256, httpJson, httpText, isBlockedTarget, isPathSafe, isSafeSegment, mimeFor, randomToken, redactSecrets, roundedTimings, runWithTimings, sanitizeErrorText, screenshotPath, sha256, slugify, storybookDir, storybookZipPath, timed, timingSafeEqualString, ulid };

package/dist/utils.mjs

@@ -0,0 +1,13 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { redactSecrets, sanitizeErrorText } from "./utils/redact.mjs";
+import { UndecryptableCredentialError, decrypt, decryptCredential, decryptWithKey, encrypt } from "./utils/encrypt.mjs";
+import { slugify, ulid } from "./utils/ulid.mjs";
+import { hmacSha256, randomToken, sha256, timingSafeEqualString } from "./utils/hash.mjs";
+import { addTiming, roundedTimings, runWithTimings, timed } from "./utils/timing.mjs";
+import { isBlockedTarget, isPathSafe, isSafeSegment } from "./utils/path-security.mjs";
+import { baselinePath, diffPath, screenshotPath, storybookDir, storybookZipPath } from "./paths.mjs";
+import { HttpError, httpJson, httpText } from "./utils/http.mjs";
+import { MIME_TYPES, mimeFor } from "./utils/mime.mjs";
+export { HttpError, MIME_TYPES, UndecryptableCredentialError, addTiming, baselinePath, decrypt, decryptCredential, decryptWithKey, diffPath, encrypt, hmacSha256, httpJson, httpText, isBlockedTarget, isPathSafe, isSafeSegment, mimeFor, randomToken, redactSecrets, roundedTimings, runWithTimings, sanitizeErrorText, screenshotPath, sha256, slugify, storybookDir, storybookZipPath, timed, timingSafeEqualString, ulid };