@utilix-tech/sdk 0.55.0 → 0.57.0

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 Full release notes for all Utilix surfaces (browser tools, REST API, SDKs, MCP server) live at [utilix.tech/changelog](https://utilix.tech/changelog). This file tracks just this package.
 
+## 0.57.0
+- Add `mergeJsonPatch`, `applyJsonMergePatch` (json-merge-patch): apply an RFC 7396 JSON Merge Patch document to a target JSON document, with null-valued patch keys removing the matching target key.
+- Add `generateCspNonce` (csp-nonce-generator): generate a cryptographically random, base64-encoded Content-Security-Policy nonce with ready-to-paste header directive and script/style tag snippets.
+
+## 0.56.0
+- Add `buildAcceptLanguage`, `parseAcceptLanguage` (accept-language-parser): build an Accept-Language request-header value from locale/quality pairs sorted by descending preference, or parse an existing one into its ranked entries.
+- Add `calculateBlendedLoanRate` (blended-loan-rate-calculator): compute the single weighted-average interest rate across a list of loan balances, plus combined monthly and annual interest accrual.
+
 ## 0.55.0
 - Add `calculateDebtToIncomeRatio` (debt-to-income-ratio-calculator): compute the debt-to-income ratio (total monthly debt payments / gross monthly income) from one or more monthly debts, plus a qualitative tier matching common mortgage-lending guidance.
 - Add `inferCsvColumnTypes` (csv-column-type-inferencer): parse CSV/TSV data and infer each column's data type (integer, float, boolean, ISO 8601 date, or string), flagging nullable columns and empty-cell counts.

package/README.md

@@ -1,6 +1,6 @@
 # @utilix-tech/sdk
 
-**648 developer utility functions for Node.js: runs locally, no API key required.**
+**659 developer utility functions for Node.js: runs locally, no API key required.**
 
 [![npm version](https://img.shields.io/npm/v/@utilix-tech/sdk?style=flat-square&color=cb3837)](https://www.npmjs.com/package/@utilix-tech/sdk)
 [![npm downloads](https://img.shields.io/npm/dm/@utilix-tech/sdk?style=flat-square)](https://www.npmjs.com/package/@utilix-tech/sdk)
@@ -66,7 +66,7 @@ const { formatJson } = require("@utilix-tech/sdk/json");
 
 ```ts
 import { formatJson, minifyJson, diffJson, jsonToTypescript, jsonSchemaToTypescript, validateJson,
-         evaluateJsonPath, resolveJsonPointer, jsonToCsv, yamlToJson, jsonToYaml, getJsonStats } from "@utilix-tech/sdk/json";
+         evaluateJsonPath, resolveJsonPointer, applyJsonMergePatch, jsonToCsv, yamlToJson, jsonToYaml, getJsonStats } from "@utilix-tech/sdk/json";
 
 // Format with 2-space indent
 formatJson('{"name":"alice","age":30}', { indent: 2 });
@@ -87,6 +87,10 @@ evaluateJsonPath(obj, "$.users[*].name");
 resolveJsonPointer('{"users":[{"name":"Alice"}]}', "/users/0/name");
 // { found: true, value: "Alice", tokens: ["users", "0", "name"] }
 
+// Apply an RFC 7396 JSON Merge Patch
+applyJsonMergePatch('{"a":"b","c":{"d":"e","f":"g"}}', '{"a":"z","c":{"f":null}}');
+// { result: { a: "z", c: { d: "e" } } }
+
 // Convert JSON to CSV
 jsonToCsv('[{"a":1,"b":2}]');
 
@@ -278,7 +282,7 @@ inferCsvColumnTypes("id,price,active\n1,9.99,true\n2,5,false");
 
 ```ts
 import { generateUuid, generateV4, generateV7, generateUlid,
-         generatePassword, checkStrength, estimatePasswordEntropy, generateData } from "@utilix-tech/sdk/generators";
+         generatePassword, checkStrength, estimatePasswordEntropy, generateData, generateCspNonce } from "@utilix-tech/sdk/generators";
 
 generateUuid();       // "f47ac10b-58cc-4372-a567-0e02b2c3d479"  (v4)
 generateV7();         // time-ordered UUID v7
@@ -296,6 +300,10 @@ generateData([
   { name: "email", type: "email" },
   { name: "age", type: "number" },
 ], 10);  // 10 rows
+
+// Cryptographically random CSP nonce, plus ready-to-paste snippets
+generateCspNonce(16);
+// { nonce: "...", scriptSrcDirective: "script-src 'nonce-...'", scriptTag: '<script nonce="...">' }
 ```
 
 ---
@@ -331,7 +339,7 @@ formatIso8601Duration(90061);        // { iso: "P1DT1H1M1S", ... }
 ### `/units`: Conversions
 
 ```ts
-import { convertBytes, pxToAll, convert, formatValue, validateCardNumber, validateIban, calculateLoan, validateBarcode, calculateTax, calculateCompoundInterest, validateIsbn, calculateTipSplit, calculateSimpleInterest, calculateTimeValue, calculatePercentageChange, convertAprApy, calculateMarginMarkup, calculateDiscount, applySuccessiveDiscounts, calculateBreakEven, calculateVideoBitrate, calculateRuleOf72, calculateEmi, calculateRoi, compareUnitPrices, calculatePaybackPeriod, calculateCdMaturity, calculateDepreciationSchedule, calculateCashRounding, calculateMovingAverages, calculateGpa, calculateCreditUtilization, calculateDebtToIncomeRatio } from "@utilix-tech/sdk/units";
+import { convertBytes, pxToAll, convert, formatValue, validateCardNumber, validateIban, calculateLoan, validateBarcode, calculateTax, calculateCompoundInterest, validateIsbn, calculateTipSplit, calculateSimpleInterest, calculateTimeValue, calculatePercentageChange, convertAprApy, calculateMarginMarkup, calculateDiscount, applySuccessiveDiscounts, calculateBreakEven, calculateVideoBitrate, calculateRuleOf72, calculateEmi, calculateRoi, compareUnitPrices, calculatePaybackPeriod, calculateCdMaturity, calculateDepreciationSchedule, calculateCashRounding, calculateMovingAverages, calculateGpa, calculateCreditUtilization, calculateDebtToIncomeRatio, calculateBlendedLoanRate } from "@utilix-tech/sdk/units";
 
 // File sizes
 convertBytes(1073741824, "GB");  // 1
@@ -487,7 +495,8 @@ import { getStatusCode, isValidIp, isValidIpv4, isValidIpv6,
          buildRangeHeader, parseContentRangeHeader, buildVaryHeader, parseVaryHeader, validateManifest,
          buildPermissionsPolicy, parsePermissionsPolicy, buildClientHints, parseClientHintHeaders,
          buildContentDisposition, parseContentDisposition,
-         buildXContentTypeOptionsHeader, parseXContentTypeOptionsHeader, assessContentTypeRisk } from "@utilix-tech/sdk/network";
+         buildXContentTypeOptionsHeader, parseXContentTypeOptionsHeader, assessContentTypeRisk,
+         buildAcceptLanguage, parseAcceptLanguage } from "@utilix-tech/sdk/network";
 
 getStatusCode(404);
 // { code: 404, text: "Not Found", description: "...", category: "Client Error" }
@@ -855,12 +864,12 @@ inspectGifFrames(new Uint8Array(gifBytes));
 
 | Import | What it does |
 |---|---|
-| `@utilix-tech/sdk/json` | Format, minify, diff, validate, JSONPath, CSV↔JSON, YAML↔JSON, TS types from data or from a JSON Schema |
+| `@utilix-tech/sdk/json` | Format, minify, diff, validate, JSONPath, JSON Pointer, RFC 7396 merge patch, CSV↔JSON, YAML↔JSON, TS types from data or from a JSON Schema |
 | `@utilix-tech/sdk/encoding` | Base64, URL, HTML entities, Base32/Base58/Base62 encode/decode |
 | `@utilix-tech/sdk/hashing` | MD5, SHA-1/256/512, bcrypt, HMAC, .htpasswd, SRI hashes, content-hash ETag generation |
 | `@utilix-tech/sdk/text` | Case convert, slugify, word count, lorem ipsum, line ops, HTML→Markdown, Levenshtein/Damerau string distance, readability scoring, sentence length distribution, emoji lookup |
 | `@utilix-tech/sdk/data` | CSV, YAML, TOML, XML, INI, NDJSON parse and convert, SRT/WebVTT subtitles, Markdown front matter parser, YAML anchor/alias resolver, CSV column type inferencer |
-| `@utilix-tech/sdk/generators` | UUID v4/v7, ULID, passwords, strength check, entropy estimator, fake data |
+| `@utilix-tech/sdk/generators` | UUID v4/v7, ULID, passwords, strength check, entropy estimator, fake data, CSP nonce generator |
 | `@utilix-tech/sdk/time` | Date diff, timezone convert, cron parse, relative time |
 | `@utilix-tech/sdk/units` | Bytes, CSS px/rem, number bases, currency format, credit card/IBAN/barcode/ISBN validation, loan calculator, EMI calculator, compound/simple interest calculators, VAT/sales tax calculator, tip/bill split calculator, break-even point calculator, Rule of 72 calculator, savings goal calculator, ROI calculator, cash denomination/till calculator, payback period calculator, CD maturity calculator, debt-to-income ratio calculator |
 | `@utilix-tech/sdk/network` | HTTP status codes, IP validation, country flags, geolocation URLs, HAR file parsing, User-Agent parsing, IPv6 address compress/expand, Permissions-Policy header builder, Client Hints header builder/parser, Content-Disposition header builder/parser, X-Content-Type-Options header builder/risk assessor, sitemap.xml validator, sitemap index splitter |

package/dist/{chunk-WVEKRKGU.js → chunk-34C6GXCC.js}

@@ -4,6 +4,7 @@ import * as yaml from 'js-yaml';
 // src/tools/json.ts
 var json_exports = {};
 __export(json_exports, {
+  applyJsonMergePatch: () => applyJsonMergePatch,
   csvToJson: () => csvToJson,
   detectFormat: () => detectFormat,
   diffJson: () => diffJson,
@@ -22,6 +23,7 @@ __export(json_exports, {
   jsonToTypescript: () => jsonToTypescript,
   jsonToYaml: () => jsonToYaml,
   jsonToZod: () => jsonToZod,
+  mergeJsonPatch: () => mergeJsonPatch,
   minifyJson: () => minifyJson,
   parseJson: () => parseJson,
   parseStructs: () => parseStructs,
@@ -1402,5 +1404,36 @@ function jsonSchemaToTypescript(schemaJson, options) {
   }
   return parts.join("\n\n");
 }
+function _isMergePatchObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function mergeJsonPatch(target, patch) {
+  if (!_isMergePatchObject(patch)) return patch;
+  const result = _isMergePatchObject(target) ? { ...target } : {};
+  for (const key of Object.keys(patch)) {
+    const value = patch[key];
+    if (value === null) {
+      delete result[key];
+    } else {
+      result[key] = mergeJsonPatch(result[key], value);
+    }
+  }
+  return result;
+}
+function applyJsonMergePatch(targetJson, patchJson) {
+  let target;
+  try {
+    target = JSON.parse(targetJson);
+  } catch {
+    return { error: "Target is not valid JSON" };
+  }
+  let patch;
+  try {
+    patch = JSON.parse(patchJson);
+  } catch {
+    return { error: "Patch is not valid JSON" };
+  }
+  return { result: mergeJsonPatch(target, patch) };
+}
 
-export { csvToJson, detectFormat, diffJson, evaluateJsonPath, formatDiffLine, formatJson, generateExample, getJsonStats, inferGoType, inferPythonType, inferType, jsonSchemaToTypescript, jsonToCsv, jsonToGo, jsonToPython, jsonToTypescript, jsonToYaml, jsonToZod, json_exports, minifyJson, parseJson, parseStructs, resolveJsonPointer, toPascalCase, toSnakeCase, validateJson, validateJsonPath, validateJsonString, yamlToJson };
+export { applyJsonMergePatch, csvToJson, detectFormat, diffJson, evaluateJsonPath, formatDiffLine, formatJson, generateExample, getJsonStats, inferGoType, inferPythonType, inferType, jsonSchemaToTypescript, jsonToCsv, jsonToGo, jsonToPython, jsonToTypescript, jsonToYaml, jsonToZod, json_exports, mergeJsonPatch, minifyJson, parseJson, parseStructs, resolveJsonPointer, toPascalCase, toSnakeCase, validateJson, validateJsonPath, validateJsonString, yamlToJson };

package/dist/{chunk-3TYWIX3B.js → chunk-422ICOZX.js}

@@ -16,6 +16,7 @@ __export(generators_exports, {
   generateBulk: () => generateBulk,
   generateBulkPasswords: () => generateBulkPasswords,
   generateBulkUlids: () => generateBulkUlids,
+  generateCspNonce: () => generateCspNonce,
   generateData: () => generateData,
   generatePassword: () => generatePassword,
   generateQrDataUrl: () => generateQrDataUrl,
@@ -622,5 +623,19 @@ async function generateQrDataUrl(text, options) {
     }
   });
 }
+function generateCspNonce(byteLength = 16) {
+  if (!Number.isInteger(byteLength) || byteLength < 8 || byteLength > 64) {
+    return { error: "Byte length must be a whole number between 8 and 64" };
+  }
+  const nonce = randomBytes(byteLength).toString("base64");
+  return {
+    nonce,
+    byteLength,
+    scriptSrcDirective: `script-src 'nonce-${nonce}'`,
+    styleSrcDirective: `style-src 'nonce-${nonce}'`,
+    scriptTag: `<script nonce="${nonce}">`,
+    styleTag: `<style nonce="${nonce}">`
+  };
+}
 
-export { AMBIGUOUS_CHARS, DATA_TYPES, DEFAULT_OPTIONS, DEFAULT_QR_OPTIONS, SYMBOL_CHARS, ULID_REGEX, checkStrength, estimatePasswordEntropy, generateBulk, generateBulkPasswords, generateBulkUlids, generateData, generatePassword, generateQrDataUrl, generateQrSvg, generateSingle, generateUlid, generateUuid, generateV4, generateV7, generators_exports, isValidUlid, isValidUuid, parseUlid, parseUuidVersion };
+export { AMBIGUOUS_CHARS, DATA_TYPES, DEFAULT_OPTIONS, DEFAULT_QR_OPTIONS, SYMBOL_CHARS, ULID_REGEX, checkStrength, estimatePasswordEntropy, generateBulk, generateBulkPasswords, generateBulkUlids, generateCspNonce, generateData, generatePassword, generateQrDataUrl, generateQrSvg, generateSingle, generateUlid, generateUuid, generateV4, generateV7, generators_exports, isValidUlid, isValidUuid, parseUlid, parseUuidVersion };

package/dist/{chunk-LI63MAZU.js → chunk-MRIGQRTU.js}

@@ -21,6 +21,7 @@ __export(units_exports, {
   bumpVersion: () => bumpVersion,
   calcAspectRatio: () => calcAspectRatio,
   calcSubnet: () => calcSubnet,
+  calculateBlendedLoanRate: () => calculateBlendedLoanRate,
   calculateBreakEven: () => calculateBreakEven,
   calculateCashBreakdown: () => calculateCashBreakdown,
   calculateCashRounding: () => calculateCashRounding,
@@ -2271,5 +2272,44 @@ function calculateDebtToIncomeRatio(debts, grossMonthlyIncome) {
     tier: _classifyDti(dtiPercent)
   };
 }
+function calculateBlendedLoanRate(loans) {
+  if (!Array.isArray(loans) || loans.length === 0) {
+    return { error: "loans must be a non-empty array" };
+  }
+  const round22 = (n) => Math.round(n * 100) / 100;
+  const round4 = (n) => Math.round(n * 1e4) / 1e4;
+  let totalBalance = 0;
+  for (let i = 0; i < loans.length; i++) {
+    const loan = loans[i];
+    if (typeof loan.balance !== "number" || !Number.isFinite(loan.balance) || loan.balance <= 0) {
+      return { error: `loan ${i + 1}: balance must be a finite number greater than zero` };
+    }
+    if (typeof loan.ratePercent !== "number" || !Number.isFinite(loan.ratePercent) || loan.ratePercent < 0) {
+      return { error: `loan ${i + 1}: ratePercent must be a finite, non-negative number` };
+    }
+    totalBalance += loan.balance;
+  }
+  let totalMonthlyInterest = 0;
+  let weightedRateSum = 0;
+  const results = loans.map((loan, i) => {
+    const monthlyInterest = round22(loan.balance * loan.ratePercent / 100 / 12);
+    totalMonthlyInterest += monthlyInterest;
+    weightedRateSum += loan.balance * loan.ratePercent;
+    return {
+      label: loan.label?.trim() || `Loan ${i + 1}`,
+      balance: loan.balance,
+      ratePercent: loan.ratePercent,
+      monthlyInterest,
+      shareOfTotalPercent: round22(loan.balance / totalBalance * 100)
+    };
+  });
+  return {
+    loans: results,
+    totalBalance: round22(totalBalance),
+    weightedAverageRatePercent: round4(weightedRateSum / totalBalance),
+    totalMonthlyInterest: round22(totalMonthlyInterest),
+    totalAnnualInterest: round22(totalMonthlyInterest * 12)
+  };
+}
 
-export { BASE_LABELS, BASE_PREFIXES, BYTE_UNITS, COMMON_CURRENCIES, COMMON_LOCALES, COMMON_PERMISSIONS, COMMON_RATIOS, COMMON_SIZES, COMMON_TAX_RATES, COMMON_TIP_PERCENTAGES, COMMON_VIEWPORTS, GPA_GRADE_POINTS, USD_DENOMINATIONS, applySuccessiveDiscounts, autoFormat, bumpVersion, calcAspectRatio, calcSubnet, calculateBreakEven, calculateCashBreakdown, calculateCashRounding, calculateCdMaturity, calculateChange, calculateCompoundInterest, calculateCreditUtilization, calculateDebtToIncomeRatio, calculateDepreciationSchedule, calculateDiscount, calculateEmi, calculateGpa, calculateLoan, calculateMarginMarkup, calculateMovingAverages, calculatePaybackPeriod, calculatePercentageChange, calculateRoi, calculateRuleOf72, calculateSavingsGoal, calculateSimpleInterest, calculateTax, calculateTimeValue, calculateTipSplit, calculateVideoBitrate, compareSemver, compareUnitPrices, convert, convertAprApy, convertBytes, convertIp, coverBox, decimalToIp, decimalToIpCidr, describePermissions, fitIntoBox, formatNumber, formatValue, formatVwValue, formatWithSeparator, gcd, ipFromBinary, ipFromDecimal, ipFromHex, ipToBinary, ipToDecimal, ipToDecimalCidr, ipToHex, ipToOctal, isValid, isValidCidr, isValidIp, isValidIpv4, marginToMarkup, markupToMargin, octalToPermissions, parseFileSize, parseInput, parseNumberString, parseSemver, permissionsToChmod, permissionsToOctal, permissionsToSymbolic, ptToPx, pxToAll, pxToViewport, remToPx, satisfiesRange, scaleByHeight, scaleByWidth, sortVersions, splitSubnet, symbolicToPermissions, units_exports, validateBarcode, validateCardNumber, validateIban, validateIsbn, viewportToPx };
+export { BASE_LABELS, BASE_PREFIXES, BYTE_UNITS, COMMON_CURRENCIES, COMMON_LOCALES, COMMON_PERMISSIONS, COMMON_RATIOS, COMMON_SIZES, COMMON_TAX_RATES, COMMON_TIP_PERCENTAGES, COMMON_VIEWPORTS, GPA_GRADE_POINTS, USD_DENOMINATIONS, applySuccessiveDiscounts, autoFormat, bumpVersion, calcAspectRatio, calcSubnet, calculateBlendedLoanRate, calculateBreakEven, calculateCashBreakdown, calculateCashRounding, calculateCdMaturity, calculateChange, calculateCompoundInterest, calculateCreditUtilization, calculateDebtToIncomeRatio, calculateDepreciationSchedule, calculateDiscount, calculateEmi, calculateGpa, calculateLoan, calculateMarginMarkup, calculateMovingAverages, calculatePaybackPeriod, calculatePercentageChange, calculateRoi, calculateRuleOf72, calculateSavingsGoal, calculateSimpleInterest, calculateTax, calculateTimeValue, calculateTipSplit, calculateVideoBitrate, compareSemver, compareUnitPrices, convert, convertAprApy, convertBytes, convertIp, coverBox, decimalToIp, decimalToIpCidr, describePermissions, fitIntoBox, formatNumber, formatValue, formatVwValue, formatWithSeparator, gcd, ipFromBinary, ipFromDecimal, ipFromHex, ipToBinary, ipToDecimal, ipToDecimalCidr, ipToHex, ipToOctal, isValid, isValidCidr, isValidIp, isValidIpv4, marginToMarkup, markupToMargin, octalToPermissions, parseFileSize, parseInput, parseNumberString, parseSemver, permissionsToChmod, permissionsToOctal, permissionsToSymbolic, ptToPx, pxToAll, pxToViewport, remToPx, satisfiesRange, scaleByHeight, scaleByWidth, sortVersions, splitSubnet, symbolicToPermissions, units_exports, validateBarcode, validateCardNumber, validateIban, validateIsbn, viewportToPx };

package/dist/{chunk-DEBIH7QS.js → chunk-TVSQ53TZ.js}

@@ -13,6 +13,7 @@ __export(network_exports, {
   X_CONTENT_TYPE_OPTIONS_HEADER: () => X_CONTENT_TYPE_OPTIONS_HEADER,
   analyzeEmailHeaders: () => analyzeEmailHeaders,
   assessContentTypeRisk: () => assessContentTypeRisk,
+  buildAcceptLanguage: () => buildAcceptLanguage,
   buildCacheControl: () => buildCacheControl,
   buildClientHints: () => buildClientHints,
   buildContentDisposition: () => buildContentDisposition,
@@ -40,6 +41,7 @@ __export(network_exports, {
   isValidIp: () => isValidIp,
   isValidIpv4: () => isValidIpv4,
   isValidIpv6: () => isValidIpv6,
+  parseAcceptLanguage: () => parseAcceptLanguage,
   parseClientHintHeaders: () => parseClientHintHeaders,
   parseContentDisposition: () => parseContentDisposition,
   parseContentRangeHeader: () => parseContentRangeHeader,
@@ -2832,5 +2834,57 @@ function assessContentTypeRisk(contentType) {
     reason: "Not a well-known type in this tool's lookup table. Treat any response type as sniffable unless you've confirmed the serving browser trusts it, and set nosniff regardless of type as a baseline defense."
   };
 }
+function formatAcceptLanguageQuality(q) {
+  let s = q.toFixed(3);
+  s = s.replace(/0+$/, "");
+  s = s.replace(/\.$/, "");
+  return s;
+}
+function formatAcceptLanguageEntries(entries) {
+  return entries.map((e) => e.quality === 1 ? e.locale : `${e.locale};q=${formatAcceptLanguageQuality(e.quality)}`).join(", ");
+}
+function sortAcceptLanguageEntries(entries) {
+  return entries.map((e, i) => ({ e, i })).sort((a, b) => b.e.quality - a.e.quality || a.i - b.i).map((x) => x.e);
+}
+function buildAcceptLanguage(locales) {
+  if (!Array.isArray(locales) || locales.length === 0) return { error: "At least one locale is required" };
+  const entries = [];
+  for (let i = 0; i < locales.length; i++) {
+    const { locale, quality } = locales[i];
+    if (typeof locale !== "string" || locale.trim() === "") return { error: `locale ${i + 1}: locale is required` };
+    const q = quality === void 0 ? 1 : quality;
+    if (typeof q !== "number" || !Number.isFinite(q) || q < 0 || q > 1) {
+      return { error: `locale ${i + 1}: quality must be between 0 and 1` };
+    }
+    entries.push({ locale: locale.trim(), quality: Math.round(q * 1e3) / 1e3 });
+  }
+  const sorted = sortAcceptLanguageEntries(entries);
+  const headerValue = formatAcceptLanguageEntries(sorted);
+  return { header: `Accept-Language: ${headerValue}`, headerValue, entries: sorted };
+}
+function parseAcceptLanguage(raw) {
+  if (!raw || raw.trim() === "") return { error: "Input is empty" };
+  const withoutLabel = raw.trim().replace(/^accept-language:\s*/i, "");
+  const parts = withoutLabel.split(",").map((p) => p.trim()).filter((p) => p.length > 0);
+  if (parts.length === 0) return { error: "Input is empty" };
+  const entries = [];
+  for (const part of parts) {
+    const [localeRaw, ...paramsRaw] = part.split(";").map((s) => s.trim());
+    if (!localeRaw) return { error: `Invalid entry: "${part}"` };
+    let quality = 1;
+    for (const param of paramsRaw) {
+      const m = /^q=([\d.]+)$/i.exec(param);
+      if (!m) return { error: `Invalid parameter in "${part}"` };
+      quality = Number(m[1]);
+      if (!Number.isFinite(quality) || quality < 0 || quality > 1) {
+        return { error: `q value must be between 0 and 1 in "${part}"` };
+      }
+    }
+    entries.push({ locale: localeRaw, quality: Math.round(quality * 1e3) / 1e3 });
+  }
+  const sorted = sortAcceptLanguageEntries(entries);
+  const headerValue = formatAcceptLanguageEntries(sorted);
+  return { header: `Accept-Language: ${headerValue}`, headerValue, entries: sorted };
+}
 
-export { CLIENT_HINTS, DNS_RECORD_TYPES, HTTP_HEADERS, LINK_REL_VALUES, PERMISSIONS_POLICY_FEATURES, REFERRER_POLICY_VALUES, STATUS_CODES, X_CONTENT_TYPE_OPTIONS_HEADER, analyzeEmailHeaders, assessContentTypeRisk, buildCacheControl, buildClientHints, buildContentDisposition, buildDnsQueryUrl, buildGeoUrl, buildLinkHeader, buildMapUrl, buildPermissionsPolicy, buildRangeHeader, buildReferrerPolicy, buildVaryHeader, buildXContentTypeOptionsHeader, checkSetCookieHeader, countryCodeToFlag, formatCoordinates, formatTtl, getByCategory, getHeader, getHeadersByCategory, getStatusByCategory, getStatusCode, isClientError, isServerError, isSuccess, isValidIp, isValidIpv4, isValidIpv6, network_exports, parseClientHintHeaders, parseContentDisposition, parseContentRangeHeader, parseDnsResponse, parseGeoResponse, parseHar, parseIpv6Address, parsePermissionsPolicy, parseUserAgent, parseVaryHeader, parseXContentTypeOptionsHeader, searchHeaders, searchStatusCodes, splitSitemap, statusCodeToText, typeNumberToLabel, validateDomain, validateHeaderName, validateHeaderValue, validateManifest, validateRobotsTxt, validateSitemap };
+export { CLIENT_HINTS, DNS_RECORD_TYPES, HTTP_HEADERS, LINK_REL_VALUES, PERMISSIONS_POLICY_FEATURES, REFERRER_POLICY_VALUES, STATUS_CODES, X_CONTENT_TYPE_OPTIONS_HEADER, analyzeEmailHeaders, assessContentTypeRisk, buildAcceptLanguage, buildCacheControl, buildClientHints, buildContentDisposition, buildDnsQueryUrl, buildGeoUrl, buildLinkHeader, buildMapUrl, buildPermissionsPolicy, buildRangeHeader, buildReferrerPolicy, buildVaryHeader, buildXContentTypeOptionsHeader, checkSetCookieHeader, countryCodeToFlag, formatCoordinates, formatTtl, getByCategory, getHeader, getHeadersByCategory, getStatusByCategory, getStatusCode, isClientError, isServerError, isSuccess, isValidIp, isValidIpv4, isValidIpv6, network_exports, parseAcceptLanguage, parseClientHintHeaders, parseContentDisposition, parseContentRangeHeader, parseDnsResponse, parseGeoResponse, parseHar, parseIpv6Address, parsePermissionsPolicy, parseUserAgent, parseVaryHeader, parseXContentTypeOptionsHeader, searchHeaders, searchStatusCodes, splitSitemap, statusCodeToText, typeNumberToLabel, validateDomain, validateHeaderName, validateHeaderValue, validateManifest, validateRobotsTxt, validateSitemap };

package/dist/{generators-Du8cBesn.d.cts → generators-DAXXrMvG.d.cts}

@@ -10,6 +10,7 @@
  *  - password-entropy-estimator : estimatePasswordEntropy
  *  - random-data     : generateSingle, generateData
  *  - qr-code         : generateQrSvg, generateQrDataUrl
+ *  - csp-nonce-generator : generateCspNonce
  */
 type UuidVersion = 'v4' | 'v7';
 interface GeneratedUuid {
@@ -117,8 +118,27 @@ interface QrOptions {
 declare const DEFAULT_QR_OPTIONS: QrOptions;
 declare function generateQrSvg(text: string, options?: QrOptions): Promise<string>;
 declare function generateQrDataUrl(text: string, options?: QrOptions): Promise<string>;
+interface CspNonceResult {
+    nonce: string;
+    byteLength: number;
+    scriptSrcDirective: string;
+    styleSrcDirective: string;
+    scriptTag: string;
+    styleTag: string;
+}
+/**
+ * Generate a cryptographically random, base64-encoded nonce for a
+ * Content-Security-Policy script-src/style-src directive, along with
+ * ready-to-paste header directive and <script>/<style nonce="..."> tag
+ * snippets. Generates a fresh value on every call; the same value must be
+ * reused for both the header and the markup within a single request.
+ */
+declare function generateCspNonce(byteLength?: number): CspNonceResult | {
+    error: string;
+};
 
 declare const generators_AMBIGUOUS_CHARS: typeof AMBIGUOUS_CHARS;
+type generators_CspNonceResult = CspNonceResult;
 declare const generators_DATA_TYPES: typeof DATA_TYPES;
 declare const generators_DEFAULT_OPTIONS: typeof DEFAULT_OPTIONS;
 declare const generators_DEFAULT_QR_OPTIONS: typeof DEFAULT_QR_OPTIONS;
@@ -141,6 +161,7 @@ declare const generators_estimatePasswordEntropy: typeof estimatePasswordEntropy
 declare const generators_generateBulk: typeof generateBulk;
 declare const generators_generateBulkPasswords: typeof generateBulkPasswords;
 declare const generators_generateBulkUlids: typeof generateBulkUlids;
+declare const generators_generateCspNonce: typeof generateCspNonce;
 declare const generators_generateData: typeof generateData;
 declare const generators_generatePassword: typeof generatePassword;
 declare const generators_generateQrDataUrl: typeof generateQrDataUrl;
@@ -155,7 +176,7 @@ declare const generators_isValidUuid: typeof isValidUuid;
 declare const generators_parseUlid: typeof parseUlid;
 declare const generators_parseUuidVersion: typeof parseUuidVersion;
 declare namespace generators {
-  export { generators_AMBIGUOUS_CHARS as AMBIGUOUS_CHARS, generators_DATA_TYPES as DATA_TYPES, generators_DEFAULT_OPTIONS as DEFAULT_OPTIONS, generators_DEFAULT_QR_OPTIONS as DEFAULT_QR_OPTIONS, type generators_DataType as DataType, type generators_GeneratedUuid as GeneratedUuid, type generators_PasswordCharsetInfo as PasswordCharsetInfo, type generators_PasswordCrackTimeEstimate as PasswordCrackTimeEstimate, type generators_PasswordEntropyResult as PasswordEntropyResult, type generators_PasswordEntropyStrength as PasswordEntropyStrength, type generators_PasswordOptions as PasswordOptions, type generators_QrErrorLevel as QrErrorLevel, type generators_QrOptions as QrOptions, type generators_QrOutputFormat as QrOutputFormat, type generators_RandomConfig as RandomConfig, generators_SYMBOL_CHARS as SYMBOL_CHARS, generators_ULID_REGEX as ULID_REGEX, type generators_UuidVersion as UuidVersion, generators_checkStrength as checkStrength, generators_estimatePasswordEntropy as estimatePasswordEntropy, generators_generateBulk as generateBulk, generators_generateBulkPasswords as generateBulkPasswords, generators_generateBulkUlids as generateBulkUlids, generators_generateData as generateData, generators_generatePassword as generatePassword, generators_generateQrDataUrl as generateQrDataUrl, generators_generateQrSvg as generateQrSvg, generators_generateSingle as generateSingle, generators_generateUlid as generateUlid, generators_generateUuid as generateUuid, generators_generateV4 as generateV4, generators_generateV7 as generateV7, generators_isValidUlid as isValidUlid, generators_isValidUuid as isValidUuid, generators_parseUlid as parseUlid, generators_parseUuidVersion as parseUuidVersion };
+  export { generators_AMBIGUOUS_CHARS as AMBIGUOUS_CHARS, type generators_CspNonceResult as CspNonceResult, generators_DATA_TYPES as DATA_TYPES, generators_DEFAULT_OPTIONS as DEFAULT_OPTIONS, generators_DEFAULT_QR_OPTIONS as DEFAULT_QR_OPTIONS, type generators_DataType as DataType, type generators_GeneratedUuid as GeneratedUuid, type generators_PasswordCharsetInfo as PasswordCharsetInfo, type generators_PasswordCrackTimeEstimate as PasswordCrackTimeEstimate, type generators_PasswordEntropyResult as PasswordEntropyResult, type generators_PasswordEntropyStrength as PasswordEntropyStrength, type generators_PasswordOptions as PasswordOptions, type generators_QrErrorLevel as QrErrorLevel, type generators_QrOptions as QrOptions, type generators_QrOutputFormat as QrOutputFormat, type generators_RandomConfig as RandomConfig, generators_SYMBOL_CHARS as SYMBOL_CHARS, generators_ULID_REGEX as ULID_REGEX, type generators_UuidVersion as UuidVersion, generators_checkStrength as checkStrength, generators_estimatePasswordEntropy as estimatePasswordEntropy, generators_generateBulk as generateBulk, generators_generateBulkPasswords as generateBulkPasswords, generators_generateBulkUlids as generateBulkUlids, generators_generateCspNonce as generateCspNonce, generators_generateData as generateData, generators_generatePassword as generatePassword, generators_generateQrDataUrl as generateQrDataUrl, generators_generateQrSvg as generateQrSvg, generators_generateSingle as generateSingle, generators_generateUlid as generateUlid, generators_generateUuid as generateUuid, generators_generateV4 as generateV4, generators_generateV7 as generateV7, generators_isValidUlid as isValidUlid, generators_isValidUuid as isValidUuid, generators_parseUlid as parseUlid, generators_parseUuidVersion as parseUuidVersion };
 }
 
-export { AMBIGUOUS_CHARS as A, isValidUuid as B, parseUlid as C, DATA_TYPES as D, parseUuidVersion as E, type GeneratedUuid as G, type PasswordCharsetInfo as P, type QrErrorLevel as Q, type RandomConfig as R, SYMBOL_CHARS as S, ULID_REGEX as U, DEFAULT_OPTIONS as a, DEFAULT_QR_OPTIONS as b, type DataType as c, type PasswordCrackTimeEstimate as d, type PasswordEntropyResult as e, type PasswordEntropyStrength as f, generators as g, type PasswordOptions as h, type QrOptions as i, type QrOutputFormat as j, type UuidVersion as k, checkStrength as l, estimatePasswordEntropy as m, generateBulk as n, generateBulkPasswords as o, generateBulkUlids as p, generateData as q, generatePassword as r, generateQrDataUrl as s, generateQrSvg as t, generateSingle as u, generateUlid as v, generateUuid as w, generateV4 as x, generateV7 as y, isValidUlid as z };
+export { AMBIGUOUS_CHARS as A, isValidUlid as B, type CspNonceResult as C, DATA_TYPES as D, isValidUuid as E, parseUlid as F, type GeneratedUuid as G, parseUuidVersion as H, type PasswordCharsetInfo as P, type QrErrorLevel as Q, type RandomConfig as R, SYMBOL_CHARS as S, ULID_REGEX as U, DEFAULT_OPTIONS as a, DEFAULT_QR_OPTIONS as b, type DataType as c, type PasswordCrackTimeEstimate as d, type PasswordEntropyResult as e, type PasswordEntropyStrength as f, generators as g, type PasswordOptions as h, type QrOptions as i, type QrOutputFormat as j, type UuidVersion as k, checkStrength as l, estimatePasswordEntropy as m, generateBulk as n, generateBulkPasswords as o, generateBulkUlids as p, generateCspNonce as q, generateData as r, generatePassword as s, generateQrDataUrl as t, generateQrSvg as u, generateSingle as v, generateUlid as w, generateUuid as x, generateV4 as y, generateV7 as z };

package/dist/{generators-Du8cBesn.d.ts → generators-DAXXrMvG.d.ts}

@@ -10,6 +10,7 @@
  *  - password-entropy-estimator : estimatePasswordEntropy
  *  - random-data     : generateSingle, generateData
  *  - qr-code         : generateQrSvg, generateQrDataUrl
+ *  - csp-nonce-generator : generateCspNonce
  */
 type UuidVersion = 'v4' | 'v7';
 interface GeneratedUuid {
@@ -117,8 +118,27 @@ interface QrOptions {
 declare const DEFAULT_QR_OPTIONS: QrOptions;
 declare function generateQrSvg(text: string, options?: QrOptions): Promise<string>;
 declare function generateQrDataUrl(text: string, options?: QrOptions): Promise<string>;
+interface CspNonceResult {
+    nonce: string;
+    byteLength: number;
+    scriptSrcDirective: string;
+    styleSrcDirective: string;
+    scriptTag: string;
+    styleTag: string;
+}
+/**
+ * Generate a cryptographically random, base64-encoded nonce for a
+ * Content-Security-Policy script-src/style-src directive, along with
+ * ready-to-paste header directive and <script>/<style nonce="..."> tag
+ * snippets. Generates a fresh value on every call; the same value must be
+ * reused for both the header and the markup within a single request.
+ */
+declare function generateCspNonce(byteLength?: number): CspNonceResult | {
+    error: string;
+};
 
 declare const generators_AMBIGUOUS_CHARS: typeof AMBIGUOUS_CHARS;
+type generators_CspNonceResult = CspNonceResult;
 declare const generators_DATA_TYPES: typeof DATA_TYPES;
 declare const generators_DEFAULT_OPTIONS: typeof DEFAULT_OPTIONS;
 declare const generators_DEFAULT_QR_OPTIONS: typeof DEFAULT_QR_OPTIONS;
@@ -141,6 +161,7 @@ declare const generators_estimatePasswordEntropy: typeof estimatePasswordEntropy
 declare const generators_generateBulk: typeof generateBulk;
 declare const generators_generateBulkPasswords: typeof generateBulkPasswords;
 declare const generators_generateBulkUlids: typeof generateBulkUlids;
+declare const generators_generateCspNonce: typeof generateCspNonce;
 declare const generators_generateData: typeof generateData;
 declare const generators_generatePassword: typeof generatePassword;
 declare const generators_generateQrDataUrl: typeof generateQrDataUrl;
@@ -155,7 +176,7 @@ declare const generators_isValidUuid: typeof isValidUuid;
 declare const generators_parseUlid: typeof parseUlid;
 declare const generators_parseUuidVersion: typeof parseUuidVersion;
 declare namespace generators {
-  export { generators_AMBIGUOUS_CHARS as AMBIGUOUS_CHARS, generators_DATA_TYPES as DATA_TYPES, generators_DEFAULT_OPTIONS as DEFAULT_OPTIONS, generators_DEFAULT_QR_OPTIONS as DEFAULT_QR_OPTIONS, type generators_DataType as DataType, type generators_GeneratedUuid as GeneratedUuid, type generators_PasswordCharsetInfo as PasswordCharsetInfo, type generators_PasswordCrackTimeEstimate as PasswordCrackTimeEstimate, type generators_PasswordEntropyResult as PasswordEntropyResult, type generators_PasswordEntropyStrength as PasswordEntropyStrength, type generators_PasswordOptions as PasswordOptions, type generators_QrErrorLevel as QrErrorLevel, type generators_QrOptions as QrOptions, type generators_QrOutputFormat as QrOutputFormat, type generators_RandomConfig as RandomConfig, generators_SYMBOL_CHARS as SYMBOL_CHARS, generators_ULID_REGEX as ULID_REGEX, type generators_UuidVersion as UuidVersion, generators_checkStrength as checkStrength, generators_estimatePasswordEntropy as estimatePasswordEntropy, generators_generateBulk as generateBulk, generators_generateBulkPasswords as generateBulkPasswords, generators_generateBulkUlids as generateBulkUlids, generators_generateData as generateData, generators_generatePassword as generatePassword, generators_generateQrDataUrl as generateQrDataUrl, generators_generateQrSvg as generateQrSvg, generators_generateSingle as generateSingle, generators_generateUlid as generateUlid, generators_generateUuid as generateUuid, generators_generateV4 as generateV4, generators_generateV7 as generateV7, generators_isValidUlid as isValidUlid, generators_isValidUuid as isValidUuid, generators_parseUlid as parseUlid, generators_parseUuidVersion as parseUuidVersion };
+  export { generators_AMBIGUOUS_CHARS as AMBIGUOUS_CHARS, type generators_CspNonceResult as CspNonceResult, generators_DATA_TYPES as DATA_TYPES, generators_DEFAULT_OPTIONS as DEFAULT_OPTIONS, generators_DEFAULT_QR_OPTIONS as DEFAULT_QR_OPTIONS, type generators_DataType as DataType, type generators_GeneratedUuid as GeneratedUuid, type generators_PasswordCharsetInfo as PasswordCharsetInfo, type generators_PasswordCrackTimeEstimate as PasswordCrackTimeEstimate, type generators_PasswordEntropyResult as PasswordEntropyResult, type generators_PasswordEntropyStrength as PasswordEntropyStrength, type generators_PasswordOptions as PasswordOptions, type generators_QrErrorLevel as QrErrorLevel, type generators_QrOptions as QrOptions, type generators_QrOutputFormat as QrOutputFormat, type generators_RandomConfig as RandomConfig, generators_SYMBOL_CHARS as SYMBOL_CHARS, generators_ULID_REGEX as ULID_REGEX, type generators_UuidVersion as UuidVersion, generators_checkStrength as checkStrength, generators_estimatePasswordEntropy as estimatePasswordEntropy, generators_generateBulk as generateBulk, generators_generateBulkPasswords as generateBulkPasswords, generators_generateBulkUlids as generateBulkUlids, generators_generateCspNonce as generateCspNonce, generators_generateData as generateData, generators_generatePassword as generatePassword, generators_generateQrDataUrl as generateQrDataUrl, generators_generateQrSvg as generateQrSvg, generators_generateSingle as generateSingle, generators_generateUlid as generateUlid, generators_generateUuid as generateUuid, generators_generateV4 as generateV4, generators_generateV7 as generateV7, generators_isValidUlid as isValidUlid, generators_isValidUuid as isValidUuid, generators_parseUlid as parseUlid, generators_parseUuidVersion as parseUuidVersion };
 }
 
-export { AMBIGUOUS_CHARS as A, isValidUuid as B, parseUlid as C, DATA_TYPES as D, parseUuidVersion as E, type GeneratedUuid as G, type PasswordCharsetInfo as P, type QrErrorLevel as Q, type RandomConfig as R, SYMBOL_CHARS as S, ULID_REGEX as U, DEFAULT_OPTIONS as a, DEFAULT_QR_OPTIONS as b, type DataType as c, type PasswordCrackTimeEstimate as d, type PasswordEntropyResult as e, type PasswordEntropyStrength as f, generators as g, type PasswordOptions as h, type QrOptions as i, type QrOutputFormat as j, type UuidVersion as k, checkStrength as l, estimatePasswordEntropy as m, generateBulk as n, generateBulkPasswords as o, generateBulkUlids as p, generateData as q, generatePassword as r, generateQrDataUrl as s, generateQrSvg as t, generateSingle as u, generateUlid as v, generateUuid as w, generateV4 as x, generateV7 as y, isValidUlid as z };
+export { AMBIGUOUS_CHARS as A, isValidUlid as B, type CspNonceResult as C, DATA_TYPES as D, isValidUuid as E, parseUlid as F, type GeneratedUuid as G, parseUuidVersion as H, type PasswordCharsetInfo as P, type QrErrorLevel as Q, type RandomConfig as R, SYMBOL_CHARS as S, ULID_REGEX as U, DEFAULT_OPTIONS as a, DEFAULT_QR_OPTIONS as b, type DataType as c, type PasswordCrackTimeEstimate as d, type PasswordEntropyResult as e, type PasswordEntropyStrength as f, generators as g, type PasswordOptions as h, type QrOptions as i, type QrOutputFormat as j, type UuidVersion as k, checkStrength as l, estimatePasswordEntropy as m, generateBulk as n, generateBulkPasswords as o, generateBulkUlids as p, generateCspNonce as q, generateData as r, generatePassword as s, generateQrDataUrl as t, generateQrSvg as u, generateSingle as v, generateUlid as w, generateUuid as x, generateV4 as y, generateV7 as z };

package/dist/index.cjs

@@ -42,6 +42,7 @@ var __export = (target, all) => {
 // src/tools/json.ts
 var json_exports = {};
 __export(json_exports, {
+  applyJsonMergePatch: () => applyJsonMergePatch,
   csvToJson: () => csvToJson,
   detectFormat: () => detectFormat,
   diffJson: () => diffJson,
@@ -60,6 +61,7 @@ __export(json_exports, {
   jsonToTypescript: () => jsonToTypescript,
   jsonToYaml: () => jsonToYaml,
   jsonToZod: () => jsonToZod,
+  mergeJsonPatch: () => mergeJsonPatch,
   minifyJson: () => minifyJson,
   parseJson: () => parseJson,
   parseStructs: () => parseStructs,
@@ -1440,6 +1442,37 @@ function jsonSchemaToTypescript(schemaJson, options) {
   }
   return parts.join("\n\n");
 }
+function _isMergePatchObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function mergeJsonPatch(target, patch) {
+  if (!_isMergePatchObject(patch)) return patch;
+  const result = _isMergePatchObject(target) ? { ...target } : {};
+  for (const key of Object.keys(patch)) {
+    const value = patch[key];
+    if (value === null) {
+      delete result[key];
+    } else {
+      result[key] = mergeJsonPatch(result[key], value);
+    }
+  }
+  return result;
+}
+function applyJsonMergePatch(targetJson, patchJson) {
+  let target;
+  try {
+    target = JSON.parse(targetJson);
+  } catch {
+    return { error: "Target is not valid JSON" };
+  }
+  let patch;
+  try {
+    patch = JSON.parse(patchJson);
+  } catch {
+    return { error: "Patch is not valid JSON" };
+  }
+  return { result: mergeJsonPatch(target, patch) };
+}
 
 // src/tools/encoding.ts
 var encoding_exports = {};
@@ -6935,6 +6968,7 @@ __export(generators_exports, {
   generateBulk: () => generateBulk,
   generateBulkPasswords: () => generateBulkPasswords,
   generateBulkUlids: () => generateBulkUlids,
+  generateCspNonce: () => generateCspNonce,
   generateData: () => generateData,
   generatePassword: () => generatePassword,
   generateQrDataUrl: () => generateQrDataUrl,
@@ -7541,6 +7575,20 @@ async function generateQrDataUrl(text, options) {
     }
   });
 }
+function generateCspNonce(byteLength = 16) {
+  if (!Number.isInteger(byteLength) || byteLength < 8 || byteLength > 64) {
+    return { error: "Byte length must be a whole number between 8 and 64" };
+  }
+  const nonce = crypto.randomBytes(byteLength).toString("base64");
+  return {
+    nonce,
+    byteLength,
+    scriptSrcDirective: `script-src 'nonce-${nonce}'`,
+    styleSrcDirective: `style-src 'nonce-${nonce}'`,
+    scriptTag: `<script nonce="${nonce}">`,
+    styleTag: `<style nonce="${nonce}">`
+  };
+}
 
 // src/tools/time.ts
 var time_exports = {};
@@ -8338,6 +8386,7 @@ __export(units_exports, {
   bumpVersion: () => bumpVersion,
   calcAspectRatio: () => calcAspectRatio,
   calcSubnet: () => calcSubnet,
+  calculateBlendedLoanRate: () => calculateBlendedLoanRate,
   calculateBreakEven: () => calculateBreakEven,
   calculateCashBreakdown: () => calculateCashBreakdown,
   calculateCashRounding: () => calculateCashRounding,
@@ -10588,6 +10637,45 @@ function calculateDebtToIncomeRatio(debts, grossMonthlyIncome) {
     tier: _classifyDti(dtiPercent)
   };
 }
+function calculateBlendedLoanRate(loans) {
+  if (!Array.isArray(loans) || loans.length === 0) {
+    return { error: "loans must be a non-empty array" };
+  }
+  const round23 = (n) => Math.round(n * 100) / 100;
+  const round4 = (n) => Math.round(n * 1e4) / 1e4;
+  let totalBalance = 0;
+  for (let i = 0; i < loans.length; i++) {
+    const loan = loans[i];
+    if (typeof loan.balance !== "number" || !Number.isFinite(loan.balance) || loan.balance <= 0) {
+      return { error: `loan ${i + 1}: balance must be a finite number greater than zero` };
+    }
+    if (typeof loan.ratePercent !== "number" || !Number.isFinite(loan.ratePercent) || loan.ratePercent < 0) {
+      return { error: `loan ${i + 1}: ratePercent must be a finite, non-negative number` };
+    }
+    totalBalance += loan.balance;
+  }
+  let totalMonthlyInterest = 0;
+  let weightedRateSum = 0;
+  const results = loans.map((loan, i) => {
+    const monthlyInterest = round23(loan.balance * loan.ratePercent / 100 / 12);
+    totalMonthlyInterest += monthlyInterest;
+    weightedRateSum += loan.balance * loan.ratePercent;
+    return {
+      label: loan.label?.trim() || `Loan ${i + 1}`,
+      balance: loan.balance,
+      ratePercent: loan.ratePercent,
+      monthlyInterest,
+      shareOfTotalPercent: round23(loan.balance / totalBalance * 100)
+    };
+  });
+  return {
+    loans: results,
+    totalBalance: round23(totalBalance),
+    weightedAverageRatePercent: round4(weightedRateSum / totalBalance),
+    totalMonthlyInterest: round23(totalMonthlyInterest),
+    totalAnnualInterest: round23(totalMonthlyInterest * 12)
+  };
+}
 
 // src/tools/network.ts
 var network_exports = {};
@@ -10602,6 +10690,7 @@ __export(network_exports, {
   X_CONTENT_TYPE_OPTIONS_HEADER: () => X_CONTENT_TYPE_OPTIONS_HEADER,
   analyzeEmailHeaders: () => analyzeEmailHeaders,
   assessContentTypeRisk: () => assessContentTypeRisk,
+  buildAcceptLanguage: () => buildAcceptLanguage,
   buildCacheControl: () => buildCacheControl,
   buildClientHints: () => buildClientHints,
   buildContentDisposition: () => buildContentDisposition,
@@ -10629,6 +10718,7 @@ __export(network_exports, {
   isValidIp: () => isValidIp2,
   isValidIpv4: () => isValidIpv42,
   isValidIpv6: () => isValidIpv6,
+  parseAcceptLanguage: () => parseAcceptLanguage,
   parseClientHintHeaders: () => parseClientHintHeaders,
   parseContentDisposition: () => parseContentDisposition,
   parseContentRangeHeader: () => parseContentRangeHeader,
@@ -13421,6 +13511,58 @@ function assessContentTypeRisk(contentType) {
     reason: "Not a well-known type in this tool's lookup table. Treat any response type as sniffable unless you've confirmed the serving browser trusts it, and set nosniff regardless of type as a baseline defense."
   };
 }
+function formatAcceptLanguageQuality(q) {
+  let s = q.toFixed(3);
+  s = s.replace(/0+$/, "");
+  s = s.replace(/\.$/, "");
+  return s;
+}
+function formatAcceptLanguageEntries(entries) {
+  return entries.map((e) => e.quality === 1 ? e.locale : `${e.locale};q=${formatAcceptLanguageQuality(e.quality)}`).join(", ");
+}
+function sortAcceptLanguageEntries(entries) {
+  return entries.map((e, i) => ({ e, i })).sort((a, b) => b.e.quality - a.e.quality || a.i - b.i).map((x) => x.e);
+}
+function buildAcceptLanguage(locales) {
+  if (!Array.isArray(locales) || locales.length === 0) return { error: "At least one locale is required" };
+  const entries = [];
+  for (let i = 0; i < locales.length; i++) {
+    const { locale, quality } = locales[i];
+    if (typeof locale !== "string" || locale.trim() === "") return { error: `locale ${i + 1}: locale is required` };
+    const q = quality === void 0 ? 1 : quality;
+    if (typeof q !== "number" || !Number.isFinite(q) || q < 0 || q > 1) {
+      return { error: `locale ${i + 1}: quality must be between 0 and 1` };
+    }
+    entries.push({ locale: locale.trim(), quality: Math.round(q * 1e3) / 1e3 });
+  }
+  const sorted = sortAcceptLanguageEntries(entries);
+  const headerValue = formatAcceptLanguageEntries(sorted);
+  return { header: `Accept-Language: ${headerValue}`, headerValue, entries: sorted };
+}
+function parseAcceptLanguage(raw) {
+  if (!raw || raw.trim() === "") return { error: "Input is empty" };
+  const withoutLabel = raw.trim().replace(/^accept-language:\s*/i, "");
+  const parts = withoutLabel.split(",").map((p) => p.trim()).filter((p) => p.length > 0);
+  if (parts.length === 0) return { error: "Input is empty" };
+  const entries = [];
+  for (const part of parts) {
+    const [localeRaw, ...paramsRaw] = part.split(";").map((s) => s.trim());
+    if (!localeRaw) return { error: `Invalid entry: "${part}"` };
+    let quality = 1;
+    for (const param of paramsRaw) {
+      const m = /^q=([\d.]+)$/i.exec(param);
+      if (!m) return { error: `Invalid parameter in "${part}"` };
+      quality = Number(m[1]);
+      if (!Number.isFinite(quality) || quality < 0 || quality > 1) {
+        return { error: `q value must be between 0 and 1 in "${part}"` };
+      }
+    }
+    entries.push({ locale: localeRaw, quality: Math.round(quality * 1e3) / 1e3 });
+  }
+  const sorted = sortAcceptLanguageEntries(entries);
+  const headerValue = formatAcceptLanguageEntries(sorted);
+  return { header: `Accept-Language: ${headerValue}`, headerValue, entries: sorted };
+}
 
 // src/tools/api.ts
 var api_exports = {};