@utilix-tech/sdk 0.76.0 → 0.77.0

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 Full release notes for all Utilix surfaces (browser tools, REST API, SDKs, MCP server) live at [utilix.tech/changelog](https://utilix.tech/changelog). This file tracks just this package.
 
+## 0.77.0
+- Add `readPdfOutline` (pdf-outline-extractor): walk a PDF's /Outlines bookmark tree (the Root -> Outlines -> First/Next/First chain) and list every bookmark's title, nesting level, and link target, in document order.
+- Add `scoreSecurityHeaders` (security-headers-scorecard): score a pasted block of raw HTTP response headers against commonly recommended security headers (CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-*), with an overall 0-100 score and A-F letter grade.
+
 ## 0.76.0
 - Add `detectWordyPhrases` (wordy-phrase-detector): scan text against a curated table of wordy/redundant phrases ("due to the fact that", "in order to") and flag each occurrence with a suggested concise replacement, an occurrence count, and character offsets.
 - Add `checkOxfordCommaConsistency` (oxford-comma-checker): scan a document for comma-before-and/or usage in three-or-more-item lists and flag documents that mix Oxford comma styles.

package/README.md

@@ -1,6 +1,6 @@
 # @utilix-tech/sdk
 
-**703 developer utility functions for Node.js: runs locally, no API key required.**
+**705 developer utility functions for Node.js: runs locally, no API key required.**
 
 [![npm version](https://img.shields.io/npm/v/@utilix-tech/sdk?style=flat-square&color=cb3837)](https://www.npmjs.com/package/@utilix-tech/sdk)
 [![npm downloads](https://img.shields.io/npm/dm/@utilix-tech/sdk?style=flat-square)](https://www.npmjs.com/package/@utilix-tech/sdk)
@@ -710,6 +710,11 @@ buildRobotsMetaTag({ flags: ["noindex", "nofollow"], name: "googlebot" });
 // Cookie header byte-size budget: per-cookie and total sizes against RFC 6265's 4096-byte limit
 calculateCookieSizeBudget("session=abc123; theme=dark; cart=42");
 // { cookieCount: 3, totalBytes: 35, budgetBytes: 4096, exceedsBudget: false, cookies: [...] }
+
+// Score pasted response headers against commonly recommended security headers
+import { scoreSecurityHeaders } from "@utilix-tech/sdk/network";
+scoreSecurityHeaders("Content-Security-Policy: default-src 'self'\nStrict-Transport-Security: max-age=63072000");
+// { score: 22, grade: "F", passCount: 2, warningCount: 0, missingCount: 7, totalChecks: 9, checks: [...] }
 ```
 
 ---
@@ -910,10 +915,10 @@ analyzeString("café");          // { length: 4, codePoints: [...], ... }
 
 ---
 
-### `/media`: Image Header Parsing, EXIF, PDF Metadata & Page Dimensions, WAV, ID3, ICO, FLAC, Video, GIF & MIDI Metadata
+### `/media`: Image Header Parsing, EXIF, PDF Metadata, Page Dimensions & Outlines, WAV, ID3, ICO, FLAC, Video, GIF & MIDI Metadata
 
 ```ts
-import { readImageInfo, readExifData, readPdfMetadata, readPdfPageDimensions, readWavInfo, readId3Tags, readIcoInfo, readFlacInfo, readVideoInfo, inspectGifFrames, readMidiInfo } from "@utilix-tech/sdk/media";
+import { readImageInfo, readExifData, readPdfMetadata, readPdfPageDimensions, readPdfOutline, readWavInfo, readId3Tags, readIcoInfo, readFlacInfo, readVideoInfo, inspectGifFrames, readMidiInfo } from "@utilix-tech/sdk/media";
 
 // Reads format, dimensions, bit depth, and alpha channel straight from
 // file bytes: no decoding, no canvas, no image library.
@@ -939,6 +944,12 @@ readPdfMetadata(new Uint8Array(pdfBytes));
 readPdfPageDimensions(new Uint8Array(pdfBytes));
 // { version: "1.7", pageCount: 12, pages: [{ pageNumber: 1, widthPt: 612, heightPt: 792, rotation: 0, orientation: "portrait", paperSize: "Letter" }, ...] }
 
+// Walks a PDF's /Outlines bookmark tree (Root -> Outlines -> First/Next/
+// First chain) to list every bookmark's title, nesting level, and link
+// target, in document order: no PDF rendering library required.
+readPdfOutline(new Uint8Array(pdfBytes));
+// { version: "1.7", bookmarkCount: 3, bookmarks: [{ title: "Chapter 1", level: 0, destType: "page", target: "3 0 R" }, ...] }
+
 // Reads sample rate, channels, bit depth, and duration from a WAV file's
 // RIFF/fmt/data chunk headers: no audio library required.
 const wavBytes = await fs.promises.readFile("recording.wav");

package/dist/{chunk-CXUOV672.js → chunk-KWS4ZCYG.js}

@@ -72,6 +72,7 @@ __export(network_exports, {
   parseVaryHeader: () => parseVaryHeader,
   parseXContentTypeOptionsHeader: () => parseXContentTypeOptionsHeader,
   parseXRobotsTag: () => parseXRobotsTag,
+  scoreSecurityHeaders: () => scoreSecurityHeaders,
   searchHeaders: () => searchHeaders,
   searchStatusCodes: () => searchStatusCodes,
   splitSitemap: () => splitSitemap,
@@ -3511,5 +3512,122 @@ function calculateCookieSizeBudget(cookieHeader, budgetBytes = DEFAULT_COOKIE_BU
     exceedsBudget: totalBytes > budgetBytes
   };
 }
+function parseRawHeaderBlock(raw) {
+  const map = /* @__PURE__ */ new Map();
+  for (const line of raw.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    const idx = trimmed.indexOf(":");
+    if (idx === -1) continue;
+    const name = trimmed.slice(0, idx).trim().toLowerCase();
+    const value = trimmed.slice(idx + 1).trim();
+    if (!map.has(name)) map.set(name, value);
+  }
+  return map;
+}
+var SECURITY_HEADER_CHECKS = [
+  {
+    header: "Content-Security-Policy",
+    evaluate: (v) => {
+      if (!v) return { status: "missing", note: "Without a CSP, an injected script runs with full page privileges." };
+      if (/unsafe-inline|unsafe-eval/i.test(v)) return { status: "warning", note: "Contains unsafe-inline or unsafe-eval, which weakens XSS protection." };
+      return { status: "pass", note: "Present. Use the CSP Header Builder tool to validate its directives in depth." };
+    }
+  },
+  {
+    header: "Strict-Transport-Security",
+    evaluate: (v) => {
+      if (!v) return { status: "missing", note: "Without HSTS, a user's first visit (and any later downgrade) can be sent over plain HTTP." };
+      const maxAgeMatch = v.match(/max-age\s*=\s*(\d+)/i);
+      if (!maxAgeMatch) return { status: "warning", note: "Present but missing a max-age directive." };
+      const maxAge = Number(maxAgeMatch[1]);
+      if (maxAge < 31536e3) return { status: "warning", note: "max-age is below the recommended 1 year (31536000 seconds)." };
+      return { status: "pass", note: "Present with a max-age of at least 1 year." };
+    }
+  },
+  {
+    header: "X-Content-Type-Options",
+    evaluate: (v) => {
+      if (!v) return { status: "missing", note: "Without this header, browsers may MIME-sniff a response into an unintended content type." };
+      if (v.trim().toLowerCase() !== "nosniff") return { status: "warning", note: `"nosniff" is the only valid value; this value won't take effect.` };
+      return { status: "pass", note: "Set to the only valid value, nosniff." };
+    }
+  },
+  {
+    header: "X-Frame-Options",
+    evaluate: (v) => {
+      if (!v) return { status: "missing", note: "Without this (or a CSP frame-ancestors directive), the page can be framed by another site for clickjacking." };
+      const upper = v.trim().toUpperCase();
+      if (upper === "DENY" || upper === "SAMEORIGIN") return { status: "pass", note: `Framing restricted (${upper}).` };
+      if (upper.startsWith("ALLOW-FROM")) return { status: "warning", note: "ALLOW-FROM is deprecated and ignored by most modern browsers." };
+      return { status: "warning", note: "Unrecognized value." };
+    }
+  },
+  {
+    header: "Referrer-Policy",
+    evaluate: (v) => {
+      if (!v) return { status: "missing", note: "Without this header, the browser's default referrer behavior applies, which can leak full URLs to third parties." };
+      if (v.trim().toLowerCase() === "unsafe-url") return { status: "warning", note: "unsafe-url leaks the full URL, including path and query string, to every destination." };
+      return { status: "pass", note: "Present." };
+    }
+  },
+  {
+    header: "Permissions-Policy",
+    evaluate: (v) => {
+      if (!v) return { status: "missing", note: "Without this header, embedded content can use powerful browser features (camera, geolocation, etc.) unless restricted another way." };
+      return { status: "pass", note: "Present." };
+    }
+  },
+  {
+    header: "Cross-Origin-Opener-Policy",
+    evaluate: (v) => {
+      if (!v) return { status: "missing", note: "Without COOP, this page can be put in the same browsing context group as a malicious opener window." };
+      const lower = v.trim().toLowerCase();
+      if (lower === "same-origin") return { status: "pass", note: "Set to same-origin, the strongest isolation value." };
+      return { status: "warning", note: `Set to "${v.trim()}", which is weaker than same-origin.` };
+    }
+  },
+  {
+    header: "Cross-Origin-Embedder-Policy",
+    evaluate: (v) => {
+      if (!v) return { status: "missing", note: "Required alongside COOP for cross-origin isolation (e.g. to use SharedArrayBuffer)." };
+      const lower = v.trim().toLowerCase();
+      if (lower === "require-corp" || lower === "credentialless") return { status: "pass", note: `Set to ${lower}.` };
+      return { status: "warning", note: `Unrecognized value "${v.trim()}".` };
+    }
+  },
+  {
+    header: "Cross-Origin-Resource-Policy",
+    evaluate: (v) => {
+      if (!v) return { status: "missing", note: "Without CORP, this resource can be loaded cross-origin by any site that knows its URL." };
+      const lower = v.trim().toLowerCase();
+      if (lower === "same-origin" || lower === "same-site") return { status: "pass", note: `Set to ${lower}.` };
+      if (lower === "cross-origin") return { status: "warning", note: "Set to cross-origin, which allows any site to load this resource." };
+      return { status: "warning", note: `Unrecognized value "${v.trim()}".` };
+    }
+  }
+];
+function scoreSecurityHeaders(rawHeaders) {
+  if (typeof rawHeaders !== "string" || !rawHeaders.trim()) {
+    return { error: 'Paste one or more response headers, one per line in "Name: value" form' };
+  }
+  const headerMap = parseRawHeaderBlock(rawHeaders);
+  if (headerMap.size === 0) {
+    return { error: 'Could not parse any "Name: value" header lines from the input' };
+  }
+  const checks = SECURITY_HEADER_CHECKS.map((def) => {
+    const value = headerMap.get(def.header.toLowerCase()) ?? null;
+    const { status, note } = def.evaluate(value);
+    return { header: def.header, status, value, note };
+  });
+  const passCount = checks.filter((c) => c.status === "pass").length;
+  const warningCount = checks.filter((c) => c.status === "warning").length;
+  const missingCount = checks.filter((c) => c.status === "missing").length;
+  const totalChecks = checks.length;
+  const points = passCount + warningCount * 0.5;
+  const score = Math.round(points / totalChecks * 100);
+  const grade = score >= 90 ? "A" : score >= 75 ? "B" : score >= 60 ? "C" : score >= 40 ? "D" : "F";
+  return { checks, score, grade, passCount, warningCount, missingCount, totalChecks };
+}
 
-export { CLIENT_HINTS, DNS_RECORD_TYPES, HTTP_HEADERS, LINK_REL_VALUES, PERMISSIONS_POLICY_FEATURES, REFERRER_POLICY_VALUES, STATUS_CODES, X_CONTENT_TYPE_OPTIONS_HEADER, analyzeEmailHeaders, assessContentTypeRisk, buildAcceptLanguage, buildCacheControl, buildClientHints, buildContentDisposition, buildDnsQueryUrl, buildGeoUrl, buildHsts, buildLinkHeader, buildMapUrl, buildPermissionsPolicy, buildPreferHeader, buildPriorityHeader, buildRangeHeader, buildReferrerPolicy, buildRetryAfterHeader, buildRobotsMetaTag, buildVaryHeader, buildXContentTypeOptionsHeader, buildXRobotsTag, calculateCookieSizeBudget, checkSetCookieHeader, countryCodeToFlag, extractMultipartBoundary, formatCoordinates, formatTtl, getByCategory, getHeader, getHeadersByCategory, getStatusByCategory, getStatusCode, isClientError, isServerError, isSuccess, isValidIp, isValidIpv4, isValidIpv6, listCloseCodes, listOpcodes, lookupCloseCode, lookupOpcode, network_exports, parseAcceptLanguage, parseClientHintHeaders, parseContentDisposition, parseContentRangeHeader, parseDnsResponse, parseGeoResponse, parseHar, parseHsts, parseIpv6Address, parseMultipartFormData, parsePermissionsPolicy, parsePreferHeader, parsePriorityHeader, parseRetryAfterHeader, parseRobotsMetaTag, parseUserAgent, parseVaryHeader, parseXContentTypeOptionsHeader, parseXRobotsTag, searchHeaders, searchStatusCodes, splitSitemap, statusCodeToText, typeNumberToLabel, validateDomain, validateHeaderName, validateHeaderValue, validateManifest, validateRobotsTxt, validateSitemap };
+export { CLIENT_HINTS, DNS_RECORD_TYPES, HTTP_HEADERS, LINK_REL_VALUES, PERMISSIONS_POLICY_FEATURES, REFERRER_POLICY_VALUES, STATUS_CODES, X_CONTENT_TYPE_OPTIONS_HEADER, analyzeEmailHeaders, assessContentTypeRisk, buildAcceptLanguage, buildCacheControl, buildClientHints, buildContentDisposition, buildDnsQueryUrl, buildGeoUrl, buildHsts, buildLinkHeader, buildMapUrl, buildPermissionsPolicy, buildPreferHeader, buildPriorityHeader, buildRangeHeader, buildReferrerPolicy, buildRetryAfterHeader, buildRobotsMetaTag, buildVaryHeader, buildXContentTypeOptionsHeader, buildXRobotsTag, calculateCookieSizeBudget, checkSetCookieHeader, countryCodeToFlag, extractMultipartBoundary, formatCoordinates, formatTtl, getByCategory, getHeader, getHeadersByCategory, getStatusByCategory, getStatusCode, isClientError, isServerError, isSuccess, isValidIp, isValidIpv4, isValidIpv6, listCloseCodes, listOpcodes, lookupCloseCode, lookupOpcode, network_exports, parseAcceptLanguage, parseClientHintHeaders, parseContentDisposition, parseContentRangeHeader, parseDnsResponse, parseGeoResponse, parseHar, parseHsts, parseIpv6Address, parseMultipartFormData, parsePermissionsPolicy, parsePreferHeader, parsePriorityHeader, parseRetryAfterHeader, parseRobotsMetaTag, parseUserAgent, parseVaryHeader, parseXContentTypeOptionsHeader, parseXRobotsTag, scoreSecurityHeaders, searchHeaders, searchStatusCodes, splitSitemap, statusCodeToText, typeNumberToLabel, validateDomain, validateHeaderName, validateHeaderValue, validateManifest, validateRobotsTxt, validateSitemap };

package/dist/{chunk-PT4N4UBL.js → chunk-ZWFZRDQ4.js}

@@ -11,6 +11,7 @@ __export(media_exports, {
   readImageInfo: () => readImageInfo,
   readMidiInfo: () => readMidiInfo,
   readPdfMetadata: () => readPdfMetadata,
+  readPdfOutline: () => readPdfOutline,
   readPdfPageDimensions: () => readPdfPageDimensions,
   readVideoInfo: () => readVideoInfo,
   readWavInfo: () => readWavInfo
@@ -581,6 +582,74 @@ function readPdfPageDimensions(bytes) {
   if (out.length === 0) return { error: "Could not locate any page objects in this PDF" };
   return { version, pageCount: out.length, pages: out };
 }
+function parsePdfOutlineDest(dict) {
+  const directRef = dict.match(/\/Dest\s*\[\s*(\d+)\s+(\d+)\s+R/);
+  if (directRef) return { destType: "page", target: `${directRef[1]} ${directRef[2]} R` };
+  const directName = dict.match(/\/Dest\s*\/([^\s/()<>[\]]+)/);
+  if (directName) return { destType: "named", target: directName[1] };
+  const directString = dict.match(/\/Dest\s*\(((?:\\.|[^\\()])*)\)/);
+  if (directString) return { destType: "named", target: decodePdfString(directString[1], false) };
+  const actionUri = dict.match(/\/S\s*\/URI[\s\S]*?\/URI\s*\(((?:\\.|[^\\()])*)\)/);
+  if (actionUri) return { destType: "uri", target: decodePdfString(actionUri[1], false) };
+  const actionGotoRef = dict.match(/\/S\s*\/GoTo[\s\S]*?\/D\s*\[\s*(\d+)\s+(\d+)\s+R/);
+  if (actionGotoRef) return { destType: "page", target: `${actionGotoRef[1]} ${actionGotoRef[2]} R` };
+  const actionGotoName = dict.match(/\/S\s*\/GoTo[\s\S]*?\/D\s*\/([^\s/()<>[\]]+)/);
+  if (actionGotoName) return { destType: "named", target: actionGotoName[1] };
+  return { destType: "none", target: null };
+}
+function walkPdfOutlineChain(objMap, startRef, level, visited, out) {
+  let ref = startRef;
+  while (ref) {
+    if (visited.has(ref)) break;
+    visited.add(ref);
+    const body = objMap.get(ref);
+    if (!body) break;
+    const titleRaw = extractDictField(body, "Title");
+    const { destType, target } = parsePdfOutlineDest(body);
+    out.push({ title: titleRaw ?? "(untitled)", level, destType, target });
+    const firstMatch = body.match(/\/First\s+(\d+)\s+(\d+)\s+R/);
+    if (firstMatch) walkPdfOutlineChain(objMap, `${firstMatch[1]} ${firstMatch[2]}`, level + 1, visited, out);
+    const nextMatch = body.match(/\/Next\s+(\d+)\s+(\d+)\s+R/);
+    ref = nextMatch ? `${nextMatch[1]} ${nextMatch[2]}` : null;
+  }
+}
+function readPdfOutline(bytes) {
+  if (bytes.length < 8) return { error: "File too small to be a PDF" };
+  const header = bytesToLatin1(bytes.subarray(0, 16));
+  const versionMatch = header.match(/%PDF-(\d\.\d)/);
+  if (!versionMatch) return { error: "Not a valid PDF file (missing %PDF header)" };
+  const version = versionMatch[1];
+  const text = bytesToLatin1(bytes);
+  const objBlocks = [...text.matchAll(/(\d+)\s+(\d+)\s+obj([\s\S]*?)endobj/g)];
+  const objMap = /* @__PURE__ */ new Map();
+  for (const b of objBlocks) objMap.set(`${b[1]} ${b[2]}`, b[3]);
+  let outlinesBody = null;
+  const trailerMatches = [...text.matchAll(/trailer\s*<<([\s\S]*?)>>/g)];
+  if (trailerMatches.length > 0) {
+    const trailer = trailerMatches[trailerMatches.length - 1][1];
+    const rootRef = trailer.match(/\/Root\s+(\d+)\s+(\d+)\s+R/);
+    if (rootRef) {
+      const catalogBody = objMap.get(`${rootRef[1]} ${rootRef[2]}`);
+      const outlinesRef = catalogBody?.match(/\/Outlines\s+(\d+)\s+(\d+)\s+R/);
+      if (outlinesRef) outlinesBody = objMap.get(`${outlinesRef[1]} ${outlinesRef[2]}`) ?? null;
+    }
+  }
+  if (!outlinesBody) {
+    for (const b of objBlocks) {
+      if (/\/Type\s*\/Outlines\b/.test(b[3])) {
+        outlinesBody = b[3];
+        break;
+      }
+    }
+  }
+  if (!outlinesBody) return { error: "No /Outlines bookmark tree found in this PDF" };
+  const out = [];
+  const firstMatch = outlinesBody.match(/\/First\s+(\d+)\s+(\d+)\s+R/);
+  if (firstMatch) {
+    walkPdfOutlineChain(objMap, `${firstMatch[1]} ${firstMatch[2]}`, 0, /* @__PURE__ */ new Set(), out);
+  }
+  return { version, bookmarkCount: out.length, bookmarks: out };
+}
 var AUDIO_FORMAT_LABELS = {
   1: "PCM",
   3: "IEEE float",
@@ -1438,4 +1507,4 @@ function readMidiInfo(bytes) {
   };
 }
 
-export { inspectGifFrames, media_exports, readExifData, readFlacInfo, readIcoInfo, readId3Tags, readImageInfo, readMidiInfo, readPdfMetadata, readPdfPageDimensions, readVideoInfo, readWavInfo };
+export { inspectGifFrames, media_exports, readExifData, readFlacInfo, readIcoInfo, readId3Tags, readImageInfo, readMidiInfo, readPdfMetadata, readPdfOutline, readPdfPageDimensions, readVideoInfo, readWavInfo };

package/dist/index.cjs

@@ -11465,6 +11465,7 @@ __export(network_exports, {
   parseVaryHeader: () => parseVaryHeader,
   parseXContentTypeOptionsHeader: () => parseXContentTypeOptionsHeader,
   parseXRobotsTag: () => parseXRobotsTag,
+  scoreSecurityHeaders: () => scoreSecurityHeaders,
   searchHeaders: () => searchHeaders,
   searchStatusCodes: () => searchStatusCodes,
   splitSitemap: () => splitSitemap,
@@ -14904,6 +14905,123 @@ function calculateCookieSizeBudget(cookieHeader, budgetBytes = DEFAULT_COOKIE_BU
     exceedsBudget: totalBytes > budgetBytes
   };
 }
+function parseRawHeaderBlock(raw) {
+  const map = /* @__PURE__ */ new Map();
+  for (const line of raw.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    const idx = trimmed.indexOf(":");
+    if (idx === -1) continue;
+    const name = trimmed.slice(0, idx).trim().toLowerCase();
+    const value = trimmed.slice(idx + 1).trim();
+    if (!map.has(name)) map.set(name, value);
+  }
+  return map;
+}
+var SECURITY_HEADER_CHECKS = [
+  {
+    header: "Content-Security-Policy",
+    evaluate: (v) => {
+      if (!v) return { status: "missing", note: "Without a CSP, an injected script runs with full page privileges." };
+      if (/unsafe-inline|unsafe-eval/i.test(v)) return { status: "warning", note: "Contains unsafe-inline or unsafe-eval, which weakens XSS protection." };
+      return { status: "pass", note: "Present. Use the CSP Header Builder tool to validate its directives in depth." };
+    }
+  },
+  {
+    header: "Strict-Transport-Security",
+    evaluate: (v) => {
+      if (!v) return { status: "missing", note: "Without HSTS, a user's first visit (and any later downgrade) can be sent over plain HTTP." };
+      const maxAgeMatch = v.match(/max-age\s*=\s*(\d+)/i);
+      if (!maxAgeMatch) return { status: "warning", note: "Present but missing a max-age directive." };
+      const maxAge = Number(maxAgeMatch[1]);
+      if (maxAge < 31536e3) return { status: "warning", note: "max-age is below the recommended 1 year (31536000 seconds)." };
+      return { status: "pass", note: "Present with a max-age of at least 1 year." };
+    }
+  },
+  {
+    header: "X-Content-Type-Options",
+    evaluate: (v) => {
+      if (!v) return { status: "missing", note: "Without this header, browsers may MIME-sniff a response into an unintended content type." };
+      if (v.trim().toLowerCase() !== "nosniff") return { status: "warning", note: `"nosniff" is the only valid value; this value won't take effect.` };
+      return { status: "pass", note: "Set to the only valid value, nosniff." };
+    }
+  },
+  {
+    header: "X-Frame-Options",
+    evaluate: (v) => {
+      if (!v) return { status: "missing", note: "Without this (or a CSP frame-ancestors directive), the page can be framed by another site for clickjacking." };
+      const upper = v.trim().toUpperCase();
+      if (upper === "DENY" || upper === "SAMEORIGIN") return { status: "pass", note: `Framing restricted (${upper}).` };
+      if (upper.startsWith("ALLOW-FROM")) return { status: "warning", note: "ALLOW-FROM is deprecated and ignored by most modern browsers." };
+      return { status: "warning", note: "Unrecognized value." };
+    }
+  },
+  {
+    header: "Referrer-Policy",
+    evaluate: (v) => {
+      if (!v) return { status: "missing", note: "Without this header, the browser's default referrer behavior applies, which can leak full URLs to third parties." };
+      if (v.trim().toLowerCase() === "unsafe-url") return { status: "warning", note: "unsafe-url leaks the full URL, including path and query string, to every destination." };
+      return { status: "pass", note: "Present." };
+    }
+  },
+  {
+    header: "Permissions-Policy",
+    evaluate: (v) => {
+      if (!v) return { status: "missing", note: "Without this header, embedded content can use powerful browser features (camera, geolocation, etc.) unless restricted another way." };
+      return { status: "pass", note: "Present." };
+    }
+  },
+  {
+    header: "Cross-Origin-Opener-Policy",
+    evaluate: (v) => {
+      if (!v) return { status: "missing", note: "Without COOP, this page can be put in the same browsing context group as a malicious opener window." };
+      const lower = v.trim().toLowerCase();
+      if (lower === "same-origin") return { status: "pass", note: "Set to same-origin, the strongest isolation value." };
+      return { status: "warning", note: `Set to "${v.trim()}", which is weaker than same-origin.` };
+    }
+  },
+  {
+    header: "Cross-Origin-Embedder-Policy",
+    evaluate: (v) => {
+      if (!v) return { status: "missing", note: "Required alongside COOP for cross-origin isolation (e.g. to use SharedArrayBuffer)." };
+      const lower = v.trim().toLowerCase();
+      if (lower === "require-corp" || lower === "credentialless") return { status: "pass", note: `Set to ${lower}.` };
+      return { status: "warning", note: `Unrecognized value "${v.trim()}".` };
+    }
+  },
+  {
+    header: "Cross-Origin-Resource-Policy",
+    evaluate: (v) => {
+      if (!v) return { status: "missing", note: "Without CORP, this resource can be loaded cross-origin by any site that knows its URL." };
+      const lower = v.trim().toLowerCase();
+      if (lower === "same-origin" || lower === "same-site") return { status: "pass", note: `Set to ${lower}.` };
+      if (lower === "cross-origin") return { status: "warning", note: "Set to cross-origin, which allows any site to load this resource." };
+      return { status: "warning", note: `Unrecognized value "${v.trim()}".` };
+    }
+  }
+];
+function scoreSecurityHeaders(rawHeaders) {
+  if (typeof rawHeaders !== "string" || !rawHeaders.trim()) {
+    return { error: 'Paste one or more response headers, one per line in "Name: value" form' };
+  }
+  const headerMap = parseRawHeaderBlock(rawHeaders);
+  if (headerMap.size === 0) {
+    return { error: 'Could not parse any "Name: value" header lines from the input' };
+  }
+  const checks = SECURITY_HEADER_CHECKS.map((def) => {
+    const value = headerMap.get(def.header.toLowerCase()) ?? null;
+    const { status, note } = def.evaluate(value);
+    return { header: def.header, status, value, note };
+  });
+  const passCount = checks.filter((c) => c.status === "pass").length;
+  const warningCount = checks.filter((c) => c.status === "warning").length;
+  const missingCount = checks.filter((c) => c.status === "missing").length;
+  const totalChecks = checks.length;
+  const points = passCount + warningCount * 0.5;
+  const score = Math.round(points / totalChecks * 100);
+  const grade = score >= 90 ? "A" : score >= 75 ? "B" : score >= 60 ? "C" : score >= 40 ? "D" : "F";
+  return { checks, score, grade, passCount, warningCount, missingCount, totalChecks };
+}
 
 // src/tools/api.ts
 var api_exports = {};
@@ -24902,6 +25020,7 @@ __export(media_exports, {
   readImageInfo: () => readImageInfo,
   readMidiInfo: () => readMidiInfo,
   readPdfMetadata: () => readPdfMetadata,
+  readPdfOutline: () => readPdfOutline,
   readPdfPageDimensions: () => readPdfPageDimensions,
   readVideoInfo: () => readVideoInfo,
   readWavInfo: () => readWavInfo
@@ -25472,6 +25591,74 @@ function readPdfPageDimensions(bytes) {
   if (out.length === 0) return { error: "Could not locate any page objects in this PDF" };
   return { version: version2, pageCount: out.length, pages: out };
 }
+function parsePdfOutlineDest(dict) {
+  const directRef = dict.match(/\/Dest\s*\[\s*(\d+)\s+(\d+)\s+R/);
+  if (directRef) return { destType: "page", target: `${directRef[1]} ${directRef[2]} R` };
+  const directName = dict.match(/\/Dest\s*\/([^\s/()<>[\]]+)/);
+  if (directName) return { destType: "named", target: directName[1] };
+  const directString = dict.match(/\/Dest\s*\(((?:\\.|[^\\()])*)\)/);
+  if (directString) return { destType: "named", target: decodePdfString(directString[1], false) };
+  const actionUri = dict.match(/\/S\s*\/URI[\s\S]*?\/URI\s*\(((?:\\.|[^\\()])*)\)/);
+  if (actionUri) return { destType: "uri", target: decodePdfString(actionUri[1], false) };
+  const actionGotoRef = dict.match(/\/S\s*\/GoTo[\s\S]*?\/D\s*\[\s*(\d+)\s+(\d+)\s+R/);
+  if (actionGotoRef) return { destType: "page", target: `${actionGotoRef[1]} ${actionGotoRef[2]} R` };
+  const actionGotoName = dict.match(/\/S\s*\/GoTo[\s\S]*?\/D\s*\/([^\s/()<>[\]]+)/);
+  if (actionGotoName) return { destType: "named", target: actionGotoName[1] };
+  return { destType: "none", target: null };
+}
+function walkPdfOutlineChain(objMap, startRef, level, visited, out) {
+  let ref = startRef;
+  while (ref) {
+    if (visited.has(ref)) break;
+    visited.add(ref);
+    const body = objMap.get(ref);
+    if (!body) break;
+    const titleRaw = extractDictField(body, "Title");
+    const { destType, target } = parsePdfOutlineDest(body);
+    out.push({ title: titleRaw ?? "(untitled)", level, destType, target });
+    const firstMatch = body.match(/\/First\s+(\d+)\s+(\d+)\s+R/);
+    if (firstMatch) walkPdfOutlineChain(objMap, `${firstMatch[1]} ${firstMatch[2]}`, level + 1, visited, out);
+    const nextMatch = body.match(/\/Next\s+(\d+)\s+(\d+)\s+R/);
+    ref = nextMatch ? `${nextMatch[1]} ${nextMatch[2]}` : null;
+  }
+}
+function readPdfOutline(bytes) {
+  if (bytes.length < 8) return { error: "File too small to be a PDF" };
+  const header = bytesToLatin1(bytes.subarray(0, 16));
+  const versionMatch = header.match(/%PDF-(\d\.\d)/);
+  if (!versionMatch) return { error: "Not a valid PDF file (missing %PDF header)" };
+  const version2 = versionMatch[1];
+  const text = bytesToLatin1(bytes);
+  const objBlocks = [...text.matchAll(/(\d+)\s+(\d+)\s+obj([\s\S]*?)endobj/g)];
+  const objMap = /* @__PURE__ */ new Map();
+  for (const b of objBlocks) objMap.set(`${b[1]} ${b[2]}`, b[3]);
+  let outlinesBody = null;
+  const trailerMatches = [...text.matchAll(/trailer\s*<<([\s\S]*?)>>/g)];
+  if (trailerMatches.length > 0) {
+    const trailer = trailerMatches[trailerMatches.length - 1][1];
+    const rootRef = trailer.match(/\/Root\s+(\d+)\s+(\d+)\s+R/);
+    if (rootRef) {
+      const catalogBody = objMap.get(`${rootRef[1]} ${rootRef[2]}`);
+      const outlinesRef = catalogBody?.match(/\/Outlines\s+(\d+)\s+(\d+)\s+R/);
+      if (outlinesRef) outlinesBody = objMap.get(`${outlinesRef[1]} ${outlinesRef[2]}`) ?? null;
+    }
+  }
+  if (!outlinesBody) {
+    for (const b of objBlocks) {
+      if (/\/Type\s*\/Outlines\b/.test(b[3])) {
+        outlinesBody = b[3];
+        break;
+      }
+    }
+  }
+  if (!outlinesBody) return { error: "No /Outlines bookmark tree found in this PDF" };
+  const out = [];
+  const firstMatch = outlinesBody.match(/\/First\s+(\d+)\s+(\d+)\s+R/);
+  if (firstMatch) {
+    walkPdfOutlineChain(objMap, `${firstMatch[1]} ${firstMatch[2]}`, 0, /* @__PURE__ */ new Set(), out);
+  }
+  return { version: version2, bookmarkCount: out.length, bookmarks: out };
+}
 var AUDIO_FORMAT_LABELS = {
   1: "PCM",
   3: "IEEE float",

package/dist/index.d.cts

@@ -6,14 +6,14 @@ export { d as data } from './data-26TALa9U.cjs';
 export { g as generators } from './generators-DAXXrMvG.cjs';
 export { t as time } from './time-KqJjdqII.cjs';
 export { u as units } from './units-BqegyALA.cjs';
-export { n as network } from './network-Da3meCWM.cjs';
+export { n as network } from './network-BskZe1n2.cjs';
 export { a as api } from './api-CQnIUrVB.cjs';
 export { c as code } from './code-46xO9xFf.cjs';
 export { c as color } from './color-tPwZCr9H.cjs';
 export { c as css } from './css-Cf7AMGM-.cjs';
 export { m as misc } from './misc-CA3N198T.cjs';
 export { a as ai_agent } from './ai_agent-CmrVjvYH.cjs';
-export { m as media } from './media-56zrIBw4.cjs';
+export { m as media } from './media-DF8BS-iA.cjs';
 
 declare const version = "0.1.0";
 

package/dist/index.d.ts

@@ -6,14 +6,14 @@ export { d as data } from './data-26TALa9U.js';
 export { g as generators } from './generators-DAXXrMvG.js';
 export { t as time } from './time-KqJjdqII.js';
 export { u as units } from './units-BqegyALA.js';
-export { n as network } from './network-Da3meCWM.js';
+export { n as network } from './network-BskZe1n2.js';
 export { a as api } from './api-CQnIUrVB.js';
 export { c as code } from './code-46xO9xFf.js';
 export { c as color } from './color-tPwZCr9H.js';
 export { c as css } from './css-Cf7AMGM-.js';
 export { m as misc } from './misc-CA3N198T.js';
 export { a as ai_agent } from './ai_agent-CmrVjvYH.js';
-export { m as media } from './media-56zrIBw4.js';
+export { m as media } from './media-DF8BS-iA.js';
 
 declare const version = "0.1.0";
 

package/dist/index.js

@@ -1,6 +1,6 @@
-export { media_exports as media } from './chunk-PT4N4UBL.js';
+export { media_exports as media } from './chunk-ZWFZRDQ4.js';
 export { units_exports as units } from './chunk-RP574L5Z.js';
-export { network_exports as network } from './chunk-CXUOV672.js';
+export { network_exports as network } from './chunk-KWS4ZCYG.js';
 export { api_exports as api } from './chunk-U2HREMZU.js';
 export { code_exports as code } from './chunk-XT2BQWXT.js';
 export { color_exports as color } from './chunk-BPVAB4P2.js';

package/dist/{media-56zrIBw4.d.cts → media-DF8BS-iA.d.cts}

@@ -87,6 +87,32 @@ interface PdfPageDimensionsResult {
  * PDF spec requires. No PDF rendering library required.
  */
 declare function readPdfPageDimensions(bytes: Uint8Array): PdfPageDimensionsResult | PdfMetadataError;
+type PdfOutlineDestType = 'page' | 'uri' | 'named' | 'none';
+interface PdfOutlineItem {
+    title: string;
+    level: number;
+    destType: PdfOutlineDestType;
+    target: string | null;
+}
+interface PdfOutlineResult {
+    version: string | null;
+    bookmarkCount: number;
+    bookmarks: PdfOutlineItem[];
+}
+interface PdfOutlineError {
+    error: string;
+}
+/**
+ * Walk a PDF's /Outlines bookmark tree (the Root -> Outlines -> First/Next/
+ * First chain of entries a PDF viewer's sidebar builds its table of
+ * contents from) and list every bookmark's title, nesting level, and link
+ * target, in document order. Only the destination's raw target is reported
+ * (an object reference for a page link, a URI for a web link, or a name for
+ * a named destination) — this does not resolve a page-ref target to a page
+ * number, since that requires a second pass over the page tree; pair it
+ * with readPdfPageDimensions's output if you need that mapping.
+ */
+declare function readPdfOutline(bytes: Uint8Array): PdfOutlineResult | PdfOutlineError;
 interface WavInfo {
     audioFormat: number;
     audioFormatLabel: string;
@@ -285,6 +311,10 @@ type media_MidiTimeSignature = MidiTimeSignature;
 type media_MidiTrackInfo = MidiTrackInfo;
 type media_PdfMetadata = PdfMetadata;
 type media_PdfMetadataError = PdfMetadataError;
+type media_PdfOutlineDestType = PdfOutlineDestType;
+type media_PdfOutlineError = PdfOutlineError;
+type media_PdfOutlineItem = PdfOutlineItem;
+type media_PdfOutlineResult = PdfOutlineResult;
 type media_PdfPageDimension = PdfPageDimension;
 type media_PdfPageDimensionsResult = PdfPageDimensionsResult;
 type media_PdfPageOrientation = PdfPageOrientation;
@@ -300,11 +330,12 @@ declare const media_readId3Tags: typeof readId3Tags;
 declare const media_readImageInfo: typeof readImageInfo;
 declare const media_readMidiInfo: typeof readMidiInfo;
 declare const media_readPdfMetadata: typeof readPdfMetadata;
+declare const media_readPdfOutline: typeof readPdfOutline;
 declare const media_readPdfPageDimensions: typeof readPdfPageDimensions;
 declare const media_readVideoInfo: typeof readVideoInfo;
 declare const media_readWavInfo: typeof readWavInfo;
 declare namespace media {
-  export { type media_ExifData as ExifData, type media_ExifError as ExifError, type media_FlacInfo as FlacInfo, type media_FlacInfoError as FlacInfoError, type media_GifInfo as GifInfo, type media_GifInfoError as GifInfoError, type media_IcoImageEntry as IcoImageEntry, type media_IcoInfo as IcoInfo, type media_IcoInfoError as IcoInfoError, type media_Id3Tags as Id3Tags, type media_Id3TagsError as Id3TagsError, type media_ImageFormat as ImageFormat, type media_ImageInfo as ImageInfo, type media_ImageInfoError as ImageInfoError, type media_MidiDivision as MidiDivision, type media_MidiInfo as MidiInfo, type media_MidiInfoError as MidiInfoError, type media_MidiTimeSignature as MidiTimeSignature, type media_MidiTrackInfo as MidiTrackInfo, type media_PdfMetadata as PdfMetadata, type media_PdfMetadataError as PdfMetadataError, type media_PdfPageDimension as PdfPageDimension, type media_PdfPageDimensionsResult as PdfPageDimensionsResult, type media_PdfPageOrientation as PdfPageOrientation, type media_VideoInfo as VideoInfo, type media_VideoInfoError as VideoInfoError, type media_WavInfo as WavInfo, type media_WavInfoError as WavInfoError, media_inspectGifFrames as inspectGifFrames, media_readExifData as readExifData, media_readFlacInfo as readFlacInfo, media_readIcoInfo as readIcoInfo, media_readId3Tags as readId3Tags, media_readImageInfo as readImageInfo, media_readMidiInfo as readMidiInfo, media_readPdfMetadata as readPdfMetadata, media_readPdfPageDimensions as readPdfPageDimensions, media_readVideoInfo as readVideoInfo, media_readWavInfo as readWavInfo };
+  export { type media_ExifData as ExifData, type media_ExifError as ExifError, type media_FlacInfo as FlacInfo, type media_FlacInfoError as FlacInfoError, type media_GifInfo as GifInfo, type media_GifInfoError as GifInfoError, type media_IcoImageEntry as IcoImageEntry, type media_IcoInfo as IcoInfo, type media_IcoInfoError as IcoInfoError, type media_Id3Tags as Id3Tags, type media_Id3TagsError as Id3TagsError, type media_ImageFormat as ImageFormat, type media_ImageInfo as ImageInfo, type media_ImageInfoError as ImageInfoError, type media_MidiDivision as MidiDivision, type media_MidiInfo as MidiInfo, type media_MidiInfoError as MidiInfoError, type media_MidiTimeSignature as MidiTimeSignature, type media_MidiTrackInfo as MidiTrackInfo, type media_PdfMetadata as PdfMetadata, type media_PdfMetadataError as PdfMetadataError, type media_PdfOutlineDestType as PdfOutlineDestType, type media_PdfOutlineError as PdfOutlineError, type media_PdfOutlineItem as PdfOutlineItem, type media_PdfOutlineResult as PdfOutlineResult, type media_PdfPageDimension as PdfPageDimension, type media_PdfPageDimensionsResult as PdfPageDimensionsResult, type media_PdfPageOrientation as PdfPageOrientation, type media_VideoInfo as VideoInfo, type media_VideoInfoError as VideoInfoError, type media_WavInfo as WavInfo, type media_WavInfoError as WavInfoError, media_inspectGifFrames as inspectGifFrames, media_readExifData as readExifData, media_readFlacInfo as readFlacInfo, media_readIcoInfo as readIcoInfo, media_readId3Tags as readId3Tags, media_readImageInfo as readImageInfo, media_readMidiInfo as readMidiInfo, media_readPdfMetadata as readPdfMetadata, media_readPdfOutline as readPdfOutline, media_readPdfPageDimensions as readPdfPageDimensions, media_readVideoInfo as readVideoInfo, media_readWavInfo as readWavInfo };
 }
 
-export { readImageInfo as A, readMidiInfo as B, readPdfMetadata as C, readPdfPageDimensions as D, type ExifData as E, type FlacInfo as F, type GifInfo as G, readVideoInfo as H, type IcoImageEntry as I, readWavInfo as J, type MidiDivision as M, type PdfMetadata as P, type VideoInfo as V, type WavInfo as W, type ExifError as a, type FlacInfoError as b, type GifInfoError as c, type IcoInfo as d, type IcoInfoError as e, type Id3Tags as f, type Id3TagsError as g, type ImageFormat as h, type ImageInfo as i, type ImageInfoError as j, type MidiInfo as k, type MidiInfoError as l, media as m, type MidiTimeSignature as n, type MidiTrackInfo as o, type PdfMetadataError as p, type PdfPageDimension as q, type PdfPageDimensionsResult as r, type PdfPageOrientation as s, type VideoInfoError as t, type WavInfoError as u, inspectGifFrames as v, readExifData as w, readFlacInfo as x, readIcoInfo as y, readId3Tags as z };
+export { readExifData as A, readFlacInfo as B, readIcoInfo as C, readId3Tags as D, type ExifData as E, type FlacInfo as F, type GifInfo as G, readImageInfo as H, type IcoImageEntry as I, readMidiInfo as J, readPdfMetadata as K, readPdfOutline as L, type MidiDivision as M, readPdfPageDimensions as N, readVideoInfo as O, type PdfMetadata as P, readWavInfo as Q, type VideoInfo as V, type WavInfo as W, type ExifError as a, type FlacInfoError as b, type GifInfoError as c, type IcoInfo as d, type IcoInfoError as e, type Id3Tags as f, type Id3TagsError as g, type ImageFormat as h, type ImageInfo as i, type ImageInfoError as j, type MidiInfo as k, type MidiInfoError as l, media as m, type MidiTimeSignature as n, type MidiTrackInfo as o, type PdfMetadataError as p, type PdfOutlineDestType as q, type PdfOutlineError as r, type PdfOutlineItem as s, type PdfOutlineResult as t, type PdfPageDimension as u, type PdfPageDimensionsResult as v, type PdfPageOrientation as w, type VideoInfoError as x, type WavInfoError as y, inspectGifFrames as z };