@vbarbarosh/node-helpers 3.78.0 → 3.79.0

package/README.md

@@ -20,7 +20,7 @@ npm install @vbarbarosh/node-helpers
 A subset of `@vbarbarosh/node-helpers` is available for browser:
 
 ```html
-<script src="https://unpkg.com/@vbarbarosh/node-helpers@3.78.0/dist/browser.js"></script>
+<script src="https://unpkg.com/@vbarbarosh/node-helpers@3.79.0/dist/browser.js"></script>
 ```
 
 ⚠️ All browser functions are exposed globally.

package/dist/browser.js

@@ -1 +1 @@
-(()=>{var t={932(t){t.exports=function(t){return"number"==typeof t&&isFinite(t)}},5392(t,e,n){const r=n(932);t.exports=function(t,e){return r(t)&&t>e}},4106(t,e){function n(t,e){var n=[],r=[];return null==e&&(e=function(t,e){return n[0]===e?"[Circular ~]":"[Circular ~."+r.slice(0,n.indexOf(e)).join(".")+"]"}),function(o,s){if(n.length>0){var u=n.indexOf(this);~u?n.splice(u+1):n.push(this),~u?r.splice(u,1/0,o):r.push(o),~n.indexOf(s)&&(s=e.call(this,o,s))}else n.push(s);return null==t?s:t.call(this,o,s)}}(t.exports=function(t,e,r,o){return JSON.stringify(t,n(e,o),r)}).getSerialize=n},6083(t){t.exports=function(t=[],e=1){if(e<1)throw new Error("Limit value should be at least 1");const n=[];for(let r=0,o=t.length;r<o;r+=e)n.push(t.slice(r,r+e));return n}},2458(t,e,n){const r=n(7727);t.exports=function(t=[],e=1,n=1){const o=r(1,e,Math.floor(t.length/n)),s=Math.floor(t.length/o);let u=t.length%o;const c=[];for(let e=0;e<t.length;){const n=s+(u?1:0);c.push(t.slice(e,e+n)),e+=n,u&&u--}return c}},353(t,e,n){const r=n(4476),o=1e-5;t.exports=function(t,e){const n=Math.floor(t*e);if(n<=1)return[0];const s=[];for(let e=0;e<n;++e)s.push(r(e/(n-1)*(t-o),o));return s}},6372(t,e,n){const r=n(6785);t.exports=function(t,e=Number){return t.map(t=>e(t)).reduce((t,e)=>r(t,e),0)}},3537(t){t.exports=function(t,e){const n=new Map;return t.forEach(function(t){const r=e(t);n.has(r)||n.set(r,{key:r,items:[]}),n.get(r).items.push(t)}),n.values().toArray()}},2976(t){t.exports=function(t,e){const n={};return t.forEach(function(t){const r=e(t);n[r]=n[r]||{key:r,items:[]},n[r].items.push(t)}),n}},2166(t,e,n){const r=n(956);t.exports=function(t,e=r){const n={};return t.forEach(t=>n[e(t)]=t),n}},7866(t,e,n){const r=n(7347);t.exports=function(t,e=Number){return t.map(t=>e(t)).reduce((t,e)=>r(t,e),1)}},6772(t,e,n){const r=n(956);t.exports=function(t,e=r){let n=null,o=null,s=!1;return t.forEach(function(t){const r=e(t);Number.isNaN(r)||(!s||o<r)&&(s=!0,o=r,n=t)}),n}},42(t,e,n){const r=n(956);t.exports=function(t,e=r){let n=null,o=null,s=!1;return t.forEach(function(t){const r=e(t);Number.isNaN(r)||(!s||o>r)&&(s=!0,o=r,n=t)}),n}},3685(t){t.exports=function t(e,n=e.length){if(n!==e.length)return function(e,n){if(0===n)return[[]];if(e.length<n)return[];const r=[];for(let o=0;o<e.length;o++){const s=e.slice(0,o).concat(e.slice(o+1));for(const u of t(s,n-1))r.push([e[o],...u])}return r}(e,n);let r,o,s=(e=e.slice()).length,u=[e.slice()],c=new Array(s).fill(0),a=1;for(;a<s;)c[a]<a?(r=a%2&&c[a],o=e[a],e[a]=e[r],e[r]=o,++c[a],a=1,u.push(e.slice())):(c[a]=0,++a);return u}},4943(t){t.exports=function(t){for(let e=t.length;--e>0;){const n=Math.floor(Math.random()*(e+1)),r=t[e];t[e]=t[n],t[n]=r}return t}},2356(t,e,n){const r=n(8310),o=n(4332);t.exports=function(t,e,n=r){const s=new Map;return t.sort(function(t,r){if(!s.has(t)){const n=e(t);s.set(t,Array.isArray(n)?n:[n])}if(!s.has(r)){const t=e(r);s.set(r,Array.isArray(t)?t:[t])}return o(s.get(t),s.get(r),n)})}},5181(t,e,n){const r=n(8310);t.exports=function(t,e,n,o=r){const s=Object.create(null);return n.forEach((t,e)=>s[t]=e+1),t.sort(function(t,n){const r=s[e(t)],u=s[e(n)];return r&&u?r-u:r?-1:u?1:o(t,n)})}},453(t){t.exports=function(t,e=Number){let n=0;return t.forEach(function(t){n+=e(t)}),n}},3523(t,e,n){const r=n(956);t.exports=function(t,e=r){const n=new Set;return t.filter(function(t){const r=e(t);return!n.has(r)&&(n.add(r),!0)})}},6382(t,e,n){const r=n(956);t.exports=function(t,e=r){const n=[],o=new Set;for(let r=t.length;--r>=0;){const s=t[r],u=e(s);o.has(u)||(o.add(u),n.push(s))}return n.reverse()}},7727(t){t.exports=function(t,e,n){return Math.max(t,Math.min(e,n))}},9870(t){t.exports=function(t,e){return t.setHours(t.getHours()+e),t}},5799(t){t.exports=function(t,e){return t.setMilliseconds(t.getMilliseconds()+e),t}},3160(t){t.exports=function(t,e){return t.setMinutes(t.getMinutes()+e),t}},1570(t){t.exports=function(t,e){if(!e)return t;const n=t.getDate();return t.setMonth(t.getMonth()+e),t.getDate()!==n&&t.setDate(0),t}},9296(t){t.exports=function(t,e){return t.setSeconds(t.getSeconds()+e),t}},5488(t){t.exports=function(t,e){return Math.floor((t.getTime()-e.getTime())/1e3)}},3752(t){t.exports=function(t){const e=t.getFullYear();return e%4==0&&e%100!=0||e%400==0}},3150(t){t.exports=function(t){return t=Math.trunc(Math.abs(t)),[Math.floor(t/36e5),Math.floor(t%36e5/6e4),Math.floor(t%6e4/1e3),t%1e3]}},2806(t){t.exports=function(t,e){return t.getTime()-e.getTime()}},8310(t,e,n){const r=n(7668);t.exports=function(t,e){return"string"==typeof t&&"string"==typeof e?r(t,e):t<e?-1:t>e?1:0}},2092(t,e,n){const r=n(8310);t.exports=function(t,e){return r(e,t)}},3553(t){function e(t){return"-"===t[0]?(t=t.slice(1),function(e,r){return n(r[t],e[t])}):function(e,r){return n(e[t],r[t])}}function n(t,e){return"string"==typeof t&&"string"==typeof e?t.localeCompare(e):t-e}t.exports=function(t){const n=t.map(e);switch(n.length){case 0:return()=>0;case 1:return n[0];case 2:return function(t,e){return n[0](t,e)||n[1](t,e)};case 3:return function(t,e){return n[0](t,e)||n[1](t,e)||n[2](t,e)};default:return function(t,e){for(let r=0;r<n.length;++r){const o=n[r](t,e);if(o)return o}return 0}}}},3129(t){t.exports=function(t,e){return t-e}},4332(t,e,n){const r=n(8310);t.exports=function(t,e,n=r){const o=Math.min(t.length,e.length);for(let r=0;r<o;++r){const o=n(t[r],e[r]);if(o)return o}return 0}},3106(t){t.exports=function(t,e){return t<e?-1:t>e?1:0}},2271(t){t.exports=function(t,e){return t.localeCompare(e,void 0,{sensitivity:"base"})}},4457(t){t.exports=function(t,e){return t.localeCompare(e,void 0,{sensitivity:"variant"})}},7668(t){function e(t,e){const r=t.replace(/^0+/,""),o=e.replace(/^0+/,"");return r.length-o.length||n(r,o)||t.length-e.length}function n(t,e){return t<e?-1:t>e?1:0}t.exports=function(t,r){const o=t.match(/\d+|\D+/g)||[],s=r.match(/\d+|\D+/g)||[],u=Math.min(o.length,s.length);for(let t=0;t<u;++t){const r=o[t][0]<="9"&&s[t][0]<="9"&&o[t][0]>="0"&&s[t][0]>="0"?e(o[t],s[t]):n(o[t],s[t]);if(r)return r}return o.length-s.length}},4385(t){t.exports=function(t,e){return t.localeCompare(e,void 0,{numeric:!0,sensitivity:"base"})}},8951(t){t.exports=function(t,e){return t.localeCompare(e,void 0,{numeric:!0,sensitivity:"variant"})}},4734(t,e,n){const r=n(8310),o=n(2092),s=n(956),u=Symbol("fcmpx.missing");function c(t){const{read:e,fcmp:n}=a(t);return function(t,r){return n(e(t),e(r))}}function a(t){if("function"==typeof t)return{read:i(t),fcmp:f(r)};if("string"==typeof t){const e=t.startsWith("-");return{read:i(e?t.slice(1):t),fcmp:f(e?o:r)}}const e=t.fcmp,n=i(t.read),s=f(t.desc?e?(t,n)=>e(n,t):o:e??r);if(Array.isArray(t.top)){const e=new Map(t.top.map((t,e)=>[t,e]));return{read:t=>e.get(n(t))??e.size,fcmp:s}}if(Array.isArray(t.bottom)){const e=new Map(t.bottom.map((t,e)=>[t,e]));return{read:t=>e.get(n(t))??-1,fcmp:s}}return{read:n,fcmp:s}}function i(t){if(void 0===t||""===t||"."===t)return s;if("function"==typeof t)return function(e){return t(e)??u};if("string"==typeof t){const e=t.split("."),[n,r,o,s,c]=e;switch(e.length){case 1:return t=>t?.[n]??u;case 2:return t=>t?.[n]?.[r]??u;case 3:return t=>t?.[n]?.[r]?.[o]??u;case 4:return t=>t?.[n]?.[r]?.[o]?.[s]??u;case 5:return t=>t?.[n]?.[r]?.[o]?.[s]?.[c]??u;default:return t=>e.reduce((t,e)=>t?.[e],t)??u}}return e=>e?.[t]??u}function f(t){return function(e,n){return e===u?n===u?0:1:n===u?-1:t(e,n)}}t.exports=function t(e){if("string"==typeof e)return e.includes(",")?t(e.split(",")):c(e);if(!Array.isArray(e))return c(e);const n=e.map(a);return function(t,e){const r=n.map(e=>e.read(t)),o=n.map(t=>t.read(e));for(let t=0;t<n.length;++t){const e=n[t].fcmp(r[t],o[t]);if(e)return e}return 0}}},7960(t){function e(t){let e,n,r;return e=t.replaceAll("^",""),n=e.length!==t.length,e=(t=e).replaceAll("$",""),r=e.length!==t.length,e=(t=e).replaceAll("!",""),(t.length-e.length)%2?n&&r?t=>!(t.startsWith(e)&&t.endsWith(e)):n?t=>!t.startsWith(e):r?t=>!t.endsWith(e):t=>!t.includes(e):n&&r?t=>t.startsWith(e)&&t.endsWith(e):n?t=>t.startsWith(e):r?t=>t.endsWith(e):t=>t.includes(e)}t.exports=function(t){let n,r,o,s;const u=function(t){return t.split("/").filter(t=>t).map(e)}(t);switch(u.length){case 0:return()=>!0;case 1:return u[0];case 2:return[n,r]=u,t=>n(t)&&r(t);case 3:return[n,r,o]=u,t=>n(t)&&r(t)&&o(t);case 4:return[n,r,o,s]=u,t=>n(t)&&r(t)&&o(t)&&s(t);default:return t=>u.every(e=>e(t))}}},6017(t){t.exports=function(t){if("number"!=typeof t||Number.isNaN(t))return"n/a";if(!t)return"0KB";if(t<1024)return"1KB";const e=Math.floor(Math.log(t)/Math.log(1024));return`${(t/1024**e).toFixed(t>1048576?2:0)}${["B","KB","MB","GB","TB","PB"][e]}`.replace(/\.00/,".0")}},1284(t){t.exports=function(t){return t.getFullYear()+`/0${t.getMonth()+1}/0${t.getDate()} 0${t.getHours()}:0${t.getMinutes()}:0${t.getSeconds()}`.replace(/0(\d\d)/g,"$1")}},5224(t){function e(t){return t>9?`${t}`:`0${t}`}t.exports=function(t){return t.getFullYear()+e(t.getMonth()+1)+e(t.getDate())+"_"+(e(t.getHours())+e(t.getMinutes())+e(t.getSeconds()))}},1690(t){function e(t){return t>9?`${t}`:`0${t}`}t.exports=function(t){return t.getFullYear()+"/"+e(t.getMonth()+1)+"/"+e(t.getDate())+" "+e(t.getHours())+":"+e(t.getMinutes())+":"+e(t.getSeconds())}},6997(t){t.exports=function(t){return t.getFullYear()+`/0${t.getMonth()+1}/0${t.getDate()}`.replace(/0(\d\d)/g,"$1")}},9009(t,e,n){const r=n(3332);t.exports=function(t){return t?t.response?.status&&t.response?.statusText&&t.response?.config?function(t){return`\n${t.message??"n/a"}\n\n--- REQUEST ---\n\n${(t.response.config.method||"").toUpperCase()} ${t.response.config.url}\n\n${JSON.stringify(t.response.config.headers||{},null,4).slice(1,-1).replace(/^\s+|,$/gm,"").trim()}\n\n--- RESPONSE ---\n\n${t.response.status} ${t.response.statusText}\n\n${String(t.response.data??"").slice(0,10240)||"n/a"}\n\n--- STACK ---\n\n${t.stack??"n/a"}\n`.trimStart()}(t):t.config?function(t){return`\n${t.message??"n/a"}\n\n--- REQUEST ---\n\n${(t.config.method||"").toUpperCase()} ${t.config.url}\n\n${JSON.stringify(t.config.headers||{},null,4).slice(1,-1).replace(/^\s+|,$/gm,"").trim()}\n\n--- STACK ---\n\n${t.stack??"n/a"}\n`.trimStart()}(t):r({code:t.code,name:t.name,message:t.message??"n/a",stack:t.stack&&t.stack.split(/\n\s*/)},null,4):r({error:void 0===t?"---undefined---":t})}},6015(t){t.exports=function(t,e=6){const[n,r]=t;return(n+r/1e9).toFixed(e)+"s"}},4153(t){t.exports=function(t){if("number"!=typeof t||Number.isNaN(t))return"n/a";if(!t)return"0";if(t<1e3)return t.toFixed(0);const e=parseInt(Math.floor(Math.log(t)/Math.log(1e3)),10);return`${(t/1e3**e).toFixed(2)}${["","K","M","G","T","P"][e]}`}},1120(t,e,n){const r=n(3150);t.exports=function(t){t||(t=0);const e=t<0?"-":"",[n,o,s]=r(t);return n?e+`0${n}:0${o}:0${s}`.replace(/0+(?=\d\d)/g,""):e+`0${o}:0${s}`.replace(/0+(?=\d\d)/g,"")}},7336(t,e,n){const r=n(3150);t.exports=function(t){t||(t=0);const e=t<0?"-":"",[n,o,s,u]=r(10*Math.round(Math.abs(t)/10));return n?e+`0${n}:0${o}:0${s}.0${u/10}`.replace(/0+(?=\d\d)/g,""):e+`0${o}:0${s}.0${u/10}`.replace(/0+(?=\d\d)/g,"")}},495(t,e,n){const r=n(3150);t.exports=function(t,e=!1){t||(t=0);const n=t<0?"-":"",[o,s,u,c]=r(t);return o||e?n+`0${o}:0${s}:0${u}.00${c}`.replace(/0+(?=\d\d+[:.]|\d\d\d)/g,""):n+`0${s}:0${u}.00${c}`.replace(/0+(?=\d\d+[:.]|\d\d\d)/g,"")}},7882(t){t.exports=function(t){return(100*t).toFixed(2).replace(/^(0|100).00$/,"$1")+"%"}},7111(t,e,n){const r=n(6017),o=n(7882),s=n(3527),u=n(5392);t.exports=function({percents:t,total:e,done:n,rate:c,eta:a,duration:i}){const f=u(c,0)?`${r(c)}/s`:"~";if(n>e)return`${r(n)} at ${f} duration=${s(i)}`;if(u(e,0)){const c=u(a,0)?s(a):"~";return`${o(t)} | ${r(n)} of ${r(e)} at ${f} ETA ${c} duration=${s(i)}`}return u(n,0)?`${r(n)} of ~ at ${f} duration=${s(i)}`:u(i,0)?`~ duration=${s(i)}`:"~"}},5051(t,e,n){const r=n(4153),o=n(7882),s=n(3527),u=n(5392);t.exports=function({percents:t,total:e,done:n,rate:c,eta:a,duration:i}){const f=u(c,0)?`${r(c)}/s`:"~";if(n>e)return`${r(n)} at ${f} duration=${s(i)}`;if(u(e,0)){const c=u(a,0)?s(a):"~";return`${o(t)} | ${r(n)} of ${r(e)} at ${f} ETA ${c} duration=${s(i)}`}return u(n,0)?`${r(n)} of ~ at ${f} duration=${s(i)}`:u(i,0)?`~ duration=${s(i)}`:"~"}},3527(t){t.exports=function(t){const e=Math.abs(Math.trunc(t)),n=`0${Math.floor(e/60/60)}:0${Math.floor(e/60)%60}:0${e%60}`.replace(/0(\d\d)/g,"$1");return t<=-1?"-"+n:n}},2677(t){t.exports=function(t){return t.toString().replace(/\B(?<!\.\d*)(?=(\d{3})+(?!\d))/g,",")}},4206(t,e,n){const r=n(3719);t.exports=function(t,e){return r.delete(t,{responseType:"json",...e}).then(t=>t.data)}},4131(t,e,n){const r=n(3719);t.exports=function(t,e){return r.get(t,{responseType:"blob",...e}).then(t=>t.data)}},706(t,e,n){const r=n(3719);t.exports=function(t,e){return r.get(t,{responseType:"arraybuffer",...e}).then(t=>t.data)}},3066(t,e,n){const r=n(3719);t.exports=function(t,e){return r.get(t,{responseType:"json",...e}).then(t=>t.data)}},3019(t,e,n){const r=n(3719);t.exports=function(t,e){return r.get(t,{responseType:"text",responseEncoding:"utf8",...e}).then(t=>t.data)}},7379(t,e,n){const r=n(3719);t.exports=function(t,e){return r.head(t,e).then(t=>t.request.res.headers)}},2552(t,e,n){const r=n(3719);t.exports=function(t,e,n){return r.patch(t,e,n).then(t=>t.data)}},7484(t,e,n){const r=n(3719);t.exports=function(t,e,n){return r.post(t,e,n).then(t=>t.data)}},5420(t,e,n){const r=n(8241),o=n(3719);t.exports=function(t,e,n){const s=new r;for(let t=0,n=e.length;t<n;++t){const n=e[t];n.options?s.append(n.name,n.body,n.options):s.append(n.name,n.body)}if(s.getHeaders){const e={...n};return e.headers={...e.headers,...s.getHeaders()},Promise.resolve(o.post(t,s,e)).then(t=>t.data)}return Promise.resolve(o.post(t,s,n)).then(t=>t.data)}},4605(t,e,n){const r=n(3719);t.exports=function(t,e,n){return r.put(t,e,n).then(t=>t.data)}},6357(t,e,n){const r=n(3719);t.exports=function(t,e,n){return r.put(t,e,n).then(t=>t.data)}},2380(t,e,n){const r=n(3719);t.exports=async function(t,e,n){return r.put(t,e,n).then(t=>t.data)}},956(t){t.exports=function(t){return t}},1828(t){t.exports=function(){}},3332(t,e,n){const r=n(4106);t.exports=r},6785(t){t.exports=function t(e,n){return n?t(n,e%n):Math.abs(e)}},7347(t,e,n){const r=n(6785);t.exports=function(t,e){return Math.abs(t*e)/r(t,e)}},792(t){t.exports=function(t,e,n,r){return 0===t&&"string"==typeof r?r:t%10==1&&t%100!=11?e.split("#").join(t):n.split("#").join(t)}},131(t){t.exports=function(t,e){return Math.floor(Math.random()*(e-t+1)+t)}},4476(t){t.exports=function(t,e=1){if(0===e)return t;const n=1/e,r=Math.sign(t),o=function(t){if(Math.floor(t)===t)return 0;const[e,n]=t.toExponential().split("e"),r=(e.split(".")[1]||"").length;return Math.max(0,r-parseInt(n,10))}(e),s=1e-12*r,u=Math.round(t*n+s)/n;return Number(u.toFixed(o))}},7233(t){t.exports=function(t,e){const n=String(t||""),r=Object.entries(e||{});if(!r.length)return n;const o=n.indexOf("#"),s=-1===o?"":n.slice(o),u=-1===o?n:n.slice(0,o),c=u.indexOf("?"),a=-1===c?u:u.slice(0,c),i=-1===c?"":u.slice(c+1),f=new URLSearchParams(i);r.forEach(function([t,e]){switch(e){case null:case void 0:f.delete(t);break;case!0:f.set(t,"1");break;case!1:f.set(t,"0");break;default:f.set(t,String(e))}});const p=f.toString();return a+(p?`?${p}`:"")+s}},6966(t,e,n){const r=n(2468);t.exports=function(t){return new r(function(e,n){t(function(t,r){t?n(t):e(r)})})}},7072(t,e,n){const r={"./array_chunk.js":6083,"./array_chunk_balanced.js":2458,"./array_fps.js":353,"./array_gcd.js":6372,"./array_group.js":3537,"./array_group_map.js":2976,"./array_index.js":2166,"./array_lcm.js":7866,"./array_max.js":6772,"./array_min.js":42,"./array_permutations.js":3685,"./array_shuffle.js":4943,"./array_sort.js":2356,"./array_sort_other.js":5181,"./array_sum.js":453,"./array_unique.js":3523,"./array_unique_last.js":6382,"./date_add_hours.js":9870,"./date_add_milliseconds.js":5799,"./date_add_minutes.js":3160,"./date_add_months.js":1570,"./date_add_seconds.js":9296,"./date_diff_seconds.js":5488,"./date_is_leap_year.js":3752,"./fcmp_dates.js":2806,"./fcmp_default.js":8310,"./fcmp_default_desc.js":2092,"./fcmp_from_spec.js":3553,"./fcmp_numbers.js":3129,"./fcmp_tuples.js":4332,"./fcmp_utf8_bin.js":3106,"./fcmp_utf8_ci.js":2271,"./fcmp_utf8_cs.js":4457,"./fcmp_utf8_natural_bin.js":7668,"./fcmp_utf8_natural_ci.js":4385,"./fcmp_utf8_natural_cs.js":8951,"./fcmpx.js":4734,"./filter1_from_spec.js":7960,"./format_bytes.js":6017,"./format_date.js":1284,"./format_date_fs.js":5224,"./format_date_human.js":1690,"./format_date_ymd.js":6997,"./format_error_report.js":9009,"./format_hrtime.js":6015,"./format_kilo.js":4153,"./format_ms.js":1120,"./format_ms2.js":7336,"./format_ms3.js":495,"./format_percents.js":7882,"./format_progress_bytes.js":7111,"./format_progress_kilo.js":5051,"./format_seconds.js":3527,"./format_thousands.js":2677,"./http_delete.js":4206,"./http_get_blob.js":4131,"./http_get_buffer.js":706,"./http_get_json.js":3066,"./http_get_utf8.js":3019,"./http_head.js":7379,"./http_patch_json.js":2552,"./http_post_json.js":7484,"./http_post_multipart.js":5420,"./http_put_buffer.js":4605,"./http_put_json.js":6357,"./http_put_utf8.js":2380,"./identity.js":956,"./ignore.js":1828,"./plural.js":792,"./random_int.js":131,"./urlmod.js":7233,"./waitcb.js":6966};function o(t){const e=s(t);return n(e)}function s(t){if(!n.o(r,t)){const e=new Error("Cannot find module '"+t+"'");throw e.code="MODULE_NOT_FOUND",e}return r[t]}o.keys=function(){return Object.keys(r)},o.resolve=s,t.exports=o,o.id=7072},8241(t){"use strict";t.exports=FormData},2468(t){"use strict";t.exports=Promise},3719(t){"use strict";t.exports=axios}};const e={};function n(r){const o=e[r];if(void 0!==o)return o.exports;const s=e[r]={exports:{}};return t[r](s,s.exports,n),s.exports}n.o=(t,e)=>Object.prototype.hasOwnProperty.call(t,e);const r=new URL(document.currentScript.src).searchParams.get("var")??"h";if(void 0!==window[r])console.log(`❌ @vbarbarosh/node-helpers@3.78.0 was not injected — window.${r} is already in use`);else{console.log(`🎉 @vbarbarosh/node-helpers@3.78.0 successfully exposed as window.${r}`),window[r]={};const t=n(7072);t.keys().forEach(function(e){const[,n]=e.match(/([^/]+)\.js$/);window[r][n]=t(e)})}})();
+(()=>{var t={932(t){t.exports=function(t){return"number"==typeof t&&isFinite(t)}},5392(t,e,n){const r=n(932);t.exports=function(t,e){return r(t)&&t>e}},4106(t,e){function n(t,e){var n=[],r=[];return null==e&&(e=function(t,e){return n[0]===e?"[Circular ~]":"[Circular ~."+r.slice(0,n.indexOf(e)).join(".")+"]"}),function(o,s){if(n.length>0){var u=n.indexOf(this);~u?n.splice(u+1):n.push(this),~u?r.splice(u,1/0,o):r.push(o),~n.indexOf(s)&&(s=e.call(this,o,s))}else n.push(s);return null==t?s:t.call(this,o,s)}}(t.exports=function(t,e,r,o){return JSON.stringify(t,n(e,o),r)}).getSerialize=n},6083(t){t.exports=function(t=[],e=1){if(e<1)throw new Error("Limit value should be at least 1");const n=[];for(let r=0,o=t.length;r<o;r+=e)n.push(t.slice(r,r+e));return n}},2458(t,e,n){const r=n(7727);t.exports=function(t=[],e=1,n=1){const o=r(1,e,Math.floor(t.length/n)),s=Math.floor(t.length/o);let u=t.length%o;const c=[];for(let e=0;e<t.length;){const n=s+(u?1:0);c.push(t.slice(e,e+n)),e+=n,u&&u--}return c}},353(t,e,n){const r=n(4476),o=1e-5;t.exports=function(t,e){const n=Math.floor(t*e);if(n<=1)return[0];const s=[];for(let e=0;e<n;++e)s.push(r(e/(n-1)*(t-o),o));return s}},6372(t,e,n){const r=n(6785);t.exports=function(t,e=Number){return t.map(t=>e(t)).reduce((t,e)=>r(t,e),0)}},3537(t){t.exports=function(t,e){const n=new Map;return t.forEach(function(t){const r=e(t);n.has(r)||n.set(r,{key:r,items:[]}),n.get(r).items.push(t)}),n.values().toArray()}},2976(t){t.exports=function(t,e){const n={};return t.forEach(function(t){const r=e(t);n[r]=n[r]||{key:r,items:[]},n[r].items.push(t)}),n}},2166(t,e,n){const r=n(956);t.exports=function(t,e=r){const n={};return t.forEach(t=>n[e(t)]=t),n}},7866(t,e,n){const r=n(7347);t.exports=function(t,e=Number){return t.map(t=>e(t)).reduce((t,e)=>r(t,e),1)}},6772(t,e,n){const r=n(956);t.exports=function(t,e=r){let n=null,o=null,s=!1;return t.forEach(function(t){const r=e(t);Number.isNaN(r)||(!s||o<r)&&(s=!0,o=r,n=t)}),n}},42(t,e,n){const r=n(956);t.exports=function(t,e=r){let n=null,o=null,s=!1;return t.forEach(function(t){const r=e(t);Number.isNaN(r)||(!s||o>r)&&(s=!0,o=r,n=t)}),n}},3685(t){t.exports=function t(e,n=e.length){if(n!==e.length)return function(e,n){if(0===n)return[[]];if(e.length<n)return[];const r=[];for(let o=0;o<e.length;o++){const s=e.slice(0,o).concat(e.slice(o+1));for(const u of t(s,n-1))r.push([e[o],...u])}return r}(e,n);let r,o,s=(e=e.slice()).length,u=[e.slice()],c=new Array(s).fill(0),a=1;for(;a<s;)c[a]<a?(r=a%2&&c[a],o=e[a],e[a]=e[r],e[r]=o,++c[a],a=1,u.push(e.slice())):(c[a]=0,++a);return u}},4943(t){t.exports=function(t){for(let e=t.length;--e>0;){const n=Math.floor(Math.random()*(e+1)),r=t[e];t[e]=t[n],t[n]=r}return t}},2356(t,e,n){const r=n(8310),o=n(4332);t.exports=function(t,e,n=r){const s=new Map;return t.sort(function(t,r){if(!s.has(t)){const n=e(t);s.set(t,Array.isArray(n)?n:[n])}if(!s.has(r)){const t=e(r);s.set(r,Array.isArray(t)?t:[t])}return o(s.get(t),s.get(r),n)})}},5181(t,e,n){const r=n(8310);t.exports=function(t,e,n,o=r){const s=Object.create(null);return n.forEach((t,e)=>s[t]=e+1),t.sort(function(t,n){const r=s[e(t)],u=s[e(n)];return r&&u?r-u:r?-1:u?1:o(t,n)})}},453(t){t.exports=function(t,e=Number){let n=0;return t.forEach(function(t){n+=e(t)}),n}},3523(t,e,n){const r=n(956);t.exports=function(t,e=r){const n=new Set;return t.filter(function(t){const r=e(t);return!n.has(r)&&(n.add(r),!0)})}},6382(t,e,n){const r=n(956);t.exports=function(t,e=r){const n=[],o=new Set;for(let r=t.length;--r>=0;){const s=t[r],u=e(s);o.has(u)||(o.add(u),n.push(s))}return n.reverse()}},7727(t){t.exports=function(t,e,n){return Math.max(t,Math.min(e,n))}},9870(t){t.exports=function(t,e){return t.setHours(t.getHours()+e),t}},5799(t){t.exports=function(t,e){return t.setMilliseconds(t.getMilliseconds()+e),t}},3160(t){t.exports=function(t,e){return t.setMinutes(t.getMinutes()+e),t}},1570(t){t.exports=function(t,e){if(!e)return t;const n=t.getDate();return t.setMonth(t.getMonth()+e),t.getDate()!==n&&t.setDate(0),t}},9296(t){t.exports=function(t,e){return t.setSeconds(t.getSeconds()+e),t}},5488(t){t.exports=function(t,e){return Math.floor((t.getTime()-e.getTime())/1e3)}},3752(t){t.exports=function(t){const e=t.getFullYear();return e%4==0&&e%100!=0||e%400==0}},3150(t){t.exports=function(t){return t=Math.trunc(Math.abs(t)),[Math.floor(t/36e5),Math.floor(t%36e5/6e4),Math.floor(t%6e4/1e3),t%1e3]}},2806(t){t.exports=function(t,e){return t.getTime()-e.getTime()}},8310(t,e,n){const r=n(7668);t.exports=function(t,e){return"string"==typeof t&&"string"==typeof e?r(t,e):t<e?-1:t>e?1:0}},2092(t,e,n){const r=n(8310);t.exports=function(t,e){return r(e,t)}},3553(t){function e(t){return"-"===t[0]?(t=t.slice(1),function(e,r){return n(r[t],e[t])}):function(e,r){return n(e[t],r[t])}}function n(t,e){return"string"==typeof t&&"string"==typeof e?t.localeCompare(e):t-e}t.exports=function(t){const n=t.map(e);switch(n.length){case 0:return()=>0;case 1:return n[0];case 2:return function(t,e){return n[0](t,e)||n[1](t,e)};case 3:return function(t,e){return n[0](t,e)||n[1](t,e)||n[2](t,e)};default:return function(t,e){for(let r=0;r<n.length;++r){const o=n[r](t,e);if(o)return o}return 0}}}},3129(t){t.exports=function(t,e){return t-e}},4332(t,e,n){const r=n(8310);t.exports=function(t,e,n=r){const o=Math.min(t.length,e.length);for(let r=0;r<o;++r){const o=n(t[r],e[r]);if(o)return o}return 0}},3106(t){t.exports=function(t,e){return t<e?-1:t>e?1:0}},2271(t){t.exports=function(t,e){return t.localeCompare(e,void 0,{sensitivity:"base"})}},4457(t){t.exports=function(t,e){return t.localeCompare(e,void 0,{sensitivity:"variant"})}},7668(t){function e(t,e){const r=t.replace(/^0+/,""),o=e.replace(/^0+/,"");return r.length-o.length||n(r,o)||t.length-e.length}function n(t,e){return t<e?-1:t>e?1:0}t.exports=function(t,r){const o=t.match(/\d+|\D+/g)||[],s=r.match(/\d+|\D+/g)||[],u=Math.min(o.length,s.length);for(let t=0;t<u;++t){const r=o[t][0]<="9"&&s[t][0]<="9"&&o[t][0]>="0"&&s[t][0]>="0"?e(o[t],s[t]):n(o[t],s[t]);if(r)return r}return o.length-s.length}},4385(t){t.exports=function(t,e){return t.localeCompare(e,void 0,{numeric:!0,sensitivity:"base"})}},8951(t){t.exports=function(t,e){return t.localeCompare(e,void 0,{numeric:!0,sensitivity:"variant"})}},4734(t,e,n){const r=n(8310),o=n(2092),s=n(956),u=Symbol("fcmpx.missing");function c(t){const{read:e,fcmp:n}=a(t);return function(t,r){return n(e(t),e(r))}}function a(t){if("function"==typeof t)return{read:i(t),fcmp:f(r)};if("string"==typeof t){const e=t.startsWith("-");return{read:i(e?t.slice(1):t),fcmp:f(e?o:r)}}const e=t.fcmp,n=i(t.read),s=f(t.desc?e?(t,n)=>e(n,t):o:e??r);if(Array.isArray(t.top)){const e=new Map(t.top.map((t,e)=>[t,e]));return{read:t=>e.get(n(t))??e.size,fcmp:s}}if(Array.isArray(t.bottom)){const e=new Map(t.bottom.map((t,e)=>[t,e]));return{read:t=>e.get(n(t))??-1,fcmp:s}}return{read:n,fcmp:s}}function i(t){if(void 0===t||""===t||"."===t)return s;if("function"==typeof t)return function(e){return t(e)??u};if("string"==typeof t){const e=t.split("."),[n,r,o,s,c]=e;switch(e.length){case 1:return t=>t?.[n]??u;case 2:return t=>t?.[n]?.[r]??u;case 3:return t=>t?.[n]?.[r]?.[o]??u;case 4:return t=>t?.[n]?.[r]?.[o]?.[s]??u;case 5:return t=>t?.[n]?.[r]?.[o]?.[s]?.[c]??u;default:return t=>e.reduce((t,e)=>t?.[e],t)??u}}return e=>e?.[t]??u}function f(t){return function(e,n){return e===u?n===u?0:1:n===u?-1:t(e,n)}}t.exports=function t(e){if("string"==typeof e)return e.includes(",")?t(e.split(",")):c(e);if(!Array.isArray(e))return c(e);const n=e.map(a);return function(t,e){const r=n.map(e=>e.read(t)),o=n.map(t=>t.read(e));for(let t=0;t<n.length;++t){const e=n[t].fcmp(r[t],o[t]);if(e)return e}return 0}}},7960(t){function e(t){let e,n,r;return e=t.replaceAll("^",""),n=e.length!==t.length,e=(t=e).replaceAll("$",""),r=e.length!==t.length,e=(t=e).replaceAll("!",""),(t.length-e.length)%2?n&&r?t=>!(t.startsWith(e)&&t.endsWith(e)):n?t=>!t.startsWith(e):r?t=>!t.endsWith(e):t=>!t.includes(e):n&&r?t=>t.startsWith(e)&&t.endsWith(e):n?t=>t.startsWith(e):r?t=>t.endsWith(e):t=>t.includes(e)}t.exports=function(t){let n,r,o,s;const u=function(t){return t.split("/").filter(t=>t).map(e)}(t);switch(u.length){case 0:return()=>!0;case 1:return u[0];case 2:return[n,r]=u,t=>n(t)&&r(t);case 3:return[n,r,o]=u,t=>n(t)&&r(t)&&o(t);case 4:return[n,r,o,s]=u,t=>n(t)&&r(t)&&o(t)&&s(t);default:return t=>u.every(e=>e(t))}}},6017(t){t.exports=function(t){if("number"!=typeof t||Number.isNaN(t))return"n/a";if(!t)return"0KB";if(t<1024)return"1KB";const e=Math.floor(Math.log(t)/Math.log(1024));return`${(t/1024**e).toFixed(t>1048576?2:0)}${["B","KB","MB","GB","TB","PB"][e]}`.replace(/\.00/,".0")}},1284(t){t.exports=function(t){return t.getFullYear()+`/0${t.getMonth()+1}/0${t.getDate()} 0${t.getHours()}:0${t.getMinutes()}:0${t.getSeconds()}`.replace(/0(\d\d)/g,"$1")}},5224(t){function e(t){return t>9?`${t}`:`0${t}`}t.exports=function(t){return t.getFullYear()+e(t.getMonth()+1)+e(t.getDate())+"_"+(e(t.getHours())+e(t.getMinutes())+e(t.getSeconds()))}},1690(t){function e(t){return t>9?`${t}`:`0${t}`}t.exports=function(t){return t.getFullYear()+"/"+e(t.getMonth()+1)+"/"+e(t.getDate())+" "+e(t.getHours())+":"+e(t.getMinutes())+":"+e(t.getSeconds())}},6997(t){t.exports=function(t){return t.getFullYear()+`/0${t.getMonth()+1}/0${t.getDate()}`.replace(/0(\d\d)/g,"$1")}},9009(t,e,n){const r=n(3332),o="***",s=new Set(["api-key","authorization","cookie","proxy-authorization","set-cookie","x-api-key","x-auth-token"]),u=new Set(["accesstoken","apikey","auth","authorization","key","pass","passwd","password","pwd","secret","sig","signature","token"]);function c(t){if(!t||"object"!=typeof t)return t;if("function"==typeof t.toJSON&&(t=t.toJSON()),Array.isArray(t))return t.map(c);const e={};return Object.entries(t).forEach(function([t,n]){s.has(String(t).toLowerCase())?e[t]=o:e[t]=c(n)}),e}function a(t){return null==t?t:String(t).replace(/^([a-z][a-z0-9+.-]*:\/\/)[^/?#@]*@/i,`$1${o}@`).replace(/([?&])([^=&#]*)=[^&#]*/g,function(t,e,n){return function(t){try{t=decodeURIComponent(t)}catch{}return!!u.has(t.toLowerCase().replace(/[^a-z0-9]/g,""))||t.replace(/([a-z0-9])([A-Z])/g,"$1_$2").toLowerCase().split(/[^a-z0-9]+/).some(t=>u.has(t))}(n)?`${e}${n}=${o}`:t})}t.exports=function(t){return t?t.response?.status&&t.response?.statusText&&t.response?.config?function(t){return`\n${t.message??"n/a"}\n\n--- REQUEST ---\n\n${(t.response.config.method||"").toUpperCase()} ${a(t.response.config.url)}\n\n${JSON.stringify(c(t.response.config.headers||{}),null,4).slice(1,-1).replace(/^\s+|,$/gm,"").trim()}\n\n--- RESPONSE ---\n\n${t.response.status} ${t.response.statusText}\n\n${String(t.response.data??"").slice(0,10240)||"n/a"}\n\n--- STACK ---\n\n${t.stack??"n/a"}\n`.trimStart()}(t):t.config?function(t){return`\n${t.message??"n/a"}\n\n--- REQUEST ---\n\n${(t.config.method||"").toUpperCase()} ${a(t.config.url)}\n\n${JSON.stringify(c(t.config.headers||{}),null,4).slice(1,-1).replace(/^\s+|,$/gm,"").trim()}\n\n--- STACK ---\n\n${t.stack??"n/a"}\n`.trimStart()}(t):r({code:t.code,name:t.name,message:t.message??"n/a",stack:t.stack&&t.stack.split(/\n\s*/)},null,4):r({error:void 0===t?"---undefined---":t})}},6015(t){t.exports=function(t,e=6){const[n,r]=t;return(n+r/1e9).toFixed(e)+"s"}},4153(t){t.exports=function(t){if("number"!=typeof t||Number.isNaN(t))return"n/a";if(!t)return"0";if(t<1e3)return t.toFixed(0);const e=parseInt(Math.floor(Math.log(t)/Math.log(1e3)),10);return`${(t/1e3**e).toFixed(2)}${["","K","M","G","T","P"][e]}`}},1120(t,e,n){const r=n(3150);t.exports=function(t){t||(t=0);const e=t<0?"-":"",[n,o,s]=r(t);return n?e+`0${n}:0${o}:0${s}`.replace(/0+(?=\d\d)/g,""):e+`0${o}:0${s}`.replace(/0+(?=\d\d)/g,"")}},7336(t,e,n){const r=n(3150);t.exports=function(t){t||(t=0);const e=t<0?"-":"",[n,o,s,u]=r(10*Math.round(Math.abs(t)/10));return n?e+`0${n}:0${o}:0${s}.0${u/10}`.replace(/0+(?=\d\d)/g,""):e+`0${o}:0${s}.0${u/10}`.replace(/0+(?=\d\d)/g,"")}},495(t,e,n){const r=n(3150);t.exports=function(t,e=!1){t||(t=0);const n=t<0?"-":"",[o,s,u,c]=r(t);return o||e?n+`0${o}:0${s}:0${u}.00${c}`.replace(/0+(?=\d\d+[:.]|\d\d\d)/g,""):n+`0${s}:0${u}.00${c}`.replace(/0+(?=\d\d+[:.]|\d\d\d)/g,"")}},7882(t){t.exports=function(t){return(100*t).toFixed(2).replace(/^(0|100).00$/,"$1")+"%"}},7111(t,e,n){const r=n(6017),o=n(7882),s=n(3527),u=n(5392);t.exports=function({percents:t,total:e,done:n,rate:c,eta:a,duration:i}){const f=u(c,0)?`${r(c)}/s`:"~";if(n>e)return`${r(n)} at ${f} duration=${s(i)}`;if(u(e,0)){const c=u(a,0)?s(a):"~";return`${o(t)} | ${r(n)} of ${r(e)} at ${f} ETA ${c} duration=${s(i)}`}return u(n,0)?`${r(n)} of ~ at ${f} duration=${s(i)}`:u(i,0)?`~ duration=${s(i)}`:"~"}},5051(t,e,n){const r=n(4153),o=n(7882),s=n(3527),u=n(5392);t.exports=function({percents:t,total:e,done:n,rate:c,eta:a,duration:i}){const f=u(c,0)?`${r(c)}/s`:"~";if(n>e)return`${r(n)} at ${f} duration=${s(i)}`;if(u(e,0)){const c=u(a,0)?s(a):"~";return`${o(t)} | ${r(n)} of ${r(e)} at ${f} ETA ${c} duration=${s(i)}`}return u(n,0)?`${r(n)} of ~ at ${f} duration=${s(i)}`:u(i,0)?`~ duration=${s(i)}`:"~"}},3527(t){t.exports=function(t){const e=Math.abs(Math.trunc(t)),n=`0${Math.floor(e/60/60)}:0${Math.floor(e/60)%60}:0${e%60}`.replace(/0(\d\d)/g,"$1");return t<=-1?"-"+n:n}},2677(t){t.exports=function(t){return t.toString().replace(/\B(?<!\.\d*)(?=(\d{3})+(?!\d))/g,",")}},4206(t,e,n){const r=n(3719);t.exports=function(t,e){return r.delete(t,{responseType:"json",...e}).then(t=>t.data)}},4131(t,e,n){const r=n(3719);t.exports=function(t,e){return r.get(t,{responseType:"blob",...e}).then(t=>t.data)}},706(t,e,n){const r=n(3719);t.exports=function(t,e){return r.get(t,{responseType:"arraybuffer",...e}).then(t=>t.data)}},3066(t,e,n){const r=n(3719);t.exports=function(t,e){return r.get(t,{responseType:"json",...e}).then(t=>t.data)}},3019(t,e,n){const r=n(3719);t.exports=function(t,e){return r.get(t,{responseType:"text",responseEncoding:"utf8",...e}).then(t=>t.data)}},7379(t,e,n){const r=n(3719);t.exports=function(t,e){return r.head(t,e).then(t=>t.request.res.headers)}},2552(t,e,n){const r=n(3719);t.exports=function(t,e,n){return r.patch(t,e,n).then(t=>t.data)}},7484(t,e,n){const r=n(3719);t.exports=function(t,e,n){return r.post(t,e,n).then(t=>t.data)}},5420(t,e,n){const r=n(8241),o=n(3719);t.exports=function(t,e,n){const s=new r;for(let t=0,n=e.length;t<n;++t){const n=e[t];n.options?s.append(n.name,n.body,n.options):s.append(n.name,n.body)}if(s.getHeaders){const e={...n};return e.headers={...e.headers,...s.getHeaders()},Promise.resolve(o.post(t,s,e)).then(t=>t.data)}return Promise.resolve(o.post(t,s,n)).then(t=>t.data)}},4605(t,e,n){const r=n(3719);t.exports=function(t,e,n){return r.put(t,e,n).then(t=>t.data)}},6357(t,e,n){const r=n(3719);t.exports=function(t,e,n){return r.put(t,e,n).then(t=>t.data)}},2380(t,e,n){const r=n(3719);t.exports=async function(t,e,n){return r.put(t,e,n).then(t=>t.data)}},956(t){t.exports=function(t){return t}},1828(t){t.exports=function(){}},3332(t,e,n){const r=n(4106);t.exports=r},6785(t){t.exports=function t(e,n){return n?t(n,e%n):Math.abs(e)}},7347(t,e,n){const r=n(6785);t.exports=function(t,e){return Math.abs(t*e)/r(t,e)}},792(t){t.exports=function(t,e,n,r){return 0===t&&"string"==typeof r?r:1===t?e.split("#").join(t):n.split("#").join(t)}},6718(t){t.exports=function(t,e,n,r,o){return 0===t&&"string"==typeof o?o:function(t,e,n,r){if(!Number.isInteger(t))return n;const o=Math.abs(t)%10,s=Math.abs(t)%100;return 1===o&&11!==s?e:o>=2&&o<=4&&(s<12||s>14)?n:r}(t,e,n,r).split("#").join(t)}},131(t){t.exports=function(t,e){return Math.floor(Math.random()*(e-t+1)+t)}},4476(t){t.exports=function(t,e=1){if(0===e)return t;const n=1/e,r=Math.sign(t),o=function(t){if(Math.floor(t)===t)return 0;const[e,n]=t.toExponential().split("e"),r=(e.split(".")[1]||"").length;return Math.max(0,r-parseInt(n,10))}(e),s=1e-12*r,u=Math.round(t*n+s)/n;return Number(u.toFixed(o))}},7233(t){t.exports=function(t,e){const n=String(t||""),r=Object.entries(e||{});if(!r.length)return n;const o=n.indexOf("#"),s=-1===o?"":n.slice(o),u=-1===o?n:n.slice(0,o),c=u.indexOf("?"),a=-1===c?u:u.slice(0,c),i=-1===c?"":u.slice(c+1),f=new URLSearchParams(i);r.forEach(function([t,e]){switch(e){case null:case void 0:f.delete(t);break;case!0:f.set(t,"1");break;case!1:f.set(t,"0");break;default:f.set(t,String(e))}});const p=f.toString();return a+(p?`?${p}`:"")+s}},6966(t,e,n){const r=n(2468);t.exports=function(t){return new r(function(e,n){t(function(t,r){t?n(t):e(r)})})}},9258(t,e,n){const r={"./array_chunk.js":6083,"./array_chunk_balanced.js":2458,"./array_fps.js":353,"./array_gcd.js":6372,"./array_group.js":3537,"./array_group_map.js":2976,"./array_index.js":2166,"./array_lcm.js":7866,"./array_max.js":6772,"./array_min.js":42,"./array_permutations.js":3685,"./array_shuffle.js":4943,"./array_sort.js":2356,"./array_sort_other.js":5181,"./array_sum.js":453,"./array_unique.js":3523,"./array_unique_last.js":6382,"./date_add_hours.js":9870,"./date_add_milliseconds.js":5799,"./date_add_minutes.js":3160,"./date_add_months.js":1570,"./date_add_seconds.js":9296,"./date_diff_seconds.js":5488,"./date_is_leap_year.js":3752,"./fcmp_dates.js":2806,"./fcmp_default.js":8310,"./fcmp_default_desc.js":2092,"./fcmp_from_spec.js":3553,"./fcmp_numbers.js":3129,"./fcmp_tuples.js":4332,"./fcmp_utf8_bin.js":3106,"./fcmp_utf8_ci.js":2271,"./fcmp_utf8_cs.js":4457,"./fcmp_utf8_natural_bin.js":7668,"./fcmp_utf8_natural_ci.js":4385,"./fcmp_utf8_natural_cs.js":8951,"./fcmpx.js":4734,"./filter1_from_spec.js":7960,"./format_bytes.js":6017,"./format_date.js":1284,"./format_date_fs.js":5224,"./format_date_human.js":1690,"./format_date_ymd.js":6997,"./format_error_report.js":9009,"./format_hrtime.js":6015,"./format_kilo.js":4153,"./format_ms.js":1120,"./format_ms2.js":7336,"./format_ms3.js":495,"./format_percents.js":7882,"./format_progress_bytes.js":7111,"./format_progress_kilo.js":5051,"./format_seconds.js":3527,"./format_thousands.js":2677,"./http_delete.js":4206,"./http_get_blob.js":4131,"./http_get_buffer.js":706,"./http_get_json.js":3066,"./http_get_utf8.js":3019,"./http_head.js":7379,"./http_patch_json.js":2552,"./http_post_json.js":7484,"./http_post_multipart.js":5420,"./http_put_buffer.js":4605,"./http_put_json.js":6357,"./http_put_utf8.js":2380,"./identity.js":956,"./ignore.js":1828,"./plural.js":792,"./plural_ru.js":6718,"./random_int.js":131,"./urlmod.js":7233,"./waitcb.js":6966};function o(t){const e=s(t);return n(e)}function s(t){if(!n.o(r,t)){const e=new Error("Cannot find module '"+t+"'");throw e.code="MODULE_NOT_FOUND",e}return r[t]}o.keys=function(){return Object.keys(r)},o.resolve=s,t.exports=o,o.id=9258},8241(t){"use strict";t.exports=FormData},2468(t){"use strict";t.exports=Promise},3719(t){"use strict";t.exports=axios}};const e={};function n(r){const o=e[r];if(void 0!==o)return o.exports;const s=e[r]={exports:{}};return t[r](s,s.exports,n),s.exports}n.o=(t,e)=>Object.prototype.hasOwnProperty.call(t,e);const r=new URL(document.currentScript.src).searchParams.get("var")??"h";if(void 0!==window[r])console.log(`❌ @vbarbarosh/node-helpers@3.79.0 was not injected — window.${r} is already in use`);else{console.log(`🎉 @vbarbarosh/node-helpers@3.79.0 successfully exposed as window.${r}`),window[r]={};const t=n(9258);t.keys().forEach(function(e){const[,n]=e.match(/([^/]+)\.js$/);window[r][n]=t(e)})}})();

package/dist/index.html

@@ -1,19 +1,11 @@
-<!DOCTYPE html>
-<html lang="en">
-<head>
-    <meta charset="utf-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
-    <link href="https://unpkg.com/@vbarbarosh/smcss@1.2.0/dist/reset.css" rel="stylesheet">
-    <link href="https://unpkg.com/@vbarbarosh/smcss@1.2.0/dist/sm.css" rel="stylesheet">
-    <title>@vbarbarsh/node-helpers</title>
-</head>
-<body>
+<!doctype html><html lang=en><head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1,shrink-to-fit=no"><link href=https://unpkg.com/@vbarbarosh/smcss@1.2.0/dist/reset.css rel=stylesheet><link href=https://unpkg.com/@vbarbarosh/smcss@1.2.0/dist/sm.css rel=stylesheet><title>@vbarbarsh/node-helpers</title></head><body>
 
-<div id="app"></div>
+<div id=app></div>
 
-<script src="https://unpkg.com/axios@1.18.1/dist/axios.js"></script>
-<script src="https://unpkg.com/bluebird@3.7.2/js/browser/bluebird.js"></script>
-<script src="browser.js"></script>
+<script src=https://unpkg.com/axios@1.20.0/dist/axios.js></script>
+<script src=https://unpkg.com/bluebird@3.7.2/js/browser/bluebird.js></script>
+<script src=browser.js></script>
 
-</body>
-</html>
+
+
+</body></html>

package/package.json

@@ -2,7 +2,7 @@
     "author": "Vladimir Barbarosh <vladimir.barbarosh@gmail.com>",
     "license": "MIT",
     "name": "@vbarbarosh/node-helpers",
-    "version": "3.78.0",
+    "version": "3.79.0",
     "description": "A set of helpers for JavaScript/Node.js",
     "unpkg": "dist/browser.js",
     "jsdelivr": "dist/browser.js",
@@ -46,8 +46,8 @@
     },
     "dependencies": {
         "@paralleldrive/cuid2": "^3.3.0",
-        "@vbarbarosh/type-helpers": "^0.2.0",
-        "axios": "1.18.1",
+        "@vbarbarosh/type-helpers": "^0.4.0",
+        "axios": "1.20.0",
         "bluebird": "^3.7.2",
         "csv-parse": "^7.0.1",
         "form-data": "^4.0.1",
@@ -65,12 +65,12 @@
     "devDependencies": {
         "@eslint/js": "^10.0.1",
         "@vbarbarosh/tree": "^0.5.0",
-        "c8": "^11.0.0",
+        "c8": "^12.0.0",
         "copy-webpack-plugin": "^14.0.0",
         "eslint": "^10.7.0",
         "express": "^5.2.1",
         "globals": "^17.7.0",
-        "mocha": "^11.0.1",
+        "mocha": "^12.0.3",
         "redis-v1": "npm:redis@1",
         "redis-v2": "npm:redis@2",
         "redis-v3": "npm:redis@3",

package/src/crypto_decrypt_aes256.js

@@ -1,16 +1,52 @@
 const crypto = require('crypto');
 
+const VERSION = 1;
+const SALT_LENGTH = 16;
+const NONCE_LENGTH = 12;
+const TAG_LENGTH = 16;
+const HEADER_LENGTH = 1 + SALT_LENGTH + NONCE_LENGTH;
+
 /**
- * @link https://nodejs.org/api/crypto.html#crypto_class_cipher
- * @link https://attacomsian.com/blog/nodejs-encrypt-decrypt-data
+ * Decrypts an envelope produced by crypto_encrypt_aes256. Throws when the
+ * envelope is malformed, the password is wrong, or the data was tampered
+ * with.
+ *
+ * @link https://nodejs.org/api/crypto.html#class-decipher
  */
 function crypto_decrypt_aes256(password, ivenc)
 {
-    const key = crypto.createHash('sha256').update(password).digest();
-    const iv = ivenc.slice(1, ivenc[0] + 1);
-    const enc = ivenc.slice(ivenc[0] + 1);
-    const decipher = crypto.createDecipheriv('aes-256-ctr', key, iv);
-    return Buffer.concat([decipher.update(enc), decipher.final()]);
+    if (!(ivenc instanceof Uint8Array)) {
+        throw new Error('crypto_decrypt_aes256: envelope should be a Buffer');
+    }
+    if (!Buffer.isBuffer(ivenc)) {
+        ivenc = Buffer.from(ivenc.buffer, ivenc.byteOffset, ivenc.byteLength);
+    }
+    if (ivenc[0] !== VERSION) {
+        throw new Error('crypto_decrypt_aes256: malformed envelope');
+    }
+    return decrypt_v1(password, ivenc);
+}
+
+function decrypt_v1(password, ivenc)
+{
+    if (ivenc.length < HEADER_LENGTH + TAG_LENGTH) {
+        throw new Error('crypto_decrypt_aes256: malformed envelope');
+    }
+    const header = ivenc.subarray(0, HEADER_LENGTH);
+    const salt = ivenc.subarray(1, 1 + SALT_LENGTH);
+    const nonce = ivenc.subarray(1 + SALT_LENGTH, HEADER_LENGTH);
+    const tag = ivenc.subarray(HEADER_LENGTH, HEADER_LENGTH + TAG_LENGTH);
+    const enc = ivenc.subarray(HEADER_LENGTH + TAG_LENGTH);
+    const key = crypto.scryptSync(password, salt, 32);
+    const decipher = crypto.createDecipheriv('aes-256-gcm', key, nonce);
+    decipher.setAAD(header);
+    decipher.setAuthTag(tag);
+    try {
+        return Buffer.concat([decipher.update(enc), decipher.final()]);
+    }
+    catch (error) {
+        throw new Error('crypto_decrypt_aes256: authentication failed (wrong password or tampered data)', {cause: error});
+    }
 }
 
 module.exports = crypto_decrypt_aes256;

package/src/crypto_decrypt_aes256.md

@@ -1,13 +1,18 @@
-Decrypts a `Buffer` produced by `crypto_encrypt_aes256` (`aes-256-ctr`, key =
-`sha256(password)`, layout `[iv_length, iv, ciphertext]`). Returns the
-plaintext as a `Buffer` — call `.toString('utf8')` for text.
+Decrypts a `Buffer` envelope produced by `crypto_encrypt_aes256` and returns
+the plaintext as a `Buffer` — call `.toString('utf8')` for text.
+
+The version 1 envelope is
+`[0x01][16-byte salt][12-byte nonce][16-byte GCM tag][ciphertext]`
+(`aes-256-gcm`, key = `crypto.scryptSync(password, salt, 32)`, header
+authenticated as additional data). Decryption **throws** when:
+
+- the password is wrong or the envelope was modified in any byte
+  (`authentication failed (wrong password or tampered data)`);
+- the envelope is malformed: not a `Buffer`/`Uint8Array`, too short, or an
+  unknown version byte (`malformed envelope`).
 
 ```js
-const ivenc = crypto_encrypt_aes256('pass123', 'hello');
-crypto_decrypt_aes256('pass123', ivenc).toString('utf8');   // 'hello'
-crypto_decrypt_aes256('wrong', ivenc).toString('utf8');     // garbage, no error
+const envelope = crypto_encrypt_aes256('pass123', 'hello');
+crypto_decrypt_aes256('pass123', envelope).toString('utf8');   // 'hello'
+crypto_decrypt_aes256('wrong', envelope);                      // throws
 ```
-
-**No integrity check:** CTR mode does not authenticate — a wrong password or
-tampered ciphertext yields garbage bytes, never an error, so verify the result
-yourself if you need to detect bad input.

package/src/crypto_encrypt_aes256.js

@@ -1,18 +1,32 @@
 const crypto = require('crypto');
 
+const VERSION = 1;
+const SALT_LENGTH = 16;
+const NONCE_LENGTH = 12;
+
 /**
- * @link https://nodejs.org/api/crypto.html#crypto_class_cipher
- * @link https://attacomsian.com/blog/nodejs-encrypt-decrypt-data
+ * Authenticated encryption with a password.
+ *
+ * Envelope (version 1):
+ *     [0x01][16-byte salt][12-byte nonce][16-byte GCM tag][ciphertext]
+ *
+ * The key is scrypt(password, salt, 32) and the version/salt/nonce header
+ * is authenticated together with the ciphertext (AES-256-GCM with the
+ * header as additional data), so any modification is detected on decrypt.
+ *
+ * @link https://nodejs.org/api/crypto.html#cryptoscryptsyncpassword-salt-keylen-options
+ * @link https://nodejs.org/api/crypto.html#class-cipher
  */
 function crypto_encrypt_aes256(password, data)
 {
-    const iv = crypto.randomBytes(16);
-    const key = crypto.createHash('sha256').update(password).digest();
-    const cipher = crypto.createCipheriv('aes-256-ctr', key, iv);
-    if (iv.length > 255) {
-        throw new Error('iv size is too big');
-    }
-    return Buffer.concat([Buffer.from([iv.length]), iv, cipher.update(data), cipher.final()]);
+    const salt = crypto.randomBytes(SALT_LENGTH);
+    const nonce = crypto.randomBytes(NONCE_LENGTH);
+    const key = crypto.scryptSync(password, salt, 32);
+    const header = Buffer.concat([Buffer.from([VERSION]), salt, nonce]);
+    const cipher = crypto.createCipheriv('aes-256-gcm', key, nonce);
+    cipher.setAAD(header);
+    const enc = Buffer.concat([cipher.update(data), cipher.final()]);
+    return Buffer.concat([header, cipher.getAuthTag(), enc]);
 }
 
 module.exports = crypto_encrypt_aes256;

package/src/crypto_encrypt_aes256.md

@@ -1,13 +1,23 @@
-Encrypts data with `aes-256-ctr`. The key is `sha256(password)`, the IV is a
-fresh random 16 bytes on every call, so encrypting the same input twice gives
-different output. Returns a `Buffer` laid out as `[iv_length, iv, ciphertext]`
-(1 + 16 + data-length bytes); pass it as-is to `crypto_decrypt_aes256`.
+Encrypts data with a password using authenticated encryption. Returns a
+`Buffer` envelope; pass it as-is to `crypto_decrypt_aes256`.
 
-```js
-const ivenc = crypto_encrypt_aes256('pass123', 'hello');
-// <Buffer 10 ...> — 22 bytes: 0x10 (iv length), 16-byte iv, 5-byte ciphertext
-crypto_decrypt_aes256('pass123', ivenc).toString('utf8');  // 'hello'
+**Envelope (version 1), 45 bytes + data length:**
+
+```
+[0x01][16-byte salt][12-byte nonce][16-byte GCM tag][ciphertext]
 ```
 
-**No integrity check:** CTR mode does not authenticate — a wrong password or
-tampered data decrypts to garbage, not an error.
+- The key is `crypto.scryptSync(password, salt, 32)` with a fresh random salt
+  per call, so guessing passwords offline is expensive and the same password
+  never yields the same key twice.
+- The cipher is `aes-256-gcm` with a fresh random nonce per call; the
+  version/salt/nonce header is authenticated as additional data together with
+  the ciphertext. Any modification of the envelope, or a wrong password, makes
+  `crypto_decrypt_aes256` throw instead of returning garbage.
+- Encrypting the same input twice gives different output.
+
+```js
+const envelope = crypto_encrypt_aes256('pass123', 'hello');
+// <Buffer 01 ...> — 50 bytes: version, 16-byte salt, 12-byte nonce, 16-byte tag, 5-byte ciphertext
+crypto_decrypt_aes256('pass123', envelope).toString('utf8');  // 'hello'
+```

package/src/escape_content_disposition.js

@@ -7,8 +7,14 @@ function escape_content_disposition(s)
     const out = s.replaceAll('\\', '\\\\')
         .replaceAll('"', '\\"')
         .replaceAll('%', '\\%')
-        .replaceAll('\n', '%x0A')
-        .replaceAll('\0', '%x00');
+        // Control characters (\n, \r, \0, \x01..., DEL) are illegal in a
+        // header value; encode every one of them as %xHH.
+        // eslint-disable-next-line no-control-regex
+        .replace(/[\x00-\x1f\x7f]/g, c => '%x' + c.charCodeAt(0).toString(16).toUpperCase().padStart(2, '0'))
+        // A quoted-string may carry ISO-8859-1 only; anything above U+00FF
+        // is replaced with '?' (use escape_content_disposition_utf8 for the RFC 5987 filename*).
+        // eslint-disable-next-line no-control-regex
+        .replace(/[^\x00-\xff]/g, '?');
     // A bare value must be a pure RFC 7230 token: any other character
     // (space, ';', ',', '"', '\', ...) requires the whole value to be a
     // quoted-string — an unquoted 'a\"b' or 'a,b' breaks header parsing.

package/src/escape_content_disposition.md

@@ -1,13 +1,21 @@
 Escapes a value (typically a filename) for use in a `Content-Disposition`
 header. A pure RFC 7230 token (letters, digits, `!#$%&'*+.^_`|~-`) is returned
 as-is; anything else — spaces, `;`, `,`, quotes, etc. — becomes a quoted-string
-with `\` `"` `%` backslash-escaped and `\n`/`\0` encoded as `%x0A`/`%x00`.
-An unquoted `a"b` or `a,b` would break header parsing.
+with `\` `"` `%` backslash-escaped, every control character (`\0`-`\x1f`,
+`\x7f`, so `\n`, `\r`, `\x01`...) encoded as `%xHH`, and any character above
+U+00FF (not representable in ISO-8859-1) replaced with `?`. The result is
+always a valid header value. An unquoted `a"b` or `a,b` would break header
+parsing.
+
+See `escape_content_disposition_utf8` for the RFC 5987 `filename*` form that
+carries a non-ASCII name alongside the `?`-degraded `filename` fallback.
 
 ```js
 escape_content_disposition('report.pdf')  // 'report.pdf'
 escape_content_disposition('foo bar.txt') // '"foo bar.txt"'
 escape_content_disposition('foo"bar')     // '"foo\\"bar"'
 escape_content_disposition('foo\nbar')    // '"foo%x0Abar"'
+escape_content_disposition('foo\rbar')    // '"foo%x0Dbar"'
+escape_content_disposition('файл.txt')    // '"????.txt"'
 escape_content_disposition('')            // '""'
 ```

package/src/escape_content_disposition_utf8.js

@@ -0,0 +1,11 @@
+/**
+ * RFC 5987 ext-value for a `filename*` parameter: `UTF-8''<percent-encoded>`.
+ * Everything outside attr-char is percent-encoded, as jshttp/content-disposition does.
+ */
+function escape_content_disposition_utf8(s)
+{
+    // eslint-disable-next-line no-control-regex
+    return `UTF-8''` + encodeURIComponent(s).replace(/[\x00-\x20"'()*,/:;<=>?@[\\\]{}\x7f]/g, c => '%' + c.charCodeAt(0).toString(16).toUpperCase().padStart(2, '0'));
+}
+
+module.exports = escape_content_disposition_utf8;

package/src/escape_content_disposition_utf8.md

@@ -0,0 +1,11 @@
+Returns the RFC 5987 ext-value `UTF-8''<percent-encoded>` for a
+`Content-Disposition` `filename*` parameter, so a non-ASCII filename can be
+sent alongside the `?`-degraded `filename` fallback produced by
+`escape_content_disposition`. Everything outside RFC 5987 attr-char is
+percent-encoded, as jshttp/content-disposition does.
+
+```js
+escape_content_disposition_utf8('файл.txt')   // "UTF-8''%D1%84%D0%B0%D0%B9%D0%BB.txt"
+escape_content_disposition_utf8('foo bar.txt') // "UTF-8''foo%20bar.txt"
+// Content-Disposition: attachment; filename="????.txt"; filename*=UTF-8''%D1%84%D0%B0%D0%B9%D0%BB.txt
+```

package/src/fastdl.js

@@ -54,6 +54,11 @@ async function download({file, read_stream_with_range, concurrency, user_friendl
     const rs0 = await read_stream_with_range(0, chunk_min_bytes);
 
     const total = rs0.content_range.total;
+    if (!Number.isInteger(total)) {
+        rs0.once('error', ignore);
+        rs0.destroy();
+        throw new UserFriendlyError('Server did not return the resource size (it may have ignored the Range header)');
+    }
     const chunk_size = Math.max(chunk_min_bytes, Math.min(chunk_max_bytes, Math.trunc(total/concurrency)));
     const progress = make_progress(total);
 
@@ -62,7 +67,7 @@ async function download({file, read_stream_with_range, concurrency, user_friendl
     let total_written = 0;
     let rs0_used = false;
 
-    const timer = setInterval(tick, 1000);
+    let timer = null;
     function tick() {
         progress.refresh();
         user_friendly_status(`${format_progress_bytes(progress)} connections=${connections}`);
@@ -71,6 +76,7 @@ async function download({file, read_stream_with_range, concurrency, user_friendl
     user_friendly_status(`${format_bytes(total)} [${format_thousands(total)} bytes] to download`);
 
     try {
+        timer = setInterval(tick, 1000);
         await parallel({concurrency, spawn});
     }
     catch (error) {

package/src/fastdl.md

@@ -8,6 +8,11 @@ flushed, closed, and atomically renamed over `file`. A failed request, exhausted
 retry, size mismatch, or write error removes the temporary file and preserves
 an existing destination.
 
+The first range response must carry an integer `content_range.total`. When the
+server ignores `Range` and answers with an unknown size (for example a chunked
+200), the stream is destroyed and the call rejects with a `UserFriendlyError`
+without leaving a progress timer behind.
+
 ```js
 await fastdl({
     file: fs_path_basename(new URL(url).pathname),

package/src/format_date_fs.js

@@ -1,3 +1,11 @@
+// // 20260916_210411, local time
+// function format_date_fs(date)
+// {
+//     return [date.getFullYear(), date.getMonth() + 1, date.getDate(), '_',
+//             date.getHours(), date.getMinutes(), date.getSeconds()]
+//         .map(v => typeof v === 'string' || v > 9 ? v : `0${v}`).join('');
+// }
+
 function format_date_fs(d)
 {
     const ymd = d.getFullYear() + dd(d.getMonth() + 1) + dd(d.getDate());

package/src/format_error_report.js

@@ -1,5 +1,38 @@
 const json_stringify_safe = require('./json_stringify_safe');
 
+const MASK = '***';
+
+// Header names (lower-cased) whose value is masked in the report
+const SENSITIVE_HEADERS = new Set([
+    'api-key',
+    'authorization',
+    'cookie',
+    'proxy-authorization',
+    'set-cookie',
+    'x-api-key',
+    'x-auth-token',
+]);
+
+// A query parameter is sensitive when any of its name's segments (split on
+// `_`, `-`, `.` and camelCase boundaries, lower-cased) is one of these words,
+// so `api_key`, `apiKey`, `access_token`, `x-auth-token`, `sig` and `key`
+// match while `keyword`, `design`, `author`, `keyboard`, `signal` do not
+const SENSITIVE_QUERY_WORDS = new Set([
+    'accesstoken',
+    'apikey',
+    'auth',
+    'authorization',
+    'key',
+    'pass',
+    'passwd',
+    'password',
+    'pwd',
+    'secret',
+    'sig',
+    'signature',
+    'token',
+]);
+
 function format_error_report(error)
 {
     if (!error) {
@@ -29,9 +62,9 @@ ${error.message ?? 'n/a'}
 
 --- REQUEST ---
 
-${(error.response.config.method||'').toUpperCase()} ${error.response.config.url}
+${(error.response.config.method||'').toUpperCase()} ${mask_url(error.response.config.url)}
 
-${JSON.stringify(error.response.config.headers||{}, null, 4).slice(1, -1).replace(/^\s+|,$/mg, '').trim()}
+${JSON.stringify(mask_headers(error.response.config.headers||{}), null, 4).slice(1, -1).replace(/^\s+|,$/mg, '').trim()}
 
 --- RESPONSE ---
 
@@ -52,9 +85,9 @@ ${error.message ?? 'n/a'}
 
 --- REQUEST ---
 
-${(error.config.method||'').toUpperCase()} ${error.config.url}
+${(error.config.method||'').toUpperCase()} ${mask_url(error.config.url)}
 
-${JSON.stringify(error.config.headers||{}, null, 4).slice(1, -1).replace(/^\s+|,$/mg, '').trim()}
+${JSON.stringify(mask_headers(error.config.headers||{}), null, 4).slice(1, -1).replace(/^\s+|,$/mg, '').trim()}
 
 --- STACK ---
 
@@ -62,4 +95,69 @@ ${error.stack ?? 'n/a'}
 `.trimStart();
 }
 
+/**
+ * Returns a copy of `headers` with sensitive values replaced by [MASK].
+ * Header names are matched case-insensitively. Axios may nest headers per
+ * method (`headers.common`, `headers.get`, ...) and may pass an AxiosHeaders
+ * instance (which serializes via `toJSON`), so nested objects are walked too.
+ */
+function mask_headers(headers)
+{
+    if (!headers || typeof headers !== 'object') {
+        return headers;
+    }
+    if (typeof headers.toJSON === 'function') {
+        headers = headers.toJSON();
+    }
+    if (Array.isArray(headers)) {
+        return headers.map(mask_headers);
+    }
+    const out = {};
+    Object.entries(headers).forEach(function ([key, value]) {
+        if (SENSITIVE_HEADERS.has(String(key).toLowerCase())) {
+            out[key] = MASK;
+        }
+        else {
+            out[key] = mask_headers(value);
+        }
+    });
+    return out;
+}
+
+/**
+ * Replaces URL userinfo (`scheme://user:pass@host`) and the values of query
+ * parameters with a sensitive-looking name by [MASK]. Works on the raw
+ * string so the rest of the URL is reported exactly as it was requested.
+ */
+function mask_url(url)
+{
+    if (url === undefined || url === null) {
+        return url;
+    }
+    return String(url)
+        .replace(/^([a-z][a-z0-9+.-]*:\/\/)[^/?#@]*@/i, `$1${MASK}@`)
+        .replace(/([?&])([^=&#]*)=[^&#]*/g, function (match, sep, name) {
+            return is_sensitive_query_name(name) ? `${sep}${name}=${MASK}` : match;
+        });
+}
+
+function is_sensitive_query_name(name)
+{
+    try {
+        name = decodeURIComponent(name);
+    }
+    catch {
+        // keep the raw name
+    }
+    // whole names such as `apikey`, `accesstoken`, `api-key`
+    if (SENSITIVE_QUERY_WORDS.has(name.toLowerCase().replace(/[^a-z0-9]/g, ''))) {
+        return true;
+    }
+    return name
+        .replace(/([a-z0-9])([A-Z])/g, '$1_$2')
+        .toLowerCase()
+        .split(/[^a-z0-9]+/)
+        .some(segment => SENSITIVE_QUERY_WORDS.has(segment));
+}
+
 module.exports = format_error_report;

package/src/format_error_report.md

@@ -10,3 +10,50 @@ errors get special treatment; everything else becomes indented JSON.
   split into an array of lines (circular-safe via `json_stringify_safe`).
 - Falsy error — `{"error":null}`-style JSON; `undefined` is reported as the
   string `'---undefined---'`.
+
+**Masking:** credentials are replaced by `***` in the REQUEST
+section so the report can be logged or sent to error tracking.
+
+Header values are masked when the name, matched case-insensitively, is one
+of:
+
+- `api-key`
+- `authorization`
+- `cookie`
+- `proxy-authorization`
+- `set-cookie`
+- `x-api-key`
+- `x-auth-token`
+
+Headers nested per method the Axios way (`headers.common`, `headers.get`,
+...) and `AxiosHeaders` instances (via `toJSON`) are handled; the error
+object itself is not modified.
+
+URL userinfo is masked (`https://user:pass@host` becomes
+`https://***@host`), and so is the value of every query parameter with a
+secret-looking name (`?token=abc&page=2` becomes `?token=***&page=2`). A
+name is secret-looking when, split on `_`/`-`/`.` and camelCase boundaries
+and lower-cased, any segment is one of the words below, or when the whole
+name with separators removed is one of them:
+
+- `accesstoken`
+- `apikey`
+- `auth`
+- `authorization`
+- `key`
+- `pass`
+- `passwd`
+- `password`
+- `pwd`
+- `secret`
+- `sig`
+- `signature`
+- `token`
+
+So `api_key`, `apiKey`, `access_token`, `x-auth-token`, `client_secret`,
+`sig` and `key` are masked while `keyword`, `design`, `author`,
+`keyboard`, `signal` and `client_id` are not. The rest of the URL is
+reported verbatim.
+
+The response body is **not** sanitized — only truncated to 10240
+characters — and the request body is never included.

package/src/http_get_stream_range.js

@@ -46,7 +46,11 @@ async function http_get_stream_range(url, first, last, options)
     else if (b !== '') {
         const actual_length = out.content_range.last - out.content_range.first + 1;
         const expected_length = out.content_range.total === null ? Math.min(actual_length, b) : Math.min(out.content_range.total, b);
-        if (actual_length !== expected_length) {
+        if (out.content_range.last === null) {
+            // Chunked 200 with no Content-Range: the server ignored the suffix range
+            out.destroy(new Error(`Server ignored the requested suffix range of ${fmt(b)} bytes and returned a response of unknown length`));
+        }
+        else if (actual_length !== expected_length) {
             out.destroy(new Error(`Length of a returned range (${fmt(actual_length)}) is not as expected: [${fmt(expected_length)}]`));
         }
         else if (out.content_range.total !== null && out.content_range.last !== out.content_range.total - 1) {

package/src/http_get_stream_range.md

@@ -14,7 +14,8 @@ chunked 200 response (neither header) is accepted as
 The returned range is validated according to the requested form. Closed ranges
 accept a `last` clamped to the end of the resource; open-ended ranges must end
 at the resource end when its size is known; suffix ranges validate their
-length and resource end. A server that ignores a range and replies 200 is
+length and resource end, and a chunked 200 (unknown length) in reply to a
+suffix request is rejected. A server that ignores a range and replies 200 is
 rejected.
 
 ```js

package/src/http_stream_range.js

@@ -1,4 +1,5 @@
 const escape_content_disposition = require('./escape_content_disposition');
+const escape_content_disposition_utf8 = require('./escape_content_disposition_utf8');
 const fs_fclose = require('./fs_fclose');
 const fs_fopen = require('./fs_fopen');
 const fs_fread = require('./fs_fread');
@@ -30,7 +31,7 @@ async function http_stream_range(req, res, file)
         res.header('Accept-Ranges', 'bytes');
         res.header('Content-Type', mime);
         res.header('Content-Length', total);
-        res.header('Content-Disposition', `inline; filename=${escape_content_disposition(fs_path_basename(file))};`);
+        res.header('Content-Disposition', content_disposition(fs_path_basename(file)));
         res.status(200);
         res.end();
         return;
@@ -122,4 +123,16 @@ async function http_stream_range(req, res, file)
     }
 }
 
+function content_disposition(name)
+{
+    // The quoted `filename` degrades anything outside ISO-8859-1 to '?', so a
+    // non-ASCII name also gets the RFC 5987 `filename*` that browsers prefer.
+    let out = `inline; filename=${escape_content_disposition(name)}`;
+    // eslint-disable-next-line no-control-regex
+    if (/[^\x00-\x7f]/.test(name)) {
+        out += `; filename*=${escape_content_disposition_utf8(name)}`;
+    }
+    return out + ';';
+}
+
 module.exports = http_stream_range;

package/src/http_stream_range.md

@@ -11,7 +11,9 @@ http_stream_range(req, res, file) → Promise
 
 - `HEAD` → 200 with `Content-Type`, `Content-Length`, and an
   `inline; filename=...` `Content-Disposition` (escaped via
-  `escape_content_disposition`); no body.
+  `escape_content_disposition`, so control characters are encoded and a
+  non-ASCII basename is also sent as an RFC 5987 `filename*=UTF-8''...`
+  parameter); no body.
 - `GET` with `Range` → 206 with `Content-Range: bytes first-last/total` and a
   matching `Content-Length`.
 - `GET` without `Range` → 200 with the whole file.

package/src/make_progress.js

@@ -21,10 +21,16 @@ function make_progress(total)
         progress: null,
         percents: null,
         add: function (delta = 0) {
-            const now_minus_10sec = Date.now() - 10000;
-            history.splice(0, history.findLastIndex(v => v.time < now_minus_10sec) + 1);
-            history.push({time: Date.now(), delta});
+            const now = Date.now();
+            // The oldest sample is the anchor the rate is measured from, so
+            // the newest sample older than 10s is kept: the window then
+            // stays close to 10s instead of shrinking after each eviction
+            const expired = history.findLastIndex(v => v.time < now - 10000);
+            if (expired > 0) {
+                history.splice(0, expired);
+            }
             out.done += delta;
+            history.push({time: now, done: out.done});
             out.refresh();
         },
         update: function (done) {
@@ -32,16 +38,17 @@ function make_progress(total)
         },
         refresh: function () {
             out.duration = (Date.now() - time0)/1000;
-            // `rate` and `eta` are null while unknown (same as before the
-            // first add): a zero time window would give rate = Infinity,
-            // and a zero rate would give eta = Infinity.
-            if (history.length) {
-                const delta = history.reduce((a,v) => a + v.delta, 0);
+            // `rate` and `eta` are null while unknown: a single sample says
+            // nothing about how long its delta took to accumulate (counting
+            // it doubled the rate early on), a zero time window would give
+            // rate = Infinity, and a zero rate would give eta = Infinity.
+            if (history.length > 1) {
+                const delta = out.done - history[0].done;
                 const time_sec = (Date.now() - history[0].time)/1000;
                 out.rate = time_sec ? delta/time_sec : null;
             }
             else {
-                out.rate = out.duration ? out.done/out.duration : null;
+                out.rate = null;
             }
             out.percents = !out.total ? null : out.done/out.total;
             out.eta = (!out.total || !out.rate) ? null : (out.total - out.done)/out.rate;

package/src/make_progress.md

@@ -3,10 +3,13 @@ rows created). Pass the snapshot to `format_progress_bytes` /
 `format_progress_kilo` for display.
 
 **Fields:** `done`, `total`, `duration` (seconds since creation), `rate`
-(units/second over a sliding 10-second history window), `eta` (seconds),
-`percents` (a fraction, `done/total`). `rate` and `eta` are `null` while
-unknown — before the first `add`, or when they would be `Infinity` (zero
-time window, zero rate); `percents` is `null` when `total` is falsy.
+(units/second over a sliding ~10-second history window), `eta` (seconds),
+`percents` (a fraction, `done/total`). The rate is measured between the
+oldest sample in the window and now, so the first sample's own delta is
+not counted (how long it took to accumulate is unknown). `rate` and `eta`
+are `null` while unknown — until two `add` calls exist, or when they would
+be `Infinity` (zero time window, zero rate); `percents` is `null` when
+`total` is falsy.
 
 **Methods:**
 - `add(delta)` — add `delta` to `done` and recompute

package/src/pgid_exists.js

@@ -2,6 +2,11 @@
 // keep in sync with pid_exists
 function pgid_exists(pgid)
 {
+    // kill(-0, ...) targets the caller's own group and kill(-1, ...) every
+    // process the user may signal: never let such ids reach the kernel
+    if (!Number.isInteger(pgid) || pgid <= 1) {
+        throw new TypeError(`pgid_exists: invalid pgid: ${pgid}`);
+    }
     try {
         process.kill(-pgid, 0);
         return true;

package/src/pgid_exists.md

@@ -3,4 +3,8 @@ Checks whether a process group is alive by sending signal `0` to the group via
 at least one member, `false` on any error (no such group, or no permission).
 A group id equals the pid of the group leader.
 
+Throws `TypeError` when `pgid` is not an integer greater than `1`: `0` would
+probe the caller's own process group and `1` every process the user may
+signal (`kill(-1, ...)`), so such values never reach `kill(2)`.
+
 See `pid_exists` for the single-process variant.

package/src/pgid_kill_grace.js

@@ -7,6 +7,11 @@ const pgid_exists = require('./pgid_exists');
 // keep in sync with pid_kill_grace
 async function pgid_kill_grace(pgid, {grace_timeout_ms = 5000, log = ignore} = {})
 {
+    // kill(-0, ...) targets the caller's own group and kill(-1, ...) every
+    // process the user may signal: never let such ids reach the kernel
+    if (!Number.isInteger(pgid) || pgid <= 1) {
+        throw new TypeError(`pgid_kill_grace: invalid pgid: ${pgid}`);
+    }
     log(`Terminating process group ${pgid}: sending SIGTERM`);
     try {
         process.kill(-pgid, 'SIGTERM');

package/src/pgid_kill_grace.md

@@ -5,6 +5,9 @@ to deliver it. A group id equals the pid of the group leader.
 
 - Options: `grace_timeout_ms` (default `5000`) and `log` (progress callback,
   default no-op).
+- Throws `TypeError` before sending anything when `pgid` is not an integer
+  greater than `1` (`0` would signal the caller's own group, `1` every
+  process the user may signal via `kill(-1, ...)`).
 - Throws `Failed to send SIGTERM to process group <pgid>: ...` when the
   initial signal cannot be sent.
 - A group that dies on its own during the grace period skips the `SIGKILL`;

package/src/pid_exists.js

@@ -1,6 +1,11 @@
 // keep in sync with pgid_exists
 function pid_exists(pid)
 {
+    // kill(0, ...) targets the caller's own group and kill(-1, ...) every
+    // process the user may signal: never let such ids reach the kernel
+    if (!Number.isInteger(pid) || pid <= 1) {
+        throw new TypeError(`pid_exists: invalid pid: ${pid}`);
+    }
     try {
         process.kill(pid, 0);
         return true;

package/src/pid_exists.md

@@ -2,4 +2,8 @@ Checks whether a process is alive by sending signal `0` via
 `process.kill(pid, 0)`. Returns `true` when the signal can be delivered,
 `false` on any error (no such process, or no permission to signal it).
 
+Throws `TypeError` when `pid` is not an integer greater than `1`: `0` would
+probe the caller's own process group and `-1` every process the user may
+signal, so such values never reach `kill(2)`.
+
 See `pgid_exists` for the process-group variant.

package/src/pid_kill_grace.js

@@ -6,6 +6,11 @@ const pid_exists = require('./pid_exists');
 // keep in sync with pgid_kill_grace
 async function pid_kill_grace(pid, {grace_timeout_ms = 5000, log = ignore} = {})
 {
+    // kill(0, ...) targets the caller's own group and kill(-1, ...) every
+    // process the user may signal: never let such ids reach the kernel
+    if (!Number.isInteger(pid) || pid <= 1) {
+        throw new TypeError(`pid_kill_grace: invalid pid: ${pid}`);
+    }
     log(`Terminating process ${pid}: sending SIGTERM`);
     try {
         process.kill(pid, 'SIGTERM');

package/src/pid_kill_grace.md

@@ -4,6 +4,9 @@ waits up to 200ms more for the kernel to deliver it.
 
 - Options: `grace_timeout_ms` (default `5000`) and `log` (progress callback,
   default no-op).
+- Throws `TypeError` before sending anything when `pid` is not an integer
+  greater than `1` (`0` would signal the caller's own group, `-1` every
+  process the user may signal).
 - Throws `Failed to send SIGTERM to process <pid>: ...` when the initial
   signal cannot be sent (e.g. the process does not exist).
 - A process that dies on its own during the grace period skips the `SIGKILL`

package/src/plural.js

@@ -3,7 +3,7 @@ function plural(n, singular, plural, zero)
     if (n === 0 && typeof zero === 'string') {
         return zero;
     }
-    if (n % 10 === 1 && n % 100 !== 11) {
+    if (n === 1) {
         return singular.split('#').join(n);
     }
     return plural.split('#').join(n);

package/src/plural.md

@@ -1,13 +1,16 @@
-Slavic-style pluralizer: `plural(n, singular, plural, zero)`. The `singular`
-form is used when `n` ends in 1 but not in 11 (1, 21, 101, ...); everything
-else gets the `plural` form. Every `#` in the chosen form is replaced with
-`n`. The optional `zero` string is returned as-is when `n === 0`.
+English pluralizer: `plural(n, singular, plural, zero)`. The `singular` form is
+used only when `n === 1`; every other `n` (0, 2, 11, 21, 101, ...) gets the
+`plural` form. Every `#` in the chosen form is replaced with `n`. The optional
+`zero` string is returned as-is when `n === 0`. A form without `#` comes back
+as it is, so the helper also picks a case: `switch (plural(n, '1', '2', '0'))`.
+Russian words have three forms: see `plural_ru`.
 
 ```js
-plural(1, '# apple', '# apples')                // '1 apple'
-plural(2, '# apple', '# apples')                // '2 apples'
-plural(11, '# apple', '# apples')               // '11 apples'
-plural(21, '# apple', '# apples')               // '21 apple'
-plural(0, '# apple', '# apples')                // '0 apples'
-plural(0, '# apple', '# apples', 'No apples')   // 'No apples'
+plural(1, '# step', '# steps')               // '1 step'
+plural(2, '# step', '# steps')               // '2 steps'
+plural(11, '# step', '# steps')              // '11 steps'
+plural(21, '# step', '# steps')              // '21 steps'
+plural(0, '# step', '# steps')               // '0 steps'
+plural(0, '# step', '# steps', 'no steps')   // 'no steps'
+plural(21, '1', '2', '0')                    // '2'
 ```

package/src/plural_ru.js

@@ -0,0 +1,27 @@
+function plural_ru(n, one, few, many, zero)
+{
+    if (n === 0 && typeof zero === 'string') {
+        return zero;
+    }
+    return plural_ru_form(n, one, few, many).split('#').join(n);
+}
+
+// Russian counts in three forms: one (1, 21, 101), few (2-4, 22-24, 102-104)
+// and many (0, 5-20, 25-30, 111-114). A fraction takes the few form: 1.5 яблока.
+function plural_ru_form(n, one, few, many)
+{
+    if (!Number.isInteger(n)) {
+        return few;
+    }
+    const mod10 = Math.abs(n) % 10;
+    const mod100 = Math.abs(n) % 100;
+    if (mod10 === 1 && mod100 !== 11) {
+        return one;
+    }
+    if (mod10 >= 2 && mod10 <= 4 && (mod100 < 12 || mod100 > 14)) {
+        return few;
+    }
+    return many;
+}
+
+module.exports = plural_ru;

package/src/plural_ru.md

@@ -0,0 +1,21 @@
+Russian pluralizer: `plural_ru(n, one, few, many, zero)`. A counted word in
+Russian has three forms, and `n` picks one: `one` when it ends in 1 but not in
+11 (1, 21, 101), `few` when it ends in 2, 3 or 4 but not in 12, 13 or 14 (2, 23,
+104), `many` otherwise (0, 5, 11, 19, 100). A fraction takes the `few` form
+(1.5 яблока). Every `#` in the chosen form is replaced with `n`. The optional
+`zero` string is returned as-is when `n === 0`. A form without `#` comes back
+as it is, so the helper also picks a case: `switch (plural_ru(n, '1', '2', '5', '0'))`.
+English words have two forms: see `plural`.
+
+```js
+plural_ru(1, '# яблоко', '# яблока', '# яблок')               // '1 яблоко'
+plural_ru(2, '# яблоко', '# яблока', '# яблок')               // '2 яблока'
+plural_ru(5, '# яблоко', '# яблока', '# яблок')               // '5 яблок'
+plural_ru(11, '# яблоко', '# яблока', '# яблок')              // '11 яблок'
+plural_ru(21, '# яблоко', '# яблока', '# яблок')              // '21 яблоко'
+plural_ru(22, '# яблоко', '# яблока', '# яблок')              // '22 яблока'
+plural_ru(1.5, '# яблоко', '# яблока', '# яблок')             // '1.5 яблока'
+plural_ru(0, '# яблоко', '# яблока', '# яблок')               // '0 яблок'
+plural_ru(0, '# яблоко', '# яблока', '# яблок', 'Нет яблок')  // 'Нет яблок'
+plural_ru(22, '1', '2', '5', '0')                             // '2'
+```

package/src/redis_poll_zshift_callback_rpush.js

@@ -64,6 +64,10 @@ async function redis_poll_zshift_callback_rpush(options)
                 log(`[${log_waiter_error_parse}] ${error.message}`);
                 continue;
             }
+            if (!message || typeof message !== 'object') {
+                log(`[${log_waiter_error_parse}] message is not an object; skipped`);
+                continue;
+            }
 
             try {
                 const uid = message.uid;

package/src/redis_poll_zshift_callback_rpush.md

@@ -5,9 +5,10 @@ type, value}` to `redis_output_queue` — `type: 'resolve'` with the callback's
 return value, or `'reject'` with the error stack/message. An empty poll
 sleeps a random 500–1500ms; the loop runs at most 86400 iterations.
 
-- Unparseable messages and messages without `uid` are skipped; a missing or
-  past `expires_at` rejects the message (payloads carry signed urls with
-  limited lifetime).
+- Unparseable messages, valid JSON that is not an object (`null`, numbers,
+  strings), and messages without `uid` are skipped; a missing or past
+  `expires_at` rejects the message (payloads carry signed urls with limited
+  lifetime).
 - `user_friendly_status(value)` rpushes `{uid, version, type:
   'user_friendly_status', value}` to the output queue; a generic
   `'Started...'` status is always pushed first so the consumer starts

package/src/redis_poll_zshift_spawn_rpush.js

@@ -73,6 +73,10 @@ async function redis_poll_zshift_spawn_rpush(options)
                 log(`[${log_waiter_error_parse}] ${error.message}`);
                 continue;
             }
+            if (!message || typeof message !== 'object') {
+                log(`[${log_waiter_error_parse}] message is not an object; skipped`);
+                continue;
+            }
 
             try {
                 const uid = message.uid;

package/src/redis_poll_zshift_spawn_rpush.md

@@ -12,9 +12,10 @@ iterations.
   `'Started...'` status is always pushed first. stdout/stderr are logged
   line by line under the `log_worker_stdout`/`log_worker_stderr` tags.
 - Only exit code 0 is a success — a signal-killed child (code `null`) fails.
-- Unparseable messages and messages without `uid` are skipped; a missing or
-  past `expires_at` fails the message (payloads carry signed urls with
-  limited lifetime).
+- Unparseable messages, valid JSON that is not an object (`null`, numbers,
+  strings), and messages without `uid` are skipped; a missing or past
+  `expires_at` fails the message (payloads carry signed urls with limited
+  lifetime).
 - `options.log` must provide `spawn()`; queue access goes through
   `redis_zshift`/`redis_rpush`, so any redis client from redis@1 to redis@6
   works. See `redis_poll_zshift_callback_rpush` for the in-process

package/src/shell.js

@@ -7,7 +7,7 @@ function shell(args, options)
             if (error) {
                 reject(error);
             }
-            else if (stderr) {
+            else if (stderr.length) {
                 reject(new Error(`Process terminated with the following STDERR:\n\n${stderr}`));
             }
             else {

package/src/shell.md

@@ -2,7 +2,8 @@ Basic helper for running external commands via `execFile`.
 
 - Fails if the command exits with non-zero code.
 - Fails if anything is printed to `stderr`.
-- Resolves with `stdout` (string), exactly as produced.
+- Resolves with `stdout` (string), exactly as produced; a `Buffer` with
+  `{encoding: 'buffer'}`.
 
 ## Signature
 

package/src/shell_json.js

@@ -7,7 +7,7 @@ function shell_json(args, options)
             if (error) {
                 reject(error);
             }
-            else if (stderr) {
+            else if (stderr.length) {
                 reject(new Error(`Process terminated with the following STDERR:\n\n${stderr}`));
             }
             else {

package/src/shell_json.md

@@ -3,7 +3,8 @@ Basic helper for running external commands via `execFile`, and parse result by J
 - Fails if the command exits with non-zero code.
 - Fails if anything is printed to `stderr`.
 - Fails if stdout is not valid JSON.
-- Resolves with parsed JSON value.
+- Resolves with parsed JSON value (`{encoding: 'buffer'}` is accepted;
+  `JSON.parse` stringifies the `Buffer`).
 
 ## Signature
 

package/src/stream_strpbrk.js

@@ -1,4 +1,5 @@
 const stream = require('stream');
+const {StringDecoder} = require('string_decoder');
 
 /**
  * Split the input stream by consecutive delimiters in `chars`
@@ -6,10 +7,13 @@ const stream = require('stream');
 function stream_strpbrk(chars = '\r\n')
 {
     const pending = [];
+    // StringDecoder buffers a multi-byte character split across chunk
+    // boundaries; plain buf.toString() would corrupt it into �.
+    const decoder = new StringDecoder('utf8');
     return new stream.Transform({
         objectMode: true,
         transform: function (str, encoding, callback) {
-            str = Buffer.isBuffer(str) ? str.toString() : str;
+            str = Buffer.isBuffer(str) ? decoder.write(str) : str;
 
             let off = 0;
             // leading delimiters
@@ -67,6 +71,10 @@ function stream_strpbrk(chars = '\r\n')
             callback();
         },
         flush: function (callback) {
+            const tail = decoder.end();
+            if (tail) {
+                pending.push(tail);
+            }
             if (pending.length) {
                 this.push(''.concat(...pending.splice(0)));
             }

package/src/stream_xml_analyze.js

@@ -17,7 +17,12 @@ function stream_xml_analyze()
         onopentag: function (name, attrs) {
             path.push(name);
             path_str = path.join(' > ');
-            analytics[path_str] ??= 0;
+            // Element names come from the outside world: `??=` on a plain
+            // object would see Object.prototype.constructor and produce NaN
+            // for a root element named `constructor`.
+            if (!Object.hasOwn(analytics, path_str)) {
+                Object.defineProperty(analytics, path_str, {value: 0, enumerable: true, writable: true, configurable: true});
+            }
             analytics[path_str]++;
         },
         onclosetag: function (name) {

package/src/stream_xml_parse.js

@@ -99,22 +99,30 @@ function guess(node)
 
     node.children.forEach(function (child) {
         const tmp = stream_xml_parse.guess(child);
-        if (child.name in out) {
+        // Element names come from the outside world: `in` and plain
+        // assignment would let `__proto__`, `constructor`, `toString`...
+        // hit Object.prototype instead of becoming own data properties.
+        if (Object.hasOwn(out, child.name)) {
             if (Array.isArray(out[child.name])) {
                 out[child.name].push(tmp);
             }
             else {
-                out[child.name] = [out[child.name], tmp];
+                define(out, child.name, [out[child.name], tmp]);
             }
         }
         else  {
-            out[child.name] = tmp;
+            define(out, child.name, tmp);
         }
     });
 
     return out;
 }
 
+function define(obj, name, value)
+{
+    Object.defineProperty(obj, name, {value, enumerable: true, writable: true, configurable: true});
+}
+
 function ashtml(node)
 {
     return node.raw.map(fn).filter(v => v).join('').trim();

package/src/urlparts.js

@@ -43,7 +43,10 @@ function urlparts(input)
     }
 
     if (resource.startsWith('//')) {
-        const slash_pos = resource.indexOf('/', 2);
+        // WHATWG parsers treat `\` as `/` for special schemes, so the
+        // authority ends at the first of either.
+        const slash_offset = resource.slice(2).search(/[/\\]/);
+        const slash_pos = slash_offset === -1 ? -1 : slash_offset + 2;
         const authority = slash_pos === -1
             ? resource.slice(2)
             : resource.slice(2, slash_pos);

package/src/urlparts.md

@@ -5,6 +5,12 @@ delimiters, while `query` and `fragment` are always parsed plain objects.
 Malformed URL text is accepted and parsed on a best-effort basis. A non-string
 argument returns the empty stable shape instead of throwing.
 
+**Warning:** `host` (like every other component) is a tolerant best-effort
+value intended for display and lenient parsing. It is not guaranteed to match
+the host a WHATWG client (browsers, Node's `URL`, Axios) would connect to for
+malformed input, so it must not be used for allow-lists, redirect-target
+validation, or SSRF decisions. Use `new URL(input)` for security checks.
+
 ```js
 urlparts('/users?a=1#top')
 // {