@vouchington/utils 0.4.1 → 0.5.1

package/README.md

@@ -6,9 +6,11 @@ export: import the capability you use from an explicit subpath.
 ```ts
 import { createTokenSecrets } from '@vouchington/utils/token-secrets'
 import { createMoneyCatalog } from '@vouchington/utils/money'
-import { serializeCookie } from '@vouchington/utils/cookies'
+import { parseCookies, serializeCookie } from '@vouchington/utils/cookies'
+import { buildSignatureHeaders, verifySignature } from '@vouchington/utils/http-signatures'
 import { bestAcceptLanguageMatch } from '@vouchington/utils/language-tags'
 import { createMessageTranslator } from '@vouchington/utils/message-catalog'
+import { createReportInputParser } from '@vouchington/utils/moderation'
 ```
 
 ## Subpaths
@@ -22,11 +24,17 @@ import { createMessageTranslator } from '@vouchington/utils/message-catalog'
 - `request-client-info`: `createClientInfoParser(config)` validates caller-selected headers,
   families, platforms, compatibility, and versions.
 - `money`: `createMoneyCatalog(currencies, scale)` supplies exact integer parsing and validation for
-  the caller's catalog.
+  the caller's catalog. `allocateProportionalAmount(amount, numerator, denominator, rounding)`
+  allocates an inclusive fraction with `down` or `up` integer rounding chosen explicitly by the
+  caller; it uses exact integer arithmetic rather than floating-point division.
 - `env-contract`: `groupEnvContracts()` and `normalizeEnvContractGroups()` produce delimiter-safe
   metadata keys and surface/sensitivity lookups.
 - `cookies`: `serializeCookie(name, value, attributes)` validates cookie grammar and requires the
   caller to supply every policy attribute. `SameSite=None` requires `Secure`.
+  `parseCookies(header)` splits a `Cookie` request header into a name/value `Map`.
+- `http-signatures`: Node-only (`node:crypto`) Cavage-12 HTTP Signatures. Callers pass signed
+  headers, allowed algorithms, and `maxAgeSeconds` on both sign and verify. The package has no
+  default header set or product keyId policy.
 - `collections`, `async`, and `stable-json`: collection deduplication/merging, bounded async mapping,
   and deterministic JSON serialization.
 - `feature-flags`: base64 JSON feature-flag cookie parsing and serialization with caller-injected
@@ -35,14 +43,20 @@ import { createMessageTranslator } from '@vouchington/utils/message-catalog'
   formatting, text normalization, title casing, and word/sentence helpers.
 - `gtin`, `bigint-ids`, and `validation`: GTIN predicates, canonical positive PostgreSQL bigint IDs,
   and basic email/UUID predicates.
+- `moderation`: caller-configured report target, reason, identifier, note, and cross-field input
+  validation. Applications own catalogs, policy, error mapping, persistence, and HTTP behavior.
 - `query` and `query-string`: generic array/boolean/number parsing, bounded integer parsing, and
   query-string serialization. Cursor parsing intentionally belongs to `@vouchington/pagination`.
-- `slugs` and `urls`: ASCII-only slugification and URL/hostname primitives. URL hostname helpers
-  return `null` for invalid input; `normalizeAsciiHostname` names its ASCII-only contract directly,
-  while `normalizeHostname` also supports WHATWG IDN conversion. `matchesHostnamePattern` supports
-  exact and inclusive `*.` hostname patterns.
+- `slugs` and `urls`: ASCII-only slugification, the `isSlug` lowercase `[a-z0-9-]+` predicate
+  (leading, trailing, and consecutive hyphens are allowed), and URL/hostname primitives. URL hostname
+  helpers return `null` for invalid input; `normalizeAsciiHostname` names its ASCII-only contract
+  directly, while `normalizeHostname` also supports WHATWG IDN conversion.
+  `matchesHostnamePattern` supports exact and inclusive `*.` hostname patterns.
 - `hashtags`: caller-configured authored/key length and separator policy for canonical ASCII hashtag
-  keys. The package does not choose application limits or accepted input separators.
+  keys, plus `maskHashtagBearingUrls` to blank absolute URLs and fragment-bearing relative paths.
+  The package does not choose application limits or accepted input separators.
+- `utm`: `createUtmParser({ sourceAliases, fallbackSourceParam? })` lowercases and trims UTM fields
+  and resolves `utm_source` through caller-owned aliases. The package has no default shortcode map.
 - `fetch-ports`: the Fetch standard forbidden-port list and membership predicates.
 - `http-body`: bounded Fetch response-body reads with abort propagation and typed missing/oversize
   errors.

package/dist/cookies.d.mts

@@ -6,3 +6,4 @@ export type CookieAttributes = {
     secure: boolean;
 };
 export declare function serializeCookie(name: string, value: string, attributes: CookieAttributes): string;
+export declare function parseCookies(cookieHeader?: string | null): Map<string, string>;

package/dist/cookies.mjs

@@ -30,3 +30,19 @@ export function serializeCookie(name, value, attributes) {
         parts.push('Secure');
     return parts.join('; ');
 }
+const COOKIE_SPLIT_REGEX = /;\s*/;
+export function parseCookies(cookieHeader) {
+    const cookies = new Map();
+    if (!cookieHeader)
+        return cookies;
+    for (const part of cookieHeader.split(COOKIE_SPLIT_REGEX)) {
+        const separatorIndex = part.indexOf('=');
+        if (separatorIndex <= 0)
+            continue;
+        const name = part.slice(0, separatorIndex).trim();
+        const value = part.slice(separatorIndex + 1).trim();
+        if (name.length > 0)
+            cookies.set(name, value);
+    }
+    return cookies;
+}

package/dist/hashtags.d.mts

@@ -13,3 +13,8 @@ export interface HashtagNormalizer {
 }
 /** Creates an ASCII hashtag normalizer whose length and separator policy is caller-owned. */
 export declare function createHashtagNormalizer(options: HashtagNormalizerOptions): HashtagNormalizer;
+/**
+ * Blanks absolute URLs and relative paths that contain `#` so fragment text is
+ * not treated as a hashtag. Parentheses stay balanced for Wikipedia-style paths.
+ */
+export declare function maskHashtagBearingUrls(input: string): string;

package/dist/hashtags.mjs

@@ -42,3 +42,46 @@ function createSeparatorPattern(separators) {
 function escapeRegularExpression(value) {
     return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
+const absoluteUrlPrefix = /(?:https?:\/\/|www\.)/gi;
+const urlBoundary = /[\s<>]/;
+/**
+ * Blanks absolute URLs and relative paths that contain `#` so fragment text is
+ * not treated as a hashtag. Parentheses stay balanced for Wikipedia-style paths.
+ */
+export function maskHashtagBearingUrls(input) {
+    const masked = input.split('');
+    for (const match of input.matchAll(absoluteUrlPrefix)) {
+        const start = match.index;
+        maskRange(masked, start, findUrlEnd(input, start));
+    }
+    for (let start = 0; start < input.length; start += 1) {
+        if (input[start] !== '/')
+            continue;
+        const end = findUrlEnd(input, start);
+        if (input.slice(start, end).includes('#'))
+            maskRange(masked, start, end);
+        start = end - 1;
+    }
+    return masked.join('');
+}
+function findUrlEnd(input, start) {
+    let parenthesisDepth = 0;
+    for (let index = start; index < input.length; index += 1) {
+        const character = input[index];
+        if (urlBoundary.test(character))
+            return index;
+        if (character === '(') {
+            parenthesisDepth += 1;
+            continue;
+        }
+        if (character === ')') {
+            if (parenthesisDepth === 0)
+                return index;
+            parenthesisDepth -= 1;
+        }
+    }
+    return input.length;
+}
+function maskRange(masked, start, end) {
+    masked.fill(' ', start, end);
+}

package/dist/http-signatures-digest.d.mts

@@ -0,0 +1,3 @@
+export declare function computeDigest(body: string | Buffer): string;
+export declare function extractDigestHash(digestHeader: string): string;
+export declare function verifyDigest(body: string | Buffer, expectedDigestHeader: string): boolean;

package/dist/http-signatures-digest.mjs

@@ -0,0 +1,20 @@
+import { createHash, timingSafeEqual } from 'node:crypto';
+const DIGEST_HEADER_PATTERN = /^SHA-256=(.+)$/;
+export function computeDigest(body) {
+    const bodyBuffer = typeof body === 'string' ? Buffer.from(body, 'utf-8') : body;
+    const hash = createHash('sha256').update(bodyBuffer).digest('base64');
+    return `SHA-256=${hash}`;
+}
+export function extractDigestHash(digestHeader) {
+    const match = DIGEST_HEADER_PATTERN.exec(digestHeader);
+    if (!match?.[1])
+        throw new Error('Invalid Digest header format');
+    return match[1];
+}
+export function verifyDigest(body, expectedDigestHeader) {
+    const computed = Buffer.from(computeDigest(body));
+    const expected = Buffer.from(expectedDigestHeader);
+    if (computed.length !== expected.length)
+        return false;
+    return timingSafeEqual(computed, expected);
+}

package/dist/http-signatures-keys.d.mts

@@ -0,0 +1,7 @@
+export type RsaSha256KeyPair = {
+    publicKeyPem: string;
+    privateKeyPem: string;
+};
+export declare function generateRsaSha256KeyPair(): RsaSha256KeyPair;
+export declare function assertPublicKeyPem(pem: string): void;
+export declare function assertPrivateKeyPem(pem: string): void;

package/dist/http-signatures-keys.mjs

@@ -0,0 +1,27 @@
+import { createPrivateKey, createPublicKey, generateKeyPairSync } from 'node:crypto';
+export function generateRsaSha256KeyPair() {
+    const { publicKey, privateKey } = generateKeyPairSync('rsa', {
+        modulusLength: 2048,
+        publicKeyEncoding: { type: 'spki', format: 'pem' },
+        privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+    });
+    return { publicKeyPem: publicKey, privateKeyPem: privateKey };
+}
+export function assertPublicKeyPem(pem) {
+    if (pem.includes('PRIVATE'))
+        throw new Error('Invalid public key PEM format');
+    try {
+        createPublicKey(pem);
+    }
+    catch {
+        throw new Error('Invalid public key PEM format');
+    }
+}
+export function assertPrivateKeyPem(pem) {
+    try {
+        createPrivateKey(pem);
+    }
+    catch {
+        throw new Error('Invalid private key PEM format');
+    }
+}

package/dist/http-signatures-sign.d.mts

@@ -0,0 +1,17 @@
+export type SignatureHeaders = {
+    digest: string;
+    signature: string;
+    date: string;
+};
+export type BuildSignatureHeadersOptions = {
+    method: string;
+    url: string;
+    body: string | Buffer;
+    keyId: string;
+    privateKeyPem: string;
+    signedHeaders: readonly string[];
+    algorithm: string;
+    now?: Date;
+    additionalHeaders?: Record<string, string>;
+};
+export declare function buildSignatureHeaders(options: BuildSignatureHeadersOptions): SignatureHeaders;

package/dist/http-signatures-sign.mjs

@@ -0,0 +1,35 @@
+import { createPrivateKey, sign } from 'node:crypto';
+import { computeDigest } from './http-signatures-digest.mjs';
+import { assertPrivateKeyPem } from './http-signatures-keys.mjs';
+import { buildSigningString, isSha256SignatureAlgorithm } from './http-signatures-string.mjs';
+export function buildSignatureHeaders(options) {
+    if (options.signedHeaders.length === 0)
+        throw new Error('signedHeaders must not be empty');
+    if (!isSha256SignatureAlgorithm(options.algorithm)) {
+        throw new Error(`Unsupported signature algorithm: ${options.algorithm}`);
+    }
+    assertPrivateKeyPem(options.privateKeyPem);
+    const digest = computeDigest(options.body);
+    const date = (options.now ?? new Date()).toUTCString();
+    const url = new URL(options.url);
+    const host = url.host;
+    const path = url.pathname + url.search;
+    const signingString = buildSigningString(options.signedHeaders, {
+        method: options.method,
+        path,
+        host,
+        date,
+        digest,
+        additionalHeaders: options.additionalHeaders,
+    });
+    if (typeof signingString !== 'string')
+        throw new Error(signingString.error);
+    const signature = sign('sha256', Buffer.from(signingString), createPrivateKey(options.privateKeyPem)).toString('base64');
+    const signatureHeaderValue = [
+        `keyId="${options.keyId}"`,
+        `algorithm="${options.algorithm}"`,
+        `headers="${options.signedHeaders.map((name) => name.toLowerCase()).join(' ')}"`,
+        `signature="${signature}"`,
+    ].join(',');
+    return { digest, signature: signatureHeaderValue, date };
+}

package/dist/http-signatures-string.d.mts

@@ -0,0 +1,12 @@
+export type SigningHeaderValues = {
+    method: string;
+    path: string;
+    host: string;
+    date: string;
+    digest: string;
+    additionalHeaders?: Record<string, string> | undefined;
+};
+export declare function isSha256SignatureAlgorithm(algorithm: string): boolean;
+export declare function buildSigningString(headerNames: readonly string[], values: SigningHeaderValues): string | {
+    error: string;
+};

package/dist/http-signatures-string.mjs

@@ -0,0 +1,40 @@
+const SHA256_ALGORITHMS = new Set(['rsa-sha256', 'hs2019']);
+export function isSha256SignatureAlgorithm(algorithm) {
+    return SHA256_ALGORITHMS.has(algorithm);
+}
+function additionalHeaderValue(headers, name) {
+    if (!headers)
+        return undefined;
+    if (Object.hasOwn(headers, name))
+        return headers[name];
+    const lower = name.toLowerCase();
+    for (const [key, value] of Object.entries(headers)) {
+        if (key.toLowerCase() === lower)
+            return value;
+    }
+    return undefined;
+}
+function signingLineForHeader(name, values) {
+    const lower = name.toLowerCase();
+    if (lower === '(request-target)') {
+        return `(request-target): ${values.method.toLowerCase()} ${values.path}`;
+    }
+    if (lower === 'host')
+        return `host: ${values.host}`;
+    if (lower === 'date')
+        return `date: ${values.date}`;
+    if (lower === 'digest')
+        return `digest: ${values.digest}`;
+    const extra = additionalHeaderValue(values.additionalHeaders, name);
+    return extra === undefined ? undefined : `${lower}: ${extra}`;
+}
+export function buildSigningString(headerNames, values) {
+    const lines = [];
+    for (const name of headerNames) {
+        const line = signingLineForHeader(name, values);
+        if (line === undefined)
+            return { error: `Unknown signed header: ${name}` };
+        lines.push(line);
+    }
+    return lines.join('\n');
+}

package/dist/http-signatures-test-helpers.d.mts

@@ -0,0 +1,30 @@
+import type { VerifySignatureOptions } from './http-signatures-verify.mts';
+export declare const KEY_ID = "https://example.test/users/alice#main-key";
+export declare const BODY: string;
+export declare const FULL_HEADERS: readonly ['(request-target)', 'host', 'date', 'digest'];
+export declare const defaultVerifyPolicy: {
+    readonly requiredHeaders: readonly ["(request-target)", "host", "date", "digest"];
+    readonly allowedAlgorithms: readonly ["rsa-sha256", "hs2019"];
+    readonly maxAgeSeconds: 3600;
+};
+export declare const defaultSignPolicy: {
+    readonly signedHeaders: readonly ["(request-target)", "host", "date", "digest"];
+    readonly algorithm: 'rsa-sha256';
+};
+export declare function digestAndDate(body?: string | Buffer): {
+    digestHeader: string;
+    dateHeader: string;
+};
+export declare function verifyArgs(publicKeyPem: string, signatureHeader: string, extras?: Partial<VerifySignatureOptions>): VerifySignatureOptions;
+export declare function buildManualSignature(options: {
+    privateKeyPem: string;
+    dateHeader: string;
+    digestHeader: string;
+    headerNames: readonly string[];
+    additionalHeaders?: Record<string, string>;
+    keyId?: string;
+    algorithm?: string | null;
+    method?: string;
+    path?: string;
+    host?: string;
+}): string;

package/dist/http-signatures-test-helpers.mjs

@@ -0,0 +1,62 @@
+import { createPrivateKey, sign as cryptoSign } from 'node:crypto';
+import { computeDigest } from './http-signatures-digest.mjs';
+export const KEY_ID = 'https://example.test/users/alice#main-key';
+const METHOD = 'POST';
+const PATH = '/inbox';
+const HOST = 'mastodon.example';
+export const BODY = JSON.stringify({ type: 'Follow', object: 'https://example.test' });
+export const FULL_HEADERS = ['(request-target)', 'host', 'date', 'digest'];
+const ALLOWED_ALGORITHMS = ['rsa-sha256', 'hs2019'];
+const MAX_AGE_SECONDS = 3600;
+export const defaultVerifyPolicy = {
+    requiredHeaders: FULL_HEADERS,
+    allowedAlgorithms: ALLOWED_ALGORITHMS,
+    maxAgeSeconds: MAX_AGE_SECONDS,
+};
+export const defaultSignPolicy = {
+    signedHeaders: FULL_HEADERS,
+    algorithm: 'rsa-sha256',
+};
+export function digestAndDate(body = BODY) {
+    return { digestHeader: computeDigest(body), dateHeader: new Date().toUTCString() };
+}
+export function verifyArgs(publicKeyPem, signatureHeader, extras = {}) {
+    const { digestHeader, dateHeader } = digestAndDate(extras.body ?? BODY);
+    return {
+        method: METHOD,
+        path: PATH,
+        host: HOST,
+        body: BODY,
+        signatureHeader,
+        digestHeader,
+        dateHeader,
+        publicKeyPem,
+        ...defaultVerifyPolicy,
+        ...extras,
+    };
+}
+export function buildManualSignature(options) {
+    const headerNames = options.headerNames;
+    const signingString = headerNames
+        .map((name) => {
+        if (name === '(request-target)') {
+            return `(request-target): ${(options.method ?? METHOD).toLowerCase()} ${options.path ?? PATH}`;
+        }
+        if (name === 'host')
+            return `host: ${options.host ?? HOST}`;
+        if (name === 'date')
+            return `date: ${options.dateHeader}`;
+        if (name === 'digest')
+            return `digest: ${options.digestHeader}`;
+        return `${name}: ${options.additionalHeaders?.[name]}`;
+    })
+        .join('\n');
+    const signature = cryptoSign('sha256', Buffer.from(signingString), createPrivateKey(options.privateKeyPem)).toString('base64');
+    const headerParts = [`keyId="${options.keyId ?? KEY_ID}"`];
+    if (options.algorithm !== null) {
+        headerParts.push(`algorithm="${options.algorithm ?? 'rsa-sha256'}"`);
+    }
+    headerParts.push(`headers="${headerNames.join(' ')}"`);
+    headerParts.push(`signature="${signature}"`);
+    return headerParts.join(',');
+}

package/dist/http-signatures-verify.d.mts

@@ -0,0 +1,21 @@
+export type VerifySignatureOptions = {
+    method: string;
+    path: string;
+    host: string;
+    body: string | Buffer;
+    signatureHeader: string;
+    digestHeader: string;
+    dateHeader: string;
+    publicKeyPem: string;
+    requiredHeaders: readonly string[];
+    allowedAlgorithms: readonly string[];
+    maxAgeSeconds: number;
+    additionalHeaders?: Record<string, string>;
+    referenceTime?: Date;
+};
+export type SignatureVerificationResult = {
+    valid: boolean;
+    error?: string;
+};
+export declare function extractSignatureKeyId(signatureHeader: string): string | undefined;
+export declare function verifySignature(options: VerifySignatureOptions): SignatureVerificationResult;

package/dist/http-signatures-verify.mjs

@@ -0,0 +1,88 @@
+import { verify } from 'node:crypto';
+import { verifyDigest } from './http-signatures-digest.mjs';
+import { assertPublicKeyPem } from './http-signatures-keys.mjs';
+import { buildSigningString, isSha256SignatureAlgorithm } from './http-signatures-string.mjs';
+const SIGNATURE_VALUE_PATTERN = /signature="([^"]+)"/;
+const HEADERS_VALUE_PATTERN = /headers="([^"]+)"/;
+const ALGORITHM_VALUE_PATTERN = /algorithm="([^"]+)"/;
+const KEY_ID_VALUE_PATTERN = /keyId="([^"]+)"/;
+export function extractSignatureKeyId(signatureHeader) {
+    return KEY_ID_VALUE_PATTERN.exec(signatureHeader)?.[1];
+}
+function parseSignatureHeader(header) {
+    const signatureMatch = SIGNATURE_VALUE_PATTERN.exec(header);
+    const headersMatch = HEADERS_VALUE_PATTERN.exec(header);
+    if (!signatureMatch?.[1] || !headersMatch?.[1])
+        return null;
+    return {
+        signature: signatureMatch[1],
+        headers: headersMatch[1].split(' ').map((name) => name.toLowerCase()),
+        algorithm: ALGORITHM_VALUE_PATTERN.exec(header)?.[1] ?? null,
+    };
+}
+export function verifySignature(options) {
+    try {
+        return verifySignatureBody(options);
+    }
+    catch (err) {
+        return {
+            valid: false,
+            error: `Signature verification exception: ${err.message}`,
+        };
+    }
+}
+function verifySignatureBody(options) {
+    assertPublicKeyPem(options.publicKeyPem);
+    const requestDate = new Date(options.dateHeader);
+    if (Number.isNaN(requestDate.getTime()))
+        return { valid: false, error: 'Invalid date header' };
+    const ageSeconds = ((options.referenceTime?.getTime() ?? Date.now()) - requestDate.getTime()) / 1000;
+    if (!Number.isFinite(options.maxAgeSeconds) || options.maxAgeSeconds < 0) {
+        return { valid: false, error: 'maxAgeSeconds must be a finite non-negative number' };
+    }
+    if (Math.abs(ageSeconds) > options.maxAgeSeconds) {
+        return {
+            valid: false,
+            error: `Date header too old: ${ageSeconds}s > ${options.maxAgeSeconds}s`,
+        };
+    }
+    if (!verifyDigest(options.body, options.digestHeader)) {
+        return { valid: false, error: 'Digest verification failed' };
+    }
+    const sigParts = parseSignatureHeader(options.signatureHeader);
+    if (!sigParts)
+        return { valid: false, error: 'Invalid signature header format' };
+    const { signature, headers, algorithm } = sigParts;
+    if (algorithm === null ||
+        !options.allowedAlgorithms.includes(algorithm) ||
+        !isSha256SignatureAlgorithm(algorithm)) {
+        return {
+            valid: false,
+            error: algorithm === null
+                ? 'Signature algorithm is required'
+                : `Unsupported signature algorithm: ${algorithm}`,
+        };
+    }
+    const covered = new Set(headers);
+    const missingRequired = options.requiredHeaders
+        .map((name) => name.toLowerCase())
+        .filter((name) => !covered.has(name));
+    if (missingRequired.length > 0) {
+        return {
+            valid: false,
+            error: `Signature must cover ${options.requiredHeaders.join(', ')} (missing: ${missingRequired.join(', ')})`,
+        };
+    }
+    const signingString = buildSigningString(headers, {
+        method: options.method,
+        path: options.path,
+        host: options.host,
+        date: options.dateHeader,
+        digest: options.digestHeader,
+        additionalHeaders: options.additionalHeaders,
+    });
+    if (typeof signingString !== 'string')
+        return { valid: false, error: signingString.error };
+    const isValid = verify('sha256', Buffer.from(signingString), options.publicKeyPem, Buffer.from(signature, 'base64'));
+    return isValid ? { valid: true } : { valid: false, error: 'Signature verification failed' };
+}

package/dist/http-signatures.d.mts

@@ -0,0 +1,4 @@
+export { computeDigest, extractDigestHash, verifyDigest } from './http-signatures-digest.mts';
+export { assertPrivateKeyPem, assertPublicKeyPem, generateRsaSha256KeyPair, type RsaSha256KeyPair, } from './http-signatures-keys.mts';
+export { buildSignatureHeaders, type BuildSignatureHeadersOptions, type SignatureHeaders, } from './http-signatures-sign.mts';
+export { extractSignatureKeyId, verifySignature, type SignatureVerificationResult, type VerifySignatureOptions, } from './http-signatures-verify.mts';

package/dist/http-signatures.mjs

@@ -0,0 +1,4 @@
+export { computeDigest, extractDigestHash, verifyDigest } from './http-signatures-digest.mjs';
+export { assertPrivateKeyPem, assertPublicKeyPem, generateRsaSha256KeyPair, } from './http-signatures-keys.mjs';
+export { buildSignatureHeaders, } from './http-signatures-sign.mjs';
+export { extractSignatureKeyId, verifySignature, } from './http-signatures-verify.mjs';

package/dist/moderation.d.mts

@@ -0,0 +1,34 @@
+interface ReportTarget<TType extends string, TId> {
+    type: TType;
+    id: TId;
+}
+interface ReportDraft<TType extends string, TId, TReason extends string> {
+    target: ReportTarget<TType, TId>;
+    reason: TReason;
+    note: string | null;
+}
+export interface ReportInputConfig<TType extends string, TId, TReason extends string> {
+    targetTypes: readonly TType[];
+    reasons: readonly TReason[];
+    parseTargetId(value: string): TId | null;
+    maxNoteLength: number;
+    validate?(draft: ReportDraft<TType, TId, TReason>): void;
+}
+interface RawReportInput {
+    targetType?: unknown;
+    targetId?: unknown;
+    reason?: unknown;
+    note?: unknown;
+}
+export interface ReportInputParser<TType extends string, TId, TReason extends string> {
+    parse(raw: RawReportInput): ReportDraft<TType, TId, TReason>;
+    readonly targetTypes: readonly TType[];
+    readonly reasons: readonly TReason[];
+}
+export type ReportValidationCode = 'invalid_target_type' | 'invalid_target_identifier' | 'invalid_reason' | 'invalid_note' | 'note_too_long';
+export declare class ReportValidationError extends Error {
+    readonly code: ReportValidationCode;
+    constructor(code: ReportValidationCode, message: string);
+}
+export declare function createReportInputParser<TType extends string, TId, TReason extends string>(config: ReportInputConfig<TType, TId, TReason>): ReportInputParser<TType, TId, TReason>;
+export {};

package/dist/moderation.mjs

@@ -0,0 +1,49 @@
+export class ReportValidationError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'ReportValidationError';
+        this.code = code;
+    }
+}
+export function createReportInputParser(config) {
+    const targetTypes = readonlyCatalog(config.targetTypes, 'targetTypes');
+    const reasons = readonlyCatalog(config.reasons, 'reasons');
+    if (!Number.isSafeInteger(config.maxNoteLength) || config.maxNoteLength < 0)
+        throw new TypeError('maxNoteLength must be a non-negative safe integer');
+    return {
+        targetTypes,
+        reasons,
+        parse(raw) {
+            const targetType = enumValue(raw.targetType, targetTypes, 'invalid_target_type', 'target type');
+            if (typeof raw.targetId !== 'string')
+                invalid('invalid_target_identifier', 'target identifier');
+            const targetId = config.parseTargetId(raw.targetId);
+            if (targetId === null)
+                invalid('invalid_target_identifier', 'target identifier');
+            const reason = enumValue(raw.reason, reasons, 'invalid_reason', 'reason');
+            if (raw.note !== undefined && raw.note !== null && typeof raw.note !== 'string')
+                invalid('invalid_note', 'note');
+            if (typeof raw.note === 'string' && raw.note.length > config.maxNoteLength)
+                throw new ReportValidationError('note_too_long', 'Note is too long');
+            const note = typeof raw.note === 'string' ? raw.note.trim() || null : null;
+            const draft = { target: { type: targetType, id: targetId }, reason, note };
+            config.validate?.(draft);
+            return draft;
+        },
+    };
+}
+function readonlyCatalog(values, name) {
+    if (values.length === 0 ||
+        values.some((value) => typeof value !== 'string' || value.length === 0))
+        throw new TypeError(`${name} must contain non-empty strings`);
+    return Object.freeze([...new Set(values)]);
+}
+function enumValue(value, catalog, code, name) {
+    if (typeof value !== 'string' || !catalog.includes(value))
+        invalid(code, name);
+    return value;
+}
+function invalid(code, name) {
+    throw new ReportValidationError(code, `Invalid ${name}`);
+}

package/dist/money.d.mts

@@ -19,6 +19,15 @@ export type MoneyRange<Code extends string = string> = {
     minimum: Money<Code>;
     maximum: Money<Code> | null;
 };
+export type ProportionalRounding = 'down' | 'up';
+/**
+ * Allocates a non-negative integer amount by an inclusive fraction.
+ *
+ * The result is exact when `amount * numerator` divides by `denominator`; otherwise callers
+ * explicitly select integer rounding down or up. All arithmetic is performed with `bigint` so
+ * safe integer inputs never pass through floating-point division.
+ */
+export declare function allocateProportionalAmount(amount: number, numerator: number, denominator: number, rounding: ProportionalRounding): number;
 export declare function createMoneyCatalog<const Currencies extends readonly Currency[]>(entries: Currencies, scale: number): {
     currencies: readonly Readonly<{
         code: string;

package/dist/money.mjs

@@ -1,4 +1,24 @@
 export const MAX_MONEY_AMOUNT = Number.MAX_SAFE_INTEGER;
+/**
+ * Allocates a non-negative integer amount by an inclusive fraction.
+ *
+ * The result is exact when `amount * numerator` divides by `denominator`; otherwise callers
+ * explicitly select integer rounding down or up. All arithmetic is performed with `bigint` so
+ * safe integer inputs never pass through floating-point division.
+ */
+export function allocateProportionalAmount(amount, numerator, denominator, rounding) {
+    if (!isAmount(amount) || !isAmount(numerator) || !isAmount(denominator))
+        throw new TypeError('Proportional allocation requires non-negative safe integer inputs');
+    if (denominator === 0 || numerator > denominator)
+        throw new RangeError('Proportional allocation requires a fraction from zero through one');
+    if (rounding !== 'down' && rounding !== 'up')
+        throw new TypeError('Proportional allocation rounding must be down or up');
+    const product = BigInt(amount) * BigInt(numerator);
+    const divisor = BigInt(denominator);
+    const quotient = product / divisor;
+    const result = rounding === 'up' && product % divisor !== 0n ? quotient + 1n : quotient;
+    return Number(result);
+}
 export function createMoneyCatalog(entries, scale) {
     validateScale(scale);
     for (const currency of entries)

package/dist/slugs.d.mts

@@ -1 +1,3 @@
 export declare function slugifyAscii(value: string): string;
+/** True for a non-empty string of lowercase ASCII letters, digits, and hyphens. */
+export declare function isSlug(value: string): boolean;

package/dist/slugs.mjs

@@ -7,3 +7,7 @@ export function slugifyAscii(value) {
         .replace(/-+/g, '-')
         .replace(/^-|-$/g, '');
 }
+/** True for a non-empty string of lowercase ASCII letters, digits, and hyphens. */
+export function isSlug(value) {
+    return value.length > 0 && /^[a-z0-9-]+$/.test(value);
+}

package/dist/utm.d.mts

@@ -0,0 +1,16 @@
+export interface UtmParserOptions {
+    sourceAliases: Readonly<Record<string, string>>;
+    fallbackSourceParam?: string;
+}
+export interface ExtractedUtmParams {
+    utmSource: string | null;
+    utmMedium: string | null;
+    utmCampaign: string | null;
+    utmContent: string | null;
+}
+export interface UtmParser {
+    resolveSource(value: string): string;
+    extractFromUrl(url: URL): ExtractedUtmParams;
+}
+/** Creates a UTM parser whose source aliases and fallback param are caller-owned. */
+export declare function createUtmParser(options: UtmParserOptions): UtmParser;

package/dist/utm.mjs

@@ -0,0 +1,28 @@
+/** Creates a UTM parser whose source aliases and fallback param are caller-owned. */
+export function createUtmParser(options) {
+    const sourceAliases = {};
+    for (const [key, value] of Object.entries(options.sourceAliases)) {
+        sourceAliases[key.toLowerCase().trim()] = value.toLowerCase().trim();
+    }
+    const fallbackSourceParam = options.fallbackSourceParam;
+    function resolveSource(value) {
+        const lower = value.toLowerCase().trim();
+        return sourceAliases[lower] ?? lower;
+    }
+    return {
+        resolveSource,
+        extractFromUrl(url) {
+            const rawSource = url.searchParams.get('utm_source');
+            const fallback = fallbackSourceParam === undefined ? null : url.searchParams.get(fallbackSourceParam);
+            const normalizedSource = rawSource ? resolveSource(rawSource) || null : null;
+            const normalizedFallback = fallback ? resolveSource(fallback) || null : null;
+            const utmSource = normalizedSource ?? normalizedFallback;
+            return {
+                utmSource,
+                utmMedium: url.searchParams.get('utm_medium')?.toLowerCase().trim() || null,
+                utmCampaign: url.searchParams.get('utm_campaign')?.toLowerCase().trim() || null,
+                utmContent: url.searchParams.get('utm_content')?.toLowerCase().trim() || null,
+            };
+        },
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vouchington/utils",
-  "version": "0.4.1",
+  "version": "0.5.1",
   "description": "Dependency-free runtime utilities for Vouchington-style applications.",
   "homepage": "https://github.com/vouchington/vouchington-platform/tree/main/packages/utils#readme",
   "bugs": {
@@ -130,6 +130,11 @@
       "import": "./dist/validation.mjs",
       "default": "./dist/validation.mjs"
     },
+    "./moderation": {
+      "types": "./dist/moderation.d.mts",
+      "import": "./dist/moderation.mjs",
+      "default": "./dist/moderation.mjs"
+    },
     "./async": {
       "types": "./dist/async.d.mts",
       "import": "./dist/async.mjs",
@@ -150,6 +155,11 @@
       "import": "./dist/hashtags.mjs",
       "default": "./dist/hashtags.mjs"
     },
+    "./utm": {
+      "types": "./dist/utm.d.mts",
+      "import": "./dist/utm.mjs",
+      "default": "./dist/utm.mjs"
+    },
     "./fetch-ports": {
       "types": "./dist/fetch-ports.d.mts",
       "import": "./dist/fetch-ports.mjs",
@@ -164,16 +174,20 @@
       "types": "./dist/http-link-pagination.d.mts",
       "import": "./dist/http-link-pagination.mjs",
       "default": "./dist/http-link-pagination.mjs"
+    },
+    "./http-signatures": {
+      "types": "./dist/http-signatures.d.mts",
+      "import": "./dist/http-signatures.mjs",
+      "default": "./dist/http-signatures.mjs"
     }
   },
   "publishConfig": {
     "access": "public"
   },
-  "scripts": {
-    "build": "tsc --project tsconfig.build.json",
-    "prepack": "pnpm run build"
-  },
   "engines": {
     "node": ">=24.0.0"
+  },
+  "scripts": {
+    "build": "tsc --project tsconfig.build.json"
   }
-}
+}