dphelper 4.7.0 → 4.7.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/SECURITY-HARDENING.md +539 -0
- package/index.cjs +1 -1
- package/index.js +1 -1
- package/modules/ai.cjs +1 -1
- package/modules/ai.js +1 -1
- package/modules/anchor.cjs +1 -1
- package/modules/anchor.js +1 -1
- package/modules/array.cjs +1 -1
- package/modules/array.js +1 -1
- package/modules/audio.cjs +1 -1
- package/modules/audio.js +1 -1
- package/modules/avoid.cjs +1 -1
- package/modules/avoid.js +1 -1
- package/modules/biometric.cjs +1 -1
- package/modules/biometric.js +1 -1
- package/modules/browser.cjs +1 -1
- package/modules/browser.js +1 -1
- package/modules/check.cjs +1 -1
- package/modules/check.js +1 -1
- package/modules/color.cjs +1 -1
- package/modules/color.js +1 -1
- package/modules/compress.cjs +1 -1
- package/modules/compress.js +1 -1
- package/modules/cookie.cjs +1 -1
- package/modules/cookie.js +1 -1
- package/modules/coords.cjs +1 -1
- package/modules/coords.js +1 -1
- package/modules/credits.cjs +1 -1
- package/modules/credits.js +1 -1
- package/modules/date.cjs +1 -1
- package/modules/date.js +1 -1
- package/modules/disable.cjs +1 -1
- package/modules/disable.js +1 -1
- package/modules/dispatch.cjs +1 -1
- package/modules/dispatch.js +1 -1
- package/modules/elements.cjs +1 -1
- package/modules/elements.js +1 -1
- package/modules/events.cjs +1 -1
- package/modules/events.js +1 -1
- package/modules/fetch.cjs +1 -1
- package/modules/fetch.js +1 -1
- package/modules/form.cjs +1 -1
- package/modules/form.js +1 -1
- package/modules/format.cjs +1 -1
- package/modules/format.js +1 -1
- package/modules/i18n.cjs +1 -1
- package/modules/i18n.js +1 -1
- package/modules/image.cjs +1 -1
- package/modules/image.js +1 -1
- package/modules/json.cjs +1 -1
- package/modules/json.js +1 -1
- package/modules/load.cjs +1 -1
- package/modules/load.js +1 -1
- package/modules/logging.cjs +1 -1
- package/modules/logging.js +1 -1
- package/modules/math.cjs +1 -1
- package/modules/math.js +1 -1
- package/modules/memory.cjs +1 -1
- package/modules/memory.js +1 -1
- package/modules/navigation.cjs +1 -1
- package/modules/navigation.js +1 -1
- package/modules/net.cjs +1 -1
- package/modules/net.js +1 -1
- package/modules/objects.cjs +1 -1
- package/modules/objects.js +1 -1
- package/modules/path.cjs +1 -1
- package/modules/path.js +1 -1
- package/modules/promise.cjs +1 -1
- package/modules/promise.js +1 -1
- package/modules/sanitize.cjs +1 -1
- package/modules/sanitize.js +1 -1
- package/modules/screen.cjs +1 -1
- package/modules/screen.js +1 -1
- package/modules/scrollbar.cjs +1 -1
- package/modules/scrollbar.js +1 -1
- package/modules/security.cjs +1 -1
- package/modules/security.js +1 -1
- package/modules/shortcut.cjs +1 -1
- package/modules/shortcut.js +1 -1
- package/modules/socket.cjs +1 -1
- package/modules/socket.js +1 -1
- package/modules/sse.cjs +1 -1
- package/modules/sse.js +1 -1
- package/modules/svg.cjs +1 -1
- package/modules/svg.js +1 -1
- package/modules/sync.cjs +1 -1
- package/modules/sync.js +1 -1
- package/modules/system.cjs +1 -1
- package/modules/system.js +1 -1
- package/modules/text.cjs +1 -1
- package/modules/text.js +1 -1
- package/modules/timer.cjs +1 -1
- package/modules/timer.js +1 -1
- package/modules/tools.cjs +1 -1
- package/modules/tools.js +1 -1
- package/modules/translators.cjs +1 -1
- package/modules/translators.js +1 -1
- package/modules/triggers.cjs +1 -1
- package/modules/triggers.js +1 -1
- package/modules/types.cjs +1 -1
- package/modules/types.js +1 -1
- package/modules/ui.cjs +1 -1
- package/modules/ui.js +1 -1
- package/modules/window.cjs +1 -1
- package/modules/window.js +1 -1
- package/modules/worker.cjs +1 -1
- package/modules/worker.js +1 -1
- package/package.json +2 -2
- package/sbom.json +6 -6
|
@@ -0,0 +1,539 @@
|
|
|
1
|
+
# Security Hardening Guide
|
|
2
|
+
|
|
3
|
+
> **Security hardening and control-alignment guidance for dphelper**
|
|
4
|
+
|
|
5
|
+
This document describes the security-hardening practices, technical controls and operational measures associated with `dphelper`.
|
|
6
|
+
|
|
7
|
+
It also maps selected practices to relevant **NIST SP 800-53** control families.
|
|
8
|
+
|
|
9
|
+
> [!IMPORTANT]
|
|
10
|
+
> **Compliance statement**
|
|
11
|
+
>
|
|
12
|
+
> This document is an engineering **alignment checklist**, not a formal NIST SP 800-53 compliance certification, authorization, assessment or attestation.
|
|
13
|
+
>
|
|
14
|
+
> A complete NIST SP 800-53 assessment applies to the information system, organizational processes, operational environment and applicable control baseline—not to an npm package in isolation.
|
|
15
|
+
|
|
16
|
+
---
|
|
17
|
+
|
|
18
|
+
# 1. Security Model
|
|
19
|
+
|
|
20
|
+
`dphelper` is designed as a **stateless, zero-dependency capability toolkit**.
|
|
21
|
+
|
|
22
|
+
Security is therefore considered at multiple layers:
|
|
23
|
+
|
|
24
|
+
```text
|
|
25
|
+
┌──────────────────────────────────────────────┐
|
|
26
|
+
│ Application │
|
|
27
|
+
│ │
|
|
28
|
+
│ Authentication / Authorization / Logging │
|
|
29
|
+
├──────────────────────────────────────────────┤
|
|
30
|
+
│ dphelper │
|
|
31
|
+
│ │
|
|
32
|
+
│ Validation / Crypto / TLS / Workers / AI │
|
|
33
|
+
├──────────────────────────────────────────────┤
|
|
34
|
+
│ Runtime / Platform │
|
|
35
|
+
│ │
|
|
36
|
+
│ Browser / Node.js / Bun / Deno / OS │
|
|
37
|
+
├──────────────────────────────────────────────┤
|
|
38
|
+
│ Supply Chain │
|
|
39
|
+
│ │
|
|
40
|
+
│ npm / CI / Repository / Dependencies │
|
|
41
|
+
└──────────────────────────────────────────────┘
|
|
42
|
+
```
|
|
43
|
+
|
|
44
|
+
No single layer should be treated as a complete security boundary.
|
|
45
|
+
|
|
46
|
+
---
|
|
47
|
+
|
|
48
|
+
# 2. Security Principles
|
|
49
|
+
|
|
50
|
+
The project follows these general principles:
|
|
51
|
+
|
|
52
|
+
* Minimize runtime dependencies.
|
|
53
|
+
* Keep application state outside the core capability layer.
|
|
54
|
+
* Validate externally supplied input at trust boundaries.
|
|
55
|
+
* Prefer established cryptographic primitives.
|
|
56
|
+
* Avoid deprecated cryptographic algorithms.
|
|
57
|
+
* Use secure transport protocols where applicable.
|
|
58
|
+
* Treat executable worker code as trusted input.
|
|
59
|
+
* Separate application security from library functionality.
|
|
60
|
+
* Continuously scan the software supply chain.
|
|
61
|
+
* Document operational controls separately from library capabilities.
|
|
62
|
+
|
|
63
|
+
---
|
|
64
|
+
|
|
65
|
+
# 3. NIST SP 800-53 Alignment
|
|
66
|
+
|
|
67
|
+
The following checklist identifies selected controls relevant to the project's engineering and operational practices.
|
|
68
|
+
|
|
69
|
+
A checked item means that a corresponding technical or process measure exists within the scope described. It does **not** mean that the entire NIST control has been satisfied for every deployment.
|
|
70
|
+
|
|
71
|
+
---
|
|
72
|
+
|
|
73
|
+
## 3.1 Access Control (AC)
|
|
74
|
+
|
|
75
|
+
### AC-2 — Account Management
|
|
76
|
+
|
|
77
|
+
* [x] Repository and package publishing accounts are managed as controlled project resources.
|
|
78
|
+
* [ ] Formal organizational account lifecycle procedures are documented.
|
|
79
|
+
|
|
80
|
+
**Status:** Partial alignment.
|
|
81
|
+
|
|
82
|
+
Account-management requirements depend on the organization and deployment environment.
|
|
83
|
+
|
|
84
|
+
---
|
|
85
|
+
|
|
86
|
+
### AC-3 — Access Enforcement
|
|
87
|
+
|
|
88
|
+
* [x] Package runtime functionality does not require application-level accounts.
|
|
89
|
+
* [x] Application state and authorization responsibilities remain outside the stateless core.
|
|
90
|
+
* [ ] Application-specific authorization must be implemented by the consuming system.
|
|
91
|
+
|
|
92
|
+
**Status:** Context-dependent.
|
|
93
|
+
|
|
94
|
+
`dphelper` does not replace application authorization mechanisms.
|
|
95
|
+
|
|
96
|
+
---
|
|
97
|
+
|
|
98
|
+
### AC-7 — Unsuccessful Logon Attempts
|
|
99
|
+
|
|
100
|
+
* [ ] Application-level login throttling and lockout must be implemented by the consuming application.
|
|
101
|
+
* [x] Package publishing authentication is delegated to the npm ecosystem and configured project accounts.
|
|
102
|
+
|
|
103
|
+
**Status:** Application / operational control.
|
|
104
|
+
|
|
105
|
+
This control is not a property of the `dphelper` runtime library itself.
|
|
106
|
+
|
|
107
|
+
---
|
|
108
|
+
|
|
109
|
+
# 4. Audit and Accountability (AU)
|
|
110
|
+
|
|
111
|
+
## AU-2 — Event Logging
|
|
112
|
+
|
|
113
|
+
* [ ] Production applications should define security-relevant audit events.
|
|
114
|
+
* [ ] Authentication, authorization and security events should be logged by the application/backend where applicable.
|
|
115
|
+
|
|
116
|
+
**Status:** Deployment responsibility.
|
|
117
|
+
|
|
118
|
+
`dphelper` does not define a universal audit policy for consuming applications.
|
|
119
|
+
|
|
120
|
+
---
|
|
121
|
+
|
|
122
|
+
## AU-12 — Audit Record Generation
|
|
123
|
+
|
|
124
|
+
* [ ] Production systems should implement appropriate audit-record generation.
|
|
125
|
+
* [ ] Logging requirements should be defined according to the application's threat model and operational environment.
|
|
126
|
+
|
|
127
|
+
**Status:** Deployment responsibility.
|
|
128
|
+
|
|
129
|
+
---
|
|
130
|
+
|
|
131
|
+
# 5. Configuration Management (CM)
|
|
132
|
+
|
|
133
|
+
## CM-2 — Baseline Configuration
|
|
134
|
+
|
|
135
|
+
* [x] Project configuration is version-controlled.
|
|
136
|
+
* [x] Package configuration is defined through `package.json` and repository configuration.
|
|
137
|
+
* [x] Build and test configuration is maintained as project source.
|
|
138
|
+
|
|
139
|
+
**Status:** Engineering alignment.
|
|
140
|
+
|
|
141
|
+
---
|
|
142
|
+
|
|
143
|
+
## CM-6 — Configuration Settings
|
|
144
|
+
|
|
145
|
+
* [x] Security-sensitive configuration is explicitly defined.
|
|
146
|
+
* [x] Strict development and build checks are used where applicable.
|
|
147
|
+
* [x] Automated testing and linting are integrated into the development workflow.
|
|
148
|
+
|
|
149
|
+
**Status:** Engineering alignment.
|
|
150
|
+
|
|
151
|
+
---
|
|
152
|
+
|
|
153
|
+
# 6. Contingency Planning (CP)
|
|
154
|
+
|
|
155
|
+
## CP-2 — Contingency Plan
|
|
156
|
+
|
|
157
|
+
* [ ] Document a formal project/application contingency plan.
|
|
158
|
+
* [ ] Define recovery responsibilities and escalation procedures.
|
|
159
|
+
|
|
160
|
+
**Status:** Open.
|
|
161
|
+
|
|
162
|
+
---
|
|
163
|
+
|
|
164
|
+
## CP-9 — System Backup
|
|
165
|
+
|
|
166
|
+
* [ ] Define and test backup procedures for critical project infrastructure.
|
|
167
|
+
* [ ] Define recovery objectives for repositories, package publishing and supporting services.
|
|
168
|
+
|
|
169
|
+
**Status:** Open.
|
|
170
|
+
|
|
171
|
+
> [!NOTE]
|
|
172
|
+
> Backup and disaster-recovery requirements belong primarily to the operational environment rather than the npm package itself.
|
|
173
|
+
|
|
174
|
+
---
|
|
175
|
+
|
|
176
|
+
# 7. Identification and Authentication (IA)
|
|
177
|
+
|
|
178
|
+
## IA-2 — Identification and Authentication
|
|
179
|
+
|
|
180
|
+
* [ ] Production applications must implement appropriate authentication.
|
|
181
|
+
* [x] Project publishing infrastructure supports authenticated package publishing.
|
|
182
|
+
* [ ] MFA should be enabled on privileged project and package-management accounts.
|
|
183
|
+
|
|
184
|
+
**Status:** Partial / operational.
|
|
185
|
+
|
|
186
|
+
Authentication of application users is outside the scope of `dphelper`.
|
|
187
|
+
|
|
188
|
+
---
|
|
189
|
+
|
|
190
|
+
## IA-5 — Authenticator Management
|
|
191
|
+
|
|
192
|
+
* [x] Package authentication is delegated to the package ecosystem and account infrastructure.
|
|
193
|
+
* [ ] Privileged project accounts should use strong authentication and MFA.
|
|
194
|
+
* [ ] Credentials and tokens must never be committed to the repository.
|
|
195
|
+
|
|
196
|
+
**Status:** Partial / operational.
|
|
197
|
+
|
|
198
|
+
---
|
|
199
|
+
|
|
200
|
+
# 8. System and Communications Protection (SC)
|
|
201
|
+
|
|
202
|
+
## SC-8 — Transmission and Confidentiality
|
|
203
|
+
|
|
204
|
+
Where network communication is required:
|
|
205
|
+
|
|
206
|
+
* [x] Secure WebSocket connections use `wss://`.
|
|
207
|
+
* [x] HTTPS is supported for secure HTTP-based communication.
|
|
208
|
+
* [x] Applications are expected to use secure transport for sensitive data.
|
|
209
|
+
|
|
210
|
+
**Status:** Technical alignment.
|
|
211
|
+
|
|
212
|
+
> [!IMPORTANT]
|
|
213
|
+
> Transport security does not guarantee application-level security. Applications must still validate endpoints, authentication, authorization and transmitted data.
|
|
214
|
+
|
|
215
|
+
---
|
|
216
|
+
|
|
217
|
+
## SC-12 — Cryptographic Key Establishment and Management
|
|
218
|
+
|
|
219
|
+
`dphelper` provides cryptographic capabilities based on established primitives, including:
|
|
220
|
+
|
|
221
|
+
* AES-256-GCM
|
|
222
|
+
* SHA-256
|
|
223
|
+
* PBKDF2
|
|
224
|
+
* PBKDF2 configurations using 310,000 iterations where applicable
|
|
225
|
+
|
|
226
|
+
**Status:** Technical alignment.
|
|
227
|
+
|
|
228
|
+
The security of a cryptographic system also depends on key generation, storage, rotation, lifecycle management and usage context.
|
|
229
|
+
|
|
230
|
+
---
|
|
231
|
+
|
|
232
|
+
# 9. Cryptographic Guidance
|
|
233
|
+
|
|
234
|
+
## Approved / Preferred Primitives
|
|
235
|
+
|
|
236
|
+
Where cryptography is required, prefer established algorithms and constructions.
|
|
237
|
+
|
|
238
|
+
### Symmetric Encryption
|
|
239
|
+
|
|
240
|
+
```text
|
|
241
|
+
AES-256-GCM
|
|
242
|
+
```
|
|
243
|
+
|
|
244
|
+
Provides authenticated encryption when correctly used with unique nonces and appropriate key management.
|
|
245
|
+
|
|
246
|
+
### Hashing
|
|
247
|
+
|
|
248
|
+
```text
|
|
249
|
+
SHA-256
|
|
250
|
+
```
|
|
251
|
+
|
|
252
|
+
Do not use SHA-1 for new security-sensitive functionality.
|
|
253
|
+
|
|
254
|
+
### Password-Based Key Derivation
|
|
255
|
+
|
|
256
|
+
```text
|
|
257
|
+
PBKDF2
|
|
258
|
+
```
|
|
259
|
+
|
|
260
|
+
Where password-derived keys are required, use an appropriate iteration count and cryptographic configuration for the application's security requirements.
|
|
261
|
+
|
|
262
|
+
> [!WARNING]
|
|
263
|
+
> Algorithm selection alone does not constitute cryptographic compliance. Secure nonce generation, key storage, key lifecycle management and correct protocol construction are equally important.
|
|
264
|
+
|
|
265
|
+
---
|
|
266
|
+
|
|
267
|
+
# 10. Network Security
|
|
268
|
+
|
|
269
|
+
Network-facing capabilities include:
|
|
270
|
+
|
|
271
|
+
```text
|
|
272
|
+
dphelper.fetch
|
|
273
|
+
dphelper.sse
|
|
274
|
+
dphelper.socket
|
|
275
|
+
```
|
|
276
|
+
|
|
277
|
+
Applications should treat externally supplied URLs and network parameters as untrusted input.
|
|
278
|
+
|
|
279
|
+
Preferred pattern:
|
|
280
|
+
|
|
281
|
+
```javascript
|
|
282
|
+
const safeUrl = dphelper.sanitize.url(userInput);
|
|
283
|
+
|
|
284
|
+
await dphelper.fetch.get(safeUrl);
|
|
285
|
+
```
|
|
286
|
+
|
|
287
|
+
Avoid:
|
|
288
|
+
|
|
289
|
+
```javascript
|
|
290
|
+
await dphelper.fetch.get(userInput);
|
|
291
|
+
```
|
|
292
|
+
|
|
293
|
+
URL sanitization does not replace:
|
|
294
|
+
|
|
295
|
+
* Authentication
|
|
296
|
+
* Authorization
|
|
297
|
+
* SSRF protection
|
|
298
|
+
* DNS/IP policy
|
|
299
|
+
* Certificate validation
|
|
300
|
+
* Application-level access controls
|
|
301
|
+
* Server-side validation
|
|
302
|
+
|
|
303
|
+
The consuming application remains responsible for these controls.
|
|
304
|
+
|
|
305
|
+
---
|
|
306
|
+
|
|
307
|
+
# 11. Web Worker Security
|
|
308
|
+
|
|
309
|
+
Worker APIs can execute JavaScript supplied by the caller.
|
|
310
|
+
|
|
311
|
+
Examples include:
|
|
312
|
+
|
|
313
|
+
```javascript
|
|
314
|
+
dphelper.worker.createInline(code);
|
|
315
|
+
dphelper.worker.create(src);
|
|
316
|
+
dphelper.worker.pool(src);
|
|
317
|
+
dphelper.worker.importScripts(worker, scripts);
|
|
318
|
+
```
|
|
319
|
+
|
|
320
|
+
Therefore:
|
|
321
|
+
|
|
322
|
+
> **Worker code and worker sources must be treated as trusted input.**
|
|
323
|
+
|
|
324
|
+
Never pass arbitrary user-controlled code directly to worker creation APIs.
|
|
325
|
+
|
|
326
|
+
Preferred:
|
|
327
|
+
|
|
328
|
+
```javascript
|
|
329
|
+
dphelper.worker.create(
|
|
330
|
+
"./my-trusted-worker.js"
|
|
331
|
+
);
|
|
332
|
+
```
|
|
333
|
+
|
|
334
|
+
Not:
|
|
335
|
+
|
|
336
|
+
```javascript
|
|
337
|
+
dphelper.worker.createInline(
|
|
338
|
+
userSuppliedCode
|
|
339
|
+
);
|
|
340
|
+
```
|
|
341
|
+
|
|
342
|
+
Worker URLs and imported scripts should also originate from trusted sources.
|
|
343
|
+
|
|
344
|
+
---
|
|
345
|
+
|
|
346
|
+
# 12. Browser Security
|
|
347
|
+
|
|
348
|
+
Applications using browser capabilities should additionally consider:
|
|
349
|
+
|
|
350
|
+
* Content Security Policy
|
|
351
|
+
* Trusted Types where appropriate
|
|
352
|
+
* Same-Origin Policy
|
|
353
|
+
* CORS configuration
|
|
354
|
+
* Secure cookies
|
|
355
|
+
* CSRF protection
|
|
356
|
+
* XSS prevention
|
|
357
|
+
* Input/output encoding
|
|
358
|
+
* Secure storage of credentials and tokens
|
|
359
|
+
|
|
360
|
+
`dphelper` capabilities should not be interpreted as a replacement for browser security controls.
|
|
361
|
+
|
|
362
|
+
---
|
|
363
|
+
|
|
364
|
+
# 13. AI Security
|
|
365
|
+
|
|
366
|
+
AI-oriented functionality introduces additional trust boundaries.
|
|
367
|
+
|
|
368
|
+
Capabilities such as:
|
|
369
|
+
|
|
370
|
+
```text
|
|
371
|
+
dphelper.ai.toon()
|
|
372
|
+
dphelper.ai.tokenCount()
|
|
373
|
+
dphelper.ai.chunker()
|
|
374
|
+
dphelper.ai.snapshot()
|
|
375
|
+
dphelper.ai.extractReasoning()
|
|
376
|
+
```
|
|
377
|
+
|
|
378
|
+
may process application data intended for AI systems.
|
|
379
|
+
|
|
380
|
+
Applications should therefore consider:
|
|
381
|
+
|
|
382
|
+
* Sensitive-data disclosure
|
|
383
|
+
* Prompt injection
|
|
384
|
+
* Data exfiltration
|
|
385
|
+
* Untrusted retrieved content
|
|
386
|
+
* Excessive context exposure
|
|
387
|
+
* Logging of confidential prompts
|
|
388
|
+
* Model-provider data policies
|
|
389
|
+
* Tool invocation boundaries
|
|
390
|
+
|
|
391
|
+
In particular, `dphelper.ai.snapshot()` should only expose runtime information that the application is permitted to send to the selected AI system.
|
|
392
|
+
|
|
393
|
+
> [!IMPORTANT]
|
|
394
|
+
> Compact representation is not a security boundary. Reducing data size does not automatically remove sensitive information.
|
|
395
|
+
|
|
396
|
+
---
|
|
397
|
+
|
|
398
|
+
# 14. Supply-Chain Security
|
|
399
|
+
|
|
400
|
+
`dphelper` is intentionally designed with zero runtime dependencies.
|
|
401
|
+
|
|
402
|
+
This reduces the runtime dependency surface but does not eliminate supply-chain risk.
|
|
403
|
+
|
|
404
|
+
The project should continuously monitor:
|
|
405
|
+
|
|
406
|
+
* Source repository integrity
|
|
407
|
+
* npm publishing credentials
|
|
408
|
+
* Package provenance
|
|
409
|
+
* CI/CD permissions
|
|
410
|
+
* Development dependencies
|
|
411
|
+
* Build tooling
|
|
412
|
+
* Release artifacts
|
|
413
|
+
* Package contents
|
|
414
|
+
|
|
415
|
+
---
|
|
416
|
+
|
|
417
|
+
# 15. Automated Security Scanning
|
|
418
|
+
|
|
419
|
+
Security scanning should be executed continuously as part of the development lifecycle.
|
|
420
|
+
|
|
421
|
+
Recommended checks include:
|
|
422
|
+
|
|
423
|
+
```text
|
|
424
|
+
Dependency analysis
|
|
425
|
+
Static analysis
|
|
426
|
+
Package inspection
|
|
427
|
+
Secret detection
|
|
428
|
+
Supply-chain analysis
|
|
429
|
+
Test suite
|
|
430
|
+
Linting
|
|
431
|
+
Build verification
|
|
432
|
+
```
|
|
433
|
+
|
|
434
|
+
Where Socket is used:
|
|
435
|
+
|
|
436
|
+
```shell
|
|
437
|
+
npx socket-dev scan .
|
|
438
|
+
```
|
|
439
|
+
|
|
440
|
+
Socket results should be treated as **security-monitoring evidence**, not as a formal compliance certification.
|
|
441
|
+
|
|
442
|
+
---
|
|
443
|
+
|
|
444
|
+
# 16. Security Development Checklist
|
|
445
|
+
|
|
446
|
+
Before publishing a release:
|
|
447
|
+
|
|
448
|
+
* [ ] Tests pass.
|
|
449
|
+
* [ ] Build succeeds.
|
|
450
|
+
* [ ] Linting succeeds.
|
|
451
|
+
* [ ] Security scanning succeeds.
|
|
452
|
+
* [ ] No secrets are present in the package.
|
|
453
|
+
* [ ] Package contents have been inspected.
|
|
454
|
+
* [ ] Public API changes have been reviewed.
|
|
455
|
+
* [ ] Security-sensitive changes have been reviewed.
|
|
456
|
+
* [ ] Publishing credentials are protected with MFA.
|
|
457
|
+
* [ ] Release provenance has been verified.
|
|
458
|
+
|
|
459
|
+
---
|
|
460
|
+
|
|
461
|
+
# 17. Operational Hardening Checklist
|
|
462
|
+
|
|
463
|
+
For project infrastructure:
|
|
464
|
+
|
|
465
|
+
* [ ] Enable MFA on privileged accounts.
|
|
466
|
+
* [ ] Use strong, unique credentials.
|
|
467
|
+
* [ ] Protect npm publishing credentials.
|
|
468
|
+
* [ ] Restrict CI/CD permissions.
|
|
469
|
+
* [ ] Review repository access regularly.
|
|
470
|
+
* [ ] Enable appropriate audit logging.
|
|
471
|
+
* [ ] Maintain backup procedures.
|
|
472
|
+
* [ ] Maintain disaster-recovery documentation.
|
|
473
|
+
* [ ] Test recovery procedures periodically.
|
|
474
|
+
|
|
475
|
+
---
|
|
476
|
+
|
|
477
|
+
# 18. Open Security Actions
|
|
478
|
+
|
|
479
|
+
The following actions remain intentionally open:
|
|
480
|
+
|
|
481
|
+
1. Define production audit logging requirements.
|
|
482
|
+
2. Define and document the project contingency plan.
|
|
483
|
+
3. Define backup and disaster-recovery procedures.
|
|
484
|
+
4. Enable and verify MFA on privileged publishing accounts.
|
|
485
|
+
5. Establish continuous supply-chain monitoring.
|
|
486
|
+
6. Review security-sensitive capabilities periodically.
|
|
487
|
+
7. Maintain security documentation as the architecture evolves.
|
|
488
|
+
|
|
489
|
+
---
|
|
490
|
+
|
|
491
|
+
# 19. Security Position
|
|
492
|
+
|
|
493
|
+
`dphelper` is designed with security-conscious engineering practices, established cryptographic primitives, minimal runtime dependencies and automated security testing.
|
|
494
|
+
|
|
495
|
+
However:
|
|
496
|
+
|
|
497
|
+
> **`dphelper` is not a security certification, compliance framework or replacement for application security engineering.**
|
|
498
|
+
|
|
499
|
+
Security ultimately depends on the interaction between:
|
|
500
|
+
|
|
501
|
+
```text
|
|
502
|
+
dphelper
|
|
503
|
+
+
|
|
504
|
+
Application
|
|
505
|
+
+
|
|
506
|
+
Runtime
|
|
507
|
+
+
|
|
508
|
+
Infrastructure
|
|
509
|
+
+
|
|
510
|
+
Operational Controls
|
|
511
|
+
```
|
|
512
|
+
|
|
513
|
+
A secure library can provide secure primitives and safer defaults.
|
|
514
|
+
|
|
515
|
+
It cannot make an insecure application secure by itself.
|
|
516
|
+
|
|
517
|
+
---
|
|
518
|
+
|
|
519
|
+
# 20. Summary
|
|
520
|
+
|
|
521
|
+
```text
|
|
522
|
+
SECURITY
|
|
523
|
+
│
|
|
524
|
+
┌──────────────┼──────────────┐
|
|
525
|
+
│ │ │
|
|
526
|
+
Technical Application Operations
|
|
527
|
+
│ │ │
|
|
528
|
+
Crypto / TLS Auth / Input MFA / Audit
|
|
529
|
+
Workers Authorization Backup
|
|
530
|
+
Validation Logging Recovery
|
|
531
|
+
│ │ │
|
|
532
|
+
└──────────────┼──────────────┘
|
|
533
|
+
│
|
|
534
|
+
dphelper
|
|
535
|
+
```
|
|
536
|
+
|
|
537
|
+
**Security is a system property, not a package property.**
|
|
538
|
+
|
|
539
|
+
`dphelper` provides security-oriented capabilities and engineering controls that can contribute to a secure system when correctly integrated and operated.
|
package/index.cjs
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
'use strict';var V={info:{title:"List",description:"Complete list of tools"},categories:["3party","system","financial","memory","numbers","time","path","file","forms","ui","other","development"]};var x={codeName:"dphelper",version:"4.7.
|
|
1
|
+
'use strict';var V={info:{title:"List",description:"Complete list of tools"},categories:["3party","system","financial","memory","numbers","time","path","file","forms","ui","other","development"]};var x={codeName:"dphelper",version:"4.7.1"};Object.defineProperty(globalThis,"dphelper",{value:new Proxy({},{}),writable:true,configurable:true,enumerable:false});Object.defineProperties(dphelper,{_list:{value:{scripts:[],sockets:[],...V},configurable:true,writable:true},version:{value:x.version,configurable:true,writable:true},isServer:{value:false,configurable:true,writable:true},isBrowser:{value:true,configurable:true,writable:true}});var P=dphelper;Object.defineProperty(P,"setProps",{value:(e,t,r)=>{Object.defineProperty(e,t.name,r||{writable:false,configurable:false,enumerable:false}),r?.lock&&Object.freeze(e[t.name]);},writable:false,configurable:false,enumerable:false});Object.defineProperty(P,"setDescription",{value:(e,t)=>{Object.defineProperties(P,{[e.name]:{value:t,writable:false,configurable:false,enumerable:false}}),Object.keys(t).map(r=>(Object.defineProperties(P[e.name],{[r]:{writable:false,configurable:false,enumerable:false}}),null)),P.setProps(P,e,{writable:false,configurable:false,enumerable:false}),P._list.scripts.push(e);}});var ue={name:"ai",active:true,subCommand:[{name:"tokenCount",version:"0.0.3",example:"dphelper.ai.tokenCount({ users: [1,2,3] })",author:"Dario Passariello",creationDate:"20260220",lastMod:"20260221",type:"function",active:true,description:"Estimate token count for LLMs. If an object is passed, it uses TOON format for calculation.",env:"both",subCommand:[]},{name:"smartSanitize",version:"0.0.2",example:"dphelper.ai.smartSanitize('My email is test@example.com')",author:"Dario Passariello & Jo",creationDate:"20260220",lastMod:"20260220",type:"function",active:true,description:"Remove PII (emails, phones, etc) from text for AI privacy",subCommand:[]},{name:"toon",version:"0.0.1",example:"dphelper.ai.toon({ users: [{id: 1, name: 'Ada'}] })",author:"TOON + Dario Passariello",creationDate:"20260221",lastMod:"20260221",type:"function",active:true,description:"Convert JSON to TOON format (Token-Oriented Object Notation)",subCommand:[]},{name:"toonToJson",version:"0.0.1",example:"dphelper.ai.toonToJson('users[1]{id,name}:\\n 1,Ada')",author:"Dario Passariello",creationDate:"20260221",lastMod:"20260221",type:"function",active:true,description:"Convert TOON format back to JSON/Object",subCommand:[]},{name:"chunker",version:"0.0.1",example:"dphelper.ai.chunker(text, { size: 1000, overlap: 200 })",author:"Dario Passariello",creationDate:"20260221",lastMod:"20260221",type:"function",active:true,description:"Split long text into chunks for RAG or AI processing.",subCommand:[]},{name:"similarity",version:"0.0.1",example:"dphelper.ai.similarity(vecA, vecB)",author:"Dario Passariello",creationDate:"20260221",lastMod:"20260221",type:"function",active:true,description:"Calculate cosine similarity between two embedding vectors.",subCommand:[]},{name:"extractReasoning",version:"0.0.1",example:"dphelper.ai.extractReasoning(aiResponse)",author:"Dario Passariello",creationDate:"20260221",lastMod:"20260221",type:"function",active:true,description:"Extract <think> tags or internal reasoning from AI responses.",subCommand:[]},{name:"prompt",version:"0.0.1",example:"dphelper.ai.prompt('Hello {{name}}', { name: 'Ada' })",author:"Dario Passariello",creationDate:"20260221",lastMod:"20260221",type:"function",active:true,description:"Simple prompt template engine with variable injection.",subCommand:[]},{name:"schema",version:"0.0.1",example:"dphelper.ai.schema({ id: 1, name: 'Ada' })",author:"Dario Passariello",creationDate:"20260221",lastMod:"20260221",type:"function",active:true,description:"Generate a TOON-style schema definition for AI instructions.",subCommand:[]},{name:"snapshot",version:"0.0.1",example:"dphelper.ai.snapshot()",author:"Dario Passariello",creationDate:"20260221",lastMod:"20260221",type:"function",active:true,description:"Capture a 'mental snapshot' of the app state (logs/globals) in TOON format for AI debugging.",env:"both",subCommand:[]}]},B=e=>e===null||typeof e!="object",H=e=>e===null?"null":typeof e=="string"?e.includes(",")||e.includes(":")||e.includes('"')||e.includes(`
|
|
2
2
|
`)||e.trim()!==e?`"${e.replace(/"/g,'\\"')}"`:e||'""':String(e),N=(e,t=0)=>{let r=" ".repeat(t);if(B(e))return H(e);if(Array.isArray(e)){if(e.length===0)return "[0]:";let n=e[0];if(!B(n)&&!Array.isArray(n)){let o=Object.keys(n),a=`[${e.length}]{${o.join(",")}}:`;for(let i of e){let s=o.map(l=>H(i[l])).join(",");a+=`
|
|
3
3
|
${r} ${s}`;}return a}else return `[${e.length}]: `+e.map(H).join(",")}else return Object.entries(e).map(([n,o])=>{let a=n.includes(" ")||n.includes(":")?`"${n}"`:n;if(!B(o)){let i=N(o,t+1);return i.startsWith("[")?`${a}${i}`:`${a}:
|
|
4
4
|
${r}${i}`}return `${a}: ${H(o)}`}).join(`
|
package/index.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
var K={info:{title:"List",description:"Complete list of tools"},categories:["3party","system","financial","memory","numbers","time","path","file","forms","ui","other","development"]};var C={codeName:"dphelper",version:"4.7.
|
|
1
|
+
var K={info:{title:"List",description:"Complete list of tools"},categories:["3party","system","financial","memory","numbers","time","path","file","forms","ui","other","development"]};var C={codeName:"dphelper",version:"4.7.1"};Object.defineProperty(globalThis,"dphelper",{value:new Proxy({},{}),writable:true,configurable:true,enumerable:false});Object.defineProperties(dphelper,{_list:{value:{scripts:[],sockets:[],...K},configurable:true,writable:true},version:{value:C.version,configurable:true,writable:true},isServer:{value:false,configurable:true,writable:true},isBrowser:{value:true,configurable:true,writable:true}});var k=dphelper;Object.defineProperty(k,"setProps",{value:(e,t,r)=>{Object.defineProperty(e,t.name,r||{writable:false,configurable:false,enumerable:false}),r?.lock&&Object.freeze(e[t.name]);},writable:false,configurable:false,enumerable:false});Object.defineProperty(k,"setDescription",{value:(e,t)=>{Object.defineProperties(k,{[e.name]:{value:t,writable:false,configurable:false,enumerable:false}}),Object.keys(t).map(r=>(Object.defineProperties(k[e.name],{[r]:{writable:false,configurable:false,enumerable:false}}),null)),k.setProps(k,e,{writable:false,configurable:false,enumerable:false}),k._list.scripts.push(e);}});var pe={name:"ai",active:true,subCommand:[{name:"tokenCount",version:"0.0.3",example:"dphelper.ai.tokenCount({ users: [1,2,3] })",author:"Dario Passariello",creationDate:"20260220",lastMod:"20260221",type:"function",active:true,description:"Estimate token count for LLMs. If an object is passed, it uses TOON format for calculation.",env:"both",subCommand:[]},{name:"smartSanitize",version:"0.0.2",example:"dphelper.ai.smartSanitize('My email is test@example.com')",author:"Dario Passariello & Jo",creationDate:"20260220",lastMod:"20260220",type:"function",active:true,description:"Remove PII (emails, phones, etc) from text for AI privacy",subCommand:[]},{name:"toon",version:"0.0.1",example:"dphelper.ai.toon({ users: [{id: 1, name: 'Ada'}] })",author:"TOON + Dario Passariello",creationDate:"20260221",lastMod:"20260221",type:"function",active:true,description:"Convert JSON to TOON format (Token-Oriented Object Notation)",subCommand:[]},{name:"toonToJson",version:"0.0.1",example:"dphelper.ai.toonToJson('users[1]{id,name}:\\n 1,Ada')",author:"Dario Passariello",creationDate:"20260221",lastMod:"20260221",type:"function",active:true,description:"Convert TOON format back to JSON/Object",subCommand:[]},{name:"chunker",version:"0.0.1",example:"dphelper.ai.chunker(text, { size: 1000, overlap: 200 })",author:"Dario Passariello",creationDate:"20260221",lastMod:"20260221",type:"function",active:true,description:"Split long text into chunks for RAG or AI processing.",subCommand:[]},{name:"similarity",version:"0.0.1",example:"dphelper.ai.similarity(vecA, vecB)",author:"Dario Passariello",creationDate:"20260221",lastMod:"20260221",type:"function",active:true,description:"Calculate cosine similarity between two embedding vectors.",subCommand:[]},{name:"extractReasoning",version:"0.0.1",example:"dphelper.ai.extractReasoning(aiResponse)",author:"Dario Passariello",creationDate:"20260221",lastMod:"20260221",type:"function",active:true,description:"Extract <think> tags or internal reasoning from AI responses.",subCommand:[]},{name:"prompt",version:"0.0.1",example:"dphelper.ai.prompt('Hello {{name}}', { name: 'Ada' })",author:"Dario Passariello",creationDate:"20260221",lastMod:"20260221",type:"function",active:true,description:"Simple prompt template engine with variable injection.",subCommand:[]},{name:"schema",version:"0.0.1",example:"dphelper.ai.schema({ id: 1, name: 'Ada' })",author:"Dario Passariello",creationDate:"20260221",lastMod:"20260221",type:"function",active:true,description:"Generate a TOON-style schema definition for AI instructions.",subCommand:[]},{name:"snapshot",version:"0.0.1",example:"dphelper.ai.snapshot()",author:"Dario Passariello",creationDate:"20260221",lastMod:"20260221",type:"function",active:true,description:"Capture a 'mental snapshot' of the app state (logs/globals) in TOON format for AI debugging.",env:"both",subCommand:[]}]},W=e=>e===null||typeof e!="object",U=e=>e===null?"null":typeof e=="string"?e.includes(",")||e.includes(":")||e.includes('"')||e.includes(`
|
|
2
2
|
`)||e.trim()!==e?`"${e.replace(/"/g,'\\"')}"`:e||'""':String(e),$=(e,t=0)=>{let r=" ".repeat(t);if(W(e))return U(e);if(Array.isArray(e)){if(e.length===0)return "[0]:";let n=e[0];if(!W(n)&&!Array.isArray(n)){let o=Object.keys(n),a=`[${e.length}]{${o.join(",")}}:`;for(let i of e){let s=o.map(l=>U(i[l])).join(",");a+=`
|
|
3
3
|
${r} ${s}`;}return a}else return `[${e.length}]: `+e.map(U).join(",")}else return Object.entries(e).map(([n,o])=>{let a=n.includes(" ")||n.includes(":")?`"${n}"`:n;if(!W(o)){let i=$(o,t+1);return i.startsWith("[")?`${a}${i}`:`${a}:
|
|
4
4
|
${r}${i}`}return `${a}: ${U(o)}`}).join(`
|
package/modules/ai.cjs
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
'use strict';var P={info:{title:"List",description:"Complete list of tools"},categories:["3party","system","financial","memory","numbers","time","path","file","forms","ui","other","development"]};var v={version:"4.7.
|
|
1
|
+
'use strict';var P={info:{title:"List",description:"Complete list of tools"},categories:["3party","system","financial","memory","numbers","time","path","file","forms","ui","other","development"]};var v={version:"4.7.1"};Object.defineProperty(globalThis,"dphelper",{value:new Proxy({},{}),writable:true,configurable:true,enumerable:false});Object.defineProperties(dphelper,{_list:{value:{scripts:[],sockets:[],...P},configurable:true,writable:true},version:{value:v.version,configurable:true,writable:true},isServer:{value:false,configurable:true,writable:true},isBrowser:{value:true,configurable:true,writable:true}});var f=dphelper;Object.defineProperty(f,"setProps",{value:(e,t,r)=>{Object.defineProperty(e,t.name,r||{writable:false,configurable:false,enumerable:false}),r?.lock&&Object.freeze(e[t.name]);},writable:false,configurable:false,enumerable:false});Object.defineProperty(f,"setDescription",{value:(e,t)=>{Object.defineProperties(f,{[e.name]:{value:t,writable:false,configurable:false,enumerable:false}}),Object.keys(t).map(r=>(Object.defineProperties(f[e.name],{[r]:{writable:false,configurable:false,enumerable:false}}),null)),f.setProps(f,e,{writable:false,configurable:false,enumerable:false}),f._list.scripts.push(e);}});var M={name:"ai",active:true,subCommand:[{name:"tokenCount",version:"0.0.3",example:"dphelper.ai.tokenCount({ users: [1,2,3] })",author:"Dario Passariello",creationDate:"20260220",lastMod:"20260221",type:"function",active:true,description:"Estimate token count for LLMs. If an object is passed, it uses TOON format for calculation.",env:"both",subCommand:[]},{name:"smartSanitize",version:"0.0.2",example:"dphelper.ai.smartSanitize('My email is test@example.com')",author:"Dario Passariello & Jo",creationDate:"20260220",lastMod:"20260220",type:"function",active:true,description:"Remove PII (emails, phones, etc) from text for AI privacy",subCommand:[]},{name:"toon",version:"0.0.1",example:"dphelper.ai.toon({ users: [{id: 1, name: 'Ada'}] })",author:"TOON + Dario Passariello",creationDate:"20260221",lastMod:"20260221",type:"function",active:true,description:"Convert JSON to TOON format (Token-Oriented Object Notation)",subCommand:[]},{name:"toonToJson",version:"0.0.1",example:"dphelper.ai.toonToJson('users[1]{id,name}:\\n 1,Ada')",author:"Dario Passariello",creationDate:"20260221",lastMod:"20260221",type:"function",active:true,description:"Convert TOON format back to JSON/Object",subCommand:[]},{name:"chunker",version:"0.0.1",example:"dphelper.ai.chunker(text, { size: 1000, overlap: 200 })",author:"Dario Passariello",creationDate:"20260221",lastMod:"20260221",type:"function",active:true,description:"Split long text into chunks for RAG or AI processing.",subCommand:[]},{name:"similarity",version:"0.0.1",example:"dphelper.ai.similarity(vecA, vecB)",author:"Dario Passariello",creationDate:"20260221",lastMod:"20260221",type:"function",active:true,description:"Calculate cosine similarity between two embedding vectors.",subCommand:[]},{name:"extractReasoning",version:"0.0.1",example:"dphelper.ai.extractReasoning(aiResponse)",author:"Dario Passariello",creationDate:"20260221",lastMod:"20260221",type:"function",active:true,description:"Extract <think> tags or internal reasoning from AI responses.",subCommand:[]},{name:"prompt",version:"0.0.1",example:"dphelper.ai.prompt('Hello {{name}}', { name: 'Ada' })",author:"Dario Passariello",creationDate:"20260221",lastMod:"20260221",type:"function",active:true,description:"Simple prompt template engine with variable injection.",subCommand:[]},{name:"schema",version:"0.0.1",example:"dphelper.ai.schema({ id: 1, name: 'Ada' })",author:"Dario Passariello",creationDate:"20260221",lastMod:"20260221",type:"function",active:true,description:"Generate a TOON-style schema definition for AI instructions.",subCommand:[]},{name:"snapshot",version:"0.0.1",example:"dphelper.ai.snapshot()",author:"Dario Passariello",creationDate:"20260221",lastMod:"20260221",type:"function",active:true,description:"Capture a 'mental snapshot' of the app state (logs/globals) in TOON format for AI debugging.",env:"both",subCommand:[]}]},x=e=>e===null||typeof e!="object",O=e=>e===null?"null":typeof e=="string"?e.includes(",")||e.includes(":")||e.includes('"')||e.includes(`
|
|
2
2
|
`)||e.trim()!==e?`"${e.replace(/"/g,'\\"')}"`:e||'""':String(e),b=(e,t=0)=>{let r=" ".repeat(t);if(x(e))return O(e);if(Array.isArray(e)){if(e.length===0)return "[0]:";let n=e[0];if(!x(n)&&!Array.isArray(n)){let s=Object.keys(n),o=`[${e.length}]{${s.join(",")}}:`;for(let i of e){let u=s.map(a=>O(i[a])).join(",");o+=`
|
|
3
3
|
${r} ${u}`;}return o}else return `[${e.length}]: `+e.map(O).join(",")}else return Object.entries(e).map(([n,s])=>{let o=n.includes(" ")||n.includes(":")?`"${n}"`:n;if(!x(s)){let i=b(s,t+1);return i.startsWith("[")?`${o}${i}`:`${o}:
|
|
4
4
|
${r}${i}`}return `${o}: ${O(s)}`}).join(`
|
package/modules/ai.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
var v={info:{title:"List",description:"Complete list of tools"},categories:["3party","system","financial","memory","numbers","time","path","file","forms","ui","other","development"]};var $={version:"4.7.
|
|
1
|
+
var v={info:{title:"List",description:"Complete list of tools"},categories:["3party","system","financial","memory","numbers","time","path","file","forms","ui","other","development"]};var $={version:"4.7.1"};Object.defineProperty(globalThis,"dphelper",{value:new Proxy({},{}),writable:true,configurable:true,enumerable:false});Object.defineProperties(dphelper,{_list:{value:{scripts:[],sockets:[],...v},configurable:true,writable:true},version:{value:$.version,configurable:true,writable:true},isServer:{value:false,configurable:true,writable:true},isBrowser:{value:true,configurable:true,writable:true}});var f=dphelper;Object.defineProperty(f,"setProps",{value:(e,t,r)=>{Object.defineProperty(e,t.name,r||{writable:false,configurable:false,enumerable:false}),r?.lock&&Object.freeze(e[t.name]);},writable:false,configurable:false,enumerable:false});Object.defineProperty(f,"setDescription",{value:(e,t)=>{Object.defineProperties(f,{[e.name]:{value:t,writable:false,configurable:false,enumerable:false}}),Object.keys(t).map(r=>(Object.defineProperties(f[e.name],{[r]:{writable:false,configurable:false,enumerable:false}}),null)),f.setProps(f,e,{writable:false,configurable:false,enumerable:false}),f._list.scripts.push(e);}});var N={name:"ai",active:true,subCommand:[{name:"tokenCount",version:"0.0.3",example:"dphelper.ai.tokenCount({ users: [1,2,3] })",author:"Dario Passariello",creationDate:"20260220",lastMod:"20260221",type:"function",active:true,description:"Estimate token count for LLMs. If an object is passed, it uses TOON format for calculation.",env:"both",subCommand:[]},{name:"smartSanitize",version:"0.0.2",example:"dphelper.ai.smartSanitize('My email is test@example.com')",author:"Dario Passariello & Jo",creationDate:"20260220",lastMod:"20260220",type:"function",active:true,description:"Remove PII (emails, phones, etc) from text for AI privacy",subCommand:[]},{name:"toon",version:"0.0.1",example:"dphelper.ai.toon({ users: [{id: 1, name: 'Ada'}] })",author:"TOON + Dario Passariello",creationDate:"20260221",lastMod:"20260221",type:"function",active:true,description:"Convert JSON to TOON format (Token-Oriented Object Notation)",subCommand:[]},{name:"toonToJson",version:"0.0.1",example:"dphelper.ai.toonToJson('users[1]{id,name}:\\n 1,Ada')",author:"Dario Passariello",creationDate:"20260221",lastMod:"20260221",type:"function",active:true,description:"Convert TOON format back to JSON/Object",subCommand:[]},{name:"chunker",version:"0.0.1",example:"dphelper.ai.chunker(text, { size: 1000, overlap: 200 })",author:"Dario Passariello",creationDate:"20260221",lastMod:"20260221",type:"function",active:true,description:"Split long text into chunks for RAG or AI processing.",subCommand:[]},{name:"similarity",version:"0.0.1",example:"dphelper.ai.similarity(vecA, vecB)",author:"Dario Passariello",creationDate:"20260221",lastMod:"20260221",type:"function",active:true,description:"Calculate cosine similarity between two embedding vectors.",subCommand:[]},{name:"extractReasoning",version:"0.0.1",example:"dphelper.ai.extractReasoning(aiResponse)",author:"Dario Passariello",creationDate:"20260221",lastMod:"20260221",type:"function",active:true,description:"Extract <think> tags or internal reasoning from AI responses.",subCommand:[]},{name:"prompt",version:"0.0.1",example:"dphelper.ai.prompt('Hello {{name}}', { name: 'Ada' })",author:"Dario Passariello",creationDate:"20260221",lastMod:"20260221",type:"function",active:true,description:"Simple prompt template engine with variable injection.",subCommand:[]},{name:"schema",version:"0.0.1",example:"dphelper.ai.schema({ id: 1, name: 'Ada' })",author:"Dario Passariello",creationDate:"20260221",lastMod:"20260221",type:"function",active:true,description:"Generate a TOON-style schema definition for AI instructions.",subCommand:[]},{name:"snapshot",version:"0.0.1",example:"dphelper.ai.snapshot()",author:"Dario Passariello",creationDate:"20260221",lastMod:"20260221",type:"function",active:true,description:"Capture a 'mental snapshot' of the app state (logs/globals) in TOON format for AI debugging.",env:"both",subCommand:[]}]},A=e=>e===null||typeof e!="object",O=e=>e===null?"null":typeof e=="string"?e.includes(",")||e.includes(":")||e.includes('"')||e.includes(`
|
|
2
2
|
`)||e.trim()!==e?`"${e.replace(/"/g,'\\"')}"`:e||'""':String(e),b=(e,t=0)=>{let r=" ".repeat(t);if(A(e))return O(e);if(Array.isArray(e)){if(e.length===0)return "[0]:";let n=e[0];if(!A(n)&&!Array.isArray(n)){let s=Object.keys(n),o=`[${e.length}]{${s.join(",")}}:`;for(let i of e){let u=s.map(a=>O(i[a])).join(",");o+=`
|
|
3
3
|
${r} ${u}`;}return o}else return `[${e.length}]: `+e.map(O).join(",")}else return Object.entries(e).map(([n,s])=>{let o=n.includes(" ")||n.includes(":")?`"${n}"`:n;if(!A(s)){let i=b(s,t+1);return i.startsWith("[")?`${o}${i}`:`${o}:
|
|
4
4
|
${r}${i}`}return `${o}: ${O(s)}`}).join(`
|
package/modules/anchor.cjs
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
'use strict';var p={info:{title:"List",description:"Complete list of tools"},categories:["3party","system","financial","memory","numbers","time","path","file","forms","ui","other","development"]};var c={version:"4.7.
|
|
1
|
+
'use strict';var p={info:{title:"List",description:"Complete list of tools"},categories:["3party","system","financial","memory","numbers","time","path","file","forms","ui","other","development"]};var c={version:"4.7.1"};Object.defineProperty(globalThis,"dphelper",{value:new Proxy({},{}),writable:true,configurable:true,enumerable:false});Object.defineProperties(dphelper,{_list:{value:{scripts:[],sockets:[],...p},configurable:true,writable:true},version:{value:c.version,configurable:true,writable:true},isServer:{value:false,configurable:true,writable:true},isBrowser:{value:true,configurable:true,writable:true}});var r=dphelper;Object.defineProperty(r,"setProps",{value:(e,t,a)=>{Object.defineProperty(e,t.name,a||{writable:false,configurable:false,enumerable:false}),a?.lock&&Object.freeze(e[t.name]);},writable:false,configurable:false,enumerable:false});Object.defineProperty(r,"setDescription",{value:(e,t)=>{Object.defineProperties(r,{[e.name]:{value:t,writable:false,configurable:false,enumerable:false}}),Object.keys(t).map(a=>(Object.defineProperties(r[e.name],{[a]:{writable:false,configurable:false,enumerable:false}}),null)),r.setProps(r,e,{writable:false,configurable:false,enumerable:false}),r._list.scripts.push(e);}});var b={name:"anchor",active:true,subCommand:[{name:"toOnClick",type:"function",version:"0.0.2",example:"dphelper.anchor.toOnClick([element, 'foo' | '.foo' | '#foo'])",description:`This tool allows you to convert all links in an element to 'onclick'.
|
|
2
2
|
It allows you to avoid the message with the path relative to the requested address
|
|
3
3
|
and it is very useful when you work with SPA but you want to keep even older browsers.`,author:"Dario Passariello",creationDate:"20210101",lastMod:"20260220",active:true,env:"client",subCommand:[]}]},d={toOnClick:e=>{let t=document.querySelector(e);if(!t)return;t.querySelectorAll("a").forEach(o=>{let l=o.getAttribute("href");if(!l)return;o.style.cursor="pointer";let n=dphelper.pathRail()?.[3]?.replace(/\//g,"")||"";n&&o.classList.add(n);let s=o.cloneNode(true);o.parentNode?.replaceChild(s,o),s.removeAttribute("href"),s.addEventListener("mouseup",u=>{l.startsWith("/")?(history.pushState({href:l},"",l),dphelper.navigation.load(l),u.stopPropagation()):dphelper.browser.href(l);});});}};dphelper?.setDescription(b,d);var A=dphelper.anchor;
|
|
4
4
|
exports.anchor=A;
|