hanzio 1.0.7 → 1.0.9

package/README.md

@@ -2,17 +2,19 @@
 
 A small TypeScript-first utility library for common application code: arrays,
 strings, promises, caching, state machines, dates, URLs, Zod helpers, API clients,
-JWTs, gzip, sitemap crawling, queues, secrets, and colorful terminal logging.
+JWTs, sitemap crawling, queues, secrets, and colorful terminal logging.
 
 ## Install
 
 ```bash
-bun add hanzio
+bun add hanzio zod
 ```
 
 The package is ESM and Bun-friendly. Bun consumers resolve the `bun` export to
 the source TypeScript files, while Node/bundler consumers resolve built files
 from `dist`.
+`zod` is a peer dependency because the Zod helpers and API wrapper share the
+consumer application's Zod instance.
 
 ## Imports
 
@@ -27,10 +29,10 @@ Heavier or dependency-specific modules are also available as subpath exports:
 ```ts
 import { createZId } from 'hanzio/zod'
 import { jwtSign } from 'hanzio/jwt'
-import { compressString } from 'hanzio/gzip'
 import { getDomainSitemap } from 'hanzio/sitemap'
 import PQueue from 'hanzio/p-queue'
 import { createCoolLogger } from 'hanzio/cool-console-log'
+import { defineSecretSet } from 'hanzio/secrets'
 ```
 
 The package currently publishes `src/**/*.ts` intentionally so Bun can consume
@@ -217,7 +219,7 @@ await promiseTimeout(250)
 Infisical before the rest of the program starts.
 
 ```ts
-import { defineSecretSet } from 'hanzio'
+import { defineSecretSet } from 'hanzio/secrets'
 
 export const backendSecrets = await defineSecretSet(
 	['DATABASE_URL', 'APP_SECRET'] as const,
@@ -229,7 +231,8 @@ const databaseUrl = backendSecrets.secret('DATABASE_URL')
 
 For Vite config, `viteSecretSetPlugin(secretSet)` exposes the loaded values as
 `import.meta.env.*` replacements. Use `getViteDefine(secretSet)` if you need the
-raw `define` object.
+raw `define` object. Import Vite helpers from `hanzio/secrets/vite` so browser
+bundles do not pull in the Infisical SDK.
 
 ### Cache
 
@@ -470,17 +473,6 @@ const token = await jwtSign({ sub: 'user_1' }, 'secret')
 const payload = await jwtVerify<{ sub: string }>(token, 'secret')
 ```
 
-### Gzip
-
-`compressString` and `decompressString` gzip roundtrip strings as base64.
-
-```ts
-import { compressString, decompressString } from 'hanzio/gzip'
-
-const compressed = compressString('hello')
-const text = decompressString(compressed)
-```
-
 ### Sitemap
 
 `getDomainSitemap` discovers and crawls sitemap URLs for a domain.

package/dist/index.d.ts

@@ -12,6 +12,5 @@ export * from './api-wrapper';
 export * from './p-queue';
 export * from './cool-console-log';
 export * from './jwt';
-export * from './gzip';
 export * from './sitemap';
 export * from './secrets';

package/dist/jwt/index.d.ts

@@ -1,3 +1,3 @@
-import * as jose from 'jose';
-export declare function jwtSign<_Payload extends object>(payload: jose.JWTPayload, secret: string): Promise<string>;
-export declare function jwtVerify<Payload extends object>(token: string, secret: string): Promise<Payload | null>;
+export type JWTPayload = Record<string, unknown>;
+export declare function jwtSign<Payload extends JWTPayload>(payload: Payload, secret: string): Promise<string>;
+export declare function jwtVerify<Payload extends JWTPayload>(token: string, secret: string): Promise<Payload | null>;

package/dist/secrets/index.d.ts

@@ -22,6 +22,7 @@ export type SecretSet<SecretKey extends string> = {
     secrets: () => Record<SecretKey, string>;
     reload: () => Promise<SecretSet<SecretKey>>;
 };
+export * from './infisical';
 export * from './vite';
 export declare function getSecretEnvironment(): SecretEnvironment;
 export declare function defineSecretSet<const SecretKeys extends readonly string[]>(keys: SecretKeys, options: DefineSecretSetOptions<SecretKeys[number]>): Promise<SecretSet<SecretKeys[number]>>;

package/dist/secrets/infisical.d.ts

@@ -0,0 +1,2 @@
+import type { SecretSetLoaderContext } from '.';
+export declare function loadInfisicalSecrets<SecretKey extends string>({ keys, projectId, environment, siteUrl, clientIdEnvKey, clientSecretEnvKey }: SecretSetLoaderContext<SecretKey>): Promise<Partial<Record<SecretKey, string>>>;

package/dist/src/index.js

@@ -880,32 +880,110 @@ class PQueue {
 }
 
 // src/jwt/index.ts
-import * as jose from "jose";
+var BYTE_CHUNK_SIZE = 32768;
+var textEncoder = new TextEncoder;
+var textDecoder = new TextDecoder;
 async function jwtSign(payload, secret) {
-  const secretKey = new TextEncoder().encode(secret);
-  return await new jose.SignJWT(payload).setProtectedHeader({ alg: "HS256" }).setIssuedAt().sign(secretKey);
+  const header = encodeJson({ alg: "HS256" });
+  const body = encodeJson({
+    ...payload,
+    iat: Math.floor(Date.now() / 1000)
+  });
+  const data = `${header}.${body}`;
+  const signature = await sign(data, secret);
+  return `${data}.${encodeBase64Url(signature)}`;
 }
-async function jwtVerify2(token, secret) {
+async function jwtVerify(token, secret) {
   try {
-    const secretKey = new TextEncoder().encode(secret);
-    const { payload } = await jose.jwtVerify(token, secretKey);
+    const parts = token.split(".");
+    if (parts.length !== 3)
+      return null;
+    const [encodedHeader, encodedPayload, encodedSignature] = parts;
+    const header = decodeJson(encodedHeader);
+    if (!isJwtHeader(header))
+      return null;
+    const data = `${encodedHeader}.${encodedPayload}`;
+    const signature = decodeBase64Url(encodedSignature);
+    const isValid = await verify(data, signature, secret);
+    if (!isValid)
+      return null;
+    const payload = decodeJson(encodedPayload);
+    if (!isJwtPayload(payload) || !isTimeValid(payload))
+      return null;
     return payload;
   } catch (_error) {
     return null;
   }
 }
-
-// src/gzip/index.ts
-import pako from "pako";
-function compressString(input) {
-  const uint8Array = new TextEncoder().encode(input);
-  const compressed = pako.deflate(uint8Array);
-  return btoa(String.fromCharCode.apply(null, compressed));
-}
-function decompressString(compressedString) {
-  const compressedData = new Uint8Array(atob(compressedString).split("").map((char) => char.charCodeAt(0)));
-  const decompressed = pako.inflate(compressedData);
-  return new TextDecoder().decode(decompressed);
+async function sign(data, secret) {
+  const key = await getKey(secret, ["sign"]);
+  return await getSubtleCrypto().sign("HMAC", key, encodeText(data));
+}
+async function verify(data, signature, secret) {
+  const key = await getKey(secret, ["verify"]);
+  return await getSubtleCrypto().verify("HMAC", key, signature, encodeText(data));
+}
+async function getKey(secret, usages) {
+  return await getSubtleCrypto().importKey("raw", encodeText(secret), {
+    name: "HMAC",
+    hash: "SHA-256"
+  }, false, usages);
+}
+function encodeJson(value) {
+  return encodeBase64Url(encodeText(JSON.stringify(value)));
+}
+function decodeJson(value) {
+  return JSON.parse(textDecoder.decode(decodeBase64Url(value)));
+}
+function encodeBase64Url(value) {
+  const bytes = value instanceof ArrayBuffer ? new Uint8Array(value) : value;
+  return btoa(bytesToBinaryString(bytes)).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function decodeBase64Url(value) {
+  const base64 = value.replaceAll("-", "+").replaceAll("_", "/");
+  const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
+  return binaryStringToBytes(atob(padded)).buffer;
+}
+function encodeText(value) {
+  return toArrayBuffer(textEncoder.encode(value));
+}
+function toArrayBuffer(bytes) {
+  return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+}
+function bytesToBinaryString(bytes) {
+  let binary = "";
+  for (let offset = 0;offset < bytes.length; offset += BYTE_CHUNK_SIZE) {
+    binary += String.fromCharCode(...bytes.subarray(offset, offset + BYTE_CHUNK_SIZE));
+  }
+  return binary;
+}
+function binaryStringToBytes(binary) {
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0;index < binary.length; index += 1) {
+    bytes[index] = binary.charCodeAt(index);
+  }
+  return bytes;
+}
+function getSubtleCrypto() {
+  const subtle = globalThis.crypto?.subtle;
+  if (!subtle) {
+    throw new Error("Web Crypto is not available in this runtime");
+  }
+  return subtle;
+}
+function isJwtHeader(value) {
+  return typeof value === "object" && value !== null && "alg" in value && value.alg === "HS256";
+}
+function isJwtPayload(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isTimeValid(payload) {
+  const now = Math.floor(Date.now() / 1000);
+  if (typeof payload.exp === "number" && now >= payload.exp)
+    return false;
+  if (typeof payload.nbf === "number" && now < payload.nbf)
+    return false;
+  return true;
 }
 
 // src/sitemap/index.ts
@@ -1023,6 +1101,98 @@ var getDomainSitemap = async (domain, options = {}) => {
   return [...result.links];
 };
 
+// src/secrets/infisical.ts
+import { z as z4 } from "zod";
+var defaultFetch = globalThis.fetch;
+var infisicalAuthResponseSchema = z4.object({
+  accessToken: z4.string()
+});
+var infisicalSecretSchema = z4.object({
+  secretKey: z4.string(),
+  secretValue: z4.string()
+});
+var infisicalSecretsResponseSchema = z4.object({
+  secrets: z4.array(infisicalSecretSchema)
+});
+async function loadInfisicalSecrets({
+  keys,
+  projectId,
+  environment,
+  siteUrl,
+  clientIdEnvKey,
+  clientSecretEnvKey
+}) {
+  const clientId = process.env[clientIdEnvKey];
+  const clientSecret = process.env[clientSecretEnvKey];
+  if (!clientId || !clientSecret) {
+    throw new Error("Missing Infisical credentials");
+  }
+  const infisical = createInfisicalApiClient(siteUrl);
+  const { data: auth } = await infisical.request("login", {
+    reqBody: {
+      clientId,
+      clientSecret
+    }
+  });
+  const { data } = await infisical.request("listSecrets", {
+    reqHeaders: {
+      Authorization: `Bearer ${auth.accessToken}`
+    },
+    reqQuery: {
+      environment,
+      projectId,
+      secretPath: "/",
+      viewSecretValue: true,
+      expandSecretReferences: true,
+      includeImports: true
+    }
+  });
+  const wantedKeys = new Set(keys);
+  return Object.fromEntries(data.secrets.filter((secret) => wantedKeys.has(secret.secretKey)).map((secret) => [secret.secretKey, secret.secretValue]));
+}
+function createInfisicalApiClient(siteUrl) {
+  return createApiClient({
+    name: "infisical",
+    baseApiUrls: {
+      infisical: siteUrl
+    },
+    defaultBaseApiUrl: "infisical",
+    fetch: getFetch(),
+    retries: 1,
+    endpoints: {
+      login: {
+        method: "POST",
+        path: "/api/v1/auth/universal-auth/login",
+        reqBodySchema: z4.object({
+          clientId: z4.string(),
+          clientSecret: z4.string()
+        }),
+        resSchema: infisicalAuthResponseSchema,
+        reqBodyFormat: "json"
+      },
+      listSecrets: {
+        method: "GET",
+        path: "/api/v4/secrets",
+        reqHeadersSchema: z4.object({
+          Authorization: z4.string()
+        }),
+        reqQuerySchema: z4.object({
+          projectId: z4.string(),
+          environment: z4.string(),
+          secretPath: z4.string(),
+          viewSecretValue: z4.boolean(),
+          expandSecretReferences: z4.boolean(),
+          includeImports: z4.boolean()
+        }),
+        resSchema: infisicalSecretsResponseSchema
+      }
+    }
+  });
+}
+function getFetch() {
+  return globalThis.fetch ?? defaultFetch;
+}
+
 // src/secrets/vite.ts
 function getViteDefine(secretSet) {
   return Object.fromEntries(Object.entries(secretSet.secrets()).map(([key, value]) => [
@@ -1040,7 +1210,6 @@ function viteSecretSetPlugin(secretSet) {
 }
 
 // src/secrets/index.ts
-import { InfisicalSDK } from "@infisical/sdk";
 import { networkInterfaces } from "node:os";
 
 // src/cool-console-log/index.ts
@@ -1220,31 +1389,6 @@ async function defineSecretSet(keys, options) {
   await loadSecrets();
   return secretSet;
 }
-async function loadInfisicalSecrets({
-  keys,
-  projectId,
-  environment,
-  siteUrl,
-  clientIdEnvKey,
-  clientSecretEnvKey
-}) {
-  const clientId = process.env[clientIdEnvKey];
-  const clientSecret = process.env[clientSecretEnvKey];
-  if (!clientId || !clientSecret) {
-    throw new Error("Missing Infisical credentials");
-  }
-  const client = new InfisicalSDK({ siteUrl });
-  await client.auth().universalAuth.login({
-    clientId,
-    clientSecret
-  });
-  const { secrets } = await client.secrets().listSecrets({
-    environment,
-    projectId
-  });
-  const wantedKeys = new Set(keys);
-  return Object.fromEntries(secrets.filter((secret) => wantedKeys.has(secret.secretKey)).map((secret) => [secret.secretKey, secret.secretValue]));
-}
 function resolveEnvironment(environment) {
   if (typeof environment === "function")
     return environment();
@@ -1935,9 +2079,10 @@ export {
   normalizeSingleOrArray,
   logOperationSummary,
   logBanner,
+  loadInfisicalSecrets,
   linearRegressionTrend,
   keyBy,
-  jwtVerify2 as jwtVerify,
+  jwtVerify,
   jwtSign,
   jsonToZodSchemaMapper,
   isSuccess,
@@ -1957,13 +2102,11 @@ export {
   findArrayDifferenceByKey,
   extractNumber,
   defineSecretSet,
-  decompressString,
   createZId,
   createResolveColorsByKeys,
   createCoolLogger,
   createApiWrapper,
   createApiClient,
-  compressString,
   compact,
   colorize,
   chunkArray,

package/dist/src/jwt/index.js

@@ -1,19 +1,110 @@
 // src/jwt/index.ts
-import * as jose from "jose";
+var BYTE_CHUNK_SIZE = 32768;
+var textEncoder = new TextEncoder;
+var textDecoder = new TextDecoder;
 async function jwtSign(payload, secret) {
-  const secretKey = new TextEncoder().encode(secret);
-  return await new jose.SignJWT(payload).setProtectedHeader({ alg: "HS256" }).setIssuedAt().sign(secretKey);
+  const header = encodeJson({ alg: "HS256" });
+  const body = encodeJson({
+    ...payload,
+    iat: Math.floor(Date.now() / 1000)
+  });
+  const data = `${header}.${body}`;
+  const signature = await sign(data, secret);
+  return `${data}.${encodeBase64Url(signature)}`;
 }
-async function jwtVerify2(token, secret) {
+async function jwtVerify(token, secret) {
   try {
-    const secretKey = new TextEncoder().encode(secret);
-    const { payload } = await jose.jwtVerify(token, secretKey);
+    const parts = token.split(".");
+    if (parts.length !== 3)
+      return null;
+    const [encodedHeader, encodedPayload, encodedSignature] = parts;
+    const header = decodeJson(encodedHeader);
+    if (!isJwtHeader(header))
+      return null;
+    const data = `${encodedHeader}.${encodedPayload}`;
+    const signature = decodeBase64Url(encodedSignature);
+    const isValid = await verify(data, signature, secret);
+    if (!isValid)
+      return null;
+    const payload = decodeJson(encodedPayload);
+    if (!isJwtPayload(payload) || !isTimeValid(payload))
+      return null;
     return payload;
   } catch (_error) {
     return null;
   }
 }
+async function sign(data, secret) {
+  const key = await getKey(secret, ["sign"]);
+  return await getSubtleCrypto().sign("HMAC", key, encodeText(data));
+}
+async function verify(data, signature, secret) {
+  const key = await getKey(secret, ["verify"]);
+  return await getSubtleCrypto().verify("HMAC", key, signature, encodeText(data));
+}
+async function getKey(secret, usages) {
+  return await getSubtleCrypto().importKey("raw", encodeText(secret), {
+    name: "HMAC",
+    hash: "SHA-256"
+  }, false, usages);
+}
+function encodeJson(value) {
+  return encodeBase64Url(encodeText(JSON.stringify(value)));
+}
+function decodeJson(value) {
+  return JSON.parse(textDecoder.decode(decodeBase64Url(value)));
+}
+function encodeBase64Url(value) {
+  const bytes = value instanceof ArrayBuffer ? new Uint8Array(value) : value;
+  return btoa(bytesToBinaryString(bytes)).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function decodeBase64Url(value) {
+  const base64 = value.replaceAll("-", "+").replaceAll("_", "/");
+  const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
+  return binaryStringToBytes(atob(padded)).buffer;
+}
+function encodeText(value) {
+  return toArrayBuffer(textEncoder.encode(value));
+}
+function toArrayBuffer(bytes) {
+  return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+}
+function bytesToBinaryString(bytes) {
+  let binary = "";
+  for (let offset = 0;offset < bytes.length; offset += BYTE_CHUNK_SIZE) {
+    binary += String.fromCharCode(...bytes.subarray(offset, offset + BYTE_CHUNK_SIZE));
+  }
+  return binary;
+}
+function binaryStringToBytes(binary) {
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0;index < binary.length; index += 1) {
+    bytes[index] = binary.charCodeAt(index);
+  }
+  return bytes;
+}
+function getSubtleCrypto() {
+  const subtle = globalThis.crypto?.subtle;
+  if (!subtle) {
+    throw new Error("Web Crypto is not available in this runtime");
+  }
+  return subtle;
+}
+function isJwtHeader(value) {
+  return typeof value === "object" && value !== null && "alg" in value && value.alg === "HS256";
+}
+function isJwtPayload(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isTimeValid(payload) {
+  const now = Math.floor(Date.now() / 1000);
+  if (typeof payload.exp === "number" && now >= payload.exp)
+    return false;
+  if (typeof payload.nbf === "number" && now < payload.nbf)
+    return false;
+  return true;
+}
 export {
-  jwtVerify2 as jwtVerify,
+  jwtVerify,
   jwtSign
 };