hanzio 1.0.8 → 1.0.9

package/dist/src/secrets/infisical.js

@@ -0,0 +1,339 @@
+// src/api-wrapper/index.ts
+import { ZodError } from "zod";
+
+class ResponseValidationError extends Error {
+  zodError;
+  rawResponse;
+  validationIssues;
+  constructor(zodError, rawResponse) {
+    const issues = zodError.issues.map((issue) => `${issue.path.join(".") || "<root>"}: ${issue.message}`).join("; ");
+    super(`Response validation failed: ${issues}`);
+    this.name = "ResponseValidationError";
+    this.zodError = zodError;
+    this.rawResponse = rawResponse;
+    this.validationIssues = issues;
+  }
+}
+
+class HttpResponseError extends Error {
+  status;
+  body;
+  constructor(status, body) {
+    super(`HTTP error: ${status} - ${body}`);
+    this.name = "HttpResponseError";
+    this.status = status;
+    this.body = body;
+  }
+}
+function createApiClient(apiConfig) {
+  const request = async (endpointKey, input = {}) => {
+    const endpoint = apiConfig.endpoints[endpointKey];
+    if (!endpoint) {
+      throw new Error(`Unknown API endpoint: ${String(endpointKey)}`);
+    }
+    const { finalUrl, fullUrl } = buildUrl(endpoint, input.reqParams, input.reqQuery, apiConfig.baseApiUrls, apiConfig.defaultBaseApiUrl, input.url);
+    const endpointName = apiConfig.name ? `${apiConfig.name}.${String(endpointKey)}` : String(endpointKey);
+    const startedAt = Date.now();
+    let retryCount = 0;
+    let httpStatus = 0;
+    apiConfig.onRequestStart?.({ endpoint: endpointName, url: fullUrl });
+    try {
+      const config = {
+        method: endpoint.method,
+        url: finalUrl,
+        queryParams: buildQueryParams(endpoint, input.reqQuery),
+        body: buildRequestBody(endpoint, input.reqBody),
+        headers: buildHeaders(endpoint, input.reqHeaders, apiConfig.defaultHeaders ?? {}),
+        doNotEncodeQueryParams: endpoint.doNotEncodeQueryParams,
+        timeoutMs: apiConfig.timeoutMs,
+        fetchFn: apiConfig.fetch ?? fetch
+      };
+      const result = await makeRequestWithRetry(config, apiConfig.retries ?? 3, apiConfig.retryDelayMs ?? 300, (response) => validateAndTransformResponse(endpoint, response), apiConfig.shouldRetry ?? defaultShouldRetry, apiConfig.logger);
+      retryCount = result.retryCount;
+      httpStatus = result.httpStatus;
+      const responseTimeMs = Date.now() - startedAt;
+      const responseSizeMb = calculateSizeInMb(result.validatedData);
+      const requestSizeMb = calculateSizeInMb({
+        method: config.method,
+        url: fullUrl,
+        body: config.body,
+        headers: config.headers
+      });
+      apiConfig.onRequestEnd?.({
+        endpoint: endpointName,
+        url: fullUrl,
+        status: httpStatus,
+        retryCount,
+        responseTimeMs
+      });
+      return {
+        data: result.validatedData,
+        requestSizeMb,
+        responseSizeMb,
+        requestSizeTotalMb: requestSizeMb + responseSizeMb,
+        responseTimeMs,
+        httpStatus,
+        retryCount
+      };
+    } catch (error) {
+      apiConfig.logger?.error?.(error);
+      throw error;
+    }
+  };
+  return { request };
+}
+var createApiWrapper = createApiClient;
+async function validateResponse(schema, data) {
+  try {
+    return await schema.parseAsync(data);
+  } catch (error) {
+    if (error instanceof ZodError) {
+      throw new ResponseValidationError(error, data);
+    }
+    throw error;
+  }
+}
+async function httpRequest(config) {
+  const queryString = config.doNotEncodeQueryParams ? Object.entries(config.queryParams).map(([key, value]) => `${key}=${value}`).join("&") : new URLSearchParams(config.queryParams).toString();
+  const fullUrl = queryString ? `${config.url}?${queryString}` : config.url;
+  const abortController = new AbortController;
+  const timeout = config.timeoutMs === undefined ? undefined : setTimeout(() => abortController.abort(), config.timeoutMs);
+  try {
+    return await config.fetchFn(fullUrl, {
+      method: config.method,
+      headers: config.headers,
+      body: buildFetchBody(config.body, config.headers),
+      signal: abortController.signal
+    });
+  } finally {
+    if (timeout)
+      clearTimeout(timeout);
+  }
+}
+async function makeRequestWithRetry(config, maxRetries, retryDelayMs, validateFn, shouldRetry, logger) {
+  let retryCount = 0;
+  while (true) {
+    try {
+      logger?.debug?.("API request", config);
+      const response = await httpRequest(config);
+      if (response.status >= 400) {
+        if (retryCount < maxRetries && shouldRetry({ response, retryCount, maxRetries })) {
+          retryCount++;
+          await delay(retryDelayMs);
+          continue;
+        }
+        throw new HttpResponseError(response.status, await response.text());
+      }
+      return {
+        validatedData: await validateFn(response),
+        retryCount,
+        httpStatus: response.status
+      };
+    } catch (error) {
+      if (error instanceof HttpResponseError)
+        throw error;
+      if (retryCount >= maxRetries || !shouldRetry({ error, retryCount, maxRetries })) {
+        throw error;
+      }
+      retryCount++;
+      await delay(retryDelayMs);
+    }
+  }
+}
+async function validateAndTransformResponse(endpoint, response) {
+  const responseHeaders = getHeadersAsObject(response.headers);
+  const contentType = responseHeaders["content-type"] ?? "";
+  const responseData = contentType.includes("application/json") ? await response.json() : await response.text();
+  const transformedData = endpoint.resFormatter ? endpoint.resFormatter(responseData, responseHeaders) : responseData;
+  return validateResponse(endpoint.resSchema, transformedData);
+}
+function buildUrl(endpoint, params, reqQuery, baseApiUrls, defaultBaseApiUrl, url) {
+  if (url) {
+    const finalUrl2 = replacePathParams(url, params);
+    const queryString2 = new URLSearchParams(buildQueryParams(endpoint, reqQuery)).toString();
+    return {
+      finalUrl: finalUrl2,
+      fullUrl: queryString2 ? `${finalUrl2}?${queryString2}` : finalUrl2
+    };
+  }
+  const defaultBaseUrl = defaultBaseApiUrl ?? Object.keys(baseApiUrls)[0];
+  if (!defaultBaseUrl) {
+    throw new Error("At least one base API URL is required");
+  }
+  const baseUrlKey = endpoint.baseApiUrl ?? defaultBaseUrl;
+  const configBaseUrl = baseApiUrls[baseUrlKey];
+  if (!configBaseUrl) {
+    throw new Error(`Unknown base API URL: ${baseUrlKey}`);
+  }
+  const baseUrl = typeof configBaseUrl === "function" ? configBaseUrl() : configBaseUrl;
+  const path = typeof endpoint.path === "function" ? endpoint.path(baseUrl) : endpoint.path;
+  const finalUrl = replacePathParams(`${baseUrl}${path}`, params);
+  const queryString = new URLSearchParams(buildQueryParams(endpoint, reqQuery)).toString();
+  return {
+    finalUrl,
+    fullUrl: queryString ? `${finalUrl}?${queryString}` : finalUrl
+  };
+}
+function buildQueryParams(endpoint, query) {
+  const defaultParams = endpoint.reqDefaultQueryParams ?? {};
+  const parsedQuery = endpoint.reqQuerySchema ? endpoint.reqQuerySchema.parse(query) : query ?? {};
+  const merged = { ...defaultParams, ...parsedQuery };
+  return Object.fromEntries(Object.entries(merged).filter(([, value]) => value !== undefined).map(([key, value]) => [key, String(value)]));
+}
+function buildRequestBody(endpoint, body) {
+  if (!endpoint.reqBodySchema)
+    return body;
+  const parsedBody = endpoint.reqBodySchema.parse(body);
+  if (endpoint.reqBodyFormat !== "form-data") {
+    return parsedBody;
+  }
+  const formData = new FormData;
+  for (const [key, value] of Object.entries(parsedBody)) {
+    if (value == null)
+      continue;
+    formData.set(key, value instanceof Blob ? value : String(value));
+  }
+  return formData;
+}
+function buildHeaders(endpoint, headers, defaultHeaders) {
+  const contentType = endpoint.reqBodyFormat === "json" ? "application/json" : undefined;
+  const parsedHeaders = endpoint.reqHeadersSchema ? endpoint.reqHeadersSchema.parse(headers) : headers ?? {};
+  return {
+    ...defaultHeaders,
+    ...contentType && { "Content-Type": contentType },
+    ...endpoint.defaultHeaders,
+    ...parsedHeaders
+  };
+}
+function buildFetchBody(body, headers) {
+  if (body === undefined || body === null)
+    return;
+  if (body instanceof FormData || body instanceof Blob)
+    return body;
+  if (headers["Content-Type"] === "application/json")
+    return JSON.stringify(body);
+  return body;
+}
+function replacePathParams(path, params) {
+  return path.replace(/:(\w+)/g, (_, key) => {
+    const value = params?.[key];
+    if (value === undefined) {
+      throw new Error(`Missing required path parameter: ${key}`);
+    }
+    return encodeURIComponent(String(value));
+  });
+}
+function getHeadersAsObject(headers) {
+  const result = {};
+  headers.forEach((value, key) => {
+    result[key] = value;
+  });
+  return result;
+}
+function calculateSizeInMb(data) {
+  const sizeInBytes = new TextEncoder().encode(JSON.stringify(data)).length;
+  return sizeInBytes / (1024 * 1024);
+}
+function defaultShouldRetry({ error, response }) {
+  if (error)
+    return true;
+  return response ? response.status >= 500 : false;
+}
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// src/secrets/infisical.ts
+import { z } from "zod";
+var defaultFetch = globalThis.fetch;
+var infisicalAuthResponseSchema = z.object({
+  accessToken: z.string()
+});
+var infisicalSecretSchema = z.object({
+  secretKey: z.string(),
+  secretValue: z.string()
+});
+var infisicalSecretsResponseSchema = z.object({
+  secrets: z.array(infisicalSecretSchema)
+});
+async function loadInfisicalSecrets({
+  keys,
+  projectId,
+  environment,
+  siteUrl,
+  clientIdEnvKey,
+  clientSecretEnvKey
+}) {
+  const clientId = process.env[clientIdEnvKey];
+  const clientSecret = process.env[clientSecretEnvKey];
+  if (!clientId || !clientSecret) {
+    throw new Error("Missing Infisical credentials");
+  }
+  const infisical = createInfisicalApiClient(siteUrl);
+  const { data: auth } = await infisical.request("login", {
+    reqBody: {
+      clientId,
+      clientSecret
+    }
+  });
+  const { data } = await infisical.request("listSecrets", {
+    reqHeaders: {
+      Authorization: `Bearer ${auth.accessToken}`
+    },
+    reqQuery: {
+      environment,
+      projectId,
+      secretPath: "/",
+      viewSecretValue: true,
+      expandSecretReferences: true,
+      includeImports: true
+    }
+  });
+  const wantedKeys = new Set(keys);
+  return Object.fromEntries(data.secrets.filter((secret) => wantedKeys.has(secret.secretKey)).map((secret) => [secret.secretKey, secret.secretValue]));
+}
+function createInfisicalApiClient(siteUrl) {
+  return createApiClient({
+    name: "infisical",
+    baseApiUrls: {
+      infisical: siteUrl
+    },
+    defaultBaseApiUrl: "infisical",
+    fetch: getFetch(),
+    retries: 1,
+    endpoints: {
+      login: {
+        method: "POST",
+        path: "/api/v1/auth/universal-auth/login",
+        reqBodySchema: z.object({
+          clientId: z.string(),
+          clientSecret: z.string()
+        }),
+        resSchema: infisicalAuthResponseSchema,
+        reqBodyFormat: "json"
+      },
+      listSecrets: {
+        method: "GET",
+        path: "/api/v4/secrets",
+        reqHeadersSchema: z.object({
+          Authorization: z.string()
+        }),
+        reqQuerySchema: z.object({
+          projectId: z.string(),
+          environment: z.string(),
+          secretPath: z.string(),
+          viewSecretValue: z.boolean(),
+          expandSecretReferences: z.boolean(),
+          includeImports: z.boolean()
+        }),
+        resSchema: infisicalSecretsResponseSchema
+      }
+    }
+  });
+}
+function getFetch() {
+  return globalThis.fetch ?? defaultFetch;
+}
+export {
+  loadInfisicalSecrets
+};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hanzio",
-  "version": "1.0.8",
-  "description": "A set of utility functions for TypeScript",
+  "version": "1.0.9",
+  "description": "A lightweight set of utility functions for TypeScript",
   "type": "module",
   "module": "./dist/src/index.js",
   "main": "./dist/src/index.js",
@@ -50,7 +50,7 @@
   },
   "scripts": {
     "build": "bun run build:js && bun run build:types",
-    "build:js": "bun build ./src/index.ts ./src/zod/index.ts ./src/api-wrapper/index.ts ./src/jwt/index.ts ./src/gzip/index.ts ./src/sitemap/index.ts ./src/p-queue/index.ts ./src/secrets/index.ts ./src/secrets/vite.ts --outdir ./dist --target node --packages external",
+    "build:js": "bun build ./src/index.ts ./src/zod/index.ts ./src/api-wrapper/index.ts ./src/jwt/index.ts ./src/sitemap/index.ts ./src/p-queue/index.ts ./src/secrets/index.ts ./src/secrets/infisical.ts ./src/secrets/vite.ts --outdir ./dist --target node --packages external",
     "build:types": "tsgo -p tsconfig.build.json",
     "prepublishOnly": "bun run build",
     "publish:patch": "npm version patch && npm publish",
@@ -65,15 +65,12 @@
   "devDependencies": {
     "@biomejs/biome": "^2.4.6",
     "@types/bun": "latest",
-    "@types/pako": "^2.0.4",
     "@typescript/native-preview": "^7.0.0-dev.20260306.1",
     "husky": "^9.1.7",
-    "typescript": "^5.7.0"
+    "typescript": "^5.7.0",
+    "zod": "^4.3.6"
   },
-  "dependencies": {
-    "@infisical/sdk": "^5.0.2",
-    "jose": "^6.2.3",
-    "pako": "^2.1.0",
+  "peerDependencies": {
     "zod": "^4.3.6"
   }
 }

package/src/index.ts

@@ -12,6 +12,5 @@ export * from './api-wrapper'
 export * from './p-queue'
 export * from './cool-console-log'
 export * from './jwt'
-export * from './gzip'
 export * from './sitemap'
 export * from './secrets'

package/src/jwt/index.ts

@@ -1,25 +1,171 @@
-import * as jose from 'jose'
+export type JWTPayload = Record<string, unknown>
 
-export async function jwtSign<_Payload extends object>(
-	payload: jose.JWTPayload,
+const BYTE_CHUNK_SIZE = 0x8000
+const textEncoder = new TextEncoder()
+const textDecoder = new TextDecoder()
+
+export async function jwtSign<Payload extends JWTPayload>(
+	payload: Payload,
 	secret: string
-) {
-	const secretKey = new TextEncoder().encode(secret)
-	return await new jose.SignJWT(payload)
-		.setProtectedHeader({ alg: 'HS256' })
-		.setIssuedAt()
-		.sign(secretKey)
+): Promise<string> {
+	const header = encodeJson({ alg: 'HS256' })
+	const body = encodeJson({
+		...payload,
+		iat: Math.floor(Date.now() / 1000)
+	})
+	const data = `${header}.${body}`
+	const signature = await sign(data, secret)
+
+	return `${data}.${encodeBase64Url(signature)}`
 }
 
-export async function jwtVerify<Payload extends object>(
+export async function jwtVerify<Payload extends JWTPayload>(
 	token: string,
 	secret: string
 ): Promise<Payload | null> {
 	try {
-		const secretKey = new TextEncoder().encode(secret)
-		const { payload } = await jose.jwtVerify(token, secretKey)
+		const parts = token.split('.')
+		if (parts.length !== 3) return null
+
+		const [encodedHeader, encodedPayload, encodedSignature] = parts as [
+			string,
+			string,
+			string
+		]
+		const header = decodeJson(encodedHeader)
+		if (!isJwtHeader(header)) return null
+
+		const data = `${encodedHeader}.${encodedPayload}`
+		const signature = decodeBase64Url(encodedSignature)
+		const isValid = await verify(data, signature, secret)
+		if (!isValid) return null
+
+		const payload = decodeJson(encodedPayload)
+		if (!isJwtPayload(payload) || !isTimeValid(payload)) return null
+
 		return payload as Payload
 	} catch (_error) {
 		return null
 	}
 }
+
+async function sign(data: string, secret: string): Promise<ArrayBuffer> {
+	const key = await getKey(secret, ['sign'])
+	return await getSubtleCrypto().sign('HMAC', key, encodeText(data))
+}
+
+async function verify(
+	data: string,
+	signature: ArrayBuffer,
+	secret: string
+): Promise<boolean> {
+	const key = await getKey(secret, ['verify'])
+	return await getSubtleCrypto().verify(
+		'HMAC',
+		key,
+		signature,
+		encodeText(data)
+	)
+}
+
+async function getKey(
+	secret: string,
+	usages: Array<'sign' | 'verify'>
+): Promise<CryptoKey> {
+	return await getSubtleCrypto().importKey(
+		'raw',
+		encodeText(secret),
+		{
+			name: 'HMAC',
+			hash: 'SHA-256'
+		},
+		false,
+		usages
+	)
+}
+
+function encodeJson(value: JWTPayload): string {
+	return encodeBase64Url(encodeText(JSON.stringify(value)))
+}
+
+function decodeJson(value: string): unknown {
+	return JSON.parse(textDecoder.decode(decodeBase64Url(value)))
+}
+
+function encodeBase64Url(value: Uint8Array | ArrayBuffer): string {
+	const bytes = value instanceof ArrayBuffer ? new Uint8Array(value) : value
+	return btoa(bytesToBinaryString(bytes))
+		.replaceAll('+', '-')
+		.replaceAll('/', '_')
+		.replace(/=+$/, '')
+}
+
+function decodeBase64Url(value: string): ArrayBuffer {
+	const base64 = value.replaceAll('-', '+').replaceAll('_', '/')
+	const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, '=')
+	return binaryStringToBytes(atob(padded)).buffer
+}
+
+function encodeText(value: string): ArrayBuffer {
+	return toArrayBuffer(textEncoder.encode(value))
+}
+
+function toArrayBuffer(bytes: Uint8Array): ArrayBuffer {
+	return bytes.buffer.slice(
+		bytes.byteOffset,
+		bytes.byteOffset + bytes.byteLength
+	) as ArrayBuffer
+}
+
+function bytesToBinaryString(bytes: Uint8Array): string {
+	let binary = ''
+
+	for (let offset = 0; offset < bytes.length; offset += BYTE_CHUNK_SIZE) {
+		binary += String.fromCharCode(
+			...bytes.subarray(offset, offset + BYTE_CHUNK_SIZE)
+		)
+	}
+
+	return binary
+}
+
+function binaryStringToBytes(binary: string): Uint8Array<ArrayBuffer> {
+	const bytes = new Uint8Array(binary.length)
+
+	for (let index = 0; index < binary.length; index += 1) {
+		bytes[index] = binary.charCodeAt(index)
+	}
+
+	return bytes
+}
+
+function getSubtleCrypto(): SubtleCrypto {
+	const subtle = globalThis.crypto?.subtle
+	if (!subtle) {
+		throw new Error('Web Crypto is not available in this runtime')
+	}
+
+	return subtle
+}
+
+function isJwtHeader(value: unknown): value is { alg: 'HS256' } {
+	return (
+		typeof value === 'object' &&
+		value !== null &&
+		'alg' in value &&
+		value.alg === 'HS256'
+	)
+}
+
+function isJwtPayload(value: unknown): value is JWTPayload {
+	return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function isTimeValid(payload: JWTPayload): boolean {
+	const now = Math.floor(Date.now() / 1000)
+
+	if (typeof payload.exp === 'number' && now >= payload.exp) return false
+	if (typeof payload.nbf === 'number' && now < payload.nbf) return false
+
+	return true
+}

package/src/secrets/index.ts

@@ -1,6 +1,6 @@
-import { InfisicalSDK } from '@infisical/sdk'
 import { networkInterfaces } from 'node:os'
 import { colorize, createCoolLogger } from '../cool-console-log'
+import { loadInfisicalSecrets } from './infisical'
 
 const DEFAULT_INFISICAL_SITE_URL = 'https://eu.infisical.com'
 const LOCAL_IP_VALUE = 'LOCAL_IP'
@@ -38,11 +38,7 @@ export type SecretSet<SecretKey extends string> = {
 	reload: () => Promise<SecretSet<SecretKey>>
 }
 
-type InfisicalSecret = {
-	secretKey: string
-	secretValue: string
-}
-
+export * from './infisical'
 export * from './vite'
 
 export function getSecretEnvironment(): SecretEnvironment {
@@ -135,43 +131,6 @@ export async function defineSecretSet<
 	return secretSet
 }
 
-async function loadInfisicalSecrets<SecretKey extends string>({
-	keys,
-	projectId,
-	environment,
-	siteUrl,
-	clientIdEnvKey,
-	clientSecretEnvKey
-}: SecretSetLoaderContext<SecretKey>): Promise<
-	Partial<Record<SecretKey, string>>
-> {
-	const clientId = process.env[clientIdEnvKey]
-	const clientSecret = process.env[clientSecretEnvKey]
-
-	if (!clientId || !clientSecret) {
-		throw new Error('Missing Infisical credentials')
-	}
-
-	const client = new InfisicalSDK({ siteUrl })
-
-	await client.auth().universalAuth.login({
-		clientId,
-		clientSecret
-	})
-
-	const { secrets } = (await client.secrets().listSecrets({
-		environment,
-		projectId
-	})) as { secrets: InfisicalSecret[] }
-
-	const wantedKeys = new Set<string>(keys)
-	return Object.fromEntries(
-		secrets
-			.filter((secret) => wantedKeys.has(secret.secretKey))
-			.map((secret) => [secret.secretKey, secret.secretValue])
-	) as Partial<Record<SecretKey, string>>
-}
-
 function resolveEnvironment(
 	environment: DefineSecretSetOptions<string>['environment']
 ): SecretEnvironment {