mevebu 2.2.0 → 2.4.0

package/README.md

@@ -2,7 +2,7 @@
 
 # mevebu
 
-**210 free browser tools, one page each. No sign up. No uploads. Everything runs in your tab.**
+**220 free browser tools, one page each. No sign up. No uploads. Everything runs in your tab.**
 
 A private toolbox for the small jobs that do not deserve a whole app: format JSON, decode a JWT, make a password, build a cron line, pick a color, scan a QR code, and a lot more.
 
@@ -10,7 +10,7 @@ A private toolbox for the small jobs that do not deserve a whole app: format JSO
 [![npm downloads](https://img.shields.io/npm/dm/mevebu?color=2ea44f)](https://www.npmjs.com/package/mevebu)
 [![License: MIT](https://img.shields.io/github/license/mevebu/mevebu?color=blue)](./LICENSE)
 [![GitHub stars](https://img.shields.io/github/stars/mevebu/mevebu?style=flat&color=yellow)](https://github.com/mevebu/mevebu/stargazers)
-![Tools](https://img.shields.io/badge/tools-210-brightgreen)
+![Tools](https://img.shields.io/badge/tools-220-brightgreen)
 ![Privacy](https://img.shields.io/badge/privacy-100%25%20in--browser-blue)
 
 [Quick start](#quick-start) · [What's inside](#whats-inside) · [Privacy](#privacy-by-design) · [Credit](#credit) · [Development](#development) · [FAQ](#faq)
@@ -23,7 +23,7 @@ A private toolbox for the small jobs that do not deserve a whole app: format JSO
 
 ## What is mevebu?
 
-mevebu is a collection of **210 small online tools** that all run **inside your browser**. Each tool lives on its own page, does one job, and does it fast. Most of them update as you type, so there is no submit button and no waiting.
+mevebu is a collection of **220 small online tools** that all run **inside your browser**. Each tool lives on its own page, does one job, and does it fast. Most of them update as you type, so there is no submit button and no waiting.
 
 Think of it as a clean, private alternative to the usual "free online tools" websites. There are no accounts, no ads in your way, no uploads, and no tracking. Your text, passwords, tokens, and files stay on your device.
 
@@ -64,13 +64,13 @@ mevebu tries port `5555` first, then `5678`, then `5432`, and finally any free p
 
 ## What's inside
 
-mevebu has **210 tools in 20 categories**. Here is the full breakdown:
+mevebu has **220 tools in 20 categories**. Here is the full breakdown:
 
 | Category           | Tools |
 | ------------------ | ----: |
 | Data Generator     |    10 |
-| Passwords and keys |    15 |
-| Developer          |    21 |
+| Passwords and keys |    20 |
+| Developer          |    26 |
 | Convert            |    15 |
 | Text and data      |    14 |
 | Daily use          |     8 |
@@ -88,7 +88,7 @@ mevebu has **210 tools in 20 categories**. Here is the full breakdown:
 | GitHub             |     8 |
 | Units              |     8 |
 | QR codes           |     2 |
-| **Total**          | **210** |
+| **Total**          | **220** |
 
 The counts come straight from the tool registry, so this table and the app never drift apart.
 
@@ -176,7 +176,7 @@ That is all. The catalog, search, breadcrumbs, and category pages pick it up aut
 ## FAQ
 
 **What is mevebu?**
-mevebu is a free, open source collection of 210 browser based tools for developers, students, creators, and everyday use. Every tool runs locally in your browser.
+mevebu is a free, open source collection of 220 browser based tools for developers, students, creators, and everyday use. Every tool runs locally in your browser.
 
 **Is mevebu really free?**
 Yes. It is MIT licensed, with no paid tier, no account, and no usage limits.

package/mevebu/app/tailwind.css

@@ -578,6 +578,12 @@
   .min-h-24 {
     min-height: calc(var(--spacing) * 24);
   }
+  .min-h-28 {
+    min-height: calc(var(--spacing) * 28);
+  }
+  .min-h-32 {
+    min-height: calc(var(--spacing) * 32);
+  }
   .min-h-40 {
     min-height: calc(var(--spacing) * 40);
   }
@@ -1041,6 +1047,12 @@
       background-color: color-mix(in oklab, var(--danger) 10%, transparent);
     }
   }
+  .bg-danger\/15 {
+    background-color: var(--danger);
+    @supports (color: color-mix(in lab, red, red)) {
+      background-color: color-mix(in oklab, var(--danger) 15%, transparent);
+    }
+  }
   .bg-deck {
     background-color: var(--deck);
   }

package/mevebu/libs/js/core.js

@@ -750,7 +750,7 @@ export function blank(iconName, text) {
 // ---------- version ----------
 
 // Kept in one place. The CLI reads the same value from package.json.
-export const VERSION = "2.2.0";
+export const VERSION = "2.4.0";
 export const PACKAGE_NAME = "mevebu";
 export const REPO_SLUG = "mevebu/mevebu";
 

package/mevebu/libs/js/js-tokens.js

@@ -0,0 +1,195 @@
+// A small JavaScript scanner shared by the formatter and the minifier. It does
+// not build an AST: it separates code from strings, templates, regexes and
+// comments so whitespace can be changed without touching what a token means.
+
+const KEYWORDS_BEFORE_REGEX = new Set([
+  "return", "typeof", "instanceof", "in", "of", "new", "delete", "void", "do",
+  "else", "case", "yield", "await", "throw",
+]);
+
+const PUNCT = [
+  ">>>=", "===", "!==", "**=", "<<=", ">>=", ">>>", "...", "&&=", "||=", "??=",
+  "=>", "==", "!=", "<=", ">=", "&&", "||", "??", "?.", "++", "--", "+=", "-=",
+  "*=", "/=", "%=", "&=", "|=", "^=", "<<", ">>", "**",
+];
+
+const isWordStart = (ch) => /[A-Za-z_$\u0080-\uffff]/.test(ch);
+const isWord = (ch) => /[A-Za-z0-9_$\u0080-\uffff]/.test(ch);
+const isDigit = (ch) => /[0-9]/.test(ch);
+
+function regexAllowed(previous) {
+  if (!previous) return true;
+  if (previous.type === "word") return KEYWORDS_BEFORE_REGEX.has(previous.value);
+  if (previous.type === "number" || previous.type === "string" || previous.type === "template" || previous.type === "regex") return false;
+  if (previous.type === "punct") return ![")", "]", "}"].includes(previous.value);
+  return true;
+}
+
+function scanTemplate(source, start) {
+  let i = start + 1;
+  while (i < source.length) {
+    const ch = source[i];
+    if (ch === "\\") { i += 2; continue; }
+    if (ch === "`") return { end: i + 1 };
+    if (ch === "$" && source[i + 1] === "{") {
+      const inner = scanBraces(source, i + 2);
+      if (inner.error) return inner;
+      i = inner.end;
+      continue;
+    }
+    i++;
+  }
+  return { error: "Unclosed template literal." };
+}
+
+function scanBraces(source, start) {
+  let depth = 1;
+  let i = start;
+  while (i < source.length) {
+    const ch = source[i];
+    if (ch === "'" || ch === '"') {
+      const end = scanString(source, i);
+      if (end.error) return end;
+      i = end.end;
+      continue;
+    }
+    if (ch === "`") {
+      const end = scanTemplate(source, i);
+      if (end.error) return end;
+      i = end.end;
+      continue;
+    }
+    if (ch === "/" && source[i + 1] === "/") {
+      const end = source.indexOf("\n", i);
+      i = end === -1 ? source.length : end;
+      continue;
+    }
+    if (ch === "/" && source[i + 1] === "*") {
+      const end = source.indexOf("*/", i + 2);
+      if (end === -1) return { error: "Unclosed block comment." };
+      i = end + 2;
+      continue;
+    }
+    if (ch === "{") depth++;
+    if (ch === "}") {
+      depth--;
+      if (depth === 0) return { end: i + 1 };
+    }
+    i++;
+  }
+  return { error: "Unclosed ${ in a template literal." };
+}
+
+function scanString(source, start) {
+  const quote = source[start];
+  let i = start + 1;
+  while (i < source.length) {
+    const ch = source[i];
+    if (ch === "\\") { i += 2; continue; }
+    if (ch === quote) return { end: i + 1 };
+    if (ch === "\n") return { error: "Unclosed string." };
+    i++;
+  }
+  return { error: "Unclosed string." };
+}
+
+function scanRegex(source, start) {
+  let i = start + 1;
+  let inClass = false;
+  while (i < source.length) {
+    const ch = source[i];
+    if (ch === "\\") { i += 2; continue; }
+    if (ch === "[") inClass = true;
+    else if (ch === "]") inClass = false;
+    else if (ch === "/" && !inClass) {
+      i++;
+      while (i < source.length && /[a-z]/i.test(source[i])) i++;
+      return { end: i };
+    } else if (ch === "\n") return { error: "Unclosed regular expression." };
+    i++;
+  }
+  return { error: "Unclosed regular expression." };
+}
+
+/**
+ * Split JavaScript into significant tokens. Whitespace is dropped, but each
+ * token remembers whether a newline came before it.
+ * @param {string} source
+ * @returns {{tokens: object[], error: string|null}}
+ */
+export function tokenize(source) {
+  const tokens = [];
+  let i = 0;
+  let newline = false;
+  const push = (token) => {
+    token.newline = newline;
+    newline = false;
+    tokens.push(token);
+  };
+
+  while (i < source.length) {
+    const ch = source[i];
+    if (ch === "\n") { newline = true; i++; continue; }
+    if (/\s/.test(ch)) { i++; continue; }
+
+    if (ch === "/" && source[i + 1] === "/") {
+      const end = source.indexOf("\n", i);
+      const stop = end === -1 ? source.length : end;
+      push({ type: "lineComment", value: source.slice(i, stop) });
+      i = stop;
+      continue;
+    }
+    if (ch === "/" && source[i + 1] === "*") {
+      const end = source.indexOf("*/", i + 2);
+      if (end === -1) return { tokens, error: "Unclosed block comment." };
+      push({ type: "blockComment", value: source.slice(i, end + 2) });
+      i = end + 2;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      const result = scanString(source, i);
+      if (result.error) return { tokens, error: result.error };
+      push({ type: "string", value: source.slice(i, result.end) });
+      i = result.end;
+      continue;
+    }
+    if (ch === "`") {
+      const result = scanTemplate(source, i);
+      if (result.error) return { tokens, error: result.error };
+      push({ type: "template", value: source.slice(i, result.end) });
+      i = result.end;
+      continue;
+    }
+    if (ch === "/" && regexAllowed(tokens[tokens.length - 1])) {
+      const result = scanRegex(source, i);
+      if (result.error) return { tokens, error: result.error };
+      push({ type: "regex", value: source.slice(i, result.end) });
+      i = result.end;
+      continue;
+    }
+    if (isDigit(ch) || (ch === "." && isDigit(source[i + 1]))) {
+      const match = source.slice(i).match(/^(?:0[xX][0-9a-fA-F_]+|0[bB][01_]+|0[oO][0-7_]+|(?:\d[\d_]*)?\.?\d[\d_]*(?:[eE][+-]?\d[\d_]*)?n?)/);
+      const value = match ? match[0] : ch;
+      push({ type: "number", value });
+      i += value.length;
+      continue;
+    }
+    if (isWordStart(ch)) {
+      let end = i + 1;
+      while (end < source.length && isWord(source[end])) end++;
+      push({ type: "word", value: source.slice(i, end) });
+      i = end;
+      continue;
+    }
+    const multi = PUNCT.find((entry) => source.startsWith(entry, i));
+    const value = multi || ch;
+    push({ type: "punct", value });
+    i += value.length;
+  }
+
+  return { tokens, error: null };
+}
+
+export function bytes(text) {
+  return new TextEncoder().encode(text).length;
+}

package/mevebu/libs/js/registry.js

@@ -481,7 +481,187 @@ export const TOOLS = [
     keywords: "aes encrypt decrypt password gcm pbkdf2 secret message",
     load: () => import("./tools/aes-text.js"),
   },
+  {
+    id: "rsa-key-pair",
+    category: "security",
+    name: "RSA Key Pair",
+    icon: "key-round",
+    note: "Make an RSA key pair in PEM form.",
+    about: "Generated in this tab with Web Crypto. Public as SPKI, private as PKCS#8.",
+    tutorial: {
+      intro: "Generate an RSA key pair and copy or download the PEM files.",
+      steps: [
+        "Pick a key size. 2048 is the common floor.",
+        "Press Generate pair and wait a moment for larger keys.",
+        "Copy or download the public and private PEM. Closing the page discards them.",
+      ],
+    },
+    keywords: "rsa key pair pem public private ssh jwt tls generate spki pkcs8",
+    load: () => import("./tools/rsa-key-pair.js"),
+  },
+  {
+    id: "bcrypt-hash",
+    category: "security",
+    name: "Bcrypt Hash",
+    icon: "hash",
+    note: "Hash a password with bcrypt, and check one.",
+    about: "Bcrypt with a cost factor you set, run in this tab with a vendored engine.",
+    tutorial: {
+      intro: "Make a bcrypt hash for a test login, or check a password against one you already have.",
+      steps: [
+        "Type a password and pick a cost factor. 10 is a common default.",
+        "Press Hash password. The timing shows how long this device takes.",
+        "To check, paste a stored hash and the password. The verdict updates as you type.",
+      ],
+    },
+    keywords: "bcrypt hash password login test salt cost compare verify",
+    load: () => import("./tools/bcrypt-hash.js"),
+  },
+  {
+    id: "password-policy",
+    category: "security",
+    name: "Password Policy Builder",
+    icon: "list-checks",
+    note: "Turn a password rule into text, a regex, and a checklist.",
+    about: "The wording, the pattern, and a live check all come from the same settings.",
+    tutorial: {
+      intro: "Write a password policy once, in every form you need.",
+      steps: [
+        "Set the length and the character classes.",
+        "Read the rule in plain words and copy the regex.",
+        "Type a sample password to see which part it fails.",
+      ],
+    },
+    keywords: "password policy regex rule requirements checklist enforce",
+    load: () => import("./tools/password-policy.js"),
+  },
+  {
+    id: "secret-scanner",
+    category: "security",
+    name: "Secret Scanner",
+    icon: "shield-alert",
+    note: "Find API keys and tokens before you paste them.",
+    about: "Known shapes for AWS, GitHub, Slack, Stripe, Google, JWTs and private keys.",
+    tutorial: {
+      intro: "Catch a leaked key before it goes into a chat.",
+      steps: [
+        "Paste the text, or drop a file.",
+        "Read the matches with their line numbers. Values are masked by default.",
+        "Rotate anything listed. A clean result is a hint, not a guarantee.",
+      ],
+    },
+    keywords: "secret scanner leak api key token private key aws github slack stripe jwt detect",
+    load: () => import("./tools/secret-scanner.js"),
+  },
+  {
+    id: "ssh-fingerprint",
+    category: "security",
+    name: "SSH Fingerprint",
+    icon: "fingerprint",
+    note: "Read the fingerprint of an SSH public key.",
+    about: "The SHA-256 form a server prints, plus the older MD5 form for comparison.",
+    tutorial: {
+      intro: "Compare a host fingerprint before you trust it.",
+      steps: [
+        "Paste the public key line, for example ssh-ed25519 AAAAC3...",
+        "Read the fingerprint and compare it with the one the host shows.",
+        "Use the MD5 form only for an old server that still prints that.",
+      ],
+    },
+    keywords: "ssh fingerprint public key sha256 md5 host verify known_hosts",
+    load: () => import("./tools/ssh-fingerprint.js"),
+  },
 
+  {
+    id: "javascript-formatter",
+    category: "developer",
+    name: "JavaScript Formatter",
+    icon: "file-code",
+    note: "Indent a JavaScript file so it reads like code again.",
+    about: "Re-indents tokens and keeps strings, templates, regexes and comments as they were.",
+    tutorial: {
+      intro: "Paste a script and get the same code with readable indentation.",
+      steps: [
+        "Paste the script. Pick two or four spaces.",
+        "Read the first bracket or string problem if the script cannot be laid out.",
+        "Copy the result. Only whitespace changed, not the code.",
+      ],
+    },
+    keywords: "javascript js format beautify indent pretty print code",
+    load: () => import("./tools/javascript-formatter.js"),
+  },
+  {
+    id: "javascript-minifier",
+    category: "developer",
+    name: "JavaScript Minifier",
+    icon: "minimize-2",
+    note: "Strip comments and extra whitespace from JavaScript.",
+    about: "Shows the bytes before and after. Variables are never renamed.",
+    tutorial: {
+      intro: "Make a script smaller without changing what it does.",
+      steps: [
+        "Paste the script.",
+        "Read the size before and after, and the percentage saved.",
+        "Copy the result. Keep license comments with /*! or @license.",
+      ],
+    },
+    keywords: "javascript js minify compress whitespace comments size",
+    load: () => import("./tools/javascript-minifier.js"),
+  },
+  {
+    id: "yaml-to-json",
+    category: "developer",
+    name: "YAML to JSON",
+    icon: "braces",
+    note: "Turn a YAML document into JSON.",
+    about: "Anchors are resolved, comments are dropped, and the key order stays.",
+    tutorial: {
+      intro: "Convert a config file for an API or a script that expects JSON.",
+      steps: [
+        "Paste the YAML.",
+        "Read the JSON on the right. An invalid document reports its line.",
+        "Copy it or download data.json.",
+      ],
+    },
+    keywords: "yaml yml to json convert config kubernetes ci",
+    load: () => import("./tools/yaml-to-json.js"),
+  },
+  {
+    id: "json-to-yaml",
+    category: "developer",
+    name: "JSON to YAML",
+    icon: "file-text",
+    note: "Write JSON as block or flow YAML.",
+    about: "Two-space block style by default, with a flow toggle for compact output.",
+    tutorial: {
+      intro: "Turn an API response into a config file.",
+      steps: [
+        "Paste the JSON.",
+        "Pick Block or Flow. Block reads better, flow is shorter.",
+        "Copy the YAML or download data.yaml.",
+      ],
+    },
+    keywords: "json to yaml yml convert config block flow",
+    load: () => import("./tools/json-to-yaml.js"),
+  },
+  {
+    id: "xml-minifier",
+    category: "developer",
+    name: "XML Minifier",
+    icon: "code",
+    note: "Remove indentation between XML tags.",
+    about: "CDATA, comments and attribute values are copied unchanged.",
+    tutorial: {
+      intro: "Compact an XML file without touching its content.",
+      steps: [
+        "Paste the XML.",
+        "Read the size saved. Text that is not only whitespace stays.",
+        "Copy the result.",
+      ],
+    },
+    keywords: "xml minify compact whitespace cdata size",
+    load: () => import("./tools/xml-minifier.js"),
+  },
   {
     id: "uuid-generator",
     category: "developer",

package/mevebu/libs/js/tools/bcrypt-hash.js

@@ -0,0 +1,161 @@
+// Bcrypt, for testing a login. The hash and the check both run in this tab with a
+// vendored pure JavaScript build, so no password leaves the page. The cost factor
+// is the point: each step doubles the work, and the timing shows it.
+import {
+  el, toast, bench, stack, panel, textInput, numberInput, button, actions,
+  toolcard, notice, copyButton, output, chipRow,
+} from "../core.js";
+
+const COST_MIN = 4;
+const COST_MAX = 14;
+
+function bcryptLib() {
+  const lib = globalThis.dcodeIO?.bcrypt ?? globalThis.bcrypt;
+  if (!lib) throw new Error("The bcrypt engine did not load.");
+  return lib;
+}
+
+function loadEngine() {
+  if (globalThis.dcodeIO?.bcrypt || globalThis.bcrypt) return Promise.resolve(bcryptLib());
+  return new Promise((resolve, reject) => {
+    const script = document.createElement("script");
+    script.src = new URL("../vendor/bcrypt.min.js", import.meta.url).href;
+    script.onload = () => {
+      try {
+        resolve(bcryptLib());
+      } catch (caught) {
+        reject(caught);
+      }
+    };
+    script.onerror = () => reject(new Error("The bcrypt engine could not be loaded."));
+    document.head.append(script);
+  });
+}
+
+const tick = () => new Promise((resolve) => setTimeout(resolve, 0));
+
+export function mount(slot) {
+  let hashed = "";
+  let busy = false;
+  let token = 0;
+
+  const password = textInput({
+    type: "password",
+    placeholder: "The password to hash",
+    "aria-label": "Password",
+    autocomplete: "new-password",
+  });
+  const show = el("input", { type: "checkbox", class: "m-0 size-4 accent-[var(--jade)]" });
+  const cost = numberInput({ min: String(COST_MIN), max: String(COST_MAX), step: "1", value: "10", "aria-label": "Cost factor" });
+  const costLabel = el("span", { class: "text-sm font-semibold text-ink-2 tabular-nums" }, "");
+
+  const existing = textInput({
+    placeholder: "$2b$10$...",
+    "aria-label": "Hash to check",
+    class: "font-mono text-sm",
+    autocomplete: "off",
+    spellcheck: "false",
+  });
+
+  const error = notice("warn");
+  const summary = el("p", { class: "text-sm text-ink-2" });
+  const hashOut = output({ rows: 3 });
+  const verdict = el("p", { class: "m-0 text-sm font-semibold" });
+
+  function syncCost() {
+    const value = Math.max(COST_MIN, Math.min(COST_MAX, Number(cost.value) || 10));
+    costLabel.textContent = `${value} · about ${2 ** value} rounds`;
+  }
+
+  async function hash() {
+    if (busy) return;
+    if (!password.value) {
+      error.write("Type a password first.");
+      return;
+    }
+    busy = true;
+    const current = ++token;
+    error.write("");
+    summary.textContent = "Hashing";
+    try {
+      const lib = await loadEngine();
+      const rounds = Math.max(COST_MIN, Math.min(COST_MAX, Number(cost.value) || 10));
+      await tick();
+      const started = performance.now();
+      const salt = lib.genSaltSync(rounds);
+      const result = lib.hashSync(password.value, salt);
+      const took = performance.now() - started;
+      if (current !== token) return;
+      hashed = result;
+      hashOut.write(result);
+      summary.textContent = `cost ${rounds} · ${Math.round(took)} ms on this device`;
+      toast("Hash ready");
+    } catch (caught) {
+      if (current !== token) return;
+      error.write(caught?.message || "The hash could not be made.");
+    } finally {
+      busy = false;
+    }
+  }
+
+  async function check() {
+    const stored = existing.value.trim();
+    verdict.textContent = "";
+    if (!stored) return;
+    if (!/^\$2[abxy]\$\d{2}\$.{53}$/.test(stored)) {
+      verdict.textContent = "That is not a bcrypt hash. It should start with $2b$ and be 60 characters.";
+      verdict.className = "m-0 text-sm font-semibold text-danger";
+      return;
+    }
+    if (!password.value) {
+      verdict.textContent = "Type the password to check against that hash.";
+      verdict.className = "m-0 text-sm font-semibold text-ink-2";
+      return;
+    }
+    try {
+      const lib = await loadEngine();
+      const ok = lib.compareSync(password.value, stored);
+      verdict.textContent = ok ? "Match: this password produces that hash." : "No match for that password.";
+      verdict.className = ok ? "m-0 text-sm font-semibold text-jade" : "m-0 text-sm font-semibold text-danger";
+    } catch (caught) {
+      verdict.textContent = caught?.message || "The check could not run.";
+      verdict.className = "m-0 text-sm font-semibold text-danger";
+    }
+  }
+
+  show.addEventListener("change", () => {
+    password.type = show.checked ? "text" : "password";
+  });
+  password.addEventListener("input", check);
+  existing.addEventListener("input", check);
+  cost.addEventListener("input", syncCost);
+
+  const copy = copyButton(() => hashed, "Copy hash");
+  const hashButton = button("Hash password", { icon: "hash", kind: "fill", onclick: hash });
+
+  syncCost();
+
+  const shell = toolcard({
+    body: bench(
+      stack(
+        panel("Password", password),
+        el("label", { class: "inline-flex min-h-9 cursor-pointer items-center gap-2 text-sm text-ink-2" }, show, "Show password"),
+        panel("Cost factor", cost, "Each step doubles the work. 10 is a common default; 12 is slower and safer."),
+        costLabel,
+        panel("Hash to check", existing, "Paste a stored hash to see whether the password matches it."),
+        verdict,
+        error
+      ),
+      stack(summary, hashOut,
+        el("p", { class: "m-0 text-2xs leading-[1.6] text-ink-3" },
+          "Bcrypt is a password hash, not encryption. The salt is in the hash, so the same password gives a different result each time. Use the timing to pick a cost your server can afford."))
+    ),
+    foot: actions(copy, hashButton),
+  });
+
+  slot.append(shell.node);
+
+  return {};
+}
+
+export default { mount };