perimetercli 0.1.0

package/src/serve.js

@@ -0,0 +1,64 @@
+import http from "node:http";
+import fs from "node:fs";
+import path from "node:path";
+
+const MIME = {
+  ".html": "text/html; charset=utf-8",
+  ".htm": "text/html; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".json": "application/json",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".md": "text/markdown; charset=utf-8",
+  ".txt": "text/plain; charset=utf-8",
+  ".sarif": "application/json; charset=utf-8",
+};
+
+export function createStaticServer(dir, { host = "127.0.0.1", port = 0 } = {}) {
+  const root = path.resolve(dir);
+  const server = http.createServer((req, res) => {
+    try {
+      let urlPath = decodeURIComponent((req.url || "/").split("?")[0]);
+      if (urlPath === "/") urlPath = "/index.html";
+      const candidate = path.normalize(path.join(root, urlPath));
+      if (!candidate.startsWith(root)) {
+        res.writeHead(403);
+        res.end("Forbidden");
+        return;
+      }
+      let file = candidate;
+      if (fs.existsSync(file) && fs.statSync(file).isDirectory()) {
+        file = path.join(file, "index.html");
+      }
+      if (!fs.existsSync(file)) {
+        const index = path.join(root, "index.html");
+        if (fs.existsSync(index)) {
+          file = index;
+        } else {
+          res.writeHead(404, { "Content-Type": "text/plain" });
+          res.end("Not found");
+          return;
+        }
+      }
+      const stat = fs.statSync(file);
+      res.writeHead(200, {
+        "Content-Type": MIME[path.extname(file).toLowerCase()] || "application/octet-stream",
+        "Content-Length": stat.size,
+        "Cache-Control": "no-cache",
+      });
+      fs.createReadStream(file).pipe(res);
+    } catch {
+      res.writeHead(500);
+      res.end("Internal error");
+    }
+  });
+  return { server, root };
+}
+
+export function listen(server, { host = "127.0.0.1", port = 0 } = {}) {
+  return new Promise((resolve, reject) => {
+    server.on("error", reject);
+    server.listen(port, host, () => resolve(server.address()));
+  });
+}

package/src/server.js

@@ -0,0 +1,194 @@
+import http from "node:http";
+import fs from "node:fs";
+import path from "node:path";
+import { escapeHtml, isoNow } from "./util.js";
+import { money } from "./tokens.js";
+
+function slugify(name) {
+  return String(name || "project")
+    .toLowerCase()
+    .trim()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/(^-|-$)/g, "")
+    .slice(0, 64) || "project";
+}
+
+function sevColor(sev) {
+  return {
+    critical: "#ef4444",
+    high: "#f97316",
+    medium: "#facc15",
+    low: "#3b82f6",
+    info: "#94a3b8",
+  }[sev] || "#94a3b8";
+}
+
+function listProjects(dataDir) {
+  if (!fs.existsSync(dataDir)) return [];
+  const projects = [];
+  for (const entry of fs.readdirSync(dataDir, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const latest = path.join(dataDir, entry.name, "latest.json");
+    if (!fs.existsSync(latest)) continue;
+    let audit;
+    try {
+      audit = JSON.parse(fs.readFileSync(latest, "utf8"));
+    } catch {
+      continue;
+    }
+    projects.push({ slug: entry.name, latest: audit });
+  }
+  projects.sort(
+    (a, b) => new Date(b.latest.generatedAt || 0) - new Date(a.latest.generatedAt || 0)
+  );
+  return projects;
+}
+
+function renderDashboard(projects) {
+  const cards = projects
+    .map((p) => {
+      const a = p.latest;
+      const verdict = a.effectiveVerdict || a.verdict || "info";
+      const counts = a.counts || {};
+      const findings = (a.findings || []).length;
+      const tokens = a.costs?.totalTokens ?? 0;
+      const cost = a.costs?.perLoadCost ?? 0;
+      return `<a class="card" href="/projects/${escapeHtml(p.slug)}">
+        <div class="row"><span class="name">${escapeHtml(a.name || p.slug)}</span><span class="verdict" style="background:${sevColor(verdict)}">${escapeHtml(verdict.toUpperCase())}</span></div>
+        <div class="meta">${findings} findings · ${counts.critical ?? 0} critical · ${counts.high ?? 0} high</div>
+        <div class="meta">${tokens.toLocaleString()} tokens/load · ${money(cost)}/load</div>
+        <div class="meta dim">${escapeHtml((a.generatedAt || "").slice(0, 19).replace("T", " "))}</div>
+      </a>`;
+    })
+    .join("\n");
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Perimeter — fleet audit</title><style>
+:root{--bg:#0b0f17;--bg2:#111827;--border:#1f2937;--text:#e5e7eb;--muted:#94a3b8}
+*{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--text);font-family:ui-sans-serif,system-ui,sans-serif;line-height:1.6}
+.wrap{max-width:1000px;margin:0 auto;padding:32px 24px}h1{letter-spacing:-.02em}
+.grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(280px,1fr));gap:16px;margin-top:20px}
+.card{background:var(--bg2);border:1px solid var(--border);border-radius:14px;padding:18px;text-decoration:none;color:var(--text)}
+.card:hover{border-color:#6366f1}.row{display:flex;justify-content:space-between;align-items:center;gap:12px}
+.name{font-weight:700;font-size:16px}.verdict{color:#fff;font-weight:700;font-size:12px;padding:3px 10px;border-radius:999px}
+.meta{color:var(--muted);font-size:13px;margin-top:8px}.dim{opacity:.7}.muted{color:var(--muted)}
+.empty{color:var(--muted);padding:20px 0}footer{margin-top:32px;color:var(--muted);font-size:13px;text-align:center}
+</style></head><body><div class="wrap"><h1>Perimeter · fleet audit</h1>
+<p class="muted">Continuous audit history. Push a report with <code>perimeter push &lt;url&gt; --project &lt;name&gt;</code>.</p>
+${cards ? `<div class="grid">${cards}</div>` : `<p class="empty">No audits yet.</p>`}
+<footer>Perimeter server</footer></div></body></html>`;
+}
+
+function renderProject(slug, audits) {
+  const latest = audits[0];
+  const a = latest;
+  const verdict = a.effectiveVerdict || a.verdict || "info";
+  const findings = (a.findings || []).slice(0, 60);
+  const findingsHtml = findings.length
+    ? findings.map((f) => `<div class="f">
+        <span class="sev" style="color:${sevColor(f.severity)}">${escapeHtml((f.severity || "").toUpperCase())}</span>
+        <code>${escapeHtml(f.id)}</code> <strong>${escapeHtml(f.title)}</strong>
+        <div class="dim">${escapeHtml(f.server || "")} — ${escapeHtml(f.detail || "")}</div>
+      </div>`).join("\n")
+    : `<p class="muted">No findings.</p>`;
+  const history = audits.map((u) => {
+    const v = u.effectiveVerdict || u.verdict || "info";
+    return `<li><span class="verdict" style="background:${sevColor(v)}">${escapeHtml(v.toUpperCase())}</span> ${escapeHtml(
+      (u.generatedAt || "").slice(0, 19).replace("T", " ")
+    )} · ${(u.findings || []).length} findings</li>`;
+  }).join("\n");
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>${escapeHtml(a.name || slug)} — Perimeter</title><style>
+:root{--bg:#0b0f17;--bg2:#111827;--border:#1f2937;--text:#e5e7eb;--muted:#94a3b8}
+*{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--text);font-family:ui-sans-serif,system-ui,sans-serif;line-height:1.6}
+.wrap{max-width:960px;margin:0 auto;padding:32px 24px}h1{letter-spacing:-.02em}
+.f{background:var(--bg2);border:1px solid var(--border);border-radius:12px;padding:12px 16px;margin:10px 0}
+.sev{font-weight:800;font-size:12px;margin-right:8px}.dim{color:var(--muted);font-size:13px;margin-top:4px}
+code{background:#0f172a;padding:1px 6px;border-radius:5px}ul{list-style:none;padding:0}
+li{display:flex;align-items:center;gap:10px;padding:6px 0}.verdict{color:#fff;font-weight:700;font-size:11px;padding:2px 9px;border-radius:999px}
+.muted{color:var(--muted)}a{color:#fca5a5}
+</style></head><body><div class="wrap"><a href="/">← Fleet</a>
+<h1>${escapeHtml(a.name || slug)}</h1>
+<p class="muted">${audits.length} audit(s) · latest ${escapeHtml(verdict.toUpperCase())}</p>
+<h2>History</h2><ul>${history || "<li class=\"muted\">none</li>"}</ul>
+<h2>Latest findings</h2>${findingsHtml}
+</div></body></html>`;
+}
+
+function readAudits(dataDir, slug) {
+  const dir = path.join(dataDir, slug);
+  if (!fs.existsSync(dir)) return [];
+  return fs
+    .readdirSync(dir)
+    .filter((f) => f.endsWith(".json") && f !== "latest.json")
+    .map((f) => {
+      try {
+        return JSON.parse(fs.readFileSync(path.join(dir, f), "utf8"));
+      } catch {
+        return null;
+      }
+    })
+    .filter(Boolean)
+    .sort((a, b) => new Date(b.generatedAt || 0) - new Date(a.generatedAt || 0));
+}
+
+export function createServer({ dataDir = ".perimeter/data", host = "127.0.0.1", port = 0 } = {}) {
+  fs.mkdirSync(dataDir, { recursive: true });
+  const server = http.createServer((req, res) => {
+    const url = new URL(req.url || "/", `http://${host}`);
+    const pathname = url.pathname;
+    res.setHeader("Content-Type", "text/html; charset=utf-8");
+    if (req.method === "POST" && pathname === "/audit") {
+      let body = "";
+      req.on("data", (c) => (body += c));
+      req.on("end", () => {
+        try {
+          const audit = JSON.parse(body);
+          const project = url.searchParams.get("project") || audit.name || "project";
+          const slug = slugify(project);
+          const dir = path.join(dataDir, slug);
+          fs.mkdirSync(dir, { recursive: true });
+          const ts = new Date().toISOString().replace(/[:.]/g, "-");
+          fs.writeFileSync(path.join(dir, `${ts}.json`), JSON.stringify(audit, null, 2));
+          fs.writeFileSync(path.join(dir, "latest.json"), JSON.stringify(audit, null, 2));
+          res.writeHead(200);
+          res.end(JSON.stringify({ ok: true, project: slug }));
+        } catch (err) {
+          res.writeHead(500);
+          res.end(JSON.stringify({ ok: false, error: String(err.message) }));
+        }
+      });
+      return;
+    }
+    if (pathname === "/" || pathname === "") {
+      res.end(renderDashboard(listProjects(dataDir)));
+      return;
+    }
+    const projectMatch = pathname.match(/^\/projects\/([a-z0-9-]+)\/?$/);
+    if (projectMatch) {
+      const slug = projectMatch[1];
+      const audits = readAudits(dataDir, slug);
+      if (audits.length === 0) {
+        res.writeHead(404);
+        res.end("Not found");
+      } else {
+        res.end(renderProject(slug, audits));
+      }
+      return;
+    }
+    if (pathname === "/health") {
+      res.setHeader("Content-Type", "application/json");
+      res.end(JSON.stringify({ ok: true }));
+      return;
+    }
+    res.writeHead(404);
+    res.end("Not found");
+  });
+  return { server, dataDir };
+}
+
+export function listen(server, { host = "127.0.0.1", port = 0 } = {}) {
+  return new Promise((resolve, reject) => {
+    server.on("error", reject);
+    server.listen(port, host, () => resolve(server.address()));
+  });
+}

package/src/sessions.js

@@ -0,0 +1,161 @@
+import os from "node:os";
+import path from "node:path";
+import fs from "node:fs";
+import { readIfExists, walkFiles } from "./util.js";
+import { estimateCost, tokensForText, resolveModel } from "./tokens.js";
+
+const HOME = os.homedir();
+
+// Claude Code tool name → capability + severity when actually used.
+const TOOL_PROFILES = {
+  Bash: { capability: "shell", severity: "critical" },
+  Write: { capability: "filesystem-write", severity: "medium" },
+  Edit: { capability: "filesystem-write", severity: "medium" },
+  MultiEdit: { capability: "filesystem-write", severity: "medium" },
+  NotebookEdit: { capability: "code-exec", severity: "high" },
+  WebFetch: { capability: "network-in", severity: "low" },
+  WebSearch: { capability: "network-in", severity: "low" },
+  Task: { capability: "subagent", severity: "info" },
+  TodoWrite: { capability: "todo", severity: "info" },
+  Grep: { capability: "search", severity: "info" },
+};
+
+export function findSessionDirs(cwd, opts = {}) {
+  const dirs = [
+    path.join(cwd, "sessions"),
+    path.join(cwd, ".perimeter", "sessions"),
+    path.join(cwd, ".claude", "projects"),
+  ];
+  if (opts.home !== false && HOME !== cwd) {
+    dirs.push(path.join(HOME, ".claude", "projects"));
+    dirs.push(path.join(HOME, ".codex", "sessions"));
+  }
+  if (opts.sessions) dirs.push(opts.sessions);
+  return dirs.filter((d) => d && fs.existsSync(d));
+}
+
+export function findSessions(cwd, opts = {}) {
+  const files = [];
+  for (const dir of findSessionDirs(cwd, opts)) {
+    for (const f of walkFiles(dir, [".git", "node_modules"])) {
+      if (f.endsWith(".jsonl")) files.push(f);
+    }
+  }
+  return files;
+}
+
+/**
+ * Parse a Claude Code (or Codex-compatible) JSONL session.
+ * Returns { file, tools, inputTokens, outputTokens, messages }.
+ */
+export function parseSessionFile(file) {
+  const raw = readIfExists(file) || "";
+  const lines = raw.split(/\r?\n/).filter(Boolean);
+  const tools = {};
+  let inputTokens = 0;
+  let outputTokens = 0;
+  let messages = 0;
+  let runs = 0;
+
+  for (const line of lines) {
+    let obj;
+    try {
+      obj = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (obj && obj.type === "assistant") {
+      messages++;
+      const usage = obj.message && obj.message.usage;
+      if (usage) {
+        inputTokens += Number(usage.input_tokens) || 0;
+        outputTokens += Number(usage.output_tokens) || 0;
+      }
+      const content = (obj.message && obj.message.content) || [];
+      if (Array.isArray(content)) {
+        for (const block of content) {
+          if (block && block.type === "tool_use" && block.name) {
+            tools[block.name] = (tools[block.name] || 0) + 1;
+          }
+        }
+      }
+    } else if (obj && obj.type === "user") {
+      messages++;
+    } else if (obj && obj.message && obj.message.role) {
+      // Generic/Codex-ish line
+      messages++;
+      const content = obj.message.content || obj.message.role === "assistant"
+        ? obj.message.content
+        : null;
+      if (Array.isArray(content)) {
+        for (const block of content) {
+          if (block && block.name) {
+            tools[block.name] = (tools[block.name] || 0) + 1;
+          }
+        }
+      }
+    }
+  }
+  runs = messages ? 1 : 0;
+  return { file, tools, inputTokens, outputTokens, messages, runs, tokenized: false };
+}
+
+function tokenizeTool(name, desc) {
+  return tokensForText(`${name} ${desc}`);
+}
+
+/**
+ * Build a runtime observability report from session logs.
+ */
+export function buildSessionReport(cwd, opts = {}) {
+  const files = findSessions(cwd, opts);
+  const sessions = [];
+  // Track a stable "tool risk" across all runs.
+  const toolTotals = {};
+  let inputTokens = 0;
+  let outputTokens = 0;
+  let messages = 0;
+
+  for (const file of files) {
+    const parsed = parseSessionFile(file);
+    if (parsed.messages === 0) continue;
+    inputTokens += parsed.inputTokens;
+    outputTokens += parsed.outputTokens;
+    messages += parsed.messages;
+    for (const [name, count] of Object.entries(parsed.tools)) {
+      toolTotals[name] = (toolTotals[name] || 0) + count;
+    }
+    sessions.push(parsed);
+  }
+
+  const tools = Object.entries(toolTotals)
+    .map(([name, count]) => {
+      const profile = TOOL_PROFILES[name] || { capability: "unrecognised", severity: "info" };
+      return {
+        name,
+        count,
+        capability: profile.capability,
+        severity: profile.severity,
+      };
+    })
+    .sort((a, b) => b.count - a.count);
+
+  // If real usage totals are unavailable, fall back to an estimate from the
+  // message text so the report is still actionable.
+  const totalTokens = inputTokens + outputTokens;
+  const cost = estimateCost(totalTokens || messages * 600, opts.model || "claude-sonnet");
+
+  return {
+    generatedAt: new Date().toISOString(),
+    sessions: sessions.length,
+    files: files.length,
+    messages,
+    inputTokens,
+    outputTokens,
+    totalTokens,
+    usageExact: inputTokens > 0 || outputTokens > 0,
+    tools,
+    riskyTools: tools.filter((t) => ["critical", "high"].includes(t.severity)),
+    cost,
+  };
+}

package/src/tokens.js

@@ -0,0 +1,99 @@
+/**
+ * Dependency-free token and cost estimation. Token counts are heuristic
+ * (≈ chars/4 for English + structure overhead) — deliberately conservative and
+ * deterministic, so reports are reproducible offline.
+ */
+
+export const MODEL_PRICES = {
+  "claude-opus": { in: 15, out: 75 },
+  "claude-sonnet": { in: 3, out: 15 },
+  "claude-haiku": { in: 1, out: 5 },
+  "gpt-5": { in: 1.25, out: 10 },
+  "gpt-4o": { in: 2.5, out: 10 },
+  "gpt-4.1": { in: 2, out: 8 },
+  "o3": { in: 2, out: 8 },
+  "gemini-2.5-pro": { in: 1.25, out: 10 },
+  "gemini-2.5-flash": { in: 0.3, out: 2.5 },
+  "deepseek-v3": { in: 0.27, out: 1.1 },
+  "grok-4": { in: 3, out: 15 },
+  "llama-4": { in: 0.5, out: 0.5 },
+};
+
+const MODEL_ALIASES = {
+  "claude-4-opus": "claude-opus",
+  "claude-4-sonnet": "claude-sonnet",
+  "claude-3-7-sonnet": "claude-sonnet",
+  "claude-3-5-sonnet": "claude-sonnet",
+  "claude-opus-4": "claude-opus",
+  "claude-sonnet-4": "claude-sonnet",
+  "gpt-5": "gpt-5",
+  "gpt-4o": "gpt-4o",
+  "gpt-4.1": "gpt-4.1",
+  "o3": "o3",
+  "grok-4": "grok-4",
+  "grok-3": "grok-4",
+  "deepseek": "deepseek-v3",
+};
+
+export function resolveModel(model) {
+  const key = String(model || "").toLowerCase().trim();
+  const canonical = MODEL_ALIASES[key] || key;
+  const price = MODEL_PRICES[canonical];
+  return {
+    name: canonical || "generic",
+    in: price?.in ?? 5,
+    out: price?.out ?? 15,
+    estimated: !price,
+  };
+}
+
+/**
+ * Estimate tokens for a single schema string. We add a small structural
+ * overhead for JSON punctuation and whitespace.
+ */
+export function tokensForText(text) {
+  const clean = String(text || "");
+  const asciiChars = clean.length;
+  const words = clean.split(/\s+/).filter(Boolean).length;
+  // Blend a char/4 estimate with a word-based estimate.
+  const byChar = asciiChars / 4;
+  const byWord = words * 1.3 + 5;
+  return Math.max(1, Math.ceil((byChar + byWord) / 2));
+}
+
+/** Estimate tokens for a list of tools (name + description + input schema). */
+export function tokensForTools(tools, overhead = 400) {
+  let total = overhead;
+  for (const tool of tools || []) {
+    total += tokensForText(tool?.name || "");
+    total += tokensForText(tool?.description || "");
+    total += tokensForText(JSON.stringify(tool?.inputSchema || {}));
+  }
+  return total;
+}
+
+/** Costs, in dollars, to load a server (input tokens) and per assumed turn. */
+export function estimateCost(inputTokens, model = "claude-sonnet", opts = {}) {
+  const resolved = resolveModel(model);
+  const outputFactor = opts.outputFactor ?? 0.5; // approximate output/turn
+  const perLoadInput = inputTokens / 1_000_000 * resolved.in;
+  const perLoadOutput = inputTokens / 1_000_000 * resolved.out * outputFactor;
+  return {
+    model: resolved.name,
+    inputRate: resolved.in,
+    outputRate: resolved.out,
+    estimated: resolved.estimated,
+    perLoad: perLoadInput + perLoadOutput,
+    perLoadInput,
+    perLoadOutput,
+  };
+}
+
+/** Format a dollar amount in a readable way. */
+export function money(value) {
+  if (value === null || value === undefined || Number.isNaN(value)) return "—";
+  if (value === 0) return "$0.00";
+  if (value < 0.01) return "<$0.01";
+  if (value < 1) return `$${value.toFixed(2)}`;
+  return `$${value.toFixed(2)}`;
+}

package/src/util.js

@@ -0,0 +1,137 @@
+import fs from "node:fs";
+import path from "node:path";
+import crypto from "node:crypto";
+
+export const colors = {
+  reset: "\x1b[0m",
+  bold: "\x1b[1m",
+  dim: "\x1b[2m",
+  gray: "\x1b[90m",
+  cyan: "\x1b[36m",
+  green: "\x1b[32m",
+  yellow: "\x1b[33m",
+  red: "\x1b[31m",
+  magenta: "\x1b[35m",
+  blue: "\x1b[34m",
+};
+
+const useColor = process.stdout.isTTY && !process.env.NO_COLOR;
+const paint = (text, code) =>
+  useColor ? `${colors[code] ?? ""}${text}${colors.reset}` : text;
+
+export const dim = (s) => paint(s, "dim");
+export const bold = (s) => paint(s, "bold");
+export const green = (s) => paint(s, "green");
+export const red = (s) => paint(s, "red");
+export const cyan = (s) => paint(s, "cyan");
+export const yellow = (s) => paint(s, "yellow");
+export const magenta = (s) => paint(s, "magenta");
+export const gray = (s) => paint(s, "gray");
+
+export function log(msg = "") {
+  process.stdout.write(`${msg}\n`);
+}
+export function info(msg) {
+  process.stdout.write(`${cyan("•")} ${msg}\n`);
+}
+export function success(msg) {
+  process.stdout.write(`${green("✓")} ${msg}\n`);
+}
+export function warn(msg) {
+  process.stderr.write(`${yellow("warn")}: ${msg}\n`);
+}
+export function error(msg) {
+  process.stderr.write(`${red("error")}: ${msg}\n`);
+}
+
+export function readIfExists(file) {
+  try {
+    return fs.readFileSync(file, "utf8");
+  } catch {
+    return null;
+  }
+}
+export function readJson(file) {
+  const raw = readIfExists(file);
+  if (!raw) return null;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+export function writeJson(file, value) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, JSON.stringify(value, null, 2));
+}
+export function writeFile(file, content) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, content);
+}
+
+export function walkFiles(root, exclude = []) {
+  const excludeSet = new Set([
+    ".git",
+    "node_modules",
+    ".hg",
+    ".svn",
+    "dist",
+    "build",
+    "coverage",
+    "fathom-dist",
+    ".next",
+    ".nuxt",
+    "venv",
+    ".venv",
+    "__pycache__",
+    ".tox",
+    ...exclude,
+  ]);
+  const results = [];
+  function walk(dir) {
+    let entries;
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.isSymbolicLink()) continue;
+      if (entry.isDirectory()) {
+        if (excludeSet.has(entry.name)) continue;
+        walk(path.join(dir, entry.name));
+      } else {
+        results.push(path.join(dir, entry.name));
+      }
+    }
+  }
+  walk(root);
+  return results;
+}
+
+export function sha256(text) {
+  return crypto.createHash("sha256").update(text).digest("hex");
+}
+
+export function jsonSize(obj) {
+  return JSON.stringify(obj)?.length ?? 0;
+}
+
+export function escapeHtml(str) {
+  return String(str)
+    .replace(/&/g, "&")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&#39;");
+}
+
+export function fileSize(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(2)} MB`;
+}
+
+export function isoNow() {
+  return new Date().toISOString();
+}

package/src/version.js

@@ -0,0 +1 @@
+export const VERSION = "0.1.0";