feat: cross post flow - #1

🏁 Script executed:

#!/bin/bash
set -eu

fd -HI -t f '^(package\.json|\.nvmrc|\.node-version|\.tool-versions|Dockerfile)$' .
rg -n -C2 '"engines"|FROM node:|NODE_VERSION|node-version' .

Repository: petrubraha/varful.ro-api-demo

Length of output: 219

🌐 Web query:

For the Node.js version intended by this project, verify support for global fetch, btoa, and crypto.createHash(...).digest("base64url").

💡 Result:

As of July 2026, Node.js provides the following levels of support for the requested APIs: 1. Global fetch: Supported. It is available as a global object in Node.js, with the implementation originating from the Undici library [1][2]. It is no longer experimental, having been enabled by default since Node.js v18.0.0 and reaching stable status in v21.0.0 [3][1]. 2. Global btoa: Supported, but marked as legacy. While it is available as a global function, Node.js documentation categorizes it as legacy and recommends using Buffer.toString('base64') instead [4][5]. 3. crypto.createHash(...).digest("base64url"): Supported. The hash.digest method accepts 'base64url' as an encoding argument to return the digest in a URL-safe Base64 format [6][7][8]. This functionality is part of the standard node:crypto module [6].

Citations:

• 1: https://nodejs.org/api/globals.html
• 2: https://nodejs.org/learn/getting-started/fetch
• 3: https://nodejs.org/docs/latest-v23.x/api/globals.html
• 4: https://nodejs.org/api/globals.md
• 5: https://nodejs.org/docs/latest-v22.x/api/globals.html
• 6: https://nodejs.org/api/crypto.html
• 7: https://nodejs.org/docs/v22.11.0/api/crypto.html
• 8: https://nodejs.org/docs/v20.12.1/api/crypto.html

🏁 Script executed:

#!/bin/bash
set -eu

printf '--- candidate package/tooling files ---\n'
git ls-files | rg '(^|/)(package\.json|package-lock\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb|\.nvmrc|\.node-version|\.tool-versions|Dockerfile|docker-compose.*|.*\.yml|.*\.yaml)$' || true

printf '\n--- root package.json ---\n'
if [ -f package.json ]; then cat -n package.json; fi

printf '\n--- cross-posts package.json ---\n'
cat -n cross-posts/package.json

printf '\n--- root tooling/version references ---\n'
rg -n -C2 '"engines"|node:"?' package.json | head -n 80 || true
rg -n -C2 'node-version|setup-node|FROM node:|node:|NODE_VERSION|NODEJS_VERSION|node_modules|npm ci|npm install|devDependencies|dependencies' -g '*.yml' -g '*.yaml' -g 'Dockerfile*' -g 'package.json' . | head -n 160 || true

Repository: petrubraha/varful.ro-api-demo

Length of output: 258

🌐 Web query:

Node.js digest base64url support initial version createHash base64url

💡 Result:

In Node.js, the base64url encoding for digests was introduced in Node.js version 15.7.0 [1]. Before this official addition, Node.js had long supported base64url input when creating Buffers (via the base64 encoding option) [2][3], which was documented as a feature in 2016 [4][3]. However, developers could not explicitly request base64url output from cryptographic methods like hash.digest() or Buffer.toString() until the release of v15.7.0 [5][1]. Before this, developers typically had to perform manual string replacements—such as .toString('base64').replaceAll('+', '-').replaceAll('/', '_')—to achieve the desired output format [5]. Since v15.7.0, base64url is a first-class encoding option throughout the Node.js API, including the crypto module's hash.digest('base64url') and various Buffer operations [5][1].

Citations:

• 1: nodejs/node@5fe188e
• 2: Support for base64url format nodejs/node#26512
• 3: which variant of Base64 is officially supported? nodejs/node#5239
• 4: nodejs/node@1624d5b049
• 5: buffer: add base64url encoding option nodejs/node#36952

🏁 Script executed:

#!/bin/bash
set -eu

printf '%s\n' '--- candidate package/tooling files ---'
git ls-files | rg '(^|/)(package\.json|package-lock\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb|\.nvmrc|\.node-version|\.tool-versions|Dockerfile|docker-compose.*|.*\.yml|.*\.yaml)$' || true

printf '%s\n' ''
printf '%s\n' '--- root package.json ---'
if [ -f package.json ]; then cat -n package.json; fi

printf '%s\n' ''
printf '%s\n' '--- cross-posts package.json ---'
cat -n cross-posts/package.json

printf '%s\n' ''
printf '%s\n' '--- root tooling/version references ---'
rg -n -C2 '"engines"|node:"?' package.json || true
rg -n -C2 'node-version|setup-node|FROM node:|node:|NODE_VERSION|NODEJS_VERSION|node_modules|npm ci|npm install|devDependencies|dependencies' -g '*.yml' -g '*.yaml' -g 'Dockerfile*' -g 'package.json' . || true

Repository: petrubraha/varful.ro-api-demo

Length of output: 1508

🌐 Web query:

For the Node.js version declared for this project, what supported mechanism cancels a global fetch request after a deadline?

💡 Result:

For the current Node.js versions (which include the v26.x and v24.x lines as of July 2026) [1][2], the supported mechanism to cancel a global fetch request after a specific deadline is the AbortSignal.timeout(ms) method [3][4]. This method, which is part of the Web API standard implemented in Node.js [5], creates an AbortSignal that automatically aborts after the specified duration in milliseconds [6][7]. You pass this signal to the fetch request via the signal property in the options object [6][4]. Example usage: const response = await fetch('https://api.example.com/data', { signal: AbortSignal.timeout(5000), // Cancels after 5000ms }); When the deadline is reached, the fetch request is automatically cancelled, and the promise rejects with a TimeoutError [6][7]. This approach is preferred over manually managing an AbortController and setTimeout, as it eliminates the need for manual cleanup and prevents memory leaks [3][6][4].

Citations:

• 1: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases
• 2: https://github.com/nodejs/node/releases
• 3: https://realcoding.blog/en/2026/02/02/nodejs-abortcontroller-fetch-timeout/
• 4: https://techearl.com/fetch-timeout-abortcontroller
• 5: https://nodejs.org/api/globals.html
• 6: https://devcraftly.com/nodejs/abortcontroller/
• 7: https://developer.mozilla.org/en-US/docs/Web/API/AbortSignal/timeout_static

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== package files =="
git ls-files | grep -E '(^|/)(package.json|package-lock.json|pnpm-lock.yaml|yarn.lock|bun.lockb)$' || true

echo "== node engine / dependencies snippets =="
for f in $(git ls-files | grep -E '(^|/)package\.json$'); do
  echo "--- $f"
  sed -n '1,220p' "$f" | grep -nE '"(engines|version|exports|type|dependencies|devDependencies|peerDependencies|imports)"|fetch|AbortSignal|node-fetch|undici' -C 2 || true
done

echo "== cross-posts/partner.js relevant sections =="
if [ -f cross-posts/partner.js ]; then
  wc -l cross-posts/partner.js
  sed -n '130,230p' cross-posts/partner.js
  echo "== fetch occurrences in cross-posts/partner.js =="
  nl -ba cross-posts/partner.js | grep -n 'fetch\|Abort' -C 2 || true
else
  echo "missing cross-posts/partner.js"
fi

echo "== lockfile env hints if present =="
for f in $(git ls-files | grep -E '(^|/)(package-lock\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb)$'); do
  echo "--- $f"
  grep -n 'node@|lts/|Node.js|nodejs.org|engines:' "$f" -C 1 | head -80 || true
done

Repository: petrubraha/varful.ro-api-demo

Length of output: 3940

• cross-posts/partner.js#L154-L164 (this comment)
• cross-posts/partner.js#L179-L193
• cross-posts/partner.js#L213-L217

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.