dphelper

The supercharged toolkit for modern web development, AI engineering & DevTools.

The stateless, zero-dependency capability toolkit for Web, Node.js, Bun, Deno and AI systems.

Modules. One namespace. One consistent API.

Table of Contents

1. What is dphelper?
2. Why dphelper?
3. Installation
4. The Capability Model
5. AI Power User Guide
6. Modular Architecture
7. Web Worker Module
8. UI Mirror & Auto-Recovery
9. Browser Extension
10. Environment Compatibility
11. Security
12. State Architecture
13. License

What is dphelper?

dphelper is a stateless, zero-dependency capability toolkit for modern JavaScript and TypeScript applications.

It provides a consistent collection of production-oriented capabilities for:

• Web development
• Node.js, Bun and Deno
• AI and LLM applications
• DevTools
• Browser applications
• Security and cryptography
• Networking
• Workers and parallel processing
• Data transformation
• Internationalization
• Runtime utilities

Instead of maintaining many small utility dependencies, applications can expose the capabilities they need through a single, consistent API.

The core idea

A capability is a self-contained operation exposed through a predictable namespace and API.

For example:

dphelper.security.ulid();
dphelper.format.currency(1234.56, "en-US", "USD");
dphelper.ai.tokenCount(data);
dphelper.worker.create("worker.js");

The same capabilities can also be imported individually when modularity and tree-shaking are preferred.

Why dphelper?

⚡ Zero Dependencies

Pure JavaScript/TypeScript with no runtime dependency chain.

🧩 Modular

Every tool is exposed as an independent module and can be imported separately.

🌐 Universal

Tools are classified according to their execution environment and can target:

• Browser
• Node.js
• Bun
• Deno
• Isomorphic environments

🔒 Type-Safe

TypeScript definitions are generated and synchronized with the available tools.

📦 Compact

Approximately 171 KB minified, with modular entry points available for smaller application bundles.

🤖 AI Ready

AI-oriented capabilities include:

• TOON structured representation
• Context-aware token counting
• RAG-oriented chunking
• Semantic similarity
• AI response processing
• Runtime snapshots optimized for LLM consumption

🔐 Security-Oriented

Uses established cryptographic primitives including:

• AES-256-GCM
• SHA-256
• PBKDF2

Security-sensitive functionality should always be evaluated according to the application's threat model and deployment environment.

[!NOTE] Network Access: dphelper includes networking primitives such as fetch, sse and socket. Applications remain responsible for validating and sanitizing externally supplied URLs and other inputs.

Installation

npm install dphelper

Usage

Import the package once at the application entry point when using the global namespace:

// Import once at your application entry point

import "dphelper";

After initialization, capabilities are available through the global dphelper namespace.

dphelper.format.currency(1234.56, "en-US", "USD");
dphelper.security.ulid();

Modular Imports

For smaller bundles and explicit dependencies, import individual capabilities:

import { sanitize } from "dphelper/sanitize";
import { format } from "dphelper/format";
import { fetch } from "dphelper/fetch";
import { security } from "dphelper/security";

sanitize.html("<strong>safe text</strong>");

format.currency(1234.56, "en-US", "USD");

await fetch.get("https://api.example.com");

security.ulid();

The same capability remains available through the global namespace after importing the module:

import "dphelper/format";

dphelper.format.currency(1234.56, "en-US", "USD");

Automatic Module Generation

Every tool under tools/ is published as a corresponding package subpath:

dphelper/array
dphelper/i18n
dphelper/worker
dphelper/security
dphelper/...

The build system automatically discovers tools and generates their modular entry points and TypeScript interfaces.

Adding a tool therefore does not require manually maintaining a separate export registry.

TypeScript and resolvePackageJsonExports

Modular subpath imports are resolved through the exports map in dphelper/package.json.

If your tsconfig.json explicitly sets:

{
  "resolvePackageJsonExports": false
}

TypeScript may fall back to physical path resolution and fail with:

TS2307: Cannot find module 'dphelper/<tool>'

Keep:

"resolvePackageJsonExports": true

or use the physical module path when required:

import { sanitize } from "dphelper/modules/sanitize";

This is a TypeScript resolution issue. Modern bundlers such as Vite resolve the package through the exports map at build/runtime.

The Capability Model

dphelper is organized around three architectural principles.

Stateless

dphelper does not own application state.

Its capabilities perform operations without becoming the authoritative store for application data.

Modular

Each capability is independently addressable.

dphelper/<capability>

This makes the system easier to compose, test and tree-shake.

Consistent

Capabilities follow a common namespace model:

dphelper.<domain>.<operation>

For example:

dphelper.ai.toon()
dphelper.security.ulid()
dphelper.i18n.t()
dphelper.worker.create()
dphelper.sync.pulse()

This consistency is intended to make capabilities easier to discover, integrate and reason about.

AI Power User Guide

The dphelper.ai module provides utilities for modern AI applications, including LLM, RAG and vector-oriented workflows.

TOON

Generate a compact structured representation suitable for LLM prompts:

const toonData = dphelper.ai.toon(myJsonObject);

Context-Aware Token Counting

const tokens = dphelper.ai.tokenCount(myJsonObject);

Token estimation can take the resulting representation into account rather than treating the original object as the only representation.

RAG-Oriented Chunking

const chunks = dphelper.ai.chunker(longText, {
  size: 1000,
  overlap: 200
});

Semantic Similarity

const score = dphelper.ai.similarity(
  embeddingA,
  embeddingB
);

Reasoning Extraction

const { reasoning, content } =
  dphelper.ai.extractReasoning(rawAiReply);

Designed to process model responses that expose separate reasoning/content representations.

AI Runtime Snapshot

const appStateToon = dphelper.ai.snapshot();

The snapshot capability generates a compact runtime representation intended for AI-assisted inspection, debugging and recovery.

Depending on the application environment, this can include information such as:

• URL
• runtime/global state
• application logs
• relevant runtime context

Modular Architecture

Every tool in dphelper is maintained as a self-contained module.

The build system:

1. Scans the tools/ directory.
2. Generates module entry points.
3. Generates dynamic imports for the core.
4. Synchronizes TypeScript interfaces.
5. Keeps the public API aligned with the available tools.

This makes the module system extensible without requiring a manually maintained central registry.

Web Worker Module

dphelper.worker provides worker creation, inline workers, worker pools and SharedWorker support.

Worker

const worker = dphelper.worker.create("worker.js", {
  onmessage: (e) => console.log(e.data)
});

Inline Worker

const inlineWorker = dphelper.worker.createInline(`
  self.onmessage = e => postMessage(e.data * 2);
`);

Worker Pool

const pool = dphelper.worker.pool("worker.js", 4);

const results = await dphelper.worker.poolExec(
  pool,
  [1, 2, 3, 4]
);

SharedWorker

const shared = dphelper.worker.shared(
  "worker.js",
  { name: "my-shared" }
);

UI Mirror & Auto-Recovery

dphelper provides browser capabilities designed to make web applications behave more like persistent desktop applications.

Auto-Recovery

Persist useful UI context across reloads and crashes:

dphelper.UI.anchorContext();

Cross-Tab Event Bus

Use BroadcastChannel-based synchronization without requiring a backend:

const bus = dphelper.sync.pulse(
  "my-app",
  (msg) => {
    console.debug(
      "Received from another tab:",
      msg
    );
  }
);

bus.emit({
  action: "theme-change",
  value: "dark"
});

Browser Interlock

Monitor the number of active application tabs:

dphelper.browser.interlock((count) => {
  console.debug(`Active tabs: ${count}`);
});

Server-Sent Events

const stream = dphelper.sse.open("/api/ai", {
  method: "POST",
  headers: {
    "Authorization": "Bearer ..."
  },
  body: JSON.stringify({
    prompt: "Hello AI"
  })
});

stream.on("message", (data) => {
  console.debug("Chunk:", data);
});

stream.on("error", (err) => {
  console.error("Stream failure:", err);
});

Browser Extension

The dphelper Manager browser extension provides tools for managing the dphelper environment, monitoring memory usage and accessing documentation.

• Chrome Web Store
• Microsoft Edge Add-ons

Environment Compatibility

Tools are classified according to their execution target.

| Type | Description | | ----------------- | ------------------------------------------------------------------------------------- | | 🌐 Client | Browser-only capabilities requiring DOM, window, navigator or other browser APIs. | | 🖥️ Server | Node.js, Bun or Deno capabilities requiring server-side APIs. | | 🧬 Isomorphic | Capabilities designed to work across browser and server environments. |

Core Module Status

| Module | Environment | | ----------------- | --------------------------- | | dphelper.ai | 🧬 Isomorphic | | dphelper.fetch | 🧬 Isomorphic — Node.js 18+ | | dphelper.sse | 🌐 Client | | dphelper.socket | 🌐 Client | | dphelper.sync | 🌐 Client | | dphelper.UI | 🌐 Client |

Security

Security-sensitive functionality should be evaluated according to the application's own threat model and deployment requirements.

Cryptography

dphelper uses established cryptographic primitives including:

• AES-256-GCM
• SHA-256
• PBKDF2
• 310,000 PBKDF2 iterations where applicable

These choices are intended to align with widely recognized security guidance; they should not be interpreted as a blanket certification or compliance claim for every application using the library.

Network Security

Networking capabilities include:

• HTTPS for fetch and SSE where required by the application
• wss:// for secure WebSocket connections
• URL validation capabilities

[!IMPORTANT] Library users remain responsible for input validation.

Always validate and sanitize externally supplied URLs before passing them to networking capabilities.

const safeUrl = dphelper.sanitize.url(userInput);
if (!safeUrl) throw new Error("Invalid URL");

await dphelper.fetch.get(safeUrl);

Avoid:

await dphelper.fetch.get(userInput);

Web Workers

Worker APIs execute supplied scripts in the Worker context and therefore require trusted input.

Do not pass untrusted user-controlled code directly to:

dphelper.worker.createInline(code);
dphelper.worker.create(src);
dphelper.worker.pool(src);
dphelper.worker.importScripts(worker, scripts);

For example:

// Trusted static worker
dphelper.worker.create("./my-trusted-worker.js");

// Trusted external resource
dphelper.worker.importScripts(
  worker,
  ["https://cdn.example.com/lib.js"]
);

Never treat user-supplied code or URLs as trusted merely because they are passed through a library API.

Security Testing

The project uses automated security scanning as part of its development workflow.

State Architecture

dphelper is intentionally stateless.

Application state management is separated into dedicated libraries to keep capability execution independent from application state.

Architecture

| Layer | Package | Operational Target | Design Philosophy | | ---------------------------------- | ----------- | --------------------------- | ----------------------------------------------- | | Stateless Utilities & AI Tools | dphelper | Browser, Node.js, Bun, Deno | Zero-dependency universal capability layer | | Enterprise State Architecture | memorio | Application runtime | Lightweight global state management |

Why separate state?

Keeping application state outside dphelper provides a clear separation between:

CAPABILITIES
     │
     ▼
dphelper
     │
     │ stateless operations
     ▼
APPLICATION
     │
     ▼
STATE
     │
 ┌───┴────┐
 ▼        ▼
Memorio   ?

This avoids coupling utility execution to application-specific state ownership.

Integration Guidance

Do not rely on legacy state APIs such as:

dphelper.store

Migrate state management to the appropriate dedicated state system.

For cross-tab communication, dphelper.sync can provide the transport/event mechanism while a dedicated state manager remains responsible for application state.

License

MIT License

Credits

Copyright (c) Dario Passariello