@actuate-media/cms-core 0.82.0 → 0.84.0

package/dist/__tests__/security/rate-limit.test.js

@@ -1,199 +0,0 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import { createRateLimiter, resolveUpstashCredentials, warnStrictRateLimitConfigAtBoot, } from '../../security/rate-limit.js';
-function clearUpstashEnv() {
-    delete process.env.UPSTASH_REDIS_REST_URL;
-    delete process.env.UPSTASH_REDIS_REST_TOKEN;
-    delete process.env.KV_REST_API_URL;
-    delete process.env.KV_REST_API_TOKEN;
-}
-describe('resolveUpstashCredentials', () => {
-    it('returns undefined when nothing is configured', () => {
-        expect(resolveUpstashCredentials({})).toEqual({ url: undefined, token: undefined });
-    });
-    it('reads the native UPSTASH_* names', () => {
-        expect(resolveUpstashCredentials({
-            UPSTASH_REDIS_REST_URL: 'https://u.upstash.io',
-            UPSTASH_REDIS_REST_TOKEN: 'tok',
-        })).toEqual({ url: 'https://u.upstash.io', token: 'tok' });
-    });
-    it('falls back to the Vercel Marketplace KV_REST_API_* names', () => {
-        // Vercel's Upstash integration provisions these instead of UPSTASH_*.
-        expect(resolveUpstashCredentials({
-            KV_REST_API_URL: 'https://kv.upstash.io',
-            KV_REST_API_TOKEN: 'kv-tok',
-        })).toEqual({ url: 'https://kv.upstash.io', token: 'kv-tok' });
-    });
-    it('prefers UPSTASH_* over KV_* when both are present', () => {
-        expect(resolveUpstashCredentials({
-            UPSTASH_REDIS_REST_URL: 'https://native.upstash.io',
-            UPSTASH_REDIS_REST_TOKEN: 'native',
-            KV_REST_API_URL: 'https://kv.upstash.io',
-            KV_REST_API_TOKEN: 'kv',
-        })).toEqual({ url: 'https://native.upstash.io', token: 'native' });
-    });
-});
-describe('createRateLimiter', () => {
-    beforeEach(() => {
-        vi.useFakeTimers();
-    });
-    afterEach(() => {
-        vi.useRealTimers();
-    });
-    it('allows requests under the limit', async () => {
-        const limiter = createRateLimiter({ windowMs: 60_000, maxRequests: 5 });
-        const r1 = await limiter.check('ip:127.0.0.1');
-        expect(r1.allowed).toBe(true);
-        expect(r1.remaining).toBe(4);
-        const r2 = await limiter.check('ip:127.0.0.1');
-        expect(r2.allowed).toBe(true);
-        expect(r2.remaining).toBe(3);
-    });
-    it('blocks requests over the limit', async () => {
-        const limiter = createRateLimiter({ windowMs: 60_000, maxRequests: 3 });
-        await limiter.check('ip:test');
-        await limiter.check('ip:test');
-        await limiter.check('ip:test');
-        const blocked = await limiter.check('ip:test');
-        expect(blocked.allowed).toBe(false);
-        expect(blocked.remaining).toBe(0);
-        expect(blocked.retryAfter).toBeDefined();
-        expect(blocked.retryAfter).toBeGreaterThan(0);
-    });
-    it('resets after window expires', async () => {
-        const limiter = createRateLimiter({ windowMs: 10_000, maxRequests: 2 });
-        await limiter.check('ip:expire');
-        await limiter.check('ip:expire');
-        const blocked = await limiter.check('ip:expire');
-        expect(blocked.allowed).toBe(false);
-        vi.advanceTimersByTime(11_000);
-        const afterReset = await limiter.check('ip:expire');
-        expect(afterReset.allowed).toBe(true);
-        expect(afterReset.remaining).toBe(1);
-    });
-    it('reset() clears the counter', async () => {
-        const limiter = createRateLimiter({ windowMs: 60_000, maxRequests: 2 });
-        await limiter.check('ip:reset');
-        await limiter.check('ip:reset');
-        const blocked = await limiter.check('ip:reset');
-        expect(blocked.allowed).toBe(false);
-        await limiter.reset('ip:reset');
-        const afterReset = await limiter.check('ip:reset');
-        expect(afterReset.allowed).toBe(true);
-        expect(afterReset.remaining).toBe(1);
-    });
-    it('tracks different keys independently', async () => {
-        const limiter = createRateLimiter({ windowMs: 60_000, maxRequests: 1 });
-        const r1 = await limiter.check('key-a');
-        expect(r1.allowed).toBe(true);
-        const r2 = await limiter.check('key-b');
-        expect(r2.allowed).toBe(true);
-        const r3 = await limiter.check('key-a');
-        expect(r3.allowed).toBe(false);
-    });
-    it('caps the in-memory key map and evicts the oldest (LRU)', async () => {
-        // M1: with maxKeys=3, after seeing keys a, b, c, then d, the LRU entry
-        // (a) must have been evicted. We verify by re-checking 'a' — its counter
-        // should restart from 1 (i.e. no prior history).
-        const limiter = createRateLimiter({
-            windowMs: 60_000,
-            maxRequests: 5,
-            maxKeys: 3,
-        });
-        // Key 'a' gets two hits (count = 2)
-        await limiter.check('a');
-        await limiter.check('a');
-        // Keys 'b', 'c', 'd' get one hit each. Inserting 'd' must evict 'a'
-        // because 'a' is now the least-recently-used (oldest insertion).
-        await limiter.check('b');
-        await limiter.check('c');
-        await limiter.check('d');
-        // 'a' should look fresh — its prior count was evicted.
-        const a = await limiter.check('a');
-        expect(a.remaining).toBe(4); // 5 max, 1 used = 4 remaining
-    });
-    it('marks recently-touched keys as MRU so they are not evicted first', async () => {
-        // M1: re-checking 'a' between inserts moves it to the tail of the LRU
-        // map. With maxKeys=3, inserting 'd' must then evict 'b' (now the
-        // oldest), not 'a'.
-        const limiter = createRateLimiter({
-            windowMs: 60_000,
-            maxRequests: 5,
-            maxKeys: 3,
-        });
-        await limiter.check('a');
-        await limiter.check('b');
-        await limiter.check('c');
-        await limiter.check('a'); // touches 'a' → most-recent
-        await limiter.check('d'); // evicts 'b' (oldest)
-        const a = await limiter.check('a');
-        // 'a' had 2 prior hits and now this 3rd one
-        expect(a.remaining).toBe(2);
-        const b = await limiter.check('b');
-        // 'b' was evicted, restarted
-        expect(b.remaining).toBe(4);
-    });
-});
-describe('createRateLimiter fail-closed (roadmap #393)', () => {
-    const originalEnv = process.env.NODE_ENV;
-    beforeEach(() => {
-        clearUpstashEnv();
-        delete process.env.ACTUATE_DISABLE_RATE_LIMIT;
-    });
-    afterEach(() => {
-        vi.unstubAllGlobals();
-        clearUpstashEnv();
-        process.env.NODE_ENV = originalEnv;
-    });
-    it('denies when Upstash is missing in production', async () => {
-        process.env.NODE_ENV = 'production';
-        const limiter = createRateLimiter({
-            windowMs: 60_000,
-            maxRequests: 5,
-            failClosed: true,
-        });
-        const result = await limiter.check('login:203.0.113.1');
-        expect(result.allowed).toBe(false);
-        expect(result.remaining).toBe(0);
-        expect(result.retryAfter).toBeGreaterThan(0);
-    });
-    it('denies when Upstash pipeline fails for fail-closed limiters', async () => {
-        process.env.NODE_ENV = 'production';
-        process.env.UPSTASH_REDIS_REST_URL = 'https://test.upstash.io';
-        process.env.UPSTASH_REDIS_REST_TOKEN = 'tok';
-        vi.stubGlobal('fetch', vi.fn().mockRejectedValue(new Error('network down')));
-        const limiter = createRateLimiter({
-            windowMs: 60_000,
-            maxRequests: 5,
-            failClosed: true,
-        });
-        const result = await limiter.check('login:203.0.113.1');
-        expect(result.allowed).toBe(false);
-    });
-    it('still fails open for non-strict limiters when Upstash pipeline fails', async () => {
-        process.env.NODE_ENV = 'production';
-        process.env.UPSTASH_REDIS_REST_URL = 'https://test.upstash.io';
-        process.env.UPSTASH_REDIS_REST_TOKEN = 'tok';
-        vi.stubGlobal('fetch', vi.fn().mockRejectedValue(new Error('network down')));
-        const limiter = createRateLimiter({ windowMs: 60_000, maxRequests: 100 });
-        const result = await limiter.check('rl:203.0.113.1');
-        expect(result.allowed).toBe(true);
-    });
-    it('uses in-memory fallback for fail-closed limiters outside production', async () => {
-        process.env.NODE_ENV = 'development';
-        const limiter = createRateLimiter({
-            windowMs: 60_000,
-            maxRequests: 5,
-            failClosed: true,
-        });
-        const result = await limiter.check('login:127.0.0.1');
-        expect(result.allowed).toBe(true);
-        expect(result.remaining).toBe(4);
-    });
-    it('warnStrictRateLimitConfigAtBoot is a no-op when Upstash is configured', () => {
-        process.env.NODE_ENV = 'production';
-        process.env.UPSTASH_REDIS_REST_URL = 'https://test.upstash.io';
-        process.env.UPSTASH_REDIS_REST_TOKEN = 'tok';
-        expect(() => warnStrictRateLimitConfigAtBoot()).not.toThrow();
-    });
-});
-//# sourceMappingURL=rate-limit.test.js.map

package/dist/__tests__/security/rate-limit.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rate-limit.test.js","sourceRoot":"","sources":["../../../src/__tests__/security/rate-limit.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAA;AACxE,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,+BAA+B,GAChC,MAAM,8BAA8B,CAAA;AAErC,SAAS,eAAe;IACtB,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAA;IACzC,OAAO,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAA;IAC3C,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAA;IAClC,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAA;AACtC,CAAC;AAED,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;IACrF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CACJ,yBAAyB,CAAC;YACxB,sBAAsB,EAAE,sBAAsB;YAC9C,wBAAwB,EAAE,KAAK;SAChC,CAAC,CACH,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,sEAAsE;QACtE,MAAM,CACJ,yBAAyB,CAAC;YACxB,eAAe,EAAE,uBAAuB;YACxC,iBAAiB,EAAE,QAAQ;SAC5B,CAAC,CACH,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC9D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CACJ,yBAAyB,CAAC;YACxB,sBAAsB,EAAE,2BAA2B;YACnD,wBAAwB,EAAE,QAAQ;YAClC,eAAe,EAAE,uBAAuB;YACxC,iBAAiB,EAAE,IAAI;SACxB,CAAC,CACH,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,2BAA2B,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAA;IACpB,CAAC,CAAC,CAAA;IAEF,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,aAAa,EAAE,CAAA;IACpB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAA;QAEvE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;QAC9C,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC7B,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAE5B,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;QAC9C,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC7B,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAA;QAEvE,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QAC9B,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QAC9B,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QAE9B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QAC9C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACnC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAA;QACxC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAA;QAEvE,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QAChC,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QAEhC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QAChD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAEnC,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAA;QAE9B,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QACnD,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACrC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACtC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAA;QAEvE,MAAM,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QAC/B,MAAM,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QAE/B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QAC/C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAEnC,MAAM,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QAE/B,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QAClD,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACrC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACtC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAA;QAEvE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACvC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAE7B,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACvC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAE7B,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACvC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,uEAAuE;QACvE,yEAAyE;QACzE,iDAAiD;QACjD,MAAM,OAAO,GAAG,iBAAiB,CAAC;YAChC,QAAQ,EAAE,MAAM;YAChB,WAAW,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QAEF,oCAAoC;QACpC,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACxB,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACxB,oEAAoE;QACpE,iEAAiE;QACjE,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACxB,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACxB,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAExB,uDAAuD;QACvD,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAClC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA,CAAC,8BAA8B;IAC5D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,sEAAsE;QACtE,kEAAkE;QAClE,oBAAoB;QACpB,MAAM,OAAO,GAAG,iBAAiB,CAAC;YAChC,QAAQ,EAAE,MAAM;YAChB,WAAW,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QAEF,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACxB,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACxB,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACxB,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA,CAAC,4BAA4B;QACrD,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA,CAAC,sBAAsB;QAE/C,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAClC,4CAA4C;QAC5C,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAE3B,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAClC,6BAA6B;QAC7B,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,8CAA8C,EAAE,GAAG,EAAE;IAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;IAExC,UAAU,CAAC,GAAG,EAAE;QACd,eAAe,EAAE,CAAA;QACjB,OAAO,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,gBAAgB,EAAE,CAAA;QACrB,eAAe,EAAE,CAAA;QACjB,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,WAAW,CAAA;IACpC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAA;QACnC,MAAM,OAAO,GAAG,iBAAiB,CAAC;YAChC,QAAQ,EAAE,MAAM;YAChB,WAAW,EAAE,CAAC;YACd,UAAU,EAAE,IAAI;SACjB,CAAC,CAAA;QAEF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAA;QACvD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAChC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;IAC9C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAA;QACnC,OAAO,CAAC,GAAG,CAAC,sBAAsB,GAAG,yBAAyB,CAAA;QAC9D,OAAO,CAAC,GAAG,CAAC,wBAAwB,GAAG,KAAK,CAAA;QAC5C,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAA;QAE5E,MAAM,OAAO,GAAG,iBAAiB,CAAC;YAChC,QAAQ,EAAE,MAAM;YAChB,WAAW,EAAE,CAAC;YACd,UAAU,EAAE,IAAI;SACjB,CAAC,CAAA;QAEF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAA;QACvD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAA;QACnC,OAAO,CAAC,GAAG,CAAC,sBAAsB,GAAG,yBAAyB,CAAA;QAC9D,OAAO,CAAC,GAAG,CAAC,wBAAwB,GAAG,KAAK,CAAA;QAC5C,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAA;QAE5E,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAA;QAEzE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;QACpD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,aAAa,CAAA;QACpC,MAAM,OAAO,GAAG,iBAAiB,CAAC;YAChC,QAAQ,EAAE,MAAM;YAChB,WAAW,EAAE,CAAC;YACd,UAAU,EAAE,IAAI;SACjB,CAAC,CAAA;QAEF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;QACrD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAA;QACnC,OAAO,CAAC,GAAG,CAAC,sBAAsB,GAAG,yBAAyB,CAAA;QAC9D,OAAO,CAAC,GAAG,CAAC,wBAAwB,GAAG,KAAK,CAAA;QAC5C,MAAM,CAAC,GAAG,EAAE,CAAC,+BAA+B,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;IAC/D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/security/reauth.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=reauth.test.d.ts.map

package/dist/__tests__/security/reauth.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"reauth.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/security/reauth.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/security/reauth.test.js

@@ -1,30 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { requiresReauth, DEFAULT_REAUTH_CONFIG } from '../../security/reauth.js';
-describe('requiresReauth', () => {
-    it('returns false for actions not in the required list', () => {
-        const result = requiresReauth({ lastAuthAt: new Date(0), action: 'view_dashboard' }, DEFAULT_REAUTH_CONFIG);
-        expect(result).toBe(false);
-    });
-    it('returns false when recently authenticated', () => {
-        const result = requiresReauth({ lastAuthAt: new Date(), action: 'delete_user' }, DEFAULT_REAUTH_CONFIG);
-        expect(result).toBe(false);
-    });
-    it('returns true when authentication is stale', () => {
-        const staleDate = new Date(Date.now() - 600_000);
-        const result = requiresReauth({ lastAuthAt: staleDate, action: 'delete_user' }, DEFAULT_REAUTH_CONFIG);
-        expect(result).toBe(true);
-    });
-    it('returns true for change_settings when stale', () => {
-        const staleDate = new Date(Date.now() - 600_000);
-        const result = requiresReauth({ lastAuthAt: staleDate, action: 'change_settings' }, DEFAULT_REAUTH_CONFIG);
-        expect(result).toBe(true);
-    });
-    it('respects custom maxAgeSeconds', () => {
-        const config = { maxAgeSeconds: 10, requiredForActions: ['test_action'] };
-        const recentEnough = new Date(Date.now() - 5_000);
-        expect(requiresReauth({ lastAuthAt: recentEnough, action: 'test_action' }, config)).toBe(false);
-        const tooOld = new Date(Date.now() - 15_000);
-        expect(requiresReauth({ lastAuthAt: tooOld, action: 'test_action' }, config)).toBe(true);
-    });
-});
-//# sourceMappingURL=reauth.test.js.map

package/dist/__tests__/security/reauth.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"reauth.test.js","sourceRoot":"","sources":["../../../src/__tests__/security/reauth.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAA;AAEhF,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,MAAM,GAAG,cAAc,CAC3B,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,EACrD,qBAAqB,CACtB,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,MAAM,GAAG,cAAc,CAC3B,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,EACjD,qBAAqB,CACtB,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAA;QAChD,MAAM,MAAM,GAAG,cAAc,CAC3B,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,EAChD,qBAAqB,CACtB,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAA;QAChD,MAAM,MAAM,GAAG,cAAc,CAC3B,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,EACpD,qBAAqB,CACtB,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,MAAM,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,kBAAkB,EAAE,CAAC,aAAa,CAAC,EAAE,CAAA;QACzE,MAAM,YAAY,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAA;QACjD,MAAM,CAAC,cAAc,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAE/F,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAA;QAC5C,MAAM,CAAC,cAAc,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1F,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/security/redact.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=redact.test.d.ts.map

package/dist/__tests__/security/redact.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"redact.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/security/redact.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/security/redact.test.js

@@ -1,31 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { redactSecrets } from '../../security/redact.js';
-describe('redactSecrets', () => {
-    it('redacts OpenAI keys', () => {
-        expect(redactSecrets('use sk-abcdefghijklmnopqrstuv0123 for now')).toBe('use [REDACTED] for now');
-    });
-    it('redacts Anthropic keys', () => {
-        expect(redactSecrets('sk-ant-api03-AbCdEfGhIjKlMnOpQrStUvWxYz123456 secret')).toBe('[REDACTED] secret');
-    });
-    it('redacts Actuate API keys', () => {
-        expect(redactSecrets('act_sk_abcdef0123456789ABCDEF0123456789 leaked')).toBe('[REDACTED] leaked');
-    });
-    it('redacts GitHub tokens', () => {
-        expect(redactSecrets('ghp_abcdefghijklmnopqrstuvwxyz0123456789')).toBe('[REDACTED]');
-    });
-    it('redacts AWS access keys', () => {
-        expect(redactSecrets('AKIAIOSFODNN7EXAMPLE is mine')).toBe('[REDACTED] is mine');
-    });
-    it('redacts JWTs', () => {
-        const jwt = 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NSJ9.dQw4w9WgXcQabcdef1234';
-        expect(redactSecrets(`bearer ${jwt}`)).toBe('bearer [REDACTED]');
-    });
-    it('redacts password assignments', () => {
-        expect(redactSecrets('password: "hunter2x9"')).toBe('[REDACTED]');
-    });
-    it('preserves non-secret content', () => {
-        expect(redactSecrets('hello world')).toBe('hello world');
-        expect(redactSecrets('')).toBe('');
-    });
-});
-//# sourceMappingURL=redact.test.js.map

package/dist/__tests__/security/redact.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"redact.test.js","sourceRoot":"","sources":["../../../src/__tests__/security/redact.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAExD,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC7B,MAAM,CAAC,aAAa,CAAC,2CAA2C,CAAC,CAAC,CAAC,IAAI,CACrE,wBAAwB,CACzB,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,CAAC,aAAa,CAAC,sDAAsD,CAAC,CAAC,CAAC,IAAI,CAChF,mBAAmB,CACpB,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,CAAC,aAAa,CAAC,gDAAgD,CAAC,CAAC,CAAC,IAAI,CAC1E,mBAAmB,CACpB,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,aAAa,CAAC,0CAA0C,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACtF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;IAClF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,cAAc,EAAE,GAAG,EAAE;QACtB,MAAM,GAAG,GAAG,iEAAiE,CAAA;QAC7E,MAAM,CAAC,aAAa,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACxD,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/security/safe-fetch.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=safe-fetch.test.d.ts.map

package/dist/__tests__/security/safe-fetch.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"safe-fetch.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/security/safe-fetch.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/security/safe-fetch.test.js

@@ -1,97 +0,0 @@
-import { describe, expect, it, vi, beforeEach, afterEach } from 'vitest';
-import { safeFetch, SsrfBlockedError } from '../../security/safe-fetch.js';
-describe('safeFetch — DNS rebinding defense', () => {
-    let originalFetch;
-    let mockFetch;
-    beforeEach(() => {
-        originalFetch = globalThis.fetch;
-        mockFetch = vi.fn();
-        globalThis.fetch = mockFetch;
-    });
-    afterEach(() => {
-        globalThis.fetch = originalFetch;
-    });
-    it('proceeds with public IP when DNS resolves to a public address', async () => {
-        mockFetch.mockResolvedValueOnce(new Response('ok', { status: 200 }));
-        const resolver = vi.fn().mockResolvedValue({ safe: true, resolvedIp: '8.8.8.8' });
-        const res = await safeFetch('https://example.com/x', { _resolver: resolver });
-        expect(res.status).toBe(200);
-        expect(resolver).toHaveBeenCalledWith('example.com');
-        expect(mockFetch).toHaveBeenCalledTimes(1);
-    });
-    it('rejects when DNS resolves to a private IP (DNS rebinding defeated)', async () => {
-        const resolver = vi.fn().mockResolvedValue({
-            safe: false,
-            resolvedIp: '127.0.0.1',
-            error: 'Resolved IP 127.0.0.1 is in a private range',
-        });
-        await expect(safeFetch('https://attacker-controlled.tld/probe', { _resolver: resolver })).rejects.toBeInstanceOf(SsrfBlockedError);
-        expect(mockFetch).not.toHaveBeenCalled();
-    });
-    it('rejects when DNS resolves to AWS metadata IP', async () => {
-        const resolver = vi.fn().mockResolvedValue({
-            safe: false,
-            resolvedIp: '169.254.169.254',
-            error: 'Resolved IP 169.254.169.254 is in a private range',
-        });
-        await expect(safeFetch('https://looks-public.com/', { _resolver: resolver })).rejects.toBeInstanceOf(SsrfBlockedError);
-    });
-    it('best-effort mode: proceeds when resolver throws (default)', async () => {
-        mockFetch.mockResolvedValueOnce(new Response('ok'));
-        const resolver = vi.fn().mockRejectedValue(new Error('DNS module unavailable'));
-        const res = await safeFetch('https://example.com/', { _resolver: resolver });
-        expect(res.status).toBe(200);
-    });
-    it('strict mode: rejects when resolver throws and requireDnsCheck=true', async () => {
-        const resolver = vi.fn().mockRejectedValue(new Error('DNS module unavailable'));
-        await expect(safeFetch('https://example.com/', {
-            _resolver: resolver,
-            requireDnsCheck: true,
-        })).rejects.toBeInstanceOf(SsrfBlockedError);
-        expect(mockFetch).not.toHaveBeenCalled();
-    });
-    it('rejects URL-string bypass forms before any DNS lookup', async () => {
-        const resolver = vi.fn();
-        await expect(safeFetch('http://2130706433/', { _resolver: resolver })).rejects.toBeInstanceOf(SsrfBlockedError);
-        await expect(safeFetch('http://[::ffff:127.0.0.1]/', { _resolver: resolver })).rejects.toBeInstanceOf(SsrfBlockedError);
-        expect(resolver).not.toHaveBeenCalled();
-    });
-    it('re-validates AND re-resolves every redirect hop', async () => {
-        // Hop 1: example.com (public) -> 302 to evil.com
-        mockFetch.mockResolvedValueOnce(new Response(null, { status: 302, headers: { Location: 'https://evil.com/inner' } }));
-        // Hop 2 should never be issued because resolver flags evil.com as private.
-        const resolver = vi
-            .fn()
-            .mockImplementationOnce(async () => ({ safe: true, resolvedIp: '8.8.8.8' }))
-            .mockImplementationOnce(async () => ({
-            safe: false,
-            resolvedIp: '10.0.0.5',
-            error: 'private',
-        }));
-        await expect(safeFetch('https://example.com/start', {
-            _resolver: resolver,
-            followRedirects: true,
-        })).rejects.toBeInstanceOf(SsrfBlockedError);
-        expect(resolver).toHaveBeenCalledTimes(2);
-        expect(mockFetch).toHaveBeenCalledTimes(1); // only the first hop went out
-    });
-    it('default (no follow) returns the redirect response unmodified', async () => {
-        mockFetch.mockResolvedValueOnce(new Response(null, { status: 302, headers: { Location: 'https://elsewhere.com/' } }));
-        const resolver = vi.fn().mockResolvedValue({ safe: true, resolvedIp: '8.8.8.8' });
-        const res = await safeFetch('https://example.com/', { _resolver: resolver });
-        expect(res.status).toBe(302);
-        expect(mockFetch).toHaveBeenCalledTimes(1);
-        // No re-resolve because we didn't follow the redirect.
-        expect(resolver).toHaveBeenCalledTimes(1);
-    });
-    it('honors maxRedirects bound', async () => {
-        mockFetch.mockResolvedValue(new Response(null, { status: 302, headers: { Location: 'https://example.com/loop' } }));
-        const resolver = vi.fn().mockResolvedValue({ safe: true, resolvedIp: '8.8.8.8' });
-        await expect(safeFetch('https://example.com/start', {
-            _resolver: resolver,
-            followRedirects: true,
-            maxRedirects: 2,
-        })).rejects.toBeInstanceOf(SsrfBlockedError);
-    });
-});
-//# sourceMappingURL=safe-fetch.test.js.map

package/dist/__tests__/security/safe-fetch.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"safe-fetch.test.js","sourceRoot":"","sources":["../../../src/__tests__/security/safe-fetch.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAA;AACxE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAE1E,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IACjD,IAAI,aAA2B,CAAA;IAC/B,IAAI,SAAmC,CAAA;IAEvC,UAAU,CAAC,GAAG,EAAE;QACd,aAAa,GAAG,UAAU,CAAC,KAAK,CAAA;QAChC,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAA;QACnB,UAAU,CAAC,KAAK,GAAG,SAAoC,CAAA;IACzD,CAAC,CAAC,CAAA;IAEF,SAAS,CAAC,GAAG,EAAE;QACb,UAAU,CAAC,KAAK,GAAG,aAAa,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,SAAS,CAAC,qBAAqB,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;QACpE,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAA;QAEjF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,uBAAuB,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAA;QAE7E,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAA;QACpD,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;YACzC,IAAI,EAAE,KAAK;YACX,UAAU,EAAE,WAAW;YACvB,KAAK,EAAE,6CAA6C;SACrD,CAAC,CAAA;QAEF,MAAM,MAAM,CACV,SAAS,CAAC,uCAAuC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAC5E,CAAC,OAAO,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAA;QAE1C,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;YACzC,IAAI,EAAE,KAAK;YACX,UAAU,EAAE,iBAAiB;YAC7B,KAAK,EAAE,mDAAmD;SAC3D,CAAC,CAAA;QAEF,MAAM,MAAM,CACV,SAAS,CAAC,2BAA2B,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAChE,CAAC,OAAO,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,SAAS,CAAC,qBAAqB,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;QACnD,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAA;QAE/E,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,sBAAsB,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC5E,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAA;QAE/E,MAAM,MAAM,CACV,SAAS,CAAC,sBAAsB,EAAE;YAChC,SAAS,EAAE,QAAQ;YACnB,eAAe,EAAE,IAAI;SACtB,CAAC,CACH,CAAC,OAAO,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAA;QAE1C,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,EAAE,CAAA;QACxB,MAAM,MAAM,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAC3F,gBAAgB,CACjB,CAAA;QACD,MAAM,MAAM,CACV,SAAS,CAAC,4BAA4B,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CACjE,CAAC,OAAO,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAA;QAC1C,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;IACzC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,iDAAiD;QACjD,SAAS,CAAC,qBAAqB,CAC7B,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,wBAAwB,EAAE,EAAE,CAAC,CACrF,CAAA;QACD,2EAA2E;QAE3E,MAAM,QAAQ,GAAG,EAAE;aAChB,EAAE,EAAE;aACJ,sBAAsB,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;aAC3E,sBAAsB,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YACnC,IAAI,EAAE,KAAK;YACX,UAAU,EAAE,UAAU;YACtB,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC,CAAA;QAEL,MAAM,MAAM,CACV,SAAS,CAAC,2BAA2B,EAAE;YACrC,SAAS,EAAE,QAAQ;YACnB,eAAe,EAAE,IAAI;SACtB,CAAC,CACH,CAAC,OAAO,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAA;QAE1C,MAAM,CAAC,QAAQ,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;QACzC,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA,CAAC,8BAA8B;IAC3E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,SAAS,CAAC,qBAAqB,CAC7B,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,wBAAwB,EAAE,EAAE,CAAC,CACrF,CAAA;QACD,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAA;QAEjF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,sBAAsB,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC5E,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;QAC1C,uDAAuD;QACvD,MAAM,CAAC,QAAQ,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,SAAS,CAAC,iBAAiB,CACzB,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,0BAA0B,EAAE,EAAE,CAAC,CACvF,CAAA;QACD,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAA;QAEjF,MAAM,MAAM,CACV,SAAS,CAAC,2BAA2B,EAAE;YACrC,SAAS,EAAE,QAAQ;YACnB,eAAe,EAAE,IAAI;YACrB,YAAY,EAAE,CAAC;SAChB,CAAC,CACH,CAAC,OAAO,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/security/sanitize-document.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=sanitize-document.test.d.ts.map

package/dist/__tests__/security/sanitize-document.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sanitize-document.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/security/sanitize-document.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/security/sanitize-document.test.js

@@ -1,146 +0,0 @@
-import { afterEach, describe, expect, it } from 'vitest';
-import { setActuateConfig } from '../../config/runtime.js';
-import { sanitizeDocumentHtml, sanitizeLayoutTree } from '../../security/sanitize-document.js';
-/**
- * Regression tests for write-time HTML sanitization (security audit H1).
- *
- * Before this fix only TOP-LEVEL `richText` fields were sanitized on write, so
- * HTML nested inside `array`/`blocks` fields, the canonical `sections[]`
- * rich-text slots, and the page-builder `_layout` tree was stored raw — a
- * stored-XSS path reachable by any authenticated writer, since the public
- * renderer trusts stored HTML by default. These tests pin that every reachable
- * HTML sink is sanitized and that plain-text fields are left untouched.
- */
-const XSS = '<p>ok</p><script>alert(1)</script><img src=x onerror=alert(2)>';
-function registerPostsConfig() {
-    setActuateConfig({
-        collections: {
-            posts: {
-                slug: 'posts',
-                fields: {
-                    title: { type: 'text', label: 'Title' },
-                    body: { type: 'richText', label: 'Body' },
-                    sectionsList: {
-                        type: 'array',
-                        label: 'Sections',
-                        fields: {
-                            heading: { type: 'text', label: 'Heading' },
-                            copy: { type: 'richText', label: 'Copy' },
-                        },
-                    },
-                    flexible: {
-                        type: 'blocks',
-                        label: 'Flexible',
-                        blocks: [
-                            {
-                                slug: 'prose',
-                                labels: { singular: 'Prose', plural: 'Prose' },
-                                fields: {
-                                    label: { type: 'text', label: 'Label' },
-                                    html: { type: 'richText', label: 'HTML' },
-                                },
-                            },
-                        ],
-                    },
-                },
-            },
-        },
-    });
-}
-describe('sanitizeDocumentHtml', () => {
-    afterEach(() => {
-        delete globalThis.__actuateConfig;
-    });
-    it('sanitizes top-level richText but leaves plain text fields untouched', () => {
-        registerPostsConfig();
-        const out = sanitizeDocumentHtml({ title: 'A < B plain', body: XSS }, 'posts');
-        expect(out.body).not.toContain('<script>');
-        expect(out.body).not.toContain('onerror');
-        expect(out.body).toContain('<p>ok</p>');
-        // Plain-text field must be byte-for-byte preserved (no HTML re-parsing).
-        expect(out.title).toBe('A < B plain');
-    });
-    it('sanitizes richText nested inside array field items', () => {
-        registerPostsConfig();
-        const out = sanitizeDocumentHtml({ sectionsList: [{ heading: 'keep < me', copy: XSS }] }, 'posts');
-        const item = out.sectionsList[0];
-        expect(item.copy).not.toContain('<script>');
-        expect(item.heading).toBe('keep < me');
-    });
-    it('sanitizes richText inside blocks field items via the block discriminator', () => {
-        registerPostsConfig();
-        const out = sanitizeDocumentHtml({ flexible: [{ blockType: 'prose', label: 'x < y', html: XSS }] }, 'posts');
-        const block = out.flexible[0];
-        expect(block.html).not.toContain('<script>');
-        expect(block.label).toBe('x < y');
-    });
-    it('sanitizes canonical section rich-text slots from the registry', () => {
-        registerPostsConfig();
-        const out = sanitizeDocumentHtml({
-            sections: [
-                {
-                    id: 's1',
-                    sectionType: 'article-body',
-                    content: { source: 'override', body: XSS, width: 'normal' },
-                },
-            ],
-        }, 'posts');
-        const section = out.sections[0];
-        const content = section.content;
-        expect(content.body).not.toContain('<script>');
-        expect(content.body).not.toContain('onerror');
-        // Non-richText section content is preserved verbatim.
-        expect(content.width).toBe('normal');
-    });
-    it('does not throw on unknown section types or malformed nested values', () => {
-        registerPostsConfig();
-        expect(() => sanitizeDocumentHtml({
-            body: 123,
-            sectionsList: 'not-an-array',
-            sections: [{ sectionType: 'does-not-exist', content: { body: XSS } }, null],
-        }, 'posts')).not.toThrow();
-    });
-    it('is a no-op when the collection has no field config', () => {
-        delete globalThis.__actuateConfig;
-        const out = sanitizeDocumentHtml({ body: XSS }, 'unknown');
-        // No field schema → nothing declared as HTML → untouched.
-        expect(out.body).toBe(XSS);
-    });
-});
-describe('sanitizeLayoutTree', () => {
-    it('sanitizes rich-text block bodies and recurses through children', () => {
-        const tree = {
-            type: 'page',
-            children: [
-                {
-                    type: 'row',
-                    children: [
-                        {
-                            type: 'column',
-                            children: [
-                                { type: 'block', settings: { blockType: 'richText' }, data: { content: XSS } },
-                                {
-                                    type: 'block',
-                                    settings: { blockType: 'heading' },
-                                    data: { text: 'Plain < text' },
-                                },
-                            ],
-                        },
-                    ],
-                },
-            ],
-        };
-        const out = sanitizeLayoutTree(tree);
-        const column = out.children[0].children[0];
-        const blocks = column.children;
-        expect(blocks[0].data.content).not.toContain('<script>');
-        expect(blocks[0].data.content).toContain('<p>ok</p>');
-        // Plain-text block fields (keys not in the HTML allow-list) are untouched.
-        expect(blocks[1].data.text).toBe('Plain < text');
-    });
-    it('returns non-object layouts unchanged', () => {
-        expect(sanitizeLayoutTree(null)).toBeNull();
-        expect(sanitizeLayoutTree('nope')).toBe('nope');
-    });
-});
-//# sourceMappingURL=sanitize-document.test.js.map

package/dist/__tests__/security/sanitize-document.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sanitize-document.test.js","sourceRoot":"","sources":["../../../src/__tests__/security/sanitize-document.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAExD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAA;AAE9F;;;;;;;;;GASG;AACH,MAAM,GAAG,GAAG,gEAAgE,CAAA;AAE5E,SAAS,mBAAmB;IAC1B,gBAAgB,CAAC;QACf,WAAW,EAAE;YACX,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE;oBACN,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE;oBACvC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE;oBACzC,YAAY,EAAE;wBACZ,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,UAAU;wBACjB,MAAM,EAAE;4BACN,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE;4BAC3C,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE;yBAC1C;qBACF;oBACD,QAAQ,EAAE;wBACR,IAAI,EAAE,QAAQ;wBACd,KAAK,EAAE,UAAU;wBACjB,MAAM,EAAE;4BACN;gCACE,IAAI,EAAE,OAAO;gCACb,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;gCAC9C,MAAM,EAAE;oCACN,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE;oCACvC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE;iCAC1C;6BACF;yBACF;qBACF;iBACF;aACF;SACF;KACO,CAAC,CAAA;AACb,CAAC;AAED,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,SAAS,CAAC,GAAG,EAAE;QACb,OAAQ,UAA4C,CAAC,eAAe,CAAA;IACtE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,mBAAmB,EAAE,CAAA;QACrB,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,OAAO,CAAC,CAAA;QAC9E,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;QAC1C,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QACzC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;QACvC,yEAAyE;QACzE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,mBAAmB,EAAE,CAAA;QACrB,MAAM,GAAG,GAAG,oBAAoB,CAC9B,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,EACvD,OAAO,CACR,CAAA;QACD,MAAM,IAAI,GAAI,GAAG,CAAC,YAA+C,CAAC,CAAC,CAAE,CAAA;QACrE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;QAC3C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,mBAAmB,EAAE,CAAA;QACrB,MAAM,GAAG,GAAG,oBAAoB,CAC9B,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,EACjE,OAAO,CACR,CAAA;QACD,MAAM,KAAK,GAAI,GAAG,CAAC,QAA2C,CAAC,CAAC,CAAE,CAAA;QAClE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;QAC5C,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,mBAAmB,EAAE,CAAA;QACrB,MAAM,GAAG,GAAG,oBAAoB,CAC9B;YACE,QAAQ,EAAE;gBACR;oBACE,EAAE,EAAE,IAAI;oBACR,WAAW,EAAE,cAAc;oBAC3B,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE;iBAC5D;aACF;SACF,EACD,OAAO,CACR,CAAA;QACD,MAAM,OAAO,GAAI,GAAG,CAAC,QAA2C,CAAC,CAAC,CAAE,CAAA;QACpE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAkC,CAAA;QAC1D,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;QAC9C,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QAC7C,sDAAsD;QACtD,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACtC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,mBAAmB,EAAE,CAAA;QACrB,MAAM,CAAC,GAAG,EAAE,CACV,oBAAoB,CAClB;YACE,IAAI,EAAE,GAAY;YAClB,YAAY,EAAE,cAAuB;YACrC,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC;SAC5E,EACD,OAAO,CACR,CACF,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;IACjB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,OAAQ,UAA4C,CAAC,eAAe,CAAA;QACpE,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,SAAS,CAAC,CAAA;QAC1D,0DAA0D;QAC1D,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,IAAI,GAAG;YACX,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,KAAK;oBACX,QAAQ,EAAE;wBACR;4BACE,IAAI,EAAE,QAAQ;4BACd,QAAQ,EAAE;gCACR,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;gCAC9E;oCACE,IAAI,EAAE,OAAO;oCACb,QAAQ,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE;oCAClC,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE;iCAC/B;6BACF;yBACF;qBACF;iBACF;aACF;SACF,CAAA;QAKD,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAS,CAAA;QAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,QAAS,CAAC,CAAC,CAAE,CAAC,QAAS,CAAC,CAAC,CAAE,CAAA;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAS,CAAA;QAC/B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,IAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;QAC1D,MAAM,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,IAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;QACvD,2EAA2E;QAC3E,MAAM,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,IAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC3C,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/security/sanitize.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=sanitize.test.d.ts.map

package/dist/__tests__/security/sanitize.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sanitize.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/security/sanitize.test.ts"],"names":[],"mappings":""}