@aglyn/shared-util-http 1.0.0-beta.143

package/src/lib/http.js

@@ -0,0 +1,28 @@
+/**
+ * @license
+ * Copyright 2022 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ export * from "./types.js";
+export * from "./cookie-get-user-id-token.js";
+export * from "./cookie-set-user-id-token.js";
+export * from "./cors-build-response-handler.js";
+export * from "./cors-handle-response.js";
+export * from "./get-absolute-url.js";
+export * from "./get-allowed-headers.js";
+export * from "./get-origin-headers.js";
+export * from "./get-origin-headers-from-request.js";
+export * from "./get-request-header.js";
+export * from "./is-origin-allowed.js";
+
+//# sourceMappingURL=http.js.map

package/src/lib/http.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/shared/util/http/src/lib/http.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2022 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nexport * from './types'\n\nexport * from './cookie-get-user-id-token'\nexport * from './cookie-set-user-id-token'\nexport * from './cors-build-response-handler'\nexport * from './cors-handle-response'\nexport * from './get-absolute-url'\nexport * from './get-allowed-headers'\nexport * from './get-origin-headers'\nexport * from './get-origin-headers-from-request'\nexport * from './get-request-header'\nexport * from './is-origin-allowed'\n"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,cAAc,aAAS;AAEvB,cAAc,gCAA4B;AAC1C,cAAc,gCAA4B;AAC1C,cAAc,mCAA+B;AAC7C,cAAc,4BAAwB;AACtC,cAAc,wBAAoB;AAClC,cAAc,2BAAuB;AACrC,cAAc,0BAAsB;AACpC,cAAc,uCAAmC;AACjD,cAAc,0BAAsB;AACpC,cAAc,yBAAqB"}

package/src/lib/is-origin-allowed.d.ts

@@ -0,0 +1,19 @@
+/**
+ * @license
+ * Copyright 2022 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { StaticOrigin } from './types';
+export declare function isOriginAllowed(origin: string, allowed: StaticOrigin): boolean;
+export default isOriginAllowed;

package/src/lib/is-origin-allowed.js

@@ -0,0 +1,21 @@
+/**
+ * @license
+ * Copyright 2022 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ export function isOriginAllowed(origin, allowed) {
+    return Array.isArray(allowed) ? allowed.some((o)=>isOriginAllowed(origin, o)) : typeof allowed === 'string' ? origin === allowed : allowed instanceof RegExp ? allowed.test(origin) : !!allowed;
+}
+export default isOriginAllowed;
+
+//# sourceMappingURL=is-origin-allowed.js.map

package/src/lib/is-origin-allowed.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/shared/util/http/src/lib/is-origin-allowed.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2022 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type {StaticOrigin} from './types'\n\n\nexport function isOriginAllowed(origin: string, allowed: StaticOrigin): boolean {\n  return Array.isArray(allowed)\n    ? allowed.some((o) => isOriginAllowed(origin, o))\n    : typeof allowed === 'string'\n      ? origin === allowed\n      : allowed instanceof RegExp\n        ? allowed.test(origin)\n        : !!allowed\n}\n\nexport default isOriginAllowed\n"],"names":["isOriginAllowed","origin","allowed","Array","isArray","some","o","RegExp","test"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAKD,OAAO,SAASA,gBAAgBC,MAAc,EAAEC,OAAqB;IACnE,OAAOC,MAAMC,OAAO,CAACF,WACjBA,QAAQG,IAAI,CAAC,CAACC,IAAMN,gBAAgBC,QAAQK,MAC5C,OAAOJ,YAAY,WACjBD,WAAWC,UACXA,mBAAmBK,SACjBL,QAAQM,IAAI,CAACP,UACb,CAAC,CAACC;AACZ;AAEA,eAAeF,gBAAe"}

package/src/lib/safe-redirect.d.ts

@@ -0,0 +1,41 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * True when `candidate` is a relative path that resolves onto its own origin.
+ *
+ * Answers `false` for absent, non-string and unparseable input rather than
+ * throwing: `strictNullChecks` is off repo-wide, so an absent query parameter
+ * reaches this as an empty string or `null` at runtime however the types read,
+ * and a `TypeError` escaping into a sign-in render is a worse outage than the
+ * redirect bug this guards.
+ *
+ * Absolute URLs are refused here even when they name our own host. A caller
+ * that must accept a same-site absolute (the workspace-domain return in
+ * `use-continue-url`) checks that separately, against the parsed hostname —
+ * for an absolute input the parser's verdict is already ground truth, so that
+ * branch never had this bug.
+ */
+export declare function isSameOriginPath(candidate: string | null | undefined): boolean;
+/**
+ * The trimmed path when it stays on this origin, otherwise `fallback`.
+ *
+ * The trimmed value is returned, not the raw one, so what was validated is
+ * what the caller navigates to. Handing back the original would reintroduce
+ * the whole bug class: a guard is only worth anything if the string it
+ * approved is the string that gets used.
+ */
+export declare function safeSameOriginPath(candidate: string | null | undefined, fallback?: string): string;

package/src/lib/safe-redirect.js

@@ -0,0 +1,101 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * The one predicate for "this string is a path on MY origin" (AGL-1881).
+ *
+ * ## Why this exists rather than a sixth hand-rolled shape test
+ *
+ * Six call sites independently implemented the same guard, and every one of
+ * them was written as a list of tricks to reject:
+ *
+ * ```ts
+ * value.startsWith('/') && !value.startsWith('//')   // and later, sometimes:
+ * !value.includes('\\')
+ * ```
+ *
+ * AGL-2486 discovered the backslash and added it to four of the six lists. The
+ * list was still incomplete, because the list can never be complete: the
+ * WHATWG URL parser **removes every ASCII tab, LF and CR from the input before
+ * it parses anything**, so a tab sitting between the two slashes hides the
+ * protocol-relative form from any test that reads the raw characters.
+ * Measured in node 20 and in the browser alike:
+ *
+ *     new URL('/\t/evil.example', 'https://console.acme.com').href
+ *     // → 'https://evil.example/'
+ *
+ * and `window.location.assign` — which is what these call sites go on to do —
+ * resolves it exactly the same way. `\n` and `\r` do it too. So does the
+ * combination `'/\t\\evil.example'`, which slips past even the
+ * backslash-aware version because the character it checks for is no longer in
+ * the authority position when the parser is done.
+ *
+ * ## The shape of the fix
+ *
+ * Stop enumerating. **Ask the same parser the browser will ask**, and accept
+ * only when it agrees the result stayed on the origin we started from. A trick
+ * that the parser does not honor cannot hurt us, and a trick it does honor is
+ * caught by construction — including the ones nobody has thought of yet.
+ *
+ * That is the difference between a check that happens to pass today and a
+ * check that cannot silently stop working, which is the property a redirect
+ * guard needs: these values land the user somewhere immediately after signing
+ * them in, and one that has survived a round trip through an external identity
+ * provider is fully attacker-chosen.
+ *
+ * `.invalid` is reserved by RFC 2606 and can never resolve, so the probe
+ * origin cannot collide with a real host and the comparison means only what it
+ * says.
+ */ const PROBE_ORIGIN = 'https://redirect-probe.aglyn.invalid';
+/**
+ * True when `candidate` is a relative path that resolves onto its own origin.
+ *
+ * Answers `false` for absent, non-string and unparseable input rather than
+ * throwing: `strictNullChecks` is off repo-wide, so an absent query parameter
+ * reaches this as an empty string or `null` at runtime however the types read,
+ * and a `TypeError` escaping into a sign-in render is a worse outage than the
+ * redirect bug this guards.
+ *
+ * Absolute URLs are refused here even when they name our own host. A caller
+ * that must accept a same-site absolute (the workspace-domain return in
+ * `use-continue-url`) checks that separately, against the parsed hostname —
+ * for an absolute input the parser's verdict is already ground truth, so that
+ * branch never had this bug.
+ */ export function isSameOriginPath(candidate) {
+    if (typeof candidate !== 'string') return false;
+    const value = candidate.trim();
+    if (!value.startsWith('/')) return false;
+    try {
+        // Resolve-and-compare. `origin` is what a navigation would actually reach,
+        // so any input the parser rewrites into a different authority — `//host`,
+        // `/\host`, `/<TAB>/host`, and whatever comes next — fails right here.
+        return new URL(value, PROBE_ORIGIN).origin === PROBE_ORIGIN;
+    } catch (unused) {
+        return false;
+    }
+}
+/**
+ * The trimmed path when it stays on this origin, otherwise `fallback`.
+ *
+ * The trimmed value is returned, not the raw one, so what was validated is
+ * what the caller navigates to. Handing back the original would reintroduce
+ * the whole bug class: a guard is only worth anything if the string it
+ * approved is the string that gets used.
+ */ export function safeSameOriginPath(candidate, fallback = '/') {
+    if (!isSameOriginPath(candidate)) return fallback;
+    return candidate.trim();
+}
+
+//# sourceMappingURL=safe-redirect.js.map

package/src/lib/safe-redirect.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/shared/util/http/src/lib/safe-redirect.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The one predicate for \"this string is a path on MY origin\" (AGL-1881).\n *\n * ## Why this exists rather than a sixth hand-rolled shape test\n *\n * Six call sites independently implemented the same guard, and every one of\n * them was written as a list of tricks to reject:\n *\n * ```ts\n * value.startsWith('/') && !value.startsWith('//')   // and later, sometimes:\n * !value.includes('\\\\')\n * ```\n *\n * AGL-2486 discovered the backslash and added it to four of the six lists. The\n * list was still incomplete, because the list can never be complete: the\n * WHATWG URL parser **removes every ASCII tab, LF and CR from the input before\n * it parses anything**, so a tab sitting between the two slashes hides the\n * protocol-relative form from any test that reads the raw characters.\n * Measured in node 20 and in the browser alike:\n *\n *     new URL('/\\t/evil.example', 'https://console.acme.com').href\n *     // → 'https://evil.example/'\n *\n * and `window.location.assign` — which is what these call sites go on to do —\n * resolves it exactly the same way. `\\n` and `\\r` do it too. So does the\n * combination `'/\\t\\\\evil.example'`, which slips past even the\n * backslash-aware version because the character it checks for is no longer in\n * the authority position when the parser is done.\n *\n * ## The shape of the fix\n *\n * Stop enumerating. **Ask the same parser the browser will ask**, and accept\n * only when it agrees the result stayed on the origin we started from. A trick\n * that the parser does not honor cannot hurt us, and a trick it does honor is\n * caught by construction — including the ones nobody has thought of yet.\n *\n * That is the difference between a check that happens to pass today and a\n * check that cannot silently stop working, which is the property a redirect\n * guard needs: these values land the user somewhere immediately after signing\n * them in, and one that has survived a round trip through an external identity\n * provider is fully attacker-chosen.\n *\n * `.invalid` is reserved by RFC 2606 and can never resolve, so the probe\n * origin cannot collide with a real host and the comparison means only what it\n * says.\n */\nconst PROBE_ORIGIN = 'https://redirect-probe.aglyn.invalid'\n\n/**\n * True when `candidate` is a relative path that resolves onto its own origin.\n *\n * Answers `false` for absent, non-string and unparseable input rather than\n * throwing: `strictNullChecks` is off repo-wide, so an absent query parameter\n * reaches this as an empty string or `null` at runtime however the types read,\n * and a `TypeError` escaping into a sign-in render is a worse outage than the\n * redirect bug this guards.\n *\n * Absolute URLs are refused here even when they name our own host. A caller\n * that must accept a same-site absolute (the workspace-domain return in\n * `use-continue-url`) checks that separately, against the parsed hostname —\n * for an absolute input the parser's verdict is already ground truth, so that\n * branch never had this bug.\n */\nexport function isSameOriginPath(\n  candidate: string | null | undefined,\n): boolean {\n  if (typeof candidate !== 'string') return false\n  const value = candidate.trim()\n  if (!value.startsWith('/')) return false\n  try {\n    // Resolve-and-compare. `origin` is what a navigation would actually reach,\n    // so any input the parser rewrites into a different authority — `//host`,\n    // `/\\host`, `/<TAB>/host`, and whatever comes next — fails right here.\n    return new URL(value, PROBE_ORIGIN).origin === PROBE_ORIGIN\n  } catch {\n    return false\n  }\n}\n\n/**\n * The trimmed path when it stays on this origin, otherwise `fallback`.\n *\n * The trimmed value is returned, not the raw one, so what was validated is\n * what the caller navigates to. Handing back the original would reintroduce\n * the whole bug class: a guard is only worth anything if the string it\n * approved is the string that gets used.\n */\nexport function safeSameOriginPath(\n  candidate: string | null | undefined,\n  fallback = '/',\n): string {\n  if (!isSameOriginPath(candidate)) return fallback\n  return (candidate as string).trim()\n}\n"],"names":["PROBE_ORIGIN","isSameOriginPath","candidate","value","trim","startsWith","URL","origin","safeSameOriginPath","fallback"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6CC,GACD,MAAMA,eAAe;AAErB;;;;;;;;;;;;;;CAcC,GACD,OAAO,SAASC,iBACdC,SAAoC;IAEpC,IAAI,OAAOA,cAAc,UAAU,OAAO;IAC1C,MAAMC,QAAQD,UAAUE,IAAI;IAC5B,IAAI,CAACD,MAAME,UAAU,CAAC,MAAM,OAAO;IACnC,IAAI;QACF,2EAA2E;QAC3E,0EAA0E;QAC1E,uEAAuE;QACvE,OAAO,IAAIC,IAAIH,OAAOH,cAAcO,MAAM,KAAKP;IACjD,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA;;;;;;;CAOC,GACD,OAAO,SAASQ,mBACdN,SAAoC,EACpCO,WAAW,GAAG;IAEd,IAAI,CAACR,iBAAiBC,YAAY,OAAOO;IACzC,OAAO,AAACP,UAAqBE,IAAI;AACnC"}

package/src/lib/safe-url-scheme.d.ts

@@ -0,0 +1,42 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * True when `value` may be emitted as a link target.
+ *
+ * A value naming no scheme is allowed: a relative path, a `?query` or a
+ * `#fragment` resolves against whatever base the document has and can name
+ * no protocol at all.
+ *
+ * ### This runs BEFORE the value is escaped, and that order matters
+ *
+ * A caller must escape the approved value into the attribute afterwards, and
+ * the two steps together are what closes the entity-encoded forms. This
+ * function reads raw characters, so `javascript:alert(1)` reads to it as
+ * a value with no scheme and is approved — and then the escape turns its `&`
+ * into `&`, so the parser sees the literal text `javascript:` in the
+ * attribute rather than a character reference, and it names no scheme there
+ * either. Drop the escape and that input becomes live; decode entities here
+ * instead and the escape double-encodes every legitimate `&` in a query
+ * string. Keep both, in this order.
+ */
+export declare function hasSafeLinkScheme(value: string | null | undefined): boolean;
+/**
+ * True when `value` may be emitted as a media source — an `img`, a logo, a
+ * poster. Same contract as {@link hasSafeLinkScheme}, against the narrower
+ * {@link MEDIA_SCHEMES}.
+ */
+export declare function hasSafeMediaScheme(value: string | null | undefined): boolean;

package/src/lib/safe-url-scheme.js

@@ -0,0 +1,124 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Scheme allowlists for a URL this codebase writes into markup, in the one
+ * shared-scope home a `scope:shared` lib can reach.
+ *
+ * ## Why here rather than reusing one of the three that already exist
+ *
+ * The repo has a protocol allowlist in `markdown-lite`'s `safeLinkUrl` /
+ * `safeImageUrl`, another in `author-html`'s `isAllowedUrl`, and a third on
+ * the published marketplace node. All three live in `libs/aglyn` or in a
+ * plugin, and the nx boundary rule `scope:shared → only scope:shared` puts
+ * every one of them out of reach of a `scope:shared` consumer — the same wall
+ * `host-email-tokens.ts` documents for the host-token registry. So a shared
+ * consumer had the choice of a fourth private copy or a shared home; this is
+ * the shared home, next to `safe-redirect.ts`, which already answers the
+ * neighboring question of whether a path stays on our own origin.
+ *
+ * ## What these do and, more importantly, what they do not
+ *
+ * They answer ONE question: does this string name a scheme we are willing to
+ * emit? They say nothing about the host, the path, or whether the target
+ * exists, and they are not a substitute for escaping the value into the
+ * attribute afterwards — see {@link hasSafeLinkScheme} for why the ordering
+ * of those two steps is load-bearing.
+ */ /**
+ * The scheme grammar a browser accepts: an ASCII letter followed by letters,
+ * digits, `+`, `-` or `.`, up to the first colon.
+ */ const SCHEME_PATTERN = /^([a-z][a-z0-9+.-]*):/;
+/**
+ * Schemes allowed on a link the reader chooses to follow.
+ *
+ * `data:` is deliberately absent. A `data:` href is a document the reader
+ * navigates INTO, carrying whatever markup and script the author put in it,
+ * which is the whole vector rather than a corner of it; and no authoring
+ * surface in this product has a reason to mint one, because a link that
+ * cannot be visited, shared, or resolved by a mail client is not a link.
+ *
+ * `javascript:` and `vbscript:` are absent for the obvious reason and are
+ * refused by construction rather than by name — anything not on this list is
+ * refused, so a scheme nobody has thought of yet is refused too.
+ */ const LINK_SCHEMES = new Set([
+    'http',
+    'https',
+    'mailto',
+    'tel',
+    'sms'
+]);
+/**
+ * Schemes allowed on a source the client fetches on its own, with no reader
+ * action: an image, a logo, a thumbnail.
+ *
+ * Narrower than {@link LINK_SCHEMES} because the trust is different. A link
+ * is followed deliberately; a media source is fetched the moment the document
+ * renders, so it must name something ordinary over the network and nothing
+ * else. `mailto:`/`tel:`/`sms:` are meaningless in the position, and `data:`
+ * is excluded for the reason above plus a practical one: a media reference is
+ * resolved against an origin precisely so it comes out as something fetchable.
+ */ const MEDIA_SCHEMES = new Set([
+    'http',
+    'https'
+]);
+/**
+ * The scheme a browser would read out of `value`, or `null` when the value
+ * names none — a relative path, a query, a fragment, or an empty string.
+ *
+ * Compared on a copy with every C0 control and space removed and folded to
+ * lower case, because that is what browsers strip while resolving a scheme:
+ * `"java\tscript:alert(1)"` navigates, and a check that reads the raw
+ * characters does not see it. This mirrors `author-html`'s `isAllowedUrl`,
+ * which learned the same lesson on the tenant render path.
+ */ function schemeOf(value) {
+    // eslint-disable-next-line no-control-regex
+    const stripped = value.replace(/[\u0000-\u0020\u007f]/g, '').toLowerCase();
+    const match = SCHEME_PATTERN.exec(stripped);
+    return match ? match[1] : null;
+}
+/**
+ * True when `value` may be emitted as a link target.
+ *
+ * A value naming no scheme is allowed: a relative path, a `?query` or a
+ * `#fragment` resolves against whatever base the document has and can name
+ * no protocol at all.
+ *
+ * ### This runs BEFORE the value is escaped, and that order matters
+ *
+ * A caller must escape the approved value into the attribute afterwards, and
+ * the two steps together are what closes the entity-encoded forms. This
+ * function reads raw characters, so `javascript:alert(1)` reads to it as
+ * a value with no scheme and is approved — and then the escape turns its `&`
+ * into `&`, so the parser sees the literal text `javascript:` in the
+ * attribute rather than a character reference, and it names no scheme there
+ * either. Drop the escape and that input becomes live; decode entities here
+ * instead and the escape double-encodes every legitimate `&` in a query
+ * string. Keep both, in this order.
+ */ export function hasSafeLinkScheme(value) {
+    if (typeof value !== 'string') return false;
+    const scheme = schemeOf(value);
+    return scheme === null || LINK_SCHEMES.has(scheme);
+}
+/**
+ * True when `value` may be emitted as a media source — an `img`, a logo, a
+ * poster. Same contract as {@link hasSafeLinkScheme}, against the narrower
+ * {@link MEDIA_SCHEMES}.
+ */ export function hasSafeMediaScheme(value) {
+    if (typeof value !== 'string') return false;
+    const scheme = schemeOf(value);
+    return scheme === null || MEDIA_SCHEMES.has(scheme);
+}
+
+//# sourceMappingURL=safe-url-scheme.js.map

package/src/lib/safe-url-scheme.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/shared/util/http/src/lib/safe-url-scheme.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Scheme allowlists for a URL this codebase writes into markup, in the one\n * shared-scope home a `scope:shared` lib can reach.\n *\n * ## Why here rather than reusing one of the three that already exist\n *\n * The repo has a protocol allowlist in `markdown-lite`'s `safeLinkUrl` /\n * `safeImageUrl`, another in `author-html`'s `isAllowedUrl`, and a third on\n * the published marketplace node. All three live in `libs/aglyn` or in a\n * plugin, and the nx boundary rule `scope:shared → only scope:shared` puts\n * every one of them out of reach of a `scope:shared` consumer — the same wall\n * `host-email-tokens.ts` documents for the host-token registry. So a shared\n * consumer had the choice of a fourth private copy or a shared home; this is\n * the shared home, next to `safe-redirect.ts`, which already answers the\n * neighboring question of whether a path stays on our own origin.\n *\n * ## What these do and, more importantly, what they do not\n *\n * They answer ONE question: does this string name a scheme we are willing to\n * emit? They say nothing about the host, the path, or whether the target\n * exists, and they are not a substitute for escaping the value into the\n * attribute afterwards — see {@link hasSafeLinkScheme} for why the ordering\n * of those two steps is load-bearing.\n */\n\n/**\n * The scheme grammar a browser accepts: an ASCII letter followed by letters,\n * digits, `+`, `-` or `.`, up to the first colon.\n */\nconst SCHEME_PATTERN = /^([a-z][a-z0-9+.-]*):/\n\n/**\n * Schemes allowed on a link the reader chooses to follow.\n *\n * `data:` is deliberately absent. A `data:` href is a document the reader\n * navigates INTO, carrying whatever markup and script the author put in it,\n * which is the whole vector rather than a corner of it; and no authoring\n * surface in this product has a reason to mint one, because a link that\n * cannot be visited, shared, or resolved by a mail client is not a link.\n *\n * `javascript:` and `vbscript:` are absent for the obvious reason and are\n * refused by construction rather than by name — anything not on this list is\n * refused, so a scheme nobody has thought of yet is refused too.\n */\nconst LINK_SCHEMES: ReadonlySet<string> = new Set([\n  'http',\n  'https',\n  'mailto',\n  'tel',\n  'sms',\n])\n\n/**\n * Schemes allowed on a source the client fetches on its own, with no reader\n * action: an image, a logo, a thumbnail.\n *\n * Narrower than {@link LINK_SCHEMES} because the trust is different. A link\n * is followed deliberately; a media source is fetched the moment the document\n * renders, so it must name something ordinary over the network and nothing\n * else. `mailto:`/`tel:`/`sms:` are meaningless in the position, and `data:`\n * is excluded for the reason above plus a practical one: a media reference is\n * resolved against an origin precisely so it comes out as something fetchable.\n */\nconst MEDIA_SCHEMES: ReadonlySet<string> = new Set(['http', 'https'])\n\n/**\n * The scheme a browser would read out of `value`, or `null` when the value\n * names none — a relative path, a query, a fragment, or an empty string.\n *\n * Compared on a copy with every C0 control and space removed and folded to\n * lower case, because that is what browsers strip while resolving a scheme:\n * `\"java\\tscript:alert(1)\"` navigates, and a check that reads the raw\n * characters does not see it. This mirrors `author-html`'s `isAllowedUrl`,\n * which learned the same lesson on the tenant render path.\n */\nfunction schemeOf(value: string): string | null {\n  // eslint-disable-next-line no-control-regex\n  const stripped = value.replace(/[\\u0000-\\u0020\\u007f]/g, '').toLowerCase()\n  const match = SCHEME_PATTERN.exec(stripped)\n  return match ? match[1] : null\n}\n\n/**\n * True when `value` may be emitted as a link target.\n *\n * A value naming no scheme is allowed: a relative path, a `?query` or a\n * `#fragment` resolves against whatever base the document has and can name\n * no protocol at all.\n *\n * ### This runs BEFORE the value is escaped, and that order matters\n *\n * A caller must escape the approved value into the attribute afterwards, and\n * the two steps together are what closes the entity-encoded forms. This\n * function reads raw characters, so `&#106;avascript:alert(1)` reads to it as\n * a value with no scheme and is approved — and then the escape turns its `&`\n * into `&amp;`, so the parser sees the literal text `&#106;avascript:` in the\n * attribute rather than a character reference, and it names no scheme there\n * either. Drop the escape and that input becomes live; decode entities here\n * instead and the escape double-encodes every legitimate `&` in a query\n * string. Keep both, in this order.\n */\nexport function hasSafeLinkScheme(value: string | null | undefined): boolean {\n  if (typeof value !== 'string') return false\n  const scheme = schemeOf(value)\n  return scheme === null || LINK_SCHEMES.has(scheme)\n}\n\n/**\n * True when `value` may be emitted as a media source — an `img`, a logo, a\n * poster. Same contract as {@link hasSafeLinkScheme}, against the narrower\n * {@link MEDIA_SCHEMES}.\n */\nexport function hasSafeMediaScheme(value: string | null | undefined): boolean {\n  if (typeof value !== 'string') return false\n  const scheme = schemeOf(value)\n  return scheme === null || MEDIA_SCHEMES.has(scheme)\n}\n"],"names":["SCHEME_PATTERN","LINK_SCHEMES","Set","MEDIA_SCHEMES","schemeOf","value","stripped","replace","toLowerCase","match","exec","hasSafeLinkScheme","scheme","has","hasSafeMediaScheme"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GAED;;;CAGC,GACD,MAAMA,iBAAiB;AAEvB;;;;;;;;;;;;CAYC,GACD,MAAMC,eAAoC,IAAIC,IAAI;IAChD;IACA;IACA;IACA;IACA;CACD;AAED;;;;;;;;;;CAUC,GACD,MAAMC,gBAAqC,IAAID,IAAI;IAAC;IAAQ;CAAQ;AAEpE;;;;;;;;;CASC,GACD,SAASE,SAASC,KAAa;IAC7B,4CAA4C;IAC5C,MAAMC,WAAWD,MAAME,OAAO,CAAC,0BAA0B,IAAIC,WAAW;IACxE,MAAMC,QAAQT,eAAeU,IAAI,CAACJ;IAClC,OAAOG,QAAQA,KAAK,CAAC,EAAE,GAAG;AAC5B;AAEA;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,SAASE,kBAAkBN,KAAgC;IAChE,IAAI,OAAOA,UAAU,UAAU,OAAO;IACtC,MAAMO,SAASR,SAASC;IACxB,OAAOO,WAAW,QAAQX,aAAaY,GAAG,CAACD;AAC7C;AAEA;;;;CAIC,GACD,OAAO,SAASE,mBAAmBT,KAAgC;IACjE,IAAI,OAAOA,UAAU,UAAU,OAAO;IACtC,MAAMO,SAASR,SAASC;IACxB,OAAOO,WAAW,QAAQT,cAAcU,GAAG,CAACD;AAC9C"}

package/src/lib/types.d.ts

@@ -0,0 +1,30 @@
+/**
+ * @license
+ * Copyright 2022 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { HttpStatusCode } from '@aglyn/shared-data-enums';
+import type { NextApiRequest } from 'next';
+export type StaticOrigin = boolean | string | RegExp | (boolean | string | RegExp)[];
+export type OriginFn = (origin: string[] | string | undefined, request: Request | NextApiRequest) => StaticOrigin | Promise<StaticOrigin>;
+export interface CorsOptions {
+    origin?: StaticOrigin | OriginFn;
+    methods?: string | string[];
+    allowedHeaders?: string | string[];
+    exposedHeaders?: string | string[];
+    credentials?: boolean;
+    maxAge?: number;
+    preflightContinue?: boolean;
+    optionsSuccessStatus?: HttpStatusCode;
+}

package/src/lib/types.js

@@ -0,0 +1,18 @@
+/**
+ * @license
+ * Copyright 2022 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ export { };
+
+//# sourceMappingURL=types.js.map

package/src/lib/types.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/shared/util/http/src/lib/types.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2022 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport type {HttpStatusCode} from '@aglyn/shared-data-enums'\nimport type {NextApiRequest} from 'next'\n\n\nexport type StaticOrigin = boolean | string | RegExp | (boolean | string | RegExp)[]\n\nexport type OriginFn = (\n  origin: string[] | string | undefined,\n  request: Request | NextApiRequest,\n) => StaticOrigin | Promise<StaticOrigin>\n\nexport interface CorsOptions {\n  origin?: StaticOrigin | OriginFn\n  methods?: string | string[]\n  allowedHeaders?: string | string[]\n  exposedHeaders?: string | string[]\n  credentials?: boolean\n  maxAge?: number\n  preflightContinue?: boolean\n  optionsSuccessStatus?: HttpStatusCode\n}\n"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAYD,WASC"}