@almadar/orb 1.17.1 → 2.44.0

package/shells/almadar-shell/packages/server/src/app.ts

@@ -4,6 +4,8 @@
 
 import express, { type Express } from 'express';
 import cors from 'cors';
+import helmet from 'helmet';
+import rateLimit from 'express-rate-limit';
 import {
   env,
   logger,
@@ -16,9 +18,12 @@ import { registerRoutes } from './routes.js';
 export const app: Express = express();
 
 // Middleware
-app.use(cors({ origin: true, credentials: true }));
-app.use(express.json());
-app.use(express.urlencoded({ extended: true }));
+app.use(helmet());
+// CORS: env-driven allowlist (CORS_ORIGIN) — never reflect arbitrary origins with credentials.
+app.use(cors({ origin: env.CORS_ORIGIN, credentials: true }));
+app.use(express.json({ limit: '1mb' }));
+app.use(express.urlencoded({ extended: true, limit: '1mb' }));
+app.use('/api', rateLimit({ windowMs: 15 * 60 * 1000, max: 300, standardHeaders: true, legacyHeaders: false }));
 
 // Health check
 app.get('/health', (_req, res) => {

package/shells/almadar-shell/packages/server/src/types/express.d.ts

@@ -1,3 +1,5 @@
+import type { EventPayloadValue } from '@almadar/core';
+
 declare global {
   namespace Express {
     interface Request {
@@ -6,7 +8,7 @@ declare global {
         email?: string;
         name?: string;
         picture?: string;
-        [key: string]: unknown;
+        [key: string]: EventPayloadValue;
       };
     }
   }

package/shells/almadar-shell/packages/shared/package.json

@@ -5,6 +5,7 @@
   "main": "src/index.ts",
   "types": "src/index.ts",
   "dependencies": {
+    "@almadar/core": "^7.14.3",
     "zod": "^3.22.0"
   }
 }

package/shells/almadar-shell/packages/shared/pnpm-lock.yaml

@@ -0,0 +1,22 @@
+lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false
+
+importers:
+
+  .:
+    dependencies:
+      zod:
+        specifier: ^3.22.0
+        version: 3.25.76
+
+packages:
+
+  zod@3.25.76:
+    resolution: {integrity: sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==}
+
+snapshots:
+
+  zod@3.25.76: {}