@antasphere/chassis-server 1.0.0

package/dist/middleware/cross-site.d.ts

@@ -0,0 +1,61 @@
+import type { MiddlewareHandler } from 'hono';
+/**
+ * Cross-site request forgery defence for the whole `/api/v1` surface.
+ *
+ * The session cookie authenticates every business route (`/orgs`, `/members`,
+ * `/invitations`, `/me/*`, `/apikeys`, every product route a instantiation
+ * adds), and a cookie is attached by the browser on a cross-site POST just as
+ * happily as on a same-origin one. Better Auth's own origin check covers only
+ * its `/sign-in` paths, so without this middleware a page on any origin could
+ * drive a signed-in user's whole API.
+ *
+ * Two independent signals, both browser-set and unforgeable by page script
+ * (both are Forbidden Header Names — `fetch` cannot override them):
+ *
+ *  1. `Sec-Fetch-Site: cross-site` — a request initiated by a document on a
+ *     different site. Refused outright.
+ *  2. `Origin` — present on every browser request with an unsafe method.
+ *     Refused unless it is the origin we are being served on, the configured
+ *     public origin, or an explicitly trusted extra.
+ *
+ * Deliberately NOT refused:
+ *
+ *  - Safe methods (GET/HEAD/OPTIONS). A cross-site read cannot be seen by the
+ *    attacker — `/api/v1` sends no `Access-Control-Allow-Origin` except on the
+ *    OAuth surfaces below — and refusing them would break legitimate
+ *    cross-origin embeds of authenticated content.
+ *  - Requests presenting an `Authorization` header. Those are API keys and
+ *    OAuth bearers: not ambient credentials, so not forgeable cross-site (a
+ *    page cannot attach the header without a preflight we never approve).
+ *    Refusing them would break every scripted and browser-based MCP client.
+ *  - The deliberate wildcard-CORS OAuth endpoints (oauth-public.ts): token,
+ *    register, introspect, revoke, jwks and discovery are cookie-less by
+ *    design and MUST answer any origin.
+ *  - Requests with neither header. Non-browser clients (curl, the CLI, the
+ *    SDK, server-to-server) send neither, and this middleware must not become
+ *    a browser-only gate on a self-hosted API. The ambient-credential threat
+ *    this closes is browser-only, and browsers always send at least one.
+ */
+export interface CrossSiteGuardOptions {
+    /** The instance's configured public origin (PUBLIC_BASE_URL). */
+    publicBaseUrl: string;
+    /**
+     * Additional origins allowed to drive the API with cookies — a separately
+     * hosted first-party dashboard, say. Empty on the template.
+     */
+    extraTrustedOrigins?: readonly string[];
+    /**
+     * Origins REFUSED even when they equal the origin this request was served
+     * on: the viewer origin (VIEWER_BASE_URL, PRDCT-1352). The host gate keeps
+     * `/api/v1` (minus the token-authed `/viewer/*` subset) off that hostname
+     * altogether, so in the shipped assembly no request here carries it as the
+     * serving origin — this is the second lock, so that a gate regression or a
+     * proxy routing the viewer hostname at the app never turns "the origin we
+     * are served on" into a trust grant for author-controlled script.
+     */
+    deniedOrigins?: readonly string[];
+    /** Escape hatch for surfaces that must stay open (paths are `/api/v1/...`). */
+    isExempt?: (path: string) => boolean;
+}
+export declare function crossSiteGuard({ publicBaseUrl, extraTrustedOrigins, deniedOrigins, isExempt }: CrossSiteGuardOptions): MiddlewareHandler;
+//# sourceMappingURL=cross-site.d.ts.map

package/dist/middleware/cross-site.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cross-site.d.ts","sourceRoot":"","sources":["../../src/middleware/cross-site.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAIvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,WAAW,qBAAqB;IACpC,iEAAiE;IACjE,aAAa,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CACtC;AAiBD,wBAAgB,cAAc,CAAC,EAC7B,aAAa,EACb,mBAAwB,EACxB,aAAkB,EAClB,QAAQ,EACT,EAAE,qBAAqB,GAAG,iBAAiB,CAsC3C"}

package/dist/middleware/cross-site.js

@@ -0,0 +1,59 @@
+import { apiError } from '../api/errors.js';
+import { isPublicOauthPath } from './oauth-public.js';
+const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
+function originOf(value) {
+    try {
+        return new URL(value).origin;
+    }
+    catch {
+        return null;
+    }
+}
+/** The origin this very request was addressed to (works on localhost, previews, any domain). */
+function servingOrigin(c) {
+    return originOf(c.req.url);
+}
+export function crossSiteGuard({ publicBaseUrl, extraTrustedOrigins = [], deniedOrigins = [], isExempt }) {
+    const configured = new Set();
+    const publicOrigin = originOf(publicBaseUrl);
+    if (publicOrigin)
+        configured.add(publicOrigin);
+    for (const extra of extraTrustedOrigins) {
+        const origin = originOf(extra);
+        if (origin)
+            configured.add(origin);
+    }
+    const denied = new Set();
+    for (const value of deniedOrigins) {
+        const origin = originOf(value);
+        if (origin)
+            denied.add(origin);
+    }
+    // A denied origin wins over every trust source, the serving origin included.
+    for (const origin of denied)
+        configured.delete(origin);
+    return async (c, next) => {
+        if (SAFE_METHODS.has(c.req.method))
+            return next();
+        if (c.req.header('authorization'))
+            return next();
+        if (isPublicOauthPath(c.req.path))
+            return next();
+        if (isExempt?.(c.req.path))
+            return next();
+        const secFetchSite = c.req.header('sec-fetch-site');
+        if (secFetchSite === 'cross-site') {
+            return apiError(c, 403, 'cross_site_forbidden', 'Cross-site requests are not accepted on this API');
+        }
+        const origin = c.req.header('origin');
+        if (origin) {
+            const serving = servingOrigin(c);
+            const trusted = !denied.has(origin) && (origin === serving || configured.has(origin));
+            if (!trusted) {
+                return apiError(c, 403, 'cross_site_forbidden', 'Cross-site requests are not accepted on this API');
+            }
+        }
+        return next();
+    };
+}
+//# sourceMappingURL=cross-site.js.map

package/dist/middleware/cross-site.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cross-site.js","sourceRoot":"","sources":["../../src/middleware/cross-site.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AA6DtD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAEzD,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,EAC7B,aAAa,EACb,mBAAmB,GAAG,EAAE,EACxB,aAAa,GAAG,EAAE,EAClB,QAAQ,EACc;IACtB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,YAAY,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC7C,IAAI,YAAY;QAAE,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC/C,KAAK,MAAM,KAAK,IAAI,mBAAmB,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,MAAM;YAAE,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,6EAA6E;IAC7E,KAAK,MAAM,MAAM,IAAI,MAAM;QAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEvD,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACjD,IAAI,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACjD,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAE1C,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACpD,IAAI,YAAY,KAAK,YAAY,EAAE,CAAC;YAClC,OAAO,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,sBAAsB,EAAE,kDAAkD,CAAC,CAAC;QACtG,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;YACjC,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YACtF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,sBAAsB,EAAE,kDAAkD,CAAC,CAAC;YACtG,CAAC;QACH,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/hub-managed.d.ts

@@ -0,0 +1,45 @@
+import type { MiddlewareHandler } from 'hono';
+/**
+ * P7 (internal/federation.md "Hub-managed membership"): on the cloud edition,
+ * membership of a HUB-ORIGIN (projected) workspace is the hub's source of
+ * truth — invites, roles, and removals happen at the hub and flow in via
+ * SSO login + the P4 re-assertion. A local membership mutation on such a
+ * workspace would create divergence the next login/re-assertion fights, so
+ * every mutation on the local /members + /invitations surfaces answers this
+ * refusal instead. READS stay open: the projected roster is real.
+ *
+ * Why 403 (not 410): the member rows demonstrably exist (GET /members
+ * serves them), so "the resource is gone" would be false — what is denied
+ * is the OPERATION's local authority, for every caller, regardless of role
+ * or credential. That is RFC 9110 403's "forbidden for reasons unrelated to
+ * the credentials", and it keeps the platform's refusal vocabulary in one
+ * register (guest_forbidden, endpoint_not_allowed, workspace_mismatch are
+ * all 403). The `hub_managed` code + `details.manageUrl` carry the pointer.
+ *
+ * Fail-closed by construction:
+ *  - Hub-origin detection keys on `principal.accountRef`, which every
+ *    credential resolver (session: platform/local-identity.ts; API key:
+ *    apikeys/service.ts; OAuth bearer: identity/oauth-jwt.ts) populates from
+ *    a LIVE join on `workspaces.central_account_id` for the request's ONE
+ *    workspace (ADR 014) — the same signal the live hub gate keys on
+ *    (identity/hub-live-gate.ts). There is no principal-construction path
+ *    that skips the join.
+ *  - The gate is method-keyed, not route-enumerated, and mounted ONCE per
+ *    subtree wildcard (`/members/*`, `/invitations/*` — in Hono the
+ *    wildcard also matches the collection root): any FUTURE mutation
+ *    registered anywhere under those surfaces is refused by default, with
+ *    no per-path registration to remember.
+ *  - It is registered only on EDITION=cloud (the `hubConfig` presence
+ *    switch, like every cloud seam) — oss carries zero behavior change, and
+ *    on oss `centralAccountId` is never set anyway (double cover).
+ *
+ * Principal-less requests pass through untouched: the public invitation
+ * accept/lookup segments are explicitly SKIPPED where this is mounted (their
+ * target workspace is the invitation's, not the caller's — the accept
+ * handler runs its own hub-origin check on the invitation's workspace), and
+ * every other gated route 401s in its requireAuth/requireRole gate.
+ */
+export declare function hubManagedMembershipGate(manageUrl: string, message?: string): MiddlewareHandler;
+/** The teams' sentence for the same gate (PRDCT-2813): a projected team is shaped on the account site. */
+export declare const HUB_MANAGED_TEAMS_MESSAGE = "Teams of this workspace are managed at the Antasphere hub \u2014 create, rename, and seat people there";
+//# sourceMappingURL=hub-managed.d.ts.map

package/dist/middleware/hub-managed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub-managed.d.ts","sourceRoot":"","sources":["../../src/middleware/hub-managed.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAG9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,OAAO,SAA2G,GACjH,iBAAiB,CAUnB;AAED,0GAA0G;AAC1G,eAAO,MAAM,yBAAyB,2GAC+D,CAAC"}

package/dist/middleware/hub-managed.js

@@ -0,0 +1,56 @@
+import { apiError } from '../api/errors.js';
+/**
+ * P7 (internal/federation.md "Hub-managed membership"): on the cloud edition,
+ * membership of a HUB-ORIGIN (projected) workspace is the hub's source of
+ * truth — invites, roles, and removals happen at the hub and flow in via
+ * SSO login + the P4 re-assertion. A local membership mutation on such a
+ * workspace would create divergence the next login/re-assertion fights, so
+ * every mutation on the local /members + /invitations surfaces answers this
+ * refusal instead. READS stay open: the projected roster is real.
+ *
+ * Why 403 (not 410): the member rows demonstrably exist (GET /members
+ * serves them), so "the resource is gone" would be false — what is denied
+ * is the OPERATION's local authority, for every caller, regardless of role
+ * or credential. That is RFC 9110 403's "forbidden for reasons unrelated to
+ * the credentials", and it keeps the platform's refusal vocabulary in one
+ * register (guest_forbidden, endpoint_not_allowed, workspace_mismatch are
+ * all 403). The `hub_managed` code + `details.manageUrl` carry the pointer.
+ *
+ * Fail-closed by construction:
+ *  - Hub-origin detection keys on `principal.accountRef`, which every
+ *    credential resolver (session: platform/local-identity.ts; API key:
+ *    apikeys/service.ts; OAuth bearer: identity/oauth-jwt.ts) populates from
+ *    a LIVE join on `workspaces.central_account_id` for the request's ONE
+ *    workspace (ADR 014) — the same signal the live hub gate keys on
+ *    (identity/hub-live-gate.ts). There is no principal-construction path
+ *    that skips the join.
+ *  - The gate is method-keyed, not route-enumerated, and mounted ONCE per
+ *    subtree wildcard (`/members/*`, `/invitations/*` — in Hono the
+ *    wildcard also matches the collection root): any FUTURE mutation
+ *    registered anywhere under those surfaces is refused by default, with
+ *    no per-path registration to remember.
+ *  - It is registered only on EDITION=cloud (the `hubConfig` presence
+ *    switch, like every cloud seam) — oss carries zero behavior change, and
+ *    on oss `centralAccountId` is never set anyway (double cover).
+ *
+ * Principal-less requests pass through untouched: the public invitation
+ * accept/lookup segments are explicitly SKIPPED where this is mounted (their
+ * target workspace is the invitation's, not the caller's — the accept
+ * handler runs its own hub-origin check on the invitation's workspace), and
+ * every other gated route 401s in its requireAuth/requireRole gate.
+ */
+export function hubManagedMembershipGate(manageUrl, message = 'Membership of this workspace is managed at the Antasphere hub — invite, remove, and change roles there') {
+    return async (c, next) => {
+        const method = c.req.method;
+        if (method === 'GET' || method === 'HEAD' || method === 'OPTIONS')
+            return next();
+        const principal = c.get('principal');
+        if (principal?.accountRef) {
+            return apiError(c, 403, 'hub_managed', message, { manageUrl });
+        }
+        return next();
+    };
+}
+/** The teams' sentence for the same gate (PRDCT-2813): a projected team is shaped on the account site. */
+export const HUB_MANAGED_TEAMS_MESSAGE = 'Teams of this workspace are managed at the Antasphere hub — create, rename, and seat people there';
+//# sourceMappingURL=hub-managed.js.map

package/dist/middleware/hub-managed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub-managed.js","sourceRoot":"","sources":["../../src/middleware/hub-managed.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,UAAU,wBAAwB,CACtC,SAAiB,EACjB,OAAO,GAAG,wGAAwG;IAElH,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;QAC5B,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,EAAE,CAAC;QACjF,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,SAAS,EAAE,UAAU,EAAE,CAAC;YAC1B,OAAO,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,0GAA0G;AAC1G,MAAM,CAAC,MAAM,yBAAyB,GACpC,mGAAmG,CAAC"}

package/dist/middleware/idempotency.d.ts

@@ -0,0 +1,14 @@
+import type { MiddlewareHandler } from 'hono';
+import { type Db } from '@antasphere/chassis-db';
+/** Encrypt a response body for storage at rest: `iv.ciphertext.tag` base64url. */
+export declare function seal(plain: string, authSecret: string): string;
+/** Decrypt a sealed body; null on tamper, malformed input, or a wrong/rotated key. */
+export declare function open(sealed: string, authSecret: string): string | null;
+export interface IdempotencyDeps {
+    db: Db;
+    authSecret: string;
+    /** The tool's own create POSTs that take the claim (a pure predicate over the path; POST only). */
+    toolTargets?: (path: string) => boolean;
+}
+export declare function idempotency({ db, authSecret, toolTargets }: IdempotencyDeps): MiddlewareHandler;
+//# sourceMappingURL=idempotency.d.ts.map

package/dist/middleware/idempotency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.d.ts","sourceRoot":"","sources":["../../src/middleware/idempotency.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAG9C,OAAO,EAAmB,KAAK,EAAE,EAAE,MAAM,wBAAwB,CAAC;AAkGlE,kFAAkF;AAClF,wBAAgB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAK9D;AAED,sFAAsF;AACtF,wBAAgB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAYtE;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,EAAE,CAAC;IACP,UAAU,EAAE,MAAM,CAAC;IACnB,mGAAmG;IACnG,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CACzC;AAED,wBAAgB,WAAW,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,EAAE,eAAe,GAAG,iBAAiB,CAmI/F"}

package/dist/middleware/idempotency.js

@@ -0,0 +1,222 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'node:crypto';
+import { and, eq } from 'drizzle-orm';
+import { idempotencyKeys } from '@antasphere/chassis-db';
+import { apiError } from '../api/errors.js';
+/**
+ * Idempotency-Key middleware: an opt-in `Idempotency-Key` request header on
+ * the non-idempotent create POSTs makes a network-blip retry replay the
+ * original response instead of double-creating. Claim-first: the row is
+ * inserted BEFORE the handler runs (the unique index is the mutex), so two
+ * concurrent requests with the same key can never both execute.
+ *
+ * Explicit target list, fail-closed style — only these consult it (the
+ * lines that say "the tool's" are the TOOL's, declared through `toolTargets`):
+ *   POST /api/v1/api-keys
+ *   POST /api/v1/invitations
+ *   POST /api/v1/members/{id}/reset-link
+ *   POST /api/v1/members/{id}/change-email-link (FUZZ-7, PRDCT-1354: the
+ *     SECOND secret-minting member route, and the more dangerous one — its
+ *     token is sign-in-equivalent. Its contract has always declared
+ *     `Idempotency-Key` and a 409, but the claim never covered it, so a
+ *     retried mint silently produced a SECOND live sign-in-equivalent JWT
+ *     that cannot be revoked, on top of the first. The two mint routes must
+ *     stay listed together.)
+ *   the tool's token mint on one of its resources
+ *   the tool's duplicate of a resource (PRDCT-2279: one click mints
+ *     one copy; a network-blip retry must not mint a second copy)
+ *   POST /api/v1/workspaces (PRDCT-2444/2443: one click mints one workspace;
+ *     on cloud the retry would otherwise create a second organization at
+ *     the hub. The claim is scoped to the caller's CURRENT workspace + user;
+ *     the cloud zero-membership session has no principal and runs unclaimed)
+ *   the tool's upload reserve (a retried reserve must not leak a
+ *     second session + reserved resource id)
+ *   POST /api/v1/projects (one click mints one project) and
+ *   POST /api/v1/projects/{id}/members (a retried add answers the first
+ *     add's 201, not 409 `already_member`)
+ * Deliberate NON-targets:
+ *   POST /api/v1/files and the tool's asset upload — content-addressed
+ *     dedupe already makes them idempotent, and upload bodies must never be
+ *     buffered here;
+ *   POST /api/v1/setup and /api/v1/invitations/accept — one-shot by
+ *     construction (retries answer 410), and they run without a principal;
+ *   the tool's version commits — one-shot (session consumed / version counter)
+ *     by construction: a retry answers 409.
+ *
+ * The cached response body is stored AES-256-GCM ENCRYPTED: these responses
+ * carry one-shot secrets (the full API key, the invitation acceptUrl token,
+ * the reset link) whose plaintext is deliberately never persisted anywhere
+ * else, and this cache must not become the exception. Sealed payload format:
+ * `iv.ciphertext.tag`, each part base64url; key = sha256(authSecret +
+ * ':idempotency'). Rotating AUTH_SECRET inside the 24h window is the same
+ * hard cutover it is for API keys: `open()` fails closed (null) and the
+ * stale row is dropped and re-executed.
+ *
+ * Accepted edge: a crash between the handler's commit and the response
+ * persist leaves a claim without a response — same-key retries answer 409
+ * `idempotency_in_flight` until the 24h expiry. Safe (never double-creates),
+ * mildly annoying, self-healing.
+ */
+/** Rows live 24h (the Stripe convention); the nightly purge deletes expired ones. */
+const TTL_MS = 24 * 60 * 60 * 1000;
+const KEY_MAX_LENGTH = 200;
+const TARGET_PATHS = new Set([
+    '/api/v1/api-keys',
+    '/api/v1/invitations',
+    '/api/v1/workspaces',
+    '/api/v1/projects'
+]);
+// The two member routes that MINT a credential for another user. Both are
+// covered (FUZZ-7): a replayed mint hands out a second live secret, and the
+// change-email JWT is stateless, so it cannot even be revoked afterwards.
+const RESET_LINK_RE = /^\/api\/v1\/members\/[^/]+\/reset-link$/;
+const CHANGE_EMAIL_LINK_RE = /^\/api\/v1\/members\/[^/]+\/change-email-link$/;
+const PROJECT_MEMBERS_RE = /^\/api\/v1\/projects\/[^/]+\/members$/;
+function isTarget(method, path, toolTargets) {
+    return (method === 'POST' &&
+        (TARGET_PATHS.has(path) ||
+            RESET_LINK_RE.test(path) ||
+            CHANGE_EMAIL_LINK_RE.test(path) ||
+            PROJECT_MEMBERS_RE.test(path) ||
+            (toolTargets?.(path) ?? false)));
+}
+/** AES-256-GCM key derived from the server auth secret (domain-separated). */
+function keyOf(authSecret) {
+    return createHash('sha256')
+        .update(authSecret + ':idempotency')
+        .digest();
+}
+/** Encrypt a response body for storage at rest: `iv.ciphertext.tag` base64url. */
+export function seal(plain, authSecret) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', keyOf(authSecret), iv);
+    const ciphertext = Buffer.concat([cipher.update(plain, 'utf8'), cipher.final()]);
+    return `${iv.toString('base64url')}.${ciphertext.toString('base64url')}.${cipher.getAuthTag().toString('base64url')}`;
+}
+/** Decrypt a sealed body; null on tamper, malformed input, or a wrong/rotated key. */
+export function open(sealed, authSecret) {
+    const [iv, ciphertext, tag] = sealed.split('.');
+    if (!iv || !ciphertext || !tag)
+        return null;
+    try {
+        const decipher = createDecipheriv('aes-256-gcm', keyOf(authSecret), Buffer.from(iv, 'base64url'));
+        decipher.setAuthTag(Buffer.from(tag, 'base64url'));
+        return Buffer.concat([decipher.update(Buffer.from(ciphertext, 'base64url')), decipher.final()]).toString('utf8');
+    }
+    catch {
+        return null;
+    }
+}
+export function idempotency({ db, authSecret, toolTargets }) {
+    return async (c, next) => {
+        if (!isTarget(c.req.method, c.req.path, toolTargets))
+            return next();
+        const key = c.req.header('idempotency-key');
+        if (key === undefined)
+            return next();
+        if (key.length === 0 || key.length > KEY_MAX_LENGTH) {
+            // This middleware runs before contract validation, so the header bound
+            // is enforced here (the contract mirrors it for the OpenAPI document).
+            return apiError(c, 400, 'invalid_idempotency_key', 'Idempotency-Key must be 1–200 characters');
+        }
+        const principal = c.get('principal');
+        if (!principal)
+            return next(); // the route gates 401 downstream
+        // Hono caches the body: the zod validator's later c.req.json() re-reads
+        // from the same cache (verified on hono 4.12), so this text() is safe.
+        const bodyText = await c.req.text();
+        // Raw bytes, no canonicalization: a retry that re-serializes the same
+        // JSON differently hashes differently and 409s — by design.
+        const requestHash = createHash('sha256')
+            .update(`${c.req.method}\n${c.req.path}\n${bodyText}`)
+            .digest('hex');
+        const scope = and(eq(idempotencyKeys.workspaceId, principal.workspaceId), eq(idempotencyKeys.userId, principal.userId), eq(idempotencyKeys.key, key));
+        const claim = async () => {
+            const rows = await db
+                .insert(idempotencyKeys)
+                .values({
+                workspaceId: principal.workspaceId,
+                userId: principal.userId,
+                key,
+                requestHash,
+                expiresAt: new Date(Date.now() + TTL_MS)
+            })
+                .onConflictDoNothing({
+                target: [idempotencyKeys.workspaceId, idempotencyKeys.userId, idempotencyKeys.key]
+            })
+                .returning({ id: idempotencyKeys.id });
+            return rows[0]?.id ?? null;
+        };
+        let claimId = await claim();
+        if (claimId === null) {
+            // Claim lost: someone (possibly an earlier attempt of this very
+            // client) holds the key. Inspect the row to replay or conflict.
+            const [existing] = await db.select().from(idempotencyKeys).where(scope).limit(1);
+            if (!existing) {
+                // The row vanished between insert and select (raced the nightly
+                // purge). Claim once more; losing again means a live concurrent racer.
+                claimId = await claim();
+                if (claimId === null) {
+                    return apiError(c, 409, 'idempotency_in_flight', 'A request with this Idempotency-Key is in flight — retry shortly');
+                }
+            }
+            else if (existing.requestHash !== requestHash) {
+                return apiError(c, 409, 'idempotency_key_reuse', 'This Idempotency-Key was already used with a different request');
+            }
+            else if (existing.responseStatus === null || existing.responseBodyEnc === null) {
+                return apiError(c, 409, 'idempotency_in_flight', 'The original request is still in flight — retry shortly');
+            }
+            else {
+                const plain = open(existing.responseBodyEnc, authSecret);
+                if (plain === null) {
+                    // Sealed under a rotated AUTH_SECRET (documented hard cutover):
+                    // unrecoverable, so drop the stale row and execute afresh.
+                    await db.delete(idempotencyKeys).where(eq(idempotencyKeys.id, existing.id));
+                    claimId = await claim();
+                    if (claimId === null) {
+                        return apiError(c, 409, 'idempotency_in_flight', 'A request with this Idempotency-Key is in flight — retry shortly');
+                    }
+                }
+                else {
+                    c.header('idempotency-replayed', 'true');
+                    return c.json(JSON.parse(plain), existing.responseStatus);
+                }
+            }
+        }
+        // Owner path: we hold the claim; the handler executes.
+        const ownedClaimId = claimId;
+        // Best-effort release: a failed request must stay retryable with the
+        // same key (release errors must not mask the real outcome).
+        const release = async () => {
+            await db
+                .delete(idempotencyKeys)
+                .where(eq(idempotencyKeys.id, ownedClaimId))
+                .catch(() => { });
+        };
+        try {
+            await next();
+        }
+        catch (e) {
+            await release();
+            throw e;
+        }
+        if (c.res.status >= 200 && c.res.status < 300) {
+            // clone() tees the stream — the client still receives the original.
+            const body = await c.res.clone().text();
+            try {
+                await db
+                    .update(idempotencyKeys)
+                    .set({ responseStatus: c.res.status, responseBodyEnc: seal(body, authSecret) })
+                    .where(eq(idempotencyKeys.id, ownedClaimId));
+            }
+            catch {
+                // Best-effort, like audit: the handler's mutation has already
+                // committed, so a failed persist must never turn into a 500. The
+                // claim stays response-less; same-key retries 409 until expiry.
+            }
+        }
+        else {
+            await release();
+        }
+    };
+}
+//# sourceMappingURL=idempotency.js.map

package/dist/middleware/idempotency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.js","sourceRoot":"","sources":["../../src/middleware/idempotency.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAGxF,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,eAAe,EAAW,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH,qFAAqF;AACrF,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,kBAAkB;IAClB,qBAAqB;IACrB,oBAAoB;IACpB,kBAAkB;CACnB,CAAC,CAAC;AACH,0EAA0E;AAC1E,4EAA4E;AAC5E,0EAA0E;AAC1E,MAAM,aAAa,GAAG,yCAAyC,CAAC;AAChE,MAAM,oBAAoB,GAAG,gDAAgD,CAAC;AAC9E,MAAM,kBAAkB,GAAG,uCAAuC,CAAC;AAEnE,SAAS,QAAQ,CACf,MAAc,EACd,IAAY,EACZ,WAAoD;IAEpD,OAAO,CACL,MAAM,KAAK,MAAM;QACjB,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YACrB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;YACxB,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;YAC/B,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;YAC7B,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAClC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,KAAK,CAAC,UAAkB;IAC/B,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,UAAU,GAAG,cAAc,CAAC;SACnC,MAAM,EAAE,CAAC;AACd,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,IAAI,CAAC,KAAa,EAAE,UAAkB;IACpD,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACjF,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AACxH,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,IAAI,CAAC,MAAc,EAAE,UAAkB;IACrD,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;QAClG,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;QACnD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CACtG,MAAM,CACP,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AASD,MAAM,UAAU,WAAW,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,EAAmB;IAC1E,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACpE,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAC5C,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,IAAI,EAAE,CAAC;QACrC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;YACpD,uEAAuE;YACvE,uEAAuE;YACvE,OAAO,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,yBAAyB,EAAE,0CAA0C,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,EAAE,CAAC,CAAC,iCAAiC;QAEhE,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACpC,sEAAsE;QACtE,4DAA4D;QAC5D,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC;aACrC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;aACrD,MAAM,CAAC,KAAK,CAAC,CAAC;QAEjB,MAAM,KAAK,GAAG,GAAG,CACf,EAAE,CAAC,eAAe,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,EACtD,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,EAC5C,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAC7B,CAAC;QACF,MAAM,KAAK,GAAG,KAAK,IAA4B,EAAE;YAC/C,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,MAAM,CAAC,eAAe,CAAC;iBACvB,MAAM,CAAC;gBACN,WAAW,EAAE,SAAS,CAAC,WAAW;gBAClC,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,GAAG;gBACH,WAAW;gBACX,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;aACzC,CAAC;iBACD,mBAAmB,CAAC;gBACnB,MAAM,EAAE,CAAC,eAAe,CAAC,WAAW,EAAE,eAAe,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC;aACnF,CAAC;iBACD,SAAS,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC;YACzC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC;QAC7B,CAAC,CAAC;QAEF,IAAI,OAAO,GAAG,MAAM,KAAK,EAAE,CAAC;QAE5B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,gEAAgE;YAChE,gEAAgE;YAChE,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACjF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,gEAAgE;gBAChE,uEAAuE;gBACvE,OAAO,GAAG,MAAM,KAAK,EAAE,CAAC;gBACxB,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBACrB,OAAO,QAAQ,CACb,CAAC,EACD,GAAG,EACH,uBAAuB,EACvB,kEAAkE,CACnE,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;gBAChD,OAAO,QAAQ,CACb,CAAC,EACD,GAAG,EACH,uBAAuB,EACvB,gEAAgE,CACjE,CAAC;YACJ,CAAC;iBAAM,IAAI,QAAQ,CAAC,cAAc,KAAK,IAAI,IAAI,QAAQ,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;gBACjF,OAAO,QAAQ,CACb,CAAC,EACD,GAAG,EACH,uBAAuB,EACvB,yDAAyD,CAC1D,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBACzD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;oBACnB,gEAAgE;oBAChE,2DAA2D;oBAC3D,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;oBAC5E,OAAO,GAAG,MAAM,KAAK,EAAE,CAAC;oBACxB,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;wBACrB,OAAO,QAAQ,CACb,CAAC,EACD,GAAG,EACH,uBAAuB,EACvB,kEAAkE,CACnE,CAAC;oBACJ,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,CAAC,CAAC,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;oBACzC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,cAAsC,CAAC,CAAC;gBACpF,CAAC;YACH,CAAC;QACH,CAAC;QAED,uDAAuD;QACvD,MAAM,YAAY,GAAG,OAAO,CAAC;QAC7B,qEAAqE;QACrE,4DAA4D;QAC5D,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;YACzB,MAAM,EAAE;iBACL,MAAM,CAAC,eAAe,CAAC;iBACvB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;iBAC3C,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACrB,CAAC,CAAC;QACF,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,OAAO,EAAE,CAAC;YAChB,MAAM,CAAC,CAAC;QACV,CAAC;QACD,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC9C,oEAAoE;YACpE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,CAAC;gBACH,MAAM,EAAE;qBACL,MAAM,CAAC,eAAe,CAAC;qBACvB,GAAG,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;qBAC9E,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;gBAC9D,iEAAiE;gBACjE,gEAAgE;YAClE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,EAAE,CAAC;QAClB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/index.d.ts

@@ -0,0 +1,12 @@
+export { type AdmitResult, type PrincipalGate, admitPrincipal, authContext, requireAuth, requireNonGuest, requireRole, resolveSessionPrincipal } from './auth-context.js';
+export { type BucketDeclaration, type ClientIpFn, type QuotaDecision, type RateLimiters, type RequestQuotaService, createRateLimiters, createRequestQuota, emailKeyOf, makeClientIp, principalBucketKey, quotaHeaderEntries, rateLimit } from './rate-limit.js';
+export { requestId } from './request-id.js';
+export { type ScopeAllowlistOptions, type ScopeRule, createScopeAllowlist, looksLikeJwt } from './scopes.js';
+export { authBodyGuard } from './auth-body.js';
+export { crossSiteGuard } from './cross-site.js';
+export { idempotency, open, seal } from './idempotency.js';
+export { MAX_JSON_DEPTH, exceedsJsonDepth, jsonDepthLimit } from './json-depth.js';
+export { noStoreAuthenticated } from './no-store.js';
+export { isPublicOauthPath, oauthPublicEndpoints } from './oauth-public.js';
+export { buildCsp, hstsValue, inlineScriptHashes, securityHeaders } from './security-headers.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/middleware/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,cAAc,EACd,WAAW,EACX,WAAW,EACX,eAAe,EACf,WAAW,EACX,uBAAuB,EACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,kBAAkB,EAClB,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,SAAS,EACV,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,KAAK,qBAAqB,EAAE,KAAK,SAAS,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC7G,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/middleware/index.js

@@ -0,0 +1,12 @@
+export { admitPrincipal, authContext, requireAuth, requireNonGuest, requireRole, resolveSessionPrincipal } from './auth-context.js';
+export { createRateLimiters, createRequestQuota, emailKeyOf, makeClientIp, principalBucketKey, quotaHeaderEntries, rateLimit } from './rate-limit.js';
+export { requestId } from './request-id.js';
+export { createScopeAllowlist, looksLikeJwt } from './scopes.js';
+export { authBodyGuard } from './auth-body.js';
+export { crossSiteGuard } from './cross-site.js';
+export { idempotency, open, seal } from './idempotency.js';
+export { MAX_JSON_DEPTH, exceedsJsonDepth, jsonDepthLimit } from './json-depth.js';
+export { noStoreAuthenticated } from './no-store.js';
+export { isPublicOauthPath, oauthPublicEndpoints } from './oauth-public.js';
+export { buildCsp, hstsValue, inlineScriptHashes, securityHeaders } from './security-headers.js';
+//# sourceMappingURL=index.js.map

package/dist/middleware/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,cAAc,EACd,WAAW,EACX,WAAW,EACX,eAAe,EACf,WAAW,EACX,uBAAuB,EACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAML,kBAAkB,EAClB,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,SAAS,EACV,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAA8C,oBAAoB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC7G,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/middleware/json-depth.d.ts

@@ -0,0 +1,32 @@
+import type { MiddlewareHandler } from 'hono';
+/**
+ * Nesting cap for request JSON. Deliberately far above anything a contract in
+ * `@antasphere/contract` describes (the deepest is three or four levels) and far
+ * below the depth at which V8 recursion breaks.
+ *
+ * Why a cap at all: `JSON.parse` is iterative and swallows any depth, but
+ * `JSON.stringify` is RECURSIVE and blows the stack with a `RangeError` past a
+ * few thousand levels — and the exact depth depends on the V8 build, so it
+ * reproduces inside the shipped `node:22-alpine` image and not on a newer host
+ * Node. Every path that echoes, audits, logs, or persists a validated body
+ * stringifies it, so an anonymous client could turn one small request body
+ * into a 500 plus an error-level stack trace. Rejecting at the edge — before
+ * anything parses, let alone stringifies — is the only place the fix is
+ * complete.
+ */
+export declare const MAX_JSON_DEPTH = 100;
+/**
+ * True when `text` nests `{`/`[` deeper than `max`. A single string-aware
+ * scan, no parsing and no allocation: brackets inside JSON string literals
+ * (and escaped quotes inside them) do not count. Returns as soon as the limit
+ * is passed, so a hostile body costs O(prefix), not O(body).
+ */
+export declare function exceedsJsonDepth(text: string, max: number): boolean;
+/**
+ * Rejects over-deep JSON bodies with a 400 before any handler, parser or
+ * serializer sees them. Non-JSON and bodyless requests pass untouched, so
+ * streamed uploads and form-encoded token calls are unaffected. Mount it
+ * AFTER the body-size limit so the scan is bounded by that cap.
+ */
+export declare function jsonDepthLimit(maxDepth?: number): MiddlewareHandler;
+//# sourceMappingURL=json-depth.d.ts.map

package/dist/middleware/json-depth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-depth.d.ts","sourceRoot":"","sources":["../../src/middleware/json-depth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAG9C;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,cAAc,MAAM,CAAC;AAKlC;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAmBnE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,GAAE,MAAuB,GAAG,iBAAiB,CAiBnF"}