@chatcops/server 0.5.0 → 0.6.0

package/dist/security/startup-checks.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Startup checks for the security settings the server is about to add: the
+ * allowed origins and the secrets that sign session tokens.
+ *
+ * These are the mistakes that fail silently. A secret that is ten characters
+ * long works, and so does a secret that is also a `NEXT_PUBLIC_` variable, so
+ * nothing breaks until the day it does. A function that finds them before the
+ * server starts is worth more than one that finds them during a request.
+ *
+ * Nothing here logs or throws. The caller decides what to do with a problem.
+ */
+/** The security settings a server is configured with. */
+export interface SecuritySettings {
+    /** The origins the server accepts requests from. `*` allows every origin. */
+    allowedOrigins?: string[];
+    /** The secrets that sign session tokens. */
+    sessionSecrets?: string[];
+}
+/** One thing that is wrong with the security settings. */
+export interface SecurityProblem {
+    /** An error stops the server from starting. A warning is worth a look. */
+    level: 'error' | 'warning';
+    /** What is wrong, and what to do about it. Never contains a secret. */
+    message: string;
+}
+/**
+ * Finds the mistakes in the security settings, most serious first.
+ *
+ * `env` is the environment to look in, and defaults to `process.env`.
+ */
+export declare function checkSecuritySettings(settings: SecuritySettings, env?: Record<string, string | undefined>): SecurityProblem[];
+/** What a server's security settings come to, for the startup log. */
+export interface SecuritySummary {
+    allowedOrigins: string[];
+    /** Seconds, when session tokens are on. */
+    sessionTtlSec?: number;
+    requireSession?: boolean;
+    turnstile: boolean;
+}
+/** The one line the server logs at startup about its security settings. */
+export declare function describeSecurity(summary: SecuritySummary): string;
+/** Logs the problems `checkSecuritySettings` finds, errors first, then the summary line. */
+export declare function logSecurityAtStartup(settings: SecuritySettings & Omit<SecuritySummary, 'allowedOrigins'>): void;
+//# sourceMappingURL=startup-checks.d.ts.map

package/dist/security/startup-checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup-checks.d.ts","sourceRoot":"","sources":["../../src/security/startup-checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,yDAAyD;AACzD,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,4CAA4C;IAC5C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,0DAA0D;AAC1D,MAAM,WAAW,eAAe;IAC9B,0EAA0E;IAC1E,KAAK,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3B,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;CACjB;AAwBD;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,gBAAgB,EAC1B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACvC,eAAe,EAAE,CAkFnB;AAED,sEAAsE;AACtE,MAAM,WAAW,eAAe;IAC9B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,2CAA2C;IAC3C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,CASjE;AAED,4FAA4F;AAC5F,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAC,eAAe,EAAE,gBAAgB,CAAC,GAAG,IAAI,CAM/G"}

package/dist/security/startup-checks.js

@@ -0,0 +1,134 @@
+/**
+ * Startup checks for the security settings the server is about to add: the
+ * allowed origins and the secrets that sign session tokens.
+ *
+ * These are the mistakes that fail silently. A secret that is ten characters
+ * long works, and so does a secret that is also a `NEXT_PUBLIC_` variable, so
+ * nothing breaks until the day it does. A function that finds them before the
+ * server starts is worth more than one that finds them during a request.
+ *
+ * Nothing here logs or throws. The caller decides what to do with a problem.
+ */
+/** How many bytes a session secret needs to be worth signing with. */
+const MIN_SECRET_BYTES = 32;
+/**
+ * The env var prefixes whose value is shipped to the browser, so a secret
+ * that shares a value with one of them is in the client bundle.
+ */
+const PUBLIC_ENV_PREFIXES = ['NEXT_PUBLIC_', 'VITE_', 'PUBLIC_', 'NUXT_PUBLIC_', 'EXPO_PUBLIC_', 'REACT_APP_'];
+/**
+ * The environment to read, which is `process.env` where there is one. Workers
+ * have no `process`, so the checks still work there with an empty environment.
+ */
+function defaultEnv() {
+    return globalThis.process?.env ?? {};
+}
+/** How many bytes a string takes in UTF-8, so a 32 byte secret is 32 bytes. */
+function utf8Length(value) {
+    return new TextEncoder().encode(value).length;
+}
+/**
+ * Finds the mistakes in the security settings, most serious first.
+ *
+ * `env` is the environment to look in, and defaults to `process.env`.
+ */
+export function checkSecuritySettings(settings, env) {
+    const problems = [];
+    const secrets = settings.sessionSecrets ?? [];
+    const origins = settings.allowedOrigins ?? [];
+    const environment = env ?? defaultEnv();
+    for (const [index, secret] of secrets.entries()) {
+        if (utf8Length(secret) < MIN_SECRET_BYTES) {
+            problems.push({
+                level: 'error',
+                message: `Session secret ${index + 1} is shorter than ${MIN_SECRET_BYTES} bytes.`,
+            });
+        }
+    }
+    for (const [index, secret] of secrets.entries()) {
+        for (const name of Object.keys(environment)) {
+            if (!PUBLIC_ENV_PREFIXES.some((prefix) => name.startsWith(prefix)))
+                continue;
+            if (environment[name] !== secret)
+                continue;
+            problems.push({
+                level: 'error',
+                message: `Session secret ${index + 1} is also the value of the ${name} environment variable, ` +
+                    'which is sent to the browser. Use a different secret.',
+            });
+        }
+    }
+    for (const [index, secret] of secrets.entries()) {
+        const first = secrets.indexOf(secret);
+        if (first !== index) {
+            problems.push({
+                level: 'warning',
+                message: `Session secrets ${first + 1} and ${index + 1} are the same.`,
+            });
+        }
+    }
+    for (const origin of origins) {
+        if (origin === '*')
+            continue;
+        if (!origin.startsWith('http://') && !origin.startsWith('https://')) {
+            problems.push({
+                level: 'error',
+                message: `Allowed origin "${origin}" must start with http:// or https://.`,
+            });
+            continue;
+        }
+        let parsed;
+        try {
+            parsed = new URL(origin);
+        }
+        catch {
+            problems.push({
+                level: 'error',
+                message: `Allowed origin "${origin}" is not a valid URL.`,
+            });
+            continue;
+        }
+        if (parsed.pathname !== '/' || parsed.search !== '' || parsed.hash !== '' || /[/?#]$/.test(origin)) {
+            problems.push({
+                level: 'error',
+                message: `Allowed origin "${origin}" must not have a path, a query, a fragment or a trailing slash, ` +
+                    `because browsers send the origin without one. Use "${parsed.origin}".`,
+            });
+            continue;
+        }
+        if (origin.startsWith('http://') && parsed.hostname !== 'localhost' && parsed.hostname !== '127.0.0.1') {
+            problems.push({
+                level: 'warning',
+                message: `Allowed origin "${origin}" uses http://. Use https://, unless it is a local development server.`,
+            });
+        }
+    }
+    if (origins.includes('*') && origins.length > 1) {
+        problems.push({
+            level: 'warning',
+            message: 'Allowed origins include "*", which allows every site, so the other entries do nothing.',
+        });
+    }
+    return problems;
+}
+/** The one line the server logs at startup about its security settings. */
+export function describeSecurity(summary) {
+    const origins = summary.allowedOrigins.includes('*')
+        ? 'any site (allowedOrigins is "*"; list your sites in production)'
+        : summary.allowedOrigins.join(', ');
+    const sessions = summary.sessionTtlSec === undefined
+        ? 'session tokens off'
+        : `session tokens on (${summary.sessionTtlSec}s${summary.requireSession === false ? ', not required' : ''})`;
+    return `[chatcops] Security: chat allowed from ${origins}; ${sessions}; Turnstile ${summary.turnstile ? 'on' : 'off'}.`;
+}
+/** Logs the problems `checkSecuritySettings` finds, errors first, then the summary line. */
+export function logSecurityAtStartup(settings) {
+    const allowedOrigins = settings.allowedOrigins ?? ['*'];
+    const problems = checkSecuritySettings({ ...settings, allowedOrigins });
+    for (const problem of problems.filter((p) => p.level === 'error'))
+        console.error(`[chatcops] ERROR: ${problem.message}`);
+    for (const problem of problems.filter((p) => p.level === 'warning'))
+        console.warn(`[chatcops] ${problem.message}`);
+    console.info(describeSecurity({ ...settings, allowedOrigins }));
+}
+//# sourceMappingURL=startup-checks.js.map

package/dist/security/startup-checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup-checks.js","sourceRoot":"","sources":["../../src/security/startup-checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAkBH,sEAAsE;AACtE,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B;;;GAGG;AACH,MAAM,mBAAmB,GAAG,CAAC,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;AAE/G;;;GAGG;AACH,SAAS,UAAU;IACjB,OAAQ,UAAyE,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;AACvG,CAAC;AAED,+EAA+E;AAC/E,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAA0B,EAC1B,GAAwC;IAExC,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,QAAQ,CAAC,cAAc,IAAI,EAAE,CAAC;IAC9C,MAAM,OAAO,GAAG,QAAQ,CAAC,cAAc,IAAI,EAAE,CAAC;IAC9C,MAAM,WAAW,GAAG,GAAG,IAAI,UAAU,EAAE,CAAC;IAExC,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAChD,IAAI,UAAU,CAAC,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE,kBAAkB,KAAK,GAAG,CAAC,oBAAoB,gBAAgB,SAAS;aAClF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAChD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBAAE,SAAS;YAC7E,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,MAAM;gBAAE,SAAS;YAC3C,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,OAAO;gBACd,OAAO,EACL,kBAAkB,KAAK,GAAG,CAAC,6BAA6B,IAAI,yBAAyB;oBACrF,uDAAuD;aAC1D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,SAAS;gBAChB,OAAO,EAAE,mBAAmB,KAAK,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,gBAAgB;aACvE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,KAAK,GAAG;YAAE,SAAS;QAC7B,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACpE,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE,mBAAmB,MAAM,wCAAwC;aAC3E,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE,mBAAmB,MAAM,uBAAuB;aAC1D,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACnG,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,OAAO;gBACd,OAAO,EACL,mBAAmB,MAAM,mEAAmE;oBAC5F,sDAAsD,MAAM,CAAC,MAAM,IAAI;aAC1E,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YACvG,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,SAAS;gBAChB,OAAO,EAAE,mBAAmB,MAAM,wEAAwE;aAC3G,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,QAAQ,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,wFAAwF;SAClG,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAWD,2EAA2E;AAC3E,MAAM,UAAU,gBAAgB,CAAC,OAAwB;IACvD,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC;QAClD,CAAC,CAAC,iEAAiE;QACnE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,QAAQ,GACZ,OAAO,CAAC,aAAa,KAAK,SAAS;QACjC,CAAC,CAAC,oBAAoB;QACtB,CAAC,CAAC,sBAAsB,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;IACjH,OAAO,0CAA0C,OAAO,KAAK,QAAQ,eAAe,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;AAC1H,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,oBAAoB,CAAC,QAAoE;IACvG,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,IAAI,CAAC,GAAG,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,EAAE,GAAG,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;IACxE,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC;QAAE,OAAO,CAAC,KAAK,CAAC,qBAAqB,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACzH,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,cAAc,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACnH,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;AAClE,CAAC"}

package/dist/security/turnstile.d.ts

@@ -0,0 +1,24 @@
+export interface TurnstileConfig {
+    secretKey: string;
+    /** Expected action to validate against the Turnstile response. */
+    action?: string;
+    /** Expected hostnames where the challenge may be solved. */
+    expectedHostnames?: string[];
+    /** Timeout in milliseconds for the verification request. Defaults to 5000 ms. */
+    timeoutMs?: number;
+}
+export type TurnstileResult = {
+    ok: true;
+    hostname?: string;
+    action?: string;
+} | {
+    ok: false;
+    code: 'missing_token' | 'invalid_token' | 'hostname_mismatch' | 'action_mismatch' | 'unavailable';
+    errorCodes?: string[];
+};
+export declare function verifyTurnstile(token: string | undefined, config: TurnstileConfig, opts?: {
+    remoteIp?: string;
+    idempotencyKey?: string;
+    fetch?: typeof fetch;
+}): Promise<TurnstileResult>;
+//# sourceMappingURL=turnstile.d.ts.map

package/dist/security/turnstile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"turnstile.d.ts","sourceRoot":"","sources":["../../src/security/turnstile.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAChD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EACA,eAAe,GACf,eAAe,GACf,mBAAmB,GACnB,iBAAiB,GACjB,aAAa,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB,CAAC;AAKN,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,MAAM,EAAE,eAAe,EACvB,IAAI,CAAC,EAAE;IACL,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB,GACA,OAAO,CAAC,eAAe,CAAC,CA+G1B"}

package/dist/security/turnstile.js

@@ -0,0 +1,93 @@
+const SITEVERIFY_URL = 'https://challenges.cloudflare.com/turnstile/v0/siteverify';
+const DEFAULT_TIMEOUT_MS = 5000;
+export async function verifyTurnstile(token, config, opts) {
+    if (token === undefined || token === null || typeof token !== 'string' || token.trim() === '') {
+        return { ok: false, code: 'missing_token' };
+    }
+    try {
+        const body = {
+            secret: config.secretKey,
+            response: token,
+        };
+        if (opts?.remoteIp !== undefined && opts.remoteIp !== '') {
+            body.remoteip = opts.remoteIp;
+        }
+        if (opts?.idempotencyKey !== undefined && opts.idempotencyKey !== '') {
+            body.idempotency_key = opts.idempotencyKey;
+        }
+        const fetchFn = opts?.fetch ?? globalThis.fetch;
+        const timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        let response;
+        try {
+            response = await fetchFn(SITEVERIFY_URL, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify(body),
+                signal: AbortSignal.timeout(timeoutMs),
+            });
+        }
+        catch {
+            return { ok: false, code: 'unavailable' };
+        }
+        let data;
+        try {
+            data = await response.json();
+        }
+        catch {
+            return { ok: false, code: 'unavailable' };
+        }
+        if (typeof data !== 'object' ||
+            data === null ||
+            Array.isArray(data) ||
+            typeof data.success !== 'boolean') {
+            return { ok: false, code: 'unavailable' };
+        }
+        const payload = data;
+        if (!response.ok) {
+            if (response.status >= 500 || payload.success !== false) {
+                return { ok: false, code: 'unavailable' };
+            }
+        }
+        if (!payload.success) {
+            const errorCodes = Array.isArray(payload['error-codes'])
+                ? payload['error-codes'].map(String)
+                : undefined;
+            const isUnavailable = errorCodes?.includes('internal-error');
+            const result = {
+                ok: false,
+                code: isUnavailable ? 'unavailable' : 'invalid_token',
+            };
+            if (errorCodes !== undefined) {
+                result.errorCodes = errorCodes;
+            }
+            return result;
+        }
+        const returnedHostname = typeof payload.hostname === 'string' ? payload.hostname : undefined;
+        const returnedAction = typeof payload.action === 'string' ? payload.action : undefined;
+        if (config.expectedHostnames !== undefined) {
+            if (!returnedHostname ||
+                !config.expectedHostnames.some((expected) => expected.toLowerCase() === returnedHostname.toLowerCase())) {
+                return { ok: false, code: 'hostname_mismatch' };
+            }
+        }
+        if (config.action !== undefined) {
+            if (returnedAction !== config.action) {
+                return { ok: false, code: 'action_mismatch' };
+            }
+        }
+        const result = { ok: true };
+        if (returnedHostname !== undefined) {
+            result.hostname = returnedHostname;
+        }
+        if (returnedAction !== undefined) {
+            result.action = returnedAction;
+        }
+        return result;
+    }
+    catch {
+        return { ok: false, code: 'unavailable' };
+    }
+}
+//# sourceMappingURL=turnstile.js.map

package/dist/security/turnstile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"turnstile.js","sourceRoot":"","sources":["../../src/security/turnstile.ts"],"names":[],"mappings":"AAuBA,MAAM,cAAc,GAAG,2DAA2D,CAAC;AACnF,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAyB,EACzB,MAAuB,EACvB,IAIC;IAED,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IAC9C,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAA2B;YACnC,MAAM,EAAE,MAAM,CAAC,SAAS;YACxB,QAAQ,EAAE,KAAK;SAChB,CAAC;QAEF,IAAI,IAAI,EAAE,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YACzD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAChC,CAAC;QAED,IAAI,IAAI,EAAE,cAAc,KAAK,SAAS,IAAI,IAAI,CAAC,cAAc,KAAK,EAAE,EAAE,CAAC;YACrE,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC;QAC7C,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,EAAE,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;QAChD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,kBAAkB,CAAC;QAEzD,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,OAAO,CAAC,cAAc,EAAE;gBACvC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;aACvC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QAC5C,CAAC;QAED,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QAC5C,CAAC;QAED,IACE,OAAO,IAAI,KAAK,QAAQ;YACxB,IAAI,KAAK,IAAI;YACb,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACnB,OAAQ,IAAgC,CAAC,OAAO,KAAK,SAAS,EAC9D,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QAC5C,CAAC;QAED,MAAM,OAAO,GAAG,IAKf,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;gBACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;gBACtD,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;gBACpC,CAAC,CAAC,SAAS,CAAC;YAEd,MAAM,aAAa,GAAG,UAAU,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;YAE7D,MAAM,MAAM,GAAoB;gBAC9B,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe;aACtD,CAAC;YACF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC;YACjC,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,gBAAgB,GAAG,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7F,MAAM,cAAc,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAEvF,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC3C,IACE,CAAC,gBAAgB;gBACjB,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC,WAAW,EAAE,CAAC,EACvG,CAAC;gBACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;YAClD,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,cAAc,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;gBACrC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;YAChD,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAoB,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAC7C,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,CAAC,QAAQ,GAAG,gBAAgB,CAAC;QACrC,CAAC;QACD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,CAAC,MAAM,GAAG,cAAc,CAAC;QACjC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAC5C,CAAC;AACH,CAAC"}

package/dist/visitor-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"visitor-context.d.ts","sourceRoot":"","sources":["../src/visitor-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAGxD;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,kSACyP,CAAC;AAElS,yFAAyF;AACzF,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAa9C,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,oBAAoB,EAAE,aAAa,GAAG,UAAU,CAAC,GAAG,MAAM,GAAG,IAAI,CAqB9G;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,WAAW,EAAE,CAOjG;AAED,6EAA6E;AAC7E,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnD"}
+{"version":3,"file":"visitor-context.d.ts","sourceRoot":"","sources":["../src/visitor-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAGxD;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,kSACyP,CAAC;AAElS,yFAAyF;AACzF,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAc9C,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,oBAAoB,EAAE,aAAa,GAAG,UAAU,CAAC,GAAG,MAAM,GAAG,IAAI,CAqB9G;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,WAAW,EAAE,CAOjG;AAED,6EAA6E;AAC7E,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnD"}

package/dist/visitor-context.js

@@ -12,6 +12,7 @@ const TAG = 'visitor_context';
 /** One line of plain text: no control characters, no line breaks, no tags that could close the block. */
 function clean(value) {
     return value
+        // biome-ignore lint/suspicious/noControlCharactersInRegex: sanitize control characters
         .replace(/[\u0000-\u001f\u007f]+/g, ' ')
         .replace(new RegExp(`<\\s*/?\\s*${TAG}[^>]*>`, 'gi'), '')
         .replace(/\s+/g, ' ')

package/dist/visitor-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"visitor-context.js","sourceRoot":"","sources":["../src/visitor-context.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GACtC,+RAA+R,CAAC;AAElS,yFAAyF;AACzF,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAE9C,MAAM,GAAG,GAAG,iBAAiB,CAAC;AAE9B,yGAAyG;AACzG,SAAS,KAAK,CAAC,KAAa;IAC1B,OAAO,KAAK;SACT,OAAO,CAAC,yBAAyB,EAAE,GAAG,CAAC;SACvC,OAAO,CAAC,IAAI,MAAM,CAAC,cAAc,GAAG,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;SACxD,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAA2D;IAC7F,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QACpB,+FAA+F;QAC/F,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC;QAChF,IAAI,GAAG,CAAC,WAAW,CAAC,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,eAAe,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrF,IAAI,GAAG,CAAC,WAAW,CAAC,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACzG,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACvF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;QAC/E,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpC,IAAI,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,GAAG,yBAAyB;QAAE,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,yBAAyB,CAAC,KAAK,CAAC;IACrG,OAAO,IAAI,GAAG,MAAM,IAAI,OAAO,GAAG,GAAG,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAuB,EAAE,OAAsB;IAChF,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IAClC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,CACjC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,OAAO,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CACpF,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,OAAO,kCAAkC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACzD,CAAC"}
+{"version":3,"file":"visitor-context.js","sourceRoot":"","sources":["../src/visitor-context.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GACtC,+RAA+R,CAAC;AAElS,yFAAyF;AACzF,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAE9C,MAAM,GAAG,GAAG,iBAAiB,CAAC;AAE9B,yGAAyG;AACzG,SAAS,KAAK,CAAC,KAAa;IAC1B,OAAO,KAAK;QACV,uFAAuF;SACtF,OAAO,CAAC,yBAAyB,EAAE,GAAG,CAAC;SACvC,OAAO,CAAC,IAAI,MAAM,CAAC,cAAc,GAAG,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;SACxD,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAA2D;IAC7F,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QACpB,+FAA+F;QAC/F,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC;QAChF,IAAI,GAAG,CAAC,WAAW,CAAC,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,eAAe,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrF,IAAI,GAAG,CAAC,WAAW,CAAC,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACzG,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACvF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;QAC/E,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpC,IAAI,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,GAAG,yBAAyB;QAAE,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,yBAAyB,CAAC,KAAK,CAAC;IACrG,OAAO,IAAI,GAAG,MAAM,IAAI,OAAO,GAAG,GAAG,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAuB,EAAE,OAAsB;IAChF,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IAClC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,CACjC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,OAAO,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CACpF,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,OAAO,kCAAkC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACzD,CAAC"}

package/package.json

@@ -1,7 +1,19 @@
 {
   "name": "@chatcops/server",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Server-side handler and adapters for ChatCops",
+  "keywords": [
+    "chatcops",
+    "ai",
+    "chatbot",
+    "llm",
+    "sse",
+    "express",
+    "vercel",
+    "cloudflare-workers"
+  ],
+  "homepage": "https://chat.codercops.com",
+  "bugs": "https://github.com/codercops/chatcops/issues",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -28,7 +40,7 @@
   ],
   "dependencies": {
     "zod": "^3.24.0",
-    "@chatcops/core": "0.4.0"
+    "@chatcops/core": "0.5.0"
   },
   "peerDependencies": {
     "express": "^4.0.0 || ^5.0.0"
@@ -39,19 +51,24 @@
     }
   },
   "devDependencies": {
+    "@types/express": "^5.0.0",
+    "ai": "7.0.122",
     "typescript": "^5.7.0",
-    "vitest": "^4.1.11",
-    "@types/express": "^5.0.0"
+    "vitest": "^4.1.11"
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/codercops/chatcops",
+    "url": "git+https://github.com/codercops/chatcops.git",
     "directory": "packages/server"
   },
   "publishConfig": {
     "access": "public"
   },
   "license": "MIT",
+  "engines": {
+    "node": ">=22"
+  },
+  "sideEffects": false,
   "scripts": {
     "build": "tsc",
     "typecheck": "tsc --noEmit",