npm - @cogenta/cli - Versions diffs - 0.2.2 → 0.4.0 - Mend

@cogenta/cli 0.2.2 → 0.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (71) hide show

package/dist/admin-assets/assets/index-C9a7O_Xs.css +1 -0
package/dist/admin-assets/assets/index-DXvMgWvn.js +74 -0
package/dist/admin-assets/fonts/ibm-plex-mono-400.woff2 +0 -0
package/dist/admin-assets/fonts/ibm-plex-mono-500.woff2 +0 -0
package/dist/admin-assets/fonts/ibm-plex-mono-600.woff2 +0 -0
package/dist/admin-assets/fonts/ibm-plex-mono-700.woff2 +0 -0
package/dist/admin-assets/fonts/ibm-plex-sans-var.woff2 +0 -0
package/dist/admin-assets/index.html +2 -2
package/dist/commands/assistant.d.ts +65 -0
package/dist/commands/assistant.d.ts.map +1 -0
package/dist/commands/assistant.js +207 -0
package/dist/commands/assistant.js.map +1 -0
package/dist/commands/content-webhooks.d.ts +41 -0
package/dist/commands/content-webhooks.d.ts.map +1 -0
package/dist/commands/content-webhooks.js +61 -0
package/dist/commands/content-webhooks.js.map +1 -0
package/dist/commands/http-security.d.ts +39 -0
package/dist/commands/http-security.d.ts.map +1 -0
package/dist/commands/http-security.js +153 -0
package/dist/commands/http-security.js.map +1 -0
package/dist/commands/links.d.ts +24 -0
package/dist/commands/links.d.ts.map +1 -0
package/dist/commands/links.js +109 -0
package/dist/commands/links.js.map +1 -0
package/dist/commands/media-images.d.ts +67 -0
package/dist/commands/media-images.d.ts.map +1 -0
package/dist/commands/media-images.js +107 -0
package/dist/commands/media-images.js.map +1 -0
package/dist/commands/search-page.d.ts +40 -0
package/dist/commands/search-page.d.ts.map +1 -0
package/dist/commands/search-page.js +104 -0
package/dist/commands/search-page.js.map +1 -0
package/dist/commands/security-alerts.d.ts +24 -0
package/dist/commands/security-alerts.d.ts.map +1 -0
package/dist/commands/security-alerts.js +82 -0
package/dist/commands/security-alerts.js.map +1 -0
package/dist/commands/seo.d.ts +88 -0
package/dist/commands/seo.d.ts.map +1 -0
package/dist/commands/seo.js +155 -0
package/dist/commands/seo.js.map +1 -0
package/dist/commands/serve.d.ts +138 -4
package/dist/commands/serve.d.ts.map +1 -1
package/dist/commands/serve.js +1145 -43
package/dist/commands/serve.js.map +1 -1
package/dist/commands/site-plan.d.ts +86 -0
package/dist/commands/site-plan.d.ts.map +1 -0
package/dist/commands/site-plan.js +235 -0
package/dist/commands/site-plan.js.map +1 -0
package/dist/commands/theme-css.d.ts +54 -0
package/dist/commands/theme-css.d.ts.map +1 -0
package/dist/commands/theme-css.js +121 -0
package/dist/commands/theme-css.js.map +1 -0
package/dist/commands/theme-render.d.ts +115 -4
package/dist/commands/theme-render.d.ts.map +1 -1
package/dist/commands/theme-render.js +260 -17
package/dist/commands/theme-render.js.map +1 -1
package/dist/commands/users.d.ts +7 -1
package/dist/commands/users.d.ts.map +1 -1
package/dist/commands/users.js +129 -15
package/dist/commands/users.js.map +1 -1
package/dist/index.d.ts +2 -0
package/dist/index.d.ts.map +1 -1
package/dist/index.js +31 -0
package/dist/index.js.map +1 -1
package/dist/reset-mail.d.ts +39 -0
package/dist/reset-mail.d.ts.map +1 -0
package/dist/reset-mail.js +45 -0
package/dist/reset-mail.js.map +1 -0
package/package.json +15 -10
package/dist/admin-assets/assets/index-21ZcDkDC.css +0 -1
package/dist/admin-assets/assets/index-BXVsXHD2.js +0 -23

package/dist/admin-assets/fonts/ibm-plex-mono-400.woff2 ADDED Viewed

Binary file

package/dist/admin-assets/fonts/ibm-plex-mono-500.woff2 ADDED Viewed

Binary file

package/dist/admin-assets/fonts/ibm-plex-mono-600.woff2 ADDED Viewed

Binary file

package/dist/admin-assets/fonts/ibm-plex-mono-700.woff2 ADDED Viewed

Binary file

package/dist/admin-assets/fonts/ibm-plex-sans-var.woff2 ADDED Viewed

Binary file

package/dist/admin-assets/index.html CHANGED Viewed

@@ -4,8 +4,8 @@
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>Cogenta</title>
-    <script type="module" crossorigin src="/admin/assets/index-BXVsXHD2.js"></script>
-    <link rel="stylesheet" crossorigin href="/admin/assets/index-21ZcDkDC.css">
+    <script type="module" crossorigin src="/admin/assets/index-DXvMgWvn.js"></script>
+    <link rel="stylesheet" crossorigin href="/admin/assets/index-C9a7O_Xs.css">
   </head>
   <body>
     <div id="root"></div>

package/dist/commands/assistant.d.ts ADDED Viewed

@@ -0,0 +1,65 @@
+import { type AssistToolset, type EmbeddingProvider, type SemanticSearch, type VectorStore } from '@cogenta/agents';
+import type { CogentaConfig, DatabaseHandle, Logger } from '@cogenta/core';
+import type { CollectionDefinition, ContentStore, SearchDriver } from '@cogenta/schema';
+/**
+ * Where L18 is actually wired into a running site.
+ *
+ * This module is the only place in the repository that knows both
+ * `@cogenta/agents` (the tools) and `@cogenta/schema` (the content), which is
+ * why the bridge between a written entry and a stored embedding lives here
+ * rather than in either of them: `@cogenta/schema` may not depend on the agent
+ * runtime, and `@cogenta/agents` may not depend on the content engine.
+ *
+ * **Everything here is optional and fails soft.** A site with no AI provider
+ * gets an unavailable toolset and no route change; a site whose embeddings
+ * provider has no adapter yet gets no semantic search and a warning in the log,
+ * not a refusal to start. Nothing in this file can prevent `cogenta serve` from
+ * serving a site (R2).
+ */
+export interface AssistantAssembly {
+    readonly toolset: AssistToolset;
+    /** Absent when semantic search is not available on this site. */
+    readonly search?: SemanticSearch;
+    /** Absent for the same reason. Used to keep the index in step with the content. */
+    readonly vectors?: {
+        readonly store: VectorStore;
+        readonly embeddings: EmbeddingProvider;
+    };
+    /** What `cogenta serve` prints on startup. Always truthful about what is off. */
+    readonly summary: string;
+    dispose(): Promise<void>;
+}
+export interface BuildAssistantOptions {
+    readonly config: CogentaConfig;
+    readonly db: DatabaseHandle;
+    readonly logger: Logger;
+    /** L10's full-text index, fused with the vector half rather than replaced by it. */
+    readonly fullText?: SearchDriver;
+}
+export declare function buildAssistant(options: BuildAssistantOptions): Promise<AssistantAssembly>;
+/**
+ * Keeps the vector index in step with the content, by wrapping the store.
+ *
+ * Exactly the shape `withSearchIndexing` (L10 task 3) already established, and
+ * for the same reason: `serve.ts` hands the *same* store instances to REST and
+ * to GraphQL, so one wrap covers both transports and neither can bypass it.
+ *
+ * Only the **published** face is indexed. A chat answer is quotable, and the
+ * one thing that must never happen is a visitor being told something from a
+ * draft nobody approved — so an entry with no published face is removed from
+ * the index rather than indexed under its draft status.
+ *
+ * A failed index write never fails the content write that triggered it: the
+ * embedding is derived data that can be rebuilt from the content at any time,
+ * and losing an editor's save because an embedding could not be stored would be
+ * the wrong trade.
+ */
+export interface VectorIndexingOptions {
+    readonly collection: CollectionDefinition;
+    readonly siteId: string;
+    readonly store: VectorStore;
+    readonly embeddings: EmbeddingProvider;
+    readonly onError?: (error: unknown) => void;
+}
+export declare function withVectorIndexing(store: ContentStore, options: VectorIndexingOptions): ContentStore;
+//# sourceMappingURL=assistant.d.ts.map

package/dist/commands/assistant.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"assistant.d.ts","sourceRoot":"","sources":["../../src/commands/assistant.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAOlB,KAAK,iBAAiB,EAKtB,KAAK,cAAc,EAEnB,KAAK,WAAW,EACjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAC1E,OAAO,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAGvF;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAA;IAChC,mFAAmF;IACnF,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;QAAC,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAA;KAAE,CAAA;IAC1F,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAA;CACjC;AAwFD,wBAAsB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA0D/F;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAA;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAA;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;CAC5C;AAyCD,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,qBAAqB,GAC7B,YAAY,CAyCd"}

package/dist/commands/assistant.js ADDED Viewed

@@ -0,0 +1,207 @@
+import { createAssistToolset, createHashingEmbeddingProvider, createImageProviderRegistry, createProviderRegistry, createSemanticSearch, createVectorRegistry, PROVIDER_NAMES, } from '@cogenta/agents';
+import { searchDocumentFor } from '@cogenta/schema';
+function isProviderName(value) {
+    return PROVIDER_NAMES.includes(value);
+}
+/**
+ * The text client, or nothing.
+ *
+ * A configured provider whose name this build does not know, or whose API key
+ * is missing, produces `undefined` and a warning — never a throw. An operator
+ * who mistyped a provider name should get a site that works with the assistant
+ * off, plus a log line saying exactly that.
+ */
+function textProvider(options) {
+    const llm = options.config.llm;
+    if (llm === undefined)
+        return undefined;
+    if (!isProviderName(llm.provider)) {
+        options.logger.warn('unknown LLM provider, the writing assistant stays off', {
+            provider: llm.provider,
+            known: PROVIDER_NAMES,
+        });
+        return undefined;
+    }
+    if (llm.apiKey === undefined) {
+        options.logger.warn('LLM provider configured with no API key, the writing assistant stays off', {
+            provider: llm.provider,
+            variable: 'COGENTA_LLM_API_KEY',
+        });
+        return undefined;
+    }
+    const registry = createProviderRegistry({
+        [llm.provider]: {
+            apiKey: llm.apiKey,
+            model: llm.model,
+            ...(llm.baseUrl === undefined ? {} : { baseUrl: llm.baseUrl }),
+        },
+    });
+    return registry.get(llm.provider);
+}
+function imageProvider(options) {
+    const images = options.config.imageGeneration;
+    if (images === undefined)
+        return undefined;
+    if (images.apiKey === undefined) {
+        options.logger.warn('image provider configured with no API key, image generation stays off', {
+            provider: images.provider,
+            variable: 'COGENTA_IMAGE_API_KEY',
+        });
+        return undefined;
+    }
+    const registry = createImageProviderRegistry({
+        [images.provider]: {
+            apiKey: images.apiKey,
+            model: images.model,
+            ...(images.baseUrl === undefined ? {} : { baseUrl: images.baseUrl }),
+        },
+    });
+    return registry.get(images.provider);
+}
+/**
+ * The embedder, or nothing.
+ *
+ * Only `local` has an adapter today — the hashing provider, which needs no key,
+ * no service and no model download. `openai` is a valid configuration value
+ * that nothing implements yet, and the honest answer to it is to switch the
+ * feature off with a log line naming what is missing, not to quietly substitute
+ * a different embedding space (which would rank nonsense) and not to refuse to
+ * boot over a feature the site may not even use.
+ */
+function embeddingProvider(options) {
+    const { provider, dimensions } = options.config.embeddings;
+    if (provider === 'local')
+        return createHashingEmbeddingProvider({ dimensions });
+    options.logger.warn('no adapter for this embeddings provider yet, semantic search and duplicate detection stay off', { provider, implemented: ['local'] });
+    return undefined;
+}
+export async function buildAssistant(options) {
+    const { config, logger } = options;
+    const provider = textProvider(options);
+    const images = imageProvider(options);
+    const embeddings = embeddingProvider(options);
+    let store;
+    let disposeVectors;
+    let vectorDriver = 'none';
+    if (embeddings !== undefined) {
+        try {
+            const selection = await createVectorRegistry({ db: options.db, logger }).select({
+                driver: config.vector.driver,
+                dimensions: embeddings.dimensions,
+                path: config.vector.path,
+                table: config.vector.table,
+            });
+            store = selection.instance;
+            vectorDriver = selection.driver;
+            disposeVectors = () => selection.dispose();
+        }
+        catch (error) {
+            // Same posture as everywhere else here: a vector store that will not
+            // start takes semantic search with it and nothing else.
+            logger.warn('no vector store available, semantic search stays off', { error: String(error) });
+        }
+    }
+    const search = store === undefined || embeddings === undefined
+        ? undefined
+        : createSemanticSearch({
+            store,
+            embeddings,
+            ...(options.fullText === undefined ? {} : { fullText: options.fullText }),
+        });
+    const toolset = createAssistToolset({
+        site: { name: config.site.name, locales: config.site.locales },
+        ...(provider === undefined ? {} : { provider }),
+        ...(images === undefined ? {} : { imageProvider: images }),
+        ...(search === undefined ? {} : { search }),
+        ...(store === undefined || embeddings === undefined ? {} : { vectors: { store, embeddings } }),
+    });
+    const summary = toolset.available
+        ? `assistant: ${toolset.tools.length} tool(s), text provider: ${provider?.name ?? 'none'}, image provider: ${images?.name ?? 'none'}, vector driver: ${vectorDriver}`
+        : 'assistant: off (no AI provider configured)';
+    return {
+        toolset,
+        ...(search === undefined ? {} : { search }),
+        ...(store === undefined || embeddings === undefined ? {} : { vectors: { store, embeddings } }),
+        summary,
+        dispose: async () => {
+            await disposeVectors?.();
+        },
+    };
+}
+/** The chunk id an entry's single document occupies. One chunk per entry, for now — see the note in `reindexEntry`. */
+function chunkIdFor(collection, id) {
+    return `${collection}:${id}:0`;
+}
+async function recordFor(options, document) {
+    const text = [document.title, document.body].filter((part) => part.length > 0).join('\n\n');
+    if (text.trim().length === 0)
+        return null;
+    const [vector] = await options.embeddings.embed([text]);
+    if (vector === undefined)
+        return null;
+    return {
+        siteId: options.siteId,
+        collection: options.collection.name,
+        entryId: document.id,
+        locale: document.locale,
+        status: document.status,
+        chunk: {
+            // One chunk per entry rather than `chunkDocument`'s real chunking.
+            // `chunkDocument` (L4) wants a block list with heading flags, which
+            // `searchDocumentFor` has already flattened away — feeding it the
+            // flattened string would produce chunk boundaries in the wrong places.
+            // Wiring real chunking means reading the entry's blocks directly, which
+            // is a piece of work of its own; one chunk per entry retrieves the right
+            // entries today and simply quotes more of them than it needs to.
+            id: chunkIdFor(options.collection.name, document.id),
+            documentId: document.id,
+            blockIds: [],
+            text,
+            hash: document.id,
+        },
+        vector,
+    };
+}
+export function withVectorIndexing(store, options) {
+    async function reindex(id) {
+        try {
+            const published = await store.read(id, { state: 'published' });
+            if (published === null) {
+                await options.store.remove([chunkIdFor(options.collection.name, id)]);
+                return;
+            }
+            const record = await recordFor(options, searchDocumentFor(options.collection, published));
+            if (record === null) {
+                await options.store.remove([chunkIdFor(options.collection.name, id)]);
+                return;
+            }
+            await options.store.upsert([record]);
+        }
+        catch (error) {
+            options.onError?.(error);
+        }
+    }
+    async function after(entry) {
+        await reindex(entry.id);
+        return entry;
+    }
+    return {
+        ...store,
+        create: async (input) => after(await store.create(input)),
+        update: async (id, input) => after(await store.update(id, input)),
+        publish: async (id, input) => after(await store.publish(id, input)),
+        unpublish: async (id, input) => after(await store.unpublish(id, input)),
+        restore: async (id, version, input) => after(await store.restore(id, version, input)),
+        delete: async (id) => {
+            const removed = await store.delete(id);
+            try {
+                await options.store.remove([chunkIdFor(options.collection.name, id)]);
+            }
+            catch (error) {
+                options.onError?.(error);
+            }
+            return removed;
+        },
+    };
+}
+//# sourceMappingURL=assistant.js.map

package/dist/commands/assistant.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"assistant.js","sourceRoot":"","sources":["../../src/commands/assistant.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,mBAAmB,EACnB,8BAA8B,EAC9B,2BAA2B,EAC3B,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EAGpB,cAAc,GAMf,MAAM,iBAAiB,CAAA;AAGxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAqCnD,SAAS,cAAc,CAAC,KAAa;IACnC,OAAQ,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAC9D,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,OAA8B;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAA;IAC9B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAEvC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,uDAAuD,EAAE;YAC3E,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,KAAK,EAAE,cAAc;SACtB,CAAC,CAAA;QACF,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,IAAI,CACjB,0EAA0E,EAC1E;YACE,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,QAAQ,EAAE,qBAAqB;SAChC,CACF,CAAA;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,sBAAsB,CAAC;QACtC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;YACd,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;SAC/D;KACF,CAAC,CAAA;IACF,OAAO,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;AACnC,CAAC;AAED,SAAS,aAAa,CAAC,OAA8B;IACnD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,CAAA;IAC7C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC1C,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,uEAAuE,EAAE;YAC3F,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,uBAAuB;SAClC,CAAC,CAAA;QACF,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,2BAA2B,CAAC;QAC3C,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;SACrE;KACF,CAAC,CAAA;IACF,OAAO,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;AACtC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,iBAAiB,CAAC,OAA8B;IACvD,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAA;IAC1D,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,8BAA8B,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IAE/E,OAAO,CAAC,MAAM,CAAC,IAAI,CACjB,+FAA+F,EAC/F,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,CACrC,CAAA;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA8B;IACjE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAClC,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;IACtC,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;IACrC,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;IAE7C,IAAI,KAA8B,CAAA;IAClC,IAAI,cAAiD,CAAA;IACrD,IAAI,YAAY,GAAG,MAAM,CAAA;IAEzB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;gBAC9E,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;gBAC5B,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;gBACxB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK;aAC3B,CAAC,CAAA;YACF,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAA;YAC1B,YAAY,GAAG,SAAS,CAAC,MAAM,CAAA;YAC/B,cAAc,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,CAAA;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qEAAqE;YACrE,wDAAwD;YACxD,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAC/F,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GACV,KAAK,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS;QAC7C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,oBAAoB,CAAC;YACnB,KAAK;YACL,UAAU;YACV,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;SAC1E,CAAC,CAAA;IAER,MAAM,OAAO,GAAG,mBAAmB,CAAC;QAClC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE;QAC9D,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;QAC1D,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3C,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;KAC/F,CAAC,CAAA;IAEF,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS;QAC/B,CAAC,CAAC,cAAc,OAAO,CAAC,KAAK,CAAC,MAAM,4BAA4B,QAAQ,EAAE,IAAI,IAAI,MAAM,qBAAqB,MAAM,EAAE,IAAI,IAAI,MAAM,oBAAoB,YAAY,EAAE;QACrK,CAAC,CAAC,4CAA4C,CAAA;IAEhD,OAAO;QACL,OAAO;QACP,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3C,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;QAC9F,OAAO;QACP,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,MAAM,cAAc,EAAE,EAAE,CAAA;QAC1B,CAAC;KACF,CAAA;AACH,CAAC;AA2BD,uHAAuH;AACvH,SAAS,UAAU,CAAC,UAAkB,EAAE,EAAU;IAChD,OAAO,GAAG,UAAU,IAAI,EAAE,IAAI,CAAA;AAChC,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,OAA8B,EAC9B,QAAqF;IAErF,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC3F,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAEzC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IACvD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAErC,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI;QACnC,OAAO,EAAE,QAAQ,CAAC,EAAE;QACpB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,KAAK,EAAE;YACL,mEAAmE;YACnE,oEAAoE;YACpE,kEAAkE;YAClE,uEAAuE;YACvE,wEAAwE;YACxE,yEAAyE;YACzE,iEAAiE;YACjE,EAAE,EAAE,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;YACpD,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,QAAQ,EAAE,EAAE;YACZ,IAAI;YACJ,IAAI,EAAE,QAAQ,CAAC,EAAE;SAClB;QACD,MAAM;KACP,CAAA;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAAmB,EACnB,OAA8B;IAE9B,KAAK,UAAU,OAAO,CAAC,EAAU;QAC/B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;YAC9D,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;gBACrE,OAAM;YACR,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAA;YACzF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;gBACrE,OAAM;YACR,CAAC;YACD,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAA;QAC1B,CAAC;IACH,CAAC;IAED,KAAK,UAAU,KAAK,CAAyC,KAAa;QACxE,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACvB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO;QACL,GAAG,KAAK;QACR,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACjE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACnE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACvE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACrF,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YACnB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YACtC,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;YACvE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAA;YAC1B,CAAC;YACD,OAAO,OAAO,CAAA;QAChB,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/commands/content-webhooks.d.ts ADDED Viewed

@@ -0,0 +1,41 @@
+import { type WebhookEventSender } from '@cogenta/channels';
+import type { CogentaConfig, Logger } from '@cogenta/core';
+import type { ContentLifecycleEvent } from '@cogenta/schema';
+/**
+ * Turns the site's configuration into the one thing `assembleSite` needs: a
+ * function that publishes a content lifecycle event to the outside world
+ * (L14 task 1).
+ *
+ * The signed webhook channel has existed since L6 and nothing ever called it.
+ * This is the missing half — and deliberately only the wiring: the signature,
+ * the headers and the freshness semantics are `@cogenta/channels`'s, unchanged.
+ */
+export interface ContentWebhookOptions {
+    readonly webhooks: CogentaConfig['webhooks'];
+    /** The site's public base URL, used to turn an entry's path into an absolute URL. */
+    readonly siteUrl: string;
+    readonly logger: Logger;
+    /** Overridable for tests; defaults to the sender built from `webhooks`. */
+    readonly sender?: WebhookEventSender;
+}
+export interface ContentWebhookEmitter {
+    /** `null` when the site sends nothing — no endpoint, or no secret. */
+    readonly emit: ((event: ContentLifecycleEvent) => Promise<void>) | null;
+    /**
+     * The same signed channel, for the events that are not about content — the
+     * suspicious-activity alert of L14 task 4. Deliberately the *same* sender, so
+     * a site configures one set of endpoints and one secret, and there is never a
+     * second signing path to review.
+     */
+    readonly send: ((event: string, data: Readonly<Record<string, unknown>>) => Promise<void>) | null;
+}
+/**
+ * Both halves are required, and the missing-secret case is a refusal rather
+ * than a downgrade: sending a *signed* webhook to nowhere is harmless, but
+ * sending an *unsigned* one is an unauthenticated instruction arriving at
+ * somebody else's server, which they have no way to tell from an attacker's.
+ * A site that configured endpoints without a secret is told so once, at
+ * startup, instead of silently never delivering.
+ */
+export declare function createContentWebhookEmitter(options: ContentWebhookOptions): ContentWebhookEmitter;
+//# sourceMappingURL=content-webhooks.d.ts.map

package/dist/commands/content-webhooks.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"content-webhooks.d.ts","sourceRoot":"","sources":["../../src/commands/content-webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACrF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAE5D;;;;;;;;GAQG;AAEH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,UAAU,CAAC,CAAA;IAC5C,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAA;CACrC;AAED,MAAM,WAAW,qBAAqB;IACpC,sEAAsE;IACtE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,qBAAqB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAA;IACvE;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAA;CAClG;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,qBAAqB,GAAG,qBAAqB,CAqDjG"}

package/dist/commands/content-webhooks.js ADDED Viewed

@@ -0,0 +1,61 @@
+import { createWebhookEventSender } from '@cogenta/channels';
+/**
+ * Both halves are required, and the missing-secret case is a refusal rather
+ * than a downgrade: sending a *signed* webhook to nowhere is harmless, but
+ * sending an *unsigned* one is an unauthenticated instruction arriving at
+ * somebody else's server, which they have no way to tell from an attacker's.
+ * A site that configured endpoints without a secret is told so once, at
+ * startup, instead of silently never delivering.
+ */
+export function createContentWebhookEmitter(options) {
+    const { endpoints, secret } = options.webhooks;
+    if (options.sender === undefined && endpoints.length === 0)
+        return { emit: null, send: null };
+    if (options.sender === undefined && secret === undefined) {
+        options.logger.warn('outbound webhooks are configured but disabled', {
+            endpoints: endpoints.length,
+            reason: 'COGENTA_WEBHOOK_SECRET is not set',
+        });
+        return { emit: null, send: null };
+    }
+    const sender = options.sender ?? createWebhookEventSender({ endpoints, secret: secret ?? '' });
+    /**
+     * Structured, and never silent: an outbound side effect that failed is
+     * exactly the thing an operator needs in the log, and there is no retry to
+     * make it right later (rule R1 — this deployment guarantees no durable
+     * worker).
+     */
+    const send = async (event, data) => {
+        for (const result of await sender.send(event, data)) {
+            if (result.delivered) {
+                options.logger.info('webhook delivered', {
+                    event,
+                    url: result.url,
+                    status: result.status,
+                });
+            }
+            else {
+                options.logger.error('webhook delivery failed', {
+                    event,
+                    url: result.url,
+                    status: result.status,
+                    error: result.error?.code ?? 'UNKNOWN',
+                });
+            }
+        }
+    };
+    return {
+        send,
+        emit: async (event) => {
+            const { path, ...rest } = event;
+            await send(event.event, {
+                ...rest,
+                path,
+                // An absolute URL costs the receiver one less thing to know. Built from
+                // the same `site.url` the canonical tag and the sitemap already use.
+                url: path === null ? null : new URL(path, options.siteUrl).toString(),
+            });
+        },
+    };
+}
+//# sourceMappingURL=content-webhooks.js.map

package/dist/commands/content-webhooks.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"content-webhooks.js","sourceRoot":"","sources":["../../src/commands/content-webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAA2B,MAAM,mBAAmB,CAAA;AAmCrF;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAA8B;IACxE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAA;IAE9C,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IAE7F,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;YACnE,SAAS,EAAE,SAAS,CAAC,MAAM;YAC3B,MAAM,EAAE,mCAAmC;SAC5C,CAAC,CAAA;QACF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IACnC,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,wBAAwB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC,CAAA;IAE9F;;;;;OAKG;IACH,MAAM,IAAI,GAAG,KAAK,EAAE,KAAa,EAAE,IAAuC,EAAiB,EAAE;QAC3F,KAAK,MAAM,MAAM,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;YACpD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACrB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE;oBACvC,KAAK;oBACL,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,MAAM,EAAE,MAAM,CAAC,MAAM;iBACtB,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE;oBAC9C,KAAK;oBACL,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,IAAI,SAAS;iBACvC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAA;IAED,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACpB,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAA;YAC/B,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE;gBACtB,GAAG,IAAI;gBACP,IAAI;gBACJ,wEAAwE;gBACxE,qEAAqE;gBACrE,GAAG,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;aACtE,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/commands/http-security.d.ts ADDED Viewed

@@ -0,0 +1,39 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { CogentaConfig } from '@cogenta/core';
+/**
+ * CORS, security headers and cache-control for `cogenta serve` (L10 task 6).
+ *
+ * All three are applied in one place, before any route runs, for the reason
+ * that makes them worth having at all: a header added per route is a header
+ * some route forgets. `writeHead` is patched once per request so that every
+ * existing `res.writeHead(...)` call — and there are a dozen — picks them up
+ * without being rewritten, and so that a route added later cannot opt out by
+ * omission.
+ */
+export type SecurityConfig = CogentaConfig['security'];
+/** Which cache-control a path class gets. */
+export declare function cacheControlFor(pathname: string, security: SecurityConfig): string | null;
+/**
+ * The CORS headers this request earns, or an empty object.
+ *
+ * The origin is echoed rather than reflected blindly: only an exact match in
+ * the configured list, or `*` when the list holds it. `Vary: Origin` goes out
+ * with any match, because a shared cache that stores one origin's response
+ * and serves it to another is the whole class of CORS cache-poisoning bugs.
+ */
+export declare function corsHeadersFor(origin: string | undefined, security: SecurityConfig): Readonly<Record<string, string>>;
+/** The extra headers a preflight needs on top of the ones above. */
+export declare function preflightHeadersFor(security: SecurityConfig): Readonly<Record<string, string>>;
+/**
+ * Applies the headers to every response of this request, and answers a CORS
+ * preflight outright.
+ *
+ * Returns `true` when the request is finished — the caller must then do
+ * nothing else. Patching `writeHead` rather than calling `setHeader` up front
+ * is what makes this survive the routes that pass a header object of their
+ * own: `res.writeHead(200, { 'content-type': … })` replaces every header
+ * previously set, so setting them early would silently lose them on most of
+ * the routes in this file.
+ */
+export declare function applySecurity(req: IncomingMessage, res: ServerResponse, pathname: string, security: SecurityConfig): boolean;
+//# sourceMappingURL=http-security.d.ts.map

package/dist/commands/http-security.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"http-security.d.ts","sourceRoot":"","sources":["../../src/commands/http-security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAuB,cAAc,EAAE,MAAM,WAAW,CAAA;AACrF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAElD;;;;;;;;;GASG;AAEH,MAAM,MAAM,cAAc,GAAG,aAAa,CAAC,UAAU,CAAC,CAAA;AAkBtD,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAkBzF;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,EAAE,cAAc,GACvB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAYlC;AAED,oEAAoE;AACpE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAM9F;AAyDD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,cAAc,GACvB,OAAO,CAsCT"}

package/dist/commands/http-security.js ADDED Viewed

@@ -0,0 +1,153 @@
+/**
+ * Headers every response carries, whatever it is.
+ *
+ * Deliberately short. `X-Content-Type-Options` stops a browser guessing that
+ * an uploaded file is a script; `X-Frame-Options` and `Referrer-Policy` are
+ * the two others with no plausible downside and a real failure mode without
+ * them. Anything beyond that (`Permissions-Policy`, COEP/COOP) breaks real
+ * pages depending on what a site embeds, so it belongs in the site's own
+ * `csp` string rather than in a default nobody chose.
+ */
+const ALWAYS = Object.freeze({
+    'x-content-type-options': 'nosniff',
+    'x-frame-options': 'SAMEORIGIN',
+    'referrer-policy': 'strict-origin-when-cross-origin',
+});
+/** Which cache-control a path class gets. */
+export function cacheControlFor(pathname, security) {
+    // Never store an API response: they are per-actor by construction — the same
+    // URL answers differently for an editor and for a stranger — and a shared
+    // cache that keeps one is a permission leak, not a performance win.
+    if (pathname.startsWith('/api/'))
+        return 'no-store';
+    // The admin shell is a signed-in application. Its hashed assets could be
+    // cached forever, but `index.html` must not be, and telling them apart here
+    // would duplicate Vite's naming convention in a second place.
+    if (pathname === '/admin' || pathname.startsWith('/admin/'))
+        return 'no-store';
+    // Images and sitemaps set their own, longer, values at their route.
+    if (pathname === '/_image' || pathname === '/robots.txt')
+        return null;
+    if (pathname === '/search')
+        return null;
+    // A public page: cacheable, briefly. `must-revalidate` rather than a long
+    // max-age because publishing is supposed to be visible immediately, and a
+    // CMS whose edits appear ten minutes later is a CMS people stop trusting.
+    return security.pageMaxAge === 0
+        ? 'no-store'
+        : `public, max-age=0, s-maxage=${security.pageMaxAge}, must-revalidate`;
+}
+/**
+ * The CORS headers this request earns, or an empty object.
+ *
+ * The origin is echoed rather than reflected blindly: only an exact match in
+ * the configured list, or `*` when the list holds it. `Vary: Origin` goes out
+ * with any match, because a shared cache that stores one origin's response
+ * and serves it to another is the whole class of CORS cache-poisoning bugs.
+ */
+export function corsHeadersFor(origin, security) {
+    const { cors } = security;
+    if (cors.origins.length === 0 || origin === undefined)
+        return {};
+    const wildcard = cors.origins.includes('*');
+    if (!wildcard && !cors.origins.includes(origin))
+        return {};
+    return {
+        'access-control-allow-origin': wildcard && !cors.credentials ? '*' : origin,
+        vary: 'Origin',
+        ...(cors.credentials ? { 'access-control-allow-credentials': 'true' } : {}),
+    };
+}
+/** The extra headers a preflight needs on top of the ones above. */
+export function preflightHeadersFor(security) {
+    return {
+        'access-control-allow-methods': security.cors.methods.join(', '),
+        'access-control-allow-headers': security.cors.headers.join(', '),
+        'access-control-max-age': String(security.cors.maxAge),
+    };
+}
+function baseHeadersFor(req, pathname, security) {
+    const headers = { ...ALWAYS };
+    if (security.csp !== undefined && security.csp !== false) {
+        headers['content-security-policy'] = security.csp;
+    }
+    // Only over TLS. Sent on a plain HTTP response the header is ignored by
+    // browsers anyway, and sending it locally is how somebody pins
+    // `localhost` to HTTPS and cannot develop for the next year.
+    if (security.hstsMaxAge > 0 && isSecure(req)) {
+        headers['strict-transport-security'] = `max-age=${security.hstsMaxAge}${security.hstsIncludeSubDomains ? '; includeSubDomains' : ''}`;
+    }
+    const origin = headerOf(req, 'origin');
+    Object.assign(headers, corsHeadersFor(origin, security));
+    // A page render is per-actor: `renderRequestedPage` passes the requesting
+    // actor's context down, so an editor's `GET /blog/embargoed` returns the
+    // draft. `public, s-maxage=…` is precisely the pair RFC 9111 §3.5 says
+    // re-authorises a *shared* cache to store a response to a request carrying
+    // `Authorization` — a CDN in front of the site would then serve that draft
+    // to everyone for a minute. Anything sent with credentials is private and
+    // unstorable, whatever class its path belongs to. Found by the security
+    // review of L10 task 6.
+    const cacheControl = hasCredentials(req)
+        ? 'private, no-store'
+        : cacheControlFor(pathname, security);
+    if (cacheControl !== null)
+        headers['cache-control'] = cacheControl;
+    return headers;
+}
+/** True when the request carries something that makes its answer actor-specific. */
+function hasCredentials(req) {
+    return headerOf(req, 'authorization') !== undefined || headerOf(req, 'cookie') !== undefined;
+}
+function headerOf(req, name) {
+    const value = req.headers[name];
+    return Array.isArray(value) ? value[0] : value;
+}
+/** True behind a TLS socket, or behind a proxy that says it terminated one. */
+function isSecure(req) {
+    if ('encrypted' in req.socket && req.socket.encrypted === true)
+        return true;
+    return headerOf(req, 'x-forwarded-proto')?.split(',')[0]?.trim() === 'https';
+}
+/**
+ * Applies the headers to every response of this request, and answers a CORS
+ * preflight outright.
+ *
+ * Returns `true` when the request is finished — the caller must then do
+ * nothing else. Patching `writeHead` rather than calling `setHeader` up front
+ * is what makes this survive the routes that pass a header object of their
+ * own: `res.writeHead(200, { 'content-type': … })` replaces every header
+ * previously set, so setting them early would silently lose them on most of
+ * the routes in this file.
+ */
+export function applySecurity(req, res, pathname, security) {
+    const base = baseHeadersFor(req, pathname, security);
+    const original = res.writeHead.bind(res);
+    // Both of Node's overloads are accepted, so no existing call site changes.
+    // An array-of-raw-headers form exists too and is not used anywhere here; it
+    // is passed through untouched rather than half-merged.
+    res.writeHead = ((status, reasonOrHeaders, maybeHeaders) => {
+        const supplied = typeof reasonOrHeaders === 'string' ? maybeHeaders : (reasonOrHeaders ?? maybeHeaders);
+        if (Array.isArray(supplied)) {
+            return typeof reasonOrHeaders === 'string'
+                ? original(status, reasonOrHeaders, supplied)
+                : original(status, supplied);
+        }
+        const merged = { ...base, ...(supplied ?? {}) };
+        return typeof reasonOrHeaders === 'string'
+            ? original(status, reasonOrHeaders, merged)
+            : original(status, merged);
+    });
+    if (req.method === 'OPTIONS') {
+        const origin = headerOf(req, 'origin');
+        const allowed = corsHeadersFor(origin, security);
+        // A preflight for an origin that is not allowed gets a plain 204 with no
+        // CORS headers: the browser then refuses the real request on its own. A
+        // 403 would be no more secure and would look like a server fault in the
+        // console instead of the policy decision it is.
+        res.writeHead(204, Object.keys(allowed).length === 0 ? {} : preflightHeadersFor(security));
+        res.end();
+        return true;
+    }
+    return false;
+}
+//# sourceMappingURL=http-security.js.map

package/dist/commands/http-security.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"http-security.js","sourceRoot":"","sources":["../../src/commands/http-security.ts"],"names":[],"mappings":"AAgBA;;;;;;;;;GASG;AACH,MAAM,MAAM,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC7D,wBAAwB,EAAE,SAAS;IACnC,iBAAiB,EAAE,YAAY;IAC/B,iBAAiB,EAAE,iCAAiC;CACrD,CAAC,CAAA;AAEF,6CAA6C;AAC7C,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,QAAwB;IACxE,6EAA6E;IAC7E,0EAA0E;IAC1E,oEAAoE;IACpE,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,UAAU,CAAA;IACnD,yEAAyE;IACzE,4EAA4E;IAC5E,8DAA8D;IAC9D,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,UAAU,CAAA;IAC9E,oEAAoE;IACpE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,aAAa;QAAE,OAAO,IAAI,CAAA;IACrE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACvC,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,OAAO,QAAQ,CAAC,UAAU,KAAK,CAAC;QAC9B,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,+BAA+B,QAAQ,CAAC,UAAU,mBAAmB,CAAA;AAC3E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,MAA0B,EAC1B,QAAwB;IAExB,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAA;IACzB,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IAEhE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC3C,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAA;IAE1D,OAAO;QACL,6BAA6B,EAAE,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;QAC3E,IAAI,EAAE,QAAQ;QACd,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,kCAAkC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAA;AACH,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,mBAAmB,CAAC,QAAwB;IAC1D,OAAO;QACL,8BAA8B,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAChE,8BAA8B,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAChE,wBAAwB,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;KACvD,CAAA;AACH,CAAC;AAED,SAAS,cAAc,CACrB,GAAoB,EACpB,QAAgB,EAChB,QAAwB;IAExB,MAAM,OAAO,GAA2B,EAAE,GAAG,MAAM,EAAE,CAAA;IAErD,IAAI,QAAQ,CAAC,GAAG,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QACzD,OAAO,CAAC,yBAAyB,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAA;IACnD,CAAC;IAED,wEAAwE;IACxE,+DAA+D;IAC/D,6DAA6D;IAC7D,IAAI,QAAQ,CAAC,UAAU,GAAG,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,CAAC,2BAA2B,CAAC,GAAG,WAAW,QAAQ,CAAC,UAAU,GACnE,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAC3D,EAAE,CAAA;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACtC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;IAExD,0EAA0E;IAC1E,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,wBAAwB;IACxB,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC;QACtC,CAAC,CAAC,mBAAmB;QACrB,CAAC,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;IACvC,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,CAAC,eAAe,CAAC,GAAG,YAAY,CAAA;IAElE,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,oFAAoF;AACpF,SAAS,cAAc,CAAC,GAAoB;IAC1C,OAAO,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,SAAS,CAAA;AAC9F,CAAC;AAED,SAAS,QAAQ,CAAC,GAAoB,EAAE,IAAY;IAClD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;AAChD,CAAC;AAED,+EAA+E;AAC/E,SAAS,QAAQ,CAAC,GAAoB;IACpC,IAAI,WAAW,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC3E,OAAO,QAAQ,CAAC,GAAG,EAAE,mBAAmB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,OAAO,CAAA;AAC9E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAoB,EACpB,GAAmB,EACnB,QAAgB,EAChB,QAAwB;IAExB,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;IAEpD,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxC,2EAA2E;IAC3E,4EAA4E;IAC5E,uDAAuD;IACvD,GAAG,CAAC,SAAS,GAAG,CAAC,CACf,MAAc,EACd,eAAkE,EAClE,YAAsD,EACtD,EAAE;QACF,MAAM,QAAQ,GACZ,OAAO,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,eAAe,IAAI,YAAY,CAAC,CAAA;QACxF,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,OAAO,OAAO,eAAe,KAAK,QAAQ;gBACxC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,EAAE,QAAoB,CAAC;gBACzD,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAoB,CAAC,CAAA;QAC5C,CAAC;QACD,MAAM,MAAM,GAAwB,EAAE,GAAG,IAAI,EAAE,GAAG,CAAE,QAAgC,IAAI,EAAE,CAAC,EAAE,CAAA;QAC7F,OAAO,OAAO,eAAe,KAAK,QAAQ;YACxC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,CAAC;YAC3C,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,CAAC,CAAgC,CAAA;IAEjC,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QACtC,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAChD,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,gDAAgD;QAChD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC1F,GAAG,CAAC,GAAG,EAAE,CAAA;QACT,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC"}