@cosmicdrift/kumiko-bundled-features 0.328.0 → 0.329.0

package/dist/page-render/css-sanitize.js

@@ -0,0 +1,355 @@
+// Allowlist-based CSS sanitizer for UNTRUSTED tenant-supplied CSS (managed-pages
+// custom-css capability). Security model: allowlist-by-construction — the output
+// is REBUILT from validated tokens (scope-prefixed selector + allowed
+// `property: value` pairs), never a filtered passthrough of the input. A rule
+// that doesn't parse cleanly into that shape is dropped whole (fail-closed).
+// `url()`, `@import`, `expression()` and friends are closed BY CONSTRUCTION:
+// they can never match an allowed value grammar, so we never depend on detecting
+// their literal spelling — which CSS escape sequences like `\75rl(` would defeat.
+//
+// Scoping: every selector is prefixed with `scopeSelector`, so a tenant rule can
+// only style elements INSIDE the page-content container — never `html`/`body`/
+// `:root` (those become inert: no such element is a descendant of the scope) and
+// never another tenant's content. A segment may NOT start with a combinator
+// (`~ X`/`+ X`/`> X` would reach the scope's siblings/parent — the host chrome);
+// internal combinators stay in-scope. The container element itself is unreachable
+// (descendant combinator), so the host-emitted containment styles — including the
+// `overflow` clip and `isolation` in layout.ts — can't be overridden by tenant CSS.
+//
+// Hard rejections (no presentational CSS needs them): any `\` (escape-sequence
+// bypass), any `@`-rule (no `@media`/`@font-face`/`@import`), any function token
+// outside {rgb,rgba,hsl,hsla,calc} (closes `url`/`expression`/`var`/`image-set`),
+// any `[`/`]` (attribute selectors), `::` AND single-colon `:before`/`:after`/
+// `:first-line`/`:first-letter` (pseudo-elements → content/defacement), `url(`/
+// `expression(` in a selector, and `<`/`>`/`"`/`'`/`{`/`}`/`;`/`@` inside a value.
+//
+// Residual (documented, tier-gated): best-effort defense-in-depth for untrusted
+// tenants. The surface is deliberately small — no at-rules, no `url()`, no
+// `var()`/custom-props, no pseudo-elements, no quotes in values, no leading
+// combinators. A scoped element can still RESTYLE/DEFACE its own page area
+// (within the container's `overflow` clip) — that is the tenant's own content,
+// not host chrome. Keep CSS-inject behind the operator/tier gate; this is not a
+// hard isolation boundary (an iframe sandbox would be).
+const MAX_CSS_LENGTH = 8000;
+// Presentational properties only. `position` is intentionally NOT here — it is
+// allowed with a value constraint (fixed/sticky enable viewport overlays /
+// clickjacking), handled in sanitizeValue.
+const ALLOWED_PROPERTIES = new Set([
+    "color",
+    "background-color",
+    "font-family",
+    "font-size",
+    "font-weight",
+    "font-style",
+    "font-variant",
+    "line-height",
+    "letter-spacing",
+    "word-spacing",
+    "text-align",
+    "text-decoration",
+    "text-transform",
+    "text-indent",
+    "text-shadow",
+    "white-space",
+    "margin",
+    "margin-top",
+    "margin-right",
+    "margin-bottom",
+    "margin-left",
+    "padding",
+    "padding-top",
+    "padding-right",
+    "padding-bottom",
+    "padding-left",
+    "border",
+    "border-top",
+    "border-right",
+    "border-bottom",
+    "border-left",
+    "border-color",
+    "border-width",
+    "border-style",
+    "border-radius",
+    "border-top-left-radius",
+    "border-top-right-radius",
+    "border-bottom-left-radius",
+    "border-bottom-right-radius",
+    "box-shadow",
+    "outline",
+    "outline-color",
+    "outline-width",
+    "outline-style",
+    "width",
+    "max-width",
+    "min-width",
+    "height",
+    "max-height",
+    "min-height",
+    "display",
+    "opacity",
+    "visibility",
+    "list-style",
+    "list-style-type",
+    "list-style-position",
+    "vertical-align",
+    "cursor",
+    "box-sizing",
+    "transition",
+    "transition-property",
+    "transition-duration",
+    "transition-timing-function",
+    "transition-delay",
+    "transform",
+    "transform-origin",
+    "z-index",
+]);
+// `position` is allowed only with these values — `fixed`/`sticky` (and anything
+// unknown) is dropped to deny viewport-pinned overlays / clickjacking.
+const ALLOWED_POSITION_VALUES = new Set([
+    "static",
+    "relative",
+    "absolute",
+]);
+const ALLOWED_FUNCTIONS = new Set([
+    "rgb",
+    "rgba",
+    "hsl",
+    "hsla",
+    "calc",
+]);
+// Permitted value chars AFTER `!important` is split off. No `\` (escapes), no
+// `<`/`>`/`{`/`}`/`@`/`;` (breakouts), no quotes (string sinks like `content`,
+// quoted `url("…")`). `*` and `/` are kept for `calc()`.
+const VALUE_CHARS = /^[a-zA-Z0-9 \t.,#%()/*+-]+$/;
+const FUNCTION_NAME = /([a-zA-Z][a-zA-Z0-9-]*)\s*\(/g;
+const IMPORTANT_SUFFIX = /\s*!\s*important\s*$/i;
+// Permitted selector chars. Class/id/element idents, descendant/child/sibling
+// combinators, single-colon pseudo-CLASS, universal, `()` for `:not()`/
+// `:nth-child()`. No `[`/`]` (attribute selectors), no `,` (split earlier), no
+// `\`/quotes/braces/`@`/angle brackets. `::` is rejected separately.
+const SELECTOR_CHARS = /^[a-zA-Z0-9 \t.#:>+~*_()-]+$/;
+// A segment may NOT start with a combinator: `[scope] ~ X` / `[scope] + X` reach
+// the scope container's SIBLINGS (e.g. the host brand-header) and `[scope] > X`
+// its direct children-from-outside — all escape "descendants only". Internal
+// combinators (`.a > .b`, `.a ~ .b`) stay in-scope and are fine.
+const LEADING_COMBINATOR = /^[>+~]/;
+// Single-colon legacy pseudo-elements are pseudo-elements too — the `::` check
+// alone misses them. Reject both syntaxes (no pseudo-elements at all).
+const LEGACY_PSEUDO_ELEMENT = /:(?:before|after|first-line|first-letter)\b/i;
+// `url()`/`expression()` in a SELECTOR (e.g. inside `:not()`) don't fetch/execute
+// — selector context never loads resources — but reject them anyway so no such
+// token ever reaches output (defense-in-depth, avoids engine quirks).
+const SELECTOR_FUNCTION_SINK = /(?:url|expression)\s*\(/i;
+function stripComments(css) {
+    let out = "";
+    let i = 0;
+    const n = css.length;
+    while (i < n) {
+        if (css[i] === "/" && css[i + 1] === "*") {
+            const end = css.indexOf("*/", i + 2);
+            if (end === -1)
+                break; // unterminated comment → drop the rest (fail-closed)
+            i = end + 2;
+            out += " "; // a space so `@im/**/port` can't re-form a single token
+            continue;
+        }
+        out += css[i];
+        i++;
+    }
+    return out;
+}
+// Brace-depth-aware rule extractor. At depth 0, everything up to `{` is the
+// prelude; the matching `}` (tracking nested braces, e.g. an at-rule body)
+// closes the block. An unbalanced trailing `{` drops the rest (fail-closed).
+function extractRules(css) {
+    const rules = [];
+    let prelude = "";
+    let i = 0;
+    const n = css.length;
+    while (i < n) {
+        const ch = css[i];
+        if (ch === "{") {
+            let depth = 1;
+            let block = "";
+            i++;
+            while (i < n && depth > 0) {
+                const c = css[i];
+                if (c === "{")
+                    depth++;
+                else if (c === "}") {
+                    depth--;
+                    if (depth === 0) {
+                        i++;
+                        break;
+                    }
+                }
+                block += c;
+                i++;
+            }
+            if (depth > 0)
+                return rules; // unbalanced → fail-closed
+            rules.push({ prelude, block });
+            prelude = "";
+            continue;
+        }
+        if (ch === "}") {
+            prelude = ""; // stray close brace → reset
+            i++;
+            continue;
+        }
+        prelude += ch;
+        i++;
+    }
+    return rules; // trailing prelude without a block is discarded
+}
+function splitTopLevel(str, delimiter) {
+    const parts = [];
+    let depth = 0;
+    let buf = "";
+    for (const ch of str) {
+        if (ch === "(")
+            depth++;
+        else if (ch === ")")
+            depth = Math.max(0, depth - 1);
+        if (ch === delimiter && depth === 0) {
+            parts.push(buf);
+            buf = "";
+        }
+        else {
+            buf += ch;
+        }
+    }
+    parts.push(buf);
+    return parts;
+}
+function parensBalanced(s) {
+    let depth = 0;
+    for (const ch of s) {
+        if (ch === "(")
+            depth++;
+        else if (ch === ")") {
+            depth--;
+            if (depth < 0)
+                return false;
+        }
+    }
+    return depth === 0;
+}
+function sanitizeSelector(seg, scope) {
+    const s = seg.trim();
+    if (s === "")
+        return null;
+    if (s.includes("\\"))
+        return null; // escape-sequence bypass
+    if (s.includes("::"))
+        return null; // no pseudo-elements (content/defacement)
+    if (LEGACY_PSEUDO_ELEMENT.test(s))
+        return null; // single-colon pseudo-elements
+    if (LEADING_COMBINATOR.test(s))
+        return null; // scope-escape via leading >/+/~
+    if (SELECTOR_FUNCTION_SINK.test(s))
+        return null; // no url()/expression() in selectors
+    if (!SELECTOR_CHARS.test(s))
+        return null; // rejects [ ] , < > { } @ " '
+    if (!parensBalanced(s))
+        return null;
+    return `${scope} ${s}`;
+}
+function sanitizeValue(prop, rawValue) {
+    let value = rawValue.trim();
+    if (value === "")
+        return null;
+    if (value.includes("\\"))
+        return null; // escape-sequence bypass
+    let important = "";
+    const imp = value.match(IMPORTANT_SUFFIX);
+    if (imp) {
+        important = " !important";
+        value = value.slice(0, value.length - imp[0].length).trim();
+        if (value === "")
+            return null;
+    }
+    if (!VALUE_CHARS.test(value))
+        return null;
+    if (!parensBalanced(value))
+        return null;
+    // Every function token must be an allowed function — this is what closes
+    // url()/expression()/var()/image-set() without matching their literal names.
+    FUNCTION_NAME.lastIndex = 0;
+    let m = FUNCTION_NAME.exec(value);
+    while (m !== null) {
+        const fnName = m[1];
+        if (fnName === undefined || !ALLOWED_FUNCTIONS.has(fnName.toLowerCase()))
+            return null;
+        m = FUNCTION_NAME.exec(value);
+    }
+    if (prop === "position" && !ALLOWED_POSITION_VALUES.has(value.toLowerCase())) {
+        return null;
+    }
+    return value + important;
+}
+function sanitizeDeclarations(block) {
+    const out = [];
+    for (const part of block.split(";")) {
+        const decl = part.trim();
+        if (decl === "")
+            continue;
+        if (decl.includes("\\"))
+            continue;
+        const colon = decl.indexOf(":");
+        if (colon <= 0)
+            continue;
+        const prop = decl.slice(0, colon).trim().toLowerCase();
+        if (prop !== "position" && !ALLOWED_PROPERTIES.has(prop))
+            continue;
+        const value = sanitizeValue(prop, decl.slice(colon + 1));
+        if (value === null)
+            continue;
+        out.push(`${prop}: ${value}`);
+    }
+    return out.join("; ");
+}
+function sanitizeRule(rule, scope) {
+    const prelude = rule.prelude.trim();
+    if (prelude === "")
+        return null;
+    if (prelude.startsWith("@"))
+        return null; // no at-rules
+    if (prelude.includes("\\"))
+        return null; // escape-sequence bypass
+    const scoped = [];
+    for (const seg of splitTopLevel(prelude, ",")) {
+        const s = sanitizeSelector(seg, scope);
+        if (s === null)
+            return null; // any bad selector segment → drop the rule
+        scoped.push(s);
+    }
+    const decls = sanitizeDeclarations(rule.block);
+    if (decls === "")
+        return null;
+    return `${scoped.join(", ")} { ${decls} }`;
+}
+// Sanitize untrusted tenant CSS into a scoped, allowlisted stylesheet string
+// safe to drop into `<style>${...}</style>`. `scopeSelector` (e.g.
+// `[data-tenant-content]`) is prefixed onto every selector. Returns "" for
+// empty/over-cap/fully-rejected input — the caller emits no `<style>` block then.
+export function sanitizeTenantCss(css, scopeSelector) {
+    if (typeof css !== "string")
+        return "";
+    if (css.length === 0 || css.length > MAX_CSS_LENGTH)
+        return "";
+    const decommented = stripComments(css);
+    const out = [];
+    for (const rule of extractRules(decommented)) {
+        const s = sanitizeRule(rule, scopeSelector);
+        if (s !== null)
+            out.push(s);
+    }
+    const result = out.join("\n");
+    // Final breakout assert — reject any `<`, which is the only way to begin the
+    // `</style>` sequence that exits the RAWTEXT <style> element. `>` is left
+    // intact: it is a valid CSS child combinator and inert inside <style>.
+    if (result.includes("<"))
+        return "";
+    return result;
+}

package/dist/page-render/index.d.ts

@@ -0,0 +1,6 @@
+export { type BrandingTokens, brandingHeaderHtml, brandingStyleBlock, EMPTY_BRANDING, isSafeHexColor, isSafeHttpsUrl, layoutMaxWidth, } from "./branding.js";
+export { type CachedSecurePageResponseInit, cachedSecurePageResponse, } from "./cached-page-response.js";
+export { sanitizeTenantCss } from "./css-sanitize.js";
+export { type SeoHeadInput, TENANT_CONTENT_ATTR, tenantStyleBlock, wrapInLayout, } from "./layout.js";
+export { renderSafeMarkdown } from "./markdown.js";
+export { securePageHeaders } from "./security-headers.js";

package/dist/page-render/index.js

@@ -0,0 +1,6 @@
+export { brandingHeaderHtml, brandingStyleBlock, EMPTY_BRANDING, isSafeHexColor, isSafeHttpsUrl, layoutMaxWidth, } from "./branding.js";
+export { cachedSecurePageResponse, } from "./cached-page-response.js";
+export { sanitizeTenantCss } from "./css-sanitize.js";
+export { TENANT_CONTENT_ATTR, tenantStyleBlock, wrapInLayout, } from "./layout.js";
+export { renderSafeMarkdown } from "./markdown.js";
+export { securePageHeaders } from "./security-headers.js";

package/dist/page-render/layout.d.ts

@@ -0,0 +1,15 @@
+import { type ApexHead } from "@cosmicdrift/kumiko-headless/apex";
+import { type BrandingTokens } from "./branding.js";
+export type SeoHeadInput = Omit<ApexHead, "title" | "description" | "lang">;
+export declare const TENANT_CONTENT_ATTR = "data-tenant-content";
+export declare function tenantStyleBlock(customCss: string): string;
+export declare function wrapInLayout(opts: {
+    title: string;
+    bodyHtml: string;
+    lang: string;
+    description?: string | null;
+    branding?: BrandingTokens;
+    /** Adds Open Graph/Twitter/canonical/JSON-LD tags via the shared apex head
+     *  renderer. Omitted → unchanged minimal title+description behavior. */
+    seo?: SeoHeadInput;
+}): string;

package/dist/page-render/layout.js

@@ -0,0 +1,98 @@
+import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+import { renderApexHeadTags } from "@cosmicdrift/kumiko-headless/apex";
+import { brandingHeaderHtml, brandingStyleBlock } from "./branding.js";
+import { sanitizeTenantCss } from "./css-sanitize.js";
+// Attribute marking the content container. The page body lives in
+// `<main data-tenant-content>`; tenant custom CSS is scoped to its descendants
+// and host containment clips its paint to this box. A custom wrapLayout that
+// enables CSS-inject MUST put this attribute on the element wrapping the body
+// (e.g. `<main ${TENANT_CONTENT_ATTR}>`) and emit `tenantStyleBlock(branding.
+// customCss)` in <head> — otherwise tenant rules attach to nothing and the
+// containment is absent. Exported so the attr and the helper's internal scope
+// can't drift.
+export const TENANT_CONTENT_ATTR = "data-tenant-content";
+const TENANT_SCOPE = `[${TENANT_CONTENT_ATTR}]`;
+// Host-controlled containment, emitted together with (and only alongside)
+// tenant CSS. position+isolation box a tenant `position:absolute`/z-index to
+// the container; overflow:hidden clips tenant paint (negative margins,
+// transform, huge shadows, absolute children) off the host chrome. Tenant
+// rules are scoped descendants (`[data-tenant-content] X`) and can't match the
+// bare container, so they can't override either rule. No tenant CSS → neither
+// is emitted → plain/legal pages render unclipped (normal overflow for wide
+// tables/<pre>).
+const TENANT_CONTAINMENT = `${TENANT_SCOPE}{position:relative;isolation:isolate}`;
+const TENANT_CLIP = `${TENANT_SCOPE}{overflow:hidden}`;
+// Render the per-tenant custom-CSS <style> block — the single emission path for
+// the default skeleton below AND any custom wrapLayout. Returns "" when the
+// input is empty or fully rejected (no element). Otherwise one `<style
+// data-tenant-css>` carrying host containment + clip + the allowlist-sanitized,
+// scope-prefixed tenant rules. Bakes in the scope so a caller can't mis-scope
+// and silently lose containment; position:fixed/sticky are dropped upstream by
+// the sanitizer.
+export function tenantStyleBlock(customCss) {
+    const sanitized = sanitizeTenantCss(customCss, TENANT_SCOPE);
+    if (!sanitized)
+        return "";
+    // html-ok: sanitizeTenantCss ist die Escaping-Boundary (Allowlist, strippt `<`).
+    return `\n<style data-tenant-css>${TENANT_CONTAINMENT}\n${TENANT_CLIP}\n${sanitized}</style>`;
+}
+// Minimaler HTML5-Skeleton mit Inline-CSS — Default-`wrapLayout` für
+// server-gerenderte Public-Pages, damit sie auch ohne App-Layout sauber
+// aussehen. Apps die ihr eigenes Marketing-Layout (Header/Footer/Theme)
+// um den Body legen wollen, übergeben ihre eigene Render-Function.
+//
+// Branding (optional): emittiert nach dem Base-`<style>` einen scoped
+// `:root`-Override (Accent-Farbe, Layout-Preset → max-width) plus einen
+// Logo-/Titel-Header. Alle Branding-Werte sind tenant-supplied + untrusted
+// und werden in branding.ts re-validiert/escaped, bevor sie ins Markup gehen.
+export function wrapInLayout(opts) {
+    const themeStyleHtml = opts.branding ? brandingStyleBlock(opts.branding) : "";
+    const header = opts.branding ? brandingHeaderHtml(opts.branding) : "";
+    // Untrusted per-tenant CSS — scoped, allowlist-sanitized and host-contained
+    // at the render boundary by tenantStyleBlock (same helper a custom wrapLayout
+    // calls, so containment can't drift between the two paths). Empty/rejected →
+    // no block, plain/legal pages keep normal overflow.
+    const tenantStyle = tenantStyleBlock(opts.branding?.customCss ?? "");
+    // Page description wins; the tenant's branding description is the site-wide
+    // fallback when a page omits its own (keeps branding-description a live key).
+    const description = opts.description && opts.description.length > 0
+        ? opts.description
+        : (opts.branding?.description ?? "");
+    const metaDescription = description
+        ? `\n<meta name="description" content="${escapeHtmlAttr(description)}">`
+        : "";
+    // Without `seo`: identical title+description emission as before (no
+    // behavior change for legal-pages/managed-pages callers that don't pass it).
+    const headHtml = opts.seo
+        ? renderApexHeadTags({ title: opts.title, description, lang: opts.lang, ...opts.seo })
+        : `<title>${escapeHtml(opts.title)}</title>${metaDescription}`;
+    return `<!doctype html>
+<html lang="${escapeHtmlAttr(opts.lang)}">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+${headHtml}
+<style>
+  :root { --accent: #0066cc; --page-max-width: 720px; }
+  body { font-family: system-ui, -apple-system, sans-serif; max-width: var(--page-max-width);
+         margin: 2rem auto; padding: 0 1rem; line-height: 1.6; color: #222; }
+  h1, h2, h3 { line-height: 1.2; margin-top: 2rem; }
+  h1 { font-size: 1.8rem; } h2 { font-size: 1.4rem; } h3 { font-size: 1.15rem; }
+  a { color: var(--accent); }
+  code { background: #f4f4f4; padding: 0.1rem 0.3rem; border-radius: 3px; }
+  hr { border: 0; border-top: 1px solid #ddd; margin: 2rem 0; }
+  .brand-header { position: relative; z-index: 1; display: flex; align-items: center;
+                  gap: 0.6rem; margin-bottom: 1.5rem; }
+  .brand-header a { display: flex; align-items: center; gap: 0.6rem; color: inherit; text-decoration: none; }
+  .brand-logo { height: 2rem; width: auto; }
+  .brand-title { font-weight: 600; font-size: 1.1rem; }
+</style>${themeStyleHtml}${tenantStyle}
+</head>
+<body>
+${header}
+<main data-tenant-content>
+${opts.bodyHtml}
+</main>
+</body>
+</html>`;
+}

package/dist/page-render/markdown.d.ts

@@ -0,0 +1 @@
+export declare function renderSafeMarkdown(markdown: string): string;

package/dist/page-render/markdown.js

@@ -0,0 +1,29 @@
+import { escapeHtml, isSafeHref } from "@cosmicdrift/kumiko-headless";
+import { Marked } from "marked";
+// Geteilter, gehärteter Markdown→HTML-Kern für server-gerenderte Public-
+// Pages (legal-pages, managed-pages). Annahme: untrusted Tenant-Authoren.
+// Raw-HTML-Tokens werden als Text escaped (kein <script>/<img onerror>-
+// Passthrough), und link/image-hrefs auf http(s)/mailto/relativ beschränkt
+// (kein javascript:/data:). Markdown-Struktur (Headings, Listen, Links,
+// Code) bleibt intakt — das neutralisiert die XSS-Vektoren ohne Sanitizer-
+// Dependency. Defense-in-Depth ergänzt `securePageHeaders` (`script-src
+// 'none'`). GFM aus, breaks aus — strukturierte Pages brauchen keine
+// Tables/Strikethrough/Task-Lists.
+const safeRenderer = new Marked({ gfm: false, breaks: false });
+safeRenderer.use({
+    walkTokens(token) {
+        if ((token.type === "link" || token.type === "image") && !isSafeHref(token.href)) {
+            token.href = "#";
+        }
+    },
+    renderer: {
+        html({ text }) {
+            return escapeHtml(text);
+        },
+    },
+});
+export function renderSafeMarkdown(markdown) {
+    // @cast-boundary marked.parse return-type ist `string | Promise<string>`;
+    // `{ async: false }` garantiert sync (string) — Cast nur API-Vertragsfix.
+    return safeRenderer.parse(markdown, { async: false });
+}

package/dist/page-render/security-headers.d.ts

@@ -0,0 +1 @@
+export declare function securePageHeaders(extra: Record<string, string>): Record<string, string>;

package/dist/page-render/security-headers.js

@@ -0,0 +1,18 @@
+// Security-Header für server-gerenderte Public-HTML-Pages (legal-pages,
+// managed-pages). `script-src 'none'` ist Defense-in-Depth: selbst wenn
+// HTML-Injection durchrutscht, läuft kein Script. Bewusst KEIN `default-src`
+// → Styles/Images/Fonts bleiben unrestricted (rückwärtskompatibel zu
+// Inline-<style>-Layouts wie publicstatus' renderLegalLayout).
+// nosniff/SAMEORIGIN/Referrer-Policy sind universell sichere Defaults.
+const PUBLIC_PAGE_SECURITY_HEADERS = {
+    "content-security-policy": "script-src 'none'; object-src 'none'; base-uri 'none'",
+    "x-content-type-options": "nosniff",
+    "x-frame-options": "SAMEORIGIN",
+    "referrer-policy": "strict-origin-when-cross-origin",
+};
+// Security headers spread LAST so a caller's `extra` can never override a
+// hardened default (CSP/nosniff/frame-options); extra only adds non-security
+// headers like content-type/cache-control/vary.
+export function securePageHeaders(extra) {
+    return { ...extra, ...PUBLIC_PAGE_SECURITY_HEADERS };
+}

package/dist/page-render/web.d.ts

@@ -0,0 +1,5 @@
+export { type BrandingTokens, brandingHeaderHtml, brandingStyleBlock, EMPTY_BRANDING, isSafeHexColor, isSafeHttpsUrl, layoutMaxWidth, } from "./branding.js";
+export { sanitizeTenantCss } from "./css-sanitize.js";
+export { TENANT_CONTENT_ATTR, tenantStyleBlock, wrapInLayout } from "./layout.js";
+export { renderSafeMarkdown } from "./markdown.js";
+export { securePageHeaders } from "./security-headers.js";

package/dist/page-render/web.js

@@ -0,0 +1,6 @@
+// kumiko-lint-ignore app-feature-structure Server-side re-export barrel (branding/sanitize helpers), not a client screen — name collision with the web.ts monolith heuristic
+export { brandingHeaderHtml, brandingStyleBlock, EMPTY_BRANDING, isSafeHexColor, isSafeHttpsUrl, layoutMaxWidth, } from "./branding.js";
+export { sanitizeTenantCss } from "./css-sanitize.js";
+export { TENANT_CONTENT_ATTR, tenantStyleBlock, wrapInLayout } from "./layout.js";
+export { renderSafeMarkdown } from "./markdown.js";
+export { securePageHeaders } from "./security-headers.js";

package/dist/personal-access-tokens/constants.d.ts

@@ -0,0 +1,22 @@
+export declare const PAT_FEATURE = "personal-access-tokens";
+export declare const PatErrors: {
+    readonly ownershipDenied: "ownership_denied";
+    readonly reauthRequired: "reauth_required";
+};
+export declare const PAT_DEFAULT_EXPIRES_IN_DAYS = 90;
+export declare const PAT_SCREEN_ID = "api-tokens";
+export declare const PAT_MINT_SCREEN_ID = "api-token-create";
+export declare const PatHandlers: {
+    readonly create: "personal-access-tokens:write:create";
+    readonly revoke: "personal-access-tokens:write:revoke";
+};
+export declare const PatQueries: {
+    readonly mine: "personal-access-tokens:query:mine";
+    readonly availableScopes: "personal-access-tokens:query:available-scopes";
+};
+export declare const PAT_PREFIX_DISPLAY_LENGTH = 12;
+export type PatRateLimit = {
+    readonly maxRequests: number;
+    readonly windowMs: number;
+};
+export declare const PAT_DEFAULT_RATE_LIMIT: PatRateLimit;

package/dist/personal-access-tokens/constants.js

@@ -0,0 +1,34 @@
+// @runtime client
+// Pure constants — client-marked so the web screen (web/) may import screen-id
+// and QN names without pulling the feature's server runtime barrel.
+export const PAT_FEATURE = "personal-access-tokens";
+// Snake_case reason strings (Error-Reasons guard: no colons/dashes).
+export const PatErrors = {
+    ownershipDenied: "ownership_denied",
+    // Uniform for wrong-password AND missing/wrong MFA code — a distinct
+    // reason per case would leak whether the account has MFA enrolled.
+    reauthRequired: "reauth_required",
+};
+// expiresInDays default when omitted at mint time. A silent "never expires"
+// default is a standing-credential risk; the existing 3650-day cap still
+// lets callers who genuinely want a long-lived token pass it explicitly.
+export const PAT_DEFAULT_EXPIRES_IN_DAYS = 90;
+// Declarative projectionList screen id — the caller's own tokens, revoke as a
+// row action. The app places it via r.nav.
+export const PAT_SCREEN_ID = "api-tokens";
+// Declarative secretMint screen id — mints a new token, reveals it once.
+export const PAT_MINT_SCREEN_ID = "api-token-create";
+export const PatHandlers = {
+    create: "personal-access-tokens:write:create",
+    revoke: "personal-access-tokens:write:revoke",
+};
+export const PatQueries = {
+    mine: "personal-access-tokens:query:mine",
+    availableScopes: "personal-access-tokens:query:available-scopes",
+};
+// Only the first chars of a minted token are stored (alongside the hash) so the
+// UI can show "kpat_ab12…" for recognition without ever holding the secret.
+export const PAT_PREFIX_DISPLAY_LENGTH = 12;
+// Default per-token request rate for PAT-authenticated calls. Generous enough
+// for normal automation, low enough to blunt a leaked-token abuse spike.
+export const PAT_DEFAULT_RATE_LIMIT = { maxRequests: 120, windowMs: 60_000 };

package/dist/personal-access-tokens/expiry.d.ts

@@ -0,0 +1,3 @@
+export declare function isExpiredAt(expiresAt: {
+    epochMilliseconds: number;
+} | null): boolean;

package/dist/personal-access-tokens/expiry.js

@@ -0,0 +1,4 @@
+import { Temporal } from "temporal-polyfill";
+export function isExpiredAt(expiresAt) {
+    return (expiresAt !== null && expiresAt.epochMilliseconds <= Temporal.Now.instant().epochMilliseconds);
+}

package/dist/personal-access-tokens/feature.d.ts

@@ -0,0 +1,23 @@
+import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { type PatRateLimit } from "./constants.js";
+import { type CreatePatOptions } from "./handlers/create.write.js";
+import type { PatScopeConfig } from "./scopes.js";
+export type BindPatAutoRevokeOnPasswordChange = (revoker: (userId: string) => Promise<number>) => void;
+export declare function bindPatAutoRevokeOnPasswordChangeFromFeature(feature: FeatureDefinition): BindPatAutoRevokeOnPasswordChange | undefined;
+export type PersonalAccessTokensOptions = {
+    readonly scopes: PatScopeConfig;
+    readonly rateLimit?: PatRateLimit;
+    /** Make the whole feature tier-gatable via the tier-engine. Use
+     *  { default: false } for fail-closed gating (feature off until a tier grants
+     *  it). Omit to keep PAT always-on (default). */
+    readonly toggleable?: {
+        readonly default: boolean;
+    };
+    readonly mfaVerifier?: CreatePatOptions["mfaVerifier"];
+    readonly autoRevokeOnPasswordChange?: (userId: string) => Promise<number>;
+};
+export type PatFeatureExports = {
+    readonly rateLimit: PatRateLimit;
+    readonly bindAutoRevokeOnPasswordChange: BindPatAutoRevokeOnPasswordChange;
+};
+export declare function createPersonalAccessTokensFeature(options: PersonalAccessTokensOptions): FeatureDefinition;