@devorash/core 0.1.0

package/dist/constants/index.js

@@ -0,0 +1,236 @@
+/**
+ * Constants for Devora SDKs
+ * @module @devorash/core/constants
+ */
+// ============================================================================
+// API Endpoints
+// ============================================================================
+/**
+ * Predefined endpoint constants for Devora SDK integration.
+ * Using these constants ensures:
+ * - Typo prevention (/impersonation vs /impersonate)
+ * - Automatic HTTP method detection
+ * - IDE autocomplete and documentation
+ * - Consistency across all customer integrations
+ */
+export const DEVORA_ENDPOINTS = {
+    /**
+     * User search endpoint - allows Devora to search customer's users
+     * @method GET
+     * @path /user/search
+     * @query term - Search term (name, email, or user ID)
+     */
+    USER_SEARCH: "/user/search",
+    /**
+     * Get user by ID endpoint - retrieves a specific user's details
+     * @method GET
+     * @path /user/:id
+     * @params id - User ID to look up
+     */
+    USER_BY_ID: "/user/:id",
+    /**
+     * Impersonation start endpoint - generates auth token for session
+     * @method POST
+     * @path /impersonate/:id
+     * @params id - Target user ID to impersonate
+     */
+    IMPERSONATE: "/impersonate/:id",
+    /**
+     * Session termination endpoint - revokes impersonation session
+     * @method DELETE
+     * @path /impersonate/:id/terminate
+     * @params id - Session ID to terminate
+     */
+    TERMINATE: "/impersonate/:id/terminate",
+    /**
+     * Connection test endpoint - validates SDK setup (built-in)
+     * @method GET
+     * @path /test
+     * @internal This endpoint is automatically provided by the SDK
+     */
+    TEST: "/test",
+    /**
+     * Health check endpoint - SDK health and metrics (built-in)
+     * @method GET
+     * @path /health
+     * @internal This endpoint is automatically provided by the SDK
+     */
+    HEALTH: "/health",
+};
+/**
+ * HTTP methods for each endpoint (auto-detected when using constants)
+ */
+export const ENDPOINT_METHODS = {
+    [DEVORA_ENDPOINTS.USER_SEARCH]: "GET",
+    [DEVORA_ENDPOINTS.USER_BY_ID]: "GET",
+    [DEVORA_ENDPOINTS.IMPERSONATE]: "POST",
+    [DEVORA_ENDPOINTS.TERMINATE]: "DELETE",
+    [DEVORA_ENDPOINTS.TEST]: "GET",
+    [DEVORA_ENDPOINTS.HEALTH]: "GET",
+};
+/**
+ * Built-in endpoints that cannot be overridden
+ */
+export const PROTECTED_ENDPOINTS = [
+    DEVORA_ENDPOINTS.TEST,
+    DEVORA_ENDPOINTS.HEALTH,
+];
+// ============================================================================
+// Security Headers
+// ============================================================================
+/**
+ * HTTP headers used for HMAC authentication
+ */
+export const SECURITY_HEADERS = {
+    /** HMAC-SHA256 signature (hex encoded) */
+    SIGNATURE: "x-devora-signature",
+    /** Unix timestamp in seconds when request was sent */
+    SENT_AT: "x-devora-sent-at",
+    /** API Key ID (public identifier) */
+    KEY_ID: "x-devora-key-id",
+    /** Organization ID */
+    ORG_ID: "x-devora-org-id",
+    /** Unique request identifier used for replay prevention */
+    REQUEST_ID: "x-devora-request-id",
+    /** Signature payload version */
+    SIGNATURE_VERSION: "x-devora-signature-version",
+    /** Session ID (for impersonation requests) */
+    SESSION_ID: "x-devora-session-id",
+};
+/**
+ * Frontend SDK headers
+ */
+export const FRONTEND_HEADERS = {
+    /** Client API Key */
+    API_KEY: "x-devora-key",
+    /** Session ID */
+    SESSION: "x-devora-session",
+    /** Short-lived impersonation-session bearer token (never the customer auth token). */
+    SESSION_TOKEN: "x-devora-session-token",
+};
+// ============================================================================
+// URL Parameters
+// ============================================================================
+/**
+ * URL parameters used for impersonation payload passing
+ */
+/**
+ * Browser-session bridge: the customer route the browser SDK calls to restore
+ * an impersonation session in a new tab. Always allowed by the scope guards
+ * because it only mints a Devora resume code for an already-authenticated
+ * customer session.
+ */
+export const BROWSER_SESSION_BRIDGE = {
+    /** Default customer route path. */
+    PATH: "/api/devora/browser-session",
+    /** Devora endpoint the customer backend calls with a signed server request. */
+    RESUME_CODE_ENDPOINT: "/api/sdk/browser-resume-code",
+    /** Devora endpoint the browser calls to redeem the code for its own capability. */
+    RESUME_ENDPOINT: "/api/sdk/browser-resume",
+    /** Non-secret per-tab identifier shape (also stored in sessionStorage). */
+    TAB_REF_PATTERN: /^[A-Za-z0-9_-]{4,96}$/,
+};
+export const URL_PARAMS = {
+    /** One-time code exchanged for the encrypted impersonation payload */
+    EXCHANGE_CODE: "devora_exchange",
+};
+// ============================================================================
+// Default Configuration
+// ============================================================================
+import { DEVORA_API_ORIGIN, DEVORA_DASHBOARD_ORIGIN } from "./api-url.gen.js";
+/**
+ * Default SDK configuration values
+ */
+export const SDK_DEFAULTS = {
+    /** Devora API origin baked into the SDK package at build time. */
+    API_URL: DEVORA_API_ORIGIN,
+    /**
+     * The Devora dashboard origin, baked in at build time. Only a tab at this
+     * origin (or, for a customer app on loopback, a loopback dashboard) may hand
+     * an exchange verifier to the browser SDK.
+     */
+    DASHBOARD_ORIGIN: DEVORA_DASHBOARD_ORIGIN,
+    /** Timestamp tolerance in seconds (5 minutes) */
+    TIMESTAMP_TOLERANCE: 300,
+    /** Log batch size before flush */
+    LOG_BATCH_SIZE: 10,
+    /** Log flush interval in milliseconds (5 seconds) */
+    LOG_FLUSH_INTERVAL: 5000,
+    /** Maximum log queue size */
+    MAX_LOG_QUEUE_SIZE: 100,
+};
+// ============================================================================
+// SDK Metadata
+// ============================================================================
+/**
+ * SDK package names
+ */
+export const SDK_PACKAGES = {
+    CORE: "@devorash/core",
+    NODE: "@devorash/node",
+    BROWSER: "@devorash/browser",
+    EXPRESS: "@devorash/express",
+    HONO: "@devorash/hono",
+    FASTIFY: "@devorash/fastify",
+    REACT: "@devorash/react",
+    VUE: "@devorash/vue",
+    SVELTE: "@devorash/svelte",
+    SOLID: "@devorash/solid",
+    NEXT: "@devorash/nextjs",
+};
+/**
+ * Current SDK version (synced across all packages)
+ */
+export const SDK_VERSION = "0.1.0";
+// ============================================================================
+// Error Codes
+// ============================================================================
+/**
+ * SDK error codes
+ */
+export const ERROR_CODES = {
+    // Security errors (1xx)
+    MISSING_HEADERS: "DEVORA_101",
+    INVALID_TIMESTAMP: "DEVORA_102",
+    TIMESTAMP_EXPIRED: "DEVORA_103",
+    INVALID_SIGNATURE: "DEVORA_104",
+    ORG_MISMATCH: "DEVORA_105",
+    KEY_NOT_FOUND: "DEVORA_106",
+    KEY_REVOKED: "DEVORA_107",
+    MISSING_SIGNATURE: "DEVORA_108",
+    // Validation errors (2xx)
+    INVALID_CONFIG: "DEVORA_201",
+    MISSING_ENDPOINT: "DEVORA_202",
+    INVALID_HANDLER: "DEVORA_203",
+    DUPLICATE_ENDPOINT: "DEVORA_204",
+    BODY_TOO_LARGE: "DEVORA_205",
+    INVALID_API_KEY: "DEVORA_206",
+    INVALID_ORG_ID: "DEVORA_207",
+    // Runtime errors (3xx)
+    HANDLER_ERROR: "DEVORA_301",
+    NETWORK_ERROR: "DEVORA_302",
+    SESSION_EXPIRED: "DEVORA_303",
+    TOKEN_CONSUMED: "DEVORA_304",
+    // Scope errors (4xx)
+    SCOPE_VIOLATION: "DEVORA_401",
+    WRITE_BLOCKED: "DEVORA_402",
+    // Rate limiting errors (5xx)
+    RATE_LIMITED: "DEVORA_501",
+    TOO_MANY_REQUESTS: "DEVORA_502",
+};
+// ============================================================================
+// HTTP Methods
+// ============================================================================
+/**
+ * HTTP methods considered as write operations (blocked in read-only mode)
+ */
+export const WRITE_METHODS = ["POST", "PUT", "DELETE", "PATCH"];
+/**
+ * HTTP methods considered as read operations (allowed in read-only mode)
+ */
+export const READ_METHODS = ["GET", "HEAD", "OPTIONS"];
+// ============================================================================
+// Session Lifecycle
+// ============================================================================
+export * from "./sessionLifecycle.js";
+//# sourceMappingURL=index.js.map

package/dist/constants/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/constants/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,+EAA+E;AAC/E,gBAAgB;AAChB,+EAA+E;AAE/E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC/B;;;;;OAKG;IACH,WAAW,EAAE,cAAc;IAE3B;;;;;OAKG;IACH,UAAU,EAAE,WAAW;IAEvB;;;;;OAKG;IACH,WAAW,EAAE,kBAAkB;IAE/B;;;;;OAKG;IACH,SAAS,EAAE,4BAA4B;IAEvC;;;;;OAKG;IACH,IAAI,EAAE,OAAO;IAEb;;;;;OAKG;IACH,MAAM,EAAE,SAAS;CACR,CAAA;AAQV;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA0D;IACtF,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,KAAK;IACrC,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,KAAK;IACpC,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,MAAM;IACtC,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,QAAQ;IACtC,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,KAAK;IAC9B,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,KAAK;CAChC,CAAA;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAkC;IACjE,gBAAgB,CAAC,IAAI;IACrB,gBAAgB,CAAC,MAAM;CACvB,CAAA;AAED,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC/B,0CAA0C;IAC1C,SAAS,EAAE,oBAAoB;IAC/B,sDAAsD;IACtD,OAAO,EAAE,kBAAkB;IAC3B,qCAAqC;IACrC,MAAM,EAAE,iBAAiB;IACzB,sBAAsB;IACtB,MAAM,EAAE,iBAAiB;IACzB,2DAA2D;IAC3D,UAAU,EAAE,qBAAqB;IACjC,gCAAgC;IAChC,iBAAiB,EAAE,4BAA4B;IAC/C,8CAA8C;IAC9C,UAAU,EAAE,qBAAqB;CACxB,CAAA;AAEV;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC/B,qBAAqB;IACrB,OAAO,EAAE,cAAc;IACvB,iBAAiB;IACjB,OAAO,EAAE,kBAAkB;IAC3B,sFAAsF;IACtF,aAAa,EAAE,wBAAwB;CAC9B,CAAA;AAEV,+EAA+E;AAC/E,iBAAiB;AACjB,+EAA+E;AAE/E;;GAEG;AACH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACrC,mCAAmC;IACnC,IAAI,EAAE,6BAA6B;IACnC,+EAA+E;IAC/E,oBAAoB,EAAE,8BAA8B;IACpD,mFAAmF;IACnF,eAAe,EAAE,yBAAyB;IAC1C,2EAA2E;IAC3E,eAAe,EAAE,uBAAuB;CAC/B,CAAA;AAEV,MAAM,CAAC,MAAM,UAAU,GAAG;IACzB,sEAAsE;IACtE,aAAa,EAAE,iBAAiB;CACvB,CAAA;AAEV,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AAE7E;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC3B,kEAAkE;IAClE,OAAO,EAAE,iBAAiB;IAC1B;;;;OAIG;IACH,gBAAgB,EAAE,uBAAuB;IACzC,iDAAiD;IACjD,mBAAmB,EAAE,GAAG;IACxB,kCAAkC;IAClC,cAAc,EAAE,EAAE;IAClB,qDAAqD;IACrD,kBAAkB,EAAE,IAAI;IACxB,6BAA6B;IAC7B,kBAAkB,EAAE,GAAG;CACd,CAAA;AAEV,+EAA+E;AAC/E,eAAe;AACf,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC3B,IAAI,EAAE,gBAAgB;IACtB,IAAI,EAAE,gBAAgB;IACtB,OAAO,EAAE,mBAAmB;IAC5B,OAAO,EAAE,mBAAmB;IAC5B,IAAI,EAAE,gBAAgB;IACtB,OAAO,EAAE,mBAAmB;IAC5B,KAAK,EAAE,iBAAiB;IACxB,GAAG,EAAE,eAAe;IACpB,MAAM,EAAE,kBAAkB;IAC1B,KAAK,EAAE,iBAAiB;IACxB,IAAI,EAAE,kBAAkB;CACf,CAAA;AAEV;;GAEG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAA;AAElC,+EAA+E;AAC/E,cAAc;AACd,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IAC1B,wBAAwB;IACxB,eAAe,EAAE,YAAY;IAC7B,iBAAiB,EAAE,YAAY;IAC/B,iBAAiB,EAAE,YAAY;IAC/B,iBAAiB,EAAE,YAAY;IAC/B,YAAY,EAAE,YAAY;IAC1B,aAAa,EAAE,YAAY;IAC3B,WAAW,EAAE,YAAY;IACzB,iBAAiB,EAAE,YAAY;IAE/B,0BAA0B;IAC1B,cAAc,EAAE,YAAY;IAC5B,gBAAgB,EAAE,YAAY;IAC9B,eAAe,EAAE,YAAY;IAC7B,kBAAkB,EAAE,YAAY;IAChC,cAAc,EAAE,YAAY;IAC5B,eAAe,EAAE,YAAY;IAC7B,cAAc,EAAE,YAAY;IAE5B,uBAAuB;IACvB,aAAa,EAAE,YAAY;IAC3B,aAAa,EAAE,YAAY;IAC3B,eAAe,EAAE,YAAY;IAC7B,cAAc,EAAE,YAAY;IAE5B,qBAAqB;IACrB,eAAe,EAAE,YAAY;IAC7B,aAAa,EAAE,YAAY;IAE3B,6BAA6B;IAC7B,YAAY,EAAE,YAAY;IAC1B,iBAAiB,EAAE,YAAY;CACtB,CAAA;AAIV,+EAA+E;AAC/E,eAAe;AACf,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAU,CAAA;AAExE;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAU,CAAA;AAK/D,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E,cAAc,uBAAuB,CAAA"}

package/dist/constants/sessionLifecycle.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Session Lifecycle Constants for SDK
+ *
+ * These constants are used by the frontend SDK when ending sessions.
+ * They match the backend expectations.
+ */
+/**
+ * Reasons the SDK can send when ending a session.
+ * These are mapped by the backend to EndReason values.
+ */
+export declare const SDK_END_REASON: {
+    /** User clicked the "End Session" button in the customer app */
+    readonly USER_ENDED: "user_ended";
+    /** Frontend timer detected that the session has expired */
+    readonly EXPIRED: "expired";
+    /** Session was terminated externally (detected via validation check) */
+    readonly TERMINATED_EXTERNALLY: "terminated_externally";
+    /** Page is being unloaded (beforeunload event) */
+    readonly PAGE_UNLOAD: "page_unload";
+};
+export type SDKEndReason = (typeof SDK_END_REASON)[keyof typeof SDK_END_REASON];
+//# sourceMappingURL=sessionLifecycle.d.ts.map

package/dist/constants/sessionLifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionLifecycle.d.ts","sourceRoot":"","sources":["../../src/constants/sessionLifecycle.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;GAGG;AACH,eAAO,MAAM,cAAc;IAC1B,gEAAgE;;IAEhE,2DAA2D;;IAE3D,wEAAwE;;IAExE,kDAAkD;;CAEzC,CAAA;AAEV,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,CAAA"}

package/dist/constants/sessionLifecycle.js

@@ -0,0 +1,21 @@
+/**
+ * Session Lifecycle Constants for SDK
+ *
+ * These constants are used by the frontend SDK when ending sessions.
+ * They match the backend expectations.
+ */
+/**
+ * Reasons the SDK can send when ending a session.
+ * These are mapped by the backend to EndReason values.
+ */
+export const SDK_END_REASON = {
+    /** User clicked the "End Session" button in the customer app */
+    USER_ENDED: "user_ended",
+    /** Frontend timer detected that the session has expired */
+    EXPIRED: "expired",
+    /** Session was terminated externally (detected via validation check) */
+    TERMINATED_EXTERNALLY: "terminated_externally",
+    /** Page is being unloaded (beforeunload event) */
+    PAGE_UNLOAD: "page_unload",
+};
+//# sourceMappingURL=sessionLifecycle.js.map

package/dist/constants/sessionLifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionLifecycle.js","sourceRoot":"","sources":["../../src/constants/sessionLifecycle.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC7B,gEAAgE;IAChE,UAAU,EAAE,YAAY;IACxB,2DAA2D;IAC3D,OAAO,EAAE,SAAS;IAClB,wEAAwE;IACxE,qBAAqB,EAAE,uBAAuB;IAC9C,kDAAkD;IAClD,WAAW,EAAE,aAAa;CACjB,CAAA"}

package/dist/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Devora SDK Core
+ * Shared types, constants, and utilities for all Devora SDKs
+ *
+ * @packageDocumentation
+ * @module @devorash/core
+ */
+export type { DevoraRequest, DevoraResponse, DevoraUser, UserSearchRequest, UserSearchResponse, ImpersonationScope, ImpersonationDuration, DevoraImpersonationContext, ImpersonationStartRequest, ImpersonationStartResponse, ImpersonationTerminateRequest, ImpersonationTerminateResponse, ImpersonationUserInfo, ImpersonatePayload, ImpersonateCallback, SessionEndCallback, FrontendSDKConfig, ErrorHandlers, PayloadError, ScopeViolation, DevoraMaskingProfile, DevoraCapturePolicy, DevoraCaptureSnapshot, BackendSDKConfig, RouteHandler, RouteDefinition, LogEventType, LogEvent, SDKInfo, HealthCheckResponse, ConnectionTestResponse, SessionBridgeResult, BrowserResumeCode, } from "./types/index.js";
+export { DEVORA_PRIVACY_MARKERS } from "./types/index.js";
+export { DEVORA_ENDPOINTS, ENDPOINT_METHODS, PROTECTED_ENDPOINTS, type DevoraEndpointKey, type DevoraEndpointPath, SECURITY_HEADERS, FRONTEND_HEADERS, URL_PARAMS, BROWSER_SESSION_BRIDGE, SDK_DEFAULTS, SDK_PACKAGES, SDK_VERSION, ERROR_CODES, type DevoraErrorCode, WRITE_METHODS, READ_METHODS, type WriteMethod, type ReadMethod, SDK_END_REASON, type SDKEndReason, } from "./constants/index.js";
+export { validateTimestamp, isValidTimestampTolerance, assertTimestampTolerance, isWriteMethod, matchEndpointPattern, normalizeRequestPath, isAmbiguousRequestPath, getRawRequestPath, METHOD_OVERRIDE_HEADERS, getPolicyMethods, getDenyMethods, joinMountedTarget, createBlockedResponse, generateRandomString, arrayBufferToHex, hexToArrayBuffer, DevoraSDKError, DevoraSecurityError, DevoraValidationError, DevoraConfigError, DevoraNetworkError, } from "./security/index.js";
+export { SIGNING, SIGNED_HEADER_PATTERNS, strictEncode, encodePathParam, buildStrictQuery, isValidSignedPath, isValidSignedQuery, buildCanonicalString, getSingleHeader, parseSignatureHeaders, hasIdentityContentEncoding, replayNamespace, replayExpiresAtMs, parseVerifiedQuery, parseVerifiedJsonBody, routeRelativePath, type SigningDirection, type SignatureErrorCode, type HeaderMap, type SignatureHeaders, type SignatureHeaderResult, type CanonicalFields, type VerifiedBodyResult, } from "./security/signing.js";
+export { createSuccessResponse, createErrorResponse, extractUrlParams, cleanImpersonationParams, matchPath, extractPathParams, getHeaderValue, getErrorStatusCode, RateLimiter, scopeAllowsWrite, getScopeDescription, createLogEvent, createSDKInfo, LogLevel, configureLogger, getLoggerConfig, resetLoggerConfig, createLogger, type LoggerConfig, type LogHandler, type Logger, validateApiKeyFormat, validateOrgIdFormat, safeJsonParse, safeJsonStringify, deepFreeze, createDeferred, } from "./utils/index.js";
+export { readBoundedBody, readBoundedBytes, BodyReadError } from "./security/request-body.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,YAAY,EAEX,aAAa,EACb,cAAc,EAEd,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAElB,kBAAkB,EAClB,qBAAqB,EACrB,0BAA0B,EAC1B,yBAAyB,EACzB,0BAA0B,EAC1B,6BAA6B,EAC7B,8BAA8B,EAE9B,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,aAAa,EACb,YAAY,EACZ,cAAc,EAEd,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EAErB,gBAAgB,EAChB,YAAY,EACZ,eAAe,EAEf,YAAY,EACZ,QAAQ,EAER,OAAO,EACP,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,iBAAiB,GACjB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAMzD,OAAO,EAEN,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EAEvB,gBAAgB,EAChB,gBAAgB,EAEhB,UAAU,EACV,sBAAsB,EAEtB,YAAY,EAEZ,YAAY,EACZ,WAAW,EAEX,WAAW,EACX,KAAK,eAAe,EAEpB,aAAa,EACb,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,UAAU,EAEf,cAAc,EACd,KAAK,YAAY,GACjB,MAAM,sBAAsB,CAAA;AAM7B,OAAO,EAEN,iBAAiB,EACjB,yBAAyB,EACzB,wBAAwB,EAExB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,EACjB,uBAAuB,EACvB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EAErB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAEhB,cAAc,EACd,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,GAClB,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EACN,OAAO,EACP,sBAAsB,EACtB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,qBAAqB,EACrB,0BAA0B,EAC1B,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,kBAAkB,GACvB,MAAM,uBAAuB,CAAA;AAM9B,OAAO,EAEN,qBAAqB,EACrB,mBAAmB,EAEnB,gBAAgB,EAChB,wBAAwB,EAExB,SAAS,EACT,iBAAiB,EAGjB,cAAc,EACd,kBAAkB,EAGlB,WAAW,EAEX,gBAAgB,EAChB,mBAAmB,EAEnB,cAAc,EAEd,aAAa,EAEb,QAAQ,EACR,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,YAAY,EACZ,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,MAAM,EAEX,oBAAoB,EACpB,mBAAmB,EAEnB,aAAa,EACb,iBAAiB,EACjB,UAAU,EACV,cAAc,GACd,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA"}

package/dist/index.js

@@ -0,0 +1,72 @@
+/**
+ * Devora SDK Core
+ * Shared types, constants, and utilities for all Devora SDKs
+ *
+ * @packageDocumentation
+ * @module @devorash/core
+ */
+export { DEVORA_PRIVACY_MARKERS } from "./types/index.js";
+// ============================================================================
+// Constants
+// ============================================================================
+export { 
+// Endpoints
+DEVORA_ENDPOINTS, ENDPOINT_METHODS, PROTECTED_ENDPOINTS, 
+// Headers
+SECURITY_HEADERS, FRONTEND_HEADERS, 
+// URL & Storage
+URL_PARAMS, BROWSER_SESSION_BRIDGE, 
+// Defaults
+SDK_DEFAULTS, 
+// Metadata
+SDK_PACKAGES, SDK_VERSION, 
+// Error codes
+ERROR_CODES, 
+// HTTP Methods
+WRITE_METHODS, READ_METHODS, 
+// Session Lifecycle
+SDK_END_REASON, } from "./constants/index.js";
+// ============================================================================
+// Security
+// ============================================================================
+export { 
+// Timestamps
+validateTimestamp, isValidTimestampTolerance, assertTimestampTolerance, 
+// Scope
+isWriteMethod, matchEndpointPattern, normalizeRequestPath, isAmbiguousRequestPath, getRawRequestPath, METHOD_OVERRIDE_HEADERS, getPolicyMethods, getDenyMethods, joinMountedTarget, createBlockedResponse, 
+// Tokens
+generateRandomString, arrayBufferToHex, hexToArrayBuffer, 
+// Errors
+DevoraSDKError, DevoraSecurityError, DevoraValidationError, DevoraConfigError, DevoraNetworkError, } from "./security/index.js";
+// Request signing (v3)
+export { SIGNING, SIGNED_HEADER_PATTERNS, strictEncode, encodePathParam, buildStrictQuery, isValidSignedPath, isValidSignedQuery, buildCanonicalString, getSingleHeader, parseSignatureHeaders, hasIdentityContentEncoding, replayNamespace, replayExpiresAtMs, parseVerifiedQuery, parseVerifiedJsonBody, routeRelativePath, } from "./security/signing.js";
+// ============================================================================
+// Utilities
+// ============================================================================
+export { 
+// Response helpers
+createSuccessResponse, createErrorResponse, 
+// URL helpers
+extractUrlParams, cleanImpersonationParams, 
+// Path matching
+matchPath, extractPathParams, 
+// Query string
+// Header utilities
+getHeaderValue, getErrorStatusCode, 
+// Request canonicalization (for HMAC)
+// Rate limiting
+RateLimiter, 
+// Scope helpers
+scopeAllowsWrite, getScopeDescription, 
+// Logging
+createLogEvent, 
+// SDK info
+createSDKInfo, 
+// Logger service
+LogLevel, configureLogger, getLoggerConfig, resetLoggerConfig, createLogger, 
+// Validation
+validateApiKeyFormat, validateOrgIdFormat, 
+// Misc
+safeJsonParse, safeJsonStringify, deepFreeze, createDeferred, } from "./utils/index.js";
+export { readBoundedBody, readBoundedBytes, BodyReadError } from "./security/request-body.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAkDH,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAEzD,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,OAAO;AACN,YAAY;AACZ,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB;AAGnB,UAAU;AACV,gBAAgB,EAChB,gBAAgB;AAChB,gBAAgB;AAChB,UAAU,EACV,sBAAsB;AACtB,WAAW;AACX,YAAY;AACZ,WAAW;AACX,YAAY,EACZ,WAAW;AACX,cAAc;AACd,WAAW;AAEX,eAAe;AACf,aAAa,EACb,YAAY;AAGZ,oBAAoB;AACpB,cAAc,GAEd,MAAM,sBAAsB,CAAA;AAE7B,+EAA+E;AAC/E,WAAW;AACX,+EAA+E;AAE/E,OAAO;AACN,aAAa;AACb,iBAAiB,EACjB,yBAAyB,EACzB,wBAAwB;AACxB,QAAQ;AACR,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,EACjB,uBAAuB,EACvB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,qBAAqB;AACrB,SAAS;AACT,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB;AAChB,SAAS;AACT,cAAc,EACd,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,GAClB,MAAM,qBAAqB,CAAA;AAE5B,uBAAuB;AACvB,OAAO,EACN,OAAO,EACP,sBAAsB,EACtB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,qBAAqB,EACrB,0BAA0B,EAC1B,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,GAQjB,MAAM,uBAAuB,CAAA;AAE9B,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,OAAO;AACN,mBAAmB;AACnB,qBAAqB,EACrB,mBAAmB;AACnB,cAAc;AACd,gBAAgB,EAChB,wBAAwB;AACxB,gBAAgB;AAChB,SAAS,EACT,iBAAiB;AACjB,eAAe;AACf,mBAAmB;AACnB,cAAc,EACd,kBAAkB;AAClB,sCAAsC;AACtC,gBAAgB;AAChB,WAAW;AACX,gBAAgB;AAChB,gBAAgB,EAChB,mBAAmB;AACnB,UAAU;AACV,cAAc;AACd,WAAW;AACX,aAAa;AACb,iBAAiB;AACjB,QAAQ,EACR,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,YAAY;AAIZ,aAAa;AACb,oBAAoB,EACpB,mBAAmB;AACnB,OAAO;AACP,aAAa,EACb,iBAAiB,EACjB,UAAU,EACV,cAAc,GACd,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA"}

package/dist/security/index.d.ts

@@ -0,0 +1,118 @@
+/**
+ * Security utilities for Devora SDKs
+ * @module @devorash/core/security
+ */
+import type { SignatureErrorCode } from "./signing.js";
+/**
+ * A timestamp tolerance is a whole, non-negative number of seconds. Zero means
+ * only the current second is accepted; there is no "falsy means default".
+ */
+export declare function isValidTimestampTolerance(value: unknown): value is number;
+/** Throws for configuration values that {@link isValidTimestampTolerance} rejects. */
+export declare function assertTimestampTolerance(value: unknown, name?: string): void;
+/**
+ * Validate timestamp is within acceptable window
+ */
+export declare function validateTimestamp(requestTimestamp: number, toleranceSeconds?: number): {
+    valid: boolean;
+    error?: string;
+};
+/**
+ * Check if HTTP method is a write operation
+ */
+export declare function isWriteMethod(method: string): boolean;
+/**
+ * Path of an origin-form request target (`/path?query`), still percent-encoded.
+ *
+ * Absolute-form targets (`http://host/path`) are deliberately NOT unwrapped:
+ * routers disagree with any regex about where such a host ends (a `?` inside
+ * it moves the routed path to `/`), so the result does not start with `/` and
+ * {@link isAmbiguousRequestPath} rejects it.
+ */
+export declare function getRawRequestPath(value: string): string;
+/** Headers through which common middleware lets a client change the effective method. */
+export declare const METHOD_OVERRIDE_HEADERS: readonly ["x-http-method-override", "x-http-method", "x-method-override"];
+/** The query parameter method-override middleware reads (`?_method=DELETE`). */
+export declare const METHOD_OVERRIDE_QUERY_PARAM = "_method";
+/**
+ * Every method a request might execute as. The guard judges all of them, so a
+ * method-override middleware ordered after the guard cannot turn an allowed
+ * POST into a blocked DELETE. `target` (the raw request target) adds any
+ * `_method` query parameters. A `_method` field in a request body is invisible
+ * to a guard that runs before body parsing; see the guard docs.
+ */
+export declare function getPolicyMethods(method: string, headers?: Record<string, string | string[] | undefined>, target?: string): string[];
+/**
+ * Methods a deny rule must cover. Frameworks answer HEAD with the GET handler,
+ * so a GET deny rule also denies HEAD.
+ */
+export declare function getDenyMethods(methods: string[]): string[];
+/** Join a router mount prefix and a mount-relative origin-form target. */
+export declare function joinMountedTarget(mountPath: string | undefined, target: string): string;
+/** Reject paths whose segment boundaries differ between common routers. */
+export declare function isAmbiguousRequestPath(value: string): boolean;
+/** Decode one segment at a time, preserving case and separators. */
+export declare function normalizeRequestPath(value: string): string;
+/**
+ * Bounded iterative glob matching: * stays within a segment; ** spans zero or
+ * more whole segments. Allow rules preserve case/trailing slashes. Deny rules
+ * opt into conservative case-insensitive matching for non-strict routers.
+ */
+export declare function matchEndpointPattern(pattern: string, path: string, options?: {
+    caseSensitive?: boolean;
+    ignoreTrailingSlash?: boolean;
+}): boolean;
+/**
+ * Create a blocked response for scope violations
+ */
+export declare function createBlockedResponse(method: string, url: string): Response;
+/**
+ * Generate a cryptographically secure random string for tokens/IDs.
+ *
+ * @throws {Error} If no secure random source is available.
+ *         This is intentional - we must never fall back to Math.random()
+ *         for security-sensitive operations like token generation.
+ */
+export declare function generateRandomString(length?: number): string;
+/**
+ * Convert ArrayBuffer to hex string
+ */
+export declare function arrayBufferToHex(buffer: ArrayBuffer): string;
+/**
+ * Convert hex string to ArrayBuffer
+ */
+export declare function hexToArrayBuffer(hex: string): ArrayBuffer;
+/**
+ * Base error class for Devora SDK errors
+ */
+export declare class DevoraSDKError extends Error {
+    readonly code: string;
+    readonly statusCode: number;
+    constructor(message: string, code: string, statusCode?: number);
+}
+/**
+ * Security-related errors
+ */
+export declare class DevoraSecurityError extends DevoraSDKError {
+    readonly securityCode: SignatureErrorCode;
+    constructor(message: string, securityCode: SignatureErrorCode, statusCode?: number);
+}
+/**
+ * Validation errors
+ */
+export declare class DevoraValidationError extends DevoraSDKError {
+    constructor(message: string, code?: string);
+}
+/**
+ * Configuration errors
+ */
+export declare class DevoraConfigError extends DevoraSDKError {
+    constructor(message: string);
+}
+/**
+ * Network/connectivity errors
+ */
+export declare class DevoraNetworkError extends DevoraSDKError {
+    constructor(message: string);
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAMtD;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEzE;AAED,sFAAsF;AACtF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAuB,GAAG,IAAI,CAG1F;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAChC,gBAAgB,EAAE,MAAM,EACxB,gBAAgB,GAAE,MAAyC,GACzD;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAuBpC;AAMD;;GAEG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAGrD;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,yFAAyF;AACzF,eAAO,MAAM,uBAAuB,2EAI1B,CAAA;AAEV,gFAAgF;AAChF,eAAO,MAAM,2BAA2B,YAAY,CAAA;AAEpD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC/B,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,EACvD,MAAM,CAAC,EAAE,MAAM,GACb,MAAM,EAAE,CAkBV;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAE1D;AAED,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAOvF;AAUD,2EAA2E;AAC3E,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAoB7D;AAED,oEAAoE;AACpE,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAO1D;AAwBD;;;;GAIG;AACH,wBAAgB,oBAAoB,CACnC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAC;IAAC,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAAO,GACtE,OAAO,CAgCT;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,QAAQ,CAa3E;AAMD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,GAAE,MAAW,GAAG,MAAM,CA4BhE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAK5D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,CASzD;AAMD;;GAEG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;gBAEf,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,GAAE,MAAY;CAMnE;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,cAAc;IACtD,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAA;gBAE7B,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,kBAAkB,EAAE,UAAU,GAAE,MAAY;CAKvF;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,cAAc;gBAC5C,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,MAA2B;CAI9D;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,cAAc;gBACxC,OAAO,EAAE,MAAM;CAI3B;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,cAAc;gBACzC,OAAO,EAAE,MAAM;CAI3B"}