@fuzdev/fuz_app 0.105.0 → 0.106.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fuzdev/fuz_app",
-  "version": "0.105.0",
+  "version": "0.106.1",
   "description": "fullstack app library",
   "glyph": "🗝",
   "logo": "logo.svg",
@@ -33,7 +33,7 @@
   "peerDependencies": {
     "@electric-sql/pglite": ">=0.4",
     "@fuzdev/blake3_wasm": ">=0.1.0",
-    "@fuzdev/fuz_util": ">=0.65.2",
+    "@fuzdev/fuz_util": ">=0.68.0",
     "@hono/node-server": ">=1",
     "@hono/node-ws": ">=1",
     "@node-rs/argon2": ">=2",

package/dist/server/fact_write.d.ts

@@ -1,32 +0,0 @@
-/**
- * Shared helper for routing fact bytes between embedded (PG `bytes`
- * column) and external (filesystem + `put_ref`) storage tiers based
- * on size.
- *
- * External writes go through atomic temp+rename so the `facts` row
- * never references a partial file; idempotence comes from POSIX
- * `rename` overwrite + `INSERT ... ON CONFLICT DO NOTHING` in the
- * fact-store queries layer.
- *
- * @module
- */
-import { type FactHash } from '@fuzdev/fuz_util/hash_schemas.ts';
-import type { FactStore } from '@fuzdev/fuz_util/fact_store.ts';
-export interface WriteFactOptions {
-    content_type: string;
-}
-/**
- * Write `bytes` as a fact, choosing embedded (PG) vs external (disk +
- * `put_ref`) based on `embedded_threshold`. Returns the canonical
- * `blake3:` hash either way.
- *
- * @param fact_store - the `FactStore` (typically `PgFactStore`)
- * @param embedded_threshold - bytes ≤ threshold → embedded; > threshold → disk
- * @param facts_dir - root of the sharded facts directory tree on disk
- * @param bytes - the raw fact bytes
- * @param options - content type for the fact metadata
- * @returns the fact's `blake3:<hex64>` hash
- * @mutates `fact_store`, `facts_dir` filesystem
- */
-export declare const write_fact: (fact_store: FactStore, embedded_threshold: number, facts_dir: string, bytes: Uint8Array, options: WriteFactOptions) => Promise<FactHash>;
-//# sourceMappingURL=fact_write.d.ts.map

package/dist/server/fact_write.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"fact_write.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/fact_write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,EAAoB,KAAK,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAGhE,MAAM,WAAW,gBAAgB;IAChC,YAAY,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,UAAU,GACtB,YAAY,SAAS,EACrB,oBAAoB,MAAM,EAC1B,WAAW,MAAM,EACjB,OAAO,UAAU,EACjB,SAAS,gBAAgB,KACvB,OAAO,CAAC,QAAQ,CA4BlB,CAAC"}

package/dist/server/fact_write.js

@@ -1,57 +0,0 @@
-/**
- * Shared helper for routing fact bytes between embedded (PG `bytes`
- * column) and external (filesystem + `put_ref`) storage tiers based
- * on size.
- *
- * External writes go through atomic temp+rename so the `facts` row
- * never references a partial file; idempotence comes from POSIX
- * `rename` overwrite + `INSERT ... ON CONFLICT DO NOTHING` in the
- * fact-store queries layer.
- *
- * @module
- */
-import { randomBytes } from 'node:crypto';
-import { writeFile, rename, mkdir, unlink } from 'node:fs/promises';
-import { join } from 'node:path';
-import { fact_hash_bytes } from '@fuzdev/fuz_util/fact_hash.ts';
-import { FACT_HASH_PREFIX } from '@fuzdev/fuz_util/hash_schemas.ts';
-import { mint_file_fact_url } from '../db/file_fact_url.js';
-/**
- * Write `bytes` as a fact, choosing embedded (PG) vs external (disk +
- * `put_ref`) based on `embedded_threshold`. Returns the canonical
- * `blake3:` hash either way.
- *
- * @param fact_store - the `FactStore` (typically `PgFactStore`)
- * @param embedded_threshold - bytes ≤ threshold → embedded; > threshold → disk
- * @param facts_dir - root of the sharded facts directory tree on disk
- * @param bytes - the raw fact bytes
- * @param options - content type for the fact metadata
- * @returns the fact's `blake3:<hex64>` hash
- * @mutates `fact_store`, `facts_dir` filesystem
- */
-export const write_fact = async (fact_store, embedded_threshold, facts_dir, bytes, options) => {
-    if (bytes.length <= embedded_threshold) {
-        return fact_store.put(bytes, options);
-    }
-    const hash = fact_hash_bytes(bytes);
-    const hex = hash.slice(FACT_HASH_PREFIX.length);
-    const shard = hex.slice(0, 2);
-    const rest = hex.slice(2);
-    const shard_dir = join(facts_dir, shard);
-    const tmp_dir = join(facts_dir, '.tmp');
-    const tmp_path = join(tmp_dir, `${randomBytes(16).toString('hex')}.tmp`);
-    const final_path = join(shard_dir, rest);
-    await Promise.all([mkdir(shard_dir, { recursive: true }), mkdir(tmp_dir, { recursive: true })]);
-    let renamed = false;
-    try {
-        await writeFile(tmp_path, bytes);
-        await rename(tmp_path, final_path);
-        renamed = true;
-    }
-    finally {
-        if (!renamed) {
-            await unlink(tmp_path).catch(() => undefined);
-        }
-    }
-    return fact_store.put_ref(mint_file_fact_url(shard, rest), bytes.length, options);
-};

package/dist/server/validate_nginx.d.ts

@@ -1,34 +0,0 @@
-/**
- * String-based nginx config validator for fuz_app deploy configs.
- *
- * Checks consumer `NGINX_CONFIG` template strings for required security
- * properties. This is pattern matching on template strings, not a real
- * nginx parser — it catches common security omissions but won't catch
- * all possible misconfigurations.
- *
- * @module
- */
-/**
- * Result of validating an nginx config template string.
- */
-export interface NginxValidationResult {
-    /** True when no errors were detected. Warnings do not affect this flag. */
-    ok: boolean;
-    /** Non-fatal issues — missing optional headers, weakened defaults, etc. */
-    warnings: Array<string>;
-    /** Fatal issues — missing `/api` block, missing required security headers, etc. */
-    errors: Array<string>;
-}
-/**
- * Validate an nginx config template string for security properties.
- *
- * Checks for required security headers, Authorization stripping in `/api`
- * blocks, and the nginx `add_header` inheritance gotcha. Designed for
- * fuz_app consumer deploy configs (zap.ts `NGINX_CONFIG` constants).
- *
- * Limitations: string pattern matching, not a real nginx parser. Catches
- * common omissions in fuz_app deploy configs but won't catch all possible
- * misconfigurations.
- */
-export declare const validate_nginx_config: (config: string) => NginxValidationResult;
-//# sourceMappingURL=validate_nginx.d.ts.map

package/dist/server/validate_nginx.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"validate_nginx.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/validate_nginx.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACrC,2EAA2E;IAC3E,EAAE,EAAE,OAAO,CAAC;IACZ,2EAA2E;IAC3E,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,mFAAmF;IACnF,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAgGD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,GAAI,QAAQ,MAAM,KAAG,qBA+FtD,CAAC"}

package/dist/server/validate_nginx.js

@@ -1,169 +0,0 @@
-/**
- * String-based nginx config validator for fuz_app deploy configs.
- *
- * Checks consumer `NGINX_CONFIG` template strings for required security
- * properties. This is pattern matching on template strings, not a real
- * nginx parser — it catches common security omissions but won't catch
- * all possible misconfigurations.
- *
- * @module
- */
-/**
- * Extract location blocks from an nginx config string.
- *
- * Finds `location [modifier] <path> {` directives (modifier may be `=`, `~`,
- * `~*`, `^~`, or absent) and returns the full block content including nested
- * braces.
- */
-const extract_location_blocks = (config) => {
-    const blocks = [];
-    const location_regex = /location\s+(=|~\*?|\^~)?\s*(\S+)\s*\{/g;
-    let match;
-    while ((match = location_regex.exec(config)) !== null) {
-        const modifier = match[1] ?? '';
-        const path = match[2];
-        const open_brace_index = match.index + match[0].length - 1;
-        let depth = 1;
-        let block_end = open_brace_index + 1;
-        for (let i = open_brace_index + 1; i < config.length; i++) {
-            if (config[i] === '{')
-                depth++;
-            else if (config[i] === '}') {
-                depth--;
-                if (depth === 0) {
-                    block_end = i + 1;
-                    break;
-                }
-            }
-        }
-        blocks.push({ modifier, path, content: config.slice(match.index, block_end) });
-    }
-    return blocks;
-};
-/**
- * Canonical `/api` URIs used to probe regex location patterns.
- *
- * Two probes cover the common regex shapes:
- * - `/api` catches `^/api$`, `^/api(/|$)`, `^/(admin|api)`, etc.
- * - `/api/` catches `^/api/` (which requires the trailing slash).
- *
- * Only consulted from the regex branch of `location_matches_api` — non-regex
- * blocks compare `block.path` literally.
- */
-const API_TEST_URIS = ['/api', '/api/'];
-/**
- * Does a location block route `/api` traffic?
- *
- * The matching strategy is deliberately asymmetric across modifier types:
- *
- * - **Regex (`~`, `~*`)**: compiles `block.path` as a regex and tests it
- *   against `API_TEST_URIS`. `~*` gets the `i` flag. Any match flags the
- *   block as `/api`-handling. Invalid regex returns `false` (nginx would
- *   reject it too). URI-probing is needed because regex patterns don't
- *   admit a reliable substring check — `^/(admin|api)` has no `/api` prefix
- *   textually but routes `/api` traffic.
- * - **Prefix (no modifier, `^~`) and exact (`=`)**: literal check —
- *   `block.path === '/api'` or `block.path.startsWith('/api/')`. We do NOT
- *   probe with `API_TEST_URIS` here because that would produce false
- *   positives on overly broad prefixes: a catch-all `location /` technically
- *   routes `/api` requests, but nginx would prefer a more specific `/api`
- *   block when one exists — and we want the separate "No /api block found"
- *   error when one doesn't.
- *
- * Known blind spot: a regex matching only a sub-path that isn't in
- * `API_TEST_URIS` (e.g. `^/api/v99$`, or `^/api/.+` which requires content
- * after the slash) won't be flagged. Acceptable for fuz_app deploy configs,
- * which route all `/api` traffic through a single broad block.
- */
-const location_matches_api = (block) => {
-    if (block.modifier === '~' || block.modifier === '~*') {
-        try {
-            const re = new RegExp(block.path, block.modifier === '~*' ? 'i' : '');
-            return API_TEST_URIS.some((uri) => re.test(uri));
-        }
-        catch {
-            return false;
-        }
-    }
-    return block.path === '/api' || block.path.startsWith('/api/');
-};
-/**
- * Validate an nginx config template string for security properties.
- *
- * Checks for required security headers, Authorization stripping in `/api`
- * blocks, and the nginx `add_header` inheritance gotcha. Designed for
- * fuz_app consumer deploy configs (zap.ts `NGINX_CONFIG` constants).
- *
- * Limitations: string pattern matching, not a real nginx parser. Catches
- * common omissions in fuz_app deploy configs but won't catch all possible
- * misconfigurations.
- */
-export const validate_nginx_config = (config) => {
-    const errors = [];
-    const warnings = [];
-    const all_blocks = extract_location_blocks(config);
-    // 1. proxy_set_header Authorization "" in /api location blocks
-    const api_blocks = all_blocks.filter(location_matches_api);
-    if (api_blocks.length === 0) {
-        errors.push('No /api location block found — config must have an /api location block ' +
-            'with Authorization header stripping. If you intentionally route /api ' +
-            'through a different structure, skip this validator.');
-    }
-    else {
-        const has_auth_strip = api_blocks.some((block) => block.content.includes('proxy_set_header Authorization ""') ||
-            block.content.includes("proxy_set_header Authorization ''"));
-        if (!has_auth_strip) {
-            errors.push('Missing `proxy_set_header Authorization ""` in /api location block — ' +
-                'required for v1 cookie-only external auth posture');
-        }
-    }
-    // 2. Strict-Transport-Security (error if missing)
-    if (!config.includes('Strict-Transport-Security')) {
-        errors.push('Missing Strict-Transport-Security header');
-    }
-    // 3. X-Content-Type-Options "nosniff" (warning if missing)
-    if (!config.includes('X-Content-Type-Options')) {
-        warnings.push('Missing X-Content-Type-Options "nosniff" header');
-    }
-    // 4. X-Frame-Options (warning if missing)
-    if (!config.includes('X-Frame-Options')) {
-        warnings.push('Missing X-Frame-Options header');
-    }
-    // 5. Referrer-Policy (warning if missing)
-    if (!config.includes('Referrer-Policy')) {
-        warnings.push('Missing Referrer-Policy header');
-    }
-    // 6. server_tokens off (warning if missing)
-    if (!config.includes('server_tokens off')) {
-        warnings.push('Missing server_tokens off — nginx version may be disclosed');
-    }
-    // 7. limit_req (warning if missing — may be in a separate rate_limit.conf)
-    if (!config.includes('limit_req')) {
-        warnings.push('Missing limit_req — may be in a separate rate_limit.conf. ' +
-            'Consider adding nginx-level rate limiting');
-    }
-    // 8. X-Forwarded-For: prefer $remote_addr over $proxy_add_x_forwarded_for
-    if (config.includes('$proxy_add_x_forwarded_for')) {
-        warnings.push('Using $proxy_add_x_forwarded_for — prefer $remote_addr for single-proxy setups ' +
-            'to avoid client-injected XFF headers');
-    }
-    // 9. Child location blocks with add_header must repeat security headers
-    for (const block of all_blocks) {
-        if (block.content.includes('add_header') &&
-            !block.content.includes('Strict-Transport-Security')) {
-            // Only flag child locations that add their own response headers
-            // (Cache-Control, Content-Disposition, etc.) — these override
-            // inherited headers from the parent server block
-            if (block.content.includes('Cache-Control') ||
-                block.content.includes('Content-Disposition')) {
-                warnings.push(`Location ${block.path} has add_header but is missing Strict-Transport-Security — ` +
-                    'nginx add_header in child blocks replaces (not extends) inherited headers');
-            }
-        }
-    }
-    return {
-        ok: errors.length === 0,
-        warnings,
-        errors
-    };
-};