@hasna/mementos 0.14.87 → 0.15.2

package/dist/server/auth.d.ts

@@ -1,4 +1,6 @@
 import { type ApiKeyVerifier } from "@hasna/contracts/auth";
+/** True when {@link checkApiKey} verified an explicit API key on this request. */
+export declare function isAuthenticated(req: Request): boolean;
 /** Lazily build the contracts verifier. Returns null when auth is disabled. */
 export declare function getApiKeyVerifier(): ApiKeyVerifier | null;
 /**

package/dist/server/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAkBA,OAAO,EAGL,KAAK,cAAc,EAEpB,MAAM,uBAAuB,CAAC;AA0C/B,+EAA+E;AAC/E,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,IAAI,CAgCzD;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,GACjC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAU1B;AAED,mFAAmF;AACnF,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAqBA,OAAO,EAGL,KAAK,cAAc,EAEpB,MAAM,uBAAuB,CAAC;AAwB/B,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAErD;AAkCD,+EAA+E;AAC/E,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,IAAI,CAuCzD;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,GACjC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA6B1B;AAED,mFAAmF;AACnF,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C"}

package/dist/server/helpers.d.ts

@@ -1,5 +1,52 @@
 export declare const CORS_HEADERS: Record<string, string>;
-export declare const MIME_TYPES: Record<string, string>;
+/** True for methods that mutate state — the CSRF-relevant request surface. */
+export declare function isStateChangingMethod(method: string): boolean;
+/**
+ * The configured allowlist of origins permitted to mutate state.
+ *
+ * `MEMENTOS_CORS_ORIGIN` accepts a comma-separated list; each entry may be a
+ * full origin (`http://localhost:19428`) or a bare `host[:port]`. The default
+ * is the mementos server's own origin. An empty value yields an empty
+ * allowlist, which fails closed (no origin or host is allowed to mutate
+ * state).
+ */
+export declare function getAllowedOrigins(): string[];
+/**
+ * Reject state-changing requests whose Origin (when present) or Host (when no
+ * Origin is present) is not on the configured allowlist. Read-only methods
+ * pass through untouched. Returns an error `Response` to reject, or `null`.
+ *
+ * This is the non-OPTIONS sibling of the preflight gate: a hostile page can
+ * forge a POST/PATCH/DELETE with any Origin it likes, so those methods must
+ * be allowlisted on every request, not only at preflight time.
+ *
+ * `authenticated` marks a request whose API key was already verified (see
+ * auth.ts `checkApiKey`): such a request is not CSRF, so the ambient-credential
+ * gate is skipped for it when it carries no Origin header (the CLI/MCP/SDK
+ * client shape). See `checkWriteOriginOrHost`.
+ */
+export declare function checkOriginOrHost(req: Request, method: string, authenticated?: boolean): Response | null;
+/**
+ * The allowlist check itself: reject a request whose Origin (when present) or
+ * Host (when no Origin is present) is not on the configured allowlist.
+ *
+ * GET requests are CORS "simple requests" — a hostile cross-origin page can
+ * trigger one with no preflight — so a GET route whose handler writes state
+ * (a touch/recency update, a cache write, an LLM call) must be gated exactly
+ * like a state-changing method, even though its HTTP method is not one.
+ *
+ * `authenticated` exempts requests that carry a VERIFIED explicit API key and
+ * no Origin header. The allowlist is an ambient-credential (CSRF) defense: a
+ * hostile page cannot attach the Authorization header without CORS preflight
+ * (which is separately allowlisted) and cannot read the key, so a keyed
+ * request with no Origin is not CSRF and must be served regardless of
+ * MEMENTOS_CORS_ORIGIN — a deployment that omits the env var (or a client
+ * reaching the server through a Host the allowlist does not name) must not
+ * take down every CLI/MCP/SDK client with 403 'Host is not allowed'.
+ * Browser-context requests — any request WITH an Origin header — keep the
+ * full Origin allowlist even when keyed, as defense in depth.
+ */
+export declare function checkWriteOriginOrHost(req: Request, authenticated?: boolean): Response | null;
 export declare function json(data: unknown, status?: number): Response;
 export declare function errorResponse(message: string, status: number, details?: unknown): Response;
 /**
@@ -17,6 +64,4 @@ export declare function readJson(req: Request): Promise<unknown>;
 export declare function getCorsHeaders(req?: Request): Record<string, string>;
 export declare function authenticateRequest(req: Request): Response | null;
 export declare function getSearchParams(url: URL): Record<string, string>;
-export declare function resolveDashboardDir(): string;
-export declare function serveStaticFile(filePath: string): Response | null;
 //# sourceMappingURL=helpers.d.ts.map

package/dist/server/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../src/server/helpers.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAK/C,CAAC;AAMF,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAU7C,CAAC;AAMF,wBAAgB,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,SAAM,GAAG,QAAQ,CAK1D;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,OAAO,GAChB,QAAQ,CAIV;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAWrE;AAKD,wBAAsB,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAU7D;AAMD,wBAAgB,cAAc,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWpE;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,GAAG,IAAI,CAqBjE;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMhE;AAMD,wBAAgB,mBAAmB,IAAI,MAAM,CAiB5C;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAMjE"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../src/server/helpers.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAK/C,CAAC;AAQF,8EAA8E;AAC9E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,EAAE,CAM5C;AAWD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,UAAQ,GAAG,QAAQ,GAAG,IAAI,CAGtG;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,UAAQ,GAAG,QAAQ,GAAG,IAAI,CAmB3F;AAMD,wBAAgB,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,SAAM,GAAG,QAAQ,CAK1D;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,OAAO,GAChB,QAAQ,CAIV;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAWrE;AAKD,wBAAsB,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAU7D;AAMD,wBAAgB,cAAc,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWpE;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,GAAG,IAAI,CAqBjE;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMhE"}

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":";AACA;;;GAGG;AA+CH,OAAO,sBAAsB,CAAC;AAC9B,OAAO,oBAAoB,CAAC;AAC5B,OAAO,sBAAsB,CAAC;AAC9B,OAAO,kCAAkC,CAAC;AAC1C,OAAO,sBAAsB,CAAC;AAC9B,OAAO,mBAAmB,CAAC;AAC3B,OAAO,oBAAoB,CAAC;AA8F5B,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CA4L9C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":";AACA;;;GAGG;AA6CH,OAAO,sBAAsB,CAAC;AAC9B,OAAO,oBAAoB,CAAC;AAC5B,OAAO,sBAAsB,CAAC;AAC9B,OAAO,kCAAkC,CAAC;AAC1C,OAAO,sBAAsB,CAAC;AAC9B,OAAO,mBAAmB,CAAC;AAC3B,OAAO,oBAAoB,CAAC;AA8F5B,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAqM9C"}