@hasna/mementos 0.14.88 → 0.15.2

package/dist/server/auth.d.ts

@@ -1,4 +1,6 @@
 import { type ApiKeyVerifier } from "@hasna/contracts/auth";
+/** True when {@link checkApiKey} verified an explicit API key on this request. */
+export declare function isAuthenticated(req: Request): boolean;
 /** Lazily build the contracts verifier. Returns null when auth is disabled. */
 export declare function getApiKeyVerifier(): ApiKeyVerifier | null;
 /**

package/dist/server/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAqBA,OAAO,EAGL,KAAK,cAAc,EAEpB,MAAM,uBAAuB,CAAC;AA0C/B,+EAA+E;AAC/E,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,IAAI,CAgCzD;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,GACjC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAmB1B;AAED,mFAAmF;AACnF,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAqBA,OAAO,EAGL,KAAK,cAAc,EAEpB,MAAM,uBAAuB,CAAC;AAwB/B,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAErD;AAkCD,+EAA+E;AAC/E,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,IAAI,CAuCzD;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,GACjC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA6B1B;AAED,mFAAmF;AACnF,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C"}

package/dist/server/helpers.d.ts

@@ -6,8 +6,9 @@ export declare function isStateChangingMethod(method: string): boolean;
  *
  * `MEMENTOS_CORS_ORIGIN` accepts a comma-separated list; each entry may be a
  * full origin (`http://localhost:19428`) or a bare `host[:port]`. The default
- * is the local dashboard origin. An empty value yields an empty allowlist,
- * which fails closed (no origin or host is allowed to mutate state).
+ * is the mementos server's own origin. An empty value yields an empty
+ * allowlist, which fails closed (no origin or host is allowed to mutate
+ * state).
  */
 export declare function getAllowedOrigins(): string[];
 /**
@@ -18,8 +19,13 @@ export declare function getAllowedOrigins(): string[];
  * This is the non-OPTIONS sibling of the preflight gate: a hostile page can
  * forge a POST/PATCH/DELETE with any Origin it likes, so those methods must
  * be allowlisted on every request, not only at preflight time.
+ *
+ * `authenticated` marks a request whose API key was already verified (see
+ * auth.ts `checkApiKey`): such a request is not CSRF, so the ambient-credential
+ * gate is skipped for it when it carries no Origin header (the CLI/MCP/SDK
+ * client shape). See `checkWriteOriginOrHost`.
  */
-export declare function checkOriginOrHost(req: Request, method: string): Response | null;
+export declare function checkOriginOrHost(req: Request, method: string, authenticated?: boolean): Response | null;
 /**
  * The allowlist check itself: reject a request whose Origin (when present) or
  * Host (when no Origin is present) is not on the configured allowlist.
@@ -28,9 +34,19 @@ export declare function checkOriginOrHost(req: Request, method: string): Respons
  * trigger one with no preflight — so a GET route whose handler writes state
  * (a touch/recency update, a cache write, an LLM call) must be gated exactly
  * like a state-changing method, even though its HTTP method is not one.
+ *
+ * `authenticated` exempts requests that carry a VERIFIED explicit API key and
+ * no Origin header. The allowlist is an ambient-credential (CSRF) defense: a
+ * hostile page cannot attach the Authorization header without CORS preflight
+ * (which is separately allowlisted) and cannot read the key, so a keyed
+ * request with no Origin is not CSRF and must be served regardless of
+ * MEMENTOS_CORS_ORIGIN — a deployment that omits the env var (or a client
+ * reaching the server through a Host the allowlist does not name) must not
+ * take down every CLI/MCP/SDK client with 403 'Host is not allowed'.
+ * Browser-context requests — any request WITH an Origin header — keep the
+ * full Origin allowlist even when keyed, as defense in depth.
  */
-export declare function checkWriteOriginOrHost(req: Request): Response | null;
-export declare const MIME_TYPES: Record<string, string>;
+export declare function checkWriteOriginOrHost(req: Request, authenticated?: boolean): Response | null;
 export declare function json(data: unknown, status?: number): Response;
 export declare function errorResponse(message: string, status: number, details?: unknown): Response;
 /**
@@ -48,6 +64,4 @@ export declare function readJson(req: Request): Promise<unknown>;
 export declare function getCorsHeaders(req?: Request): Record<string, string>;
 export declare function authenticateRequest(req: Request): Response | null;
 export declare function getSearchParams(url: URL): Record<string, string>;
-export declare function resolveDashboardDir(): string;
-export declare function serveStaticFile(filePath: string): Response | null;
 //# sourceMappingURL=helpers.d.ts.map

package/dist/server/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../src/server/helpers.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAK/C,CAAC;AAQF,8EAA8E;AAC9E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,EAAE,CAM5C;AAWD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAG/E;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,GAAG,IAAI,CAkBpE;AAMD,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAU7C,CAAC;AAMF,wBAAgB,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,SAAM,GAAG,QAAQ,CAK1D;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,OAAO,GAChB,QAAQ,CAIV;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAWrE;AAKD,wBAAsB,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAU7D;AAMD,wBAAgB,cAAc,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWpE;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,GAAG,IAAI,CAqBjE;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMhE;AAMD,wBAAgB,mBAAmB,IAAI,MAAM,CAiB5C;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAMjE"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../src/server/helpers.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAK/C,CAAC;AAQF,8EAA8E;AAC9E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,EAAE,CAM5C;AAWD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,UAAQ,GAAG,QAAQ,GAAG,IAAI,CAGtG;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,UAAQ,GAAG,QAAQ,GAAG,IAAI,CAmB3F;AAMD,wBAAgB,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,SAAM,GAAG,QAAQ,CAK1D;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,OAAO,GAChB,QAAQ,CAIV;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAWrE;AAKD,wBAAsB,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAU7D;AAMD,wBAAgB,cAAc,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWpE;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,GAAG,IAAI,CAqBjE;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMhE"}

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":";AACA;;;GAGG;AA+CH,OAAO,sBAAsB,CAAC;AAC9B,OAAO,oBAAoB,CAAC;AAC5B,OAAO,sBAAsB,CAAC;AAC9B,OAAO,kCAAkC,CAAC;AAC1C,OAAO,sBAAsB,CAAC;AAC9B,OAAO,mBAAmB,CAAC;AAC3B,OAAO,oBAAoB,CAAC;AA8F5B,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAkM9C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":";AACA;;;GAGG;AA6CH,OAAO,sBAAsB,CAAC;AAC9B,OAAO,oBAAoB,CAAC;AAC5B,OAAO,sBAAsB,CAAC;AAC9B,OAAO,kCAAkC,CAAC;AAC1C,OAAO,sBAAsB,CAAC;AAC9B,OAAO,mBAAmB,CAAC;AAC3B,OAAO,oBAAoB,CAAC;AA8F5B,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAqM9C"}