@indecisivedev/openplan 0.2.0-alpha.2

package/dist/oidc.js

@@ -0,0 +1,194 @@
+import * as client from "openid-client";
+/** Parse deployment-owned configuration; no issuer or client comes from a request. */
+export function parseOidcSettings(env) {
+    const issuer = env.OPENPLAN_OIDC_ISSUER?.trim() || "";
+    try {
+        const url = new URL(issuer);
+        if (url.protocol !== "https:" || url.username || url.password || /[?#\x00-\x20\x7f\\]/.test(issuer)) {
+            throw new Error();
+        }
+    }
+    catch {
+        throw new Error("OPENPLAN_OIDC_ISSUER must be an HTTPS issuer URL without credentials, query, or fragment.");
+    }
+    const clientId = env.OPENPLAN_OIDC_CLIENT_ID?.trim() || "";
+    if (!clientId)
+        throw new Error("OPENPLAN_OIDC_CLIENT_ID is required for OIDC authentication.");
+    const clientSecret = env.OPENPLAN_OIDC_CLIENT_SECRET || undefined;
+    const configuredMethod = env.OPENPLAN_OIDC_TOKEN_ENDPOINT_AUTH_METHOD?.trim();
+    const tokenEndpointAuthMethod = configuredMethod || (clientSecret ? "client_secret_basic" : "none");
+    if (tokenEndpointAuthMethod !== "client_secret_basic" && tokenEndpointAuthMethod !== "client_secret_post" && tokenEndpointAuthMethod !== "none") {
+        throw new Error("OPENPLAN_OIDC_TOKEN_ENDPOINT_AUTH_METHOD must be client_secret_basic, client_secret_post, or none.");
+    }
+    if (tokenEndpointAuthMethod === "none" && clientSecret) {
+        throw new Error("OPENPLAN_OIDC_CLIENT_SECRET must be unset when token endpoint authentication is none.");
+    }
+    if (tokenEndpointAuthMethod !== "none" && !clientSecret?.trim()) {
+        throw new Error("OPENPLAN_OIDC_CLIENT_SECRET is required for the configured token endpoint authentication method.");
+    }
+    const scopes = [...new Set((env.OPENPLAN_OIDC_SCOPES?.trim() || "openid profile email").split(/\s+/))];
+    if (!scopes.includes("openid") || scopes.some((scope) => !/^[\x21\x23-\x5b\x5d-\x7e]+$/.test(scope))) {
+        throw new Error("OPENPLAN_OIDC_SCOPES must contain openid and valid space-separated OAuth scopes.");
+    }
+    return {
+        issuer,
+        clientId,
+        ...(clientSecret ? { clientSecret } : {}),
+        scopes: scopes.join(" "),
+        tokenEndpointAuthMethod
+    };
+}
+/** OIDC subjects are unique within an exact issuer, never by email address. */
+export function oidcProviderKey(settings) {
+    return `oidc:${settings.issuer}`;
+}
+/** Changing the issuer or client registration invalidates existing browser sessions. */
+export function oidcSessionBinding(settings) {
+    return JSON.stringify(["oidc", settings.issuer, settings.clientId]);
+}
+const discoveryCache = new Map();
+const DISCOVERY_CACHE_TTL_MS = 10 * 60 * 1000;
+const DISCOVERY_CACHE_LIMIT = 8;
+function getConfiguration(settings) {
+    // Include registration credentials so a rotated secret never reuses stale client authentication.
+    const key = JSON.stringify([settings.issuer, settings.clientId, settings.clientSecret, settings.tokenEndpointAuthMethod]);
+    const now = Date.now();
+    for (const [cachedKey, entry] of discoveryCache) {
+        if (entry.expiresAt <= now)
+            discoveryCache.delete(cachedKey);
+    }
+    const cached = discoveryCache.get(key);
+    if (cached)
+        return cached.configuration;
+    if (discoveryCache.size >= DISCOVERY_CACHE_LIMIT) {
+        const oldest = discoveryCache.keys().next().value;
+        if (oldest !== undefined)
+            discoveryCache.delete(oldest);
+    }
+    const configuration = discoverConfiguration(settings).catch(() => {
+        if (discoveryCache.get(key)?.configuration === configuration)
+            discoveryCache.delete(key);
+        // Provider response bodies, request URLs, and client secrets must not reach browser errors/logs.
+        throw new Error("OIDC provider discovery failed. Check the issuer and client configuration.");
+    });
+    discoveryCache.set(key, { expiresAt: now + DISCOVERY_CACHE_TTL_MS, configuration });
+    return configuration;
+}
+async function discoverConfiguration(settings) {
+    const authentication = settings.tokenEndpointAuthMethod === "none"
+        ? client.None()
+        : settings.tokenEndpointAuthMethod === "client_secret_basic"
+            ? client.ClientSecretBasic(settings.clientSecret)
+            : client.ClientSecretPost(settings.clientSecret);
+    const configuration = await client.discovery(new URL(settings.issuer), settings.clientId, {}, authentication, {
+        algorithm: "oidc",
+        timeout: 10,
+        execute: [client.enableNonRepudiationChecks]
+    });
+    const metadata = configuration.serverMetadata();
+    // Preserve exact issuer spelling, including whether the operator supplied a trailing slash.
+    if (metadata.issuer !== settings.issuer)
+        throw new Error("Unexpected OIDC issuer.");
+    for (const value of [metadata.authorization_endpoint, metadata.token_endpoint, metadata.jwks_uri]) {
+        validateEndpoint(value);
+    }
+    if (metadata.userinfo_endpoint !== undefined)
+        validateEndpoint(metadata.userinfo_endpoint);
+    if (metadata.token_endpoint_auth_methods_supported && !metadata.token_endpoint_auth_methods_supported.includes(settings.tokenEndpointAuthMethod)) {
+        throw new Error("Unsupported OIDC client authentication method.");
+    }
+    if (metadata.code_challenge_methods_supported && !metadata.code_challenge_methods_supported.includes("S256")) {
+        throw new Error("OIDC provider does not support S256 PKCE.");
+    }
+    return configuration;
+}
+function validateEndpoint(value) {
+    if (typeof value !== "string")
+        throw new Error("Missing OIDC endpoint.");
+    const url = new URL(value);
+    if (url.protocol !== "https:" || url.username || url.password || /[#\x00-\x20\x7f\\]/.test(value)) {
+        throw new Error("Invalid OIDC endpoint.");
+    }
+}
+function validateRedirectUri(value) {
+    try {
+        const url = new URL(value);
+        const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+        if ((url.protocol !== "https:" && !(url.protocol === "http:" && loopback))
+            || url.username || url.password || /[?#\x00-\x20\x7f\\]/.test(value)) {
+            throw new Error();
+        }
+        return url;
+    }
+    catch {
+        throw new Error("OIDC callback must use HTTPS (or loopback HTTP), without credentials, query, or fragment.");
+    }
+}
+export async function beginOidcLogin(settings, redirectUri) {
+    // Validate before discovery or building a URL that could disclose misconfigured credentials.
+    validateRedirectUri(redirectUri);
+    const configuration = await getConfiguration(settings);
+    const state = client.randomState();
+    const verifier = client.randomPKCECodeVerifier();
+    const nonce = client.randomNonce();
+    const url = client.buildAuthorizationUrl(configuration, {
+        redirect_uri: redirectUri,
+        response_type: "code",
+        response_mode: "query",
+        scope: settings.scopes,
+        state,
+        nonce,
+        code_challenge: await client.calculatePKCECodeChallenge(verifier),
+        code_challenge_method: "S256"
+    });
+    return { url: url.href, state, verifier, nonce };
+}
+export async function completeOidcLogin(settings, callbackUrl, transaction, redirectUri) {
+    try {
+        const expectedRedirect = validateRedirectUri(redirectUri);
+        if (callbackUrl.origin !== expectedRedirect.origin || callbackUrl.pathname !== expectedRedirect.pathname
+            || callbackUrl.username || callbackUrl.password || callbackUrl.hash || expectedRedirect.search || expectedRedirect.hash
+            || !transaction.state || !transaction.nonce || !/^[A-Za-z0-9._~-]{43,128}$/.test(transaction.verifier)) {
+            throw new Error("Invalid OIDC callback transaction.");
+        }
+        const configuration = await getConfiguration(settings);
+        const tokens = await client.authorizationCodeGrant(configuration, callbackUrl, {
+            pkceCodeVerifier: transaction.verifier,
+            expectedState: transaction.state,
+            expectedNonce: transaction.nonce,
+            idTokenExpected: true
+        });
+        const claims = tokens.claims();
+        if (!claims || claims.iss !== settings.issuer || typeof claims.sub !== "string" || !claims.sub
+            || (claims.azp !== undefined && claims.azp !== settings.clientId)) {
+            throw new Error("Invalid OIDC identity.");
+        }
+        const scopes = new Set(settings.scopes.split(" "));
+        const needsEmail = scopes.has("email") && (typeof claims.email !== "string" || typeof claims.email_verified !== "boolean");
+        const needsProfile = scopes.has("profile") && (typeof claims.name !== "string" || typeof claims.picture !== "string");
+        let userInfo = {};
+        if (configuration.serverMetadata().userinfo_endpoint && (needsEmail || needsProfile)) {
+            // The library checks that UserInfo's subject exactly matches the verified ID token.
+            userInfo = await client.fetchUserInfo(configuration, tokens.access_token, claims.sub);
+        }
+        // Keep email and its verification flag from the same response; neither grants account ownership.
+        const emailClaims = typeof userInfo.email === "string" ? userInfo : claims;
+        return {
+            issuer: claims.iss,
+            subject: claims.sub,
+            profile: {
+                email: optionalString(emailClaims.email),
+                emailVerified: emailClaims.email_verified === true,
+                displayName: optionalString(userInfo.name) ?? optionalString(claims.name) ?? optionalString(userInfo.preferred_username) ?? optionalString(claims.preferred_username),
+                pictureUrl: optionalString(userInfo.picture) ?? optionalString(claims.picture)
+            }
+        };
+    }
+    catch {
+        throw new Error("OIDC sign-in failed. Start a new sign-in attempt.");
+    }
+}
+function optionalString(value) {
+    return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+//# sourceMappingURL=oidc.js.map

package/dist/oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAmCxC,sFAAsF;AACtF,MAAM,UAAU,iBAAiB,CAAC,GAAoB;IACpD,MAAM,MAAM,GAAG,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACpG,MAAM,IAAI,KAAK,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;IAC/G,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3D,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAC/F,MAAM,YAAY,GAAG,GAAG,CAAC,2BAA2B,IAAI,SAAS,CAAC;IAClE,MAAM,gBAAgB,GAAG,GAAG,CAAC,wCAAwC,EAAE,IAAI,EAAE,CAAC;IAC9E,MAAM,uBAAuB,GAAG,gBAAgB,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACpG,IAAI,uBAAuB,KAAK,qBAAqB,IAAI,uBAAuB,KAAK,oBAAoB,IAAI,uBAAuB,KAAK,MAAM,EAAE,CAAC;QAChJ,MAAM,IAAI,KAAK,CAAC,oGAAoG,CAAC,CAAC;IACxH,CAAC;IACD,IAAI,uBAAuB,KAAK,MAAM,IAAI,YAAY,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,uBAAuB,KAAK,MAAM,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,kGAAkG,CAAC,CAAC;IACtH,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,sBAAsB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACrG,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;IACtG,CAAC;IACD,OAAO;QACL,MAAM;QACN,QAAQ;QACR,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QACxB,uBAAuB;KACxB,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,eAAe,CAAC,QAAsB;IACpD,OAAO,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;AACnC,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,kBAAkB,CAAC,QAAsB;IACvD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,EAA+E,CAAC;AAC9G,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC9C,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEhC,SAAS,gBAAgB,CAAC,QAAsB;IAC9C,iGAAiG;IACjG,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC1H,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,cAAc,EAAE,CAAC;QAChD,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;YAAE,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,aAAa,CAAC;IACxC,IAAI,cAAc,CAAC,IAAI,IAAI,qBAAqB,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QAClD,IAAI,MAAM,KAAK,SAAS;YAAE,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,aAAa,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QAC/D,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa,KAAK,aAAa;YAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzF,iGAAiG;QACjG,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC,CAAC,CAAC;IACH,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,GAAG,sBAAsB,EAAE,aAAa,EAAE,CAAC,CAAC;IACpF,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,QAAsB;IACzD,MAAM,cAAc,GAAG,QAAQ,CAAC,uBAAuB,KAAK,MAAM;QAChE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;QACf,CAAC,CAAC,QAAQ,CAAC,uBAAuB,KAAK,qBAAqB;YAC1D,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,YAAa,CAAC;YAClD,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,YAAa,CAAC,CAAC;IACtD,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE;QAC5G,SAAS,EAAE,MAAM;QACjB,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,CAAC,MAAM,CAAC,0BAA0B,CAAC;KAC7C,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,aAAa,CAAC,cAAc,EAAE,CAAC;IAChD,4FAA4F;IAC5F,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACpF,KAAK,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,QAAQ,CAAC,iBAAiB,KAAK,SAAS;QAAE,gBAAgB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAC3F,IAAI,QAAQ,CAAC,qCAAqC,IAAI,CAAC,QAAQ,CAAC,qCAAqC,CAAC,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;QACjJ,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,QAAQ,CAAC,gCAAgC,IAAI,CAAC,QAAQ,CAAC,gCAAgC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7G,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACzE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClG,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;QAC1G,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,CAAC;eACrE,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,EAAE,CAAC;QACpB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;IAC/G,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAsB,EAAE,WAAmB;IAC9E,6FAA6F;IAC7F,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACjC,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,sBAAsB,EAAE,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,MAAM,CAAC,qBAAqB,CAAC,aAAa,EAAE;QACtD,YAAY,EAAE,WAAW;QACzB,aAAa,EAAE,MAAM;QACrB,aAAa,EAAE,OAAO;QACtB,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,KAAK;QACL,KAAK;QACL,cAAc,EAAE,MAAM,MAAM,CAAC,0BAA0B,CAAC,QAAQ,CAAC;QACjE,qBAAqB,EAAE,MAAM;KAC9B,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAAsB,EACtB,WAAgB,EAChB,WAA4B,EAC5B,WAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,WAAW,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM,IAAI,WAAW,CAAC,QAAQ,KAAK,gBAAgB,CAAC,QAAQ;eACnG,WAAW,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,IAAI,WAAW,CAAC,IAAI,IAAI,gBAAgB,CAAC,MAAM,IAAI,gBAAgB,CAAC,IAAI;eACpH,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzG,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,aAAa,EAAE,WAAW,EAAE;YAC7E,gBAAgB,EAAE,WAAW,CAAC,QAAQ;YACtC,aAAa,EAAE,WAAW,CAAC,KAAK;YAChC,aAAa,EAAE,WAAW,CAAC,KAAK;YAChC,eAAe,EAAE,IAAI;SACtB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,GAAG;eACzF,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACnD,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC;QAC3H,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC;QACtH,IAAI,QAAQ,GAA4B,EAAE,CAAC;QAC3C,IAAI,aAAa,CAAC,cAAc,EAAE,CAAC,iBAAiB,IAAI,CAAC,UAAU,IAAI,YAAY,CAAC,EAAE,CAAC;YACrF,oFAAoF;YACpF,QAAQ,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QACxF,CAAC;QACD,iGAAiG;QACjG,MAAM,WAAW,GAAG,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3E,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,GAAG;YAClB,OAAO,EAAE,MAAM,CAAC,GAAG;YACnB,OAAO,EAAE;gBACP,KAAK,EAAE,cAAc,CAAC,WAAW,CAAC,KAAK,CAAC;gBACxC,aAAa,EAAE,WAAW,CAAC,cAAc,KAAK,IAAI;gBAClD,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC,kBAAkB,CAAC;gBACrK,UAAU,EAAE,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC;aAC/E;SACF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzE,CAAC"}

package/dist/public-url.d.ts

@@ -0,0 +1,17 @@
+import type { Request } from "express";
+interface BaseUrlOptions {
+    publicBaseUrl: string | undefined;
+    requestBaseUrl: string;
+}
+interface DraftUrlOptions extends BaseUrlOptions {
+    draftId: string;
+}
+export declare function getRequestBaseUrl(req: Request): string;
+export declare function getHomeUrl({ publicBaseUrl, requestBaseUrl }: BaseUrlOptions): string;
+export declare function getDraftPublicUrl({ draftId, publicBaseUrl, requestBaseUrl }: DraftUrlOptions): string;
+export declare function getDraftRawUrl({ draftId, publicBaseUrl, requestBaseUrl }: DraftUrlOptions): string;
+export declare function getDraftIdFromHost({ publicBaseUrl, host }: {
+    publicBaseUrl: string | undefined;
+    host: string | undefined;
+}): string | null;
+export {};

package/dist/public-url.js

@@ -0,0 +1,96 @@
+const DRAFT_ID_PATTERN = /^[a-z0-9]{12}$/;
+export function getRequestBaseUrl(req) {
+    const forwardedProto = req.get("x-forwarded-proto");
+    const protocol = forwardedProto
+        ? forwardedProto.split(",")[0].trim()
+        : req.protocol || "http";
+    return `${protocol}://${req.get("host")}`;
+}
+export function getHomeUrl({ publicBaseUrl, requestBaseUrl }) {
+    const configured = normalizeUrl(publicBaseUrl);
+    const wildcard = parseWildcardBaseUrl(configured);
+    if (wildcard) {
+        wildcard.hostname = wildcard.hostname.slice(2);
+        wildcard.pathname = "/";
+        wildcard.search = "";
+        wildcard.hash = "";
+        return stripTrailingSlash(wildcard.toString());
+    }
+    return configured || normalizeUrl(requestBaseUrl);
+}
+export function getDraftPublicUrl({ draftId, publicBaseUrl, requestBaseUrl }) {
+    const configured = normalizeUrl(publicBaseUrl);
+    const wildcard = parseWildcardBaseUrl(configured);
+    if (wildcard) {
+        wildcard.hostname = `${draftId}.${wildcard.hostname.slice(2)}`;
+        wildcard.pathname = "/";
+        wildcard.search = "";
+        wildcard.hash = "";
+        return stripTrailingSlash(wildcard.toString());
+    }
+    const baseUrl = configured || normalizeUrl(requestBaseUrl);
+    return `${baseUrl}/d/${draftId}`;
+}
+export function getDraftRawUrl({ draftId, publicBaseUrl, requestBaseUrl }) {
+    const configured = normalizeUrl(publicBaseUrl);
+    const wildcard = parseWildcardBaseUrl(configured);
+    if (wildcard) {
+        wildcard.hostname = wildcard.hostname.slice(2);
+        wildcard.pathname = `/d/${draftId}/raw`;
+        wildcard.search = "";
+        wildcard.hash = "";
+        return wildcard.toString();
+    }
+    const baseUrl = configured || normalizeUrl(requestBaseUrl);
+    return `${baseUrl}/d/${draftId}/raw`;
+}
+export function getDraftIdFromHost({ publicBaseUrl, host }) {
+    const wildcard = parseWildcardBaseUrl(publicBaseUrl);
+    if (!wildcard)
+        return null;
+    const rootHost = wildcard.hostname.slice(2).toLowerCase();
+    const requestHost = parseHost(host);
+    if (!requestHost || !requestHost.endsWith(`.${rootHost}`))
+        return null;
+    const draftId = requestHost.slice(0, -(rootHost.length + 1));
+    if (draftId.includes(".") || !DRAFT_ID_PATTERN.test(draftId))
+        return null;
+    return draftId;
+}
+function parseWildcardBaseUrl(value) {
+    const url = parseUrl(value);
+    if (!url || !url.hostname.startsWith("*."))
+        return null;
+    return url;
+}
+function parseHost(value) {
+    const normalized = String(value || "").trim();
+    if (!normalized)
+        return null;
+    try {
+        return new URL(`http://${normalized}`).hostname.toLowerCase();
+    }
+    catch {
+        return null;
+    }
+}
+function parseUrl(value) {
+    const normalized = normalizeUrl(value);
+    if (!normalized)
+        return null;
+    try {
+        return new URL(normalized);
+    }
+    catch {
+        return null;
+    }
+}
+function normalizeUrl(value) {
+    if (typeof value !== "string")
+        return "";
+    return value.trim().replace(/\/+$/, "");
+}
+function stripTrailingSlash(value) {
+    return value.replace(/\/+$/, "");
+}
+//# sourceMappingURL=public-url.js.map

package/dist/public-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-url.js","sourceRoot":"","sources":["../src/public-url.ts"],"names":[],"mappings":"AAEA,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAW1C,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,MAAM,cAAc,GAAG,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,cAAc;QAC7B,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE;QACtC,CAAC,CAAC,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC;IAC3B,OAAO,GAAG,QAAQ,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,EAAE,aAAa,EAAE,cAAc,EAAkB;IAC1E,MAAM,UAAU,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAElD,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/C,QAAQ,CAAC,QAAQ,GAAG,GAAG,CAAC;QACxB,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC;QACrB,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC;QACnB,OAAO,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,UAAU,IAAI,YAAY,CAAC,cAAc,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAmB;IAC3F,MAAM,UAAU,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAElD,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,QAAQ,GAAG,GAAG,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,QAAQ,CAAC,QAAQ,GAAG,GAAG,CAAC;QACxB,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC;QACrB,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC;QACnB,OAAO,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,IAAI,YAAY,CAAC,cAAc,CAAC,CAAC;IAC3D,OAAO,GAAG,OAAO,MAAM,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAmB;IACxF,MAAM,UAAU,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAElD,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/C,QAAQ,CAAC,QAAQ,GAAG,MAAM,OAAO,MAAM,CAAC;QACxC,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC;QACrB,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC;QACnB,OAAO,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,IAAI,YAAY,CAAC,cAAc,CAAC,CAAC;IAC3D,OAAO,GAAG,OAAO,MAAM,OAAO,MAAM,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,EACjC,aAAa,EACb,IAAI,EAIL;IACC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;IACrD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1D,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,QAAQ,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvE,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7D,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAE7B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,UAAU,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAE7B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC"}

package/dist/rate-limit.d.ts

@@ -0,0 +1,25 @@
+import type { Request, RequestHandler } from "express";
+interface RateLimiterOptions {
+    windowMs: number;
+    max: number;
+    keyPrefix: string;
+    key?: (req: Request) => string;
+}
+export declare class RateLimitStore {
+    private readonly capacity;
+    private readonly clock;
+    private readonly buckets;
+    private nextSweepAt;
+    constructor(capacity?: number, clock?: () => number);
+    get size(): number;
+    check(bucketKey: string, windowMs: number, max: number): {
+        allowed: boolean;
+        retryAfter: number;
+    };
+}
+export declare function checkRateLimit(bucketKey: string, windowMs: number, max: number): {
+    allowed: boolean;
+    retryAfter: number;
+};
+export declare function createRateLimiter({ windowMs, max, keyPrefix, key }: RateLimiterOptions): RequestHandler;
+export {};

package/dist/rate-limit.js

@@ -0,0 +1,55 @@
+// Single-process protection: expired entries are swept on traffic, cardinality
+// is capped, and capacity pressure never evicts a live bucket to reset its limit.
+export class RateLimitStore {
+    capacity;
+    clock;
+    buckets = new Map();
+    nextSweepAt = 0;
+    constructor(capacity = 10_000, clock = Date.now) {
+        this.capacity = capacity;
+        this.clock = clock;
+        if (!Number.isInteger(capacity) || capacity < 1)
+            throw new Error("Rate-limit capacity must be positive.");
+    }
+    get size() { return this.buckets.size; }
+    check(bucketKey, windowMs, max) {
+        if (bucketKey.length > 1024 || !Number.isFinite(windowMs) || windowMs <= 0 ||
+            !Number.isInteger(max) || max < 1)
+            return { allowed: false, retryAfter: 1 };
+        const now = this.clock();
+        if (now >= this.nextSweepAt) {
+            for (const [key, bucket] of this.buckets)
+                if (bucket.resetAt <= now)
+                    this.buckets.delete(key);
+            this.nextSweepAt = now + 1000;
+        }
+        const current = this.buckets.get(bucketKey);
+        if (!current || current.resetAt <= now) {
+            if (!current && this.buckets.size >= this.capacity)
+                return { allowed: false, retryAfter: 1 };
+            this.buckets.set(bucketKey, { count: 1, resetAt: now + windowMs });
+            return { allowed: true, retryAfter: 0 };
+        }
+        current.count += 1;
+        return current.count > max
+            ? { allowed: false, retryAfter: Math.ceil((current.resetAt - now) / 1000) }
+            : { allowed: true, retryAfter: 0 };
+    }
+}
+const store = new RateLimitStore();
+export function checkRateLimit(bucketKey, windowMs, max) {
+    return store.check(bucketKey, windowMs, max);
+}
+export function createRateLimiter({ windowMs, max, keyPrefix, key }) {
+    return function rateLimiter(req, res, next) {
+        const identity = key ? key(req) : req.auth?.id || req.ip || "anonymous";
+        const bucketKey = `${keyPrefix}:${identity}`;
+        const result = checkRateLimit(bucketKey, windowMs, max);
+        if (!result.allowed) {
+            res.setHeader("Retry-After", String(result.retryAfter));
+            return res.status(429).json({ ok: false, error: "Upload rate limit exceeded." });
+        }
+        next();
+    };
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../src/rate-limit.ts"],"names":[],"mappings":"AAcA,+EAA+E;AAC/E,kFAAkF;AAClF,MAAM,OAAO,cAAc;IAII;IAAoC;IAHhD,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IACtD,WAAW,GAAG,CAAC,CAAC;IAExB,YAA6B,WAAW,MAAM,EAAmB,QAAQ,IAAI,CAAC,GAAG;QAApD,aAAQ,GAAR,QAAQ,CAAS;QAAmB,UAAK,GAAL,KAAK,CAAW;QAC/E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC5G,CAAC;IAED,IAAI,IAAI,KAAa,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAEhD,KAAK,CAAC,SAAiB,EAAE,QAAgB,EAAE,GAAW;QACpD,IAAI,SAAS,CAAC,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC;YACtE,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;QAChF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,GAAG,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO;gBAAE,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG;oBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9F,IAAI,CAAC,WAAW,GAAG,GAAG,GAAG,IAAI,CAAC;QAChC,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;YACvC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ;gBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;YAC7F,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,QAAQ,EAAE,CAAC,CAAC;YACnE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;QAC1C,CAAC;QACD,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;QACnB,OAAO,OAAO,CAAC,KAAK,GAAG,GAAG;YACxB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,EAAE;YAC3E,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;IACvC,CAAC;CACF;AAED,MAAM,KAAK,GAAG,IAAI,cAAc,EAAE,CAAC;AAEnC,MAAM,UAAU,cAAc,CAC5B,SAAiB,EACjB,QAAgB,EAChB,GAAW;IAEX,OAAO,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAsB;IACrF,OAAO,SAAS,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI;QACxC,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,WAAW,CAAC;QACxE,MAAM,SAAS,GAAG,GAAG,SAAS,IAAI,QAAQ,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YACxD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/reconcile.d.ts

@@ -0,0 +1,5 @@
+export declare function runReconciliation(): Promise<{
+    finalized: number;
+    failed: number;
+    pending: number;
+}>;

package/dist/reconcile.js

@@ -0,0 +1,18 @@
+import { reconcilePendingUploads } from "./upload-state.js";
+let running = false;
+export async function runReconciliation() {
+    if (running)
+        return { finalized: 0, failed: 0, pending: 0 };
+    running = true;
+    try {
+        const result = await reconcilePendingUploads();
+        if (result.finalized || result.failed || result.pending) {
+            console.log("openplan reconciliation completed", result);
+        }
+        return result;
+    }
+    finally {
+        running = false;
+    }
+}
+//# sourceMappingURL=reconcile.js.map

package/dist/reconcile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile.js","sourceRoot":"","sources":["../src/reconcile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,IAAI,OAAO,GAAG,KAAK,CAAC;AAEpB,MAAM,CAAC,KAAK,UAAU,iBAAiB;IAKrC,IAAI,OAAO;QAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC5D,OAAO,GAAG,IAAI,CAAC;IACf,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAC;QAC/C,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,mCAAmC,EAAE,MAAM,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/render-annotations.d.ts

@@ -0,0 +1,10 @@
+export interface AnnotationViewerInput {
+    title: string;
+    frameSrc: string;
+    draftId: string;
+    versionId: string;
+    versionNumber: number;
+    contentHash: string;
+}
+export declare function renderAnnotationViewer(input: AnnotationViewerInput): string;
+export declare function annotationViewerContentSecurityPolicy(): string;

package/dist/render-annotations.js

@@ -0,0 +1,73 @@
+export function renderAnnotationViewer(input) {
+    return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Annotate — ${escapeHtml(input.title)}</title>
+  <style>
+    * { box-sizing: border-box; }
+    html, body { height: 100%; }
+    body { margin: 0; display: grid; grid-template-rows: auto 1fr; background: #0f172a; color: #e2e8f0; font-family: ui-sans-serif, system-ui, sans-serif; }
+    .toolbar { display: flex; flex-wrap: wrap; align-items: center; gap: 7px; padding: 9px 12px; background: #111827; border-bottom: 1px solid #334155; box-shadow: 0 4px 18px rgba(0,0,0,.22); z-index: 2; }
+    .toolbar strong { margin-right: 6px; }
+    button, .export { border: 1px solid #475569; border-radius: 7px; padding: 7px 10px; background: #1e293b; color: #e2e8f0; cursor: pointer; font: inherit; font-size: 13px; }
+    button:hover, button.active { background: #0f766e; border-color: #2dd4bf; }
+    button.danger:hover { background: #991b1b; border-color: #f87171; }
+    label { display: inline-flex; align-items: center; gap: 5px; color: #cbd5e1; font-size: 12px; }
+    input[type="color"] { width: 34px; height: 30px; padding: 1px; border: 0; background: transparent; }
+    input[type="range"] { width: 86px; }
+    .status { flex: 1 1 260px; margin: 0 4px; color: #94a3b8; font-size: 12px; text-align: right; }
+    .privacy { flex: 1 1 100%; color: #cbd5e1; font-size: 12px; }
+    .privacy summary { width: fit-content; color: #99f6e4; cursor: pointer; }
+    .privacy p { max-width: 980px; margin: 7px 0 0; line-height: 1.45; }
+    iframe { width: 100%; height: 100%; border: 0; background: white; }
+    @media (max-width: 720px) { .status { order: 2; flex-basis: 100%; text-align: left; } button { padding: 7px 8px; } }
+  </style>
+  <script src="/assets/openplan-annotations.v1.js" defer></script>
+</head>
+<body data-draft-id="${escapeHtml(input.draftId)}" data-version-id="${escapeHtml(input.versionId)}" data-version-number="${input.versionNumber}" data-content-hash="${escapeHtml(input.contentHash)}">
+  <header class="toolbar" id="openplan-annotation-toolbar">
+    <strong>Annotate</strong>
+    <button type="button" data-action="pan">Browse</button>
+    <button type="button" data-action="pen">Pen</button>
+    <button type="button" data-action="highlighter">Marker</button>
+    <button type="button" data-action="text">Text highlight</button>
+    <label>Color <input id="openplan-annotation-color" type="color" value="#ef4444" aria-label="Annotation color"></label>
+    <label>Width <input id="openplan-annotation-width" type="range" min="1" max="16" value="4" aria-label="Stroke width"></label>
+    <button type="button" data-action="undo">Undo</button>
+    <button type="button" data-action="redo">Redo</button>
+    <button type="button" data-action="visibility">Show / hide</button>
+    <button type="button" data-action="export-svg">Export SVG</button>
+    <button type="button" data-action="export-json">Export JSON</button>
+    <button class="danger" type="button" data-action="clear">Clear</button>
+    <p class="status" id="openplan-annotation-status" aria-live="polite">Loading plan…</p>
+    <details class="privacy">
+      <summary>Local-only storage, loss, and recovery</summary>
+      <p>Annotations stay in this browser profile and do not follow you to another browser or device. Clearing site data, private browsing, changing browser profiles, or uninstalling the browser can remove them. Openplan support and plan owners cannot recover lost annotations. You are responsible for keeping any exported files.</p>
+    </details>
+  </header>
+  <iframe id="openplan-plan-frame" src="${escapeHtml(input.frameSrc)}" title="${escapeHtml(input.title)}" sandbox="allow-same-origin"></iframe>
+</body>
+</html>`;
+}
+export function annotationViewerContentSecurityPolicy() {
+    return [
+        "default-src 'none'",
+        "script-src 'self'",
+        "style-src 'unsafe-inline'",
+        "frame-src 'self'",
+        "img-src 'self' data:",
+        "connect-src 'none'",
+        "base-uri 'none'",
+        "form-action 'none'"
+    ].join("; ");
+}
+function escapeHtml(value) {
+    return String(value)
+        .replaceAll("&", "&amp;")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;");
+}
+//# sourceMappingURL=render-annotations.js.map

package/dist/render-annotations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"render-annotations.js","sourceRoot":"","sources":["../src/render-annotations.ts"],"names":[],"mappings":"AASA,MAAM,UAAU,sBAAsB,CAAC,KAA4B;IACjE,OAAO;;;;;sBAKa,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;;uBAsBtB,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,sBAAsB,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,0BAA0B,KAAK,CAAC,aAAa,wBAAwB,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC;;;;;;;;;;;;;;;;;;;;;0CAqBzJ,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC;;QAE/F,CAAC;AACT,CAAC;AAED,MAAM,UAAU,qCAAqC;IACnD,OAAO;QACL,oBAAoB;QACpB,mBAAmB;QACnB,2BAA2B;QAC3B,kBAAkB;QAClB,sBAAsB;QACtB,oBAAoB;QACpB,iBAAiB;QACjB,oBAAoB;KACrB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,MAAM,CAAC,KAAK,CAAC;SACjB,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC/B,CAAC"}

package/dist/render-web.d.ts

@@ -0,0 +1,74 @@
+import type { DraftDetailResult, DraftSummary, DraftVersion, DateValue } from "./drafts.js";
+import type { AccessPolicyView } from "./access-policy.js";
+import type { LocalUserSummary } from "./local-auth.js";
+export interface SessionView {
+    accountId?: string;
+    accountName?: string;
+    email?: string | null;
+    pictureUrl?: string | null;
+}
+export interface ApiKeyView {
+    id: string;
+    name: string;
+    created_at: DateValue;
+    last_used_at: DateValue | null;
+}
+export declare function renderSignIn({ next, provider, error, message }: {
+    next?: string;
+    provider?: "shoo" | "local" | "oidc";
+    error?: string;
+    message?: string;
+}): string;
+export declare function renderAccountSecurity({ session, local, message, error, isAdmin }: {
+    session: SessionView;
+    local: boolean;
+    message?: string;
+    error?: string;
+    isAdmin?: boolean;
+}): string;
+export declare function renderAdminUsers({ session, users, error }: {
+    session: SessionView;
+    users: LocalUserSummary[];
+    error?: string;
+}): string;
+export declare function renderAuthError({ message }: {
+    message: string;
+}): string;
+export declare function renderSharePassword({ title, action, error }: {
+    title: string;
+    action: string;
+    error?: string;
+}): string;
+export declare function renderDashboard({ session, drafts, isAdmin }: {
+    session: SessionView;
+    drafts: DraftSummary[];
+    isAdmin?: boolean;
+}): string;
+export declare function renderAdminFeatures({ session, enabled, updatedAt, localUsers }: {
+    session: SessionView;
+    enabled: boolean;
+    updatedAt: DateValue | null;
+    localUsers?: boolean;
+}): string;
+export declare function renderDraftDetail({ session, draft, versions, access, annotationsEnabled, isAdmin }: {
+    session: SessionView;
+    draft: DraftDetailResult["draft"];
+    versions: DraftVersion[];
+    access?: {
+        plan: AccessPolicyView;
+        versions: Map<number, AccessPolicyView>;
+    };
+    annotationsEnabled?: boolean;
+    isAdmin?: boolean;
+}): string;
+export declare function renderCliAuth({ session, keys, isAdmin }: {
+    session: SessionView;
+    keys?: ApiKeyView[];
+    isAdmin?: boolean;
+}): string;
+export declare function renderCliAuthKey({ session, token, keyName, isAdmin }: {
+    session: SessionView;
+    token: string;
+    keyName: string;
+    isAdmin?: boolean;
+}): string;