@insiderfinance/totalfinance 0.1.0

package/modules/http/dist/openapi.js

@@ -0,0 +1,431 @@
+/**
+ * OpenAPI 3.1 for the local HTTP server (Stage 7A Decision 7): generated from the registry — the
+ * operations' JSON Schemas verbatim (components keyed by id), one error schema (`OperationError`),
+ * and the `x-totalfinance` vendor extension carrying each operation's effect metadata and annotations.
+ * Deterministic (ids sorted) so the committed document diffs cleanly.
+ */
+import { ErrorCode, InputError } from '../../core/dist/index.js';
+import { OPERATION_BUDGETS, RESOURCE_HANDLE_SCHEMA, WORKFLOWS_VERSION, operationResultSchema as sharedOperationResultSchema, } from '../../workflows/dist/index.js';
+import { operationWrites } from './security.js';
+const OPERATION_ERROR = {
+    type: 'object',
+    description: 'Every non-2xx body: the same document the CLI prints and the MCP server returns.',
+    properties: {
+        code: {
+            type: 'string',
+            description: 'A registered TotalFinance error code (input.*, operation.*, …)',
+        },
+        message: { type: 'string' },
+        context: { type: 'object' },
+        operation: {
+            type: 'object',
+            properties: { id: { type: 'string' }, version: { type: 'string' } },
+            required: ['id', 'version'],
+        },
+    },
+    required: ['code', 'message', 'context', 'operation'],
+};
+const RESOURCE_HANDLE = RESOURCE_HANDLE_SCHEMA;
+const JOB_RECORD = {
+    type: 'object',
+    properties: {
+        id: { type: 'string' },
+        operation: {
+            type: 'object',
+            properties: { id: { type: 'string' }, version: { type: 'string' } },
+            required: ['id', 'version'],
+        },
+        state: {
+            type: 'string',
+            enum: ['accepted', 'queued', 'running', 'completed', 'failed', 'cancelled'],
+        },
+        progress: {
+            type: ['object', 'null'],
+            properties: { stage: { type: 'string' }, fraction: { type: ['number', 'null'] } },
+        },
+        inputsHash: { type: 'string' },
+        seed: { type: ['integer', 'null'] },
+        submittedAt: { type: 'string' },
+        startedAt: { type: ['string', 'null'] },
+        finishedAt: { type: ['string', 'null'] },
+        result: { oneOf: [{ $ref: '#/components/schemas/ResourceHandle' }, { type: 'null' }] },
+        error: { oneOf: [{ $ref: '#/components/schemas/OperationError' }, { type: 'null' }] },
+        usage: { type: 'object', properties: { elapsedMs: { type: ['number', 'null'] } } },
+    },
+    required: [
+        'id',
+        'operation',
+        'state',
+        'progress',
+        'inputsHash',
+        'seed',
+        'submittedAt',
+        'startedAt',
+        'finishedAt',
+        'result',
+        'error',
+        'usage',
+    ],
+};
+const OPERATION_DESCRIPTION = {
+    type: 'object',
+    description: 'describeOperation(...) — the transport-neutral description every adapter renders.',
+    properties: {
+        id: { type: 'string' },
+        version: { type: 'string' },
+        title: { type: 'string' },
+        description: { type: 'string' },
+        inputSchema: { type: 'object' },
+        outputSchema: { type: ['object', 'null'] },
+        sideEffect: { type: 'string', enum: ['none', 'portfolio-state', 'external-order'] },
+        authorization: { type: 'string', enum: ['none', 'policy', 'human'] },
+        idempotency: { type: 'string', enum: ['not-applicable', 'optional', 'required'] },
+        deterministic: { type: 'boolean' },
+        stochastic: { oneOf: [{ type: 'boolean' }, { type: 'string', enum: ['per-call'] }] },
+        costClass: { type: 'string', enum: ['small', 'medium', 'large', 'job'] },
+        requiredCapabilities: { type: 'array', items: { type: 'string' } },
+        supportsCancellation: { type: 'boolean' },
+        handleFields: { type: 'array', items: { type: 'string' } },
+        annotations: {
+            type: 'object',
+            properties: {
+                readOnlyHint: { type: 'boolean' },
+                destructiveHint: { type: 'boolean' },
+                idempotentHint: { type: 'boolean' },
+                openWorldHint: { type: 'boolean' },
+            },
+            required: ['readOnlyHint', 'destructiveHint', 'idempotentHint', 'openWorldHint'],
+        },
+    },
+    required: [
+        'id',
+        'version',
+        'title',
+        'description',
+        'inputSchema',
+        'outputSchema',
+        'sideEffect',
+        'authorization',
+        'idempotency',
+        'deterministic',
+        'stochastic',
+        'costClass',
+        'requiredCapabilities',
+        'supportsCancellation',
+        'handleFields',
+        'annotations',
+    ],
+};
+function operationResultSchema(outputRef) {
+    // One envelope definition for every transport (workflows/envelope-schema): the HTTP document
+    // refers to the shared handle and per-operation output components by `$ref`.
+    return sharedOperationResultSchema({
+        ...(outputRef === null ? {} : { structured: { $ref: outputRef } }),
+        handle: { $ref: '#/components/schemas/ResourceHandle' },
+    });
+}
+const errorResponse = (description) => ({
+    description,
+    content: { 'application/json': { schema: { $ref: '#/components/schemas/OperationError' } } },
+});
+const ERROR_RESPONSES = {
+    '400': errorResponse('The input was refused (an input.* code).'),
+    '401': errorResponse('Missing or invalid bearer credential (operation.capability_missing).'),
+    '403': errorResponse('Untrusted Host/Origin, missing server capability, or mutations disabled without a credential.'),
+    '404': errorResponse('Unknown operation, job, or handle.'),
+    '413': errorResponse('The input exceeds the wire byte budget (operation.input_too_large).'),
+    '415': errorResponse('JSON POST requests require Content-Type: application/json (input.wrong_shape).'),
+    '422': errorResponse('The operation failed (any other operation error).'),
+    '500': errorResponse('Internal error (operation.internal).'),
+};
+function vendorExtension(description) {
+    return {
+        'x-totalfinance': {
+            sideEffect: description.sideEffect,
+            authorization: description.authorization,
+            idempotency: description.idempotency,
+            deterministic: description.deterministic,
+            stochastic: description.stochastic,
+            costClass: description.costClass,
+            supportsCancellation: description.supportsCancellation,
+            handleFields: description.handleFields,
+            annotations: description.annotations,
+        },
+    };
+}
+/** Generate the OpenAPI 3.1 document for a registry. */
+export function openApiDocument(input) {
+    const functionName = 'openApiDocument';
+    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+        throw new InputError(`${functionName}: input must be an object ({ registry, serverUrl? }).`, {
+            code: ErrorCode.InputWrongType,
+            context: { function: functionName, field: 'input' },
+        });
+    }
+    for (const key of Object.keys(input)) {
+        if (key !== 'registry' && key !== 'serverUrl') {
+            throw new InputError(`${functionName}: unknown field "${key}" in input. Allowed fields: registry, serverUrl.`, {
+                code: ErrorCode.InputUnknownField,
+                context: { function: functionName, field: 'input', key },
+            });
+        }
+    }
+    const registry = input.registry;
+    if (registry === null ||
+        typeof registry !== 'object' ||
+        ['list', 'get', 'require', 'describe', 'run', 'packs'].some((member) => typeof registry[member] !== 'function') ||
+        !Number.isSafeInteger(registry['size']) ||
+        registry['size'] < 0) {
+        throw new InputError(`${functionName}: input.registry must be an OperationRegistry.`, {
+            code: ErrorCode.InputWrongType,
+            context: { function: functionName, field: 'input.registry' },
+        });
+    }
+    if (input.serverUrl !== undefined &&
+        (typeof input.serverUrl !== 'string' || !/^https?:\/\//.test(input.serverUrl))) {
+        throw new InputError(`${functionName}: input.serverUrl must be an http(s) url when present.`, {
+            code: typeof input.serverUrl === 'string' ? ErrorCode.InputWrongShape : ErrorCode.InputWrongType,
+            context: { function: functionName, field: 'input.serverUrl' },
+        });
+    }
+    const descriptions = [...input.registry.list()].sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
+    const schemas = {
+        OperationError: OPERATION_ERROR,
+        ResourceHandle: RESOURCE_HANDLE,
+        JobRecord: JOB_RECORD,
+        OperationDescription: OPERATION_DESCRIPTION,
+        OperationResult: operationResultSchema(null),
+    };
+    const paths = {
+        '/operations': {
+            get: {
+                operationId: 'listOperations',
+                summary: 'Every registered operation, described',
+                responses: {
+                    '200': {
+                        description: 'The descriptions, in registry order.',
+                        content: {
+                            'application/json': {
+                                schema: {
+                                    type: 'array',
+                                    items: { $ref: '#/components/schemas/OperationDescription' },
+                                },
+                            },
+                        },
+                    },
+                },
+            },
+        },
+        '/operations/{id}': {
+            get: {
+                operationId: 'describeOperation',
+                summary: 'One operation, described',
+                parameters: [{ name: 'id', in: 'path', required: true, schema: { type: 'string' } }],
+                responses: {
+                    '200': {
+                        description: 'The description.',
+                        content: {
+                            'application/json': { schema: { $ref: '#/components/schemas/OperationDescription' } },
+                        },
+                    },
+                    '404': ERROR_RESPONSES['404'],
+                },
+            },
+        },
+    };
+    for (const description of descriptions) {
+        const inputName = `${description.id}.input`;
+        const outputName = `${description.id}.output`;
+        schemas[inputName] = description.inputSchema;
+        if (description.outputSchema !== null)
+            schemas[outputName] = description.outputSchema;
+        const resultName = `${description.id}.result`;
+        schemas[resultName] = operationResultSchema(description.outputSchema !== null ? `#/components/schemas/${outputName}` : null);
+        paths[`/operations/${description.id}/run`] = {
+            post: {
+                operationId: `run.${description.id}`,
+                security: operationWrites(description) ? [{ localBearer: [] }] : [],
+                summary: description.title,
+                description: description.description,
+                requestBody: {
+                    required: true,
+                    content: {
+                        'application/json': { schema: { $ref: `#/components/schemas/${inputName}` } },
+                    },
+                },
+                responses: {
+                    '200': {
+                        description: 'The OperationResult.',
+                        content: {
+                            'application/json': { schema: { $ref: `#/components/schemas/${resultName}` } },
+                        },
+                    },
+                    ...ERROR_RESPONSES,
+                },
+                ...vendorExtension(description),
+            },
+        };
+    }
+    paths['/jobs'] = {
+        post: {
+            operationId: 'submitJob',
+            security: [{ localBearer: [] }],
+            description: 'Job creation persists state even for analytics and always requires the server-owned bearer token. Without a configured token, submission is disabled; inline read-only /run calls remain public.',
+            summary: 'Submit an operation as a job (a job-class operation runs in a worker; others inline)',
+            requestBody: {
+                required: true,
+                content: {
+                    'application/json': {
+                        schema: {
+                            type: 'object',
+                            properties: {
+                                id: { type: 'string' },
+                                input: { type: 'object' },
+                                seed: { type: 'integer' },
+                            },
+                            required: ['id', 'input'],
+                            additionalProperties: false,
+                        },
+                    },
+                },
+            },
+            responses: {
+                '202': {
+                    description: 'The accepted (or, inline, terminal) record.',
+                    content: { 'application/json': { schema: { $ref: '#/components/schemas/JobRecord' } } },
+                },
+                ...ERROR_RESPONSES,
+            },
+        },
+    };
+    paths['/jobs/{id}'] = {
+        get: {
+            operationId: 'getJob',
+            summary: 'The job record',
+            parameters: [{ name: 'id', in: 'path', required: true, schema: { type: 'string' } }],
+            responses: {
+                '200': {
+                    description: 'The record.',
+                    content: { 'application/json': { schema: { $ref: '#/components/schemas/JobRecord' } } },
+                },
+                '404': ERROR_RESPONSES['404'],
+            },
+        },
+    };
+    paths['/jobs/{id}/cancel'] = {
+        post: {
+            operationId: 'cancelJob',
+            security: [{ localBearer: [] }],
+            description: 'Cancellation mutates persisted job state and always requires the server-owned bearer token. No JSON body is required.',
+            summary: 'Cancel a job — the worker is terminated; the record moves to cancelled',
+            parameters: [{ name: 'id', in: 'path', required: true, schema: { type: 'string' } }],
+            responses: {
+                '200': {
+                    description: 'The cancelled (or already terminal) record.',
+                    content: { 'application/json': { schema: { $ref: '#/components/schemas/JobRecord' } } },
+                },
+                ...ERROR_RESPONSES,
+            },
+        },
+    };
+    paths['/jobs/{id}/result'] = {
+        get: {
+            operationId: 'getJobResult',
+            summary: 'The stored OperationResult of a completed job',
+            parameters: [{ name: 'id', in: 'path', required: true, schema: { type: 'string' } }],
+            responses: {
+                '200': {
+                    description: 'The OperationResult.',
+                    content: {
+                        'application/json': { schema: { $ref: '#/components/schemas/OperationResult' } },
+                    },
+                },
+                '404': ERROR_RESPONSES['404'],
+                '409': errorResponse('The job was cancelled (operation.cancelled) or has not finished.'),
+                '422': ERROR_RESPONSES['422'],
+            },
+        },
+    };
+    paths['/artifacts/{uri}'] = {
+        get: {
+            operationId: 'getArtifact',
+            summary: 'A stored value by handle uri (url-encoded)',
+            parameters: [{ name: 'uri', in: 'path', required: true, schema: { type: 'string' } }],
+            responses: {
+                '200': {
+                    description: 'The handle and the stored value.',
+                    content: {
+                        'application/json': {
+                            schema: {
+                                type: 'object',
+                                properties: {
+                                    handle: { $ref: '#/components/schemas/ResourceHandle' },
+                                    value: { type: 'object' },
+                                },
+                                required: ['handle', 'value'],
+                            },
+                        },
+                    },
+                },
+                '404': ERROR_RESPONSES['404'],
+            },
+        },
+    };
+    paths['/capabilities'] = {
+        get: {
+            operationId: 'capabilities',
+            summary: 'Packs, budgets, the seed policy, and which stores are attached',
+            responses: {
+                '200': {
+                    description: 'The capabilities.',
+                    content: { 'application/json': { schema: { type: 'object' } } },
+                },
+            },
+        },
+    };
+    paths['/openapi.json'] = {
+        get: {
+            operationId: 'openapi',
+            summary: 'This document',
+            responses: {
+                '200': {
+                    description: 'The OpenAPI 3.1 document.',
+                    content: { 'application/json': { schema: { type: 'object' } } },
+                },
+            },
+        },
+    };
+    // Host/Origin and malformed-target checks also protect all discovery and read routes.
+    for (const methods of Object.values(paths)) {
+        for (const operation of Object.values(methods)) {
+            const route = operation;
+            route.responses['400'] ??= ERROR_RESPONSES['400'];
+            route.responses['403'] ??= ERROR_RESPONSES['403'];
+        }
+    }
+    return {
+        openapi: '3.1.0',
+        info: {
+            title: 'TotalFinance local operations',
+            version: WORKFLOWS_VERSION,
+            description: `The local, read-only-by-default, loopback HTTP transport over the TotalFinance operation registry (${descriptions.length} operations across ${input.registry.packs().length} packs). ` +
+                `Host and any Origin must match this server's host and bound port; null/foreign origins are refused. JSON POSTs require application/json. ` +
+                `Enabled writes (including trade:approve) and job creation/cancellation require a server-owned bearer credential; read-only analytics and discovery remain unauthenticated. A credential does not grant capabilities. ` +
+                `Every request body is the operation's own input schema; every error body is one OperationError. ` +
+                `Wire byte budget default ${OPERATION_BUDGETS.maxInputBytes.transportDefault}.`,
+        },
+        servers: [{ url: input.serverUrl ?? 'http://127.0.0.1:8787', description: 'loopback' }],
+        paths,
+        components: {
+            schemas,
+            securitySchemes: {
+                localBearer: {
+                    type: 'http',
+                    scheme: 'bearer',
+                    description: 'Server-owned authenticationToken, at least 32 cryptographically random characters. Configure via --token-file or TOTALFINANCE_HTTP_TOKEN; send Authorization: Bearer <token>. Required for enabled writes (including approval), job creation and cancellation. Absent configuration disables job mutations. Read-only analytics remain public. No token is published in this document.',
+                },
+            },
+        },
+    };
+}
+//# sourceMappingURL=openapi.js.map

package/modules/http/dist/openapi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.js","sourceRoot":"","sources":["../src/openapi.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,0BAAoB,CAAC;AAE3D,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,iBAAiB,EAGjB,qBAAqB,IAAI,2BAA2B,GACrD,MAAM,+BAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAoBhD,MAAM,eAAe,GAAe;IAClC,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,kFAAkF;IAC/F,UAAU,EAAE;QACV,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,gEAAgE;SAC9E;QACD,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC3B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC3B,SAAS,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;YACnE,QAAQ,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC;SAC5B;KACF;IACD,QAAQ,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC;CACtD,CAAC;AAEF,MAAM,eAAe,GAAe,sBAAsB,CAAC;AAE3D,MAAM,UAAU,GAAe;IAC7B,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACtB,SAAS,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;YACnE,QAAQ,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC;SAC5B;QACD,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,CAAC;SAC5E;QACD,QAAQ,EAAE;YACR,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;YACxB,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE;SAClF;QACD,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC9B,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE;QACnC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC/B,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE;QACvC,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE;QACxC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,qCAAqC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE;QACtF,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,qCAAqC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE;QACrF,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE;KACnF;IACD,QAAQ,EAAE;QACR,IAAI;QACJ,WAAW;QACX,OAAO;QACP,UAAU;QACV,YAAY;QACZ,MAAM;QACN,aAAa;QACb,WAAW;QACX,YAAY;QACZ,QAAQ;QACR,OAAO;QACP,OAAO;KACR;CACF,CAAC;AAEF,MAAM,qBAAqB,GAAe;IACxC,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,mFAAmF;IAChG,UAAU,EAAE;QACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACtB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACzB,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC/B,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC/B,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE;QAC1C,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,EAAE;QACnF,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE;QACpE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE;QACjF,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAClC,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE;QACpF,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE;QACxE,oBAAoB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;QAClE,oBAAoB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QACzC,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;QAC1D,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gBACjC,eAAe,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gBACpC,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gBACnC,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;aACnC;YACD,QAAQ,EAAE,CAAC,cAAc,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,eAAe,CAAC;SACjF;KACF;IACD,QAAQ,EAAE;QACR,IAAI;QACJ,SAAS;QACT,OAAO;QACP,aAAa;QACb,aAAa;QACb,cAAc;QACd,YAAY;QACZ,eAAe;QACf,aAAa;QACb,eAAe;QACf,YAAY;QACZ,WAAW;QACX,sBAAsB;QACtB,sBAAsB;QACtB,cAAc;QACd,aAAa;KACd;CACF,CAAC;AAEF,SAAS,qBAAqB,CAAC,SAAwB;IACrD,6FAA6F;IAC7F,6EAA6E;IAC7E,OAAO,2BAA2B,CAAC;QACjC,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC;QAClE,MAAM,EAAE,EAAE,IAAI,EAAE,qCAAqC,EAAE;KACxD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,WAAmB,EAAE,EAAE,CAAC,CAAC;IAC9C,WAAW;IACX,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,qCAAqC,EAAE,EAAE,EAAE;CAC7F,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG;IACtB,KAAK,EAAE,aAAa,CAAC,0CAA0C,CAAC;IAChE,KAAK,EAAE,aAAa,CAAC,sEAAsE,CAAC;IAC5F,KAAK,EAAE,aAAa,CAClB,+FAA+F,CAChG;IACD,KAAK,EAAE,aAAa,CAAC,oCAAoC,CAAC;IAC1D,KAAK,EAAE,aAAa,CAAC,qEAAqE,CAAC;IAC3F,KAAK,EAAE,aAAa,CAClB,gFAAgF,CACjF;IACD,KAAK,EAAE,aAAa,CAAC,mDAAmD,CAAC;IACzE,KAAK,EAAE,aAAa,CAAC,sCAAsC,CAAC;CAC7D,CAAC;AAEF,SAAS,eAAe,CAAC,WAAiC;IACxD,OAAO;QACL,gBAAgB,EAAE;YAChB,UAAU,EAAE,WAAW,CAAC,UAAU;YAClC,aAAa,EAAE,WAAW,CAAC,aAAa;YACxC,WAAW,EAAE,WAAW,CAAC,WAAW;YACpC,aAAa,EAAE,WAAW,CAAC,aAAa;YACxC,UAAU,EAAE,WAAW,CAAC,UAAU;YAClC,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,oBAAoB,EAAE,WAAW,CAAC,oBAAoB;YACtD,YAAY,EAAE,WAAW,CAAC,YAAY;YACtC,WAAW,EAAE,WAAW,CAAC,WAAW;SACrC;KACF,CAAC;AACJ,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,eAAe,CAAC,KAA2B;IACzD,MAAM,YAAY,GAAG,iBAAiB,CAAC;IACvC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,UAAU,CAAC,GAAG,YAAY,uDAAuD,EAAE;YAC3F,IAAI,EAAE,SAAS,CAAC,cAAc;YAC9B,OAAO,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE;SACpD,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YAC9C,MAAM,IAAI,UAAU,CAClB,GAAG,YAAY,oBAAoB,GAAG,kDAAkD,EACxF;gBACE,IAAI,EAAE,SAAS,CAAC,iBAAiB;gBACjC,OAAO,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE;aACzD,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAqD,CAAC;IAC7E,IACE,QAAQ,KAAK,IAAI;QACjB,OAAO,QAAQ,KAAK,QAAQ;QAC5B,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CACzD,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,UAAU,CACnD;QACD,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtC,QAAQ,CAAC,MAAM,CAAY,GAAG,CAAC,EAChC,CAAC;QACD,MAAM,IAAI,UAAU,CAAC,GAAG,YAAY,gDAAgD,EAAE;YACpF,IAAI,EAAE,SAAS,CAAC,cAAc;YAC9B,OAAO,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,gBAAgB,EAAE;SAC7D,CAAC,CAAC;IACL,CAAC;IACD,IACE,KAAK,CAAC,SAAS,KAAK,SAAS;QAC7B,CAAC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAC9E,CAAC;QACD,MAAM,IAAI,UAAU,CAAC,GAAG,YAAY,wDAAwD,EAAE;YAC5F,IAAI,EACF,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,cAAc;YAC5F,OAAO,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,iBAAiB,EAAE;SAC9D,CAAC,CAAC;IACL,CAAC;IACD,MAAM,YAAY,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC5D,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACvC,CAAC;IACF,MAAM,OAAO,GAA+B;QAC1C,cAAc,EAAE,eAAe;QAC/B,cAAc,EAAE,eAAe;QAC/B,SAAS,EAAE,UAAU;QACrB,oBAAoB,EAAE,qBAAqB;QAC3C,eAAe,EAAE,qBAAqB,CAAC,IAAI,CAAC;KAC7C,CAAC;IACF,MAAM,KAAK,GAA4C;QACrD,aAAa,EAAE;YACb,GAAG,EAAE;gBACH,WAAW,EAAE,gBAAgB;gBAC7B,OAAO,EAAE,uCAAuC;gBAChD,SAAS,EAAE;oBACT,KAAK,EAAE;wBACL,WAAW,EAAE,sCAAsC;wBACnD,OAAO,EAAE;4BACP,kBAAkB,EAAE;gCAClB,MAAM,EAAE;oCACN,IAAI,EAAE,OAAO;oCACb,KAAK,EAAE,EAAE,IAAI,EAAE,2CAA2C,EAAE;iCAC7D;6BACF;yBACF;qBACF;iBACF;aACF;SACF;QACD,kBAAkB,EAAE;YAClB,GAAG,EAAE;gBACH,WAAW,EAAE,mBAAmB;gBAChC,OAAO,EAAE,0BAA0B;gBACnC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;gBACpF,SAAS,EAAE;oBACT,KAAK,EAAE;wBACL,WAAW,EAAE,kBAAkB;wBAC/B,OAAO,EAAE;4BACP,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,2CAA2C,EAAE,EAAE;yBACtF;qBACF;oBACD,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC;iBAC9B;aACF;SACF;KACF,CAAC;IACF,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,GAAG,WAAW,CAAC,EAAE,QAAQ,CAAC;QAC5C,MAAM,UAAU,GAAG,GAAG,WAAW,CAAC,EAAE,SAAS,CAAC;QAC9C,OAAO,CAAC,SAAS,CAAC,GAAG,WAAW,CAAC,WAAW,CAAC;QAC7C,IAAI,WAAW,CAAC,YAAY,KAAK,IAAI;YAAE,OAAO,CAAC,UAAU,CAAC,GAAG,WAAW,CAAC,YAAY,CAAC;QACtF,MAAM,UAAU,GAAG,GAAG,WAAW,CAAC,EAAE,SAAS,CAAC;QAC9C,OAAO,CAAC,UAAU,CAAC,GAAG,qBAAqB,CACzC,WAAW,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,wBAAwB,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAChF,CAAC;QACF,KAAK,CAAC,eAAe,WAAW,CAAC,EAAE,MAAM,CAAC,GAAG;YAC3C,IAAI,EAAE;gBACJ,WAAW,EAAE,OAAO,WAAW,CAAC,EAAE,EAAE;gBACpC,QAAQ,EAAE,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;gBACnE,OAAO,EAAE,WAAW,CAAC,KAAK;gBAC1B,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,WAAW,EAAE;oBACX,QAAQ,EAAE,IAAI;oBACd,OAAO,EAAE;wBACP,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,wBAAwB,SAAS,EAAE,EAAE,EAAE;qBAC9E;iBACF;gBACD,SAAS,EAAE;oBACT,KAAK,EAAE;wBACL,WAAW,EAAE,sBAAsB;wBACnC,OAAO,EAAE;4BACP,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,wBAAwB,UAAU,EAAE,EAAE,EAAE;yBAC/E;qBACF;oBACD,GAAG,eAAe;iBACnB;gBACD,GAAG,eAAe,CAAC,WAAW,CAAC;aAChC;SACF,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,GAAG;QACf,IAAI,EAAE;YACJ,WAAW,EAAE,WAAW;YACxB,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;YAC/B,WAAW,EACT,kMAAkM;YACpM,OAAO,EACL,sFAAsF;YACxF,WAAW,EAAE;gBACX,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE;oBACP,kBAAkB,EAAE;wBAClB,MAAM,EAAE;4BACN,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gCACtB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gCACzB,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;6BAC1B;4BACD,QAAQ,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC;4BACzB,oBAAoB,EAAE,KAAK;yBAC5B;qBACF;iBACF;aACF;YACD,SAAS,EAAE;gBACT,KAAK,EAAE;oBACL,WAAW,EAAE,6CAA6C;oBAC1D,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,gCAAgC,EAAE,EAAE,EAAE;iBACxF;gBACD,GAAG,eAAe;aACnB;SACF;KACF,CAAC;IACF,KAAK,CAAC,YAAY,CAAC,GAAG;QACpB,GAAG,EAAE;YACH,WAAW,EAAE,QAAQ;YACrB,OAAO,EAAE,gBAAgB;YACzB,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;YACpF,SAAS,EAAE;gBACT,KAAK,EAAE;oBACL,WAAW,EAAE,aAAa;oBAC1B,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,gCAAgC,EAAE,EAAE,EAAE;iBACxF;gBACD,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC;aAC9B;SACF;KACF,CAAC;IACF,KAAK,CAAC,mBAAmB,CAAC,GAAG;QAC3B,IAAI,EAAE;YACJ,WAAW,EAAE,WAAW;YACxB,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;YAC/B,WAAW,EACT,uHAAuH;YACzH,OAAO,EAAE,wEAAwE;YACjF,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;YACpF,SAAS,EAAE;gBACT,KAAK,EAAE;oBACL,WAAW,EAAE,6CAA6C;oBAC1D,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,gCAAgC,EAAE,EAAE,EAAE;iBACxF;gBACD,GAAG,eAAe;aACnB;SACF;KACF,CAAC;IACF,KAAK,CAAC,mBAAmB,CAAC,GAAG;QAC3B,GAAG,EAAE;YACH,WAAW,EAAE,cAAc;YAC3B,OAAO,EAAE,+CAA+C;YACxD,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;YACpF,SAAS,EAAE;gBACT,KAAK,EAAE;oBACL,WAAW,EAAE,sBAAsB;oBACnC,OAAO,EAAE;wBACP,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,sCAAsC,EAAE,EAAE;qBACjF;iBACF;gBACD,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC;gBAC7B,KAAK,EAAE,aAAa,CAAC,kEAAkE,CAAC;gBACxF,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC;aAC9B;SACF;KACF,CAAC;IACF,KAAK,CAAC,kBAAkB,CAAC,GAAG;QAC1B,GAAG,EAAE;YACH,WAAW,EAAE,aAAa;YAC1B,OAAO,EAAE,4CAA4C;YACrD,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;YACrF,SAAS,EAAE;gBACT,KAAK,EAAE;oBACL,WAAW,EAAE,kCAAkC;oBAC/C,OAAO,EAAE;wBACP,kBAAkB,EAAE;4BAClB,MAAM,EAAE;gCACN,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE;oCACV,MAAM,EAAE,EAAE,IAAI,EAAE,qCAAqC,EAAE;oCACvD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iCAC1B;gCACD,QAAQ,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;6BAC9B;yBACF;qBACF;iBACF;gBACD,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC;aAC9B;SACF;KACF,CAAC;IACF,KAAK,CAAC,eAAe,CAAC,GAAG;QACvB,GAAG,EAAE;YACH,WAAW,EAAE,cAAc;YAC3B,OAAO,EAAE,gEAAgE;YACzE,SAAS,EAAE;gBACT,KAAK,EAAE;oBACL,WAAW,EAAE,mBAAmB;oBAChC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;iBAChE;aACF;SACF;KACF,CAAC;IACF,KAAK,CAAC,eAAe,CAAC,GAAG;QACvB,GAAG,EAAE;YACH,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE,eAAe;YACxB,SAAS,EAAE;gBACT,KAAK,EAAE;oBACL,WAAW,EAAE,2BAA2B;oBACxC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;iBAChE;aACF;SACF;KACF,CAAC;IACF,sFAAsF;IACtF,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,SAAmD,CAAC;YAClE,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,eAAe,CAAC,KAAK,CAAC,CAAC;YAClD,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,eAAe,CAAC,KAAK,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ,KAAK,EAAE,+BAA+B;YACtC,OAAO,EAAE,iBAAiB;YAC1B,WAAW,EACT,sGAAsG,YAAY,CAAC,MAAM,sBAAsB,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,MAAM,WAAW;gBACvL,2IAA2I;gBAC3I,uNAAuN;gBACvN,kGAAkG;gBAClG,4BAA4B,iBAAiB,CAAC,aAAa,CAAC,gBAAgB,GAAG;SAClF;QACD,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,IAAI,uBAAuB,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;QACvF,KAAK;QACL,UAAU,EAAE;YACV,OAAO;YACP,eAAe,EAAE;gBACf,WAAW,EAAE;oBACX,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,QAAQ;oBAChB,WAAW,EACT,wXAAwX;iBAC3X;aACF;SACF;KACF,CAAC;AACJ,CAAC"}

package/modules/http/dist/security.d.ts

@@ -0,0 +1,21 @@
+import type { IncomingMessage } from 'node:http';
+import { ErrorCode, InputError } from '../../core/dist/index.js';
+export declare function operationWrites(operation: {
+    sideEffect: string;
+    requiredCapabilities: readonly string[];
+}): boolean;
+export declare class HttpRequestError extends InputError {
+    readonly status: number;
+    constructor(status: number, message: string, field: string, code?: ErrorCode);
+}
+export declare function hostForUrl(host: string): string;
+/** Validate authorities without DNS resolution, aliases supplied by the caller, or forwarded headers. */
+export declare function requireLocalRequest(request: IncomingMessage, host: string): void;
+export declare function requireJson(request: IncomingMessage): void;
+export declare function requireBearer(request: IncomingMessage, token: Buffer | undefined): void;
+/** Only origin-form targets; decode once, inside the handler's protected boundary. */
+export declare function requestRoute(target: string): {
+    pathname: string;
+    segments: string[];
+};
+//# sourceMappingURL=security.d.ts.map

package/modules/http/dist/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,0BAAoB,CAAC;AAE3D,wBAAgB,eAAe,CAAC,SAAS,EAAE;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC,GAAG,OAAO,CAQV;AAED,qBAAa,gBAAiB,SAAQ,UAAU;IAE5C,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,SAAqC;CAI9C;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/C;AAcD,yGAAyG;AACzG,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CA2ChF;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,CAS1D;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAqBvF;AAED,sFAAsF;AACtF,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CA+BrF"}

package/modules/http/dist/security.js

@@ -0,0 +1,116 @@
+/** Shared HTTP policy: discovery and dispatch must agree about which calls need authority. */
+import { timingSafeEqual } from 'node:crypto';
+import { ErrorCode, InputError } from '../../core/dist/index.js';
+export function operationWrites(operation) {
+    // Approval persists a grant even though its domain sideEffect is `none`.
+    return (operation.sideEffect !== 'none' ||
+        operation.requiredCapabilities.some((name) => ['trade:approve', 'trade:paper', 'portfolio:write'].includes(name)));
+}
+export class HttpRequestError extends InputError {
+    status;
+    constructor(status, message, field, code = ErrorCode.InputWrongShape) {
+        super(message, { code, context: { function: 'createLocalHttpServer', field } });
+        this.status = status;
+    }
+}
+export function hostForUrl(host) {
+    return host.includes(':') && !host.startsWith('[') ? `[${host}]` : host;
+}
+function singleHeader(request, name) {
+    let count = 0;
+    for (let i = 0; i < request.rawHeaders.length; i += 2) {
+        if (request.rawHeaders[i].toLowerCase() === name)
+            count += 1;
+    }
+    const value = request.headers[name];
+    if (count > 1 || Array.isArray(value)) {
+        throw new HttpRequestError(400, `Only one ${name} header is supported.`, name);
+    }
+    return value;
+}
+/** Validate authorities without DNS resolution, aliases supplied by the caller, or forwarded headers. */
+export function requireLocalRequest(request, host) {
+    const authority = singleHeader(request, 'host');
+    const origin = singleHeader(request, 'origin');
+    const localPort = request.socket.localPort;
+    const allowedHosts = new Set([hostForUrl(host).toLowerCase()]);
+    if (['127.0.0.1', 'localhost', '::1'].includes(host)) {
+        for (const alias of ['127.0.0.1', 'localhost', '[::1]'])
+            allowedHosts.add(alias);
+    }
+    else if (request.socket.localAddress !== undefined) {
+        allowedHosts.add(hostForUrl(request.socket.localAddress).toLowerCase());
+    }
+    const expectedAuthority = (value) => {
+        try {
+            const parsed = new URL(`http://${value}`);
+            return (
+            // Reject userinfo, paths, whitespace, percent-encoded hosts and URL parser rewrites.
+            (parsed.host.toLowerCase() === value.toLowerCase() ||
+                (localPort === 80 && `${parsed.host.toLowerCase()}:80` === value.toLowerCase())) &&
+                parsed.username === '' &&
+                parsed.password === '' &&
+                allowedHosts.has(parsed.hostname.toLowerCase()) &&
+                Number(parsed.port || 80) === localPort);
+        }
+        catch {
+            return false;
+        }
+    };
+    if (authority === undefined || !expectedAuthority(authority)) {
+        throw new HttpRequestError(authority === undefined ? 400 : 403, 'Host must name this server and its bound port.', 'host');
+    }
+    if (origin !== undefined) {
+        // Missing Origin is normal for local non-browser clients; opaque/null origins are not trusted.
+        if (!origin.startsWith('http://') || !expectedAuthority(origin.slice('http://'.length))) {
+            throw new HttpRequestError(403, 'Origin must name this local HTTP server and port.', 'origin');
+        }
+    }
+}
+export function requireJson(request) {
+    const contentType = singleHeader(request, 'content-type');
+    if (contentType?.split(';')[0]?.trim().toLowerCase() !== 'application/json') {
+        throw new HttpRequestError(415, 'JSON POST requests require Content-Type: application/json.', 'content-type');
+    }
+}
+export function requireBearer(request, token) {
+    if (token === undefined) {
+        throw new HttpRequestError(403, 'This server has no write credential. Configure authenticationToken (at least 32 random characters), --token-file, or TOTALFINANCE_HTTP_TOKEN to enable authenticated mutations.', 'authorization', ErrorCode.OperationCapabilityMissing);
+    }
+    const authorization = singleHeader(request, 'authorization');
+    const match = authorization === undefined ? null : /^Bearer ([A-Za-z0-9._~+/-]+=*)$/i.exec(authorization);
+    const received = Buffer.from(match?.[1] ?? '', 'utf8');
+    if (received.length !== token.length || !timingSafeEqual(received, token)) {
+        throw new HttpRequestError(401, 'A valid server-owned Authorization: Bearer credential is required for this mutation.', 'authorization', ErrorCode.OperationCapabilityMissing);
+    }
+}
+/** Only origin-form targets; decode once, inside the handler's protected boundary. */
+export function requestRoute(target) {
+    const hasControl = (value) => [...value].some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127);
+    try {
+        if (!target.startsWith('/') ||
+            target.startsWith('//') ||
+            /[\\#\s]/.test(target) ||
+            hasControl(target)) {
+            throw new Error('invalid target');
+        }
+        // Validate escapes in queries too, even though current routes do not consume query parameters.
+        decodeURIComponent(target);
+        const pathname = target.split('?')[0];
+        const segments = pathname.split('/').filter(Boolean).map(decodeURIComponent);
+        for (const [index, segment] of segments.entries()) {
+            if (segment.includes('\\') ||
+                hasControl(segment) ||
+                segment === '.' ||
+                segment === '..' ||
+                (segment.includes('/') && !(segments[0] === 'artifacts' && index > 0))) {
+                throw new Error('invalid segment');
+            }
+        }
+        return { pathname: new URL(target, 'http://localhost').pathname, segments };
+    }
+    catch {
+        throw new HttpRequestError(400, 'Malformed HTTP request target or URL encoding.', 'url');
+    }
+}
+//# sourceMappingURL=security.js.map

package/modules/http/dist/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,0BAAoB,CAAC;AAE3D,MAAM,UAAU,eAAe,CAAC,SAG/B;IACC,yEAAyE;IACzE,OAAO,CACL,SAAS,CAAC,UAAU,KAAK,MAAM;QAC/B,SAAS,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC3C,CAAC,eAAe,EAAE,aAAa,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CACnE,CACF,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IAEnC;IADX,YACW,MAAc,EACvB,OAAe,EACf,KAAa,EACb,OAAkB,SAAS,CAAC,eAAe;QAE3C,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,uBAAuB,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QALvE,WAAM,GAAN,MAAM,CAAQ;IAMzB,CAAC;CACF;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AAED,SAAS,YAAY,CAAC,OAAwB,EAAE,IAAY;IAC1D,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,KAAK,IAAI;YAAE,KAAK,IAAI,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,YAAY,IAAI,uBAAuB,EAAE,IAAI,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,mBAAmB,CAAC,OAAwB,EAAE,IAAY;IACxE,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;IAC3C,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,KAAK,MAAM,KAAK,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC;YAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACnF,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACrD,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,iBAAiB,GAAG,CAAC,KAAa,EAAW,EAAE;QACnD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;YAC1C,OAAO;YACL,qFAAqF;YACrF,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE;gBAChD,CAAC,SAAS,KAAK,EAAE,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;gBAClF,MAAM,CAAC,QAAQ,KAAK,EAAE;gBACtB,MAAM,CAAC,QAAQ,KAAK,EAAE;gBACtB,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC/C,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,KAAK,SAAS,CACxC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IACF,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,gBAAgB,CACxB,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EACnC,gDAAgD,EAChD,MAAM,CACP,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,+FAA+F;QAC/F,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACxF,MAAM,IAAI,gBAAgB,CACxB,GAAG,EACH,mDAAmD,EACnD,QAAQ,CACT,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAwB;IAClD,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC1D,IAAI,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,kBAAkB,EAAE,CAAC;QAC5E,MAAM,IAAI,gBAAgB,CACxB,GAAG,EACH,4DAA4D,EAC5D,cAAc,CACf,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAwB,EAAE,KAAyB;IAC/E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,gBAAgB,CACxB,GAAG,EACH,iLAAiL,EACjL,eAAe,EACf,SAAS,CAAC,0BAA0B,CACrC,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC7D,MAAM,KAAK,GACT,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kCAAkC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC9F,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IACvD,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,gBAAgB,CACxB,GAAG,EACH,sFAAsF,EACtF,eAAe,EACf,SAAS,CAAC,0BAA0B,CACrC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,MAAM,UAAU,GAAG,CAAC,KAAa,EAAW,EAAE,CAC5C,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;IAClG,IAAI,CAAC;QACH,IACE,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;YACvB,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;YACvB,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC;YACtB,UAAU,CAAC,MAAM,CAAC,EAClB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpC,CAAC;QACD,+FAA+F;QAC/F,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAC7E,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YAClD,IACE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACtB,UAAU,CAAC,OAAO,CAAC;gBACnB,OAAO,KAAK,GAAG;gBACf,OAAO,KAAK,IAAI;gBAChB,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,WAAW,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,EACtE,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,gDAAgD,EAAE,KAAK,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC"}