@kairosinternational/watchman-nextjs 0.1.0

package/dist/config.d.ts

@@ -0,0 +1,4 @@
+import type { WatchmanMiddlewareConfig } from './types.js';
+export declare const DEFAULT_MIDDLEWARE_CONFIG: Required<Omit<WatchmanMiddlewareConfig, 'projectRoot' | 'onFinding' | 'onColdStartComplete'>>;
+export declare function resolveConfig(user?: WatchmanMiddlewareConfig): WatchmanMiddlewareConfig & typeof DEFAULT_MIDDLEWARE_CONFIG;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAC9C,IAAI,CAAC,wBAAwB,EAAE,aAAa,GAAG,WAAW,GAAG,qBAAqB,CAAC,CAUpF,CAAC;AAEF,wBAAgB,aAAa,CAC3B,IAAI,GAAE,wBAA6B,GAClC,wBAAwB,GAAG,OAAO,yBAAyB,CAM7D"}

package/dist/config.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_MIDDLEWARE_CONFIG = void 0;
+exports.resolveConfig = resolveConfig;
+exports.DEFAULT_MIDDLEWARE_CONFIG = {
+    blockAt: 'critical',
+    warnAt: 'high',
+    scanBody: true,
+    scanHeaders: true,
+    scanUrl: true,
+    coldStartScan: true,
+    skipPaths: ['/_next', '/favicon.ico', '/static'],
+    quiet: false,
+};
+function resolveConfig(user = {}) {
+    return {
+        ...exports.DEFAULT_MIDDLEWARE_CONFIG,
+        projectRoot: user.projectRoot ?? process.cwd(),
+        ...user,
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":";;;AAeA,sCAQC;AArBY,QAAA,yBAAyB,GAElC;IACF,OAAO,EAAE,UAAU;IACnB,MAAM,EAAE,MAAM;IACd,QAAQ,EAAE,IAAI;IACd,WAAW,EAAE,IAAI;IACjB,OAAO,EAAE,IAAI;IACb,aAAa,EAAE,IAAI;IACnB,SAAS,EAAE,CAAC,QAAQ,EAAE,cAAc,EAAE,SAAS,CAAC;IAChD,KAAK,EAAE,KAAK;CACb,CAAC;AAEF,SAAgB,aAAa,CAC3B,OAAiC,EAAE;IAEnC,OAAO;QACL,GAAG,iCAAyB;QAC5B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE;QAC9C,GAAG,IAAI;KACR,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { withWatchman, scanRequest, scanString } from './middleware.js';
+export { withWatchmanRoute } from './route-handler.js';
+export { DEFAULT_MIDDLEWARE_CONFIG, resolveConfig } from './config.js';
+export type { WatchmanMiddlewareConfig, RequestFinding, ScanOutcome, ScanTarget, Severity, Finding, WatchmanReport, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACvE,YAAY,EACV,wBAAwB,EACxB,cAAc,EACd,WAAW,EACX,UAAU,EACV,QAAQ,EACR,OAAO,EACP,cAAc,GACf,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveConfig = exports.DEFAULT_MIDDLEWARE_CONFIG = exports.withWatchmanRoute = exports.scanString = exports.scanRequest = exports.withWatchman = void 0;
+var middleware_js_1 = require("./middleware.js");
+Object.defineProperty(exports, "withWatchman", { enumerable: true, get: function () { return middleware_js_1.withWatchman; } });
+Object.defineProperty(exports, "scanRequest", { enumerable: true, get: function () { return middleware_js_1.scanRequest; } });
+Object.defineProperty(exports, "scanString", { enumerable: true, get: function () { return middleware_js_1.scanString; } });
+var route_handler_js_1 = require("./route-handler.js");
+Object.defineProperty(exports, "withWatchmanRoute", { enumerable: true, get: function () { return route_handler_js_1.withWatchmanRoute; } });
+var config_js_1 = require("./config.js");
+Object.defineProperty(exports, "DEFAULT_MIDDLEWARE_CONFIG", { enumerable: true, get: function () { return config_js_1.DEFAULT_MIDDLEWARE_CONFIG; } });
+Object.defineProperty(exports, "resolveConfig", { enumerable: true, get: function () { return config_js_1.resolveConfig; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,iDAAwE;AAA/D,6GAAA,YAAY,OAAA;AAAE,4GAAA,WAAW,OAAA;AAAE,2GAAA,UAAU,OAAA;AAC9C,uDAAuD;AAA9C,qHAAA,iBAAiB,OAAA;AAC1B,yCAAuE;AAA9D,sHAAA,yBAAyB,OAAA;AAAE,0GAAA,aAAa,OAAA"}

package/dist/middleware.d.ts

@@ -0,0 +1,25 @@
+import { type NextRequest, type NextMiddleware } from 'next/server';
+import { DEFAULT_MIDDLEWARE_CONFIG } from './config.js';
+import type { WatchmanMiddlewareConfig, RequestFinding, ScanOutcome, ScanTarget } from './types.js';
+/**
+ * Scans a single string against injection + secret patterns.
+ * Returns an array of findings. Caller annotates target.
+ */
+export declare function scanString(input: string, target: ScanTarget): RequestFinding[];
+/**
+ * Scans a NextRequest (URL, headers, body) against AI-tool-integrity
+ * and secrets-exposure patterns.
+ */
+export declare function scanRequest(request: NextRequest, config: WatchmanMiddlewareConfig & typeof DEFAULT_MIDDLEWARE_CONFIG): Promise<ScanOutcome>;
+/**
+ * Creates a Next.js middleware function that scans every request
+ * for prompt injection and secret exposure, and runs a cold-start
+ * file scan for dependency and runtime issues.
+ *
+ * Usage in middleware.ts:
+ *   import { withWatchman } from '@kairosinternational/watchman-nextjs'
+ *   export default withWatchman()
+ *   export const config = { matcher: ['/((?!_next|static).*)'] }
+ */
+export declare function withWatchman(userConfig?: WatchmanMiddlewareConfig): NextMiddleware;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAUlF,OAAO,EAAiB,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,KAAK,EACV,wBAAwB,EACxB,cAAc,EACd,WAAW,EACX,UAAU,EACX,MAAM,YAAY,CAAC;AAsBpB;;;GAGG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,cAAc,EAAE,CAiC9E;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,wBAAwB,GAAG,OAAO,yBAAyB,GAClE,OAAO,CAAC,WAAW,CAAC,CAsCtB;AAuDD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,UAAU,GAAE,wBAA6B,GACxC,cAAc,CAgEhB"}

package/dist/middleware.js

@@ -0,0 +1,200 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scanString = scanString;
+exports.scanRequest = scanRequest;
+exports.withWatchman = withWatchman;
+const node_crypto_1 = require("node:crypto");
+const server_1 = require("next/server");
+const watchman_1 = require("@kairosinternational/watchman");
+const config_js_1 = require("./config.js");
+const SEVERITY_ORDER = {
+    critical: 4,
+    high: 3,
+    medium: 2,
+    low: 1,
+    info: 0,
+};
+function severityAtLeast(a, threshold) {
+    return SEVERITY_ORDER[a] >= SEVERITY_ORDER[threshold];
+}
+function maxSeverity(findings) {
+    if (findings.length === 0)
+        return null;
+    return findings.reduce((max, f) => (SEVERITY_ORDER[f.severity] > SEVERITY_ORDER[max] ? f.severity : max), 'info');
+}
+/**
+ * Scans a single string against injection + secret patterns.
+ * Returns an array of findings. Caller annotates target.
+ */
+function scanString(input, target) {
+    const findings = [];
+    if (!input)
+        return findings;
+    for (const sig of watchman_1.INJECTION_SIGNATURES) {
+        if (sig.pattern.test(input)) {
+            findings.push({
+                id: (0, node_crypto_1.randomUUID)(),
+                target,
+                rule: 'prompt-injection',
+                severity: sig.severity,
+                label: sig.label,
+                message: `Prompt injection signature in ${target}: ${sig.label}`,
+                evidence: input.slice(0, 200),
+            });
+        }
+    }
+    for (const sig of watchman_1.SECRET_SIGNATURES) {
+        if (sig.pattern.test(input)) {
+            findings.push({
+                id: (0, node_crypto_1.randomUUID)(),
+                target,
+                rule: 'known-patterns',
+                severity: 'critical',
+                label: sig.label,
+                message: `${sig.description} detected in ${target}`,
+                evidence: '[REDACTED]',
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * Scans a NextRequest (URL, headers, body) against AI-tool-integrity
+ * and secrets-exposure patterns.
+ */
+async function scanRequest(request, config) {
+    const findings = [];
+    if (config.scanUrl) {
+        let decoded = request.nextUrl.toString();
+        try {
+            decoded = decodeURIComponent(decoded);
+        }
+        catch {
+            // malformed -- scan as-is
+        }
+        findings.push(...scanString(decoded, 'url'));
+    }
+    if (config.scanHeaders) {
+        for (const [key, value] of request.headers.entries()) {
+            if (key.toLowerCase() === 'cookie')
+                continue;
+            findings.push(...scanString(`${key}: ${value}`, 'headers'));
+        }
+    }
+    if (config.scanBody && ['POST', 'PUT', 'PATCH'].includes(request.method)) {
+        try {
+            const cloned = request.clone();
+            const body = await cloned.text();
+            if (body) {
+                findings.push(...scanString(body, 'body'));
+            }
+        }
+        catch {
+            // Body unreadable -- skip
+        }
+    }
+    const maxSev = maxSeverity(findings);
+    const shouldBlock = maxSev !== null && severityAtLeast(maxSev, config.blockAt);
+    const shouldWarn = maxSev !== null && !shouldBlock && severityAtLeast(maxSev, config.warnAt);
+    return { findings, maxSeverity: maxSev, shouldBlock, shouldWarn };
+}
+let coldStartPromise = null;
+function runColdStartScan(config) {
+    if (coldStartPromise)
+        return coldStartPromise;
+    coldStartPromise = (async () => {
+        if (!config.coldStartScan)
+            return null;
+        try {
+            const engine = new watchman_1.WatchmanEngine({
+                projectRoot: config.projectRoot ?? process.cwd(),
+                scanners: {
+                    'dependency-integrity': { enabled: true },
+                    'runtime-monitor': { enabled: true },
+                },
+                exclude: ['node_modules', '.git', 'dist', 'build', '.next'],
+                failOn: 'high',
+            });
+            engine.register(watchman_1.dependencyIntegrityScanner);
+            engine.register(watchman_1.runtimeMonitorScanner);
+            const report = await engine.scan();
+            if (config.onColdStartComplete) {
+                await config.onColdStartComplete(report);
+            }
+            if (!config.quiet) {
+                const critical = report.results
+                    .flatMap((r) => r.findings)
+                    .filter((f) => f.severity === 'critical').length;
+                if (critical > 0) {
+                    console.warn(`[watchman] Cold-start scan: ${critical} critical findings in ${report.totalFindings} total`);
+                }
+            }
+            return report;
+        }
+        catch (err) {
+            if (!config.quiet) {
+                console.error('[watchman] Cold-start scan failed:', err);
+            }
+            return null;
+        }
+    })();
+    return coldStartPromise;
+}
+/**
+ * Creates a Next.js middleware function that scans every request
+ * for prompt injection and secret exposure, and runs a cold-start
+ * file scan for dependency and runtime issues.
+ *
+ * Usage in middleware.ts:
+ *   import { withWatchman } from '@kairosinternational/watchman-nextjs'
+ *   export default withWatchman()
+ *   export const config = { matcher: ['/((?!_next|static).*)'] }
+ */
+function withWatchman(userConfig = {}) {
+    const config = (0, config_js_1.resolveConfig)(userConfig);
+    // Kick off cold-start scan (non-blocking)
+    void runColdStartScan(config);
+    return async function watchmanMiddleware(request) {
+        const pathname = request.nextUrl.pathname;
+        if (config.skipPaths.some((p) => pathname.startsWith(p))) {
+            return server_1.NextResponse.next();
+        }
+        const outcome = await scanRequest(request, config);
+        if (config.onFinding) {
+            for (const finding of outcome.findings) {
+                await config.onFinding(finding);
+            }
+        }
+        if (outcome.shouldBlock) {
+            if (!config.quiet) {
+                console.warn(`[watchman] BLOCKED ${request.method} ${pathname} -- ${outcome.maxSeverity}: ${outcome.findings.length} findings`);
+            }
+            return server_1.NextResponse.json({
+                error: 'Request blocked by Watchman security scan',
+                severity: outcome.maxSeverity,
+                findings: outcome.findings.map((f) => ({
+                    id: f.id,
+                    target: f.target,
+                    rule: f.rule,
+                    label: f.label,
+                    severity: f.severity,
+                })),
+            }, { status: 403 });
+        }
+        const response = server_1.NextResponse.next();
+        if (outcome.shouldWarn) {
+            // Top finding is the highest-severity one that triggered the warn
+            const topFinding = outcome.findings.find((f) => f.severity === outcome.maxSeverity);
+            if (topFinding) {
+                response.headers.set('X-Watchman-Alert', topFinding.id);
+                response.headers.set('X-Watchman-Severity', topFinding.severity);
+                response.headers.set('X-Watchman-Findings', String(outcome.findings.length));
+            }
+            if (!config.quiet) {
+                console.warn(`[watchman] WARN ${request.method} ${pathname} -- ${outcome.maxSeverity}: ${outcome.findings.length} findings`);
+            }
+        }
+        return response;
+    };
+}
+//# sourceMappingURL=middleware.js.map

package/dist/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":";;AA2CA,gCAiCC;AAMD,kCAyCC;AAiED,oCAkEC;AA9PD,6CAAyC;AACzC,wCAAkF;AAClF,4DAQuC;AACvC,2CAAuE;AAQvE,MAAM,cAAc,GAA6B;IAC/C,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,IAAI,EAAE,CAAC;CACR,CAAC;AAEF,SAAS,eAAe,CAAC,CAAW,EAAE,SAAmB;IACvD,OAAO,cAAc,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,SAAS,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,WAAW,CAAC,QAA0B;IAC7C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,QAAQ,CAAC,MAAM,CACpB,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EACjF,MAAM,CACP,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,UAAU,CAAC,KAAa,EAAE,MAAkB;IAC1D,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAE5B,KAAK,MAAM,GAAG,IAAI,+BAAoB,EAAE,CAAC;QACvC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,IAAA,wBAAU,GAAE;gBAChB,MAAM;gBACN,IAAI,EAAE,kBAAkB;gBACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,OAAO,EAAE,iCAAiC,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE;gBAChE,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;aAC9B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,4BAAiB,EAAE,CAAC;QACpC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,IAAA,wBAAU,GAAE;gBAChB,MAAM;gBACN,IAAI,EAAE,gBAAgB;gBACtB,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,OAAO,EAAE,GAAG,GAAG,CAAC,WAAW,gBAAgB,MAAM,EAAE;gBACnD,QAAQ,EAAE,YAAY;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,WAAW,CAC/B,OAAoB,EACpB,MAAmE;IAEnE,MAAM,QAAQ,GAAqB,EAAE,CAAC;IAEtC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,0BAA0B;QAC5B,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACrD,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,QAAQ;gBAAE,SAAS;YAC7C,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,GAAG,GAAG,KAAK,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACjC,IAAI,IAAI,EAAE,CAAC;gBACT,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0BAA0B;QAC5B,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,MAAM,KAAK,IAAI,IAAI,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/E,MAAM,UAAU,GACd,MAAM,KAAK,IAAI,IAAI,CAAC,WAAW,IAAI,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAE5E,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;AACpE,CAAC;AAED,IAAI,gBAAgB,GAA0C,IAAI,CAAC;AAEnE,SAAS,gBAAgB,CACvB,MAAmE;IAEnE,IAAI,gBAAgB;QAAE,OAAO,gBAAgB,CAAC;IAE9C,gBAAgB,GAAG,CAAC,KAAK,IAAI,EAAE;QAC7B,IAAI,CAAC,MAAM,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QAEvC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,yBAAc,CAAC;gBAChC,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE;gBAChD,QAAQ,EAAE;oBACR,sBAAsB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;oBACzC,iBAAiB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;iBACrC;gBACD,OAAO,EAAE,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;gBAC3D,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;YAEH,MAAM,CAAC,QAAQ,CAAC,qCAA0B,CAAC,CAAC;YAC5C,MAAM,CAAC,QAAQ,CAAC,gCAAqB,CAAC,CAAC;YAEvC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAEnC,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;gBAC/B,MAAM,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAC3C,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO;qBAC5B,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;qBAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;gBACnD,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;oBACjB,OAAO,CAAC,IAAI,CACV,+BAA+B,QAAQ,yBAAyB,MAAM,CAAC,aAAa,QAAQ,CAC7F,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IAEL,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,YAAY,CAC1B,aAAuC,EAAE;IAEzC,MAAM,MAAM,GAAG,IAAA,yBAAa,EAAC,UAAU,CAAC,CAAC;IAEzC,0CAA0C;IAC1C,KAAK,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAE9B,OAAO,KAAK,UAAU,kBAAkB,CAAC,OAAoB;QAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;QAE1C,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,OAAO,qBAAY,CAAC,IAAI,EAAE,CAAC;QAC7B,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAEnD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACvC,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,OAAO,CAAC,IAAI,CACV,sBAAsB,OAAO,CAAC,MAAM,IAAI,QAAQ,OAAO,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,MAAM,WAAW,CAClH,CAAC;YACJ,CAAC;YACD,OAAO,qBAAY,CAAC,IAAI,CACtB;gBACE,KAAK,EAAE,2CAA2C;gBAClD,QAAQ,EAAE,OAAO,CAAC,WAAW;gBAC7B,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACrC,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;iBACrB,CAAC,CAAC;aACJ,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,qBAAY,CAAC,IAAI,EAAE,CAAC;QAErC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,kEAAkE;YAClE,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,WAAW,CAC1C,CAAC;YACF,IAAI,UAAU,EAAE,CAAC;gBACf,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;gBACxD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;gBACjE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/E,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,OAAO,CAAC,IAAI,CACV,mBAAmB,OAAO,CAAC,MAAM,IAAI,QAAQ,OAAO,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,MAAM,WAAW,CAC/G,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC"}

package/dist/route-handler.d.ts

@@ -0,0 +1,17 @@
+import type { NextRequest } from 'next/server';
+import type { WatchmanMiddlewareConfig } from './types.js';
+type RouteHandler = (request: NextRequest, context?: {
+    params: Record<string, string | string[]>;
+}) => Promise<Response> | Response;
+/**
+ * Higher-order wrapper for Next.js App Router route handlers.
+ * Runs Watchman scanning on the incoming request before invoking
+ * the underlying handler. Use this for per-route scanning when
+ * you don't want global middleware.
+ *
+ * Usage:
+ *   export const POST = withWatchmanRoute(async (req) => { ... });
+ */
+export declare function withWatchmanRoute<H extends RouteHandler>(handler: H, userConfig?: WatchmanMiddlewareConfig): H;
+export {};
+//# sourceMappingURL=route-handler.d.ts.map

package/dist/route-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-handler.d.ts","sourceRoot":"","sources":["../src/route-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI/C,OAAO,KAAK,EACV,wBAAwB,EAIzB,MAAM,YAAY,CAAC;AAEpB,KAAK,YAAY,GAAG,CAClB,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAA;CAAE,KACpD,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;AA+DlC;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,YAAY,EACtD,OAAO,EAAE,CAAC,EACV,UAAU,GAAE,wBAA6B,GACxC,CAAC,CAmDH"}

package/dist/route-handler.js

@@ -0,0 +1,104 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withWatchmanRoute = withWatchmanRoute;
+const server_1 = require("next/server");
+const config_js_1 = require("./config.js");
+const middleware_js_1 = require("./middleware.js");
+const SEVERITY_ORDER = {
+    critical: 4,
+    high: 3,
+    medium: 2,
+    low: 1,
+    info: 0,
+};
+function severityAtLeast(a, threshold) {
+    return SEVERITY_ORDER[a] >= SEVERITY_ORDER[threshold];
+}
+function maxSeverity(findings) {
+    if (findings.length === 0)
+        return null;
+    return findings.reduce((max, f) => (SEVERITY_ORDER[f.severity] > SEVERITY_ORDER[max] ? f.severity : max), 'info');
+}
+async function scanHandlerRequest(request, config) {
+    const findings = [];
+    if (config.scanUrl) {
+        let decoded = request.url;
+        try {
+            decoded = decodeURIComponent(decoded);
+        }
+        catch {
+            // malformed -- scan as-is
+        }
+        findings.push(...(0, middleware_js_1.scanString)(decoded, 'url'));
+    }
+    if (config.scanHeaders) {
+        for (const [key, value] of request.headers.entries()) {
+            if (key.toLowerCase() === 'cookie')
+                continue;
+            findings.push(...(0, middleware_js_1.scanString)(`${key}: ${value}`, 'headers'));
+        }
+    }
+    if (config.scanBody && ['POST', 'PUT', 'PATCH'].includes(request.method)) {
+        try {
+            const cloned = request.clone();
+            const body = await cloned.text();
+            if (body)
+                findings.push(...(0, middleware_js_1.scanString)(body, 'body'));
+        }
+        catch {
+            // unreadable body
+        }
+    }
+    const maxSev = maxSeverity(findings);
+    const shouldBlock = maxSev !== null && severityAtLeast(maxSev, config.blockAt);
+    const shouldWarn = maxSev !== null && !shouldBlock && severityAtLeast(maxSev, config.warnAt);
+    return { findings, maxSeverity: maxSev, shouldBlock, shouldWarn };
+}
+/**
+ * Higher-order wrapper for Next.js App Router route handlers.
+ * Runs Watchman scanning on the incoming request before invoking
+ * the underlying handler. Use this for per-route scanning when
+ * you don't want global middleware.
+ *
+ * Usage:
+ *   export const POST = withWatchmanRoute(async (req) => { ... });
+ */
+function withWatchmanRoute(handler, userConfig = {}) {
+    const config = (0, config_js_1.resolveConfig)(userConfig);
+    const wrapped = async (request, context) => {
+        const outcome = await scanHandlerRequest(request, config);
+        if (config.onFinding) {
+            for (const finding of outcome.findings) {
+                await config.onFinding(finding);
+            }
+        }
+        if (outcome.shouldBlock) {
+            if (!config.quiet) {
+                console.warn(`[watchman] BLOCKED route handler ${request.method} ${new URL(request.url).pathname} -- ${outcome.maxSeverity}`);
+            }
+            return server_1.NextResponse.json({
+                error: 'Request blocked by Watchman security scan',
+                severity: outcome.maxSeverity,
+                findings: outcome.findings.map((f) => ({
+                    id: f.id,
+                    target: f.target,
+                    rule: f.rule,
+                    label: f.label,
+                    severity: f.severity,
+                })),
+            }, { status: 403 });
+        }
+        const response = await handler(request, context);
+        if (outcome.shouldWarn) {
+            const topFinding = outcome.findings.find((f) => f.severity === outcome.maxSeverity);
+            if (topFinding) {
+                response.headers.set('X-Watchman-Alert', topFinding.id);
+                response.headers.set('X-Watchman-Severity', topFinding.severity);
+                response.headers.set('X-Watchman-Findings', String(outcome.findings.length));
+            }
+        }
+        return response;
+    };
+    return wrapped;
+}
+//# sourceMappingURL=route-handler.js.map

package/dist/route-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-handler.js","sourceRoot":"","sources":["../src/route-handler.ts"],"names":[],"mappings":";;AAsFA,8CAsDC;AA3ID,wCAA2C;AAC3C,2CAA4C;AAC5C,mDAA6C;AAa7C,MAAM,cAAc,GAA6B;IAC/C,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,IAAI,EAAE,CAAC;CACR,CAAC;AAEF,SAAS,eAAe,CAAC,CAAW,EAAE,SAAmB;IACvD,OAAO,cAAc,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,SAAS,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,WAAW,CAAC,QAA0B;IAC7C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,QAAQ,CAAC,MAAM,CACpB,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EACjF,MAAM,CACP,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,OAAoB,EACpB,MAAwC;IAExC,MAAM,QAAQ,GAAqB,EAAE,CAAC;IAEtC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,IAAI,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,0BAA0B;QAC5B,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAA,0BAAU,EAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACrD,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,QAAQ;gBAAE,SAAS;YAC7C,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAA,0BAAU,EAAC,GAAG,GAAG,KAAK,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACjC,IAAI,IAAI;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAA,0BAAU,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,MAAM,KAAK,IAAI,IAAI,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/E,MAAM,UAAU,GACd,MAAM,KAAK,IAAI,IAAI,CAAC,WAAW,IAAI,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAE5E,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;AACpE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAC/B,OAAU,EACV,aAAuC,EAAE;IAEzC,MAAM,MAAM,GAAG,IAAA,yBAAa,EAAC,UAAU,CAAC,CAAC;IAEzC,MAAM,OAAO,GAAiB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;QACvD,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAE1D,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACvC,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,OAAO,CAAC,IAAI,CACV,oCAAoC,OAAO,CAAC,MAAM,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,OAAO,OAAO,CAAC,WAAW,EAAE,CAChH,CAAC;YACJ,CAAC;YACD,OAAO,qBAAY,CAAC,IAAI,CACtB;gBACE,KAAK,EAAE,2CAA2C;gBAClD,QAAQ,EAAE,OAAO,CAAC,WAAW;gBAC7B,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACrC,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;iBACrB,CAAC,CAAC;aACJ,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAEjD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,WAAW,CAC1C,CAAC;YACF,IAAI,UAAU,EAAE,CAAC;gBACf,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;gBACxD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;gBACjE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,OAAY,CAAC;AACtB,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,43 @@
+import type { Severity, WatchmanReport, Finding } from '@kairosinternational/watchman';
+export type ScanTarget = 'url' | 'headers' | 'body' | 'response';
+export interface RequestFinding {
+    id: string;
+    target: ScanTarget;
+    rule: string;
+    severity: Severity;
+    label: string;
+    message: string;
+    evidence: string;
+}
+export interface WatchmanMiddlewareConfig {
+    /** Project root for cold-start file scanning. Defaults to process.cwd() */
+    projectRoot?: string;
+    /** Severity at or above which to block the request. Default: 'critical' */
+    blockAt?: Severity;
+    /** Severity at or above which to attach a warning header. Default: 'high' */
+    warnAt?: Severity;
+    /** Scan request body for secrets and injection. Default: true */
+    scanBody?: boolean;
+    /** Scan request headers. Default: true */
+    scanHeaders?: boolean;
+    /** Scan request URL and query params. Default: true */
+    scanUrl?: boolean;
+    /** Run cold-start scan (dependency-integrity + runtime-monitor) at init. Default: true */
+    coldStartScan?: boolean;
+    /** Paths to skip entirely. Default: ['/_next', '/favicon.ico'] */
+    skipPaths?: string[];
+    /** Called on every finding, useful for telemetry */
+    onFinding?: (finding: RequestFinding) => void | Promise<void>;
+    /** Called once when cold-start scan completes */
+    onColdStartComplete?: (report: WatchmanReport) => void | Promise<void>;
+    /** Quiet mode -- suppress console logging. Default: false */
+    quiet?: boolean;
+}
+export interface ScanOutcome {
+    findings: RequestFinding[];
+    maxSeverity: Severity | null;
+    shouldBlock: boolean;
+    shouldWarn: boolean;
+}
+export type { Finding, WatchmanReport, Severity };
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,+BAA+B,CAAC;AAEvF,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,SAAS,GAAG,MAAM,GAAG,UAAU,CAAC;AAEjE,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,QAAQ,CAAC;IAEnB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,QAAQ,CAAC;IAElB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB,0CAA0C;IAC1C,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,uDAAuD;IACvD,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB,0FAA0F;IAC1F,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IAErB,oDAAoD;IACpD,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D,iDAAiD;IACjD,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvE,6DAA6D;IAC7D,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,WAAW,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC"}

package/dist/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@kairosinternational/watchman-nextjs",
+  "version": "0.1.0",
+  "description": "Next.js 14 App Router adapter for @kairosinternational/watchman",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit"
+  },
+  "keywords": ["nextjs", "security", "middleware", "watchman"],
+  "author": "Kai'Ros International Technologies",
+  "license": "UNLICENSED",
+  "engines": {
+    "node": ">=18"
+  },
+  "dependencies": {
+    "@kairosinternational/watchman": "0.1.0"
+  },
+  "peerDependencies": {
+    "next": "^14.0.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.7.0",
+    "vitest": "^3.0.0",
+    "@types/node": "^22.0.0",
+    "next": "^14.2.0"
+  }
+}

package/src/config.ts

@@ -0,0 +1,24 @@
+import type { WatchmanMiddlewareConfig } from './types.js';
+
+export const DEFAULT_MIDDLEWARE_CONFIG: Required<
+  Omit<WatchmanMiddlewareConfig, 'projectRoot' | 'onFinding' | 'onColdStartComplete'>
+> = {
+  blockAt: 'critical',
+  warnAt: 'high',
+  scanBody: true,
+  scanHeaders: true,
+  scanUrl: true,
+  coldStartScan: true,
+  skipPaths: ['/_next', '/favicon.ico', '/static'],
+  quiet: false,
+};
+
+export function resolveConfig(
+  user: WatchmanMiddlewareConfig = {},
+): WatchmanMiddlewareConfig & typeof DEFAULT_MIDDLEWARE_CONFIG {
+  return {
+    ...DEFAULT_MIDDLEWARE_CONFIG,
+    projectRoot: user.projectRoot ?? process.cwd(),
+    ...user,
+  };
+}

package/src/index.ts

@@ -0,0 +1,12 @@
+export { withWatchman, scanRequest, scanString } from './middleware.js';
+export { withWatchmanRoute } from './route-handler.js';
+export { DEFAULT_MIDDLEWARE_CONFIG, resolveConfig } from './config.js';
+export type {
+  WatchmanMiddlewareConfig,
+  RequestFinding,
+  ScanOutcome,
+  ScanTarget,
+  Severity,
+  Finding,
+  WatchmanReport,
+} from './types.js';