@kelpie/server 0.4.1 → 0.5.1

package/dist/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAGnC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAItD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAEzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AAQ3E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAEhE;;;GAGG;AAEH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAA;IACpD,oEAAoE;IACpE,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAA;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,sBAAsB,CAAA;IAC5C,4DAA4D;IAC5D,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,MAAM,CAAA;IACzC,qFAAqF;IACrF,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAA;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,MAAM,CAAA;CACvD;AAED,sEAAsE;AACtE,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE;QACT,SAAS,EAAE,MAAM,CAAA;QACjB,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;CACF;AAqBD,wBAAgB,SAAS,CAAC,YAAY,EAAE,eAAe,GAAG,IAAI,CAAC,WAAW,CAAC,CAyH1E"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAGnC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAItD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAEzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AAS3E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAEhE;;;GAGG;AAEH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAA;IACpD,oEAAoE;IACpE,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAA;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,sBAAsB,CAAA;IAC5C,4DAA4D;IAC5D,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,MAAM,CAAA;IACzC,qFAAqF;IACrF,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAA;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,MAAM,CAAA;CACvD;AAED,sEAAsE;AACtE,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE;QACT,SAAS,EAAE,MAAM,CAAA;QACjB,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;CACF;AAqBD,wBAAgB,SAAS,CAAC,YAAY,EAAE,eAAe,GAAG,IAAI,CAAC,WAAW,CAAC,CAwJ1E"}

package/dist/app.js

@@ -8,6 +8,7 @@ import { MCP_INSTRUCTIONS, MCP_ROUTE_PREFIX, MCP_SERVER_INFO } from './modules/m
 import { createMcpEndpoint } from './modules/mcp/router.js';
 import { createAuthAndApiRateLimitMiddleware, createFormSubmitRateLimitMiddleware, } from './modules/rate-limit/middleware.js';
 import { createIdempotencyMiddleware } from './modules/workspace/idempotencyMiddleware.js';
+import { createWorkspaceAccessMiddleware } from './modules/workspace/workspaceAccessMiddleware.js';
 const REQUEST_ID_HEADER = 'X-Request-Id';
 /**
  * Any origin, because a public endpoint exists to be called from a customer's
@@ -58,6 +59,15 @@ export function createApp(dependencies) {
     // itself; `createFormSubmitRateLimitMiddleware` below covers it, mounted
     // where the public CORS middleware requires.
     app.use('/v1/*', createAuthAndApiRateLimitMiddleware(rateLimitDependencies));
+    // Ahead of idempotency too, for the same reason: a request this blocks
+    // must never reserve a key it will not be allowed to spend. Inert without
+    // a module granting or denying `workspace.access` (`capabilities.ts`).
+    const workspaceAccessMiddleware = createWorkspaceAccessMiddleware({
+        db: dependencies.credentials.db,
+        now: dependencies.credentials.now,
+        entitlements: dependencies.contributions.entitlements,
+    });
+    app.use('/v1/*', workspaceAccessMiddleware);
     // Every module's `POST` gets this the same way, decided once here rather than
     // per route (`api.md`). It skips `/v1/public/*` itself — a public request has
     // no `Actor` to scope a key to — so it is mounted ahead of the public CORS
@@ -97,8 +107,25 @@ export function createApp(dependencies) {
     // comes through. No CORS layer to mind the order of here, unlike the forms
     // budget — the transport checks its own `Origin` inside the handler.
     app.use(MCP_ROUTE_PREFIX, createAuthAndApiRateLimitMiddleware(rateLimitDependencies));
+    // MCP mirrors `/v1` one-to-one, so a workspace this gate blocks must not
+    // still be reachable through agent tools.
+    app.use(MCP_ROUTE_PREFIX, workspaceAccessMiddleware);
     app.route(MCP_ROUTE_PREFIX, mcp.transport);
     app.route('/v1', mcp.catalog);
+    // Module declarations on the app itself, outside /v1 (`runtime/module.ts`).
+    // Middleware first, all of it, then routes: within one request Hono
+    // composes matching handlers in registration order, so this is what makes
+    // a declared pattern cover matching routes from every module, whichever
+    // registered first. Registered after core's own surfaces above, so nothing
+    // here can run ahead of them. Not rate limited: the `/v1` budgets are
+    // per-workspace-credential, and a declared surface owns its own access
+    // rules.
+    for (const middleware of dependencies.contributions.appMiddleware) {
+        app.use(middleware.pattern, middleware.handler);
+    }
+    for (const route of dependencies.contributions.appRoutes) {
+        app.on(route.method, route.path, route.handler);
+    }
     app.onError((error, context) => {
         if (error instanceof AppError) {
             return context.json(toErrorBody(error), error.status);

package/dist/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAGhC,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAI9C,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAA;AAEpE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAC3D,OAAO,EACL,mCAAmC,EACnC,mCAAmC,GACpC,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAA;AA2C1F,MAAM,iBAAiB,GAAG,cAAc,CAAA;AAExC;;;;;;;;GAQG;AACH,MAAM,WAAW,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,GAAG;IACX,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;IACxC,YAAY,EAAE,CAAC,cAAc,CAAC;IAC9B,WAAW,EAAE,KAAK;IAClB,MAAM,EAAE,MAAM;CACf,CAAC,CAAA;AAEF,MAAM,UAAU,SAAS,CAAC,YAA6B;IACrD,MAAM,iBAAiB,GAAG,YAAY,CAAC,iBAAiB,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAA;IACvF,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,IAAI,eAAe,EAAE,CAAA;IAC3D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAe,CAAA;IAEnC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QACnC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,iBAAiB,EAAE,CAAA;QAC9E,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QAEvD,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;QACnC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC7B,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAA;QAE5C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QACnC,MAAM,IAAI,EAAE,CAAA;QAEZ,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE;YACrB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM;YAC1B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;YACtB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM;YAC1B,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;SACtD,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAA;IAEvC,MAAM,qBAAqB,GAAG;QAC5B,EAAE,EAAE,YAAY,CAAC,WAAW,CAAC,EAAE;QAC/B,GAAG,EAAE,YAAY,CAAC,WAAW,CAAC,GAAG;QACjC,QAAQ;QACR,WAAW,EAAE,YAAY,CAAC,WAAW;QACrC,eAAe,EAAE,YAAY,CAAC,eAAe;QAC7C,MAAM,EAAE,YAAY,CAAC,SAAS;KAC/B,CAAA;IAED,oEAAoE;IACpE,wEAAwE;IACxE,yEAAyE;IACzE,6CAA6C;IAC7C,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,mCAAmC,CAAC,qBAAqB,CAAC,CAAC,CAAA;IAE5E,8EAA8E;IAC9E,8EAA8E;IAC9E,2EAA2E;IAC3E,0CAA0C;IAC1C,GAAG,CAAC,GAAG,CACL,OAAO,EACP,2BAA2B,CAAC;QAC1B,EAAE,EAAE,YAAY,CAAC,WAAW,CAAC,EAAE;QAC/B,GAAG,EAAE,YAAY,CAAC,WAAW,CAAC,GAAG;QACjC,QAAQ;QACR,WAAW,EAAE,YAAY,CAAC,WAAW;QACrC,GAAG,EAAE,YAAY,CAAC,MAAM;KACzB,CAAC,CACH,CAAA;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,sEAAsE;IACtE,GAAG,CAAC,GAAG,CAAC,GAAG,mBAAmB,IAAI,EAAE,WAAW,CAAC,CAAA;IAEhD,6EAA6E;IAC7E,wEAAwE;IACxE,yEAAyE;IACzE,GAAG,CAAC,GAAG,CAAC,GAAG,mBAAmB,IAAI,EAAE,mCAAmC,CAAC,qBAAqB,CAAC,CAAC,CAAA;IAE/F,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,YAAY,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC;QAClE,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAA;IACxC,CAAC;IAED,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,YAAY,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;QAC5D,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IAC1B,CAAC;IAED,MAAM,GAAG,GAAG,iBAAiB,CAAC;QAC5B,GAAG,YAAY,CAAC,WAAW;QAC3B,KAAK,EAAE,YAAY,CAAC,aAAa,CAAC,QAAQ;QAC1C,UAAU,EAAE,eAAe;QAC3B,YAAY,EAAE,gBAAgB;QAC9B,MAAM,EAAE,YAAY,CAAC,MAAM;KAC5B,CAAC,CAAA;IAEF,sEAAsE;IACtE,qEAAqE;IACrE,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,qEAAqE;IACrE,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,mCAAmC,CAAC,qBAAqB,CAAC,CAAC,CAAA;IAErF,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,GAAG,CAAC,SAAS,CAAC,CAAA;IAC1C,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IAE7B,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7B,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;YAC9B,OAAO,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;QACvD,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE;YAC7C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM;YAC1B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;YACtB,KAAK,EAAE,KAAK,CAAC,OAAO;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAA;QACF,OAAO,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;IAE9E,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACpC,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,aAAa,EAAE,CAAA;QAEhD,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;YAC7E,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAA;QACpE,CAAC;QAED,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAGhC,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAI9C,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAA;AAEpE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAC3D,OAAO,EACL,mCAAmC,EACnC,mCAAmC,GACpC,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAA;AAC1F,OAAO,EAAE,+BAA+B,EAAE,MAAM,kDAAkD,CAAA;AA2ClG,MAAM,iBAAiB,GAAG,cAAc,CAAA;AAExC;;;;;;;;GAQG;AACH,MAAM,WAAW,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,GAAG;IACX,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;IACxC,YAAY,EAAE,CAAC,cAAc,CAAC;IAC9B,WAAW,EAAE,KAAK;IAClB,MAAM,EAAE,MAAM;CACf,CAAC,CAAA;AAEF,MAAM,UAAU,SAAS,CAAC,YAA6B;IACrD,MAAM,iBAAiB,GAAG,YAAY,CAAC,iBAAiB,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAA;IACvF,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,IAAI,eAAe,EAAE,CAAA;IAC3D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAe,CAAA;IAEnC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QACnC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,iBAAiB,EAAE,CAAA;QAC9E,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QAEvD,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;QACnC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC7B,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAA;QAE5C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QACnC,MAAM,IAAI,EAAE,CAAA;QAEZ,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE;YACrB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM;YAC1B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;YACtB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM;YAC1B,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;SACtD,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAA;IAEvC,MAAM,qBAAqB,GAAG;QAC5B,EAAE,EAAE,YAAY,CAAC,WAAW,CAAC,EAAE;QAC/B,GAAG,EAAE,YAAY,CAAC,WAAW,CAAC,GAAG;QACjC,QAAQ;QACR,WAAW,EAAE,YAAY,CAAC,WAAW;QACrC,eAAe,EAAE,YAAY,CAAC,eAAe;QAC7C,MAAM,EAAE,YAAY,CAAC,SAAS;KAC/B,CAAA;IAED,oEAAoE;IACpE,wEAAwE;IACxE,yEAAyE;IACzE,6CAA6C;IAC7C,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,mCAAmC,CAAC,qBAAqB,CAAC,CAAC,CAAA;IAE5E,uEAAuE;IACvE,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,yBAAyB,GAAG,+BAA+B,CAAC;QAChE,EAAE,EAAE,YAAY,CAAC,WAAW,CAAC,EAAE;QAC/B,GAAG,EAAE,YAAY,CAAC,WAAW,CAAC,GAAG;QACjC,YAAY,EAAE,YAAY,CAAC,aAAa,CAAC,YAAY;KACtD,CAAC,CAAA;IAEF,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAA;IAE3C,8EAA8E;IAC9E,8EAA8E;IAC9E,2EAA2E;IAC3E,0CAA0C;IAC1C,GAAG,CAAC,GAAG,CACL,OAAO,EACP,2BAA2B,CAAC;QAC1B,EAAE,EAAE,YAAY,CAAC,WAAW,CAAC,EAAE;QAC/B,GAAG,EAAE,YAAY,CAAC,WAAW,CAAC,GAAG;QACjC,QAAQ;QACR,WAAW,EAAE,YAAY,CAAC,WAAW;QACrC,GAAG,EAAE,YAAY,CAAC,MAAM;KACzB,CAAC,CACH,CAAA;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,sEAAsE;IACtE,GAAG,CAAC,GAAG,CAAC,GAAG,mBAAmB,IAAI,EAAE,WAAW,CAAC,CAAA;IAEhD,6EAA6E;IAC7E,wEAAwE;IACxE,yEAAyE;IACzE,GAAG,CAAC,GAAG,CAAC,GAAG,mBAAmB,IAAI,EAAE,mCAAmC,CAAC,qBAAqB,CAAC,CAAC,CAAA;IAE/F,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,YAAY,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC;QAClE,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAA;IACxC,CAAC;IAED,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,YAAY,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;QAC5D,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IAC1B,CAAC;IAED,MAAM,GAAG,GAAG,iBAAiB,CAAC;QAC5B,GAAG,YAAY,CAAC,WAAW;QAC3B,KAAK,EAAE,YAAY,CAAC,aAAa,CAAC,QAAQ;QAC1C,UAAU,EAAE,eAAe;QAC3B,YAAY,EAAE,gBAAgB;QAC9B,MAAM,EAAE,YAAY,CAAC,MAAM;KAC5B,CAAC,CAAA;IAEF,sEAAsE;IACtE,qEAAqE;IACrE,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,qEAAqE;IACrE,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,mCAAmC,CAAC,qBAAqB,CAAC,CAAC,CAAA;IAErF,yEAAyE;IACzE,0CAA0C;IAC1C,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,yBAAyB,CAAC,CAAA;IAEpD,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,GAAG,CAAC,SAAS,CAAC,CAAA;IAC1C,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IAE7B,4EAA4E;IAC5E,oEAAoE;IACpE,0EAA0E;IAC1E,wEAAwE;IACxE,2EAA2E;IAC3E,sEAAsE;IACtE,uEAAuE;IACvE,SAAS;IACT,KAAK,MAAM,UAAU,IAAI,YAAY,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC;QAClE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,CAAA;IACjD,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;QACzD,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IACjD,CAAC;IAED,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7B,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;YAC9B,OAAO,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;QACvD,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE;YAC7C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM;YAC1B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;YACtB,KAAK,EAAE,KAAK,CAAC,OAAO;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAA;QACF,OAAO,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;IAE9E,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACpC,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,aAAa,EAAE,CAAA;QAEhD,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;YAC7E,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAA;QACpE,CAAC;QAED,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/index.d.ts

@@ -4,6 +4,7 @@ export { WebBundleError, serveWebBundle } from './webBundle.ts';
 export type { WebBundleOptions } from './webBundle.ts';
 export { ConfigurationError, loadConfig } from './lib/config.ts';
 export type { Environment, KelpieConfig, LogLevel, RuntimeMode } from './lib/config.ts';
+export { resolveClientIpFrom } from './lib/clientIp.ts';
 export { ModuleConfigFileError, readModuleConfigFile } from './lib/moduleConfig.ts';
 export { FOREIGN_KEY_VIOLATION, RESTRICT_VIOLATION, UNIQUE_VIOLATION, connectDatabase, isReferenceViolation, postgresErrorCode, } from './lib/database.ts';
 export type { Database, DatabaseConnection, DatabaseProbe } from './lib/database.ts';
@@ -37,7 +38,7 @@ export type { ResealColumnOutcome, ResealOutcome } from './modules/reseal.ts';
 export { KEY_KINDS, kindOfSecret, mintKey, parseKeyKind, readBearerToken } from './modules/api-keys/keys.ts';
 export type { KeyKind, MintedKey } from './modules/api-keys/keys.ts';
 export { registerModules } from './runtime/registry.ts';
-export type { ModuleContributions, ModuleRouter, ModuleRuntimeOptions } from './runtime/registry.ts';
+export type { AppMiddlewareContribution, AppRouteContribution, ModuleContributions, ModuleRouter, ModuleRuntimeOptions, } from './runtime/registry.ts';
 export type { ModuleServices } from './runtime/module.ts';
 export type { Actor, ApiKeyActor, SessionActor } from './modules/auth/actor.ts';
 export { actorUserId, actorWorkspaceId, requireSessionActor } from './modules/auth/actor.ts';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AACpC,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAE5D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC/D,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEtD,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAChE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAEvF,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAEnF,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,QAAQ,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEpF,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAA;AAE3C,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAC3F,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAE5E,OAAO,EAAE,uBAAuB,EAAE,YAAY,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAClH,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAE5E,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,4BAA4B,GAC7B,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAE5E,OAAO,EACL,QAAQ,EACR,cAAc,EACd,uBAAuB,EACvB,iBAAiB,EACjB,WAAW,EACX,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAEtG,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAC1D,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAEzD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAEjE,YAAY,EACV,YAAY,EACZ,OAAO,EACP,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAElE,OAAO,EAAE,yBAAyB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAClG,YAAY,EACV,UAAU,EACV,WAAW,EACX,mBAAmB,EACnB,cAAc,EACd,aAAa,EACb,eAAe,GAChB,MAAM,2BAA2B,CAAA;AAElC,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAA;AAEjE,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAC7F,YAAY,EACV,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AACjE,YAAY,EACV,cAAc,EACd,WAAW,EACX,kBAAkB,EAClB,gBAAgB,EAChB,4BAA4B,GAC7B,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpE,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAE7D,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAExE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAE7E,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAC5G,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAEpE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,YAAY,EAAE,mBAAmB,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AACpG,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAEzD,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAC/E,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAC5F,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAA;AAC9E,YAAY,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AAC3E,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAA;AACzG,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AACpC,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAE5D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC/D,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEtD,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAChE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAEvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAEvD,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAEnF,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,QAAQ,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEpF,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAA;AAE3C,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAC3F,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAE5E,OAAO,EAAE,uBAAuB,EAAE,YAAY,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAClH,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAE5E,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,4BAA4B,GAC7B,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAE5E,OAAO,EACL,QAAQ,EACR,cAAc,EACd,uBAAuB,EACvB,iBAAiB,EACjB,WAAW,EACX,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAEtG,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAC1D,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAEzD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAEjE,YAAY,EACV,YAAY,EACZ,OAAO,EACP,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAElE,OAAO,EAAE,yBAAyB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAClG,YAAY,EACV,UAAU,EACV,WAAW,EACX,mBAAmB,EACnB,cAAc,EACd,aAAa,EACb,eAAe,GAChB,MAAM,2BAA2B,CAAA;AAElC,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAA;AAEjE,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAC7F,YAAY,EACV,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AACjE,YAAY,EACV,cAAc,EACd,WAAW,EACX,kBAAkB,EAClB,gBAAgB,EAChB,4BAA4B,GAC7B,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpE,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAE7D,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAExE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAE7E,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAC5G,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAEpE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,YAAY,EACV,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACnB,YAAY,EACZ,oBAAoB,GACrB,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAEzD,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAC/E,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAC5F,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAA;AAC9E,YAAY,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AAC3E,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAA;AACzG,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAA"}

package/dist/index.js

@@ -1,6 +1,7 @@
 export { createApp } from './app.js';
 export { WebBundleError, serveWebBundle } from './webBundle.js';
 export { ConfigurationError, loadConfig } from './lib/config.js';
+export { resolveClientIpFrom } from './lib/clientIp.js';
 export { ModuleConfigFileError, readModuleConfigFile } from './lib/moduleConfig.js';
 export { FOREIGN_KEY_VIOLATION, RESTRICT_VIOLATION, UNIQUE_VIOLATION, connectDatabase, isReferenceViolation, postgresErrorCode, } from './lib/database.js';
 export * as schema from './schema/index.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAGpC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAG/D,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAGhE,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAEnF,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,mBAAmB,CAAA;AAG1B,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAA;AAE3C,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAG3F,OAAO,EAAE,uBAAuB,EAAE,YAAY,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAClH,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAE5E,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,4BAA4B,GAC7B,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EACL,QAAQ,EACR,cAAc,EACd,uBAAuB,EACvB,iBAAiB,EACjB,WAAW,EACX,cAAc,GACf,MAAM,iBAAiB,CAAA;AAGxB,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAG1D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAa9C,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAElE,OAAO,EAAE,yBAAyB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAUlG,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAA;AAEjE,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAU7F,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AASjE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAGpE,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAExE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAGzD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAG5G,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAKvD,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAC5F,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAA;AAE9E,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAGpC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAG/D,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAGhE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAEvD,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAEnF,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,mBAAmB,CAAA;AAG1B,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAA;AAE3C,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAG3F,OAAO,EAAE,uBAAuB,EAAE,YAAY,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAClH,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAE5E,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,4BAA4B,GAC7B,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EACL,QAAQ,EACR,cAAc,EACd,uBAAuB,EACvB,iBAAiB,EACjB,WAAW,EACX,cAAc,GACf,MAAM,iBAAiB,CAAA;AAGxB,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAG1D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAa9C,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAElE,OAAO,EAAE,yBAAyB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAUlG,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAA;AAEjE,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAU7F,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AASjE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAGpE,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAExE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAGzD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAG5G,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAWvD,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAC5F,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAA;AAE9E,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAA"}

package/dist/lib/appUrl.d.ts

@@ -0,0 +1,27 @@
+import { z } from 'zod';
+/** The one variable the auth and workspace modules read to build their links. */
+export declare const appUrlConfigSchema: z.ZodObject<{
+    APP_BASE_URL: z.ZodString;
+}, z.core.$strip>;
+export type AppUrlConfig = z.infer<typeof appUrlConfigSchema>;
+/**
+ * The browser app's routes for each token-carrying link. They match the paths
+ * the single-page app serves (`packages/ui`), so a link built here reaches a
+ * real page once that bundle is deployed at `APP_BASE_URL`.
+ */
+export declare const APP_LINK_PATHS: {
+    readonly passwordReset: '/reset-password';
+    readonly verifyEmail: '/verify-email';
+    readonly inviteAccept: '/join';
+};
+/**
+ * Builds a link at the deployment's base URL, carrying the token as a query
+ * parameter.
+ *
+ * `new URL(path, baseUrl)` resolves the path against the base, so a base with a
+ * trailing slash and one without give the same result. The token is base64url
+ * and needs no escaping. `searchParams` encodes it regardless, rather than trust
+ * that.
+ */
+export declare function buildAppLink(baseUrl: string, path: string, token: string): string;
+//# sourceMappingURL=appUrl.d.ts.map

package/dist/lib/appUrl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appUrl.d.ts","sourceRoot":"","sources":["../../src/lib/appUrl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AA8BvB,iFAAiF;AACjF,eAAO,MAAM,kBAAkB;;iBAE7B,CAAA;AAEF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAE7D;;;;GAIG;AACH,eAAO,MAAM,cAAc;aACzB,aAAa,EAAE,iBAAiB;aAChC,WAAW,EAAE,eAAe;aAC5B,YAAY,EAAE,OAAO;CACb,CAAA;AAEV;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAMjF"}

package/dist/lib/appUrl.js

@@ -0,0 +1,53 @@
+import { z } from 'zod';
+/**
+ * The deployment's own base URL, and how token links in transactional mail are
+ * built from it.
+ *
+ * The service builds every reset, verification, and invite link itself, from a
+ * configured base URL. It does not build them from a URL the caller sends. A
+ * caller-supplied link lets anyone point a real Kelpie email at any address,
+ * which is an account-takeover path. The base URL is set once per deployment,
+ * beside the database URL and the mail provider.
+ */
+const APP_BASE_URL_MESSAGE = 'must be an absolute http:// or https:// URL, e.g. https://crm.example.com';
+/** True when the value is an absolute http(s) URL with no embedded credentials. */
+function isValidBaseUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return false;
+    }
+    const protocolAllowed = url.protocol === 'http:' || url.protocol === 'https:';
+    return protocolAllowed && url.username.length === 0 && url.password.length === 0;
+}
+/** The one variable the auth and workspace modules read to build their links. */
+export const appUrlConfigSchema = z.object({
+    APP_BASE_URL: z.string().refine(isValidBaseUrl, { message: APP_BASE_URL_MESSAGE }),
+});
+/**
+ * The browser app's routes for each token-carrying link. They match the paths
+ * the single-page app serves (`packages/ui`), so a link built here reaches a
+ * real page once that bundle is deployed at `APP_BASE_URL`.
+ */
+export const APP_LINK_PATHS = {
+    passwordReset: '/reset-password',
+    verifyEmail: '/verify-email',
+    inviteAccept: '/join',
+};
+/**
+ * Builds a link at the deployment's base URL, carrying the token as a query
+ * parameter.
+ *
+ * `new URL(path, baseUrl)` resolves the path against the base, so a base with a
+ * trailing slash and one without give the same result. The token is base64url
+ * and needs no escaping. `searchParams` encodes it regardless, rather than trust
+ * that.
+ */
+export function buildAppLink(baseUrl, path, token) {
+    const url = new URL(path, baseUrl);
+    url.searchParams.set('token', token);
+    return url.toString();
+}
+//# sourceMappingURL=appUrl.js.map

package/dist/lib/appUrl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appUrl.js","sourceRoot":"","sources":["../../src/lib/appUrl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;;;;;;GASG;AAEH,MAAM,oBAAoB,GAAG,2EAA2E,CAAA;AAExG,mFAAmF;AACnF,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,GAAQ,CAAA;IAEZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAA;IAE7E,OAAO,eAAe,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAA;AAClF,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;CACnF,CAAC,CAAA;AAIF;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,aAAa,EAAE,iBAAiB;IAChC,WAAW,EAAE,eAAe;IAC5B,YAAY,EAAE,OAAO;CACb,CAAA;AAEV;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,IAAY,EAAE,KAAa;IACvE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAElC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAEpC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;AACvB,CAAC"}

package/dist/lib/clientIp.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Resolving the caller's IP when the service sits behind trusted proxies.
+ *
+ * The rate limiter keys on this, so trusting it wrongly matters both ways: read a
+ * forgeable header and an attacker rotates it to dodge the limit; ignore a real
+ * proxy and every caller collapses into one bucket behind the load balancer.
+ *
+ * The deployment states how many proxies stand in front of it
+ * (`TRUSTED_PROXY_HOP_COUNT`). Zero, the default, means the service is reached
+ * directly and the socket address is the client. A positive count means the last
+ * N entries of `X-Forwarded-For` were written by infrastructure this deployment
+ * controls, so the entry just left of them is the client as the outermost trusted
+ * proxy saw it, which no earlier hop could forge.
+ */
+/**
+ * @param socketAddress The address the TCP connection arrived from.
+ * @param forwardedFor The raw `X-Forwarded-For` header, or undefined.
+ * @param hopCount How many trusted proxies stand in front of the service.
+ * @returns The client's IP. Falls back to the socket address whenever the header
+ *   is absent or holds fewer entries than the configured hop count, so a
+ *   misconfiguration over-limits rather than trusts a forgeable position.
+ */
+export declare function resolveClientIpFrom(socketAddress: string, forwardedFor: string | undefined, hopCount: number): string;
+//# sourceMappingURL=clientIp.d.ts.map

package/dist/lib/clientIp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientIp.d.ts","sourceRoot":"","sources":["../../src/lib/clientIp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,QAAQ,EAAE,MAAM,GACf,MAAM,CAaR"}

package/dist/lib/clientIp.js

@@ -0,0 +1,34 @@
+/**
+ * Resolving the caller's IP when the service sits behind trusted proxies.
+ *
+ * The rate limiter keys on this, so trusting it wrongly matters both ways: read a
+ * forgeable header and an attacker rotates it to dodge the limit; ignore a real
+ * proxy and every caller collapses into one bucket behind the load balancer.
+ *
+ * The deployment states how many proxies stand in front of it
+ * (`TRUSTED_PROXY_HOP_COUNT`). Zero, the default, means the service is reached
+ * directly and the socket address is the client. A positive count means the last
+ * N entries of `X-Forwarded-For` were written by infrastructure this deployment
+ * controls, so the entry just left of them is the client as the outermost trusted
+ * proxy saw it, which no earlier hop could forge.
+ */
+/**
+ * @param socketAddress The address the TCP connection arrived from.
+ * @param forwardedFor The raw `X-Forwarded-For` header, or undefined.
+ * @param hopCount How many trusted proxies stand in front of the service.
+ * @returns The client's IP. Falls back to the socket address whenever the header
+ *   is absent or holds fewer entries than the configured hop count, so a
+ *   misconfiguration over-limits rather than trusts a forgeable position.
+ */
+export function resolveClientIpFrom(socketAddress, forwardedFor, hopCount) {
+    if (hopCount <= 0 || forwardedFor === undefined) {
+        return socketAddress;
+    }
+    const entries = forwardedFor
+        .split(',')
+        .map((entry) => entry.trim())
+        .filter((entry) => entry.length > 0);
+    const index = entries.length - hopCount;
+    return index >= 0 ? (entries[index] ?? socketAddress) : socketAddress;
+}
+//# sourceMappingURL=clientIp.js.map

package/dist/lib/clientIp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientIp.js","sourceRoot":"","sources":["../../src/lib/clientIp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,aAAqB,EACrB,YAAgC,EAChC,QAAgB;IAEhB,IAAI,QAAQ,IAAI,CAAC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO,aAAa,CAAA;IACtB,CAAC;IAED,MAAM,OAAO,GAAG,YAAY;SACzB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAEtC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAA;IAEvC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAA;AACvE,CAAC"}

package/dist/lib/config.d.ts

@@ -28,6 +28,12 @@ export interface KelpieConfig {
      */
     readonly webBundleDirectory: string | undefined;
     readonly rateLimit: RateLimitConfig;
+    /**
+     * How many trusted proxies stand in front of the service. Zero means it is
+     * reached directly and the socket address is the client. Positive means the
+     * client IP is read from `X-Forwarded-For` (`lib/clientIp.ts`).
+     */
+    readonly trustedProxyHopCount: number;
 }
 /** Thrown at boot when the environment cannot produce a valid configuration. */
 export declare class ConfigurationError extends Error {

package/dist/lib/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAG7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAErD;;;;GAIG;AAEH,MAAM,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;AAEtE,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,MAAM,GAAG,YAAY,CAAA;AAE/D,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAA;AAE1D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAA;IAC/C,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAA;CACpC;AAED,gFAAgF;AAChF,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IAEpC,YAAY,QAAQ,EAAE,SAAS,MAAM,EAAE,EAItC;CACF;AAuBD;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,WAAW,EAAE,WAAW,GAAG,YAAY,CAuBjE"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAG7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAErD;;;;GAIG;AAEH,MAAM,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;AAEtE,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,MAAM,GAAG,YAAY,CAAA;AAE/D,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAA;AAE1D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAA;IAC/C,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAA;IACnC;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;CACtC;AAED,gFAAgF;AAChF,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IAEpC,YAAY,QAAQ,EAAE,SAAS,MAAM,EAAE,EAItC;CACF;AAwBD;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,WAAW,EAAE,WAAW,GAAG,YAAY,CAwBjE"}

package/dist/lib/config.js

@@ -29,6 +29,7 @@ const environmentSchema = z.object({
     LOG_LEVEL: z.enum(['debug', 'info', 'warn', 'error']),
     KELPIE_MODULE_CONFIG_PATH: z.string().min(1).optional(),
     WEB_BUNDLE_DIR: z.string().min(1).optional(),
+    TRUSTED_PROXY_HOP_COUNT: z.coerce.number().int().nonnegative().default(0),
     ...rateLimitConfigSchema.shape,
 });
 /**
@@ -61,6 +62,7 @@ export function loadConfig(environment) {
         moduleConfigPath: environmentResult.data.KELPIE_MODULE_CONFIG_PATH,
         webBundleDirectory: environmentResult.data.WEB_BUNDLE_DIR,
         rateLimit: rateLimitConfigFrom(environmentResult.data),
+        trustedProxyHopCount: environmentResult.data.TRUSTED_PROXY_HOP_COUNT,
     };
 }
 //# sourceMappingURL=config.js.map

package/dist/lib/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAE9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAqC3E,gFAAgF;AAChF,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,QAAQ,CAAmB;IAEpC,YAAY,QAA2B;QACrC,KAAK,CAAC,uCAAuC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACtG,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;QAChC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;CACF;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;QACnC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,aAAa,CAAA;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;IACvD,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC;IACnD,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,MAAM,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC;IACjG,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACrD,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C,GAAG,qBAAqB,CAAC,KAAK;CAC/B,CAAC,CAAA;AAEF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,UAAU,CAAC,WAAwB;IACjD,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;IAClE,MAAM,WAAW,GAAG,iBAAiB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;IAE5D,IAAI,CAAC,iBAAiB,CAAC,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QACvD,MAAM,QAAQ,GAAG;YACf,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YACjG,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;SACtF,CAAA;QAED,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IACxC,CAAC;IAED,OAAO;QACL,WAAW,EAAE,iBAAiB,CAAC,IAAI,CAAC,QAAQ;QAC5C,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI;QACjC,WAAW,EAAE,iBAAiB,CAAC,IAAI,CAAC,YAAY;QAChD,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC,SAAS;QAC1C,KAAK,EAAE,WAAW,CAAC,IAAI;QACvB,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,yBAAyB;QAClE,kBAAkB,EAAE,iBAAiB,CAAC,IAAI,CAAC,cAAc;QACzD,SAAS,EAAE,mBAAmB,CAAC,iBAAiB,CAAC,IAAI,CAAC;KACvD,CAAA;AACH,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAE9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AA2C3E,gFAAgF;AAChF,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,QAAQ,CAAmB;IAEpC,YAAY,QAA2B;QACrC,KAAK,CAAC,uCAAuC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACtG,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;QAChC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;CACF;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;QACnC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,aAAa,CAAA;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;IACvD,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC;IACnD,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,MAAM,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC;IACjG,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACrD,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C,uBAAuB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACzE,GAAG,qBAAqB,CAAC,KAAK;CAC/B,CAAC,CAAA;AAEF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,UAAU,CAAC,WAAwB;IACjD,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;IAClE,MAAM,WAAW,GAAG,iBAAiB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;IAE5D,IAAI,CAAC,iBAAiB,CAAC,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QACvD,MAAM,QAAQ,GAAG;YACf,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YACjG,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;SACtF,CAAA;QAED,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IACxC,CAAC;IAED,OAAO;QACL,WAAW,EAAE,iBAAiB,CAAC,IAAI,CAAC,QAAQ;QAC5C,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI;QACjC,WAAW,EAAE,iBAAiB,CAAC,IAAI,CAAC,YAAY;QAChD,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC,SAAS;QAC1C,KAAK,EAAE,WAAW,CAAC,IAAI;QACvB,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,yBAAyB;QAClE,kBAAkB,EAAE,iBAAiB,CAAC,IAAI,CAAC,cAAc;QACzD,SAAS,EAAE,mBAAmB,CAAC,iBAAiB,CAAC,IAAI,CAAC;QACtD,oBAAoB,EAAE,iBAAiB,CAAC,IAAI,CAAC,uBAAuB;KACrE,CAAA;AACH,CAAC"}

package/dist/lib/egress.d.ts

@@ -0,0 +1,44 @@
+import { z } from 'zod';
+/**
+ * An optional guard against outbound POSTs to private or reserved addresses.
+ *
+ * Webhook and agent endpoints are customer-supplied, and a self-hosted Kelpie
+ * legitimately posts to an internal host such as `http://automation.internal`.
+ * So the guard is off by default (`lib/url.ts` says the same). A hosted
+ * deployment, where a customer must not be able to aim a delivery at the
+ * metadata service or a neighbour's database, sets `BLOCK_PRIVATE_EGRESS=true`.
+ *
+ * The check resolves the host and refuses the request when any resolved address
+ * is loopback, private, link-local, unique-local, or otherwise reserved. It runs
+ * just before the fetch. That leaves a narrow rebinding window between this
+ * lookup and the connection's own; the senders already pass `redirect: 'manual'`,
+ * which closes the redirect-based bypass, and a hosted deployment pairs this with
+ * network-level egress rules. It is defence in depth, not the only defence.
+ */
+export declare const egressConfigSchema: z.ZodObject<{
+    BLOCK_PRIVATE_EGRESS: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        false: "false";
+        true: "true";
+    }>>, z.ZodTransform<boolean, "false" | "true">>;
+}, z.core.$strip>;
+export type EgressConfig = z.infer<typeof egressConfigSchema>;
+/** Thrown when a target resolves to an address the guard refuses. */
+export declare class BlockedEgressError extends Error {
+    constructor(host: string, address: string);
+}
+export interface EgressGuard {
+    /**
+     * @throws BlockedEgressError when the URL's host resolves to a private or
+     *   reserved address. Resolves normally when the guard is off, or when every
+     *   resolved address is public.
+     */
+    check(url: string): Promise<void>;
+}
+/**
+ * Builds the guard. When `BLOCK_PRIVATE_EGRESS` is false the guard is a no-op, so
+ * a self-hosted deployment keeps reaching its internal endpoints.
+ *
+ * @param resolveHost Injected so a test can classify a host without real DNS.
+ */
+export declare function createEgressGuard(config: EgressConfig, resolveHost?: (host: string) => Promise<readonly string[]>): EgressGuard;
+//# sourceMappingURL=egress.d.ts.map

package/dist/lib/egress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress.d.ts","sourceRoot":"","sources":["../../src/lib/egress.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,kBAAkB;;;;;iBAK7B,CAAA;AAEF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAE7D,qEAAqE;AACrE,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAGxC;CACF;AAoED,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAClC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,YAAY,EACpB,WAAW,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAsB,GAC7E,WAAW,CAoBb"}

package/dist/lib/egress.js

@@ -0,0 +1,111 @@
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+import { z } from 'zod';
+/**
+ * An optional guard against outbound POSTs to private or reserved addresses.
+ *
+ * Webhook and agent endpoints are customer-supplied, and a self-hosted Kelpie
+ * legitimately posts to an internal host such as `http://automation.internal`.
+ * So the guard is off by default (`lib/url.ts` says the same). A hosted
+ * deployment, where a customer must not be able to aim a delivery at the
+ * metadata service or a neighbour's database, sets `BLOCK_PRIVATE_EGRESS=true`.
+ *
+ * The check resolves the host and refuses the request when any resolved address
+ * is loopback, private, link-local, unique-local, or otherwise reserved. It runs
+ * just before the fetch. That leaves a narrow rebinding window between this
+ * lookup and the connection's own; the senders already pass `redirect: 'manual'`,
+ * which closes the redirect-based bypass, and a hosted deployment pairs this with
+ * network-level egress rules. It is defence in depth, not the only defence.
+ */
+export const egressConfigSchema = z.object({
+    BLOCK_PRIVATE_EGRESS: z
+        .enum(['true', 'false'])
+        .default('false')
+        .transform((value) => value === 'true'),
+});
+/** Thrown when a target resolves to an address the guard refuses. */
+export class BlockedEgressError extends Error {
+    constructor(host, address) {
+        super(`Refusing to connect to ${host}: ${address} is a private or reserved address`);
+        this.name = 'BlockedEgressError';
+    }
+}
+/** True for an IPv4 address in a loopback, private, link-local, or reserved range. */
+function isPrivateIpv4(ip) {
+    const parts = ip.split('.').map((part) => Number(part));
+    if (parts.length !== 4 || parts.some((part) => Number.isNaN(part) || part < 0 || part > 255)) {
+        return false;
+    }
+    const [a, b] = parts;
+    if (a === 0 || a === 10 || a === 127) {
+        return true;
+    }
+    if (a === 169 && b === 254) {
+        // Link-local, which is where the cloud metadata service (169.254.169.254) lives.
+        return true;
+    }
+    if (a === 172 && b >= 16 && b <= 31) {
+        return true;
+    }
+    if (a === 192 && b === 168) {
+        return true;
+    }
+    if (a === 100 && b >= 64 && b <= 127) {
+        // Carrier-grade NAT.
+        return true;
+    }
+    // Multicast (224.0.0.0/4) and reserved (240.0.0.0/4), including broadcast.
+    return a >= 224;
+}
+/** True for an IPv6 address in a loopback, unspecified, link-local, or unique-local range. */
+function isPrivateIpv6(ip) {
+    const lower = ip.toLowerCase();
+    if (lower === '::1' || lower === '::') {
+        return true;
+    }
+    const mapped = /^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/u.exec(lower);
+    if (mapped?.[1] !== undefined) {
+        // An IPv4 address written in IPv6 form resolves by its IPv4 rules.
+        return isPrivateIpv4(mapped[1]);
+    }
+    const firstHextet = Number.parseInt(lower.split(':')[0] || '0', 16);
+    // fe80::/10 link-local.
+    if ((firstHextet & 0xffc0) === 0xfe80) {
+        return true;
+    }
+    // fc00::/7 unique-local.
+    return (firstHextet & 0xfe00) === 0xfc00;
+}
+function isPrivateAddress(ip) {
+    return isIP(ip) === 6 ? isPrivateIpv6(ip) : isPrivateIpv4(ip);
+}
+/**
+ * Builds the guard. When `BLOCK_PRIVATE_EGRESS` is false the guard is a no-op, so
+ * a self-hosted deployment keeps reaching its internal endpoints.
+ *
+ * @param resolveHost Injected so a test can classify a host without real DNS.
+ */
+export function createEgressGuard(config, resolveHost = defaultResolveHost) {
+    if (!config.BLOCK_PRIVATE_EGRESS) {
+        return { check: () => Promise.resolve() };
+    }
+    return {
+        async check(url) {
+            const host = new URL(url).hostname;
+            // A bracketed IPv6 literal arrives with its brackets; `URL.hostname` keeps
+            // them, and `isIP` wants them gone.
+            const bareHost = host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : host;
+            const addresses = isIP(bareHost) !== 0 ? [bareHost] : await resolveHost(bareHost);
+            for (const address of addresses) {
+                if (isPrivateAddress(address)) {
+                    throw new BlockedEgressError(host, address);
+                }
+            }
+        },
+    };
+}
+async function defaultResolveHost(host) {
+    const results = await lookup(host, { all: true });
+    return results.map((result) => result.address);
+}
+//# sourceMappingURL=egress.js.map

package/dist/lib/egress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress.js","sourceRoot":"","sources":["../../src/lib/egress.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,oBAAoB,EAAE,CAAC;SACpB,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SACvB,OAAO,CAAC,OAAO,CAAC;SAChB,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC;CAC1C,CAAC,CAAA;AAIF,qEAAqE;AACrE,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,0BAA0B,IAAI,KAAK,OAAO,mCAAmC,CAAC,CAAA;QACpF,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;IAClC,CAAC;CACF;AAED,sFAAsF;AACtF,SAAS,aAAa,CAAC,EAAU;IAC/B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAEvD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QAC7F,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAyC,CAAA;IAExD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QACrC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAC3B,iFAAiF;QACjF,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACpC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;QACrC,qBAAqB;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,2EAA2E;IAC3E,OAAO,CAAC,IAAI,GAAG,CAAA;AACjB,CAAC;AAED,8FAA8F;AAC9F,SAAS,aAAa,CAAC,EAAU;IAC/B,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,EAAE,CAAA;IAE9B,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACtC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,MAAM,GAAG,gDAAgD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAE3E,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC9B,mEAAmE;QACnE,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;IACjC,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAA;IAEnE,wBAAwB;IACxB,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;QACtC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,yBAAyB;IACzB,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,KAAK,MAAM,CAAA;AAC1C,CAAC;AAED,SAAS,gBAAgB,CAAC,EAAU;IAClC,OAAO,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAA;AAC/D,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAoB,EACpB,WAAW,GAAiD,kBAAkB;IAE9E,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACjC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAA;IAC3C,CAAC;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,GAAG;YACb,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAA;YAClC,2EAA2E;YAC3E,oCAAoC;YACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YACtF,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAA;YAEjF,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;gBAChC,IAAI,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC9B,MAAM,IAAI,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;gBAC7C,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,IAAY;IAC5C,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;IAEjD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;AAChD,CAAC"}

package/dist/lib/ids.d.ts

@@ -7,6 +7,8 @@ export declare const idPrefixes: {
     readonly user: 'usr';
     readonly session: 'ses';
     readonly passwordResetToken: 'pwr';
+    /** Never returned over the wire either, for the same reason as `passwordResetToken`. */
+    readonly emailVerificationToken: 'evt';
     readonly teamMember: 'mem';
     readonly invite: 'inv';
     readonly apiKey: 'key';

package/dist/lib/ids.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../../src/lib/ids.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,eAAO,MAAM,UAAU;aACrB,SAAS,EAAE,IAAI;aACf,IAAI,EAAE,KAAK;aACX,OAAO,EAAE,KAAK;aACd,kBAAkB,EAAE,KAAK;aACzB,UAAU,EAAE,KAAK;aACjB,MAAM,EAAE,KAAK;aACb,MAAM,EAAE,KAAK;aACb,MAAM,EAAE,KAAK;aACb,OAAO,EAAE,KAAK;aACd,QAAQ,EAAE,KAAK;aACf,aAAa,EAAE,OAAO;aACtB,IAAI,EAAE,MAAM;aACZ,WAAW,EAAE,KAAK;aAClB,WAAW,EAAE,KAAK;aAClB,KAAK,EAAE,KAAK;aACZ,IAAI,EAAE,MAAM;aACZ,SAAS,EAAE,MAAM;aACjB,QAAQ,EAAE,MAAM;aAChB,QAAQ,EAAE,KAAK;aACf,IAAI,EAAE,MAAM;aACZ,QAAQ,EAAE,KAAK;aACf,YAAY,EAAE,IAAI;aAClB,IAAI,EAAE,MAAM;aACZ,SAAS,EAAE,IAAI;aACf,cAAc,EAAE,KAAK;aACrB,OAAO,EAAE,IAAI;IACb,8EAA8E;aAC9E,eAAe,EAAE,KAAK;aACtB,iBAAiB,EAAE,IAAI;aACvB,QAAQ,EAAE,KAAK;aACf,SAAS,EAAE,KAAK;IAChB,6FAA6F;aAC7F,aAAa,EAAE,MAAM;IACrB;;;;;OAKG;aACH,cAAc,EAAE,MAAM;IACtB;;;OAGG;aACH,eAAe,EAAE,IAAI;CACb,CAAA;AAEV,MAAM,MAAM,UAAU,GAAG,MAAM,OAAO,UAAU,CAAA;AAEhD,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,UAAU,KAAK,MAAM,CAAA;AAEpD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,YAAY,GAAE,MAAM,MAAa,GAAG,SAAS,CAE5E"}
+{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../../src/lib/ids.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,eAAO,MAAM,UAAU;aACrB,SAAS,EAAE,IAAI;aACf,IAAI,EAAE,KAAK;aACX,OAAO,EAAE,KAAK;aACd,kBAAkB,EAAE,KAAK;IACzB,wFAAwF;aACxF,sBAAsB,EAAE,KAAK;aAC7B,UAAU,EAAE,KAAK;aACjB,MAAM,EAAE,KAAK;aACb,MAAM,EAAE,KAAK;aACb,MAAM,EAAE,KAAK;aACb,OAAO,EAAE,KAAK;aACd,QAAQ,EAAE,KAAK;aACf,aAAa,EAAE,OAAO;aACtB,IAAI,EAAE,MAAM;aACZ,WAAW,EAAE,KAAK;aAClB,WAAW,EAAE,KAAK;aAClB,KAAK,EAAE,KAAK;aACZ,IAAI,EAAE,MAAM;aACZ,SAAS,EAAE,MAAM;aACjB,QAAQ,EAAE,MAAM;aAChB,QAAQ,EAAE,KAAK;aACf,IAAI,EAAE,MAAM;aACZ,QAAQ,EAAE,KAAK;aACf,YAAY,EAAE,IAAI;aAClB,IAAI,EAAE,MAAM;aACZ,SAAS,EAAE,IAAI;aACf,cAAc,EAAE,KAAK;aACrB,OAAO,EAAE,IAAI;IACb,8EAA8E;aAC9E,eAAe,EAAE,KAAK;aACtB,iBAAiB,EAAE,IAAI;aACvB,QAAQ,EAAE,KAAK;aACf,SAAS,EAAE,KAAK;IAChB,6FAA6F;aAC7F,aAAa,EAAE,MAAM;IACrB;;;;;OAKG;aACH,cAAc,EAAE,MAAM;IACtB;;;OAGG;aACH,eAAe,EAAE,IAAI;CACb,CAAA;AAEV,MAAM,MAAM,UAAU,GAAG,MAAM,OAAO,UAAU,CAAA;AAEhD,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,UAAU,KAAK,MAAM,CAAA;AAEpD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,YAAY,GAAE,MAAM,MAAa,GAAG,SAAS,CAE5E"}

package/dist/lib/ids.js

@@ -8,6 +8,8 @@ export const idPrefixes = {
     user: 'usr',
     session: 'ses',
     passwordResetToken: 'pwr',
+    /** Never returned over the wire either, for the same reason as `passwordResetToken`. */
+    emailVerificationToken: 'evt',
     teamMember: 'mem',
     invite: 'inv',
     apiKey: 'key',

package/dist/lib/ids.js.map

@@ -1 +1 @@
-{"version":3,"file":"ids.js","sourceRoot":"","sources":["../../src/lib/ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,SAAS,EAAE,IAAI;IACf,IAAI,EAAE,KAAK;IACX,OAAO,EAAE,KAAK;IACd,kBAAkB,EAAE,KAAK;IACzB,UAAU,EAAE,KAAK;IACjB,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,KAAK;IACb,OAAO,EAAE,KAAK;IACd,QAAQ,EAAE,KAAK;IACf,aAAa,EAAE,OAAO;IACtB,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,KAAK;IAClB,WAAW,EAAE,KAAK;IAClB,KAAK,EAAE,KAAK;IACZ,IAAI,EAAE,MAAM;IACZ,SAAS,EAAE,MAAM;IACjB,QAAQ,EAAE,MAAM;IAChB,QAAQ,EAAE,KAAK;IACf,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,KAAK;IACf,YAAY,EAAE,IAAI;IAClB,IAAI,EAAE,MAAM;IACZ,SAAS,EAAE,IAAI;IACf,cAAc,EAAE,KAAK;IACrB,OAAO,EAAE,IAAI;IACb,8EAA8E;IAC9E,eAAe,EAAE,KAAK;IACtB,iBAAiB,EAAE,IAAI;IACvB,QAAQ,EAAE,KAAK;IACf,SAAS,EAAE,KAAK;IAChB,6FAA6F;IAC7F,aAAa,EAAE,MAAM;IACrB;;;;;OAKG;IACH,cAAc,EAAE,MAAM;IACtB;;;OAGG;IACH,eAAe,EAAE,IAAI;CACb,CAAA;AAMV;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,YAAY,GAAiB,IAAI;IAC/D,OAAO,CAAC,IAAgB,EAAU,EAAE,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,YAAY,EAAE,EAAE,CAAA;AAC9E,CAAC"}
+{"version":3,"file":"ids.js","sourceRoot":"","sources":["../../src/lib/ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,SAAS,EAAE,IAAI;IACf,IAAI,EAAE,KAAK;IACX,OAAO,EAAE,KAAK;IACd,kBAAkB,EAAE,KAAK;IACzB,wFAAwF;IACxF,sBAAsB,EAAE,KAAK;IAC7B,UAAU,EAAE,KAAK;IACjB,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,KAAK;IACb,OAAO,EAAE,KAAK;IACd,QAAQ,EAAE,KAAK;IACf,aAAa,EAAE,OAAO;IACtB,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,KAAK;IAClB,WAAW,EAAE,KAAK;IAClB,KAAK,EAAE,KAAK;IACZ,IAAI,EAAE,MAAM;IACZ,SAAS,EAAE,MAAM;IACjB,QAAQ,EAAE,MAAM;IAChB,QAAQ,EAAE,KAAK;IACf,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,KAAK;IACf,YAAY,EAAE,IAAI;IAClB,IAAI,EAAE,MAAM;IACZ,SAAS,EAAE,IAAI;IACf,cAAc,EAAE,KAAK;IACrB,OAAO,EAAE,IAAI;IACb,8EAA8E;IAC9E,eAAe,EAAE,KAAK;IACtB,iBAAiB,EAAE,IAAI;IACvB,QAAQ,EAAE,KAAK;IACf,SAAS,EAAE,KAAK;IAChB,6FAA6F;IAC7F,aAAa,EAAE,MAAM;IACrB;;;;;OAKG;IACH,cAAc,EAAE,MAAM;IACtB;;;OAGG;IACH,eAAe,EAAE,IAAI;CACb,CAAA;AAMV;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,YAAY,GAAiB,IAAI;IAC/D,OAAO,CAAC,IAAgB,EAAU,EAAE,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,YAAY,EAAE,EAAE,CAAA;AAC9E,CAAC"}

package/dist/lib/rateLimit.d.ts

@@ -1,9 +1,9 @@
 import { z } from 'zod';
 /**
- * Budgets for the three request classes `api.md` rate-limits: public form
- * submissions, unauthenticated auth endpoints, and everything else under an
- * API key. Roadmap Phase 6: self-host packaging calls for this with nothing to
- * configure, so every variable here is optional and defaulted.
+ * Budgets for the request classes `api.md` rate-limits: public form submissions,
+ * unauthenticated auth endpoints by IP, login by account, and everything else
+ * under an API key. Roadmap Phase 6: self-host packaging calls for this with
+ * nothing to configure, so every variable here is optional and defaulted.
  */
 export interface RateLimitBudget {
     readonly limit: number;
@@ -12,6 +12,12 @@ export interface RateLimitBudget {
 export interface RateLimitConfig {
     readonly forms: RateLimitBudget;
     readonly auth: RateLimitBudget;
+    /**
+     * Login attempts for one email address, whatever IP they come from. The `auth`
+     * budget alone caps one IP, so a botnet spread across many addresses could
+     * still grind one account. This is the per-account half of that defence.
+     */
+    readonly loginAccount: RateLimitBudget;
     readonly api: RateLimitBudget;
 }
 export declare const rateLimitConfigSchema: z.ZodObject<{
@@ -19,6 +25,8 @@ export declare const rateLimitConfigSchema: z.ZodObject<{
     RATE_LIMIT_FORMS_WINDOW_SECONDS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     RATE_LIMIT_AUTH_LIMIT: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     RATE_LIMIT_AUTH_WINDOW_SECONDS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    RATE_LIMIT_LOGIN_ACCOUNT_LIMIT: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    RATE_LIMIT_LOGIN_ACCOUNT_WINDOW_SECONDS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     RATE_LIMIT_API_LIMIT: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     RATE_LIMIT_API_WINDOW_SECONDS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
 }, z.core.$strip>;

package/dist/lib/rateLimit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rateLimit.d.ts","sourceRoot":"","sources":["../../src/lib/rateLimit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;;GAKG;AAEH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;IAC/B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;IAC9B,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAA;CAC9B;AAED,eAAO,MAAM,qBAAqB;;;;;;;iBAOhC,CAAA;AAEF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,GAAG,eAAe,CAelG"}
+{"version":3,"file":"rateLimit.d.ts","sourceRoot":"","sources":["../../src/lib/rateLimit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;;GAKG;AAEH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;IAC/B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAA;IACtC,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAA;CAC9B;AAED,eAAO,MAAM,qBAAqB;;;;;;;;;iBAShC,CAAA;AAEF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,GAAG,eAAe,CAmBlG"}