@knpkv/control-center 0.1.0

package/dist/server/server/http/security/RichDocument.d.ts

@@ -0,0 +1,154 @@
+import { Effect, Schema } from "effect";
+import { ExternalNavigationUrl, MediaRef } from "./UrlPolicy.js";
+/** Public hard limits applied to every canonical rich document. */
+export declare const RICH_DOCUMENT_LIMITS: {
+    maximumDepth: number;
+    maximumNodes: number;
+    maximumTextBytes: number;
+    maximumLinks: number;
+    maximumMedia: number;
+    maximumEncodedBytes: number;
+};
+/** Escaped text leaf with a closed set of presentation-only marks. */
+export interface RichTextNode {
+    readonly _tag: "text";
+    readonly text: string;
+    readonly marks: ReadonlyArray<"bold" | "italic" | "strike" | "code">;
+}
+/** Explicit inline hard break. */
+export interface RichHardBreakNode {
+    readonly _tag: "hard-break";
+}
+/** Safe external link whose children cannot contain another link. */
+export interface RichLinkNode {
+    readonly _tag: "link";
+    readonly href: ExternalNavigationUrl;
+    readonly children: ReadonlyArray<RichTextNode | RichHardBreakNode>;
+}
+/** Opaque person or entity mention. */
+export interface RichMentionNode {
+    readonly _tag: "mention";
+    readonly reference: string;
+    readonly label: string;
+}
+/** Bounded emoji text, rendered without provider HTML. */
+export interface RichEmojiNode {
+    readonly _tag: "emoji";
+    readonly text: string;
+}
+/** Same-origin opaque media reference. */
+export interface RichMediaNode {
+    readonly _tag: "media";
+    readonly mediaRef: MediaRef;
+    readonly alt: string;
+}
+/** Canonical inline rich node. */
+export type RichInlineNode = RichTextNode | RichHardBreakNode | RichLinkNode | RichMentionNode | RichEmojiNode | RichMediaNode;
+interface RichLinkNodeEncoded extends Omit<RichLinkNode, "href"> {
+    readonly href: string;
+}
+interface RichMediaNodeEncoded extends Omit<RichMediaNode, "mediaRef"> {
+    readonly mediaRef: string;
+}
+type RichInlineNodeEncoded = RichTextNode | RichHardBreakNode | RichLinkNodeEncoded | RichMentionNode | RichEmojiNode | RichMediaNodeEncoded;
+export declare const RichTextNode: Schema.Codec<RichTextNode>;
+export declare const RichHardBreakNode: Schema.Codec<RichHardBreakNode>;
+export declare const RichLinkNode: Schema.Codec<RichLinkNode, RichLinkNodeEncoded>;
+export declare const RichMentionNode: Schema.Codec<RichMentionNode>;
+export declare const RichEmojiNode: Schema.Codec<RichEmojiNode>;
+export declare const RichMediaNode: Schema.Codec<RichMediaNode, RichMediaNodeEncoded>;
+export declare const RichInlineNode: Schema.Codec<RichInlineNode, RichInlineNodeEncoded>;
+/** Paragraph block. */
+export interface RichParagraphNode {
+    readonly _tag: "paragraph";
+    readonly children: ReadonlyArray<RichInlineNode>;
+}
+/** Heading block with a semantic level. */
+export interface RichHeadingNode {
+    readonly _tag: "heading";
+    readonly level: number;
+    readonly children: ReadonlyArray<RichInlineNode>;
+}
+/** Plain code block; code is never interpreted as HTML. */
+export interface RichCodeBlockNode {
+    readonly _tag: "code-block";
+    readonly language: string | null;
+    readonly text: string;
+}
+/** Horizontal separator block. */
+export interface RichRuleNode {
+    readonly _tag: "rule";
+}
+/** Block quote containing canonical blocks. */
+export interface RichBlockQuoteNode {
+    readonly _tag: "blockquote";
+    readonly children: ReadonlyArray<RichBlockNode>;
+}
+/** List item containing canonical blocks. */
+export interface RichListItemNode {
+    readonly _tag: "list-item";
+    readonly children: ReadonlyArray<RichBlockNode>;
+}
+/** Bullet list. */
+export interface RichBulletListNode {
+    readonly _tag: "bullet-list";
+    readonly children: ReadonlyArray<RichListItemNode>;
+}
+/** Ordered list with a bounded starting ordinal. */
+export interface RichOrderedListNode {
+    readonly _tag: "ordered-list";
+    readonly start: number;
+    readonly children: ReadonlyArray<RichListItemNode>;
+}
+/** Canonical rich block. */
+export type RichBlockNode = RichParagraphNode | RichHeadingNode | RichCodeBlockNode | RichRuleNode | RichBlockQuoteNode | RichBulletListNode | RichOrderedListNode;
+interface RichParagraphNodeEncoded extends Omit<RichParagraphNode, "children"> {
+    readonly children: ReadonlyArray<RichInlineNodeEncoded>;
+}
+interface RichHeadingNodeEncoded extends Omit<RichHeadingNode, "children"> {
+    readonly children: ReadonlyArray<RichInlineNodeEncoded>;
+}
+interface RichBlockQuoteNodeEncoded extends Omit<RichBlockQuoteNode, "children"> {
+    readonly children: ReadonlyArray<RichBlockNodeEncoded>;
+}
+interface RichListItemNodeEncoded extends Omit<RichListItemNode, "children"> {
+    readonly children: ReadonlyArray<RichBlockNodeEncoded>;
+}
+interface RichBulletListNodeEncoded extends Omit<RichBulletListNode, "children"> {
+    readonly children: ReadonlyArray<RichListItemNodeEncoded>;
+}
+interface RichOrderedListNodeEncoded extends Omit<RichOrderedListNode, "children"> {
+    readonly children: ReadonlyArray<RichListItemNodeEncoded>;
+}
+type RichBlockNodeEncoded = RichParagraphNodeEncoded | RichHeadingNodeEncoded | RichCodeBlockNode | RichRuleNode | RichBlockQuoteNodeEncoded | RichBulletListNodeEncoded | RichOrderedListNodeEncoded;
+export declare const RichParagraphNode: Schema.Codec<RichParagraphNode, RichParagraphNodeEncoded>;
+export declare const RichHeadingNode: Schema.Codec<RichHeadingNode, RichHeadingNodeEncoded>;
+export declare const RichCodeBlockNode: Schema.Codec<RichCodeBlockNode>;
+export declare const RichRuleNode: Schema.Codec<RichRuleNode>;
+export declare const RichListItemNode: Schema.Codec<RichListItemNode, RichListItemNodeEncoded>;
+export declare const RichBlockQuoteNode: Schema.Codec<RichBlockQuoteNode, RichBlockQuoteNodeEncoded>;
+export declare const RichBulletListNode: Schema.Codec<RichBulletListNode, RichBulletListNodeEncoded>;
+export declare const RichOrderedListNode: Schema.Codec<RichOrderedListNode, RichOrderedListNodeEncoded>;
+export declare const RichBlockNode: Schema.Codec<RichBlockNode, RichBlockNodeEncoded>;
+/** Versioned canonical rich document without any raw HTML escape hatch. */
+export interface RichDocumentV1 {
+    readonly _tag: "rich-document";
+    readonly version: 1;
+    readonly children: ReadonlyArray<RichBlockNode>;
+}
+interface RichDocumentV1Encoded extends Omit<RichDocumentV1, "children"> {
+    readonly children: ReadonlyArray<RichBlockNodeEncoded>;
+}
+export declare const RichDocumentV1: Schema.Codec<RichDocumentV1, RichDocumentV1Encoded>;
+declare const RichDocumentError_base: Schema.Class<RichDocumentError, Schema.TaggedStruct<"RichDocumentError", {
+    readonly reason: Schema.Literals<readonly ["invalid-document", "bounds-exceeded", "encoded-size-exceeded"]>;
+}>, import("effect/Cause").YieldableError>;
+/** Canonical rich content failed schema or resource-limit validation. */
+export declare class RichDocumentError extends RichDocumentError_base {
+}
+/** Validate a canonical document and all structural, text, link, media, and encoded-size bounds. */
+export declare const validateRichDocumentV1: (input: unknown) => Effect.Effect<RichDocumentV1, RichDocumentError, never>;
+/** Drop unsupported/provider-active nodes and return a validated canonical document. */
+export declare const sanitizeRichDocumentV1: (input: unknown) => Effect.Effect<RichDocumentV1, RichDocumentError, never>;
+export {};
+//# sourceMappingURL=RichDocument.d.ts.map

package/dist/server/server/http/security/RichDocument.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RichDocument.d.ts","sourceRoot":"","sources":["../../../../../src/server/http/security/RichDocument.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAqB,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE1D,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAShE,mEAAmE;AACnE,eAAO,MAAM,oBAAoB;;;;;;;CAOhC,CAAA;AAgBD,sEAAsE;AACtE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC,CAAA;CACrE;AAED,kCAAkC;AAClC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAC5B;AAED,qEAAqE;AACrE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAA;IACpC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,YAAY,GAAG,iBAAiB,CAAC,CAAA;CACnE;AAED,uCAAuC;AACvC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,0DAA0D;AAC1D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,0CAA0C;AAC1C,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED,kCAAkC;AAClC,MAAM,MAAM,cAAc,GACtB,YAAY,GACZ,iBAAiB,GACjB,YAAY,GACZ,eAAe,GACf,aAAa,GACb,aAAa,CAAA;AAEjB,UAAU,mBAAoB,SAAQ,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,UAAU,oBAAqB,SAAQ,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC;IACpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,KAAK,qBAAqB,GACtB,YAAY,GACZ,iBAAiB,GACjB,mBAAmB,GACnB,eAAe,GACf,aAAa,GACb,oBAAoB,CAAA;AAExB,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAIlD,CAAA;AAEF,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAE5D,CAAA;AAEF,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,mBAAmB,CAIvE,CAAA;AAEF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,eAAe,CAIxD,CAAA;AAEF,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAGpD,CAAA;AAEF,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,oBAAoB,CAI1E,CAAA;AAEF,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,qBAAqB,CAO7E,CAAA;AAEF,uBAAuB;AACvB,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,cAAc,CAAC,CAAA;CACjD;AAED,2CAA2C;AAC3C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,cAAc,CAAC,CAAA;CACjD;AAED,2DAA2D;AAC3D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,kCAAkC;AAClC,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,aAAa,CAAC,CAAA;CAChD;AAED,6CAA6C;AAC7C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,aAAa,CAAC,CAAA;CAChD;AAED,mBAAmB;AACnB,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAA;CACnD;AAED,oDAAoD;AACpD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAA;CACnD;AAED,4BAA4B;AAC5B,MAAM,MAAM,aAAa,GACrB,iBAAiB,GACjB,eAAe,GACf,iBAAiB,GACjB,YAAY,GACZ,kBAAkB,GAClB,kBAAkB,GAClB,mBAAmB,CAAA;AAEvB,UAAU,wBAAyB,SAAQ,IAAI,CAAC,iBAAiB,EAAE,UAAU,CAAC;IAC5E,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAA;CACxD;AAED,UAAU,sBAAuB,SAAQ,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC;IACxE,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAA;CACxD;AAED,UAAU,yBAA0B,SAAQ,IAAI,CAAC,kBAAkB,EAAE,UAAU,CAAC;IAC9E,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAA;CACvD;AAED,UAAU,uBAAwB,SAAQ,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAC;IAC1E,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAA;CACvD;AAED,UAAU,yBAA0B,SAAQ,IAAI,CAAC,kBAAkB,EAAE,UAAU,CAAC;IAC9E,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,uBAAuB,CAAC,CAAA;CAC1D;AAED,UAAU,0BAA2B,SAAQ,IAAI,CAAC,mBAAmB,EAAE,UAAU,CAAC;IAChF,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,uBAAuB,CAAC,CAAA;CAC1D;AAED,KAAK,oBAAoB,GACrB,wBAAwB,GACxB,sBAAsB,GACtB,iBAAiB,GACjB,YAAY,GACZ,yBAAyB,GACzB,yBAAyB,GACzB,0BAA0B,CAAA;AAE9B,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,wBAAwB,CAGtF,CAAA;AAEF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,sBAAsB,CAIhF,CAAA;AAEF,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAI5D,CAAA;AAEF,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAmD,CAAA;AAEvG,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,uBAAuB,CAKnF,CAAA;AAEF,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,yBAAyB,CAKzF,CAAA;AAEF,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,yBAAyB,CAGzF,CAAA;AAEF,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE,0BAA0B,CAI5F,CAAA;AAEF,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,oBAAoB,CAQ1E,CAAA;AAEF,2EAA2E;AAC3E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;IAC9B,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;IACnB,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,aAAa,CAAC,CAAA;CAChD;AAED,UAAU,qBAAsB,SAAQ,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC;IACtE,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAA;CACvD;AAED,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,qBAAqB,CAI7E,CAAA;;;;AAIF,yEAAyE;AACzE,qBAAa,iBAAkB,SAAQ,sBAErC;CAAG;AAkCL,oGAAoG;AACpG,eAAO,MAAM,sBAAsB,6EAejC,CAAA;AA4JF,wFAAwF;AACxF,eAAO,MAAM,sBAAsB,6EAWjC,CAAA"}

package/dist/server/server/http/security/SecurityHeaders.d.ts

@@ -0,0 +1,7 @@
+/** Transport facts that affect browser security headers. */
+export interface SecurityHeaderPolicy {
+    readonly isSecureTransport: boolean;
+}
+/** Build the outer response headers applied to documents, APIs, errors, and static misses. */
+export declare const securityHeaders: (policy: SecurityHeaderPolicy) => Readonly<Record<string, string>>;
+//# sourceMappingURL=SecurityHeaders.d.ts.map

package/dist/server/server/http/security/SecurityHeaders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityHeaders.d.ts","sourceRoot":"","sources":["../../../../../src/server/http/security/SecurityHeaders.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAA;CACpC;AAoBD,8FAA8F;AAC9F,eAAO,MAAM,eAAe,GAAI,QAAQ,oBAAoB,KAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA0B7F,CAAA"}

package/dist/server/server/http/security/StaticAssetStore.d.ts

@@ -0,0 +1,43 @@
+import { Context, Effect, FileSystem, Layer, Option, Path, Schema } from "effect";
+/** MIME types that the static server is allowed to emit. */
+export declare const StaticAssetMimeType: Schema.Literals<readonly ["text/html; charset=utf-8", "text/css; charset=utf-8", "text/javascript; charset=utf-8", "image/png", "image/jpeg", "image/webp", "image/avif", "image/svg+xml", "image/x-icon", "font/woff", "font/woff2", "font/ttf", "font/otf", "application/wasm", "application/manifest+json"]>;
+/** Decoded closed static MIME type. */
+export type StaticAssetMimeType = typeof StaticAssetMimeType.Type;
+declare const StaticAssetStoreError_base: Schema.Class<StaticAssetStoreError, Schema.TaggedStruct<"StaticAssetStoreError", {
+    readonly reason: Schema.Literals<readonly ["invalid-options", "manifest-invalid", "path-rejected", "containment-rejected", "file-rejected", "mime-rejected", "asset-too-large", "asset-total-too-large", "io-failure"]>;
+    readonly assetPath: Schema.NullOr<Schema.String>;
+}>, import("effect/Cause").YieldableError>;
+/** Static asset initialization failed closed. */
+export declare class StaticAssetStoreError extends StaticAssetStoreError_base {
+}
+/** Construction options for the immutable startup-loaded asset map. */
+export interface StaticAssetStoreOptions {
+    readonly root: string;
+    readonly publicAssets?: ReadonlyArray<string> | undefined;
+    readonly maximumIndexBytes?: number | undefined;
+    readonly maximumAssetBytes?: number | undefined;
+    readonly maximumTotalBytes?: number | undefined;
+}
+/** One immutable static response selected without request-time filesystem access. */
+export interface StaticAssetResolution {
+    readonly path: string;
+    readonly bytes: Uint8Array;
+    readonly mimeType: StaticAssetMimeType;
+    readonly cacheControl: "no-store" | "public, max-age=31536000, immutable";
+    readonly kind: "asset" | "spa";
+}
+/** Service resolving only assets captured from the validated startup manifest. */
+export interface StaticAssetStoreService {
+    readonly resolve: (requestPath: string, accept: string | null) => Option.Option<StaticAssetResolution>;
+    readonly assetCount: number;
+    readonly totalBytes: number;
+}
+/** Construct an immutable asset store from a canonicalized Vite build root. */
+export declare const makeStaticAssetStore: (options: StaticAssetStoreOptions) => Effect.Effect<StaticAssetStoreService, StaticAssetStoreError, FileSystem.FileSystem | Path.Path>;
+declare const StaticAssetStore_base: Context.ServiceClass<StaticAssetStore, "@knpkv/control-center/server/http/security/StaticAssetStore", StaticAssetStoreService>;
+/** Immutable startup static asset store. */
+export declare class StaticAssetStore extends StaticAssetStore_base {
+    static readonly layer: (options: StaticAssetStoreOptions) => Layer.Layer<StaticAssetStore, StaticAssetStoreError, FileSystem.FileSystem | Path.Path>;
+}
+export {};
+//# sourceMappingURL=StaticAssetStore.d.ts.map

package/dist/server/server/http/security/StaticAssetStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"StaticAssetStore.d.ts","sourceRoot":"","sources":["../../../../../src/server/http/security/StaticAssetStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAU,MAAM,EAAE,MAAM,QAAQ,CAAA;AA8BzF,4DAA4D;AAC5D,eAAO,MAAM,mBAAmB,iTAgB9B,CAAA;AAEF,uCAAuC;AACvC,MAAM,MAAM,mBAAmB,GAAG,OAAO,mBAAmB,CAAC,IAAI,CAAA;;;;;AAsBjE,iDAAiD;AACjD,qBAAa,qBAAsB,SAAQ,0BAgB1C;CAAG;AAEJ,uEAAuE;AACvE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IACzD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC/C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC/C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAChD;AAED,qFAAqF;AACrF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAA;IACtC,QAAQ,CAAC,YAAY,EAAE,UAAU,GAAG,qCAAqC,CAAA;IACzE,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,KAAK,CAAA;CAC/B;AASD,kFAAkF;AAClF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAA;IACtG,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAoCD,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,wIAkH/B,CAAA;;AAEF,4CAA4C;AAC5C,qBAAa,gBAAiB,SAAQ,qBAErC;IACC,MAAM,CAAC,QAAQ,CAAC,KAAK,GACnB,SAAS,uBAAuB,KAC/B,KAAK,CAAC,KAAK,CAAC,gBAAgB,EAAE,qBAAqB,EAAE,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAC3B;CAChE"}

package/dist/server/server/http/security/UrlPolicy.d.ts

@@ -0,0 +1,30 @@
+import { Schema } from "effect";
+/** HTTPS-only URL that may be placed in a browser navigation element. */
+export declare const ExternalNavigationUrl: Schema.decodeTo<Schema.URL, Schema.String, never, never>;
+/** Decoded safe external navigation URL. */
+export type ExternalNavigationUrl = typeof ExternalNavigationUrl.Type;
+/** HTTPS-only, credential-free URL eligible for explicit egress validation. */
+export declare const EgressUrl: Schema.decodeTo<Schema.URL, Schema.String, never, never>;
+/** Decoded egress URL; this is still not authority to open a socket. */
+export type EgressUrl = typeof EgressUrl.Type;
+/** Opaque same-origin reference used by media routes instead of accepting a URL. */
+export declare const MediaRef: Schema.brand<Schema.String, "MediaRef">;
+/** Decoded opaque media reference. */
+export type MediaRef = typeof MediaRef.Type;
+/** Return whether a canonical DNS address is globally routable under the egress policy. */
+export declare const isPublicIpAddress: (address: string) => boolean;
+/** Canonical public IPv4 or IPv6 address accepted after DNS resolution. */
+export declare const PublicIpAddress: Schema.brand<Schema.String, "PublicIpAddress">;
+/** Decoded globally routable IP address. */
+export type PublicIpAddress = typeof PublicIpAddress.Type;
+/** Socket target created only after URL, allowlist, and DNS validation. */
+export declare const ResolvedTarget: Schema.Struct<{
+    readonly url: Schema.decodeTo<Schema.URL, Schema.String, never, never>;
+    readonly hostname: Schema.String;
+    readonly port: Schema.Literal<443>;
+    readonly address: Schema.brand<Schema.String, "PublicIpAddress">;
+    readonly family: Schema.Literals<readonly [4, 6]>;
+}>;
+/** Decoded DNS-pinned egress target. */
+export type ResolvedTarget = typeof ResolvedTarget.Type;
+//# sourceMappingURL=UrlPolicy.d.ts.map

package/dist/server/server/http/security/UrlPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UrlPolicy.d.ts","sourceRoot":"","sources":["../../../../../src/server/http/security/UrlPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAwB,MAAM,QAAQ,CAAA;AAqBrD,yEAAyE;AACzE,eAAO,MAAM,qBAAqB,0DASjC,CAAA;AAED,4CAA4C;AAC5C,MAAM,MAAM,qBAAqB,GAAG,OAAO,qBAAqB,CAAC,IAAI,CAAA;AAErE,+EAA+E;AAC/E,eAAO,MAAM,SAAS,0DAmBrB,CAAA;AAED,wEAAwE;AACxE,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC,IAAI,CAAA;AAE7C,oFAAoF;AACpF,eAAO,MAAM,QAAQ,yCAEW,CAAA;AAEhC,sCAAsC;AACtC,MAAM,MAAM,QAAQ,GAAG,OAAO,QAAQ,CAAC,IAAI,CAAA;AAmE3C,2FAA2F;AAC3F,eAAO,MAAM,iBAAiB,GAAI,SAAS,MAAM,KAAG,OAKnD,CAAA;AAED,2EAA2E;AAC3E,eAAO,MAAM,eAAe,gDAKW,CAAA;AAEvC,4CAA4C;AAC5C,MAAM,MAAM,eAAe,GAAG,OAAO,eAAe,CAAC,IAAI,CAAA;AAWzD,2EAA2E;AAC3E,eAAO,MAAM,cAAc;;;;;;EAa1B,CAAA;AAED,wCAAwC;AACxC,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,IAAI,CAAA"}

package/dist/server/server/http/security/index.d.ts

@@ -0,0 +1,8 @@
+/** Hardened HTTP policies independent of the eventual server route composition. */
+export * from "./HttpLimits.js";
+export * from "./RequestPolicy.js";
+export * from "./RichDocument.js";
+export * from "./SecurityHeaders.js";
+export * from "./StaticAssetStore.js";
+export * from "./UrlPolicy.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/server/server/http/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/server/http/security/index.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,mBAAmB,CAAA;AACjC,cAAc,sBAAsB,CAAA;AACpC,cAAc,uBAAuB,CAAA;AACrC,cAAc,gBAAgB,CAAA"}

package/dist/server/server/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Server-only Control Center composition.
+ *
+ * Importing this entry from browser or API code is forbidden mechanically.
+ *
+ * @packageDocumentation
+ */
+export * from "./agent/index.js";
+export * from "./api/index.js";
+export * from "./application/index.js";
+export * from "./auth/index.js";
+export * from "./http/index.js";
+export * from "./persistence/index.js";
+export * from "./plugins/index.js";
+export * from "./runtime/index.js";
+export * from "./secrets/index.js";
+export * from "./security/index.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/server/server/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,cAAc,kBAAkB,CAAA;AAChC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,wBAAwB,CAAA;AACtC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,wBAAwB,CAAA;AACtC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA"}