@lunora/studio 1.0.0-alpha.55 → 1.0.0-alpha.57

package/dist/standalone/{chunk-JGCRBFFO.js → chunk-RIZDNIW7.js}

@@ -1 +1 @@
-import{b as f}from"./chunk-HNIDN3RX.js";import"./chunk-D73WYMRU.js";import"./chunk-XNJNSCLM.js";import{b as p}from"./chunk-4F72YCTU.js";import"./chunk-GTM65MVX.js";import"./chunk-Y572GMZE.js";import{a as R}from"./chunk-EBTLTGG3.js";import"./chunk-S2G7OH5T.js";import"./chunk-ZHVTQ37P.js";import"./chunk-3OA7PECS.js";import{d as h}from"./chunk-5XO36X4C.js";import"./chunk-ZXLEXF4X.js";import{a as i,e as m,g as S,h as A}from"./chunk-RRCPZMC2.js";var g=m(S(),1);var k=m(A(),1);var _=i((e,s)=>({"admin-token-weak":e("Weak admin token"),"auth-secret-weak":e("Weak auth secret"),"cookies-insecure":e("Session cookies are not Secure"),"cors-wildcard-credentials":e("Wildcard CORS with credentials"),"csrf-disabled":e("CSRF/origin guard is off"),"dev-args-unredacted":e("Request log keeps un-redacted args"),"security-headers-disabled":e("Security headers are off"),"ws-gate-open":e("Live admin subscriptions are ungated")})[s.kind],"findingTitle"),E=i(e=>Array.isArray(e.findings)?e.findings:[],"toFindings"),w=i(e=>({"admin-token-weak":"LUNORA_ADMIN_TOKEN","auth-secret-weak":"AUTH_SECRET","cookies-insecure":"BETTER_AUTH_URL","cors-wildcard-credentials":"LUNORA_ALLOWED_ORIGINS","csrf-disabled":"LUNORA_SECURITY_CSRF","dev-args-unredacted":"request log","security-headers-disabled":"LUNORA_SECURITY_HEADERS","ws-gate-open":"LUNORA_WS_BEARER"})[e.kind],"findingEntity"),T=i((e,s)=>({"admin-token-weak":e("Your admin token is {length} characters \u2014 use at least {min} for a brute-force-resistant secret.",{length:s.detail?.length,min:s.detail?.min}),"auth-secret-weak":e("Your auth secret is {length} characters \u2014 use at least {min} (e.g. `openssl rand -hex 32`) to sign sessions safely.",{length:s.detail?.length,min:s.detail?.min}),"cookies-insecure":e("BETTER_AUTH_URL is a plaintext http:// origin, so session cookies cannot be Secure and ride in cleartext. Serve auth over https:// in production."),"cors-wildcard-credentials":e("LUNORA_ALLOWED_ORIGINS includes a wildcard while credentials are allowed \u2014 browsers reject this and it defeats the allowlist. Name explicit origins instead of *."),"csrf-disabled":e("LUNORA_SECURITY_CSRF is off, so cross-origin state-changing cookie requests are not blocked. Re-enable it in production to keep mutations un-forgeable."),"dev-args-unredacted":e("This worker reports a development environment, so the request log stores raw args and identity. Confirm it isn't a mislabeled production deploy."),"security-headers-disabled":e("LUNORA_SECURITY_HEADERS is off, so HSTS, CSP, nosniff, and frame-options are not applied. Re-enable the baseline headers in production."),"ws-gate-open":e("LUNORA_WS_BEARER is unset, so the WebSocket upgrade gate is open: live admin subscriptions need no credential. Set it to gate them like the HTTP admin RPCs.")})[s.kind],"findingDetail"),v=i(()=>{let e=(0,g.c)(8),s=h(),r;e[0]===Symbol.for("react.memo_cache_sentinel")?(r={},e[0]=r):r=e[0];let{data:a,error:d,errorSource:c}=p(R.getSecurityAudit,r),o;if(e[1]!==a||e[2]!==s){let u=a===void 0?null:E(a);o=u===null?null:u.map(t=>({description:T(s,t),entity:w(t),issueType:_(s,t),key:t.kind,level:t.level})),e[1]=a,e[2]=s,e[3]=o}else o=e[3];let l=o,n;return e[4]!==d||e[5]!==c||e[6]!==l?(n=(0,k.jsxDEV)(f,{error:d,errorSource:c,rows:l,testId:"lunora-security-advisor"},void 0,!1),e[4]=d,e[5]=c,e[6]=l,e[7]=n):n=e[7],n},"SecurityAdvisorPanel");export{v as default};
+import{b as f}from"./chunk-HQ2CPGA4.js";import"./chunk-2ICZ6HXQ.js";import"./chunk-XNJNSCLM.js";import{b as p}from"./chunk-2YUYNNHQ.js";import"./chunk-GTM65MVX.js";import"./chunk-Y572GMZE.js";import{a as R}from"./chunk-MHGJUKCZ.js";import"./chunk-C7UZEQZ7.js";import"./chunk-ZHVTQ37P.js";import"./chunk-3OA7PECS.js";import{d as h}from"./chunk-HBGS4SEX.js";import"./chunk-ZXLEXF4X.js";import{a as i,e as m,g as S,h as A}from"./chunk-RRCPZMC2.js";var g=m(S(),1);var k=m(A(),1);var _=i((e,s)=>({"admin-token-weak":e("Weak admin token"),"auth-secret-weak":e("Weak auth secret"),"cookies-insecure":e("Session cookies are not Secure"),"cors-wildcard-credentials":e("Wildcard CORS with credentials"),"csrf-disabled":e("CSRF/origin guard is off"),"dev-args-unredacted":e("Request log keeps un-redacted args"),"security-headers-disabled":e("Security headers are off"),"ws-gate-open":e("Live admin subscriptions are ungated")})[s.kind],"findingTitle"),E=i(e=>Array.isArray(e.findings)?e.findings:[],"toFindings"),w=i(e=>({"admin-token-weak":"LUNORA_ADMIN_TOKEN","auth-secret-weak":"AUTH_SECRET","cookies-insecure":"BETTER_AUTH_URL","cors-wildcard-credentials":"LUNORA_ALLOWED_ORIGINS","csrf-disabled":"LUNORA_SECURITY_CSRF","dev-args-unredacted":"request log","security-headers-disabled":"LUNORA_SECURITY_HEADERS","ws-gate-open":"LUNORA_WS_BEARER"})[e.kind],"findingEntity"),T=i((e,s)=>({"admin-token-weak":e("Your admin token is {length} characters \u2014 use at least {min} for a brute-force-resistant secret.",{length:s.detail?.length,min:s.detail?.min}),"auth-secret-weak":e("Your auth secret is {length} characters \u2014 use at least {min} (e.g. `openssl rand -hex 32`) to sign sessions safely.",{length:s.detail?.length,min:s.detail?.min}),"cookies-insecure":e("BETTER_AUTH_URL is a plaintext http:// origin, so session cookies cannot be Secure and ride in cleartext. Serve auth over https:// in production."),"cors-wildcard-credentials":e("LUNORA_ALLOWED_ORIGINS includes a wildcard while credentials are allowed \u2014 browsers reject this and it defeats the allowlist. Name explicit origins instead of *."),"csrf-disabled":e("LUNORA_SECURITY_CSRF is off, so cross-origin state-changing cookie requests are not blocked. Re-enable it in production to keep mutations un-forgeable."),"dev-args-unredacted":e("This worker reports a development environment, so the request log stores raw args and identity. Confirm it isn't a mislabeled production deploy."),"security-headers-disabled":e("LUNORA_SECURITY_HEADERS is off, so HSTS, CSP, nosniff, and frame-options are not applied. Re-enable the baseline headers in production."),"ws-gate-open":e("LUNORA_WS_BEARER is unset, so the WebSocket upgrade gate is open: live admin subscriptions need no credential. Set it to gate them like the HTTP admin RPCs.")})[s.kind],"findingDetail"),v=i(()=>{let e=(0,g.c)(8),s=h(),r;e[0]===Symbol.for("react.memo_cache_sentinel")?(r={},e[0]=r):r=e[0];let{data:a,error:d,errorSource:c}=p(R.getSecurityAudit,r),o;if(e[1]!==a||e[2]!==s){let u=a===void 0?null:E(a);o=u===null?null:u.map(t=>({description:T(s,t),entity:w(t),issueType:_(s,t),key:t.kind,level:t.level})),e[1]=a,e[2]=s,e[3]=o}else o=e[3];let l=o,n;return e[4]!==d||e[5]!==c||e[6]!==l?(n=(0,k.jsxDEV)(f,{error:d,errorSource:c,rows:l,testId:"lunora-security-advisor"},void 0,!1),e[4]=d,e[5]=c,e[6]=l,e[7]=n):n=e[7],n},"SecurityAdvisorPanel");export{v as default};