@maudecode/talaria-web 0.0.0

package/dist/http/csp.js

@@ -0,0 +1,51 @@
+export const CSP_CONNECT_BASE = "'self' http://127.0.0.1:* http://localhost:* http://ipc.localhost https://127.0.0.1:* https://localhost:* ws://127.0.0.1:* ws://localhost:*";
+const CSP_FRAME_BASE = "'self'";
+const EXTRA_CONNECT_RE = /^(?:https?|wss?):\/\/(?:\*\.)?[A-Za-z0-9._~-]+(?::(\d{1,5}|\*))?$/;
+const EXTRA_FRAME_RE = /^https?:\/\/(?:\*\.)?[A-Za-z0-9._~-]+(?::(\d{1,5}|\*))?$/;
+export const CSP_REPORT_TO = '{"group":"csp-endpoint","max_age":10886400,"endpoints":[{"url":"/api/csp-report"}]}';
+function validSource(re, source) {
+    const m = re.exec(source);
+    if (!m)
+        return false;
+    const port = m[1];
+    if (!port || port === '*')
+        return true;
+    const n = Number(port);
+    return n >= 1 && n <= 65535;
+}
+function extraSources(raw, re, warn) {
+    const value = (raw ?? '').trim();
+    if (!value)
+        return '';
+    const sources = value.split(/\s+/);
+    if (!sources.length || sources.some((s) => !validSource(re, s))) {
+        warn();
+        return '';
+    }
+    return ' ' + sources.join(' ');
+}
+export function cspExtras(env, warn = () => undefined) {
+    return {
+        connect: extraSources(env.HERMES_WEBUI_CSP_CONNECT_EXTRA, EXTRA_CONNECT_RE, () => { warn('Ignoring invalid HERMES_WEBUI_CSP_CONNECT_EXTRA value'); }),
+        frame: extraSources(env.HERMES_WEBUI_CSP_FRAME_EXTRA, EXTRA_FRAME_RE, () => { warn('Ignoring invalid HERMES_WEBUI_CSP_FRAME_EXTRA value'); }),
+    };
+}
+export function buildCspEnforcedPolicy(extras) {
+    return ("default-src 'self' https://*.cloudflareaccess.com; " +
+        "object-src 'none'; " +
+        "frame-ancestors 'none'; " +
+        "script-src 'self' https://static.cloudflareinsights.com; " +
+        "worker-src 'self' blob:; " +
+        "style-src 'self' 'unsafe-inline'; " +
+        "img-src 'self' data: https: blob:; " +
+        "font-src 'self' data:; " +
+        "media-src 'self' data: blob:; " +
+        `connect-src ${CSP_CONNECT_BASE}${extras.connect}; ` +
+        `frame-src ${CSP_FRAME_BASE}${extras.frame}; ` +
+        "manifest-src 'self' https://*.cloudflareaccess.com; " +
+        "base-uri 'self'; form-action 'self'");
+}
+export function buildCspReportOnlyPolicy(extras) {
+    return buildCspEnforcedPolicy(extras) + '; report-uri /api/csp-report; report-to csp-endpoint';
+}
+//# sourceMappingURL=csp.js.map

package/dist/http/csp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csp.js","sourceRoot":"","sources":["../../src/http/csp.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,MAAM,gBAAgB,GAC3B,6IAA6I,CAAA;AAC/I,MAAM,cAAc,GAAG,QAAQ,CAAA;AAC/B,MAAM,gBAAgB,GAAG,mEAAmE,CAAA;AAC5F,MAAM,cAAc,GAAG,0DAA0D,CAAA;AACjF,MAAM,CAAC,MAAM,aAAa,GAAG,qFAAqF,CAAA;AAElH,SAAS,WAAW,CAAC,EAAU,EAAE,MAAc;IAC7C,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACzB,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IACpB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IACjB,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IACtC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;IACtB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAA;AAC7B,CAAC;AAED,SAAS,YAAY,CAAC,GAAuB,EAAE,EAAU,EAAE,IAAgB;IACzE,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAChC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAA;IACrB,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAClC,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,IAAI,EAAE,CAAA;QACN,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAChC,CAAC;AAID,MAAM,UAAU,SAAS,CAAC,GAAQ,EAAE,OAA+B,GAAG,EAAE,CAAC,SAAS;IAChF,OAAO;QACL,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,8BAA8B,EAAE,gBAAgB,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,uDAAuD,CAAC,CAAA,CAAC,CAAC,CAAC;QACpJ,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,4BAA4B,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,qDAAqD,CAAC,CAAA,CAAC,CAAC,CAAC;KAC7I,CAAA;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAiB;IACtD,OAAO,CACL,qDAAqD;QACrD,qBAAqB;QACrB,0BAA0B;QAC1B,2DAA2D;QAC3D,2BAA2B;QAC3B,oCAAoC;QACpC,qCAAqC;QACrC,yBAAyB;QACzB,gCAAgC;QAChC,eAAe,gBAAgB,GAAG,MAAM,CAAC,OAAO,IAAI;QACpD,aAAa,cAAc,GAAG,MAAM,CAAC,KAAK,IAAI;QAC9C,sDAAsD;QACtD,qCAAqC,CACtC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAiB;IACxD,OAAO,sBAAsB,CAAC,MAAM,CAAC,GAAG,sDAAsD,CAAA;AAChG,CAAC"}

package/dist/http/origin.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Same-origin / CSRF provenance checks, allowlisted public origins, trusted
+ * proxy networks, and forwarded client IP resolution (Python `api/routes.py`).
+ */
+import { BlockList } from 'node:net';
+import type { Env } from '../config.js';
+export declare function normalizeHostPort(value: string): [string, string | null];
+export declare function portsMatch(originScheme: string, originPort: string | null, allowedPort: string | null): boolean;
+export declare function allowedPublicOrigins(env: Env, warn?: (line: string) => void): Set<string>;
+export type CsrfFailure = 'origin_mismatch' | 'token_mismatch' | null;
+export interface ProvenanceHeaders {
+    origin?: string | undefined;
+    referer?: string | undefined;
+    host?: string | undefined;
+    secFetchSite?: string | undefined;
+    forwardedHost?: string | undefined;
+    realHost?: string | undefined;
+}
+/**
+ * Returns null when the browser request is same-origin or allowlisted; else
+ * the failure reason. Non-browser clients (no provenance headers) pass unless
+ * `requireProvenance` is set.
+ */
+export declare function checkSameOriginBrowserRequest(h: ProvenanceHeaders, env: Env, opts?: {
+    requireProvenance?: boolean;
+}): CsrfFailure;
+export declare function isBrowserUnsafeRequest(h: ProvenanceHeaders): boolean;
+export declare function csrfRejectionError(reason: CsrfFailure): string;
+/** Strip the IPv4-mapped IPv6 prefix so `::ffff:10.0.0.1` also matches IPv4 networks. */
+export declare function ipv4Mapped(addr: string): string | null;
+export declare function trustedProxyNetworks(env: Env): BlockList;
+export declare function ipInNetworks(addr: string, networks: BlockList): boolean;
+export declare function isLoopback(addr: string): boolean;
+export declare function rawPeerIsTrustedProxy(peer: string, env: Env): boolean;
+/**
+ * Real client IP behind a trusted proxy: walk X-Forwarded-For right to left
+ * skipping trusted hops; fail closed (null) on malformed chains.
+ */
+export declare function forwardedClientIp(xff: string[], realIp: string | undefined, peer: string, env: Env): string | null;

package/dist/http/origin.js

@@ -0,0 +1,183 @@
+/**
+ * Same-origin / CSRF provenance checks, allowlisted public origins, trusted
+ * proxy networks, and forwarded client IP resolution (Python `api/routes.py`).
+ */
+import { BlockList, isIP } from 'node:net';
+export function normalizeHostPort(value) {
+    const v = value.trim().toLowerCase();
+    if (!v)
+        return ['', null];
+    if (v.startsWith('[')) {
+        const end = v.indexOf(']');
+        if (end !== -1) {
+            const host = v.slice(1, end);
+            const rest = v.slice(end + 1);
+            if (rest.startsWith(':') && /^\d+$/.test(rest.slice(1)))
+                return [host, rest.slice(1)];
+            return [host, null];
+        }
+    }
+    if (v.split(':').length === 2) {
+        const at = v.lastIndexOf(':');
+        const host = v.slice(0, at);
+        const port = v.slice(at + 1);
+        if (/^\d+$/.test(port))
+            return [host, port];
+    }
+    return [v, null];
+}
+export function portsMatch(originScheme, originPort, allowedPort) {
+    if (originPort === allowedPort)
+        return true;
+    const def = originScheme === 'https' ? '443' : '80';
+    if (!originPort && allowedPort === def)
+        return true;
+    if (!allowedPort && originPort === def)
+        return true;
+    return false;
+}
+export function allowedPublicOrigins(env, warn = () => undefined) {
+    const out = new Set();
+    for (const raw of (env.HERMES_WEBUI_ALLOWED_ORIGINS ?? '').split(',')) {
+        const value = raw.trim().replace(/\/+$/, '').toLowerCase();
+        if (!value)
+            continue;
+        if (!value.startsWith('http://') && !value.startsWith('https://')) {
+            warn(`HERMES_WEBUI_ALLOWED_ORIGINS entry ${JSON.stringify(value)} is missing the scheme (expected https://hostname or http://hostname). Entry ignored.`);
+            continue;
+        }
+        out.add(value);
+    }
+    return out;
+}
+/**
+ * Returns null when the browser request is same-origin or allowlisted; else
+ * the failure reason. Non-browser clients (no provenance headers) pass unless
+ * `requireProvenance` is set.
+ */
+export function checkSameOriginBrowserRequest(h, env, opts = {}) {
+    const origin = h.origin ?? '';
+    const referer = h.referer ?? '';
+    const host = h.host ?? '';
+    const secFetchSite = (h.secFetchSite ?? '').trim().toLowerCase();
+    if (!(origin || referer || secFetchSite))
+        return opts.requireProvenance ? 'origin_mismatch' : null;
+    if (secFetchSite === 'cross-site')
+        return 'origin_mismatch';
+    const target = origin || referer;
+    if (!target) {
+        if (secFetchSite === 'none')
+            return null;
+        if (secFetchSite === 'same-origin')
+            return opts.requireProvenance ? 'origin_mismatch' : null;
+        return 'origin_mismatch';
+    }
+    const m = /^https?:\/\/([^/]+)/.exec(target);
+    if (!m)
+        return 'origin_mismatch';
+    const originScheme = m[0].split('://')[0]?.toLowerCase() ?? '';
+    const [originName, originPort] = normalizeHostPort(m[1] ?? '');
+    const originValue = m[0].replace(/\/+$/, '').toLowerCase();
+    if (allowedPublicOrigins(env).has(originValue))
+        return null;
+    const allowedHosts = [host].map((s) => s.trim()).filter(Boolean);
+    if (['1', 'true', 'yes', 'on'].includes((env.HERMES_WEBUI_TRUST_FORWARDED_HOST ?? '').trim().toLowerCase())) {
+        for (const value of [h.forwardedHost ?? '', h.realHost ?? ''])
+            if (value.trim())
+                allowedHosts.push(value.trim());
+    }
+    for (const allowed of allowedHosts) {
+        const [allowedName, allowedPort] = normalizeHostPort(allowed);
+        if (originName === allowedName && portsMatch(originScheme, originPort, allowedPort))
+            return null;
+    }
+    return 'origin_mismatch';
+}
+export function isBrowserUnsafeRequest(h) {
+    return Boolean(h.origin) || Boolean(h.referer);
+}
+export function csrfRejectionError(reason) {
+    if (reason === 'origin_mismatch')
+        return 'Cross-origin mismatch - check reverse proxy headers';
+    if (reason === 'token_mismatch')
+        return 'Session expired - reload the page';
+    return 'Cross-origin request rejected';
+}
+// ── trusted proxies ───────────────────────────────────────────────────────
+/** Strip the IPv4-mapped IPv6 prefix so `::ffff:10.0.0.1` also matches IPv4 networks. */
+export function ipv4Mapped(addr) {
+    const m = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/i.exec(addr);
+    return m ? (m[1] ?? null) : null;
+}
+export function trustedProxyNetworks(env) {
+    const list = new BlockList();
+    list.addSubnet('127.0.0.0', 8, 'ipv4');
+    list.addSubnet('::1', 128, 'ipv6');
+    list.addSubnet('::ffff:127.0.0.0', 104, 'ipv6');
+    for (const rawToken of (env.HERMES_WEBUI_TRUSTED_PROXY_CIDRS ?? '').replace(/;/g, ',').split(',')) {
+        const token = rawToken.trim();
+        if (!token)
+            continue;
+        const [addr, prefix] = token.split('/');
+        const family = isIP(addr ?? '');
+        if (!family)
+            continue;
+        const type = family === 4 ? 'ipv4' : 'ipv6';
+        if (prefix === undefined) {
+            list.addAddress(addr ?? '', type);
+            continue;
+        }
+        const bits = Number(prefix);
+        const max = family === 4 ? 32 : 128;
+        if (!/^\d+$/.test(prefix) || bits < 0 || bits > max)
+            continue;
+        try {
+            list.addSubnet(addr ?? '', bits, type);
+        }
+        catch { /* fail closed */ }
+    }
+    return list;
+}
+export function ipInNetworks(addr, networks) {
+    const family = isIP(addr);
+    if (!family)
+        return false;
+    if (networks.check(addr, family === 4 ? 'ipv4' : 'ipv6'))
+        return true;
+    const mapped = ipv4Mapped(addr);
+    return mapped !== null && networks.check(mapped, 'ipv4');
+}
+export function isLoopback(addr) {
+    const mapped = ipv4Mapped(addr) ?? addr;
+    if (isIP(mapped) === 4)
+        return mapped.startsWith('127.');
+    return isIP(mapped) === 6 && /^(0*:)*0*1$/.test(mapped.toLowerCase());
+}
+export function rawPeerIsTrustedProxy(peer, env) {
+    return Boolean(peer) && ipInNetworks(peer, trustedProxyNetworks(env));
+}
+/**
+ * Real client IP behind a trusted proxy: walk X-Forwarded-For right to left
+ * skipping trusted hops; fail closed (null) on malformed chains.
+ */
+export function forwardedClientIp(xff, realIp, peer, env) {
+    const hops = xff.flatMap((v) => v.split(',').map((t) => t.trim()));
+    if (xff.length) {
+        if (!hops.some(Boolean))
+            return null;
+        const nets = trustedProxyNetworks(env);
+        for (const hop of [...hops].reverse()) {
+            if (!hop || !isIP(hop))
+                return null;
+            if (ipInNetworks(hop, nets))
+                continue;
+            return hop;
+        }
+        return peer;
+    }
+    const real = (realIp ?? '').trim();
+    if (real)
+        return isIP(real) ? real : null;
+    return peer;
+}
+//# sourceMappingURL=origin.js.map

package/dist/http/origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin.js","sourceRoot":"","sources":["../../src/http/origin.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAG1C,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACpC,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IACzB,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC1B,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;YAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;YAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;YACrF,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;QAC5B,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC7C,CAAC;IACD,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,YAAoB,EAAE,UAAyB,EAAE,WAA0B;IACpG,IAAI,UAAU,KAAK,WAAW;QAAE,OAAO,IAAI,CAAA;IAC3C,MAAM,GAAG,GAAG,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IACnD,IAAI,CAAC,UAAU,IAAI,WAAW,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IACnD,IAAI,CAAC,WAAW,IAAI,UAAU,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IACnD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAQ,EAAE,OAA+B,GAAG,EAAE,CAAC,SAAS;IAC3F,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAA;IAC7B,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtE,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;QAC1D,IAAI,CAAC,KAAK;YAAE,SAAQ;QACpB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,sCAAsC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,uFAAuF,CAAC,CAAA;YACxJ,SAAQ;QACV,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAChB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAaD;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAAC,CAAoB,EAAE,GAAQ,EAAE,OAAwC,EAAE;IACtH,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,CAAA;IAC7B,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,EAAE,CAAA;IAC/B,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,EAAE,CAAA;IACzB,MAAM,YAAY,GAAG,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAChE,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,IAAI,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAA;IAClG,IAAI,YAAY,KAAK,YAAY;QAAE,OAAO,iBAAiB,CAAA;IAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAA;IAChC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,YAAY,KAAK,MAAM;YAAE,OAAO,IAAI,CAAA;QACxC,IAAI,YAAY,KAAK,aAAa;YAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAA;QAC5F,OAAO,iBAAiB,CAAA;IAC1B,CAAC;IACD,MAAM,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC5C,IAAI,CAAC,CAAC;QAAE,OAAO,iBAAiB,CAAA;IAChC,MAAM,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;IAC9D,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IAC9D,MAAM,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IAC1D,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAA;IAC3D,MAAM,YAAY,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAChE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC5G,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC;YAAE,IAAI,KAAK,CAAC,IAAI,EAAE;gBAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IAClH,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;QAC7D,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,CAAC,YAAY,EAAE,UAAU,EAAE,WAAW,CAAC;YAAE,OAAO,IAAI,CAAA;IAClG,CAAC;IACD,OAAO,iBAAiB,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,CAAoB;IACzD,OAAO,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;AAChD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAmB;IACpD,IAAI,MAAM,KAAK,iBAAiB;QAAE,OAAO,qDAAqD,CAAA;IAC9F,IAAI,MAAM,KAAK,gBAAgB;QAAE,OAAO,mCAAmC,CAAA;IAC3E,OAAO,+BAA+B,CAAA;AACxC,CAAC;AAED,6EAA6E;AAE7E,yFAAyF;AACzF,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,CAAC,GAAG,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACrD,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAClC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAQ;IAC3C,MAAM,IAAI,GAAG,IAAI,SAAS,EAAE,CAAA;IAC5B,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,EAAE,MAAM,CAAC,CAAA;IACtC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;IAClC,IAAI,CAAC,SAAS,CAAC,kBAAkB,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;IAC/C,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAClG,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,SAAQ;QACpB,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;QAC/B,IAAI,CAAC,MAAM;YAAE,SAAQ;QACrB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;QAC3C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC,CAAA;YACjC,SAAQ;QACV,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;QAC3B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA;QACnC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG;YAAE,SAAQ;QAC7D,IAAI,CAAC;YAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,QAAmB;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAA;IACzB,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACzB,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IACrE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAC/B,OAAO,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AAC1D,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAA;IACvC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IACxD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;AACvE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,GAAQ;IAC1D,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,EAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAA;AACvE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAa,EAAE,MAA0B,EAAE,IAAY,EAAE,GAAQ;IACjG,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;IAClE,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACf,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAA;QACpC,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAA;QACtC,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACtC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAA;YACnC,IAAI,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC;gBAAE,SAAQ;YACrC,OAAO,GAAG,CAAA;QACZ,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;IACzC,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/http/pinned.d.ts

@@ -0,0 +1,18 @@
+export type DnsLookup = (hostname: string) => Promise<{
+    address: string;
+    family: number;
+}[]>;
+export declare const systemDnsLookup: DnsLookup;
+export declare class BlockedAddressError extends Error {
+}
+/** Every address `hostname` resolves to, or a `BlockedAddressError` when any of them is refused by `blocked`. */
+export declare function vettedAddresses(hostname: string, blocked: (address: string) => boolean, lookup?: DnsLookup): Promise<string[]>;
+export interface PinnedInit {
+    method?: string;
+    headers?: Record<string, string>;
+    body?: string;
+    signal?: AbortSignal;
+}
+export type PinnedFetch = (url: string, init: PinnedInit, addresses: string[]) => Promise<Response>;
+/** `fetch` that only ever connects to `addresses`; redirects are returned as-is (never followed). */
+export declare const pinnedFetch: PinnedFetch;

package/dist/http/pinned.js

@@ -0,0 +1,62 @@
+/**
+ * Outbound requests whose destination address must be vetted before a secret
+ * travels with them. `vettedAddresses` resolves the hostname and rejects it if
+ * any answer is blocked; `pinnedFetch` then connects only to those answers
+ * (TLS still validates the URL hostname, SNI and `Host` are untouched), so a
+ * record that rebinds between the check and the connection cannot redirect the
+ * request. Both are injectable (`AppDeps.dnsLookup`, `AppDeps.pinnedFetch`) so
+ * tests never touch real DNS.
+ */
+import { lookup as dnsLookup } from 'node:dns/promises';
+import { request as httpRequest } from 'node:http';
+import { request as httpsRequest } from 'node:https';
+import { isIP, isIPv6 } from 'node:net';
+import { Readable } from 'node:stream';
+export const systemDnsLookup = (hostname) => dnsLookup(hostname, { all: true });
+export class BlockedAddressError extends Error {
+}
+/** Every address `hostname` resolves to, or a `BlockedAddressError` when any of them is refused by `blocked`. */
+export async function vettedAddresses(hostname, blocked, lookup = systemDnsLookup) {
+    const bare = hostname.replace(/^\[|\]$/g, '');
+    if (isIP(bare)) {
+        if (blocked(bare))
+            throw new BlockedAddressError(`blocked address ${bare}`);
+        return [bare];
+    }
+    const answers = await lookup(bare);
+    if (!answers.length)
+        throw new BlockedAddressError(`no address for ${bare}`);
+    for (const a of answers)
+        if (blocked(a.address))
+            throw new BlockedAddressError(`${bare} resolves to blocked address ${a.address}`);
+    return answers.map((a) => a.address);
+}
+/** `fetch` that only ever connects to `addresses`; redirects are returned as-is (never followed). */
+export const pinnedFetch = (url, init, addresses) => {
+    const u = new URL(url);
+    const pinned = addresses.map((address) => ({ address, family: isIPv6(address) ? 6 : 4 }));
+    const first = pinned[0];
+    if (!first)
+        return Promise.reject(new BlockedAddressError('no vetted address'));
+    const lookup = (_host, opts, cb) => {
+        if (opts.all)
+            cb(null, pinned);
+        else
+            cb(null, first.address, first.family);
+    };
+    return new Promise((resolve, reject) => {
+        const req = (u.protocol === 'https:' ? httpsRequest : httpRequest)(u, { method: init.method ?? 'GET', headers: init.headers ?? {}, lookup: lookup, ...(init.signal ? { signal: init.signal } : {}) }, (res) => {
+            const headers = new Headers();
+            for (const [k, v] of Object.entries(res.headers))
+                if (typeof v === 'string')
+                    headers.set(k, v);
+                else if (Array.isArray(v))
+                    for (const item of v)
+                        headers.append(k, item);
+            resolve(new Response(Readable.toWeb(res), { status: res.statusCode ?? 0, headers }));
+        });
+        req.on('error', reject);
+        req.end(init.body);
+    });
+};
+//# sourceMappingURL=pinned.js.map

package/dist/http/pinned.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pinned.js","sourceRoot":"","sources":["../../src/http/pinned.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAA;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAItC,MAAM,CAAC,MAAM,eAAe,GAAc,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;AAE1F,MAAM,OAAO,mBAAoB,SAAQ,KAAK;CAAG;AAEjD,iHAAiH;AACjH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,OAAqC,EAAE,SAAoB,eAAe;IAChI,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC7C,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAA;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAA;IACf,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAA;IAClC,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAA;IAC5E,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,GAAG,IAAI,gCAAgC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;IAClI,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;AACtC,CAAC;AAOD,qGAAqG;AACrG,MAAM,CAAC,MAAM,WAAW,GAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;IAC/D,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACtB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IACzF,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;IACvB,IAAI,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC,CAAA;IAC/E,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,IAAuB,EAAE,EAAkB,EAAQ,EAAE;QAClF,IAAI,IAAI,CAAC,GAAG;YAAE,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;;YACzB,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IAC5C,CAAC,CAAA;IACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,MAAM,EAAE,MAAe,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;YACrN,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;YAC7B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;qBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;oBAAE,KAAK,MAAM,IAAI,IAAI,CAAC;wBAAE,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;YACxK,OAAO,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAmB,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;QACxG,CAAC,CAAC,CAAA;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACvB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACpB,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+/** The sidecar RPC version this server speaks; the sidecar refuses any other. */
+export declare const SERVER_SIDECAR_RPC_VERSION: number;
+export { createApp, type App } from './app.js';
+export { createDeps } from './runtime.js';
+export { startServer } from './server.js';
+export { loadConfig, type ServerConfig } from './config.js';
+export { SettingsStore } from './settings.js';
+export { AuthStore } from './auth/store.js';
+export { StartupGate } from './startup.js';
+export { SpaShell } from './spa.js';

package/dist/index.js

@@ -0,0 +1,12 @@
+import { SIDECAR_RPC_VERSION } from '@maudecode/talaria-web-contracts';
+/** The sidecar RPC version this server speaks; the sidecar refuses any other. */
+export const SERVER_SIDECAR_RPC_VERSION = SIDECAR_RPC_VERSION;
+export { createApp } from './app.js';
+export { createDeps } from './runtime.js';
+export { startServer } from './server.js';
+export { loadConfig } from './config.js';
+export { SettingsStore } from './settings.js';
+export { AuthStore } from './auth/store.js';
+export { StartupGate } from './startup.js';
+export { SpaShell } from './spa.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAA;AAEtE,iFAAiF;AACjF,MAAM,CAAC,MAAM,0BAA0B,GAAW,mBAAmB,CAAA;AAErE,OAAO,EAAE,SAAS,EAAY,MAAM,UAAU,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,UAAU,EAAqB,MAAM,aAAa,CAAA;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA"}

package/dist/mcp/server.d.ts

@@ -0,0 +1,29 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export interface McpClientOptions {
+    baseUrl: string;
+    password: string | null;
+    profile: string | null;
+    fetch?: typeof fetch;
+    now?: () => number;
+}
+type Json = Record<string, unknown>;
+/** Thin authenticated HTTP client mirroring `_api_auth` / `_api_post`. */
+export declare class WebApiClient {
+    private readonly opts;
+    private cookie;
+    private cookieExpires;
+    private profileCookie;
+    private readonly fetchImpl;
+    private readonly now;
+    constructor(opts: McpClientOptions);
+    private auth;
+    /** The session-signed profile cookie the switch route issues; null when the profile cannot be selected. */
+    private signedProfileCookie;
+    private headers;
+    private request;
+    get(path: string): Promise<Json>;
+    post(path: string, body: unknown): Promise<Json>;
+    hasAuth(): boolean;
+}
+export declare function createTalariaMcpServer(opts: McpClientOptions): McpServer;
+export {};