@open-mercato/shared 0.10.1-develop.7584.1.99e06e1062 → 0.10.1-develop.7597.1.3d700f2421

package/dist/lib/crud/ids.js

@@ -67,7 +67,7 @@ function mergeIdFilter(existingFilters, parsedIds, options) {
     if (existingFilter === void 0 || existingFilter === null) {
       return { ...existingFilters, id: { $in: parsedIds } };
     }
-    return existingFilters;
+    return { $and: [existingFilters, { id: { $in: parsedIds } }] };
   }
   const allowed = new Set(parsedIds);
   const intersection = existingIds.filter((id) => allowed.has(id));

package/dist/lib/crud/ids.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/crud/ids.ts"],
-  "sourcesContent": ["import type { Where } from '@open-mercato/shared/lib/query/types'\nimport { toQueryValueList } from './query-params'\n\nexport const MAX_IDS_PER_REQUEST = 200\n\nconst UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i\n\nfunction isUuid(value: unknown): value is string {\n  return typeof value === 'string' && UUID_REGEX.test(value)\n}\n\nfunction normalizeIdList(values: string[]): string[] {\n  if (values.length === 0) return values\n  const deduped = new Set<string>()\n  for (const value of values) {\n    const trimmed = value.trim()\n    if (!trimmed || !isUuid(trimmed)) continue\n    deduped.add(trimmed)\n  }\n  return Array.from(deduped)\n}\n\nfunction readExistingIds(filter: unknown): string[] | null {\n  if (typeof filter === 'string') {\n    return isUuid(filter) ? [filter] : null\n  }\n  if (Array.isArray(filter)) {\n    return normalizeIdList(\n      filter.filter((value): value is string => typeof value === 'string'),\n    )\n  }\n  if (!filter || typeof filter !== 'object') return null\n\n  const operators = filter as Record<string, unknown>\n  if (isUuid(operators.$eq)) return [operators.$eq]\n\n  if (Array.isArray(operators.$in)) {\n    return normalizeIdList(\n      operators.$in.filter((value): value is string => typeof value === 'string'),\n    )\n  }\n\n  return null\n}\n\nexport function parseIdsParam(raw: unknown, maxIds: number = MAX_IDS_PER_REQUEST): string[] {\n  const values = toQueryValueList(raw)\n  if (values.length === 0) return []\n  const safeMax = Number.isFinite(maxIds) && maxIds > 0 ? Math.floor(maxIds) : MAX_IDS_PER_REQUEST\n  const parsed = normalizeIdList(values)\n  return parsed.slice(0, safeMax)\n}\n\nconst UUID_SHAPE_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\n/**\n * Splits a comma-separated id list query param into its trimmed, non-empty entries.\n */\nexport function splitIdListParam(raw: unknown): string[] {\n  if (typeof raw !== 'string') return []\n  return raw\n    .split(',')\n    .map((value) => value.trim())\n    .filter((value) => value.length > 0)\n}\n\n/**\n * Whether every entry of a comma-separated id list query param is UUID-shaped, so it can be\n * bound to a uuid column without a database error. Use it to reject a malformed or mixed list\n * with a 400 instead of dropping the bad entries and widening the result set (#7265).\n */\nexport function isUuidListParam(raw: unknown): boolean {\n  if (raw === undefined) return true\n  if (typeof raw !== 'string') return false\n  return splitIdListParam(raw).every((value) => UUID_SHAPE_REGEX.test(value))\n}\n\n/**\n * Whether an `?ids=` param was supplied at all (a non-empty string, or repeated\n * `?ids=` occurrences), regardless of whether any value survived UUID\n * validation. Lets a caller tell \"no ids filter requested\" apart from \"ids\n * filter requested but every value was malformed\" \u2014 the latter must match\n * nothing, not fall back to the full list (#4143 Finding 3).\n */\nexport function isIdsParamProvided(raw: unknown): boolean {\n  const occurrences = Array.isArray(raw) ? raw : [raw]\n  return occurrences.some((value) => typeof value === 'string' && value.trim().length > 0)\n}\n\nexport function mergeIdFilter<Fields extends Record<string, unknown>>(\n  existingFilters: Where<Fields>,\n  parsedIds: string[],\n  options?: { idsParamProvided?: boolean },\n): Where<Fields> {\n  if (parsedIds.length === 0) {\n    // The `?ids=` param was supplied but nothing survived UUID validation.\n    // Match nothing, mirroring a valid-but-unknown id returning zero rows,\n    // rather than silently dropping the filter and returning the full list\n    // (record-count side channel \u2014 #4143 Finding 3).\n    if (options?.idsParamProvided) {\n      return { ...existingFilters, id: { $in: [] } }\n    }\n    return existingFilters\n  }\n\n  const existingFilter = (existingFilters as Record<string, unknown>).id\n  const existingIds = readExistingIds(existingFilter)\n\n  if (!existingIds) {\n    // No existing narrowing \u2014 safe to install the user-supplied `$in`.\n    if (existingFilter === undefined || existingFilter === null) {\n      return { ...existingFilters, id: { $in: parsedIds } }\n    }\n    // Existing `id` filter is in a shape we do not recognise. Fail closed:\n    // preserve the existing filter instead of widening to `parsedIds`. Adding\n    // a new recognised shape to `readExistingIds` is preferable to silently\n    // dropping a narrowing that another caller put in place.\n    return existingFilters\n  }\n\n  const allowed = new Set(parsedIds)\n  const intersection = existingIds.filter((id) => allowed.has(id))\n  return {\n    ...existingFilters,\n    id: { $in: intersection },\n  }\n}\n"],
-  "mappings": "AACA,SAAS,wBAAwB;AAE1B,MAAM,sBAAsB;AAEnC,MAAM,aAAa;AAEnB,SAAS,OAAO,OAAiC;AAC/C,SAAO,OAAO,UAAU,YAAY,WAAW,KAAK,KAAK;AAC3D;AAEA,SAAS,gBAAgB,QAA4B;AACnD,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,QAAM,UAAU,oBAAI,IAAY;AAChC,aAAW,SAAS,QAAQ;AAC1B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,WAAW,CAAC,OAAO,OAAO,EAAG;AAClC,YAAQ,IAAI,OAAO;AAAA,EACrB;AACA,SAAO,MAAM,KAAK,OAAO;AAC3B;AAEA,SAAS,gBAAgB,QAAkC;AACzD,MAAI,OAAO,WAAW,UAAU;AAC9B,WAAO,OAAO,MAAM,IAAI,CAAC,MAAM,IAAI;AAAA,EACrC;AACA,MAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,WAAO;AAAA,MACL,OAAO,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,IACrE;AAAA,EACF;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAElD,QAAM,YAAY;AAClB,MAAI,OAAO,UAAU,GAAG,EAAG,QAAO,CAAC,UAAU,GAAG;AAEhD,MAAI,MAAM,QAAQ,UAAU,GAAG,GAAG;AAChC,WAAO;AAAA,MACL,UAAU,IAAI,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,IAC5E;AAAA,EACF;AAEA,SAAO;AACT;AAEO,SAAS,cAAc,KAAc,SAAiB,qBAA+B;AAC1F,QAAM,SAAS,iBAAiB,GAAG;AACnC,MAAI,OAAO,WAAW,EAAG,QAAO,CAAC;AACjC,QAAM,UAAU,OAAO,SAAS,MAAM,KAAK,SAAS,IAAI,KAAK,MAAM,MAAM,IAAI;AAC7E,QAAM,SAAS,gBAAgB,MAAM;AACrC,SAAO,OAAO,MAAM,GAAG,OAAO;AAChC;AAEA,MAAM,mBAAmB;AAKlB,SAAS,iBAAiB,KAAwB;AACvD,MAAI,OAAO,QAAQ,SAAU,QAAO,CAAC;AACrC,SAAO,IACJ,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AACvC;AAOO,SAAS,gBAAgB,KAAuB;AACrD,MAAI,QAAQ,OAAW,QAAO;AAC9B,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,SAAO,iBAAiB,GAAG,EAAE,MAAM,CAAC,UAAU,iBAAiB,KAAK,KAAK,CAAC;AAC5E;AASO,SAAS,mBAAmB,KAAuB;AACxD,QAAM,cAAc,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,GAAG;AACnD,SAAO,YAAY,KAAK,CAAC,UAAU,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,CAAC;AACzF;AAEO,SAAS,cACd,iBACA,WACA,SACe;AACf,MAAI,UAAU,WAAW,GAAG;AAK1B,QAAI,SAAS,kBAAkB;AAC7B,aAAO,EAAE,GAAG,iBAAiB,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE;AAAA,IAC/C;AACA,WAAO;AAAA,EACT;AAEA,QAAM,iBAAkB,gBAA4C;AACpE,QAAM,cAAc,gBAAgB,cAAc;AAElD,MAAI,CAAC,aAAa;AAEhB,QAAI,mBAAmB,UAAa,mBAAmB,MAAM;AAC3D,aAAO,EAAE,GAAG,iBAAiB,IAAI,EAAE,KAAK,UAAU,EAAE;AAAA,IACtD;AAKA,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,IAAI,IAAI,SAAS;AACjC,QAAM,eAAe,YAAY,OAAO,CAAC,OAAO,QAAQ,IAAI,EAAE,CAAC;AAC/D,SAAO;AAAA,IACL,GAAG;AAAA,IACH,IAAI,EAAE,KAAK,aAAa;AAAA,EAC1B;AACF;",
+  "sourcesContent": ["import type { Where } from '@open-mercato/shared/lib/query/types'\nimport { toQueryValueList } from './query-params'\n\nexport const MAX_IDS_PER_REQUEST = 200\n\nconst UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i\n\nfunction isUuid(value: unknown): value is string {\n  return typeof value === 'string' && UUID_REGEX.test(value)\n}\n\nfunction normalizeIdList(values: string[]): string[] {\n  if (values.length === 0) return values\n  const deduped = new Set<string>()\n  for (const value of values) {\n    const trimmed = value.trim()\n    if (!trimmed || !isUuid(trimmed)) continue\n    deduped.add(trimmed)\n  }\n  return Array.from(deduped)\n}\n\nfunction readExistingIds(filter: unknown): string[] | null {\n  if (typeof filter === 'string') {\n    return isUuid(filter) ? [filter] : null\n  }\n  if (Array.isArray(filter)) {\n    return normalizeIdList(\n      filter.filter((value): value is string => typeof value === 'string'),\n    )\n  }\n  if (!filter || typeof filter !== 'object') return null\n\n  const operators = filter as Record<string, unknown>\n  if (isUuid(operators.$eq)) return [operators.$eq]\n\n  if (Array.isArray(operators.$in)) {\n    return normalizeIdList(\n      operators.$in.filter((value): value is string => typeof value === 'string'),\n    )\n  }\n\n  return null\n}\n\nexport function parseIdsParam(raw: unknown, maxIds: number = MAX_IDS_PER_REQUEST): string[] {\n  const values = toQueryValueList(raw)\n  if (values.length === 0) return []\n  const safeMax = Number.isFinite(maxIds) && maxIds > 0 ? Math.floor(maxIds) : MAX_IDS_PER_REQUEST\n  const parsed = normalizeIdList(values)\n  return parsed.slice(0, safeMax)\n}\n\nconst UUID_SHAPE_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\n/**\n * Splits a comma-separated id list query param into its trimmed, non-empty entries.\n */\nexport function splitIdListParam(raw: unknown): string[] {\n  if (typeof raw !== 'string') return []\n  return raw\n    .split(',')\n    .map((value) => value.trim())\n    .filter((value) => value.length > 0)\n}\n\n/**\n * Whether every entry of a comma-separated id list query param is UUID-shaped, so it can be\n * bound to a uuid column without a database error. Use it to reject a malformed or mixed list\n * with a 400 instead of dropping the bad entries and widening the result set (#7265).\n */\nexport function isUuidListParam(raw: unknown): boolean {\n  if (raw === undefined) return true\n  if (typeof raw !== 'string') return false\n  return splitIdListParam(raw).every((value) => UUID_SHAPE_REGEX.test(value))\n}\n\n/**\n * Whether an `?ids=` param was supplied at all (a non-empty string, or repeated\n * `?ids=` occurrences), regardless of whether any value survived UUID\n * validation. Lets a caller tell \"no ids filter requested\" apart from \"ids\n * filter requested but every value was malformed\" \u2014 the latter must match\n * nothing, not fall back to the full list (#4143 Finding 3).\n */\nexport function isIdsParamProvided(raw: unknown): boolean {\n  const occurrences = Array.isArray(raw) ? raw : [raw]\n  return occurrences.some((value) => typeof value === 'string' && value.trim().length > 0)\n}\n\nexport function mergeIdFilter<Fields extends Record<string, unknown>>(\n  existingFilters: Where<Fields>,\n  parsedIds: string[],\n  options?: { idsParamProvided?: boolean },\n): Where<Fields> {\n  if (parsedIds.length === 0) {\n    // The `?ids=` param was supplied but nothing survived UUID validation.\n    // Match nothing, mirroring a valid-but-unknown id returning zero rows,\n    // rather than silently dropping the filter and returning the full list\n    // (record-count side channel \u2014 #4143 Finding 3).\n    if (options?.idsParamProvided) {\n      return { ...existingFilters, id: { $in: [] } }\n    }\n    return existingFilters\n  }\n\n  const existingFilter = (existingFilters as Record<string, unknown>).id\n  const existingIds = readExistingIds(existingFilter)\n\n  if (!existingIds) {\n    // No existing narrowing \u2014 safe to install the user-supplied `$in`.\n    if (existingFilter === undefined || existingFilter === null) {\n      return { ...existingFilters, id: { $in: parsedIds } }\n    }\n    // Existing `id` filter is in a shape we do not recognise. Fail closed by\n    // ANDing both constraints rather than dropping either: `parsedIds` may be\n    // server-supplied narrowing (an interceptor's `before` hook setting\n    // `query.ids`), so discarding it to \"preserve\" an unrecognised caller\n    // filter would silently disable that narrowing (#7641). Adding a new\n    // recognised shape to `readExistingIds` remains preferable when the\n    // shapes can be intersected directly.\n    return { $and: [existingFilters, { id: { $in: parsedIds } }] } as Where<Fields>\n  }\n\n  const allowed = new Set(parsedIds)\n  const intersection = existingIds.filter((id) => allowed.has(id))\n  return {\n    ...existingFilters,\n    id: { $in: intersection },\n  }\n}\n"],
+  "mappings": "AACA,SAAS,wBAAwB;AAE1B,MAAM,sBAAsB;AAEnC,MAAM,aAAa;AAEnB,SAAS,OAAO,OAAiC;AAC/C,SAAO,OAAO,UAAU,YAAY,WAAW,KAAK,KAAK;AAC3D;AAEA,SAAS,gBAAgB,QAA4B;AACnD,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,QAAM,UAAU,oBAAI,IAAY;AAChC,aAAW,SAAS,QAAQ;AAC1B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,WAAW,CAAC,OAAO,OAAO,EAAG;AAClC,YAAQ,IAAI,OAAO;AAAA,EACrB;AACA,SAAO,MAAM,KAAK,OAAO;AAC3B;AAEA,SAAS,gBAAgB,QAAkC;AACzD,MAAI,OAAO,WAAW,UAAU;AAC9B,WAAO,OAAO,MAAM,IAAI,CAAC,MAAM,IAAI;AAAA,EACrC;AACA,MAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,WAAO;AAAA,MACL,OAAO,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,IACrE;AAAA,EACF;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAElD,QAAM,YAAY;AAClB,MAAI,OAAO,UAAU,GAAG,EAAG,QAAO,CAAC,UAAU,GAAG;AAEhD,MAAI,MAAM,QAAQ,UAAU,GAAG,GAAG;AAChC,WAAO;AAAA,MACL,UAAU,IAAI,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,IAC5E;AAAA,EACF;AAEA,SAAO;AACT;AAEO,SAAS,cAAc,KAAc,SAAiB,qBAA+B;AAC1F,QAAM,SAAS,iBAAiB,GAAG;AACnC,MAAI,OAAO,WAAW,EAAG,QAAO,CAAC;AACjC,QAAM,UAAU,OAAO,SAAS,MAAM,KAAK,SAAS,IAAI,KAAK,MAAM,MAAM,IAAI;AAC7E,QAAM,SAAS,gBAAgB,MAAM;AACrC,SAAO,OAAO,MAAM,GAAG,OAAO;AAChC;AAEA,MAAM,mBAAmB;AAKlB,SAAS,iBAAiB,KAAwB;AACvD,MAAI,OAAO,QAAQ,SAAU,QAAO,CAAC;AACrC,SAAO,IACJ,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AACvC;AAOO,SAAS,gBAAgB,KAAuB;AACrD,MAAI,QAAQ,OAAW,QAAO;AAC9B,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,SAAO,iBAAiB,GAAG,EAAE,MAAM,CAAC,UAAU,iBAAiB,KAAK,KAAK,CAAC;AAC5E;AASO,SAAS,mBAAmB,KAAuB;AACxD,QAAM,cAAc,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,GAAG;AACnD,SAAO,YAAY,KAAK,CAAC,UAAU,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,CAAC;AACzF;AAEO,SAAS,cACd,iBACA,WACA,SACe;AACf,MAAI,UAAU,WAAW,GAAG;AAK1B,QAAI,SAAS,kBAAkB;AAC7B,aAAO,EAAE,GAAG,iBAAiB,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE;AAAA,IAC/C;AACA,WAAO;AAAA,EACT;AAEA,QAAM,iBAAkB,gBAA4C;AACpE,QAAM,cAAc,gBAAgB,cAAc;AAElD,MAAI,CAAC,aAAa;AAEhB,QAAI,mBAAmB,UAAa,mBAAmB,MAAM;AAC3D,aAAO,EAAE,GAAG,iBAAiB,IAAI,EAAE,KAAK,UAAU,EAAE;AAAA,IACtD;AAQA,WAAO,EAAE,MAAM,CAAC,iBAAiB,EAAE,IAAI,EAAE,KAAK,UAAU,EAAE,CAAC,EAAE;AAAA,EAC/D;AAEA,QAAM,UAAU,IAAI,IAAI,SAAS;AACjC,QAAM,eAAe,YAAY,OAAO,CAAC,OAAO,QAAQ,IAAI,EAAE,CAAC;AAC/D,SAAO;AAAA,IACL,GAAG;AAAA,IACH,IAAI,EAAE,KAAK,aAAa;AAAA,EAC1B;AACF;",
   "names": []
 }

package/dist/lib/url.js

@@ -44,6 +44,9 @@ function readAllowedOrigins(env) {
   }
   return origins;
 }
+function readConfiguredAppOrigins(env = process.env) {
+  return Array.from(readAllowedOrigins(env));
+}
 function readFirstHeaderValue(value) {
   const first = value?.split(",")[0]?.trim();
   return first && first.length > 0 ? first : null;
@@ -127,13 +130,16 @@ function normalizeOriginPort(url) {
   if (url.protocol === "http:") return "80";
   return "";
 }
-function isEquivalentLoopbackOrigin(origin, allowedOrigin) {
+function isEquivalentLoopbackOrigin(origin, allowedOrigin, options = {}) {
   try {
     const candidateUrl = new URL(origin);
     const allowedUrl = new URL(allowedOrigin);
     if (!isLoopbackHostname(candidateUrl.hostname) || !isLoopbackHostname(allowedUrl.hostname)) {
       return false;
     }
+    if (options.requireSameProtocol && candidateUrl.protocol !== allowedUrl.protocol) {
+      return false;
+    }
     return normalizeOriginPort(candidateUrl) === normalizeOriginPort(allowedUrl);
   } catch {
     return false;
@@ -239,7 +245,9 @@ export {
   getAppBaseUrl,
   getSecurityEmailBaseUrl,
   isCrossSiteBrowserRequest,
+  isEquivalentLoopbackOrigin,
   mapSecurityEmailUrlError,
+  readConfiguredAppOrigins,
   resolveRequestOrigin,
   toAbsoluteUrl,
   toSecurityEmailUrl

package/dist/lib/url.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/url.ts"],
-  "sourcesContent": ["import { createLogger } from './logger'\n\nconst logger = createLogger('shared').child({ component: 'origin-check' })\n\nconst DEFAULT_DEV_APP_URL = 'http://localhost:3000'\n\ntype EnvLike = Record<string, string | undefined> & {\n  APP_URL?: string\n  NEXT_PUBLIC_APP_URL?: string\n  APP_ALLOWED_ORIGINS?: string\n  NODE_ENV?: string\n}\ntype RequestInput = Request | string | undefined\n\nexport type SecurityEmailUrlErrorMapping = {\n  scope: string\n  configMessage: string\n}\n\nexport class AppOriginConfigurationError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'AppOriginConfigurationError'\n  }\n}\n\nexport class AppOriginRejectedError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'AppOriginRejectedError'\n  }\n}\n\nfunction parseBaseUrl(raw: string | undefined): URL | null {\n  const value = raw?.trim()\n  if (!value) return null\n  try {\n    const url = new URL(value)\n    url.hash = ''\n    url.search = ''\n    return url\n  } catch {\n    return null\n  }\n}\n\nfunction normalizeBaseUrl(raw: string | undefined): string | null {\n  const url = parseBaseUrl(raw)\n  return url ? url.toString().replace(/\\/$/, '') : null\n}\n\nfunction normalizeOrigin(raw: string | undefined): string | null {\n  const url = parseBaseUrl(raw)\n  return url ? url.origin : null\n}\n\nfunction readCsv(value: string | undefined): string[] {\n  return (value ?? '')\n    .split(',')\n    .map((item) => item.trim())\n    .filter((item) => item.length > 0)\n}\n\nfunction readAllowedOrigins(env: EnvLike): Set<string> {\n  const origins = new Set<string>()\n  for (const raw of [env.APP_URL, env.NEXT_PUBLIC_APP_URL, ...readCsv(env.APP_ALLOWED_ORIGINS)]) {\n    const origin = normalizeOrigin(raw)\n    if (origin) origins.add(origin)\n  }\n  return origins\n}\n\nfunction readFirstHeaderValue(value: string | null): string | null {\n  const first = value?.split(',')[0]?.trim()\n  return first && first.length > 0 ? first : null\n}\n\nfunction originFromHost(protocol: string, rawHost: string | null): string | null {\n  const host = readFirstHeaderValue(rawHost)\n  if (!host) return null\n  return normalizeOrigin(`${protocol}//${host}`)\n}\n\ntype RequestOriginCandidates = {\n  urlOrigin: string | null\n  headerOrigins: Set<string>\n}\n\nfunction readRequestOriginCandidates(input: RequestInput): RequestOriginCandidates {\n  const candidates: RequestOriginCandidates = {\n    urlOrigin: null,\n    headerOrigins: new Set<string>(),\n  }\n  if (!input) return candidates\n\n  const requestUrl = typeof input === 'string' ? input : input.url\n  let parsedUrl: URL\n  try {\n    parsedUrl = new URL(requestUrl)\n  } catch {\n    return candidates\n  }\n\n  candidates.urlOrigin = normalizeOrigin(parsedUrl.origin)\n  if (typeof input === 'string') return candidates\n\n  const forwardedProto = readFirstHeaderValue(input.headers.get('x-forwarded-proto')) ?? parsedUrl.protocol.replace(/:$/, '')\n  const protocol = forwardedProto.endsWith(':') ? forwardedProto : `${forwardedProto}:`\n  const hostOrigin = originFromHost(protocol, input.headers.get('host'))\n  const forwardedHostOrigin = originFromHost(protocol, input.headers.get('x-forwarded-host'))\n  if (hostOrigin) candidates.headerOrigins.add(hostOrigin)\n  if (forwardedHostOrigin) candidates.headerOrigins.add(forwardedHostOrigin)\n  return candidates\n}\n\nfunction requestOrigins(input: RequestInput): Set<string> {\n  const origins = new Set<string>()\n  const { urlOrigin, headerOrigins } = readRequestOriginCandidates(input)\n  if (urlOrigin) origins.add(urlOrigin)\n  for (const origin of headerOrigins) origins.add(origin)\n  return origins\n}\n\nfunction logOriginDebugContext(\n  input: RequestInput,\n  allowedOrigins: Set<string>,\n  rejectedOrigin?: string,\n  level: 'error' | 'warn' = 'error',\n  nodeEnv?: string,\n): void {\n  if (level === 'warn' && nodeEnv === 'test') return\n  const log = (msg: string, fields: Record<string, unknown>) =>\n    level === 'warn' ? logger.warn(msg, fields) : logger.error(msg, fields)\n\n  if (typeof input === 'string') {\n    log('Origin check rejected string input', {\n      requestUrl: input,\n      rejectedOrigin: rejectedOrigin ?? null,\n      allowedOrigins: Array.from(allowedOrigins),\n    })\n    return\n  }\n\n  if (!input) {\n    log('Origin check rejected empty input', {\n      rejectedOrigin: rejectedOrigin ?? null,\n      allowedOrigins: Array.from(allowedOrigins),\n    })\n    return\n  }\n\n  log('Origin check rejected request', {\n    requestUrl: input.url,\n    host: input.headers.get('host'),\n    forwardedHost: input.headers.get('x-forwarded-host'),\n    forwardedProto: input.headers.get('x-forwarded-proto'),\n    derivedOrigins: Array.from(requestOrigins(input)),\n    rejectedOrigin: rejectedOrigin ?? null,\n    allowedOrigins: Array.from(allowedOrigins),\n  })\n}\n\nfunction isLoopbackHostname(hostname: string): boolean {\n  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1'\n}\n\nfunction isLoopbackOrigin(origin: string): boolean {\n  try {\n    return isLoopbackHostname(new URL(origin).hostname)\n  } catch {\n    return false\n  }\n}\n\nfunction normalizeOriginPort(url: URL): string {\n  if (url.port) return url.port\n  if (url.protocol === 'https:') return '443'\n  if (url.protocol === 'http:') return '80'\n  return ''\n}\n\nfunction isEquivalentLoopbackOrigin(origin: string, allowedOrigin: string): boolean {\n  try {\n    const candidateUrl = new URL(origin)\n    const allowedUrl = new URL(allowedOrigin)\n    if (!isLoopbackHostname(candidateUrl.hostname) || !isLoopbackHostname(allowedUrl.hostname)) {\n      return false\n    }\n    return normalizeOriginPort(candidateUrl) === normalizeOriginPort(allowedUrl)\n  } catch {\n    return false\n  }\n}\n\nfunction shouldAllowLoopbackOrigin(origin: string, allowedOrigins: Set<string>, env: EnvLike): boolean {\n  if (!isLoopbackOrigin(origin)) return false\n  for (const allowedOrigin of allowedOrigins) {\n    if (!isLoopbackOrigin(allowedOrigin)) continue\n    if (env.NODE_ENV !== 'production') return true\n    if (isEquivalentLoopbackOrigin(origin, allowedOrigin)) return true\n  }\n  return false\n}\n\nexport function assertAllowedAppOrigin(input: RequestInput, env: EnvLike = process.env): void {\n  const allowedOrigins = readAllowedOrigins(env)\n  if (allowedOrigins.size === 0) {\n    if (env.NODE_ENV === 'production') {\n      logOriginDebugContext(input, allowedOrigins)\n      throw new AppOriginConfigurationError('APP_URL must be configured in production')\n    }\n    return\n  }\n  const { urlOrigin, headerOrigins } = readRequestOriginCandidates(input)\n  const hasAllowedHeaderOrigin = Array.from(headerOrigins).some((origin) => allowedOrigins.has(origin))\n\n  for (const origin of headerOrigins) {\n    if (allowedOrigins.has(origin)) continue\n    if (shouldAllowLoopbackOrigin(origin, allowedOrigins, env)) continue\n    logOriginDebugContext(input, allowedOrigins, origin, 'warn', env.NODE_ENV)\n    throw new AppOriginRejectedError('Request origin is not allowed')\n  }\n\n  if (!urlOrigin) return\n  if (allowedOrigins.has(urlOrigin)) return\n  if (shouldAllowLoopbackOrigin(urlOrigin, allowedOrigins, env)) return\n  if (isLoopbackOrigin(urlOrigin) && hasAllowedHeaderOrigin) return\n\n  logOriginDebugContext(input, allowedOrigins, urlOrigin, 'warn', env.NODE_ENV)\n  throw new AppOriginRejectedError('Request origin is not allowed')\n}\n\nexport function resolveRequestOrigin(req: Request): string {\n  const url = new URL(req.url)\n  const proto = req.headers.get('x-forwarded-proto') || url.protocol.replace(':', '')\n  const host = req.headers.get('x-forwarded-host') || req.headers.get('host') || url.host\n  return `${proto}://${host}`\n}\n\nexport function getAppBaseUrl(req: Request): string {\n  return (\n    process.env.NEXT_PUBLIC_APP_URL ||\n    process.env.APP_URL ||\n    resolveRequestOrigin(req)\n  )\n}\n\nexport function toAbsoluteUrl(req: Request, path: string): string {\n  return new URL(path, getAppBaseUrl(req)).toString()\n}\n\nexport function getSecurityEmailBaseUrl(input?: RequestInput, env: EnvLike = process.env): string {\n  const configuredAppUrl = normalizeBaseUrl(env.APP_URL)\n  if (!configuredAppUrl) {\n    if (env.NODE_ENV === 'production') {\n      throw new AppOriginConfigurationError('APP_URL must be configured in production')\n    }\n    return DEFAULT_DEV_APP_URL\n  }\n\n  assertAllowedAppOrigin(input, env)\n  return configuredAppUrl\n}\n\nexport function toSecurityEmailUrl(input: RequestInput, path: string, env: EnvLike = process.env): string {\n  const base = getSecurityEmailBaseUrl(input, env)\n  return `${base}/${path.replace(/^\\/+/, '')}`\n}\n\nexport function isCrossSiteBrowserRequest(req: Request, env: EnvLike = process.env): boolean {\n  const rawFetchSite = req.headers.get('sec-fetch-site')\n  const fetchSite = rawFetchSite?.trim().toLowerCase() ?? null\n  if (fetchSite === 'cross-site') return true\n  if (fetchSite === 'same-origin' || fetchSite === 'none') return false\n\n  const rawOrigin = req.headers.get('origin')\n  if (rawOrigin === null) return rawFetchSite !== null\n  const origin = normalizeOrigin(rawOrigin)\n  if (!origin) return true\n\n  const allowedOrigins = readAllowedOrigins(env)\n  if (allowedOrigins.has(origin)) return false\n  if (shouldAllowLoopbackOrigin(origin, allowedOrigins, env)) return false\n\n  const forwardedProto = readFirstHeaderValue(req.headers.get('x-forwarded-proto'))\n  const protocol = forwardedProto\n    ? (forwardedProto.endsWith(':') ? forwardedProto : `${forwardedProto}:`)\n    : new URL(origin).protocol\n  const host = req.headers.get('host')\n  const forwardedHost = req.headers.get('x-forwarded-host')\n  if (originFromHost(protocol, forwardedHost) === origin) return false\n  if (originFromHost(protocol, host) === origin) return false\n\n  if (env.NODE_ENV !== 'test') {\n    logger.warn('Cross-site request rejected', { origin, host, forwardedHost })\n  }\n  return true\n}\n\nexport function mapSecurityEmailUrlError(\n  error: unknown,\n  mapping: SecurityEmailUrlErrorMapping,\n): { status: number; body: { error: string } } | null {\n  if (error instanceof AppOriginRejectedError) {\n    return { status: 400, body: { error: 'Invalid request origin' } }\n  }\n  if (error instanceof AppOriginConfigurationError) {\n    logger.error('APP_URL is required in production', { scope: mapping.scope })\n    return { status: 500, body: { error: mapping.configMessage } }\n  }\n  return null\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,eAAe,CAAC;AAEzE,MAAM,sBAAsB;AAerB,MAAM,oCAAoC,MAAM;AAAA,EACrD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,+BAA+B,MAAM;AAAA,EAChD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,aAAa,KAAqC;AACzD,QAAM,QAAQ,KAAK,KAAK;AACxB,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,QAAI,OAAO;AACX,QAAI,SAAS;AACb,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,iBAAiB,KAAwC;AAChE,QAAM,MAAM,aAAa,GAAG;AAC5B,SAAO,MAAM,IAAI,SAAS,EAAE,QAAQ,OAAO,EAAE,IAAI;AACnD;AAEA,SAAS,gBAAgB,KAAwC;AAC/D,QAAM,MAAM,aAAa,GAAG;AAC5B,SAAO,MAAM,IAAI,SAAS;AAC5B;AAEA,SAAS,QAAQ,OAAqC;AACpD,UAAQ,SAAS,IACd,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC;AACrC;AAEA,SAAS,mBAAmB,KAA2B;AACrD,QAAM,UAAU,oBAAI,IAAY;AAChC,aAAW,OAAO,CAAC,IAAI,SAAS,IAAI,qBAAqB,GAAG,QAAQ,IAAI,mBAAmB,CAAC,GAAG;AAC7F,UAAM,SAAS,gBAAgB,GAAG;AAClC,QAAI,OAAQ,SAAQ,IAAI,MAAM;AAAA,EAChC;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,OAAqC;AACjE,QAAM,QAAQ,OAAO,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AACzC,SAAO,SAAS,MAAM,SAAS,IAAI,QAAQ;AAC7C;AAEA,SAAS,eAAe,UAAkB,SAAuC;AAC/E,QAAM,OAAO,qBAAqB,OAAO;AACzC,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,gBAAgB,GAAG,QAAQ,KAAK,IAAI,EAAE;AAC/C;AAOA,SAAS,4BAA4B,OAA8C;AACjF,QAAM,aAAsC;AAAA,IAC1C,WAAW;AAAA,IACX,eAAe,oBAAI,IAAY;AAAA,EACjC;AACA,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,aAAa,OAAO,UAAU,WAAW,QAAQ,MAAM;AAC7D,MAAI;AACJ,MAAI;AACF,gBAAY,IAAI,IAAI,UAAU;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,aAAW,YAAY,gBAAgB,UAAU,MAAM;AACvD,MAAI,OAAO,UAAU,SAAU,QAAO;AAEtC,QAAM,iBAAiB,qBAAqB,MAAM,QAAQ,IAAI,mBAAmB,CAAC,KAAK,UAAU,SAAS,QAAQ,MAAM,EAAE;AAC1H,QAAM,WAAW,eAAe,SAAS,GAAG,IAAI,iBAAiB,GAAG,cAAc;AAClF,QAAM,aAAa,eAAe,UAAU,MAAM,QAAQ,IAAI,MAAM,CAAC;AACrE,QAAM,sBAAsB,eAAe,UAAU,MAAM,QAAQ,IAAI,kBAAkB,CAAC;AAC1F,MAAI,WAAY,YAAW,cAAc,IAAI,UAAU;AACvD,MAAI,oBAAqB,YAAW,cAAc,IAAI,mBAAmB;AACzE,SAAO;AACT;AAEA,SAAS,eAAe,OAAkC;AACxD,QAAM,UAAU,oBAAI,IAAY;AAChC,QAAM,EAAE,WAAW,cAAc,IAAI,4BAA4B,KAAK;AACtE,MAAI,UAAW,SAAQ,IAAI,SAAS;AACpC,aAAW,UAAU,cAAe,SAAQ,IAAI,MAAM;AACtD,SAAO;AACT;AAEA,SAAS,sBACP,OACA,gBACA,gBACA,QAA0B,SAC1B,SACM;AACN,MAAI,UAAU,UAAU,YAAY,OAAQ;AAC5C,QAAM,MAAM,CAAC,KAAa,WACxB,UAAU,SAAS,OAAO,KAAK,KAAK,MAAM,IAAI,OAAO,MAAM,KAAK,MAAM;AAExE,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,sCAAsC;AAAA,MACxC,YAAY;AAAA,MACZ,gBAAgB,kBAAkB;AAAA,MAClC,gBAAgB,MAAM,KAAK,cAAc;AAAA,IAC3C,CAAC;AACD;AAAA,EACF;AAEA,MAAI,CAAC,OAAO;AACV,QAAI,qCAAqC;AAAA,MACvC,gBAAgB,kBAAkB;AAAA,MAClC,gBAAgB,MAAM,KAAK,cAAc;AAAA,IAC3C,CAAC;AACD;AAAA,EACF;AAEA,MAAI,iCAAiC;AAAA,IACnC,YAAY,MAAM;AAAA,IAClB,MAAM,MAAM,QAAQ,IAAI,MAAM;AAAA,IAC9B,eAAe,MAAM,QAAQ,IAAI,kBAAkB;AAAA,IACnD,gBAAgB,MAAM,QAAQ,IAAI,mBAAmB;AAAA,IACrD,gBAAgB,MAAM,KAAK,eAAe,KAAK,CAAC;AAAA,IAChD,gBAAgB,kBAAkB;AAAA,IAClC,gBAAgB,MAAM,KAAK,cAAc;AAAA,EAC3C,CAAC;AACH;AAEA,SAAS,mBAAmB,UAA2B;AACrD,SAAO,aAAa,eAAe,aAAa,eAAe,aAAa;AAC9E;AAEA,SAAS,iBAAiB,QAAyB;AACjD,MAAI;AACF,WAAO,mBAAmB,IAAI,IAAI,MAAM,EAAE,QAAQ;AAAA,EACpD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,oBAAoB,KAAkB;AAC7C,MAAI,IAAI,KAAM,QAAO,IAAI;AACzB,MAAI,IAAI,aAAa,SAAU,QAAO;AACtC,MAAI,IAAI,aAAa,QAAS,QAAO;AACrC,SAAO;AACT;AAEA,SAAS,2BAA2B,QAAgB,eAAgC;AAClF,MAAI;AACF,UAAM,eAAe,IAAI,IAAI,MAAM;AACnC,UAAM,aAAa,IAAI,IAAI,aAAa;AACxC,QAAI,CAAC,mBAAmB,aAAa,QAAQ,KAAK,CAAC,mBAAmB,WAAW,QAAQ,GAAG;AAC1F,aAAO;AAAA,IACT;AACA,WAAO,oBAAoB,YAAY,MAAM,oBAAoB,UAAU;AAAA,EAC7E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,0BAA0B,QAAgB,gBAA6B,KAAuB;AACrG,MAAI,CAAC,iBAAiB,MAAM,EAAG,QAAO;AACtC,aAAW,iBAAiB,gBAAgB;AAC1C,QAAI,CAAC,iBAAiB,aAAa,EAAG;AACtC,QAAI,IAAI,aAAa,aAAc,QAAO;AAC1C,QAAI,2BAA2B,QAAQ,aAAa,EAAG,QAAO;AAAA,EAChE;AACA,SAAO;AACT;AAEO,SAAS,uBAAuB,OAAqB,MAAe,QAAQ,KAAW;AAC5F,QAAM,iBAAiB,mBAAmB,GAAG;AAC7C,MAAI,eAAe,SAAS,GAAG;AAC7B,QAAI,IAAI,aAAa,cAAc;AACjC,4BAAsB,OAAO,cAAc;AAC3C,YAAM,IAAI,4BAA4B,0CAA0C;AAAA,IAClF;AACA;AAAA,EACF;AACA,QAAM,EAAE,WAAW,cAAc,IAAI,4BAA4B,KAAK;AACtE,QAAM,yBAAyB,MAAM,KAAK,aAAa,EAAE,KAAK,CAAC,WAAW,eAAe,IAAI,MAAM,CAAC;AAEpG,aAAW,UAAU,eAAe;AAClC,QAAI,eAAe,IAAI,MAAM,EAAG;AAChC,QAAI,0BAA0B,QAAQ,gBAAgB,GAAG,EAAG;AAC5D,0BAAsB,OAAO,gBAAgB,QAAQ,QAAQ,IAAI,QAAQ;AACzE,UAAM,IAAI,uBAAuB,+BAA+B;AAAA,EAClE;AAEA,MAAI,CAAC,UAAW;AAChB,MAAI,eAAe,IAAI,SAAS,EAAG;AACnC,MAAI,0BAA0B,WAAW,gBAAgB,GAAG,EAAG;AAC/D,MAAI,iBAAiB,SAAS,KAAK,uBAAwB;AAE3D,wBAAsB,OAAO,gBAAgB,WAAW,QAAQ,IAAI,QAAQ;AAC5E,QAAM,IAAI,uBAAuB,+BAA+B;AAClE;AAEO,SAAS,qBAAqB,KAAsB;AACzD,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,QAAQ,IAAI,QAAQ,IAAI,mBAAmB,KAAK,IAAI,SAAS,QAAQ,KAAK,EAAE;AAClF,QAAM,OAAO,IAAI,QAAQ,IAAI,kBAAkB,KAAK,IAAI,QAAQ,IAAI,MAAM,KAAK,IAAI;AACnF,SAAO,GAAG,KAAK,MAAM,IAAI;AAC3B;AAEO,SAAS,cAAc,KAAsB;AAClD,SACE,QAAQ,IAAI,uBACZ,QAAQ,IAAI,WACZ,qBAAqB,GAAG;AAE5B;AAEO,SAAS,cAAc,KAAc,MAAsB;AAChE,SAAO,IAAI,IAAI,MAAM,cAAc,GAAG,CAAC,EAAE,SAAS;AACpD;AAEO,SAAS,wBAAwB,OAAsB,MAAe,QAAQ,KAAa;AAChG,QAAM,mBAAmB,iBAAiB,IAAI,OAAO;AACrD,MAAI,CAAC,kBAAkB;AACrB,QAAI,IAAI,aAAa,cAAc;AACjC,YAAM,IAAI,4BAA4B,0CAA0C;AAAA,IAClF;AACA,WAAO;AAAA,EACT;AAEA,yBAAuB,OAAO,GAAG;AACjC,SAAO;AACT;AAEO,SAAS,mBAAmB,OAAqB,MAAc,MAAe,QAAQ,KAAa;AACxG,QAAM,OAAO,wBAAwB,OAAO,GAAG;AAC/C,SAAO,GAAG,IAAI,IAAI,KAAK,QAAQ,QAAQ,EAAE,CAAC;AAC5C;AAEO,SAAS,0BAA0B,KAAc,MAAe,QAAQ,KAAc;AAC3F,QAAM,eAAe,IAAI,QAAQ,IAAI,gBAAgB;AACrD,QAAM,YAAY,cAAc,KAAK,EAAE,YAAY,KAAK;AACxD,MAAI,cAAc,aAAc,QAAO;AACvC,MAAI,cAAc,iBAAiB,cAAc,OAAQ,QAAO;AAEhE,QAAM,YAAY,IAAI,QAAQ,IAAI,QAAQ;AAC1C,MAAI,cAAc,KAAM,QAAO,iBAAiB;AAChD,QAAM,SAAS,gBAAgB,SAAS;AACxC,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,iBAAiB,mBAAmB,GAAG;AAC7C,MAAI,eAAe,IAAI,MAAM,EAAG,QAAO;AACvC,MAAI,0BAA0B,QAAQ,gBAAgB,GAAG,EAAG,QAAO;AAEnE,QAAM,iBAAiB,qBAAqB,IAAI,QAAQ,IAAI,mBAAmB,CAAC;AAChF,QAAM,WAAW,iBACZ,eAAe,SAAS,GAAG,IAAI,iBAAiB,GAAG,cAAc,MAClE,IAAI,IAAI,MAAM,EAAE;AACpB,QAAM,OAAO,IAAI,QAAQ,IAAI,MAAM;AACnC,QAAM,gBAAgB,IAAI,QAAQ,IAAI,kBAAkB;AACxD,MAAI,eAAe,UAAU,aAAa,MAAM,OAAQ,QAAO;AAC/D,MAAI,eAAe,UAAU,IAAI,MAAM,OAAQ,QAAO;AAEtD,MAAI,IAAI,aAAa,QAAQ;AAC3B,WAAO,KAAK,+BAA+B,EAAE,QAAQ,MAAM,cAAc,CAAC;AAAA,EAC5E;AACA,SAAO;AACT;AAEO,SAAS,yBACd,OACA,SACoD;AACpD,MAAI,iBAAiB,wBAAwB;AAC3C,WAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,OAAO,yBAAyB,EAAE;AAAA,EAClE;AACA,MAAI,iBAAiB,6BAA6B;AAChD,WAAO,MAAM,qCAAqC,EAAE,OAAO,QAAQ,MAAM,CAAC;AAC1E,WAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,OAAO,QAAQ,cAAc,EAAE;AAAA,EAC/D;AACA,SAAO;AACT;",
+  "sourcesContent": ["import { createLogger } from './logger'\n\nconst logger = createLogger('shared').child({ component: 'origin-check' })\n\nconst DEFAULT_DEV_APP_URL = 'http://localhost:3000'\n\ntype EnvLike = Record<string, string | undefined> & {\n  APP_URL?: string\n  NEXT_PUBLIC_APP_URL?: string\n  APP_ALLOWED_ORIGINS?: string\n  NODE_ENV?: string\n}\ntype RequestInput = Request | string | undefined\n\nexport type SecurityEmailUrlErrorMapping = {\n  scope: string\n  configMessage: string\n}\n\nexport class AppOriginConfigurationError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'AppOriginConfigurationError'\n  }\n}\n\nexport class AppOriginRejectedError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'AppOriginRejectedError'\n  }\n}\n\nfunction parseBaseUrl(raw: string | undefined): URL | null {\n  const value = raw?.trim()\n  if (!value) return null\n  try {\n    const url = new URL(value)\n    url.hash = ''\n    url.search = ''\n    return url\n  } catch {\n    return null\n  }\n}\n\nfunction normalizeBaseUrl(raw: string | undefined): string | null {\n  const url = parseBaseUrl(raw)\n  return url ? url.toString().replace(/\\/$/, '') : null\n}\n\nfunction normalizeOrigin(raw: string | undefined): string | null {\n  const url = parseBaseUrl(raw)\n  return url ? url.origin : null\n}\n\nfunction readCsv(value: string | undefined): string[] {\n  return (value ?? '')\n    .split(',')\n    .map((item) => item.trim())\n    .filter((item) => item.length > 0)\n}\n\nfunction readAllowedOrigins(env: EnvLike): Set<string> {\n  const origins = new Set<string>()\n  for (const raw of [env.APP_URL, env.NEXT_PUBLIC_APP_URL, ...readCsv(env.APP_ALLOWED_ORIGINS)]) {\n    const origin = normalizeOrigin(raw)\n    if (origin) origins.add(origin)\n  }\n  return origins\n}\n\nexport function readConfiguredAppOrigins(env: EnvLike = process.env): string[] {\n  return Array.from(readAllowedOrigins(env))\n}\n\nfunction readFirstHeaderValue(value: string | null): string | null {\n  const first = value?.split(',')[0]?.trim()\n  return first && first.length > 0 ? first : null\n}\n\nfunction originFromHost(protocol: string, rawHost: string | null): string | null {\n  const host = readFirstHeaderValue(rawHost)\n  if (!host) return null\n  return normalizeOrigin(`${protocol}//${host}`)\n}\n\ntype RequestOriginCandidates = {\n  urlOrigin: string | null\n  headerOrigins: Set<string>\n}\n\nfunction readRequestOriginCandidates(input: RequestInput): RequestOriginCandidates {\n  const candidates: RequestOriginCandidates = {\n    urlOrigin: null,\n    headerOrigins: new Set<string>(),\n  }\n  if (!input) return candidates\n\n  const requestUrl = typeof input === 'string' ? input : input.url\n  let parsedUrl: URL\n  try {\n    parsedUrl = new URL(requestUrl)\n  } catch {\n    return candidates\n  }\n\n  candidates.urlOrigin = normalizeOrigin(parsedUrl.origin)\n  if (typeof input === 'string') return candidates\n\n  const forwardedProto = readFirstHeaderValue(input.headers.get('x-forwarded-proto')) ?? parsedUrl.protocol.replace(/:$/, '')\n  const protocol = forwardedProto.endsWith(':') ? forwardedProto : `${forwardedProto}:`\n  const hostOrigin = originFromHost(protocol, input.headers.get('host'))\n  const forwardedHostOrigin = originFromHost(protocol, input.headers.get('x-forwarded-host'))\n  if (hostOrigin) candidates.headerOrigins.add(hostOrigin)\n  if (forwardedHostOrigin) candidates.headerOrigins.add(forwardedHostOrigin)\n  return candidates\n}\n\nfunction requestOrigins(input: RequestInput): Set<string> {\n  const origins = new Set<string>()\n  const { urlOrigin, headerOrigins } = readRequestOriginCandidates(input)\n  if (urlOrigin) origins.add(urlOrigin)\n  for (const origin of headerOrigins) origins.add(origin)\n  return origins\n}\n\nfunction logOriginDebugContext(\n  input: RequestInput,\n  allowedOrigins: Set<string>,\n  rejectedOrigin?: string,\n  level: 'error' | 'warn' = 'error',\n  nodeEnv?: string,\n): void {\n  if (level === 'warn' && nodeEnv === 'test') return\n  const log = (msg: string, fields: Record<string, unknown>) =>\n    level === 'warn' ? logger.warn(msg, fields) : logger.error(msg, fields)\n\n  if (typeof input === 'string') {\n    log('Origin check rejected string input', {\n      requestUrl: input,\n      rejectedOrigin: rejectedOrigin ?? null,\n      allowedOrigins: Array.from(allowedOrigins),\n    })\n    return\n  }\n\n  if (!input) {\n    log('Origin check rejected empty input', {\n      rejectedOrigin: rejectedOrigin ?? null,\n      allowedOrigins: Array.from(allowedOrigins),\n    })\n    return\n  }\n\n  log('Origin check rejected request', {\n    requestUrl: input.url,\n    host: input.headers.get('host'),\n    forwardedHost: input.headers.get('x-forwarded-host'),\n    forwardedProto: input.headers.get('x-forwarded-proto'),\n    derivedOrigins: Array.from(requestOrigins(input)),\n    rejectedOrigin: rejectedOrigin ?? null,\n    allowedOrigins: Array.from(allowedOrigins),\n  })\n}\n\nfunction isLoopbackHostname(hostname: string): boolean {\n  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1'\n}\n\nfunction isLoopbackOrigin(origin: string): boolean {\n  try {\n    return isLoopbackHostname(new URL(origin).hostname)\n  } catch {\n    return false\n  }\n}\n\nfunction normalizeOriginPort(url: URL): string {\n  if (url.port) return url.port\n  if (url.protocol === 'https:') return '443'\n  if (url.protocol === 'http:') return '80'\n  return ''\n}\n\nexport function isEquivalentLoopbackOrigin(\n  origin: string,\n  allowedOrigin: string,\n  options: { requireSameProtocol?: boolean } = {},\n): boolean {\n  try {\n    const candidateUrl = new URL(origin)\n    const allowedUrl = new URL(allowedOrigin)\n    if (!isLoopbackHostname(candidateUrl.hostname) || !isLoopbackHostname(allowedUrl.hostname)) {\n      return false\n    }\n    if (options.requireSameProtocol && candidateUrl.protocol !== allowedUrl.protocol) {\n      return false\n    }\n    return normalizeOriginPort(candidateUrl) === normalizeOriginPort(allowedUrl)\n  } catch {\n    return false\n  }\n}\n\nfunction shouldAllowLoopbackOrigin(origin: string, allowedOrigins: Set<string>, env: EnvLike): boolean {\n  if (!isLoopbackOrigin(origin)) return false\n  for (const allowedOrigin of allowedOrigins) {\n    if (!isLoopbackOrigin(allowedOrigin)) continue\n    if (env.NODE_ENV !== 'production') return true\n    if (isEquivalentLoopbackOrigin(origin, allowedOrigin)) return true\n  }\n  return false\n}\n\nexport function assertAllowedAppOrigin(input: RequestInput, env: EnvLike = process.env): void {\n  const allowedOrigins = readAllowedOrigins(env)\n  if (allowedOrigins.size === 0) {\n    if (env.NODE_ENV === 'production') {\n      logOriginDebugContext(input, allowedOrigins)\n      throw new AppOriginConfigurationError('APP_URL must be configured in production')\n    }\n    return\n  }\n  const { urlOrigin, headerOrigins } = readRequestOriginCandidates(input)\n  const hasAllowedHeaderOrigin = Array.from(headerOrigins).some((origin) => allowedOrigins.has(origin))\n\n  for (const origin of headerOrigins) {\n    if (allowedOrigins.has(origin)) continue\n    if (shouldAllowLoopbackOrigin(origin, allowedOrigins, env)) continue\n    logOriginDebugContext(input, allowedOrigins, origin, 'warn', env.NODE_ENV)\n    throw new AppOriginRejectedError('Request origin is not allowed')\n  }\n\n  if (!urlOrigin) return\n  if (allowedOrigins.has(urlOrigin)) return\n  if (shouldAllowLoopbackOrigin(urlOrigin, allowedOrigins, env)) return\n  if (isLoopbackOrigin(urlOrigin) && hasAllowedHeaderOrigin) return\n\n  logOriginDebugContext(input, allowedOrigins, urlOrigin, 'warn', env.NODE_ENV)\n  throw new AppOriginRejectedError('Request origin is not allowed')\n}\n\nexport function resolveRequestOrigin(req: Request): string {\n  const url = new URL(req.url)\n  const proto = req.headers.get('x-forwarded-proto') || url.protocol.replace(':', '')\n  const host = req.headers.get('x-forwarded-host') || req.headers.get('host') || url.host\n  return `${proto}://${host}`\n}\n\nexport function getAppBaseUrl(req: Request): string {\n  return (\n    process.env.NEXT_PUBLIC_APP_URL ||\n    process.env.APP_URL ||\n    resolveRequestOrigin(req)\n  )\n}\n\nexport function toAbsoluteUrl(req: Request, path: string): string {\n  return new URL(path, getAppBaseUrl(req)).toString()\n}\n\nexport function getSecurityEmailBaseUrl(input?: RequestInput, env: EnvLike = process.env): string {\n  const configuredAppUrl = normalizeBaseUrl(env.APP_URL)\n  if (!configuredAppUrl) {\n    if (env.NODE_ENV === 'production') {\n      throw new AppOriginConfigurationError('APP_URL must be configured in production')\n    }\n    return DEFAULT_DEV_APP_URL\n  }\n\n  assertAllowedAppOrigin(input, env)\n  return configuredAppUrl\n}\n\nexport function toSecurityEmailUrl(input: RequestInput, path: string, env: EnvLike = process.env): string {\n  const base = getSecurityEmailBaseUrl(input, env)\n  return `${base}/${path.replace(/^\\/+/, '')}`\n}\n\nexport function isCrossSiteBrowserRequest(req: Request, env: EnvLike = process.env): boolean {\n  const rawFetchSite = req.headers.get('sec-fetch-site')\n  const fetchSite = rawFetchSite?.trim().toLowerCase() ?? null\n  if (fetchSite === 'cross-site') return true\n  if (fetchSite === 'same-origin' || fetchSite === 'none') return false\n\n  const rawOrigin = req.headers.get('origin')\n  if (rawOrigin === null) return rawFetchSite !== null\n  const origin = normalizeOrigin(rawOrigin)\n  if (!origin) return true\n\n  const allowedOrigins = readAllowedOrigins(env)\n  if (allowedOrigins.has(origin)) return false\n  if (shouldAllowLoopbackOrigin(origin, allowedOrigins, env)) return false\n\n  const forwardedProto = readFirstHeaderValue(req.headers.get('x-forwarded-proto'))\n  const protocol = forwardedProto\n    ? (forwardedProto.endsWith(':') ? forwardedProto : `${forwardedProto}:`)\n    : new URL(origin).protocol\n  const host = req.headers.get('host')\n  const forwardedHost = req.headers.get('x-forwarded-host')\n  if (originFromHost(protocol, forwardedHost) === origin) return false\n  if (originFromHost(protocol, host) === origin) return false\n\n  if (env.NODE_ENV !== 'test') {\n    logger.warn('Cross-site request rejected', { origin, host, forwardedHost })\n  }\n  return true\n}\n\nexport function mapSecurityEmailUrlError(\n  error: unknown,\n  mapping: SecurityEmailUrlErrorMapping,\n): { status: number; body: { error: string } } | null {\n  if (error instanceof AppOriginRejectedError) {\n    return { status: 400, body: { error: 'Invalid request origin' } }\n  }\n  if (error instanceof AppOriginConfigurationError) {\n    logger.error('APP_URL is required in production', { scope: mapping.scope })\n    return { status: 500, body: { error: mapping.configMessage } }\n  }\n  return null\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,eAAe,CAAC;AAEzE,MAAM,sBAAsB;AAerB,MAAM,oCAAoC,MAAM;AAAA,EACrD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,+BAA+B,MAAM;AAAA,EAChD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,aAAa,KAAqC;AACzD,QAAM,QAAQ,KAAK,KAAK;AACxB,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,QAAI,OAAO;AACX,QAAI,SAAS;AACb,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,iBAAiB,KAAwC;AAChE,QAAM,MAAM,aAAa,GAAG;AAC5B,SAAO,MAAM,IAAI,SAAS,EAAE,QAAQ,OAAO,EAAE,IAAI;AACnD;AAEA,SAAS,gBAAgB,KAAwC;AAC/D,QAAM,MAAM,aAAa,GAAG;AAC5B,SAAO,MAAM,IAAI,SAAS;AAC5B;AAEA,SAAS,QAAQ,OAAqC;AACpD,UAAQ,SAAS,IACd,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC;AACrC;AAEA,SAAS,mBAAmB,KAA2B;AACrD,QAAM,UAAU,oBAAI,IAAY;AAChC,aAAW,OAAO,CAAC,IAAI,SAAS,IAAI,qBAAqB,GAAG,QAAQ,IAAI,mBAAmB,CAAC,GAAG;AAC7F,UAAM,SAAS,gBAAgB,GAAG;AAClC,QAAI,OAAQ,SAAQ,IAAI,MAAM;AAAA,EAChC;AACA,SAAO;AACT;AAEO,SAAS,yBAAyB,MAAe,QAAQ,KAAe;AAC7E,SAAO,MAAM,KAAK,mBAAmB,GAAG,CAAC;AAC3C;AAEA,SAAS,qBAAqB,OAAqC;AACjE,QAAM,QAAQ,OAAO,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AACzC,SAAO,SAAS,MAAM,SAAS,IAAI,QAAQ;AAC7C;AAEA,SAAS,eAAe,UAAkB,SAAuC;AAC/E,QAAM,OAAO,qBAAqB,OAAO;AACzC,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,gBAAgB,GAAG,QAAQ,KAAK,IAAI,EAAE;AAC/C;AAOA,SAAS,4BAA4B,OAA8C;AACjF,QAAM,aAAsC;AAAA,IAC1C,WAAW;AAAA,IACX,eAAe,oBAAI,IAAY;AAAA,EACjC;AACA,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,aAAa,OAAO,UAAU,WAAW,QAAQ,MAAM;AAC7D,MAAI;AACJ,MAAI;AACF,gBAAY,IAAI,IAAI,UAAU;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,aAAW,YAAY,gBAAgB,UAAU,MAAM;AACvD,MAAI,OAAO,UAAU,SAAU,QAAO;AAEtC,QAAM,iBAAiB,qBAAqB,MAAM,QAAQ,IAAI,mBAAmB,CAAC,KAAK,UAAU,SAAS,QAAQ,MAAM,EAAE;AAC1H,QAAM,WAAW,eAAe,SAAS,GAAG,IAAI,iBAAiB,GAAG,cAAc;AAClF,QAAM,aAAa,eAAe,UAAU,MAAM,QAAQ,IAAI,MAAM,CAAC;AACrE,QAAM,sBAAsB,eAAe,UAAU,MAAM,QAAQ,IAAI,kBAAkB,CAAC;AAC1F,MAAI,WAAY,YAAW,cAAc,IAAI,UAAU;AACvD,MAAI,oBAAqB,YAAW,cAAc,IAAI,mBAAmB;AACzE,SAAO;AACT;AAEA,SAAS,eAAe,OAAkC;AACxD,QAAM,UAAU,oBAAI,IAAY;AAChC,QAAM,EAAE,WAAW,cAAc,IAAI,4BAA4B,KAAK;AACtE,MAAI,UAAW,SAAQ,IAAI,SAAS;AACpC,aAAW,UAAU,cAAe,SAAQ,IAAI,MAAM;AACtD,SAAO;AACT;AAEA,SAAS,sBACP,OACA,gBACA,gBACA,QAA0B,SAC1B,SACM;AACN,MAAI,UAAU,UAAU,YAAY,OAAQ;AAC5C,QAAM,MAAM,CAAC,KAAa,WACxB,UAAU,SAAS,OAAO,KAAK,KAAK,MAAM,IAAI,OAAO,MAAM,KAAK,MAAM;AAExE,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,sCAAsC;AAAA,MACxC,YAAY;AAAA,MACZ,gBAAgB,kBAAkB;AAAA,MAClC,gBAAgB,MAAM,KAAK,cAAc;AAAA,IAC3C,CAAC;AACD;AAAA,EACF;AAEA,MAAI,CAAC,OAAO;AACV,QAAI,qCAAqC;AAAA,MACvC,gBAAgB,kBAAkB;AAAA,MAClC,gBAAgB,MAAM,KAAK,cAAc;AAAA,IAC3C,CAAC;AACD;AAAA,EACF;AAEA,MAAI,iCAAiC;AAAA,IACnC,YAAY,MAAM;AAAA,IAClB,MAAM,MAAM,QAAQ,IAAI,MAAM;AAAA,IAC9B,eAAe,MAAM,QAAQ,IAAI,kBAAkB;AAAA,IACnD,gBAAgB,MAAM,QAAQ,IAAI,mBAAmB;AAAA,IACrD,gBAAgB,MAAM,KAAK,eAAe,KAAK,CAAC;AAAA,IAChD,gBAAgB,kBAAkB;AAAA,IAClC,gBAAgB,MAAM,KAAK,cAAc;AAAA,EAC3C,CAAC;AACH;AAEA,SAAS,mBAAmB,UAA2B;AACrD,SAAO,aAAa,eAAe,aAAa,eAAe,aAAa;AAC9E;AAEA,SAAS,iBAAiB,QAAyB;AACjD,MAAI;AACF,WAAO,mBAAmB,IAAI,IAAI,MAAM,EAAE,QAAQ;AAAA,EACpD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,oBAAoB,KAAkB;AAC7C,MAAI,IAAI,KAAM,QAAO,IAAI;AACzB,MAAI,IAAI,aAAa,SAAU,QAAO;AACtC,MAAI,IAAI,aAAa,QAAS,QAAO;AACrC,SAAO;AACT;AAEO,SAAS,2BACd,QACA,eACA,UAA6C,CAAC,GACrC;AACT,MAAI;AACF,UAAM,eAAe,IAAI,IAAI,MAAM;AACnC,UAAM,aAAa,IAAI,IAAI,aAAa;AACxC,QAAI,CAAC,mBAAmB,aAAa,QAAQ,KAAK,CAAC,mBAAmB,WAAW,QAAQ,GAAG;AAC1F,aAAO;AAAA,IACT;AACA,QAAI,QAAQ,uBAAuB,aAAa,aAAa,WAAW,UAAU;AAChF,aAAO;AAAA,IACT;AACA,WAAO,oBAAoB,YAAY,MAAM,oBAAoB,UAAU;AAAA,EAC7E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,0BAA0B,QAAgB,gBAA6B,KAAuB;AACrG,MAAI,CAAC,iBAAiB,MAAM,EAAG,QAAO;AACtC,aAAW,iBAAiB,gBAAgB;AAC1C,QAAI,CAAC,iBAAiB,aAAa,EAAG;AACtC,QAAI,IAAI,aAAa,aAAc,QAAO;AAC1C,QAAI,2BAA2B,QAAQ,aAAa,EAAG,QAAO;AAAA,EAChE;AACA,SAAO;AACT;AAEO,SAAS,uBAAuB,OAAqB,MAAe,QAAQ,KAAW;AAC5F,QAAM,iBAAiB,mBAAmB,GAAG;AAC7C,MAAI,eAAe,SAAS,GAAG;AAC7B,QAAI,IAAI,aAAa,cAAc;AACjC,4BAAsB,OAAO,cAAc;AAC3C,YAAM,IAAI,4BAA4B,0CAA0C;AAAA,IAClF;AACA;AAAA,EACF;AACA,QAAM,EAAE,WAAW,cAAc,IAAI,4BAA4B,KAAK;AACtE,QAAM,yBAAyB,MAAM,KAAK,aAAa,EAAE,KAAK,CAAC,WAAW,eAAe,IAAI,MAAM,CAAC;AAEpG,aAAW,UAAU,eAAe;AAClC,QAAI,eAAe,IAAI,MAAM,EAAG;AAChC,QAAI,0BAA0B,QAAQ,gBAAgB,GAAG,EAAG;AAC5D,0BAAsB,OAAO,gBAAgB,QAAQ,QAAQ,IAAI,QAAQ;AACzE,UAAM,IAAI,uBAAuB,+BAA+B;AAAA,EAClE;AAEA,MAAI,CAAC,UAAW;AAChB,MAAI,eAAe,IAAI,SAAS,EAAG;AACnC,MAAI,0BAA0B,WAAW,gBAAgB,GAAG,EAAG;AAC/D,MAAI,iBAAiB,SAAS,KAAK,uBAAwB;AAE3D,wBAAsB,OAAO,gBAAgB,WAAW,QAAQ,IAAI,QAAQ;AAC5E,QAAM,IAAI,uBAAuB,+BAA+B;AAClE;AAEO,SAAS,qBAAqB,KAAsB;AACzD,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,QAAQ,IAAI,QAAQ,IAAI,mBAAmB,KAAK,IAAI,SAAS,QAAQ,KAAK,EAAE;AAClF,QAAM,OAAO,IAAI,QAAQ,IAAI,kBAAkB,KAAK,IAAI,QAAQ,IAAI,MAAM,KAAK,IAAI;AACnF,SAAO,GAAG,KAAK,MAAM,IAAI;AAC3B;AAEO,SAAS,cAAc,KAAsB;AAClD,SACE,QAAQ,IAAI,uBACZ,QAAQ,IAAI,WACZ,qBAAqB,GAAG;AAE5B;AAEO,SAAS,cAAc,KAAc,MAAsB;AAChE,SAAO,IAAI,IAAI,MAAM,cAAc,GAAG,CAAC,EAAE,SAAS;AACpD;AAEO,SAAS,wBAAwB,OAAsB,MAAe,QAAQ,KAAa;AAChG,QAAM,mBAAmB,iBAAiB,IAAI,OAAO;AACrD,MAAI,CAAC,kBAAkB;AACrB,QAAI,IAAI,aAAa,cAAc;AACjC,YAAM,IAAI,4BAA4B,0CAA0C;AAAA,IAClF;AACA,WAAO;AAAA,EACT;AAEA,yBAAuB,OAAO,GAAG;AACjC,SAAO;AACT;AAEO,SAAS,mBAAmB,OAAqB,MAAc,MAAe,QAAQ,KAAa;AACxG,QAAM,OAAO,wBAAwB,OAAO,GAAG;AAC/C,SAAO,GAAG,IAAI,IAAI,KAAK,QAAQ,QAAQ,EAAE,CAAC;AAC5C;AAEO,SAAS,0BAA0B,KAAc,MAAe,QAAQ,KAAc;AAC3F,QAAM,eAAe,IAAI,QAAQ,IAAI,gBAAgB;AACrD,QAAM,YAAY,cAAc,KAAK,EAAE,YAAY,KAAK;AACxD,MAAI,cAAc,aAAc,QAAO;AACvC,MAAI,cAAc,iBAAiB,cAAc,OAAQ,QAAO;AAEhE,QAAM,YAAY,IAAI,QAAQ,IAAI,QAAQ;AAC1C,MAAI,cAAc,KAAM,QAAO,iBAAiB;AAChD,QAAM,SAAS,gBAAgB,SAAS;AACxC,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,iBAAiB,mBAAmB,GAAG;AAC7C,MAAI,eAAe,IAAI,MAAM,EAAG,QAAO;AACvC,MAAI,0BAA0B,QAAQ,gBAAgB,GAAG,EAAG,QAAO;AAEnE,QAAM,iBAAiB,qBAAqB,IAAI,QAAQ,IAAI,mBAAmB,CAAC;AAChF,QAAM,WAAW,iBACZ,eAAe,SAAS,GAAG,IAAI,iBAAiB,GAAG,cAAc,MAClE,IAAI,IAAI,MAAM,EAAE;AACpB,QAAM,OAAO,IAAI,QAAQ,IAAI,MAAM;AACnC,QAAM,gBAAgB,IAAI,QAAQ,IAAI,kBAAkB;AACxD,MAAI,eAAe,UAAU,aAAa,MAAM,OAAQ,QAAO;AAC/D,MAAI,eAAe,UAAU,IAAI,MAAM,OAAQ,QAAO;AAEtD,MAAI,IAAI,aAAa,QAAQ;AAC3B,WAAO,KAAK,+BAA+B,EAAE,QAAQ,MAAM,cAAc,CAAC;AAAA,EAC5E;AACA,SAAO;AACT;AAEO,SAAS,yBACd,OACA,SACoD;AACpD,MAAI,iBAAiB,wBAAwB;AAC3C,WAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,OAAO,yBAAyB,EAAE;AAAA,EAClE;AACA,MAAI,iBAAiB,6BAA6B;AAChD,WAAO,MAAM,qCAAqC,EAAE,OAAO,QAAQ,MAAM,CAAC;AAC1E,WAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,OAAO,QAAQ,cAAc,EAAE;AAAA,EAC/D;AACA,SAAO;AACT;",
   "names": []
 }

package/dist/lib/version.js

@@ -1,4 +1,4 @@
-const APP_VERSION = "0.10.1-develop.7584.1.99e06e1062";
+const APP_VERSION = "0.10.1-develop.7597.1.3d700f2421";
 const appVersion = APP_VERSION;
 export {
   APP_VERSION,

package/dist/lib/version.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/version.ts"],
-  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.10.1-develop.7584.1.99e06e1062';\nexport const appVersion = APP_VERSION;\n"],
+  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.10.1-develop.7597.1.3d700f2421';\nexport const appVersion = APP_VERSION;\n"],
   "mappings": "AACO,MAAM,cAAc;AACpB,MAAM,aAAa;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/shared",
-  "version": "0.10.1-develop.7584.1.99e06e1062",
+  "version": "0.10.1-develop.7597.1.3d700f2421",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -126,7 +126,7 @@
     "@mikro-orm/core": "^7.1.14",
     "@mikro-orm/decorators": "^7.1.14",
     "@mikro-orm/postgresql": "^7.1.14",
-    "@open-mercato/cache": "0.10.1-develop.7584.1.99e06e1062",
+    "@open-mercato/cache": "0.10.1-develop.7597.1.3d700f2421",
     "@types/html-to-text": "^9.0.4",
     "@types/sanitize-html": "^2.16.1",
     "dotenv": "^17.4.2",

package/src/lib/__tests__/url.test.ts

@@ -4,6 +4,8 @@ import {
   assertAllowedAppOrigin,
   getAppBaseUrl,
   getSecurityEmailBaseUrl,
+  isEquivalentLoopbackOrigin,
+  readConfiguredAppOrigins,
   resolveRequestOrigin,
   toAbsoluteUrl,
   toSecurityEmailUrl,
@@ -265,3 +267,42 @@ describe('toAbsoluteUrl', () => {
     expect(toAbsoluteUrl(req, '/reset/token123')).toBe('https://app.example.com/reset/token123')
   })
 })
+
+describe('isEquivalentLoopbackOrigin', () => {
+  it('treats mismatched loopback hostnames on the same scheme and port as equivalent by default', () => {
+    expect(isEquivalentLoopbackOrigin('http://127.0.0.1:3000', 'http://localhost:3000')).toBe(true)
+  })
+
+  it('ignores a scheme mismatch by default (TLS-terminating proxy tolerance)', () => {
+    expect(isEquivalentLoopbackOrigin('https://127.0.0.1:3000', 'http://127.0.0.1:3000')).toBe(true)
+  })
+
+  it('rejects a scheme mismatch when requireSameProtocol is set', () => {
+    expect(
+      isEquivalentLoopbackOrigin('https://127.0.0.1:3000', 'http://127.0.0.1:3000', { requireSameProtocol: true }),
+    ).toBe(false)
+  })
+
+  it('still allows matching schemes when requireSameProtocol is set', () => {
+    expect(
+      isEquivalentLoopbackOrigin('http://127.0.0.1:3000', 'http://localhost:3000', { requireSameProtocol: true }),
+    ).toBe(true)
+  })
+})
+
+describe('readConfiguredAppOrigins', () => {
+  it('collects APP_URL, NEXT_PUBLIC_APP_URL and APP_ALLOWED_ORIGINS as de-duplicated origins', () => {
+    expect(
+      readConfiguredAppOrigins({
+        APP_URL: 'https://quotes.example.com/base/',
+        NEXT_PUBLIC_APP_URL: 'https://app.example.com',
+        APP_ALLOWED_ORIGINS: 'https://shop.example.com, https://app.example.com',
+      }),
+    ).toEqual(['https://quotes.example.com', 'https://app.example.com', 'https://shop.example.com'])
+  })
+
+  it('skips malformed values and returns an empty list when nothing is configured', () => {
+    expect(readConfiguredAppOrigins({ APP_URL: 'not a url' })).toEqual([])
+    expect(readConfiguredAppOrigins({})).toEqual([])
+  })
+})

package/src/lib/crud/__tests__/ids.test.ts

@@ -90,22 +90,24 @@ describe('crud ids helpers', () => {
     })
   })
 
-  it('mergeIdFilter preserves existing filter for unknown filter shape (fail closed)', () => {
-    // Regression: previously the unrecognised shape was silently discarded and
-    // replaced with `{ id: { $in: parsedIds } }`, widening access. The contract
-    // is "intersect with existing id filters — never widen" — so unknown shapes
-    // must degrade closed.
+  it('mergeIdFilter AND-combines an unknown filter shape with parsedIds (fail closed, never dropped)', () => {
+    // Regression for #7641: an earlier fix made the unrecognised shape fail
+    // closed by discarding `parsedIds` and keeping only the existing filter —
+    // but `parsedIds` can itself be server-supplied narrowing (an
+    // interceptor's `before` hook setting `query.ids`), so dropping it
+    // silently disabled that narrowing. Both constraints must survive via
+    // `$and` — this neither widens (still an AND) nor drops either side.
     expect(
       mergeIdFilter({ id: { $ne: idA } as any }, [idA, idB]),
-    ).toEqual({ id: { $ne: idA } })
+    ).toEqual({ $and: [{ id: { $ne: idA } }, { id: { $in: [idA, idB] } }] })
   })
 
-  it('mergeIdFilter preserves existing $eq with unsupported value (fail closed)', () => {
-    // An `$eq` with a non-UUID payload is also an unrecognised narrowing — we
-    // must not drop it and substitute `parsedIds`.
+  it('mergeIdFilter AND-combines an unsupported $eq value with parsedIds (fail closed, never dropped)', () => {
+    // An `$eq` with a non-UUID payload is also an unrecognised narrowing — it
+    // must survive alongside `parsedIds`, not be replaced or dropped.
     expect(
       mergeIdFilter({ id: { $eq: 'not-a-uuid' } as any }, [idA]),
-    ).toEqual({ id: { $eq: 'not-a-uuid' } })
+    ).toEqual({ $and: [{ id: { $eq: 'not-a-uuid' } }, { id: { $in: [idA] } }] })
   })
 
   it('mergeIdFilter treats undefined/null id as no existing narrowing', () => {

package/src/lib/crud/ids.ts

@@ -111,11 +111,14 @@ export function mergeIdFilter<Fields extends Record<string, unknown>>(
     if (existingFilter === undefined || existingFilter === null) {
       return { ...existingFilters, id: { $in: parsedIds } }
     }
-    // Existing `id` filter is in a shape we do not recognise. Fail closed:
-    // preserve the existing filter instead of widening to `parsedIds`. Adding
-    // a new recognised shape to `readExistingIds` is preferable to silently
-    // dropping a narrowing that another caller put in place.
-    return existingFilters
+    // Existing `id` filter is in a shape we do not recognise. Fail closed by
+    // ANDing both constraints rather than dropping either: `parsedIds` may be
+    // server-supplied narrowing (an interceptor's `before` hook setting
+    // `query.ids`), so discarding it to "preserve" an unrecognised caller
+    // filter would silently disable that narrowing (#7641). Adding a new
+    // recognised shape to `readExistingIds` remains preferable when the
+    // shapes can be intersected directly.
+    return { $and: [existingFilters, { id: { $in: parsedIds } }] } as Where<Fields>
   }
 
   const allowed = new Set(parsedIds)

package/src/lib/url.ts

@@ -70,6 +70,10 @@ function readAllowedOrigins(env: EnvLike): Set<string> {
   return origins
 }
 
+export function readConfiguredAppOrigins(env: EnvLike = process.env): string[] {
+  return Array.from(readAllowedOrigins(env))
+}
+
 function readFirstHeaderValue(value: string | null): string | null {
   const first = value?.split(',')[0]?.trim()
   return first && first.length > 0 ? first : null
@@ -179,13 +183,20 @@ function normalizeOriginPort(url: URL): string {
   return ''
 }
 
-function isEquivalentLoopbackOrigin(origin: string, allowedOrigin: string): boolean {
+export function isEquivalentLoopbackOrigin(
+  origin: string,
+  allowedOrigin: string,
+  options: { requireSameProtocol?: boolean } = {},
+): boolean {
   try {
     const candidateUrl = new URL(origin)
     const allowedUrl = new URL(allowedOrigin)
     if (!isLoopbackHostname(candidateUrl.hostname) || !isLoopbackHostname(allowedUrl.hostname)) {
       return false
     }
+    if (options.requireSameProtocol && candidateUrl.protocol !== allowedUrl.protocol) {
+      return false
+    }
     return normalizeOriginPort(candidateUrl) === normalizeOriginPort(allowedUrl)
   } catch {
     return false