@prenta/core 0.118.0

package/dist/security/center/types.d.ts

@@ -0,0 +1,142 @@
+/**
+ * Security Center types.
+ *
+ * The Security Center answers one question for an operator: "is this CMS safe
+ * to run in production?" It is mostly a *computed posture* surface — it reads
+ * real auth/session/secret/audit state — plus a small set of genuinely
+ * enforced, persisted policy settings (MFA requirement, concurrent-session
+ * cap). Anything that is not actually enforced is reported as honest status
+ * with a source badge, never as a decorative toggle.
+ */
+export type SecurityStatusLevel = 'secure' | 'needs_attention' | 'at_risk' | 'unknown';
+export type CheckStatus = 'pass' | 'warning' | 'fail' | 'unknown';
+export interface SecurityCheck {
+    key: string;
+    label: string;
+    status: CheckStatus;
+    /** Short human value, e.g. "3 of 4 admins" or "Enabled". */
+    value?: string;
+    /** In-admin deep link the operator can follow to act on this check. */
+    actionHref?: string;
+}
+export type SecurityWarningCategory = 'auth' | 'sessions' | 'api_keys' | 'uploads' | 'rate_limit' | 'audit' | 'secrets' | 'access';
+export interface SecurityWarning {
+    id: string;
+    severity: 'critical' | 'warning' | 'info';
+    category: SecurityWarningCategory;
+    title: string;
+    description: string;
+    actionLabel?: string;
+    actionHref?: string;
+}
+export interface SecurityStatus {
+    status: SecurityStatusLevel;
+    /** 0–100 posture score (advisory; the level is the source of truth). */
+    score: number;
+    label: string;
+    description: string;
+    checks: SecurityCheck[];
+    warnings: SecurityWarning[];
+    lastCheckedAt: string;
+}
+/** Persisted, enforced MFA policy. */
+export interface MfaSettings {
+    required: boolean;
+    gracePeriodDays: number;
+    /** ISO timestamp when `required` was last switched on (drives the grace window). */
+    requiredAt?: string;
+}
+/** Persisted, enforced session policy. `maxConcurrentSessions = 0` ⇒ unlimited. */
+export interface SessionSettings {
+    maxConcurrentSessions: number;
+    /** Session lifetime in hours (1 | 8 | 24 | 168). Login mints JWT + row expiry from this. */
+    timeoutHours: number;
+    /** When true, the admin client signs the user out after `timeoutHours` of inactivity. */
+    idleLogoutEnabled: boolean;
+}
+/** Persisted, enforced access-control policy. */
+export interface AccessSettings {
+    /** IP/CIDR entries merged with the config `admin.ipAllowlist` (union) at enforcement time. */
+    ipAllowlist: string[];
+    /** When false, `logEvent()` no-ops except for security-critical events. Default true. */
+    auditLoggingEnabled: boolean;
+}
+export interface SecuritySettings {
+    mfa: MfaSettings;
+    session: SessionSettings;
+    access: AccessSettings;
+    updatedAt?: string;
+    updatedBy?: string;
+}
+export interface UsersSecuritySummary {
+    totalUsers: number;
+    totalAdmins: number;
+    withMfa: number;
+    withoutMfa: number;
+    adminsWithoutMfa: number;
+    inactive: number;
+}
+export interface ApiKeysSecuritySummary {
+    active: number;
+    withoutExpiration: number;
+    broadScope: number;
+    staleUnused90d: number;
+}
+/** Status of secrets/encryption — never the values themselves. */
+export interface SecretsStatus {
+    cmsSecret: CheckStatus;
+    encryptionKey: CheckStatus;
+    rateLimitBackend: 'distributed' | 'in_memory';
+    apiKeysHashed: boolean;
+    webhookSecretsEncrypted: boolean;
+}
+export interface IpAllowlistStatus {
+    enabled: boolean;
+    source: 'config' | 'database' | 'mixed' | 'none';
+    /** Effective enforced ranges — the union of config + database entries. */
+    ranges: string[];
+    /** Ranges provided by `admin.ipAllowlist` in prenta.config.ts (read-only). */
+    configRanges: string[];
+    currentIp: string | null;
+    currentIpAllowed: boolean | null;
+}
+export interface SecuritySourceMetadata {
+    source: 'config' | 'environment' | 'database' | 'plugin' | 'computed';
+    editable: boolean;
+    reason?: string;
+}
+/** Everything the admin Security tab needs in one round-trip. */
+export interface SecurityCenterData {
+    settings: SecuritySettings;
+    status: SecurityStatus;
+    users: UsersSecuritySummary;
+    apiKeys: ApiKeysSecuritySummary;
+    secrets: SecretsStatus;
+    ipAllowlist: IpAllowlistStatus;
+    failedLogins24h: number;
+    activeSessions: number;
+    csrfEnabled: boolean;
+    uploadValidation: boolean;
+    auditEnabled: boolean;
+    /** Effective max session age in hours — mirrors `settings.session.timeoutHours`. */
+    sessionMaxAgeHours: number;
+    /** Whether the current admin (the viewer) has TOTP enabled — drives lockout-safe MFA enable. */
+    viewerHasMfa: boolean;
+    environment: string;
+    sources: Record<string, SecuritySourceMetadata>;
+}
+/** Signals consumed by the pure {@link computeSecurityStatus}. */
+export interface SecurityStatusInput {
+    isProduction: boolean;
+    settings: SecuritySettings;
+    users: UsersSecuritySummary;
+    apiKeys: ApiKeysSecuritySummary;
+    secrets: SecretsStatus;
+    ipAllowlist: IpAllowlistStatus;
+    failedLogins24h: number;
+    activeSessions: number;
+    csrfEnabled: boolean;
+    uploadValidation: boolean;
+    auditEnabled: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/security/center/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/security/center/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,iBAAiB,GAAG,SAAS,GAAG,SAAS,CAAA;AACtF,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAA;AAEjE,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,WAAW,CAAA;IACnB,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,MAAM,uBAAuB,GAC/B,MAAM,GACN,UAAU,GACV,UAAU,GACV,SAAS,GACT,YAAY,GACZ,OAAO,GACP,SAAS,GACT,QAAQ,CAAA;AAEZ,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,UAAU,GAAG,SAAS,GAAG,MAAM,CAAA;IACzC,QAAQ,EAAE,uBAAuB,CAAA;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,mBAAmB,CAAA;IAC3B,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,aAAa,EAAE,CAAA;IACvB,QAAQ,EAAE,eAAe,EAAE,CAAA;IAC3B,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,sCAAsC;AACtC,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,OAAO,CAAA;IACjB,eAAe,EAAE,MAAM,CAAA;IACvB,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,mFAAmF;AACnF,MAAM,WAAW,eAAe;IAC9B,qBAAqB,EAAE,MAAM,CAAA;IAC7B,4FAA4F;IAC5F,YAAY,EAAE,MAAM,CAAA;IACpB,yFAAyF;IACzF,iBAAiB,EAAE,OAAO,CAAA;CAC3B;AAED,iDAAiD;AACjD,MAAM,WAAW,cAAc;IAC7B,8FAA8F;IAC9F,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,yFAAyF;IACzF,mBAAmB,EAAE,OAAO,CAAA;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,WAAW,CAAA;IAChB,OAAO,EAAE,eAAe,CAAA;IACxB,MAAM,EAAE,cAAc,CAAA;IACtB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,gBAAgB,EAAE,MAAM,CAAA;IACxB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAA;IACd,iBAAiB,EAAE,MAAM,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,WAAW,CAAA;IACtB,aAAa,EAAE,WAAW,CAAA;IAC1B,gBAAgB,EAAE,aAAa,GAAG,WAAW,CAAA;IAC7C,aAAa,EAAE,OAAO,CAAA;IACtB,uBAAuB,EAAE,OAAO,CAAA;CACjC;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,QAAQ,GAAG,UAAU,GAAG,OAAO,GAAG,MAAM,CAAA;IAChD,0EAA0E;IAC1E,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,8EAA8E;IAC9E,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,gBAAgB,EAAE,OAAO,GAAG,IAAI,CAAA;CACjC;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,QAAQ,GAAG,aAAa,GAAG,UAAU,GAAG,QAAQ,GAAG,UAAU,CAAA;IACrE,QAAQ,EAAE,OAAO,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,MAAM,EAAE,cAAc,CAAA;IACtB,KAAK,EAAE,oBAAoB,CAAA;IAC3B,OAAO,EAAE,sBAAsB,CAAA;IAC/B,OAAO,EAAE,aAAa,CAAA;IACtB,WAAW,EAAE,iBAAiB,CAAA;IAC9B,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,OAAO,CAAA;IACpB,gBAAgB,EAAE,OAAO,CAAA;IACzB,YAAY,EAAE,OAAO,CAAA;IACrB,oFAAoF;IACpF,kBAAkB,EAAE,MAAM,CAAA;IAC1B,gGAAgG;IAChG,YAAY,EAAE,OAAO,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAA;CAChD;AAED,kEAAkE;AAClE,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,OAAO,CAAA;IACrB,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,KAAK,EAAE,oBAAoB,CAAA;IAC3B,OAAO,EAAE,sBAAsB,CAAA;IAC/B,OAAO,EAAE,aAAa,CAAA;IACtB,WAAW,EAAE,iBAAiB,CAAA;IAC9B,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,OAAO,CAAA;IACpB,gBAAgB,EAAE,OAAO,CAAA;IACzB,YAAY,EAAE,OAAO,CAAA;CACtB"}

package/dist/security/center/types.js

@@ -0,0 +1,12 @@
+/**
+ * Security Center types.
+ *
+ * The Security Center answers one question for an operator: "is this CMS safe
+ * to run in production?" It is mostly a *computed posture* surface — it reads
+ * real auth/session/secret/audit state — plus a small set of genuinely
+ * enforced, persisted policy settings (MFA requirement, concurrent-session
+ * cap). Anything that is not actually enforced is reported as honest status
+ * with a source badge, never as a decorative toggle.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/security/center/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/security/center/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/security/client-ip.d.ts

@@ -0,0 +1,23 @@
+export interface TrustedIpOptions {
+    /** When true, fall back to parsing X-Forwarded-For. Defaults to false. */
+    trustProxy?: boolean;
+}
+export declare function getClientIp(request: Request, options?: TrustedIpOptions): string;
+/**
+ * Returns true when the resolved client IP is a real value we can use for
+ * security-sensitive keys (rate limits, IP allowlists). Returns false for the
+ * `'unknown'` sentinel.
+ */
+export declare function isResolvedIp(ip: string): boolean;
+/**
+ * One-way hash of a client IP for storage alongside form submissions.
+ *
+ * We never persist raw IPs — they are PII and a liability. Hashing with the
+ * instance secret as salt lets operators correlate repeat submitters / abuse
+ * within a single deployment while making the stored value useless to anyone
+ * who exfiltrates the table without also having `CMS_SECRET`. Returns `null`
+ * for the `'unknown'` sentinel so callers store SQL NULL rather than a hash of
+ * the literal string `'unknown'`.
+ */
+export declare function hashClientIp(ip: string): string | null;
+//# sourceMappingURL=client-ip.d.ts.map

package/dist/security/client-ip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-ip.d.ts","sourceRoot":"","sources":["../../src/security/client-ip.ts"],"names":[],"mappings":"AA2BA,MAAM,WAAW,gBAAgB;IAC/B,0EAA0E;IAC1E,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAsBD,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,GAAE,gBAAqB,GAAG,MAAM,CA+BpF;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAEhD;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAItD"}

package/dist/security/client-ip.js

@@ -0,0 +1,97 @@
+/**
+ * Trusted client-IP extraction.
+ *
+ * The `X-Forwarded-For` header is fully attacker-controlled when the server is
+ * directly reachable from the Internet — anyone can send `X-Forwarded-For: 1.2.3.4`
+ * to bypass per-IP rate limits and poison audit logs.
+ *
+ * This helper resolves the real client IP using the most trustworthy header
+ * available, in this order:
+ *
+ *   1. Vercel — `x-vercel-forwarded-for` is set by the Vercel edge and cannot
+ *      be spoofed by clients (Vercel strips inbound copies).
+ *   2. Common reverse proxies — `x-real-ip` is typically set by nginx/Caddy
+ *      to the directly-connected client IP.
+ *   3. `x-forwarded-for` — only honoured when the integrator opts in via
+ *      `trustProxy: true`. In that mode we use the **last** entry (closest to
+ *      the proxy) rather than the first (closest to the client / spoofable).
+ *
+ * Returns the literal string `'unknown'` when no trusted source is available;
+ * callers should treat that as a hard failure for security-sensitive decisions.
+ */
+import { createHash } from 'node:crypto';
+import { createLogger } from '../diagnostics/logger.js';
+const logger = createLogger('client-ip');
+const VERCEL_HEADER = 'x-vercel-forwarded-for';
+const REAL_IP_HEADER = 'x-real-ip';
+const FORWARDED_HEADER = 'x-forwarded-for';
+// Warn (once per process) the first time a request's client IP can't be
+// resolved from a trusted source. Without a resolvable IP, per-IP rate limits
+// (login, forgot/reset password) fall back to a shared global bucket. Non-Vercel
+// deployments must set `PRENTA_TRUST_PROXY=1` behind a proxy that appends a
+// trusted `X-Forwarded-For`, or have their proxy set `X-Real-IP`.
+let warnedNoTrustedIpSource = false;
+function warnNoTrustedIpSource() {
+    if (warnedNoTrustedIpSource)
+        return;
+    warnedNoTrustedIpSource = true;
+    logger.warn('No trusted client-IP source — per-IP rate limits are degraded to a shared bucket. ' +
+        'On non-Vercel hosts set PRENTA_TRUST_PROXY=1 behind a proxy that sets a trusted ' +
+        'X-Forwarded-For, or have your proxy set X-Real-IP.');
+}
+export function getClientIp(request, options = {}) {
+    const trustProxy = options.trustProxy ?? process.env.PRENTA_TRUST_PROXY === '1';
+    const vercel = request.headers.get(VERCEL_HEADER);
+    if (vercel) {
+        const first = vercel.split(',')[0]?.trim();
+        if (first)
+            return first;
+    }
+    const realIp = request.headers.get(REAL_IP_HEADER);
+    if (realIp) {
+        const trimmed = realIp.trim();
+        if (trimmed)
+            return trimmed;
+    }
+    if (trustProxy) {
+        const fwd = request.headers.get(FORWARDED_HEADER);
+        if (fwd) {
+            // Use the last entry — that's the IP your trusted proxy itself saw,
+            // not whatever the original client claimed in the chain.
+            const parts = fwd
+                .split(',')
+                .map((p) => p.trim())
+                .filter(Boolean);
+            const last = parts[parts.length - 1];
+            if (last)
+                return last;
+        }
+    }
+    warnNoTrustedIpSource();
+    return 'unknown';
+}
+/**
+ * Returns true when the resolved client IP is a real value we can use for
+ * security-sensitive keys (rate limits, IP allowlists). Returns false for the
+ * `'unknown'` sentinel.
+ */
+export function isResolvedIp(ip) {
+    return ip !== 'unknown' && ip.length > 0;
+}
+/**
+ * One-way hash of a client IP for storage alongside form submissions.
+ *
+ * We never persist raw IPs — they are PII and a liability. Hashing with the
+ * instance secret as salt lets operators correlate repeat submitters / abuse
+ * within a single deployment while making the stored value useless to anyone
+ * who exfiltrates the table without also having `CMS_SECRET`. Returns `null`
+ * for the `'unknown'` sentinel so callers store SQL NULL rather than a hash of
+ * the literal string `'unknown'`.
+ */
+export function hashClientIp(ip) {
+    if (!isResolvedIp(ip))
+        return null;
+    const salt = process.env.CMS_SECRET ?? 'prenta-fallback-salt';
+    return createHash('sha256').update(`${salt}:${ip}`).digest('hex').slice(0, 32);
+}
+//# sourceMappingURL=client-ip.js.map

package/dist/security/client-ip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-ip.js","sourceRoot":"","sources":["../../src/security/client-ip.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAEvD,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,CAAC,CAAA;AAOxC,MAAM,aAAa,GAAG,wBAAwB,CAAA;AAC9C,MAAM,cAAc,GAAG,WAAW,CAAA;AAClC,MAAM,gBAAgB,GAAG,iBAAiB,CAAA;AAE1C,wEAAwE;AACxE,8EAA8E;AAC9E,iFAAiF;AACjF,4EAA4E;AAC5E,kEAAkE;AAClE,IAAI,uBAAuB,GAAG,KAAK,CAAA;AACnC,SAAS,qBAAqB;IAC5B,IAAI,uBAAuB;QAAE,OAAM;IACnC,uBAAuB,GAAG,IAAI,CAAA;IAC9B,MAAM,CAAC,IAAI,CACT,oFAAoF;QAClF,kFAAkF;QAClF,oDAAoD,CACvD,CAAA;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAgB,EAAE,UAA4B,EAAE;IAC1E,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,GAAG,CAAA;IAE/E,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IACjD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;QAC1C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAA;IACzB,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IAClD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;QAC7B,IAAI,OAAO;YAAE,OAAO,OAAO,CAAA;IAC7B,CAAC;IAED,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;QACjD,IAAI,GAAG,EAAE,CAAC;YACR,oEAAoE;YACpE,yDAAyD;YACzD,MAAM,KAAK,GAAG,GAAG;iBACd,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,MAAM,CAAC,OAAO,CAAC,CAAA;YAClB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YACpC,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAA;QACvB,CAAC;IACH,CAAC;IAED,qBAAqB,EAAE,CAAA;IACvB,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,EAAU;IACrC,OAAO,EAAE,KAAK,SAAS,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,EAAU;IACrC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,sBAAsB,CAAA;IAC7D,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AAChF,CAAC"}

package/dist/security/cors.d.ts

@@ -0,0 +1,11 @@
+export interface CorsConfig {
+    allowedOrigins: string[] | '*';
+    allowedMethods?: string[];
+    allowedHeaders?: string[];
+    exposedHeaders?: string[];
+    credentials?: boolean;
+    maxAge?: number;
+}
+/** Build CORS headers for a given request origin. */
+export declare function getCorsHeaders(requestOrigin: string | null, config: CorsConfig): Record<string, string>;
+//# sourceMappingURL=cors.d.ts.map

package/dist/security/cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../src/security/cors.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,MAAM,EAAE,GAAG,GAAG,CAAA;IAC9B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAKD,qDAAqD;AACrD,wBAAgB,cAAc,CAC5B,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,MAAM,EAAE,UAAU,GACjB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAwBxB"}

package/dist/security/cors.js

@@ -0,0 +1,33 @@
+const DEFAULT_METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'];
+const DEFAULT_HEADERS = ['Content-Type', 'Authorization', 'X-CSRF-Token'];
+/** Build CORS headers for a given request origin. */
+export function getCorsHeaders(requestOrigin, config) {
+    const headers = {};
+    const allowedOrigin = resolveOrigin(requestOrigin, config.allowedOrigins);
+    if (!allowedOrigin)
+        return headers;
+    headers['Access-Control-Allow-Origin'] = allowedOrigin;
+    headers['Access-Control-Allow-Methods'] = (config.allowedMethods ?? DEFAULT_METHODS).join(', ');
+    headers['Access-Control-Allow-Headers'] = (config.allowedHeaders ?? DEFAULT_HEADERS).join(', ');
+    if (config.exposedHeaders?.length) {
+        headers['Access-Control-Expose-Headers'] = config.exposedHeaders.join(', ');
+    }
+    if (config.credentials) {
+        headers['Access-Control-Allow-Credentials'] = 'true';
+    }
+    if (config.maxAge !== undefined) {
+        headers['Access-Control-Max-Age'] = String(config.maxAge);
+    }
+    if (config.allowedOrigins !== '*') {
+        headers['Vary'] = 'Origin';
+    }
+    return headers;
+}
+function resolveOrigin(requestOrigin, allowed) {
+    if (allowed === '*')
+        return '*';
+    if (!requestOrigin)
+        return null;
+    return allowed.includes(requestOrigin) ? requestOrigin : null;
+}
+//# sourceMappingURL=cors.js.map

package/dist/security/cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/security/cors.ts"],"names":[],"mappings":"AASA,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;AAC5E,MAAM,eAAe,GAAG,CAAC,cAAc,EAAE,eAAe,EAAE,cAAc,CAAC,CAAA;AAEzE,qDAAqD;AACrD,MAAM,UAAU,cAAc,CAC5B,aAA4B,EAC5B,MAAkB;IAElB,MAAM,OAAO,GAA2B,EAAE,CAAA;IAE1C,MAAM,aAAa,GAAG,aAAa,CAAC,aAAa,EAAE,MAAM,CAAC,cAAc,CAAC,CAAA;IACzE,IAAI,CAAC,aAAa;QAAE,OAAO,OAAO,CAAA;IAElC,OAAO,CAAC,6BAA6B,CAAC,GAAG,aAAa,CAAA;IACtD,OAAO,CAAC,8BAA8B,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/F,OAAO,CAAC,8BAA8B,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAE/F,IAAI,MAAM,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;QAClC,OAAO,CAAC,+BAA+B,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7E,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,OAAO,CAAC,kCAAkC,CAAC,GAAG,MAAM,CAAA;IACtD,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,CAAC,wBAAwB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3D,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,KAAK,GAAG,EAAE,CAAC;QAClC,OAAO,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAA;IAC5B,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,aAA4B,EAAE,OAAuB;IAC1E,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,GAAG,CAAA;IAC/B,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAA;IAC/B,OAAO,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAA;AAC/D,CAAC"}

package/dist/security/csp-nonces.d.ts

@@ -0,0 +1,5 @@
+/** Generate a cryptographically secure nonce for Content Security Policy inline scripts/styles. */
+export declare function generateCspNonce(): string;
+/** Build a CSP header value incorporating the generated nonce. */
+export declare function buildCspHeader(nonce: string, directives?: Record<string, string[]>): string;
+//# sourceMappingURL=csp-nonces.d.ts.map

package/dist/security/csp-nonces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csp-nonces.d.ts","sourceRoot":"","sources":["../../src/security/csp-nonces.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,wBAAgB,gBAAgB,IAAI,MAAM,CAGzC;AAED,kEAAkE;AAClE,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAiB3F"}

package/dist/security/csp-nonces.js

@@ -0,0 +1,24 @@
+/** Generate a cryptographically secure nonce for Content Security Policy inline scripts/styles. */
+export function generateCspNonce() {
+    const bytes = crypto.getRandomValues(new Uint8Array(16));
+    return btoa(String.fromCharCode(...bytes));
+}
+/** Build a CSP header value incorporating the generated nonce. */
+export function buildCspHeader(nonce, directives) {
+    const defaults = {
+        'default-src': ["'self'"],
+        'script-src': ["'self'", `'nonce-${nonce}'`],
+        'style-src': ["'self'", `'nonce-${nonce}'`, "'unsafe-inline'"],
+        'img-src': ["'self'", 'data:', 'https:'],
+        'font-src': ["'self'"],
+        'connect-src': ["'self'"],
+        'frame-ancestors': ["'none'"],
+        'base-uri': ["'self'"],
+        'form-action': ["'self'"],
+        ...directives,
+    };
+    return Object.entries(defaults)
+        .map(([key, values]) => `${key} ${values.join(' ')}`)
+        .join('; ');
+}
+//# sourceMappingURL=csp-nonces.js.map

package/dist/security/csp-nonces.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csp-nonces.js","sourceRoot":"","sources":["../../src/security/csp-nonces.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,MAAM,UAAU,gBAAgB;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IACxD,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAA;AAC5C,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,UAAqC;IACjF,MAAM,QAAQ,GAA6B;QACzC,aAAa,EAAE,CAAC,QAAQ,CAAC;QACzB,YAAY,EAAE,CAAC,QAAQ,EAAE,UAAU,KAAK,GAAG,CAAC;QAC5C,WAAW,EAAE,CAAC,QAAQ,EAAE,UAAU,KAAK,GAAG,EAAE,iBAAiB,CAAC;QAC9D,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC;QACxC,UAAU,EAAE,CAAC,QAAQ,CAAC;QACtB,aAAa,EAAE,CAAC,QAAQ,CAAC;QACzB,iBAAiB,EAAE,CAAC,QAAQ,CAAC;QAC7B,UAAU,EAAE,CAAC,QAAQ,CAAC;QACtB,aAAa,EAAE,CAAC,QAAQ,CAAC;QACzB,GAAG,UAAU;KACd,CAAA;IAED,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;SAC5B,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;SACpD,IAAI,CAAC,IAAI,CAAC,CAAA;AACf,CAAC"}

package/dist/security/csrf.d.ts

@@ -0,0 +1,5 @@
+/** Generate a CSRF token using Web Crypto. */
+export declare function generateToken(): Promise<string>;
+/** Validate a submitted CSRF token against the stored value using constant-time comparison. */
+export declare function validateToken(token: string, storedToken: string): boolean;
+//# sourceMappingURL=csrf.d.ts.map

package/dist/security/csrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/security/csrf.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,wBAAsB,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,CAKrD;AAED,+FAA+F;AAC/F,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAWzE"}

package/dist/security/csrf.js

@@ -0,0 +1,20 @@
+/** Generate a CSRF token using Web Crypto. */
+export async function generateToken() {
+    const bytes = crypto.getRandomValues(new Uint8Array(32));
+    return Array.from(bytes)
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
+}
+/** Validate a submitted CSRF token against the stored value using constant-time comparison. */
+export function validateToken(token, storedToken) {
+    if (token.length !== storedToken.length)
+        return false;
+    const a = new TextEncoder().encode(token);
+    const b = new TextEncoder().encode(storedToken);
+    let diff = 0;
+    for (let i = 0; i < a.length; i++) {
+        diff |= (a[i] ?? 0) ^ (b[i] ?? 0);
+    }
+    return diff === 0;
+}
+//# sourceMappingURL=csrf.js.map

package/dist/security/csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../../src/security/csrf.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IACxD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;SACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAA;AACb,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,WAAmB;IAC9D,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAErD,MAAM,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACzC,MAAM,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IAE/C,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IACnC,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAA;AACnB,CAAC"}

package/dist/security/encrypted-fields.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Thrown for invalid `CMS_ENCRYPTION_KEY` shape. We use a named class so the
+ * caller (typically an API handler) can map it to a clear 500 with operator
+ * guidance rather than the opaque `OperationError` that some Web Crypto
+ * implementations throw on malformed keys.
+ */
+export declare class InvalidEncryptionKeyError extends Error {
+    constructor(reason: string);
+}
+/** Encrypt a field value using AES-256-GCM. */
+export declare function encryptField(value: string, keyHex: string): Promise<string>;
+/** Decrypt a field value encrypted with AES-256-GCM. */
+export declare function decryptField(encrypted: string, keyHex: string): Promise<string>;
+//# sourceMappingURL=encrypted-fields.d.ts.map

package/dist/security/encrypted-fields.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted-fields.d.ts","sourceRoot":"","sources":["../../src/security/encrypted-fields.ts"],"names":[],"mappings":"AAQA;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,MAAM,EAAE,MAAM;CAQ3B;AAyBD,+CAA+C;AAC/C,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBjF;AAED,wDAAwD;AACxD,wBAAsB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAcrF"}

package/dist/security/encrypted-fields.js

@@ -0,0 +1,94 @@
+const ALGORITHM = 'AES-GCM';
+const IV_LENGTH = 12;
+const TAG_LENGTH = 128;
+const KEY_BYTES = 32; // AES-256 requires exactly 32 bytes
+const KEY_HEX_LENGTH = KEY_BYTES * 2;
+const HEX_RE = /^[0-9a-fA-F]+$/;
+/**
+ * Thrown for invalid `CMS_ENCRYPTION_KEY` shape. We use a named class so the
+ * caller (typically an API handler) can map it to a clear 500 with operator
+ * guidance rather than the opaque `OperationError` that some Web Crypto
+ * implementations throw on malformed keys.
+ */
+export class InvalidEncryptionKeyError extends Error {
+    constructor(reason) {
+        super(`[Prenta CMS] CMS_ENCRYPTION_KEY is invalid: ${reason}. ` +
+            `Generate a valid key with: ` +
+            `node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"`);
+        this.name = 'InvalidEncryptionKeyError';
+    }
+}
+/**
+ * Validate that `keyHex` is exactly 64 hex chars (32 bytes for AES-256).
+ *
+ * Without this guard, WebCrypto's `importKey` either throws an opaque
+ * `OperationError` (short keys), or in some non-spec runtimes silently
+ * truncates / pads — both produce ciphertext that the matching `decrypt`
+ * call can't reverse, surfaced to the user as a generic "decryption failed"
+ * weeks after the bad key was first deployed.
+ */
+function validateKey(keyHex) {
+    if (typeof keyHex !== 'string' || keyHex.length === 0) {
+        throw new InvalidEncryptionKeyError('key is empty or not a string');
+    }
+    if (keyHex.length !== KEY_HEX_LENGTH) {
+        throw new InvalidEncryptionKeyError(`key must be ${KEY_HEX_LENGTH} hex characters (${KEY_BYTES} bytes), got ${keyHex.length}`);
+    }
+    if (!HEX_RE.test(keyHex)) {
+        throw new InvalidEncryptionKeyError('key must contain only hex characters [0-9a-fA-F]');
+    }
+}
+/** Encrypt a field value using AES-256-GCM. */
+export async function encryptField(value, keyHex) {
+    validateKey(keyHex);
+    const key = await importKey(keyHex);
+    const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH));
+    const encoded = new TextEncoder().encode(value);
+    const ciphertext = await crypto.subtle.encrypt({ name: ALGORITHM, iv, tagLength: TAG_LENGTH }, key, encoded);
+    const combined = new Uint8Array(iv.length + ciphertext.byteLength);
+    combined.set(iv);
+    combined.set(new Uint8Array(ciphertext), iv.length);
+    return bufferToHex(combined);
+}
+/** Decrypt a field value encrypted with AES-256-GCM. */
+export async function decryptField(encrypted, keyHex) {
+    validateKey(keyHex);
+    const key = await importKey(keyHex);
+    const data = hexToBuffer(encrypted);
+    const iv = data.slice(0, IV_LENGTH);
+    const ciphertext = data.slice(IV_LENGTH);
+    const decrypted = await crypto.subtle.decrypt({ name: ALGORITHM, iv, tagLength: TAG_LENGTH }, key, ciphertext);
+    return new TextDecoder().decode(decrypted);
+}
+async function importKey(keyHex) {
+    const keyData = hexToBuffer(keyHex);
+    return crypto.subtle.importKey('raw', keyData, ALGORITHM, false, [
+        'encrypt',
+        'decrypt',
+    ]);
+}
+function bufferToHex(buffer) {
+    return Array.from(buffer)
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
+}
+/**
+ * Decode a hex string to bytes. Caller is expected to have validated shape
+ * via `validateKey` for keys; this function tolerates already-validated input
+ * and rejects odd-length hex (which previously silently dropped trailing chars).
+ */
+function hexToBuffer(hex) {
+    if (hex.length % 2 !== 0) {
+        throw new Error('hex string must have an even number of characters');
+    }
+    const bytes = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < hex.length; i += 2) {
+        const byte = parseInt(hex.slice(i, i + 2), 16);
+        if (Number.isNaN(byte)) {
+            throw new Error(`invalid hex character at offset ${i}`);
+        }
+        bytes[i / 2] = byte;
+    }
+    return bytes;
+}
+//# sourceMappingURL=encrypted-fields.js.map

package/dist/security/encrypted-fields.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted-fields.js","sourceRoot":"","sources":["../../src/security/encrypted-fields.ts"],"names":[],"mappings":"AAAA,MAAM,SAAS,GAAG,SAAS,CAAA;AAC3B,MAAM,SAAS,GAAG,EAAE,CAAA;AACpB,MAAM,UAAU,GAAG,GAAG,CAAA;AACtB,MAAM,SAAS,GAAG,EAAE,CAAA,CAAC,oCAAoC;AACzD,MAAM,cAAc,GAAG,SAAS,GAAG,CAAC,CAAA;AAEpC,MAAM,MAAM,GAAG,gBAAgB,CAAA;AAE/B;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,YAAY,MAAc;QACxB,KAAK,CACH,+CAA+C,MAAM,IAAI;YACvD,6BAA6B;YAC7B,0EAA0E,CAC7E,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;IACzC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,MAAc;IACjC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,yBAAyB,CAAC,8BAA8B,CAAC,CAAA;IACrE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACrC,MAAM,IAAI,yBAAyB,CACjC,eAAe,cAAc,oBAAoB,SAAS,gBAAgB,MAAM,CAAC,MAAM,EAAE,CAC1F,CAAA;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,yBAAyB,CAAC,kDAAkD,CAAC,CAAA;IACzF,CAAC;AACH,CAAC;AAED,+CAA+C;AAC/C,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAa,EAAE,MAAc;IAC9D,WAAW,CAAC,MAAM,CAAC,CAAA;IACnB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAA;IACnC,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;IAC5D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAE/C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC5C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,EAC9C,GAAG,EACH,OAAO,CACR,CAAA;IAED,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAA;IAClE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAChB,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAA;IAEnD,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAA;AAC9B,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAAiB,EAAE,MAAc;IAClE,WAAW,CAAC,MAAM,CAAC,CAAA;IACnB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAA;IACnC,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;IACnC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IACnC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAExC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC3C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,EAC9C,GAAG,EACH,UAAU,CACX,CAAA;IAED,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;AAC5C,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,MAAc;IACrC,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAkC,EAAE,SAAS,EAAE,KAAK,EAAE;QAC1F,SAAS;QACT,SAAS;KACV,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAkB;IACrC,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;SACtB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACtE,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAC9C,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,EAAE,CAAC,CAAA;QACzD,CAAC;QACD,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAA;IACrB,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/security/headers.d.ts

@@ -0,0 +1,11 @@
+export interface SecurityHeadersConfig {
+    contentSecurityPolicy?: string;
+    strictTransportSecurity?: string;
+    xContentTypeOptions?: string;
+    xFrameOptions?: string;
+    referrerPolicy?: string;
+    permissionsPolicy?: string;
+}
+/** Get the default security headers for HTTP responses. */
+export declare function getSecurityHeaders(overrides?: SecurityHeadersConfig): Record<string, string>;
+//# sourceMappingURL=headers.d.ts.map

package/dist/security/headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"headers.d.ts","sourceRoot":"","sources":["../../src/security/headers.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,qBAAqB;IACpC,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAWD,2DAA2D;AAC3D,wBAAgB,kBAAkB,CAAC,SAAS,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAuB5F"}

package/dist/security/headers.js

@@ -0,0 +1,32 @@
+const DEFAULT_HEADERS = {
+    'X-Content-Type-Options': 'nosniff',
+    'X-Frame-Options': 'DENY',
+    'X-XSS-Protection': '0',
+    'Referrer-Policy': 'strict-origin-when-cross-origin',
+    'Strict-Transport-Security': 'max-age=63072000; includeSubDomains; preload',
+    'Permissions-Policy': 'camera=(), microphone=(), geolocation=()',
+};
+/** Get the default security headers for HTTP responses. */
+export function getSecurityHeaders(overrides) {
+    const headers = { ...DEFAULT_HEADERS };
+    if (overrides?.contentSecurityPolicy) {
+        headers['Content-Security-Policy'] = overrides.contentSecurityPolicy;
+    }
+    if (overrides?.strictTransportSecurity) {
+        headers['Strict-Transport-Security'] = overrides.strictTransportSecurity;
+    }
+    if (overrides?.xContentTypeOptions) {
+        headers['X-Content-Type-Options'] = overrides.xContentTypeOptions;
+    }
+    if (overrides?.xFrameOptions) {
+        headers['X-Frame-Options'] = overrides.xFrameOptions;
+    }
+    if (overrides?.referrerPolicy) {
+        headers['Referrer-Policy'] = overrides.referrerPolicy;
+    }
+    if (overrides?.permissionsPolicy) {
+        headers['Permissions-Policy'] = overrides.permissionsPolicy;
+    }
+    return headers;
+}
+//# sourceMappingURL=headers.js.map

package/dist/security/headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"headers.js","sourceRoot":"","sources":["../../src/security/headers.ts"],"names":[],"mappings":"AASA,MAAM,eAAe,GAA2B;IAC9C,wBAAwB,EAAE,SAAS;IACnC,iBAAiB,EAAE,MAAM;IACzB,kBAAkB,EAAE,GAAG;IACvB,iBAAiB,EAAE,iCAAiC;IACpD,2BAA2B,EAAE,8CAA8C;IAC3E,oBAAoB,EAAE,0CAA0C;CACjE,CAAA;AAED,2DAA2D;AAC3D,MAAM,UAAU,kBAAkB,CAAC,SAAiC;IAClE,MAAM,OAAO,GAAG,EAAE,GAAG,eAAe,EAAE,CAAA;IAEtC,IAAI,SAAS,EAAE,qBAAqB,EAAE,CAAC;QACrC,OAAO,CAAC,yBAAyB,CAAC,GAAG,SAAS,CAAC,qBAAqB,CAAA;IACtE,CAAC;IACD,IAAI,SAAS,EAAE,uBAAuB,EAAE,CAAC;QACvC,OAAO,CAAC,2BAA2B,CAAC,GAAG,SAAS,CAAC,uBAAuB,CAAA;IAC1E,CAAC;IACD,IAAI,SAAS,EAAE,mBAAmB,EAAE,CAAC;QACnC,OAAO,CAAC,wBAAwB,CAAC,GAAG,SAAS,CAAC,mBAAmB,CAAA;IACnE,CAAC;IACD,IAAI,SAAS,EAAE,aAAa,EAAE,CAAC;QAC7B,OAAO,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC,aAAa,CAAA;IACtD,CAAC;IACD,IAAI,SAAS,EAAE,cAAc,EAAE,CAAC;QAC9B,OAAO,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC,cAAc,CAAA;IACvD,CAAC;IACD,IAAI,SAAS,EAAE,iBAAiB,EAAE,CAAC;QACjC,OAAO,CAAC,oBAAoB,CAAC,GAAG,SAAS,CAAC,iBAAiB,CAAA;IAC7D,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC"}