@prenta/core 0.118.0

package/dist/security/ip-canon.js

@@ -0,0 +1,352 @@
+/**
+ * IP canonicalization for SSRF defense.
+ *
+ * The previous regex-based approach in `webhook.ts` only matched the literal
+ * dotted-quad form. It missed every encoding that `getaddrinfo` (and therefore
+ * `fetch`) accepts:
+ *
+ *   - Decimal:        http://2130706433/        → 127.0.0.1
+ *   - Octal:          http://0177.0.0.1/        → 127.0.0.1
+ *   - Hex:            http://0x7f.0.0.1/        → 127.0.0.1
+ *   - Short-form:     http://127.1/             → 127.0.0.1
+ *   - IPv4-mapped v6: http://[::ffff:127.0.0.1] → 127.0.0.1
+ *   - IPv4-compat v6: http://[::127.0.0.1]      → 127.0.0.1
+ *
+ * This module canonicalizes any of those forms to a 4-octet IPv4 string (or
+ * a normalized 16-byte IPv6 address), then range-checks against a complete
+ * private/internal block list including AWS/GCP/Azure metadata endpoints and
+ * the carrier-grade NAT range.
+ */
+const PRIVATE_IPV4_RANGES = [
+    // 0.0.0.0/8         "this network"
+    { network: 0x00_00_00_00, mask: 0xff_00_00_00, reason: '0.0.0.0/8 (this network)' },
+    // 10.0.0.0/8        RFC1918 private
+    { network: 0x0a_00_00_00, mask: 0xff_00_00_00, reason: '10.0.0.0/8 (RFC1918 private)' },
+    // 100.64.0.0/10     RFC6598 carrier-grade NAT
+    { network: 0x64_40_00_00, mask: 0xff_c0_00_00, reason: '100.64.0.0/10 (CGNAT)' },
+    // 127.0.0.0/8       loopback
+    { network: 0x7f_00_00_00, mask: 0xff_00_00_00, reason: '127.0.0.0/8 (loopback)' },
+    // 169.254.0.0/16    link-local + cloud metadata (AWS 169.254.169.254 is in here)
+    { network: 0xa9_fe_00_00, mask: 0xff_ff_00_00, reason: '169.254.0.0/16 (link-local + metadata)' },
+    // 172.16.0.0/12     RFC1918 private
+    { network: 0xac_10_00_00, mask: 0xff_f0_00_00, reason: '172.16.0.0/12 (RFC1918 private)' },
+    // 192.0.0.0/24      RFC6890 IETF protocol assignments
+    { network: 0xc0_00_00_00, mask: 0xff_ff_ff_00, reason: '192.0.0.0/24 (IETF reserved)' },
+    // 192.0.2.0/24      TEST-NET-1 (documentation)
+    { network: 0xc0_00_02_00, mask: 0xff_ff_ff_00, reason: '192.0.2.0/24 (TEST-NET-1)' },
+    // 192.168.0.0/16    RFC1918 private
+    { network: 0xc0_a8_00_00, mask: 0xff_ff_00_00, reason: '192.168.0.0/16 (RFC1918 private)' },
+    // 198.18.0.0/15     benchmark
+    { network: 0xc6_12_00_00, mask: 0xff_fe_00_00, reason: '198.18.0.0/15 (benchmark)' },
+    // 198.51.100.0/24   TEST-NET-2
+    { network: 0xc6_33_64_00, mask: 0xff_ff_ff_00, reason: '198.51.100.0/24 (TEST-NET-2)' },
+    // 203.0.113.0/24    TEST-NET-3
+    { network: 0xcb_00_71_00, mask: 0xff_ff_ff_00, reason: '203.0.113.0/24 (TEST-NET-3)' },
+    // 224.0.0.0/4       multicast
+    { network: 0xe0_00_00_00, mask: 0xf0_00_00_00, reason: '224.0.0.0/4 (multicast)' },
+    // 240.0.0.0/4       reserved (includes 255.255.255.255 broadcast)
+    { network: 0xf0_00_00_00, mask: 0xf0_00_00_00, reason: '240.0.0.0/4 (reserved)' },
+];
+/**
+ * Canonicalize a URL hostname into either a normalized IP address or a
+ * passthrough hostname. Handles every IPv4 encoding accepted by `inet_aton`
+ * (decimal, octal, hex, short-form), IPv4-mapped IPv6, and bracketed IPv6.
+ */
+export function canonicalizeHostname(rawHostname) {
+    const raw = rawHostname;
+    // Strip surrounding brackets (URLs use `[::1]` for IPv6 hosts).
+    let host = raw;
+    if (host.startsWith('[') && host.endsWith(']')) {
+        host = host.slice(1, -1);
+    }
+    // Try IPv6 first — only IPv6 contains ':'.
+    if (host.includes(':')) {
+        const ipv6 = parseIPv6(host);
+        if (ipv6) {
+            // IPv4-mapped (::ffff:a.b.c.d) and IPv4-compatible (::a.b.c.d) both
+            // tunnel an IPv4 address through IPv6 — collapse to the underlying v4
+            // so the v4 range check catches them.
+            const tunnelled = extractIPv4FromIPv6(ipv6);
+            if (tunnelled !== null) {
+                return { raw, ipv4: ipv4ToString(tunnelled), isHostname: false, isValidIp: true };
+            }
+            return { raw, ipv6: formatIPv6(ipv6), isHostname: false, isValidIp: true };
+        }
+        // Looked like IPv6 (had a colon) but didn't parse. Mark as a non-hostname
+        // *and* not a valid IP — SSRF gates fail closed on this shape.
+        return { raw, isHostname: false, isValidIp: false };
+    }
+    // Try IPv4 in any of: decimal, octal, hex, dotted, short-form.
+    const ipv4 = parseIPv4Literal(host);
+    if (ipv4 !== null) {
+        return { raw, ipv4: ipv4ToString(ipv4), isHostname: false, isValidIp: true };
+    }
+    // Not an IP literal in any form → treat as DNS hostname.
+    return { raw, isHostname: true, isValidIp: false };
+}
+/**
+ * Returns the matching private/internal range when the canonicalized host is
+ * one, `null` when it's a safe public IP, or a "malformed" reason when the
+ * input claims to be an IP literal but didn't parse cleanly.
+ *
+ * Defense-in-depth: even if a caller forgets to gate on `isValidIp`, this
+ * function still fails closed on the malformed shape (`isHostname=false`
+ * with no `ipv4`/`ipv6`).
+ */
+export function isPrivateAddress(host) {
+    if (host.ipv4) {
+        const num = ipv4StringToNumber(host.ipv4);
+        if (num === null)
+            return { reason: 'invalid IPv4 numeric form' };
+        for (const range of PRIVATE_IPV4_RANGES) {
+            // `>>> 0` forces the int32 result of `&` back to an unsigned 32-bit
+            // value so comparisons with `range.network` (a positive JS number)
+            // work correctly even when the high bit is set (172.16.x.x and up).
+            if ((num & range.mask) >>> 0 === range.network) {
+                return { reason: range.reason };
+            }
+        }
+        return null;
+    }
+    if (host.ipv6) {
+        const v6 = parseIPv6(host.ipv6);
+        if (!v6)
+            return { reason: 'invalid IPv6 form' };
+        return checkPrivateIPv6(v6);
+    }
+    // Malformed IP literal (looked like an IP but didn't parse). Fail closed.
+    if (!host.isHostname) {
+        return { reason: 'malformed IP literal' };
+    }
+    // DNS hostname → no IP-level check possible without resolution.
+    return null;
+}
+/**
+ * Parse an IPv4 literal in *any* form `inet_aton` accepts:
+ *   - 4 parts: a.b.c.d  (each 0-255)
+ *   - 3 parts: a.b.c    (c is bottom 16 bits)
+ *   - 2 parts: a.b      (b is bottom 24 bits)
+ *   - 1 part:  a        (full 32-bit number)
+ *
+ * Each part may be decimal, octal (leading 0), or hex (leading 0x).
+ */
+function parseIPv4Literal(input) {
+    if (input.length === 0)
+        return null;
+    const parts = input.split('.');
+    if (parts.length === 0 || parts.length > 4)
+        return null;
+    const nums = [];
+    for (const p of parts) {
+        if (p.length === 0)
+            return null;
+        const n = parsePartNumber(p);
+        if (n === null)
+            return null;
+        nums.push(n);
+    }
+    // Build 32-bit value per inet_aton rules.
+    switch (nums.length) {
+        case 1: {
+            const a = nums[0];
+            if (a > 0xff_ff_ff_ff)
+                return null;
+            return a >>> 0;
+        }
+        case 2: {
+            const [a, b] = nums;
+            if (a > 0xff || b > 0xff_ff_ff)
+                return null;
+            return ((a << 24) | b) >>> 0;
+        }
+        case 3: {
+            const [a, b, c] = nums;
+            if (a > 0xff || b > 0xff || c > 0xff_ff)
+                return null;
+            return ((a << 24) | (b << 16) | c) >>> 0;
+        }
+        case 4: {
+            const [a, b, c, d] = nums;
+            if (a > 0xff || b > 0xff || c > 0xff || d > 0xff)
+                return null;
+            return ((a << 24) | (b << 16) | (c << 8) | d) >>> 0;
+        }
+        default:
+            return null;
+    }
+}
+function parsePartNumber(part) {
+    // Hex: 0x...
+    if (part.startsWith('0x') || part.startsWith('0X')) {
+        const hex = part.slice(2);
+        if (hex.length === 0 || !/^[0-9a-fA-F]+$/.test(hex))
+            return null;
+        const n = parseInt(hex, 16);
+        return Number.isFinite(n) ? n : null;
+    }
+    // Octal: starts with 0 followed by digits (but bare "0" is decimal 0).
+    if (part.length > 1 && part.startsWith('0')) {
+        if (!/^[0-7]+$/.test(part))
+            return null;
+        const n = parseInt(part, 8);
+        return Number.isFinite(n) ? n : null;
+    }
+    // Decimal.
+    if (!/^[0-9]+$/.test(part))
+        return null;
+    const n = parseInt(part, 10);
+    return Number.isFinite(n) ? n : null;
+}
+function ipv4StringToNumber(s) {
+    const parts = s.split('.');
+    if (parts.length !== 4)
+        return null;
+    let n = 0;
+    for (const p of parts) {
+        const x = parseInt(p, 10);
+        if (!Number.isFinite(x) || x < 0 || x > 255)
+            return null;
+        n = (n << 8) | x;
+    }
+    return n >>> 0;
+}
+function ipv4ToString(n) {
+    return [(n >>> 24) & 0xff, (n >>> 16) & 0xff, (n >>> 8) & 0xff, n & 0xff].join('.');
+}
+/**
+ * Parse an IPv6 address into 8 groups of 16-bit numbers. Supports `::`
+ * compression and the `::ffff:a.b.c.d` IPv4-mapped trailing form.
+ *
+ * Reconstruction order with compression:
+ *   [head hextets] [zero-fill] [tail hextets] [optional v4 suffix as 2 hextets]
+ *
+ * Without compression: just `[8 hextets, optional last replaced by v4 suffix]`.
+ */
+function parseIPv6(input) {
+    if (input.length === 0)
+        return null;
+    const doubleColon = input.indexOf('::');
+    let head;
+    let tail;
+    if (doubleColon >= 0) {
+        if (input.indexOf('::', doubleColon + 1) !== -1)
+            return null; // multiple ::
+        head = input
+            .slice(0, doubleColon)
+            .split(':')
+            .filter((s) => s.length > 0);
+        tail = input
+            .slice(doubleColon + 2)
+            .split(':')
+            .filter((s) => s.length > 0);
+    }
+    else {
+        head = input.split(':');
+        tail = [];
+        // No compression: must be exactly 8 hextets (or 7 + a trailing IPv4).
+    }
+    // The trailing group may be a dotted-quad IPv4. It's always at the end of
+    // either `tail` (when compression is present) or `head` (when not).
+    let v4Suffix = null;
+    const trailingGroupArr = tail.length > 0 ? tail : head;
+    const trailingGroup = trailingGroupArr[trailingGroupArr.length - 1] ?? '';
+    if (trailingGroup.includes('.')) {
+        const v4 = parseIPv4Literal(trailingGroup);
+        if (v4 === null)
+            return null;
+        v4Suffix = [(v4 >>> 16) & 0xff_ff, v4 & 0xff_ff];
+        if (tail.length > 0)
+            tail = tail.slice(0, -1);
+        else
+            head = head.slice(0, -1);
+    }
+    const headGroups = head.map(parseHextet);
+    const tailGroups = tail.map(parseHextet);
+    if (headGroups.includes(null) || tailGroups.includes(null))
+        return null;
+    const v4Count = v4Suffix ? 2 : 0;
+    if (doubleColon >= 0) {
+        const fillCount = 8 - headGroups.length - tailGroups.length - v4Count;
+        if (fillCount < 0)
+            return null;
+        const zeros = new Array(fillCount).fill(0);
+        const result = [
+            ...headGroups,
+            ...zeros,
+            ...tailGroups,
+            ...(v4Suffix ?? []),
+        ];
+        return result.length === 8 ? result : null;
+    }
+    // No compression — must add up to exactly 8 hextets including v4 suffix.
+    const result = [...headGroups, ...(v4Suffix ?? [])];
+    return result.length === 8 ? result : null;
+}
+function parseHextet(s) {
+    if (s.length === 0 || s.length > 4)
+        return null;
+    if (!/^[0-9a-fA-F]+$/.test(s))
+        return null;
+    return parseInt(s, 16);
+}
+function formatIPv6(groups) {
+    return groups.map((g) => g.toString(16)).join(':');
+}
+/**
+ * If `groups` represents an IPv4-mapped (`::ffff:a.b.c.d`) or non-trivial
+ * IPv4-compatible (`::a.b.c.d` with a.b.c.d != ::1, deprecated) IPv6 address,
+ * return the inner 32-bit IPv4 value.
+ *
+ * IMPORTANT: We deliberately do NOT extract from `::1` (loopback) or `::`
+ * (unspecified). Those are pure IPv6 addresses, not tunneled IPv4 — treating
+ * `::1` as `0.0.0.1` would silently allow loopback bypass via the IPv4
+ * range checks (which don't include `0.0.0.1`).
+ */
+function extractIPv4FromIPv6(groups) {
+    // First 5 groups must be all zero (the high-order 80 bits).
+    if (groups.slice(0, 5).some((g) => g !== 0))
+        return null;
+    const isMapped = groups[5] === 0xff_ff;
+    if (isMapped) {
+        return (((groups[6] ?? 0) << 16) | (groups[7] ?? 0)) >>> 0;
+    }
+    // IPv4-compatible (deprecated by RFC4291 §2.5.5.1): only when groups[5]===0
+    // AND the embedded "IPv4" is itself a real public-looking address (i.e.
+    // the whole thing isn't just `::N` for small N). We require the high
+    // hextet of the IPv4 portion (groups[6]) to be non-zero — that excludes
+    // `::1`, `::`, `::N` for N < 65536, all of which should be treated as
+    // pure IPv6 by their own range checks (loopback, unspecified, etc).
+    const isCompat = groups[5] === 0 && (groups[6] ?? 0) !== 0;
+    if (isCompat) {
+        return (((groups[6] ?? 0) << 16) | (groups[7] ?? 0)) >>> 0;
+    }
+    return null;
+}
+function checkPrivateIPv6(groups) {
+    // ::1 loopback
+    if (groups.every((g, i) => (i === 7 ? g === 1 : g === 0))) {
+        return { reason: '::1 (IPv6 loopback)' };
+    }
+    // :: unspecified
+    if (groups.every((g) => g === 0)) {
+        return { reason: ':: (unspecified)' };
+    }
+    // fc00::/7  unique local
+    if ((groups[0] & 0xfe_00) === 0xfc_00) {
+        return { reason: 'fc00::/7 (IPv6 unique local)' };
+    }
+    // fe80::/10  link-local
+    if ((groups[0] & 0xff_c0) === 0xfe_80) {
+        return { reason: 'fe80::/10 (IPv6 link-local)' };
+    }
+    // ff00::/8  multicast
+    if ((groups[0] & 0xff_00) === 0xff_00) {
+        return { reason: 'ff00::/8 (IPv6 multicast)' };
+    }
+    // 64:ff9b::/96  well-known IPv4/IPv6 translation
+    if (groups[0] === 0x00_64 && groups[1] === 0xff_9b && groups.slice(2, 6).every((g) => g === 0)) {
+        return { reason: '64:ff9b::/96 (IPv4-IPv6 translation)' };
+    }
+    return null;
+}
+//# sourceMappingURL=ip-canon.js.map

package/dist/security/ip-canon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-canon.js","sourceRoot":"","sources":["../../src/security/ip-canon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,mBAAmB,GAAqE;IAC5F,mCAAmC;IACnC,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,0BAA0B,EAAE;IACnF,oCAAoC;IACpC,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,8BAA8B,EAAE;IACvF,8CAA8C;IAC9C,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,uBAAuB,EAAE;IAChF,6BAA6B;IAC7B,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,wBAAwB,EAAE;IACjF,iFAAiF;IACjF,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,wCAAwC,EAAE;IACjG,oCAAoC;IACpC,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,iCAAiC,EAAE;IAC1F,sDAAsD;IACtD,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,8BAA8B,EAAE;IACvF,+CAA+C;IAC/C,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,2BAA2B,EAAE;IACpF,oCAAoC;IACpC,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,kCAAkC,EAAE;IAC3F,8BAA8B;IAC9B,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,2BAA2B,EAAE;IACpF,+BAA+B;IAC/B,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,8BAA8B,EAAE;IACvF,+BAA+B;IAC/B,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,6BAA6B,EAAE;IACtF,8BAA8B;IAC9B,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,yBAAyB,EAAE;IAClF,kEAAkE;IAClE,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,wBAAwB,EAAE;CAClF,CAAA;AAoCD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,MAAM,GAAG,GAAG,WAAW,CAAA;IAEvB,gEAAgE;IAChE,IAAI,IAAI,GAAG,GAAG,CAAA;IACd,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC1B,CAAC;IAED,2CAA2C;IAC3C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;QAC5B,IAAI,IAAI,EAAE,CAAC;YACT,oEAAoE;YACpE,sEAAsE;YACtE,sCAAsC;YACtC,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;YAC3C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;YACnF,CAAC;YACD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;QAC5E,CAAC;QACD,0EAA0E;QAC1E,+DAA+D;QAC/D,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;IACrD,CAAC;IAED,+DAA+D;IAC/D,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;IACnC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;IAC9E,CAAC;IAED,yDAAyD;IACzD,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;AACpD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAuB;IACtD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACzC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAA;QAChE,KAAK,MAAM,KAAK,IAAI,mBAAmB,EAAE,CAAC;YACxC,oEAAoE;YACpE,mEAAmE;YACnE,oEAAoE;YACpE,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;gBAC/C,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAA;YACjC,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/B,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;QAC/C,OAAO,gBAAgB,CAAC,EAAE,CAAC,CAAA;IAC7B,CAAC;IAED,0EAA0E;IAC1E,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAA;IAC3C,CAAC;IAED,gEAAgE;IAChE,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAEvD,MAAM,IAAI,GAAa,EAAE,CAAA;IACzB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAC/B,MAAM,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAA;QAC5B,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAC3B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACd,CAAC;IAED,0CAA0C;IAC1C,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,CAAC,CAAC,CAAC,CAAC;YACP,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAA;YAClB,IAAI,CAAC,GAAG,aAAa;gBAAE,OAAO,IAAI,CAAA;YAClC,OAAO,CAAC,KAAK,CAAC,CAAA;QAChB,CAAC;QACD,KAAK,CAAC,CAAC,CAAC,CAAC;YACP,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAwB,CAAA;YACvC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,UAAU;gBAAE,OAAO,IAAI,CAAA;YAC3C,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAA;QAC9B,CAAC;QACD,KAAK,CAAC,CAAC,CAAC,CAAC;YACP,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,IAAgC,CAAA;YAClD,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,OAAO;gBAAE,OAAO,IAAI,CAAA;YACpD,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAA;QAC1C,CAAC;QACD,KAAK,CAAC,CAAC,CAAC,CAAC;YACP,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,IAAwC,CAAA;YAC7D,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI;gBAAE,OAAO,IAAI,CAAA;YAC7D,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAA;QACrD,CAAC;QACD;YACE,OAAO,IAAI,CAAA;IACf,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,aAAa;IACb,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACzB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;QAChE,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;QAC3B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACtC,CAAC;IACD,uEAAuE;IACvE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QACvC,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QAC3B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACtC,CAAC;IACD,WAAW;IACX,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACvC,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAC5B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACtC,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAS;IACnC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACzB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG;YAAE,OAAO,IAAI,CAAA;QACxD,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;IAClB,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,CAAA;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACrF,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAEnC,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACvC,IAAI,IAAc,CAAA;IAClB,IAAI,IAAc,CAAA;IAClB,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAA,CAAC,cAAc;QAC3E,IAAI,GAAG,KAAK;aACT,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC;aACrB,KAAK,CAAC,GAAG,CAAC;aACV,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QAC9B,IAAI,GAAG,KAAK;aACT,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC;aACtB,KAAK,CAAC,GAAG,CAAC;aACV,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAChC,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACvB,IAAI,GAAG,EAAE,CAAA;QACT,sEAAsE;IACxE,CAAC;IAED,0EAA0E;IAC1E,oEAAoE;IACpE,IAAI,QAAQ,GAA4B,IAAI,CAAA;IAC5C,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;IACtD,MAAM,aAAa,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;IACzE,IAAI,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAA;QAC1C,IAAI,EAAE,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAC5B,QAAQ,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,EAAE,EAAE,GAAG,OAAO,CAAC,CAAA;QAChD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;;YACxC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC/B,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACxC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACxC,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAEvE,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAEhC,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,SAAS,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,GAAG,OAAO,CAAA;QACrE,IAAI,SAAS,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;QAC9B,MAAM,KAAK,GAAG,IAAI,KAAK,CAAS,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAClD,MAAM,MAAM,GAAG;YACb,GAAI,UAAuB;YAC3B,GAAG,KAAK;YACR,GAAI,UAAuB;YAC3B,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;SACpB,CAAA;QACD,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;IAC5C,CAAC;IAED,yEAAyE;IACzE,MAAM,MAAM,GAAG,CAAC,GAAI,UAAuB,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAA;IACjE,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;AAC5C,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAC/C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1C,OAAO,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AACxB,CAAC;AAED,SAAS,UAAU,CAAC,MAAgB;IAClC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACpD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,mBAAmB,CAAC,MAAgB;IAC3C,4DAA4D;IAC5D,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAExD,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAA;IACtC,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IAC5D,CAAC;IAED,4EAA4E;IAC5E,wEAAwE;IACxE,qEAAqE;IACrE,wEAAwE;IACxE,sEAAsE;IACtE,oEAAoE;IACpE,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAA;IAC1D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IAC5D,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAgB;IACxC,eAAe;IACf,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAA;IAC1C,CAAC;IACD,iBAAiB;IACjB,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAA;IACvC,CAAC;IACD,yBAAyB;IACzB,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,GAAG,OAAO,CAAC,KAAK,OAAO,EAAE,CAAC;QACvC,OAAO,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAA;IACnD,CAAC;IACD,wBAAwB;IACxB,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,GAAG,OAAO,CAAC,KAAK,OAAO,EAAE,CAAC;QACvC,OAAO,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAA;IAClD,CAAC;IACD,sBAAsB;IACtB,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,GAAG,OAAO,CAAC,KAAK,OAAO,EAAE,CAAC;QACvC,OAAO,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAA;IAChD,CAAC;IACD,iDAAiD;IACjD,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/F,OAAO,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAA;IAC3D,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/security/middleware.d.ts

@@ -0,0 +1,20 @@
+import { type SecurityHeadersConfig } from './headers.js';
+import type { RateLimiter } from './rate-limit.js';
+export interface SecurityMiddlewareConfig {
+    headers?: SecurityHeadersConfig;
+    csrf?: {
+        enabled: boolean;
+        cookieName?: string;
+    };
+    rateLimit?: RateLimiter;
+    rateLimitKey?: (request: Request) => string;
+}
+export interface SecurityMiddlewareResult {
+    allowed: boolean;
+    headers: Record<string, string>;
+    error?: string;
+    status?: number;
+}
+/** Compose a security middleware pipeline that applies headers, CSRF, and rate limiting. */
+export declare function applySecurityMiddleware(request: Request, config: SecurityMiddlewareConfig): Promise<SecurityMiddlewareResult>;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/security/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/security/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAE7E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAElD,MAAM,WAAW,wBAAwB;IACvC,OAAO,CAAC,EAAE,qBAAqB,CAAA;IAC/B,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAChD,SAAS,CAAC,EAAE,WAAW,CAAA;IACvB,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,MAAM,CAAA;CAC5C;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,4FAA4F;AAC5F,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC,wBAAwB,CAAC,CAiCnC"}

package/dist/security/middleware.js

@@ -0,0 +1,45 @@
+import { getSecurityHeaders } from './headers.js';
+import { validateToken as validateCsrf } from './csrf.js';
+/** Compose a security middleware pipeline that applies headers, CSRF, and rate limiting. */
+export async function applySecurityMiddleware(request, config) {
+    const responseHeaders = getSecurityHeaders(config.headers);
+    if (config.rateLimit) {
+        const key = config.rateLimitKey?.(request) ?? getClientIp(request);
+        const result = await config.rateLimit.check(key);
+        if (!result.allowed) {
+            return {
+                allowed: false,
+                headers: responseHeaders,
+                error: 'Rate limit exceeded',
+                status: 429,
+            };
+        }
+        responseHeaders['X-RateLimit-Remaining'] = String(result.remaining);
+        responseHeaders['X-RateLimit-Reset'] = result.resetAt.toISOString();
+    }
+    if (config.csrf?.enabled && isMutatingMethod(request.method)) {
+        const csrfToken = request.headers.get('x-csrf-token') ?? '';
+        const cookieName = config.csrf.cookieName ?? '__prenta_csrf';
+        const storedToken = parseCookie(request.headers.get('cookie') ?? '', cookieName);
+        if (!storedToken || !validateCsrf(csrfToken, storedToken)) {
+            return {
+                allowed: false,
+                headers: responseHeaders,
+                error: 'Invalid CSRF token',
+                status: 403,
+            };
+        }
+    }
+    return { allowed: true, headers: responseHeaders };
+}
+function isMutatingMethod(method) {
+    return ['POST', 'PUT', 'PATCH', 'DELETE'].includes(method.toUpperCase());
+}
+function getClientIp(request) {
+    return request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() ?? 'unknown';
+}
+function parseCookie(cookieHeader, name) {
+    const match = cookieHeader.match(new RegExp(`(?:^|;\\s*)${name}=([^;]*)`));
+    return match?.[1];
+}
+//# sourceMappingURL=middleware.js.map

package/dist/security/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/security/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAA8B,MAAM,cAAc,CAAA;AAC7E,OAAO,EAAE,aAAa,IAAI,YAAY,EAAE,MAAM,WAAW,CAAA;AAiBzD,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAgB,EAChB,MAAgC;IAEhC,MAAM,eAAe,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAE1D,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,CAAA;QAClE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAChD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,eAAe;gBACxB,KAAK,EAAE,qBAAqB;gBAC5B,MAAM,EAAE,GAAG;aACZ,CAAA;QACH,CAAC;QACD,eAAe,CAAC,uBAAuB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QACnE,eAAe,CAAC,mBAAmB,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAA;IACrE,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,EAAE,OAAO,IAAI,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;QAC3D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,eAAe,CAAA;QAC5D,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,UAAU,CAAC,CAAA;QAChF,IAAI,CAAC,WAAW,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;YAC1D,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,eAAe;gBACxB,KAAK,EAAE,oBAAoB;gBAC3B,MAAM,EAAE,GAAG;aACZ,CAAA;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,CAAA;AACpD,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc;IACtC,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;AAC1E,CAAC;AAED,SAAS,WAAW,CAAC,OAAgB;IACnC,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAA;AACnF,CAAC;AAED,SAAS,WAAW,CAAC,YAAoB,EAAE,IAAY;IACrD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,cAAc,IAAI,UAAU,CAAC,CAAC,CAAA;IAC1E,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;AACnB,CAAC"}

package/dist/security/rate-limit-policy.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Chooses a rate-limit budget for a request.
+ *
+ * A single 100/minute per-IP bucket fits a browser, not a front-end. Astro and
+ * Next sites render server-side, so every one of their CMS reads arrives from
+ * the same serverless egress IP — the whole site shares one browser-sized
+ * bucket, and a crawler walking unique URLs (which never hit the front-end's
+ * read cache) can exhaust it for real visitors. When that happens the site
+ * gets a 429 on a document lookup and cannot tell whether the page exists.
+ *
+ * Splitting the anonymous, cacheable read endpoints into their own class with
+ * real headroom fixes that without loosening anything that matters: writes,
+ * auth, and admin reads keep the strict budget, in a separate counter so the
+ * two classes can never drain each other.
+ */
+export interface RateLimitPolicy {
+    /** Bucket-key prefix. Distinct per class so counters never overlap. */
+    readonly scope: string;
+    readonly windowMs: number;
+    readonly maxRequests: number;
+}
+/** Writes, auth, and everything reachable only by an authenticated operator. */
+export declare const DEFAULT_RATE_LIMIT: RateLimitPolicy;
+/**
+ * Anonymous, cacheable, read-only endpoints that a front-end calls per render.
+ *
+ * The ceiling is a runaway-loop guard rather than a per-visitor limit — abuse
+ * of these paths is a CDN concern, and they expose only published content.
+ */
+export declare const PUBLIC_READ_RATE_LIMIT: RateLimitPolicy;
+export declare function rateLimitPolicyFor(method: string, pathname: string): RateLimitPolicy;
+/**
+ * The counter key for a caller.
+ *
+ * An unresolvable IP collapses into one shared bucket per class, deliberately:
+ * a caller who has hidden their origin shares a budget with every other such
+ * caller rather than getting a private one.
+ */
+export declare function rateLimitBucket(policy: RateLimitPolicy, ip: string): string;
+//# sourceMappingURL=rate-limit-policy.d.ts.map

package/dist/security/rate-limit-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit-policy.d.ts","sourceRoot":"","sources":["../../src/security/rate-limit-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,eAAe;IAC9B,uEAAuE;IACvE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAID,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,EAAE,eAIhC,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE,eAIpC,CAAA;AAYD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,eAAe,CAOpF;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAE3E"}

package/dist/security/rate-limit-policy.js

@@ -0,0 +1,57 @@
+/**
+ * Chooses a rate-limit budget for a request.
+ *
+ * A single 100/minute per-IP bucket fits a browser, not a front-end. Astro and
+ * Next sites render server-side, so every one of their CMS reads arrives from
+ * the same serverless egress IP — the whole site shares one browser-sized
+ * bucket, and a crawler walking unique URLs (which never hit the front-end's
+ * read cache) can exhaust it for real visitors. When that happens the site
+ * gets a 429 on a document lookup and cannot tell whether the page exists.
+ *
+ * Splitting the anonymous, cacheable read endpoints into their own class with
+ * real headroom fixes that without loosening anything that matters: writes,
+ * auth, and admin reads keep the strict budget, in a separate counter so the
+ * two classes can never drain each other.
+ */
+const WINDOW_MS = 60_000;
+/** Writes, auth, and everything reachable only by an authenticated operator. */
+export const DEFAULT_RATE_LIMIT = {
+    scope: 'rl',
+    windowMs: WINDOW_MS,
+    maxRequests: 100,
+};
+/**
+ * Anonymous, cacheable, read-only endpoints that a front-end calls per render.
+ *
+ * The ceiling is a runaway-loop guard rather than a per-visitor limit — abuse
+ * of these paths is a CDN concern, and they expose only published content.
+ */
+export const PUBLIC_READ_RATE_LIMIT = {
+    scope: 'rl:pub',
+    windowMs: WINDOW_MS,
+    maxRequests: 1_000,
+};
+/** CMS-relative paths a front-end reads on every page render. */
+const PUBLIC_READ_PATHS = new Set(['/resolve', '/md', '/script-tags/resolve', '/redirects/public']);
+/** Everything published under `/public/` is anonymous and read-only by design. */
+const PUBLIC_READ_PREFIX = '/public/';
+const API_PREFIX = '/api/cms';
+const READ_METHODS = new Set(['GET', 'HEAD']);
+export function rateLimitPolicyFor(method, pathname) {
+    if (!READ_METHODS.has(method.toUpperCase()))
+        return DEFAULT_RATE_LIMIT;
+    const path = pathname.startsWith(API_PREFIX) ? pathname.slice(API_PREFIX.length) : pathname;
+    const isPublicRead = PUBLIC_READ_PATHS.has(path) || path.startsWith(PUBLIC_READ_PREFIX);
+    return isPublicRead ? PUBLIC_READ_RATE_LIMIT : DEFAULT_RATE_LIMIT;
+}
+/**
+ * The counter key for a caller.
+ *
+ * An unresolvable IP collapses into one shared bucket per class, deliberately:
+ * a caller who has hidden their origin shares a budget with every other such
+ * caller rather than getting a private one.
+ */
+export function rateLimitBucket(policy, ip) {
+    return `${policy.scope}:${ip === 'unknown' ? '_unknown' : ip}`;
+}
+//# sourceMappingURL=rate-limit-policy.js.map

package/dist/security/rate-limit-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit-policy.js","sourceRoot":"","sources":["../../src/security/rate-limit-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AASH,MAAM,SAAS,GAAG,MAAM,CAAA;AAExB,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAoB;IACjD,KAAK,EAAE,IAAI;IACX,QAAQ,EAAE,SAAS;IACnB,WAAW,EAAE,GAAG;CACjB,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAoB;IACrD,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,SAAS;IACnB,WAAW,EAAE,KAAK;CACnB,CAAA;AAED,iEAAiE;AACjE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,sBAAsB,EAAE,mBAAmB,CAAC,CAAC,CAAA;AAEnG,kFAAkF;AAClF,MAAM,kBAAkB,GAAG,UAAU,CAAA;AAErC,MAAM,UAAU,GAAG,UAAU,CAAA;AAE7B,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;AAE7C,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,QAAgB;IACjE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,kBAAkB,CAAA;IAEtE,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;IAC3F,MAAM,YAAY,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAA;IAEvF,OAAO,YAAY,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,kBAAkB,CAAA;AACnE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,MAAuB,EAAE,EAAU;IACjE,OAAO,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;AAChE,CAAC"}

package/dist/security/rate-limit.d.ts

@@ -0,0 +1,55 @@
+export interface RateLimitResult {
+    allowed: boolean;
+    remaining: number;
+    resetAt: Date;
+    retryAfter?: number;
+}
+export interface RateLimiter {
+    check(key: string): Promise<RateLimitResult>;
+    reset(key: string): Promise<void>;
+}
+export interface RateLimitConfig {
+    windowMs: number;
+    maxRequests: number;
+    /**
+     * Maximum number of distinct keys retained by the in-memory limiter.
+     * When exceeded, the oldest entry (insertion order) is evicted. Defaults
+     * to 10,000 — high enough to cover any legitimate single-process traffic
+     * while bounding worst-case memory under enumeration / IP-spoofing
+     * attacks. See M1 in the engineering audit.
+     */
+    maxKeys?: number;
+    /**
+     * When true, login/AI/upload-class limiters deny requests if Upstash is
+     * unavailable (production) or returns an error, instead of failing open.
+     */
+    failClosed?: boolean;
+}
+/** Create a rate limiter backed by an in-memory sliding window (for dev/single-process). */
+export declare function createInMemoryRateLimiter(config: RateLimitConfig): RateLimiter;
+/** Log once at boot when strict limiters cannot reach a distributed backend in production. */
+export declare function warnStrictRateLimitConfigAtBoot(): void;
+/**
+ * Resolve the Upstash REST URL + token from the environment.
+ *
+ * Accepts two naming schemes for the same credentials:
+ *   1. `UPSTASH_REDIS_REST_URL` / `UPSTASH_REDIS_REST_TOKEN` — what you get
+ *      from the Upstash console directly.
+ *   2. `KV_REST_API_URL` / `KV_REST_API_TOKEN` — what Vercel's Marketplace
+ *      Upstash (Redis/KV) integration auto-provisions. This is the *recommended*
+ *      provisioning path in our deploy docs, so we must read these names too —
+ *      otherwise a correctly-provisioned store silently falls back to the
+ *      in-memory limiter.
+ *
+ * `UPSTASH_*` wins when both are present so an explicit override is honoured.
+ * Both values point at the same REST endpoint / full-access token, so the
+ * `/pipeline` transport below works identically regardless of which was set.
+ */
+export declare function resolveUpstashCredentials(env?: NodeJS.ProcessEnv): {
+    url?: string;
+    token?: string;
+};
+/** Create a rate limiter backed by Upstash Redis (for serverless/production). */
+export declare function createUpstashRateLimiter(config: RateLimitConfig): RateLimiter;
+export declare function createRateLimiter(config: RateLimitConfig): RateLimiter;
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/security/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/security/rate-limit.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,IAAI,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;IAC5C,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AASD,4FAA4F;AAC5F,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,eAAe,GAAG,WAAW,CAmE9E;AAmCD,8FAA8F;AAC9F,wBAAgB,+BAA+B,IAAI,IAAI,CAQtD;AA6BD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAKA;AAED,iFAAiF;AACjF,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,eAAe,GAAG,WAAW,CA8F7E;AA6BD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,eAAe,GAAG,WAAW,CA+BtE"}