@prenta/core 0.118.0

package/dist/security/rate-limit.js

@@ -0,0 +1,298 @@
+import { createLogger } from '../diagnostics/logger.js';
+const logger = createLogger('rate-limit');
+const DEFAULT_MAX_KEYS = 10_000;
+/**
+ * Sweep expired entries on every Nth `check()` call. Tunable at module level
+ * so tests can stub it without exposing it via the public config surface.
+ */
+const SWEEP_EVERY_N_CHECKS = 256;
+/** Create a rate limiter backed by an in-memory sliding window (for dev/single-process). */
+export function createInMemoryRateLimiter(config) {
+    // `Map` preserves insertion order so we can use it as an LRU directly:
+    // every `check()` re-inserts the touched key (delete + set) which moves it
+    // to the tail. When we exceed the cap, `windows.keys().next().value` is the
+    // least-recently-touched entry and we evict it.
+    const windows = new Map();
+    const maxKeys = config.maxKeys && config.maxKeys > 0 ? config.maxKeys : DEFAULT_MAX_KEYS;
+    let checksSinceSweep = 0;
+    function sweepExpired(now) {
+        // Bounded periodic cleanup of expired entries. We cap iterations so a
+        // pathological burst of new keys can't make this O(n) on every call.
+        let removed = 0;
+        for (const [key, entry] of windows) {
+            if (entry.resetAt <= now) {
+                windows.delete(key);
+                removed++;
+                if (removed >= 1000)
+                    break;
+            }
+        }
+    }
+    function evictIfFull() {
+        while (windows.size >= maxKeys) {
+            const oldestKey = windows.keys().next().value;
+            if (oldestKey === undefined)
+                break;
+            windows.delete(oldestKey);
+        }
+    }
+    return {
+        async check(key) {
+            const now = Date.now();
+            checksSinceSweep++;
+            if (checksSinceSweep >= SWEEP_EVERY_N_CHECKS) {
+                checksSinceSweep = 0;
+                sweepExpired(now);
+            }
+            const entry = windows.get(key);
+            if (!entry || now > entry.resetAt) {
+                const resetAt = now + config.windowMs;
+                windows.delete(key);
+                evictIfFull();
+                windows.set(key, { count: 1, resetAt });
+                return { allowed: true, remaining: config.maxRequests - 1, resetAt: new Date(resetAt) };
+            }
+            entry.count++;
+            // Re-insert to mark as most-recently-used.
+            windows.delete(key);
+            windows.set(key, entry);
+            const allowed = entry.count <= config.maxRequests;
+            return {
+                allowed,
+                remaining: Math.max(0, config.maxRequests - entry.count),
+                resetAt: new Date(entry.resetAt),
+                retryAfter: allowed ? undefined : Math.ceil((entry.resetAt - now) / 1000),
+            };
+        },
+        async reset(key) {
+            windows.delete(key);
+        },
+    };
+}
+/**
+ * Throttle the noisy "Upstash failed" audit event so a sustained outage does
+ * not generate one DB write per request. We allow at most one audit log per
+ * `AUDIT_THROTTLE_MS`. The `console.error` line still fires on every failure
+ * for live operator visibility.
+ */
+const AUDIT_THROTTLE_MS = 60_000;
+let lastAuditAt = 0;
+let strictRateLimitWarned = false;
+function isProductionRuntime() {
+    return process.env.NODE_ENV === 'production';
+}
+function denyResult(config) {
+    const retryAfter = Math.ceil(config.windowMs / 1000);
+    return {
+        allowed: false,
+        remaining: 0,
+        resetAt: new Date(Date.now() + config.windowMs),
+        retryAfter,
+    };
+}
+function warnStrictRateLimitMisconfig(reason) {
+    if (strictRateLimitWarned)
+        return;
+    strictRateLimitWarned = true;
+    logger.error('Strict rate limiters (login, AI, uploads) are misconfigured — requests will be denied until Upstash Redis is available', { reason });
+}
+/** Log once at boot when strict limiters cannot reach a distributed backend in production. */
+export function warnStrictRateLimitConfigAtBoot() {
+    if (process.env.PRENTA_DISABLE_RATE_LIMIT === '1')
+        return;
+    if (!isProductionRuntime())
+        return;
+    const { url, token } = resolveUpstashCredentials();
+    if (url && token)
+        return;
+    warnStrictRateLimitMisconfig('Set UPSTASH_REDIS_REST_URL + UPSTASH_REDIS_REST_TOKEN (or KV_REST_API_URL + KV_REST_API_TOKEN)');
+}
+function createUnavailableRateLimiter(config, reason) {
+    warnStrictRateLimitMisconfig(reason);
+    void emitDegradedAudit(reason);
+    return {
+        async check() {
+            return denyResult(config);
+        },
+        async reset() { },
+    };
+}
+async function emitDegradedAudit(reason) {
+    const now = Date.now();
+    if (now - lastAuditAt < AUDIT_THROTTLE_MS)
+        return;
+    lastAuditAt = now;
+    try {
+        // Lazy import — avoids a static dep cycle (audit.ts -> db.js -> ...).
+        const { logEvent } = await import('./audit.js');
+        await logEvent({
+            event: 'rate_limit.degraded',
+            details: { reason, throttleMs: AUDIT_THROTTLE_MS },
+        });
+    }
+    catch {
+        // Audit failures are themselves logged in audit.ts; don't double-log here.
+    }
+}
+/**
+ * Resolve the Upstash REST URL + token from the environment.
+ *
+ * Accepts two naming schemes for the same credentials:
+ *   1. `UPSTASH_REDIS_REST_URL` / `UPSTASH_REDIS_REST_TOKEN` — what you get
+ *      from the Upstash console directly.
+ *   2. `KV_REST_API_URL` / `KV_REST_API_TOKEN` — what Vercel's Marketplace
+ *      Upstash (Redis/KV) integration auto-provisions. This is the *recommended*
+ *      provisioning path in our deploy docs, so we must read these names too —
+ *      otherwise a correctly-provisioned store silently falls back to the
+ *      in-memory limiter.
+ *
+ * `UPSTASH_*` wins when both are present so an explicit override is honoured.
+ * Both values point at the same REST endpoint / full-access token, so the
+ * `/pipeline` transport below works identically regardless of which was set.
+ */
+export function resolveUpstashCredentials(env = process.env) {
+    return {
+        url: env.UPSTASH_REDIS_REST_URL ?? env.KV_REST_API_URL,
+        token: env.UPSTASH_REDIS_REST_TOKEN ?? env.KV_REST_API_TOKEN,
+    };
+}
+/** Create a rate limiter backed by Upstash Redis (for serverless/production). */
+export function createUpstashRateLimiter(config) {
+    const { url, token } = resolveUpstashCredentials();
+    if (!url || !token) {
+        throw new Error('Upstash credentials are required: set UPSTASH_REDIS_REST_URL + UPSTASH_REDIS_REST_TOKEN ' +
+            '(or the Vercel-provisioned KV_REST_API_URL + KV_REST_API_TOKEN).');
+    }
+    async function redisPipeline(commands) {
+        // Upstash exposes pipelined commands via the /pipeline endpoint. Sending
+        // INCR + EXPIRE in a single round-trip eliminates the race where the
+        // process dies after INCR (or where EXPIRE silently fails) and leaves a
+        // counter that never resets — a subtle DoS where one unlucky user is
+        // permanently locked out.
+        const response = await fetch(`${url}/pipeline`, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${token}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify(commands),
+        });
+        if (!response.ok) {
+            throw new Error(`Upstash pipeline returned ${response.status}`);
+        }
+        const data = (await response.json());
+        return data.map((entry) => entry?.result);
+    }
+    const windowSec = Math.ceil(config.windowMs / 1000);
+    return {
+        async check(key) {
+            const redisKey = `ratelimit:${key}`;
+            try {
+                const [count, _expireResult, ttl] = (await redisPipeline([
+                    ['INCR', redisKey],
+                    ['EXPIRE', redisKey, String(windowSec), 'NX'], // only set when no TTL exists
+                    ['TTL', redisKey],
+                ]));
+                // Belt-and-braces: if Redis reports the key with no TTL, set one. This
+                // can only happen if the EXPIRE NX above wasn't supported, in which
+                // case we still want to bound the counter's lifetime.
+                if (ttl < 0) {
+                    await redisPipeline([['EXPIRE', redisKey, String(windowSec)]]).catch(() => undefined);
+                }
+                const effectiveTtl = ttl > 0 ? ttl : windowSec;
+                const resetAt = new Date(Date.now() + effectiveTtl * 1000);
+                const allowed = count <= config.maxRequests;
+                return {
+                    allowed,
+                    remaining: Math.max(0, config.maxRequests - count),
+                    resetAt,
+                    retryAfter: allowed ? undefined : effectiveTtl,
+                };
+            }
+            catch (err) {
+                const reason = err instanceof Error ? err.message : String(err);
+                if (config.failClosed) {
+                    logger.error('Upstash request failed, denying request (fail-closed)', { reason });
+                    void emitDegradedAudit(reason);
+                    return denyResult(config);
+                }
+                // Fail open with logging — a Redis outage should NOT take the entire
+                // CMS offline. We surface the degradation through:
+                //   1. console.error for live ops/log aggregator dashboards;
+                //   2. a throttled audit-log event so the outage is preserved in the
+                //      durable security record without flooding the DB during long
+                //      Upstash incidents.
+                logger.error('Upstash request failed, allowing through', { reason });
+                void emitDegradedAudit(reason);
+                return {
+                    allowed: true,
+                    remaining: Math.max(0, config.maxRequests - 1),
+                    resetAt: new Date(Date.now() + config.windowMs),
+                };
+            }
+        },
+        async reset(key) {
+            try {
+                await redisPipeline([['DEL', `ratelimit:${key}`]]);
+            }
+            catch (err) {
+                logger.error('Upstash reset failed', {
+                    reason: err instanceof Error ? err.message : String(err),
+                });
+            }
+        },
+    };
+}
+/**
+ * Create a rate limiter with automatic backend detection.
+ * Uses Upstash Redis if UPSTASH_REDIS_REST_URL is set, otherwise falls back to in-memory.
+ */
+/**
+ * Returns a rate limiter that always permits requests.
+ *
+ * Useful for test harnesses (Playwright, Vitest, k6) where every test
+ * shares the same client-side IP — without a bypass, the first 5 login
+ * attempts exhaust the strict 5-per-15-minute bucket and every later
+ * test fails with HTTP 429. Production never sets the env var that
+ * activates this; the activation lives in `createRateLimiter` so every
+ * caller gets it without scattering env checks across the codebase.
+ */
+function createPermissiveRateLimiter(config) {
+    return {
+        async check() {
+            return {
+                allowed: true,
+                remaining: config.maxRequests,
+                resetAt: new Date(Date.now() + config.windowMs),
+            };
+        },
+        async reset() { },
+    };
+}
+export function createRateLimiter(config) {
+    // Explicit, environment-gated bypass for test harnesses. We deliberately
+    // do NOT key off `NODE_ENV === 'test'` because Next.js builds run with
+    // NODE_ENV=test in some CI configurations and we want unit tests that
+    // explicitly opt in to still exercise the real limiter logic. Vercel +
+    // the deploy guide both omit this var, so production never disables.
+    if (process.env.PRENTA_DISABLE_RATE_LIMIT === '1') {
+        return createPermissiveRateLimiter(config);
+    }
+    const { url, token } = resolveUpstashCredentials();
+    if (config.failClosed && isProductionRuntime() && (!url || !token)) {
+        return createUnavailableRateLimiter(config, 'Upstash credentials missing for strict rate limiter in production');
+    }
+    if (url && token) {
+        try {
+            return createUpstashRateLimiter(config);
+        }
+        catch {
+            if (config.failClosed && isProductionRuntime()) {
+                return createUnavailableRateLimiter(config, 'Upstash rate limiter init failed');
+            }
+            // Non-strict limiters fall back to in-memory when Upstash init fails.
+        }
+    }
+    return createInMemoryRateLimiter(config);
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/security/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../src/security/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAEvD,MAAM,MAAM,GAAG,YAAY,CAAC,YAAY,CAAC,CAAA;AAgCzC,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAC/B;;;GAGG;AACH,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAEhC,4FAA4F;AAC5F,MAAM,UAAU,yBAAyB,CAAC,MAAuB;IAC/D,uEAAuE;IACvE,2EAA2E;IAC3E,4EAA4E;IAC5E,gDAAgD;IAChD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8C,CAAA;IACrE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAA;IACxF,IAAI,gBAAgB,GAAG,CAAC,CAAA;IAExB,SAAS,YAAY,CAAC,GAAW;QAC/B,sEAAsE;QACtE,qEAAqE;QACrE,IAAI,OAAO,GAAG,CAAC,CAAA;QACf,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACnC,IAAI,KAAK,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;gBACzB,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBACnB,OAAO,EAAE,CAAA;gBACT,IAAI,OAAO,IAAI,IAAI;oBAAE,MAAK;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,WAAW;QAClB,OAAO,OAAO,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YAC7C,IAAI,SAAS,KAAK,SAAS;gBAAE,MAAK;YAClC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC3B,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,GAAW;YACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YACtB,gBAAgB,EAAE,CAAA;YAClB,IAAI,gBAAgB,IAAI,oBAAoB,EAAE,CAAC;gBAC7C,gBAAgB,GAAG,CAAC,CAAA;gBACpB,YAAY,CAAC,GAAG,CAAC,CAAA;YACnB,CAAC;YAED,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAE9B,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;gBAClC,MAAM,OAAO,GAAG,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAA;gBACrC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBACnB,WAAW,EAAE,CAAA;gBACb,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;gBACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,WAAW,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAA;YACzF,CAAC;YAED,KAAK,CAAC,KAAK,EAAE,CAAA;YACb,2CAA2C;YAC3C,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACnB,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YAEvB,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,WAAW,CAAA;YACjD,OAAO;gBACL,OAAO;gBACP,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC;gBACxD,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;gBAChC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC;aAC1E,CAAA;QACH,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,GAAW;YACrB,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACrB,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,MAAM,CAAA;AAChC,IAAI,WAAW,GAAG,CAAC,CAAA;AACnB,IAAI,qBAAqB,GAAG,KAAK,CAAA;AAEjC,SAAS,mBAAmB;IAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAA;AAC9C,CAAC;AAED,SAAS,UAAU,CAAC,MAAuB;IACzC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAA;IACpD,OAAO;QACL,OAAO,EAAE,KAAK;QACd,SAAS,EAAE,CAAC;QACZ,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC/C,UAAU;KACX,CAAA;AACH,CAAC;AAED,SAAS,4BAA4B,CAAC,MAAc;IAClD,IAAI,qBAAqB;QAAE,OAAM;IACjC,qBAAqB,GAAG,IAAI,CAAA;IAC5B,MAAM,CAAC,KAAK,CACV,wHAAwH,EACxH,EAAE,MAAM,EAAE,CACX,CAAA;AACH,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,+BAA+B;IAC7C,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,GAAG;QAAE,OAAM;IACzD,IAAI,CAAC,mBAAmB,EAAE;QAAE,OAAM;IAClC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,yBAAyB,EAAE,CAAA;IAClD,IAAI,GAAG,IAAI,KAAK;QAAE,OAAM;IACxB,4BAA4B,CAC1B,gGAAgG,CACjG,CAAA;AACH,CAAC;AAED,SAAS,4BAA4B,CAAC,MAAuB,EAAE,MAAc;IAC3E,4BAA4B,CAAC,MAAM,CAAC,CAAA;IACpC,KAAK,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAC9B,OAAO;QACL,KAAK,CAAC,KAAK;YACT,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;QAC3B,CAAC;QACD,KAAK,CAAC,KAAK,KAAmB,CAAC;KAChC,CAAA;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,MAAc;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,IAAI,GAAG,GAAG,WAAW,GAAG,iBAAiB;QAAE,OAAM;IACjD,WAAW,GAAG,GAAG,CAAA;IACjB,IAAI,CAAC;QACH,sEAAsE;QACtE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAA;QAC/C,MAAM,QAAQ,CAAC;YACb,KAAK,EAAE,qBAAqB;YAC5B,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE;SACnD,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;IAC7E,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAI5E,OAAO;QACL,GAAG,EAAE,GAAG,CAAC,sBAAsB,IAAI,GAAG,CAAC,eAAe;QACtD,KAAK,EAAE,GAAG,CAAC,wBAAwB,IAAI,GAAG,CAAC,iBAAiB;KAC7D,CAAA;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,wBAAwB,CAAC,MAAuB;IAC9D,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,yBAAyB,EAAE,CAAA;IAElD,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,0FAA0F;YACxF,kEAAkE,CACrE,CAAA;IACH,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,QAAoB;QAC/C,yEAAyE;QACzE,qEAAqE;QACrE,wEAAwE;QACxE,qEAAqE;QACrE,0BAA0B;QAC1B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,WAAW,EAAE;YAC9C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;SAC/B,CAAC,CAAA;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QACjE,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4C,CAAA;QAC/E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IAC3C,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAA;IAEnD,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,GAAW;YACrB,MAAM,QAAQ,GAAG,aAAa,GAAG,EAAE,CAAA;YAEnC,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,aAAa,CAAC;oBACvD,CAAC,MAAM,EAAE,QAAQ,CAAC;oBAClB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,EAAE,8BAA8B;oBAC7E,CAAC,KAAK,EAAE,QAAQ,CAAC;iBAClB,CAAC,CAA6B,CAAA;gBAE/B,uEAAuE;gBACvE,oEAAoE;gBACpE,sDAAsD;gBACtD,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;oBACZ,MAAM,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;gBACvF,CAAC;gBAED,MAAM,YAAY,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;gBAC9C,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,GAAG,IAAI,CAAC,CAAA;gBAC1D,MAAM,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,WAAW,CAAA;gBAE3C,OAAO;oBACL,OAAO;oBACP,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC;oBAClD,OAAO;oBACP,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY;iBAC/C,CAAA;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBAC/D,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;oBACtB,MAAM,CAAC,KAAK,CAAC,uDAAuD,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;oBACjF,KAAK,iBAAiB,CAAC,MAAM,CAAC,CAAA;oBAC9B,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;gBAC3B,CAAC;gBACD,qEAAqE;gBACrE,mDAAmD;gBACnD,6DAA6D;gBAC7D,qEAAqE;gBACrE,mEAAmE;gBACnE,0BAA0B;gBAC1B,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;gBACpE,KAAK,iBAAiB,CAAC,MAAM,CAAC,CAAA;gBAC9B,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC;oBAC9C,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;iBAChD,CAAA;YACH,CAAC;QACH,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,GAAW;YACrB,IAAI,CAAC;gBACH,MAAM,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,aAAa,GAAG,EAAE,CAAC,CAAC,CAAC,CAAA;YACpD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE;oBACnC,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACzD,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;GAGG;AACH;;;;;;;;;GASG;AACH,SAAS,2BAA2B,CAAC,MAAuB;IAC1D,OAAO;QACL,KAAK,CAAC,KAAK;YACT,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,MAAM,CAAC,WAAW;gBAC7B,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;aAChD,CAAA;QACH,CAAC;QACD,KAAK,CAAC,KAAK,KAAmB,CAAC;KAChC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAuB;IACvD,yEAAyE;IACzE,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,qEAAqE;IACrE,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,GAAG,EAAE,CAAC;QAClD,OAAO,2BAA2B,CAAC,MAAM,CAAC,CAAA;IAC5C,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,yBAAyB,EAAE,CAAA;IAElD,IAAI,MAAM,CAAC,UAAU,IAAI,mBAAmB,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnE,OAAO,4BAA4B,CACjC,MAAM,EACN,mEAAmE,CACpE,CAAA;IACH,CAAC;IAED,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAA;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,MAAM,CAAC,UAAU,IAAI,mBAAmB,EAAE,EAAE,CAAC;gBAC/C,OAAO,4BAA4B,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAAA;YACjF,CAAC;YACD,sEAAsE;QACxE,CAAC;IACH,CAAC;IAED,OAAO,yBAAyB,CAAC,MAAM,CAAC,CAAA;AAC1C,CAAC"}

package/dist/security/reauth.d.ts

@@ -0,0 +1,16 @@
+import type { PrentaDB } from '../db/client-types.js';
+export interface ReauthConfig {
+    maxAgeSeconds: number;
+    requiredForActions: string[];
+}
+export interface ReauthContext {
+    lastAuthAt: Date;
+    action: string;
+}
+/** Check whether a sensitive action requires re-authentication. */
+export declare function requiresReauth(context: ReauthContext, config: ReauthConfig): boolean;
+/** Verify re-authentication credentials (password or TOTP). */
+export declare function verifyReauth(userId: string, credential: string, method: 'password' | 'totp', db?: PrentaDB): Promise<boolean>;
+/** Default configuration for sensitive actions requiring re-auth. */
+export declare const DEFAULT_REAUTH_CONFIG: ReauthConfig;
+//# sourceMappingURL=reauth.d.ts.map

package/dist/security/reauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reauth.d.ts","sourceRoot":"","sources":["../../src/security/reauth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAErD,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,CAAA;IACrB,kBAAkB,EAAE,MAAM,EAAE,CAAA;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,IAAI,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;CACf;AAED,mEAAmE;AACnE,wBAAgB,cAAc,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAIpF;AAED,+DAA+D;AAC/D,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,UAAU,GAAG,MAAM,EAC3B,EAAE,CAAC,EAAE,QAAQ,GACZ,OAAO,CAAC,OAAO,CAAC,CAuClB;AAED,qEAAqE;AACrE,eAAO,MAAM,qBAAqB,EAAE,YASnC,CAAA"}

package/dist/security/reauth.js

@@ -0,0 +1,56 @@
+import { verifyPassword } from '../auth/password.js';
+/** Check whether a sensitive action requires re-authentication. */
+export function requiresReauth(context, config) {
+    if (!config.requiredForActions.includes(context.action))
+        return false;
+    const elapsed = (Date.now() - context.lastAuthAt.getTime()) / 1000;
+    return elapsed > config.maxAgeSeconds;
+}
+/** Verify re-authentication credentials (password or TOTP). */
+export async function verifyReauth(userId, credential, method, db) {
+    if (!db) {
+        const { getDB } = await import('../db.js');
+        db = getDB();
+    }
+    if (method === 'totp') {
+        const user = await db.user.findUnique({
+            where: { id: userId },
+            select: { totpEnabled: true, totpSecret: true, isActive: true },
+        });
+        if (!user || !user.isActive || !user.totpEnabled || !user.totpSecret) {
+            return false;
+        }
+        // totpSecret is stored ENCRYPTED at rest — decrypt before verifying, exactly
+        // as the login flow does. Passing the ciphertext straight to verifyTOTP made
+        // TOTP re-auth silently always fail. Fail closed if decryption throws
+        // (e.g. a rotated encryption key).
+        const { verifyTOTP } = await import('../auth/totp.js');
+        const { decryptSecret } = await import('./secret-storage.js');
+        try {
+            return verifyTOTP(credential, await decryptSecret(user.totpSecret));
+        }
+        catch {
+            return false;
+        }
+    }
+    const user = await db.user.findUnique({
+        where: { id: userId },
+        select: { passwordHash: true, isActive: true },
+    });
+    if (!user || !user.isActive || !user.passwordHash) {
+        return false;
+    }
+    return verifyPassword(credential, user.passwordHash);
+}
+/** Default configuration for sensitive actions requiring re-auth. */
+export const DEFAULT_REAUTH_CONFIG = {
+    maxAgeSeconds: 300,
+    requiredForActions: [
+        'delete_user',
+        'change_user_role',
+        'change_settings',
+        'export_data',
+        'reset_password_other',
+    ],
+};
+//# sourceMappingURL=reauth.js.map

package/dist/security/reauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reauth.js","sourceRoot":"","sources":["../../src/security/reauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAapD,mEAAmE;AACnE,MAAM,UAAU,cAAc,CAAC,OAAsB,EAAE,MAAoB;IACzE,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IACrE,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAA;IAClE,OAAO,OAAO,GAAG,MAAM,CAAC,aAAa,CAAA;AACvC,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAc,EACd,UAAkB,EAClB,MAA2B,EAC3B,EAAa;IAEb,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAA;QAC1C,EAAE,GAAG,KAAK,EAAY,CAAA;IACxB,CAAC;IAED,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;YACpC,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;YACrB,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;SAChE,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrE,OAAO,KAAK,CAAA;QACd,CAAC;QAED,6EAA6E;QAC7E,6EAA6E;QAC7E,sEAAsE;QACtE,mCAAmC;QACnC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAA;QACtD,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAA;QAC7D,IAAI,CAAC;YACH,OAAO,UAAU,CAAC,UAAU,EAAE,MAAM,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAA;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;QACpC,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;QACrB,MAAM,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC/C,CAAC,CAAA;IAEF,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;AACtD,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,MAAM,qBAAqB,GAAiB;IACjD,aAAa,EAAE,GAAG;IAClB,kBAAkB,EAAE;QAClB,aAAa;QACb,kBAAkB;QAClB,iBAAiB;QACjB,aAAa;QACb,sBAAsB;KACvB;CACF,CAAA"}

package/dist/security/redact.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Best-effort scrubber for secrets pasted into prompts, search queries, and
+ * other user-supplied text that ends up in audit logs. Replaces matched
+ * patterns with `[REDACTED]` so we don't store live keys/tokens in plain
+ * `details` JSON.
+ *
+ * This is defensive, not exhaustive — clients should never paste secrets
+ * into prompts in the first place. The patterns favour false negatives over
+ * false positives so we don't mangle legitimate content.
+ */
+export declare function redactSecrets(input: string): string;
+//# sourceMappingURL=redact.d.ts.map

package/dist/security/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/security/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AA4BH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOnD"}

package/dist/security/redact.js

@@ -0,0 +1,44 @@
+/**
+ * Best-effort scrubber for secrets pasted into prompts, search queries, and
+ * other user-supplied text that ends up in audit logs. Replaces matched
+ * patterns with `[REDACTED]` so we don't store live keys/tokens in plain
+ * `details` JSON.
+ *
+ * This is defensive, not exhaustive — clients should never paste secrets
+ * into prompts in the first place. The patterns favour false negatives over
+ * false positives so we don't mangle legitimate content.
+ */
+const PATTERNS = [
+    // OpenAI / Anthropic / Google API keys
+    { name: 'openai-key', regex: /\bsk-[A-Za-z0-9_-]{20,}\b/g },
+    { name: 'anthropic-key', regex: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g },
+    // Prenta API keys
+    { name: 'prenta-key', regex: /\bact_[A-Za-z0-9_]{20,}\b/g },
+    // GitHub tokens
+    { name: 'github-token', regex: /\bgh[opsu]_[A-Za-z0-9]{30,}\b/g },
+    // AWS access keys
+    { name: 'aws-access-key', regex: /\bAKIA[0-9A-Z]{16}\b/g },
+    // AWS secret access keys (40 char base64-ish, prefixed with common context words)
+    {
+        name: 'aws-secret',
+        regex: /\b(?:aws_secret_access_key|aws_secret|secret_key)\s*[:=]\s*["']?([A-Za-z0-9/+]{40})["']?/gi,
+    },
+    // JWTs (3 base64url segments)
+    { name: 'jwt', regex: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g },
+    // Slack tokens
+    { name: 'slack-token', regex: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
+    // Stripe keys
+    { name: 'stripe-key', regex: /\b(?:sk|pk|rk)_(?:test|live)_[A-Za-z0-9]{20,}\b/g },
+    // Generic password assignment
+    { name: 'password-assign', regex: /\b(?:password|passwd|pwd)\s*[:=]\s*["']([^"']{6,})["']/gi },
+];
+export function redactSecrets(input) {
+    if (!input)
+        return input;
+    let result = input;
+    for (const { regex } of PATTERNS) {
+        result = result.replace(regex, '[REDACTED]');
+    }
+    return result;
+}
+//# sourceMappingURL=redact.js.map

package/dist/security/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/security/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,QAAQ,GAA2C;IACvD,uCAAuC;IACvC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,4BAA4B,EAAE;IAC3D,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,gCAAgC,EAAE;IAClE,kBAAkB;IAClB,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,4BAA4B,EAAE;IAC3D,gBAAgB;IAChB,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,gCAAgC,EAAE;IACjE,kBAAkB;IAClB,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,uBAAuB,EAAE;IAC1D,kFAAkF;IAClF;QACE,IAAI,EAAE,YAAY;QAClB,KAAK,EACH,4FAA4F;KAC/F;IACD,8BAA8B;IAC9B,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,oEAAoE,EAAE;IAC5F,eAAe;IACf,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,mCAAmC,EAAE;IACnE,cAAc;IACd,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,kDAAkD,EAAE;IACjF,8BAA8B;IAC9B,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,0DAA0D,EAAE;CAC/F,CAAA;AAED,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IACxB,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,QAAQ,EAAE,CAAC;QACjC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;IAC9C,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/security/safe-fetch.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Perform a `fetch()` with SSRF defenses applied:
+ *
+ *  - Reject non-http/https URLs (no `file:`, `gopher:`, `data:`).
+ *  - Reject hostnames that resolve to private/loopback IP literals via the
+ *    canonicalizer in `ip-canon.ts` (decimal, octal, hex, IPv4-mapped IPv6,
+ *    short-form, CGNAT, cloud metadata, etc.).
+ *  - Reject `localhost`, `0.0.0.0`, and `*.internal` hostnames.
+ *  - DNS-resolve the hostname before fetching and reject if any A/AAAA record
+ *    lands in a private range. This defeats DNS rebinding — without it, an
+ *    attacker controlling DNS for `evil.tld` returns `8.8.8.8` to our
+ *    validator and `127.0.0.1` to the actual `fetch`. The pre-resolution
+ *    forces the same lookup.
+ *  - Disable HTTP redirects by default (`redirect: 'manual'`) — a 302 to an
+ *    internal address would otherwise smuggle the request past the validator.
+ *    When `followRedirects: true`, each hop is re-validated AND re-resolved.
+ *  - Apply a hard request timeout via `AbortSignal.timeout`.
+ *
+ * Use this for any internal `fetch()` call that targets a URL derived from
+ * user/admin input (webhooks, link health, image URL fetches, etc).
+ *
+ * **Runtime caveat:** DNS resolution uses `node:dns/promises`. On Edge / Bun
+ * / Workers without that module, `resolveDns` is skipped and only the
+ * URL-string check applies — set `requireDnsCheck: true` to fail closed on
+ * runtimes where the resolver isn't available.
+ */
+export interface SafeFetchOptions extends RequestInit {
+    /** Hard timeout applied via AbortSignal. Defaults to 5000ms. */
+    timeoutMs?: number;
+    /** When true, allow following redirects. Each hop is re-validated. Default: false. */
+    followRedirects?: boolean;
+    /** Maximum number of redirect hops when followRedirects is true. Default: 3. */
+    maxRedirects?: number;
+    /**
+     * When true, DNS resolution failures (including missing `node:dns/promises`)
+     * cause the request to fail closed with an `SsrfBlockedError` instead of
+     * proceeding with only the string-level check. Default: false (best effort
+     * — preserves portability across Edge/Workers runtimes).
+     */
+    requireDnsCheck?: boolean;
+    /**
+     * Test seam — allows tests to substitute a fake resolver instead of hitting
+     * real DNS. Production callers leave this undefined.
+     */
+    _resolver?: (hostname: string) => Promise<{
+        safe: boolean;
+        resolvedIp?: string;
+        error?: string;
+    }>;
+}
+export declare class SsrfBlockedError extends Error {
+    readonly url: string;
+    readonly reason: string;
+    constructor(url: string, reason: string);
+}
+export declare function safeFetch(url: string, options?: SafeFetchOptions): Promise<Response>;
+//# sourceMappingURL=safe-fetch.d.ts.map

package/dist/security/safe-fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-fetch.d.ts","sourceRoot":"","sources":["../../src/security/safe-fetch.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,sFAAsF;IACtF,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAClG;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;gBACX,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAMxC;AAuCD,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,QAAQ,CAAC,CA0C9F"}

package/dist/security/safe-fetch.js

@@ -0,0 +1,71 @@
+import { resolveAndCheck, validateWebhookUrl } from './webhook.js';
+export class SsrfBlockedError extends Error {
+    url;
+    reason;
+    constructor(url, reason) {
+        super(`SSRF blocked: ${reason} (url=${url})`);
+        this.name = 'SsrfBlockedError';
+        this.url = url;
+        this.reason = reason;
+    }
+}
+async function preflightUrl(url, options) {
+    const check = validateWebhookUrl(url);
+    if (!check.valid) {
+        throw new SsrfBlockedError(url, check.error ?? 'URL rejected by SSRF policy');
+    }
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new SsrfBlockedError(url, 'invalid URL');
+    }
+    // resolveAndCheck short-circuits when the hostname is already an IP literal
+    // (which validateWebhookUrl just covered), so this only does real DNS work
+    // for actual hostnames.
+    let resolved;
+    try {
+        resolved = await options.resolver(parsed.hostname);
+    }
+    catch (err) {
+        if (options.requireDnsCheck) {
+            throw new SsrfBlockedError(url, `DNS resolution failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        return; // best-effort mode: proceed with string check only
+    }
+    if (!resolved.safe) {
+        throw new SsrfBlockedError(url, resolved.error ?? 'hostname resolves to a private IP');
+    }
+}
+export async function safeFetch(url, options = {}) {
+    const { timeoutMs = 5000, followRedirects = false, maxRedirects = 3, requireDnsCheck = false, _resolver = resolveAndCheck, ...init } = options;
+    let currentUrl = url;
+    let hops = 0;
+    while (true) {
+        await preflightUrl(currentUrl, { requireDnsCheck, resolver: _resolver });
+        const response = await fetch(currentUrl, {
+            ...init,
+            redirect: 'manual',
+            signal: init.signal ?? AbortSignal.timeout(timeoutMs),
+        });
+        const isRedirect = response.status >= 300 && response.status < 400;
+        if (!isRedirect || !followRedirects) {
+            return response;
+        }
+        if (hops >= maxRedirects) {
+            throw new SsrfBlockedError(currentUrl, `exceeded ${maxRedirects} redirects`);
+        }
+        const location = response.headers.get('location');
+        if (!location)
+            return response;
+        try {
+            currentUrl = new URL(location, currentUrl).toString();
+        }
+        catch {
+            throw new SsrfBlockedError(location, 'invalid Location header');
+        }
+        hops += 1;
+    }
+}
+//# sourceMappingURL=safe-fetch.js.map

package/dist/security/safe-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-fetch.js","sourceRoot":"","sources":["../../src/security/safe-fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAiDlE,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,GAAG,CAAQ;IACX,MAAM,CAAQ;IACvB,YAAY,GAAW,EAAE,MAAc;QACrC,KAAK,CAAC,iBAAiB,MAAM,SAAS,GAAG,GAAG,CAAC,CAAA;QAC7C,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAA;QAC9B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;QACd,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;CACF;AAED,KAAK,UAAU,YAAY,CACzB,GAAW,EACX,OAA2F;IAE3F,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,IAAI,6BAA6B,CAAC,CAAA;IAC/E,CAAC;IAED,IAAI,MAAW,CAAA;IACf,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;IAChD,CAAC;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,wBAAwB;IACxB,IAAI,QAAQ,CAAA;IACZ,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5B,MAAM,IAAI,gBAAgB,CACxB,GAAG,EACH,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC7E,CAAA;QACH,CAAC;QACD,OAAM,CAAC,mDAAmD;IAC5D,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,IAAI,mCAAmC,CAAC,CAAA;IACxF,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,UAA4B,EAAE;IACzE,MAAM,EACJ,SAAS,GAAG,IAAI,EAChB,eAAe,GAAG,KAAK,EACvB,YAAY,GAAG,CAAC,EAChB,eAAe,GAAG,KAAK,EACvB,SAAS,GAAG,eAAe,EAC3B,GAAG,IAAI,EACR,GAAG,OAAO,CAAA;IAEX,IAAI,UAAU,GAAG,GAAG,CAAA;IACpB,IAAI,IAAI,GAAG,CAAC,CAAA;IAEZ,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,YAAY,CAAC,UAAU,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAA;QAExE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE;YACvC,GAAG,IAAI;YACP,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACtD,CAAC,CAAA;QAEF,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAA;QAClE,IAAI,CAAC,UAAU,IAAI,CAAC,eAAe,EAAE,CAAC;YACpC,OAAO,QAAQ,CAAA;QACjB,CAAC;QAED,IAAI,IAAI,IAAI,YAAY,EAAE,CAAC;YACzB,MAAM,IAAI,gBAAgB,CAAC,UAAU,EAAE,YAAY,YAAY,YAAY,CAAC,CAAA;QAC9E,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QACjD,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAA;QAE9B,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAA;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,gBAAgB,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAA;QACjE,CAAC;QAED,IAAI,IAAI,CAAC,CAAA;IACX,CAAC;AACH,CAAC"}

package/dist/security/sanitize-document.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Sanitize a page-builder layout node tree in place-immutably, cleaning the
+ * rich-text block bodies. Containers/rows/columns recurse through `children`.
+ */
+export declare function sanitizeLayoutTree(layout: unknown): unknown;
+/**
+ * Sanitize every author-HTML sink reachable in a document's `data` payload for
+ * the given collection: top-level + nested rich-text fields and the canonical
+ * `sections[]` rich-text slots. The page-builder `_layout` tree is sanitized
+ * separately via {@link sanitizeLayoutTree} because it is split into an envelope
+ * before this runs.
+ */
+export declare function sanitizeDocumentHtml(data: Record<string, unknown>, collection: string): Record<string, unknown>;
+//# sourceMappingURL=sanitize-document.d.ts.map

package/dist/security/sanitize-document.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize-document.d.ts","sourceRoot":"","sources":["../../src/security/sanitize-document.ts"],"names":[],"mappings":"AAwGA;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAE3D;AAkBD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,UAAU,EAAE,MAAM,GACjB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWzB"}