@prenta/core 0.118.0

package/dist/security/sanitize-document.js

@@ -0,0 +1,117 @@
+import { getPrentaConfig } from '../config/runtime.js';
+import { getSectionType } from '../sections/registry.js';
+import { sanitizeHtml } from './sanitize.js';
+/** Bound recursion against pathological / adversarial nesting depth. */
+const MAX_DEPTH = 10;
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** Block-data keys that conventionally carry author HTML in the page-builder tree. */
+const HTML_BLOCK_KEYS = ['content', 'html'];
+/** Resolve a `blocks` field item to its block definition via the conventional discriminator. */
+function pickBlockSlug(item) {
+    for (const key of ['blockType', 'blockName', 'blockSlug', '_type']) {
+        const v = item[key];
+        if (typeof v === 'string')
+            return v;
+    }
+    return undefined;
+}
+function sanitizeObjectByFields(obj, fields, depth) {
+    const out = { ...obj };
+    for (const [key, def] of Object.entries(fields)) {
+        if (key in out)
+            out[key] = sanitizeByFieldDef(out[key], def, depth);
+    }
+    return out;
+}
+function sanitizeByFieldDef(value, def, depth) {
+    if (depth > MAX_DEPTH)
+        return value;
+    switch (def.type) {
+        case 'richText':
+            return typeof value === 'string' ? sanitizeHtml(value) : value;
+        case 'array': {
+            if (!Array.isArray(value))
+                return value;
+            const arrayDef = def;
+            return value.map((item) => isPlainObject(item) ? sanitizeObjectByFields(item, arrayDef.fields, depth + 1) : item);
+        }
+        case 'blocks': {
+            if (!Array.isArray(value))
+                return value;
+            const blocksDef = def;
+            return value.map((item) => {
+                if (!isPlainObject(item))
+                    return item;
+                const slug = pickBlockSlug(item);
+                const blockDef = slug ? blocksDef.blocks.find((b) => b.slug === slug) : undefined;
+                if (!blockDef)
+                    return item;
+                return sanitizeObjectByFields(item, blockDef.fields, depth + 1);
+            });
+        }
+        default:
+            return value;
+    }
+}
+/** Sanitize the rich-text slots of a single canonical `PageSection`. */
+function sanitizeSection(section) {
+    if (!isPlainObject(section))
+        return section;
+    const typeId = typeof section.sectionType === 'string' ? section.sectionType : undefined;
+    const def = typeId ? getSectionType(typeId) : undefined;
+    if (!def || !isPlainObject(section.content))
+        return section;
+    let mutated = false;
+    const content = { ...section.content };
+    for (const field of def.fields) {
+        if (field.type === 'richText' && typeof content[field.key] === 'string') {
+            content[field.key] = sanitizeHtml(content[field.key]);
+            mutated = true;
+        }
+    }
+    return mutated ? { ...section, content } : section;
+}
+/**
+ * Sanitize a page-builder layout node tree in place-immutably, cleaning the
+ * rich-text block bodies. Containers/rows/columns recurse through `children`.
+ */
+export function sanitizeLayoutTree(layout) {
+    return sanitizeNode(layout, 0);
+}
+function sanitizeNode(node, depth) {
+    if (depth > MAX_DEPTH || !isPlainObject(node))
+        return node;
+    const out = { ...node };
+    if (out.type === 'block' && isPlainObject(out.data)) {
+        const data = { ...out.data };
+        for (const key of HTML_BLOCK_KEYS) {
+            if (typeof data[key] === 'string')
+                data[key] = sanitizeHtml(data[key]);
+        }
+        out.data = data;
+    }
+    if (Array.isArray(out.children)) {
+        out.children = out.children.map((child) => sanitizeNode(child, depth + 1));
+    }
+    return out;
+}
+/**
+ * Sanitize every author-HTML sink reachable in a document's `data` payload for
+ * the given collection: top-level + nested rich-text fields and the canonical
+ * `sections[]` rich-text slots. The page-builder `_layout` tree is sanitized
+ * separately via {@link sanitizeLayoutTree} because it is split into an envelope
+ * before this runs.
+ */
+export function sanitizeDocumentHtml(data, collection) {
+    const fields = getPrentaConfig()?.collections?.[collection]?.fields ?? {};
+    let result = sanitizeObjectByFields(data, fields, 0);
+    // `sections` is the canonical page-content array; it is NOT part of the
+    // collection field config, so resolve its HTML slots from the registry.
+    if (Array.isArray(result.sections)) {
+        result = { ...result, sections: result.sections.map(sanitizeSection) };
+    }
+    return result;
+}
+//# sourceMappingURL=sanitize-document.js.map

package/dist/security/sanitize-document.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize-document.js","sourceRoot":"","sources":["../../src/security/sanitize-document.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAE5C,wEAAwE;AACxE,MAAM,SAAS,GAAG,EAAE,CAAA;AAEpB,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED,sFAAsF;AACtF,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,MAAM,CAAU,CAAA;AAEpD,gGAAgG;AAChG,SAAS,aAAa,CAAC,IAA6B;IAClD,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,CAAU,EAAE,CAAC;QAC5E,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAA;QACnB,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,sBAAsB,CAC7B,GAA4B,EAC5B,MAAuC,EACvC,KAAa;IAEb,MAAM,GAAG,GAAG,EAAE,GAAG,GAAG,EAAE,CAAA;IACtB,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,IAAI,GAAG,IAAI,GAAG;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IACrE,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc,EAAE,GAAoB,EAAE,KAAa;IAC7E,IAAI,KAAK,GAAG,SAAS;QAAE,OAAO,KAAK,CAAA;IACnC,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAChE,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAA;YACvC,MAAM,QAAQ,GAAG,GAAiB,CAAA;YAClC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACxB,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACtF,CAAA;QACH,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAA;YACvC,MAAM,SAAS,GAAG,GAAkB,CAAA;YACpC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;gBACxB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;oBAAE,OAAO,IAAI,CAAA;gBACrC,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;gBAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;gBACjF,IAAI,CAAC,QAAQ;oBAAE,OAAO,IAAI,CAAA;gBAC1B,OAAO,sBAAsB,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YACjE,CAAC,CAAC,CAAA;QACJ,CAAC;QACD;YACE,OAAO,KAAK,CAAA;IAChB,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,SAAS,eAAe,CAAC,OAAgB;IACvC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAA;IAC3C,MAAM,MAAM,GAAG,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAA;IACxF,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACvD,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAA;IAC3D,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,MAAM,OAAO,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;IACtC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;YACxE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAW,CAAC,CAAA;YAC/D,OAAO,GAAG,IAAI,CAAA;QAChB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAe;IAChD,OAAO,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;AAChC,CAAC;AAED,SAAS,YAAY,CAAC,IAAa,EAAE,KAAa;IAChD,IAAI,KAAK,GAAG,SAAS,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1D,MAAM,GAAG,GAA4B,EAAE,GAAG,IAAI,EAAE,CAAA;IAChD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,EAAE,GAAI,GAAG,CAAC,IAAgC,EAAE,CAAA;QACzD,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YAClC,IAAI,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,QAAQ;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAW,CAAC,CAAA;QAClF,CAAC;QACD,GAAG,CAAC,IAAI,GAAG,IAAI,CAAA;IACjB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAA;IAC5E,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAA6B,EAC7B,UAAkB;IAElB,MAAM,MAAM,GAAG,eAAe,EAAE,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,IAAI,EAAE,CAAA;IACzE,IAAI,MAAM,GAAG,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;IAEpD,wEAAwE;IACxE,wEAAwE;IACxE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAA;IACxE,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/security/sanitize.d.ts

@@ -0,0 +1,13 @@
+export interface SanitizeOptions {
+    allowedTags?: string[];
+    allowedAttributes?: Record<string, string[]>;
+    stripAll?: boolean;
+}
+declare const DEFAULT_ALLOWED_TAGS: string[];
+declare const DEFAULT_ALLOWED_ATTRS: Record<string, string[]>;
+/** Sanitize HTML content. Strips dangerous tags/attributes while preserving safe content. */
+export declare function sanitizeHtml(html: string, options?: SanitizeOptions): string;
+/** Strip all HTML tags, returning plain text. */
+export declare function stripHtml(html: string): string;
+export { DEFAULT_ALLOWED_TAGS, DEFAULT_ALLOWED_ATTRS };
+//# sourceMappingURL=sanitize.d.ts.map

package/dist/security/sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../src/security/sanitize.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,eAAe;IAC9B,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAC5C,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED,QAAA,MAAM,oBAAoB,UAqCzB,CAAA;AAED,QAAA,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAKnD,CAAA;AAED,6FAA6F;AAC7F,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,MAAM,CAa5E;AAED,iDAAiD;AACjD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,CAAA"}

package/dist/security/sanitize.js

@@ -0,0 +1,64 @@
+import sanitize from 'sanitize-html';
+const DEFAULT_ALLOWED_TAGS = [
+    'p',
+    'br',
+    'b',
+    'i',
+    'em',
+    'strong',
+    'a',
+    'ul',
+    'ol',
+    'li',
+    'h1',
+    'h2',
+    'h3',
+    'h4',
+    'h5',
+    'h6',
+    'blockquote',
+    'code',
+    'pre',
+    'img',
+    'figure',
+    'figcaption',
+    'table',
+    'thead',
+    'tbody',
+    'tr',
+    'th',
+    'td',
+    'span',
+    'div',
+    'hr',
+    'sub',
+    'sup',
+    's',
+    'u',
+    'mark',
+];
+const DEFAULT_ALLOWED_ATTRS = {
+    a: ['href', 'title', 'target', 'rel'],
+    img: ['src', 'alt', 'title', 'width', 'height', 'loading'],
+    td: ['colspan', 'rowspan'],
+    th: ['colspan', 'rowspan', 'scope'],
+};
+/** Sanitize HTML content. Strips dangerous tags/attributes while preserving safe content. */
+export function sanitizeHtml(html, options) {
+    if (options?.stripAll) {
+        return sanitize(html, { allowedTags: [], allowedAttributes: {} });
+    }
+    const tags = options?.allowedTags ?? DEFAULT_ALLOWED_TAGS;
+    const attrs = options?.allowedAttributes ?? DEFAULT_ALLOWED_ATTRS;
+    return sanitize(html, {
+        allowedTags: tags,
+        allowedAttributes: attrs,
+        disallowedTagsMode: 'discard',
+    });
+}
+/** Strip all HTML tags, returning plain text. */
+export function stripHtml(html) {
+    return sanitize(html, { allowedTags: [], allowedAttributes: {} }).trim();
+}
+export { DEFAULT_ALLOWED_TAGS, DEFAULT_ALLOWED_ATTRS };
+//# sourceMappingURL=sanitize.js.map

package/dist/security/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../src/security/sanitize.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,eAAe,CAAA;AAQpC,MAAM,oBAAoB,GAAG;IAC3B,GAAG;IACH,IAAI;IACJ,GAAG;IACH,GAAG;IACH,IAAI;IACJ,QAAQ;IACR,GAAG;IACH,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,YAAY;IACZ,MAAM;IACN,KAAK;IACL,KAAK;IACL,QAAQ;IACR,YAAY;IACZ,OAAO;IACP,OAAO;IACP,OAAO;IACP,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,MAAM;IACN,KAAK;IACL,IAAI;IACJ,KAAK;IACL,KAAK;IACL,GAAG;IACH,GAAG;IACH,MAAM;CACP,CAAA;AAED,MAAM,qBAAqB,GAA6B;IACtD,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC;IACrC,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC;IAC1D,EAAE,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;IAC1B,EAAE,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC;CACpC,CAAA;AAED,6FAA6F;AAC7F,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAAyB;IAClE,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;QACtB,OAAO,QAAQ,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC,CAAA;IACnE,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,EAAE,WAAW,IAAI,oBAAoB,CAAA;IACzD,MAAM,KAAK,GAAG,OAAO,EAAE,iBAAiB,IAAI,qBAAqB,CAAA;IAEjE,OAAO,QAAQ,CAAC,IAAI,EAAE;QACpB,WAAW,EAAE,IAAI;QACjB,iBAAiB,EAAE,KAAK;QACxB,kBAAkB,EAAE,SAAS;KAC9B,CAAC,CAAA;AACJ,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,QAAQ,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;AAC1E,CAAC;AAED,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,CAAA"}

package/dist/security/secret-storage.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Encrypt a value for storage. Returns the original value unchanged when no
+ * encryption key is configured (development convenience). Production deployments
+ * MUST set `CMS_ENCRYPTION_KEY` — see `security.mdc`.
+ */
+export declare function encryptSecret(plaintext: string): Promise<string>;
+/**
+ * Decrypt a value that was stored via `encryptSecret`. Plaintext values
+ * (written before encryption was enabled, or written by a deployment without
+ * the key) are returned unchanged.
+ */
+export declare function decryptSecret(stored: string): Promise<string>;
+/** True when the value is stored encrypted (and therefore needs decryption). */
+export declare function isEncrypted(value: string): boolean;
+/**
+ * Encrypt each string element in an array. Returns the array unchanged when
+ * encryption is disabled. Used for things like TOTP backup codes.
+ */
+export declare function encryptStringArray(values: string[]): Promise<string[]>;
+/** Decrypt each element in an array stored via `encryptStringArray`. */
+export declare function decryptStringArray(values: string[]): Promise<string[]>;
+//# sourceMappingURL=secret-storage.d.ts.map

package/dist/security/secret-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-storage.d.ts","sourceRoot":"","sources":["../../src/security/secret-storage.ts"],"names":[],"mappings":"AAiCA;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMtE;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAWnE;AAED,gFAAgF;AAChF,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAElD;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAE5E;AAED,wEAAwE;AACxE,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAE5E"}

package/dist/security/secret-storage.js

@@ -0,0 +1,75 @@
+import { encryptField, decryptField } from './encrypted-fields.js';
+/**
+ * High-level helpers for storing per-user secrets (TOTP secret, OAuth tokens,
+ * webhook signing keys) at rest. Wraps the raw `encryptField`/`decryptField`
+ * primitives so callers don't have to plumb `CMS_ENCRYPTION_KEY` through every
+ * code path.
+ *
+ * Encrypted values are tagged with a version prefix so we can rotate keys or
+ * change the encoding without breaking existing rows. Plaintext values written
+ * before encryption was enabled are passed through unchanged on read so
+ * upgrades don't break existing data — call `migrateSecret()` when you want
+ * to opportunistically re-encrypt them on next access.
+ */
+const PREFIX = 'enc:v1:';
+function getKey() {
+    const key = process.env.CMS_ENCRYPTION_KEY;
+    if (!key)
+        return null;
+    // 32 bytes = 64 hex chars
+    if (key.length !== 64) {
+        console.warn('[prenta][crypto] CMS_ENCRYPTION_KEY must be 64 hex characters (32 bytes); got ' +
+            key.length +
+            '. Falling back to plaintext storage. Generate with: ' +
+            "node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\"");
+        return null;
+    }
+    return key;
+}
+/**
+ * Encrypt a value for storage. Returns the original value unchanged when no
+ * encryption key is configured (development convenience). Production deployments
+ * MUST set `CMS_ENCRYPTION_KEY` — see `security.mdc`.
+ */
+export async function encryptSecret(plaintext) {
+    if (!plaintext)
+        return plaintext;
+    const key = getKey();
+    if (!key)
+        return plaintext;
+    const ciphertext = await encryptField(plaintext, key);
+    return PREFIX + ciphertext;
+}
+/**
+ * Decrypt a value that was stored via `encryptSecret`. Plaintext values
+ * (written before encryption was enabled, or written by a deployment without
+ * the key) are returned unchanged.
+ */
+export async function decryptSecret(stored) {
+    if (!stored)
+        return stored;
+    if (!stored.startsWith(PREFIX))
+        return stored;
+    const key = getKey();
+    if (!key) {
+        throw new Error('CMS_ENCRYPTION_KEY is required to decrypt this value but is not set. ' +
+            'Configure the same key used at write time.');
+    }
+    return decryptField(stored.slice(PREFIX.length), key);
+}
+/** True when the value is stored encrypted (and therefore needs decryption). */
+export function isEncrypted(value) {
+    return typeof value === 'string' && value.startsWith(PREFIX);
+}
+/**
+ * Encrypt each string element in an array. Returns the array unchanged when
+ * encryption is disabled. Used for things like TOTP backup codes.
+ */
+export async function encryptStringArray(values) {
+    return Promise.all(values.map((v) => encryptSecret(v)));
+}
+/** Decrypt each element in an array stored via `encryptStringArray`. */
+export async function decryptStringArray(values) {
+    return Promise.all(values.map((v) => decryptSecret(v)));
+}
+//# sourceMappingURL=secret-storage.js.map

package/dist/security/secret-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-storage.js","sourceRoot":"","sources":["../../src/security/secret-storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAElE;;;;;;;;;;;GAWG;AAEH,MAAM,MAAM,GAAG,SAAS,CAAA;AAExB,SAAS,MAAM;IACb,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAA;IAC1C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,0BAA0B;IAC1B,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CACV,gFAAgF;YAC9E,GAAG,CAAC,MAAM;YACV,sDAAsD;YACtD,4EAA4E,CAC/E,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAA;IAChC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;IACpB,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAA;IAC1B,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;IACrD,OAAO,MAAM,GAAG,UAAU,CAAA;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAc;IAChD,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAA;IAC1B,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAA;IAC7C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;IACpB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,uEAAuE;YACrE,4CAA4C,CAC/C,CAAA;IACH,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;AACvD,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAgB;IACvD,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACzD,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAgB;IACvD,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACzD,CAAC"}

package/dist/security/security-txt.d.ts

@@ -0,0 +1,12 @@
+export interface SecurityTxtConfig {
+    contact: string;
+    expires: Date;
+    encryption?: string;
+    acknowledgments?: string;
+    preferredLanguages?: string[];
+    canonical?: string;
+    policy?: string;
+}
+/** Generate a security.txt file contents per RFC 9116. */
+export declare function generateSecurityTxt(config: SecurityTxtConfig): string;
+//# sourceMappingURL=security-txt.d.ts.map

package/dist/security/security-txt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-txt.d.ts","sourceRoot":"","sources":["../../src/security/security-txt.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,IAAI,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,0DAA0D;AAC1D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAerE"}

package/dist/security/security-txt.js

@@ -0,0 +1,19 @@
+/** Generate a security.txt file contents per RFC 9116. */
+export function generateSecurityTxt(config) {
+    const lines = [];
+    lines.push(`Contact: ${config.contact}`);
+    lines.push(`Expires: ${config.expires.toISOString()}`);
+    if (config.encryption)
+        lines.push(`Encryption: ${config.encryption}`);
+    if (config.acknowledgments)
+        lines.push(`Acknowledgments: ${config.acknowledgments}`);
+    if (config.preferredLanguages?.length) {
+        lines.push(`Preferred-Languages: ${config.preferredLanguages.join(', ')}`);
+    }
+    if (config.canonical)
+        lines.push(`Canonical: ${config.canonical}`);
+    if (config.policy)
+        lines.push(`Policy: ${config.policy}`);
+    return lines.join('\n') + '\n';
+}
+//# sourceMappingURL=security-txt.js.map

package/dist/security/security-txt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-txt.js","sourceRoot":"","sources":["../../src/security/security-txt.ts"],"names":[],"mappings":"AAUA,0DAA0D;AAC1D,MAAM,UAAU,mBAAmB,CAAC,MAAyB;IAC3D,MAAM,KAAK,GAAa,EAAE,CAAA;IAE1B,KAAK,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;IACxC,KAAK,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;IAEtD,IAAI,MAAM,CAAC,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,UAAU,EAAE,CAAC,CAAA;IACrE,IAAI,MAAM,CAAC,eAAe;QAAE,KAAK,CAAC,IAAI,CAAC,oBAAoB,MAAM,CAAC,eAAe,EAAE,CAAC,CAAA;IACpF,IAAI,MAAM,CAAC,kBAAkB,EAAE,MAAM,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,wBAAwB,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC5E,CAAC;IACD,IAAI,MAAM,CAAC,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,SAAS,EAAE,CAAC,CAAA;IAClE,IAAI,MAAM,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;IAEzD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;AAChC,CAAC"}

package/dist/security/session-limits.d.ts

@@ -0,0 +1,17 @@
+export interface SessionInfo {
+    sessionId: string;
+    userId: string;
+    createdAt: Date;
+    ipAddress?: string;
+    userAgent?: string;
+}
+export interface SessionLimitConfig {
+    maxConcurrentSessions: number;
+    strategy: 'deny_new' | 'revoke_oldest';
+}
+/** Enforce concurrent session limits, returning sessions to revoke if any. */
+export declare function enforceSessionLimits(activeSessions: SessionInfo[], config: SessionLimitConfig): {
+    allowed: boolean;
+    sessionsToRevoke: string[];
+};
+//# sourceMappingURL=session-limits.d.ts.map

package/dist/security/session-limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-limits.d.ts","sourceRoot":"","sources":["../../src/security/session-limits.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,qBAAqB,EAAE,MAAM,CAAA;IAC7B,QAAQ,EAAE,UAAU,GAAG,eAAe,CAAA;CACvC;AAED,8EAA8E;AAC9E,wBAAgB,oBAAoB,CAClC,cAAc,EAAE,WAAW,EAAE,EAC7B,MAAM,EAAE,kBAAkB,GACzB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAAE,CAclD"}

package/dist/security/session-limits.js

@@ -0,0 +1,14 @@
+/** Enforce concurrent session limits, returning sessions to revoke if any. */
+export function enforceSessionLimits(activeSessions, config) {
+    if (activeSessions.length < config.maxConcurrentSessions) {
+        return { allowed: true, sessionsToRevoke: [] };
+    }
+    if (config.strategy === 'deny_new') {
+        return { allowed: false, sessionsToRevoke: [] };
+    }
+    const sorted = [...activeSessions].sort((a, b) => a.createdAt.getTime() - b.createdAt.getTime());
+    const excess = sorted.length - config.maxConcurrentSessions + 1;
+    const toRevoke = sorted.slice(0, excess).map((s) => s.sessionId);
+    return { allowed: true, sessionsToRevoke: toRevoke };
+}
+//# sourceMappingURL=session-limits.js.map

package/dist/security/session-limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-limits.js","sourceRoot":"","sources":["../../src/security/session-limits.ts"],"names":[],"mappings":"AAaA,8EAA8E;AAC9E,MAAM,UAAU,oBAAoB,CAClC,cAA6B,EAC7B,MAA0B;IAE1B,IAAI,cAAc,CAAC,MAAM,GAAG,MAAM,CAAC,qBAAqB,EAAE,CAAC;QACzD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAA;IAChD,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAA;IACjD,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;IAChG,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,qBAAqB,GAAG,CAAC,CAAA;IAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAEhE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAA;AACtD,CAAC"}

package/dist/security/upload.d.ts

@@ -0,0 +1,32 @@
+export interface FileValidationResult {
+    valid: boolean;
+    error?: string;
+    detectedMimeType?: string;
+}
+declare const ALLOWED_IMAGE_TYPES: Set<string>;
+declare const ALLOWED_DOCUMENT_TYPES: Set<string>;
+/**
+ * Validate a file's declared MIME type against an allowlist.
+ *
+ * Accepts either an array (typical caller form) or a Set (legacy form).
+ * Returns a plain boolean to make call-sites read naturally:
+ *
+ *     if (!validateMimeType(file.type, ALLOWED)) return badRequest(...)
+ */
+export declare function validateMimeType(mimeType: string, allowedTypes?: ReadonlyArray<string> | ReadonlySet<string>): boolean;
+/**
+ * Check a file's magic bytes against the declared mime type. Returns
+ * `{ valid: true, detectedMimeType }` when the bytes match the declared type
+ * (or when we have no signature to check), and `{ valid: false, error }`
+ * otherwise.
+ *
+ * For container formats (WebP, AVIF) we additionally inspect the inner
+ * sub-type — a generic RIFF header would otherwise let `.wav` files masquerade
+ * as `.webp` and bypass image-only checks.
+ *
+ * For SVG (which is XML, not a binary signature) we look for `<svg` near the
+ * start of the file. A leading XML declaration or BOM is allowed.
+ */
+export declare function checkMagicBytes(input: ArrayBuffer | Uint8Array | Buffer, declaredMimeType: string): FileValidationResult;
+export { ALLOWED_IMAGE_TYPES, ALLOWED_DOCUMENT_TYPES };
+//# sourceMappingURL=upload.d.ts.map

package/dist/security/upload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../../src/security/upload.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,OAAO,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,QAAA,MAAM,mBAAmB,aAOvB,CAAA;AAEF,QAAA,MAAM,sBAAsB,aAM1B,CAAA;AAEF;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,GACzD,OAAO,CAOT;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,WAAW,GAAG,UAAU,GAAG,MAAM,EACxC,gBAAgB,EAAE,MAAM,GACvB,oBAAoB,CA6BtB;AAgED,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,CAAA"}

package/dist/security/upload.js

@@ -0,0 +1,129 @@
+const ALLOWED_IMAGE_TYPES = new Set([
+    'image/jpeg',
+    'image/png',
+    'image/gif',
+    'image/webp',
+    'image/svg+xml',
+    'image/avif',
+]);
+const ALLOWED_DOCUMENT_TYPES = new Set([
+    'application/pdf',
+    'text/plain',
+    'text/csv',
+    'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+    'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+]);
+/**
+ * Validate a file's declared MIME type against an allowlist.
+ *
+ * Accepts either an array (typical caller form) or a Set (legacy form).
+ * Returns a plain boolean to make call-sites read naturally:
+ *
+ *     if (!validateMimeType(file.type, ALLOWED)) return badRequest(...)
+ */
+export function validateMimeType(mimeType, allowedTypes) {
+    const allowed = allowedTypes
+        ? allowedTypes instanceof Set
+            ? allowedTypes
+            : new Set(allowedTypes)
+        : new Set([...ALLOWED_IMAGE_TYPES, ...ALLOWED_DOCUMENT_TYPES]);
+    return allowed.has(mimeType);
+}
+/**
+ * Check a file's magic bytes against the declared mime type. Returns
+ * `{ valid: true, detectedMimeType }` when the bytes match the declared type
+ * (or when we have no signature to check), and `{ valid: false, error }`
+ * otherwise.
+ *
+ * For container formats (WebP, AVIF) we additionally inspect the inner
+ * sub-type — a generic RIFF header would otherwise let `.wav` files masquerade
+ * as `.webp` and bypass image-only checks.
+ *
+ * For SVG (which is XML, not a binary signature) we look for `<svg` near the
+ * start of the file. A leading XML declaration or BOM is allowed.
+ */
+export function checkMagicBytes(input, declaredMimeType) {
+    const bytes = toUint8(input);
+    const detected = detectMimeType(bytes);
+    // No signature for the declared type — accept (caller is expected to have
+    // already checked the allowlist).
+    if (detected === null) {
+        return { valid: true };
+    }
+    if (detected === declaredMimeType) {
+        return { valid: true, detectedMimeType: detected };
+    }
+    // Some legitimate aliases:
+    //   image/jpg ↔ image/jpeg
+    //   image/x-png ↔ image/png
+    if ((detected === 'image/jpeg' && declaredMimeType === 'image/jpg') ||
+        (detected === 'image/png' && declaredMimeType === 'image/x-png')) {
+        return { valid: true, detectedMimeType: detected };
+    }
+    return {
+        valid: false,
+        error: `Declared "${declaredMimeType}" but content looks like "${detected}"`,
+        detectedMimeType: detected,
+    };
+}
+function toUint8(input) {
+    if (input instanceof Uint8Array)
+        return input;
+    return new Uint8Array(input);
+}
+/** Returns the detected mime type, or null when the bytes don't match a known signature. */
+function detectMimeType(b) {
+    if (b.length < 4)
+        return null;
+    if (b[0] === 0xff && b[1] === 0xd8 && b[2] === 0xff)
+        return 'image/jpeg';
+    if (b[0] === 0x89 && b[1] === 0x50 && b[2] === 0x4e && b[3] === 0x47)
+        return 'image/png';
+    // GIF: full 6-byte signature ("GIF87a" or "GIF89a"), not just "GIF".
+    if (b[0] === 0x47 &&
+        b[1] === 0x49 &&
+        b[2] === 0x46 &&
+        b[3] === 0x38 &&
+        (b[4] === 0x37 || b[4] === 0x39) &&
+        b[5] === 0x61)
+        return 'image/gif';
+    // RIFF + 4-byte size + format identifier ("WEBP" / "WAVE" / "AVI ").
+    if (b.length >= 12 && b[0] === 0x52 && b[1] === 0x49 && b[2] === 0x46 && b[3] === 0x46) {
+        if (b[8] === 0x57 && b[9] === 0x45 && b[10] === 0x42 && b[11] === 0x50)
+            return 'image/webp';
+        if (b[8] === 0x57 && b[9] === 0x41 && b[10] === 0x56 && b[11] === 0x45)
+            return 'audio/wav';
+    }
+    // AVIF / HEIC: ISO BMFF "ftyp" box at offset 4 with brand at offset 8.
+    if (b.length >= 12 && b[4] === 0x66 && b[5] === 0x74 && b[6] === 0x79 && b[7] === 0x70) {
+        const brand = String.fromCharCode(b[8] ?? 0, b[9] ?? 0, b[10] ?? 0, b[11] ?? 0);
+        if (brand === 'avif' || brand === 'avis')
+            return 'image/avif';
+        if (brand === 'mp42' || brand === 'isom' || brand === 'iso2')
+            return 'video/mp4';
+    }
+    // PDF
+    if (b[0] === 0x25 && b[1] === 0x50 && b[2] === 0x44 && b[3] === 0x46)
+        return 'application/pdf';
+    // OGG
+    if (b[0] === 0x4f && b[1] === 0x67 && b[2] === 0x67 && b[3] === 0x53)
+        return 'audio/ogg';
+    // MP3 — either "ID3" tag or a frame sync (0xFFE).
+    if (b[0] === 0x49 && b[1] === 0x44 && b[2] === 0x33)
+        return 'audio/mpeg';
+    if (b[0] === 0xff && (b[1] & 0xe0) === 0xe0)
+        return 'audio/mpeg';
+    // WebM / Matroska EBML header
+    if (b[0] === 0x1a && b[1] === 0x45 && b[2] === 0xdf && b[3] === 0xa3)
+        return 'video/webm';
+    // SVG: scan the first 1024 bytes for a "<svg" tag. Accept optional XML
+    // declaration / BOM / whitespace / comments.
+    const head = new TextDecoder('utf-8', { fatal: false }).decode(b.slice(0, 1024)).trimStart();
+    if (head.toLowerCase().includes('<svg') ||
+        (head.startsWith('<?xml') && head.toLowerCase().includes('<svg'))) {
+        return 'image/svg+xml';
+    }
+    return null;
+}
+export { ALLOWED_IMAGE_TYPES, ALLOWED_DOCUMENT_TYPES };
+//# sourceMappingURL=upload.js.map

package/dist/security/upload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload.js","sourceRoot":"","sources":["../../src/security/upload.ts"],"names":[],"mappings":"AAMA,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,YAAY;IACZ,WAAW;IACX,WAAW;IACX,YAAY;IACZ,eAAe;IACf,YAAY;CACb,CAAC,CAAA;AAEF,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,iBAAiB;IACjB,YAAY;IACZ,UAAU;IACV,yEAAyE;IACzE,mEAAmE;CACpE,CAAC,CAAA;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,YAA0D;IAE1D,MAAM,OAAO,GAAG,YAAY;QAC1B,CAAC,CAAC,YAAY,YAAY,GAAG;YAC3B,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC;QACzB,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,mBAAmB,EAAE,GAAG,sBAAsB,CAAC,CAAC,CAAA;IAChE,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;AAC9B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAwC,EACxC,gBAAwB;IAExB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;IAC5B,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;IAEtC,0EAA0E;IAC1E,kCAAkC;IAClC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IACxB,CAAC;IAED,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QAClC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAA;IACpD,CAAC;IAED,2BAA2B;IAC3B,2BAA2B;IAC3B,4BAA4B;IAC5B,IACE,CAAC,QAAQ,KAAK,YAAY,IAAI,gBAAgB,KAAK,WAAW,CAAC;QAC/D,CAAC,QAAQ,KAAK,WAAW,IAAI,gBAAgB,KAAK,aAAa,CAAC,EAChE,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAA;IACpD,CAAC;IAED,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,aAAa,gBAAgB,6BAA6B,QAAQ,GAAG;QAC5E,gBAAgB,EAAE,QAAQ;KAC3B,CAAA;AACH,CAAC;AAED,SAAS,OAAO,CAAC,KAAwC;IACvD,IAAI,KAAK,YAAY,UAAU;QAAE,OAAO,KAAK,CAAA;IAC7C,OAAO,IAAI,UAAU,CAAC,KAAoB,CAAC,CAAA;AAC7C,CAAC;AAED,4FAA4F;AAC5F,SAAS,cAAc,CAAC,CAAa;IACnC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAE7B,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,YAAY,CAAA;IACxE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,WAAW,CAAA;IAExF,qEAAqE;IACrE,IACE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QACb,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QACb,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QACb,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QACb,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;QAChC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QAEb,OAAO,WAAW,CAAA;IAEpB,qEAAqE;IACrE,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACvF,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI;YAAE,OAAO,YAAY,CAAA;QAC3F,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI;YAAE,OAAO,WAAW,CAAA;IAC5F,CAAC;IAED,uEAAuE;IACvE,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACvF,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;QAC/E,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM;YAAE,OAAO,YAAY,CAAA;QAC7D,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM;YAAE,OAAO,WAAW,CAAA;IAClF,CAAC;IAED,MAAM;IACN,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,iBAAiB,CAAA;IAE9F,MAAM;IACN,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,WAAW,CAAA;IAExF,kDAAkD;IAClD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,YAAY,CAAA;IACxE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,YAAY,CAAA;IAEjE,8BAA8B;IAC9B,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,YAAY,CAAA;IAEzF,uEAAuE;IACvE,6CAA6C;IAC7C,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAA;IAC5F,IACE,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;QACnC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EACjE,CAAC;QACD,OAAO,eAAe,CAAA;IACxB,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,CAAA"}

package/dist/security/webhook.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Validate that a webhook URL does not target private/internal networks
+ * (string-level SSRF prevention).
+ *
+ * Catches every IP-literal encoding `getaddrinfo` accepts: decimal
+ * (`http://2130706433`), octal (`http://0177.0.0.1`), hex
+ * (`http://0x7f.0.0.1`), short-form (`http://127.1`), IPv4-mapped IPv6
+ * (`http://[::ffff:127.0.0.1]`), bracketed IPv6, and the reserved
+ * `100.64.0.0/10` carrier-grade NAT range that previously slipped through.
+ *
+ * **Important caveat:** this only validates the URL **as written**. A hostname
+ * like `attacker-controlled.tld` that resolves to a public IP at validation
+ * time and to `127.0.0.1` at fetch time (DNS rebinding) still bypasses this
+ * check — `safeFetch` calls `resolveAndCheck()` on top to defend against that.
+ */
+export declare function validateWebhookUrl(url: string): {
+    valid: boolean;
+    error?: string;
+};
+/**
+ * Resolve a hostname's A/AAAA records and verify none of them land in a
+ * private range. Pair with `validateWebhookUrl` to defend against DNS
+ * rebinding — see `safeFetch`.
+ */
+export declare function resolveAndCheck(hostname: string): Promise<{
+    safe: boolean;
+    resolvedIp?: string;
+    error?: string;
+}>;
+//# sourceMappingURL=webhook.d.ts.map

package/dist/security/webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../../src/security/webhook.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAmDlF;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAgEjE"}