@remit/backend 0.0.143 → 0.0.145

package/dist/dev-server/content-handler.d.ts

@@ -0,0 +1,38 @@
+import { parseContentStorageKey } from "@remit/storage-service";
+export { parseContentStorageKey };
+export interface ContentResult {
+    status: number;
+    headers: Record<string, string>;
+    body: string | Buffer;
+}
+export interface ServeContentDeps {
+    /**
+     * Reads the stored bytes, or returns null when the object is genuinely
+     * missing (ENOENT / NoSuchKey). Any other read error must throw so the route
+     * 500s — a permission/infra failure is never masked as a missing body.
+     */
+    readObject(fullPath: string): Promise<Buffer | null>;
+    /** Resolves the message's mailbox + uid so the cue can issue one FETCH. */
+    lookupMessage(messageId: string): Promise<{
+        mailboxId: string;
+        uid: number;
+    } | null>;
+    requestBodySync(input: {
+        accountId: string;
+        mailboxId: string;
+        messageId: string;
+        uid?: number;
+    }): Promise<void>;
+}
+/**
+ * Local stand-in for the CloudFront `/content/*` behavior. Body-fetch outcomes:
+ *
+ * - Object present → 200 with the (decompressed) bytes.
+ * - Object missing → 202 + `Retry-After: 1`, and re-arm the SYNC_MESSAGE_BODY
+ *   cue for that message so a retry succeeds once the worker stores the body.
+ * - Any other read failure throws, so the route 500s loudly.
+ */
+export declare const serveContent: (deps: ServeContentDeps, args: {
+    fullPath: string;
+    storageKey: string;
+}) => Promise<ContentResult>;

package/dist/dev-server/content-handler.js

@@ -0,0 +1,46 @@
+import { gunzipSync } from "node:zlib";
+import { parseContentStorageKey } from "@remit/storage-service";
+// Re-exported for existing same-package consumers (server.ts,
+// content-handler.test.ts). The key-shape parser itself lives in
+// `@remit/storage-service` next to the `build*Key` functions it
+// inverts, so non-backend consumers (e.g. the content-selfheal worker) can
+// depend on it without pulling in the rest of `@remit/backend`.
+export { parseContentStorageKey };
+/**
+ * Local stand-in for the CloudFront `/content/*` behavior. Body-fetch outcomes:
+ *
+ * - Object present → 200 with the (decompressed) bytes.
+ * - Object missing → 202 + `Retry-After: 1`, and re-arm the SYNC_MESSAGE_BODY
+ *   cue for that message so a retry succeeds once the worker stores the body.
+ * - Any other read failure throws, so the route 500s loudly.
+ */
+export const serveContent = async (deps, args) => {
+    const raw = await deps.readObject(args.fullPath);
+    if (raw) {
+        // The filesystem/S3 backends gzip every part; decompress here since there
+        // is no CloudFront to auto-decode locally.
+        const buffer = raw[0] === 0x1f && raw[1] === 0x8b ? gunzipSync(raw) : raw;
+        return {
+            status: 200,
+            headers: { "content-type": "application/octet-stream" },
+            body: buffer,
+        };
+    }
+    const ids = parseContentStorageKey(args.storageKey);
+    if (ids) {
+        const message = await deps.lookupMessage(ids.messageId);
+        if (message) {
+            await deps.requestBodySync({
+                accountId: ids.accountId,
+                mailboxId: message.mailboxId,
+                messageId: ids.messageId,
+                uid: message.uid,
+            });
+        }
+    }
+    return {
+        status: 202,
+        headers: { "Retry-After": "1" },
+        body: "body not yet synced",
+    };
+};

package/dist/src/api.d.ts

@@ -0,0 +1,5 @@
+import { type Document, OpenAPIBackend } from "openapi-backend";
+export declare const OpenAPISpec: Document;
+declare const api: OpenAPIBackend;
+export { setLogger } from "@remit/logger";
+export { api };

package/dist/src/api.js

@@ -0,0 +1,73 @@
+import spec from "@remit/api-openapi-spec/openapi.json" with { type: "json" };
+import { redactCalendarFeedPath } from "@remit/calendar-service";
+import { logger } from "@remit/logger";
+import { OpenAPIBackend, } from "openapi-backend";
+import { defaultErrorCode } from "./error.js";
+import { postResponseHandler } from "./response.js";
+const isDocument = (value) => typeof value === "object" &&
+    value !== null &&
+    "openapi" in value &&
+    typeof value.openapi === "string" &&
+    "paths" in value;
+// Imported, not read from disk, so no host has to place openapi.json next to the
+// entry point — a Worker has no filesystem to read it from.
+if (!isDocument(spec)) {
+    throw new Error("@remit/api-openapi-spec is not an OpenAPI document");
+}
+// Typed as a Document so importers do not see the JSON literal type.
+export const OpenAPISpec = spec;
+const api = new OpenAPIBackend({
+    definition: OpenAPISpec,
+    quick: true,
+    // Coerce query/path params to their schema types. API Gateway delivers every
+    // query param as a string; handlers cast them to number/boolean (e.g. `limit`,
+    // `hasAttachment`) and forward them downstream. Without coercion a string
+    // `limit` reaches ElectroDB's `.go({ limit })` and DynamoDB rejects the
+    // numeric Limit field ("STRING_VALUE cannot be converted to Integer"), 500ing
+    // /addresses/search.
+    coerceTypes: true,
+});
+api.register("postResponseHandler", postResponseHandler);
+/**
+ * The validator's findings, narrowed to the three fields `RequestValidationDetail`
+ * declares. Copied field by field rather than passed through: an AJV error also
+ * carries `params`, and under `verbose` the rejected `data` itself — which for a
+ * refused request body is whatever the caller sent, a password among the
+ * possibilities. Naming the fields is what keeps that off the wire.
+ */
+const validationDetails = (errors) => (errors ?? []).map((error) => ({
+    path: error.instancePath,
+    rule: error.keyword,
+    message: error.message ?? "refused",
+}));
+// The errors and the operation, and nothing that came off the wire. A request
+// that fails validation is logged at error level, and the request it carries
+// holds the caller's headers and cookies — an Authorization bearer among them,
+// and for a calendar feed the token in the path is itself the credential
+// (issue #1065). The path is redacted the same way the request scope redacts it.
+api.register("validationFail", (c) => {
+    logger.error({
+        errors: c.validation.errors,
+        path: redactCalendarFeedPath(c.request.path),
+        operation: c.operation?.operationId,
+    }, "Validation failed");
+    return {
+        statusCode: 400,
+        body: {
+            code: defaultErrorCode(400),
+            message: "Invalid request",
+            errors: validationDetails(c.validation.errors),
+        },
+    };
+});
+api.register("notFound", () => ({
+    statusCode: 404,
+    body: { code: defaultErrorCode(404), message: "Not found" },
+}));
+api.register("notImplemented", () => ({
+    statusCode: 501,
+    body: { code: defaultErrorCode(501), message: "Not implemented" },
+}));
+api.init();
+export { setLogger } from "@remit/logger";
+export { api };

package/dist/src/auth.d.ts

@@ -0,0 +1,24 @@
+import type { APIGatewayProxyEvent } from "aws-lambda";
+import type { HandlerIdentity } from "./types.js";
+/**
+ * The LOCAL_ACCOUNT_CONFIG_ID / LOCAL_COGNITO_SUB overrides bypass authentication
+ * for local dev and fixtures: with them set, an unauthenticated request is served
+ * as the pinned account. They must never reach a deployed environment. Refuse to
+ * start (throw at module load) if either is present outside a local NODE_ENV — the
+ * same `development`/`test` signal the data layer already uses to decide local vs
+ * deployed. Fail loud rather than silently ignore, so a leaked env var is caught at
+ * boot, not exploited at runtime. In a local NODE_ENV the bypass is read here
+ * once, so a bypass set without LOCAL_EMAIL also fails at boot.
+ */
+export declare const assertLocalBypassNotInDeployedEnv: (env: NodeJS.ProcessEnv) => void;
+export declare const userFromClaims: (sub: string, email: string | undefined) => HandlerIdentity;
+export declare const localIdentityFromEnv: (env: NodeJS.ProcessEnv) => HandlerIdentity;
+/**
+ * The caller of an API Gateway event. Production reads the Cognito `sub` and
+ * `email` claims (verified by the authorizer, or by `jwt-auth.ts` on
+ * self-host) and derives the accountConfigId via UUIDv5. Local development
+ * honours `LOCAL_ACCOUNT_CONFIG_ID` (a pinned seeded config) and
+ * `LOCAL_COGNITO_SUB` (a pinned sub, derived like production), read once at
+ * boot into `localIdentity`.
+ */
+export declare const getIdentityFromEvent: (event: APIGatewayProxyEvent, localIdentity: HandlerIdentity) => HandlerIdentity;

package/dist/src/auth.js

@@ -0,0 +1,81 @@
+import { deriveAccountConfigId } from "@remit/data-ports/id";
+const LOCAL_BYPASS_VARS = [
+    "LOCAL_ACCOUNT_CONFIG_ID",
+    "LOCAL_COGNITO_SUB",
+];
+const isLocalEnv = (env) => env.NODE_ENV === "development" || env.NODE_ENV === "test";
+/**
+ * The LOCAL_ACCOUNT_CONFIG_ID / LOCAL_COGNITO_SUB overrides bypass authentication
+ * for local dev and fixtures: with them set, an unauthenticated request is served
+ * as the pinned account. They must never reach a deployed environment. Refuse to
+ * start (throw at module load) if either is present outside a local NODE_ENV — the
+ * same `development`/`test` signal the data layer already uses to decide local vs
+ * deployed. Fail loud rather than silently ignore, so a leaked env var is caught at
+ * boot, not exploited at runtime. In a local NODE_ENV the bypass is read here
+ * once, so a bypass set without LOCAL_EMAIL also fails at boot.
+ */
+export const assertLocalBypassNotInDeployedEnv = (env) => {
+    if (isLocalEnv(env)) {
+        localIdentityFromEnv(env);
+        return;
+    }
+    const leaked = LOCAL_BYPASS_VARS.filter((name) => {
+        const value = env[name];
+        return typeof value === "string" && value.length > 0;
+    });
+    if (leaked.length === 0)
+        return;
+    throw new Error(`Refusing to start: local auth bypass ${leaked.join(", ")} is set while NODE_ENV=${env.NODE_ENV ?? "(unset)"}. These overrides bypass authentication and must never be present in a deployed environment.`);
+};
+const readClaim = (event, name) => {
+    const value = event.requestContext?.authorizer?.claims?.[name];
+    if (typeof value === "string" && value.length > 0)
+        return value;
+    return undefined;
+};
+const ANONYMOUS = { kind: "anonymous" };
+export const userFromClaims = (sub, email) => {
+    if (!email)
+        return ANONYMOUS;
+    return {
+        kind: "user",
+        accountConfigId: deriveAccountConfigId(sub),
+        sub,
+        email,
+    };
+};
+const pinnedLocalUser = (env) => {
+    const localAccountConfigId = env.LOCAL_ACCOUNT_CONFIG_ID;
+    if (localAccountConfigId) {
+        return { accountConfigId: localAccountConfigId, sub: localAccountConfigId };
+    }
+    const localSub = env.LOCAL_COGNITO_SUB;
+    if (localSub) {
+        return { accountConfigId: deriveAccountConfigId(localSub), sub: localSub };
+    }
+    return undefined;
+};
+export const localIdentityFromEnv = (env) => {
+    const pinned = pinnedLocalUser(env);
+    if (!pinned)
+        return ANONYMOUS;
+    const email = env.LOCAL_EMAIL;
+    if (!email) {
+        throw new Error("Refusing to start: the local auth bypass (LOCAL_ACCOUNT_CONFIG_ID or LOCAL_COGNITO_SUB) is set without LOCAL_EMAIL. The bypass serves a signed-in user, and every user carries an email; set LOCAL_EMAIL to the address that user signs in with.");
+    }
+    return { kind: "user", ...pinned, email };
+};
+/**
+ * The caller of an API Gateway event. Production reads the Cognito `sub` and
+ * `email` claims (verified by the authorizer, or by `jwt-auth.ts` on
+ * self-host) and derives the accountConfigId via UUIDv5. Local development
+ * honours `LOCAL_ACCOUNT_CONFIG_ID` (a pinned seeded config) and
+ * `LOCAL_COGNITO_SUB` (a pinned sub, derived like production), read once at
+ * boot into `localIdentity`.
+ */
+export const getIdentityFromEvent = (event, localIdentity) => {
+    const sub = readClaim(event, "sub");
+    if (!sub)
+        return localIdentity;
+    return userFromClaims(sub, readClaim(event, "email"));
+};

package/dist/src/config/api-config.d.ts

@@ -0,0 +1,20 @@
+import type { MsOAuthConfig } from "./msoauth.js";
+export type AuthConfig = {
+    mode: "BetterAuthJwt";
+    contentSigningSecret: string;
+} | {
+    mode: "GatewayAuthorizer";
+};
+export type ResponseValidation = "Log" | "Skip";
+export type SelfUpdate = "Enabled" | "Disabled";
+export interface ApiConfig {
+    auth: AuthConfig;
+    corsAllowedOrigins: readonly string[];
+    publicOrigin: string;
+    contentDeliveryDomain: string;
+    msOAuth: MsOAuthConfig;
+    selfUpdate: SelfUpdate;
+    updateControlDir: string;
+    commit: string;
+    responseValidation: ResponseValidation;
+}

package/dist/src/config/api-config.js

@@ -0,0 +1 @@
+export {};

package/dist/src/config/from-env.d.ts

@@ -0,0 +1,2 @@
+import type { ApiConfig } from "./api-config.js";
+export declare const configFromEnv: (env: NodeJS.ProcessEnv) => ApiConfig;

package/dist/src/config/from-env.js

@@ -0,0 +1,65 @@
+import { msOAuthCredentialsFromSecret } from "./msoauth-secrets-manager.js";
+const DEFAULT_UPDATE_CONTROL_DIR = "/data/control";
+const optional = (env, key) => env[key] || undefined;
+const required = (env, key, reason) => {
+    const value = optional(env, key);
+    if (!value)
+        throw new Error(`Refusing to start: ${key} is not set. ${reason}`);
+    return value;
+};
+const commaList = (raw) => (raw ?? "")
+    .split(",")
+    .map((origin) => origin.trim())
+    .filter((origin) => origin.length > 0);
+const authFromEnv = (env) => env.DATA_BACKEND === "sqlite"
+    ? {
+        mode: "BetterAuthJwt",
+        contentSigningSecret: required(env, "BETTER_AUTH_SECRET", "The self-host SQL backend signs content URLs with it."),
+    }
+    : { mode: "GatewayAuthorizer" };
+const contentDeliveryDomainFromEnv = (env, auth, publicOrigin) => {
+    if (auth.mode === "BetterAuthJwt") {
+        return optional(env, "CONTENT_DELIVERY_DOMAIN") ?? publicOrigin;
+    }
+    return required(env, "CONTENT_DELIVERY_DOMAIN", "BodyPartResponse.contentUrl is built from the CloudFront distribution domain (#299); wire it via the API Lambda env (see infra/bin/infra.ts).");
+};
+const msOAuthCredentialsFromEnv = (env) => {
+    const clientId = optional(env, "MSOAUTH_CLIENT_ID");
+    const clientSecret = optional(env, "MSOAUTH_CLIENT_SECRET");
+    if (clientId && clientSecret) {
+        return async () => ({ clientId, clientSecret });
+    }
+    const secretArn = optional(env, "MSOAUTH_SECRET_ARN");
+    if (secretArn)
+        return msOAuthCredentialsFromSecret(secretArn);
+    return undefined;
+};
+const msOAuthFromEnv = (env) => {
+    const credentials = msOAuthCredentialsFromEnv(env);
+    if (!credentials)
+        return { mode: "Disabled" };
+    const tokenEndpoint = optional(env, "MSOAUTH_TOKEN_ENDPOINT");
+    return {
+        mode: "Enabled",
+        redirectUri: required(env, "MSOAUTH_REDIRECT_URI", "It is derived from PUBLIC_ORIGIN — set PUBLIC_ORIGIN in the deploy env file (deploy/vps/.env) and restart, or set MSOAUTH_REDIRECT_URI directly."),
+        overrides: tokenEndpoint ? { tokenEndpoint } : {},
+        credentials,
+    };
+};
+export const configFromEnv = (env) => {
+    const publicOrigin = required(env, "PUBLIC_ORIGIN", "It is the origin the web client is served from.");
+    const auth = authFromEnv(env);
+    return {
+        auth,
+        corsAllowedOrigins: commaList(env.CORS_ALLOWED_ORIGINS),
+        publicOrigin,
+        contentDeliveryDomain: contentDeliveryDomainFromEnv(env, auth, publicOrigin),
+        msOAuth: msOAuthFromEnv(env),
+        selfUpdate: optional(env, "REMIT_UPDATE_MANIFEST_URL")
+            ? "Enabled"
+            : "Disabled",
+        updateControlDir: optional(env, "REMIT_UPDATE_CONTROL_DIR") ?? DEFAULT_UPDATE_CONTROL_DIR,
+        commit: optional(env, "REMIT_WORKER_SHA") ?? optional(env, "GITHUB_SHA") ?? "dev",
+        responseValidation: env.STAGE_NAME === "dev" ? "Log" : "Skip",
+    };
+};

package/dist/src/config/msoauth-secrets-manager.d.ts

@@ -0,0 +1,2 @@
+import type { MsOAuthCredentials } from "./msoauth.js";
+export declare const msOAuthCredentialsFromSecret: (secretArn: string) => () => Promise<MsOAuthCredentials>;

package/dist/src/config/msoauth-secrets-manager.js

@@ -0,0 +1,28 @@
+import { GetSecretValueCommand, SecretsManagerClient, } from "@aws-sdk/client-secrets-manager";
+import { z } from "zod";
+const MsOAuthSecret = z.object({
+    clientId: z.string().min(1),
+    clientSecret: z.string().min(1),
+});
+let client = null;
+const secretsManager = () => {
+    if (!client)
+        client = new SecretsManagerClient({});
+    return client;
+};
+const parseSecret = (raw) => {
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+};
+export const msOAuthCredentialsFromSecret = (secretArn) => async () => {
+    const result = await secretsManager().send(new GetSecretValueCommand({ SecretId: secretArn }));
+    const parsed = MsOAuthSecret.safeParse(parseSecret(result.SecretString ?? ""));
+    if (!parsed.success) {
+        throw new Error("The Microsoft OAuth secret named by MSOAUTH_SECRET_ARN does not hold a JSON object with a non-empty clientId and clientSecret");
+    }
+    return parsed.data;
+};

package/dist/src/config/msoauth.d.ts

@@ -0,0 +1,19 @@
+import type { OAuthProviderConfig } from "@remit/mail-oauth-service";
+export interface MsOAuthCredentials {
+    clientId: string;
+    clientSecret: string;
+}
+export interface MsOAuthEnabled {
+    mode: "Enabled";
+    redirectUri: string;
+    overrides: Partial<Pick<OAuthProviderConfig, "tokenEndpoint">>;
+    credentials: () => Promise<MsOAuthCredentials>;
+}
+export type MsOAuthConfig = {
+    mode: "Disabled";
+} | MsOAuthEnabled;
+export interface LoadedMsOAuth {
+    config: MsOAuthEnabled;
+    credentials: MsOAuthCredentials;
+}
+export declare const loadMsOAuth: (config: MsOAuthConfig) => Promise<LoadedMsOAuth>;

package/dist/src/config/msoauth.js

@@ -0,0 +1,6 @@
+export const loadMsOAuth = async (config) => {
+    if (config.mode === "Disabled") {
+        throw new Error("No Microsoft OAuth credentials are configured on this instance: set MSOAUTH_CLIENT_ID and MSOAUTH_CLIENT_SECRET, or MSOAUTH_SECRET_ARN");
+    }
+    return { config, credentials: await config.credentials() };
+};

package/{src/derive/autoMoved.ts → dist/src/derive/autoMoved.d.ts}

@@ -1,7 +1,5 @@
 import type { AutoMovedInfo } from "@remit/api-openapi-types";
 import type { MessageItem } from "@remit/data-ports";
-import { PlacementConfidence } from "@remit/domain-enums";
-
 /**
  * Project a Message's internal auto-move state to the public `AutoMovedInfo`
  * shape. Present only for a real, in-effect auto-move; absent otherwise, so a
@@ -27,30 +25,4 @@ import { PlacementConfidence } from "@remit/domain-enums";
  * The client derives everything else (whether the move is still in effect, the
  * undo target) from these fields plus current placement.
  */
-export const deriveAutoMoved = (
-	message: Pick<
-		MessageItem,
-		"movedByRemit" | "placementVerdict" | "filterMove"
-	>,
-): AutoMovedInfo | undefined => {
-	if (message.movedByRemit !== true) return undefined;
-
-	const filterMove = message.filterMove;
-	if (filterMove) {
-		return {
-			fromMailboxId: filterMove.sourceMailboxId,
-			destinationMailboxId: filterMove.destinationMailboxId,
-			filterId: filterMove.filterId,
-		};
-	}
-
-	const verdict = message.placementVerdict;
-	if (!verdict) return undefined;
-	if (verdict.confidence !== PlacementConfidence.Confident) return undefined;
-	if (verdict.dryRun === true) return undefined;
-
-	return {
-		action: verdict.action,
-		fromPlacement: verdict.fromPlacement,
-	};
-};
+export declare const deriveAutoMoved: (message: Pick<MessageItem, "movedByRemit" | "placementVerdict" | "filterMove">) => AutoMovedInfo | undefined;

package/dist/src/derive/autoMoved.js

@@ -0,0 +1,49 @@
+import { PlacementConfidence } from "@remit/domain-enums";
+/**
+ * Project a Message's internal auto-move state to the public `AutoMovedInfo`
+ * shape. Present only for a real, in-effect auto-move; absent otherwise, so a
+ * message synced before either mechanism existed (no `filterMove`, no
+ * `placementVerdict`) projects nothing and renders no badge.
+ *
+ * Two mechanisms move mail and both raise `movedByRemit`:
+ *
+ * 1. A standing filter (RFC 034) records a `filterMove` marker naming the
+ *    source folder, the destination folder, and the filter. It has no
+ *    classifier direction/role, so the projection carries mailbox ids
+ *    (`fromMailboxId`/`destinationMailboxId`) and the `filterId` for the
+ *    Settings link — an arbitrary destination the Inbox/Junk-shaped `action`
+ *    cannot name.
+ * 2. The Tier 0 classifier records a `placementVerdict`. Its `action`
+ *    (MoveToInbox/MoveToJunk) and `fromPlacement` (inbox/junk/other) are the
+ *    only fields that cross to the wire; confidence, dryRun, decidedAt and
+ *    reasons stay internal.
+ *
+ * The filter marker outranks the verdict check: a matched filter's move is
+ * exclusive and outranks the classifier's placement move at index time (RFC 034
+ * Decision 3.1), so a message carrying both was ultimately moved by the filter.
+ * The client derives everything else (whether the move is still in effect, the
+ * undo target) from these fields plus current placement.
+ */
+export const deriveAutoMoved = (message) => {
+    if (message.movedByRemit !== true)
+        return undefined;
+    const filterMove = message.filterMove;
+    if (filterMove) {
+        return {
+            fromMailboxId: filterMove.sourceMailboxId,
+            destinationMailboxId: filterMove.destinationMailboxId,
+            filterId: filterMove.filterId,
+        };
+    }
+    const verdict = message.placementVerdict;
+    if (!verdict)
+        return undefined;
+    if (verdict.confidence !== PlacementConfidence.Confident)
+        return undefined;
+    if (verdict.dryRun === true)
+        return undefined;
+    return {
+        action: verdict.action,
+        fromPlacement: verdict.fromPlacement,
+    };
+};

package/dist/src/derive/contentSignature.d.ts

@@ -0,0 +1,40 @@
+import { type SignedPathFailure } from "@remit/storage-service/signed-path";
+import type { ApiConfig } from "../config/api-config.js";
+/**
+ * Default validity window for a signed content URL. Long enough to cover a
+ * viewing session (react-query caches describeMessage for 30 min and inline
+ * images may load late), short enough to bound the replay window if a URL
+ * leaks.
+ */
+export declare const CONTENT_URL_TTL_SECONDS = 3600;
+export interface ContentSignature {
+    exp: number;
+    sig: string;
+}
+/**
+ * A function that signs a decoded, account-scoped storage path and returns the
+ * `exp`/`sig` query params to append to its content URL.
+ */
+export type ContentSigner = (relativePath: string) => ContentSignature;
+export declare const createContentSigner: (masterSecret: string, ttlSeconds?: number) => ContentSigner;
+/**
+ * Build the content-URL signer for the current environment, or `undefined` when
+ * signing does not apply. Signing is enforced on the self-host SQL backend,
+ * which serves `/content/*` straight from the backend container; on AWS the
+ * Lambda@Edge JWT verifier guards `/content/*` and the URL stays unsigned so
+ * CloudFront/S3 behaviour is unchanged.
+ */
+export declare const getContentSigner: (config: ApiConfig) => ContentSigner | undefined;
+export type ContentSignatureFailure = SignedPathFailure;
+export type ContentSignatureResult = {
+    valid: true;
+} | {
+    valid: false;
+    reason: ContentSignatureFailure;
+};
+/**
+ * Verify a signed content request. Recomputes the HMAC over the requested path
+ * and the supplied expiry and constant-time compares it against the presented
+ * signature. Pure so the decision can be unit-tested without a live server.
+ */
+export declare const verifyContentSignature: (relativePath: string, expRaw: string | undefined, sig: string | undefined, masterSecret: string, nowSeconds: number) => ContentSignatureResult;