@revealui/core 0.0.1-pre.4 → 0.2.0

package/dist/security/headers.js

@@ -0,0 +1,402 @@
+/**
+ * Security Headers and CORS Configuration
+ *
+ * HTTP security headers and CORS policy management
+ */
+/**
+ * Security headers manager
+ */
+export class SecurityHeaders {
+    config;
+    constructor(config = {}) {
+        this.config = config;
+    }
+    /**
+     * Get all security headers
+     */
+    getHeaders() {
+        const headers = {};
+        // Content Security Policy
+        if (this.config.contentSecurityPolicy) {
+            headers['Content-Security-Policy'] = this.buildCSP(this.config.contentSecurityPolicy);
+        }
+        // Strict Transport Security
+        if (this.config.strictTransportSecurity) {
+            headers['Strict-Transport-Security'] = this.buildHSTS(this.config.strictTransportSecurity);
+        }
+        // X-Frame-Options
+        if (this.config.xFrameOptions) {
+            headers['X-Frame-Options'] = this.config.xFrameOptions;
+        }
+        // X-Content-Type-Options
+        if (this.config.xContentTypeOptions !== false) {
+            headers['X-Content-Type-Options'] = 'nosniff';
+        }
+        // Referrer-Policy
+        if (this.config.referrerPolicy) {
+            headers['Referrer-Policy'] = this.config.referrerPolicy;
+        }
+        // Permissions-Policy
+        if (this.config.permissionsPolicy) {
+            headers['Permissions-Policy'] = this.buildPermissionsPolicy(this.config.permissionsPolicy);
+        }
+        // Cross-Origin headers
+        if (this.config.crossOriginEmbedderPolicy) {
+            headers['Cross-Origin-Embedder-Policy'] = this.config.crossOriginEmbedderPolicy;
+        }
+        if (this.config.crossOriginOpenerPolicy) {
+            headers['Cross-Origin-Opener-Policy'] = this.config.crossOriginOpenerPolicy;
+        }
+        if (this.config.crossOriginResourcePolicy) {
+            headers['Cross-Origin-Resource-Policy'] = this.config.crossOriginResourcePolicy;
+        }
+        return headers;
+    }
+    /**
+     * Build Content Security Policy header
+     */
+    buildCSP(config) {
+        if (typeof config === 'string') {
+            return config;
+        }
+        const directives = [];
+        const addDirective = (name, values) => {
+            if (values && values.length > 0) {
+                directives.push(`${name} ${values.join(' ')}`);
+            }
+        };
+        addDirective('default-src', config.defaultSrc);
+        addDirective('script-src', config.scriptSrc);
+        addDirective('style-src', config.styleSrc);
+        addDirective('img-src', config.imgSrc);
+        addDirective('font-src', config.fontSrc);
+        addDirective('connect-src', config.connectSrc);
+        addDirective('frame-src', config.frameSrc);
+        addDirective('object-src', config.objectSrc);
+        addDirective('media-src', config.mediaSrc);
+        addDirective('worker-src', config.workerSrc);
+        addDirective('child-src', config.childSrc);
+        addDirective('form-action', config.formAction);
+        addDirective('frame-ancestors', config.frameAncestors);
+        addDirective('base-uri', config.baseUri);
+        addDirective('manifest-src', config.manifestSrc);
+        if (config.upgradeInsecureRequests) {
+            directives.push('upgrade-insecure-requests');
+        }
+        if (config.blockAllMixedContent) {
+            directives.push('block-all-mixed-content');
+        }
+        if (config.reportUri) {
+            directives.push(`report-uri ${config.reportUri}`);
+        }
+        if (config.reportTo) {
+            directives.push(`report-to ${config.reportTo}`);
+        }
+        return directives.join('; ');
+    }
+    /**
+     * Build HSTS header
+     */
+    buildHSTS(config) {
+        if (config === true) {
+            return 'max-age=31536000; includeSubDomains';
+        }
+        if (config === false) {
+            return '';
+        }
+        // config is now HSTSConfig
+        const parts = [`max-age=${config.maxAge}`];
+        if (config.includeSubDomains) {
+            parts.push('includeSubDomains');
+        }
+        if (config.preload) {
+            parts.push('preload');
+        }
+        return parts.join('; ');
+    }
+    /**
+     * Build Permissions-Policy header
+     */
+    buildPermissionsPolicy(config) {
+        if (typeof config === 'string') {
+            return config;
+        }
+        const policies = [];
+        Object.entries(config).forEach(([feature, origins]) => {
+            if (!origins || origins.length === 0) {
+                policies.push(`${feature}=()`);
+            }
+            else if (origins.includes('*')) {
+                policies.push(`${feature}=*`);
+            }
+            else {
+                const originsList = origins.map((o) => `"${o}"`).join(' ');
+                policies.push(`${feature}=(${originsList})`);
+            }
+        });
+        return policies.join(', ');
+    }
+    /**
+     * Apply headers to response
+     */
+    applyHeaders(response) {
+        const headers = this.getHeaders();
+        Object.entries(headers).forEach(([name, value]) => {
+            response.headers.set(name, value);
+        });
+        return response;
+    }
+}
+/**
+ * CORS manager
+ */
+export class CORSManager {
+    config;
+    constructor(config = {}) {
+        this.config = {
+            origin: config.origin ?? [],
+            methods: config.methods || ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'],
+            allowedHeaders: config.allowedHeaders || ['Content-Type', 'Authorization'],
+            exposedHeaders: config.exposedHeaders || [],
+            credentials: config.credentials ?? false,
+            maxAge: config.maxAge || 86400,
+            preflightContinue: config.preflightContinue ?? false,
+            optionsSuccessStatus: config.optionsSuccessStatus || 204,
+        };
+    }
+    /**
+     * Check if origin is allowed
+     */
+    isOriginAllowed(origin) {
+        const { origin: allowedOrigin } = this.config;
+        if (allowedOrigin === '*') {
+            return true;
+        }
+        if (typeof allowedOrigin === 'function') {
+            return allowedOrigin(origin);
+        }
+        if (typeof allowedOrigin === 'string') {
+            return origin === allowedOrigin;
+        }
+        if (Array.isArray(allowedOrigin)) {
+            return allowedOrigin.includes(origin);
+        }
+        return false;
+    }
+    /**
+     * Get CORS headers
+     */
+    getCORSHeaders(origin) {
+        const headers = {};
+        // Access-Control-Allow-Origin
+        if (this.isOriginAllowed(origin)) {
+            headers['Access-Control-Allow-Origin'] = this.config.origin === '*' ? '*' : origin;
+        }
+        // Access-Control-Allow-Credentials — incompatible with origin: '*' per Fetch spec
+        if (this.config.credentials && this.config.origin !== '*') {
+            headers['Access-Control-Allow-Credentials'] = 'true';
+        }
+        // Access-Control-Expose-Headers
+        if (this.config.exposedHeaders.length > 0) {
+            headers['Access-Control-Expose-Headers'] = this.config.exposedHeaders.join(', ');
+        }
+        return headers;
+    }
+    /**
+     * Get preflight headers
+     */
+    getPreflightHeaders(origin) {
+        const headers = this.getCORSHeaders(origin);
+        // Access-Control-Allow-Methods
+        headers['Access-Control-Allow-Methods'] = this.config.methods.join(', ');
+        // Access-Control-Allow-Headers
+        headers['Access-Control-Allow-Headers'] = this.config.allowedHeaders.join(', ');
+        // Access-Control-Max-Age
+        headers['Access-Control-Max-Age'] = this.config.maxAge.toString();
+        return headers;
+    }
+    /**
+     * Handle CORS request
+     */
+    handleRequest(request) {
+        const origin = request.headers.get('Origin');
+        if (!origin) {
+            return null;
+        }
+        // Handle preflight
+        if (request.method === 'OPTIONS') {
+            return this.handlePreflight(request, origin);
+        }
+        return null;
+    }
+    /**
+     * Handle preflight request
+     */
+    handlePreflight(_request, origin) {
+        if (!this.isOriginAllowed(origin)) {
+            return new Response(null, { status: 403 });
+        }
+        const headers = this.getPreflightHeaders(origin);
+        return new Response(null, {
+            status: this.config.optionsSuccessStatus,
+            headers,
+        });
+    }
+    /**
+     * Apply CORS headers to response
+     */
+    applyHeaders(response, origin) {
+        if (!this.isOriginAllowed(origin)) {
+            return response;
+        }
+        const headers = this.getCORSHeaders(origin);
+        Object.entries(headers).forEach(([name, value]) => {
+            response.headers.set(name, value);
+        });
+        return response;
+    }
+}
+/**
+ * Common security header presets
+ */
+export const SecurityPresets = {
+    /**
+     * Strict security (recommended for production)
+     */
+    strict: () => ({
+        contentSecurityPolicy: {
+            defaultSrc: ["'self'"],
+            scriptSrc: ["'self'"],
+            styleSrc: ["'self'", "'unsafe-inline'"],
+            imgSrc: ["'self'", 'data:', 'https:'],
+            fontSrc: ["'self'", 'data:'],
+            connectSrc: ["'self'"],
+            frameSrc: ["'none'"],
+            objectSrc: ["'none'"],
+            baseUri: ["'self'"],
+            formAction: ["'self'"],
+            frameAncestors: ["'none'"],
+            upgradeInsecureRequests: true,
+        },
+        strictTransportSecurity: {
+            maxAge: 31536000,
+            includeSubDomains: true,
+            preload: true,
+        },
+        xFrameOptions: 'DENY',
+        xContentTypeOptions: true,
+        referrerPolicy: 'strict-origin-when-cross-origin',
+        crossOriginEmbedderPolicy: 'require-corp',
+        crossOriginOpenerPolicy: 'same-origin',
+        crossOriginResourcePolicy: 'same-origin',
+    }),
+    /**
+     * Moderate security (balanced)
+     */
+    moderate: () => ({
+        contentSecurityPolicy: {
+            defaultSrc: ["'self'"],
+            scriptSrc: ["'self'", "'unsafe-inline'"],
+            styleSrc: ["'self'", "'unsafe-inline'"],
+            imgSrc: ["'self'", 'data:', 'https:'],
+            fontSrc: ["'self'", 'data:', 'https:'],
+            connectSrc: ["'self'", 'https:'],
+            frameAncestors: ["'self'"],
+        },
+        strictTransportSecurity: {
+            maxAge: 31536000,
+            includeSubDomains: true,
+        },
+        xFrameOptions: 'SAMEORIGIN',
+        xContentTypeOptions: true,
+        referrerPolicy: 'origin-when-cross-origin',
+    }),
+    /**
+     * Development (permissive)
+     */
+    development: () => ({
+        xContentTypeOptions: true,
+        referrerPolicy: 'no-referrer-when-downgrade',
+    }),
+};
+/**
+ * Common CORS presets
+ */
+export const CORSPresets = {
+    /**
+     * Strict CORS (same origin only)
+     */
+    strict: () => ({
+        origin: [],
+        methods: ['GET', 'POST', 'PUT', 'DELETE'],
+        allowedHeaders: ['Content-Type', 'Authorization'],
+        credentials: true,
+        maxAge: 86400,
+    }),
+    /**
+     * Moderate CORS (specific origins)
+     */
+    moderate: (allowedOrigins) => ({
+        origin: allowedOrigins,
+        methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH'],
+        allowedHeaders: ['Content-Type', 'Authorization', 'X-Requested-With'],
+        exposedHeaders: ['X-Total-Count'],
+        credentials: true,
+        maxAge: 86400,
+    }),
+    /**
+     * Permissive CORS (all origins)
+     */
+    permissive: () => ({
+        origin: '*',
+        methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'],
+        allowedHeaders: ['*'],
+        credentials: false,
+        maxAge: 86400,
+    }),
+    /**
+     * API CORS (for public APIs)
+     */
+    api: () => ({
+        origin: '*',
+        methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH'],
+        allowedHeaders: ['Content-Type', 'Authorization', 'X-API-Key'],
+        exposedHeaders: ['X-RateLimit-Limit', 'X-RateLimit-Remaining', 'X-RateLimit-Reset'],
+        credentials: false,
+        maxAge: 86400,
+    }),
+};
+/**
+ * Security middleware creator
+ */
+export function createSecurityMiddleware(securityConfig, corsConfig) {
+    const security = new SecurityHeaders(securityConfig);
+    const cors = new CORSManager(corsConfig);
+    return async (request, next) => {
+        const origin = request.headers.get('Origin');
+        // Handle CORS preflight
+        if (origin && request.method === 'OPTIONS') {
+            const preflightResponse = cors.handleRequest(request);
+            if (preflightResponse) {
+                return preflightResponse;
+            }
+        }
+        // Process request
+        const response = await next();
+        // Apply security headers
+        security.applyHeaders(response);
+        // Apply CORS headers
+        if (origin) {
+            cors.applyHeaders(response, origin);
+        }
+        return response;
+    };
+}
+/**
+ * Rate limiting headers
+ */
+export function setRateLimitHeaders(response, limit, remaining, reset) {
+    response.headers.set('X-RateLimit-Limit', limit.toString());
+    response.headers.set('X-RateLimit-Remaining', remaining.toString());
+    response.headers.set('X-RateLimit-Reset', reset.toString());
+}

package/dist/security/index.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Security & Compliance
+ *
+ * Comprehensive security infrastructure for authentication, authorization,
+ * encryption, audit logging, GDPR compliance, and secure headers
+ */
+export type { AuditEvent, AuditEventType, AuditQuery, AuditSeverity, AuditStorage, } from './audit';
+export { AuditReportGenerator, AuditSystem, AuditTrail, audit, createAuditMiddleware, InMemoryAuditStorage, } from './audit';
+export type { AuthConfig, AuthSession, AuthToken, JWTPayload, OAuthConfig, User, } from './auth';
+export { AuthSystem, OAuthClient, OAuthProviders, PasswordHasher, TwoFactorAuth, } from './auth';
+export type { AuthorizationContext, Permission, Policy, PolicyCondition, Role, } from './authorization';
+export { AuthorizationSystem, authorization, CommonRoles, canAccessResource, checkAttributeAccess, createAuthorizationMiddleware, PermissionBuilder, PermissionCache, PolicyBuilder, permissionCache, RequirePermission, RequireRole, } from './authorization';
+export type { EncryptedData, EncryptionConfig, } from './encryption';
+export { DataMasking, EncryptionSystem, EnvelopeEncryption, encryption, FieldEncryption, KeyRotationManager, TokenGenerator, } from './encryption';
+export type { ConsentRecord, ConsentType, CookieConsentConfig, DataBreach, DataCategory, DataDeletionRequest, DataProcessingPurpose, PersonalDataExport, } from './gdpr';
+export { ConsentManager, CookieConsentManager, consentManager, cookieConsentManager, DataAnonymization, DataBreachManager, DataDeletionSystem, DataExportSystem, dataBreachManager, dataDeletionSystem, dataExportSystem, PrivacyPolicyManager, privacyPolicyManager, } from './gdpr';
+export type { CORSConfig, ContentSecurityPolicyConfig, HSTSConfig, PermissionsPolicyConfig, ReferrerPolicyValue, SecurityHeadersConfig, } from './headers';
+export { CORSManager, CORSPresets, createSecurityMiddleware, SecurityHeaders, SecurityPresets, setRateLimitHeaders, } from './headers';
+//# sourceMappingURL=index.d.ts.map

package/dist/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EACV,UAAU,EACV,cAAc,EACd,UAAU,EACV,aAAa,EACb,YAAY,GACb,MAAM,SAAS,CAAA;AAEhB,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,UAAU,EACV,KAAK,EACL,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,SAAS,CAAA;AAChB,YAAY,EACV,UAAU,EACV,WAAW,EACX,SAAS,EACT,UAAU,EACV,WAAW,EACX,IAAI,GACL,MAAM,QAAQ,CAAA;AAEf,OAAO,EACL,UAAU,EACV,WAAW,EACX,cAAc,EACd,cAAc,EACd,aAAa,GACd,MAAM,QAAQ,CAAA;AACf,YAAY,EACV,oBAAoB,EACpB,UAAU,EACV,MAAM,EACN,eAAe,EACf,IAAI,GACL,MAAM,iBAAiB,CAAA;AAExB,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,oBAAoB,EACpB,6BAA6B,EAC7B,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,WAAW,GACZ,MAAM,iBAAiB,CAAA;AACxB,YAAY,EACV,aAAa,EACb,gBAAgB,GACjB,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,cAAc,GACf,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,aAAa,EACb,WAAW,EACX,mBAAmB,EACnB,UAAU,EACV,YAAY,EACZ,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,QAAQ,CAAA;AAEf,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,QAAQ,CAAA;AACf,YAAY,EACV,UAAU,EACV,2BAA2B,EAC3B,UAAU,EACV,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,WAAW,CAAA;AAElB,OAAO,EACL,WAAW,EACX,WAAW,EACX,wBAAwB,EACxB,eAAe,EACf,eAAe,EACf,mBAAmB,GACpB,MAAM,WAAW,CAAA"}

package/dist/security/index.js

@@ -0,0 +1,18 @@
+/**
+ * Security & Compliance
+ *
+ * Comprehensive security infrastructure for authentication, authorization,
+ * encryption, audit logging, GDPR compliance, and secure headers
+ */
+// Audit logging
+export { AuditReportGenerator, AuditSystem, AuditTrail, audit, createAuditMiddleware, InMemoryAuditStorage, } from './audit';
+// Authentication
+export { AuthSystem, OAuthClient, OAuthProviders, PasswordHasher, TwoFactorAuth, } from './auth';
+// Authorization
+export { AuthorizationSystem, authorization, CommonRoles, canAccessResource, checkAttributeAccess, createAuthorizationMiddleware, PermissionBuilder, PermissionCache, PolicyBuilder, permissionCache, RequirePermission, RequireRole, } from './authorization';
+// Encryption
+export { DataMasking, EncryptionSystem, EnvelopeEncryption, encryption, FieldEncryption, KeyRotationManager, TokenGenerator, } from './encryption';
+// GDPR compliance
+export { ConsentManager, CookieConsentManager, consentManager, cookieConsentManager, DataAnonymization, DataBreachManager, DataDeletionSystem, DataExportSystem, dataBreachManager, dataDeletionSystem, dataExportSystem, PrivacyPolicyManager, privacyPolicyManager, } from './gdpr';
+// Security headers
+export { CORSManager, CORSPresets, createSecurityMiddleware, SecurityHeaders, SecurityPresets, setRateLimitHeaders, } from './headers';

package/dist/server/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * RevealUI Core - Server Entry Point
+ *
+ * Server-only exports for RevealUI framework.
+ * This module includes Node.js-specific utilities and should only be imported
+ * in server-side code (API routes, server components, middleware with nodejs runtime).
+ *
+ * WARNING: Do NOT import from this module in client components or edge runtime.
+ * Use '@revealui/core' or '@revealui/core/client' for client-safe exports.
+ *
+ * NOTE: This file does NOT use 'use server' directive as that's for Server Actions in Next.js,
+ * not for server-only modules. The separation is enforced through package.json exports.
+ */
+export { createRESTHandlers, handleRESTRequest } from '../api/rest.js';
+export { universalPostgresAdapter } from '../database/universal-postgres.js';
+export { vercelBlobStorage } from '../storage/vercel-blob.js';
+export type { LogContext, Logger, LogLevel } from '../utils/logger-server.js';
+export { createLogger, logger } from '../utils/logger-server.js';
+export * from '../utils/request-context.js';
+export { renderPage } from './renderPage.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAEtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAA;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAC7D,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAA;AAE7E,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAEhE,cAAc,6BAA6B,CAAA;AAQ3C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA"}

package/dist/server/index.js

@@ -0,0 +1,28 @@
+/**
+ * RevealUI Core - Server Entry Point
+ *
+ * Server-only exports for RevealUI framework.
+ * This module includes Node.js-specific utilities and should only be imported
+ * in server-side code (API routes, server components, middleware with nodejs runtime).
+ *
+ * WARNING: Do NOT import from this module in client components or edge runtime.
+ * Use '@revealui/core' or '@revealui/core/client' for client-safe exports.
+ *
+ * NOTE: This file does NOT use 'use server' directive as that's for Server Actions in Next.js,
+ * not for server-only modules. The separation is enforced through package.json exports.
+ */
+// Server-only API handlers
+export { createRESTHandlers, handleRESTRequest } from '../api/rest.js';
+// Server-only database/storage
+export { universalPostgresAdapter } from '../database/universal-postgres.js';
+export { vercelBlobStorage } from '../storage/vercel-blob.js';
+// Server-only logger with request context
+export { createLogger, logger } from '../utils/logger-server.js';
+// Request context utilities (server-only - uses async_hooks)
+export * from '../utils/request-context.js';
+// Monitoring (server-only due to request-context dependency)
+// NOTE: Monitoring exports are commented out due to Sentry build-time import issues
+// Import directly from '@revealui/core/monitoring' if needed
+// export * from '../monitoring/index.js'
+// Existing server functionality
+export { renderPage } from './renderPage.js';

package/dist/server/renderPage.d.ts

@@ -0,0 +1,69 @@
+import type { PageContext } from '../types/frontend.js';
+export type { PageContext, PageContextInit } from '../types/frontend.js';
+/**
+ * Escape HTML entities to prevent XSS attacks.
+ *
+ * @param str - String to escape
+ * @returns Escaped string safe for HTML content
+ *
+ * @example
+ * ```typescript
+ * escapeHtml('<script>alert("xss")</script>')
+ * // Returns: '&lt;script&gt;alert(&quot;xss&quot;)&lt;/script&gt;'
+ * ```
+ */
+export declare function escapeHtml(str: string): string;
+/**
+ * Options for rendering an HTML shell
+ */
+export interface HTMLShellOptions {
+    title?: string;
+    description?: string;
+    lang?: string;
+    charset?: string;
+    viewport?: string;
+    styles?: string[];
+    scripts?: string[];
+    headContent?: string;
+    bodyContent?: string;
+    bodyAttributes?: Record<string, string>;
+}
+/**
+ * Render a basic HTML shell for SSR.
+ *
+ * @param options - Options for the HTML shell
+ * @returns Complete HTML document string
+ *
+ * @example
+ * ```typescript
+ * const html = renderHTMLShell({
+ *   title: 'My Page',
+ *   description: 'A sample page',
+ *   bodyContent: '<div id="root">Loading...</div>',
+ *   styles: ['/styles/main.css'],
+ *   scripts: ['/js/app.js'],
+ * })
+ * ```
+ */
+export declare function renderHTMLShell(options?: HTMLShellOptions): string;
+/**
+ * Render a page to HTML string for server-side rendering.
+ *
+ * This is a framework-agnostic utility for basic SSR. For React Server Components
+ * and advanced features like Lexical rich text serialization, use the full
+ * SSR handler at apps/mainframe/src/server/revealui-handler.tsx.
+ *
+ * @param pageData - The page data to render
+ * @param context - Page context information
+ * @returns HTML string
+ *
+ * @example
+ * ```typescript
+ * const html = renderPage(
+ *   { title: 'Welcome', content: '<p>Hello world</p>' },
+ *   { url: '/welcome', locale: 'en' }
+ * )
+ * ```
+ */
+export declare function renderPage(pageData: unknown, context: PageContext): string;
+//# sourceMappingURL=renderPage.d.ts.map

package/dist/server/renderPage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"renderPage.d.ts","sourceRoot":"","sources":["../../src/server/renderPage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAGvD,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAcxE;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACxC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,OAAO,GAAE,gBAAqB,GAAG,MAAM,CA6CtE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,GAAG,MAAM,CAoB1E"}

package/dist/server/renderPage.js

@@ -0,0 +1,109 @@
+/**
+ * HTML entity escaping map for preventing XSS
+ */
+const HTML_ESCAPE_MAP = {
+    '&': '&',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#x27;',
+    '/': '&#x2F;',
+};
+/**
+ * Escape HTML entities to prevent XSS attacks.
+ *
+ * @param str - String to escape
+ * @returns Escaped string safe for HTML content
+ *
+ * @example
+ * ```typescript
+ * escapeHtml('<script>alert("xss")</script>')
+ * // Returns: '&lt;script&gt;alert(&quot;xss&quot;)&lt;/script&gt;'
+ * ```
+ */
+export function escapeHtml(str) {
+    return str.replace(/[&<>"'/]/g, (char) => HTML_ESCAPE_MAP[char] || char);
+}
+/**
+ * Render a basic HTML shell for SSR.
+ *
+ * @param options - Options for the HTML shell
+ * @returns Complete HTML document string
+ *
+ * @example
+ * ```typescript
+ * const html = renderHTMLShell({
+ *   title: 'My Page',
+ *   description: 'A sample page',
+ *   bodyContent: '<div id="root">Loading...</div>',
+ *   styles: ['/styles/main.css'],
+ *   scripts: ['/js/app.js'],
+ * })
+ * ```
+ */
+export function renderHTMLShell(options = {}) {
+    const { title = 'Page', description = '', lang = 'en', charset = 'UTF-8', viewport = 'width=device-width, initial-scale=1.0', styles = [], scripts = [], headContent = '', bodyContent = '', bodyAttributes = {}, } = options;
+    const escapedTitle = escapeHtml(title);
+    const escapedDescription = escapeHtml(description);
+    const styleLinks = styles
+        .map((href) => `  <link rel="stylesheet" href="${escapeHtml(href)}">`)
+        .join('\n');
+    const scriptTags = scripts
+        .map((src) => `  <script src="${escapeHtml(src)}" defer></script>`)
+        .join('\n');
+    const bodyAttrs = Object.entries(bodyAttributes)
+        .map(([key, value]) => `${escapeHtml(key)}="${escapeHtml(value)}"`)
+        .join(' ');
+    const bodyTag = bodyAttrs ? `<body ${bodyAttrs}>` : '<body>';
+    return `<!DOCTYPE html>
+<html lang="${lang}">
+<head>
+  <meta charset="${charset}">
+  <meta name="viewport" content="${viewport}">
+  <title>${escapedTitle}</title>
+  ${escapedDescription ? `<meta name="description" content="${escapedDescription}">` : ''}
+${styleLinks}
+${headContent}
+</head>
+${bodyTag}
+${bodyContent}
+${scriptTags}
+</body>
+</html>`.trim();
+}
+/**
+ * Render a page to HTML string for server-side rendering.
+ *
+ * This is a framework-agnostic utility for basic SSR. For React Server Components
+ * and advanced features like Lexical rich text serialization, use the full
+ * SSR handler at apps/mainframe/src/server/revealui-handler.tsx.
+ *
+ * @param pageData - The page data to render
+ * @param context - Page context information
+ * @returns HTML string
+ *
+ * @example
+ * ```typescript
+ * const html = renderPage(
+ *   { title: 'Welcome', content: '<p>Hello world</p>' },
+ *   { url: '/welcome', locale: 'en' }
+ * )
+ * ```
+ */
+export function renderPage(pageData, context) {
+    void context;
+    const data = pageData && typeof pageData === 'object' ? pageData : {};
+    const title = typeof data.title === 'string' ? data.title : 'Page';
+    const content = typeof data.content === 'string' ? data.content : '';
+    const description = typeof data.description === 'string' ? data.description : 'Generated by RevealUI CMS';
+    // Escape title and description, but allow content to contain safe HTML
+    const escapedTitle = escapeHtml(title);
+    return renderHTMLShell({
+        title,
+        description,
+        bodyContent: `  <div id="root">
+    <h1>${escapedTitle}</h1>
+    <div>${content}</div>
+  </div>`,
+    });
+}