@robthepcguy/rag-vault 1.0.0

package/dist/web/http-server.js

@@ -0,0 +1,311 @@
+"use strict";
+// HTTP server for web frontend
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createHttpServerWithManager = createHttpServerWithManager;
+exports.createHttpServer = createHttpServer;
+exports.startServer = startServer;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const promises_1 = require("node:fs/promises");
+const node_path_1 = __importDefault(require("node:path"));
+const compression_1 = __importDefault(require("compression"));
+const cors_1 = __importDefault(require("cors"));
+const express_1 = __importDefault(require("express"));
+const file_type_1 = require("file-type");
+const helmet_1 = __importDefault(require("helmet"));
+const multer_1 = __importDefault(require("multer"));
+const api_routes_js_1 = require("./api-routes.js");
+const config_routes_js_1 = require("./config-routes.js");
+const index_js_1 = require("./middleware/index.js");
+// ============================================
+// Constants
+// ============================================
+/** Default JSON body limit (5MB) - prevents DoS from large payloads */
+const DEFAULT_JSON_LIMIT = '5mb';
+/** Default allowed CORS origins (localhost only for security) */
+const DEFAULT_CORS_ORIGINS = [
+    'http://localhost:5173',
+    'http://localhost:3000',
+    'http://127.0.0.1:5173',
+    'http://127.0.0.1:3000',
+];
+/** File size limit for uploads (100MB) */
+const FILE_SIZE_LIMIT_BYTES = 100 * 1024 * 1024;
+/** Default request timeout (30 seconds) */
+const DEFAULT_REQUEST_TIMEOUT_MS = 30000;
+/** Minimum allowed request timeout (1 second) */
+const MIN_REQUEST_TIMEOUT_MS = 1000;
+/**
+ * Get request timeout from environment variable or use default
+ * @returns Request timeout in milliseconds
+ */
+function getRequestTimeoutMs() {
+    const envValue = process.env['REQUEST_TIMEOUT_MS'];
+    if (!envValue)
+        return DEFAULT_REQUEST_TIMEOUT_MS;
+    const parsed = Number.parseInt(envValue, 10);
+    if (Number.isNaN(parsed) || parsed < MIN_REQUEST_TIMEOUT_MS) {
+        console.warn(`Invalid REQUEST_TIMEOUT_MS value "${envValue}". Using default ${DEFAULT_REQUEST_TIMEOUT_MS}ms.`);
+        return DEFAULT_REQUEST_TIMEOUT_MS;
+    }
+    return parsed;
+}
+/** Allowed MIME types for file uploads (validated by magic bytes) */
+const ALLOWED_MIME_TYPES = [
+    'application/pdf',
+    'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+    'text/plain',
+    'text/markdown',
+    'text/html',
+    'application/json',
+];
+/**
+ * Create and configure Express app with DatabaseManager
+ */
+async function createHttpServerWithManager(dbManager, config) {
+    // Create server accessor
+    const serverAccessor = () => {
+        return dbManager.getServer();
+    };
+    // Create config router to add before error handlers
+    const configRouter = (0, config_routes_js_1.createConfigRouter)(dbManager);
+    const app = await createHttpServerInternal(serverAccessor, config, configRouter);
+    return app;
+}
+/**
+ * Create and configure Express app (legacy - direct RAGServer)
+ */
+async function createHttpServer(ragServer, config) {
+    return createHttpServerInternal(() => ragServer, config);
+}
+/**
+ * Internal function to create Express app
+ */
+/**
+ * Validate file content using magic bytes
+ * Returns true if file type is allowed, false otherwise
+ */
+async function validateFileContent(filePath) {
+    try {
+        const buffer = await (0, promises_1.readFile)(filePath);
+        const type = await (0, file_type_1.fileTypeFromBuffer)(buffer);
+        // Allow text files which may not have magic bytes
+        if (!type) {
+            // Check if it's likely a text file by looking for common text patterns
+            const sample = buffer.subarray(0, 1024).toString('utf-8');
+            const isLikelyText = !sample.includes('\x00'); // No null bytes
+            return isLikelyText;
+        }
+        return ALLOWED_MIME_TYPES.includes(type.mime);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Request timeout middleware
+ * Aborts requests that take longer than the specified timeout
+ */
+function requestTimeout(timeoutMs) {
+    return (_req, res, next) => {
+        const timeoutId = setTimeout(() => {
+            if (!res.headersSent) {
+                res.status(503).json({
+                    error: 'Request timeout',
+                    code: 'REQUEST_TIMEOUT',
+                });
+            }
+        }, timeoutMs);
+        res.on('finish', () => clearTimeout(timeoutId));
+        res.on('close', () => clearTimeout(timeoutId));
+        next();
+    };
+}
+/**
+ * Parse CORS origins from environment variable with validation
+ */
+function parseCorsOrigins(env) {
+    if (!env || env.trim() === '')
+        return DEFAULT_CORS_ORIGINS;
+    if (env === '*') {
+        console.warn('[SECURITY] CORS_ORIGINS="*" allows all origins. This is not recommended for production environments.');
+        return '*';
+    }
+    return env
+        .split(',')
+        .map((o) => o.trim())
+        .filter(Boolean);
+}
+async function createHttpServerInternal(serverAccessor, config, configRouter) {
+    const app = (0, express_1.default)();
+    // Security headers (helmet)
+    app.use((0, helmet_1.default)({
+        contentSecurityPolicy: {
+            directives: {
+                defaultSrc: ["'self'"],
+                scriptSrc: ["'self'"],
+                styleSrc: ["'self'", "'unsafe-inline'"], // For Tailwind CSS
+                imgSrc: ["'self'", 'data:'],
+                connectSrc: ["'self'"],
+            },
+        },
+    }));
+    // Response compression
+    app.use((0, compression_1.default)());
+    // Request timeout for API routes (configurable via REQUEST_TIMEOUT_MS env var)
+    app.use('/api', requestTimeout(getRequestTimeoutMs()));
+    // CORS configuration
+    // CORS_ORIGINS env var: comma-separated list of allowed origins, or "*" for all
+    const corsOrigins = parseCorsOrigins(process.env['CORS_ORIGINS']);
+    app.use((0, cors_1.default)({
+        origin: corsOrigins,
+        methods: ['GET', 'POST', 'DELETE', 'OPTIONS'],
+        allowedHeaders: ['Content-Type', 'Authorization', 'X-API-Key'],
+    }));
+    // JSON body parser with size limit to prevent DoS
+    const jsonLimit = process.env['JSON_BODY_LIMIT'] || DEFAULT_JSON_LIMIT;
+    app.use(express_1.default.json({ limit: jsonLimit }));
+    // Request ID tracking for tracing and debugging
+    app.use((req, res, next) => {
+        const requestId = req.headers['x-request-id'] || (0, node_crypto_1.randomUUID)();
+        res.setHeader('X-Request-ID', requestId);
+        next();
+    });
+    // Request logging (enabled when REQUEST_LOGGING=true)
+    if ((0, index_js_1.isRequestLoggingEnabled)()) {
+        app.use((0, index_js_1.createRequestLogger)());
+    }
+    // Rate limiting (configurable via RATE_LIMIT_* env vars)
+    const rateLimitConfig = (0, index_js_1.getRateLimitConfigFromEnv)();
+    app.use('/api', (0, index_js_1.createRateLimiter)(rateLimitConfig));
+    // API Key authentication (enabled when RAG_API_KEY env var is set)
+    app.use('/api', index_js_1.apiKeyAuth);
+    // Ensure upload directory exists
+    if (!(0, node_fs_1.existsSync)(config.uploadDir)) {
+        await (0, promises_1.mkdir)(config.uploadDir, { recursive: true });
+    }
+    // Configure multer for file uploads
+    const storage = multer_1.default.diskStorage({
+        destination: (_req, _file, cb) => {
+            cb(null, config.uploadDir);
+        },
+        filename: (_req, file, cb) => {
+            // Preserve original filename with timestamp prefix
+            const timestamp = Date.now();
+            const safeName = file.originalname.replace(/[^a-zA-Z0-9.-]/g, '_');
+            cb(null, `${timestamp}-${safeName}`);
+        },
+    });
+    const upload = (0, multer_1.default)({
+        storage,
+        limits: {
+            fileSize: FILE_SIZE_LIMIT_BYTES,
+        },
+        fileFilter: (_req, file, cb) => {
+            // Allow common document types by MIME type or extension
+            const allowedExtensions = ['.pdf', '.docx', '.txt', '.md', '.html', '.json'];
+            const ext = node_path_1.default.extname(file.originalname).toLowerCase();
+            if (ALLOWED_MIME_TYPES.includes(file.mimetype) || allowedExtensions.includes(ext)) {
+                cb(null, true);
+            }
+            else {
+                cb(new Error(`File type not allowed: ${file.mimetype}`));
+            }
+        },
+    });
+    // API routes
+    const apiRouter = (0, api_routes_js_1.createApiRouter)(serverAccessor);
+    // Apply multer middleware to upload endpoint with magic byte validation
+    app.use('/api/v1/files/upload', upload.single('file'), async (req, res, next) => {
+        // Multer adds file to req.file
+        const file = req.file;
+        if (file) {
+            // Validate file content using magic bytes
+            const isValid = await validateFileContent(file.path);
+            if (!isValid) {
+                // Delete the uploaded file
+                const { unlink } = await Promise.resolve().then(() => __importStar(require('node:fs/promises')));
+                try {
+                    await unlink(file.path);
+                }
+                catch {
+                    // Ignore deletion errors
+                }
+                res.status(400).json({
+                    error: 'File content does not match allowed types',
+                    code: 'INVALID_FILE_CONTENT',
+                });
+                return;
+            }
+        }
+        next();
+    });
+    app.use('/api/v1', apiRouter);
+    // Add config routes if provided (must be before error handlers)
+    if (configRouter) {
+        app.use('/api/v1/config', configRouter);
+    }
+    // Serve static files in production
+    if (config.staticDir && (0, node_fs_1.existsSync)(config.staticDir)) {
+        app.use(express_1.default.static(config.staticDir));
+        // SPA fallback - serve index.html for all non-API routes
+        app.get('*', (req, res) => {
+            if (!req.path.startsWith('/api/')) {
+                res.sendFile(node_path_1.default.join(config.staticDir, 'index.html'));
+            }
+        });
+    }
+    // 404 handler for API routes
+    app.use('/api/*', index_js_1.notFoundHandler);
+    // Error handling middleware
+    app.use(index_js_1.errorHandler);
+    return app;
+}
+/**
+ * Start HTTP server
+ */
+function startServer(app, port) {
+    return new Promise((resolve) => {
+        app.listen(port, () => {
+            console.log(`Web server running at http://localhost:${port}`);
+            resolve();
+        });
+    });
+}
+//# sourceMappingURL=http-server.js.map

package/dist/web/http-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-server.js","sourceRoot":"","sources":["../../src/web/http-server.ts"],"names":[],"mappings":";AAAA,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiG/B,kEAeC;AAKD,4CAKC;AAqOD,kCAOC;AApWD,6CAAwC;AACxC,qCAAoC;AACpC,+CAAkD;AAClD,0DAA4B;AAC5B,8DAAqC;AACrC,gDAAuB;AACvB,sDAA+F;AAC/F,yCAA8C;AAC9C,oDAA2B;AAC3B,oDAA2B;AAE3B,mDAAiD;AACjD,yDAAuD;AAEvD,oDAQ8B;AAG9B,+CAA+C;AAC/C,YAAY;AACZ,+CAA+C;AAE/C,uEAAuE;AACvE,MAAM,kBAAkB,GAAG,KAAK,CAAA;AAEhC,iEAAiE;AACjE,MAAM,oBAAoB,GAAG;IAC3B,uBAAuB;IACvB,uBAAuB;IACvB,uBAAuB;IACvB,uBAAuB;CACxB,CAAA;AAED,0CAA0C;AAC1C,MAAM,qBAAqB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAA;AAE/C,2CAA2C;AAC3C,MAAM,0BAA0B,GAAG,KAAM,CAAA;AAEzC,iDAAiD;AACjD,MAAM,sBAAsB,GAAG,IAAK,CAAA;AAEpC;;;GAGG;AACH,SAAS,mBAAmB;IAC1B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;IAClD,IAAI,CAAC,QAAQ;QAAE,OAAO,0BAA0B,CAAA;IAEhD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;IAC5C,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,sBAAsB,EAAE,CAAC;QAC5D,OAAO,CAAC,IAAI,CACV,qCAAqC,QAAQ,oBAAoB,0BAA0B,KAAK,CACjG,CAAA;QACD,OAAO,0BAA0B,CAAA;IACnC,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,qEAAqE;AACrE,MAAM,kBAAkB,GAAG;IACzB,iBAAiB;IACjB,yEAAyE;IACzE,YAAY;IACZ,eAAe;IACf,WAAW;IACX,kBAAkB;CACnB,CAAA;AAiBD;;GAEG;AACI,KAAK,UAAU,2BAA2B,CAC/C,SAA0B,EAC1B,MAAwB;IAExB,yBAAyB;IACzB,MAAM,cAAc,GAAmB,GAAG,EAAE;QAC1C,OAAO,SAAS,CAAC,SAAS,EAAE,CAAA;IAC9B,CAAC,CAAA;IAED,oDAAoD;IACpD,MAAM,YAAY,GAAG,IAAA,qCAAkB,EAAC,SAAS,CAAC,CAAA;IAElD,MAAM,GAAG,GAAG,MAAM,wBAAwB,CAAC,cAAc,EAAE,MAAM,EAAE,YAAY,CAAC,CAAA;IAEhF,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,gBAAgB,CACpC,SAAoB,EACpB,MAAwB;IAExB,OAAO,wBAAwB,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;AAC1D,CAAC;AAED;;GAEG;AACH;;;GAGG;AACH,KAAK,UAAU,mBAAmB,CAAC,QAAgB;IACjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAA,mBAAQ,EAAC,QAAQ,CAAC,CAAA;QACvC,MAAM,IAAI,GAAG,MAAM,IAAA,8BAAkB,EAAC,MAAM,CAAC,CAAA;QAE7C,kDAAkD;QAClD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,uEAAuE;YACvE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YACzD,MAAM,YAAY,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA,CAAC,gBAAgB;YAC9D,OAAO,YAAY,CAAA;QACrB,CAAC;QAED,OAAO,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,SAAiB;IACvC,OAAO,CAAC,IAAa,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAChE,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAChC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,iBAAiB;oBACxB,IAAI,EAAE,iBAAiB;iBACxB,CAAC,CAAA;YACJ,CAAC;QACH,CAAC,EAAE,SAAS,CAAC,CAAA;QAEb,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAA;QAC/C,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAA;QAE9C,IAAI,EAAE,CAAA;IACR,CAAC,CAAA;AACH,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,GAAuB;IAC/C,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,oBAAoB,CAAA;IAC1D,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;QAChB,OAAO,CAAC,IAAI,CACV,sGAAsG,CACvG,CAAA;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IACD,OAAO,GAAG;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAA;AACpB,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,cAA8B,EAC9B,MAAwB,EACxB,YAAoD;IAEpD,MAAM,GAAG,GAAG,IAAA,iBAAO,GAAE,CAAA;IAErB,4BAA4B;IAC5B,GAAG,CAAC,GAAG,CACL,IAAA,gBAAM,EAAC;QACL,qBAAqB,EAAE;YACrB,UAAU,EAAE;gBACV,UAAU,EAAE,CAAC,QAAQ,CAAC;gBACtB,SAAS,EAAE,CAAC,QAAQ,CAAC;gBACrB,QAAQ,EAAE,CAAC,QAAQ,EAAE,iBAAiB,CAAC,EAAE,mBAAmB;gBAC5D,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;gBAC3B,UAAU,EAAE,CAAC,QAAQ,CAAC;aACvB;SACF;KACF,CAAC,CACH,CAAA;IAED,uBAAuB;IACvB,GAAG,CAAC,GAAG,CAAC,IAAA,qBAAW,GAAE,CAAC,CAAA;IAEtB,+EAA+E;IAC/E,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAA;IAEtD,qBAAqB;IACrB,gFAAgF;IAChF,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAA;IAEjE,GAAG,CAAC,GAAG,CACL,IAAA,cAAI,EAAC;QACH,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC;QAC7C,cAAc,EAAE,CAAC,cAAc,EAAE,eAAe,EAAE,WAAW,CAAC;KAC/D,CAAC,CACH,CAAA;IAED,kDAAkD;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,kBAAkB,CAAA;IACtE,GAAG,CAAC,GAAG,CAAC,iBAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA;IAE3C,gDAAgD;IAChD,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,SAAS,GAAI,GAAG,CAAC,OAAO,CAAC,cAAc,CAAY,IAAI,IAAA,wBAAU,GAAE,CAAA;QACzE,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,CAAC,CAAA;QACxC,IAAI,EAAE,CAAA;IACR,CAAC,CAAC,CAAA;IAEF,sDAAsD;IACtD,IAAI,IAAA,kCAAuB,GAAE,EAAE,CAAC;QAC9B,GAAG,CAAC,GAAG,CAAC,IAAA,8BAAmB,GAAE,CAAC,CAAA;IAChC,CAAC;IAED,yDAAyD;IACzD,MAAM,eAAe,GAAG,IAAA,oCAAyB,GAAE,CAAA;IACnD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAA,4BAAiB,EAAC,eAAe,CAAC,CAAC,CAAA;IAEnD,mEAAmE;IACnE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,qBAAU,CAAC,CAAA;IAE3B,iCAAiC;IACjC,IAAI,CAAC,IAAA,oBAAU,EAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,MAAM,IAAA,gBAAK,EAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACpD,CAAC;IAED,oCAAoC;IACpC,MAAM,OAAO,GAAG,gBAAM,CAAC,WAAW,CAAC;QACjC,WAAW,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YAC/B,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;QAC5B,CAAC;QACD,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;YAC3B,mDAAmD;YACnD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAA;YAClE,EAAE,CAAC,IAAI,EAAE,GAAG,SAAS,IAAI,QAAQ,EAAE,CAAC,CAAA;QACtC,CAAC;KACF,CAAC,CAAA;IAEF,MAAM,MAAM,GAAG,IAAA,gBAAM,EAAC;QACpB,OAAO;QACP,MAAM,EAAE;YACN,QAAQ,EAAE,qBAAqB;SAChC;QACD,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;YAC7B,wDAAwD;YACxD,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;YAE5E,MAAM,GAAG,GAAG,mBAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAA;YACzD,IAAI,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClF,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YAChB,CAAC;iBAAM,CAAC;gBACN,EAAE,CAAC,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;YAC1D,CAAC;QACH,CAAC;KACF,CAAC,CAAA;IAEF,aAAa;IACb,MAAM,SAAS,GAAG,IAAA,+BAAe,EAAC,cAAc,CAAC,CAAA;IAEjD,wEAAwE;IACxE,GAAG,CAAC,GAAG,CACL,sBAAsB,EACtB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EACrB,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACxD,+BAA+B;QAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;QACrB,IAAI,IAAI,EAAE,CAAC;YACT,0CAA0C;YAC1C,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACpD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,2BAA2B;gBAC3B,MAAM,EAAE,MAAM,EAAE,GAAG,wDAAa,kBAAkB,GAAC,CAAA;gBACnD,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBACzB,CAAC;gBAAC,MAAM,CAAC;oBACP,yBAAyB;gBAC3B,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,2CAA2C;oBAClD,IAAI,EAAE,sBAAsB;iBAC7B,CAAC,CAAA;gBACF,OAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,EAAE,CAAA;IACR,CAAC,CACF,CAAA;IAED,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;IAE7B,gEAAgE;IAChE,IAAI,YAAY,EAAE,CAAC;QACjB,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAA;IACzC,CAAC;IAED,mCAAmC;IACnC,IAAI,MAAM,CAAC,SAAS,IAAI,IAAA,oBAAU,EAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,GAAG,CAAC,iBAAO,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;QAEzC,yDAAyD;QACzD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACxB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,GAAG,CAAC,QAAQ,CAAC,mBAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAmB,EAAE,YAAY,CAAC,CAAC,CAAA;YACnE,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,6BAA6B;IAC7B,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,0BAAe,CAAC,CAAA;IAElC,4BAA4B;IAC5B,GAAG,CAAC,GAAG,CAAC,uBAAY,CAAC,CAAA;IAErB,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;GAEG;AACH,SAAgB,WAAW,CAAC,GAAY,EAAE,IAAY;IACpD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;YACpB,OAAO,CAAC,GAAG,CAAC,0CAA0C,IAAI,EAAE,CAAC,CAAA;YAC7D,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/web/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/web/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/web/index.ts"],"names":[],"mappings":""}

package/dist/web/index.js

@@ -0,0 +1,114 @@
+#!/usr/bin/env node
+"use strict";
+// Entry point for RAG Web Server
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_fs_1 = require("node:fs");
+const node_path_1 = __importDefault(require("node:path"));
+const config_js_1 = require("../utils/config.js");
+const process_handlers_js_1 = require("../utils/process-handlers.js");
+const index_js_1 = require("./middleware/index.js");
+// Setup global error handlers
+(0, process_handlers_js_1.setupProcessHandlers)();
+// Setup graceful shutdown
+(0, process_handlers_js_1.setupGracefulShutdown)();
+// Register rate limiter cleanup for graceful shutdown
+(0, process_handlers_js_1.onShutdown)(() => {
+    console.error('Cleaning up rate limiter...');
+    (0, index_js_1.stopRateLimiterCleanup)();
+});
+/**
+ * Entry point - Start RAG Web Server
+ */
+async function main() {
+    try {
+        // Dynamic imports to avoid loading heavy modules at CLI parse time
+        const { RAGServer } = await Promise.resolve().then(() => __importStar(require('../server/index.js')));
+        const { createHttpServerWithManager, startServer } = await Promise.resolve().then(() => __importStar(require('./http-server.js')));
+        const { DatabaseManager } = await Promise.resolve().then(() => __importStar(require('./database-manager.js')));
+        // Configuration from environment
+        const port = Number.parseInt(process.env['WEB_PORT'] || '3000', 10);
+        const uploadDir = process.env['UPLOAD_DIR'] || './uploads/';
+        // Determine static files directory
+        // Check relative to cwd for development and relative to dist for production
+        let staticDir;
+        const cwd = process.cwd();
+        const devStaticPath = node_path_1.default.resolve(cwd, 'web-ui/dist');
+        const prodStaticPath = node_path_1.default.resolve(cwd, 'dist/web-ui');
+        // Check which exists
+        if ((0, node_fs_1.existsSync)(devStaticPath)) {
+            staticDir = devStaticPath;
+        }
+        else if ((0, node_fs_1.existsSync)(prodStaticPath)) {
+            staticDir = prodStaticPath;
+        }
+        // Build RAG config from environment
+        const config = (0, config_js_1.buildRAGConfig)();
+        console.log('Starting RAG Web Server...');
+        console.log('Configuration:', { ...config, port, uploadDir, staticDir });
+        // Create DatabaseManager with server factory
+        const { dbPath, ...baseConfig } = config;
+        const dbManager = new DatabaseManager((cfg) => new RAGServer(cfg), baseConfig);
+        // Initialize with the configured database
+        await dbManager.initialize(dbPath);
+        // Create and start HTTP server with DatabaseManager
+        const httpConfig = {
+            port,
+            uploadDir,
+        };
+        if (staticDir !== undefined) {
+            httpConfig.staticDir = staticDir;
+        }
+        const app = await createHttpServerWithManager(dbManager, httpConfig);
+        await startServer(app, port);
+        console.log('RAG Web Server started successfully');
+        if (staticDir) {
+            console.log(`Serving UI from: ${staticDir}`);
+        }
+        else {
+            console.log('No UI build found. Run "pnpm ui:build" to build the frontend.');
+        }
+    }
+    catch (error) {
+        console.error('Failed to start RAG Web Server:', error);
+        process.exit(1);
+    }
+}
+// Execute main
+main();
+//# sourceMappingURL=index.js.map

package/dist/web/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/web/index.ts"],"names":[],"mappings":";;AACA,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEjC,qCAAoC;AACpC,0DAA4B;AAC5B,kDAAmD;AACnD,sEAIqC;AACrC,oDAA8D;AAE9D,8BAA8B;AAC9B,IAAA,0CAAoB,GAAE,CAAA;AAEtB,0BAA0B;AAC1B,IAAA,2CAAqB,GAAE,CAAA;AAEvB,sDAAsD;AACtD,IAAA,gCAAU,EAAC,GAAG,EAAE;IACd,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAA;IAC5C,IAAA,iCAAsB,GAAE,CAAA;AAC1B,CAAC,CAAC,CAAA;AAEF;;GAEG;AACH,KAAK,UAAU,IAAI;IACjB,IAAI,CAAC;QACH,mEAAmE;QACnE,MAAM,EAAE,SAAS,EAAE,GAAG,wDAAa,oBAAoB,GAAC,CAAA;QACxD,MAAM,EAAE,2BAA2B,EAAE,WAAW,EAAE,GAAG,wDAAa,kBAAkB,GAAC,CAAA;QACrF,MAAM,EAAE,eAAe,EAAE,GAAG,wDAAa,uBAAuB,GAAC,CAAA;QAEjE,iCAAiC;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,MAAM,EAAE,EAAE,CAAC,CAAA;QACnE,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,YAAY,CAAA;QAE3D,mCAAmC;QACnC,4EAA4E;QAC5E,IAAI,SAA6B,CAAA;QACjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;QACzB,MAAM,aAAa,GAAG,mBAAI,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;QACtD,MAAM,cAAc,GAAG,mBAAI,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;QAEvD,qBAAqB;QACrB,IAAI,IAAA,oBAAU,EAAC,aAAa,CAAC,EAAE,CAAC;YAC9B,SAAS,GAAG,aAAa,CAAA;QAC3B,CAAC;aAAM,IAAI,IAAA,oBAAU,EAAC,cAAc,CAAC,EAAE,CAAC;YACtC,SAAS,GAAG,cAAc,CAAA;QAC5B,CAAC;QAED,oCAAoC;QACpC,MAAM,MAAM,GAAG,IAAA,0BAAc,GAAE,CAAA;QAE/B,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAA;QACzC,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAA;QAExE,6CAA6C;QAC7C,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,EAAE,GAAG,MAAM,CAAA;QACxC,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,CAAA;QAE9E,0CAA0C;QAC1C,MAAM,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QAElC,oDAAoD;QACpD,MAAM,UAAU,GAAsD;YACpE,IAAI;YACJ,SAAS;SACV,CAAA;QACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,UAAU,CAAC,SAAS,GAAG,SAAS,CAAA;QAClC,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,2BAA2B,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;QAEpE,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAE5B,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAA;QAClD,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,oBAAoB,SAAS,EAAE,CAAC,CAAA;QAC9C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAA;QAC9E,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAA;QACvD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;AACH,CAAC;AAED,eAAe;AACf,IAAI,EAAE,CAAA"}

package/dist/web/middleware/async-handler.d.ts

@@ -0,0 +1,17 @@
+import type { NextFunction, Request, Response } from 'express';
+/**
+ * Async request handler type
+ */
+export type AsyncHandler = (req: Request, res: Response, next: NextFunction) => Promise<void>;
+/**
+ * Wraps an async route handler to automatically catch errors
+ * and pass them to Express error middleware
+ *
+ * @example
+ * router.post('/search', asyncHandler(async (req, res) => {
+ *   const results = await search(req.body.query)
+ *   res.json({ results })
+ * }))
+ */
+export declare function asyncHandler(handler: AsyncHandler): AsyncHandler;
+//# sourceMappingURL=async-handler.d.ts.map

package/dist/web/middleware/async-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"async-handler.d.ts","sourceRoot":"","sources":["../../../src/web/middleware/async-handler.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAE9D;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAE7F;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,YAAY,CAQhE"}

package/dist/web/middleware/async-handler.js

@@ -0,0 +1,26 @@
+"use strict";
+// Express async handler wrapper
+// Eliminates try/catch boilerplate in route handlers
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.asyncHandler = asyncHandler;
+/**
+ * Wraps an async route handler to automatically catch errors
+ * and pass them to Express error middleware
+ *
+ * @example
+ * router.post('/search', asyncHandler(async (req, res) => {
+ *   const results = await search(req.body.query)
+ *   res.json({ results })
+ * }))
+ */
+function asyncHandler(handler) {
+    return async (req, res, next) => {
+        try {
+            await handler(req, res, next);
+        }
+        catch (error) {
+            next(error);
+        }
+    };
+}
+//# sourceMappingURL=async-handler.js.map

package/dist/web/middleware/async-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"async-handler.js","sourceRoot":"","sources":["../../../src/web/middleware/async-handler.ts"],"names":[],"mappings":";AAAA,gCAAgC;AAChC,qDAAqD;;AAmBrD,oCAQC;AAlBD;;;;;;;;;GASG;AACH,SAAgB,YAAY,CAAC,OAAqB;IAChD,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;QAC9E,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAA;QACb,CAAC;IACH,CAAC,CAAA;AACH,CAAC"}

package/dist/web/middleware/auth.d.ts

@@ -0,0 +1,22 @@
+import type { NextFunction, Request, Response } from 'express';
+/**
+ * API Key authentication middleware
+ *
+ * Validates requests against RAG_API_KEY environment variable.
+ * If RAG_API_KEY is not set, authentication is disabled (local-only mode).
+ *
+ * Accepts API key via:
+ * - Authorization header: "Bearer <key>" or "ApiKey <key>"
+ * - X-API-Key header
+ *
+ * @example
+ * // Enable by setting environment variable
+ * RAG_API_KEY=your-secret-key npm start
+ *
+ * // Client usage
+ * fetch('/api/v1/search', {
+ *   headers: { 'Authorization': 'Bearer your-secret-key' }
+ * })
+ */
+export declare function apiKeyAuth(req: Request, res: Response, next: NextFunction): void;
+//# sourceMappingURL=auth.d.ts.map

package/dist/web/middleware/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/web/middleware/auth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAE9D;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAoChF"}

package/dist/web/middleware/auth.js

@@ -0,0 +1,81 @@
+"use strict";
+// API Key authentication middleware
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.apiKeyAuth = apiKeyAuth;
+const node_crypto_1 = require("node:crypto");
+/**
+ * API Key authentication middleware
+ *
+ * Validates requests against RAG_API_KEY environment variable.
+ * If RAG_API_KEY is not set, authentication is disabled (local-only mode).
+ *
+ * Accepts API key via:
+ * - Authorization header: "Bearer <key>" or "ApiKey <key>"
+ * - X-API-Key header
+ *
+ * @example
+ * // Enable by setting environment variable
+ * RAG_API_KEY=your-secret-key npm start
+ *
+ * // Client usage
+ * fetch('/api/v1/search', {
+ *   headers: { 'Authorization': 'Bearer your-secret-key' }
+ * })
+ */
+function apiKeyAuth(req, res, next) {
+    const configuredKey = process.env['RAG_API_KEY'];
+    // If no API key configured, skip authentication (local-only mode)
+    if (!configuredKey) {
+        next();
+        return;
+    }
+    // Extract API key from request
+    const authHeader = req.headers['authorization'];
+    const xApiKey = req.headers['x-api-key'];
+    let providedKey;
+    if (authHeader) {
+        // Support "Bearer <key>" and "ApiKey <key>" formats
+        const match = authHeader.match(/^(?:Bearer|ApiKey)\s+(.+)$/i);
+        if (match?.[1]) {
+            providedKey = match[1];
+        }
+    }
+    else if (typeof xApiKey === 'string') {
+        providedKey = xApiKey;
+    }
+    // Validate API key using timing-safe comparison
+    if (!providedKey || !safeCompare(providedKey, configuredKey)) {
+        res.status(401).json({
+            error: 'Unauthorized',
+            code: 'AUTH_REQUIRED',
+            message: 'Valid API key required. Set RAG_API_KEY environment variable.',
+        });
+        return;
+    }
+    next();
+}
+/**
+ * Timing-safe string comparison to prevent timing attacks
+ *
+ * Uses Node.js crypto.timingSafeEqual with padding to prevent length leaks.
+ * Both strings are padded to the same length before comparison.
+ * Length comparison is computed BEFORE timing-safe comparison to prevent
+ * timing leaks from short-circuit evaluation.
+ */
+function safeCompare(a, b) {
+    const bufA = Buffer.from(a);
+    const bufB = Buffer.from(b);
+    // Compute length match FIRST (constant time for number comparison)
+    // This prevents timing leaks from short-circuit evaluation
+    const lengthsMatch = bufA.length === bufB.length;
+    // Pad to same length to prevent length timing leak in content comparison
+    const maxLen = Math.max(bufA.length, bufB.length);
+    const padA = Buffer.alloc(maxLen);
+    const padB = Buffer.alloc(maxLen);
+    bufA.copy(padA);
+    bufB.copy(padB);
+    // Use Node.js timing-safe comparison and verify original lengths match
+    // lengthsMatch is already computed, so no timing leak from && evaluation
+    return (0, node_crypto_1.timingSafeEqual)(padA, padB) && lengthsMatch;
+}
+//# sourceMappingURL=auth.js.map

package/dist/web/middleware/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/web/middleware/auth.ts"],"names":[],"mappings":";AAAA,oCAAoC;;AAwBpC,gCAoCC;AA1DD,6CAA6C;AAG7C;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,UAAU,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACxE,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IAEhD,kEAAkE;IAClE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,IAAI,EAAE,CAAA;QACN,OAAM;IACR,CAAC;IAED,+BAA+B;IAC/B,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;IAC/C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IAExC,IAAI,WAA+B,CAAA;IAEnC,IAAI,UAAU,EAAE,CAAC;QACf,oDAAoD;QACpD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAA;QAC7D,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACf,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACxB,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACvC,WAAW,GAAG,OAAO,CAAA;IACvB,CAAC;IAED,gDAAgD;IAChD,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,cAAc;YACrB,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,+DAA+D;SACzE,CAAC,CAAA;QACF,OAAM;IACR,CAAC;IAED,IAAI,EAAE,CAAA;AACR,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAE3B,mEAAmE;IACnE,2DAA2D;IAC3D,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAA;IAEhD,yEAAyE;IACzE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IACjD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACjC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACjC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACf,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEf,uEAAuE;IACvE,yEAAyE;IACzE,OAAO,IAAA,6BAAe,EAAC,IAAI,EAAE,IAAI,CAAC,IAAI,YAAY,CAAA;AACpD,CAAC"}

package/dist/web/middleware/error-handler.d.ts

@@ -0,0 +1,36 @@
+import type { NextFunction, Request, Response } from 'express';
+/**
+ * HTTP status codes for API responses
+ */
+export declare enum HttpStatus {
+    OK = 200,
+    CREATED = 201,
+    NO_CONTENT = 204,
+    BAD_REQUEST = 400,
+    UNAUTHORIZED = 401,
+    FORBIDDEN = 403,
+    NOT_FOUND = 404,
+    CONFLICT = 409,
+    TOO_MANY_REQUESTS = 429,
+    INTERNAL_ERROR = 500,
+    SERVICE_UNAVAILABLE = 503
+}
+/**
+ * Express error handling middleware
+ *
+ * Handles:
+ * - RAGError subclasses (with proper status codes)
+ * - Generic errors (500 Internal Server Error)
+ *
+ * In production, hides stack traces and internal details.
+ *
+ * @example
+ * // Add as the last middleware
+ * app.use(errorHandler)
+ */
+export declare function errorHandler(err: Error, _req: Request, res: Response, _next: NextFunction): void;
+/**
+ * 404 Not Found handler
+ */
+export declare function notFoundHandler(_req: Request, res: Response): void;
+//# sourceMappingURL=error-handler.d.ts.map

package/dist/web/middleware/error-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-handler.d.ts","sourceRoot":"","sources":["../../../src/web/middleware/error-handler.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAG9D;;GAEG;AACH,oBAAY,UAAU;IACpB,EAAE,MAAM;IACR,OAAO,MAAM;IACb,UAAU,MAAM;IAChB,WAAW,MAAM;IACjB,YAAY,MAAM;IAClB,SAAS,MAAM;IACf,SAAS,MAAM;IACf,QAAQ,MAAM;IACd,iBAAiB,MAAM;IACvB,cAAc,MAAM;IACpB,mBAAmB,MAAM;CAC1B;AAWD;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,GAAG,IAAI,CA2BhG;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,IAAI,CAElE"}