@selvajs/server 0.2.0-beta.1 → 0.2.0-beta.3

package/dist/errors/SentryErrorReporter.js

@@ -0,0 +1,60 @@
+export class SentryErrorReporter {
+    sentry;
+    constructor(sentry) {
+        this.sentry = sentry;
+    }
+    /**
+     * Initialize Sentry and return a reporter, or `null` if `@sentry/node` is
+     * not installed (optional dependency absent). Never throws — a broken
+     * error-tracker must not take down boot.
+     */
+    static async create(opts) {
+        try {
+            // Dynamic so the package stays optional. `@vite-ignore` keeps the
+            // bundler from trying to resolve it at build time when it's absent.
+            // `@ts-ignore` (not `@ts-expect-error`) because whether the module
+            // resolves at type-check time depends on the environment — it's a real
+            // dep in some installs, absent in others — so we can't assert the error
+            // is always present. The `as unknown as` cast narrows whatever loads to
+            // the two calls we use.
+            // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+            // @ts-ignore -- optional dependency, may be absent at type-check time
+            const sentry = (await import(/* @vite-ignore */ '@sentry/node'));
+            sentry.init({
+                dsn: opts.dsn,
+                environment: opts.environment,
+                release: opts.release,
+                // Error tracking only — no performance tracing by default. Flip
+                // this up later if you want transactions/spans.
+                tracesSampleRate: 0
+            });
+            return new SentryErrorReporter(sentry);
+        }
+        catch (err) {
+            console.error('[ErrorReporter] A Sentry DSN is set but @sentry/node could not be loaded. ' +
+                'Install it (`pnpm add @sentry/node`) or unset the DSN. Falling back to no-op.', err);
+            return null;
+        }
+    }
+    capture(error, context) {
+        try {
+            const tags = { ...context?.tags };
+            if (context?.method)
+                tags.method = context.method;
+            if (context?.route)
+                tags.route = context.route;
+            if (context?.orgId)
+                tags.orgId = context.orgId;
+            this.sentry.captureException(error, {
+                tags,
+                user: context?.userId ? { id: context.userId } : undefined
+            });
+        }
+        catch (err) {
+            // Reporting is best-effort and sits on the error path — a second
+            // failure here would mask the first. Swallow after logging.
+            console.error('[ErrorReporter] Failed to capture error:', err);
+        }
+    }
+}
+//# sourceMappingURL=SentryErrorReporter.js.map

package/dist/errors/SentryErrorReporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SentryErrorReporter.js","sourceRoot":"","sources":["../../src/errors/SentryErrorReporter.ts"],"names":[],"mappings":"AA4BA,MAAM,OAAO,mBAAmB;IACM;IAArC,YAAqC,MAAkB;QAAlB,WAAM,GAAN,MAAM,CAAY;IAAG,CAAC;IAE3D;;;;OAIG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAInB;QACA,IAAI,CAAC;YACJ,kEAAkE;YAClE,oEAAoE;YACpE,mEAAmE;YACnE,uEAAuE;YACvE,wEAAwE;YACxE,wEAAwE;YACxE,wBAAwB;YACxB,6DAA6D;YAC7D,sEAAsE;YACtE,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAA0B,CAAC;YAC1F,MAAM,CAAC,IAAI,CAAC;gBACX,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,gEAAgE;gBAChE,gDAAgD;gBAChD,gBAAgB,EAAE,CAAC;aACnB,CAAC,CAAC;YACH,OAAO,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CACZ,4EAA4E;gBAC3E,+EAA+E,EAChF,GAAG,CACH,CAAC;YACF,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAED,OAAO,CAAC,KAAc,EAAE,OAAsB;QAC7C,IAAI,CAAC;YACJ,MAAM,IAAI,GAA2B,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,CAAC;YAC1D,IAAI,OAAO,EAAE,MAAM;gBAAE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAClD,IAAI,OAAO,EAAE,KAAK;gBAAE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;YAC/C,IAAI,OAAO,EAAE,KAAK;gBAAE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE;gBACnC,IAAI;gBACJ,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS;aAC1D,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,iEAAiE;YACjE,4DAA4D;YAC5D,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;IACF,CAAC;CACD"}

package/dist/errors/index.d.ts

@@ -0,0 +1,2 @@
+export { SentryErrorReporter } from './SentryErrorReporter.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/errors/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/errors/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/errors/index.js

@@ -0,0 +1,3 @@
+// Error reporting — Sentry-backed IErrorReporter (optional @sentry/node peer).
+export { SentryErrorReporter } from './SentryErrorReporter.js';
+//# sourceMappingURL=index.js.map

package/dist/errors/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/errors/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAE/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/http/__tests__/body-size.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=body-size.test.d.ts.map

package/dist/http/__tests__/body-size.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-size.test.d.ts","sourceRoot":"","sources":["../../../src/http/__tests__/body-size.test.ts"],"names":[],"mappings":""}

package/dist/http/__tests__/body-size.test.js

@@ -0,0 +1,24 @@
+import { describe, it, expect } from 'vitest';
+import { declaredBodySizeExceeds } from '../body-size.js';
+function headersWith(contentLength) {
+    const h = new Headers();
+    if (contentLength !== undefined)
+        h.set('content-length', contentLength);
+    return h;
+}
+describe('declaredBodySizeExceeds', () => {
+    it('flags a declared size over the limit', () => {
+        expect(declaredBodySizeExceeds(headersWith('1001'), 1000)).toBe(true);
+    });
+    it('passes a declared size at or under the limit', () => {
+        expect(declaredBodySizeExceeds(headersWith('1000'), 1000)).toBe(false);
+        expect(declaredBodySizeExceeds(headersWith('0'), 1000)).toBe(false);
+    });
+    it('passes when Content-Length is absent (chunked transfer — global limit is the backstop)', () => {
+        expect(declaredBodySizeExceeds(headersWith(), 1000)).toBe(false);
+    });
+    it('passes a non-numeric Content-Length rather than throwing', () => {
+        expect(declaredBodySizeExceeds(headersWith('not-a-number'), 1000)).toBe(false);
+    });
+});
+//# sourceMappingURL=body-size.test.js.map

package/dist/http/__tests__/body-size.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-size.test.js","sourceRoot":"","sources":["../../../src/http/__tests__/body-size.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,SAAS,WAAW,CAAC,aAAsB;IAC1C,MAAM,CAAC,GAAG,IAAI,OAAO,EAAE,CAAC;IACxB,IAAI,aAAa,KAAK,SAAS;QAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;IACxE,OAAO,CAAC,CAAC;AACV,CAAC;AAED,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,uBAAuB,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,uBAAuB,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,CAAC,uBAAuB,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wFAAwF,EAAE,GAAG,EAAE;QACjG,MAAM,CAAC,uBAAuB,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,uBAAuB,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/http/__tests__/route-classifier.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=route-classifier.test.d.ts.map

package/dist/http/__tests__/route-classifier.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-classifier.test.d.ts","sourceRoot":"","sources":["../../../src/http/__tests__/route-classifier.test.ts"],"names":[],"mappings":""}

package/dist/http/__tests__/route-classifier.test.js

@@ -0,0 +1,54 @@
+import { describe, it, expect } from 'vitest';
+import { createRouteClassifier } from '../route-classifier.js';
+// Generic values — the consuming app's actual route policy is pinned by its
+// own test suite; these cover the classifier mechanics.
+const classifier = createRouteClassifier({
+    publicPages: ['/', '/login'],
+    publicPrefixes: ['/auth/', '/logout'],
+    publicApis: ['/api/health'],
+    selfGatingPrefix: '/api/files/',
+    staticPrefixes: ['/_app/', '/favicon/'],
+    staticPaths: ['/favicon.svg', '/robots.txt']
+});
+describe('createRouteClassifier', () => {
+    it('classifies exact pages, API allowlist, prefixes, and self-gating as public', () => {
+        for (const path of [
+            '/',
+            '/login',
+            '/api/health',
+            '/auth/oauth/callback',
+            '/logout',
+            '/api/files/orgs/abc/logo.webp'
+        ]) {
+            expect(classifier.isPublicRoute(path)).toBe(true);
+        }
+    });
+    it('denies by default — unknown routes are gated', () => {
+        for (const path of ['/library', '/api/projects', '/billing', '/whatever']) {
+            expect(classifier.isPublicRoute(path)).toBe(false);
+        }
+    });
+    it('exact-match pages do not admit siblings via prefix', () => {
+        expect(classifier.isPublicRoute('/login-other')).toBe(false);
+        expect(classifier.isPublicRoute('/api/healthz')).toBe(false);
+    });
+    it('self-gating prefix is not a loose match', () => {
+        expect(classifier.isSelfGatingApiRoute('/api/files/x')).toBe(true);
+        expect(classifier.isSelfGatingApiRoute('/api/filesX/y')).toBe(false);
+        expect(classifier.isSelfGatingApiRoute('/api/projects')).toBe(false);
+    });
+    it('recognizes static assets by prefix and exact path', () => {
+        expect(classifier.isStaticAsset('/_app/immutable/x.js')).toBe(true);
+        expect(classifier.isStaticAsset('/favicon/16.png')).toBe(true);
+        expect(classifier.isStaticAsset('/robots.txt')).toBe(true);
+        expect(classifier.isStaticAsset('/favicon-other.png')).toBe(false);
+        expect(classifier.isStaticAsset('/login')).toBe(false);
+    });
+    it('every allowlist is optional — an empty config gates everything', () => {
+        const closed = createRouteClassifier({});
+        expect(closed.isPublicRoute('/')).toBe(false);
+        expect(closed.isStaticAsset('/robots.txt')).toBe(false);
+        expect(closed.isSelfGatingApiRoute('/api/files/x')).toBe(false);
+    });
+});
+//# sourceMappingURL=route-classifier.test.js.map

package/dist/http/__tests__/route-classifier.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-classifier.test.js","sourceRoot":"","sources":["../../../src/http/__tests__/route-classifier.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,4EAA4E;AAC5E,wDAAwD;AACxD,MAAM,UAAU,GAAG,qBAAqB,CAAC;IACxC,WAAW,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC;IAC5B,cAAc,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;IACrC,UAAU,EAAE,CAAC,aAAa,CAAC;IAC3B,gBAAgB,EAAE,aAAa;IAC/B,cAAc,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC;IACvC,WAAW,EAAE,CAAC,cAAc,EAAE,aAAa,CAAC;CAC5C,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACrF,KAAK,MAAM,IAAI,IAAI;YAClB,GAAG;YACH,QAAQ;YACR,aAAa;YACb,sBAAsB;YACtB,SAAS;YACT,+BAA+B;SAC/B,EAAE,CAAC;YACH,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACvD,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC;YAC3E,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,UAAU,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,CAAC,UAAU,CAAC,oBAAoB,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrE,MAAM,CAAC,UAAU,CAAC,oBAAoB,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpE,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/D,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnE,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACzE,MAAM,MAAM,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/http/__tests__/safe-redirect.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=safe-redirect.test.d.ts.map

package/dist/http/__tests__/safe-redirect.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-redirect.test.d.ts","sourceRoot":"","sources":["../../../src/http/__tests__/safe-redirect.test.ts"],"names":[],"mappings":""}

package/dist/http/__tests__/safe-redirect.test.js

@@ -0,0 +1,44 @@
+import { describe, it, expect } from 'vitest';
+import { safeRedirectTarget } from '../redirect.js';
+/**
+ * `safeRedirectTarget` is the post-login redirect validator. The point of
+ * the function is to reject *exactly* the values that would otherwise
+ * smuggle an external host into a `redirect(303, …)` call:
+ * protocol-relative URLs (`//evil.com`) and back-slash variants some
+ * browsers normalize as a path separator. Each row below is one such case.
+ */
+describe('safeRedirectTarget', () => {
+    it.each([
+        ['/foo', '/foo'],
+        ['/foo/bar', '/foo/bar'],
+        ['/foo?x=1', '/foo?x=1'],
+        ['/foo#frag', '/foo#frag'],
+        ['/a', '/a'] // shortest valid path: `/` + non-`/` char
+    ])('accepts same-origin path %j → %j', (input, expected) => {
+        expect(safeRedirectTarget(input, '/fallback')).toBe(expected);
+    });
+    it.each([
+        ['//evil.com', 'protocol-relative URL'],
+        ['//evil.com/path', 'protocol-relative URL with path'],
+        ['/\\evil.com', 'back-slash bypass'],
+        ['https://evil.com', 'absolute URL'],
+        ['http://evil.com', 'absolute URL'],
+        ['javascript:alert(1)', 'javascript: scheme'],
+        ['', 'empty string'],
+        ['/', 'lone slash (length<2)'],
+        ['evil.com', 'no leading slash'],
+        ['./relative', 'relative path']
+    ])('rejects %j (%s)', (input) => {
+        expect(safeRedirectTarget(input, '/fallback')).toBe('/fallback');
+    });
+    it.each([null, undefined])('rejects %j', (input) => {
+        expect(safeRedirectTarget(input, '/fallback')).toBe('/fallback');
+    });
+    it('passes through arbitrary non-string types as fallback', () => {
+        // safeRedirectTarget's signature is `string | null | undefined`, but
+        // some call sites get `unknown` from FormData — make sure we don't
+        // throw on a stray non-string.
+        expect(safeRedirectTarget(42, '/fallback')).toBe('/fallback');
+    });
+});
+//# sourceMappingURL=safe-redirect.test.js.map

package/dist/http/__tests__/safe-redirect.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-redirect.test.js","sourceRoot":"","sources":["../../../src/http/__tests__/safe-redirect.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD;;;;;;GAMG;AACH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,IAAI,CAAC;QACP,CAAC,MAAM,EAAE,MAAM,CAAC;QAChB,CAAC,UAAU,EAAE,UAAU,CAAC;QACxB,CAAC,UAAU,EAAE,UAAU,CAAC;QACxB,CAAC,WAAW,EAAE,WAAW,CAAC;QAC1B,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,0CAA0C;KACvD,CAAC,CAAC,kCAAkC,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;QAC1D,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACP,CAAC,YAAY,EAAE,uBAAuB,CAAC;QACvC,CAAC,iBAAiB,EAAE,iCAAiC,CAAC;QACtD,CAAC,aAAa,EAAE,mBAAmB,CAAC;QACpC,CAAC,kBAAkB,EAAE,cAAc,CAAC;QACpC,CAAC,iBAAiB,EAAE,cAAc,CAAC;QACnC,CAAC,qBAAqB,EAAE,oBAAoB,CAAC;QAC7C,CAAC,EAAE,EAAE,cAAc,CAAC;QACpB,CAAC,GAAG,EAAE,uBAAuB,CAAC;QAC9B,CAAC,UAAU,EAAE,kBAAkB,CAAC;QAChC,CAAC,YAAY,EAAE,eAAe,CAAC;KAC/B,CAAC,CAAC,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE;QAC/B,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE;QAClD,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAChE,qEAAqE;QACrE,mEAAmE;QACnE,+BAA+B;QAC/B,MAAM,CAAC,kBAAkB,CAAC,EAAuB,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/http/__tests__/security-headers.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=security-headers.test.d.ts.map

package/dist/http/__tests__/security-headers.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-headers.test.d.ts","sourceRoot":"","sources":["../../../src/http/__tests__/security-headers.test.ts"],"names":[],"mappings":""}

package/dist/http/__tests__/security-headers.test.js

@@ -0,0 +1,24 @@
+import { describe, it, expect } from 'vitest';
+import { applySecurityHeaders } from '../security-headers.js';
+describe('applySecurityHeaders', () => {
+    it('sets the baseline hardening headers and returns the same response', () => {
+        const response = new Response('ok');
+        const out = applySecurityHeaders(response, { hsts: false });
+        expect(out).toBe(response);
+        expect(out.headers.get('X-Content-Type-Options')).toBe('nosniff');
+        expect(out.headers.get('Referrer-Policy')).toBe('strict-origin-when-cross-origin');
+        expect(out.headers.get('Permissions-Policy')).toContain('camera=()');
+    });
+    it('sets HSTS only when asked (production)', () => {
+        const dev = applySecurityHeaders(new Response('ok'), { hsts: false });
+        expect(dev.headers.get('Strict-Transport-Security')).toBeNull();
+        const prod = applySecurityHeaders(new Response('ok'), { hsts: true });
+        expect(prod.headers.get('Strict-Transport-Security')).toBe('max-age=31536000; includeSubDomains');
+    });
+    it('never sets CSP or frame headers (iframe embedding is a product requirement)', () => {
+        const out = applySecurityHeaders(new Response('ok'), { hsts: true });
+        expect(out.headers.get('Content-Security-Policy')).toBeNull();
+        expect(out.headers.get('X-Frame-Options')).toBeNull();
+    });
+});
+//# sourceMappingURL=security-headers.test.js.map

package/dist/http/__tests__/security-headers.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-headers.test.js","sourceRoot":"","sources":["../../../src/http/__tests__/security-headers.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE9D,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC5E,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,oBAAoB,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACnF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QACjD,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAEhE,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC,IAAI,CACzD,qCAAqC,CACrC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACtF,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9D,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvD,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/http/body-size.d.ts

@@ -0,0 +1,21 @@
+/** Minimal read-side view of a request's headers — `Headers` satisfies it. */
+export interface HeadersLike {
+    get(name: string): string | null;
+}
+/**
+ * True when the request's declared `Content-Length` exceeds `maxBytes`.
+ * Check BEFORE the body is read so a malicious client can't burn memory by
+ * sending a huge payload to a small-body endpoint; the route maps a `true`
+ * result to its transport's 413.
+ *
+ * Background: a global body-size limit (e.g. adapter-node's `BODY_SIZE_LIMIT`)
+ * has to be set high enough for the largest legitimate upload, which means
+ * smaller JSON endpoints inherit that ceiling by default. This check is the
+ * per-route lower bound.
+ *
+ * Caveat: requests without `Content-Length` (chunked transfer encoding) bypass
+ * this check. Most browsers and HTTP clients send Content-Length on POST/PUT.
+ * The global limit is the backstop for those.
+ */
+export declare function declaredBodySizeExceeds(headers: HeadersLike, maxBytes: number): boolean;
+//# sourceMappingURL=body-size.d.ts.map

package/dist/http/body-size.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-size.d.ts","sourceRoot":"","sources":["../../src/http/body-size.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,MAAM,WAAW,WAAW;IAC3B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CACjC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGvF"}

package/dist/http/body-size.js

@@ -0,0 +1,20 @@
+/**
+ * True when the request's declared `Content-Length` exceeds `maxBytes`.
+ * Check BEFORE the body is read so a malicious client can't burn memory by
+ * sending a huge payload to a small-body endpoint; the route maps a `true`
+ * result to its transport's 413.
+ *
+ * Background: a global body-size limit (e.g. adapter-node's `BODY_SIZE_LIMIT`)
+ * has to be set high enough for the largest legitimate upload, which means
+ * smaller JSON endpoints inherit that ceiling by default. This check is the
+ * per-route lower bound.
+ *
+ * Caveat: requests without `Content-Length` (chunked transfer encoding) bypass
+ * this check. Most browsers and HTTP clients send Content-Length on POST/PUT.
+ * The global limit is the backstop for those.
+ */
+export function declaredBodySizeExceeds(headers, maxBytes) {
+    const declared = Number(headers.get('content-length'));
+    return Number.isFinite(declared) && declared > maxBytes;
+}
+//# sourceMappingURL=body-size.js.map

package/dist/http/body-size.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-size.js","sourceRoot":"","sources":["../../src/http/body-size.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAoB,EAAE,QAAgB;IAC7E,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACvD,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,QAAQ,CAAC;AACzD,CAAC"}

package/dist/http/index.d.ts

@@ -0,0 +1,5 @@
+export { safeRedirectTarget } from './redirect.js';
+export { declaredBodySizeExceeds, type HeadersLike } from './body-size.js';
+export { applySecurityHeaders, type SecurityHeaderOptions } from './security-headers.js';
+export { createRouteClassifier, type RouteClassifier, type RouteClassifierConfig } from './route-classifier.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/http/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACzF,OAAO,EACN,qBAAqB,EACrB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,MAAM,uBAAuB,CAAC"}

package/dist/http/index.js

@@ -0,0 +1,6 @@
+// HTTP hardening helpers — transport-agnostic request/response guards.
+export { safeRedirectTarget } from './redirect.js';
+export { declaredBodySizeExceeds } from './body-size.js';
+export { applySecurityHeaders } from './security-headers.js';
+export { createRouteClassifier } from './route-classifier.js';
+//# sourceMappingURL=index.js.map

package/dist/http/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAAA,uEAAuE;AAEvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAoB,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAA8B,MAAM,uBAAuB,CAAC;AACzF,OAAO,EACN,qBAAqB,EAGrB,MAAM,uBAAuB,CAAC"}

package/dist/http/redirect.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Validate a user-supplied post-login redirect target. Accepts only same-origin
+ * relative paths starting with `/` followed by a non-`/` character, so
+ * `//evil.com/path` (protocol-relative URL — browser treats as cross-origin)
+ * and `/\evil.com` (back-slash variants some browsers normalize) are rejected.
+ *
+ * Always returns a safe path: the validated target on success, the fallback
+ * otherwise. Routes call this with `redirectTo` from form data or query string.
+ */
+export declare function safeRedirectTarget(raw: string | null | undefined, fallback: string): string;
+//# sourceMappingURL=redirect.d.ts.map

package/dist/http/redirect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect.d.ts","sourceRoot":"","sources":["../../src/http/redirect.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAM3F"}

package/dist/http/redirect.js

@@ -0,0 +1,20 @@
+/**
+ * Validate a user-supplied post-login redirect target. Accepts only same-origin
+ * relative paths starting with `/` followed by a non-`/` character, so
+ * `//evil.com/path` (protocol-relative URL — browser treats as cross-origin)
+ * and `/\evil.com` (back-slash variants some browsers normalize) are rejected.
+ *
+ * Always returns a safe path: the validated target on success, the fallback
+ * otherwise. Routes call this with `redirectTo` from form data or query string.
+ */
+export function safeRedirectTarget(raw, fallback) {
+    if (typeof raw !== 'string' || raw.length < 2)
+        return fallback;
+    if (raw[0] !== '/')
+        return fallback;
+    // Reject protocol-relative (`//host`) and back-slash bypass (`/\host`).
+    if (raw[1] === '/' || raw[1] === '\\')
+        return fallback;
+    return raw;
+}
+//# sourceMappingURL=redirect.js.map

package/dist/http/redirect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect.js","sourceRoot":"","sources":["../../src/http/redirect.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAA8B,EAAE,QAAgB;IAClF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC/D,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,QAAQ,CAAC;IACpC,wEAAwE;IACxE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACvD,OAAO,GAAG,CAAC;AACZ,CAAC"}

package/dist/http/route-classifier.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Deny-by-default route classification. Every request is gated unless its
+ * path matches one of the explicit allowlists supplied here — so adding a new
+ * top-level route is safe: forgetting to update the lists makes it gated (a
+ * loud 401/redirect), not silently public.
+ *
+ * The *pattern* is reusable; the *values* are app policy — a consuming app
+ * supplies its own route sets. All matching is plain exact/prefix string
+ * comparison: cheap enough for the hooks hot path, and no regex to get wrong.
+ */
+export interface RouteClassifierConfig {
+    /** Exact-match public pages — no session needed (e.g. `/`, `/login`). */
+    publicPages?: Iterable<string>;
+    /**
+     * Public path prefixes (e.g. `/auth/` for OAuth start + callback — the
+     * user has no session yet by definition).
+     */
+    publicPrefixes?: readonly string[];
+    /**
+     * Exact-match API endpoints that must answer without a session (e.g. a
+     * load-balancer health probe). Anything added here must be safe to expose
+     * to anonymous callers.
+     */
+    publicApis?: Iterable<string>;
+    /**
+     * A single prefix whose routes apply their own per-request authorization
+     * (e.g. a blob proxy classifying each asset path). The hook must NOT deny
+     * these up front; they classify as public (best-effort session attach) and
+     * the route makes the real decision. Keep this to ONE prefix — every other
+     * API route stays deny-by-default.
+     */
+    selfGatingPrefix?: string;
+    /** Static-asset path prefixes the adapter serves directly (e.g. `/_app/`). */
+    staticPrefixes?: readonly string[];
+    /** Exact static-asset paths (e.g. `/favicon.svg`, `/robots.txt`). */
+    staticPaths?: Iterable<string>;
+}
+export interface RouteClassifier {
+    /** Static assets bypass auth gating; callers may add cache headers. */
+    isStaticAsset(pathname: string): boolean;
+    /** True for paths under `selfGatingPrefix` — the route gates itself. */
+    isSelfGatingApiRoute(pathname: string): boolean;
+    /** True when the path needs no session: pages, APIs, prefixes, self-gating. */
+    isPublicRoute(pathname: string): boolean;
+}
+export declare function createRouteClassifier(config: RouteClassifierConfig): RouteClassifier;
+//# sourceMappingURL=route-classifier.d.ts.map

package/dist/http/route-classifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-classifier.d.ts","sourceRoot":"","sources":["../../src/http/route-classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,WAAW,qBAAqB;IACrC,yEAAyE;IACzE,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B;;;OAGG;IACH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;;OAIG;IACH,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,qEAAqE;IACrE,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe;IAC/B,uEAAuE;IACvE,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IACzC,wEAAwE;IACxE,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IAChD,+EAA+E;IAC/E,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;CACzC;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,GAAG,eAAe,CAyBpF"}

package/dist/http/route-classifier.js

@@ -0,0 +1,37 @@
+/**
+ * Deny-by-default route classification. Every request is gated unless its
+ * path matches one of the explicit allowlists supplied here — so adding a new
+ * top-level route is safe: forgetting to update the lists makes it gated (a
+ * loud 401/redirect), not silently public.
+ *
+ * The *pattern* is reusable; the *values* are app policy — a consuming app
+ * supplies its own route sets. All matching is plain exact/prefix string
+ * comparison: cheap enough for the hooks hot path, and no regex to get wrong.
+ */
+export function createRouteClassifier(config) {
+    const publicPages = new Set(config.publicPages ?? []);
+    const publicPrefixes = config.publicPrefixes ?? [];
+    const publicApis = new Set(config.publicApis ?? []);
+    const selfGatingPrefix = config.selfGatingPrefix;
+    const staticPrefixes = config.staticPrefixes ?? [];
+    const staticPaths = new Set(config.staticPaths ?? []);
+    function isStaticAsset(pathname) {
+        if (staticPaths.has(pathname))
+            return true;
+        return staticPrefixes.some((p) => pathname.startsWith(p));
+    }
+    function isSelfGatingApiRoute(pathname) {
+        return selfGatingPrefix !== undefined && pathname.startsWith(selfGatingPrefix);
+    }
+    function isPublicRoute(pathname) {
+        if (publicPages.has(pathname))
+            return true;
+        if (publicApis.has(pathname))
+            return true;
+        if (isSelfGatingApiRoute(pathname))
+            return true;
+        return publicPrefixes.some((p) => pathname.startsWith(p));
+    }
+    return { isStaticAsset, isSelfGatingApiRoute, isPublicRoute };
+}
+//# sourceMappingURL=route-classifier.js.map

package/dist/http/route-classifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-classifier.js","sourceRoot":"","sources":["../../src/http/route-classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAuCH,MAAM,UAAU,qBAAqB,CAAC,MAA6B;IAClE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IACtD,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC;IACnD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACjD,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC;IACnD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAEtD,SAAS,aAAa,CAAC,QAAgB;QACtC,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,SAAS,oBAAoB,CAAC,QAAgB;QAC7C,OAAO,gBAAgB,KAAK,SAAS,IAAI,QAAQ,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;IAChF,CAAC;IAED,SAAS,aAAa,CAAC,QAAgB;QACtC,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1C,IAAI,oBAAoB,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAChD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,aAAa,EAAE,CAAC;AAC/D,CAAC"}

package/dist/http/security-headers.d.ts

@@ -0,0 +1,31 @@
+export interface SecurityHeaderOptions {
+    /**
+     * Set `Strict-Transport-Security` — production only. Locking dev
+     * (http://localhost) into HTTPS would brick local development, so the
+     * caller decides what "production" means (e.g. `NODE_ENV`).
+     */
+    hsts: boolean;
+}
+/**
+ * Apply baseline browser-hardening headers to a response. Cheap wins that
+ * don't require UI verification:
+ *
+ *   - X-Content-Type-Options: nosniff — disables MIME sniffing.
+ *   - Referrer-Policy: strict-origin-when-cross-origin — strips the path
+ *     and query from cross-origin Referer headers; matches modern browser
+ *     defaults but pins the behavior in case the default ever drifts.
+ *   - Permissions-Policy: opt out of browser APIs Selva-engine apps don't
+ *     use, so XSS can't enable them.
+ *   - HSTS when `opts.hsts` (production).
+ *
+ * **Intentionally NOT set here:**
+ *   - Content-Security-Policy + frame-ancestors. Selva-engine apps are built
+ *     for iframe embedding, so a strict CSP needs UI-phase validation against
+ *     real consumer sites before it can ship.
+ *   - X-Frame-Options. Same iframe-embedding constraint.
+ *   - Cache-Control. Asset-path layout is app policy; set it in the caller.
+ *
+ * Returns the same response for chaining.
+ */
+export declare function applySecurityHeaders(response: Response, opts: SecurityHeaderOptions): Response;
+//# sourceMappingURL=security-headers.d.ts.map

package/dist/http/security-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-headers.d.ts","sourceRoot":"","sources":["../../src/http/security-headers.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,qBAAqB;IACrC;;;;OAIG;IACH,IAAI,EAAE,OAAO,CAAC;CACd;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,GAAG,QAAQ,CAW9F"}

package/dist/http/security-headers.js

@@ -0,0 +1,31 @@
+/**
+ * Apply baseline browser-hardening headers to a response. Cheap wins that
+ * don't require UI verification:
+ *
+ *   - X-Content-Type-Options: nosniff — disables MIME sniffing.
+ *   - Referrer-Policy: strict-origin-when-cross-origin — strips the path
+ *     and query from cross-origin Referer headers; matches modern browser
+ *     defaults but pins the behavior in case the default ever drifts.
+ *   - Permissions-Policy: opt out of browser APIs Selva-engine apps don't
+ *     use, so XSS can't enable them.
+ *   - HSTS when `opts.hsts` (production).
+ *
+ * **Intentionally NOT set here:**
+ *   - Content-Security-Policy + frame-ancestors. Selva-engine apps are built
+ *     for iframe embedding, so a strict CSP needs UI-phase validation against
+ *     real consumer sites before it can ship.
+ *   - X-Frame-Options. Same iframe-embedding constraint.
+ *   - Cache-Control. Asset-path layout is app policy; set it in the caller.
+ *
+ * Returns the same response for chaining.
+ */
+export function applySecurityHeaders(response, opts) {
+    response.headers.set('X-Content-Type-Options', 'nosniff');
+    response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
+    response.headers.set('Permissions-Policy', 'accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()');
+    if (opts.hsts) {
+        response.headers.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
+    }
+    return response;
+}
+//# sourceMappingURL=security-headers.js.map

package/dist/http/security-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-headers.js","sourceRoot":"","sources":["../../src/http/security-headers.ts"],"names":[],"mappings":"AASA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAkB,EAAE,IAA2B;IACnF,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IAC1D,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;IAC3E,QAAQ,CAAC,OAAO,CAAC,GAAG,CACnB,oBAAoB,EACpB,+GAA+G,CAC/G,CAAC;IACF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,qCAAqC,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC"}

package/dist/index.d.ts

@@ -9,10 +9,19 @@
  *
  * The full compute subsurface is also available at `@selvajs/server/compute`,
  * the definitions slice (DefinitionService, schema extraction/validation,
- * render loader) at `@selvajs/server/definitions`, and the provider wiring
- * (registry-driven `createSelvaProviders`) at `@selvajs/server/providers`.
+ * render loader) at `@selvajs/server/definitions`, the provider wiring
+ * (registry-driven `createSelvaProviders`) at `@selvajs/server/providers`,
+ * the HMAC token codec at `@selvajs/server/tokens`, error reporting at
+ * `@selvajs/server/errors`, HTTP hardening helpers at `@selvajs/server/http`,
+ * access-rule input assembly at `@selvajs/server/access`, and deployment/ops
+ * helpers at `@selvajs/server/ops`.
  */
 export * from './compute/index.js';
 export * from './definitions/index.js';
 export * from './providers/index.js';
+export * from './tokens/index.js';
+export * from './errors/index.js';
+export * from './http/index.js';
+export * from './access/index.js';
+export * from './ops/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC"}