@selvajs/server 1.0.4 → 1.2.0

package/dist/compute/index.d.ts

@@ -1,6 +1,6 @@
 export { resolveComputeLimits, readPositiveInt, readNonNegativeInt, readBool, type ComputeLimits, type EnvRecord } from './limits.js';
 export { createComputeRateLimiter, DEFAULT_MAX_KEYS, type ComputeRateLimiter, type ComputeRateLimiterConfig, type RateLimitResult } from './rate-limit.js';
 export { createIdempotencyStore, DEFAULT_IDEMPOTENCY_MAX_KEYS, type IdempotencyStore, type IdempotencyStoreConfig, type IdempotencyOutcome } from './idempotency.js';
-export { isSafeRemoteDefinitionUrl, assertSafeRemoteDefinitionUrl } from './safe-url.js';
+export { isSafeRemoteDefinitionUrl, assertSafeRemoteDefinitionUrl, isLinkLocalUrl } from './safe-url.js';
 export { createRemoteDefinitionFetcher, readBodyWithCap, type RemoteDefinitionFetcher, type RemoteDefinitionConfig } from './remote-definition.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/compute/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/compute/index.ts"],"names":[],"mappings":"AAWA,OAAO,EACN,oBAAoB,EACpB,eAAe,EACf,kBAAkB,EAClB,QAAQ,EACR,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,MAAM,aAAa,CAAC;AAErB,OAAO,EACN,wBAAwB,EACxB,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACN,sBAAsB,EACtB,4BAA4B,EAC5B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,MAAM,eAAe,CAAC;AAEzF,OAAO,EACN,6BAA6B,EAC7B,eAAe,EACf,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/compute/index.ts"],"names":[],"mappings":"AAWA,OAAO,EACN,oBAAoB,EACpB,eAAe,EACf,kBAAkB,EAClB,QAAQ,EACR,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,MAAM,aAAa,CAAC;AAErB,OAAO,EACN,wBAAwB,EACxB,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACN,sBAAsB,EACtB,4BAA4B,EAC5B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACN,yBAAyB,EACzB,6BAA6B,EAC7B,cAAc,EACd,MAAM,eAAe,CAAC;AAEvB,OAAO,EACN,6BAA6B,EAC7B,eAAe,EACf,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,MAAM,wBAAwB,CAAC"}

package/dist/compute/index.js

@@ -11,6 +11,6 @@
 export { resolveComputeLimits, readPositiveInt, readNonNegativeInt, readBool } from './limits.js';
 export { createComputeRateLimiter, DEFAULT_MAX_KEYS } from './rate-limit.js';
 export { createIdempotencyStore, DEFAULT_IDEMPOTENCY_MAX_KEYS } from './idempotency.js';
-export { isSafeRemoteDefinitionUrl, assertSafeRemoteDefinitionUrl } from './safe-url.js';
+export { isSafeRemoteDefinitionUrl, assertSafeRemoteDefinitionUrl, isLinkLocalUrl } from './safe-url.js';
 export { createRemoteDefinitionFetcher, readBodyWithCap } from './remote-definition.js';
 //# sourceMappingURL=index.js.map

package/dist/compute/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/compute/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,kGAAkG;AAClG,mGAAmG;AACnG,oBAAoB;AACpB,EAAE;AACF,6FAA6F;AAC7F,6FAA6F;AAC7F,8FAA8F;AAC9F,qCAAqC;AAErC,OAAO,EACN,oBAAoB,EACpB,eAAe,EACf,kBAAkB,EAClB,QAAQ,EAGR,MAAM,aAAa,CAAC;AAErB,OAAO,EACN,wBAAwB,EACxB,gBAAgB,EAIhB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACN,sBAAsB,EACtB,4BAA4B,EAI5B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,MAAM,eAAe,CAAC;AAEzF,OAAO,EACN,6BAA6B,EAC7B,eAAe,EAGf,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/compute/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,kGAAkG;AAClG,mGAAmG;AACnG,oBAAoB;AACpB,EAAE;AACF,6FAA6F;AAC7F,6FAA6F;AAC7F,8FAA8F;AAC9F,qCAAqC;AAErC,OAAO,EACN,oBAAoB,EACpB,eAAe,EACf,kBAAkB,EAClB,QAAQ,EAGR,MAAM,aAAa,CAAC;AAErB,OAAO,EACN,wBAAwB,EACxB,gBAAgB,EAIhB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACN,sBAAsB,EACtB,4BAA4B,EAI5B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACN,yBAAyB,EACzB,6BAA6B,EAC7B,cAAc,EACd,MAAM,eAAe,CAAC;AAEvB,OAAO,EACN,6BAA6B,EAC7B,eAAe,EAGf,MAAM,wBAAwB,CAAC"}

package/dist/compute/safe-url.d.ts

@@ -6,6 +6,22 @@ import { type ILogger } from '@selvajs/platform';
  * caught only by `assertSafeRemoteDefinitionUrl`.
  */
 export declare function isSafeRemoteDefinitionUrl(raw: string): boolean;
+/**
+ * True when `raw` targets the link-local range (`169.254.0.0/16`), which
+ * carries the cloud metadata service at `169.254.169.254` — the endpoint that
+ * hands out a host's own IAM credentials to anything on the box.
+ *
+ * A far narrower judgement than {@link isSafeRemoteDefinitionUrl}, for the one
+ * caller that must tolerate private addresses: an operator's own compute server
+ * legitimately lives on `localhost` or a LAN, so blocking RFC1918 there would
+ * reject the ordinary self-hosted layout. Nothing legitimate is ever reached
+ * over link-local, so this stays blocked with no opt-out.
+ *
+ * Shares `canonicalizeNumericIpv4`, so the encodings that bypass a naive string
+ * comparison — `http://2852039166/`, `http://0251.0376.0251.0376/`,
+ * `http://0xa9fea9fe/` — all resolve to the same verdict.
+ */
+export declare function isLinkLocalUrl(raw: string): boolean;
 /**
  * Full SSRF check: literal pre-filter, then resolve every A/AAAA record and
  * reject if *any* resolved IP is blocked. Returns the original URL on success

package/dist/compute/safe-url.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"safe-url.d.ts","sourceRoot":"","sources":["../../src/compute/safe-url.ts"],"names":[],"mappings":"AAEA,OAAO,EAAc,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AA0H7D;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CA2B9D;AAED;;;;;;;GAOG;AACH,wBAAsB,6BAA6B,CAClD,GAAG,EAAE,MAAM,EACX,MAAM,GAAE,OAA0B,GAChC,OAAO,CAAC,MAAM,CAAC,CAqCjB"}
+{"version":3,"file":"safe-url.d.ts","sourceRoot":"","sources":["../../src/compute/safe-url.ts"],"names":[],"mappings":"AAEA,OAAO,EAAc,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AA0H7D;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CA2B9D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAiBnD;AAED;;;;;;;GAOG;AACH,wBAAsB,6BAA6B,CAClD,GAAG,EAAE,MAAM,EACX,MAAM,GAAE,OAA0B,GAChC,OAAO,CAAC,MAAM,CAAC,CAqCjB"}

package/dist/compute/safe-url.js

@@ -166,6 +166,42 @@ export function isSafeRemoteDefinitionUrl(raw) {
     // A real hostname — passes the literal filter; DNS resolution is the gate.
     return true;
 }
+/**
+ * True when `raw` targets the link-local range (`169.254.0.0/16`), which
+ * carries the cloud metadata service at `169.254.169.254` — the endpoint that
+ * hands out a host's own IAM credentials to anything on the box.
+ *
+ * A far narrower judgement than {@link isSafeRemoteDefinitionUrl}, for the one
+ * caller that must tolerate private addresses: an operator's own compute server
+ * legitimately lives on `localhost` or a LAN, so blocking RFC1918 there would
+ * reject the ordinary self-hosted layout. Nothing legitimate is ever reached
+ * over link-local, so this stays blocked with no opt-out.
+ *
+ * Shares `canonicalizeNumericIpv4`, so the encodings that bypass a naive string
+ * comparison — `http://2852039166/`, `http://0251.0376.0251.0376/`,
+ * `http://0xa9fea9fe/` — all resolve to the same verdict.
+ */
+export function isLinkLocalUrl(raw) {
+    let host;
+    try {
+        host = new URL(raw).hostname.toLowerCase();
+    }
+    catch {
+        return false;
+    }
+    if (!host)
+        return false;
+    if (host.startsWith('[') && host.endsWith(']'))
+        host = host.slice(1, -1);
+    // IPv6 link-local (fe80::/10), the v6 counterpart of the range below.
+    if (isIP(host) === 6)
+        return /^fe[89ab][0-9a-f]:/.test(host);
+    const canonical = canonicalizeNumericIpv4(host);
+    if (!canonical)
+        return false; // a real hostname — DNS is not this check's job
+    const [a, b] = canonical.split('.').map(Number);
+    return a === 169 && b === 254;
+}
 /**
  * Full SSRF check: literal pre-filter, then resolve every A/AAAA record and
  * reject if *any* resolved IP is blocked. Returns the original URL on success

package/dist/compute/safe-url.js.map

@@ -1 +1 @@
-{"version":3,"file":"safe-url.js","sourceRoot":"","sources":["../../src/compute/safe-url.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,UAAU,EAAgB,MAAM,mBAAmB,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;GAIG;AACH,SAAS,WAAW,CAAC,EAAU;IAC9B,IAAI,IAAI,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAE5B,wEAAwE;IACxE,2EAA2E;IAC3E,gDAAgD;IAChD,MAAM,YAAY,GAAG,+CAA+C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChF,IAAI,YAAY,EAAE,CAAC;QAClB,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;SAAM,CAAC;QACP,MAAM,SAAS,GAAG,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxE,IAAI,SAAS,EAAE,CAAC;YACf,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtC,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtC,IAAI,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7E,CAAC;IACF,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,oBAAoB;QACzF,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,4BAA4B;QACtD,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,WAAW;QACvC,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC,CAAC,UAAU;QACrC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,UAAU;QACnD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC,CAAC,UAAU;QAC5D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,8BAA8B;QACvE,OAAO,KAAK,CAAC;IACd,CAAC;IAED,iBAAiB;IACjB,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,yBAAyB;IAC3E,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;IAC9E,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,uBAAuB;IACzE,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,uBAAuB,CAAC,IAAY;IAC5C,6DAA6D;IAC7D,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAElC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9D,MAAM,SAAS,GAAG,CAAC,CAAS,EAAiB,EAAE;QAC9C,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QAC1B,IAAI,CAAS,CAAC;QACd,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;aAC7C,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;aAC5C,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;;YAC5C,OAAO,IAAI,CAAC;QACjB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAgB,CAAC;IAE/B,6EAA6E;IAC7E,yEAAyE;IACzE,IAAI,KAAa,CAAC;IAClB,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;QACtB,KAAK,CAAC;YACL,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACjB,MAAM;QACP,KAAK,CAAC;YACL,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACxD,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACpC,MAAM;QACP,KAAK,CAAC;YACL,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzE,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACvD,MAAM;QACP;YACC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC7C,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,wBAAwB;IAC7C,IAAI,KAAK,GAAG,UAAU;QAAE,OAAO,IAAI,CAAC;IAEpC,OAAO,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,CAC7F,GAAG,CACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACpD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE9E,IAAI,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAExB,0CAA0C;IAC1C,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IAEtE,qDAAqD;IACrD,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,WAAW;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAE1C,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAEhD,2DAA2D;IAC3D,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,SAAS;QAAE,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAE9C,2EAA2E;IAC3E,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAClD,GAAW,EACX,SAAkB,IAAI,UAAU,EAAE;IAElC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;YAC5C,SAAS,EAAE,cAAc;YACzB,MAAM,EAAE,gBAAgB;YACxB,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC;SACjB,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAEzE,0EAA0E;IAC1E,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IAElE,IAAI,QAA+B,CAAC;IACpC,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;YAC5C,SAAS,EAAE,cAAc;YACzB,MAAM,EAAE,mBAAmB;YAC3B,IAAI;SACJ,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACrF,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;YAC5C,SAAS,EAAE,cAAc;YACzB,MAAM,EAAE,wBAAwB;YAChC,IAAI;YACJ,UAAU,EAAE,OAAO;SACnB,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,8EAA8E;AAC9E,SAAS,MAAM,CAAC,GAAW;IAC1B,IAAI,CAAC;QACJ,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;AACF,CAAC"}
+{"version":3,"file":"safe-url.js","sourceRoot":"","sources":["../../src/compute/safe-url.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,UAAU,EAAgB,MAAM,mBAAmB,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;GAIG;AACH,SAAS,WAAW,CAAC,EAAU;IAC9B,IAAI,IAAI,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAE5B,wEAAwE;IACxE,2EAA2E;IAC3E,gDAAgD;IAChD,MAAM,YAAY,GAAG,+CAA+C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChF,IAAI,YAAY,EAAE,CAAC;QAClB,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;SAAM,CAAC;QACP,MAAM,SAAS,GAAG,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxE,IAAI,SAAS,EAAE,CAAC;YACf,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtC,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtC,IAAI,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7E,CAAC;IACF,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,oBAAoB;QACzF,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,4BAA4B;QACtD,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,WAAW;QACvC,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC,CAAC,UAAU;QACrC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,UAAU;QACnD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC,CAAC,UAAU;QAC5D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,8BAA8B;QACvE,OAAO,KAAK,CAAC;IACd,CAAC;IAED,iBAAiB;IACjB,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,yBAAyB;IAC3E,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;IAC9E,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,uBAAuB;IACzE,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,uBAAuB,CAAC,IAAY;IAC5C,6DAA6D;IAC7D,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAElC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9D,MAAM,SAAS,GAAG,CAAC,CAAS,EAAiB,EAAE;QAC9C,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QAC1B,IAAI,CAAS,CAAC;QACd,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;aAC7C,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;aAC5C,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;;YAC5C,OAAO,IAAI,CAAC;QACjB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAgB,CAAC;IAE/B,6EAA6E;IAC7E,yEAAyE;IACzE,IAAI,KAAa,CAAC;IAClB,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;QACtB,KAAK,CAAC;YACL,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACjB,MAAM;QACP,KAAK,CAAC;YACL,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACxD,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACpC,MAAM;QACP,KAAK,CAAC;YACL,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzE,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACvD,MAAM;QACP;YACC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC7C,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,wBAAwB;IAC7C,IAAI,KAAK,GAAG,UAAU;QAAE,OAAO,IAAI,CAAC;IAEpC,OAAO,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,CAC7F,GAAG,CACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACpD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE9E,IAAI,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAExB,0CAA0C;IAC1C,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IAEtE,qDAAqD;IACrD,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,WAAW;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAE1C,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAEhD,2DAA2D;IAC3D,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,SAAS;QAAE,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAE9C,2EAA2E;IAC3E,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACzC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACJ,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAEzE,sEAAsE;IACtE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE7D,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC,CAAC,gDAAgD;IAC9E,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChD,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAClD,GAAW,EACX,SAAkB,IAAI,UAAU,EAAE;IAElC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;YAC5C,SAAS,EAAE,cAAc;YACzB,MAAM,EAAE,gBAAgB;YACxB,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC;SACjB,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAEzE,0EAA0E;IAC1E,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IAElE,IAAI,QAA+B,CAAC;IACpC,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;YAC5C,SAAS,EAAE,cAAc;YACzB,MAAM,EAAE,mBAAmB;YAC3B,IAAI;SACJ,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACrF,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;YAC5C,SAAS,EAAE,cAAc;YACzB,MAAM,EAAE,wBAAwB;YAChC,IAAI;YACJ,UAAU,EAAE,OAAO;SACnB,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,8EAA8E;AAC9E,SAAS,MAAM,CAAC,GAAW;IAC1B,IAAI,CAAC;QACJ,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;AACF,CAAC"}

package/dist/http/security-headers.d.ts

@@ -5,6 +5,14 @@ export interface SecurityHeaderOptions {
      * what "production" means (e.g. `NODE_ENV`).
      */
     hsts: boolean;
+    /**
+     * Forbid framing this response. Off by default — Selva-engine app routes are
+     * built to be embedded. Turn it on for operator surfaces (`/admin/*`,
+     * `/setup`), where an authenticated session plus a framable page is a
+     * UI-redress attack. `SameSite=Lax` blunts cross-site POST, not same-origin
+     * redress, so the cookie flag is not a substitute.
+     */
+    denyFraming?: boolean;
 }
 /**
  * Apply baseline browser-hardening headers to a response and return it for
@@ -17,12 +25,14 @@ export interface SecurityHeaderOptions {
  *   - Permissions-Policy: opts out of browser APIs Selva-engine apps don't use,
  *     so XSS can't enable them.
  *   - HSTS when `opts.hsts`.
+ *   - X-Frame-Options + `frame-ancestors 'none'` when `opts.denyFraming` — the
+ *     caller opts in per route, since embeddable app routes must stay framable.
  *
  * **Intentionally NOT set here:**
- *   - Content-Security-Policy + frame-ancestors. Selva-engine apps are built
- *     for iframe embedding, so a strict CSP needs validating against real
- *     consumer sites before it can ship.
- *   - X-Frame-Options. Same iframe-embedding constraint.
+ *   - A full Content-Security-Policy. Selva-engine apps are built for iframe
+ *     embedding, so a strict CSP needs validating against real consumer sites
+ *     before it can ship. `denyFraming` sets only the `frame-ancestors`
+ *     directive, which constrains nothing else the page loads.
  *   - Cache-Control. Asset-path layout is app policy; set it in the caller.
  */
 export declare function applySecurityHeaders(response: Response, opts: SecurityHeaderOptions): Response;

package/dist/http/security-headers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security-headers.d.ts","sourceRoot":"","sources":["../../src/http/security-headers.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,qBAAqB;IACrC;;;;OAIG;IACH,IAAI,EAAE,OAAO,CAAC;CACd;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,GAAG,QAAQ,CAW9F"}
+{"version":3,"file":"security-headers.d.ts","sourceRoot":"","sources":["../../src/http/security-headers.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,qBAAqB;IACrC;;;;OAIG;IACH,IAAI,EAAE,OAAO,CAAC;IACd;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,GAAG,QAAQ,CAe9F"}

package/dist/http/security-headers.js

@@ -9,12 +9,14 @@
  *   - Permissions-Policy: opts out of browser APIs Selva-engine apps don't use,
  *     so XSS can't enable them.
  *   - HSTS when `opts.hsts`.
+ *   - X-Frame-Options + `frame-ancestors 'none'` when `opts.denyFraming` — the
+ *     caller opts in per route, since embeddable app routes must stay framable.
  *
  * **Intentionally NOT set here:**
- *   - Content-Security-Policy + frame-ancestors. Selva-engine apps are built
- *     for iframe embedding, so a strict CSP needs validating against real
- *     consumer sites before it can ship.
- *   - X-Frame-Options. Same iframe-embedding constraint.
+ *   - A full Content-Security-Policy. Selva-engine apps are built for iframe
+ *     embedding, so a strict CSP needs validating against real consumer sites
+ *     before it can ship. `denyFraming` sets only the `frame-ancestors`
+ *     directive, which constrains nothing else the page loads.
  *   - Cache-Control. Asset-path layout is app policy; set it in the caller.
  */
 export function applySecurityHeaders(response, opts) {
@@ -24,6 +26,10 @@ export function applySecurityHeaders(response, opts) {
     if (opts.hsts) {
         response.headers.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
     }
+    if (opts.denyFraming) {
+        response.headers.set('X-Frame-Options', 'DENY');
+        response.headers.set('Content-Security-Policy', "frame-ancestors 'none'");
+    }
     return response;
 }
 //# sourceMappingURL=security-headers.js.map

package/dist/http/security-headers.js.map

@@ -1 +1 @@
-{"version":3,"file":"security-headers.js","sourceRoot":"","sources":["../../src/http/security-headers.ts"],"names":[],"mappings":"AASA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAkB,EAAE,IAA2B;IACnF,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IAC1D,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;IAC3E,QAAQ,CAAC,OAAO,CAAC,GAAG,CACnB,oBAAoB,EACpB,+GAA+G,CAC/G,CAAC;IACF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,qCAAqC,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC"}
+{"version":3,"file":"security-headers.js","sourceRoot":"","sources":["../../src/http/security-headers.ts"],"names":[],"mappings":"AAiBA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAkB,EAAE,IAA2B;IACnF,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IAC1D,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;IAC3E,QAAQ,CAAC,OAAO,CAAC,GAAG,CACnB,oBAAoB,EACpB,+GAA+G,CAC/G,CAAC;IACF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,qCAAqC,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QAChD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,wBAAwB,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC"}

package/dist/notifications/index.d.ts

@@ -0,0 +1,3 @@
+export { SmtpNotificationProvider } from './smtp-provider.js';
+export { readSmtpConfig, type SmtpConfig, type SmtpEnv } from './smtp-config.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/notifications/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/notifications/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,KAAK,UAAU,EAAE,KAAK,OAAO,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/notifications/index.js

@@ -0,0 +1,3 @@
+export { SmtpNotificationProvider } from './smtp-provider.js';
+export { readSmtpConfig } from './smtp-config.js';
+//# sourceMappingURL=index.js.map

package/dist/notifications/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/notifications/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAiC,MAAM,kBAAkB,CAAC"}

package/dist/notifications/smtp-config.d.ts

@@ -0,0 +1,37 @@
+export interface SmtpConfig {
+    host: string;
+    port: number;
+    secure: boolean;
+    auth?: {
+        user: string;
+        pass: string;
+    };
+    from: string;
+}
+/** The env vars this provider reads. The app passes `process.env` or its framework equivalent. */
+export interface SmtpEnv {
+    SMTP_HOST?: string;
+    SMTP_PORT?: string;
+    SMTP_USER?: string;
+    SMTP_PASS?: string;
+    SMTP_FROM?: string;
+    SMTP_SECURE?: string;
+    [key: string]: string | undefined;
+}
+/**
+ * Read SMTP settings from an env bag. Taken as a parameter rather than read
+ * from `process.env` directly: under `vite dev` the framework does not mirror
+ * `.env` into `process.env`, so the app must hand over its own resolved env
+ * (`$env/dynamic/private` in SvelteKit) or overrides silently fall back to
+ * defaults.
+ *
+ * Returns null when mail is not configured — the caller treats that as "no
+ * mail", not as an error.
+ *
+ * Throws only when `SMTP_HOST` is set but `SMTP_FROM` is missing: that
+ * combination is a half-finished config, and failing loudly beats silently
+ * never sending. Every message needs an envelope sender, and guessing one
+ * produces mail that fails SPF at the recipient.
+ */
+export declare function readSmtpConfig(env: SmtpEnv): SmtpConfig | null;
+//# sourceMappingURL=smtp-config.d.ts.map

package/dist/notifications/smtp-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"smtp-config.d.ts","sourceRoot":"","sources":["../../src/notifications/smtp-config.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACtC,IAAI,EAAE,MAAM,CAAC;CACb;AAED,kGAAkG;AAClG,MAAM,WAAW,OAAO;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IAKrB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CAClC;AAOD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,GAAG,IAAI,CAsB9D"}

package/dist/notifications/smtp-config.js

@@ -0,0 +1,41 @@
+function parsePort(raw) {
+    const n = Number(raw ?? 587);
+    return Number.isInteger(n) && n > 0 && n < 65536 ? n : 587;
+}
+/**
+ * Read SMTP settings from an env bag. Taken as a parameter rather than read
+ * from `process.env` directly: under `vite dev` the framework does not mirror
+ * `.env` into `process.env`, so the app must hand over its own resolved env
+ * (`$env/dynamic/private` in SvelteKit) or overrides silently fall back to
+ * defaults.
+ *
+ * Returns null when mail is not configured — the caller treats that as "no
+ * mail", not as an error.
+ *
+ * Throws only when `SMTP_HOST` is set but `SMTP_FROM` is missing: that
+ * combination is a half-finished config, and failing loudly beats silently
+ * never sending. Every message needs an envelope sender, and guessing one
+ * produces mail that fails SPF at the recipient.
+ */
+export function readSmtpConfig(env) {
+    const host = env.SMTP_HOST?.trim();
+    if (!host)
+        return null;
+    const from = env.SMTP_FROM?.trim();
+    if (!from) {
+        throw new Error('SMTP_HOST is set but SMTP_FROM is missing — mail needs a sender address.');
+    }
+    const port = parsePort(env.SMTP_PORT);
+    const user = env.SMTP_USER?.trim();
+    const pass = env.SMTP_PASS;
+    return {
+        host,
+        port,
+        // Port 465 is implicit TLS; 587 and 25 start plaintext and upgrade via
+        // STARTTLS, which nodemailer does on its own when `secure` is false.
+        secure: env.SMTP_SECURE ? env.SMTP_SECURE === 'true' : port === 465,
+        auth: user && pass ? { user, pass } : undefined,
+        from
+    };
+}
+//# sourceMappingURL=smtp-config.js.map

package/dist/notifications/smtp-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"smtp-config.js","sourceRoot":"","sources":["../../src/notifications/smtp-config.ts"],"names":[],"mappings":"AAuBA,SAAS,SAAS,CAAC,GAAuB;IACzC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC;IAE3B,OAAO;QACN,IAAI;QACJ,IAAI;QACJ,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG;QACnE,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QAC/C,IAAI;KACJ,CAAC;AACH,CAAC"}

package/dist/notifications/smtp-provider.d.ts

@@ -0,0 +1,18 @@
+import { type ILogger, type INotificationProvider, type OutboundMessage, type SendResult } from '@selvajs/platform';
+import { type SmtpEnv } from './smtp-config.js';
+/**
+ * SMTP transport. Any server works — a transactional provider, an internal
+ * relay, or a mailbox with an app password.
+ *
+ * Settings are read per send rather than cached, so a restart is the only
+ * thing needed to reconfigure and a rotated password takes effect without
+ * anyone remembering there is a cache.
+ */
+export declare class SmtpNotificationProvider implements INotificationProvider {
+    private readonly env;
+    readonly name = "SMTP";
+    constructor(env: SmtpEnv);
+    send(message: OutboundMessage, log?: ILogger): Promise<SendResult>;
+    isConfigured(): boolean;
+}
+//# sourceMappingURL=smtp-provider.d.ts.map

package/dist/notifications/smtp-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"smtp-provider.d.ts","sourceRoot":"","sources":["../../src/notifications/smtp-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAEN,KAAK,OAAO,EACZ,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAkB,KAAK,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAEhE;;;;;;;GAOG;AACH,qBAAa,wBAAyB,YAAW,qBAAqB;IAGzD,OAAO,CAAC,QAAQ,CAAC,GAAG;IAFhC,QAAQ,CAAC,IAAI,UAAU;gBAEM,GAAG,EAAE,OAAO;IAEnC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,GAAE,OAA0B,GAAG,OAAO,CAAC,UAAU,CAAC;IA6C1F,YAAY,IAAI,OAAO;CAOvB"}

package/dist/notifications/smtp-provider.js

@@ -0,0 +1,71 @@
+import { NoopLogger } from '@selvajs/platform';
+import { readSmtpConfig } from './smtp-config.js';
+/**
+ * SMTP transport. Any server works — a transactional provider, an internal
+ * relay, or a mailbox with an app password.
+ *
+ * Settings are read per send rather than cached, so a restart is the only
+ * thing needed to reconfigure and a rotated password takes effect without
+ * anyone remembering there is a cache.
+ */
+export class SmtpNotificationProvider {
+    env;
+    name = 'SMTP';
+    constructor(env) {
+        this.env = env;
+    }
+    async send(message, log = new NoopLogger()) {
+        let config;
+        try {
+            config = readSmtpConfig(this.env);
+        }
+        catch (err) {
+            log.error('SMTP is misconfigured', {
+                component: 'SmtpNotificationProvider',
+                error: err instanceof Error ? err.message : String(err)
+            });
+            return { status: 'failed', reason: 'misconfigured' };
+        }
+        if (!config)
+            return { status: 'not-configured' };
+        try {
+            // Lazy: an instance with no SMTP_HOST never pays to load nodemailer.
+            const { createTransport } = await import('nodemailer');
+            const transport = createTransport({
+                host: config.host,
+                port: config.port,
+                secure: config.secure,
+                auth: config.auth
+            });
+            await transport.sendMail({
+                from: config.from,
+                to: message.to,
+                subject: message.subject,
+                text: message.text,
+                html: message.html
+            });
+            return { status: 'sent' };
+        }
+        catch (err) {
+            const reason = err instanceof Error ? err.message : String(err);
+            // Recipient is personal data — logged at warn only, as the minimum
+            // needed to diagnose a bounce. Never the subject or body.
+            log.warn('Failed to send mail', {
+                component: 'SmtpNotificationProvider',
+                to: message.to,
+                kind: message.kind,
+                reason
+            });
+            return { status: 'failed', reason };
+        }
+    }
+    isConfigured() {
+        try {
+            return readSmtpConfig(this.env) !== null;
+        }
+        catch {
+            return false;
+        }
+    }
+}
+//# sourceMappingURL=smtp-provider.js.map

package/dist/notifications/smtp-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"smtp-provider.js","sourceRoot":"","sources":["../../src/notifications/smtp-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,UAAU,EAKV,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAgB,MAAM,kBAAkB,CAAC;AAEhE;;;;;;;GAOG;AACH,MAAM,OAAO,wBAAwB;IAGP;IAFpB,IAAI,GAAG,MAAM,CAAC;IAEvB,YAA6B,GAAY;QAAZ,QAAG,GAAH,GAAG,CAAS;IAAG,CAAC;IAE7C,KAAK,CAAC,IAAI,CAAC,OAAwB,EAAE,MAAe,IAAI,UAAU,EAAE;QACnE,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACJ,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE;gBAClC,SAAS,EAAE,0BAA0B;gBACrC,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACvD,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAEjD,IAAI,CAAC;YACJ,qEAAqE;YACrE,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;YACvD,MAAM,SAAS,GAAG,eAAe,CAAC;gBACjC,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,IAAI,EAAE,MAAM,CAAC,IAAI;aACjB,CAAC,CAAC;YAEH,MAAM,SAAS,CAAC,QAAQ,CAAC;gBACxB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;aAClB,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChE,mEAAmE;YACnE,0DAA0D;YAC1D,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE;gBAC/B,SAAS,EAAE,0BAA0B;gBACrC,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM;aACN,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACrC,CAAC;IACF,CAAC;IAED,YAAY;QACX,IAAI,CAAC;YACJ,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;CACD"}

package/dist/ops/deploymentConfig.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Reverse-proxy and body-limit configuration rules, evaluated against a plain
+ * env bag. Pure predicates — no filesystem, no network, no process.
+ *
+ * These settings are read by adapter-node, not by Selva, so getting them wrong
+ * is invisible: nothing throws, nothing logs, and the deployment serves traffic
+ * while a whole class of requests fails. `selva doctor` reports them on the
+ * host; the admin health panel runs the same rules so an operator who never
+ * opens a shell still sees them.
+ *
+ * `packages/cli/src/checks/config.js` carries a duplicate of every rule here.
+ * Duplicated because the CLI is dependency-free by design — it scaffolds the
+ * deployment that installs this runtime, so it cannot import from it. A shared
+ * fixture table (`ops/__tests__/deployment-config-fixtures.js`) is asserted by
+ * both test suites, so a rule changed on one side fails CI on the other.
+ */
+/** Neutral severity. Callers map it onto their own presentation. */
+export type ConfigVerdict = 'ok' | 'warn' | 'fail';
+export interface ConfigFinding {
+    id: string;
+    label: string;
+    verdict: ConfigVerdict;
+    summary: string;
+    /** Concrete next step. Absent when the verdict is `ok`. */
+    remediation?: string;
+}
+/** Just the vars these rules read. Values are raw strings, as they come from `.env`. */
+export interface DeploymentEnv {
+    ORIGIN?: string;
+    ADDRESS_HEADER?: string;
+    XFF_DEPTH?: string;
+    BODY_SIZE_LIMIT?: string;
+    COMPUTE_REQUEST_MAX_BYTES?: string;
+    [key: string]: string | undefined;
+}
+/**
+ * Parse a `BODY_SIZE_LIMIT` the way adapter-node does, so this agrees with the
+ * thing that actually rejects the request.
+ *
+ * The quirk is load-bearing: adapter-node reads only the LAST character as the
+ * suffix, so `60mb` parses as the digits `60m` and happens to mean 60 MB, while
+ * `60xy` silently becomes NaN. Returns bytes, or null when the value is one
+ * adapter-node can't use.
+ */
+export declare function parseBodySizeLimit(raw: string | undefined | null): number | null;
+/**
+ * BODY_SIZE_LIMIT has to clear the compute request cap, or adapter-node's global
+ * backstop rejects the upload first — with a non-JSON body the app never sees
+ * and cannot log. Unset is the dangerous case, not a neutral one: adapter-node
+ * falls back to 512 KB, so every upload 413s on a deployment that looks fine.
+ */
+export declare function checkBodySizeLimit(env: DeploymentEnv): ConfigFinding;
+/**
+ * `ADDRESS_HEADER` / `XFF_DEPTH` are read by adapter-node, not by Selva, and
+ * unset they are invisible: nothing fails, nothing logs, and the deployment
+ * looks healthy.
+ *
+ * What actually happens is that `getClientAddress()` returns the socket peer,
+ * which behind a reverse proxy is the proxy — `127.0.0.1` for every request
+ * from every user. Login rate limiting keys on that, so the whole instance
+ * shares one bucket: five failed logins from anywhere return 429 to everyone,
+ * and only a *successful* login clears a bucket, which nobody can then reach.
+ *
+ * `ORIGIN` is the proxy tell. It is only needed when the app is served under a
+ * public URL it can't derive from its own socket, so its presence means a proxy
+ * is terminating requests. Without it we say nothing: on a directly-reachable
+ * app these settings are a footgun, since `X-Forwarded-For` is client-supplied
+ * and anyone could then pick their own rate-limit bucket.
+ */
+export declare function checkClientAddress(env: DeploymentEnv): ConfigFinding;
+/** Every deployment-config rule, in report order. */
+export declare function checkDeploymentConfig(env: DeploymentEnv): ConfigFinding[];
+//# sourceMappingURL=deploymentConfig.d.ts.map

package/dist/ops/deploymentConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploymentConfig.d.ts","sourceRoot":"","sources":["../../src/ops/deploymentConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,oEAAoE;AACpE,MAAM,MAAM,aAAa,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AAEnD,MAAM,WAAW,aAAa;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,aAAa,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wFAAwF;AACxF,MAAM,WAAW,aAAa;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAKnC,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CAClC;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAUhF;AAOD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,aAAa,GAAG,aAAa,CA0CpE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,aAAa,GAAG,aAAa,CAwDpE;AAED,qDAAqD;AACrD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,aAAa,GAAG,aAAa,EAAE,CAEzE"}

package/dist/ops/deploymentConfig.js

@@ -0,0 +1,154 @@
+/**
+ * Reverse-proxy and body-limit configuration rules, evaluated against a plain
+ * env bag. Pure predicates — no filesystem, no network, no process.
+ *
+ * These settings are read by adapter-node, not by Selva, so getting them wrong
+ * is invisible: nothing throws, nothing logs, and the deployment serves traffic
+ * while a whole class of requests fails. `selva doctor` reports them on the
+ * host; the admin health panel runs the same rules so an operator who never
+ * opens a shell still sees them.
+ *
+ * `packages/cli/src/checks/config.js` carries a duplicate of every rule here.
+ * Duplicated because the CLI is dependency-free by design — it scaffolds the
+ * deployment that installs this runtime, so it cannot import from it. A shared
+ * fixture table (`ops/__tests__/deployment-config-fixtures.js`) is asserted by
+ * both test suites, so a rule changed on one side fails CI on the other.
+ */
+/**
+ * Parse a `BODY_SIZE_LIMIT` the way adapter-node does, so this agrees with the
+ * thing that actually rejects the request.
+ *
+ * The quirk is load-bearing: adapter-node reads only the LAST character as the
+ * suffix, so `60mb` parses as the digits `60m` and happens to mean 60 MB, while
+ * `60xy` silently becomes NaN. Returns bytes, or null when the value is one
+ * adapter-node can't use.
+ */
+export function parseBodySizeLimit(raw) {
+    if (raw == null || raw === '')
+        return null;
+    const value = String(raw).trim();
+    if (value === '')
+        return null;
+    const units = { K: 1024, M: 1024 * 1024, G: 1024 * 1024 * 1024 };
+    const multiplier = units[value.at(-1).toUpperCase()] ?? 1;
+    const bytes = Number(multiplier !== 1 ? value.slice(0, -1) : value) * multiplier;
+    if (!Number.isFinite(bytes) || bytes <= 0)
+        return null;
+    return bytes;
+}
+/** The app's own default for COMPUTE_REQUEST_MAX_BYTES (compute/limits.ts). */
+const COMPUTE_REQUEST_DEFAULT_BYTES = 256 * 1024 * 1024;
+const asMb = (bytes) => `${Math.round(bytes / (1024 * 1024))} MB`;
+/**
+ * BODY_SIZE_LIMIT has to clear the compute request cap, or adapter-node's global
+ * backstop rejects the upload first — with a non-JSON body the app never sees
+ * and cannot log. Unset is the dangerous case, not a neutral one: adapter-node
+ * falls back to 512 KB, so every upload 413s on a deployment that looks fine.
+ */
+export function checkBodySizeLimit(env) {
+    const base = { id: 'body-size-limit', label: 'Upload size limit' };
+    const raw = env.BODY_SIZE_LIMIT;
+    const requestCap = Number(env.COMPUTE_REQUEST_MAX_BYTES) || COMPUTE_REQUEST_DEFAULT_BYTES;
+    if (raw == null || raw === '') {
+        return {
+            ...base,
+            verdict: 'fail',
+            summary: 'BODY_SIZE_LIMIT is unset — adapter-node falls back to 512 KB, so uploads over ' +
+                'that fail with an opaque 413 no app log records.',
+            remediation: `Set BODY_SIZE_LIMIT to at least ${asMb(requestCap)} (the compute request cap) and restart.`
+        };
+    }
+    const bytes = parseBodySizeLimit(raw);
+    if (bytes === null) {
+        return {
+            ...base,
+            verdict: 'fail',
+            summary: `BODY_SIZE_LIMIT="${raw}" — adapter-node cannot parse this and throws on boot.`,
+            remediation: 'Use a byte count or a single K/M/G suffix, e.g. "256M".'
+        };
+    }
+    if (bytes < requestCap) {
+        return {
+            ...base,
+            verdict: 'warn',
+            summary: `BODY_SIZE_LIMIT=${raw} (${asMb(bytes)}) is below COMPUTE_REQUEST_MAX_BYTES ` +
+                `(${asMb(requestCap)}) — the global cap rejects first, making the compute cap dead config.`,
+            remediation: `Raise BODY_SIZE_LIMIT to at least ${asMb(requestCap)} and restart.`
+        };
+    }
+    return {
+        ...base,
+        verdict: 'ok',
+        summary: `BODY_SIZE_LIMIT=${raw} clears the compute request cap.`
+    };
+}
+/**
+ * `ADDRESS_HEADER` / `XFF_DEPTH` are read by adapter-node, not by Selva, and
+ * unset they are invisible: nothing fails, nothing logs, and the deployment
+ * looks healthy.
+ *
+ * What actually happens is that `getClientAddress()` returns the socket peer,
+ * which behind a reverse proxy is the proxy — `127.0.0.1` for every request
+ * from every user. Login rate limiting keys on that, so the whole instance
+ * shares one bucket: five failed logins from anywhere return 429 to everyone,
+ * and only a *successful* login clears a bucket, which nobody can then reach.
+ *
+ * `ORIGIN` is the proxy tell. It is only needed when the app is served under a
+ * public URL it can't derive from its own socket, so its presence means a proxy
+ * is terminating requests. Without it we say nothing: on a directly-reachable
+ * app these settings are a footgun, since `X-Forwarded-For` is client-supplied
+ * and anyone could then pick their own rate-limit bucket.
+ */
+export function checkClientAddress(env) {
+    const base = { id: 'client-address', label: 'Client IP behind proxy' };
+    const header = env.ADDRESS_HEADER;
+    const depth = env.XFF_DEPTH;
+    if (!env.ORIGIN) {
+        return {
+            ...base,
+            verdict: 'ok',
+            summary: 'ADDRESS_HEADER is not needed — ORIGIN is unset, so no reverse proxy is in play.'
+        };
+    }
+    if (!header) {
+        return {
+            ...base,
+            verdict: 'fail',
+            summary: 'ADDRESS_HEADER is unset while ORIGIN is set — every request looks like it came from ' +
+                'the proxy, so all users share ONE login rate-limit bucket. Five failed logins from ' +
+                'anyone locks out the whole instance for 15 minutes.',
+            remediation: 'Set ADDRESS_HEADER=X-Forwarded-For and XFF_DEPTH=<number of proxies>, then restart. ' +
+                'To count your proxies, see docs/self-hosting/deployment/reverse-proxy.md.'
+        };
+    }
+    if (header.toLowerCase() === 'x-forwarded-for' && !depth) {
+        return {
+            ...base,
+            verdict: 'warn',
+            summary: `ADDRESS_HEADER=${header} but XFF_DEPTH is unset. X-Forwarded-For is a ` +
+                'client-appendable list, so a caller can prepend fake entries — adapter-node needs ' +
+                'the proxy count to know which entry is real.',
+            remediation: 'Set XFF_DEPTH=1 for a single reverse proxy, 2 if a CDN or load balancer sits in ' +
+                'front of it. Unsure? docs/self-hosting/deployment/reverse-proxy.md shows how to ' +
+                'read the header the app actually receives.'
+        };
+    }
+    if (depth !== undefined && !/^[1-9][0-9]*$/.test(depth)) {
+        return {
+            ...base,
+            verdict: 'fail',
+            summary: `XFF_DEPTH="${depth}" is not a positive integer.`,
+            remediation: 'It counts proxies from the outside in — use 1 for a single reverse proxy.'
+        };
+    }
+    return {
+        ...base,
+        verdict: 'ok',
+        summary: `ADDRESS_HEADER=${header}${depth ? ` (XFF_DEPTH=${depth})` : ''}.`
+    };
+}
+/** Every deployment-config rule, in report order. */
+export function checkDeploymentConfig(env) {
+    return [checkClientAddress(env), checkBodySizeLimit(env)];
+}
+//# sourceMappingURL=deploymentConfig.js.map

package/dist/ops/deploymentConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploymentConfig.js","sourceRoot":"","sources":["../../src/ops/deploymentConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA4BH;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAA8B;IAChE,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,KAAK,GAA2B,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,GAAG,IAAI,EAAE,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;IACzF,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC;IACjF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,MAAM,6BAA6B,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAExD,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAkB;IACpD,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IACnE,MAAM,GAAG,GAAG,GAAG,CAAC,eAAe,CAAC;IAChC,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,IAAI,6BAA6B,CAAC;IAE1F,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAC/B,OAAO;YACN,GAAG,IAAI;YACP,OAAO,EAAE,MAAM;YACf,OAAO,EACN,gFAAgF;gBAChF,kDAAkD;YACnD,WAAW,EAAE,mCAAmC,IAAI,CAAC,UAAU,CAAC,yCAAyC;SACzG,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACN,GAAG,IAAI;YACP,OAAO,EAAE,MAAM;YACf,OAAO,EAAE,oBAAoB,GAAG,wDAAwD;YACxF,WAAW,EAAE,yDAAyD;SACtE,CAAC;IACH,CAAC;IAED,IAAI,KAAK,GAAG,UAAU,EAAE,CAAC;QACxB,OAAO;YACN,GAAG,IAAI;YACP,OAAO,EAAE,MAAM;YACf,OAAO,EACN,mBAAmB,GAAG,KAAK,IAAI,CAAC,KAAK,CAAC,uCAAuC;gBAC7E,IAAI,IAAI,CAAC,UAAU,CAAC,uEAAuE;YAC5F,WAAW,EAAE,qCAAqC,IAAI,CAAC,UAAU,CAAC,eAAe;SACjF,CAAC;IACH,CAAC;IAED,OAAO;QACN,GAAG,IAAI;QACP,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,mBAAmB,GAAG,kCAAkC;KACjE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAkB;IACpD,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;IACvE,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,CAAC;IAClC,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC;IAE5B,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO;YACN,GAAG,IAAI;YACP,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,iFAAiF;SAC1F,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO;YACN,GAAG,IAAI;YACP,OAAO,EAAE,MAAM;YACf,OAAO,EACN,sFAAsF;gBACtF,qFAAqF;gBACrF,qDAAqD;YACtD,WAAW,EACV,sFAAsF;gBACtF,2EAA2E;SAC5E,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,iBAAiB,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1D,OAAO;YACN,GAAG,IAAI;YACP,OAAO,EAAE,MAAM;YACf,OAAO,EACN,kBAAkB,MAAM,gDAAgD;gBACxE,oFAAoF;gBACpF,8CAA8C;YAC/C,WAAW,EACV,kFAAkF;gBAClF,kFAAkF;gBAClF,4CAA4C;SAC7C,CAAC;IACH,CAAC;IAED,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,OAAO;YACN,GAAG,IAAI;YACP,OAAO,EAAE,MAAM;YACf,OAAO,EAAE,cAAc,KAAK,8BAA8B;YAC1D,WAAW,EAAE,2EAA2E;SACxF,CAAC;IACH,CAAC;IAED,OAAO;QACN,GAAG,IAAI;QACP,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,kBAAkB,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,eAAe,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;KAC3E,CAAC;AACH,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,qBAAqB,CAAC,GAAkB;IACvD,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/ops/index.d.ts

@@ -1,2 +1,3 @@
 export { parseSemver, isNewer, compareCore, satisfiesRange, type ReleaseChannel } from './semver.js';
+export { checkClientAddress, checkBodySizeLimit, checkDeploymentConfig, parseBodySizeLimit, type ConfigFinding, type ConfigVerdict, type DeploymentEnv } from './deploymentConfig.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/ops/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ops/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACN,WAAW,EACX,OAAO,EACP,WAAW,EACX,cAAc,EACd,KAAK,cAAc,EACnB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ops/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACN,WAAW,EACX,OAAO,EACP,WAAW,EACX,cAAc,EACd,KAAK,cAAc,EACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACN,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,MAAM,uBAAuB,CAAC"}

package/dist/ops/index.js

@@ -1,4 +1,5 @@
-// Deployment/ops helpers — channel-aware semver comparison and engines.node
-// range checks.
+// Deployment/ops helpers — channel-aware semver comparison, engines.node range
+// checks, and the reverse-proxy/body-limit configuration rules.
 export { parseSemver, isNewer, compareCore, satisfiesRange } from './semver.js';
+export { checkClientAddress, checkBodySizeLimit, checkDeploymentConfig, parseBodySizeLimit } from './deploymentConfig.js';
 //# sourceMappingURL=index.js.map

package/dist/ops/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/ops/index.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,gBAAgB;AAEhB,OAAO,EACN,WAAW,EACX,OAAO,EACP,WAAW,EACX,cAAc,EAEd,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/ops/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,gEAAgE;AAEhE,OAAO,EACN,WAAW,EACX,OAAO,EACP,WAAW,EACX,cAAc,EAEd,MAAM,aAAa,CAAC;AAErB,OAAO,EACN,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAIlB,MAAM,uBAAuB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@selvajs/server",
-  "version": "1.0.4",
+  "version": "1.2.0",
   "description": "Transport-agnostic server building blocks for apps built on the Selva engine (limits, rate limiting, SSRF guard, remote-definition fetch, definition service + render loader); the solve core lives in @selvajs/solve/server",
   "license": "MIT",
   "author": "VektorNode",
@@ -70,6 +70,11 @@
       "selva-source": "./src/ops/index.ts",
       "types": "./dist/ops/index.d.ts",
       "import": "./dist/ops/index.js"
+    },
+    "./notifications": {
+      "selva-source": "./src/notifications/index.ts",
+      "types": "./dist/notifications/index.d.ts",
+      "import": "./dist/notifications/index.js"
     }
   },
   "files": [
@@ -80,23 +85,29 @@
   ],
   "dependencies": {
     "@selvajs/compute": "^4.0.2",
-    "@selvajs/platform": "^0.19.0",
-    "@selvajs/schemas": "^5.0.0"
+    "@selvajs/platform": "^0.20.0",
+    "@selvajs/schemas": "^5.0.1"
   },
   "peerDependencies": {
     "@sentry/node": ">=8",
+    "nodemailer": ">=7",
     "pino": ">=9"
   },
   "peerDependenciesMeta": {
     "@sentry/node": {
       "optional": true
     },
+    "nodemailer": {
+      "optional": true
+    },
     "pino": {
       "optional": true
     }
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
+    "@types/nodemailer": "^8.0.1",
+    "nodemailer": "^9.0.5",
     "typescript": "~6.0.3",
     "vitest": "^4.1.10",
     "@selvajs/config": "0.0.4"
@@ -106,6 +117,8 @@
     "dev": "tsc --watch",
     "type-check": "tsc --noEmit",
     "test": "vitest run",
-    "test:watch": "vitest"
+    "test:watch": "vitest",
+    "lint": "eslint .",
+    "lint:types": "eslint . --config eslint.typed.config.js"
   }
 }