@vesk/compiler 0.1.1 → 0.2.8

package/dist/server-utils.js

@@ -134,31 +134,264 @@ export function isStatic(body) {
 }
 export function escapeHtml(str) {
     return str
-        .replace(/&/g, '&')
-        .replace(/</g, '&lt;')
-        .replace(/>/g, '&gt;')
-        .replace(/"/g, '&quot;')
-        .replace(/'/g, '&#39;');
-}
-const SECRET_PATTERNS = [
-    { pattern: /(sk_live_[a-zA-Z0-9]{20,})/g, replace: 'sk_live_***' },
-    { pattern: /(sk_test_[a-zA-Z0-9]{20,})/g, replace: 'sk_test_***' },
-    { pattern: /(ghp_[a-zA-Z0-9]{36,})/g, replace: 'ghp_***' },
-    { pattern: /(gho_[a-zA-Z0-9]{36,})/g, replace: 'gho_***' },
-    { pattern: /(xox[bpsra]-[a-zA-Z0-9-]{20,})/g, replace: 'xox-***' },
-    { pattern: /(Bearer\s+)[a-zA-Z0-9._-]{20,}/g, replace: '$1***' },
-    { pattern: /(Authorization:\s*Basic\s+)[a-zA-Z0-9+/=]{20,}/gi, replace: '$1***' },
-    { pattern: /(-----BEGIN\s+(?:RSA\s+)?PRIVATE KEY-----)[\s\S]*?(-----END\s+(?:RSA\s+)?PRIVATE KEY-----)/g, replace: '$1***$2' },
-    { pattern: /(['"]?(?:api[_-]?key|secret|password|token|auth|private[_-]?key|access[_-]?key|session[_-]?secret)[, }\]'"*]*[:=]\s*['"]?)(?!.*\*\*\*)([^'"\s,}\]]{8,})(['"]?)/gi, replace: '$1***$3' },
+        .split('&').join('&amp;')
+        .split('<').join('&lt;')
+        .split('>').join('&gt;')
+        .split('"').join('&quot;')
+        .split("'").join('&#39;');
+}
+/** Escapes double quotes for embedding text inside a double-quoted attribute. */
+export function quoteAttr(str) {
+    return str.split('"').join('&quot;');
+}
+/**
+ * Makes JSON output safe to embed inside an inline <script> block.
+ * Escapes `<` (breaks out of script context via `</script>`), line
+ * separators U+2028/U+2029 (valid JSON but invalid JS string literals).
+ */
+export function safeJsonForScript(json) {
+    return json
+        .split('<').join('\\u003c')
+        .split('\u2028').join('\\u2028')
+        .split('\u2029').join('\\u2029');
+}
+/** Cryptographically strong random hex token (WebCrypto CSPRNG). */
+export function randomToken(bytes = 24) {
+    const buf = new Uint8Array(bytes);
+    crypto.getRandomValues(buf);
+    let hex = '';
+    for (const b of buf)
+        hex += b.toString(16).padStart(2, '0');
+    return hex;
+}
+/** Default request-body cap (bytes) for servers and action/API handlers. */
+export const DEFAULT_MAX_BODY_BYTES = 1024 * 1024;
+function isAlnum(code) {
+    return (code >= 48 && code <= 57) || (code >= 65 && code <= 90) || (code >= 97 && code <= 122);
+}
+/** Token body charset: alnum plus base64url/JWT punctuation. */
+function isTokenChar(code) {
+    return isAlnum(code) || code === 46 /* . */ || code === 95 /* _ */ || code === 45 /* - */ || code === 43 /* + */ || code === 47 /* / */ || code === 61 /* = */;
+}
+const TOKEN_PREFIXES = [
+    {
+        match: (s, i) => {
+            if (!s.startsWith('sk_', i))
+                return null;
+            if (s.startsWith('sk_live_', i))
+                return 'sk_live_';
+            if (s.startsWith('sk_test_', i))
+                return 'sk_test_';
+            return null;
+        },
+        emit: (keep) => keep + '***',
+        minLen: 20,
+    },
+    {
+        match: (s, i) => {
+            if (s.startsWith('ghp_', i))
+                return 'ghp_';
+            if (s.startsWith('gho_', i))
+                return 'gho_';
+            return null;
+        },
+        emit: (keep) => keep + '***',
+        minLen: 36,
+    },
+    {
+        match: (s, i) => {
+            if (!s.startsWith('xox', i) || i + 4 >= s.length)
+                return null;
+            const c = s[i + 3];
+            if (c !== 'b' && c !== 'p' && c !== 's' && c !== 'r' && c !== 'a')
+                return null;
+            if (s[i + 4] !== '-')
+                return null;
+            return 'xox' + c + '-';
+        },
+        emit: () => 'xox-***',
+        minLen: 20,
+    },
+];
+const LOWER = (c) => c >= 'A' && c <= 'Z' ? String.fromCharCode(c.charCodeAt(0) + 32) : c;
+function ciStartsWith(s, word, i) {
+    if (i + word.length > s.length)
+        return false;
+    for (let j = 0; j < word.length; j++) {
+        if (LOWER(s[i + j]) !== word[j])
+            return false;
+    }
+    return true;
+}
+/**
+ * Replaces known secret token shapes with `prefix***`. Char-scan pass over
+ * the whole string (no regex). Returns a new string.
+ */
+function scanSecretTokens(str) {
+    let out = '';
+    let i = 0;
+    while (i < str.length) {
+        // PEM private key blocks: BEGIN header kept, body collapsed, END kept.
+        if (str.startsWith('-----BEGIN ', i)) {
+            let hdrEnd = -1;
+            for (let j = i + 11; j + 5 <= str.length; j++) {
+                if (str.startsWith('-----', j)) {
+                    hdrEnd = j;
+                    break;
+                }
+            }
+            const endIdx = str.indexOf('-----END ', i + 11);
+            if (hdrEnd !== -1 && endIdx !== -1 && endIdx > hdrEnd) {
+                let closeIdx = -1;
+                for (let j = endIdx + 9; j + 5 <= str.length; j++) {
+                    if (str.startsWith('-----', j)) {
+                        closeIdx = j;
+                        break;
+                    }
+                }
+                if (closeIdx !== -1) {
+                    out += str.slice(i, hdrEnd + 5) + '***' + str.slice(endIdx, closeIdx + 5);
+                    i = closeIdx + 5;
+                    continue;
+                }
+            }
+        }
+        let matched = false;
+        for (const tp of TOKEN_PREFIXES) {
+            const keep = tp.match(str, i);
+            if (keep !== null) {
+                let j = i + keep.length;
+                while (j < str.length && isTokenChar(str.charCodeAt(j)))
+                    j++;
+                if (j - (i + keep.length) >= tp.minLen) {
+                    out += tp.emit(keep);
+                    i = j;
+                    matched = true;
+                }
+                break;
+            }
+        }
+        if (matched)
+            continue;
+        // Bearer <token> / Authorization: Basic <token>
+        const prevIsWord = i > 0 && isAlnum(str.charCodeAt(i - 1));
+        if (!prevIsWord && ciStartsWith(str, 'bearer', i)) {
+            let j = i + 6;
+            let spaces = 0;
+            while (j < str.length && (str[j] === ' ' || str[j] === '\t')) {
+                j++;
+                spaces++;
+            }
+            if (spaces > 0) {
+                let k = j;
+                while (k < str.length && isTokenChar(str.charCodeAt(k)))
+                    k++;
+                if (k - j >= 20) {
+                    out += 'Bearer ***';
+                    i = k;
+                    continue;
+                }
+            }
+        }
+        if (!prevIsWord && ciStartsWith(str, 'basic', i)) {
+            let j = i + 5;
+            let spaces = 0;
+            while (j < str.length && (str[j] === ' ' || str[j] === '\t')) {
+                j++;
+                spaces++;
+            }
+            if (spaces > 0) {
+                let k = j;
+                while (k < str.length && isTokenChar(str.charCodeAt(k)))
+                    k++;
+                if (k - j >= 20) {
+                    out += 'Basic ***';
+                    i = k;
+                    continue;
+                }
+            }
+        }
+        out += str[i];
+        i++;
+    }
+    return out;
+}
+const SECRET_KEY_NAMES = [
+    'api_key', 'api-key', 'apikey',
+    'secret', 'password', 'token', 'auth',
+    'private_key', 'private-key',
+    'access_key', 'access-key',
+    'session_secret',
 ];
+function lowerRun(s) {
+    let out = '';
+    for (const c of s)
+        out += LOWER(c);
+    return out;
+}
+function isValueStopChar(c) {
+    return c === "'" || c === '"' || c === ' ' || c === '\t' || c === '\n' || c === '\r'
+        || c === ',' || c === '}' || c === ']';
+}
+/**
+ * Second redaction pass: `<secret-ish key>` followed by `:` or `=` gets its
+ * value collapsed to `***` unless the value already contains `***` (already
+ * handled by the token pass).
+ */
+function scanKeyValueSecrets(str) {
+    let out = '';
+    let i = 0;
+    while (i < str.length) {
+        let keyHit = null;
+        if (i === 0 || !(isAlnum(str.charCodeAt(i - 1)) || str[i - 1] === '_' || str[i - 1] === '-')) {
+            const run = lowerRun(str.slice(i, i + 16));
+            for (const name of SECRET_KEY_NAMES) {
+                if (run.startsWith(name)) {
+                    keyHit = { nameLen: name.length };
+                    break;
+                }
+            }
+        }
+        if (keyHit) {
+            let j = i + keyHit.nameLen;
+            // filler chars between key and separator: , space } ] ' " *
+            while (j < str.length && (str[j] === ',' || str[j] === ' ' || str[j] === '}' || str[j] === ']' || str[j] === "'" || str[j] === '"' || str[j] === '*'))
+                j++;
+            if (str[j] === ':' || str[j] === '=') {
+                j++; // separator
+                while (j < str.length && (str[j] === ' ' || str[j] === '\t'))
+                    j++;
+                let openQuote = '';
+                if (str[j] === "'" || str[j] === '"') {
+                    openQuote = str[j];
+                    j++;
+                }
+                let k = j;
+                while (k < str.length && !isValueStopChar(str[k]))
+                    k++;
+                const value = str.slice(j, k);
+                if (k - j >= 8 && !value.includes('***')) {
+                    out += str.slice(i, j) + '***';
+                    if (openQuote && k < str.length && str[k] === openQuote) {
+                        out += openQuote;
+                        k++;
+                    }
+                    else if (openQuote)
+                        out += openQuote;
+                    i = k;
+                    continue;
+                }
+            }
+        }
+        out += str[i];
+        i++;
+    }
+    return out;
+}
 export function redactLog(str) {
     if (!str || typeof str !== 'string')
         return str;
-    let result = str;
-    for (const { pattern, replace } of SECRET_PATTERNS) {
-        result = result.replace(pattern, replace);
-    }
-    return result;
+    return scanKeyValueSecrets(scanSecretTokens(str));
 }
 const _origConsoleError = console.error;
 const _origConsoleLog = console.log;
@@ -179,24 +412,116 @@ export function raw(value) {
         return '';
     return String(value);
 }
+// ── SHA-256 / HMAC (pure JS, sync — works in Node and browsers) ───
+const SHA_K = new Uint32Array([
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+]);
+function sha256Bytes(msg) {
+    const len = msg.length;
+    const paddedLen = (((len + 9) + 63) >> 6) << 6;
+    const buf = new Uint8Array(paddedLen);
+    buf.set(msg);
+    buf[len] = 0x80;
+    const dv = new DataView(buf.buffer);
+    const bitLen = len * 8;
+    dv.setUint32(paddedLen - 8, Math.floor(bitLen / 0x100000000));
+    dv.setUint32(paddedLen - 4, bitLen >>> 0);
+    const rr = (x, n) => (x >>> n) | (x << (32 - n));
+    let h0 = 0x6a09e667, h1 = 0xbb67ae85, h2 = 0x3c6ef372, h3 = 0xa54ff53a;
+    let h4 = 0x510e527f, h5 = 0x9b05688c, h6 = 0x1f83d9ab, h7 = 0x5be0cd19;
+    const w = new Uint32Array(64);
+    for (let off = 0; off < paddedLen; off += 64) {
+        for (let j = 0; j < 16; j++)
+            w[j] = dv.getUint32(off + j * 4);
+        for (let j = 16; j < 64; j++) {
+            const s0 = rr(w[j - 15], 7) ^ rr(w[j - 15], 18) ^ (w[j - 15] >>> 3);
+            const s1 = rr(w[j - 2], 17) ^ rr(w[j - 2], 19) ^ (w[j - 2] >>> 10);
+            w[j] = (w[j - 16] + s0 + w[j - 7] + s1) >>> 0;
+        }
+        let a = h0, b = h1, c = h2, d = h3, e = h4, f = h5, g = h6, h = h7;
+        for (let j = 0; j < 64; j++) {
+            const S1 = rr(e, 6) ^ rr(e, 11) ^ rr(e, 25);
+            const ch = (e & f) ^ (~e & g);
+            const t1 = (h + S1 + ch + SHA_K[j] + w[j]) >>> 0;
+            const S0 = rr(a, 2) ^ rr(a, 13) ^ rr(a, 22);
+            const maj = (a & b) ^ (a & c) ^ (b & c);
+            const t2 = (S0 + maj) >>> 0;
+            h = g;
+            g = f;
+            f = e;
+            e = (d + t1) >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (t1 + t2) >>> 0;
+        }
+        h0 = (h0 + a) >>> 0;
+        h1 = (h1 + b) >>> 0;
+        h2 = (h2 + c) >>> 0;
+        h3 = (h3 + d) >>> 0;
+        h4 = (h4 + e) >>> 0;
+        h5 = (h5 + f) >>> 0;
+        h6 = (h6 + g) >>> 0;
+        h7 = (h7 + h) >>> 0;
+    }
+    const out = new Uint8Array(32);
+    const odv = new DataView(out.buffer);
+    odv.setUint32(0, h0);
+    odv.setUint32(4, h1);
+    odv.setUint32(8, h2);
+    odv.setUint32(12, h3);
+    odv.setUint32(16, h4);
+    odv.setUint32(20, h5);
+    odv.setUint32(24, h6);
+    odv.setUint32(28, h7);
+    return out;
+}
+function concatBytes(a, b) {
+    const out = new Uint8Array(a.length + b.length);
+    out.set(a);
+    out.set(b, a.length);
+    return out;
+}
+function hmacSha256(keyBytes, message) {
+    const key = keyBytes.length > 64 ? sha256Bytes(keyBytes) : keyBytes;
+    const ipad = new Uint8Array(64);
+    const opad = new Uint8Array(64);
+    ipad.fill(0x36);
+    opad.fill(0x5c);
+    for (let i = 0; i < key.length; i++) {
+        ipad[i] ^= key[i];
+        opad[i] ^= key[i];
+    }
+    return sha256Bytes(concatBytes(opad, sha256Bytes(concatBytes(ipad, message))));
+}
+function toHex(bytes) {
+    let hex = '';
+    for (const b of bytes)
+        hex += b.toString(16).padStart(2, '0');
+    return hex;
+}
+function utf8(s) {
+    return new TextEncoder().encode(s);
+}
 const __csrfSecrets = new Map();
 function csrfSecret(host) {
     if (!host)
         host = 'localhost';
     if (!__csrfSecrets.has(host)) {
-        __csrfSecrets.set(host, Math.random().toString(36).slice(2) + Math.random().toString(36).slice(2));
+        __csrfSecrets.set(host, randomToken(32));
     }
     return __csrfSecrets.get(host);
 }
-function csrfHmac(value, secret) {
-    let h = 0;
-    for (let i = 0; i < value.length; i++) {
-        h = ((h << 5) - h + value.charCodeAt(i)) | 0;
-    }
-    for (let i = 0; i < secret.length; i++) {
-        h = ((h << 5) - h + secret.charCodeAt(i)) | 0;
-    }
-    return (h >>> 0).toString(36);
+/** HMAC-SHA256 over `value` keyed by `secret`, hex-encoded. */
+export function csrfHmac(value, secret) {
+    return toHex(hmacSha256(utf8(secret), utf8(value)));
 }
 export function csrfToken(sessionId, host) {
     const secret = csrfSecret(host);
@@ -230,12 +555,94 @@ export function csrfGuard(request, host) {
         throw new Error('CSRF validation failed');
     }
 }
+// ── Same-origin enforcement (default CSRF defense for actions/API) ──
+/** Reads a header from either a plain record or a Headers-like object. */
+function readHeader(headers, name) {
+    if (!headers)
+        return '';
+    const h = headers;
+    if (typeof h.get === 'function')
+        return String(h.get(name) ?? '');
+    return String(h[name] ?? '');
+}
+/** Extracts the authority (host[:port]) part of an absolute URL. */
+export function urlAuthority(url) {
+    const schemeIdx = url.indexOf('://');
+    if (schemeIdx === -1)
+        return '';
+    let rest = url.slice(schemeIdx + 3);
+    let end = rest.length;
+    for (let i = 0; i < rest.length; i++) {
+        const c = rest[i];
+        if (c === '/' || c === '?' || c === '#') {
+            end = i;
+            break;
+        }
+    }
+    rest = rest.slice(0, end);
+    const at = rest.lastIndexOf('@');
+    if (at !== -1)
+        rest = rest.slice(at + 1);
+    return rest.toLowerCase();
+}
+function hostName(authority) {
+    const colon = authority.lastIndexOf(':');
+    if (colon === -1)
+        return authority;
+    // bare IPv6 without brackets has multiple colons — keep whole authority
+    let isIpv6 = false;
+    for (let i = 0; i < authority.length; i++) {
+        if (authority[i] === ':' && i !== colon) {
+            isIpv6 = true;
+            break;
+        }
+    }
+    return isIpv6 ? authority : authority.slice(0, colon);
+}
+const UNSAFE_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+/**
+ * Default CSRF defense: unsafe methods must present an Origin or Referer
+ * whose authority matches the request Host. Browsers always attach Origin
+ * to cross-site POSTs, so mismatches are blocked; non-browser clients that
+ * send no Origin/Referer are allowed (they cannot be CSRF'd).
+ * Throws a 403-status error on mismatch.
+ */
+export function assertSameOrigin(request) {
+    if (!request || typeof request !== 'object')
+        return;
+    const method = String(request.method || 'GET').toUpperCase();
+    if (!UNSAFE_METHODS.has(method))
+        return;
+    const headers = request.headers;
+    const origin = readHeader(headers, 'origin');
+    const source = origin || readHeader(headers, 'referer');
+    if (!source)
+        return; // non-browser client — no CSRF risk
+    const hostHeader = readHeader(headers, 'host').toLowerCase().trim();
+    if (!hostHeader)
+        return;
+    const sourceAuthority = urlAuthority(source);
+    if (sourceAuthority === hostHeader)
+        return;
+    // Tolerate one-sided port presence (e.g. proxy strips port from Host),
+    // but never a different hostname.
+    const srcHost = hostName(sourceAuthority);
+    if (srcHost && srcHost === hostName(hostHeader)) {
+        const srcHasPort = sourceAuthority.length > srcHost.length;
+        const dstHasPort = hostHeader.length > hostName(hostHeader).length;
+        if (srcHasPort !== dstHasPort)
+            return;
+    }
+    const err = new Error('Cross-origin request blocked');
+    err.status = 403;
+    throw err;
+}
 const __cookieSecrets = new Map();
 function cookieSecret(host) {
     if (!host)
         host = 'localhost';
     if (!__cookieSecrets.has(host)) {
-        __cookieSecrets.set(host, Math.random().toString(36).slice(2) + Math.random().toString(36).slice(2));
+        __cookieSecrets.set(host, randomToken(32));
     }
     return __cookieSecrets.get(host);
 }
@@ -245,8 +652,12 @@ export async function signCookie(name, value, host) {
     const enc = new TextEncoder();
     const key = await crypto.subtle.importKey('raw', enc.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
     const sig = await crypto.subtle.sign('HMAC', key, enc.encode(payload));
-    const sigB64 = btoa(String.fromCharCode(...new Uint8Array(sig))).replace(/=+$/, '');
-    return `${value}.${sigB64}`;
+    const sigChars = btoa(String.fromCharCode(...new Uint8Array(sig)));
+    // strip trailing '=' padding without regex
+    let sigEnd = sigChars.length;
+    while (sigEnd > 0 && sigChars[sigEnd - 1] === '=')
+        sigEnd--;
+    return `${value}.${sigChars.slice(0, sigEnd)}`;
 }
 export async function unsignCookie(name, signedValue, host) {
     if (!signedValue || typeof signedValue !== 'string')
@@ -316,7 +727,7 @@ export function securityHeaders(config = {}) {
 export function corsHeaders(security = {}, requestOrigin = '', host = '') {
     if (!requestOrigin)
         return {};
-    const originHost = (requestOrigin || '').replace(/^https?:\/\//, '').split('/')[0].split(':')[0];
+    const originHost = stripScheme(requestOrigin).split('/')[0].split(':')[0];
     const localHost = (host || '').split(':')[0];
     if (originHost && localHost && originHost === localHost) {
         return {};
@@ -330,14 +741,24 @@ export function corsHeaders(security = {}, requestOrigin = '', host = '') {
         : allowedOrigins.includes(requestOrigin) ? requestOrigin : null;
     if (!origin)
         return {};
+    // Credentials are opt-in: `*` origins can never carry credentials, and
+    // defaulting this on silently exposed credentialed responses cross-origin.
+    const allowCredentials = cors.credentials === true && origin !== '*';
     return {
         'Access-Control-Allow-Origin': origin,
         'Access-Control-Allow-Methods': cors.methods || 'GET,POST,PUT,DELETE,PATCH,OPTIONS',
         'Access-Control-Allow-Headers': cors.headers || 'Content-Type,Authorization,X-CSRF-Token',
-        ...(cors.credentials !== false ? { 'Access-Control-Allow-Credentials': 'true' } : {}),
+        ...(allowCredentials ? { 'Access-Control-Allow-Credentials': 'true' } : {}),
         'Access-Control-Max-Age': String(cors.maxAge || 86400),
     };
 }
+function stripScheme(url) {
+    if (url.startsWith('https://'))
+        return url.slice(8);
+    if (url.startsWith('http://'))
+        return url.slice(7);
+    return url;
+}
 export function corsPreflight(request, security) {
     if ((request.method || 'GET').toUpperCase() !== 'OPTIONS')
         return false;
@@ -394,6 +815,8 @@ export function createRateLimiter(options = {}) {
         cleanupInterval.unref();
     function getClientIp(request) {
         const headers = request?.headers;
+        if (!options.trustProxy)
+            return 'unknown';
         const forwarded = headers?.['x-forwarded-for'];
         if (forwarded) {
             const ip = (typeof forwarded === 'string' ? forwarded.split(',')[0] : forwarded[0]).trim();
@@ -446,24 +869,27 @@ export function createRateLimiter(options = {}) {
         },
     };
 }
+/**
+ * Resolves the client IP. Proxy headers (`x-forwarded-for`, `x-real-ip`) are
+ * only honored when `trustProxy` is explicitly enabled — otherwise any
+ * client could spoof its identity (and defeat rate limiting) with a header.
+ */
 export function getClientIp(request, trustProxy = false) {
+    if (!trustProxy)
+        return 'unknown';
     const headers = (request?.headers || {});
-    if (trustProxy) {
-        const forwarded = headers['x-forwarded-for'];
-        if (forwarded) {
-            const ips = (typeof forwarded === 'string' ? forwarded : String(forwarded)).split(',').map(s => s.trim());
-            return ips[0] || 'unknown';
-        }
-        const realIp = headers['x-real-ip'];
-        if (realIp)
-            return typeof realIp === 'string' ? realIp : String(realIp);
-    }
-    if (headers['x-forwarded-for']) {
-        const fwd = headers['x-forwarded-for'];
-        return typeof fwd === 'string' ? fwd.split(',')[0].trim() : fwd[0];
+    const forwarded = headers['x-forwarded-for'];
+    if (forwarded) {
+        const ips = (typeof forwarded === 'string' ? forwarded : String(forwarded)).split(',').map(s => s.trim());
+        if (ips[0])
+            return ips[0];
     }
-    if (headers['x-real-ip'])
-        return typeof headers['x-real-ip'] === 'string' ? headers['x-real-ip'] : String(headers['x-real-ip']);
+    const realIp = headers['x-real-ip'];
+    if (realIp)
+        return typeof realIp === 'string' ? realIp : String(realIp);
+    const cfIp = headers['cf-connecting-ip'];
+    if (cfIp)
+        return typeof cfIp === 'string' ? cfIp : String(cfIp);
     return 'unknown';
 }
 export function getClientProtocol(request, trustProxy = false) {
@@ -472,7 +898,7 @@ export function getClientProtocol(request, trustProxy = false) {
         if (proto)
             return (typeof proto === 'string' ? proto.split(',')[0] : String(proto)).trim();
     }
-    return request?.headers?.['x-forwarded-proto'] ? 'https' : 'http';
+    return 'http';
 }
 export function applyTrustProxy(ctx, trustProxy) {
     if (!ctx || !trustProxy)

package/dist/ssr-store.d.ts

@@ -1,4 +1,4 @@
-import { type SsrDataSink } from '@vesk/runtime/src/index-server';
+import type { SsrDataSink } from '@vesk/runtime/src/resource';
 export declare function withSsrStore<T>(fn: () => T): T;
 export declare const ssrSink: SsrDataSink;
 //# sourceMappingURL=ssr-store.d.ts.map

package/dist/ssr-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssr-store.d.ts","sourceRoot":"","sources":["../src/ssr-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,KAAK,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAI9E,wBAAgB,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAI9C;AAED,eAAO,MAAM,OAAO,EAAE,WAgBrB,CAAC"}
+{"version":3,"file":"ssr-store.d.ts","sourceRoot":"","sources":["../src/ssr-store.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAI9D,wBAAgB,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAI9C;AAED,eAAO,MAAM,OAAO,EAAE,WAgBrB,CAAC"}

package/dist/ssr-store.js

@@ -1,4 +1,7 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
+// Import the type from its defining module (not the barrel): on a fresh
+// checkout the compiler typechecks BEFORE @vesk/runtime's dist exists, and
+// resolving types through the barrel then fails.
 import { setSsrSink } from '@vesk/runtime/src/index-server';
 const storage = new AsyncLocalStorage();
 export function withSsrStore(fn) {