@waiaas/daemon 2.11.0-rc.8 → 2.11.0

package/README.md

@@ -133,7 +133,7 @@ waiaas quickset                  # Creates wallets + sessions automatically
 waiaas set-master                # (Later) Harden password, then delete recovery.key
 ```
 
-The `--auto-provision` flag generates a cryptographically random master password and saves it to `~/.waiaas/recovery.key`. All subsequent CLI commands read it automatically. See the [Agent Self-Setup Guide](docs/guides/agent-self-setup.md) for the complete flow.
+The `--auto-provision` flag generates a cryptographically random master password and saves it to `~/.waiaas/recovery.key`. All subsequent CLI commands read it automatically. See the [Agent Self-Setup Guide](docs/agent-guides/agent-self-setup.md) for the complete flow.
 
 For manual setup with human-guided password entry, install skills and follow `waiaas-setup/SKILL.md`:
 
@@ -215,10 +215,10 @@ Enabled by default (`admin_ui = true` in config.toml).
 | [Security Model](docs/security-model.md) | Authentication, policy engine, Kill Switch, AutoStop |
 | [Deployment Guide](docs/deployment.md) | Docker, npm, configuration reference |
 | [API Reference](docs/api-reference.md) | REST API endpoints and authentication |
-| [Agent Self-Setup Guide](docs/guides/agent-self-setup.md) | Fully autonomous setup with auto-provision |
-| [Agent Skills Integration](docs/guides/agent-skills-integration.md) | Universal guide for 27+ AI agent platforms |
-| [Claude Code Integration](docs/guides/claude-code-integration.md) | Skill files + MCP server setup for Claude Code |
-| [OpenClaw Integration](docs/guides/openclaw-integration.md) | Quick setup for OpenClaw bot |
+| [Agent Self-Setup Guide](docs/agent-guides/agent-self-setup.md) | Fully autonomous setup with auto-provision |
+| [Agent Skills Integration](docs/agent-guides/agent-skills-integration.md) | Universal guide for 27+ AI agent platforms |
+| [Claude Code Integration](docs/agent-guides/claude-code-integration.md) | Skill files + MCP server setup for Claude Code |
+| [OpenClaw Integration](docs/agent-guides/openclaw-integration.md) | Quick setup for OpenClaw bot |
 | [Wallet SDK Integration](docs/wallet-sdk-integration.md) | Integration guide for wallet developers |
 | [Why WAIaaS?](docs/why-waiaas/) | Background on AI agent wallet security |
 | [Contributing](CONTRIBUTING.md) | Development setup, code style, testing, PR guidelines |

package/dist/api/middleware/address-validation.d.ts

@@ -1,38 +1,11 @@
 /**
- * validateOwnerAddress: Chain-aware address validation utility.
+ * Re-export bridge: address validation canonical location is infrastructure/auth/address-validation.ts
  *
- * Validates and normalizes owner wallet addresses for both supported chains:
- * - **Solana**: Base58-encoded 32-byte Ed25519 public key
- * - **Ethereum**: 0x-prefixed EIP-55 checksum address (strict mode)
+ * This file exists for backward compatibility with existing api/ layer imports.
+ * New code should import directly from infrastructure/auth/address-validation.js.
  *
- * **EIP-55 strict mode**: All-lowercase and all-uppercase addresses are rejected.
- * This is intentional -- we require EIP-55 checksum format for security to prevent
- * address typos from going undetected.
- *
- * The `decodeBase58` function is extracted from owner-auth.ts and exported here
- * as the canonical location. owner-auth.ts will import from here in Plan 87-02.
- *
- * @see docs/52-auth-redesign.md
- */
-import type { ChainType } from '@waiaas/core';
-export interface AddressValidationResult {
-    valid: boolean;
-    /** Normalized address (EIP-55 checksum for Ethereum, unchanged for Solana) */
-    normalized?: string;
-    /** Reason on failure */
-    error?: string;
-}
-/**
- * Decode a Base58-encoded string (Bitcoin alphabet) to a Buffer.
- * Characters not in the Base58 alphabet (0, O, I, l) cause an error.
- */
-export declare function decodeBase58(str: string): Buffer;
-/**
- * Validate and normalize an owner wallet address for the given chain.
- *
- * - Solana: Base58 32-byte Ed25519 public key
- * - Ethereum: 0x + EIP-55 checksum (strict -- all-lowercase rejected)
- * - Unknown chain: rejected
+ * @see packages/daemon/src/infrastructure/auth/address-validation.ts
  */
-export declare function validateOwnerAddress(chain: ChainType, address: string): AddressValidationResult;
+export { decodeBase58, validateOwnerAddress } from '../../infrastructure/auth/address-validation.js';
+export type { AddressValidationResult } from '../../infrastructure/auth/address-validation.js';
 //# sourceMappingURL=address-validation.d.ts.map

package/dist/api/middleware/address-validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"address-validation.d.ts","sourceRoot":"","sources":["../../../src/api/middleware/address-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAO9C,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,8EAA8E;IAC9E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wBAAwB;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AASD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAyChD;AA8DD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,uBAAuB,CAS/F"}
+{"version":3,"file":"address-validation.d.ts","sourceRoot":"","sources":["../../../src/api/middleware/address-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AACrG,YAAY,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC"}

package/dist/api/middleware/address-validation.js

@@ -1,134 +1,10 @@
 /**
- * validateOwnerAddress: Chain-aware address validation utility.
+ * Re-export bridge: address validation canonical location is infrastructure/auth/address-validation.ts
  *
- * Validates and normalizes owner wallet addresses for both supported chains:
- * - **Solana**: Base58-encoded 32-byte Ed25519 public key
- * - **Ethereum**: 0x-prefixed EIP-55 checksum address (strict mode)
+ * This file exists for backward compatibility with existing api/ layer imports.
+ * New code should import directly from infrastructure/auth/address-validation.js.
  *
- * **EIP-55 strict mode**: All-lowercase and all-uppercase addresses are rejected.
- * This is intentional -- we require EIP-55 checksum format for security to prevent
- * address typos from going undetected.
- *
- * The `decodeBase58` function is extracted from owner-auth.ts and exported here
- * as the canonical location. owner-auth.ts will import from here in Plan 87-02.
- *
- * @see docs/52-auth-redesign.md
- */
-import { isAddress, getAddress } from 'viem';
-// ---------------------------------------------------------------------------
-// Base58 decode (Bitcoin alphabet) -- canonical location
-// Extracted from owner-auth.ts for reuse across address validation.
-// ---------------------------------------------------------------------------
-const BASE58_ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
-/**
- * Decode a Base58-encoded string (Bitcoin alphabet) to a Buffer.
- * Characters not in the Base58 alphabet (0, O, I, l) cause an error.
- */
-export function decodeBase58(str) {
-    // Count leading '1's (zero bytes)
-    let zeroes = 0;
-    for (let i = 0; i < str.length && str[i] === '1'; i++) {
-        zeroes++;
-    }
-    // Allocate enough space in base256 representation
-    const size = Math.ceil((str.length * 733) / 1000) + 1;
-    const b256 = new Uint8Array(size);
-    let length = 0;
-    for (let i = zeroes; i < str.length; i++) {
-        const charIndex = BASE58_ALPHABET.indexOf(str[i]);
-        if (charIndex === -1) {
-            throw new Error(`Invalid Base58 character: ${str[i]}`);
-        }
-        let carry = charIndex;
-        let j = 0;
-        for (let k = size - 1; k >= 0 && (carry !== 0 || j < length); k--, j++) {
-            carry += 58 * (b256[k] ?? 0);
-            b256[k] = carry % 256;
-            carry = Math.floor(carry / 256);
-        }
-        length = j;
-    }
-    // Skip leading zeros in b256
-    let start = 0;
-    while (start < size && b256[start] === 0) {
-        start++;
-    }
-    // Build result with leading zero bytes
-    const result = Buffer.alloc(zeroes + (size - start));
-    for (let i = start; i < size; i++) {
-        result[zeroes + (i - start)] = b256[i];
-    }
-    return result;
-}
-// ---------------------------------------------------------------------------
-// Solana address validation
-// ---------------------------------------------------------------------------
-function validateSolanaAddress(address) {
-    try {
-        const decoded = decodeBase58(address);
-        if (decoded.length !== 32) {
-            return {
-                valid: false,
-                error: `Invalid Solana address: expected 32 bytes, got ${String(decoded.length)}`,
-            };
-        }
-        return { valid: true, normalized: address };
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        return { valid: false, error: `Invalid Solana address (Base58 decode failed): ${msg}` };
-    }
-}
-// ---------------------------------------------------------------------------
-// Ethereum address validation
-// ---------------------------------------------------------------------------
-function validateEthereumAddress(address) {
-    // Check basic format first (0x prefix + hex)
-    if (!address.startsWith('0x')) {
-        return { valid: false, error: 'Invalid Ethereum address format: missing 0x prefix' };
-    }
-    // isAddress with strict=false checks format only (0x + 40 hex chars)
-    if (!isAddress(address, { strict: false })) {
-        return { valid: false, error: 'Invalid Ethereum address format' };
-    }
-    // Require EIP-55 mixed-case checksum format.
-    // viem isAddress(strict:true) still accepts all-lowercase/all-uppercase,
-    // so we explicitly reject those -- we require the checksummed mixed-case form
-    // for security (prevents undetected typos).
-    const hex = address.slice(2);
-    if (hex === hex.toLowerCase() || hex === hex.toUpperCase()) {
-        return { valid: false, error: 'Invalid EIP-55 checksum: all-lowercase or all-uppercase addresses are not accepted, use checksummed format' };
-    }
-    // Verify the mixed-case matches EIP-55 checksum exactly
-    try {
-        const checksummed = getAddress(address);
-        if (checksummed !== address) {
-            return { valid: false, error: 'Invalid EIP-55 checksum' };
-        }
-        return { valid: true, normalized: checksummed };
-    }
-    catch {
-        return { valid: false, error: 'Invalid EIP-55 checksum' };
-    }
-}
-// ---------------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------------
-/**
- * Validate and normalize an owner wallet address for the given chain.
- *
- * - Solana: Base58 32-byte Ed25519 public key
- * - Ethereum: 0x + EIP-55 checksum (strict -- all-lowercase rejected)
- * - Unknown chain: rejected
+ * @see packages/daemon/src/infrastructure/auth/address-validation.ts
  */
-export function validateOwnerAddress(chain, address) {
-    switch (chain) {
-        case 'solana':
-            return validateSolanaAddress(address);
-        case 'ethereum':
-            return validateEthereumAddress(address);
-        default:
-            return { valid: false, error: `Unsupported chain: ${chain}` };
-    }
-}
+export { decodeBase58, validateOwnerAddress } from '../../infrastructure/auth/address-validation.js';
 //# sourceMappingURL=address-validation.js.map

package/dist/api/middleware/address-validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"address-validation.js","sourceRoot":"","sources":["../../../src/api/middleware/address-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAc7C,8EAA8E;AAC9E,yDAAyD;AACzD,oEAAoE;AACpE,8EAA8E;AAE9E,MAAM,eAAe,GAAG,4DAA4D,CAAC;AAErF;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,kCAAkC;IAClC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACtD,MAAM,EAAE,CAAC;IACX,CAAC;IAED,kDAAkD;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,KAAK,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC;QACnD,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,KAAK,GAAG,SAAS,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YACvE,KAAK,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7B,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,GAAG,CAAC;YACtB,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,MAAM,GAAG,CAAC,CAAC;IACb,CAAC;IAED,6BAA6B;IAC7B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,KAAK,EAAE,CAAC;IACV,CAAC;IAED,uCAAuC;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC;IACrD,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;IAC1C,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,SAAS,qBAAqB,CAAC,OAAe;IAC5C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAC1B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,kDAAkD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;aAClF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kDAAkD,GAAG,EAAE,EAAE,CAAC;IAC1F,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,8BAA8B;AAC9B,8EAA8E;AAE9E,SAAS,uBAAuB,CAAC,OAAe;IAC9C,6CAA6C;IAC7C,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oDAAoD,EAAE,CAAC;IACvF,CAAC;IAED,qEAAqE;IACrE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;IACpE,CAAC;IAED,6CAA6C;IAC7C,yEAAyE;IACzE,8EAA8E;IAC9E,4CAA4C;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,GAAG,KAAK,GAAG,CAAC,WAAW,EAAE,IAAI,GAAG,KAAK,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,4GAA4G,EAAE,CAAC;IAC/I,CAAC;IAED,wDAAwD;IACxD,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;YAC5B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;QAC5D,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAgB,EAAE,OAAe;IACpE,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,QAAQ;YACX,OAAO,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACxC,KAAK,UAAU;YACb,OAAO,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC1C;YACE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,KAAe,EAAE,EAAE,CAAC;IAC5E,CAAC;AACH,CAAC"}
+{"version":3,"file":"address-validation.js","sourceRoot":"","sources":["../../../src/api/middleware/address-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC"}

package/dist/api/middleware/host-guard.d.ts

@@ -2,7 +2,7 @@
  * Host guard middleware: restricts requests to localhost only.
  *
  * Checks the Host header and only allows requests where the hostname
- * starts with 127.0.0.1, localhost, or [::1].
+ * exactly matches 127.0.0.1, localhost, or [::1].
  * Non-localhost requests are rejected with 403 SYSTEM_LOCKED.
  *
  * @see docs/29-api-framework-design.md

package/dist/api/middleware/host-guard.js

@@ -2,7 +2,7 @@
  * Host guard middleware: restricts requests to localhost only.
  *
  * Checks the Host header and only allows requests where the hostname
- * starts with 127.0.0.1, localhost, or [::1].
+ * exactly matches 127.0.0.1, localhost, or [::1].
  * Non-localhost requests are rejected with 403 SYSTEM_LOCKED.
  *
  * @see docs/29-api-framework-design.md
@@ -14,7 +14,7 @@ export const hostGuard = createMiddleware(async (c, next) => {
     const host = c.req.header('Host') ?? '';
     // Extract hostname (strip port if present)
     const hostname = host.replace(/:\d+$/, '');
-    const isLocalhost = LOCALHOST_PATTERNS.some((pattern) => hostname === pattern || hostname.startsWith(pattern));
+    const isLocalhost = LOCALHOST_PATTERNS.some((pattern) => hostname === pattern);
     if (!isLocalhost) {
         throw new WAIaaSError('SYSTEM_LOCKED', {
             message: 'Only localhost access allowed',

package/dist/api/middleware/host-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"host-guard.js","sourceRoot":"","sources":["../../../src/api/middleware/host-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,kBAAkB,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IAC1D,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACxC,2CAA2C;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAE3C,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CACzC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAClE,CAAC;IAEF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE;YACrC,OAAO,EAAE,+BAA+B;SACzC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC"}
+{"version":3,"file":"host-guard.js","sourceRoot":"","sources":["../../../src/api/middleware/host-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,kBAAkB,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IAC1D,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACxC,2CAA2C;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAE3C,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CACzC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,KAAK,OAAO,CAClC,CAAC;IAEF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE;YACrC,OAAO,EAAE,+BAA+B;SACzC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC"}

package/dist/api/middleware/index.d.ts

@@ -10,4 +10,5 @@ export { createSessionAuth, type SessionAuthDeps } from './session-auth.js';
 export { createMasterAuth, type MasterAuthDeps } from './master-auth.js';
 export { createOwnerAuth, type OwnerAuthDeps } from './owner-auth.js';
 export { cspMiddleware } from './csp.js';
+export { createIpRateLimiter, createSessionRateLimiter, createTxRateLimiter, SlidingWindowRateLimiter } from './rate-limiter.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/api/middleware/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/middleware/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,qBAAqB,EAAE,KAAK,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACxF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/middleware/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,qBAAqB,EAAE,KAAK,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACxF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/api/middleware/index.js

@@ -10,4 +10,5 @@ export { createSessionAuth } from './session-auth.js';
 export { createMasterAuth } from './master-auth.js';
 export { createOwnerAuth } from './owner-auth.js';
 export { cspMiddleware } from './csp.js';
+export { createIpRateLimiter, createSessionRateLimiter, createTxRateLimiter, SlidingWindowRateLimiter } from './rate-limiter.js';
 //# sourceMappingURL=index.js.map

package/dist/api/middleware/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/api/middleware/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,qBAAqB,EAA2B,MAAM,wBAAwB,CAAC;AACxF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAwB,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAuB,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAsB,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/api/middleware/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,qBAAqB,EAA2B,MAAM,wBAAwB,CAAC;AACxF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAwB,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAuB,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAsB,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/api/middleware/master-auth.d.ts

@@ -9,11 +9,8 @@
  * @see docs/52-auth-redesign.md
  */
 import type { Database as SQLiteDatabase } from 'better-sqlite3';
-/** Mutable ref for in-memory master password + hash, enabling hot-swap on password change. */
-export interface MasterPasswordRef {
-    password: string;
-    hash: string;
-}
+export type { MasterPasswordRef } from '../../infrastructure/auth/types.js';
+import type { MasterPasswordRef } from '../../infrastructure/auth/types.js';
 export interface MasterAuthDeps {
     masterPasswordHash?: string;
     /** Mutable ref for live password/hash updates. Takes precedence over masterPasswordHash. */

package/dist/api/middleware/master-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"master-auth.d.ts","sourceRoot":"","sources":["../../../src/api/middleware/master-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,KAAK,EAAE,QAAQ,IAAI,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAOjE,8FAA8F;AAC9F,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,4FAA4F;IAC5F,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,yDAAyD;IACzD,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB;AAMD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,+DA2CpD"}
+{"version":3,"file":"master-auth.d.ts","sourceRoot":"","sources":["../../../src/api/middleware/master-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,KAAK,EAAE,QAAQ,IAAI,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAOjE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAE5E,MAAM,WAAW,cAAc;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,4FAA4F;IAC5F,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,yDAAyD;IACzD,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB;AAMD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,+DA2CpD"}

package/dist/api/middleware/master-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"master-auth.js","sourceRoot":"","sources":["../../../src/api/middleware/master-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAE,cAAc,EAAE,MAAM,+CAA+C,CAAC;AAoB/E,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,MAAM,UAAU,gBAAgB,CAAC,IAAoB;IACnD,OAAO,gBAAgB,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACxC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAEnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,WAAW,CAAC,yBAAyB,EAAE;gBAC/C,OAAO,EAAE,sCAAsC;aAChD,CAAC,CAAC;QACL,CAAC;QAED,kEAAkE;QAClE,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,IAAI,CAAC,kBAAkB,CAAC;QAC/D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,WAAW,CAAC,yBAAyB,EAAE;gBAC/C,OAAO,EAAE,gCAAgC;aAC1C,CAAC,CAAC;QACL,CAAC;QAED,+CAA+C;QAC/C,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAEpD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,8CAA8C;YAC9C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE;oBAC1B,SAAS,EAAE,oBAAoB;oBAC/B,KAAK,EAAE,SAAS;oBAChB,OAAO,EAAE;wBACP,MAAM,EAAE,yBAAyB;wBACjC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,WAAW;qBACnD;oBACD,QAAQ,EAAE,UAAU;oBACpB,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,SAAS;iBACxD,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,WAAW,CAAC,yBAAyB,EAAE;gBAC/C,OAAO,EAAE,yBAAyB;aACnC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"master-auth.js","sourceRoot":"","sources":["../../../src/api/middleware/master-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAE,cAAc,EAAE,MAAM,+CAA+C,CAAC;AAiB/E,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,MAAM,UAAU,gBAAgB,CAAC,IAAoB;IACnD,OAAO,gBAAgB,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACxC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAEnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,WAAW,CAAC,yBAAyB,EAAE;gBAC/C,OAAO,EAAE,sCAAsC;aAChD,CAAC,CAAC;QACL,CAAC;QAED,kEAAkE;QAClE,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,IAAI,CAAC,kBAAkB,CAAC;QAC/D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,WAAW,CAAC,yBAAyB,EAAE;gBAC/C,OAAO,EAAE,gCAAgC;aAC1C,CAAC,CAAC;QACL,CAAC;QAED,+CAA+C;QAC/C,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAEpD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,8CAA8C;YAC9C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE;oBAC1B,SAAS,EAAE,oBAAoB;oBAC/B,KAAK,EAAE,SAAS;oBAChB,OAAO,EAAE;wBACP,MAAM,EAAE,yBAAyB;wBACjC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,WAAW;qBACnD;oBACD,QAAQ,EAAE,UAAU;oBACpB,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,SAAS;iBACxD,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,WAAW,CAAC,yBAAyB,EAAE;gBAC/C,OAAO,EAAE,yBAAyB;aACnC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/api/middleware/rate-limiter.d.ts

@@ -0,0 +1,51 @@
+/**
+ * In-memory sliding-window rate limiter with 3-tier Hono middleware factories.
+ *
+ * Architecture:
+ * - SlidingWindowRateLimiter: generic sliding-window counter with TTL auto-cleanup
+ * - createIpRateLimiter: IP-based global rate limit (all endpoints)
+ * - createSessionRateLimiter: session-based rate limit (sessionAuth endpoints)
+ * - createTxRateLimiter: transaction-specific rate limit (POST /v1/transactions, /v1/actions)
+ *
+ * All three read limit values from SettingsService on each request (hot-reload).
+ * Expired window entries are automatically cleaned every 60 seconds.
+ *
+ * @see packages/daemon/src/infrastructure/settings/setting-keys.ts for rate_limit_* keys
+ */
+import type { SettingsService } from '../../infrastructure/settings/index.js';
+interface SlidingWindowOpts {
+    /** Cleanup interval in ms (default 60_000) */
+    cleanupIntervalMs?: number;
+}
+interface CheckResult {
+    allowed: boolean;
+    remaining: number;
+    retryAfterSec: number;
+}
+export declare class SlidingWindowRateLimiter {
+    private buckets;
+    private cleanupTimer;
+    constructor(opts?: SlidingWindowOpts);
+    /**
+     * Check if a request is allowed under the sliding window.
+     *
+     * @param key - Rate limit key (IP, session ID, etc.)
+     * @param limit - Max requests per window
+     * @param windowMs - Window duration in ms (default 60_000 = 1 minute)
+     */
+    check(key: string, limit: number, windowMs?: number): CheckResult;
+    /** Remove buckets whose ALL timestamps are expired. */
+    cleanup(): void;
+    /** Stop the cleanup timer. */
+    destroy(): void;
+    /** Number of active keys (for testing). */
+    get size(): number;
+}
+interface RateLimiterDeps {
+    settingsService: SettingsService;
+}
+export declare function createIpRateLimiter(deps: RateLimiterDeps): import("hono").MiddlewareHandler<any, string, {}, Response>;
+export declare function createSessionRateLimiter(deps: RateLimiterDeps): import("hono").MiddlewareHandler<any, string, {}, Response>;
+export declare function createTxRateLimiter(deps: RateLimiterDeps): import("hono").MiddlewareHandler<any, string, {}, Response>;
+export {};
+//# sourceMappingURL=rate-limiter.d.ts.map

package/dist/api/middleware/rate-limiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.d.ts","sourceRoot":"","sources":["../../../src/api/middleware/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AAM9E,UAAU,iBAAiB;IACzB,8CAA8C;IAC9C,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,UAAU,WAAW;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,wBAAwB;IACnC,OAAO,CAAC,OAAO,CAA+C;IAC9D,OAAO,CAAC,YAAY,CAAiC;gBAEzC,IAAI,GAAE,iBAAsB;IASxC;;;;;;OAMG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,SAAS,GAAG,WAAW;IAgCjE,uDAAuD;IACvD,OAAO,IAAI,IAAI;IAUf,8BAA8B;IAC9B,OAAO,IAAI,IAAI;IAIf,2CAA2C;IAC3C,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF;AAMD,UAAU,eAAe;IACvB,eAAe,EAAE,eAAe,CAAC;CAClC;AAsBD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,eAAe,+DAkBxD;AAMD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,eAAe,+DAmB7D;AAMD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,eAAe,+DAmBxD"}

package/dist/api/middleware/rate-limiter.js

@@ -0,0 +1,146 @@
+/**
+ * In-memory sliding-window rate limiter with 3-tier Hono middleware factories.
+ *
+ * Architecture:
+ * - SlidingWindowRateLimiter: generic sliding-window counter with TTL auto-cleanup
+ * - createIpRateLimiter: IP-based global rate limit (all endpoints)
+ * - createSessionRateLimiter: session-based rate limit (sessionAuth endpoints)
+ * - createTxRateLimiter: transaction-specific rate limit (POST /v1/transactions, /v1/actions)
+ *
+ * All three read limit values from SettingsService on each request (hot-reload).
+ * Expired window entries are automatically cleaned every 60 seconds.
+ *
+ * @see packages/daemon/src/infrastructure/settings/setting-keys.ts for rate_limit_* keys
+ */
+import { createMiddleware } from 'hono/factory';
+export class SlidingWindowRateLimiter {
+    buckets = new Map();
+    cleanupTimer;
+    constructor(opts = {}) {
+        const interval = opts.cleanupIntervalMs ?? 60_000;
+        this.cleanupTimer = setInterval(() => this.cleanup(), interval);
+        // Unref so the timer doesn't keep the process alive
+        if (typeof this.cleanupTimer === 'object' && 'unref' in this.cleanupTimer) {
+            this.cleanupTimer.unref();
+        }
+    }
+    /**
+     * Check if a request is allowed under the sliding window.
+     *
+     * @param key - Rate limit key (IP, session ID, etc.)
+     * @param limit - Max requests per window
+     * @param windowMs - Window duration in ms (default 60_000 = 1 minute)
+     */
+    check(key, limit, windowMs = 60_000) {
+        const now = Date.now();
+        const cutoff = now - windowMs;
+        let bucket = this.buckets.get(key);
+        if (!bucket) {
+            bucket = { timestamps: [] };
+            this.buckets.set(key, bucket);
+        }
+        // Remove timestamps outside the window
+        bucket.timestamps = bucket.timestamps.filter((t) => t > cutoff);
+        if (bucket.timestamps.length < limit) {
+            bucket.timestamps.push(now);
+            return {
+                allowed: true,
+                remaining: limit - bucket.timestamps.length,
+                retryAfterSec: 0,
+            };
+        }
+        // Rate limited: calculate when the oldest entry in the window will expire
+        const oldest = bucket.timestamps[0];
+        const retryAfterMs = oldest + windowMs - now;
+        return {
+            allowed: false,
+            remaining: 0,
+            retryAfterSec: Math.ceil(retryAfterMs / 1000),
+        };
+    }
+    /** Remove buckets whose ALL timestamps are expired. */
+    cleanup() {
+        const cutoff = Date.now() - 60_000;
+        for (const [key, bucket] of this.buckets) {
+            bucket.timestamps = bucket.timestamps.filter((t) => t > cutoff);
+            if (bucket.timestamps.length === 0) {
+                this.buckets.delete(key);
+            }
+        }
+    }
+    /** Stop the cleanup timer. */
+    destroy() {
+        clearInterval(this.cleanupTimer);
+    }
+    /** Number of active keys (for testing). */
+    get size() {
+        return this.buckets.size;
+    }
+}
+// ---------------------------------------------------------------------------
+// Helper: return 429 JSON response with Retry-After header
+// ---------------------------------------------------------------------------
+function rateLimit429(c, retryAfterSec, message) {
+    c.header('Retry-After', String(retryAfterSec));
+    return c.json({
+        code: 'RATE_LIMITED',
+        message,
+        retryable: true,
+    }, 429);
+}
+// ---------------------------------------------------------------------------
+// IP rate limiter (global, all endpoints)
+// ---------------------------------------------------------------------------
+export function createIpRateLimiter(deps) {
+    const limiter = new SlidingWindowRateLimiter();
+    return createMiddleware(async (c, next) => {
+        const ip = c.req.header('x-forwarded-for')?.split(',')[0]?.trim() ||
+            c.req.header('x-real-ip') ||
+            'unknown';
+        const limit = parseInt(deps.settingsService.get('security.rate_limit_global_ip_rpm'), 10) || 1000;
+        const result = limiter.check(ip, limit);
+        if (!result.allowed) {
+            return rateLimit429(c, result.retryAfterSec, 'IP rate limit exceeded');
+        }
+        await next();
+    });
+}
+// ---------------------------------------------------------------------------
+// Session rate limiter (session-authed endpoints)
+// ---------------------------------------------------------------------------
+export function createSessionRateLimiter(deps) {
+    const limiter = new SlidingWindowRateLimiter();
+    return createMiddleware(async (c, next) => {
+        const sessionId = c.get('sessionId');
+        if (!sessionId) {
+            await next();
+            return;
+        }
+        const limit = parseInt(deps.settingsService.get('security.rate_limit_session_rpm'), 10) || 300;
+        const result = limiter.check(sessionId, limit);
+        if (!result.allowed) {
+            return rateLimit429(c, result.retryAfterSec, 'Session rate limit exceeded');
+        }
+        await next();
+    });
+}
+// ---------------------------------------------------------------------------
+// TX rate limiter (transaction submission endpoints)
+// ---------------------------------------------------------------------------
+export function createTxRateLimiter(deps) {
+    const limiter = new SlidingWindowRateLimiter();
+    return createMiddleware(async (c, next) => {
+        const sessionId = c.get('sessionId');
+        if (!sessionId) {
+            await next();
+            return;
+        }
+        const limit = parseInt(deps.settingsService.get('security.rate_limit_tx_rpm'), 10) || 10;
+        const result = limiter.check(sessionId, limit);
+        if (!result.allowed) {
+            return rateLimit429(c, result.retryAfterSec, 'Transaction rate limit exceeded');
+        }
+        await next();
+    });
+}
+//# sourceMappingURL=rate-limiter.js.map

package/dist/api/middleware/rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../../src/api/middleware/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAkBhD,MAAM,OAAO,wBAAwB;IAC3B,OAAO,GAAG,IAAI,GAAG,EAAoC,CAAC;IACtD,YAAY,CAAiC;IAErD,YAAY,OAA0B,EAAE;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,IAAI,MAAM,CAAC;QAClD,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;QAChE,oDAAoD;QACpD,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC1E,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,GAAW,EAAE,KAAa,EAAE,QAAQ,GAAG,MAAM;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC;QAE9B,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC;QAED,uCAAuC;QACvC,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;QAEhE,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;YACrC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC5B,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM;gBAC3C,aAAa,EAAE,CAAC;aACjB,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC;QACrC,MAAM,YAAY,GAAG,MAAM,GAAG,QAAQ,GAAG,GAAG,CAAC;QAC7C,OAAO;YACL,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,CAAC;YACZ,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;SAC9C,CAAC;IACJ,CAAC;IAED,uDAAuD;IACvD,OAAO;QACL,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;QACnC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACzC,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;YAChE,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,OAAO;QACL,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACnC,CAAC;IAED,2CAA2C;IAC3C,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;CACF;AAUD,8EAA8E;AAC9E,2DAA2D;AAC3D,8EAA8E;AAE9E,SAAS,YAAY,CAAC,CAAuG,EAAE,aAAqB,EAAE,OAAe;IACnK,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IAC/C,OAAO,CAAC,CAAC,IAAI,CACX;QACE,IAAI,EAAE,cAAc;QACpB,OAAO;QACP,SAAS,EAAE,IAAI;KAChB,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAE9E,MAAM,UAAU,mBAAmB,CAAC,IAAqB;IACvD,MAAM,OAAO,GAAG,IAAI,wBAAwB,EAAE,CAAC;IAE/C,OAAO,gBAAgB,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACxC,MAAM,EAAE,GACN,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;YACtD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;YACzB,SAAS,CAAC;QAEZ,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,mCAAmC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;QAClG,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAExC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,aAAa,EAAE,wBAAwB,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,kDAAkD;AAClD,8EAA8E;AAE9E,MAAM,UAAU,wBAAwB,CAAC,IAAqB;IAC5D,MAAM,OAAO,GAAG,IAAI,wBAAwB,EAAE,CAAC;IAE/C,OAAO,gBAAgB,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACxC,MAAM,SAAS,GAAI,CAAC,CAAC,GAA2C,CAAC,WAAW,CAAC,CAAC;QAC9E,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,iCAAiC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;QAC/F,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAE/C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,aAAa,EAAE,6BAA6B,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,qDAAqD;AACrD,8EAA8E;AAE9E,MAAM,UAAU,mBAAmB,CAAC,IAAqB;IACvD,MAAM,OAAO,GAAG,IAAI,wBAAwB,EAAE,CAAC;IAE/C,OAAO,gBAAgB,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACxC,MAAM,SAAS,GAAI,CAAC,CAAC,GAA2C,CAAC,WAAW,CAAC,CAAC;QAC9E,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,4BAA4B,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;QACzF,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAE/C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,aAAa,EAAE,iCAAiC,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/api/middleware/siwe-verify.d.ts

@@ -1,31 +1,11 @@
 /**
- * verifySIWE: Pure function for SIWE (EIP-4361) message verification.
+ * Re-export bridge: verifySIWE canonical location is infrastructure/auth/siwe-verify.ts
  *
- * Verifies that:
- * 1. The message is a valid EIP-4361 SIWE message (parseable, not expired, not before notBefore)
- * 2. The EIP-191 personal_sign signature matches the expectedAddress
+ * This file exists for backward compatibility with existing api/ layer imports.
+ * New code should import directly from infrastructure/auth/siwe-verify.js.
  *
- * Per design decision [v1.4.1]: nonce is NOT validated server-side
- * (consistency with Solana owner-auth which has no server-side nonce check;
- * security relies on expirationTime).
- *
- * @see docs/52-auth-redesign.md
- * @see docs/28-daemon.md (owner-auth SIWE)
+ * @see packages/daemon/src/infrastructure/auth/siwe-verify.ts
  */
-export interface VerifySIWEParams {
-    /** EIP-4361 formatted message string */
-    message: string;
-    /** Hex-encoded 0x-prefixed EIP-191 signature */
-    signature: string;
-    /** 0x EIP-55 checksum address to match */
-    expectedAddress: string;
-}
-export interface VerifySIWEResult {
-    valid: boolean;
-    /** Recovered address on success */
-    address?: string;
-    /** Reason on failure */
-    error?: string;
-}
-export declare function verifySIWE(params: VerifySIWEParams): Promise<VerifySIWEResult>;
+export { verifySIWE } from '../../infrastructure/auth/siwe-verify.js';
+export type { VerifySIWEParams, VerifySIWEResult } from '../../infrastructure/auth/siwe-verify.js';
 //# sourceMappingURL=siwe-verify.d.ts.map

package/dist/api/middleware/siwe-verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"siwe-verify.d.ts","sourceRoot":"","sources":["../../../src/api/middleware/siwe-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AASH,MAAM,WAAW,gBAAgB;IAC/B,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,mCAAmC;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wBAAwB;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAMD,wBAAsB,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAuCpF"}
+{"version":3,"file":"siwe-verify.d.ts","sourceRoot":"","sources":["../../../src/api/middleware/siwe-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,0CAA0C,CAAC;AACtE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC"}