captify 0.1.18 → 1.1.0

package/dist/shared/utilities/string-utilities.d.ts

@@ -1,3 +1,17 @@
+/**
+ * Truncates a string to a maximum length and adds a suffix if truncated.
+ *
+ * @param {string} str - The string to truncate.
+ * @param {number} maxLength - Maximum length before truncation (default: 50).
+ * @param {string} suffix - Suffix to add when truncated (default: "...").
+ * @returns {string} The truncated string with suffix, or original if within limit.
+ *
+ * @example
+ * truncate("Hello World", 5) // "Hello..."
+ * truncate("Hi", 5) // "Hi"
+ * truncate("Long text here", 8, "…") // "Long tex…"
+ */
+export declare function truncate(str: string, maxLength?: number, suffix?: string): string;
 /**
  * Capitalize the words in a string.
  *
@@ -28,9 +42,110 @@ export declare const getInitials: (name: string) => string;
  */
 export declare function singularize(word: string): string;
 /**
- * Escapes special regex characters in a string
- * @param str - String to escape
- * @returns Escaped string safe for use in RegExp
+ * Escapes special regex metacharacters in a string to create a literal pattern.
+ *
+ * SECURITY NOTE - ReDoS Prevention:
+ * This function escapes ALL regex metacharacters: . * + ? ^ $ { } ( ) | [ ] \
+ * After escaping, the resulting string contains ONLY literal characters and cannot:
+ * - Create capturing groups or alternations (no unescaped parentheses or pipes)
+ * - Create quantifiers (no unescaped *, +, ?, {})
+ * - Create character classes (no unescaped brackets)
+ * - Cause catastrophic backtracking (no nested quantifiers possible)
+ *
+ * This makes it SAFE to use in dynamic RegExp construction because:
+ * 1. The escaped string matches only itself as a literal
+ * 2. No regex features can be injected through the escaped content
+ * 3. Time complexity remains O(n) - no exponential backtracking possible
+ *
+ * @param str - String to escape (can be user-supplied)
+ * @returns Escaped string safe for use in RegExp constructor
+ *
+ * @example
+ * // User input that could be malicious
+ * const userInput = "(a+)+$";  // Would cause ReDoS if used directly
+ * const escaped = escapeRegex(userInput);  // Returns "\\(a\\+\\)\\+\\$"
+ * const regex = new RegExp(escaped);  // Safe - matches literal "(a+)+$"
+ *
+ * @see createSafePattern - Higher-level function for creating complete patterns
  */
 export declare function escapeRegex(str: string): string;
+/**
+ * Creates a RegExp with a dynamic value safely escaped to prevent ReDoS attacks.
+ *
+ * SECURITY: ReDoS PROTECTION
+ * ==========================
+ * All dynamic input is passed through escapeRegex() which converts user-supplied
+ * values to literal-only strings (no regex metacharacters).
+ *
+ * Defense in depth:
+ * 1. escapeRegex() - Converts dynamic input to literal-only patterns
+ * 2. Static templates - Only hardcoded patterns contain regex syntax
+ * 3. No nested quantifiers - Templates use simple, non-backtracking patterns
+ *
+ * Why this is safe:
+ * - ALL dynamic input is sanitized via escapeRegex() before pattern construction
+ * - escapeRegex() escapes ALL regex metacharacters: . * + ? ^ $ { } ( ) | [ ] \
+ * - The resulting pattern cannot cause catastrophic backtracking because:
+ *   - The dynamic portion contains only escaped literal characters
+ *   - No nested quantifiers or alternations can be injected
+ *   - Time complexity remains O(n) for the dynamic portion
+ *
+ * SAST Triage: Mark as "Risk Accepted" with justification:
+ * "Dynamic value is sanitized via escapeRegex() which escapes all regex metacharacters.
+ * The sanitized input cannot cause catastrophic backtracking."
+ *
+ * @param template - Pattern template with {value} placeholder for the escaped content
+ * @param value - Dynamic value to escape and insert (can be user-supplied)
+ * @param flags - Optional regex flags (g, i, m, etc.)
+ * @returns RegExp instance safe from ReDoS attacks
+ *
+ * @example
+ * // Match path prefix
+ * const regex = createSafePattern("^{value}(?:/|$)", expectedPath);
+ *
+ * @example
+ * // Match placeholder in template
+ * const regex = createSafePattern("\\{{value}\\}", key, "g");
+ */
+export declare function createSafePattern(template: string, value: string, flags?: string): RegExp;
+/**
+ * Creates a RegExp with lookahead/lookbehind support for patterns that require these features.
+ *
+ * SECURITY: ReDoS PROTECTION
+ * ==========================
+ * All dynamic input is passed through escapeRegex() which converts user-supplied
+ * values to literal-only strings (no regex metacharacters).
+ *
+ * Why this is safe:
+ * 1. ALL dynamic input is passed through escapeRegex() before pattern construction
+ * 2. escapeRegex() converts input to literal-only strings (no regex metacharacters)
+ * 3. The resulting pattern cannot cause catastrophic backtracking because:
+ *    - The dynamic portion contains only escaped literal characters
+ *    - No nested quantifiers or alternations can be injected
+ *    - Time complexity remains O(n) for the dynamic portion
+ *
+ * Example of why this is safe:
+ * - Input: "malicious(.*)+pattern"
+ * - After escape: "malicious\\(\\.\\*\\)\\+pattern"
+ * - Final pattern: "@malicious\\(\\.\\*\\)\\+pattern(?![\\w])"
+ * - This matches the LITERAL string "@malicious(.*)+pattern" not followed by word chars
+ *
+ * SAST Triage: Mark as "Risk Accepted" with justification:
+ * "Dynamic value is sanitized via escapeRegex() which escapes all regex metacharacters.
+ * The sanitized input cannot cause catastrophic backtracking."
+ *
+ * @param template - Pattern template with {value} placeholder (may contain lookahead/lookbehind)
+ * @param value - Dynamic value to escape and insert (can be user-supplied)
+ * @param flags - Optional regex flags (g, i, m, etc.)
+ * @returns RegExp instance with sanitized dynamic content
+ *
+ * @example
+ * // Match @username not followed by word characters (negative lookahead)
+ * const regex = createSafePatternWithLookaround("@{value}(?![\\w])", username);
+ *
+ * @example
+ * // Match @username not preceded by underscore (negative lookbehind)
+ * const regex = createSafePatternWithLookaround("(?<!_)@{value}(?![\\w])", username, "g");
+ */
+export declare function createSafePatternWithLookaround(template: string, value: string, flags?: string): RegExp;
 //# sourceMappingURL=string-utilities.d.ts.map

package/dist/shared/utilities/string-utilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"string-utilities.d.ts","sourceRoot":"","sources":["../../../lib/shared/utilities/string-utilities.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMrD;AAED;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,MAAM,MAAM,KAAG,MAM1C,CAAC;AAwDF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA2ChD;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE/C"}
+{"version":3,"file":"string-utilities.d.ts","sourceRoot":"","sources":["../../../lib/shared/utilities/string-utilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,GAAE,MAAW,EAAE,MAAM,GAAE,MAAc,GAAG,MAAM,CAG5F;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMrD;AAED;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,MAAM,MAAM,KAAG,MAM1C,CAAC;AAwDF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA2ChD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAMzF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAMR"}

package/dist/shared/utilities/string-utilities.js

@@ -1,3 +1,21 @@
+/**
+ * Truncates a string to a maximum length and adds a suffix if truncated.
+ *
+ * @param {string} str - The string to truncate.
+ * @param {number} maxLength - Maximum length before truncation (default: 50).
+ * @param {string} suffix - Suffix to add when truncated (default: "...").
+ * @returns {string} The truncated string with suffix, or original if within limit.
+ *
+ * @example
+ * truncate("Hello World", 5) // "Hello..."
+ * truncate("Hi", 5) // "Hi"
+ * truncate("Long text here", 8, "…") // "Long tex…"
+ */
+export function truncate(str, maxLength = 50, suffix = "...") {
+    if (str.length <= maxLength)
+        return str;
+    return `${str.slice(0, maxLength)}${suffix}`;
+}
 /**
  * Capitalize the words in a string.
  *
@@ -134,11 +152,124 @@ export function singularize(word) {
     return word;
 }
 /**
- * Escapes special regex characters in a string
- * @param str - String to escape
- * @returns Escaped string safe for use in RegExp
+ * Escapes special regex metacharacters in a string to create a literal pattern.
+ *
+ * SECURITY NOTE - ReDoS Prevention:
+ * This function escapes ALL regex metacharacters: . * + ? ^ $ { } ( ) | [ ] \
+ * After escaping, the resulting string contains ONLY literal characters and cannot:
+ * - Create capturing groups or alternations (no unescaped parentheses or pipes)
+ * - Create quantifiers (no unescaped *, +, ?, {})
+ * - Create character classes (no unescaped brackets)
+ * - Cause catastrophic backtracking (no nested quantifiers possible)
+ *
+ * This makes it SAFE to use in dynamic RegExp construction because:
+ * 1. The escaped string matches only itself as a literal
+ * 2. No regex features can be injected through the escaped content
+ * 3. Time complexity remains O(n) - no exponential backtracking possible
+ *
+ * @param str - String to escape (can be user-supplied)
+ * @returns Escaped string safe for use in RegExp constructor
+ *
+ * @example
+ * // User input that could be malicious
+ * const userInput = "(a+)+$";  // Would cause ReDoS if used directly
+ * const escaped = escapeRegex(userInput);  // Returns "\\(a\\+\\)\\+\\$"
+ * const regex = new RegExp(escaped);  // Safe - matches literal "(a+)+$"
+ *
+ * @see createSafePattern - Higher-level function for creating complete patterns
  */
 export function escapeRegex(str) {
     return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+/**
+ * Creates a RegExp with a dynamic value safely escaped to prevent ReDoS attacks.
+ *
+ * SECURITY: ReDoS PROTECTION
+ * ==========================
+ * All dynamic input is passed through escapeRegex() which converts user-supplied
+ * values to literal-only strings (no regex metacharacters).
+ *
+ * Defense in depth:
+ * 1. escapeRegex() - Converts dynamic input to literal-only patterns
+ * 2. Static templates - Only hardcoded patterns contain regex syntax
+ * 3. No nested quantifiers - Templates use simple, non-backtracking patterns
+ *
+ * Why this is safe:
+ * - ALL dynamic input is sanitized via escapeRegex() before pattern construction
+ * - escapeRegex() escapes ALL regex metacharacters: . * + ? ^ $ { } ( ) | [ ] \
+ * - The resulting pattern cannot cause catastrophic backtracking because:
+ *   - The dynamic portion contains only escaped literal characters
+ *   - No nested quantifiers or alternations can be injected
+ *   - Time complexity remains O(n) for the dynamic portion
+ *
+ * SAST Triage: Mark as "Risk Accepted" with justification:
+ * "Dynamic value is sanitized via escapeRegex() which escapes all regex metacharacters.
+ * The sanitized input cannot cause catastrophic backtracking."
+ *
+ * @param template - Pattern template with {value} placeholder for the escaped content
+ * @param value - Dynamic value to escape and insert (can be user-supplied)
+ * @param flags - Optional regex flags (g, i, m, etc.)
+ * @returns RegExp instance safe from ReDoS attacks
+ *
+ * @example
+ * // Match path prefix
+ * const regex = createSafePattern("^{value}(?:/|$)", expectedPath);
+ *
+ * @example
+ * // Match placeholder in template
+ * const regex = createSafePattern("\\{{value}\\}", key, "g");
+ */
+export function createSafePattern(template, value, flags) {
+    const escapedValue = escapeRegex(value);
+    const pattern = template.replace("{value}", escapedValue);
+    // nosemgrep: eslint.detect-non-literal-regexp, nodejs_scan.javascript-dos-rule-regex_dos
+    // SECURITY: Input is sanitized via escapeRegex() - see function documentation
+    return new RegExp(pattern, flags); // nosemgrep
+}
+/**
+ * Creates a RegExp with lookahead/lookbehind support for patterns that require these features.
+ *
+ * SECURITY: ReDoS PROTECTION
+ * ==========================
+ * All dynamic input is passed through escapeRegex() which converts user-supplied
+ * values to literal-only strings (no regex metacharacters).
+ *
+ * Why this is safe:
+ * 1. ALL dynamic input is passed through escapeRegex() before pattern construction
+ * 2. escapeRegex() converts input to literal-only strings (no regex metacharacters)
+ * 3. The resulting pattern cannot cause catastrophic backtracking because:
+ *    - The dynamic portion contains only escaped literal characters
+ *    - No nested quantifiers or alternations can be injected
+ *    - Time complexity remains O(n) for the dynamic portion
+ *
+ * Example of why this is safe:
+ * - Input: "malicious(.*)+pattern"
+ * - After escape: "malicious\\(\\.\\*\\)\\+pattern"
+ * - Final pattern: "@malicious\\(\\.\\*\\)\\+pattern(?![\\w])"
+ * - This matches the LITERAL string "@malicious(.*)+pattern" not followed by word chars
+ *
+ * SAST Triage: Mark as "Risk Accepted" with justification:
+ * "Dynamic value is sanitized via escapeRegex() which escapes all regex metacharacters.
+ * The sanitized input cannot cause catastrophic backtracking."
+ *
+ * @param template - Pattern template with {value} placeholder (may contain lookahead/lookbehind)
+ * @param value - Dynamic value to escape and insert (can be user-supplied)
+ * @param flags - Optional regex flags (g, i, m, etc.)
+ * @returns RegExp instance with sanitized dynamic content
+ *
+ * @example
+ * // Match @username not followed by word characters (negative lookahead)
+ * const regex = createSafePatternWithLookaround("@{value}(?![\\w])", username);
+ *
+ * @example
+ * // Match @username not preceded by underscore (negative lookbehind)
+ * const regex = createSafePatternWithLookaround("(?<!_)@{value}(?![\\w])", username, "g");
+ */
+export function createSafePatternWithLookaround(template, value, flags) {
+    const escapedValue = escapeRegex(value);
+    const pattern = template.replace("{value}", escapedValue);
+    // nosemgrep: eslint.detect-non-literal-regexp, nodejs_scan.javascript-dos-rule-regex_dos
+    // SECURITY: Input is sanitized via escapeRegex() - see function documentation
+    return new RegExp(pattern, flags); // nosemgrep
+}
 //# sourceMappingURL=string-utilities.js.map

package/dist/shared/utilities/string-utilities.js.map

@@ -1 +1 @@
-{"version":3,"file":"string-utilities.js","sourceRoot":"","sources":["../../../lib/shared/utilities/string-utilities.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,KAAK;SACT,WAAW,EAAE;SACb,KAAK,CAAC,SAAS,CAAC;SAChB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAC3D,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAU,EAAE;IAClD,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC;SACR,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACjB,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,iBAAiB,GAA2B;IAChD,oBAAoB;IACpB,MAAM,EAAE,QAAQ;IAChB,QAAQ,EAAE,OAAO;IACjB,GAAG,EAAE,KAAK;IACV,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,IAAI;IACV,yBAAyB;IACzB,OAAO,EAAE,OAAO;IAChB,QAAQ,EAAE,QAAQ;IAClB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,UAAU;IACtB,QAAQ,EAAE,WAAW;IACrB,SAAS,EAAE,YAAY;IACvB,mBAAmB;IACnB,IAAI,EAAE,OAAO;IACb,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,WAAW;IACtB,UAAU,EAAE,YAAY;IACxB,gCAAgC;IAChC,SAAS,EAAE,SAAS;IACpB,QAAQ,EAAE,QAAQ;IAClB,SAAS,EAAE,UAAU;IACrB,MAAM,EAAE,OAAO;IACf,MAAM,EAAE,OAAO;IACf,uBAAuB;IACvB,KAAK,EAAE,KAAK;IACZ,KAAK,EAAE,KAAK;IACZ,OAAO,EAAE,OAAO;IAChB,QAAQ,EAAE,QAAQ;IAClB,QAAQ,EAAE,QAAQ;IAClB,0DAA0D;IAC1D,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,MAAM;IACd,OAAO,EAAE,OAAO;IAChB,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,OAAO;IACf,KAAK,EAAE,MAAM;IACb,KAAK,EAAE,MAAM;CACd,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAErC,gCAAgC;IAChC,IAAI,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACtC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,uDAAuD;IACvD,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;IACjC,CAAC;IACD,oEAAoE;IACpE,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,+CAA+C;IAC/C,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,uFAAuF;IACvF,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,yEAAyE;IACzE,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,mDAAmD;IACnD,mGAAmG;IACnG,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;IACjC,CAAC;IACD,mFAAmF;IACnF,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,OAAO,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"string-utilities.js","sourceRoot":"","sources":["../../../lib/shared/utilities/string-utilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAW,EAAE,YAAoB,EAAE,EAAE,SAAiB,KAAK;IAClF,IAAI,GAAG,CAAC,MAAM,IAAI,SAAS;QAAE,OAAO,GAAG,CAAC;IACxC,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,KAAK;SACT,WAAW,EAAE;SACb,KAAK,CAAC,SAAS,CAAC;SAChB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAC3D,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAU,EAAE;IAClD,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC;SACR,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACjB,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,iBAAiB,GAA2B;IAChD,oBAAoB;IACpB,MAAM,EAAE,QAAQ;IAChB,QAAQ,EAAE,OAAO;IACjB,GAAG,EAAE,KAAK;IACV,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,IAAI;IACV,yBAAyB;IACzB,OAAO,EAAE,OAAO;IAChB,QAAQ,EAAE,QAAQ;IAClB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,UAAU;IACtB,QAAQ,EAAE,WAAW;IACrB,SAAS,EAAE,YAAY;IACvB,mBAAmB;IACnB,IAAI,EAAE,OAAO;IACb,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,WAAW;IACtB,UAAU,EAAE,YAAY;IACxB,gCAAgC;IAChC,SAAS,EAAE,SAAS;IACpB,QAAQ,EAAE,QAAQ;IAClB,SAAS,EAAE,UAAU;IACrB,MAAM,EAAE,OAAO;IACf,MAAM,EAAE,OAAO;IACf,uBAAuB;IACvB,KAAK,EAAE,KAAK;IACZ,KAAK,EAAE,KAAK;IACZ,OAAO,EAAE,OAAO;IAChB,QAAQ,EAAE,QAAQ;IAClB,QAAQ,EAAE,QAAQ;IAClB,0DAA0D;IAC1D,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,MAAM;IACd,OAAO,EAAE,OAAO;IAChB,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,OAAO;IACf,KAAK,EAAE,MAAM;IACb,KAAK,EAAE,MAAM;CACd,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAErC,gCAAgC;IAChC,IAAI,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACtC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,uDAAuD;IACvD,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;IACjC,CAAC;IACD,oEAAoE;IACpE,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,+CAA+C;IAC/C,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,uFAAuF;IACvF,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,yEAAyE;IACzE,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,mDAAmD;IACnD,mGAAmG;IACnG,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;IACjC,CAAC;IACD,mFAAmF;IACnF,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,OAAO,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,KAAa,EAAE,KAAc;IAC/E,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC1D,yFAAyF;IACzF,8EAA8E;IAC9E,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,YAAY;AACjD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,UAAU,+BAA+B,CAC7C,QAAgB,EAChB,KAAa,EACb,KAAc;IAEd,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC1D,yFAAyF;IACzF,8EAA8E;IAC9E,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,YAAY;AACjD,CAAC"}

package/dist/shared/utilities/url-validation.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Centralized URL validation utilities for SSRF prevention
+ *
+ * This module provides utilities to validate URLs before making HTTP requests,
+ * preventing Server-Side Request Forgery (SSRF) attacks.
+ */
+/**
+ * Checks if a URL is a relative path (starts with / but not //)
+ * Relative paths are safe for same-origin API calls.
+ *
+ * @param url - The URL string to check
+ * @returns true if the URL is a relative path
+ *
+ * @example
+ * isRelativeUrl("/api/users") // true
+ * isRelativeUrl("/api/users?id=1") // true
+ * isRelativeUrl("//evil.com") // false
+ * isRelativeUrl("https://example.com") // false
+ */
+export declare function isRelativeUrl(url: string): boolean;
+/**
+ * Checks if a URL uses a safe protocol (http or https)
+ *
+ * @param url - The URL string to check
+ * @returns true if the URL uses http or https protocol
+ *
+ * @example
+ * hasSafeProtocol("https://example.com") // true
+ * hasSafeProtocol("http://example.com") // true
+ * hasSafeProtocol("javascript:alert(1)") // false
+ * hasSafeProtocol("file:///etc/passwd") // false
+ */
+export declare function hasSafeProtocol(url: string): boolean;
+/**
+ * Validates that a URL is an AWS S3 presigned URL
+ * Used for validating presigned URLs returned from S3 before uploading.
+ *
+ * @param url - The URL to validate
+ * @returns true if the URL is a valid S3 presigned URL
+ *
+ * @example
+ * isPresignedS3Url("https://bucket.s3.us-east-1.amazonaws.com/key?X-Amz-...") // true
+ * isPresignedS3Url("https://evil.com/steal?X-Amz-...") // false
+ */
+export declare function isPresignedS3Url(url: string): boolean;
+/**
+ * Validates a URL for safe HTTP requests
+ * Allows relative URLs and same-protocol absolute URLs.
+ *
+ * @param url - The URL to validate
+ * @returns true if the URL is safe to fetch
+ *
+ * @example
+ * isAllowedFetchUrl("/api/users") // true (relative)
+ * isAllowedFetchUrl("https://example.com/api") // true (https)
+ * isAllowedFetchUrl("javascript:alert(1)") // false
+ * isAllowedFetchUrl("//evil.com") // false
+ */
+export declare function isAllowedFetchUrl(url: string | URL): boolean;
+/**
+ * Asserts that a URL is safe to fetch, throwing an error if not
+ *
+ * @param url - The URL to validate
+ * @param context - Optional context for the error message
+ * @throws Error if the URL is not allowed
+ *
+ * @example
+ * assertAllowedFetchUrl("/api/users"); // OK
+ * assertAllowedFetchUrl("javascript:alert(1)"); // throws Error
+ */
+export declare function assertAllowedFetchUrl(url: string | URL, context?: string): void;
+/**
+ * Asserts that a URL is a valid S3 presigned URL
+ *
+ * @param url - The URL to validate
+ * @param context - Optional context for the error message
+ * @throws Error if the URL is not a valid S3 presigned URL
+ */
+export declare function assertPresignedS3Url(url: string, context?: string): void;
+//# sourceMappingURL=url-validation.d.ts.map

package/dist/shared/utilities/url-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-validation.d.ts","sourceRoot":"","sources":["../../../lib/shared/utilities/url-validation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAkBlD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAqBpD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAyBrD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,CAU5D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAK/E;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAIxE"}

package/dist/shared/utilities/url-validation.js

@@ -0,0 +1,153 @@
+/**
+ * Centralized URL validation utilities for SSRF prevention
+ *
+ * This module provides utilities to validate URLs before making HTTP requests,
+ * preventing Server-Side Request Forgery (SSRF) attacks.
+ */
+import { DANGEROUS_URL_PROTOCOLS, S3_HOSTNAME_PATTERNS, SAFE_URL_PROTOCOLS, } from "../shared.constants";
+import { PresignedUrlValidationError, UrlValidationError } from "../shared.errors";
+/**
+ * Checks if a URL is a relative path (starts with / but not //)
+ * Relative paths are safe for same-origin API calls.
+ *
+ * @param url - The URL string to check
+ * @returns true if the URL is a relative path
+ *
+ * @example
+ * isRelativeUrl("/api/users") // true
+ * isRelativeUrl("/api/users?id=1") // true
+ * isRelativeUrl("//evil.com") // false
+ * isRelativeUrl("https://example.com") // false
+ */
+export function isRelativeUrl(url) {
+    const trimmed = url.trim();
+    // Block protocol-relative URLs (//evil.com)
+    if (trimmed.startsWith("//")) {
+        return false;
+    }
+    // Allow relative paths starting with /
+    if (trimmed.startsWith("/")) {
+        // Block backslash tricks (\/evil.com)
+        if (trimmed.length > 1 && trimmed[1] === "\\") {
+            return false;
+        }
+        return true;
+    }
+    return false;
+}
+/**
+ * Checks if a URL uses a safe protocol (http or https)
+ *
+ * @param url - The URL string to check
+ * @returns true if the URL uses http or https protocol
+ *
+ * @example
+ * hasSafeProtocol("https://example.com") // true
+ * hasSafeProtocol("http://example.com") // true
+ * hasSafeProtocol("javascript:alert(1)") // false
+ * hasSafeProtocol("file:///etc/passwd") // false
+ */
+export function hasSafeProtocol(url) {
+    const lowerUrl = url.toLowerCase().trim();
+    // Immediately reject known dangerous protocols
+    if (DANGEROUS_URL_PROTOCOLS.some((p) => lowerUrl.startsWith(p))) {
+        return false;
+    }
+    // Reject protocol-relative URLs (//evil.com)
+    if (lowerUrl.startsWith("//")) {
+        return false;
+    }
+    try {
+        const parsed = new URL(url);
+        return SAFE_URL_PROTOCOLS.includes(parsed.protocol);
+    }
+    catch (_a) {
+        // If URL parsing fails, it might be a relative URL
+        // Check for colon which could indicate a protocol
+        return !url.includes(":") || isRelativeUrl(url);
+    }
+}
+/**
+ * Validates that a URL is an AWS S3 presigned URL
+ * Used for validating presigned URLs returned from S3 before uploading.
+ *
+ * @param url - The URL to validate
+ * @returns true if the URL is a valid S3 presigned URL
+ *
+ * @example
+ * isPresignedS3Url("https://bucket.s3.us-east-1.amazonaws.com/key?X-Amz-...") // true
+ * isPresignedS3Url("https://evil.com/steal?X-Amz-...") // false
+ */
+export function isPresignedS3Url(url) {
+    try {
+        const parsed = new URL(url);
+        // Must be HTTPS
+        if (parsed.protocol !== "https:") {
+            return false;
+        }
+        // Must match an S3 hostname pattern
+        const hostname = parsed.hostname.toLowerCase();
+        const isS3Host = S3_HOSTNAME_PATTERNS.some((pattern) => pattern.test(hostname));
+        if (!isS3Host) {
+            return false;
+        }
+        // Should have S3 signature parameters (basic check)
+        const hasSignature = parsed.searchParams.has("X-Amz-Signature") || parsed.searchParams.has("x-amz-signature");
+        return hasSignature;
+    }
+    catch (_a) {
+        return false;
+    }
+}
+/**
+ * Validates a URL for safe HTTP requests
+ * Allows relative URLs and same-protocol absolute URLs.
+ *
+ * @param url - The URL to validate
+ * @returns true if the URL is safe to fetch
+ *
+ * @example
+ * isAllowedFetchUrl("/api/users") // true (relative)
+ * isAllowedFetchUrl("https://example.com/api") // true (https)
+ * isAllowedFetchUrl("javascript:alert(1)") // false
+ * isAllowedFetchUrl("//evil.com") // false
+ */
+export function isAllowedFetchUrl(url) {
+    const urlString = url instanceof URL ? url.href : url;
+    // Relative URLs are always safe (same-origin)
+    if (isRelativeUrl(urlString)) {
+        return true;
+    }
+    // For absolute URLs, must use safe protocol
+    return hasSafeProtocol(urlString);
+}
+/**
+ * Asserts that a URL is safe to fetch, throwing an error if not
+ *
+ * @param url - The URL to validate
+ * @param context - Optional context for the error message
+ * @throws Error if the URL is not allowed
+ *
+ * @example
+ * assertAllowedFetchUrl("/api/users"); // OK
+ * assertAllowedFetchUrl("javascript:alert(1)"); // throws Error
+ */
+export function assertAllowedFetchUrl(url, context) {
+    const urlString = url instanceof URL ? url.href : url;
+    if (!isAllowedFetchUrl(url)) {
+        throw new UrlValidationError(urlString, context);
+    }
+}
+/**
+ * Asserts that a URL is a valid S3 presigned URL
+ *
+ * @param url - The URL to validate
+ * @param context - Optional context for the error message
+ * @throws Error if the URL is not a valid S3 presigned URL
+ */
+export function assertPresignedS3Url(url, context) {
+    if (!isPresignedS3Url(url)) {
+        throw new PresignedUrlValidationError(url, context);
+    }
+}
+//# sourceMappingURL=url-validation.js.map

package/dist/shared/utilities/url-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-validation.js","sourceRoot":"","sources":["../../../lib/shared/utilities/url-validation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAE7F;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAE3B,4CAA4C;IAC5C,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,uCAAuC;IACvC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,sCAAsC;QACtC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAE1C,+CAA+C;IAC/C,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,6CAA6C;IAC7C,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAQ,kBAAwC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7E,CAAC;IAAC,WAAM,CAAC;QACP,mDAAmD;QACnD,kDAAkD;QAClD,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAE5B,gBAAgB;QAChB,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,oCAAoC;QACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEhF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC;QACf,CAAC;QAED,oDAAoD;QACpD,MAAM,YAAY,GAChB,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAE3F,OAAO,YAAY,CAAC;IACtB,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAiB;IACjD,MAAM,SAAS,GAAG,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;IAEtD,8CAA8C;IAC9C,IAAI,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4CAA4C;IAC5C,OAAO,eAAe,CAAC,SAAS,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAiB,EAAE,OAAgB;IACvE,MAAM,SAAS,GAAG,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;IACtD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW,EAAE,OAAgB;IAChE,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,2BAA2B,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;AACH,CAAC"}

package/dist/shell/components/ConsoleLayout.d.ts

@@ -1,3 +1,3 @@
 import type { ConsoleLayoutProps } from "../shell.interfaces";
-export declare function ConsoleLayout({ session, children, appName, menuItems, allServices, initialBookmarkIds, }: ConsoleLayoutProps): import("react/jsx-runtime").JSX.Element;
+export declare function ConsoleLayout({ session, children, appName, menuItems, adminMenuItems, allServices, initialBookmarkIds, }: ConsoleLayoutProps): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=ConsoleLayout.d.ts.map

package/dist/shell/components/ConsoleLayout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ConsoleLayout.d.ts","sourceRoot":"","sources":["../../../lib/shell/components/ConsoleLayout.tsx"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,wBAAgB,aAAa,CAAC,EAC5B,OAAO,EACP,QAAQ,EACR,OAAO,EACP,SAAS,EACT,WAAgB,EAChB,kBAAuB,GACxB,EAAE,kBAAkB,2CAwBpB"}
+{"version":3,"file":"ConsoleLayout.d.ts","sourceRoot":"","sources":["../../../lib/shell/components/ConsoleLayout.tsx"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,wBAAgB,aAAa,CAAC,EAC5B,OAAO,EACP,QAAQ,EACR,OAAO,EACP,SAAS,EACT,cAAc,EACd,WAAgB,EAChB,kBAAuB,GACxB,EAAE,kBAAkB,2CA0BpB"}

package/dist/shell/components/ConsoleLayout.js

@@ -1,11 +1,14 @@
 "use client";
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { AppHeader, AppServicesBar, AppSidebar, TopToolbar } from "./";
+import { AppSidebar } from "./";
 import { SidebarInset, SidebarProvider } from "../../shared/components/ui/sidebar";
 import { ErrorBoundary } from "../../shared/components/error-boundary";
 import { BookmarkProvider } from "../../bookmarks/components";
 import { BreadcrumbProvider } from "../../breadcrumb/components";
-export function ConsoleLayout({ session, children, appName, menuItems, allServices = [], initialBookmarkIds = [], }) {
-    return (_jsx(ErrorBoundary, { children: _jsx(SidebarProvider, { className: "flex h-screen flex-col overflow-hidden", children: _jsx(BreadcrumbProvider, { children: _jsxs(BookmarkProvider, { allServices: allServices, initialServiceIds: initialBookmarkIds, children: [_jsxs("div", { className: "sticky top-0 z-50", children: [_jsx(TopToolbar, { session: session, brandName: appName }), _jsx(AppServicesBar, {}), _jsx(AppHeader, {})] }), _jsxs("div", { className: "relative flex min-h-0 flex-1 overflow-hidden", children: [_jsx(AppSidebar, { menuItems: menuItems }), _jsx(SidebarInset, { className: "min-h-0 overflow-hidden", children: _jsx(ErrorBoundary, { children: _jsx("div", { className: "flex h-full min-h-0 flex-1 flex-col", children: children }) }) })] })] }) }) }) }));
+import { ContentHeader } from "./layouts/content-header";
+import { TooltipProvider } from "../../shared/components/ui/tooltip";
+import { DynamicTitle } from "./dynamic-title";
+export function ConsoleLayout({ session, children, appName, menuItems, adminMenuItems, allServices = [], initialBookmarkIds = [], }) {
+    return (_jsxs(ErrorBoundary, { children: [_jsx(DynamicTitle, {}), _jsx(TooltipProvider, { children: _jsx(SidebarProvider, { className: "flex h-screen", children: _jsx(BreadcrumbProvider, { children: _jsxs(BookmarkProvider, { allServices: allServices, initialServiceIds: initialBookmarkIds, children: [_jsx(AppSidebar, { menuItems: menuItems, adminMenuItems: adminMenuItems, session: session, appName: appName }), _jsx(SidebarInset, { className: "flex flex-col overflow-hidden", children: _jsxs(ErrorBoundary, { children: [_jsx(ContentHeader, {}), _jsx("div", { className: "flex-1 overflow-y-auto focus:outline-none", children: children })] }) })] }) }) }) })] }));
 }
 //# sourceMappingURL=ConsoleLayout.js.map

package/dist/shell/components/ConsoleLayout.js.map

@@ -1 +1 @@
-{"version":3,"file":"ConsoleLayout.js","sourceRoot":"","sources":["../../../lib/shell/components/ConsoleLayout.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAGjE,MAAM,UAAU,aAAa,CAAC,EAC5B,OAAO,EACP,QAAQ,EACR,OAAO,EACP,SAAS,EACT,WAAW,GAAG,EAAE,EAChB,kBAAkB,GAAG,EAAE,GACJ;IACnB,OAAO,CACL,KAAC,aAAa,cACZ,KAAC,eAAe,IAAC,SAAS,EAAC,wCAAwC,YACjE,KAAC,kBAAkB,cACjB,MAAC,gBAAgB,IAAC,WAAW,EAAE,WAAW,EAAE,iBAAiB,EAAE,kBAAkB,aAC/E,eAAK,SAAS,EAAC,mBAAmB,aAChC,KAAC,UAAU,IAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,GAAI,EACpD,KAAC,cAAc,KAAG,EAClB,KAAC,SAAS,KAAG,IACT,EACN,eAAK,SAAS,EAAC,8CAA8C,aAC3D,KAAC,UAAU,IAAC,SAAS,EAAE,SAAS,GAAI,EACpC,KAAC,YAAY,IAAC,SAAS,EAAC,yBAAyB,YAC/C,KAAC,aAAa,cACZ,cAAK,SAAS,EAAC,qCAAqC,YAAE,QAAQ,GAAO,GACvD,GACH,IACX,IACW,GACA,GACL,GACJ,CACjB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"ConsoleLayout.js","sourceRoot":"","sources":["../../../lib/shell/components/ConsoleLayout.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,+CAA+C,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AAGpE,MAAM,UAAU,aAAa,CAAC,EAC5B,OAAO,EACP,QAAQ,EACR,OAAO,EACP,SAAS,EACT,cAAc,EACd,WAAW,GAAG,EAAE,EAChB,kBAAkB,GAAG,EAAE,GACJ;IACnB,OAAO,CACL,MAAC,aAAa,eACZ,KAAC,YAAY,KAAG,EAChB,KAAC,eAAe,cACd,KAAC,eAAe,IAAC,SAAS,EAAC,eAAe,YACxC,KAAC,kBAAkB,cACjB,MAAC,gBAAgB,IAAC,WAAW,EAAE,WAAW,EAAE,iBAAiB,EAAE,kBAAkB,aAC/E,KAAC,UAAU,IACT,SAAS,EAAE,SAAS,EACpB,cAAc,EAAE,cAAc,EAC9B,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,GAChB,EACF,KAAC,YAAY,IAAC,SAAS,EAAC,+BAA+B,YACrD,MAAC,aAAa,eACZ,KAAC,aAAa,KAAG,EACjB,cAAK,SAAS,EAAC,2CAA2C,YAAE,QAAQ,GAAO,IAC7D,GACH,IACE,GACA,GACL,GACF,IACJ,CACjB,CAAC;AACJ,CAAC"}

package/dist/shell/components/app-launcher/app-launcher-search-bar.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-launcher-search-bar.d.ts","sourceRoot":"","sources":["../../../../lib/shell/components/app-launcher/app-launcher-search-bar.tsx"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAGzE,QAAA,MAAM,oBAAoB,GAAI,yCAI3B,yBAAyB,4CAa3B,CAAC;AACF,eAAe,oBAAoB,CAAC"}
+{"version":3,"file":"app-launcher-search-bar.d.ts","sourceRoot":"","sources":["../../../../lib/shell/components/app-launcher/app-launcher-search-bar.tsx"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAGzE,QAAA,MAAM,oBAAoB,GAAI,yCAI3B,yBAAyB,4CAgB3B,CAAC;AACF,eAAe,oBAAoB,CAAC"}

package/dist/shell/components/app-launcher/app-launcher-search-bar.js

@@ -2,7 +2,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { Input } from "../../../shared/components/ui/input";
 import { Search } from "lucide-react";
 const AppLauncherSearchBar = ({ value, onSearchChange, placeholder = "Search services...", }) => {
-    return (_jsxs("div", { className: "relative", children: [_jsx(Search, { className: "text-muted-foreground absolute top-1/2 left-3 size-4 -translate-y-1/2" }), _jsx(Input, { type: "text", placeholder: placeholder, value: value, onChange: (e) => onSearchChange(e.target.value), className: "focus:ring-ring w-full rounded-md border-none bg-transparent py-2 pr-3 pl-9 text-sm shadow-none focus:ring-2 focus:ring-offset-2 focus:outline-none dark:focus:border-(--border)" })] }));
+    return (_jsxs("div", { className: "relative", children: [_jsx(Search, { className: "text-primary absolute top-1/2 left-3 size-4 -translate-y-1/2", "aria-hidden": "true" }), _jsx(Input, { type: "text", placeholder: placeholder, value: value, onChange: (e) => onSearchChange(e.target.value), className: "border-primary/20 focus-visible:border-primary focus-visible:ring-primary/30 w-full rounded-md bg-transparent py-2 pr-3 pl-9 text-sm shadow-none focus-visible:ring-[3px] focus-visible:outline-none" })] }));
 };
 export default AppLauncherSearchBar;
 //# sourceMappingURL=app-launcher-search-bar.js.map

package/dist/shell/components/app-launcher/app-launcher-search-bar.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-launcher-search-bar.js","sourceRoot":"","sources":["../../../../lib/shell/components/app-launcher/app-launcher-search-bar.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,kCAAkC,CAAC;AAEzD,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,MAAM,oBAAoB,GAAG,CAAC,EAC5B,KAAK,EACL,cAAc,EACd,WAAW,GAAG,oBAAoB,GACR,EAAE,EAAE;IAC9B,OAAO,CACL,eAAK,SAAS,EAAC,UAAU,aACvB,KAAC,MAAM,IAAC,SAAS,EAAC,uEAAuE,GAAG,EAC5F,KAAC,KAAK,IACJ,IAAI,EAAC,MAAM,EACX,WAAW,EAAE,WAAW,EACxB,KAAK,EAAE,KAAK,EACZ,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAC/C,SAAS,EAAC,kLAAkL,GAC5L,IACE,CACP,CAAC;AACJ,CAAC,CAAC;AACF,eAAe,oBAAoB,CAAC"}
+{"version":3,"file":"app-launcher-search-bar.js","sourceRoot":"","sources":["../../../../lib/shell/components/app-launcher/app-launcher-search-bar.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,kCAAkC,CAAC;AAEzD,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,MAAM,oBAAoB,GAAG,CAAC,EAC5B,KAAK,EACL,cAAc,EACd,WAAW,GAAG,oBAAoB,GACR,EAAE,EAAE;IAC9B,OAAO,CACL,eAAK,SAAS,EAAC,UAAU,aACvB,KAAC,MAAM,IACL,SAAS,EAAC,8DAA8D,iBAC5D,MAAM,GAClB,EACF,KAAC,KAAK,IACJ,IAAI,EAAC,MAAM,EACX,WAAW,EAAE,WAAW,EACxB,KAAK,EAAE,KAAK,EACZ,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAC/C,SAAS,EAAC,sMAAsM,GAChN,IACE,CACP,CAAC;AACJ,CAAC,CAAC;AACF,eAAe,oBAAoB,CAAC"}

package/dist/shell/components/app-launcher/app-launcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-launcher.d.ts","sourceRoot":"","sources":["../../../../lib/shell/components/app-launcher/app-launcher.tsx"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAmB,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAMtF,QAAA,MAAM,WAAW,GAAI,0BAAoC,gBAAgB,4CAwDxE,CAAC;AAEF,eAAe,WAAW,CAAC"}
+{"version":3,"file":"app-launcher.d.ts","sourceRoot":"","sources":["../../../../lib/shell/components/app-launcher/app-launcher.tsx"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAmB,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAItF,QAAA,MAAM,WAAW,GAAI,0BAAoC,gBAAgB,4CAqExE,CAAC;AAEF,eAAe,WAAW,CAAC"}