daemora 1.0.0-alpha.0

package/dist/server/index.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Express bootstrap. Mounts route modules, common middleware, and
+ * surfaces typed errors as proper HTTP responses.
+ */
+import type { Express } from "express";
+import type { ChannelManager } from "../channels/ChannelManager.js";
+import type { ChannelRegistry } from "../channels/ChannelRegistry.js";
+import type { ConfigManager } from "../config/ConfigManager.js";
+import type { AgentLoop } from "../core/AgentLoop.js";
+import type { TaskRunner } from "../core/TaskRunner.js";
+import type { CostTracker } from "../costs/CostTracker.js";
+import type { CrewRegistry } from "../crew/CrewRegistry.js";
+import type { CronStore } from "../cron/CronStore.js";
+import type { CronScheduler } from "../cron/CronScheduler.js";
+import type { MCPManager } from "../mcp/MCPManager.js";
+import type { DeclarativeMemoryStore } from "../memory/DeclarativeMemoryStore.js";
+import type { MemoryStore } from "../memory/MemoryStore.js";
+import type { SessionStore } from "../memory/SessionStore.js";
+import type { GoalStore } from "../goals/GoalStore.js";
+import type { AuditLog } from "../safety/AuditLog.js";
+import type { SkillRegistry } from "../skills/SkillRegistry.js";
+import type { TaskStore } from "../tasks/TaskStore.js";
+import type { TeamStore } from "../teams/TeamStore.js";
+import type { WatcherStore } from "../watchers/WatcherStore.js";
+import type { WatcherRunner } from "../watchers/WatcherRunner.js";
+import type { Auth } from "../auth/index.js";
+import type { IntegrationManager } from "../integrations/IntegrationManager.js";
+import type { TunnelManager } from "../tunnels/TunnelManager.js";
+import type { WebhookTokenStore } from "../webhooks/WebhookTokenStore.js";
+import type { DeliveryPresetStore } from "../scheduler/DeliveryPresetStore.js";
+export interface ServerDeps {
+    readonly cfg: ConfigManager;
+    readonly agent: AgentLoop;
+    readonly runner: TaskRunner;
+    readonly sessions: SessionStore;
+    readonly memory: MemoryStore;
+    readonly declarativeMemory?: DeclarativeMemoryStore;
+    readonly crews: CrewRegistry;
+    readonly crewLoader: import("../crew/CrewLoader.js").CrewLoader;
+    readonly models: import("../models/ModelRouter.js").ModelRouter;
+    readonly costs: CostTracker;
+    readonly audit: AuditLog;
+    readonly cron: CronStore;
+    readonly cronScheduler: CronScheduler;
+    readonly watchers: WatcherStore;
+    readonly watcherRunner: WatcherRunner;
+    readonly goals: GoalStore;
+    readonly tasks: TaskStore;
+    readonly skills: SkillRegistry;
+    readonly mcp: MCPManager;
+    readonly mcpStore: import("../mcp/MCPStore.js").MCPStore;
+    readonly channels: ChannelRegistry;
+    readonly channelManager: ChannelManager;
+    readonly teamStore: TeamStore;
+    readonly auth: Auth;
+    readonly webhookTokens: WebhookTokenStore;
+    /**
+     * When true, the requireAuth middleware gates all /api/* routes.
+     * When false (default, for dev / first-run), the middleware is a
+     * no-op. Flipped via the `AUTH_ENABLED` setting.
+     */
+    readonly authEnabled: boolean;
+    /**
+     * Externally reachable URL used for webhook registration. Accessed
+     * as a getter because the tunnel provider may resolve AFTER server
+     * startup — when it does, routes pick up the new value on next call.
+     */
+    readonly getPublicUrl: () => string;
+    readonly tunnel: TunnelManager;
+    readonly deliveryPresets: DeliveryPresetStore;
+    readonly integrations: IntegrationManager;
+    readonly guard: import("../safety/FilesystemGuard.js").FilesystemGuard;
+    readonly skillLoader: import("../skills/SkillLoader.js").SkillLoader;
+    readonly customSkillsDir: string;
+}
+export declare function createApp(deps: ServerDeps): Express;
+//# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,KAAK,EAAE,OAAO,EAAmC,MAAM,SAAS,CAAC;AAExE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AA0B1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAO/E,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,OAAO,uBAAuB,EAAE,UAAU,CAAC;IAChE,QAAQ,CAAC,MAAM,EAAE,OAAO,0BAA0B,EAAE,WAAW,CAAC;IAChE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,OAAO,oBAAoB,EAAE,QAAQ,CAAC;IACzD,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,aAAa,EAAE,iBAAiB,CAAC;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,MAAM,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,mBAAmB,CAAC;IAC9C,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,OAAO,8BAA8B,EAAE,eAAe,CAAC;IACvE,QAAQ,CAAC,WAAW,EAAE,OAAO,0BAA0B,EAAE,WAAW,CAAC;IACrE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAkNnD"}

package/dist/server/index.js

@@ -0,0 +1,227 @@
+/**
+ * Express bootstrap. Mounts route modules, common middleware, and
+ * surfaces typed errors as proper HTTP responses.
+ */
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+import express from "express";
+import { DaemoraError, toDaemoraError } from "../util/errors.js";
+import { createLogger } from "../util/logger.js";
+import { mountAuthRoutes } from "./routes/auth.js";
+import { mountChannelRoutes } from "./routes/channels.js";
+import { mountChatRoutes } from "./routes/chat.js";
+import { mountCompatRoutes } from "./routes/compat.js";
+import { mountConfigRoutes } from "./routes/config.js";
+import { mountCostRoutes } from "./routes/costs.js";
+import { mountCrewRoutes } from "./routes/crew.js";
+import { mountCronRoutes } from "./routes/cron.js";
+import { mountGoalRoutes } from "./routes/goals.js";
+import { mountMCPRoutes } from "./routes/mcp.js";
+import { mountMemoryRoutes } from "./routes/memory.js";
+import { mountProviderRoutes } from "./routes/providers.js";
+import { mountSecurityRoutes } from "./routes/security.js";
+import { mountSessionRoutes } from "./routes/sessions.js";
+import { mountSkillRoutes } from "./routes/skills.js";
+import { mountTaskRoutes } from "./routes/tasks.js";
+import { mountTeamRoutes } from "./routes/teams.js";
+import { mountVaultRoutes } from "./routes/vault.js";
+import { mountVoiceRoutes } from "./routes/voice.js";
+import { mountWatcherRoutes } from "./routes/watchers.js";
+import { mountIntegrationRoutes } from "./routes/integrations.js";
+import { mountTunnelRoutes } from "./routes/tunnel.js";
+import { mountDeliveryPresetRoutes } from "./routes/deliveryPresets.js";
+import { mountWebhookRoutes } from "../webhooks/WebhookHandler.js";
+import { requireAuth } from "./middleware/requireAuth.js";
+import { cors, createSecurityHeaders } from "./middleware/security.js";
+const log = createLogger("server");
+export function createApp(deps) {
+    const app = express();
+    // Capture the raw body alongside JSON parsing — channel webhooks
+    // (LINE HMAC, etc.) need the unparsed bytes for signature checks.
+    app.use(express.json({
+        // 40 MB leaves headroom for base64-encoded file attachments
+        // (UI encodes up to ~25 MB of raw bytes, which is ~33 MB base64).
+        limit: "40mb",
+        verify: (req, _res, buf) => {
+            req.rawBody = buf.toString("utf8");
+        },
+    }));
+    // Twilio / form-encoded webhooks (WhatsApp) send application/x-www-form-urlencoded.
+    app.use(express.urlencoded({
+        extended: true,
+        verify: (req, _res, buf) => {
+            req.rawBody = buf.toString("utf8");
+        },
+    }));
+    // Channel webhook entrypoint — POST /webhooks/:id dispatches to the
+    // currently-running channel of that id.
+    app.post("/webhooks/:id", async (req, res) => {
+        const id = req.params.id ?? "";
+        const rawBody = req.rawBody ?? null;
+        const ok = await deps.channelManager.dispatchWebhook(id, { headers: req.headers, body: req.body, method: req.method, query: req.query }, {
+            status(code) {
+                res.status(code);
+                return this;
+            },
+            json(body) {
+                res.json(body);
+                return this;
+            },
+            send(body) {
+                res.send(body);
+                return this;
+            },
+            end(body) {
+                res.end(body);
+            },
+        }, rawBody);
+        if (!ok && !res.headersSent)
+            res.status(404).json({ error: "channel not running" });
+    });
+    // Light request log — body never logged.
+    app.use((req, _res, next) => {
+        log.debug({ method: req.method, path: req.path }, "request");
+        next();
+    });
+    // ── Security middleware (applies everywhere, including static) ─────────
+    // CSP needs to permit WebSockets to the LiveKit server at runtime —
+    // the voice room lives on a different origin (e.g. ws://localhost:7880)
+    // so a static 'self' policy would block it. Derive the allowed origins
+    // from the current LIVEKIT_URL setting on each request so config
+    // changes take effect without a server restart.
+    app.use(createSecurityHeaders({
+        extraConnectOrigins: () => {
+            const liveKitUrl = deps.cfg.setting("LIVEKIT_URL") ?? process.env["LIVEKIT_URL"] ?? "";
+            const origins = [];
+            if (liveKitUrl) {
+                try {
+                    const u = new URL(liveKitUrl);
+                    // Allow both the declared scheme and its HTTP twin — the
+                    // LiveKit client does fetch() probes over http/https before
+                    // upgrading to ws/wss, so both have to be whitelisted.
+                    const wsScheme = u.protocol === "https:" ? "wss:" : u.protocol === "http:" ? "ws:" : u.protocol;
+                    const httpScheme = wsScheme === "wss:" ? "https:" : wsScheme === "ws:" ? "http:" : "https:";
+                    const port = u.port;
+                    const host = u.hostname;
+                    // Loopback whitelist — the voice token endpoint rewrites
+                    // the LiveKit URL to match the browser's Host header (so a
+                    // browser on localhost talks to ws://localhost:PORT even if
+                    // the config says 127.0.0.1). To keep CSP from blocking any
+                    // of those variants, allow every loopback alias on the port.
+                    const isLoopback = host === "127.0.0.1" || host === "::1" || host === "localhost";
+                    const hosts = isLoopback ? ["localhost", "127.0.0.1", "[::1]"] : [host];
+                    for (const h of hosts) {
+                        const authority = port ? `${h}:${port}` : h;
+                        origins.push(`${wsScheme}//${authority}`, `${httpScheme}//${authority}`);
+                    }
+                }
+                catch {
+                    // Malformed URL — leave CSP strict.
+                }
+            }
+            return origins;
+        },
+    }));
+    const allowedOrigins = (process.env["CORS_ALLOW_ORIGINS"] ?? "")
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean);
+    app.use(cors({ allowedOrigins }));
+    // Auth gate — guards /api/* + /auth/sessions + /auth/audit + /auth/session.
+    // Login/refresh/logout bypass is handled inside the middleware.
+    app.use(requireAuth({
+        fileToken: deps.auth.fileToken,
+        enabled: deps.authEnabled,
+    }));
+    // Auth routes — always mounted. If authEnabled=false they still work,
+    // just nothing requires them yet. Handy for pre-enabling the UI flow.
+    mountAuthRoutes(app, deps.auth);
+    // Serve the Daemora UI from ui/dist/ (full UI source lives at ui/).
+    const uiDir = process.env["DAEMORA_UI_DIR"] ?? join(dirname(fileURLToPath(import.meta.url)), "../../ui/dist");
+    app.use(express.static(uiDir));
+    // SPA fallback — inject the loopback file-token as a <meta> tag so
+    // same-machine UI loads can auth-fetch without a login step. Remote
+    // browsers never see the token because the injector noops when the
+    // request peer isn't loopback.
+    app.get("*", (req, res, next) => {
+        if (req.path.startsWith("/api/")
+            || req.path === "/health"
+            || req.path.startsWith("/oauth/")
+            || req.path.startsWith("/webhooks/")
+            || req.path.startsWith("/hooks/"))
+            return next();
+        const indexPath = join(uiDir, "index.html");
+        try {
+            const raw = readFileSync(indexPath, "utf-8");
+            const peer = req.socket.remoteAddress;
+            const isLocal = peer === "127.0.0.1" || peer === "::1" || peer === "::ffff:127.0.0.1";
+            const injected = isLocal && deps.authEnabled
+                ? raw.replace("</head>", `<meta name="api-token" content="${deps.auth.fileToken}"></head>`)
+                : raw;
+            res.setHeader("Content-Type", "text/html; charset=utf-8");
+            res.send(injected);
+        }
+        catch {
+            next();
+        }
+    });
+    app.get(["/health", "/api/health"], (_req, res) => {
+        res.json({
+            ok: true,
+            status: "ok",
+            uptime: Math.floor(process.uptime()),
+            tools: deps.agent.tools.list().length,
+            model: deps.cfg.setting("DEFAULT_MODEL") ?? "ollama:llama3.1",
+            permissionTier: "full",
+            queue: { pending: 0, running: 0, completed: 0, failed: 0, total: 0 },
+            todayCost: deps.costs.todayCost(),
+            vault_unlocked: deps.cfg.vault.isUnlocked(),
+            vault_exists: deps.cfg.vault.exists(),
+        });
+    });
+    // Express dispatches by first-registered handler. compat.ts already
+    // implements the full UI-facing surface (tasks, costs, cron, mcp,
+    // skills, goals, memory, crew, channels, teams, watchers...) with the
+    // exact shapes the React UI expects. Mount it FIRST so those paths
+    // win. The new dedicated route modules below register additional
+    // endpoints (PATCH, search, /file, /summary, etc.) compat doesn't have.
+    mountCompatRoutes(app, deps);
+    mountChannelRoutes(app, deps);
+    mountChatRoutes(app, deps);
+    mountConfigRoutes(app, deps);
+    mountCostRoutes(app, deps);
+    mountCrewRoutes(app, deps);
+    mountCronRoutes(app, deps);
+    mountGoalRoutes(app, deps);
+    mountMCPRoutes(app, deps);
+    mountMemoryRoutes(app, deps);
+    mountProviderRoutes(app, deps);
+    mountSecurityRoutes(app, deps);
+    mountSessionRoutes(app, deps);
+    mountSkillRoutes(app, deps);
+    mountTaskRoutes(app, deps);
+    mountTeamRoutes(app, deps);
+    mountVaultRoutes(app, deps);
+    mountVoiceRoutes(app, deps); // voice token + sidecar control
+    mountWatcherRoutes(app, deps);
+    mountTunnelRoutes(app, deps.tunnel, deps.getPublicUrl);
+    mountIntegrationRoutes(app, { integrations: deps.integrations, getPublicUrl: deps.getPublicUrl, cfg: deps.cfg });
+    mountDeliveryPresetRoutes(app, deps.deliveryPresets);
+    mountWebhookRoutes(app, {
+        runner: deps.runner,
+        watchers: deps.watchers,
+        webhookTokens: deps.webhookTokens,
+        authStore: deps.auth.store,
+    });
+    // (compat is now mounted FIRST above so its UI-shaped responses win
+    //  for paths the new dedicated route modules also define.)
+    // Final error handler — converts thrown errors to typed JSON responses.
+    app.use((err, _req, res, _next) => {
+        const e = err instanceof DaemoraError ? err : toDaemoraError(err);
+        log.error({ code: e.code, status: e.status, message: e.message }, "request failed");
+        res.status(e.status).json(e.toJSON());
+    });
+    return app;
+}
+//# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,OAAO,MAAM,SAAS,CAAC;AA2B9B,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAExE,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEvE,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;AAgDnC,MAAM,UAAU,SAAS,CAAC,IAAgB;IACxC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,iEAAiE;IACjE,kEAAkE;IAClE,GAAG,CAAC,GAAG,CACL,OAAO,CAAC,IAAI,CAAC;QACX,4DAA4D;QAC5D,kEAAkE;QAClE,KAAK,EAAE,MAAM;QACb,MAAM,EAAE,CAAC,GAAY,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;YACjC,GAAsC,CAAC,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzE,CAAC;KACF,CAAC,CACH,CAAC;IACF,oFAAoF;IACpF,GAAG,CAAC,GAAG,CACL,OAAO,CAAC,UAAU,CAAC;QACjB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,CAAC,GAAY,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;YACjC,GAAsC,CAAC,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzE,CAAC;KACF,CAAC,CACH,CAAC;IAEF,oEAAoE;IACpE,wCAAwC;IACxC,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC9D,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAI,GAAsC,CAAC,OAAO,IAAI,IAAI,CAAC;QACxE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAClD,EAAE,EACF,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAgC,EAAE,EACzG;YACE,MAAM,CAAC,IAAY;gBACjB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,IAAa;gBAChB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACf,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,IAAY;gBACf,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACf,OAAO,IAAI,CAAC;YACd,CAAC;YACD,GAAG,CAAC,IAAa;gBACf,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;SACF,EACD,OAAO,CACR,CAAC;QACF,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW;YAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,yCAAyC;IACzC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB,EAAE,EAAE;QAC3D,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC;QAC7D,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,oEAAoE;IACpE,wEAAwE;IACxE,uEAAuE;IACvE,iEAAiE;IACjE,gDAAgD;IAChD,GAAG,CAAC,GAAG,CACL,qBAAqB,CAAC;QACpB,mBAAmB,EAAE,GAAG,EAAE;YACxB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YACvF,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;oBAC9B,yDAAyD;oBACzD,4DAA4D;oBAC5D,uDAAuD;oBACvD,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;oBAChG,MAAM,UAAU,GAAG,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;oBAC5F,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;oBACpB,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC;oBACxB,yDAAyD;oBACzD,2DAA2D;oBAC3D,4DAA4D;oBAC5D,4DAA4D;oBAC5D,6DAA6D;oBAC7D,MAAM,UAAU,GAAG,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,WAAW,CAAC;oBAClF,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;oBACxE,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;wBACtB,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;wBAC5C,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,KAAK,SAAS,EAAE,EAAE,GAAG,UAAU,KAAK,SAAS,EAAE,CAAC,CAAC;oBAC3E,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,oCAAoC;gBACtC,CAAC;YACH,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC,CACH,CAAC;IACF,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC;SAC7D,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;IAElC,4EAA4E;IAC5E,gEAAgE;IAChE,GAAG,CAAC,GAAG,CACL,WAAW,CAAC;QACV,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;QAC9B,OAAO,EAAE,IAAI,CAAC,WAAW;KAC1B,CAAC,CACH,CAAC;IAEF,sEAAsE;IACtE,sEAAsE;IACtE,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAEhC,oEAAoE;IACpE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;IAC9G,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/B,mEAAmE;IACnE,oEAAoE;IACpE,mEAAmE;IACnE,+BAA+B;IAC/B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9B,IACE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;eACzB,GAAG,CAAC,IAAI,KAAK,SAAS;eACtB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;eAC9B,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;eACjC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YACjC,OAAO,IAAI,EAAE,CAAC;QAChB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC;YACtC,MAAM,OAAO,GAAG,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,kBAAkB,CAAC;YACtF,MAAM,QAAQ,GAAG,OAAO,IAAI,IAAI,CAAC,WAAW;gBAC1C,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,mCAAmC,IAAI,CAAC,IAAI,CAAC,SAAS,WAAW,CAAC;gBAC3F,CAAC,CAAC,GAAG,CAAC;YACR,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;YAC1D,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,EAAE,CAAC;QACT,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAChD,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM;YACrC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,iBAAiB;YAC7D,cAAc,EAAE,MAAM;YACtB,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;YACpE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;YACjC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE;YAC3C,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE;SACtC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,oEAAoE;IACpE,kEAAkE;IAClE,sEAAsE;IACtE,mEAAmE;IACnE,iEAAiE;IACjE,wEAAwE;IACxE,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE7B,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC9B,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3B,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7B,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3B,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3B,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3B,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3B,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1B,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7B,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC/B,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC/B,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC9B,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5B,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3B,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3B,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5B,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAE,gCAAgC;IAC9D,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC9B,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACvD,sBAAsB,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACjH,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACrD,kBAAkB,CAAC,GAAG,EAAE;QACtB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;KAC3B,CAAC,CAAC;IACH,oEAAoE;IACpE,2DAA2D;IAE3D,wEAAwE;IACxE,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,IAAa,EAAE,GAAa,EAAE,KAAmB,EAAE,EAAE;QAC1E,MAAM,CAAC,GAAG,GAAG,YAAY,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAClE,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,gBAAgB,CAAC,CAAC;QACpF,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/server/middleware/requireAuth.d.ts

@@ -0,0 +1,41 @@
+/**
+ * requireAuth — gate every protected route behind the loopback file-
+ * token. No JWT sessions; there are no user accounts in Daemora, only
+ * the vault on this machine.
+ *
+ * Acceptance:
+ *   1. `X-Auth-Token: <token>` loopback file-token — only when the TCP
+ *      peer is 127.0.0.1/::1 (X-Forwarded-For ignored).
+ *   2. `?token=<token>` query — same rule; used by SSE/EventSource
+ *      which can't set headers.
+ *   Otherwise → 401.
+ *
+ * Bypassed paths:
+ *   - /health, /api/health — monitoring probes
+ *   - /auth/login, /auth/logout — vault unlock/lock flow (no auth required
+ *       because they ARE the credential exchange)
+ *   - /webhooks/:id — channel webhook ingress (per-channel HMAC)
+ *   - /hooks/:watcher — watcher webhook (per-watcher token / HMAC)
+ *   - /oauth/:provider/callback — external OAuth redirect landing
+ *
+ * On success, `req.auth = { userId: "local", scopes: ["all"], loopback: true }`
+ * so any remaining scope checks trivially pass. Daemora is single-tenant.
+ */
+import type { NextFunction, Request, Response } from "express";
+export interface AuthContext {
+    readonly userId: string;
+    readonly scopes: readonly string[];
+    readonly loopback: boolean;
+}
+export interface RequireAuthDeps {
+    readonly fileToken: string;
+    readonly enabled: boolean;
+}
+export declare function requireAuth(deps: RequireAuthDeps): (req: Request, res: Response, next: NextFunction) => void;
+/**
+ * Per-route scope guard. With the JWT system gone the local loopback
+ * caller always has `all`, so this is effectively a no-op — kept for
+ * future scope models and to avoid a wide refactor.
+ */
+export declare function requireScope(_scope: string): (req: Request, res: Response, next: NextFunction) => void | Response<any, Record<string, any>>;
+//# sourceMappingURL=requireAuth.d.ts.map

package/dist/server/middleware/requireAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requireAuth.d.ts","sourceRoot":"","sources":["../../../src/server/middleware/requireAuth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAI/D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAQD,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,IACvC,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UA6BxD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,IACjC,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,+CAIxD"}

package/dist/server/middleware/requireAuth.js

@@ -0,0 +1,72 @@
+/**
+ * requireAuth — gate every protected route behind the loopback file-
+ * token. No JWT sessions; there are no user accounts in Daemora, only
+ * the vault on this machine.
+ *
+ * Acceptance:
+ *   1. `X-Auth-Token: <token>` loopback file-token — only when the TCP
+ *      peer is 127.0.0.1/::1 (X-Forwarded-For ignored).
+ *   2. `?token=<token>` query — same rule; used by SSE/EventSource
+ *      which can't set headers.
+ *   Otherwise → 401.
+ *
+ * Bypassed paths:
+ *   - /health, /api/health — monitoring probes
+ *   - /auth/login, /auth/logout — vault unlock/lock flow (no auth required
+ *       because they ARE the credential exchange)
+ *   - /webhooks/:id — channel webhook ingress (per-channel HMAC)
+ *   - /hooks/:watcher — watcher webhook (per-watcher token / HMAC)
+ *   - /oauth/:provider/callback — external OAuth redirect landing
+ *
+ * On success, `req.auth = { userId: "local", scopes: ["all"], loopback: true }`
+ * so any remaining scope checks trivially pass. Daemora is single-tenant.
+ */
+import { constantTimeEqual, isLoopback } from "../../auth/fileToken.js";
+const BYPASS_EXACT = new Set([
+    "/health", "/api/health",
+    "/auth/login", "/auth/logout", "/auth/session",
+]);
+const BYPASS_PREFIX = ["/webhooks/", "/hooks/", "/oauth/"];
+export function requireAuth(deps) {
+    return (req, res, next) => {
+        const path = req.path;
+        const bypass = BYPASS_EXACT.has(path)
+            || BYPASS_PREFIX.some((p) => path.startsWith(p));
+        const peer = req.socket.remoteAddress;
+        const loopback = isLoopback(peer);
+        let identified = false;
+        if (loopback) {
+            const headerTok = typeof req.headers["x-auth-token"] === "string"
+                ? req.headers["x-auth-token"]
+                : null;
+            const queryTok = typeof req.query["token"] === "string"
+                ? req.query["token"]
+                : null;
+            const supplied = headerTok ?? queryTok;
+            if (supplied && constantTimeEqual(supplied, deps.fileToken)) {
+                req.auth = { userId: "local", scopes: ["all"], loopback: true };
+                identified = true;
+            }
+        }
+        if (bypass)
+            return next();
+        if (!deps.enabled)
+            return next();
+        if (identified)
+            return next();
+        res.status(401).json({ error: "Unauthorized", code: "auth_required" });
+    };
+}
+/**
+ * Per-route scope guard. With the JWT system gone the local loopback
+ * caller always has `all`, so this is effectively a no-op — kept for
+ * future scope models and to avoid a wide refactor.
+ */
+export function requireScope(_scope) {
+    return (req, res, next) => {
+        if (!req.auth)
+            return res.status(401).json({ error: "Unauthorized" });
+        return next();
+    };
+}
+//# sourceMappingURL=requireAuth.js.map

package/dist/server/middleware/requireAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requireAuth.js","sourceRoot":"","sources":["../../../src/server/middleware/requireAuth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAaxE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS;IACnC,SAAS,EAAE,aAAa;IACxB,aAAa,EAAE,cAAc,EAAE,eAAe;CAC/C,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AAE3D,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACtB,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;eAChC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAEnD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC;QACtC,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,UAAU,GAAG,KAAK,CAAC;QAEvB,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,QAAQ;gBAC/D,CAAC,CAAE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAY;gBACzC,CAAC,CAAC,IAAI,CAAC;YACT,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,QAAQ;gBACrD,CAAC,CAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAY;gBAChC,CAAC,CAAC,IAAI,CAAC;YACT,MAAM,QAAQ,GAAG,SAAS,IAAI,QAAQ,CAAC;YACvC,IAAI,QAAQ,IAAI,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5D,GAAG,CAAC,IAAI,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBAChE,UAAU,GAAG,IAAI,CAAC;YACpB,CAAC;QACH,CAAC;QAED,IAAI,MAAM;YAAE,OAAO,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,EAAE,CAAC;QACjC,IAAI,UAAU;YAAE,OAAO,IAAI,EAAE,CAAC;QAE9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;IACzE,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,CAAC,GAAG,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QACtE,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/server/middleware/security.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Security middleware — headers + CORS + rate limit + exponential backoff.
+ *
+ * Headers (applied to every response):
+ *   X-Content-Type-Options   : nosniff
+ *   X-Frame-Options          : DENY
+ *   Referrer-Policy          : no-referrer
+ *   Content-Security-Policy  : tight — only self + data: images + inline
+ *                              styles (the UI bundles inline styles).
+ *                              Script-src is 'self' only — no eval, no CDN.
+ *   Strict-Transport-Security: max-age=31536000; includeSubDomains
+ *                              (only emitted when the request arrived
+ *                              over HTTPS, via X-Forwarded-Proto or the
+ *                              socket's tls flag — never asserted on
+ *                              plain http to avoid breaking loopback)
+ *
+ * CORS (for /api/* and /auth/*):
+ *   - Same-origin + loopback by default
+ *   - Additional allowed origins via `CORS_ALLOW_ORIGINS` (comma list)
+ *   - Credentials: true (needed for httpOnly refresh cookie)
+ *   - OPTIONS preflight: 204 with the allow-* headers
+ *
+ * Rate limit (per IP):
+ *   - Exposed as a middleware factory: `rateLimit({ max, windowMs })`
+ *   - Exponential backoff variant for /auth/login specifically: after
+ *     N consecutive failures from the same IP, reject with 429 and a
+ *     Retry-After header for 2^N seconds (capped at 1h).
+ */
+import type { NextFunction, Request, Response } from "express";
+export interface SecurityHeadersOpts {
+    /**
+     * Called per-request to return the list of extra origins the page is
+     * allowed to open connections to (WebSockets, fetch, etc.). Used for
+     * LiveKit — the browser's voice room is a separate origin from the
+     * API server, so CSP has to permit it explicitly.
+     */
+    readonly extraConnectOrigins?: () => readonly string[];
+}
+/**
+ * Default security headers middleware (for callers that don't need
+ * dynamic CSP). Retained as a convenience; production code goes
+ * through `createSecurityHeaders` so runtime values like LIVEKIT_URL
+ * can be reflected in the CSP.
+ */
+export declare function securityHeaders(req: Request, res: Response, next: NextFunction): void;
+export declare function createSecurityHeaders(opts?: SecurityHeadersOpts): (req: Request, res: Response, next: NextFunction) => void;
+export interface CorsOpts {
+    /** Explicit allow-list; `*` wildcards are NOT allowed (would break credentialed CORS). */
+    readonly allowedOrigins?: readonly string[];
+}
+export declare function cors(opts?: CorsOpts): (req: Request, res: Response, next: NextFunction) => void;
+export interface RateLimitOpts {
+    readonly max: number;
+    readonly windowMs: number;
+    /** Key extractor. Default: peer IP (socket.remoteAddress, not XFF). */
+    readonly keyFn?: (req: Request) => string;
+}
+/**
+ * Fixed-window per-IP rate limit. In-memory; sufficient for a
+ * self-hosted single-process agent. Multi-instance deploys should
+ * swap this for Redis.
+ */
+export declare function rateLimit(opts: RateLimitOpts): (req: Request, res: Response, next: NextFunction) => void;
+/**
+ * Exponential backoff per IP for login failures. Each consecutive
+ * failure doubles the lockout. Resets on success via `recordSuccess`.
+ *
+ * Usage:
+ *   const backoff = loginBackoff();
+ *   app.post("/auth/login", backoff.middleware, async (req, res) => {
+ *     const ok = await verify(...);
+ *     if (!ok) return backoff.recordFailure(req, res);
+ *     backoff.recordSuccess(req);
+ *     ...
+ *   });
+ */
+export interface LoginBackoff {
+    middleware(req: Request, res: Response, next: NextFunction): void;
+    recordFailure(req: Request, res: Response): void;
+    recordSuccess(req: Request): void;
+}
+export declare function loginBackoff(): LoginBackoff;
+//# sourceMappingURL=security.d.ts.map

package/dist/server/middleware/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/server/middleware/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAwB/D,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;CACxD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAUrF;AAED,wBAAgB,qBAAqB,CAAC,IAAI,GAAE,mBAAwB,IAC1D,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAYxD;AAID,MAAM,WAAW,QAAQ;IACvB,0FAA0F;IAC1F,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAED,wBAAgB,IAAI,CAAC,IAAI,GAAE,QAAa,IAE9B,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAoBxD;AAaD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uEAAuE;IACvE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;CAC3C;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,aAAa,IAEnC,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAkBxD;AAID;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,YAAY;IAC3B,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IAClE,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,IAAI,CAAC;IACjD,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAAC;CACnC;AAKD,wBAAgB,YAAY,IAAI,YAAY,CAgC3C"}