edgeaegis 2026.10.1

package/tools/.build/scr/origin/types.d.ts

@@ -0,0 +1,18 @@
+export type PlatformName = "cloudflare" | "vercel" | "netlify" | "esa" | "edgeone";
+export type OriginSettings = {
+    mode: "function";
+    platform: PlatformName;
+} | {
+    mode: "proxy";
+    platform: PlatformName;
+    url: string;
+} | {
+    mode: "relay";
+    platform: PlatformName;
+    endpoint: string;
+    publicKeyFile: string;
+    authenticationKeyFile: string;
+};
+export interface BusinessFunction {
+    fetch(request: Request): Promise<Response> | Response;
+}

package/tools/.build/scr/origin/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/tools/.build/scr/origin/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../scr/origin/types.ts"],"names":[],"mappings":""}

package/tools/.build/scr/runtime/allowlist.d.ts

@@ -0,0 +1,21 @@
+import type { TrustedContext } from "../core/types.js";
+export interface AllowlistEntry {
+    /** Operator-defined identifier for auditing. */
+    id: string;
+    /** Bypass any rule, or only the listed rule IDs. "*" means every rule. */
+    ruleIds?: string[];
+    /** Explicitly exempt native WAF rules. */
+    skip: "rules"[];
+    /** All filters below are optional. Omitting them matches all requests. */
+    path?: string;
+    pathPrefix?: string;
+    methods?: string[];
+    identity?: string;
+    verifiedClientIp?: string;
+    cidrs?: string[];
+    /** Optional ISO-8601 expiration: no forced lifetime. */
+    expiresAt?: string;
+    reason?: string;
+}
+/** All bypass scope and expiry are operator-managed. No automatic whitelist entries. */
+export declare function createAllowlist(entries?: AllowlistEntry[]): (path: string, method: string, context: TrustedContext, ruleId: string | null, now: number) => boolean;

package/tools/.build/scr/runtime/allowlist.js

@@ -0,0 +1,84 @@
+import ipaddr from "ipaddr.js";
+/** All bypass scope and expiry are operator-managed. No automatic whitelist entries. */
+export function createAllowlist(entries = []) {
+    if (!Array.isArray(entries))
+        throw new Error("Allowlist must be an array");
+    const prepared = entries.map((entry) => {
+        if (!entry || typeof entry.id !== "string" || !entry.id.trim())
+            throw new Error("Allowlist entry requires an id");
+        if (!Array.isArray(entry.skip) ||
+            !entry.skip.length ||
+            entry.skip.some((value) => value !== "rules"))
+            throw new Error("Allowlist skip must select rules");
+        if (entry.ruleIds !== undefined &&
+            (!Array.isArray(entry.ruleIds) || entry.ruleIds.some((x) => typeof x !== "string" || !x)))
+            throw new Error("Allowlist ruleIds must be an array of rule names or *");
+        if (entry.methods !== undefined &&
+            (!Array.isArray(entry.methods) ||
+                entry.methods.some((x) => typeof x !== "string" || !/^[A-Z]+$/.test(x))))
+            throw new Error("Allowlist methods must be uppercase HTTP methods");
+        if (entry.path !== undefined && (typeof entry.path !== "string" || !entry.path.startsWith("/")))
+            throw new Error("Allowlist path must be an absolute request path");
+        if (entry.pathPrefix !== undefined &&
+            (typeof entry.pathPrefix !== "string" || !entry.pathPrefix.startsWith("/")))
+            throw new Error("Allowlist pathPrefix must be an absolute request path prefix");
+        if (entry.identity !== undefined && (typeof entry.identity !== "string" || !entry.identity))
+            throw new Error("Allowlist identity must be a nonempty string");
+        if (entry.verifiedClientIp !== undefined && !ipaddr.isValid(entry.verifiedClientIp))
+            throw new Error("Allowlist exact IP is invalid");
+        if (entry.cidrs !== undefined &&
+            (!Array.isArray(entry.cidrs) || entry.cidrs.some((x) => typeof x !== "string")))
+            throw new Error("Allowlist CIDRs must be strings");
+        const cidrs = (entry.cidrs ?? []).map((value) => {
+            try {
+                return ipaddr.parseCIDR(value);
+            }
+            catch {
+                throw new Error("Invalid allowlist CIDR");
+            }
+        });
+        const expiry = entry.expiresAt === undefined ? Number.POSITIVE_INFINITY : Date.parse(entry.expiresAt);
+        if (Number.isNaN(expiry))
+            throw new Error("Invalid allowlist expiration");
+        if (entry.reason !== undefined && typeof entry.reason !== "string")
+            throw new Error("Invalid allowlist reason");
+        return { entry, cidrs, expiry };
+    });
+    return (path, method, context, ruleId, now) => prepared.some(({ entry, cidrs, expiry }) => {
+        if (now >= expiry)
+            return false;
+        if (entry.ruleIds &&
+            !entry.ruleIds.includes("*") &&
+            (ruleId === null || !entry.ruleIds.includes(ruleId)))
+            return false;
+        if (entry.path !== undefined && entry.path !== path)
+            return false;
+        if (entry.pathPrefix !== undefined && !path.startsWith(entry.pathPrefix))
+            return false;
+        if (entry.methods !== undefined && !entry.methods.includes(method))
+            return false;
+        if (entry.identity !== undefined && entry.identity !== context.identity)
+            return false;
+        if (entry.verifiedClientIp !== undefined &&
+            entry.verifiedClientIp !== context.verifiedClientIp)
+            return false;
+        if (entry.cidrs !== undefined) {
+            if (!context.verifiedClientIp)
+                return false;
+            let actual;
+            try {
+                actual = ipaddr.process(context.verifiedClientIp);
+            }
+            catch {
+                return false;
+            }
+            if (!cidrs.some(([address, prefix]) => {
+                const candidate = ipaddr.process(address.toString());
+                return actual.kind() === candidate.kind() && actual.match(candidate, prefix);
+            }))
+                return false;
+        }
+        return true;
+    });
+}
+//# sourceMappingURL=allowlist.js.map

package/tools/.build/scr/runtime/allowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlist.js","sourceRoot":"","sources":["../../../../scr/runtime/allowlist.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,WAAW,CAAC;AA2B/B,wFAAwF;AACxF,MAAM,UAAU,eAAe,CAAC,OAAO,GAAqB,EAAE;IAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAe,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACjD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE;YAC5D,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;YAC1B,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM;YAClB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC;YAE7C,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,IACE,KAAK,CAAC,OAAO,KAAK,SAAS;YAC3B,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC;YAEzF,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,IACE,KAAK,CAAC,OAAO,KAAK,SAAS;YAC3B,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;gBAC5B,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAE1E,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC7F,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,IACE,KAAK,CAAC,UAAU,KAAK,SAAS;YAC9B,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAE3E,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAClF,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;YACzF,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,IACE,KAAK,CAAC,KAAK,KAAK,SAAS;YACzB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;YAE/E,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAC9C,IAAI,CAAC;gBACH,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GACV,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACzF,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC1E,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;YAChE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IACH,OAAO,CACL,IAAY,EACZ,MAAc,EACd,OAAuB,EACvB,MAAqB,EACrB,GAAW,EACX,EAAE,CACF,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE;QACzC,IAAI,GAAG,IAAI,MAAM;YAAE,OAAO,KAAK,CAAC;QAChC,IACE,KAAK,CAAC,OAAO;YACb,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC5B,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAEpD,OAAO,KAAK,CAAC;QACf,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAClE,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QACvF,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QACjF,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QACtF,IACE,KAAK,CAAC,gBAAgB,KAAK,SAAS;YACpC,KAAK,CAAC,gBAAgB,KAAK,OAAO,CAAC,gBAAgB;YAEnD,OAAO,KAAK,CAAC;QACf,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,OAAO,CAAC,gBAAgB;gBAAE,OAAO,KAAK,CAAC;YAC5C,IAAI,MAAiC,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IACE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE;gBAChC,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACrD,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,SAAS,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAC/E,CAAC,CAAC;gBAEF,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACP,CAAC"}

package/tools/.build/scr/runtime/browser-cache.d.ts

@@ -0,0 +1,7 @@
+export interface BrowserCachePolicy {
+    /** Maximum freshness lifetime. The origin must also explicitly permit public caching. */
+    maxAgeSeconds: number;
+}
+export declare function validateBrowserCache(policy: BrowserCachePolicy | undefined): void;
+/** Client caching reduces future network requests; no server-side rule decision is reused. */
+export declare function applyBrowserCache(request: Request, response: Response, headers: Headers, policy?: BrowserCachePolicy): void;

package/tools/.build/scr/runtime/browser-cache.js

@@ -0,0 +1,50 @@
+import { requireInteger } from "../core/types.js";
+export function validateBrowserCache(policy) {
+    if (policy === undefined)
+        return;
+    if (!policy ||
+        typeof policy !== "object" ||
+        Object.keys(policy).some((k) => k !== "maxAgeSeconds"))
+        throw new Error("Invalid browser cache policy");
+    requireInteger(policy.maxAgeSeconds, 1, 86400, "browser cache lifetime");
+}
+/** Client caching reduces future network requests; no server-side rule decision is reused. */
+export function applyBrowserCache(request, response, headers, policy) {
+    headers.set("cache-control", "no-store");
+    if (!policy ||
+        !["GET", "HEAD"].includes(request.method) ||
+        response.status !== 200 ||
+        request.headers.has("authorization") ||
+        request.headers.has("proxy-authorization") ||
+        request.headers.has("cookie") ||
+        request.headers.has("upgrade") ||
+        response.headers.has("set-cookie") ||
+        request.headers.get("pragma")?.toLowerCase().includes("no-cache") ||
+        /(?:^|,)\s*(?:(?:no-cache|no-store)(?:\s*=|\s*(?:,|$))|max-age\s*=\s*"?0"?(?:\s|,|$))/i.test(request.headers.get("cache-control") ?? ""))
+        return;
+    const directives = (response.headers.get("cache-control") ?? "")
+        .toLowerCase()
+        .split(",")
+        .map((part) => part.trim());
+    if (!directives.includes("public") ||
+        directives.some((part) => /^(?:private|no-store|no-cache)(?:\s*=|$)/.test(part)))
+        return;
+    const ages = directives.filter((part) => /^max-age\s*=/.test(part));
+    if (ages.length !== 1 || !/^max-age\s*=\s*\d+$/.test(ages[0]))
+        return;
+    const originAge = Number(ages[0].split("=")[1]);
+    if (!Number.isSafeInteger(originAge) || originAge < 1)
+        return;
+    const vary = (response.headers.get("vary") ?? "").split(",").map((part) => part.trim());
+    if (vary.includes("*"))
+        return;
+    // Prevent an anonymous browser entry being reused after a login changes credentials.
+    for (const name of ["Cookie", "Authorization"])
+        if (!vary.some((part) => part.toLowerCase() === name.toLowerCase()))
+            vary.push(name);
+    headers.set("vary", vary.filter(Boolean).join(", "));
+    // Private prohibits a shared cache from answering before the SecLang entry point.
+    // Preserve Date/Age, validators and Vary; never extend the origin freshness lifetime.
+    headers.set("cache-control", `private, max-age=${Math.min(policy.maxAgeSeconds, originAge)}, must-revalidate`);
+}
+//# sourceMappingURL=browser-cache.js.map

package/tools/.build/scr/runtime/browser-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-cache.js","sourceRoot":"","sources":["../../../../scr/runtime/browser-cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAOlD,MAAM,UAAU,oBAAoB,CAAC,MAAsC;IACzE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IACjC,IACE,CAAC,MAAM;QACP,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,eAAe,CAAC;QAEtD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,cAAc,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,EAAE,KAAK,EAAE,wBAAwB,CAAC,CAAC;AAC3E,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,iBAAiB,CAC/B,OAAgB,EAChB,QAAkB,EAClB,OAAgB,EAChB,MAA2B;IAE3B,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IACzC,IACE,CAAC,MAAM;QACP,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QACzC,QAAQ,CAAC,MAAM,KAAK,GAAG;QACvB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QACpC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QAC1C,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC7B,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAC9B,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAClC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;QACjE,uFAAuF,CAAC,IAAI,CAC1F,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAC3C;QAED,OAAO;IACT,MAAM,UAAU,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;SAC7D,WAAW,EAAE;SACb,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9B,IACE,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC9B,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEhF,OAAO;IACT,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;QAAE,OAAO;IACvE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO;IAC9D,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACxF,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO;IAC/B,qFAAqF;IACrF,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,kFAAkF;IAClF,sFAAsF;IACtF,OAAO,CAAC,GAAG,CACT,eAAe,EACf,oBAAoB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,mBAAmB,CACjF,CAAC;AACJ,CAAC"}

package/tools/.build/scr/runtime/error-pages.d.ts

@@ -0,0 +1,10 @@
+/** Trusted, build-generated HTML only. Never interpolate request data into these pages. */
+export interface ErrorPage {
+    html: string;
+    contentSecurityPolicy: string;
+    json?: unknown;
+}
+export type ErrorPages = Partial<Record<number, ErrorPage>>;
+export declare function wantsHtml(request: Request): boolean;
+export declare function createErrorPageResponse(request: Request, status: number, input: ErrorPage): Response;
+export declare function createErrorPages(input: ErrorPages): (request: Request, status: number) => Response | undefined;

package/tools/.build/scr/runtime/error-pages.js

@@ -0,0 +1,72 @@
+export function wantsHtml(request) {
+    const accept = request.headers.get("accept") ?? "";
+    if (accept.length > 8192)
+        return false;
+    let html = 0;
+    let json = 0;
+    for (const item of accept.split(",").slice(0, 64)) {
+        const [type, ...parameters] = item.trim().toLowerCase().split(";");
+        const parameter = parameters.find((p) => p.trim().startsWith("q="));
+        const quality = parameter ? Number(parameter.trim().slice(2)) : 1;
+        if (!Number.isFinite(quality) || quality < 0 || quality > 1)
+            continue;
+        if (type === "text/html" || type === "application/xhtml+xml")
+            html = Math.max(html, quality);
+        if (type === "application/json" || type === "application/*" || type === "*/*")
+            json = Math.max(json, quality);
+    }
+    return html > 0 && html >= json;
+}
+function validate(page) {
+    if (typeof page.html !== "string" ||
+        new TextEncoder().encode(page.html).length > 262144 ||
+        !/<html\b/i.test(page.html))
+        throw new Error("Error pages require trusted complete HTML within 256 KiB");
+    if (typeof page.contentSecurityPolicy !== "string" ||
+        !page.contentSecurityPolicy.trim() ||
+        page.contentSecurityPolicy.length > 8192 ||
+        /[\r\n\0]/.test(page.contentSecurityPolicy))
+        throw new Error("Error pages require a bounded, explicit CSP");
+    return { ...page };
+}
+export function createErrorPageResponse(request, status, input) {
+    if (!Number.isInteger(status) || status < 400 || status > 599)
+        throw new Error("Unsupported error page status");
+    const page = validate(input);
+    return new Response(request.method === "HEAD" ? null : page.html, {
+        status,
+        headers: {
+            "content-type": "text/html; charset=utf-8",
+            "cache-control": "no-store",
+            "content-security-policy": page.contentSecurityPolicy,
+            "x-content-type-options": "nosniff",
+            "x-robots-tag": "noindex, nofollow",
+            "referrer-policy": "no-referrer",
+            vary: "Accept",
+        },
+    });
+}
+export function createErrorPages(input) {
+    if (Object.keys(input).some((key) => !/^\d{3}$/.test(key) || Number(key) < 400 || Number(key) > 599))
+        throw new Error("Unsupported error page status");
+    const pages = {};
+    for (const status of Object.keys(input).map(Number))
+        if (input[status])
+            pages[status] = validate(input[status]);
+    return (request, status) => {
+        const page = pages[status];
+        if (page && wantsHtml(request))
+            return createErrorPageResponse(request, status, page);
+        if (page && page.json !== undefined)
+            return new Response(request.method === "HEAD" ? null : JSON.stringify(page.json), {
+                status,
+                headers: {
+                    "content-type": "application/json; charset=utf-8",
+                    "cache-control": "no-store",
+                    "x-content-type-options": "nosniff",
+                    vary: "Accept",
+                },
+            });
+    };
+}
+//# sourceMappingURL=error-pages.js.map

package/tools/.build/scr/runtime/error-pages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-pages.js","sourceRoot":"","sources":["../../../../scr/runtime/error-pages.ts"],"names":[],"mappings":"AAQA,MAAM,UAAU,SAAS,CAAC,OAAgB;IACxC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnD,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnE,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC;YAAE,SAAS;QACtE,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,uBAAuB;YAAE,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC7F,IAAI,IAAI,KAAK,kBAAkB,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,KAAK;YAC3E,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC;AAClC,CAAC;AAED,SAAS,QAAQ,CAAC,IAAe;IAC/B,IACE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAC7B,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,MAAM;QACnD,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAE3B,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,IACE,OAAO,IAAI,CAAC,qBAAqB,KAAK,QAAQ;QAC9C,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE;QAClC,IAAI,CAAC,qBAAqB,CAAC,MAAM,GAAG,IAAI;QACxC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC;QAE3C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAgB,EAChB,MAAc,EACd,KAAgB;IAEhB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,GAAG,GAAG;QAC3D,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE;QAChE,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,eAAe,EAAE,UAAU;YAC3B,yBAAyB,EAAE,IAAI,CAAC,qBAAqB;YACrD,wBAAwB,EAAE,SAAS;YACnC,cAAc,EAAE,mBAAmB;YACnC,iBAAiB,EAAE,aAAa;YAChC,IAAI,EAAE,QAAQ;SACf;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAiB;IAChD,IACE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QAEhG,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;QACjD,IAAI,KAAK,CAAC,MAAM,CAAC;YAAE,KAAK,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7D,OAAO,CAAC,OAAgB,EAAE,MAAc,EAAwB,EAAE;QAChE,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,IAAI,IAAI,SAAS,CAAC,OAAO,CAAC;YAAE,OAAO,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACtF,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YACjC,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAChF,MAAM;gBACN,OAAO,EAAE;oBACP,cAAc,EAAE,iCAAiC;oBACjD,eAAe,EAAE,UAAU;oBAC3B,wBAAwB,EAAE,SAAS;oBACnC,IAAI,EAAE,QAAQ;iBACf;aACF,CAAC,CAAC;IACP,CAAC,CAAC;AACJ,CAAC"}

package/tools/.build/scr/runtime/index.d.ts

@@ -0,0 +1,54 @@
+import { type SecurityEvent, type TrustedContext } from "../core/types.js";
+import { type BoundaryLimits } from "../http-boundary/index.js";
+import { type CompileSecLangOptions } from "../seclang/index.js";
+import { type AllowlistEntry } from "./allowlist.js";
+import { type BrowserCachePolicy } from "./browser-cache.js";
+import { type ErrorPages } from "./error-pages.js";
+import { type ProxyOptions } from "./proxy.js";
+export type { SecurityEvent, TrustedContext } from "../core/types.js";
+export type { AllowlistEntry } from "./allowlist.js";
+export type { BrowserCachePolicy } from "./browser-cache.js";
+export type { ProxyOptions } from "./proxy.js";
+export interface Route {
+    path: string;
+    business: string;
+    methods: string[];
+    authenticated: boolean;
+    body?: "json" | "text" | "none";
+    /** Inspect the HTTP handshake; upgraded frames remain opaque to SecLang. */
+    websocket?: boolean;
+    /** Opt-in client freshness for public origin responses, after full SecLang inspection. */
+    browserCache?: BrowserCachePolicy;
+}
+export interface ShieldOptions {
+    tenant: string;
+    service: string;
+    publicHosts: string[];
+    routes: Route[];
+    /** Native SecLang rules, compiled and evaluated by EdgeAegis itself (no conversion). */
+    secLang: string;
+    secLangOptions?: Omit<CompileSecLangOptions, "strict">;
+    /** Fully operator-defined rule exemptions, including optional global bypass. */
+    allowlist?: AllowlistEntry[];
+    origins: Record<string, ProxyOptions>;
+    limits?: Partial<BoundaryLimits>;
+    maxConcurrentRequests?: number;
+    event?: (event: SecurityEvent) => void;
+    /** Optional trusted static pages; JSON API responses remain the default. */
+    errorPages?: ErrorPages;
+    now?: () => number;
+}
+export declare function createShield(input: ShieldOptions): Promise<{
+    handle: (request: Request, context: TrustedContext, rawTarget?: string, hooks?: {
+        event?: (event: SecurityEvent) => void;
+    }) => Promise<Response>;
+    version: string;
+    dispose(): void;
+    stats: {
+        requests: number;
+        ruleEvaluations: number;
+        blocked: number;
+        originRequests: number;
+        eventFailures: number;
+    };
+}>;