sporades 0.9.42 → 0.9.43

package/CHANGES.md

@@ -1,5 +1,27 @@
 # Changes
 
+## v0.9.43 - 2026-11-01
+
+Changes since v0.9.42.
+
+### 🚀 Features
+
+- Allow registry propagation before verifying npm releases (#324) (15bdab53).
+
+### 🐛 Bug Fixes
+
+- Fix dependency audit vulnerabilities (#328) (cd70c8de).
+
+### 🔧 Improvements
+
+- Regenerate dist and bin [skip ci] (de2841c9).
+- Regenerate dist and bin [skip ci] (57a49c25).
+
+### 📝 Documentation
+
+- Preserve endpoint security on rollback and record ingress refusals (#327) (1a7e2185).
+- Trigger npm releases from labelled Release issues (#325) (83a9c292).
+
 ## v0.9.42 - 2026-10-30
 
 Changes since v0.9.41.

package/bin/sporades-host-helper.js

@@ -46189,7 +46189,7 @@ var mutationExecution = new MutationExecutionStorage();
 init_cli_support();
 
 // src/cli/cli-version.ts
-var CLI_VERSION = "0.9.42";
+var CLI_VERSION = "0.9.43";
 
 // src/cli/schedule-inspection-envelope.ts
 var SCHEDULE_DIAGNOSTIC_FIELDS = /* @__PURE__ */ new Set([

package/bin/sporades.js

@@ -95491,6 +95491,38 @@ function flushTeamSecurityEvents(database, context2, options = {}) {
   }
 }
 
+// src/endpoint-error.ts
+function endpointError(headers) {
+  const invalid4 = () => new Error("Invalid endpoint error headers.");
+  if (!headers || typeof headers !== "object" || Array.isArray(headers) || ![Object.prototype, null].includes(Object.getPrototypeOf(headers))) throw invalid4();
+  const result = {};
+  let size = 0;
+  for (const key of Reflect.ownKeys(headers)) {
+    if (typeof key !== "string") throw invalid4();
+    const name2 = key.toLowerCase();
+    if (!["cache-control", "pragma", "x-robots-tag", "content-security-policy", "referrer-policy"].includes(name2) || Object.hasOwn(result, name2)) throw invalid4();
+    const property = Object.getOwnPropertyDescriptor(headers, key);
+    const value = property?.value;
+    if (!property || !Object.hasOwn(property, "value") || typeof value !== "string" || !value.trim() || /[^\x20-\x7e]/.test(value)) throw invalid4();
+    size += name2.length + value.length;
+    if (size > 8192) throw invalid4();
+    result[name2] = value;
+  }
+  const error = new Error("Endpoint handler failed.");
+  Object.defineProperty(error, Symbol.for("sporades.endpoint.errorHeaders"), { value: Object.freeze(result) });
+  return error;
+}
+function endpointErrorResponseHeaders(error) {
+  try {
+    const descriptor = error && typeof error === "object" ? Object.getOwnPropertyDescriptor(error, Symbol.for("sporades.endpoint.errorHeaders")) : void 0;
+    if (!descriptor || !Object.hasOwn(descriptor, "value")) return {};
+    const checked = endpointError(descriptor.value);
+    return checked[Symbol.for("sporades.endpoint.errorHeaders")];
+  } catch {
+    return {};
+  }
+}
+
 // src/http-runtime.ts
 import { ServerResponse } from "node:http";
 import { randomBytes as randomBytes6 } from "node:crypto";
@@ -129726,8 +129758,9 @@ function prepareHttpSecurity(database, request, response, admitPreflight) {
   response.writeHead = ((statusCode, statusMessageOrHeaders, maybeHeaders) => {
     const statusMessage = typeof statusMessageOrHeaders === "string" ? statusMessageOrHeaders : void 0;
     const inputHeaders = statusMessage ? maybeHeaders : typeof statusMessageOrHeaders === "string" ? {} : statusMessageOrHeaders;
+    const supplied = sanitizeResponseHeaders({ ...response.getHeaders?.() ?? {}, ...inputHeaders });
     const headers = {
-      ...sanitizeResponseHeaders(inputHeaders ?? {}),
+      ...supplied,
       "x-content-type-options": "nosniff",
       "referrer-policy": "no-referrer",
       "x-frame-options": "DENY",
@@ -129736,6 +129769,11 @@ function prepareHttpSecurity(database, request, response, admitPreflight) {
       [policy.csp.header]: serializeCspDirectives(directives),
       ...policy.hsts ? { "strict-transport-security": policy.hsts } : {}
     };
+    const suppliedCsp = supplied[policy.csp.header];
+    if (suppliedCsp) headers[policy.csp.header] = [
+      ...Array.isArray(suppliedCsp) ? suppliedCsp.map(String) : [String(suppliedCsp)],
+      serializeCspDirectives(directives)
+    ];
     if (isGuardedAttachmentHttpResponse(response)) {
       delete headers["content-security-policy-report-only"];
       delete headers["access-control-allow-origin"];
@@ -130015,7 +130053,7 @@ function sanitizeResponseHeaders(headers) {
     [...entries].filter(([name2]) => {
       const normalized = String(name2).toLowerCase();
       return normalized !== "x-powered-by" && normalized !== "server";
-    })
+    }).map(([name2, value]) => [String(name2).toLowerCase(), value])
   );
 }
 async function handleFileHttpRoute(database, request, response, websocketHub = null) {
@@ -130282,7 +130320,7 @@ function mergeEndpointResponseHeaders(handlerHeaders, runtimeHeaders) {
   return { ...headers, ...runtimeHeaders };
 }
 function writeEndpointError(response, error) {
-  const headers = { "content-type": "application/json; charset=utf-8" };
+  const headers = { ...endpointErrorResponseHeaders(error), "content-type": "application/json; charset=utf-8" };
   if (error?.code === "UNAUTHENTICATED" && error?.sporadesAccessKeyFailure) {
     headers["www-authenticate"] = error?.sporadesAccessKeyFailure === "invalid" && error?.sporadesAccessKeyReason !== "missing" ? 'Bearer realm="sporades", error="invalid_token"' : 'Bearer realm="sporades"';
   }
@@ -130290,6 +130328,10 @@ function writeEndpointError(response, error) {
     headers["cache-control"] = "no-store";
     headers.pragma = "no-cache";
   }
+  if (String(response.getHeader?.("cache-control") ?? "").includes("no-store")) {
+    headers["cache-control"] = response.getHeader("cache-control");
+    headers.pragma = "no-cache";
+  }
   const multipartDetails = safeMultipartLimitDetails(error);
   response.writeHead(endpointErrorStatus(error), headers);
   response.end(
@@ -130314,6 +130356,7 @@ function safeMultipartLimitDetails(error) {
   return { partType: details.partType, limitKind: details.limitKind, limit: details.limit };
 }
 function endpointErrorStatus(error) {
+  if (error?.code === "FILE_INGRESS_REFUSAL_FAILED") return 503;
   if (error?.code === "UNAUTHENTICATED") return 401;
   if (error?.code === "FORBIDDEN") return 403;
   if (error?.code === "RATE_LIMITED") return 429;
@@ -142565,6 +142608,7 @@ function privilegedOnlyTableAcl() {
 }
 function serverRuntimeModuleSource() {
   return `export { escapeHtml, html } from "sporades:html";
+export const endpointError = ${endpointError.toString()};
 const validateEndpointSessionDeclaration = ${validateEndpointSessionDeclaration.toString()};
 const AUTH_REQUIREMENTS = Symbol.for("sporades.auth.requirements");
 const ATOMIC_STRIPE_EVENT_DEFINITION = Symbol.for("sporades.stripeEvent.atomicDefinition");
@@ -145115,6 +145159,49 @@ function restartPolicyStatus(mode, overrides2 = {}) {
   };
 }
 
+// src/file-ingress-refusal.ts
+function snapshotIngressDecision(value) {
+  let nodes = 0;
+  let bytes = 0;
+  const invalid4 = () => {
+    throw new Error("Invalid File ingress decision.");
+  };
+  const visit = (input, depth2) => {
+    if (++nodes > 1024 || depth2 > 16) return invalid4();
+    if (input === null || typeof input === "boolean") return input;
+    if (typeof input === "number") return Number.isFinite(input) ? input : invalid4();
+    if (typeof input === "string") {
+      bytes += Buffer.byteLength(input, "utf8");
+      return bytes <= 8192 ? input : invalid4();
+    }
+    if (!input || typeof input !== "object" || !Array.isArray(input) && ![Object.prototype, null].includes(Object.getPrototypeOf(input))) return invalid4();
+    const output = Array.isArray(input) ? [] : /* @__PURE__ */ Object.create(null);
+    for (const key of Reflect.ownKeys(input)) {
+      if (Array.isArray(input) && key === "length") continue;
+      if (typeof key !== "string") return invalid4();
+      bytes += Buffer.byteLength(key, "utf8");
+      if (bytes > 8192) return invalid4();
+      const descriptor = Object.getOwnPropertyDescriptor(input, key);
+      if (!descriptor || !Object.hasOwn(descriptor, "value") || !descriptor.enumerable) return invalid4();
+      if (depth2 === 0 && (key === "allowFiles" || key === "refusalJob") && descriptor.value === void 0) continue;
+      if (Array.isArray(input) && (!/^(0|[1-9][0-9]*)$/.test(key) || Number(key) >= 1024)) return invalid4();
+      Object.defineProperty(output, key, { value: visit(descriptor.value, depth2 + 1), enumerable: true });
+    }
+    if (Array.isArray(input) && (input.length > 1024 || Object.keys(output).length !== input.length)) return invalid4();
+    return Object.freeze(output);
+  };
+  const result = visit(value, 0);
+  if (Buffer.byteLength(JSON.stringify(result) ?? "", "utf8") > 8192) invalid4();
+  return result;
+}
+function ingressRefusalJob(decision) {
+  if (!decision || decision.allow !== false || Object.keys(decision).some((key) => !["allow", "refusalJob"].includes(key))) throw new Error("Invalid File ingress refusal.");
+  if (!Object.hasOwn(decision, "refusalJob")) return null;
+  const job = decision.refusalJob;
+  if (!job || typeof job !== "object" || Array.isArray(job) || Object.keys(job).length !== 3 || Object.keys(job).some((key) => !["name", "payload", "idempotencyKey"].includes(key)) || typeof job.name !== "string" || !/^[a-zA-Z][a-zA-Z0-9_-]{0,127}$/.test(job.name) || typeof job.idempotencyKey !== "string" || !job.idempotencyKey || Buffer.byteLength(job.idempotencyKey, "utf8") > 256 || /[\x00-\x1f\x7f]/.test(job.idempotencyKey) || !Object.hasOwn(job, "payload") || Buffer.byteLength(JSON.stringify(job.payload), "utf8") > 4096) throw new Error("Invalid File ingress refusal.");
+  return job;
+}
+
 // src/services-context.ts
 import { inspect } from "node:util";
 var hidden = { toJSON: { value: () => void 0 }, [inspect.custom]: { value: () => "[Capsule services]" } };
@@ -151471,25 +151558,47 @@ function multipartAdmissionFilePermission(decision, principalMode = false) {
   if (keys.some((key) => key !== "allow" && key !== "allowFiles" && !(principalMode && key === "principal")) || !allow || !Object.prototype.hasOwnProperty.call(allow, "value") || allow.value !== true || principalMode && (!principal || !Object.prototype.hasOwnProperty.call(principal, "value")) || allowFiles && (!Object.prototype.hasOwnProperty.call(allowFiles, "value") || allowFiles.value !== void 0 && typeof allowFiles.value !== "boolean")) throw multipartAdmissionDenied();
   return allowFiles?.value !== false;
 }
-async function admitCapsuleIngressPrincipal(database, endpoint, endpointRequest, signal) {
+async function admitCapsuleIngressPrincipal(database, endpoint, endpointRequest, requestSignal) {
+  const signal = requestSignal ? AbortSignal.any([requestSignal, AbortSignal.timeout(5e3)]) : AbortSignal.timeout(5e3);
   const definition = database.fileIngressDefinition;
   if (!definition) throw commandError("Unauthenticated.", "Provide valid ingress authority and retry.", "UNAUTHENTICATED");
-  const decision = await database.adapter.withTransaction((transaction) => withTrustedRead(database, {
-    transaction,
-    purpose: "files.ingress-admission",
-    subject: { method: endpoint.options.method, path: endpoint.options.path },
-    signal
-  }, (db, assertActive) => definition.admit(Object.freeze({
-    db,
-    app: database.app,
-    env: database.serverEnv,
-    signal,
-    rateLimit: (key2, options) => {
+  let decision;
+  try {
+    decision = await database.adapter.withTransaction((transaction) => withTrustedRead(database, {
+      transaction,
+      purpose: "files.ingress-admission",
+      subject: { method: endpoint.options.method, path: endpoint.options.path },
+      signal
+    }, async (db, assertActive) => {
+      const request = Object.freeze({ method: endpointRequest.method, path: endpointRequest.path, headers: Object.freeze({ ...endpointRequest.headers }), query: Object.freeze({ ...endpointRequest.query }) });
+      const result = await raceIngressAdmission(() => definition.admit(Object.freeze({
+        db,
+        app: database.app,
+        env: database.serverEnv,
+        signal,
+        request,
+        rateLimit: (key2, options) => {
+          assertActive();
+          return database.capsuleRateLimiter.consume(key2, options);
+        }
+      }), request), signal);
       assertActive();
-      return database.capsuleRateLimiter.consume(key2, options);
-    },
-    request: Object.freeze({ method: endpointRequest.method, path: endpointRequest.path, headers: Object.freeze({ ...endpointRequest.headers }), query: Object.freeze({ ...endpointRequest.query }) })
-  }), Object.freeze({ method: endpointRequest.method, path: endpointRequest.path, headers: Object.freeze({ ...endpointRequest.headers }), query: Object.freeze({ ...endpointRequest.query }) }))));
+      return snapshotIngressDecision(result);
+    }), { signal });
+    if (signal?.aborted) throw new Error("Aborted");
+  } catch {
+    throw capsuleIngressDenied();
+  }
+  if (decision?.allow === false) {
+    let refusal;
+    try {
+      refusal = ingressRefusalJob(decision);
+    } catch {
+      throw capsuleIngressDenied();
+    }
+    if (refusal) await enqueueCapsuleIngressRefusal(database, endpointRequest, refusal, requestSignal);
+    throw capsuleIngressDenied();
+  }
   let allowFiles;
   try {
     allowFiles = multipartAdmissionFilePermission(decision, true);
@@ -151510,6 +151619,58 @@ async function admitCapsuleIngressPrincipal(database, endpoint, endpointRequest,
   }
   return Object.freeze({ allowFiles, authority: Object.freeze({ kind: "capsule-principal", namespace, key, keyDigest: createHash15("sha256").update(`${namespace}\0${key}`, "utf8").digest("hex"), ownerId: database.capsuleIngressOwnerId }) });
 }
+async function raceIngressAdmission(evaluate, signal) {
+  if (signal.aborted) throw capsuleIngressDenied();
+  let removeAbort = () => {
+  };
+  try {
+    const abort = new Promise((_2, reject) => {
+      const onAbort = () => reject(capsuleIngressDenied());
+      signal.addEventListener("abort", onAbort, { once: true });
+      removeAbort = () => signal.removeEventListener("abort", onAbort);
+    });
+    return await Promise.race([Promise.resolve().then(evaluate), abort]);
+  } finally {
+    removeAbort();
+  }
+}
+function capsuleIngressDenied() {
+  return commandError("Unauthenticated.", "Provide valid ingress authority and retry.", "UNAUTHENTICATED");
+}
+async function enqueueCapsuleIngressRefusal(database, request, refusal, signal) {
+  let context2;
+  const failure2 = () => commandError("File ingress refusal could not be recorded.", "Retry the request later.", "FILE_INGRESS_REFUSAL_FAILED");
+  try {
+    if (signal?.aborted || !database.jobs?.some((job) => job.name === refusal.name) || refusal.name.toLowerCase().startsWith(RESERVED_JOB_NAME_PREFIX)) throw failure2();
+    const idempotencyKey = "file-ingress-refusal:" + createHash15("sha256").update(JSON.stringify([request.method, request.path, refusal.name, refusal.idempotencyKey]), "utf8").digest("hex");
+    await database.adapter.withTransaction(async (adapter) => {
+      const scoped = createTransactionDatabase(database, adapter);
+      const checks = Symbol.for("sporades.database.transactionBeforeCommitChecks");
+      (adapter[checks] ??= []).push(() => {
+        if (signal?.aborted) throw failure2();
+      });
+      let failed = false;
+      try {
+        if (signal?.aborted) throw failure2();
+        context2 = createMutationContext(scoped, { userId: database.capsuleIngressOwnerId, displayName: "File ingress", email: null, picture: null, isAuthenticated: false, isGuest: false, provider: "file-ingress" }, { ordinaryCredential: false });
+        await context2.privileged.run(
+          { operation: "files.ingress-refusal", targetResourceKind: "job-queue", signal },
+          (privileged) => privileged.jobs.enqueue(refusal.name, refusal.payload, { idempotencyKey })
+        );
+        if (signal?.aborted) throw failure2();
+      } catch (error) {
+        failed = true;
+        throw error;
+      } finally {
+        await cleanupTransactionHandler(scoped, context2, failed);
+      }
+    }, { signal });
+    await dispatchPendingJobs(context2);
+  } catch {
+    dropPendingJobDispatch(context2);
+    throw failure2();
+  }
+}
 var endpointMultipartAdmissionTimeoutMs = 5e3;
 function multipartAdmissionDenied() {
   return commandError("Multipart request was not admitted.", "Check the request conditions and retry.", "MULTIPART_ADMISSION_DENIED");
@@ -151632,8 +151793,10 @@ async function runEndpoint(database, endpoint, requestUrl, request, requestPath
       let allowFiles = true;
       if (claimAuthority === "capsule-principal") {
         const endpointSignal = request.__sporadesEndpointSignal ?? request.signal;
+        request.__sporadesCapsuleIngressAdmissionDenied = true;
         const admission = await admitCapsuleIngressPrincipal(database, endpoint, endpointRequest, endpointSignal);
         if (endpointSignal?.aborted) throw commandError("Unauthenticated.", "Provide valid ingress authority and retry.", "UNAUTHENTICATED");
+        delete request.__sporadesCapsuleIngressAdmissionDenied;
         ingressAuthority = admission.authority;
         allowFiles = admission.allowFiles;
       } else {
@@ -164411,7 +164574,7 @@ jobs:
 }
 
 // src/cli/cli-version.ts
-var CLI_VERSION = "0.9.42";
+var CLI_VERSION = "0.9.43";
 
 // src/cli/sporades.ts
 var containerSecretResolutions = /* @__PURE__ */ new WeakMap();

package/dist/cli/cli-version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.9.42";
+export declare const CLI_VERSION = "0.9.43";
 //# sourceMappingURL=cli-version.d.ts.map

package/dist/cli/cli-version.js

@@ -1,3 +1,3 @@
 // Generated by `npm run build` from package.json. Do not edit by hand.
-export const CLI_VERSION = "0.9.42";
+export const CLI_VERSION = "0.9.43";
 //# sourceMappingURL=cli-version.js.map

package/dist/endpoint-error.d.ts

@@ -0,0 +1,7 @@
+/** The only response headers available on a thrown endpoint failure. */
+export type EndpointErrorHeaders = Readonly<Partial<Record<"Cache-Control" | "Pragma" | "X-Robots-Tag" | "Content-Security-Policy" | "Referrer-Policy" | "cache-control" | "pragma" | "x-robots-tag" | "content-security-policy" | "referrer-policy", string>>>;
+/** Self-contained so the public helper and generated Capsule helper use identical validation. */
+export declare function endpointError(headers: EndpointErrorHeaders): Error;
+/** Revalidate the public helper's snapshot at the response boundary, including forged errors. */
+export declare function endpointErrorResponseHeaders(error: unknown): Record<string, string>;
+//# sourceMappingURL=endpoint-error.d.ts.map

package/dist/endpoint-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-error.d.ts","sourceRoot":"","sources":["../src/endpoint-error.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CACxD,eAAe,GAAG,QAAQ,GAAG,cAAc,GAAG,yBAAyB,GAAG,iBAAiB,GAC3F,eAAe,GAAG,QAAQ,GAAG,cAAc,GAAG,yBAAyB,GAAG,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AAEzG,iGAAiG;AACjG,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,KAAK,CAqBlE;AAED,iGAAiG;AACjG,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOnF"}

package/dist/endpoint-error.js

@@ -0,0 +1,42 @@
+/** Self-contained so the public helper and generated Capsule helper use identical validation. */
+export function endpointError(headers) {
+    const invalid = () => new Error("Invalid endpoint error headers.");
+    if (!headers || typeof headers !== "object" || Array.isArray(headers)
+        || ![Object.prototype, null].includes(Object.getPrototypeOf(headers)))
+        throw invalid();
+    const result = {};
+    let size = 0;
+    for (const key of Reflect.ownKeys(headers)) {
+        if (typeof key !== "string")
+            throw invalid();
+        const name = key.toLowerCase();
+        if (!["cache-control", "pragma", "x-robots-tag", "content-security-policy", "referrer-policy"].includes(name) || Object.hasOwn(result, name))
+            throw invalid();
+        const property = Object.getOwnPropertyDescriptor(headers, key);
+        const value = property?.value;
+        // ASCII only, with a total 8 KiB budget; never invoke accessors or coerce values.
+        if (!property || !Object.hasOwn(property, "value") || typeof value !== "string" || !value.trim() || /[^\x20-\x7e]/.test(value))
+            throw invalid();
+        size += name.length + value.length;
+        if (size > 8192)
+            throw invalid();
+        result[name] = value;
+    }
+    const error = new Error("Endpoint handler failed.");
+    Object.defineProperty(error, Symbol.for("sporades.endpoint.errorHeaders"), { value: Object.freeze(result) });
+    return error;
+}
+/** Revalidate the public helper's snapshot at the response boundary, including forged errors. */
+export function endpointErrorResponseHeaders(error) {
+    try {
+        const descriptor = error && typeof error === "object" ? Object.getOwnPropertyDescriptor(error, Symbol.for("sporades.endpoint.errorHeaders")) : undefined;
+        if (!descriptor || !Object.hasOwn(descriptor, "value"))
+            return {};
+        const checked = endpointError(descriptor.value);
+        return checked[Symbol.for("sporades.endpoint.errorHeaders")];
+    }
+    catch {
+        return {};
+    }
+}
+//# sourceMappingURL=endpoint-error.js.map

package/dist/endpoint-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-error.js","sourceRoot":"","sources":["../src/endpoint-error.ts"],"names":[],"mappings":"AAKA,iGAAiG;AACjG,MAAM,UAAU,aAAa,CAAC,OAA6B;IACzD,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;WAChE,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IACzF,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,MAAM,OAAO,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAC/B,IAAI,CAAC,CAAC,eAAe,EAAE,QAAQ,EAAE,cAAc,EAAE,yBAAyB,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;YAAE,MAAM,OAAO,EAAE,CAAC;QAC9J,MAAM,QAAQ,GAAG,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,CAAC;QAC9B,kFAAkF;QAClF,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,OAAO,EAAE,CAAC;QAChJ,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACnC,IAAI,IAAI,GAAG,IAAI;YAAE,MAAM,OAAO,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACvB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACpD,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,gCAAgC,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzJ,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QAClE,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAChD,OAAQ,OAAe,CAAC,MAAM,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AACxB,CAAC"}

package/dist/file-ingress-refusal.d.ts

@@ -0,0 +1,4 @@
+/** Snapshot untrusted policy output without getters/toJSON or retained mutable references. */
+export declare function snapshotIngressDecision(value: unknown): any;
+export declare function ingressRefusalJob(decision: any): any;
+//# sourceMappingURL=file-ingress-refusal.d.ts.map

package/dist/file-ingress-refusal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-ingress-refusal.d.ts","sourceRoot":"","sources":["../src/file-ingress-refusal.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,GAAG,CAkC3D;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,GAAG,OAW9C"}

package/dist/file-ingress-refusal.js

@@ -0,0 +1,64 @@
+/** Snapshot untrusted policy output without getters/toJSON or retained mutable references. */
+export function snapshotIngressDecision(value) {
+    let nodes = 0;
+    let bytes = 0;
+    const invalid = () => { throw new Error("Invalid File ingress decision."); };
+    const visit = (input, depth) => {
+        if (++nodes > 1024 || depth > 16)
+            return invalid();
+        if (input === null || typeof input === "boolean")
+            return input;
+        if (typeof input === "number")
+            return Number.isFinite(input) ? input : invalid();
+        if (typeof input === "string") {
+            bytes += Buffer.byteLength(input, "utf8");
+            return bytes <= 8192 ? input : invalid();
+        }
+        if (!input || typeof input !== "object" || (!Array.isArray(input) && ![Object.prototype, null].includes(Object.getPrototypeOf(input))))
+            return invalid();
+        const output = Array.isArray(input) ? [] : Object.create(null);
+        for (const key of Reflect.ownKeys(input)) {
+            if (Array.isArray(input) && key === "length")
+                continue;
+            if (typeof key !== "string")
+                return invalid();
+            bytes += Buffer.byteLength(key, "utf8");
+            if (bytes > 8192)
+                return invalid();
+            const descriptor = Object.getOwnPropertyDescriptor(input, key);
+            if (!descriptor || !Object.hasOwn(descriptor, "value") || !descriptor.enumerable)
+                return invalid();
+            // Preserve the established optional allowFiles contract while keeping
+            // refusal payloads strict JSON. Explicitly undefined optional fields
+            // have the same meaning as omission, only at the decision root.
+            if (depth === 0 && (key === "allowFiles" || key === "refusalJob") && descriptor.value === undefined)
+                continue;
+            if (Array.isArray(input) && (!/^(0|[1-9][0-9]*)$/.test(key) || Number(key) >= 1024))
+                return invalid();
+            Object.defineProperty(output, key, { value: visit(descriptor.value, depth + 1), enumerable: true });
+        }
+        if (Array.isArray(input) && (input.length > 1024 || Object.keys(output).length !== input.length))
+            return invalid();
+        return Object.freeze(output);
+    };
+    const result = visit(value, 0);
+    if (Buffer.byteLength(JSON.stringify(result) ?? "", "utf8") > 8192)
+        invalid();
+    return result;
+}
+export function ingressRefusalJob(decision) {
+    if (!decision || decision.allow !== false || Object.keys(decision).some(key => !["allow", "refusalJob"].includes(key)))
+        throw new Error("Invalid File ingress refusal.");
+    if (!Object.hasOwn(decision, "refusalJob"))
+        return null;
+    const job = decision.refusalJob;
+    if (!job || typeof job !== "object" || Array.isArray(job) || Object.keys(job).length !== 3
+        || Object.keys(job).some(key => !["name", "payload", "idempotencyKey"].includes(key))
+        || typeof job.name !== "string" || !/^[a-zA-Z][a-zA-Z0-9_-]{0,127}$/.test(job.name)
+        || typeof job.idempotencyKey !== "string" || !job.idempotencyKey || Buffer.byteLength(job.idempotencyKey, "utf8") > 256
+        || /[\x00-\x1f\x7f]/.test(job.idempotencyKey)
+        || !Object.hasOwn(job, "payload") || Buffer.byteLength(JSON.stringify(job.payload), "utf8") > 4096)
+        throw new Error("Invalid File ingress refusal.");
+    return job;
+}
+//# sourceMappingURL=file-ingress-refusal.js.map

package/dist/file-ingress-refusal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-ingress-refusal.js","sourceRoot":"","sources":["../src/file-ingress-refusal.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,OAAO,GAAG,GAAG,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,CAAC,KAAU,EAAE,KAAa,EAAO,EAAE;QAC/C,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE;YAAE,OAAO,OAAO,EAAE,CAAC;QACnD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACjF,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC1C,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;YAAE,OAAO,OAAO,EAAE,CAAC;QACzJ,MAAM,MAAM,GAAQ,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpE,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,QAAQ;gBAAE,SAAS;YACvD,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,OAAO,OAAO,EAAE,CAAC;YAC9C,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACxC,IAAI,KAAK,GAAG,IAAI;gBAAE,OAAO,OAAO,EAAE,CAAC;YACnC,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC/D,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU;gBAAE,OAAO,OAAO,EAAE,CAAC;YACnG,sEAAsE;YACtE,qEAAqE;YACrE,gEAAgE;YAChE,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,YAAY,CAAC,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS;gBAAE,SAAS;YAC9G,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;gBAAE,OAAO,OAAO,EAAE,CAAC;YACtG,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,OAAO,EAAE,CAAC;QACnH,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,GAAG,IAAI;QAAE,OAAO,EAAE,CAAC;IAC9E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAa;IAC7C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACzK,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC;IAChC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;WACrF,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;WAClF,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;WAChF,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,cAAc,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,GAAG,GAAG;WACpH,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;WAC1C,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACvJ,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/generated-source-manifest.json

@@ -80,8 +80,10 @@
       "src/dev-clamav-sidecar.ts",
       "src/email-events-config.ts",
       "src/email-events-runtime.ts",
+      "src/endpoint-error.ts",
       "src/endpoint-file-response.ts",
       "src/endpoint-session.ts",
+      "src/file-ingress-refusal.ts",
       "src/file-ingress-runtime.ts",
       "src/file-policy.ts",
       "src/file-storage-runtime.ts",
@@ -158,7 +160,7 @@
       "tsconfig.json",
       "tsconfig.runtime.json"
     ],
-    "digest": "03b9f54d552fd4b2040d645f572c76cad26f639f762eb0046bb67e6cc10031a0"
+    "digest": "e705886424917bce68edceb78f8f45184c1055abfd7699836596e6e4e364a7e5"
   },
   "outputs": {
     "files": [
@@ -448,6 +450,10 @@
       "dist/email-events-runtime.d.ts.map",
       "dist/email-events-runtime.js",
       "dist/email-events-runtime.js.map",
+      "dist/endpoint-error.d.ts",
+      "dist/endpoint-error.d.ts.map",
+      "dist/endpoint-error.js",
+      "dist/endpoint-error.js.map",
       "dist/endpoint-file-response.d.ts",
       "dist/endpoint-file-response.d.ts.map",
       "dist/endpoint-file-response.js",
@@ -456,6 +462,10 @@
       "dist/endpoint-session.d.ts.map",
       "dist/endpoint-session.js",
       "dist/endpoint-session.js.map",
+      "dist/file-ingress-refusal.d.ts",
+      "dist/file-ingress-refusal.d.ts.map",
+      "dist/file-ingress-refusal.js",
+      "dist/file-ingress-refusal.js.map",
       "dist/file-ingress-runtime.d.ts",
       "dist/file-ingress-runtime.d.ts.map",
       "dist/file-ingress-runtime.js",
@@ -706,6 +716,6 @@
       "dist/user-preferences-runtime.js.map",
       "monitoring/trace/inventory-contract.mjs"
     ],
-    "digest": "b7b91be6ef8746a346a6d48d53da2d3c6db34b177f1e8c78aede76da59f18c9b"
+    "digest": "2beff51c6581530f9cc54446a881f896db899362e19c06d4d883e0fbaf54a9ff"
   }
 }

package/dist/http-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-runtime.d.ts","sourceRoot":"","sources":["../src/http-runtime.ts"],"names":[],"mappings":"AAyGA,OAAO,EAAE,cAAc,EAAE,KAAK,mBAAmB,EAAE,KAAK,eAAe,EAA4B,MAAM,WAAW,CAAC;AAIrH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAuB1C,KAAK,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACvC,KAAK,aAAa,GAAG,WAAW,CAAC;AAejC,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE;QACJ,UAAU,EAAE,OAAO,CAAC;QACpB,SAAS,EAAE,OAAO,CAAC;QACnB,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,qBAAqB,EAAE,MAAM,EAAE,CAAC;QAChC,0BAA0B,EAAE,OAAO,CAAC;QACpC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,aAAa,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IACF,GAAG,EAAE;QACH,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC;QAC9C,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,QAAQ,CAAC,EAAE,eAAe,CAAC;KAC5B,CAAC;CACH,CAAC;AACF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,mBAAmB,GAAG,WAAW,CAAC;IAC3C,MAAM,CAAC,EAAE,GAAG,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,IAAI,EAAE,UAAU,GAAG,UAAU,GAAG,QAAQ,CAAC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;CACV,CAAC;AAMF,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,4BAA4B,GAAG,IAAI,CAyBhH;AAGD,2FAA2F;AAC3F,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,WAAW,EACrB,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,KAAK,GAAG,QAAQ,GAAG,YAAY,GAAG,SAAS,CAAC,EAC3E,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,GAAG,KAAK,CAAC,EACnD,MAAM,CAAC,EAAE,4BAA4B,EACrC,SAAS,GAAE,MAAM,GAAG,WAAoB,WAgEzC;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,KAAK,GAAG,QAAQ,CAAC,gCAQ7E;AAED,oFAAoF;AACpF,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,WA6BtG;AAWD,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,GAAG,KAAK,CAAC,QAMjJ;AAED,wBAAsB,eAAe,CAAC,OAAO,EAAE,eAAe,EAAE,WAAW,GAAE,WAAW,GAAG,MAAM,GAAG,IAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAGrI;AAED,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,GAAG,EAAE,WAAW,GAAE,WAAW,GAAG,MAAM,GAAG,IAAW,gCAazG;AAED,wBAAgB,uBAAuB,CAAC,MAAM,GAAE,WAAW,GAAG,MAAM,GAAG,IAAW,UAKjF;AAaD,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,GAAG,QAgB7I;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,GAAG,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,GAAE,WAAgB,QAwBtI;AAID,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE;IAAE,cAAc,CAAC,EAAE,qBAAqB,CAAA;CAAE,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,CAAC,eAAe,CAAC,GAAG;IAAE,GAAG,EAAE,eAAe,CAAC;CAAE,EAAE,cAAc,CAAC,EAAE,MAAM,OAAO,WA4ExN;AAED,wBAAgB,4BAA4B,CAAC,MAAM,GAAE,aAAkB,GAAG,qBAAqB,CAwC9F;AAsBD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,WAAW,oCAM7G;AAED,0GAA0G;AAC1G,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,MAAM,UAiC5G;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,WAEpF;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,GAAG,KAAK,GAAG,SAAS,GAAG,QAAQ,CAAC,EACvE,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,GAAG,KAAK,CAAC,EACnD,qBAAqB,EAAE,CAAC,YAAY,CAAC,EAAE,MAAM,KAAK,MAAM,WAwBzD;AAyBD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,kBAAkB,WAKhG;AAWD,wBAAgB,eAAe,CAAC,KAAK,EAAE,GAAG,iBASzC;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,OAmCzF;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,GAAG,iBAS1C;AA0CD,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,CAAC,eAAe,CAAC,GAAG;IAAE,GAAG,EAAE,eAAe,CAAC;CAAE,EAAE,YAAY,GAAE,GAAU,oBAkGzL;AAED,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE;QAAE,CAAC,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;KAAE,CAAC;CAAE,EAAE,QAAQ,EAAE,GAAG,oBA0BrJ;AAgCD,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,WAAW,gBAE7D;AA6BD,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,GAAE,WAAgB,oBA2C5H;AA4DD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,QAqC3D"}
+{"version":3,"file":"http-runtime.d.ts","sourceRoot":"","sources":["../src/http-runtime.ts"],"names":[],"mappings":"AA0GA,OAAO,EAAE,cAAc,EAAE,KAAK,mBAAmB,EAAE,KAAK,eAAe,EAA4B,MAAM,WAAW,CAAC;AAIrH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAuB1C,KAAK,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACvC,KAAK,aAAa,GAAG,WAAW,CAAC;AAejC,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE;QACJ,UAAU,EAAE,OAAO,CAAC;QACpB,SAAS,EAAE,OAAO,CAAC;QACnB,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,qBAAqB,EAAE,MAAM,EAAE,CAAC;QAChC,0BAA0B,EAAE,OAAO,CAAC;QACpC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,aAAa,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IACF,GAAG,EAAE;QACH,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC;QAC9C,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,QAAQ,CAAC,EAAE,eAAe,CAAC;KAC5B,CAAC;CACH,CAAC;AACF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,mBAAmB,GAAG,WAAW,CAAC;IAC3C,MAAM,CAAC,EAAE,GAAG,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,IAAI,EAAE,UAAU,GAAG,UAAU,GAAG,QAAQ,CAAC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;CACV,CAAC;AAMF,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,4BAA4B,GAAG,IAAI,CAyBhH;AAGD,2FAA2F;AAC3F,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,WAAW,EACrB,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,KAAK,GAAG,QAAQ,GAAG,YAAY,GAAG,SAAS,CAAC,EAC3E,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,GAAG,KAAK,CAAC,EACnD,MAAM,CAAC,EAAE,4BAA4B,EACrC,SAAS,GAAE,MAAM,GAAG,WAAoB,WAgEzC;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,KAAK,GAAG,QAAQ,CAAC,gCAQ7E;AAED,oFAAoF;AACpF,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,WA6BtG;AAWD,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,GAAG,KAAK,CAAC,QAMjJ;AAED,wBAAsB,eAAe,CAAC,OAAO,EAAE,eAAe,EAAE,WAAW,GAAE,WAAW,GAAG,MAAM,GAAG,IAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAGrI;AAED,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,GAAG,EAAE,WAAW,GAAE,WAAW,GAAG,MAAM,GAAG,IAAW,gCAazG;AAED,wBAAgB,uBAAuB,CAAC,MAAM,GAAE,WAAW,GAAG,MAAM,GAAG,IAAW,UAKjF;AAaD,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,GAAG,QAgB7I;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,GAAG,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,GAAE,WAAgB,QAwBtI;AAID,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE;IAAE,cAAc,CAAC,EAAE,qBAAqB,CAAA;CAAE,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,CAAC,eAAe,CAAC,GAAG;IAAE,GAAG,EAAE,eAAe,CAAC;CAAE,EAAE,cAAc,CAAC,EAAE,MAAM,OAAO,WAoFxN;AAED,wBAAgB,4BAA4B,CAAC,MAAM,GAAE,aAAkB,GAAG,qBAAqB,CAwC9F;AAsBD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,WAAW,oCAM7G;AAED,0GAA0G;AAC1G,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,MAAM,UAiC5G;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,WAEpF;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,GAAG,KAAK,GAAG,SAAS,GAAG,QAAQ,CAAC,EACvE,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,GAAG,KAAK,CAAC,EACnD,qBAAqB,EAAE,CAAC,YAAY,CAAC,EAAE,MAAM,KAAK,MAAM,WAwBzD;AAyBD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,kBAAkB,WAKhG;AAWD,wBAAgB,eAAe,CAAC,KAAK,EAAE,GAAG,iBASzC;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,OAmCzF;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,GAAG,iBAS1C;AA0CD,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,CAAC,eAAe,CAAC,GAAG;IAAE,GAAG,EAAE,eAAe,CAAC;CAAE,EAAE,YAAY,GAAE,GAAU,oBAkGzL;AAED,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE;QAAE,CAAC,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;KAAE,CAAC;CAAE,EAAE,QAAQ,EAAE,GAAG,oBA0BrJ;AAgCD,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,WAAW,gBAE7D;AA6BD,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,GAAE,WAAgB,oBA2C5H;AA4DD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,QAyC3D"}

package/dist/http-runtime.js

@@ -1,3 +1,4 @@
+import { endpointErrorResponseHeaders } from "./endpoint-error.js";
 // The Capsule runtime's HTTP and security policy domain: the CORS and CSP posture every response
 // carries, the origin and host-header validation behind it, the request body reader and its size
 // limit, the generic response writers, and the two routes the runtime owns outright — the health
@@ -405,8 +406,9 @@ export function prepareHttpSecurity(database, request, response, admitPreflight)
     response.writeHead = ((statusCode, statusMessageOrHeaders, maybeHeaders) => {
         const statusMessage = typeof statusMessageOrHeaders === "string" ? statusMessageOrHeaders : undefined;
         const inputHeaders = statusMessage ? maybeHeaders : typeof statusMessageOrHeaders === "string" ? {} : statusMessageOrHeaders;
+        const supplied = sanitizeResponseHeaders({ ...(response.getHeaders?.() ?? {}), ...inputHeaders });
         const headers = {
-            ...sanitizeResponseHeaders(inputHeaders ?? {}),
+            ...supplied,
             "x-content-type-options": "nosniff",
             "referrer-policy": "no-referrer",
             "x-frame-options": "DENY",
@@ -415,6 +417,14 @@ export function prepareHttpSecurity(database, request, response, admitPreflight)
             [policy.csp.header]: serializeCspDirectives(directives),
             ...(policy.hsts ? { "strict-transport-security": policy.hsts } : {}),
         };
+        // Multiple CSP policies are enforced independently (intersection), never merged
+        // by directive: neither the endpoint nor the platform can weaken the other.
+        const suppliedCsp = supplied[policy.csp.header];
+        if (suppliedCsp)
+            headers[policy.csp.header] = [
+                ...(Array.isArray(suppliedCsp) ? suppliedCsp.map(String) : [String(suppliedCsp)]),
+                serializeCspDirectives(directives),
+            ];
         if (isGuardedAttachmentHttpResponse(response)) {
             delete headers["content-security-policy-report-only"];
             delete headers["access-control-allow-origin"];
@@ -731,7 +741,7 @@ function sanitizeResponseHeaders(headers) {
     return Object.fromEntries([...entries].filter(([name]) => {
         const normalized = String(name).toLowerCase();
         return normalized !== "x-powered-by" && normalized !== "server";
-    }));
+    }).map(([name, value]) => [String(name).toLowerCase(), value]));
 }
 export async function handleFileHttpRoute(database, request, response, websocketHub = null) {
     const target = requestTarget(request);
@@ -1013,7 +1023,7 @@ function mergeEndpointResponseHeaders(handlerHeaders, runtimeHeaders) {
     return { ...headers, ...runtimeHeaders };
 }
 export function writeEndpointError(response, error) {
-    const headers = { "content-type": "application/json; charset=utf-8" };
+    const headers = { ...endpointErrorResponseHeaders(error), "content-type": "application/json; charset=utf-8" };
     if (error?.code === "UNAUTHENTICATED" && error?.sporadesAccessKeyFailure) {
         headers["www-authenticate"] = error?.sporadesAccessKeyFailure === "invalid" && error?.sporadesAccessKeyReason !== "missing"
             ? 'Bearer realm="sporades", error="invalid_token"'
@@ -1023,6 +1033,10 @@ export function writeEndpointError(response, error) {
         headers["cache-control"] = "no-store";
         headers.pragma = "no-cache";
     }
+    if (String(response.getHeader?.("cache-control") ?? "").includes("no-store")) {
+        headers["cache-control"] = response.getHeader("cache-control");
+        headers.pragma = "no-cache";
+    }
     const multipartDetails = safeMultipartLimitDetails(error);
     response.writeHead(endpointErrorStatus(error), headers);
     response.end(`${JSON.stringify({
@@ -1058,6 +1072,8 @@ function safeMultipartLimitDetails(error) {
     return { partType: details.partType, limitKind: details.limitKind, limit: details.limit };
 }
 function endpointErrorStatus(error) {
+    if (error?.code === "FILE_INGRESS_REFUSAL_FAILED")
+        return 503;
     if (error?.code === "UNAUTHENTICATED")
         return 401;
     if (error?.code === "FORBIDDEN")