theokit 0.2.4 → 0.4.0

package/dist/chunk-ASDXVRJD.js

@@ -0,0 +1,185 @@
+import {
+  InMemoryStore
+} from "./chunk-VMEWD57H.js";
+import {
+  parseCookieHeader
+} from "./chunk-ZJQ4O76G.js";
+
+// src/server/rate-limit/rate-limit-per-route.ts
+function normalizePath(input) {
+  const noQuery = input.split("?")[0];
+  if (noQuery.length > 1 && noQuery.endsWith("/")) return noQuery.slice(0, -1);
+  return noQuery;
+}
+function matchRoutePattern(path, pattern) {
+  const canonical = normalizePath(path);
+  if (typeof pattern === "string") {
+    return canonical === normalizePath(pattern);
+  }
+  pattern.lastIndex = 0;
+  return pattern.test(canonical);
+}
+async function hashFragment(input) {
+  const buf = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(input));
+  const bytes = new Uint8Array(buf);
+  let bin = "";
+  for (const b of bytes) bin += String.fromCharCode(b);
+  const b64url = btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  return b64url.slice(0, 16);
+}
+function readCookie(req, name) {
+  return parseCookieHeader(req.headers.cookie ?? void 0).get(name);
+}
+async function deriveKey(req, keyBy, cookieName) {
+  if (typeof keyBy === "function") return keyBy(req);
+  const ip = req.socket?.remoteAddress ?? "unknown";
+  switch (keyBy) {
+    case "session": {
+      const cookie = readCookie(req, cookieName);
+      return cookie ? `session:${await hashFragment(cookie)}` : `ip:${ip}`;
+    }
+    case "user": {
+      const userId = req.user?.id;
+      return userId ? `user:${userId}` : `ip:${ip}`;
+    }
+    case "ip":
+    default:
+      return `ip:${ip}`;
+  }
+}
+function createRouteRateLimiter(config) {
+  const isFlat = "windowMs" in config && "max" in config && !("default" in config) && !("routes" in config);
+  const cfg = isFlat ? { default: config } : config;
+  const store = cfg.store ?? new InMemoryStore();
+  if (!(store instanceof InMemoryStore)) {
+    throw new Error(
+      "createRouteRateLimiter: async RateLimitStore implementations require a dedicated async middleware path. Use the InMemoryStore default for the sync fa\xE7ade."
+    );
+  }
+  const inMemoryStore = store;
+  const keyBy = cfg.keyBy ?? "ip";
+  const cookieName = cfg.cookieName ?? "theo_session";
+  const patternList = [];
+  if (cfg.routes) {
+    for (const [pattern, c] of Object.entries(cfg.routes)) patternList.push([pattern, c]);
+  }
+  if (cfg.routePatterns) {
+    for (const tuple of cfg.routePatterns) patternList.push(tuple);
+  }
+  return async function checkRouteRateLimit(req) {
+    const url = req.url ?? "";
+    let matched;
+    for (const [pattern, c] of patternList) {
+      if (matchRoutePattern(url, pattern)) {
+        matched = c;
+        break;
+      }
+    }
+    const effective = matched ?? cfg.default;
+    if (!effective) {
+      return { limited: false, headers: {} };
+    }
+    const bucketSuffix = typeof matched === "undefined" ? "*default*" : normalizePath(url);
+    const key = `${await deriveKey(req, keyBy, cookieName)}|${bucketSuffix}`;
+    const state = inMemoryStore.incrSync(key, effective.windowMs);
+    if (state.count > effective.max) {
+      const retryAfter = Math.ceil((state.resetAt - Date.now()) / 1e3);
+      return {
+        limited: true,
+        headers: {
+          "X-RateLimit-Limit": String(effective.max),
+          "X-RateLimit-Remaining": "0",
+          "Retry-After": String(retryAfter)
+        }
+      };
+    }
+    return {
+      limited: false,
+      headers: {
+        "X-RateLimit-Limit": String(effective.max),
+        "X-RateLimit-Remaining": String(Math.max(0, effective.max - state.count))
+      }
+    };
+  };
+}
+async function deriveKeyFromRequest(request, keyBy, cookieName, ctx = {}) {
+  const ip = ctx.clientIp ?? "unknown";
+  switch (keyBy) {
+    case "session": {
+      const { getCookieFromRequest } = await import("./cookies-MJKMGJ7N.js");
+      const cookie = getCookieFromRequest(request, cookieName);
+      return cookie ? `session:${await hashFragment(cookie)}` : `ip:${ip}`;
+    }
+    case "user": {
+      return ctx.userId ? `user:${ctx.userId}` : `ip:${ip}`;
+    }
+    case "ip":
+    default:
+      return `ip:${ip}`;
+  }
+}
+function createRouteRateLimiterWeb(config) {
+  const isFlat = "windowMs" in config && "max" in config && !("default" in config) && !("routes" in config);
+  const cfg = isFlat ? { default: config } : config;
+  const store = cfg.store ?? new InMemoryStore();
+  if (!(store instanceof InMemoryStore)) {
+    throw new Error(
+      "createRouteRateLimiterWeb: async RateLimitStore implementations require a dedicated async middleware path. Use the InMemoryStore default for the Web fa\xE7ade."
+    );
+  }
+  const inMemoryStore = store;
+  const keyBy = cfg.keyBy ?? "ip";
+  const cookieName = cfg.cookieName ?? "theo_session";
+  const patternList = [];
+  if (cfg.routes) {
+    for (const [pattern, c] of Object.entries(cfg.routes)) patternList.push([pattern, c]);
+  }
+  if (cfg.routePatterns) {
+    for (const tuple of cfg.routePatterns) patternList.push(tuple);
+  }
+  return async function checkRouteRateLimitWeb(request, ctx = {}) {
+    const parsed = new URL(request.url);
+    const url = `${parsed.pathname}${parsed.search}`;
+    let matched;
+    for (const [pattern, c] of patternList) {
+      if (matchRoutePattern(url, pattern)) {
+        matched = c;
+        break;
+      }
+    }
+    const effective = matched ?? cfg.default;
+    if (!effective) {
+      return { limited: false, headers: {} };
+    }
+    const bucketSuffix = typeof matched === "undefined" ? "*default*" : normalizePath(url);
+    const key = `${await deriveKeyFromRequest(request, keyBy, cookieName, ctx)}|${bucketSuffix}`;
+    const state = inMemoryStore.incrSync(key, effective.windowMs);
+    if (state.count > effective.max) {
+      const retryAfter = Math.ceil((state.resetAt - Date.now()) / 1e3);
+      return {
+        limited: true,
+        headers: {
+          "X-RateLimit-Limit": String(effective.max),
+          "X-RateLimit-Remaining": "0",
+          "Retry-After": String(retryAfter)
+        }
+      };
+    }
+    return {
+      limited: false,
+      headers: {
+        "X-RateLimit-Limit": String(effective.max),
+        "X-RateLimit-Remaining": String(Math.max(0, effective.max - state.count))
+      }
+    };
+  };
+}
+
+export {
+  matchRoutePattern,
+  deriveKey,
+  createRouteRateLimiter,
+  deriveKeyFromRequest,
+  createRouteRateLimiterWeb
+};
+//# sourceMappingURL=chunk-ASDXVRJD.js.map

package/dist/chunk-ASDXVRJD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/rate-limit/rate-limit-per-route.ts"],"sourcesContent":["// T5a.1d — Web Crypto migration. The last node:crypto consumer in server/.\n// `createHash('sha256')` is sync but Web Crypto's `subtle.digest('SHA-256', ...)`\n// is async. This propagates through hashFragment → deriveKey → the factory's\n// returned checker. createRouteRateLimiter has NO production consumers\n// (verified via grep; api-middleware uses the sibling createRateLimiter from\n// rate-limit.ts), so the cascade only affects test sites. IncomingMessage stays\n// as a type-only import (TS-erased; runtime-clean).\nimport type { IncomingMessage } from 'node:http'\n\nimport { parseCookieHeader } from '../http/cookies.js'\n\nimport { InMemoryStore, type RateLimitStore } from './rate-limit-store.js'\nimport type { RateLimitConfig, RateLimitResult } from './rate-limit.js'\n\n/**\n * T2.2 — Per-route + per-user rate limiting.\n *\n * Layered on top of `rate-limit-store.ts`. The route map allows\n * declarative policies (\"strict /api/login, loose everything else\")\n * driven by config, not handler-decorated. `keyBy` selects what\n * identifier the limiter buckets on.\n *\n * ADR D2: per-route via path matching, NOT per-handler decorator.\n * Operators can tune policies without touching route definitions.\n */\n\nexport type KeyByMode = 'ip' | 'session' | 'user' | ((req: IncomingMessage) => string)\n\nexport interface RouteRateLimitConfig {\n  /** Fallback config used when no per-route entry matches. */\n  default?: RateLimitConfig\n  /** Map of path pattern → config. Exact-string keys (RegExp via API). */\n  routes?: Record<string, RateLimitConfig>\n  /** Same as `routes` but each entry is a [pattern, config] tuple, RegExp allowed. */\n  routePatterns?: readonly [string | RegExp, RateLimitConfig][]\n  /** Bucket identifier strategy. Default 'ip'. */\n  keyBy?: KeyByMode\n  /** Cookie name used by keyBy='session'. Defaults to 'theo_session'. */\n  cookieName?: string\n  /** Optional shared store (for multi-route correlation). Default per-limiter InMemoryStore. */\n  store?: RateLimitStore\n}\n\n/**\n * Normalize a path for matching: strip query string, drop trailing slash\n * unless root. EC-5: `/api/login` and `/api/login/` collapse to the same\n * canonical form so attackers can't bypass strict limits.\n */\nfunction normalizePath(input: string): string {\n  const noQuery = input.split('?')[0]\n  if (noQuery.length > 1 && noQuery.endsWith('/')) return noQuery.slice(0, -1)\n  return noQuery\n}\n\n/**\n * Test whether `path` matches `pattern`. String patterns are compared\n * after trailing-slash normalization (EC-5). RegExp uses `.test` after\n * resetting `lastIndex` (defensive against `/g` flag).\n */\nexport function matchRoutePattern(path: string, pattern: string | RegExp): boolean {\n  const canonical = normalizePath(path)\n  if (typeof pattern === 'string') {\n    return canonical === normalizePath(pattern)\n  }\n  pattern.lastIndex = 0\n  return pattern.test(canonical)\n}\n\n/**\n * Hash a string with SHA-256 and return the first 16 base64url chars.\n * Used by `keyBy='session'` so the raw cookie value never lands in a\n * rate-limit key (which may flow into audit logs).\n *\n * T5a.1d — async via Web Crypto subtle.digest (no node:crypto). The\n * base64url encoding is done manually because btoa+url-safe transform is\n * available everywhere but `digest('base64url')` is Node-only.\n */\nasync function hashFragment(input: string): Promise<string> {\n  const buf = await globalThis.crypto.subtle.digest('SHA-256', new TextEncoder().encode(input))\n  const bytes = new Uint8Array(buf)\n  let bin = ''\n  for (const b of bytes) bin += String.fromCharCode(b)\n  // eslint-disable-next-line sonarjs/slow-regex -- input is fixed-length 44 chars (SHA-256 base64), trailing '=' padding ≤ 2 chars, no ReDoS surface\n  const b64url = btoa(bin).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '')\n  return b64url.slice(0, 16)\n}\n\n// T3.2 DRY consolidation: cookie parsing moved to ../http/cookies.ts.\n// The canonical `parseCookieHeader` returns a Map for O(1) lookup; this\n// wrapper preserves the original `readCookie(req, name)` signature so the\n// rest of the file stays untouched.\nfunction readCookie(req: IncomingMessage, name: string): string | undefined {\n  return parseCookieHeader(req.headers.cookie ?? undefined).get(name)\n}\n\n/**\n * Build the rate-limit bucket key for the request based on `keyBy`.\n *\n * EC-6: session mode reads the configured `cookieName`. With the wrong\n * cookie name (e.g., default 'theo_session' but app uses 'app_session'),\n * we fall back to IP so anonymous users still get rate-limited rather\n * than sharing an empty bucket.\n */\nexport async function deriveKey(\n  req: IncomingMessage,\n  keyBy: KeyByMode,\n  cookieName: string,\n): Promise<string> {\n  if (typeof keyBy === 'function') return keyBy(req)\n  // `req.socket` is typed as always-present in Node typings, but in test\n  // doubles (object literals without `socket`) it can be missing — the\n  // optional chain keeps the fallback path reachable.\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- defensive for test doubles\n  const ip = req.socket?.remoteAddress ?? 'unknown'\n  switch (keyBy) {\n    case 'session': {\n      const cookie = readCookie(req, cookieName)\n      return cookie ? `session:${await hashFragment(cookie)}` : `ip:${ip}`\n    }\n    case 'user': {\n      const userId = (req as unknown as { user?: { id?: string } }).user?.id\n      return userId ? `user:${userId}` : `ip:${ip}`\n    }\n    case 'ip':\n    default:\n      return `ip:${ip}`\n  }\n}\n\n/**\n * Per-route rate limiter factory. Returns a sync checker compatible with\n * the existing api-middleware shape.\n *\n * Backwards-compatibility (ADR D2): a flat `{ windowMs, max }` config is\n * accepted and treated as `default` (no per-route variants).\n */\nexport function createRouteRateLimiter(config: RouteRateLimitConfig | RateLimitConfig) {\n  // Detect legacy flat shape\n  const isFlat =\n    'windowMs' in config && 'max' in config && !('default' in config) && !('routes' in config)\n  const cfg: RouteRateLimitConfig = isFlat ? { default: config } : config\n\n  const store = cfg.store ?? new InMemoryStore()\n  // CR-005: validate store shape ONCE at construction. The previous\n  // implementation ran `instanceof InMemoryStore` on every request and\n  // threw at request-time if a non-InMemoryStore was passed — which\n  // turned a clear config error into a runtime 500 on the first request.\n  if (!(store instanceof InMemoryStore)) {\n    throw new Error(\n      'createRouteRateLimiter: async RateLimitStore implementations require a dedicated async middleware path. ' +\n        'Use the InMemoryStore default for the sync façade.',\n    )\n  }\n  const inMemoryStore = store\n  const keyBy = cfg.keyBy ?? 'ip'\n  const cookieName = cfg.cookieName ?? 'theo_session'\n\n  // Build a pre-compiled list of (pattern, config) tuples for matching.\n  const patternList: [string | RegExp, RateLimitConfig][] = []\n  if (cfg.routes) {\n    for (const [pattern, c] of Object.entries(cfg.routes)) patternList.push([pattern, c])\n  }\n  if (cfg.routePatterns) {\n    for (const tuple of cfg.routePatterns) patternList.push(tuple)\n  }\n\n  return async function checkRouteRateLimit(req: IncomingMessage): Promise<RateLimitResult> {\n    const url = req.url ?? ''\n    let matched: RateLimitConfig | undefined\n    for (const [pattern, c] of patternList) {\n      if (matchRoutePattern(url, pattern)) {\n        matched = c\n        break\n      }\n    }\n    const effective = matched ?? cfg.default\n    if (!effective) {\n      // No route match + no default → not limited.\n      return { limited: false, headers: {} }\n    }\n\n    // Bucket key includes normalized path so /api/login and /api/login/\n    // collapse to the same bucket (EC-5).\n    const bucketSuffix = typeof matched === 'undefined' ? '*default*' : normalizePath(url)\n    const key = `${await deriveKey(req, keyBy, cookieName)}|${bucketSuffix}`\n    const state = inMemoryStore.incrSync(key, effective.windowMs)\n\n    if (state.count > effective.max) {\n      const retryAfter = Math.ceil((state.resetAt - Date.now()) / 1000)\n      return {\n        limited: true,\n        headers: {\n          'X-RateLimit-Limit': String(effective.max),\n          'X-RateLimit-Remaining': '0',\n          'Retry-After': String(retryAfter),\n        },\n      }\n    }\n    return {\n      limited: false,\n      headers: {\n        'X-RateLimit-Limit': String(effective.max),\n        'X-RateLimit-Remaining': String(Math.max(0, effective.max - state.count)),\n      },\n    }\n  }\n}\n\n/**\n * T5a.2 Phase D slice 1/3 — Web-Standards rate-limiter inputs context.\n *\n * Web `Request` has no equivalent of `req.socket.remoteAddress` (Node\n * runtime concept) or `req.user` (set by upstream middleware). The\n * Web-shaped rate-limiter requires the caller to pass these explicitly:\n *\n *   - `clientIp` — resolved per-runtime (Node: `socket.remoteAddress`;\n *     CF Workers: `request.headers.get('cf-connecting-ip')`; Vercel:\n *     `x-forwarded-for` first hop; Bun/Deno: adapter-specific).\n *   - `userId` — resolved by auth middleware (Phase D slice 3/3 ships\n *     the Web-shaped session helper).\n *\n * Defaults: `clientIp = 'unknown'`, `userId = undefined` (matches the\n * IncomingMessage path's fallback semantics).\n */\nexport interface DeriveKeyRequestContext {\n  clientIp?: string\n  userId?: string\n}\n\n/**\n * T5a.2 Phase D slice 1/3 — Web-Standards-shaped key derivation.\n *\n * Mirror of `deriveKey(req: IncomingMessage, keyBy, cookieName)` for the\n * Web `Request` shape. Same `'ip' | 'session' | 'user'` enum cases (the\n * `function` callback case is IncomingMessage-only because the existing\n * `KeyByMode` callback type is Node-shaped; Web callers use the enum\n * cases or call a future `KeyByModeWeb` shape — out of T5a.2 Phase D scope).\n *\n * Uses `getCookieFromRequest` (Phase B slice 6/6) for session-mode cookie\n * lookup. Cookie parsing has the same CR-009 percent-encoding safety.\n */\nexport async function deriveKeyFromRequest(\n  request: Request,\n  keyBy: Exclude<KeyByMode, (req: IncomingMessage) => string>,\n  cookieName: string,\n  ctx: DeriveKeyRequestContext = {},\n): Promise<string> {\n  const ip = ctx.clientIp ?? 'unknown'\n  switch (keyBy) {\n    case 'session': {\n      // Reuse the Web cookie helper extracted in Phase B slice 6/6 so\n      // CR-009 percent-encoding sanity stays consistent across paths.\n      const { getCookieFromRequest } = await import('../http/cookies.js')\n      const cookie = getCookieFromRequest(request, cookieName)\n      return cookie ? `session:${await hashFragment(cookie)}` : `ip:${ip}`\n    }\n    case 'user': {\n      return ctx.userId ? `user:${ctx.userId}` : `ip:${ip}`\n    }\n    case 'ip':\n    default:\n      return `ip:${ip}`\n  }\n}\n\n/**\n * T5a.2 Phase D slice 1/3 — Web-Standards rate-limiter factory.\n *\n * Mirror of `createRouteRateLimiter(config)` returning a checker that\n * accepts `(request: Request, ctx?: DeriveKeyRequestContext)` instead of\n * `(req: IncomingMessage)`. Same `RouteRateLimitConfig` accepted; same\n * `keyBy` enum cases; same `InMemoryStore` constraint (CR-005 guard).\n *\n * Same returned `RateLimitResult` shape (headers + limited boolean).\n *\n * Web `Request` has no `req.url` path-only property — uses\n * `new URL(request.url).pathname + search` to derive the URL the way the\n * IncomingMessage path's `req.url ?? ''` would.\n */\nexport function createRouteRateLimiterWeb(config: RouteRateLimitConfig | RateLimitConfig) {\n  const isFlat =\n    'windowMs' in config && 'max' in config && !('default' in config) && !('routes' in config)\n  const cfg: RouteRateLimitConfig = isFlat ? { default: config } : config\n\n  const store = cfg.store ?? new InMemoryStore()\n  if (!(store instanceof InMemoryStore)) {\n    throw new Error(\n      'createRouteRateLimiterWeb: async RateLimitStore implementations require a dedicated async middleware path. ' +\n        'Use the InMemoryStore default for the Web façade.',\n    )\n  }\n  const inMemoryStore = store\n  const keyBy = (cfg.keyBy ?? 'ip') as Exclude<KeyByMode, (req: IncomingMessage) => string>\n  const cookieName = cfg.cookieName ?? 'theo_session'\n\n  const patternList: [string | RegExp, RateLimitConfig][] = []\n  if (cfg.routes) {\n    for (const [pattern, c] of Object.entries(cfg.routes)) patternList.push([pattern, c])\n  }\n  if (cfg.routePatterns) {\n    for (const tuple of cfg.routePatterns) patternList.push(tuple)\n  }\n\n  return async function checkRouteRateLimitWeb(\n    request: Request,\n    ctx: DeriveKeyRequestContext = {},\n  ): Promise<RateLimitResult> {\n    // Web Request guarantees absolute URL — extract path+query for pattern\n    // matching (mirror of IncomingMessage's `req.url ?? ''`).\n    const parsed = new URL(request.url)\n    const url = `${parsed.pathname}${parsed.search}`\n    let matched: RateLimitConfig | undefined\n    for (const [pattern, c] of patternList) {\n      if (matchRoutePattern(url, pattern)) {\n        matched = c\n        break\n      }\n    }\n    const effective = matched ?? cfg.default\n    if (!effective) {\n      return { limited: false, headers: {} }\n    }\n\n    const bucketSuffix = typeof matched === 'undefined' ? '*default*' : normalizePath(url)\n    const key = `${await deriveKeyFromRequest(request, keyBy, cookieName, ctx)}|${bucketSuffix}`\n    const state = inMemoryStore.incrSync(key, effective.windowMs)\n\n    if (state.count > effective.max) {\n      const retryAfter = Math.ceil((state.resetAt - Date.now()) / 1000)\n      return {\n        limited: true,\n        headers: {\n          'X-RateLimit-Limit': String(effective.max),\n          'X-RateLimit-Remaining': '0',\n          'Retry-After': String(retryAfter),\n        },\n      }\n    }\n    return {\n      limited: false,\n      headers: {\n        'X-RateLimit-Limit': String(effective.max),\n        'X-RateLimit-Remaining': String(Math.max(0, effective.max - state.count)),\n      },\n    }\n  }\n}\n"],"mappings":";;;;;;;;AAgDA,SAAS,cAAc,OAAuB;AAC5C,QAAM,UAAU,MAAM,MAAM,GAAG,EAAE,CAAC;AAClC,MAAI,QAAQ,SAAS,KAAK,QAAQ,SAAS,GAAG,EAAG,QAAO,QAAQ,MAAM,GAAG,EAAE;AAC3E,SAAO;AACT;AAOO,SAAS,kBAAkB,MAAc,SAAmC;AACjF,QAAM,YAAY,cAAc,IAAI;AACpC,MAAI,OAAO,YAAY,UAAU;AAC/B,WAAO,cAAc,cAAc,OAAO;AAAA,EAC5C;AACA,UAAQ,YAAY;AACpB,SAAO,QAAQ,KAAK,SAAS;AAC/B;AAWA,eAAe,aAAa,OAAgC;AAC1D,QAAM,MAAM,MAAM,WAAW,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AAC5F,QAAM,QAAQ,IAAI,WAAW,GAAG;AAChC,MAAI,MAAM;AACV,aAAW,KAAK,MAAO,QAAO,OAAO,aAAa,CAAC;AAEnD,QAAM,SAAS,KAAK,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAClF,SAAO,OAAO,MAAM,GAAG,EAAE;AAC3B;AAMA,SAAS,WAAW,KAAsB,MAAkC;AAC1E,SAAO,kBAAkB,IAAI,QAAQ,UAAU,MAAS,EAAE,IAAI,IAAI;AACpE;AAUA,eAAsB,UACpB,KACA,OACA,YACiB;AACjB,MAAI,OAAO,UAAU,WAAY,QAAO,MAAM,GAAG;AAKjD,QAAM,KAAK,IAAI,QAAQ,iBAAiB;AACxC,UAAQ,OAAO;AAAA,IACb,KAAK,WAAW;AACd,YAAM,SAAS,WAAW,KAAK,UAAU;AACzC,aAAO,SAAS,WAAW,MAAM,aAAa,MAAM,CAAC,KAAK,MAAM,EAAE;AAAA,IACpE;AAAA,IACA,KAAK,QAAQ;AACX,YAAM,SAAU,IAA8C,MAAM;AACpE,aAAO,SAAS,QAAQ,MAAM,KAAK,MAAM,EAAE;AAAA,IAC7C;AAAA,IACA,KAAK;AAAA,IACL;AACE,aAAO,MAAM,EAAE;AAAA,EACnB;AACF;AASO,SAAS,uBAAuB,QAAgD;AAErF,QAAM,SACJ,cAAc,UAAU,SAAS,UAAU,EAAE,aAAa,WAAW,EAAE,YAAY;AACrF,QAAM,MAA4B,SAAS,EAAE,SAAS,OAAO,IAAI;AAEjE,QAAM,QAAQ,IAAI,SAAS,IAAI,cAAc;AAK7C,MAAI,EAAE,iBAAiB,gBAAgB;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,QAAM,gBAAgB;AACtB,QAAM,QAAQ,IAAI,SAAS;AAC3B,QAAM,aAAa,IAAI,cAAc;AAGrC,QAAM,cAAoD,CAAC;AAC3D,MAAI,IAAI,QAAQ;AACd,eAAW,CAAC,SAAS,CAAC,KAAK,OAAO,QAAQ,IAAI,MAAM,EAAG,aAAY,KAAK,CAAC,SAAS,CAAC,CAAC;AAAA,EACtF;AACA,MAAI,IAAI,eAAe;AACrB,eAAW,SAAS,IAAI,cAAe,aAAY,KAAK,KAAK;AAAA,EAC/D;AAEA,SAAO,eAAe,oBAAoB,KAAgD;AACxF,UAAM,MAAM,IAAI,OAAO;AACvB,QAAI;AACJ,eAAW,CAAC,SAAS,CAAC,KAAK,aAAa;AACtC,UAAI,kBAAkB,KAAK,OAAO,GAAG;AACnC,kBAAU;AACV;AAAA,MACF;AAAA,IACF;AACA,UAAM,YAAY,WAAW,IAAI;AACjC,QAAI,CAAC,WAAW;AAEd,aAAO,EAAE,SAAS,OAAO,SAAS,CAAC,EAAE;AAAA,IACvC;AAIA,UAAM,eAAe,OAAO,YAAY,cAAc,cAAc,cAAc,GAAG;AACrF,UAAM,MAAM,GAAG,MAAM,UAAU,KAAK,OAAO,UAAU,CAAC,IAAI,YAAY;AACtE,UAAM,QAAQ,cAAc,SAAS,KAAK,UAAU,QAAQ;AAE5D,QAAI,MAAM,QAAQ,UAAU,KAAK;AAC/B,YAAM,aAAa,KAAK,MAAM,MAAM,UAAU,KAAK,IAAI,KAAK,GAAI;AAChE,aAAO;AAAA,QACL,SAAS;AAAA,QACT,SAAS;AAAA,UACP,qBAAqB,OAAO,UAAU,GAAG;AAAA,UACzC,yBAAyB;AAAA,UACzB,eAAe,OAAO,UAAU;AAAA,QAClC;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,SAAS;AAAA,QACP,qBAAqB,OAAO,UAAU,GAAG;AAAA,QACzC,yBAAyB,OAAO,KAAK,IAAI,GAAG,UAAU,MAAM,MAAM,KAAK,CAAC;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AACF;AAmCA,eAAsB,qBACpB,SACA,OACA,YACA,MAA+B,CAAC,GACf;AACjB,QAAM,KAAK,IAAI,YAAY;AAC3B,UAAQ,OAAO;AAAA,IACb,KAAK,WAAW;AAGd,YAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,uBAAoB;AAClE,YAAM,SAAS,qBAAqB,SAAS,UAAU;AACvD,aAAO,SAAS,WAAW,MAAM,aAAa,MAAM,CAAC,KAAK,MAAM,EAAE;AAAA,IACpE;AAAA,IACA,KAAK,QAAQ;AACX,aAAO,IAAI,SAAS,QAAQ,IAAI,MAAM,KAAK,MAAM,EAAE;AAAA,IACrD;AAAA,IACA,KAAK;AAAA,IACL;AACE,aAAO,MAAM,EAAE;AAAA,EACnB;AACF;AAgBO,SAAS,0BAA0B,QAAgD;AACxF,QAAM,SACJ,cAAc,UAAU,SAAS,UAAU,EAAE,aAAa,WAAW,EAAE,YAAY;AACrF,QAAM,MAA4B,SAAS,EAAE,SAAS,OAAO,IAAI;AAEjE,QAAM,QAAQ,IAAI,SAAS,IAAI,cAAc;AAC7C,MAAI,EAAE,iBAAiB,gBAAgB;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,QAAM,gBAAgB;AACtB,QAAM,QAAS,IAAI,SAAS;AAC5B,QAAM,aAAa,IAAI,cAAc;AAErC,QAAM,cAAoD,CAAC;AAC3D,MAAI,IAAI,QAAQ;AACd,eAAW,CAAC,SAAS,CAAC,KAAK,OAAO,QAAQ,IAAI,MAAM,EAAG,aAAY,KAAK,CAAC,SAAS,CAAC,CAAC;AAAA,EACtF;AACA,MAAI,IAAI,eAAe;AACrB,eAAW,SAAS,IAAI,cAAe,aAAY,KAAK,KAAK;AAAA,EAC/D;AAEA,SAAO,eAAe,uBACpB,SACA,MAA+B,CAAC,GACN;AAG1B,UAAM,SAAS,IAAI,IAAI,QAAQ,GAAG;AAClC,UAAM,MAAM,GAAG,OAAO,QAAQ,GAAG,OAAO,MAAM;AAC9C,QAAI;AACJ,eAAW,CAAC,SAAS,CAAC,KAAK,aAAa;AACtC,UAAI,kBAAkB,KAAK,OAAO,GAAG;AACnC,kBAAU;AACV;AAAA,MACF;AAAA,IACF;AACA,UAAM,YAAY,WAAW,IAAI;AACjC,QAAI,CAAC,WAAW;AACd,aAAO,EAAE,SAAS,OAAO,SAAS,CAAC,EAAE;AAAA,IACvC;AAEA,UAAM,eAAe,OAAO,YAAY,cAAc,cAAc,cAAc,GAAG;AACrF,UAAM,MAAM,GAAG,MAAM,qBAAqB,SAAS,OAAO,YAAY,GAAG,CAAC,IAAI,YAAY;AAC1F,UAAM,QAAQ,cAAc,SAAS,KAAK,UAAU,QAAQ;AAE5D,QAAI,MAAM,QAAQ,UAAU,KAAK;AAC/B,YAAM,aAAa,KAAK,MAAM,MAAM,UAAU,KAAK,IAAI,KAAK,GAAI;AAChE,aAAO;AAAA,QACL,SAAS;AAAA,QACT,SAAS;AAAA,UACP,qBAAqB,OAAO,UAAU,GAAG;AAAA,UACzC,yBAAyB;AAAA,UACzB,eAAe,OAAO,UAAU;AAAA,QAClC;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,SAAS;AAAA,QACP,qBAAqB,OAAO,UAAU,GAAG;AAAA,QACzC,yBAAyB,OAAO,KAAK,IAAI,GAAG,UAAU,MAAM,MAAM,KAAK,CAAC;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-B3L3TJVF.js

@@ -0,0 +1,406 @@
+import {
+  safeAudit
+} from "./chunk-UD3LFGDL.js";
+
+// src/server/security/csrf-readiness-store.ts
+var CsrfReadinessStore = class _CsrfReadinessStore {
+  static MAX_ENTRIES = 1e3;
+  entries = /* @__PURE__ */ new Map();
+  keyFor(event) {
+    return `${event.method}\0${event.path}\0${event.reason}`;
+  }
+  record(event) {
+    const key = this.keyFor(event);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const existing = this.entries.get(key);
+    if (existing) {
+      existing.count++;
+      existing.lastSeen = now;
+      return;
+    }
+    if (this.entries.size >= _CsrfReadinessStore.MAX_ENTRIES) {
+      const firstKey = this.entries.keys().next().value;
+      if (firstKey !== void 0) this.entries.delete(firstKey);
+    }
+    this.entries.set(key, { count: 1, firstSeen: now, lastSeen: now });
+  }
+  summary() {
+    let total = 0;
+    const routes = [];
+    for (const [key, entry] of this.entries) {
+      const [method, path, reason] = key.split("\0");
+      routes.push({
+        method,
+        path,
+        reason,
+        count: entry.count,
+        firstSeen: entry.firstSeen,
+        lastSeen: entry.lastSeen
+      });
+      total += entry.count;
+    }
+    return {
+      generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      totalEvents: total,
+      routes
+    };
+  }
+  reset() {
+    this.entries.clear();
+  }
+};
+
+// src/server/security/csp-report.ts
+var CSP_REPORT_PATH = "/__theo/csp-report";
+var MAX_BODY = 16 * 1024;
+function pickHeader(value) {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value) && value.length > 0) return value[0];
+  return "";
+}
+function toStringSafe(value, fallback = "(missing)") {
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  return fallback;
+}
+function normalizeLegacy(raw) {
+  return {
+    blockedUrl: toStringSafe(raw["blocked-uri"]),
+    documentUrl: toStringSafe(raw["document-uri"]),
+    violatedDirective: toStringSafe(raw["violated-directive"]),
+    effectiveDirective: typeof raw["effective-directive"] === "string" ? raw["effective-directive"] : void 0,
+    originalPolicy: typeof raw["original-policy"] === "string" ? raw["original-policy"] : void 0,
+    disposition: raw.disposition === "enforce" || raw.disposition === "report" ? raw.disposition : void 0,
+    statusCode: typeof raw["status-code"] === "number" ? raw["status-code"] : void 0,
+    sourceFile: typeof raw["source-file"] === "string" ? raw["source-file"] : void 0,
+    lineNumber: typeof raw["line-number"] === "number" ? raw["line-number"] : void 0,
+    columnNumber: typeof raw["column-number"] === "number" ? raw["column-number"] : void 0
+  };
+}
+function normalizeNew(entry) {
+  if (!entry || typeof entry !== "object") return null;
+  const body = entry.body;
+  if (!body || typeof body !== "object") return null;
+  const b = body;
+  return {
+    blockedUrl: toStringSafe(b.blockedURL),
+    documentUrl: toStringSafe(b.documentURL),
+    violatedDirective: toStringSafe(b.violatedDirective),
+    effectiveDirective: typeof b.effectiveDirective === "string" ? b.effectiveDirective : void 0,
+    originalPolicy: typeof b.originalPolicy === "string" ? b.originalPolicy : void 0,
+    disposition: b.disposition === "enforce" || b.disposition === "report" ? b.disposition : void 0,
+    statusCode: typeof b.statusCode === "number" ? b.statusCode : void 0,
+    sourceFile: typeof b.sourceFile === "string" ? b.sourceFile : void 0,
+    lineNumber: typeof b.lineNumber === "number" ? b.lineNumber : void 0,
+    columnNumber: typeof b.columnNumber === "number" ? b.columnNumber : void 0
+  };
+}
+async function readBody(req, maxBytes) {
+  return await new Promise((resolve, reject) => {
+    const chunks = [];
+    let total = 0;
+    req.on("data", (chunk) => {
+      total += chunk.length;
+      if (total > maxBytes) {
+        reject(new Error("body too large"));
+        req.destroy();
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on("end", () => {
+      resolve(Buffer.concat(chunks).toString("utf8"));
+    });
+    req.on("error", reject);
+  });
+}
+async function handleCspReport(req, res, opts) {
+  const ctHeader = req.headers["content-type"];
+  const ct = pickHeader(ctHeader);
+  let raw;
+  try {
+    raw = await readBody(req, MAX_BODY);
+  } catch {
+    res.statusCode = 413;
+    res.end();
+    return;
+  }
+  let violations;
+  try {
+    if (ct.startsWith("application/csp-report")) {
+      const parsed = JSON.parse(raw);
+      const inner = parsed["csp-report"];
+      if (!inner || typeof inner !== "object") {
+        res.statusCode = 204;
+        res.end();
+        return;
+      }
+      violations = [normalizeLegacy(inner)];
+    } else if (ct.startsWith("application/reports+json")) {
+      const parsed = JSON.parse(raw);
+      const entries = Array.isArray(parsed) ? parsed : [];
+      violations = entries.map((e) => normalizeNew(e)).filter((v) => v !== null);
+    } else {
+      res.statusCode = 415;
+      res.end();
+      return;
+    }
+  } catch {
+    res.statusCode = 400;
+    res.end();
+    return;
+  }
+  for (const v of violations) {
+    safeAudit(opts.auditLogger, {
+      action: "csp.violation",
+      metadata: v
+    });
+    try {
+      opts.devtoolsDispatcher?.onCspViolation?.(v);
+    } catch {
+    }
+    try {
+      opts.onViolation?.(v);
+    } catch {
+    }
+  }
+  res.statusCode = 204;
+  res.end();
+}
+async function readBodyFromRequest(request, maxBytes) {
+  const contentLengthHeader = request.headers.get("content-length");
+  if (contentLengthHeader !== null) {
+    const declared = Number.parseInt(contentLengthHeader, 10);
+    if (Number.isFinite(declared) && declared > maxBytes) return null;
+  }
+  const text = await request.text();
+  if (text.length > maxBytes) return null;
+  return text;
+}
+function dispatchViolations(violations, opts) {
+  for (const v of violations) {
+    safeAudit(opts.auditLogger, {
+      action: "csp.violation",
+      metadata: v
+    });
+    try {
+      opts.devtoolsDispatcher?.onCspViolation?.(v);
+    } catch {
+    }
+    try {
+      opts.onViolation?.(v);
+    } catch {
+    }
+  }
+}
+async function handleCspReportRequest(request, opts) {
+  const ct = request.headers.get("content-type") ?? "";
+  const raw = await readBodyFromRequest(request, MAX_BODY);
+  if (raw === null) {
+    return new Response(null, { status: 413 });
+  }
+  let violations;
+  try {
+    if (ct.startsWith("application/csp-report")) {
+      const parsed = JSON.parse(raw);
+      const inner = parsed["csp-report"];
+      if (!inner || typeof inner !== "object") {
+        return new Response(null, { status: 204 });
+      }
+      violations = [normalizeLegacy(inner)];
+    } else if (ct.startsWith("application/reports+json")) {
+      const parsed = JSON.parse(raw);
+      const entries = Array.isArray(parsed) ? parsed : [];
+      violations = entries.map((e) => normalizeNew(e)).filter((v) => v !== null);
+    } else {
+      return new Response(null, { status: 415 });
+    }
+  } catch {
+    return new Response(null, { status: 400 });
+  }
+  dispatchViolations(violations, opts);
+  return new Response(null, { status: 204 });
+}
+
+// src/server/security/csrf-readiness-endpoint.ts
+var CSRF_READINESS_PATH = "/__theo/csrf-readiness";
+var CSRF_READINESS_RESET_PATH = "/__theo/csrf-readiness/reset";
+function originMatchesHost(req) {
+  const origin = req.headers.origin;
+  if (typeof origin !== "string") return false;
+  const host = req.headers.host;
+  if (typeof host !== "string") return false;
+  try {
+    const parsed = new URL(origin);
+    return parsed.host === host;
+  } catch {
+    return false;
+  }
+}
+function sendJson(res, status, body) {
+  res.writeHead(status, { "content-type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+function sendNoContent(res) {
+  res.writeHead(204);
+  res.end();
+}
+function sendError(res, status, code, message) {
+  res.writeHead(status, { "content-type": "application/json" });
+  res.end(JSON.stringify({ error: { code, message } }));
+}
+async function handleCsrfReadiness(req, res, store) {
+  const url = (req.url ?? "").split("?")[0];
+  const method = req.method ?? "GET";
+  if (url === CSRF_READINESS_PATH) {
+    if (method === "GET") {
+      sendJson(res, 200, store.summary());
+      return true;
+    }
+    sendError(res, 405, "METHOD_NOT_ALLOWED", `Use GET on ${CSRF_READINESS_PATH}`);
+    return true;
+  }
+  if (url === CSRF_READINESS_RESET_PATH) {
+    if (method !== "POST") {
+      sendError(res, 405, "METHOD_NOT_ALLOWED", `Use POST on ${CSRF_READINESS_RESET_PATH}`);
+      return true;
+    }
+    const hasHeader = req.headers["x-theo-action"] === "1";
+    if (!hasHeader || !originMatchesHost(req)) {
+      sendError(res, 403, "CSRF_INVALID", "Reset requires X-Theo-Action: 1 + same-origin");
+      return true;
+    }
+    store.reset();
+    sendNoContent(res);
+    return true;
+  }
+  return false;
+}
+function buildJsonResponse(status, body) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json" }
+  });
+}
+function buildErrorResponse(status, code, message) {
+  return buildJsonResponse(status, { error: { code, message } });
+}
+function originMatchesHostFromRequest(request) {
+  const origin = request.headers.get("origin");
+  if (origin === null || origin.length === 0) return false;
+  const host = request.headers.get("host");
+  if (host === null || host.length === 0) {
+    try {
+      const reqHost = new URL(request.url).host;
+      const originHost = new URL(origin).host;
+      return originHost === reqHost;
+    } catch {
+      return false;
+    }
+  }
+  try {
+    return new URL(origin).host === host;
+  } catch {
+    return false;
+  }
+}
+async function handleCsrfReadinessRequest(request, store) {
+  const url = new URL(request.url).pathname;
+  const method = request.method.toUpperCase();
+  if (url === CSRF_READINESS_PATH) {
+    if (method === "GET") {
+      return buildJsonResponse(200, store.summary());
+    }
+    return buildErrorResponse(405, "METHOD_NOT_ALLOWED", `Use GET on ${CSRF_READINESS_PATH}`);
+  }
+  if (url === CSRF_READINESS_RESET_PATH) {
+    if (method !== "POST") {
+      return buildErrorResponse(
+        405,
+        "METHOD_NOT_ALLOWED",
+        `Use POST on ${CSRF_READINESS_RESET_PATH}`
+      );
+    }
+    const hasHeader = request.headers.get("x-theo-action") === "1";
+    if (!hasHeader || !originMatchesHostFromRequest(request)) {
+      return buildErrorResponse(
+        403,
+        "CSRF_INVALID",
+        "Reset requires X-Theo-Action: 1 + same-origin"
+      );
+    }
+    store.reset();
+    return new Response(null, { status: 204 });
+  }
+  return null;
+}
+
+// src/server/security/security-headers.ts
+var DEFAULT_CSP = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' ws: wss:; frame-ancestors 'none'; report-uri /__theo/csp-report";
+var DEFAULT_PERMISSIONS_POLICY = "geolocation=(), camera=(), microphone=(), payment=(), usb=(), accelerometer=(), gyroscope=()";
+var DEFAULT_HSTS = "max-age=31536000; includeSubDomains";
+function applyNonceToCsp(policy, nonce) {
+  return policy.split(";").map((directive) => {
+    const trimmed = directive.trim();
+    if (!trimmed.startsWith("script-src")) return directive;
+    if (trimmed.includes("'unsafe-inline'")) {
+      return directive.replace("'unsafe-inline'", `'nonce-${nonce}'`);
+    }
+    return `${directive} 'nonce-${nonce}'`;
+  }).join(";");
+}
+function applyCsp(out, config, effectiveNonce) {
+  if (config.csp === false || config.cspMode === "off") return;
+  let policy = typeof config.csp === "string" ? config.csp : DEFAULT_CSP;
+  if (effectiveNonce) {
+    policy = applyNonceToCsp(policy, effectiveNonce);
+  }
+  const mode = config.cspMode ?? "enforce";
+  if (mode === "enforce") {
+    out["Content-Security-Policy"] = policy;
+  } else {
+    out["Content-Security-Policy-Report-Only"] = policy;
+  }
+}
+function buildSecurityHeaders(config, env, options = {}) {
+  const out = {};
+  const effectiveNonce = options.prerender ? void 0 : options.nonce;
+  applyCsp(out, config, effectiveNonce);
+  out["X-Frame-Options"] = config.frameOptions ?? "DENY";
+  out["X-Content-Type-Options"] = config.contentTypeOptions ?? "nosniff";
+  out["Referrer-Policy"] = config.referrerPolicy ?? "strict-origin-when-cross-origin";
+  if (config.permissionsPolicy !== false) {
+    out["Permissions-Policy"] = typeof config.permissionsPolicy === "string" ? config.permissionsPolicy : DEFAULT_PERMISSIONS_POLICY;
+  }
+  if (env.production && config.hsts !== false) {
+    out["Strict-Transport-Security"] = typeof config.hsts === "string" ? config.hsts : DEFAULT_HSTS;
+  }
+  if (effectiveNonce) {
+    out["Cache-Control"] = "private, no-store";
+  }
+  return out;
+}
+function applySecurityHeaders(res, config, env, options = {}) {
+  const headers = buildSecurityHeaders(config, env, options);
+  for (const [key, value] of Object.entries(headers)) {
+    res.setHeader(key, value);
+  }
+}
+
+export {
+  CsrfReadinessStore,
+  CSP_REPORT_PATH,
+  normalizeLegacy,
+  normalizeNew,
+  handleCspReport,
+  handleCspReportRequest,
+  CSRF_READINESS_PATH,
+  CSRF_READINESS_RESET_PATH,
+  handleCsrfReadiness,
+  handleCsrfReadinessRequest,
+  DEFAULT_CSP,
+  DEFAULT_PERMISSIONS_POLICY,
+  buildSecurityHeaders,
+  applySecurityHeaders
+};
+//# sourceMappingURL=chunk-B3L3TJVF.js.map