webpeel 0.12.0 → 0.12.2

package/dist/server/routes/oauth.js

@@ -0,0 +1,296 @@
+/**
+ * OAuth authentication routes
+ * Handles OAuth login from Auth.js (GitHub, Google)
+ */
+import { Router } from 'express';
+import crypto from 'crypto';
+import jwt from 'jsonwebtoken';
+import pg from 'pg';
+import { PostgresAuthStore } from '../pg-auth-store.js';
+const { Pool } = pg;
+/**
+ * Validate email format
+ */
+function isValidEmail(email) {
+    const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+    return emailRegex.test(email);
+}
+/**
+ * Simple in-memory rate limiter for OAuth endpoint
+ */
+class OAuthRateLimiter {
+    attempts = new Map();
+    maxAttempts = 10;
+    windowMs = 60000; // 1 minute
+    check(identifier) {
+        const now = Date.now();
+        const attempts = this.attempts.get(identifier) || [];
+        // Remove old attempts outside the window
+        const recentAttempts = attempts.filter(time => now - time < this.windowMs);
+        if (recentAttempts.length >= this.maxAttempts) {
+            return false;
+        }
+        recentAttempts.push(now);
+        this.attempts.set(identifier, recentAttempts);
+        return true;
+    }
+    cleanup() {
+        const now = Date.now();
+        for (const [key, attempts] of this.attempts.entries()) {
+            const recentAttempts = attempts.filter(time => now - time < this.windowMs);
+            if (recentAttempts.length === 0) {
+                this.attempts.delete(key);
+            }
+            else {
+                this.attempts.set(key, recentAttempts);
+            }
+        }
+    }
+}
+const rateLimiter = new OAuthRateLimiter();
+// Clean up rate limiter every 2 minutes
+setInterval(() => {
+    rateLimiter.cleanup();
+}, 2 * 60 * 1000);
+/**
+ * Create OAuth routes
+ */
+export function createOAuthRouter() {
+    const router = Router();
+    const dbUrl = process.env.DATABASE_URL;
+    if (!dbUrl) {
+        throw new Error('DATABASE_URL environment variable is required');
+    }
+    const pool = new Pool({
+        connectionString: dbUrl,
+        // TLS: enabled when DATABASE_URL contains sslmode=require.
+        // Secure by default (rejectUnauthorized: true); set PG_REJECT_UNAUTHORIZED=false
+        // only for managed DBs (Render/Neon/Supabase) that use self-signed certs.
+        ssl: process.env.DATABASE_URL?.includes('sslmode=require')
+            ? { rejectUnauthorized: process.env.PG_REJECT_UNAUTHORIZED !== 'false' }
+            : undefined,
+    });
+    /**
+     * Helper: generate a refresh token and store its jti in the database
+     */
+    async function createRefreshToken(userId, jwtSecret) {
+        const jti = crypto.randomUUID();
+        const expiresAt = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000); // 30 days
+        await pool.query(`INSERT INTO refresh_tokens (id, user_id, expires_at) VALUES ($1, $2, $3)`, [jti, userId, expiresAt]);
+        return jwt.sign({ userId, jti }, jwtSecret, { expiresIn: '30d' });
+    }
+    /**
+     * POST /v1/auth/oauth
+     * OAuth callback handler - called by Auth.js after successful OAuth flow
+     * Auto-creates users if they don't exist
+     */
+    router.post('/v1/auth/oauth', async (req, res) => {
+        try {
+            const { provider, accessToken, name, avatar } = req.body;
+            // Rate limiting — scoped per-IP per-provider (not global) to prevent DoS.
+            // IP extracted from cf-connecting-ip (Cloudflare) > x-forwarded-for (reverse proxy) > req.ip.
+            // Limit: 10 attempts per minute per IP+provider combination.
+            const clientIp = req.headers['cf-connecting-ip'] || req.headers['x-forwarded-for']?.split(',')[0]?.trim() || req.ip || 'unknown';
+            if (!rateLimiter.check(`${clientIp}:${provider || 'unknown'}`)) {
+                res.status(429).json({
+                    error: 'rate_limit_exceeded',
+                    message: 'Too many OAuth attempts. Please try again in a minute.',
+                });
+                return;
+            }
+            // Input validation
+            if (!provider || !accessToken) {
+                res.status(400).json({
+                    error: 'missing_fields',
+                    message: 'provider and accessToken are required',
+                });
+                return;
+            }
+            // Validate provider
+            if (provider !== 'github' && provider !== 'google') {
+                res.status(400).json({
+                    error: 'invalid_provider',
+                    message: 'provider must be "github" or "google"',
+                });
+                return;
+            }
+            // SECURITY: Verify the OAuth token server-side and extract trusted identity
+            let providerId;
+            let email;
+            if (provider === 'github') {
+                // Verify GitHub access token
+                const ghRes = await fetch('https://api.github.com/user', {
+                    headers: {
+                        Authorization: `Bearer ${accessToken}`,
+                        Accept: 'application/vnd.github+json',
+                    },
+                });
+                if (!ghRes.ok) {
+                    res.status(401).json({
+                        error: 'invalid_token',
+                        message: 'Invalid GitHub access token',
+                    });
+                    return;
+                }
+                const ghUser = await ghRes.json();
+                providerId = String(ghUser.id);
+                // GitHub may not return email on /user; fetch from /user/emails
+                if (ghUser.email) {
+                    email = ghUser.email;
+                }
+                else {
+                    const emailRes = await fetch('https://api.github.com/user/emails', {
+                        headers: {
+                            Authorization: `Bearer ${accessToken}`,
+                            Accept: 'application/vnd.github+json',
+                        },
+                    });
+                    if (emailRes.ok) {
+                        const emails = await emailRes.json();
+                        const primary = emails.find(e => e.primary && e.verified);
+                        email = primary?.email || emails[0]?.email || '';
+                    }
+                    else {
+                        email = '';
+                    }
+                }
+            }
+            else {
+                // Verify Google ID token
+                const gRes = await fetch(`https://oauth2.googleapis.com/tokeninfo?id_token=${encodeURIComponent(accessToken)}`);
+                if (!gRes.ok) {
+                    res.status(401).json({
+                        error: 'invalid_token',
+                        message: 'Invalid Google token',
+                    });
+                    return;
+                }
+                const gUser = await gRes.json();
+                providerId = gUser.sub;
+                email = gUser.email || '';
+            }
+            // Validate email from verified token
+            if (!email || !isValidEmail(email)) {
+                res.status(400).json({
+                    error: 'invalid_email',
+                    message: 'Could not retrieve a valid email from OAuth provider',
+                });
+                return;
+            }
+            const client = await pool.connect();
+            try {
+                await client.query('BEGIN');
+                // Check if OAuth account already exists
+                const oauthResult = await client.query(`SELECT user_id FROM oauth_accounts 
+           WHERE provider = $1 AND provider_id = $2`, [provider, providerId]);
+                let userId;
+                let isNew = false;
+                let apiKey;
+                if (oauthResult.rows.length > 0) {
+                    // Existing OAuth account - get user
+                    userId = oauthResult.rows[0].user_id;
+                    // Update OAuth account info
+                    await client.query(`UPDATE oauth_accounts 
+             SET email = $1, name = $2, avatar_url = $3, updated_at = now()
+             WHERE provider = $4 AND provider_id = $5`, [email, name || null, avatar || null, provider, providerId]);
+                }
+                else {
+                    // New OAuth account - check if user with this email exists
+                    const userResult = await client.query('SELECT id FROM users WHERE email = $1', [email]);
+                    if (userResult.rows.length > 0) {
+                        // User exists - link OAuth account to existing user
+                        userId = userResult.rows[0].id;
+                        // Update user info
+                        await client.query(`UPDATE users 
+               SET name = COALESCE($1, name), 
+                   avatar_url = COALESCE($2, avatar_url), 
+                   updated_at = now()
+               WHERE id = $3`, [name || null, avatar || null, userId]);
+                        // Create OAuth account link
+                        await client.query(`INSERT INTO oauth_accounts 
+               (user_id, provider, provider_id, email, name, avatar_url)
+               VALUES ($1, $2, $3, $4, $5, $6)`, [userId, provider, providerId, email, name || null, avatar || null]);
+                    }
+                    else {
+                        // New user - create account
+                        const newUserResult = await client.query(`INSERT INTO users 
+               (email, password_hash, tier, weekly_limit, burst_limit, rate_limit, name, avatar_url)
+               VALUES ($1, NULL, 'free', 125, 25, 10, $2, $3)
+               RETURNING id`, [email, name || null, avatar || null]);
+                        userId = newUserResult.rows[0].id;
+                        isNew = true;
+                        // Create OAuth account link
+                        await client.query(`INSERT INTO oauth_accounts 
+               (user_id, provider, provider_id, email, name, avatar_url)
+               VALUES ($1, $2, $3, $4, $5, $6)`, [userId, provider, providerId, email, name || null, avatar || null]);
+                        // Generate first API key for new user
+                        apiKey = PostgresAuthStore.generateApiKey();
+                        const keyHash = crypto.createHash('sha256').update(apiKey).digest('hex');
+                        const keyPrefix = PostgresAuthStore.getKeyPrefix(apiKey);
+                        await client.query(`INSERT INTO api_keys (user_id, key_hash, key_prefix, name)
+               VALUES ($1, $2, $3, 'Default')`, [userId, keyHash, keyPrefix]);
+                    }
+                }
+                // Get user info for response
+                const userInfoResult = await client.query('SELECT id, email, tier, name, avatar_url FROM users WHERE id = $1', [userId]);
+                const user = userInfoResult.rows[0];
+                // Generate JWT
+                const jwtSecret = process.env.JWT_SECRET;
+                if (!jwtSecret) {
+                    throw new Error('JWT_SECRET not configured');
+                }
+                const token = jwt.sign({
+                    userId: user.id,
+                    email: user.email,
+                    tier: user.tier,
+                }, jwtSecret, { expiresIn: '1h' });
+                await client.query('COMMIT');
+                // Generate refresh token (after commit, uses pool not client)
+                const refreshToken = await createRefreshToken(user.id, jwtSecret);
+                // Response
+                const response = {
+                    user: {
+                        id: user.id,
+                        email: user.email,
+                        tier: user.tier,
+                        name: user.name,
+                        avatar: user.avatar_url,
+                    },
+                    token,
+                    refreshToken,
+                    expiresIn: 3600,
+                    isNew,
+                };
+                // Include API key only for new users
+                if (isNew && apiKey) {
+                    response.apiKey = apiKey;
+                }
+                res.json(response);
+            }
+            catch (error) {
+                await client.query('ROLLBACK');
+                throw error;
+            }
+            finally {
+                client.release();
+            }
+        }
+        catch (error) {
+            console.error('OAuth error:', error);
+            // Handle specific errors
+            if (error.code === '23505') { // Unique violation
+                res.status(409).json({
+                    error: 'oauth_conflict',
+                    message: 'OAuth account already exists',
+                });
+                return;
+            }
+            res.status(500).json({
+                error: 'oauth_failed',
+                message: 'Failed to process OAuth login',
+            });
+        }
+    });
+    return router;
+}
+//# sourceMappingURL=oauth.js.map

package/dist/server/routes/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/server/routes/oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,EAAqB,MAAM,SAAS,CAAC;AACpD,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAmBpB;;GAEG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,UAAU,GAAG,4BAA4B,CAAC;IAChD,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,MAAM,gBAAgB;IACZ,QAAQ,GAA0B,IAAI,GAAG,EAAE,CAAC;IACnC,WAAW,GAAG,EAAE,CAAC;IACjB,QAAQ,GAAG,KAAK,CAAC,CAAC,WAAW;IAE9C,KAAK,CAAC,UAAkB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAErD,yCAAyC;QACzC,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE3E,IAAI,cAAc,CAAC,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YACtD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC3E,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,MAAM,WAAW,GAAG,IAAI,gBAAgB,EAAE,CAAC;AAE3C,wCAAwC;AACxC,WAAW,CAAC,GAAG,EAAE;IACf,WAAW,CAAC,OAAO,EAAE,CAAC;AACxB,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAElB;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACvC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;QACpB,gBAAgB,EAAE,KAAK;QACvB,2DAA2D;QAC3D,iFAAiF;QACjF,0EAA0E;QAC1E,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,iBAAiB,CAAC;YACxD,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,OAAO,EAAE;YACxE,CAAC,CAAC,SAAS;KACd,CAAC,CAAC;IAEH;;OAEG;IACH,KAAK,UAAU,kBAAkB,CAAC,MAAc,EAAE,SAAiB;QACjE,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU;QAE7E,MAAM,IAAI,CAAC,KAAK,CACd,0EAA0E,EAC1E,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CACzB,CAAC;QAEF,OAAO,GAAG,CAAC,IAAI,CACb,EAAE,MAAM,EAAE,GAAG,EAAyB,EACtC,SAAS,EACT,EAAE,SAAS,EAAE,KAAK,EAAE,CACrB,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAClE,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;YAEzD,0EAA0E;YAC1E,8FAA8F;YAC9F,6DAA6D;YAC7D,MAAM,QAAQ,GAAI,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAY,IAAK,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC;YACzJ,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,QAAQ,IAAI,QAAQ,IAAI,SAAS,EAAE,CAAC,EAAE,CAAC;gBAC/D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,qBAAqB;oBAC5B,OAAO,EAAE,wDAAwD;iBAClE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,mBAAmB;YACnB,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,gBAAgB;oBACvB,OAAO,EAAE,uCAAuC;iBACjD,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,oBAAoB;YACpB,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,kBAAkB;oBACzB,OAAO,EAAE,uCAAuC;iBACjD,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,4EAA4E;YAC5E,IAAI,UAAkB,CAAC;YACvB,IAAI,KAAa,CAAC;YAElB,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1B,6BAA6B;gBAC7B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,6BAA6B,EAAE;oBACvD,OAAO,EAAE;wBACP,aAAa,EAAE,UAAU,WAAW,EAAE;wBACtC,MAAM,EAAE,6BAA6B;qBACtC;iBACF,CAAC,CAAC;gBACH,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;oBACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,KAAK,EAAE,eAAe;wBACtB,OAAO,EAAE,6BAA6B;qBACvC,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,EAA2C,CAAC;gBAC3E,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAE/B,gEAAgE;gBAChE,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBACjB,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;gBACvB,CAAC;qBAAM,CAAC;oBACN,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,oCAAoC,EAAE;wBACjE,OAAO,EAAE;4BACP,aAAa,EAAE,UAAU,WAAW,EAAE;4BACtC,MAAM,EAAE,6BAA6B;yBACtC;qBACF,CAAC,CAAC;oBACH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;wBAChB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAmE,CAAC;wBACtG,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;wBAC1D,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;oBACnD,CAAC;yBAAM,CAAC;wBACN,KAAK,GAAG,EAAE,CAAC;oBACb,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,yBAAyB;gBACzB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,oDAAoD,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;gBAChH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;oBACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,KAAK,EAAE,eAAe;wBACtB,OAAO,EAAE,sBAAsB;qBAChC,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAqC,CAAC;gBACnE,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC;gBACvB,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5B,CAAC;YAED,qCAAqC;YACrC,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,eAAe;oBACtB,OAAO,EAAE,sDAAsD;iBAChE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAEpC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAE5B,wCAAwC;gBACxC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,CACpC;oDAC0C,EAC1C,CAAC,QAAQ,EAAE,UAAU,CAAC,CACvB,CAAC;gBAEF,IAAI,MAAc,CAAC;gBACnB,IAAI,KAAK,GAAG,KAAK,CAAC;gBAClB,IAAI,MAA0B,CAAC;gBAE/B,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAChC,oCAAoC;oBACpC,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;oBAErC,4BAA4B;oBAC5B,MAAM,MAAM,CAAC,KAAK,CAChB;;sDAE0C,EAC1C,CAAC,KAAK,EAAE,IAAI,IAAI,IAAI,EAAE,MAAM,IAAI,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,CAC5D,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,2DAA2D;oBAC3D,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CACnC,uCAAuC,EACvC,CAAC,KAAK,CAAC,CACR,CAAC;oBAEF,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAC/B,oDAAoD;wBACpD,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;wBAE/B,mBAAmB;wBACnB,MAAM,MAAM,CAAC,KAAK,CAChB;;;;6BAIe,EACf,CAAC,IAAI,IAAI,IAAI,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,CAAC,CACvC,CAAC;wBAEF,4BAA4B;wBAC5B,MAAM,MAAM,CAAC,KAAK,CAChB;;+CAEiC,EACjC,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,IAAI,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC,CACpE,CAAC;oBACJ,CAAC;yBAAM,CAAC;wBACN,4BAA4B;wBAC5B,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,KAAK,CACtC;;;4BAGc,EACd,CAAC,KAAK,EAAE,IAAI,IAAI,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC,CACtC,CAAC;wBAEF,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;wBAClC,KAAK,GAAG,IAAI,CAAC;wBAEb,4BAA4B;wBAC5B,MAAM,MAAM,CAAC,KAAK,CAChB;;+CAEiC,EACjC,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,IAAI,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC,CACpE,CAAC;wBAEF,sCAAsC;wBACtC,MAAM,GAAG,iBAAiB,CAAC,cAAc,EAAE,CAAC;wBAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;wBACzE,MAAM,SAAS,GAAG,iBAAiB,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;wBAEzD,MAAM,MAAM,CAAC,KAAK,CAChB;8CACgC,EAChC,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAC7B,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAED,6BAA6B;gBAC7B,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,KAAK,CACvC,mEAAmE,EACnE,CAAC,MAAM,CAAC,CACT,CAAC;gBAEF,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAEpC,eAAe;gBACf,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;gBACzC,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;gBAC/C,CAAC;gBAED,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CACpB;oBACE,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,IAAI,EAAE,IAAI,CAAC,IAAI;iBACF,EACf,SAAS,EACT,EAAE,SAAS,EAAE,IAAI,EAAE,CACpB,CAAC;gBAEF,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAE7B,8DAA8D;gBAC9D,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;gBAElE,WAAW;gBACX,MAAM,QAAQ,GAAQ;oBACpB,IAAI,EAAE;wBACJ,EAAE,EAAE,IAAI,CAAC,EAAE;wBACX,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,MAAM,EAAE,IAAI,CAAC,UAAU;qBACxB;oBACD,KAAK;oBACL,YAAY;oBACZ,SAAS,EAAE,IAAI;oBACf,KAAK;iBACN,CAAC;gBAEF,qCAAqC;gBACrC,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;oBACpB,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;gBAC3B,CAAC;gBAED,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC/B,MAAM,KAAK,CAAC;YACd,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;YAErC,yBAAyB;YACzB,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC,mBAAmB;gBAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,gBAAgB;oBACvB,OAAO,EAAE,8BAA8B;iBACxC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,+BAA+B;aACzC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/server/routes/screenshot.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Screenshot endpoint — POST /v1/screenshot
+ *
+ * Takes a screenshot of a URL and returns base64-encoded image data.
+ * Uses the same rate limiting / credit system as the fetch endpoint (1 credit).
+ */
+import { Router } from 'express';
+import type { AuthStore } from '../auth-store.js';
+export declare function createScreenshotRouter(authStore: AuthStore): Router;
+//# sourceMappingURL=screenshot.d.ts.map

package/dist/server/routes/screenshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"screenshot.d.ts","sourceRoot":"","sources":["../../../src/server/routes/screenshot.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAqB,MAAM,SAAS,CAAC;AAEpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAIlD,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,SAAS,GAAG,MAAM,CAwPnE"}

package/dist/server/routes/screenshot.js

@@ -0,0 +1,217 @@
+/**
+ * Screenshot endpoint — POST /v1/screenshot
+ *
+ * Takes a screenshot of a URL and returns base64-encoded image data.
+ * Uses the same rate limiting / credit system as the fetch endpoint (1 credit).
+ */
+import { Router } from 'express';
+import { takeScreenshot } from '../../core/screenshot.js';
+import { validateUrlForSSRF, SSRFError } from '../middleware/url-validator.js';
+import { normalizeActions } from '../../core/actions.js';
+export function createScreenshotRouter(authStore) {
+    const router = Router();
+    router.post('/v1/screenshot', async (req, res) => {
+        try {
+            const { url, fullPage = false, width, height, format = 'png', quality, waitFor, timeout, actions, headers, cookies, stealth, } = req.body;
+            // --- Validate URL --------------------------------------------------
+            if (!url || typeof url !== 'string') {
+                res.status(400).json({
+                    error: 'invalid_request',
+                    message: 'Missing or invalid "url" parameter',
+                });
+                return;
+            }
+            if (url.length > 2048) {
+                res.status(400).json({
+                    error: 'invalid_url',
+                    message: 'URL too long (max 2048 characters)',
+                });
+                return;
+            }
+            try {
+                const parsed = new URL(url);
+                if (!['http:', 'https:'].includes(parsed.protocol)) {
+                    res.status(400).json({
+                        error: 'invalid_url',
+                        message: 'Only HTTP and HTTPS protocols are allowed',
+                    });
+                    return;
+                }
+            }
+            catch {
+                res.status(400).json({
+                    error: 'invalid_url',
+                    message: 'Invalid URL format',
+                });
+                return;
+            }
+            try {
+                validateUrlForSSRF(url);
+            }
+            catch (error) {
+                if (error instanceof SSRFError) {
+                    res.status(400).json({
+                        error: 'ssrf_blocked',
+                        message: 'Cannot fetch localhost, private networks, or non-HTTP URLs',
+                    });
+                    return;
+                }
+                throw error;
+            }
+            // --- Validate options -----------------------------------------------
+            if (format !== undefined && !['png', 'jpeg', 'jpg'].includes(format)) {
+                res.status(400).json({
+                    error: 'invalid_request',
+                    message: 'Invalid format: must be "png", "jpeg", or "jpg"',
+                });
+                return;
+            }
+            if (width !== undefined && (typeof width !== 'number' || width < 100 || width > 5000)) {
+                res.status(400).json({
+                    error: 'invalid_request',
+                    message: 'Invalid width: must be between 100 and 5000',
+                });
+                return;
+            }
+            if (height !== undefined && (typeof height !== 'number' || height < 100 || height > 5000)) {
+                res.status(400).json({
+                    error: 'invalid_request',
+                    message: 'Invalid height: must be between 100 and 5000',
+                });
+                return;
+            }
+            if (quality !== undefined && (typeof quality !== 'number' || quality < 1 || quality > 100)) {
+                res.status(400).json({
+                    error: 'invalid_request',
+                    message: 'Invalid quality: must be between 1 and 100',
+                });
+                return;
+            }
+            if (waitFor !== undefined && (typeof waitFor !== 'number' || waitFor < 0 || waitFor > 60000)) {
+                res.status(400).json({
+                    error: 'invalid_request',
+                    message: 'Invalid waitFor: must be between 0 and 60000ms',
+                });
+                return;
+            }
+            // Normalize user-provided actions (accepts Firecrawl-style too)
+            let normalizedActions;
+            if (actions !== undefined) {
+                try {
+                    normalizedActions = normalizeActions(actions);
+                }
+                catch (e) {
+                    res.status(400).json({
+                        error: 'invalid_request',
+                        message: `Invalid actions: ${e.message}`,
+                    });
+                    return;
+                }
+            }
+            // --- Take the screenshot -------------------------------------------
+            const startTime = Date.now();
+            const result = await takeScreenshot(url, {
+                fullPage: fullPage === true,
+                width,
+                height,
+                format,
+                quality,
+                waitFor,
+                timeout: timeout || 30000,
+                actions: normalizedActions,
+                headers,
+                cookies,
+                stealth: stealth === true,
+            });
+            const elapsed = Date.now() - startTime;
+            // --- Track usage ---------------------------------------------------
+            const isSoftLimited = req.auth?.softLimited === true;
+            const hasExtraUsage = req.auth?.extraUsageAvailable === true;
+            const pgStore = authStore;
+            if (req.auth?.keyInfo?.key && typeof pgStore.trackBurstUsage === 'function') {
+                await pgStore.trackBurstUsage(req.auth.keyInfo.key);
+                if (isSoftLimited && hasExtraUsage) {
+                    const extraResult = await pgStore.trackExtraUsage(req.auth.keyInfo.key, 'stealth', url, elapsed, 200);
+                    if (extraResult.success) {
+                        res.setHeader('X-Extra-Usage-Charged', `$${extraResult.cost.toFixed(4)}`);
+                        res.setHeader('X-Extra-Usage-New-Balance', extraResult.newBalance.toFixed(2));
+                    }
+                }
+                else if (!isSoftLimited) {
+                    await pgStore.trackUsage(req.auth.keyInfo.key, 'stealth');
+                }
+            }
+            // Log to usage_logs (fire and forget)
+            if (req.auth?.keyInfo?.accountId && typeof pgStore.pool !== 'undefined') {
+                pgStore.pool.query(`INSERT INTO usage_logs
+            (user_id, endpoint, url, method, processing_time_ms, status_code, ip_address, user_agent)
+          VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`, [
+                    req.auth.keyInfo.accountId,
+                    'screenshot',
+                    url,
+                    'stealth',
+                    elapsed,
+                    200,
+                    req.ip || req.socket.remoteAddress,
+                    req.get('user-agent'),
+                ]).catch((err) => {
+                    console.error('Failed to log screenshot request:', err);
+                });
+            }
+            // --- Respond -------------------------------------------------------
+            res.setHeader('X-Credits-Used', '1');
+            res.setHeader('X-Processing-Time', elapsed.toString());
+            res.setHeader('X-Fetch-Type', 'screenshot');
+            res.json({
+                success: true,
+                data: {
+                    url: result.url,
+                    screenshot: `data:${result.contentType};base64,${result.screenshot}`,
+                    metadata: {
+                        sourceURL: result.url,
+                        format: result.format,
+                        width: width || 1280,
+                        height: height || 720,
+                        fullPage: fullPage === true,
+                    },
+                },
+            });
+        }
+        catch (error) {
+            console.error('Screenshot error:', error);
+            // Log error (fire and forget)
+            const pgStore = authStore;
+            if (req.auth?.keyInfo?.accountId && typeof pgStore.pool !== 'undefined') {
+                pgStore.pool.query(`INSERT INTO usage_logs
+            (user_id, endpoint, url, method, status_code, error, ip_address, user_agent)
+          VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`, [
+                    req.auth.keyInfo.accountId,
+                    'screenshot',
+                    req.body?.url,
+                    'stealth',
+                    500,
+                    error.message || 'Unknown error',
+                    req.ip || req.socket.remoteAddress,
+                    req.get('user-agent'),
+                ]).catch((logErr) => {
+                    console.error('Failed to log screenshot error:', logErr);
+                });
+            }
+            if (error.code) {
+                const safeMessage = error.message.replace(/[<>"']/g, '');
+                res.status(500).json({
+                    error: 'screenshot_error',
+                    message: safeMessage,
+                });
+            }
+            else {
+                res.status(500).json({
+                    error: 'internal_error',
+                    message: 'An unexpected error occurred while taking the screenshot',
+                });
+            }
+        }
+    });
+    return router;
+}
+//# sourceMappingURL=screenshot.js.map

package/dist/server/routes/screenshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"screenshot.js","sourceRoot":"","sources":["../../../src/server/routes/screenshot.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAqB,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,MAAM,UAAU,sBAAsB,CAAC,SAAoB;IACzD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAClE,IAAI,CAAC;YACH,MAAM,EACJ,GAAG,EACH,QAAQ,GAAG,KAAK,EAChB,KAAK,EACL,MAAM,EACN,MAAM,GAAG,KAAK,EACd,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,GACR,GAAG,GAAG,CAAC,IAAI,CAAC;YAEb,sEAAsE;YACtE,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,iBAAiB;oBACxB,OAAO,EAAE,oCAAoC;iBAC9C,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;gBACtB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,aAAa;oBACpB,OAAO,EAAE,oCAAoC;iBAC9C,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC5B,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,KAAK,EAAE,aAAa;wBACpB,OAAO,EAAE,2CAA2C;qBACrD,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,aAAa;oBACpB,OAAO,EAAE,oBAAoB;iBAC9B,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,kBAAkB,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;oBAC/B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,KAAK,EAAE,cAAc;wBACrB,OAAO,EAAE,4DAA4D;qBACtE,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YAED,uEAAuE;YACvE,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,iBAAiB;oBACxB,OAAO,EAAE,iDAAiD;iBAC3D,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,GAAG,GAAG,IAAI,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC;gBACtF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,iBAAiB;oBACxB,OAAO,EAAE,6CAA6C;iBACvD,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;gBAC1F,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,iBAAiB;oBACxB,OAAO,EAAE,8CAA8C;iBACxD,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,GAAG,CAAC,EAAE,CAAC;gBAC3F,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,iBAAiB;oBACxB,OAAO,EAAE,4CAA4C;iBACtD,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC;gBAC7F,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,iBAAiB;oBACxB,OAAO,EAAE,gDAAgD;iBAC1D,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,gEAAgE;YAChE,IAAI,iBAAiB,CAAC;YACtB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACH,iBAAiB,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBAChD,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,KAAK,EAAE,iBAAiB;wBACxB,OAAO,EAAE,oBAAqB,CAAW,CAAC,OAAO,EAAE;qBACpD,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;YACH,CAAC;YAED,sEAAsE;YACtE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAE7B,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE;gBACvC,QAAQ,EAAE,QAAQ,KAAK,IAAI;gBAC3B,KAAK;gBACL,MAAM;gBACN,MAAM;gBACN,OAAO;gBACP,OAAO;gBACP,OAAO,EAAE,OAAO,IAAI,KAAK;gBACzB,OAAO,EAAE,iBAAiB;gBAC1B,OAAO;gBACP,OAAO;gBACP,OAAO,EAAE,OAAO,KAAK,IAAI;aAC1B,CAAC,CAAC;YAEH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAEvC,sEAAsE;YACtE,MAAM,aAAa,GAAG,GAAG,CAAC,IAAI,EAAE,WAAW,KAAK,IAAI,CAAC;YACrD,MAAM,aAAa,GAAG,GAAG,CAAC,IAAI,EAAE,mBAAmB,KAAK,IAAI,CAAC;YAE7D,MAAM,OAAO,GAAG,SAAgB,CAAC;YACjC,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;gBAC5E,MAAM,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAEpD,IAAI,aAAa,IAAI,aAAa,EAAE,CAAC;oBACnC,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,eAAe,CAC/C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EACpB,SAAS,EACT,GAAG,EACH,OAAO,EACP,GAAG,CACJ,CAAC;oBAEF,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;wBACxB,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;wBAC1E,GAAG,CAAC,SAAS,CAAC,2BAA2B,EAAE,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;oBAChF,CAAC;gBACH,CAAC;qBAAM,IAAI,CAAC,aAAa,EAAE,CAAC;oBAC1B,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBAC5D,CAAC;YACH,CAAC;YAED,sCAAsC;YACtC,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBACxE,OAAO,CAAC,IAAI,CAAC,KAAK,CAChB;;kDAEwC,EACxC;oBACE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS;oBAC1B,YAAY;oBACZ,GAAG;oBACH,SAAS;oBACT,OAAO;oBACP,GAAG;oBACH,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa;oBAClC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC;iBACtB,CACF,CAAC,KAAK,CAAC,CAAC,GAAQ,EAAE,EAAE;oBACnB,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;gBAC1D,CAAC,CAAC,CAAC;YACL,CAAC;YAED,sEAAsE;YACtE,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;YACrC,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;YACvD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;YAE5C,GAAG,CAAC,IAAI,CAAC;gBACP,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE;oBACJ,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,UAAU,EAAE,QAAQ,MAAM,CAAC,WAAW,WAAW,MAAM,CAAC,UAAU,EAAE;oBACpE,QAAQ,EAAE;wBACR,SAAS,EAAE,MAAM,CAAC,GAAG;wBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;wBACrB,KAAK,EAAE,KAAK,IAAI,IAAI;wBACpB,MAAM,EAAE,MAAM,IAAI,GAAG;wBACrB,QAAQ,EAAE,QAAQ,KAAK,IAAI;qBAC5B;iBACF;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;YAE1C,8BAA8B;YAC9B,MAAM,OAAO,GAAG,SAAgB,CAAC;YACjC,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBACxE,OAAO,CAAC,IAAI,CAAC,KAAK,CAChB;;kDAEwC,EACxC;oBACE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS;oBAC1B,YAAY;oBACZ,GAAG,CAAC,IAAI,EAAE,GAAG;oBACb,SAAS;oBACT,GAAG;oBACH,KAAK,CAAC,OAAO,IAAI,eAAe;oBAChC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa;oBAClC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC;iBACtB,CACF,CAAC,KAAK,CAAC,CAAC,MAAW,EAAE,EAAE;oBACtB,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,MAAM,CAAC,CAAC;gBAC3D,CAAC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBACf,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,kBAAkB;oBACzB,OAAO,EAAE,WAAW;iBACrB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,gBAAgB;oBACvB,OAAO,EAAE,0DAA0D;iBACpE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/server/routes/search.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Search endpoint with caching — supports DuckDuckGo (default) and Brave (BYOK)
+ */
+import { Router } from 'express';
+import { AuthStore } from '../auth-store.js';
+export declare function createSearchRouter(authStore: AuthStore): Router;
+//# sourceMappingURL=search.d.ts.map

package/dist/server/routes/search.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../../src/server/routes/search.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,MAAM,EAAqB,MAAM,SAAS,CAAC;AAIpD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAuC7C,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,SAAS,GAAG,MAAM,CAgU/D"}