Seal Node/Next SDK 1.0.6

Recovered from published @desicon/[email protected]; see SOURCE-PROVENANCE.md. Not published. The advertised GitHub repository is currently unavailable.

const { seal } = require('@desicon/seal');
seal.init({apiKey: process.env.SEAL_API_KEY, signingSecret: process.env.SEAL_SIGNING_SECRET,
           appName:'My API', environment:'production'});
// Express: app.use(seal.httpMiddleware());

Retains the published seal, SealClient, sealExpressMiddleware and /next exports. Every heartbeat is freshly signed, HTTP acknowledgement is checked, and delivery exposes seal.deliveryHealth.heartbeatOK. Startup, heartbeat and deployment routes preserve custom endpoint prefixes. A browser policy's enforce mode does not implicitly change application WAF actions.

Threat reports omit credentials, cookies and raw URLs. Ordinary curl/wget/Python clients are allowed. Forwarded identity/country headers require explicit trustProxyHeaders behind a sanitizing proxy. The Next adapter accepts (request, event) and uses event.waitUntil for delivery, with a bounded awaited fallback where unavailable. It supports SEAL_SIGNING_SECRET and server-only SEAL_API_KEY.

These SDKs report application events; they do not execute rescue patches. Error reports still contain exception and source context. Run npm test. Integrate these changes into the actual source repository before publishing.

Explicit application enforcement

Set waf.honeypot.action, waf.sqli.action and waf.xss.action to drop to reject matching requests with HTTP 403. Each rejected request is reported with context.action: blocked. report records an observation and allows the request. These three rules default to report for compatibility; enable them deliberately for each application. Honeypot paths include WordPress login/admin paths, so do not enable that rule on a site that legitimately serves those paths. Next inspects URLs; Express also inspects already-parsed small request bodies. These are heuristic checks, not a complete attack-prevention guarantee.

waf: {
  maliciousScanners: { action: 'drop' },
  pathTraversal: { action: 'drop' },
  honeypot: { action: 'drop' },
  sqli: { action: 'drop' },
  xss: { action: 'drop' }
}

Applications must upgrade and redeploy to use these rules. Historical observations cannot be reclassified as blocks without recorded enforcement evidence.