@beignet/core 0.0.23 → 0.0.24

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @beignet/core
 
+## 0.0.24
+
+### Patch Changes
+
+- 9d518c0: Generate server-only boundary markers as side-effect imports so app linting can
+  keep a consistent unused-import rule.
+- 91bc9b5: Harden framework security defaults for generated tenancy, auth secrets, CORS,
+  body limits, uploads, devtools, OpenAPI, rate-limit IP sources, public storage,
+  and Meilisearch query fields.
+
 ## 0.0.23
 
 ### Patch Changes

package/README.md

@@ -79,6 +79,14 @@ name the framework area they depend on.
 | `@beignet/core/uploads/client` | Browser upload client for server and direct uploads |
 | `@beignet/core/webhooks` | Inbound webhook definitions, verifiers, memory test verifier, and HMAC verifier |
 
+Use boundary markers as side-effect imports so local linting and formatting do
+not treat them as unused symbols:
+
+```typescript
+import "@beignet/core/client-only";
+import "@beignet/core/server-only";
+```
+
 ## Durable failure language
 
 Jobs, outbox delivery, and schedule runners use the same terms:
@@ -339,6 +347,9 @@ const results = await ctx.ports.search.search(issueSearchIndex, {
 Use `createMemorySearch(...)` in tests, `createMemorySearchProvider()` for local
 provider wiring, or install `@beignet/provider-search-meilisearch` for
 production search.
+Provider adapters may require query fields to be declared in the index
+metadata. For Meilisearch, `filters` and `facets` must use
+`filterableAttributes`, and `sort` must use `sortableAttributes`.
 
 ## Webhooks
 
@@ -1023,10 +1034,10 @@ const server = await createServer<AppContext, AppPorts>({
 
 - `global` and `ip` scopes run in `onRequest` before parsing and context
   creation; `user` scope runs in `beforeHandle` once `ctx.actor` exists.
-- `ip` buckets default to the last `x-forwarded-for` entry, the address
-  appended by the platform's trusted proxy. Use the `ipSource` option to
-  switch to `"x-forwarded-for-first"` behind a header-normalizing edge, or
-  pass a function for platform headers such as `cf-connecting-ip`.
+- `ip` buckets default to `ip:unknown`; Beignet does not trust forwarding
+  headers unless you set `ipSource`. Use `"x-forwarded-for-last"` only behind a
+  trusted proxy that appends the socket address, or pass a function for
+  platform headers such as `cf-connecting-ip`.
 - Denials throw the framework `429 Too Many Requests` catalog error with
   `scope`, `retryAfterSeconds`, and `resetAt` details. The bucket key is
   never included in the client-visible response.
@@ -1255,6 +1266,23 @@ const writerAuth = createAuthHooks<AppContext>()({
 });
 ```
 
+Use `createCorsHooks(...)` for app-wide CORS headers. Wildcard origins are
+accepted only for non-credentialed requests:
+
+```ts
+import { createCorsHooks } from "@beignet/core/server";
+
+const publicCors = createCorsHooks({ origins: "*" });
+const browserAppCors = createCorsHooks({
+  origins: ["https://app.example.com"],
+  credentials: true,
+});
+```
+
+`createCorsHooks({ origins: "*", credentials: true })` throws during setup so
+apps do not accidentally reflect arbitrary request origins for cookies or
+authorization headers.
+
 ### HTTP adapter boundary
 
 `@beignet/core/server` is framework-neutral. It owns route matching, hooks,

package/dist/server/hooks/cors.d.ts

@@ -7,7 +7,8 @@ import type { HttpRequestLike, ServerHook } from "../types.js";
  */
 export interface CorsConfig {
     /**
-     * Allowed origins. Use `"*"` to allow any origin.
+     * Allowed origins. Use `"*"` only for non-credentialed requests.
+     * Credentialed CORS requires an explicit origin allow-list.
      */
     origins?: string[] | "*";
     /**
@@ -26,8 +27,8 @@ export interface CorsConfig {
 /**
  * Apply CORS response headers to a mutable header record.
  *
- * When credentials are enabled with wildcard origins, the request origin is
- * reflected and `Vary: Origin` is appended.
+ * Credentialed CORS rejects wildcard origins. Use an explicit origin allow-list
+ * when cookies or authorization headers are allowed cross-origin.
  */
 export declare function applyCorsHeaders(headers: Record<string, string>, req: HttpRequestLike, corsConfig: CorsConfig): void;
 /**

package/dist/server/hooks/cors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../../src/server/hooks/cors.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE/D;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IACzB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;OAEG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAmBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,GAAG,EAAE,eAAe,EACpB,UAAU,EAAE,UAAU,GACrB,IAAI,CA4BN;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,CAsBxE"}
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../../src/server/hooks/cors.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE/D;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IACzB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;OAEG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAwCD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,GAAG,EAAE,eAAe,EACpB,UAAU,EAAE,UAAU,GACrB,IAAI,CAwBN;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,CAwBxE"}

package/dist/server/hooks/cors.js

@@ -7,6 +7,20 @@ const DEFAULT_CORS = {
     headers: ["Content-Type", "Authorization"],
     credentials: false,
 };
+function resolveCorsConfig(config) {
+    const resolved = {
+        origins: config.origins ?? DEFAULT_CORS.origins,
+        methods: config.methods ?? DEFAULT_CORS.methods,
+        headers: config.headers ?? DEFAULT_CORS.headers,
+        credentials: config.credentials ?? DEFAULT_CORS.credentials,
+    };
+    if (resolved.credentials &&
+        (resolved.origins === "*" ||
+            (Array.isArray(resolved.origins) && resolved.origins.includes("*")))) {
+        throw new Error('Credentialed CORS cannot use a wildcard origin. Use origins: ["https://app.example.com"] with credentials: true.');
+    }
+    return resolved;
+}
 function appendVaryOrigin(headers) {
     const varyKey = Object.keys(headers).find((key) => key.toLowerCase() === "vary") ?? "Vary";
     const current = headers[varyKey];
@@ -18,22 +32,12 @@ function appendVaryOrigin(headers) {
 /**
  * Apply CORS response headers to a mutable header record.
  *
- * When credentials are enabled with wildcard origins, the request origin is
- * reflected and `Vary: Origin` is appended.
+ * Credentialed CORS rejects wildcard origins. Use an explicit origin allow-list
+ * when cookies or authorization headers are allowed cross-origin.
  */
 export function applyCorsHeaders(headers, req, corsConfig) {
-    const origins = corsConfig.origins ?? DEFAULT_CORS.origins;
-    const methods = corsConfig.methods ?? DEFAULT_CORS.methods;
-    const allowedHeaders = corsConfig.headers ?? DEFAULT_CORS.headers;
-    const credentials = corsConfig.credentials ?? DEFAULT_CORS.credentials;
-    if (credentials && origins === "*") {
-        const requestOrigin = req.headers.get("Origin");
-        if (requestOrigin) {
-            headers["Access-Control-Allow-Origin"] = requestOrigin;
-            appendVaryOrigin(headers);
-        }
-    }
-    else if (origins === "*") {
+    const { origins, methods, headers: allowedHeaders, credentials, } = resolveCorsConfig(corsConfig);
+    if (origins === "*") {
         headers["Access-Control-Allow-Origin"] = "*";
     }
     else if (Array.isArray(origins)) {
@@ -56,13 +60,14 @@ export function applyCorsHeaders(headers, req, corsConfig) {
  * decorated in `beforeSend`.
  */
 export function createCorsHooks(config) {
+    const corsConfig = resolveCorsConfig(config);
     return {
         name: "cors",
         onRequest: ({ req }) => {
             if (req.method !== "OPTIONS")
                 return undefined;
             const headers = {};
-            applyCorsHeaders(headers, req, config);
+            applyCorsHeaders(headers, req, corsConfig);
             return {
                 status: 204,
                 headers,
@@ -71,7 +76,7 @@ export function createCorsHooks(config) {
         },
         beforeSend: ({ req, response }) => {
             const headers = { ...(response.headers ?? {}) };
-            applyCorsHeaders(headers, req, config);
+            applyCorsHeaders(headers, req, corsConfig);
             return {
                 ...response,
                 headers,

package/dist/server/hooks/cors.js.map

@@ -1 +1 @@
-{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../../src/server/hooks/cors.ts"],"names":[],"mappings":"AAAA;;GAEG;AA0BH,MAAM,YAAY,GAAyB;IACzC,OAAO,EAAE,GAAG;IACZ,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC;IAC7D,OAAO,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;IAC1C,WAAW,EAAE,KAAK;CACnB,CAAC;AAEF,SAAS,gBAAgB,CAAC,OAA+B;IACvD,MAAM,OAAO,GACX,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC;IAC7E,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9E,IAAI,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO;IAEvC,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAA+B,EAC/B,GAAoB,EACpB,UAAsB;IAEtB,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,IAAI,YAAY,CAAC,OAAO,CAAC;IAC3D,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,IAAI,YAAY,CAAC,OAAO,CAAC;IAC3D,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,IAAI,YAAY,CAAC,OAAO,CAAC;IAClE,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,IAAI,YAAY,CAAC,WAAW,CAAC;IAEvE,IAAI,WAAW,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,CAAC,6BAA6B,CAAC,GAAG,aAAa,CAAC;YACvD,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;QAC3B,OAAO,CAAC,6BAA6B,CAAC,GAAG,GAAG,CAAC;IAC/C,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,aAAa,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACrD,OAAO,CAAC,6BAA6B,CAAC,GAAG,aAAa,CAAC;YACvD,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,CAAC,8BAA8B,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7D,OAAO,CAAC,8BAA8B,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEpE,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,kCAAkC,CAAC,GAAG,MAAM,CAAC;IACvD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAM,MAAkB;IACrD,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;YACrB,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC/C,MAAM,OAAO,GAA2B,EAAE,CAAC;YAC3C,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YACvC,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,OAAO;gBACP,IAAI,EAAE,IAAI;aACX,CAAC;QACJ,CAAC;QACD,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE;YAChC,MAAM,OAAO,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;YAChD,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YACvC,OAAO;gBACL,GAAG,QAAQ;gBACX,OAAO;aACR,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../../src/server/hooks/cors.ts"],"names":[],"mappings":"AAAA;;GAEG;AA2BH,MAAM,YAAY,GAAyB;IACzC,OAAO,EAAE,GAAG;IACZ,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC;IAC7D,OAAO,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;IAC1C,WAAW,EAAE,KAAK;CACnB,CAAC;AAEF,SAAS,iBAAiB,CAAC,MAAkB;IAC3C,MAAM,QAAQ,GAAG;QACf,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,YAAY,CAAC,OAAO;QAC/C,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,YAAY,CAAC,OAAO;QAC/C,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,YAAY,CAAC,OAAO;QAC/C,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,YAAY,CAAC,WAAW;KAC5D,CAAC;IAEF,IACE,QAAQ,CAAC,WAAW;QACpB,CAAC,QAAQ,CAAC,OAAO,KAAK,GAAG;YACvB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EACtE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,kHAAkH,CACnH,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAA+B;IACvD,MAAM,OAAO,GACX,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC;IAC7E,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9E,IAAI,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO;IAEvC,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAA+B,EAC/B,GAAoB,EACpB,UAAsB;IAEtB,MAAM,EACJ,OAAO,EACP,OAAO,EACP,OAAO,EAAE,cAAc,EACvB,WAAW,GACZ,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAElC,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;QACpB,OAAO,CAAC,6BAA6B,CAAC,GAAG,GAAG,CAAC;IAC/C,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,aAAa,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACrD,OAAO,CAAC,6BAA6B,CAAC,GAAG,aAAa,CAAC;YACvD,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,CAAC,8BAA8B,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7D,OAAO,CAAC,8BAA8B,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEpE,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,kCAAkC,CAAC,GAAG,MAAM,CAAC;IACvD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAM,MAAkB;IACrD,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAE7C,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;YACrB,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC/C,MAAM,OAAO,GAA2B,EAAE,CAAC;YAC3C,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YAC3C,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,OAAO;gBACP,IAAI,EAAE,IAAI;aACX,CAAC;QACJ,CAAC;QACD,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE;YAChC,MAAM,OAAO,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;YAChD,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YAC3C,OAAO;gBACL,GAAG,QAAQ;gBACX,OAAO;aACR,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/hooks/rate-limit.d.ts

@@ -21,16 +21,17 @@ type EarlyRateLimitScope = Exclude<RateLimitScope, "user">;
 /**
  * Strategy for resolving the client IP used by `ip`-scoped limits.
  *
- * - `"x-forwarded-for-last"` (default): the last `x-forwarded-for` entry.
- *   This is the address appended by the platform's trusted reverse proxy and
- *   cannot be chosen by the client.
+ * - `"none"` (default): do not trust request headers for IP resolution.
+ * - `"x-forwarded-for-last"`: the last `x-forwarded-for` entry. Use this only
+ *   when the app is always behind a trusted reverse proxy that appends the
+ *   socket address.
  * - `"x-forwarded-for-first"`: the first `x-forwarded-for` entry. This value
  *   is client-controlled, so only use it when a trusted edge normalizes the
  *   header before it reaches the app.
  * - A function receives the raw request and returns the client IP, for
  *   platform-specific headers such as `cf-connecting-ip`.
  */
-export type RateLimitIpSource = "x-forwarded-for-last" | "x-forwarded-for-first" | ((req: HttpRequestLike) => string | undefined);
+export type RateLimitIpSource = "none" | "x-forwarded-for-last" | "x-forwarded-for-first" | ((req: HttpRequestLike) => string | undefined);
 /**
  * Options for `createRateLimitHooks(...)`.
  */
@@ -57,8 +58,8 @@ export interface RateLimitOptions<Ctx> {
     /**
      * Resolve the client IP for `ip`-scoped limits.
      *
-     * Defaults to `"x-forwarded-for-last"`, the entry appended by the
-     * platform's trusted proxy. Pass a function for platform-specific headers.
+     * Defaults to `"none"`. Pass an explicit trusted proxy strategy or a
+     * function for platform-specific headers.
      */
     ipSource?: RateLimitIpSource;
 }

package/dist/server/hooks/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/server/hooks/rate-limit.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAKzE,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE/D;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,SAAS,EAAE,aAAa,CAAC;CAC1B,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,cAAc,CAAC;IACtB,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB,CAAC;AAEF,KAAK,mBAAmB,GAAG,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;AAE3D;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,iBAAiB,GACzB,sBAAsB,GACtB,uBAAuB,GACvB,CAAC,CAAC,GAAG,EAAE,eAAe,KAAK,MAAM,GAAG,SAAS,CAAC,CAAC;AAEnD;;GAEG;AACH,MAAM,WAAW,gBAAgB,CAAC,GAAG;IACnC;;;;OAIG;IACH,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE;QACX,GAAG,EAAE,GAAG,CAAC;QACT,GAAG,EAAE,eAAe,CAAC;QACrB,KAAK,EAAE,cAAc,CAAC;KACvB,KAAK,MAAM,CAAC;IACb;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE;QAChB,GAAG,EAAE,eAAe,CAAC;QACrB,KAAK,EAAE,mBAAmB,CAAC;KAC5B,KAAK,MAAM,CAAC;IACb;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,iBAAiB,CAAC;CAC9B;AA4HD;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,SAAS,gBAAgB,EAC/D,OAAO,GAAE,gBAAgB,CAAC,GAAG,CAAM,GAClC,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAuDjC"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/server/hooks/rate-limit.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAKzE,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE/D;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,SAAS,EAAE,aAAa,CAAC;CAC1B,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,cAAc,CAAC;IACtB,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB,CAAC;AAEF,KAAK,mBAAmB,GAAG,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;AAE3D;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,iBAAiB,GACzB,MAAM,GACN,sBAAsB,GACtB,uBAAuB,GACvB,CAAC,CAAC,GAAG,EAAE,eAAe,KAAK,MAAM,GAAG,SAAS,CAAC,CAAC;AAEnD;;GAEG;AACH,MAAM,WAAW,gBAAgB,CAAC,GAAG;IACnC;;;;OAIG;IACH,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE;QACX,GAAG,EAAE,GAAG,CAAC;QACT,GAAG,EAAE,eAAe,CAAC;QACrB,KAAK,EAAE,cAAc,CAAC;KACvB,KAAK,MAAM,CAAC;IACb;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE;QAChB,GAAG,EAAE,eAAe,CAAC;QACrB,KAAK,EAAE,mBAAmB,CAAC;KAC5B,KAAK,MAAM,CAAC;IACb;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,iBAAiB,CAAC;CAC9B;AAgID;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,SAAS,gBAAgB,EAC/D,OAAO,GAAE,gBAAgB,CAAC,GAAG,CAAM,GAClC,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAuDjC"}

package/dist/server/hooks/rate-limit.js

@@ -14,6 +14,9 @@ function resolveClientIp(req, ipSource) {
     if (typeof ipSource === "function") {
         return ipSource(req) || undefined;
     }
+    if (ipSource === "none") {
+        return undefined;
+    }
     const entries = parseForwardedFor(req);
     if (entries.length === 0) {
         return undefined;
@@ -92,7 +95,7 @@ async function enforceRateLimit(ports, args) {
  * @returns A server hook backed by `ctx.ports.rateLimit`.
  */
 export function createRateLimitHooks(options = {}) {
-    const ipSource = options.ipSource ?? "x-forwarded-for-last";
+    const ipSource = options.ipSource ?? "none";
     const getClientIp = (req) => resolveClientIp(req, ipSource);
     return {
         name: "rate-limit",

package/dist/server/hooks/rate-limit.js.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../../src/server/hooks/rate-limit.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,EACL,6BAA6B,GAE9B,MAAM,0BAA0B,CAAC;AAqElC,SAAS,iBAAiB,CAAC,GAAoB;IAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;IACxD,OAAO,MAAM;SACV,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,eAAe,CACtB,GAAoB,EACpB,QAA2B;IAE3B,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;IACpC,CAAC;IAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,QAAQ,KAAK,uBAAuB;QACzC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACZ,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,QAAQ,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,SAAS,CAAC,EAAU;IAC3B,OAAO,MAAM,EAAE,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,mBAAmB,CAC1B,IAIC,EACD,WAAyD;IAEzD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAEjC,IAAI,KAAK,KAAK,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACnE,OAAO,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;QACzC,OAAO,SAAS,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAGC,EACD,WAAyD;IAEzD,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;QAC9C,OAAO,SAAS,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,KAAqB,EACrB,IAKC;IAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC;QACvC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO;IACT,CAAC;IAED,4EAA4E;IAC5E,8DAA8D;IAC9D,MAAM,eAAe,GAAG,6BAA6B,CACnD,KAAsC,EACtC;QACE,YAAY,EAAE,YAAY;QAC1B,OAAO,EAAE,WAAW;KACrB,CACF,CAAC;IACF,eAAe,CAAC,MAAM,CAAC;QACrB,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,mBAAmB;QAC1B,OAAO,EAAE,yBAAyB,IAAI,CAAC,GAAG,EAAE;QAC5C,OAAO,EAAE;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B;KACF,CAAC,CAAC;IAEH,MAAM,IAAI,QAAQ,CAChB,UAAU,CAAC,eAAe,EAC1B;QACE,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,IAAI;KAC/C,EACD,qBAAqB,CACtB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAiC,EAAE;IAEnC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,sBAAsB,CAAC;IAC5D,MAAM,WAAW,GAAG,CAAC,GAAoB,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAE7E,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,SAAS,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE;YAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;YAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,KAAK,GAAmB,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC;YACvD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBACrB,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,GAAG,GACP,OAAO,CAAC,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;gBAClC,wBAAwB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,WAAW,CAAC,CAAC;YAExD,MAAM,gBAAgB,CAAC,KAAK,EAAE;gBAC5B,GAAG;gBACH,KAAK,EAAE,MAAM,CAAC,GAAG;gBACjB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,KAAK;aACN,CAAC,CAAC;YAEH,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,YAAY,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE;YAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;YAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,KAAK,GAAmB,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC;YACvD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBACrB,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,GAAG,GACP,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;gBAClC,mBAAmB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,WAAW,CAAC,CAAC;YAExD,MAAM,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE;gBAChC,GAAG;gBACH,KAAK,EAAE,MAAM,CAAC,GAAG;gBACjB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,KAAK;aACN,CAAC,CAAC;YAEH,OAAO,SAAS,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../../src/server/hooks/rate-limit.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,EACL,6BAA6B,GAE9B,MAAM,0BAA0B,CAAC;AAuElC,SAAS,iBAAiB,CAAC,GAAoB;IAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;IACxD,OAAO,MAAM;SACV,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,eAAe,CACtB,GAAoB,EACpB,QAA2B;IAE3B,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;IACpC,CAAC;IAED,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,QAAQ,KAAK,uBAAuB;QACzC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACZ,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,QAAQ,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,SAAS,CAAC,EAAU;IAC3B,OAAO,MAAM,EAAE,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,mBAAmB,CAC1B,IAIC,EACD,WAAyD;IAEzD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAEjC,IAAI,KAAK,KAAK,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACnE,OAAO,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;QACzC,OAAO,SAAS,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAGC,EACD,WAAyD;IAEzD,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;QAC9C,OAAO,SAAS,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,KAAqB,EACrB,IAKC;IAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC;QACvC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO;IACT,CAAC;IAED,4EAA4E;IAC5E,8DAA8D;IAC9D,MAAM,eAAe,GAAG,6BAA6B,CACnD,KAAsC,EACtC;QACE,YAAY,EAAE,YAAY;QAC1B,OAAO,EAAE,WAAW;KACrB,CACF,CAAC;IACF,eAAe,CAAC,MAAM,CAAC;QACrB,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,mBAAmB;QAC1B,OAAO,EAAE,yBAAyB,IAAI,CAAC,GAAG,EAAE;QAC5C,OAAO,EAAE;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B;KACF,CAAC,CAAC;IAEH,MAAM,IAAI,QAAQ,CAChB,UAAU,CAAC,eAAe,EAC1B;QACE,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,IAAI;KAC/C,EACD,qBAAqB,CACtB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAiC,EAAE;IAEnC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC;IAC5C,MAAM,WAAW,GAAG,CAAC,GAAoB,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAE7E,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,SAAS,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE;YAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;YAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,KAAK,GAAmB,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC;YACvD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBACrB,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,GAAG,GACP,OAAO,CAAC,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;gBAClC,wBAAwB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,WAAW,CAAC,CAAC;YAExD,MAAM,gBAAgB,CAAC,KAAK,EAAE;gBAC5B,GAAG;gBACH,KAAK,EAAE,MAAM,CAAC,GAAG;gBACjB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,KAAK;aACN,CAAC,CAAC;YAEH,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,YAAY,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE;YAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;YAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,KAAK,GAAmB,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC;YACvD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBACrB,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,GAAG,GACP,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;gBAClC,mBAAmB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,WAAW,CAAC,CAAC;YAExD,MAAM,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE;gBAChC,GAAG;gBACH,KAAK,EAAE,MAAM,CAAC,GAAG;gBACjB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,KAAK;aACN,CAAC,CAAC;YAEH,OAAO,SAAS,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/server.d.ts

@@ -106,6 +106,17 @@ export declare function defineRoute<Ctx>(): {
  * ServiceInput>()` form stay assignable to server provider lists.
  */
 type AnyServiceProvider = ServiceProvider<unknown, StandardSchemaV1<any, any>, AnyPorts, any, any>;
+/**
+ * Request body limits enforced before contract body validation.
+ */
+export interface RequestBodyOptions {
+    /**
+     * Maximum request body size in bytes for JSON/text route bodies.
+     *
+     * @default 1048576
+     */
+    maxBytes?: number;
+}
 /**
  * Options for creating a Beignet server instance.
  */
@@ -168,6 +179,10 @@ export type CreateServerOptions<Ctx, Ports extends AnyPorts, ServiceInput = void
      * @default true
      */
     validateResponses?: boolean;
+    /**
+     * Request body parsing limits for JSON/text contract routes.
+     */
+    requestBody?: RequestBodyOptions;
     /**
      * Route list to register up front.
      */

package/dist/server/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/server/server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAIL,KAAK,kBAAkB,EAIxB,MAAM,uBAAuB,CAAC;AAiB/B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAQlD,OAAO,KAAK,EACV,kBAAkB,EAElB,eAAe,EAChB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAEV,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGxE,OAAO,KAAK,EACV,iBAAiB,EACjB,OAAO,EAEP,eAAe,EACf,YAAY,EAGZ,SAAS,EACT,qBAAqB,EACrB,UAAU,EACV,0BAA0B,EAC3B,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAC;AAczE,OAAO,KAAK,EACV,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACrB,MAAM,qBAAqB,CAAC;AAM7B;;;;;GAKG;AACH,MAAM,MAAM,eAAe,CACzB,GAAG,EACH,KAAK,SAAS,YAAY,GAAG,YAAY,EACzC,KAAK,SAAS,SAAS,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,SAAS,SAAS,CAClE,GAAG,EACH,MAAM,CACP,EAAE,IACD;IACF;;OAEG;IACH,QAAQ,EAAE,KAAK,CAAC;IAChB;;OAEG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC;IACd;;OAEG;IACH,MAAM,EAAE,OAAO,CAAC,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,OAAO,CAAC,EAAE,KAAK,CAAC;IAChB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,MAAM,CAAC,EAAE,KAAK,CAAC;CAChB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,QAAQ,CAClB,GAAG,EACH,KAAK,SAAS,YAAY,GAAG,YAAY,EACzC,KAAK,SAAS,SAAS,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,SAAS,SAAS,CAClE,GAAG,EACH,MAAM,CACP,EAAE,IACD,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAG/E,KAAK,WAAW,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAGtC,KAAK,aAAa,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;AAG1D,KAAK,mBAAmB,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAEnD,QAAA,MAAM,gBAAgB,wBAAwB,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,CACpB,GAAG,EACH,MAAM,SAAS,SAAS,WAAW,EAAE,GAAG,SAAS,WAAW,EAAE,IAC5D;IACF;;OAEG;IACH,IAAI,EAAE,OAAO,gBAAgB,CAAC;IAC9B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,KAAK,CAAC,EAAE,SAAS,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;IAC1C;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,KAAK,UAAU,CAAC,GAAG,IACf,mBAAmB,CAAC,GAAG,CAAC,GACxB,WAAW,GACX,UAAU,CAAC,GAAG,EAAE,SAAS,WAAW,EAAE,CAAC,CAAC;AAE5C,KAAK,oBAAoB,CAAC,GAAG,IACzB,aAAa,CAAC,GAAG,CAAC,GAClB,UAAU,CAAC,GAAG,EAAE,SAAS,WAAW,EAAE,CAAC,CAAC;AAE5C,KAAK,iBAAiB,CAAC,GAAG,IAAI;IAC5B,CACE,KAAK,CAAC,UAAU,SAAS,SAAS,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,SAAS,EAAE,EACxE,KAAK,CAAC,CAAC,SAAS,SAAS,aAAa,CACpC,GAAG,GAAG,iBAAiB,CAAC,UAAU,CAAC,CACpC,EAAE,GAAG,SAAS,aAAa,CAAC,GAAG,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC,EAAE,EACnE,KAAK,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,UAAU,CAAC;QACnB,MAAM,EAAE,CAAC,GAAG,oBAAoB,CAAC,GAAG,GAAG,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;KAC1E,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACvB,CACE,KAAK,CAAC,UAAU,SAAS,SAAS,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,SAAS,EAAE,EACxE,KAAK,CAAC,CAAC,SAAS,SAAS,WAAW,EAAE,GAAG,SAAS,WAAW,EAAE,EAC/D,KAAK,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,UAAU,CAAC;QACnB,MAAM,EAAE,CAAC,GAAG,oBAAoB,CAAC,GAAG,GAAG,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;KAC1E,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;CACxB,CAAC;AAEF,KAAK,eAAe,CAAC,KAAK,IACxB,KAAK,SAAS,UAAU,CAAC,MAAM,IAAI,EAAE,MAAM,MAAM,CAAC,GAC9C,MAAM,GACN,KAAK,SAAS,WAAW,GACvB,SAAS,CAAC,KAAK,CAAC,GAChB,SAAS,EAAE,CAAC;AAEpB,KAAK,kBAAkB,CAAC,MAAM,SAAS,SAAS,OAAO,EAAE,IACvD,MAAM,SAAS,MAAM,CAAC,QAAQ,CAAC,GAC3B,SAAS,WAAW,EAAE,GACtB,MAAM,SAAS,SAAS,CAAC,MAAM,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,GAClD,SAAS,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,EAAE,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,GACjE,SAAS,EAAE,CAAC;AAEpB,KAAK,sBAAsB,CAEzB,MAAM,SAAS,SAAS,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,IAC1C;IACF,QAAQ,EAAE,KAAK,IAAI,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,QAAQ,CAE9D,GAAG,EACH,MAAM,KAAK,CACZ,GACG,eAAe,CAAC,KAAK,CAAC,GACtB,KAAK;CACV,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,GAAG;KAE3B,KAAK,SAAS,YAAY,EAC1B,EAAE,SAAS,cAAc,QACnB,KAAK,SAAS,SAAS,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,uBAE9C,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,GAC5C,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC;KAEvC,KAAK,SAAS,YAAY,QACpB,KAAK,SAAS,SAAS,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,uBAE9C,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,GACxC,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC;EAMtC;AAED;;;;;;GAMG;AACH,KAAK,kBAAkB,GAAG,eAAe,CACvC,OAAO,EAEP,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,EAC1B,QAAQ,EAER,GAAG,EAEH,GAAG,CACJ,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,mBAAmB,CAC7B,GAAG,EACH,KAAK,SAAS,QAAQ,EACtB,YAAY,GAAG,IAAI,EAEnB,MAAM,SAAS,SAAS,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,GAAG,SAAS,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAC5E,SAAS,SAAS,SAAS,kBAAkB,EAAE,GAAG,SAAS,EAAE,IAC3D;IACF;;OAEG;IACH,KAAK,EAAE,KAAK,CAAC;IACb;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IAEtB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACjD;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEzC;;;;;;;;;;OAUG;IACH,OAAO,EAAE,mBAAmB,CAC1B,GAAG,EACH,KAAK,GAAG,kBAAkB,CAAC,SAAS,CAAC,EACrC,YAAY,CACb,CAAC;IACF;;OAEG;IACH,KAAK,CAAC,EAAE,UAAU,CAAC,GAAG,EAAE,KAAK,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;IACjE;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EAAE,4BAA4B,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC5D;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;IAC7C;;OAEG;IACH,aAAa,CAAC,EAAE,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC3C;;OAEG;IACH,iBAAiB,CAAC,EAAE,0BAA0B,CAAC,GAAG,CAAC,CAAC;CACrD,CAAC;AAEF,UAAU,YAAY,CAAC,GAAG,EAAE,CAAC,SAAS,kBAAkB;IACtD,MAAM,EAAE,CACN,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,KAChB,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;CACtD;AAED;;GAEG;AACH,MAAM,WAAW,cAAc,CAC7B,GAAG,EACH,KAAK,SAAS,QAAQ,GAAG,QAAQ,EACjC,YAAY,GAAG,IAAI;IAEnB;;OAEG;IACH,GAAG,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IACrD;;OAEG;IACH,KAAK,EAAE,CAAC,KAAK,SAAS,YAAY,EAChC,YAAY,EAAE,KAAK,KAChB,YAAY,CAAC,GAAG,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/C;;;;;OAKG;IACH,oBAAoB,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7D;;;;;OAKG;IACH,oBAAoB,EAAE,CACpB,GAAG,IAAI,EAAE,uBAAuB,CAAC,YAAY,CAAC,KAC3C,OAAO,CAAC,GAAG,CAAC,CAAC;IAClB;;OAEG;IACH,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACzC;;OAEG;IACH,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B;;OAEG;IACH,KAAK,EAAE,KAAK,CAAC;CACd;AA65CD;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,CAChC,GAAG,EACH,KAAK,SAAS,QAAQ,EACtB,YAAY,GAAG,IAAI,EAEnB,MAAM,SAAS,SAAS,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,GAAG,SAAS,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAC5E,SAAS,SAAS,SAAS,kBAAkB,EAAE,GAAG,SAAS,EAAE,EAE7D,OAAO,EAAE,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC,GACxE,OAAO,CACR,cAAc,CAAC,GAAG,EAAE,KAAK,GAAG,kBAAkB,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC,CACzE,CA4aA;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EACH,KAAK,CAAC,CAAC,SACL,SAAS,oBAAoB,CAAC,GAAG,CAAC,EAAE,GAAG,SAAS,oBAAoB,CAAC,GAAG,CAAC,EAAE,EAC7E,MAAM,EAAE,CAAC,GAAG,oBAAoB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;AACnE,wBAAgB,YAAY,CAC1B,GAAG,EACH,KAAK,CAAC,CAAC,SAAS,SAAS,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,SAAS,UAAU,CAAC,GAAG,CAAC,EAAE,EACvE,MAAM,EAAE,CAAC,GAAG,oBAAoB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;AAuBnE;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAEjC,KAAK,CAAC,CAAC,SAAS,SAAS,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAC7C,MAAM,EAAE,CAAC,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAItC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,KAAK,iBAAiB,CAAC,GAAG,CAAC,CAAC;AAChE;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAEH,KAAK,CAAC,CAAC,SAAS,SAAS,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,GAAG,SAAS,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAC7E,KAAK,EAAE;IACP,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,SAAS,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;IAC1C,MAAM,EAAE,CAAC,GAAG,oBAAoB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;CAC1C,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/server/server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAIL,KAAK,kBAAkB,EAIxB,MAAM,uBAAuB,CAAC;AAiB/B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAQlD,OAAO,KAAK,EACV,kBAAkB,EAElB,eAAe,EAChB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAEV,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGxE,OAAO,KAAK,EACV,iBAAiB,EACjB,OAAO,EAEP,eAAe,EACf,YAAY,EAGZ,SAAS,EACT,qBAAqB,EACrB,UAAU,EACV,0BAA0B,EAC3B,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAC;AAczE,OAAO,KAAK,EACV,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACrB,MAAM,qBAAqB,CAAC;AAM7B;;;;;GAKG;AACH,MAAM,MAAM,eAAe,CACzB,GAAG,EACH,KAAK,SAAS,YAAY,GAAG,YAAY,EACzC,KAAK,SAAS,SAAS,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,SAAS,SAAS,CAClE,GAAG,EACH,MAAM,CACP,EAAE,IACD;IACF;;OAEG;IACH,QAAQ,EAAE,KAAK,CAAC;IAChB;;OAEG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC;IACd;;OAEG;IACH,MAAM,EAAE,OAAO,CAAC,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,OAAO,CAAC,EAAE,KAAK,CAAC;IAChB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,MAAM,CAAC,EAAE,KAAK,CAAC;CAChB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,QAAQ,CAClB,GAAG,EACH,KAAK,SAAS,YAAY,GAAG,YAAY,EACzC,KAAK,SAAS,SAAS,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,SAAS,SAAS,CAClE,GAAG,EACH,MAAM,CACP,EAAE,IACD,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAG/E,KAAK,WAAW,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAGtC,KAAK,aAAa,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;AAG1D,KAAK,mBAAmB,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAEnD,QAAA,MAAM,gBAAgB,wBAAwB,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,CACpB,GAAG,EACH,MAAM,SAAS,SAAS,WAAW,EAAE,GAAG,SAAS,WAAW,EAAE,IAC5D;IACF;;OAEG;IACH,IAAI,EAAE,OAAO,gBAAgB,CAAC;IAC9B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,KAAK,CAAC,EAAE,SAAS,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;IAC1C;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,KAAK,UAAU,CAAC,GAAG,IACf,mBAAmB,CAAC,GAAG,CAAC,GACxB,WAAW,GACX,UAAU,CAAC,GAAG,EAAE,SAAS,WAAW,EAAE,CAAC,CAAC;AAE5C,KAAK,oBAAoB,CAAC,GAAG,IACzB,aAAa,CAAC,GAAG,CAAC,GAClB,UAAU,CAAC,GAAG,EAAE,SAAS,WAAW,EAAE,CAAC,CAAC;AAE5C,KAAK,iBAAiB,CAAC,GAAG,IAAI;IAC5B,CACE,KAAK,CAAC,UAAU,SAAS,SAAS,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,SAAS,EAAE,EACxE,KAAK,CAAC,CAAC,SAAS,SAAS,aAAa,CACpC,GAAG,GAAG,iBAAiB,CAAC,UAAU,CAAC,CACpC,EAAE,GAAG,SAAS,aAAa,CAAC,GAAG,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC,EAAE,EACnE,KAAK,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,UAAU,CAAC;QACnB,MAAM,EAAE,CAAC,GAAG,oBAAoB,CAAC,GAAG,GAAG,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;KAC1E,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACvB,CACE,KAAK,CAAC,UAAU,SAAS,SAAS,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,SAAS,EAAE,EACxE,KAAK,CAAC,CAAC,SAAS,SAAS,WAAW,EAAE,GAAG,SAAS,WAAW,EAAE,EAC/D,KAAK,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,UAAU,CAAC;QACnB,MAAM,EAAE,CAAC,GAAG,oBAAoB,CAAC,GAAG,GAAG,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;KAC1E,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;CACxB,CAAC;AAEF,KAAK,eAAe,CAAC,KAAK,IACxB,KAAK,SAAS,UAAU,CAAC,MAAM,IAAI,EAAE,MAAM,MAAM,CAAC,GAC9C,MAAM,GACN,KAAK,SAAS,WAAW,GACvB,SAAS,CAAC,KAAK,CAAC,GAChB,SAAS,EAAE,CAAC;AAEpB,KAAK,kBAAkB,CAAC,MAAM,SAAS,SAAS,OAAO,EAAE,IACvD,MAAM,SAAS,MAAM,CAAC,QAAQ,CAAC,GAC3B,SAAS,WAAW,EAAE,GACtB,MAAM,SAAS,SAAS,CAAC,MAAM,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,GAClD,SAAS,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,EAAE,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,GACjE,SAAS,EAAE,CAAC;AAEpB,KAAK,sBAAsB,CAEzB,MAAM,SAAS,SAAS,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,IAC1C;IACF,QAAQ,EAAE,KAAK,IAAI,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,QAAQ,CAE9D,GAAG,EACH,MAAM,KAAK,CACZ,GACG,eAAe,CAAC,KAAK,CAAC,GACtB,KAAK;CACV,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,GAAG;KAE3B,KAAK,SAAS,YAAY,EAC1B,EAAE,SAAS,cAAc,QACnB,KAAK,SAAS,SAAS,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,uBAE9C,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,GAC5C,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC;KAEvC,KAAK,SAAS,YAAY,QACpB,KAAK,SAAS,SAAS,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,uBAE9C,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,GACxC,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC;EAMtC;AAED;;;;;;GAMG;AACH,KAAK,kBAAkB,GAAG,eAAe,CACvC,OAAO,EAEP,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,EAC1B,QAAQ,EAER,GAAG,EAEH,GAAG,CACJ,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,MAAM,mBAAmB,CAC7B,GAAG,EACH,KAAK,SAAS,QAAQ,EACtB,YAAY,GAAG,IAAI,EAEnB,MAAM,SAAS,SAAS,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,GAAG,SAAS,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAC5E,SAAS,SAAS,SAAS,kBAAkB,EAAE,GAAG,SAAS,EAAE,IAC3D;IACF;;OAEG;IACH,KAAK,EAAE,KAAK,CAAC;IACb;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IAEtB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACjD;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEzC;;;;;;;;;;OAUG;IACH,OAAO,EAAE,mBAAmB,CAC1B,GAAG,EACH,KAAK,GAAG,kBAAkB,CAAC,SAAS,CAAC,EACrC,YAAY,CACb,CAAC;IACF;;OAEG;IACH,KAAK,CAAC,EAAE,UAAU,CAAC,GAAG,EAAE,KAAK,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;IACjE;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EAAE,4BAA4B,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC5D;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;OAEG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;IAC7C;;OAEG;IACH,aAAa,CAAC,EAAE,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC3C;;OAEG;IACH,iBAAiB,CAAC,EAAE,0BAA0B,CAAC,GAAG,CAAC,CAAC;CACrD,CAAC;AAEF,UAAU,YAAY,CAAC,GAAG,EAAE,CAAC,SAAS,kBAAkB;IACtD,MAAM,EAAE,CACN,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,KAChB,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;CACtD;AAED;;GAEG;AACH,MAAM,WAAW,cAAc,CAC7B,GAAG,EACH,KAAK,SAAS,QAAQ,GAAG,QAAQ,EACjC,YAAY,GAAG,IAAI;IAEnB;;OAEG;IACH,GAAG,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IACrD;;OAEG;IACH,KAAK,EAAE,CAAC,KAAK,SAAS,YAAY,EAChC,YAAY,EAAE,KAAK,KAChB,YAAY,CAAC,GAAG,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/C;;;;;OAKG;IACH,oBAAoB,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7D;;;;;OAKG;IACH,oBAAoB,EAAE,CACpB,GAAG,IAAI,EAAE,uBAAuB,CAAC,YAAY,CAAC,KAC3C,OAAO,CAAC,GAAG,CAAC,CAAC;IAClB;;OAEG;IACH,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACzC;;OAEG;IACH,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B;;OAEG;IACH,KAAK,EAAE,KAAK,CAAC;CACd;AA+/CD;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,CAChC,GAAG,EACH,KAAK,SAAS,QAAQ,EACtB,YAAY,GAAG,IAAI,EAEnB,MAAM,SAAS,SAAS,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,GAAG,SAAS,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAC5E,SAAS,SAAS,SAAS,kBAAkB,EAAE,GAAG,SAAS,EAAE,EAE7D,OAAO,EAAE,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC,GACxE,OAAO,CACR,cAAc,CAAC,GAAG,EAAE,KAAK,GAAG,kBAAkB,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC,CACzE,CA4aA;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EACH,KAAK,CAAC,CAAC,SACL,SAAS,oBAAoB,CAAC,GAAG,CAAC,EAAE,GAAG,SAAS,oBAAoB,CAAC,GAAG,CAAC,EAAE,EAC7E,MAAM,EAAE,CAAC,GAAG,oBAAoB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;AACnE,wBAAgB,YAAY,CAC1B,GAAG,EACH,KAAK,CAAC,CAAC,SAAS,SAAS,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,SAAS,UAAU,CAAC,GAAG,CAAC,EAAE,EACvE,MAAM,EAAE,CAAC,GAAG,oBAAoB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;AAuBnE;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAEjC,KAAK,CAAC,CAAC,SAAS,SAAS,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAC7C,MAAM,EAAE,CAAC,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAItC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,KAAK,iBAAiB,CAAC,GAAG,CAAC,CAAC;AAChE;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAEH,KAAK,CAAC,CAAC,SAAS,SAAS,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,GAAG,SAAS,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAC7E,KAAK,EAAE;IACP,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,SAAS,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;IAC1C,MAAM,EAAE,CAAC,GAAG,oBAAoB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;CAC1C,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC"}

package/dist/server/server.js

@@ -387,7 +387,69 @@ function defaultErrorResponse(err, ctx) {
         }),
     };
 }
-async function parseBody(req) {
+const DEFAULT_REQUEST_BODY_MAX_BYTES = 1024 * 1024;
+class RequestBodyTooLargeError extends Error {
+    maxBytes;
+    actualBytes;
+    constructor(maxBytes, actualBytes) {
+        super("Request body exceeds the configured size limit.");
+        this.name = "RequestBodyTooLargeError";
+        this.maxBytes = maxBytes;
+        this.actualBytes = actualBytes;
+    }
+}
+function requestBodyLimit(options) {
+    const maxBytes = options?.maxBytes ?? DEFAULT_REQUEST_BODY_MAX_BYTES;
+    if (!Number.isFinite(maxBytes) || maxBytes <= 0) {
+        throw new Error("createServer requestBody.maxBytes must be a positive number.");
+    }
+    return maxBytes;
+}
+function assertContentLengthWithinLimit(headers, maxBytes) {
+    const contentLength = headers.get("content-length");
+    if (contentLength === null)
+        return;
+    const actualBytes = Number(contentLength);
+    if (!Number.isFinite(actualBytes) || actualBytes < 0)
+        return;
+    if (actualBytes > maxBytes) {
+        throw new RequestBodyTooLargeError(maxBytes, actualBytes);
+    }
+}
+async function readLimitedRequestText(req, maxBytes) {
+    assertContentLengthWithinLimit(req.headers, maxBytes);
+    const body = req.raw?.body;
+    if (!body) {
+        const text = await req.text();
+        const actualBytes = new TextEncoder().encode(text).byteLength;
+        if (actualBytes > maxBytes) {
+            throw new RequestBodyTooLargeError(maxBytes, actualBytes);
+        }
+        return text;
+    }
+    const reader = body.getReader();
+    const decoder = new TextDecoder();
+    let received = 0;
+    let text = "";
+    try {
+        while (true) {
+            const result = await reader.read();
+            if (result.done)
+                break;
+            received += result.value.byteLength;
+            if (received > maxBytes) {
+                throw new RequestBodyTooLargeError(maxBytes, received);
+            }
+            text += decoder.decode(result.value, { stream: true });
+        }
+        text += decoder.decode();
+    }
+    finally {
+        reader.releaseLock();
+    }
+    return text;
+}
+async function parseBody(req, maxBytes) {
     const method = req.method.toUpperCase();
     if (!methodSupportsRequestBody(method)) {
         return undefined;
@@ -395,16 +457,18 @@ async function parseBody(req) {
     const bodyReq = req.clone?.() ?? req;
     const contentType = req.headers.get("content-type") || "";
     if (contentType.includes("application/json")) {
-        const text = await bodyReq.text();
+        const text = await readLimitedRequestText(bodyReq, maxBytes);
         if (text === "")
             return undefined;
         return JSON.parse(text);
     }
     try {
-        const text = await bodyReq.text();
+        const text = await readLimitedRequestText(bodyReq, maxBytes);
         return text === "" ? undefined : text;
     }
-    catch {
+    catch (error) {
+        if (error instanceof RequestBodyTooLargeError)
+            throw error;
         return undefined;
     }
 }
@@ -419,6 +483,7 @@ function createRequestExecutor(
 // biome-ignore lint/suspicious/noExplicitAny: Options are generic and need to work with any routes
 options, finalPorts, contextRuntime, hooks, routeHooks = [], optionsOverrides) {
     const warnedNativeReplacementHooks = new WeakSet();
+    const maxRequestBodyBytes = requestBodyLimit(options.requestBody);
     return async (target, req, preMatchedParams) => {
         const { contract, handler: userHandler } = target;
         let baseCtx;
@@ -802,13 +867,21 @@ options, finalPorts, contextRuntime, hooks, routeHooks = [], optionsOverrides) {
                     let body;
                     if (!result) {
                         try {
-                            body = await parseBody(req);
+                            body = await parseBody(req, maxRequestBodyBytes);
                         }
                         catch (error) {
-                            result = {
-                                response: requestValidationError(contract, 400, "INVALID_BODY", "Malformed JSON", "body", error),
-                                owner: "framework",
-                            };
+                            if (error instanceof RequestBodyTooLargeError) {
+                                result = {
+                                    response: requestValidationError(contract, 413, "PAYLOAD_TOO_LARGE", "Request body is too large", "body", error),
+                                    owner: "framework",
+                                };
+                            }
+                            else {
+                                result = {
+                                    response: requestValidationError(contract, 400, "INVALID_BODY", "Malformed JSON", "body", error),
+                                    owner: "framework",
+                                };
+                            }
                         }
                     }
                     if (!result && contract.body) {