@beignet/core 0.0.31 → 0.0.33

package/dist/server/hooks/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/server/hooks/rate-limit.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAKzE,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE/D;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,SAAS,EAAE,aAAa,CAAC;CAC1B,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,cAAc,CAAC;IACtB,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB,CAAC;AAEF,KAAK,mBAAmB,GAAG,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;AAE3D;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,iBAAiB,GACzB,MAAM,GACN,sBAAsB,GACtB,uBAAuB,GACvB,CAAC,CAAC,GAAG,EAAE,eAAe,KAAK,MAAM,GAAG,SAAS,CAAC,CAAC;AAEnD;;GAEG;AACH,MAAM,WAAW,gBAAgB,CAAC,GAAG;IACnC;;;;OAIG;IACH,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE;QACX,GAAG,EAAE,GAAG,CAAC;QACT,GAAG,EAAE,eAAe,CAAC;QACrB,KAAK,EAAE,cAAc,CAAC;KACvB,KAAK,MAAM,CAAC;IACb;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE;QAChB,GAAG,EAAE,eAAe,CAAC;QACrB,KAAK,EAAE,mBAAmB,CAAC;KAC5B,KAAK,MAAM,CAAC;IACb;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,iBAAiB,CAAC;CAC9B;AAiJD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,SAAS,gBAAgB,EAC/D,OAAO,GAAE,gBAAgB,CAAC,GAAG,CAAM,GAClC,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CA+EjC"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/server/hooks/rate-limit.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAKzE,OAAO,EAEL,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE/D;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,SAAS,EAAE,aAAa,CAAC;CAC1B,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,cAAc,CAAC;IACtB,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB,CAAC;AAEF,KAAK,mBAAmB,GAAG,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;AAE3D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,0BAA0B,CAAC;AAEpE;;GAEG;AACH,MAAM,WAAW,gBAAgB,CAAC,GAAG;IACnC;;;;OAIG;IACH,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE;QACX,GAAG,EAAE,GAAG,CAAC;QACT,GAAG,EAAE,eAAe,CAAC;QACrB,KAAK,EAAE,cAAc,CAAC;KACvB,KAAK,MAAM,CAAC;IACb;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE;QAChB,GAAG,EAAE,eAAe,CAAC;QACrB,KAAK,EAAE,mBAAmB,CAAC;KAC5B,KAAK,MAAM,CAAC;IACb;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;CACnC;AAmID;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,SAAS,gBAAgB,EAC/D,OAAO,GAAE,gBAAgB,CAAC,GAAG,CAAM,GAClC,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAsFjC"}

package/dist/server/hooks/rate-limit.js

@@ -3,36 +3,25 @@
  */
 import { AppError, httpErrors } from "../../errors/index.js";
 import { createProviderInstrumentation, } from "../../providers/index.js";
-function parseForwardedFor(req) {
-    const header = req.headers.get("x-forwarded-for") ?? "";
-    return header
-        .split(",")
-        .map((entry) => entry.trim())
-        .filter(Boolean);
-}
+import { resolveTrustedClientIp, } from "../trusted-proxy.js";
 function resolveClientIp(req, ipSource) {
-    if (typeof ipSource === "function") {
-        return ipSource(req) || undefined;
-    }
     if (ipSource === "none") {
         return undefined;
     }
-    const entries = parseForwardedFor(req);
-    if (entries.length === 0) {
-        return undefined;
-    }
-    return ipSource === "x-forwarded-for-first"
-        ? entries[0]
-        : entries[entries.length - 1];
+    return resolveTrustedClientIp(req, ipSource);
+}
+function hasTrustedProxyClientIp(config) {
+    if (!config)
+        return false;
+    return Boolean(config.clientIp);
 }
 function formatContractNames(names) {
     return names.map((name) => `"${name}"`).join(", ");
 }
 function ipSourceConfigurationError(contractNames) {
-    return new Error(`createRateLimitHooks(...) has no ipSource configured, but contract(s) ${contractNames} declare an "ip"-scoped rate limit. ` +
-        `Set ipSource to "x-forwarded-for-last" (app is always behind a trusted reverse proxy that appends the socket address), ` +
-        `"x-forwarded-for-first" (a trusted edge normalizes the header before it reaches the app), ` +
-        `a function for platform-specific headers such as cf-connecting-ip, ` +
+    return new Error(`createRateLimitHooks(...) has no client IP source configured, but contract(s) ${contractNames} declare an "ip"-scoped rate limit. ` +
+        `Set trustedProxy.clientIp or ipSource to a header source written by a trusted edge, ` +
+        `for example "x-forwarded-for-last", "x-forwarded-for-first", "x-real-ip", "cf-connecting-ip", or a custom function, ` +
         `or "none" to explicitly accept one shared ip:unknown bucket for all clients.`);
 }
 function emitUserKey(userId) {
@@ -106,30 +95,35 @@ async function enforceRateLimit(ports, args) {
  * never sent to clients; denials emit a `rateLimit.denied` instrumentation
  * event that carries the key for operators.
  *
- * `ip`-scoped limits require an explicit `ipSource` (or a custom `earlyKey`):
- * the hook's `validate` phase fails `createServer(...)` startup when a
- * registered contract declares an `ip` scope without one, instead of silently
- * collapsing all clients into a shared `ip:unknown` bucket. Contracts added
- * later through `server.route(...)` are not visible to `validate`, so
- * enforcing an `ip`-scoped limit without an `ipSource` throws the same
- * configuration error at request time as a backstop. Pass `ipSource: "none"`
- * to explicitly opt in to the shared `ip:unknown` bucket.
+ * `ip`-scoped limits require an explicit `trustedProxy.clientIp`, `ipSource`,
+ * or custom `earlyKey`: the hook's `validate` phase fails `createServer(...)`
+ * startup when a registered contract declares an `ip` scope without one,
+ * instead of silently collapsing all clients into a shared `ip:unknown` bucket.
+ * Contracts added later through `server.route(...)` are not visible to
+ * `validate`, so enforcing an `ip`-scoped limit without a client-IP source
+ * throws the same configuration error at request time as a backstop. Pass
+ * `ipSource: "none"` to explicitly opt in to the shared `ip:unknown` bucket.
  *
  * @param options - Optional key builders and client-IP source.
  * @returns A server hook backed by `ctx.ports.rateLimit`.
  */
 export function createRateLimitHooks(options = {}) {
-    const { ipSource } = options;
+    const { ipSource, trustedProxy } = options;
     const getClientIp = (req, contractName) => {
-        if (ipSource === undefined) {
-            throw ipSourceConfigurationError(formatContractNames([contractName]));
+        if (ipSource !== undefined) {
+            return resolveClientIp(req, ipSource);
+        }
+        if (hasTrustedProxyClientIp(trustedProxy) && trustedProxy) {
+            return resolveTrustedClientIp(req, trustedProxy.clientIp);
         }
-        return resolveClientIp(req, ipSource);
+        throw ipSourceConfigurationError(formatContractNames([contractName]));
     };
     return {
         name: "rate-limit",
         validate: ({ contracts }) => {
-            if (ipSource !== undefined || options.earlyKey) {
+            if (ipSource !== undefined ||
+                hasTrustedProxyClientIp(trustedProxy) ||
+                options.earlyKey) {
                 return;
             }
             const ipScoped = contracts

package/dist/server/hooks/rate-limit.js.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../../src/server/hooks/rate-limit.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,EACL,6BAA6B,GAE9B,MAAM,0BAA0B,CAAC;AA4ElC,SAAS,iBAAiB,CAAC,GAAoB;IAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;IACxD,OAAO,MAAM;SACV,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,eAAe,CACtB,GAAoB,EACpB,QAA2B;IAE3B,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;IACpC,CAAC;IAED,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,QAAQ,KAAK,uBAAuB;QACzC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACZ,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAwB;IACnD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,0BAA0B,CAAC,aAAqB;IACvD,OAAO,IAAI,KAAK,CACd,yEAAyE,aAAa,sCAAsC;QAC1H,yHAAyH;QACzH,4FAA4F;QAC5F,qEAAqE;QACrE,8EAA8E,CACjF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,QAAQ,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,SAAS,CAAC,EAAU;IAC3B,OAAO,MAAM,EAAE,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,mBAAmB,CAC1B,IAIC,EACD,WAAyD;IAEzD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAEjC,IAAI,KAAK,KAAK,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACnE,OAAO,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;QACzC,OAAO,SAAS,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAGC,EACD,WAAyD;IAEzD,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;QAC9C,OAAO,SAAS,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,KAAqB,EACrB,IAKC;IAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC;QACvC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO;IACT,CAAC;IAED,4EAA4E;IAC5E,8DAA8D;IAC9D,MAAM,eAAe,GAAG,6BAA6B,CACnD,KAAsC,EACtC;QACE,YAAY,EAAE,YAAY;QAC1B,OAAO,EAAE,WAAW;KACrB,CACF,CAAC;IACF,eAAe,CAAC,MAAM,CAAC;QACrB,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,mBAAmB;QAC1B,OAAO,EAAE,yBAAyB,IAAI,CAAC,GAAG,EAAE;QAC5C,OAAO,EAAE;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B;KACF,CAAC,CAAC;IAEH,MAAM,IAAI,QAAQ,CAChB,UAAU,CAAC,eAAe,EAC1B;QACE,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,IAAI;KAC/C,EACD,qBAAqB,EACrB,MAAM,CAAC,iBAAiB,KAAK,IAAI;QAC/B,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,EAAE;QAClE,CAAC,CAAC,SAAS,CACd,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAiC,EAAE;IAEnC,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAC7B,MAAM,WAAW,GAAG,CAClB,GAAoB,EACpB,YAAoB,EACA,EAAE;QACtB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,0BAA0B,CAAC,mBAAmB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxC,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE;YAC1B,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAC/C,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,SAAS;iBACvB,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,KAAK,IAAI,CAAC;iBAClE,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO;YACT,CAAC;YACD,MAAM,0BAA0B,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,SAAS,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE;YAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;YAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,KAAK,GAAmB,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC;YACvD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBACrB,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,GAAG,GACP,OAAO,CAAC,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;gBAClC,wBAAwB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAC7C,WAAW,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAC9B,CAAC;YAEJ,MAAM,gBAAgB,CAAC,KAAK,EAAE;gBAC5B,GAAG;gBACH,KAAK,EAAE,MAAM,CAAC,GAAG;gBACjB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,KAAK;aACN,CAAC,CAAC;YAEH,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,YAAY,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE;YAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;YAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,KAAK,GAAmB,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC;YACvD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBACrB,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,GAAG,GACP,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;gBAClC,mBAAmB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAC7C,WAAW,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAC9B,CAAC;YAEJ,MAAM,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE;gBAChC,GAAG;gBACH,KAAK,EAAE,MAAM,CAAC,GAAG;gBACjB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,KAAK;aACN,CAAC,CAAC;YAEH,OAAO,SAAS,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../../src/server/hooks/rate-limit.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,EACL,6BAA6B,GAE9B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,sBAAsB,GAGvB,MAAM,qBAAqB,CAAC;AAoF7B,SAAS,eAAe,CACtB,GAAoB,EACpB,QAA2B;IAE3B,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,sBAAsB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAAsC;IAEtC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAwB;IACnD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,0BAA0B,CAAC,aAAqB;IACvD,OAAO,IAAI,KAAK,CACd,iFAAiF,aAAa,sCAAsC;QAClI,sFAAsF;QACtF,sHAAsH;QACtH,8EAA8E,CACjF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,QAAQ,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,SAAS,CAAC,EAAU;IAC3B,OAAO,MAAM,EAAE,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,mBAAmB,CAC1B,IAIC,EACD,WAAyD;IAEzD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAEjC,IAAI,KAAK,KAAK,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACnE,OAAO,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;QACzC,OAAO,SAAS,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAGC,EACD,WAAyD;IAEzD,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;QAC9C,OAAO,SAAS,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,KAAqB,EACrB,IAKC;IAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC;QACvC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO;IACT,CAAC;IAED,4EAA4E;IAC5E,8DAA8D;IAC9D,MAAM,eAAe,GAAG,6BAA6B,CACnD,KAAsC,EACtC;QACE,YAAY,EAAE,YAAY;QAC1B,OAAO,EAAE,WAAW;KACrB,CACF,CAAC;IACF,eAAe,CAAC,MAAM,CAAC;QACrB,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,mBAAmB;QAC1B,OAAO,EAAE,yBAAyB,IAAI,CAAC,GAAG,EAAE;QAC5C,OAAO,EAAE;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B;KACF,CAAC,CAAC;IAEH,MAAM,IAAI,QAAQ,CAChB,UAAU,CAAC,eAAe,EAC1B;QACE,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,IAAI;KAC/C,EACD,qBAAqB,EACrB,MAAM,CAAC,iBAAiB,KAAK,IAAI;QAC/B,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,EAAE;QAClE,CAAC,CAAC,SAAS,CACd,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAiC,EAAE;IAEnC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IAC3C,MAAM,WAAW,GAAG,CAClB,GAAoB,EACpB,YAAoB,EACA,EAAE;QACtB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,uBAAuB,CAAC,YAAY,CAAC,IAAI,YAAY,EAAE,CAAC;YAC1D,OAAO,sBAAsB,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,0BAA0B,CAAC,mBAAmB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE;YAC1B,IACE,QAAQ,KAAK,SAAS;gBACtB,uBAAuB,CAAC,YAAY,CAAC;gBACrC,OAAO,CAAC,QAAQ,EAChB,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,SAAS;iBACvB,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,KAAK,IAAI,CAAC;iBAClE,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO;YACT,CAAC;YACD,MAAM,0BAA0B,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,SAAS,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE;YAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;YAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,KAAK,GAAmB,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC;YACvD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBACrB,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,GAAG,GACP,OAAO,CAAC,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;gBAClC,wBAAwB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAC7C,WAAW,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAC9B,CAAC;YAEJ,MAAM,gBAAgB,CAAC,KAAK,EAAE;gBAC5B,GAAG;gBACH,KAAK,EAAE,MAAM,CAAC,GAAG;gBACjB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,KAAK;aACN,CAAC,CAAC;YAEH,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,YAAY,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE;YAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;YAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,KAAK,GAAmB,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC;YACvD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBACrB,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,GAAG,GACP,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;gBAClC,mBAAmB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAC7C,WAAW,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAC9B,CAAC;YAEJ,MAAM,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE;gBAChC,GAAG;gBACH,KAAK,EAAE,MAAM,CAAC,GAAG;gBACjB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,KAAK;aACN,CAAC,CAAC;YAEH,OAAO,SAAS,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/hooks/security.d.ts

@@ -0,0 +1,179 @@
+/**
+ * Security hooks for @beignet/core/server
+ */
+import type { HttpContractConfig } from "../../contracts/index.js";
+import { type TrustedProxyConfig } from "../trusted-proxy.js";
+import type { HttpRequestLike, ServerHook } from "../types.js";
+/**
+ * Strict-Transport-Security configuration.
+ *
+ * HSTS is disabled by default because it should only be sent by HTTPS
+ * deployments that intentionally commit browsers to the configured host policy.
+ */
+export interface StrictTransportSecurityOptions {
+    /**
+     * HSTS max-age value in seconds.
+     *
+     * Defaults to one year when `strictTransportSecurity` is configured as an
+     * object.
+     */
+    maxAgeSec?: number;
+    /**
+     * Include subdomains in the HSTS policy.
+     */
+    includeSubDomains?: boolean;
+    /**
+     * Mark the policy as eligible for browser preload lists.
+     */
+    preload?: boolean;
+}
+/**
+ * Response security headers applied by `createSecurityHeadersHooks(...)`.
+ *
+ * Headers are only added when the response does not already define the same
+ * header name. Route handlers can therefore opt into route-specific CSP or
+ * download headers without fighting the global hook.
+ */
+export interface SecurityHeadersOptions {
+    /**
+     * Content Security Policy value. Disabled by default because browser apps need
+     * an app-owned asset, image, frame, and script policy.
+     */
+    contentSecurityPolicy?: string | false;
+    /**
+     * Cross-Origin-Opener-Policy value.
+     *
+     * Defaults to `"same-origin"`.
+     */
+    crossOriginOpenerPolicy?: string | false;
+    /**
+     * Cross-Origin-Resource-Policy value.
+     *
+     * Defaults to `"same-origin"`.
+     */
+    crossOriginResourcePolicy?: string | false;
+    /**
+     * Permissions-Policy value.
+     *
+     * Defaults to disabling camera, microphone, and geolocation.
+     */
+    permissionsPolicy?: string | false;
+    /**
+     * Referrer-Policy value.
+     *
+     * Defaults to `"strict-origin-when-cross-origin"`.
+     */
+    referrerPolicy?: string | false;
+    /**
+     * Strict-Transport-Security value. Pass a string for full control or an object
+     * for Beignet to format the header. Disabled by default.
+     */
+    strictTransportSecurity?: StrictTransportSecurityOptions | string | false;
+    /**
+     * X-Content-Type-Options value.
+     *
+     * Defaults to `"nosniff"`.
+     */
+    xContentTypeOptions?: "nosniff" | false;
+    /**
+     * X-Frame-Options value.
+     *
+     * Defaults to `"DENY"`. Use `contentSecurityPolicy` with `frame-ancestors`
+     * for more precise frame control.
+     */
+    xFrameOptions?: "DENY" | "SAMEORIGIN" | false;
+}
+export type CsrfFailureReason = "missing_origin" | "untrusted_origin" | "missing_token" | "invalid_token";
+/**
+ * Double-submit cookie token configuration for `createCsrfHooks(...)`.
+ */
+export interface CsrfTokenOptions {
+    /**
+     * Header that must carry the CSRF token.
+     *
+     * Defaults to `"x-csrf-token"`.
+     */
+    headerName?: string;
+    /**
+     * Cookie that stores the expected CSRF token.
+     *
+     * Defaults to `"beignet.csrf"`.
+     */
+    cookieName?: string;
+}
+/**
+ * Options for `createCsrfHooks(...)`.
+ */
+export interface CsrfHooksOptions {
+    /**
+     * Unsafe HTTP methods protected by the hook.
+     *
+     * Defaults to `POST`, `PUT`, `PATCH`, and `DELETE`.
+     */
+    protectedMethods?: readonly string[];
+    /**
+     * Additional trusted origins allowed to send protected requests.
+     *
+     * The request URL's own origin is always trusted. Use this for sibling
+     * frontends such as `https://app.example.com` calling `https://api.example.com`.
+     */
+    trustedOrigins?: readonly string[] | ((args: {
+        origin: string;
+        req: HttpRequestLike;
+        contract: HttpContractConfig;
+    }) => boolean);
+    /**
+     * Whether unsafe requests without `Origin` or `Referer` are allowed.
+     *
+     * Defaults to `true` so server-to-server calls, tests, and older same-origin
+     * clients keep working. Set to `false` for cookie-backed browser-only APIs.
+     */
+    allowMissingOrigin?: boolean;
+    /**
+     * Optional double-submit cookie token check.
+     *
+     * When configured, protected requests must send the same token in the
+     * configured header and cookie.
+     */
+    token?: false | CsrfTokenOptions;
+    /**
+     * Shared trusted-proxy policy used when comparing the request's external
+     * origin against `Origin` or `Referer`.
+     *
+     * Configure this only when the app is always behind a platform or reverse
+     * proxy that strips or normalizes forwarding headers. Without this option,
+     * CSRF uses `req.url` exactly as the adapter provided it.
+     */
+    trustedProxy?: TrustedProxyConfig;
+    /**
+     * App-owned escape hatch for routes that have another verifier, such as
+     * provider webhooks or auth callbacks.
+     */
+    skip?: (args: {
+        req: HttpRequestLike;
+        contract: HttpContractConfig;
+        params: Record<string, string>;
+    }) => boolean | Promise<boolean>;
+}
+/**
+ * Apply Beignet's default security response headers to a mutable header record.
+ *
+ * Existing headers are preserved case-insensitively so route-owned responses can
+ * provide more specific policies.
+ */
+export declare function applySecurityHeaders(headers: Record<string, string>, options?: SecurityHeadersOptions): void;
+/**
+ * Create a server hook that adds common browser security headers to every
+ * response, including native streamed responses.
+ */
+export declare function createSecurityHeadersHooks<Ctx>(options?: SecurityHeadersOptions): ServerHook<Ctx>;
+/**
+ * Create CSRF protection for unsafe HTTP methods.
+ *
+ * The default protects cookie-backed browser routes from cross-origin unsafe
+ * requests while still allowing server-to-server calls and tests that do not
+ * send browser origin headers. Set `allowMissingOrigin: false` and configure
+ * `token` for stricter browser-only APIs.
+ */
+export declare function createCsrfHooks<Ctx>(options?: CsrfHooksOptions): ServerHook<Ctx>;
+//# sourceMappingURL=security.d.ts.map

package/dist/server/hooks/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/server/hooks/security.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,OAAO,EAEL,KAAK,kBAAkB,EAExB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,WAAW,8BAA8B;IAC7C;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;OAEG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACvC;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACzC;;;;OAIG;IACH,yBAAyB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC3C;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACnC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAChC;;;OAGG;IACH,uBAAuB,CAAC,EAAE,8BAA8B,GAAG,MAAM,GAAG,KAAK,CAAC;IAC1E;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC;IACxC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,KAAK,CAAC;CAC/C;AAED,MAAM,MAAM,iBAAiB,GACzB,gBAAgB,GAChB,kBAAkB,GAClB,eAAe,GACf,eAAe,CAAC;AAEpB;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;OAKG;IACH,cAAc,CAAC,EACX,SAAS,MAAM,EAAE,GACjB,CAAC,CAAC,IAAI,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,eAAe,CAAC;QACrB,QAAQ,EAAE,kBAAkB,CAAC;KAC9B,KAAK,OAAO,CAAC,CAAC;IACnB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,KAAK,GAAG,gBAAgB,CAAC;IACjC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC;;;OAGG;IACH,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE;QACZ,GAAG,EAAE,eAAe,CAAC;QACrB,QAAQ,EAAE,kBAAkB,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAChC,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAClC;AAsCD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,GAAE,sBAA2B,GACnC,IAAI,CAyCN;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAC5C,OAAO,GAAE,sBAA2B,GACnC,UAAU,CAAC,GAAG,CAAC,CAYjB;AAwLD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EACjC,OAAO,GAAE,gBAAqB,GAC7B,UAAU,CAAC,GAAG,CAAC,CA2BjB"}

package/dist/server/hooks/security.js

@@ -0,0 +1,225 @@
+/**
+ * Security hooks for @beignet/core/server
+ */
+import { AppError, httpErrors } from "../../errors/index.js";
+import { resolveTrustedRequest, } from "../trusted-proxy.js";
+const DEFAULT_PERMISSIONS_POLICY = "camera=(), microphone=(), geolocation=()";
+const DEFAULT_PROTECTED_METHODS = ["POST", "PUT", "PATCH", "DELETE"];
+const DEFAULT_CSRF_HEADER = "x-csrf-token";
+const DEFAULT_CSRF_COOKIE = "beignet.csrf";
+function headerKey(headers, name) {
+    const lowerName = name.toLowerCase();
+    return Object.keys(headers).find((key) => key.toLowerCase() === lowerName);
+}
+function setHeaderIfMissing(headers, name, value) {
+    if (value === false || value === undefined)
+        return;
+    if (headerKey(headers, name))
+        return;
+    headers[name] = value;
+}
+function formatStrictTransportSecurity(config) {
+    if (typeof config === "string" || config === false || config === undefined) {
+        return config;
+    }
+    const directives = [`max-age=${config.maxAgeSec ?? 31_536_000}`];
+    if (config.includeSubDomains)
+        directives.push("includeSubDomains");
+    if (config.preload)
+        directives.push("preload");
+    return directives.join("; ");
+}
+/**
+ * Apply Beignet's default security response headers to a mutable header record.
+ *
+ * Existing headers are preserved case-insensitively so route-owned responses can
+ * provide more specific policies.
+ */
+export function applySecurityHeaders(headers, options = {}) {
+    setHeaderIfMissing(headers, "Content-Security-Policy", options.contentSecurityPolicy);
+    setHeaderIfMissing(headers, "Cross-Origin-Opener-Policy", options.crossOriginOpenerPolicy ?? "same-origin");
+    setHeaderIfMissing(headers, "Cross-Origin-Resource-Policy", options.crossOriginResourcePolicy ?? "same-origin");
+    setHeaderIfMissing(headers, "Permissions-Policy", options.permissionsPolicy ?? DEFAULT_PERMISSIONS_POLICY);
+    setHeaderIfMissing(headers, "Referrer-Policy", options.referrerPolicy ?? "strict-origin-when-cross-origin");
+    setHeaderIfMissing(headers, "Strict-Transport-Security", formatStrictTransportSecurity(options.strictTransportSecurity));
+    setHeaderIfMissing(headers, "X-Content-Type-Options", options.xContentTypeOptions ?? "nosniff");
+    setHeaderIfMissing(headers, "X-Frame-Options", options.xFrameOptions ?? "DENY");
+}
+/**
+ * Create a server hook that adds common browser security headers to every
+ * response, including native streamed responses.
+ */
+export function createSecurityHeadersHooks(options = {}) {
+    return {
+        name: "security-headers",
+        beforeSend: ({ response }) => {
+            const headers = { ...(response.headers ?? {}) };
+            applySecurityHeaders(headers, options);
+            return {
+                ...response,
+                headers,
+            };
+        },
+    };
+}
+function normalizeOrigin(value, source) {
+    try {
+        return new URL(value).origin;
+    }
+    catch {
+        throw new Error(`${source} must be an absolute URL origin.`);
+    }
+}
+function requestOrigin(req, trustedProxy) {
+    return resolveTrustedRequest(req, trustedProxyOriginConfig(trustedProxy))
+        .origin;
+}
+function trustedProxyOriginConfig(trustedProxy) {
+    if (!trustedProxy)
+        return trustedProxy;
+    const originConfig = {};
+    if (trustedProxy.hostHeader !== undefined) {
+        originConfig.hostHeader = trustedProxy.hostHeader;
+    }
+    if (trustedProxy.protocolHeader !== undefined) {
+        originConfig.protocolHeader = trustedProxy.protocolHeader;
+    }
+    return originConfig;
+}
+function headerOrigin(value) {
+    if (!value)
+        return undefined;
+    try {
+        return new URL(value).origin;
+    }
+    catch {
+        return undefined;
+    }
+}
+function originFromRequestHeaders(req) {
+    const origin = req.headers.get("origin");
+    if (origin)
+        return headerOrigin(origin) ?? origin;
+    return headerOrigin(req.headers.get("referer"));
+}
+function normalizeTrustedOrigins(trustedOrigins) {
+    if (!Array.isArray(trustedOrigins))
+        return trustedOrigins;
+    return trustedOrigins.map((origin) => normalizeOrigin(origin, "trustedOrigins entries"));
+}
+function isTrustedOrigin(args) {
+    if (args.origin === args.requestOrigin)
+        return true;
+    if (Array.isArray(args.trustedOrigins)) {
+        return args.trustedOrigins.includes(args.origin);
+    }
+    if (typeof args.trustedOrigins === "function") {
+        return args.trustedOrigins({
+            origin: args.origin,
+            req: args.req,
+            contract: args.contract,
+        });
+    }
+    return false;
+}
+function decodeCookiePart(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}
+function parseCookieHeader(cookieHeader) {
+    if (!cookieHeader)
+        return {};
+    return Object.fromEntries(cookieHeader
+        .split(";")
+        .map((entry) => entry.trim())
+        .filter(Boolean)
+        .map((entry) => {
+        const separator = entry.indexOf("=");
+        if (separator === -1)
+            return [entry, ""];
+        return [
+            decodeCookiePart(entry.slice(0, separator).trim()),
+            decodeCookiePart(entry.slice(separator + 1).trim()),
+        ];
+    }));
+}
+function tokensMatch(left, right) {
+    if (left.length !== right.length)
+        return false;
+    let result = 0;
+    for (let index = 0; index < left.length; index += 1) {
+        result |= left.charCodeAt(index) ^ right.charCodeAt(index);
+    }
+    return result === 0;
+}
+function csrfError(reason, message) {
+    return new AppError(httpErrors.Forbidden, { reason }, message);
+}
+function enforceOrigin(args) {
+    const origin = originFromRequestHeaders(args.req);
+    if (!origin) {
+        if (args.allowMissingOrigin)
+            return;
+        throw csrfError("missing_origin", "CSRF check failed because the request did not include an Origin or Referer header.");
+    }
+    if (!isTrustedOrigin({
+        origin,
+        req: args.req,
+        contract: args.contract,
+        requestOrigin: requestOrigin(args.req, args.trustedProxy),
+        trustedOrigins: args.trustedOrigins,
+    })) {
+        throw csrfError("untrusted_origin", "CSRF check failed because the request origin is not trusted.");
+    }
+}
+function enforceToken(req, token) {
+    if (!token)
+        return;
+    const headerName = token.headerName ?? DEFAULT_CSRF_HEADER;
+    const cookieName = token.cookieName ?? DEFAULT_CSRF_COOKIE;
+    const headerToken = req.headers.get(headerName);
+    const cookieToken = parseCookieHeader(req.headers.get("cookie"))[cookieName];
+    if (!headerToken || !cookieToken) {
+        throw csrfError("missing_token", `CSRF check failed because ${headerName} and ${cookieName} must both be present.`);
+    }
+    if (!tokensMatch(headerToken, cookieToken)) {
+        throw csrfError("invalid_token", "CSRF check failed because the submitted token does not match the cookie token.");
+    }
+}
+/**
+ * Create CSRF protection for unsafe HTTP methods.
+ *
+ * The default protects cookie-backed browser routes from cross-origin unsafe
+ * requests while still allowing server-to-server calls and tests that do not
+ * send browser origin headers. Set `allowMissingOrigin: false` and configure
+ * `token` for stricter browser-only APIs.
+ */
+export function createCsrfHooks(options = {}) {
+    const protectedMethods = new Set((options.protectedMethods ?? DEFAULT_PROTECTED_METHODS).map((method) => method.toUpperCase()));
+    const allowMissingOrigin = options.allowMissingOrigin ?? true;
+    const trustedOrigins = normalizeTrustedOrigins(options.trustedOrigins);
+    const token = options.token ?? false;
+    return {
+        name: "csrf",
+        onRequest: async ({ req, contract, params }) => {
+            if (!protectedMethods.has(req.method.toUpperCase()))
+                return undefined;
+            if (await options.skip?.({ req, contract, params }))
+                return undefined;
+            enforceOrigin({
+                req,
+                contract,
+                allowMissingOrigin,
+                trustedOrigins,
+                trustedProxy: options.trustedProxy,
+            });
+            enforceToken(req, token);
+            return undefined;
+        },
+    };
+}
+//# sourceMappingURL=security.js.map

package/dist/server/hooks/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/server/hooks/security.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EACL,qBAAqB,GAGtB,MAAM,qBAAqB,CAAC;AAqK7B,MAAM,0BAA0B,GAAG,0CAA0C,CAAC;AAC9E,MAAM,yBAAyB,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAU,CAAC;AAC9E,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAC3C,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAE3C,SAAS,SAAS,CAChB,OAA+B,EAC/B,IAAY;IAEZ,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,kBAAkB,CACzB,OAA+B,EAC/B,IAAY,EACZ,KAAiC;IAEjC,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IACnD,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC;QAAE,OAAO;IACrC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;AACxB,CAAC;AAED,SAAS,6BAA6B,CACpC,MAAyD;IAEzD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3E,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,WAAW,MAAM,CAAC,SAAS,IAAI,UAAU,EAAE,CAAC,CAAC;IACjE,IAAI,MAAM,CAAC,iBAAiB;QAAE,UAAU,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACnE,IAAI,MAAM,CAAC,OAAO;QAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/C,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAA+B,EAC/B,UAAkC,EAAE;IAEpC,kBAAkB,CAChB,OAAO,EACP,yBAAyB,EACzB,OAAO,CAAC,qBAAqB,CAC9B,CAAC;IACF,kBAAkB,CAChB,OAAO,EACP,4BAA4B,EAC5B,OAAO,CAAC,uBAAuB,IAAI,aAAa,CACjD,CAAC;IACF,kBAAkB,CAChB,OAAO,EACP,8BAA8B,EAC9B,OAAO,CAAC,yBAAyB,IAAI,aAAa,CACnD,CAAC;IACF,kBAAkB,CAChB,OAAO,EACP,oBAAoB,EACpB,OAAO,CAAC,iBAAiB,IAAI,0BAA0B,CACxD,CAAC;IACF,kBAAkB,CAChB,OAAO,EACP,iBAAiB,EACjB,OAAO,CAAC,cAAc,IAAI,iCAAiC,CAC5D,CAAC;IACF,kBAAkB,CAChB,OAAO,EACP,2BAA2B,EAC3B,6BAA6B,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAC/D,CAAC;IACF,kBAAkB,CAChB,OAAO,EACP,wBAAwB,EACxB,OAAO,CAAC,mBAAmB,IAAI,SAAS,CACzC,CAAC;IACF,kBAAkB,CAChB,OAAO,EACP,iBAAiB,EACjB,OAAO,CAAC,aAAa,IAAI,MAAM,CAChC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAAkC,EAAE;IAEpC,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC3B,MAAM,OAAO,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;YAChD,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACvC,OAAO;gBACL,GAAG,QAAQ;gBACX,OAAO;aACR,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,MAAc;IACpD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,kCAAkC,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,GAAoB,EACpB,YAA4C;IAE5C,OAAO,qBAAqB,CAAC,GAAG,EAAE,wBAAwB,CAAC,YAAY,CAAC,CAAC;SACtE,MAAM,CAAC;AACZ,CAAC;AAED,SAAS,wBAAwB,CAC/B,YAA4C;IAE5C,IAAI,CAAC,YAAY;QAAE,OAAO,YAAY,CAAC;IAEvC,MAAM,YAAY,GAAwB,EAAE,CAAC;IAC7C,IAAI,YAAY,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC1C,YAAY,CAAC,UAAU,GAAG,YAAY,CAAC,UAAU,CAAC;IACpD,CAAC;IACD,IAAI,YAAY,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC9C,YAAY,CAAC,cAAc,GAAG,YAAY,CAAC,cAAc,CAAC;IAC5D,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,YAAY,CAAC,KAAoB;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAE7B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,GAAoB;IACpD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,MAAM;QAAE,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;IAElD,OAAO,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,uBAAuB,CAC9B,cAAkD;IAElD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;QAAE,OAAO,cAAc,CAAC;IAC1D,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACnC,eAAe,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAClD,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAMxB;IACC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEpD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,cAAc,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,YAA2B;IAE3B,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC;IAE7B,OAAO,MAAM,CAAC,WAAW,CACvB,YAAY;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,SAAS,KAAK,CAAC,CAAC;YAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzC,OAAO;YACL,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;YAClD,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpD,CAAC;IACJ,CAAC,CAAC,CACL,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa;IAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE/C,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,KAAK,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,SAAS,CAAC,MAAyB,EAAE,OAAe;IAC3D,OAAO,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,aAAa,CAAC,IAMtB;IACC,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,IAAI,CAAC,kBAAkB;YAAE,OAAO;QACpC,MAAM,SAAS,CACb,gBAAgB,EAChB,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAED,IACE,CAAC,eAAe,CAAC;QACf,MAAM;QACN,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,aAAa,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC;QACzD,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC,EACF,CAAC;QACD,MAAM,SAAS,CACb,kBAAkB,EAClB,8DAA8D,CAC/D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CACnB,GAAoB,EACpB,KAA+B;IAE/B,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC3D,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC3D,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAE7E,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,SAAS,CACb,eAAe,EACf,6BAA6B,UAAU,QAAQ,UAAU,wBAAwB,CAClF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC3C,MAAM,SAAS,CACb,eAAe,EACf,gFAAgF,CACjF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,UAA4B,EAAE;IAE9B,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B,CAAC,OAAO,CAAC,gBAAgB,IAAI,yBAAyB,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACrE,MAAM,CAAC,WAAW,EAAE,CACrB,CACF,CAAC;IACF,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC;IAC9D,MAAM,cAAc,GAAG,uBAAuB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IAErC,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE;YAC7C,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBAAE,OAAO,SAAS,CAAC;YACtE,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;gBAAE,OAAO,SAAS,CAAC;YAEtE,aAAa,CAAC;gBACZ,GAAG;gBACH,QAAQ;gBACR,kBAAkB;gBAClB,cAAc;gBACd,YAAY,EAAE,OAAO,CAAC,YAAY;aACnC,CAAC,CAAC;YACH,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/index.d.ts

@@ -41,6 +41,10 @@ export * from "./providers/index.js";
  * Ambient request correlation context shared with instrumentation sinks.
  */
 export { type ActiveRequestContext, clearActiveRequestContext, enterActiveRequestContext, getActiveRequestContext, inheritActiveRequestContext, } from "./request-context.js";
+/**
+ * Runtime workflow registration integrity helpers.
+ */
+export * from "./runtime-integrity.js";
 /**
  * Server configuration and route types.
  */
@@ -53,6 +57,10 @@ export { contractsFromRoutes, createServer, defineRoute, defineRouteGroup, defin
  * Server context blueprint declaration helper.
  */
 export { defineServerContext } from "./server-context.js";
+/**
+ * Trusted proxy request metadata helpers.
+ */
+export * from "./trusted-proxy.js";
 export * from "./types.js";
 /**
  * Contract-aware route binder types and helpers.

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,YAAY,EACV,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B;;GAEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C;;GAEG;AACH,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD;;GAEG;AACH,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D;;GAEG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D;;GAEG;AACH,YAAY,EACV,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B;;GAEG;AACH,YAAY,EACV,kBAAkB,EAClB,4BAA4B,GAC7B,MAAM,sBAAsB,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC;;GAEG;AACH,OAAO,EACL,KAAK,oBAAoB,EACzB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B;;GAEG;AACH,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,UAAU,EACV,cAAc,GACf,MAAM,aAAa,CAAC;AACrB;;GAEG;AACH,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,YAAY,GACb,MAAM,aAAa,CAAC;AACrB;;GAEG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,cAAc,YAAY,CAAC;AAC3B;;GAEG;AACH,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,YAAY,EACV,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B;;GAEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C;;GAEG;AACH,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD;;GAEG;AACH,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D;;GAEG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D;;GAEG;AACH,YAAY,EACV,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B;;GAEG;AACH,YAAY,EACV,kBAAkB,EAClB,4BAA4B,GAC7B,MAAM,sBAAsB,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC;;GAEG;AACH,OAAO,EACL,KAAK,oBAAoB,EACzB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B;;GAEG;AACH,cAAc,wBAAwB,CAAC;AACvC;;GAEG;AACH,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,UAAU,EACV,cAAc,GACf,MAAM,aAAa,CAAC;AACrB;;GAEG;AACH,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,YAAY,GACb,MAAM,aAAa,CAAC;AACrB;;GAEG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D;;GAEG;AACH,cAAc,oBAAoB,CAAC;AACnC,cAAc,YAAY,CAAC;AAC3B;;GAEG;AACH,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,qBAAqB,CAAC"}

package/dist/server/index.js

@@ -21,6 +21,10 @@ export * from "./providers/index.js";
  * Ambient request correlation context shared with instrumentation sinks.
  */
 export { clearActiveRequestContext, enterActiveRequestContext, getActiveRequestContext, inheritActiveRequestContext, } from "./request-context.js";
+/**
+ * Runtime workflow registration integrity helpers.
+ */
+export * from "./runtime-integrity.js";
 /**
  * Server runtime helpers.
  */
@@ -29,6 +33,10 @@ export { contractsFromRoutes, createServer, defineRoute, defineRouteGroup, defin
  * Server context blueprint declaration helper.
  */
 export { defineServerContext } from "./server-context.js";
+/**
+ * Trusted proxy request metadata helpers.
+ */
+export * from "./trusted-proxy.js";
 export * from "./types.js";
 /**
  * Contract-aware route binder types and helpers.

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAWH;;GAEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAS9C;;GAEG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAY3D,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAQ1B,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC;;GAEG;AACH,OAAO,EAEL,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAa9B;;GAEG;AACH,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,YAAY,GACb,MAAM,aAAa,CAAC;AACrB;;GAEG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,cAAc,YAAY,CAAC;AAC3B;;GAEG;AACH,OAAO,EAIL,kBAAkB,GAKnB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAWH;;GAEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAS9C;;GAEG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAY3D,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAQ1B,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC;;GAEG;AACH,OAAO,EAEL,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B;;GAEG;AACH,cAAc,wBAAwB,CAAC;AAavC;;GAEG;AACH,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,YAAY,GACb,MAAM,aAAa,CAAC;AACrB;;GAEG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D;;GAEG;AACH,cAAc,oBAAoB,CAAC;AACnC,cAAc,YAAY,CAAC;AAC3B;;GAEG;AACH,OAAO,EAIL,kBAAkB,GAKnB,MAAM,qBAAqB,CAAC"}

package/dist/server/instrumentation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"instrumentation.d.ts","sourceRoot":"","sources":["../../src/server/instrumentation.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAElD,OAAO,EACL,KAAK,iCAAiC,EAGvC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAQ/E;;;;;;;;;;GAUG;AACH,MAAM,WAAW,4BAA4B,CAAC,GAAG,GAAG,OAAO;IACzD;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAEjC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAEpC;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEhC;;;;OAIG;IACH,MAAM,CAAC,EAAE,CACP,KAAK,EAAE,iCAAiC,KACrC,iCAAiC,CAAC;IAEvC;;OAEG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE;QACrB,GAAG,EAAE,eAAe,CAAC;QACrB,GAAG,CAAC,EAAE,GAAG,CAAC;QACV,QAAQ,EAAE,kBAAkB,CAAC;QAC7B,QAAQ,EAAE,gBAAgB,CAAC;QAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,KAAK,OAAO,CAAC;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,KAAK,EAAE,YAAY,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,4BAA4B,CAAC,GAAG;IAC/C;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI,CAAC;IACnC;;OAEG;IACH,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,kBAAkB,CAAC;IACzD;;OAEG;IACH,wBAAwB,IAAI,kBAAkB,CAAC;IAC/C;;;OAGG;IACH,IAAI,CAAC,EAAE,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;CAClC;AA2GD;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAC7C,OAAO,EAAE,4BAA4B,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,SAAS,GAC7D,4BAA4B,CAAC,GAAG,CAAC,CA6OnC"}
+{"version":3,"file":"instrumentation.d.ts","sourceRoot":"","sources":["../../src/server/instrumentation.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAElD,OAAO,EACL,KAAK,iCAAiC,EAGvC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAIL,KAAK,YAAY,EAElB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAQ/E;;;;;;;;;;GAUG;AACH,MAAM,WAAW,4BAA4B,CAAC,GAAG,GAAG,OAAO;IACzD;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAEjC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAEpC;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEhC;;;;OAIG;IACH,MAAM,CAAC,EAAE,CACP,KAAK,EAAE,iCAAiC,KACrC,iCAAiC,CAAC;IAEvC;;OAEG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE;QACrB,GAAG,EAAE,eAAe,CAAC;QACrB,GAAG,CAAC,EAAE,GAAG,CAAC;QACV,QAAQ,EAAE,kBAAkB,CAAC;QAC7B,QAAQ,EAAE,gBAAgB,CAAC;QAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,KAAK,OAAO,CAAC;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,KAAK,EAAE,YAAY,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,4BAA4B,CAAC,GAAG;IAC/C;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI,CAAC;IACnC;;OAEG;IACH,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,kBAAkB,CAAC;IACzD;;OAEG;IACH,wBAAwB,IAAI,kBAAkB,CAAC;IAC/C;;;OAGG;IACH,IAAI,CAAC,EAAE,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;CAClC;AA8GD;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAC7C,OAAO,EAAE,4BAA4B,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,SAAS,GAC7D,4BAA4B,CAAC,GAAG,CAAC,CA4PnC"}