@daloyjs/core 0.17.0 → 0.28.0

package/dist/dependency.js

@@ -0,0 +1,68 @@
+/**
+ * Typed-DI chain helper (Wave 6 item 12).
+ *
+ * `defineDependency()` wraps a middleware so the framework deduplicates
+ * evaluation per request — a request that triggers two routes both depending
+ * on `getCurrentUser` runs the auth check exactly once per request, with the
+ * typed result threaded through `ctx.state` declared in {@link AppState}.
+ *
+ * Refuses-at-construction on cyclic dependency declarations (companion to
+ * the cyclic plugin-extension-ordering refusal in {@link App.register}).
+ *
+ * @since 0.24.0
+ */
+/** Symbol stamped on hooks returned by {@link defineDependency}. */
+export const DEPENDENCY_MARKER = Symbol.for("daloyjs.dependency.marker");
+/** Per-request cache of dependency results, keyed by dependency name. */
+const RESULTS_KEY = Symbol.for("daloyjs.dependency.results");
+/**
+ * Wrap a per-request value producer as a {@link Hooks} bundle. The hook
+ * runs in `beforeHandle` and writes its resolved value to
+ * `ctx.state[stateKey]` (default `name`). Composing the same dependency
+ * twice in one chain runs `resolve()` exactly once.
+ *
+ * @since 0.24.0
+ */
+export function defineDependency(opts) {
+    if (typeof opts.name !== "string" || opts.name.length === 0) {
+        throw new Error("defineDependency(): name is required and must be a non-empty string.");
+    }
+    const dependsOn = opts.dependsOn ?? [];
+    if (dependsOn.includes(opts.name)) {
+        throw new Error(`defineDependency(): dependency "${opts.name}" declares itself as a dependency (cycle).`);
+    }
+    const stateKey = opts.stateKey ?? opts.name;
+    const hooks = {
+        async beforeHandle(ctx) {
+            const state = ctx.state;
+            let cache = state[RESULTS_KEY];
+            if (!cache) {
+                cache = new Map();
+                state[RESULTS_KEY] = cache;
+            }
+            if (cache.has(opts.name)) {
+                // Already resolved this request — re-stamp for the active stateKey
+                // in case a sibling chain wrote it under a different key.
+                state[stateKey] = cache.get(opts.name);
+                return;
+            }
+            // Verify declared dependencies ran first; the developer composes them
+            // in the correct order via `every(...)` or registration order.
+            for (const dep of dependsOn) {
+                if (!cache.has(dep)) {
+                    throw new Error(`defineDependency(): "${opts.name}" requires "${dep}" to be composed first.`);
+                }
+            }
+            const value = await opts.resolve(ctx);
+            cache.set(opts.name, value);
+            state[stateKey] = value;
+        },
+    };
+    Object.defineProperty(hooks, DEPENDENCY_MARKER, {
+        value: { name: opts.name, dependsOn: [...dependsOn] },
+        enumerable: false,
+        writable: false,
+    });
+    return hooks;
+}
+//# sourceMappingURL=dependency.js.map

package/dist/dependency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency.js","sourceRoot":"","sources":["../src/dependency.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,oEAAoE;AACpE,MAAM,CAAC,MAAM,iBAAiB,GAAkB,MAAM,CAAC,GAAG,CACxD,2BAA2B,CAC5B,CAAC;AAEF,yEAAyE;AACzE,MAAM,WAAW,GAAkB,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;AAyB5E;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAI9B,IAAiD;IACjD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;IACvC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,mCAAmC,IAAI,CAAC,IAAI,4CAA4C,CACzF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC;IAE5C,MAAM,KAAK,GAAU;QACnB,KAAK,CAAC,YAAY,CAAC,GAAG;YACpB,MAAM,KAAK,GAAG,GAAG,CAAC,KAEjB,CAAC;YACF,IAAI,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;YAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;gBAClB,KAAK,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC;YAC7B,CAAC;YACD,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,mEAAmE;gBACnE,0DAA0D;gBAC1D,KAAK,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACvC,OAAO;YACT,CAAC;YACD,sEAAsE;YACtE,+DAA+D;YAC/D,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACpB,MAAM,IAAI,KAAK,CACb,wBAAwB,IAAI,CAAC,IAAI,eAAe,GAAG,yBAAyB,CAC7E,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACtC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC5B,KAAK,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;QAC1B,CAAC;KACF,CAAC;IACF,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,iBAAiB,EAAE;QAC9C,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,EAAE;QACrD,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IACH,OAAO,KAAwB,CAAC;AAClC,CAAC"}

package/dist/etag.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Wave 5 leftover: first-party `etag()` helper with strong-validation default.
+ *
+ * Automatically computes a SHA-1 strong ETag for successful `GET` / `HEAD`
+ * responses, responds `304 Not Modified` on a matching `If-None-Match`, and
+ * — critical for tenant-isolated APIs — skips entirely when the response
+ * carries a `Set-Cookie` header OR a `Cache-Control` directive of
+ * `private` / `no-store` / `no-cache`. Cross-tenant fingerprinting via
+ * cached ETag values is the documented attack class this defense addresses;
+ * the skip behavior is on by default and not configurable.
+ *
+ * @since 0.21.0
+ */
+import type { Hooks } from "./types.js";
+/** Options for {@link etag}. */
+export interface ETagOptions {
+    /**
+     * Emit a weak ETag (`W/"..."`). Default `false` — strong ETags allow
+     * range-request resumption and prevent byte-level cache poisoning by
+     * intermediaries.
+     */
+    weak?: boolean;
+    /**
+     * Override the digest function. Default: SHA-1 via WebCrypto. SHA-1 is
+     * appropriate here because the ETag is a cache identifier, not a security
+     * boundary; collisions only cause a stale `304`, never a confidentiality
+     * break.
+     */
+    generator?: (body: Uint8Array) => string | Promise<string>;
+}
+/**
+ * ETag generation + conditional-GET handler.
+ *
+ * - Skips when the response already carries an `ETag`.
+ * - Skips when the response carries `Set-Cookie` OR `Cache-Control: private | no-store | no-cache`.
+ * - Skips non-`2xx` responses and methods other than `GET` / `HEAD`.
+ * - Emits `304 Not Modified` (preserving `cache-control`, `content-location`, `date`, `etag`, `expires`, `vary` per RFC 7232 §4.1) on a matching `If-None-Match`.
+ *
+ * @example
+ * ```ts
+ * import { etag } from "@daloyjs/core";
+ * app.use(etag());
+ * ```
+ *
+ * @since 0.21.0
+ */
+export declare function etag(opts?: ETagOptions): Hooks;
+//# sourceMappingURL=etag.d.ts.map

package/dist/etag.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"etag.d.ts","sourceRoot":"","sources":["../src/etag.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAExC,gCAAgC;AAChC,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;OAKG;IACH,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D;AA4CD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,IAAI,CAAC,IAAI,GAAE,WAAgB,GAAG,KAAK,CAmClD"}

package/dist/etag.js

@@ -0,0 +1,117 @@
+/**
+ * Wave 5 leftover: first-party `etag()` helper with strong-validation default.
+ *
+ * Automatically computes a SHA-1 strong ETag for successful `GET` / `HEAD`
+ * responses, responds `304 Not Modified` on a matching `If-None-Match`, and
+ * — critical for tenant-isolated APIs — skips entirely when the response
+ * carries a `Set-Cookie` header OR a `Cache-Control` directive of
+ * `private` / `no-store` / `no-cache`. Cross-tenant fingerprinting via
+ * cached ETag values is the documented attack class this defense addresses;
+ * the skip behavior is on by default and not configurable.
+ *
+ * @since 0.21.0
+ */
+const CACHE_SKIP_DIRECTIVES = new Set(["private", "no-store", "no-cache"]);
+function shouldSkipForCache(res) {
+    if (res.headers.has("set-cookie"))
+        return true;
+    const cc = res.headers.get("cache-control");
+    if (!cc)
+        return false;
+    for (const part of cc.split(",")) {
+        const token = part.trim().toLowerCase().split("=")[0];
+        if (CACHE_SKIP_DIRECTIVES.has(token))
+            return true;
+    }
+    return false;
+}
+async function sha1Hex(bytes) {
+    const c = globalThis.crypto;
+    if (!c?.subtle) {
+        throw new Error("etag(): WebCrypto SubtleCrypto API is unavailable on this runtime.");
+    }
+    const digest = new Uint8Array(await c.subtle.digest("SHA-1", bytes));
+    let out = "";
+    for (let i = 0; i < digest.length; i++)
+        out += digest[i].toString(16).padStart(2, "0");
+    return out;
+}
+function inmMatches(headerValue, candidate) {
+    // RFC 7232 §3.2: comma-separated list of entity tags or `*`.
+    const list = headerValue.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+    if (list.length === 0)
+        return false;
+    for (const tag of list) {
+        if (tag === "*")
+            return true;
+        // Strong comparison: tag and candidate must be byte-equal AND neither weak.
+        if (tag === candidate) {
+            if (!tag.startsWith("W/") && !candidate.startsWith("W/"))
+                return true;
+        }
+        // Weak comparison fallback for HEAD/GET on cached representations.
+        const tStripped = tag.startsWith("W/") ? tag.slice(2) : tag;
+        const cStripped = candidate.startsWith("W/") ? candidate.slice(2) : candidate;
+        if (tStripped === cStripped)
+            return true;
+    }
+    return false;
+}
+/**
+ * ETag generation + conditional-GET handler.
+ *
+ * - Skips when the response already carries an `ETag`.
+ * - Skips when the response carries `Set-Cookie` OR `Cache-Control: private | no-store | no-cache`.
+ * - Skips non-`2xx` responses and methods other than `GET` / `HEAD`.
+ * - Emits `304 Not Modified` (preserving `cache-control`, `content-location`, `date`, `etag`, `expires`, `vary` per RFC 7232 §4.1) on a matching `If-None-Match`.
+ *
+ * @example
+ * ```ts
+ * import { etag } from "@daloyjs/core";
+ * app.use(etag());
+ * ```
+ *
+ * @since 0.21.0
+ */
+export function etag(opts = {}) {
+    const weak = opts.weak === true;
+    const gen = opts.generator;
+    return {
+        async onSend(res, ctx) {
+            if (res.headers.has("etag"))
+                return undefined;
+            if (res.status < 200 || res.status >= 300)
+                return undefined;
+            const method = ctx?.request?.method;
+            if (method !== "GET" && method !== "HEAD")
+                return undefined;
+            if (shouldSkipForCache(res))
+                return undefined;
+            const body = new Uint8Array(await res.clone().arrayBuffer());
+            const tag = gen ? await gen(body) : await sha1Hex(body);
+            const value = `${weak ? "W/" : ""}"${tag}"`;
+            const headers = new Headers(res.headers);
+            headers.set("etag", value);
+            const inm = ctx?.request?.headers.get("if-none-match");
+            if (inm && inmMatches(inm, value)) {
+                const stripped = new Headers();
+                for (const allow of ["cache-control", "content-location", "date", "etag", "expires", "vary"]) {
+                    const v = headers.get(allow);
+                    if (v !== null)
+                        stripped.set(allow, v);
+                }
+                return new Response(null, { status: 304, headers: stripped });
+            }
+            // Re-emit response with the new header. For HEAD requests the body is
+            // already empty so passing `body` is safe; we read the bytes for the
+            // digest above, so a fresh Response is required either way.
+            const responseBody = method === "HEAD" ? null : body;
+            return new Response(responseBody, {
+                status: res.status,
+                statusText: res.statusText,
+                headers,
+            });
+        },
+    };
+}
+//# sourceMappingURL=etag.js.map

package/dist/etag.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"etag.js","sourceRoot":"","sources":["../src/etag.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAqBH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AAE3E,SAAS,kBAAkB,CAAC,GAAa;IACvC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC5C,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACtB,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACvD,IAAI,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,KAAiB;IACtC,MAAM,CAAC,GAAI,UAA6C,CAAC,MAAM,CAAC;IAChE,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAqB,CAAC,CAAC,CAAC;IACrF,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,MAAM,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,WAAmB,EAAE,SAAiB;IACxD,6DAA6D;IAC7D,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC7B,4EAA4E;QAC5E,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;QACxE,CAAC;QACD,mEAAmE;QACnE,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC5D,MAAM,SAAS,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,IAAI,CAAC,OAAoB,EAAE;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;IAC3B,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG;YACnB,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC9C,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;gBAAE,OAAO,SAAS,CAAC;YAC5D,MAAM,MAAM,GAAG,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC;YACpC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM;gBAAE,OAAO,SAAS,CAAC;YAC5D,IAAI,kBAAkB,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC9C,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;YACxD,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,GAAG,CAAC;YAC5C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC3B,MAAM,GAAG,GAAG,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YACvD,IAAI,GAAG,IAAI,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;gBAClC,MAAM,QAAQ,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC/B,KAAK,MAAM,KAAK,IAAI,CAAC,eAAe,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;oBAC7F,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;oBAC7B,IAAI,CAAC,KAAK,IAAI;wBAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBACzC,CAAC;gBACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,sEAAsE;YACtE,qEAAqE;YACrE,4DAA4D;YAC5D,MAAM,YAAY,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACrD,OAAO,IAAI,QAAQ,CAAC,YAAY,EAAE;gBAChC,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,OAAO;aACR,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -1,16 +1,45 @@
 export { App } from "./app.js";
 export { createApp } from "./app.js";
 export { _resetPackageJsonCacheForTests } from "./app.js";
-export type { AppOptions, AppOpenAPIOptions, DocsRouteOptions, IntrospectedRoute, PluginInstalledEvent, ShutdownEvent, } from "./app.js";
-export type { RouteDefinition, HttpMethod, PathString, RequestSchemas, ResponsesMap, ResponseSpec, AuthSpec, Hooks, BaseContext, AppState, HandlerReturn, InferRequest, ParamsOf, PathParams, CallbackDefinition, CallbackMap, CallbackOperation, RouteExample, RouteMeta, } from "./types.js";
+export { _resetCrashHandlersForTests } from "./app.js";
+export { _resetInsecureDefaultsLogForTests } from "./app.js";
+export type { AppOptions, AppOpenAPIOptions, DocsRouteOptions, HealthRouteOptions, CspReportRouteOptions, IntrospectedRoute, PluginInstalledEvent, PluginExtension, ShutdownEvent, } from "./app.js";
+export { getConnInfo, setConnInfo, assertBehindProxy, resolveClientIp, readRemoteAddress, readRemotePort, pickForwardedForByHops, } from "./conn-info.js";
+export type { BehindProxyConfig, ConnInfo } from "./conn-info.js";
+export { subdomains, PSL_SNAPSHOT_DATE, PSL_PUBLIC_SUFFIXES, MAX_SNAPSHOT_AGE_DAYS, } from "./subdomains.js";
+export type { SubdomainsOptions, SubdomainsResult } from "./subdomains.js";
+export { defineDependency, DEPENDENCY_MARKER } from "./dependency.js";
+export type { DependencyHooks, DependencyOptions, } from "./dependency.js";
+export type { RouteDefinition, HttpMethod, PathString, RequestSchemas, ResponsesMap, ResponseSpec, AuthSpec, Hooks, BaseContext, AppState, AuthScheme, AuthContext, HandlerReturn, InferRequest, ParamsOf, PathParams, CallbackDefinition, CallbackMap, CallbackOperation, RouteExample, RouteMeta, } from "./types.js";
 export { HttpError, BadRequestError, ValidationError, NotFoundError, UnauthorizedError, ForbiddenError, MethodNotAllowedError, PayloadTooLargeError, UnsupportedMediaTypeError, TooManyRequestsError, RequestTimeoutError, InternalError, } from "./errors.js";
 export type { ProblemDetails, ProblemRenderOptions } from "./errors.js";
 export type { StandardSchemaV1 } from "./schema.js";
 export { validate, isStandardSchema } from "./schema.js";
 export { readBodyLimited, safeJsonParse, sanitizeHeaderName, sanitizeHeaderValue, timingSafeEqual, randomId, assertNoDuplicateSingletonHeaders, SMUGGLING_SINGLETON_HEADERS, verifyWebhookSignature, signWebhookPayload, assertStrongSecret, MIN_PROD_SECRET_BYTES, WEAK_SECRET_STRINGS, } from "./security.js";
 export type { WebhookHmacAlgorithm } from "./security.js";
-export { requestId, secureHeaders, SECURE_HEADERS_MARKER, cors, CORS_HOOK_MARKER, CORS_ORIGIN_ALLOW_MARKER, CORS_WILDCARD_ORIGIN_MARKER, rateLimit, timing, bearerAuth, basicAuth, csrf, CSRF_HOOK_MARKER, } from "./middleware.js";
-export type { RequestIdOptions, SecureHeadersOptions, CspDirectivesOptions, CorsOptions, CorsOriginAllow, RateLimitOptions, RateLimitStore, CsrfOptions, CsrfCookieOptions, BasicAuthOptions, } from "./middleware.js";
+export { requestId, secureHeaders, SECURE_HEADERS_MARKER, cors, CORS_HOOK_MARKER, CORS_ORIGIN_ALLOW_MARKER, CORS_WILDCARD_ORIGIN_MARKER, rateLimit, loginThrottle, timing, bearerAuth, basicAuth, csrf, CSRF_HOOK_MARKER, requireScopes, REQUIRE_SCOPES_AGGREGATE_KEY, REQUIRE_SCOPES_HOOK_MARKER, _resetSharedRateLimitStoresForTests, } from "./middleware.js";
+export { etag } from "./etag.js";
+export type { ETagOptions } from "./etag.js";
+export { compression, COMPRESSION_HOOK_MARKER, _resetCompressionRuntimeProbeForTests, } from "./compression.js";
+export type { CompressionEncoding, CompressionOptions, } from "./compression.js";
+export { createJwtSigner, createJwtVerifier, JwtError, DEFAULT_JWT_MAX_LIFETIME_SECONDS, } from "./jwt.js";
+export type { JwtAlgorithm, JwtKeyMaterial, JwtSignerOptions, JwtVerifierOptions, JwtVerified, } from "./jwt.js";
+export { jwk } from "./jwk.js";
+export type { JwkAlgorithm, JwkOptions, JwkSet, JwkSource, JwkVerifyHook, } from "./jwk.js";
+export { serializeCookie, serializeClearCookie, assertCookieAttributes, readRequestCookie, } from "./cookie.js";
+export type { CookieAttributes, CookieSameSite } from "./cookie.js";
+export { assertTemporalClaims, TemporalClaimError, } from "./time-claims.js";
+export type { TemporalClaims, TemporalClaimErrorCode, AssertTemporalClaimsOptions, } from "./time-claims.js";
+export { every, some, except } from "./combine.js";
+export type { ExceptPredicate } from "./combine.js";
+export { ipRestriction } from "./ip-restriction.js";
+export type { IpRestrictionOptions } from "./ip-restriction.js";
+export { loadShedding, LOAD_SHEDDING_MARKER } from "./load-shedding.js";
+export type { LoadSheddingOptions, LoadSheddingSnapshot, } from "./load-shedding.js";
+export { defineConfig, ConfigValidationError } from "./config.js";
+export type { ConfigSource, DefineConfigOptions, } from "./config.js";
+export type { RequestIdOptions, SecureHeadersOptions, CspDirectivesOptions, CorsOptions, CorsOriginAllow, RateLimitOptions, RateLimitStore, LoginThrottleOptions, CsrfOptions, CsrfCookieOptions, BasicAuthOptions, } from "./middleware.js";
+export type { BearerAuthOptions, BearerAuthVerifyHook } from "./middleware.js";
 export { createLogger, noopLogger, DEFAULT_REDACT_KEYS } from "./logger.js";
 export type { Logger, LogLevel, ConsoleLoggerOptions, LoggerRedactionOptions, } from "./logger.js";
 export type { ScalarJsonPrimitive, ScalarJsonValue, ScalarReferenceConfiguration, ScalarTheme, } from "./docs.js";
@@ -18,16 +47,16 @@ export { formatStartupBanner, printStartupBanner } from "./banner.js";
 export type { StartupBannerLink, StartupBannerOptions } from "./banner.js";
 export { sseStream, sseResponse, ndjsonStream, ndjsonResponse, } from "./streaming.js";
 export type { SSEMessage, StreamOptions, SSEStreamOptions, SSEResponseOptions, NDJSONResponseOptions, } from "./streaming.js";
-export { httpBearerScheme, httpBasicScheme, apiKeyScheme, oauth2Scheme, openIdConnectScheme, } from "./security-schemes.js";
-export type { ApiKeyLocation, ApiKeyScheme, ApiKeySchemeOptions, HttpBasicScheme, HttpBasicSchemeOptions, HttpBearerScheme, HttpBearerSchemeOptions, OAuth2AuthorizationCodeFlow, OAuth2ClientCredentialsFlow, OAuth2Flows, OAuth2ImplicitFlow, OAuth2PasswordFlow, OAuth2Scheme, OAuth2SchemeOptions, OpenIdConnectScheme, OpenIdConnectSchemeOptions, SecurityScheme, } from "./security-schemes.js";
+export { httpBearerScheme, httpBasicScheme, apiKeyScheme, oauth2Scheme, openIdConnectScheme, REQUIRE_PAYLOAD_AUTH_EXTENSION, securitySchemeRequiresPayloadAuth, toOpenAPISecurityScheme, } from "./security-schemes.js";
+export type { ApiKeyLocation, ApiKeyScheme, ApiKeySchemeOptions, HttpBasicScheme, HttpBasicSchemeOptions, HttpBearerScheme, HttpBearerSchemeOptions, OAuth2AuthorizationCodeFlow, OAuth2ClientCredentialsFlow, OAuth2Flows, OAuth2ImplicitFlow, OAuth2PasswordFlow, OAuth2Scheme, OAuth2SchemeOptions, OpenIdConnectScheme, OpenIdConnectSchemeOptions, SecurityScheme, RequirePayloadAuthExtension, } from "./security-schemes.js";
 export { discriminator, discriminatedUnion } from "./discriminator.js";
 export type { DiscriminatorObject, DiscriminatedUnion, DiscriminatedUnionOptions, } from "./discriminator.js";
-export { session, signValue, verifySignedValue, MemorySessionStore, SESSION_HOOK_MARKER, SESSION_SECRETS_MARKER, } from "./session.js";
-export type { SessionOptions, SessionCookieOptions, SessionContext, SessionRecord, SessionStore, SessionState, } from "./session.js";
+export { session, rotateSession, signValue, verifySignedValue, MemorySessionStore, SESSION_HOOK_MARKER, SESSION_SECRETS_MARKER, } from "./session.js";
+export type { SessionOptions, SessionCookieOptions, SessionContext, SessionRecord, SessionStore, SessionState, RotateSessionOptions, } from "./session.js";
 export { fileField, multipartObject, isFileFieldSchema, isMultipartObjectSchema, } from "./multipart.js";
-export type { FileFieldSchema, FileFieldOptions, MultipartObjectOptions, MultipartShape, UploadedFile, } from "./multipart.js";
+export type { FileFieldSchema, FileFieldOptions, FileMagicBytesOption, FileMagicBytesSignature, MultipartObjectOptions, MultipartShape, UploadedFile, } from "./multipart.js";
 export { otelTracing, TRACING_SPAN_KIND_SERVER, TRACING_SPAN_STATUS_UNSET, TRACING_SPAN_STATUS_OK, TRACING_SPAN_STATUS_ERROR, } from "./tracing.js";
 export type { OtelTracingOptions, TracingAttributes, TracingAttributeValue, TracingSpan, TracingStartSpanOptions, TracingTracer, } from "./tracing.js";
-export { defineWebSocket, WebSocketRegistry, WebSocketProtocolError, WS_GUID, WS_READY_STATE, WS_OPCODE, WS_CLOSE_CODE, WS_MAX_CONTROL_PAYLOAD, computeAcceptKey, parseSubprotocols, validateSelectedSubprotocol, validateUpgrade, parseFrame, encodeFrame, encodeClosePayload, decodeClosePayload, encodeSendPayload, FrameSink, FRAME_INCOMPLETE, } from "./websocket.js";
-export type { WebSocketConnection, WebSocketContext, WebSocketHandler, WebSocketRouteEntry, HandshakeResult, ParsedFrame, MessageEvent as WebSocketMessageEvent, FrameSinkEvents, } from "./websocket.js";
+export { defineWebSocket, WebSocketRegistry, WebSocketProtocolError, WebSocketPayloadTooLargeError, WS_GUID, WS_READY_STATE, WS_OPCODE, WS_CLOSE_CODE, WS_MAX_CONTROL_PAYLOAD, DEFAULT_WS_BACKPRESSURE_LIMIT, DEFAULT_WS_MAX_PAYLOAD_LENGTH, DEFAULT_WS_IDLE_TIMEOUT_SECONDS, computeAcceptKey, parseSubprotocols, validateSelectedSubprotocol, validateUpgrade, parseFrame, encodeFrame, encodeClosePayload, decodeClosePayload, encodeSendPayload, normalizeWebSocketOptions, wsRateLimit, FrameSink, FRAME_INCOMPLETE, } from "./websocket.js";
+export type { WebSocketConnection, WebSocketContext, WebSocketHandler, WebSocketRouteEntry, NormalizedWebSocketOptions, WebSocketBeforeUpgrade, HandshakeResult, ParsedFrame, MessageEvent as WebSocketMessageEvent, FrameSinkEvents, } from "./websocket.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,8BAA8B,EAAE,MAAM,UAAU,CAAC;AAC1D,YAAY,EACV,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,aAAa,GACd,MAAM,UAAU,CAAC;AAElB,YAAY,EACV,eAAe,EACf,UAAU,EACV,UAAU,EACV,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,QAAQ,EACR,KAAK,EACL,WAAW,EACX,QAAQ,EACR,aAAa,EACb,YAAY,EACZ,QAAQ,EACR,UAAU,EACV,kBAAkB,EAClB,WAAW,EACX,iBAAiB,EACjB,YAAY,EACZ,SAAS,GACV,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,SAAS,EACT,eAAe,EACf,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAExE,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,EACL,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,QAAQ,EACR,iCAAiC,EACjC,2BAA2B,EAC3B,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAE1D,OAAO,EACL,SAAS,EACT,aAAa,EACb,qBAAqB,EACrB,IAAI,EACJ,gBAAgB,EAChB,wBAAwB,EACxB,2BAA2B,EAC3B,SAAS,EACT,MAAM,EACN,UAAU,EACV,SAAS,EACT,IAAI,EACJ,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC5E,YAAY,EACV,MAAM,EACN,QAAQ,EACR,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,4BAA4B,EAC5B,WAAW,GACZ,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtE,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAE3E,OAAO,EACL,SAAS,EACT,WAAW,EACX,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,gBAAgB,EAChB,uBAAuB,EACvB,2BAA2B,EAC3B,2BAA2B,EAC3B,WAAW,EACX,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,EACnB,mBAAmB,EACnB,0BAA0B,EAC1B,cAAc,GACf,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACvE,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,OAAO,EACP,SAAS,EACT,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,aAAa,EACb,YAAY,EACZ,YAAY,GACb,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,YAAY,GACb,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,WAAW,EACX,uBAAuB,EACvB,aAAa,GACd,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,OAAO,EACP,cAAc,EACd,SAAS,EACT,aAAa,EACb,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,2BAA2B,EAC3B,eAAe,EACf,UAAU,EACV,WAAW,EACX,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,SAAS,EACT,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,YAAY,IAAI,qBAAqB,EACrC,eAAe,GAChB,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,8BAA8B,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,iCAAiC,EAAE,MAAM,UAAU,CAAC;AAC7D,YAAY,EACV,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,aAAa,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACtE,YAAY,EACV,eAAe,EACf,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EACV,eAAe,EACf,UAAU,EACV,UAAU,EACV,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,QAAQ,EACR,KAAK,EACL,WAAW,EACX,QAAQ,EACR,UAAU,EACV,WAAW,EACX,aAAa,EACb,YAAY,EACZ,QAAQ,EACR,UAAU,EACV,kBAAkB,EAClB,WAAW,EACX,iBAAiB,EACjB,YAAY,EACZ,SAAS,GACV,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,SAAS,EACT,eAAe,EACf,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAExE,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,EACL,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,QAAQ,EACR,iCAAiC,EACjC,2BAA2B,EAC3B,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAE1D,OAAO,EACL,SAAS,EACT,aAAa,EACb,qBAAqB,EACrB,IAAI,EACJ,gBAAgB,EAChB,wBAAwB,EACxB,2BAA2B,EAC3B,SAAS,EACT,aAAa,EACb,MAAM,EACN,UAAU,EACV,SAAS,EACT,IAAI,EACJ,gBAAgB,EAChB,aAAa,EACb,4BAA4B,EAC5B,0BAA0B,EAC1B,mCAAmC,GACpC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,qCAAqC,GACtC,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,QAAQ,EACR,gCAAgC,GACjC,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,WAAW,GACZ,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,YAAY,EACV,YAAY,EACZ,UAAU,EACV,MAAM,EACN,SAAS,EACT,aAAa,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EACL,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,cAAc,EACd,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACnD,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACxE,YAAY,EACV,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAClE,YAAY,EACV,YAAY,EACZ,mBAAmB,GACpB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,oBAAoB,EACpB,WAAW,EACX,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE/E,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC5E,YAAY,EACV,MAAM,EACN,QAAQ,EACR,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,4BAA4B,EAC5B,WAAW,GACZ,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtE,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAE3E,OAAO,EACL,SAAS,EACT,WAAW,EACX,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,8BAA8B,EAC9B,iCAAiC,EACjC,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,gBAAgB,EAChB,uBAAuB,EACvB,2BAA2B,EAC3B,2BAA2B,EAC3B,WAAW,EACX,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,EACnB,mBAAmB,EACnB,0BAA0B,EAC1B,cAAc,EACd,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACvE,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,OAAO,EACP,aAAa,EACb,SAAS,EACT,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,oBAAoB,GACrB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,cAAc,EACd,YAAY,GACb,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,WAAW,EACX,uBAAuB,EACvB,aAAa,GACd,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,6BAA6B,EAC7B,OAAO,EACP,cAAc,EACd,SAAS,EACT,aAAa,EACb,sBAAsB,EACtB,6BAA6B,EAC7B,6BAA6B,EAC7B,+BAA+B,EAC/B,gBAAgB,EAChB,iBAAiB,EACjB,2BAA2B,EAC3B,eAAe,EACf,UAAU,EACV,WAAW,EACX,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,yBAAyB,EACzB,WAAW,EACX,SAAS,EACT,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,0BAA0B,EAC1B,sBAAsB,EACtB,eAAe,EACf,WAAW,EACX,YAAY,IAAI,qBAAqB,EACrC,eAAe,GAChB,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -1,17 +1,32 @@
 export { App } from "./app.js";
 export { createApp } from "./app.js";
 export { _resetPackageJsonCacheForTests } from "./app.js";
+export { _resetCrashHandlersForTests } from "./app.js";
+export { _resetInsecureDefaultsLogForTests } from "./app.js";
+export { getConnInfo, setConnInfo, assertBehindProxy, resolveClientIp, readRemoteAddress, readRemotePort, pickForwardedForByHops, } from "./conn-info.js";
+export { subdomains, PSL_SNAPSHOT_DATE, PSL_PUBLIC_SUFFIXES, MAX_SNAPSHOT_AGE_DAYS, } from "./subdomains.js";
+export { defineDependency, DEPENDENCY_MARKER } from "./dependency.js";
 export { HttpError, BadRequestError, ValidationError, NotFoundError, UnauthorizedError, ForbiddenError, MethodNotAllowedError, PayloadTooLargeError, UnsupportedMediaTypeError, TooManyRequestsError, RequestTimeoutError, InternalError, } from "./errors.js";
 export { validate, isStandardSchema } from "./schema.js";
 export { readBodyLimited, safeJsonParse, sanitizeHeaderName, sanitizeHeaderValue, timingSafeEqual, randomId, assertNoDuplicateSingletonHeaders, SMUGGLING_SINGLETON_HEADERS, verifyWebhookSignature, signWebhookPayload, assertStrongSecret, MIN_PROD_SECRET_BYTES, WEAK_SECRET_STRINGS, } from "./security.js";
-export { requestId, secureHeaders, SECURE_HEADERS_MARKER, cors, CORS_HOOK_MARKER, CORS_ORIGIN_ALLOW_MARKER, CORS_WILDCARD_ORIGIN_MARKER, rateLimit, timing, bearerAuth, basicAuth, csrf, CSRF_HOOK_MARKER, } from "./middleware.js";
+export { requestId, secureHeaders, SECURE_HEADERS_MARKER, cors, CORS_HOOK_MARKER, CORS_ORIGIN_ALLOW_MARKER, CORS_WILDCARD_ORIGIN_MARKER, rateLimit, loginThrottle, timing, bearerAuth, basicAuth, csrf, CSRF_HOOK_MARKER, requireScopes, REQUIRE_SCOPES_AGGREGATE_KEY, REQUIRE_SCOPES_HOOK_MARKER, _resetSharedRateLimitStoresForTests, } from "./middleware.js";
+export { etag } from "./etag.js";
+export { compression, COMPRESSION_HOOK_MARKER, _resetCompressionRuntimeProbeForTests, } from "./compression.js";
+export { createJwtSigner, createJwtVerifier, JwtError, DEFAULT_JWT_MAX_LIFETIME_SECONDS, } from "./jwt.js";
+export { jwk } from "./jwk.js";
+export { serializeCookie, serializeClearCookie, assertCookieAttributes, readRequestCookie, } from "./cookie.js";
+export { assertTemporalClaims, TemporalClaimError, } from "./time-claims.js";
+export { every, some, except } from "./combine.js";
+export { ipRestriction } from "./ip-restriction.js";
+export { loadShedding, LOAD_SHEDDING_MARKER } from "./load-shedding.js";
+export { defineConfig, ConfigValidationError } from "./config.js";
 export { createLogger, noopLogger, DEFAULT_REDACT_KEYS } from "./logger.js";
 export { formatStartupBanner, printStartupBanner } from "./banner.js";
 export { sseStream, sseResponse, ndjsonStream, ndjsonResponse, } from "./streaming.js";
-export { httpBearerScheme, httpBasicScheme, apiKeyScheme, oauth2Scheme, openIdConnectScheme, } from "./security-schemes.js";
+export { httpBearerScheme, httpBasicScheme, apiKeyScheme, oauth2Scheme, openIdConnectScheme, REQUIRE_PAYLOAD_AUTH_EXTENSION, securitySchemeRequiresPayloadAuth, toOpenAPISecurityScheme, } from "./security-schemes.js";
 export { discriminator, discriminatedUnion } from "./discriminator.js";
-export { session, signValue, verifySignedValue, MemorySessionStore, SESSION_HOOK_MARKER, SESSION_SECRETS_MARKER, } from "./session.js";
+export { session, rotateSession, signValue, verifySignedValue, MemorySessionStore, SESSION_HOOK_MARKER, SESSION_SECRETS_MARKER, } from "./session.js";
 export { fileField, multipartObject, isFileFieldSchema, isMultipartObjectSchema, } from "./multipart.js";
 export { otelTracing, TRACING_SPAN_KIND_SERVER, TRACING_SPAN_STATUS_UNSET, TRACING_SPAN_STATUS_OK, TRACING_SPAN_STATUS_ERROR, } from "./tracing.js";
-export { defineWebSocket, WebSocketRegistry, WebSocketProtocolError, WS_GUID, WS_READY_STATE, WS_OPCODE, WS_CLOSE_CODE, WS_MAX_CONTROL_PAYLOAD, computeAcceptKey, parseSubprotocols, validateSelectedSubprotocol, validateUpgrade, parseFrame, encodeFrame, encodeClosePayload, decodeClosePayload, encodeSendPayload, FrameSink, FRAME_INCOMPLETE, } from "./websocket.js";
+export { defineWebSocket, WebSocketRegistry, WebSocketProtocolError, WebSocketPayloadTooLargeError, WS_GUID, WS_READY_STATE, WS_OPCODE, WS_CLOSE_CODE, WS_MAX_CONTROL_PAYLOAD, DEFAULT_WS_BACKPRESSURE_LIMIT, DEFAULT_WS_MAX_PAYLOAD_LENGTH, DEFAULT_WS_IDLE_TIMEOUT_SECONDS, computeAcceptKey, parseSubprotocols, validateSelectedSubprotocol, validateUpgrade, parseFrame, encodeFrame, encodeClosePayload, decodeClosePayload, encodeSendPayload, normalizeWebSocketOptions, wsRateLimit, FrameSink, FRAME_INCOMPLETE, } from "./websocket.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,8BAA8B,EAAE,MAAM,UAAU,CAAC;AAgC1D,OAAO,EACL,SAAS,EACT,eAAe,EACf,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,GACd,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,EACL,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,QAAQ,EACR,iCAAiC,EACjC,2BAA2B,EAC3B,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,SAAS,EACT,aAAa,EACb,qBAAqB,EACrB,IAAI,EACJ,gBAAgB,EAChB,wBAAwB,EACxB,2BAA2B,EAC3B,SAAS,EACT,MAAM,EACN,UAAU,EACV,SAAS,EACT,IAAI,EACJ,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAczB,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAe5E,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGtE,OAAO,EACL,SAAS,EACT,WAAW,EACX,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AASxB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAqB/B,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAOvE,OAAO,EACL,OAAO,EACP,SAAS,EACT,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAUtB,OAAO,EACL,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AASxB,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AAUtB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,OAAO,EACP,cAAc,EACd,SAAS,EACT,aAAa,EACb,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,2BAA2B,EAC3B,eAAe,EACf,UAAU,EACV,WAAW,EACX,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,SAAS,EACT,gBAAgB,GACjB,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,8BAA8B,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,iCAAiC,EAAE,MAAM,UAAU,CAAC;AAY7D,OAAO,EACL,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AA8BtE,OAAO,EACL,SAAS,EACT,eAAe,EACf,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,GACd,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,EACL,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,QAAQ,EACR,iCAAiC,EACjC,2BAA2B,EAC3B,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,SAAS,EACT,aAAa,EACb,qBAAqB,EACrB,IAAI,EACJ,gBAAgB,EAChB,wBAAwB,EACxB,2BAA2B,EAC3B,SAAS,EACT,aAAa,EACb,MAAM,EACN,UAAU,EACV,SAAS,EACT,IAAI,EACJ,gBAAgB,EAChB,aAAa,EACb,4BAA4B,EAC5B,0BAA0B,EAC1B,mCAAmC,GACpC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,qCAAqC,GACtC,MAAM,kBAAkB,CAAC;AAK1B,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,QAAQ,EACR,gCAAgC,GACjC,MAAM,UAAU,CAAC;AAQlB,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAQ/B,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAM1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEnD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAKxE,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAoBlE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAe5E,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGtE,OAAO,EACL,SAAS,EACT,WAAW,EACX,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AASxB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,8BAA8B,EAC9B,iCAAiC,EACjC,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAsB/B,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAOvE,OAAO,EACL,OAAO,EACP,aAAa,EACb,SAAS,EACT,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAWtB,OAAO,EACL,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AAWxB,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AAUtB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,6BAA6B,EAC7B,OAAO,EACP,cAAc,EACd,SAAS,EACT,aAAa,EACb,sBAAsB,EACtB,6BAA6B,EAC7B,6BAA6B,EAC7B,+BAA+B,EAC/B,gBAAgB,EAChB,iBAAiB,EACjB,2BAA2B,EAC3B,eAAe,EACf,UAAU,EACV,WAAW,EACX,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,yBAAyB,EACzB,WAAW,EACX,SAAS,EACT,gBAAgB,GACjB,MAAM,gBAAgB,CAAC"}

package/dist/ip-restriction.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Network-layer access control for {@link Hooks}. The {@link ipRestriction}
+ * middleware enforces IPv4 / IPv6 / CIDR allow- and deny-lists. Because the
+ * Web-standard {@link Request} does not expose a peer address, callers must
+ * either provide a trusted resolver or explicitly opt in to trusted proxy
+ * headers.
+ *
+ * @since 0.19.0
+ */
+import type { BaseContext, Hooks } from "./types.js";
+/**
+ * Options for {@link ipRestriction}. At least one of `allow` or `deny` must
+ * be provided; supplying both runs deny-first then allow-otherwise (deny
+ * wins on conflict, matching the principle of least privilege).
+ *
+ * @since 0.19.0
+ */
+export interface IpRestrictionOptions {
+    /**
+     * IP addresses or CIDR ranges (e.g. `"10.0.0.0/8"`, `"2001:db8::/32"`,
+     * `"203.0.113.42"`) that should be allowed. When set, any peer whose
+     * address does not match a pattern in this list is rejected with HTTP
+     * `403 Forbidden`. Mutually exclusive with running without any list.
+     */
+    allow?: readonly string[];
+    /**
+     * IP addresses or CIDR ranges that should be rejected outright. Matches
+     * here always lose to nothing — even an explicit allow-list entry will
+     * not override a deny. Useful for blocking known bad ranges while
+     * keeping a broad allow-list.
+     */
+    deny?: readonly string[];
+    /**
+     * Override the source of the client IP. By default Daloy fails closed
+     * because Web-standard `Request` objects do not expose the peer address.
+     * Provide a function to read adapter connection metadata or a trusted
+     * custom header (e.g. a CDN-specific identifier).
+     */
+    resolveIp?: (ctx: BaseContext<any, any>) => string | undefined;
+    /**
+     * Read `X-Forwarded-For` / `X-Real-IP` in the default resolver. Defaults
+     * to `false` because those headers are client-spoofable unless every
+     * request reaches Daloy through a proxy chain you control. Pair with
+     * `new App({ trustProxy: true })` in production.
+     */
+    trustProxyHeaders?: boolean;
+    /**
+     * Response message when a request is rejected. Defaults to
+     * `"IP address not permitted"`. Avoid echoing the client IP back —
+     * doing so can leak proxy topology to attackers.
+     */
+    message?: string;
+}
+/**
+ * Block or allow requests by source IP / CIDR range. In direct Web-standard
+ * runtimes, pass `resolveIp` from the adapter-specific connection metadata.
+ * Behind a trusted proxy chain, set `trustProxyHeaders: true` to read
+ * `X-Forwarded-For` / `X-Real-IP`.
+ *
+ * @example
+ * ```ts
+ * app.use(ipRestriction({
+ *   allow: ["10.0.0.0/8", "::1"],
+ *   deny: ["10.6.6.0/24"],
+ *   trustProxyHeaders: true,
+ * }));
+ * ```
+ *
+ * On reject the middleware throws a {@link ForbiddenError}, which Daloy
+ * renders as RFC 9457 `application/problem+json`.
+ *
+ * @since 0.19.0
+ */
+export declare function ipRestriction(opts: IpRestrictionOptions): Hooks;
+//# sourceMappingURL=ip-restriction.d.ts.map

package/dist/ip-restriction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-restriction.d.ts","sourceRoot":"","sources":["../src/ip-restriction.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAGrD;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B;;;;;OAKG;IACH,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,MAAM,GAAG,SAAS,CAAC;IAC/D;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAaD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,KAAK,CAyB/D"}