@daloyjs/core 0.30.0 → 0.34.0

package/dist/docs.d.ts

@@ -1,16 +1,27 @@
 /**
  * Built-in API documentation handlers.
  *
- * Both serve a single self-contained HTML page that loads the spec at
- * `specUrl` from a CDN. No build step, no extra deps.
+ * Scalar and Swagger UI helpers serve a single HTML page that loads the spec
+ * at `specUrl` and fetches UI assets from a CDN by default. No build step,
+ * no extra deps.
  *
  * (You can self-host the assets if your CSP forbids CDNs.)
  */
+/** JSON primitive accepted by {@link ScalarReferenceConfiguration}. */
 export type ScalarJsonPrimitive = string | number | boolean | null;
+/** Recursive JSON value accepted by Scalar configuration fields. */
 export type ScalarJsonValue = ScalarJsonPrimitive | ScalarJsonValue[] | {
     [key: string]: ScalarJsonValue | undefined;
 };
+/** Built-in Scalar API Reference color theme names. */
 export type ScalarTheme = "alternate" | "default" | "moon" | "purple" | "solarized" | "bluePlanet" | "saturn" | "kepler" | "mars" | "deepSpace" | "laserwave" | "none";
+/**
+ * Subset of Scalar API Reference configuration safe to serialize from the
+ * server (function callbacks and inline `spec` are intentionally excluded).
+ *
+ * Forwarded verbatim as the `data-configuration` attribute on the Scalar
+ * script tag.
+ */
 export interface ScalarReferenceConfiguration {
     [key: string]: ScalarJsonValue | undefined;
     theme?: ScalarTheme;
@@ -81,29 +92,65 @@ export interface ScalarReferenceConfiguration {
     spec?: never;
     url?: never;
 }
+/** Shared options for {@link scalarHtml} and {@link swaggerUiHtml}. */
 export interface DocsOptions {
+    /** Absolute or relative URL of the OpenAPI document to render. */
     specUrl: string;
+    /** `<title>` of the generated HTML page. */
     title?: string;
+    /** Override CDN URLs for the docs UI assets (useful for self-hosting). */
     assets?: {
         scalarScriptUrl?: string;
         swaggerUiCssUrl?: string;
         swaggerUiBundleUrl?: string;
     };
+    /** CSP `nonce` to apply to inline/script tags; must match the response CSP. */
     scriptNonce?: string;
 }
+/** Options for {@link scalarHtml}; adds Scalar-specific UI configuration. */
 export interface ScalarHtmlOptions extends DocsOptions {
+    /** Forwarded to the Scalar `<script id="api-reference">` tag. */
     configuration?: ScalarReferenceConfiguration;
 }
+/** Options for {@link docsContentSecurityPolicy}. */
 export interface DocsContentSecurityPolicyOptions {
+    /** Extra origins to allow for `script-src` / `style-src` (defaults to jsDelivr). */
     assetOrigins?: string[];
+    /** When set, allows nonce-protected inline scripts instead of `'unsafe-inline'`. */
     scriptNonce?: string;
+    /** When `false`, omits `'unsafe-inline'` from `style-src`. Defaults to `true`. */
     allowInlineStyles?: boolean;
 }
+/** Options for {@link htmlResponse}. */
 export interface HtmlResponseOptions extends DocsContentSecurityPolicyOptions {
+    /** Override the computed `content-security-policy` header verbatim. */
     contentSecurityPolicy?: string;
 }
+/**
+ * Render a Scalar API Reference HTML page that loads `opts.specUrl`.
+ *
+ * The output is a single HTML document with configurable external assets;
+ * pair it with {@link htmlResponse} (or your own `Response`) and serve from
+ * any route.
+ */
 export declare function scalarHtml(opts: ScalarHtmlOptions): string;
+/**
+ * Render a Swagger UI HTML page that loads `opts.specUrl`. Same usage as
+ * {@link scalarHtml} but emits the classic Swagger UI bundle.
+ */
 export declare function swaggerUiHtml(opts: DocsOptions): string;
+/**
+ * Build a Content-Security-Policy string compatible with the docs HTML
+ * produced by {@link scalarHtml} / {@link swaggerUiHtml}.
+ *
+ * Allows `'self'` plus the listed `assetOrigins` (default: jsDelivr) and
+ * either `'unsafe-inline'` or the provided `scriptNonce` for scripts.
+ */
 export declare function docsContentSecurityPolicy(opts?: DocsContentSecurityPolicyOptions): string;
+/**
+ * Wrap a docs HTML string in a `Response` with safe defaults:
+ * `text/html` content type, `nosniff`, `no-referrer`, and a CSP from
+ * {@link docsContentSecurityPolicy} (or a caller-supplied override).
+ */
 export declare function htmlResponse(html: string, opts?: HtmlResponseOptions): Response;
 //# sourceMappingURL=docs.d.ts.map

package/dist/docs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../src/docs.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;AACnE,MAAM,MAAM,eAAe,GACvB,mBAAmB,GACnB,eAAe,EAAE,GACjB;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAAA;CAAE,CAAC;AAEnD,MAAM,MAAM,WAAW,GACnB,WAAW,GACX,SAAS,GACT,MAAM,GACN,QAAQ,GACR,WAAW,GACX,YAAY,GACZ,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,WAAW,GACX,WAAW,GACX,MAAM,CAAC;AAEX,MAAM,WAAW,4BAA4B;IAC3C,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAAC;IAC3C,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACtC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC9B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kBAAkB,CAAC,EAAE,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;IACtD,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;IACpE,oBAAoB,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IAC1C,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,uBAAuB,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,gBAAgB,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IACtC,cAAc,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAAA;KAAE,CAAC;IAChE,iBAAiB,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAAA;KAAE,CAAC;IACnE,QAAQ,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAAA;KAAE,CAAC;IAC1D,GAAG,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAAA;KAAE,CAAC;IACrD,WAAW,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAAA;KAAE,CAAC;IAC7D,OAAO,CAAC,EAAE,eAAe,EAAE,CAAC;IAC5B,OAAO,CAAC,EAAE,KAAK,CAAC;IAChB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,mBAAmB,CAAC,EAAE,KAAK,CAAC;IAC5B,iBAAiB,CAAC,EAAE,KAAK,CAAC;IAC1B,qBAAqB,CAAC,EAAE,KAAK,CAAC;IAC9B,eAAe,CAAC,EAAE,KAAK,CAAC;IACxB,mBAAmB,CAAC,EAAE,KAAK,CAAC;IAC5B,eAAe,CAAC,EAAE,KAAK,CAAC;IACxB,gBAAgB,CAAC,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,EAAE,KAAK,CAAC;IACjB,aAAa,CAAC,EAAE,KAAK,CAAC;IACtB,cAAc,CAAC,EAAE,KAAK,CAAC;IACvB,UAAU,CAAC,EAAE,KAAK,CAAC;IACnB,cAAc,CAAC,EAAE,KAAK,CAAC;IACvB,YAAY,CAAC,EAAE,KAAK,CAAC;IACrB,OAAO,CAAC,EAAE,KAAK,CAAC;IAChB,QAAQ,CAAC,EAAE,KAAK,CAAC;IACjB,OAAO,CAAC,EAAE,KAAK,CAAC;IAChB,IAAI,CAAC,EAAE,KAAK,CAAC;IACb,GAAG,CAAC,EAAE,KAAK,CAAC;CACb;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE;QACP,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACpD,aAAa,CAAC,EAAE,4BAA4B,CAAC;CAC9C;AAED,MAAM,WAAW,gCAAgC;IAC/C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAoB,SAAQ,gCAAgC;IAC3E,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAQD,wBAAgB,UAAU,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,CAqB1D;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAuBvD;AAED,wBAAgB,yBAAyB,CACvC,IAAI,GAAE,gCAAqC,GAC1C,MAAM,CAgBR;AAED,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,mBAAwB,GAC7B,QAAQ,CAeV"}
+{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../src/docs.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,uEAAuE;AACvE,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;AACnE,oEAAoE;AACpE,MAAM,MAAM,eAAe,GACvB,mBAAmB,GACnB,eAAe,EAAE,GACjB;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAAA;CAAE,CAAC;AAEnD,uDAAuD;AACvD,MAAM,MAAM,WAAW,GACnB,WAAW,GACX,SAAS,GACT,MAAM,GACN,QAAQ,GACR,WAAW,GACX,YAAY,GACZ,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,WAAW,GACX,WAAW,GACX,MAAM,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,WAAW,4BAA4B;IAC3C,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAAC;IAC3C,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACtC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC9B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kBAAkB,CAAC,EAAE,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;IACtD,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;IACpE,oBAAoB,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IAC1C,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,uBAAuB,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,gBAAgB,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IACtC,cAAc,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAAA;KAAE,CAAC;IAChE,iBAAiB,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAAA;KAAE,CAAC;IACnE,QAAQ,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAAA;KAAE,CAAC;IAC1D,GAAG,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAAA;KAAE,CAAC;IACrD,WAAW,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAAA;KAAE,CAAC;IAC7D,OAAO,CAAC,EAAE,eAAe,EAAE,CAAC;IAC5B,OAAO,CAAC,EAAE,KAAK,CAAC;IAChB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,mBAAmB,CAAC,EAAE,KAAK,CAAC;IAC5B,iBAAiB,CAAC,EAAE,KAAK,CAAC;IAC1B,qBAAqB,CAAC,EAAE,KAAK,CAAC;IAC9B,eAAe,CAAC,EAAE,KAAK,CAAC;IACxB,mBAAmB,CAAC,EAAE,KAAK,CAAC;IAC5B,eAAe,CAAC,EAAE,KAAK,CAAC;IACxB,gBAAgB,CAAC,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,EAAE,KAAK,CAAC;IACjB,aAAa,CAAC,EAAE,KAAK,CAAC;IACtB,cAAc,CAAC,EAAE,KAAK,CAAC;IACvB,UAAU,CAAC,EAAE,KAAK,CAAC;IACnB,cAAc,CAAC,EAAE,KAAK,CAAC;IACvB,YAAY,CAAC,EAAE,KAAK,CAAC;IACrB,OAAO,CAAC,EAAE,KAAK,CAAC;IAChB,QAAQ,CAAC,EAAE,KAAK,CAAC;IACjB,OAAO,CAAC,EAAE,KAAK,CAAC;IAChB,IAAI,CAAC,EAAE,KAAK,CAAC;IACb,GAAG,CAAC,EAAE,KAAK,CAAC;CACb;AAED,uEAAuE;AACvE,MAAM,WAAW,WAAW;IAC1B,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,MAAM,CAAC,EAAE;QACP,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,6EAA6E;AAC7E,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACpD,iEAAiE;IACjE,aAAa,CAAC,EAAE,4BAA4B,CAAC;CAC9C;AAED,qDAAqD;AACrD,MAAM,WAAW,gCAAgC;IAC/C,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kFAAkF;IAClF,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,wCAAwC;AACxC,MAAM,WAAW,mBAAoB,SAAQ,gCAAgC;IAC3E,uEAAuE;IACvE,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAQD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,CAqB1D;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAuBvD;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,GAAE,gCAAqC,GAC1C,MAAM,CAgBR;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,mBAAwB,GAC7B,QAAQ,CAeV"}

package/dist/docs.js

@@ -1,8 +1,9 @@
 /**
  * Built-in API documentation handlers.
  *
- * Both serve a single self-contained HTML page that loads the spec at
- * `specUrl` from a CDN. No build step, no extra deps.
+ * Scalar and Swagger UI helpers serve a single HTML page that loads the spec
+ * at `specUrl` and fetches UI assets from a CDN by default. No build step,
+ * no extra deps.
  *
  * (You can self-host the assets if your CSP forbids CDNs.)
  */
@@ -10,6 +11,13 @@ const JSDELIVR_ORIGIN = "https://cdn.jsdelivr.net";
 function nonceAttr(nonce) {
     return nonce ? ` nonce="${escapeHtml(nonce)}"` : "";
 }
+/**
+ * Render a Scalar API Reference HTML page that loads `opts.specUrl`.
+ *
+ * The output is a single HTML document with configurable external assets;
+ * pair it with {@link htmlResponse} (or your own `Response`) and serve from
+ * any route.
+ */
 export function scalarHtml(opts) {
     const title = escapeHtml(opts.title ?? "API Reference");
     const url = escapeHtml(opts.specUrl);
@@ -27,6 +35,10 @@ export function scalarHtml(opts) {
 <script src="${scriptUrl}"${nonce}></script>
 </body></html>`;
 }
+/**
+ * Render a Swagger UI HTML page that loads `opts.specUrl`. Same usage as
+ * {@link scalarHtml} but emits the classic Swagger UI bundle.
+ */
 export function swaggerUiHtml(opts) {
     const title = escapeHtml(opts.title ?? "API Docs");
     const url = escapeHtml(opts.specUrl);
@@ -47,6 +59,13 @@ export function swaggerUiHtml(opts) {
 <script${nonce}>window.onload=()=>SwaggerUIBundle({url:"${url}",dom_id:"#swagger"});</script>
 </body></html>`;
 }
+/**
+ * Build a Content-Security-Policy string compatible with the docs HTML
+ * produced by {@link scalarHtml} / {@link swaggerUiHtml}.
+ *
+ * Allows `'self'` plus the listed `assetOrigins` (default: jsDelivr) and
+ * either `'unsafe-inline'` or the provided `scriptNonce` for scripts.
+ */
 export function docsContentSecurityPolicy(opts = {}) {
     const assetOrigins = opts.assetOrigins ?? [JSDELIVR_ORIGIN];
     const scriptSrc = ["'self'", ...assetOrigins];
@@ -65,6 +84,11 @@ export function docsContentSecurityPolicy(opts = {}) {
         "connect-src 'self'",
     ].join("; ");
 }
+/**
+ * Wrap a docs HTML string in a `Response` with safe defaults:
+ * `text/html` content type, `nosniff`, `no-referrer`, and a CSP from
+ * {@link docsContentSecurityPolicy} (or a caller-supplied override).
+ */
 export function htmlResponse(html, opts = {}) {
     return new Response(html, {
         headers: {

package/dist/docs.js.map

@@ -1 +1 @@
-{"version":3,"file":"docs.js","sourceRoot":"","sources":["../src/docs.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA4GH,MAAM,eAAe,GAAG,0BAA0B,CAAC;AAEnD,SAAS,SAAS,CAAC,KAAyB;IAC1C,OAAO,KAAK,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAuB;IAChD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,eAAe,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,UAAU,CAC1B,IAAI,CAAC,MAAM,EAAE,eAAe;QAC1B,GAAG,eAAe,4BAA4B,CACjD,CAAC;IACF,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,uBAAuB,CAC3C,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,aAAa,CACnB,CAAC;IACF,OAAO;;;;SAIA,KAAK;;uCAEyB,GAAG,IAAI,aAAa,GAAG,KAAK;eACpD,SAAS,IAAI,KAAK;eAClB,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAiB;IAC7C,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,UAAU,CACvB,IAAI,CAAC,MAAM,EAAE,eAAe;QAC1B,GAAG,eAAe,qCAAqC,CAC1D,CAAC;IACF,MAAM,SAAS,GAAG,UAAU,CAC1B,IAAI,CAAC,MAAM,EAAE,kBAAkB;QAC7B,GAAG,eAAe,2CAA2C,CAChE,CAAC;IACF,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1C,OAAO;;;;SAIA,KAAK;+BACiB,MAAM;;;eAGtB,SAAS,IAAI,KAAK;SACxB,KAAK,4CAA4C,GAAG;eAC9C,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,OAAyC,EAAE;IAE3C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,CAAC,QAAQ,EAAE,GAAG,YAAY,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,WAAW;QAAE,SAAS,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;;QAC/D,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAEvC,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,GAAG,YAAY,CAAC,CAAC;IAC7C,IAAI,IAAI,CAAC,iBAAiB,KAAK,KAAK;QAAE,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAEvE,OAAO;QACL,oBAAoB;QACpB,cAAc,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACnC,aAAa,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACjC,6BAA6B;QAC7B,oBAAoB;KACrB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,OAA4B,EAAE;IAE9B,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,yBAAyB,EACvB,IAAI,CAAC,qBAAqB;gBAC1B,yBAAyB,CAAC;oBACxB,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;iBAC1C,CAAC;YACJ,wBAAwB,EAAE,SAAS;YACnC,iBAAiB,EAAE,aAAa;SACjC;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CACd,UAAU,EACV,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CACvE,CAAC,CACD,CACL,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,OAAe,EACf,aAAuD;IAEvD,IAAI,CAAC,aAAa;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,EACJ,OAAO,EAAE,QAAQ,EACjB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,QAAQ,EACjB,OAAO,EAAE,QAAQ,EACjB,IAAI,EAAE,KAAK,EACX,GAAG,EAAE,IAAI,EACT,GAAG,eAAe,EACnB,GAAG,aAAa,CAAC;IAClB,OAAO,wBAAwB,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,eAAe,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC;AACrG,CAAC"}
+{"version":3,"file":"docs.js","sourceRoot":"","sources":["../src/docs.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAmIH,MAAM,eAAe,GAAG,0BAA0B,CAAC;AAEnD,SAAS,SAAS,CAAC,KAAyB;IAC1C,OAAO,KAAK,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AACtD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,IAAuB;IAChD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,eAAe,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,UAAU,CAC1B,IAAI,CAAC,MAAM,EAAE,eAAe;QAC1B,GAAG,eAAe,4BAA4B,CACjD,CAAC;IACF,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,uBAAuB,CAC3C,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,aAAa,CACnB,CAAC;IACF,OAAO;;;;SAIA,KAAK;;uCAEyB,GAAG,IAAI,aAAa,GAAG,KAAK;eACpD,SAAS,IAAI,KAAK;eAClB,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAiB;IAC7C,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,UAAU,CACvB,IAAI,CAAC,MAAM,EAAE,eAAe;QAC1B,GAAG,eAAe,qCAAqC,CAC1D,CAAC;IACF,MAAM,SAAS,GAAG,UAAU,CAC1B,IAAI,CAAC,MAAM,EAAE,kBAAkB;QAC7B,GAAG,eAAe,2CAA2C,CAChE,CAAC;IACF,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1C,OAAO;;;;SAIA,KAAK;+BACiB,MAAM;;;eAGtB,SAAS,IAAI,KAAK;SACxB,KAAK,4CAA4C,GAAG;eAC9C,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAAyC,EAAE;IAE3C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,CAAC,QAAQ,EAAE,GAAG,YAAY,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,WAAW;QAAE,SAAS,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;;QAC/D,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAEvC,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,GAAG,YAAY,CAAC,CAAC;IAC7C,IAAI,IAAI,CAAC,iBAAiB,KAAK,KAAK;QAAE,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAEvE,OAAO;QACL,oBAAoB;QACpB,cAAc,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACnC,aAAa,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACjC,6BAA6B;QAC7B,oBAAoB;KACrB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,OAA4B,EAAE;IAE9B,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,yBAAyB,EACvB,IAAI,CAAC,qBAAqB;gBAC1B,yBAAyB,CAAC;oBACxB,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;iBAC1C,CAAC;YACJ,wBAAwB,EAAE,SAAS;YACnC,iBAAiB,EAAE,aAAa;SACjC;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CACd,UAAU,EACV,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CACvE,CAAC,CACD,CACL,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,OAAe,EACf,aAAuD;IAEvD,IAAI,CAAC,aAAa;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,EACJ,OAAO,EAAE,QAAQ,EACjB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,QAAQ,EACjB,OAAO,EAAE,QAAQ,EACjB,IAAI,EAAE,KAAK,EACX,GAAG,EAAE,IAAI,EACT,GAAG,eAAe,EACnB,GAAG,aAAa,CAAC;IAClB,OAAO,wBAAwB,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,eAAe,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC;AACrG,CAAC"}

package/dist/errors.d.ts

@@ -49,7 +49,96 @@ export interface ProblemRenderOptions {
     production?: boolean;
     /** Request id stamped into `instance` as `urn:request:<id>` for log correlation. */
     requestId?: string;
+    /**
+     * Extra response headers (typically `ctx.set.headers`) to merge
+     * onto the rendered problem response so per-request state (CSRF rotation,
+     * session renewal, request-id, secure-headers) is not lost when a handler
+     * throws an {@link HttpError}. Existing headers baked into the error
+     * (e.g. `cache-control: no-store` on `UnauthorizedError`) win over the
+     * supplied set — they were declared by the error class for a reason and
+     * are not overridable by ad-hoc Context state.
+     *
+     * @since 0.32.0
+     */
+    contextHeaders?: Headers | HeadersInit;
+}
+/**
+ * Headers that are safe to attach to a custom error response
+ * (typically a `WWW-Authenticate` challenge built by an auth helper). Any
+ * header outside this allowlist on a custom response would leak state from
+ * the request scope into a generic error response and is refused at
+ * construction time by {@link httpError}.
+ *
+ * @since 0.32.0
+ */
+export declare const SAFE_CUSTOM_ERROR_RESPONSE_HEADERS: ReadonlySet<string>;
+/**
+ * Thrown when {@link httpError} is asked to attach a custom
+ * `Response` whose headers would leak request-scoped state (cookies,
+ * caching directives other than `no-store` / `no-cache`, server-timing,
+ * `X-*-Token` debug headers) into the error response.
+ *
+ * @since 0.32.0
+ */
+export declare class MessageLeakError extends Error {
+    readonly offendingHeaders: ReadonlyArray<{
+        name: string;
+        reason: string;
+    }>;
+    constructor(offendingHeaders: ReadonlyArray<{
+        name: string;
+        reason: string;
+    }>);
+}
+/**
+ * @internal — header-safety check applied by {@link httpError} when a custom
+ * `res` is supplied. Exported for audits and tests.
+ */
+export declare function checkCustomErrorResponseHeaders(headers: Headers): Array<{
+    name: string;
+    reason: string;
+}>;
+/**
+ * Factory for constructing an {@link HttpError} with an optional
+ * custom `res` (typically a `WWW-Authenticate` challenge). Refuses-at-
+ * construction in production under `secureDefaults` when the custom
+ * response carries headers that would leak request-scoped state — see
+ * {@link SAFE_CUSTOM_ERROR_RESPONSE_HEADERS} and {@link MessageLeakError}.
+ *
+ * @since 0.32.0
+ */
+export interface HttpErrorOptions {
+    status: number;
+    problem: Partial<ProblemDetails> & {
+        title: string;
+    };
+    /** Plain headers merged onto the rendered response. */
+    headers?: Record<string, string>;
+    /**
+     * Custom `Response` providing additional headers (typically a
+     * `WWW-Authenticate` challenge). Body is ignored; only headers are
+     * extracted. Headers are validated against the safe allowlist.
+     */
+    res?: Response;
+    /**
+     * Override the production check. Defaults to
+     * `process.env.NODE_ENV === "production"`.
+     */
+    production?: boolean;
+    /**
+     * Override the secureDefaults check. Defaults to `true`. The refuse-at-
+     * construction behavior only activates when `production && secureDefaults`
+     * are both true.
+     */
+    secureDefaults?: boolean;
 }
+/**
+ * Build an {@link HttpError} with optional safe-header extraction from a
+ * custom `Response`. See {@link HttpErrorOptions}.
+ *
+ * @since 0.32.0
+ */
+export declare function httpError(opts: HttpErrorOptions): HttpError;
 /**
  * Base class for every DaloyJS HTTP error.
  *

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,cAAc;IAC7B,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,oDAAoD;IACpD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,8FAA8F;IAC9F,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,oFAAoF;IACpF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAGxC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,EACpD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAclC;;;;;;;OAOG;IACH,UAAU,CAAC,IAAI,GAAE,oBAAyB,GAAG,QAAQ;CAetD;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,eAAgB,SAAQ,SAAS;gBAChC,MAAM,CAAC,EAAE,MAAM;CAQ5B;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,eAAgB,SAAQ,SAAS;gBAE1C,KAAK,EAAE,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,EAC9C,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAUnD;AAED;;;;;;GAMG;AACH,qBAAa,aAAc,SAAQ,SAAS;gBAC9B,MAAM,CAAC,EAAE,MAAM;CAQ5B;AAED;;;;;;;GAOG;AACH,qBAAa,iBAAkB,SAAQ,SAAS;gBAClC,MAAM,CAAC,EAAE,MAAM;CAc5B;AAED;;;;;;;GAOG;AACH,qBAAa,cAAe,SAAQ,SAAS;gBAC/B,MAAM,CAAC,EAAE,MAAM;CAa5B;AAED;;;;;;;;GAQG;AACH,qBAAa,qBAAsB,SAAQ,SAAS;gBACtC,KAAK,EAAE,MAAM,EAAE;CAW5B;AAED;;;;;;;;GAQG;AACH,qBAAa,oBAAqB,SAAQ,SAAS;gBACrC,KAAK,EAAE,MAAM;CAQ1B;AAED;;;;;;;;GAQG;AACH,qBAAa,yBAA0B,SAAQ,SAAS;gBAC1C,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE;CAQ5C;AAED;;;;;;;;GAQG;AACH,qBAAa,oBAAqB,SAAQ,SAAS;gBACrC,iBAAiB,CAAC,EAAE,MAAM;CAevC;AAED;;;;;;;;GAQG;AACH,qBAAa,mBAAoB,SAAQ,SAAS;gBACpC,EAAE,EAAE,MAAM;CAQvB;AAED;;;;;;;;GAQG;AACH,qBAAa,aAAc,SAAQ,SAAS;gBAC9B,MAAM,CAAC,EAAE,MAAM;CAQ5B"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,cAAc;IAC7B,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,oDAAoD;IACpD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,8FAA8F;IAC9F,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,oFAAoF;IACpF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC;CACxC;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,kCAAkC,EAAE,WAAW,CAAC,MAAM,CAUjE,CAAC;AAEH;;;;;;;GAOG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;gBAEzE,gBAAgB,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAcpE;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,OAAO,GACf,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA+BzC;AA4BD;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC;;;;OAIG;IACH,GAAG,CAAC,EAAE,QAAQ,CAAC;IACf;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,SAAS,CAmB3D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAGxC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,EACpD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAclC;;;;;;;OAOG;IACH,UAAU,CAAC,IAAI,GAAE,oBAAyB,GAAG,QAAQ;CA8BtD;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,eAAgB,SAAQ,SAAS;gBAChC,MAAM,CAAC,EAAE,MAAM;CAQ5B;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,eAAgB,SAAQ,SAAS;gBAE1C,KAAK,EAAE,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,EAC9C,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAUnD;AAED;;;;;;GAMG;AACH,qBAAa,aAAc,SAAQ,SAAS;gBAC9B,MAAM,CAAC,EAAE,MAAM;CAQ5B;AAED;;;;;;;GAOG;AACH,qBAAa,iBAAkB,SAAQ,SAAS;gBAClC,MAAM,CAAC,EAAE,MAAM;CAc5B;AAED;;;;;;;GAOG;AACH,qBAAa,cAAe,SAAQ,SAAS;gBAC/B,MAAM,CAAC,EAAE,MAAM;CAa5B;AAED;;;;;;;;GAQG;AACH,qBAAa,qBAAsB,SAAQ,SAAS;gBACtC,KAAK,EAAE,MAAM,EAAE;CAW5B;AAED;;;;;;;;GAQG;AACH,qBAAa,oBAAqB,SAAQ,SAAS;gBACrC,KAAK,EAAE,MAAM;CAQ1B;AAED;;;;;;;;GAQG;AACH,qBAAa,yBAA0B,SAAQ,SAAS;gBAC1C,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE;CAQ5C;AAED;;;;;;;;GAQG;AACH,qBAAa,oBAAqB,SAAQ,SAAS;gBACrC,iBAAiB,CAAC,EAAE,MAAM;CAevC;AAED;;;;;;;;GAQG;AACH,qBAAa,mBAAoB,SAAQ,SAAS;gBACpC,EAAE,EAAE,MAAM;CAQvB;AAED;;;;;;;;GAQG;AACH,qBAAa,aAAc,SAAQ,SAAS;gBAC9B,MAAM,CAAC,EAAE,MAAM;CAQ5B"}

package/dist/errors.js

@@ -8,6 +8,132 @@
  * Production-mode rendering scrubs `detail` for 5xx responses so internal
  * messages never leak to clients (security: information disclosure).
  */
+/**
+ * Headers that are safe to attach to a custom error response
+ * (typically a `WWW-Authenticate` challenge built by an auth helper). Any
+ * header outside this allowlist on a custom response would leak state from
+ * the request scope into a generic error response and is refused at
+ * construction time by {@link httpError}.
+ *
+ * @since 0.32.0
+ */
+export const SAFE_CUSTOM_ERROR_RESPONSE_HEADERS = new Set([
+    "www-authenticate",
+    "proxy-authenticate",
+    "retry-after",
+    "content-type",
+    "content-language",
+    "content-length",
+    // `cache-control` is allowed only when its value is `no-store` or
+    // `no-cache`; that constraint is enforced in the check itself.
+    "cache-control",
+]);
+/**
+ * Thrown when {@link httpError} is asked to attach a custom
+ * `Response` whose headers would leak request-scoped state (cookies,
+ * caching directives other than `no-store` / `no-cache`, server-timing,
+ * `X-*-Token` debug headers) into the error response.
+ *
+ * @since 0.32.0
+ */
+export class MessageLeakError extends Error {
+    offendingHeaders;
+    constructor(offendingHeaders) {
+        const summary = offendingHeaders
+            .map((h) => `${h.name} (${h.reason})`)
+            .join(", ");
+        super(`httpError({ res }): custom error response carries disallowed header(s): ${summary}. ` +
+            "Only WWW-Authenticate, Proxy-Authenticate, Retry-After, Content-Type, " +
+            "Content-Language, Content-Length, and Cache-Control (no-store|no-cache) " +
+            "are permitted on a custom error response.");
+        this.name = "MessageLeakError";
+        this.offendingHeaders = offendingHeaders;
+    }
+}
+/**
+ * @internal — header-safety check applied by {@link httpError} when a custom
+ * `res` is supplied. Exported for audits and tests.
+ */
+export function checkCustomErrorResponseHeaders(headers) {
+    const offending = [];
+    headers.forEach((value, name) => {
+        const lower = name.toLowerCase();
+        if (lower === "cache-control") {
+            const token = value.trim().toLowerCase();
+            if (token !== "no-store" && token !== "no-cache") {
+                offending.push({
+                    name,
+                    reason: `cache-control must be "no-store" or "no-cache"; got ${JSON.stringify(value)}`,
+                });
+            }
+            return;
+        }
+        if (lower === "set-cookie" || lower === "set-cookie2") {
+            offending.push({ name, reason: "cookies are not permitted on a generic error response" });
+            return;
+        }
+        if (lower === "server-timing") {
+            offending.push({ name, reason: "Server-Timing is a side-channel leak in error responses" });
+            return;
+        }
+        if (lower.startsWith("x-") && lower.endsWith("-token")) {
+            offending.push({ name, reason: "X-*-Token headers are request-scoped" });
+            return;
+        }
+        if (!SAFE_CUSTOM_ERROR_RESPONSE_HEADERS.has(lower)) {
+            offending.push({ name, reason: "not in the safe-custom-error-response allowlist" });
+        }
+    });
+    return offending;
+}
+function defaultIsProduction() {
+    return typeof process !== "undefined" && process.env?.NODE_ENV === "production";
+}
+function defaultSecureDefaults() {
+    // Mirrors App({ secureDefaults: true }) — on unless explicitly opted out.
+    return true;
+}
+function isSafeCustomErrorHeaderValue(name, value) {
+    const lower = name.toLowerCase();
+    return (SAFE_CUSTOM_ERROR_RESPONSE_HEADERS.has(lower) &&
+        !(lower === "cache-control" &&
+            value.trim().toLowerCase() !== "no-store" &&
+            value.trim().toLowerCase() !== "no-cache"));
+}
+function shouldCopyCustomErrorHeader(name, value) {
+    if (!isSafeCustomErrorHeaderValue(name, value))
+        return false;
+    // The custom Response body is intentionally ignored by httpError({ res });
+    // forwarding its Content-Length would describe the wrong problem+json body.
+    return name.toLowerCase() !== "content-length";
+}
+/**
+ * Build an {@link HttpError} with optional safe-header extraction from a
+ * custom `Response`. See {@link HttpErrorOptions}.
+ *
+ * @since 0.32.0
+ */
+export function httpError(opts) {
+    const headers = new Headers(opts.headers);
+    if (opts.res) {
+        const isProd = opts.production ?? defaultIsProduction();
+        const secureDefaults = opts.secureDefaults ?? defaultSecureDefaults();
+        const offending = checkCustomErrorResponseHeaders(opts.res.headers);
+        if (isProd && secureDefaults && offending.length > 0) {
+            throw new MessageLeakError(offending);
+        }
+        opts.res.headers.forEach((value, name) => {
+            // Allow the safe headers through; disallowed ones are dropped in
+            // non-secureDefaults / dev contexts after a check-only pass.
+            if (shouldCopyCustomErrorHeader(name, value)) {
+                // Don't overwrite caller-supplied headers.
+                if (!headers.has(name))
+                    headers.set(name, value);
+            }
+        });
+    }
+    return new HttpError(opts.status, opts.problem, Object.fromEntries(headers.entries()));
+}
 /**
  * Base class for every DaloyJS HTTP error.
  *
@@ -75,10 +201,25 @@ export class HttpError extends Error {
         }
         if (opts.requestId)
             out.instance = `urn:request:${opts.requestId}`;
-        const headers = {
-            "content-type": "application/problem+json",
-            ...(this.headers ?? {}),
-        };
+        const headers = new Headers({ "content-type": "application/problem+json" });
+        for (const [name, value] of Object.entries(this.headers ?? {})) {
+            headers.set(name, value);
+        }
+        // Merge Context.set.headers (CSRF rotation, session renewal,
+        // request-id, secureHeaders output) without overriding headers the
+        // error class baked in (e.g. `cache-control: no-store` on auth
+        // failures). The framework already merges these at the dispatch
+        // boundary; this branch lets direct callers (custom `onError` hooks,
+        // tests) get the same behavior.
+        if (opts.contextHeaders) {
+            const ctxHeaders = opts.contextHeaders instanceof Headers
+                ? opts.contextHeaders
+                : new Headers(opts.contextHeaders);
+            ctxHeaders.forEach((value, name) => {
+                if (!headers.has(name))
+                    headers.set(name, value);
+            });
+        }
         return new Response(JSON.stringify(out), { status: this.status, headers });
     }
 }
@@ -160,7 +301,7 @@ export class UnauthorizedError extends HttpError {
             title: "Unauthorized",
             ...(detail ? { detail } : {}),
         }, 
-        // Wave 11 — auth-failure responses must never be cached. `no-store`
+        // Auth-failure responses must never be cached. `no-store`
         // already forbids both shared and private caches per RFC 9111 §5.2.2.5.
         { "cache-control": "no-store" });
         this.name = "UnauthorizedError";
@@ -181,7 +322,7 @@ export class ForbiddenError extends HttpError {
             title: "Forbidden",
             ...(detail ? { detail } : {}),
         }, 
-        // Wave 11 — authorization-failure responses must never be cached.
+        // Authorization-failure responses must never be cached.
         { "cache-control": "no-store" });
         this.name = "ForbiddenError";
     }
@@ -257,7 +398,7 @@ export class TooManyRequestsError extends HttpError {
             type: "https://daloyjs.dev/errors/too-many-requests",
             title: "Too Many Requests",
         }, 
-        // Wave 11 — rate-limit responses must never be cached so a 429 from a
+        // Rate-limit responses must never be cached so a 429 from a
         // private cache cannot extend the throttle window past `Retry-After`.
         retryAfterSeconds !== undefined
             ? { "retry-after": String(retryAfterSeconds), "cache-control": "no-store" }

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AA2CH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,OAAO,SAAU,SAAQ,KAAK;IACzB,MAAM,CAAS;IACf,OAAO,CAAiB;IACxB,OAAO,CAA0B;IAE1C,YACE,MAAc,EACd,OAAoD,EACpD,OAAgC;QAEhC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG;YACb,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,2BAA2B,MAAM,EAAE;YACzD,GAAG,OAAO;YACV,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM;SACP,CAAC;QACF,IAAI,OAAO;YAAE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACtC,CAAC;IAED;;;;;;;OAOG;IACH,UAAU,CAAC,OAA6B,EAAE;QACxC,MAAM,MAAM,GACV,IAAI,CAAC,UAAU;YACf,CAAC,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,QAAQ,KAAK,YAAY,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAmB,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAChD,IAAI,MAAM,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACjC,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,wBAAwB;QAC7C,CAAC;QACD,IAAI,IAAI,CAAC,SAAS;YAAE,GAAG,CAAC,QAAQ,GAAG,eAAe,IAAI,CAAC,SAAS,EAAE,CAAC;QACnE,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,0BAA0B;YAC1C,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;SACxB,CAAC;QACF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7E,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,eAAgB,SAAQ,SAAS;IAC5C,YAAY,MAAe;QACzB,KAAK,CAAC,GAAG,EAAE;YACT,IAAI,EAAE,wCAAwC;YAC9C,KAAK,EAAE,aAAa;YACpB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,eAAgB,SAAQ,SAAS;IAC5C,YACE,KAA8C,EAC9C,MAAgD;QAEhD,KAAK,CAAC,GAAG,EAAE;YACT,IAAI,EAAE,uCAAuC;YAC7C,KAAK,EAAE,2BAA2B;YAClC,MAAM,EAAE,WAAW,KAAK,EAAE;YAC1B,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,aAAc,SAAQ,SAAS;IAC1C,YAAY,MAAe;QACzB,KAAK,CAAC,GAAG,EAAE;YACT,IAAI,EAAE,sCAAsC;YAC5C,KAAK,EAAE,WAAW;YAClB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAkB,SAAQ,SAAS;IAC9C,YAAY,MAAe;QACzB,KAAK,CACH,GAAG,EACH;YACE,IAAI,EAAE,yCAAyC;YAC/C,KAAK,EAAE,cAAc;YACrB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B;QACD,oEAAoE;QACpE,wEAAwE;QACxE,EAAE,eAAe,EAAE,UAAU,EAAE,CAChC,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,cAAe,SAAQ,SAAS;IAC3C,YAAY,MAAe;QACzB,KAAK,CACH,GAAG,EACH;YACE,IAAI,EAAE,sCAAsC;YAC5C,KAAK,EAAE,WAAW;YAClB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B;QACD,kEAAkE;QAClE,EAAE,eAAe,EAAE,UAAU,EAAE,CAChC,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAsB,SAAQ,SAAS;IAClD,YAAY,KAAe;QACzB,KAAK,CACH,GAAG,EACH;YACE,IAAI,EAAE,+CAA+C;YACrD,KAAK,EAAE,oBAAoB;SAC5B,EACD,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5B,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,oBAAqB,SAAQ,SAAS;IACjD,YAAY,KAAa;QACvB,KAAK,CAAC,GAAG,EAAE;YACT,IAAI,EAAE,8CAA8C;YACpD,KAAK,EAAE,mBAAmB;YAC1B,MAAM,EAAE,gBAAgB,KAAK,QAAQ;SACtC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,yBAA0B,SAAQ,SAAS;IACtD,YAAY,GAAW,EAAE,QAAkB;QACzC,KAAK,CAAC,GAAG,EAAE;YACT,IAAI,EAAE,mDAAmD;YACzD,KAAK,EAAE,wBAAwB;YAC/B,MAAM,EAAE,QAAQ,GAAG,uBAAuB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAChE,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,oBAAqB,SAAQ,SAAS;IACjD,YAAY,iBAA0B;QACpC,KAAK,CACH,GAAG,EACH;YACE,IAAI,EAAE,8CAA8C;YACpD,KAAK,EAAE,mBAAmB;SAC3B;QACD,sEAAsE;QACtE,sEAAsE;QACtE,iBAAiB,KAAK,SAAS;YAC7B,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE;YAC3E,CAAC,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,CACpC,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,mBAAoB,SAAQ,SAAS;IAChD,YAAY,EAAU;QACpB,KAAK,CAAC,GAAG,EAAE;YACT,IAAI,EAAE,4CAA4C;YAClD,KAAK,EAAE,iBAAiB;YACxB,MAAM,EAAE,oBAAoB,EAAE,IAAI;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,aAAc,SAAQ,SAAS;IAC1C,YAAY,MAAe;QACzB,KAAK,CAAC,GAAG,EAAE;YACT,IAAI,EAAE,qCAAqC;YAC3C,KAAK,EAAE,uBAAuB;YAC9B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAuDH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAwB,IAAI,GAAG,CAAC;IAC7E,kBAAkB;IAClB,oBAAoB;IACpB,aAAa;IACb,cAAc;IACd,kBAAkB;IAClB,gBAAgB;IAChB,kEAAkE;IAClE,+DAA+D;IAC/D,eAAe;CAChB,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,gBAAgB,CAAkD;IAC3E,YACE,gBAAiE;QAEjE,MAAM,OAAO,GAAG,gBAAgB;aAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;aACrC,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,KAAK,CACH,2EAA2E,OAAO,IAAI;YACpF,wEAAwE;YACxE,0EAA0E;YAC1E,2CAA2C,CAC9C,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IAC3C,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B,CAC7C,OAAgB;IAEhB,MAAM,SAAS,GAA4C,EAAE,CAAC;IAC9D,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACzC,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;gBACjD,SAAS,CAAC,IAAI,CAAC;oBACb,IAAI;oBACJ,MAAM,EAAE,uDAAuD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;iBACvF,CAAC,CAAC;YACL,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YACtD,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAC,CAAC;YAC1F,OAAO;QACT,CAAC;QACD,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;YAC9B,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,yDAAyD,EAAE,CAAC,CAAC;YAC5F,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvD,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QACD,IAAI,CAAC,kCAAkC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACnD,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,QAAQ,KAAK,YAAY,CAAC;AAClF,CAAC;AAED,SAAS,qBAAqB;IAC5B,0EAA0E;IAC1E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,4BAA4B,CAAC,IAAY,EAAE,KAAa;IAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,CACL,kCAAkC,CAAC,GAAG,CAAC,KAAK,CAAC;QAC7C,CAAC,CAAC,KAAK,KAAK,eAAe;YACzB,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,UAAU;YACzC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,CAC7C,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,IAAY,EAAE,KAAa;IAC9D,IAAI,CAAC,4BAA4B,CAAC,IAAI,EAAE,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,2EAA2E;IAC3E,4EAA4E;IAC5E,OAAO,IAAI,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC;AACjD,CAAC;AAmCD;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,IAAsB;IAC9C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,IAAI,mBAAmB,EAAE,CAAC;QACxD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,qBAAqB,EAAE,CAAC;QACtE,MAAM,SAAS,GAAG,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpE,IAAI,MAAM,IAAI,cAAc,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YACvC,iEAAiE;YACjE,6DAA6D;YAC7D,IAAI,2BAA2B,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC7C,2CAA2C;gBAC3C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACnD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,OAAO,SAAU,SAAQ,KAAK;IACzB,MAAM,CAAS;IACf,OAAO,CAAiB;IACxB,OAAO,CAA0B;IAE1C,YACE,MAAc,EACd,OAAoD,EACpD,OAAgC;QAEhC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG;YACb,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,2BAA2B,MAAM,EAAE;YACzD,GAAG,OAAO;YACV,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM;SACP,CAAC;QACF,IAAI,OAAO;YAAE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACtC,CAAC;IAED;;;;;;;OAOG;IACH,UAAU,CAAC,OAA6B,EAAE;QACxC,MAAM,MAAM,GACV,IAAI,CAAC,UAAU;YACf,CAAC,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,QAAQ,KAAK,YAAY,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAmB,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAChD,IAAI,MAAM,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACjC,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,wBAAwB;QAC7C,CAAC;QACD,IAAI,IAAI,CAAC,SAAS;YAAE,GAAG,CAAC,QAAQ,GAAG,eAAe,IAAI,CAAC,SAAS,EAAE,CAAC;QACnE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC5E,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,6DAA6D;QAC7D,mEAAmE;QACnE,+DAA+D;QAC/D,gEAAgE;QAChE,qEAAqE;QACrE,gCAAgC;QAChC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,UAAU,GACd,IAAI,CAAC,cAAc,YAAY,OAAO;gBACpC,CAAC,CAAC,IAAI,CAAC,cAAc;gBACrB,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACvC,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;gBACjC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACnD,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7E,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,eAAgB,SAAQ,SAAS;IAC5C,YAAY,MAAe;QACzB,KAAK,CAAC,GAAG,EAAE;YACT,IAAI,EAAE,wCAAwC;YAC9C,KAAK,EAAE,aAAa;YACpB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,eAAgB,SAAQ,SAAS;IAC5C,YACE,KAA8C,EAC9C,MAAgD;QAEhD,KAAK,CAAC,GAAG,EAAE;YACT,IAAI,EAAE,uCAAuC;YAC7C,KAAK,EAAE,2BAA2B;YAClC,MAAM,EAAE,WAAW,KAAK,EAAE;YAC1B,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,aAAc,SAAQ,SAAS;IAC1C,YAAY,MAAe;QACzB,KAAK,CAAC,GAAG,EAAE;YACT,IAAI,EAAE,sCAAsC;YAC5C,KAAK,EAAE,WAAW;YAClB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAkB,SAAQ,SAAS;IAC9C,YAAY,MAAe;QACzB,KAAK,CACH,GAAG,EACH;YACE,IAAI,EAAE,yCAAyC;YAC/C,KAAK,EAAE,cAAc;YACrB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B;QACD,0DAA0D;QAC1D,wEAAwE;QACxE,EAAE,eAAe,EAAE,UAAU,EAAE,CAChC,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,cAAe,SAAQ,SAAS;IAC3C,YAAY,MAAe;QACzB,KAAK,CACH,GAAG,EACH;YACE,IAAI,EAAE,sCAAsC;YAC5C,KAAK,EAAE,WAAW;YAClB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B;QACD,wDAAwD;QACxD,EAAE,eAAe,EAAE,UAAU,EAAE,CAChC,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAsB,SAAQ,SAAS;IAClD,YAAY,KAAe;QACzB,KAAK,CACH,GAAG,EACH;YACE,IAAI,EAAE,+CAA+C;YACrD,KAAK,EAAE,oBAAoB;SAC5B,EACD,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5B,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,oBAAqB,SAAQ,SAAS;IACjD,YAAY,KAAa;QACvB,KAAK,CAAC,GAAG,EAAE;YACT,IAAI,EAAE,8CAA8C;YACpD,KAAK,EAAE,mBAAmB;YAC1B,MAAM,EAAE,gBAAgB,KAAK,QAAQ;SACtC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,yBAA0B,SAAQ,SAAS;IACtD,YAAY,GAAW,EAAE,QAAkB;QACzC,KAAK,CAAC,GAAG,EAAE;YACT,IAAI,EAAE,mDAAmD;YACzD,KAAK,EAAE,wBAAwB;YAC/B,MAAM,EAAE,QAAQ,GAAG,uBAAuB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAChE,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,oBAAqB,SAAQ,SAAS;IACjD,YAAY,iBAA0B;QACpC,KAAK,CACH,GAAG,EACH;YACE,IAAI,EAAE,8CAA8C;YACpD,KAAK,EAAE,mBAAmB;SAC3B;QACD,4DAA4D;QAC5D,sEAAsE;QACtE,iBAAiB,KAAK,SAAS;YAC7B,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE;YAC3E,CAAC,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,CACpC,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,mBAAoB,SAAQ,SAAS;IAChD,YAAY,EAAU;QACpB,KAAK,CAAC,GAAG,EAAE;YACT,IAAI,EAAE,4CAA4C;YAClD,KAAK,EAAE,iBAAiB;YACxB,MAAM,EAAE,oBAAoB,EAAE,IAAI;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,aAAc,SAAQ,SAAS;IAC1C,YAAY,MAAe;QACzB,KAAK,CAAC,GAAG,EAAE;YACT,IAAI,EAAE,qCAAqC;YAC3C,KAAK,EAAE,uBAAuB;YAC9B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF"}

package/dist/etag.d.ts

@@ -1,5 +1,5 @@
 /**
- * Wave 5 leftover: first-party `etag()` helper with strong-validation default.
+ * First-party `etag()` helper with strong-validation default.
  *
  * Automatically computes a SHA-1 strong ETag for successful `GET` / `HEAD`
  * responses, responds `304 Not Modified` on a matching `If-None-Match`, and

package/dist/etag.js

@@ -1,5 +1,5 @@
 /**
- * Wave 5 leftover: first-party `etag()` helper with strong-validation default.
+ * First-party `etag()` helper with strong-validation default.
  *
  * Automatically computes a SHA-1 strong ETag for successful `GET` / `HEAD`
  * responses, responds `304 Not Modified` on a matching `If-None-Match`, and