@daloyjs/core 0.34.3 → 0.35.1

package/dist/ip-restriction.js

@@ -203,4 +203,3 @@ function parseIPv6(input) {
     }
     return { bytes, family: 6 };
 }
-//# sourceMappingURL=ip-restriction.js.map

package/dist/jwk.d.ts

@@ -79,4 +79,3 @@ export interface JwkOptions {
  * @since 0.22.0
  */
 export declare function jwk(opts: JwkOptions): Hooks;
-//# sourceMappingURL=jwk.d.ts.map

package/dist/jwk.js

@@ -266,4 +266,3 @@ function extractScopes(payload) {
     }
     return out;
 }
-//# sourceMappingURL=jwk.js.map

package/dist/jwt.d.ts

@@ -74,6 +74,21 @@ export interface JwtVerifierOptions {
      * RS256 + JWK silently accepts an HS256 token signed with the public key.
      */
     refuseSymmetricWithJwk?: boolean;
+    /**
+     * Optional revocation / blocklist hook. Invoked after signature and
+     * temporal/issuer/audience checks have passed, receiving the verified
+     * `{ header, payload }`. Return `true` (or a promise resolving to `true`)
+     * to reject the token with `JwtError("token_revoked", …)` — typically by
+     * looking up the token's `jti` (or `sub` for global logout) in a Redis
+     * blocklist or database. Closes the well-documented "Fastify does not
+     * offer JWT blocklisting" gap called out in
+     * [Snyk's framework comparison](https://snyk.io/blog/comparing-node-js-web-frameworks/),
+     * without forcing `@daloyjs/core` to ship a runtime dependency — the
+     * caller owns the storage layer. The hook runs last so a revoked token
+     * with a tampered signature is still rejected as `invalid_signature`,
+     * never `token_revoked` (which would leak the existence of the `jti`).
+     */
+    isRevoked?: (verified: JwtVerified) => boolean | Promise<boolean>;
     /** Optional injectable clock for tests. */
     now?: () => number;
 }
@@ -100,4 +115,3 @@ export declare function createJwtSigner(opts: JwtSignerOptions): {
 export declare function createJwtVerifier(opts: JwtVerifierOptions): {
     verify(token: string): Promise<JwtVerified>;
 };
-//# sourceMappingURL=jwt.d.ts.map

package/dist/jwt.js

@@ -43,6 +43,19 @@ const ALL_ALGS = new Set([...SYMMETRIC, ...ASYMMETRIC]);
  * stronger HMAC than HS256-with-a-256-bit-key.
  */
 const MIN_HS_KEY_BYTES = 32;
+/**
+ * Minimum RSA modulus length (in bits) accepted for `RS*` / `PS*` JWT
+ * algorithms. NIST SP 800-131A has disallowed RSA moduli shorter than
+ * 2048 bits for signature generation/verification since 2014; the same
+ * floor is called out in
+ * [Snyk's encryption guidance](https://snyk.io/blog/symmetric-vs-asymmetric-encryption-python/)
+ * ("undersized keys (fewer than 2048 bits) — which hackers can crack").
+ * WebCrypto happily imports 1024-bit or smaller keys, so the framework
+ * enforces the floor itself and refuses to import a weak key for either
+ * signing or verification — issuing or accepting a JWT signed with a
+ * 1024-bit RSA key is effectively a weak-signature footgun.
+ */
+const MIN_RSA_KEY_BITS = 2048;
 /** Default lifetime cap when none is declared in development (`30d`). */
 export const DEFAULT_JWT_MAX_LIFETIME_SECONDS = 30 * 24 * 60 * 60;
 /** Structured error thrown by every JWT helper. */
@@ -147,8 +160,10 @@ function algParams(alg) {
 async function importKey(alg, material, usage) {
     const params = algParams(alg);
     const c = getCrypto();
-    if (isCryptoKey(material))
+    if (isCryptoKey(material)) {
+        assertRsaModulusFloor(alg, material);
         return material;
+    }
     if (material instanceof Uint8Array) {
         if (!SYMMETRIC.has(alg)) {
             throw new JwtError("invalid_key", `jwt(): raw byte keys are only supported for HS256/HS384/HS512; got ${alg}.`);
@@ -172,10 +187,31 @@ async function importKey(alg, material, usage) {
                     : params.name === "RSASSA-PKCS1-v1_5"
                         ? { name: "RSASSA-PKCS1-v1_5", hash: params.hash }
                         : { name: "Ed25519" };
-        return c.subtle.importKey("jwk", material, importAlgorithm, false, [usage]);
+        const imported = await c.subtle.importKey("jwk", material, importAlgorithm, false, [usage]);
+        assertRsaModulusFloor(alg, imported);
+        return imported;
     }
     throw new JwtError("invalid_key", "jwt(): unsupported key material.");
 }
+/**
+ * Refuse RSA keys whose modulus is shorter than {@link MIN_RSA_KEY_BITS}.
+ * Only applies to `RS*` / `PS*` algorithms — non-RSA keys are ignored. The
+ * imported `CryptoKey.algorithm` for any RSA key carries a numeric
+ * `modulusLength`; when WebCrypto reports a length below the floor we
+ * refuse the key for both signing and verification.
+ */
+function assertRsaModulusFloor(alg, key) {
+    const params = algParams(alg);
+    if (params.name !== "RSASSA-PKCS1-v1_5" && params.name !== "RSA-PSS")
+        return;
+    const algorithm = key.algorithm;
+    const modulusLength = algorithm?.modulusLength;
+    if (typeof modulusLength !== "number" || !Number.isFinite(modulusLength))
+        return;
+    if (modulusLength < MIN_RSA_KEY_BITS) {
+        throw new JwtError("weak_rsa_key", `jwt(): ${alg} key modulus must be at least ${MIN_RSA_KEY_BITS} bits (NIST SP 800-131A); got ${modulusLength}.`);
+    }
+}
 function buildSignAlgorithm(alg) {
     const params = algParams(alg);
     if (params.name === "RSA-PSS")
@@ -322,6 +358,9 @@ export function createJwtVerifier(opts) {
             throw new JwtError("invalid_clock_skew", "jwt(): clockSkewSeconds must be a non-negative finite number.");
         }
     }
+    if (opts.isRevoked !== undefined && typeof opts.isRevoked !== "function") {
+        throw new JwtError("invalid_is_revoked", "jwt(): isRevoked must be a function (verified) => boolean | Promise<boolean>.");
+    }
     const issuers = normalizeStringSet(opts.issuer);
     const audiences = normalizeStringSet(opts.audience);
     const keyCache = new Map();
@@ -349,6 +388,7 @@ export function createJwtVerifier(opts) {
         issuers,
         audiences,
         clockSkewSeconds: opts.clockSkewSeconds ?? 0,
+        isRevoked: opts.isRevoked ?? null,
         now: opts.now ?? (() => Math.floor(Date.now() / 1000)),
     };
     return {
@@ -444,6 +484,19 @@ async function verifyInternal(token, r) {
             throw new JwtError("invalid_audience", "jwt(): payload.aud is missing or not a string / string[].");
         }
     }
+    if (r.isRevoked) {
+        const verified = { header, payload };
+        let revoked;
+        try {
+            revoked = await r.isRevoked(verified);
+        }
+        catch (err) {
+            const detail = err instanceof Error ? err.message : String(err);
+            throw new JwtError("revocation_check_failed", `jwt(): isRevoked threw: ${detail}`);
+        }
+        if (revoked === true) {
+            throw new JwtError("token_revoked", "jwt(): token has been revoked.");
+        }
+    }
     return { header, payload };
 }
-//# sourceMappingURL=jwt.js.map

package/dist/load-shedding.d.ts

@@ -70,4 +70,3 @@ export declare function loadShedding(opts?: LoadSheddingOptions): Hooks;
  * @internal
  */
 export declare const LOAD_SHEDDING_MARKER: unique symbol;
-//# sourceMappingURL=load-shedding.d.ts.map

package/dist/load-shedding.js

@@ -168,4 +168,3 @@ export function loadShedding(opts = {}) {
  * @internal
  */
 export const LOAD_SHEDDING_MARKER = Symbol.for("daloyjs.loadShedding");
-//# sourceMappingURL=load-shedding.js.map

package/dist/logger.d.ts

@@ -121,4 +121,3 @@ export declare function createLogger(opts?: ConsoleLoggerOptions): Logger;
  */
 export declare const noopLogger: Logger;
 export {};
-//# sourceMappingURL=logger.d.ts.map

package/dist/logger.js

@@ -258,4 +258,3 @@ export const noopLogger = {
         return noopLogger;
     },
 };
-//# sourceMappingURL=logger.js.map

package/dist/middleware.d.ts

@@ -89,6 +89,18 @@ export interface SecureHeadersOptions {
     permissionsPolicy?: string | false;
     crossOriginOpenerPolicy?: string | false;
     crossOriginResourcePolicy?: string | false;
+    /**
+     * `Cross-Origin-Embedder-Policy` (COEP). Off by default because
+     * `require-corp` breaks any cross-origin embed that has not opted in via
+     * CORP or CORS — opt in explicitly when you want a
+     * `crossOriginIsolated` document (enables `SharedArrayBuffer`,
+     * high-resolution timers, and closes additional XS-Leaks side
+     * channels). Recommended values: `"require-corp"` or
+     * `"credentialless"`. See https://xsleaks.dev/docs/defenses/isolation-policies/coep/.
+     *
+     * @since 0.37.0
+     */
+    crossOriginEmbedderPolicy?: "require-corp" | "credentialless" | "unsafe-none" | false;
     noSniff?: boolean;
     xssProtection?: boolean;
     /**
@@ -156,6 +168,72 @@ export declare const SECURE_HEADERS_MARKER: unique symbol;
  * @since 0.1.0
  */
 export declare function secureHeaders(opts?: SecureHeadersOptions): Hooks;
+/** Options for {@link fetchMetadata}. */
+export interface FetchMetadataOptions {
+    /**
+     * `Sec-Fetch-Dest` values that are always allowed even from cross-site
+     * contexts. Defaults to the destinations a browser uses for top-level
+     * navigation and embeds you typically *want* to be cross-site loadable
+     * (`document`, `embed`, `object`, `audio`, `video`, `font`, `style`,
+     * `image`). Override to tighten (e.g. `["document"]`) or extend.
+     */
+    allowedDestinations?: readonly string[];
+    /**
+     * Request methods that are always allowed when `Sec-Fetch-Mode` is
+     * `navigate` (so users can submit forms cross-site to your endpoints
+     * when you want that). Defaults to `["GET", "HEAD"]` — state-changing
+     * top-level navigations are still rejected, matching the
+     * Resource Isolation Policy from
+     * https://xsleaks.dev/docs/defenses/isolation-policies/resource-isolation/.
+     */
+    allowedNavigationMethods?: readonly string[];
+    /**
+     * Origins permitted as cross-site callers (full origin strings like
+     * `https://trusted.example`). Compared against the request `Origin`
+     * header. Empty by default.
+     */
+    allowedOrigins?: readonly string[];
+    /**
+     * Custom predicate run before any built-in check. Return `true` to allow
+     * the request unconditionally (e.g. for a public CDN-style endpoint).
+     */
+    allow?: (req: Request) => boolean;
+}
+/**
+ * Resource Isolation Policy middleware that uses the browser-set
+ * `Sec-Fetch-Site` / `Sec-Fetch-Mode` / `Sec-Fetch-Dest` request headers
+ * to reject cross-site requests that have no legitimate reason to reach
+ * your origin. This is the modern, tokenless defense against the
+ * XS-Leaks class of attacks documented at https://xsleaks.dev/ and
+ * complements {@link secureHeaders} (which sets COOP / CORP / CSP
+ * response-side) and {@link csrf} (which protects state-changing
+ * endpoints from forged submissions).
+ *
+ * Default policy (matches https://web.dev/articles/fetch-metadata):
+ *  - Allow when `Sec-Fetch-Site` is missing (non-browser client / legacy
+ *    browser — covered by other defenses) or one of `same-origin`,
+ *    `same-site`, `none`.
+ *  - Allow cross-site top-level navigations (`Sec-Fetch-Mode: navigate`)
+ *    using a safe method (`GET` / `HEAD`).
+ *  - Allow cross-site requests whose `Sec-Fetch-Dest` is in a small
+ *    allowlist of embed-friendly destinations.
+ *  - Reject everything else with `403 problem+json`.
+ *
+ * Browsers send `Sec-Fetch-*` since Chrome 76 / Firefox 90 / Safari 16.4,
+ * so for modern user agents this guard blocks the typical XS-Leak
+ * vectors (`<img>`, `<script>`, `<iframe>`, `fetch` no-cors, ...).
+ *
+ * @example
+ * ```ts
+ * import { fetchMetadata } from "@daloyjs/core";
+ * app.use(fetchMetadata());
+ * ```
+ *
+ * @param opts - Policy overrides.
+ * @returns A {@link Hooks} bundle ready for `app.use(...)`.
+ * @since 0.37.0
+ */
+export declare function fetchMetadata(opts?: FetchMetadataOptions): Hooks;
 /**
  * Marker stamped on the `Hooks` object returned by {@link cors} so the
  * framework can detect that a CORS policy has been installed. Used by the
@@ -649,4 +727,3 @@ export declare const REQUIRE_SCOPES_HOOK_MARKER: unique symbol;
  */
 export declare function requireScopes(scopes: readonly string[]): Hooks;
 export { timingSafeEqual };
-//# sourceMappingURL=middleware.d.ts.map

package/dist/middleware.js

@@ -223,7 +223,7 @@ export function secureHeaders(opts = {}) {
     const ref = opts.referrerPolicy ?? "no-referrer";
     if (ref !== false)
         headers["referrer-policy"] = ref;
-    const perm = opts.permissionsPolicy ?? "camera=(), microphone=(), geolocation=()";
+    const perm = opts.permissionsPolicy ?? "camera=(), microphone=(), geolocation=(), clipboard-write=()";
     if (perm !== false)
         headers["permissions-policy"] = perm;
     const coop = opts.crossOriginOpenerPolicy ?? "same-origin";
@@ -232,6 +232,11 @@ export function secureHeaders(opts = {}) {
     const corp = opts.crossOriginResourcePolicy ?? "same-origin";
     if (corp !== false)
         headers["cross-origin-resource-policy"] = corp;
+    // COEP is opt-in: `require-corp` would block any cross-origin embed that
+    // has not opted in via CORP / CORS, which is too aggressive as a default.
+    const coep = opts.crossOriginEmbedderPolicy;
+    if (coep)
+        headers["cross-origin-embedder-policy"] = coep;
     if (opts.noSniff !== false)
         headers["x-content-type-options"] = "nosniff";
     if (opts.xssProtection ?? false)
@@ -254,14 +259,16 @@ export function secureHeaders(opts = {}) {
                 .join(", ");
         }
     }
-    const hooks = {
-        beforeHandle(ctx) {
-            if (cspIsDynamic && cspOpt.nonce) {
+    const headerEntries = Object.entries(headers);
+    const hooks = {};
+    if (cspIsDynamic) {
+        hooks.beforeHandle = (ctx) => {
+            if (cspOpt.nonce) {
                 ctx.state[CSP_NONCE_STATE] = generateCspNonce();
             }
-        },
-        onSend(res, ctx) {
-            if (cspIsDynamic && !res.headers.has("content-security-policy")) {
+        };
+        hooks.onSend = (res, ctx) => {
+            if (!res.headers.has("content-security-policy")) {
                 const nonce = ctx
                     ? ctx.state[CSP_NONCE_STATE]
                     : undefined;
@@ -270,17 +277,100 @@ export function secureHeaders(opts = {}) {
                     res.headers.set("content-security-policy", header);
             }
             return undefined;
-        },
-        onResponse(res) {
-            for (const [k, v] of Object.entries(headers)) {
+        };
+    }
+    if (headerEntries.length > 0) {
+        hooks.onResponse = (res) => {
+            for (const [k, v] of headerEntries) {
                 if (!res.headers.has(k))
                     res.headers.set(k, v);
             }
-        },
-    };
+        };
+    }
     hooks[SECURE_HEADERS_MARKER] = true;
     return hooks;
 }
+const FETCH_METADATA_DEFAULT_DESTS = Object.freeze([
+    // Embed-only destinations that browsers use for legitimate cross-site
+    // resource loads (`<img>`, `<audio>`, `<video>`, `<link rel=stylesheet>`,
+    // `<embed>`, `<object>`, `@font-face`). `document` is intentionally
+    // excluded — that destination is for top-level navigation, which is
+    // handled separately via `Sec-Fetch-Mode: navigate` + safe method.
+    "embed",
+    "object",
+    "audio",
+    "video",
+    "font",
+    "style",
+    "image",
+]);
+const FETCH_METADATA_DEFAULT_NAV_METHODS = Object.freeze(["GET", "HEAD"]);
+/**
+ * Resource Isolation Policy middleware that uses the browser-set
+ * `Sec-Fetch-Site` / `Sec-Fetch-Mode` / `Sec-Fetch-Dest` request headers
+ * to reject cross-site requests that have no legitimate reason to reach
+ * your origin. This is the modern, tokenless defense against the
+ * XS-Leaks class of attacks documented at https://xsleaks.dev/ and
+ * complements {@link secureHeaders} (which sets COOP / CORP / CSP
+ * response-side) and {@link csrf} (which protects state-changing
+ * endpoints from forged submissions).
+ *
+ * Default policy (matches https://web.dev/articles/fetch-metadata):
+ *  - Allow when `Sec-Fetch-Site` is missing (non-browser client / legacy
+ *    browser — covered by other defenses) or one of `same-origin`,
+ *    `same-site`, `none`.
+ *  - Allow cross-site top-level navigations (`Sec-Fetch-Mode: navigate`)
+ *    using a safe method (`GET` / `HEAD`).
+ *  - Allow cross-site requests whose `Sec-Fetch-Dest` is in a small
+ *    allowlist of embed-friendly destinations.
+ *  - Reject everything else with `403 problem+json`.
+ *
+ * Browsers send `Sec-Fetch-*` since Chrome 76 / Firefox 90 / Safari 16.4,
+ * so for modern user agents this guard blocks the typical XS-Leak
+ * vectors (`<img>`, `<script>`, `<iframe>`, `fetch` no-cors, ...).
+ *
+ * @example
+ * ```ts
+ * import { fetchMetadata } from "@daloyjs/core";
+ * app.use(fetchMetadata());
+ * ```
+ *
+ * @param opts - Policy overrides.
+ * @returns A {@link Hooks} bundle ready for `app.use(...)`.
+ * @since 0.37.0
+ */
+export function fetchMetadata(opts = {}) {
+    const allowedDests = new Set(opts.allowedDestinations ?? FETCH_METADATA_DEFAULT_DESTS);
+    const allowedNavMethods = new Set((opts.allowedNavigationMethods ?? FETCH_METADATA_DEFAULT_NAV_METHODS).map((m) => m.toUpperCase()));
+    const allowedOrigins = new Set(opts.allowedOrigins ?? []);
+    const customAllow = opts.allow;
+    return {
+        beforeHandle(ctx) {
+            const req = ctx.request;
+            if (customAllow && customAllow(req))
+                return;
+            const site = req.headers.get("sec-fetch-site");
+            // Browser did not send Sec-Fetch-* (legacy UA, server-to-server,
+            // curl, ...). Other layers (CORS, CSRF, auth) cover those callers.
+            if (!site)
+                return;
+            if (site === "same-origin" || site === "same-site" || site === "none")
+                return;
+            // Cross-site from here on (`cross-site` or any future value).
+            const origin = req.headers.get("origin");
+            if (origin && allowedOrigins.has(origin))
+                return;
+            const mode = req.headers.get("sec-fetch-mode");
+            const method = req.method.toUpperCase();
+            if (mode === "navigate" && allowedNavMethods.has(method))
+                return;
+            const dest = req.headers.get("sec-fetch-dest");
+            if (dest && allowedDests.has(dest))
+                return;
+            throw new ForbiddenError("Cross-site request rejected by fetch-metadata Resource Isolation Policy.");
+        },
+    };
+}
 // `cors()` default `allowMethods` narrowed to the read-only set.
 // State-changing methods (PUT / PATCH / DELETE) require explicit opt-in.
 // POST stays because it remains a non-CORS-preflighted "simple method" with
@@ -288,6 +378,30 @@ export function secureHeaders(opts = {}) {
 // preflight method itself and is always accepted, no need to advertise it.
 const DEFAULT_CORS_METHODS = ["GET", "HEAD", "POST"];
 const DEFAULT_CORS_ALLOWED_HEADERS = ["content-type", "authorization"];
+/**
+ * Append `token` to an existing `Vary` header (or create one) without
+ * clobbering values written by other middleware (e.g. `Vary:
+ * Accept-Encoding` from `compression()`). `Vary: *` short-circuits to a
+ * no-op because the spec treats `*` as "varies on everything".
+ *
+ * @internal
+ */
+function appendVary(headers, token) {
+    const existing = headers.get("vary");
+    if (!existing) {
+        headers.set("vary", token);
+        return;
+    }
+    const lowerToken = token.toLowerCase();
+    for (const raw of existing.split(",")) {
+        const trimmed = raw.trim();
+        if (trimmed === "*")
+            return;
+        if (trimmed.toLowerCase() === lowerToken)
+            return;
+    }
+    headers.set("vary", `${existing}, ${token}`);
+}
 /**
  * Marker stamped on the `Hooks` object returned by {@link cors} so the
  * framework can detect that a CORS policy has been installed. Used by the
@@ -404,9 +518,17 @@ export function cors(opts) {
         beforeHandle(ctx) {
             const origin = ctx.request.headers.get("origin");
             const allowed = allow(origin);
+            // Always advertise that the response depends on `Origin` when the
+            // request carried one, even if we decided not to allow it. Otherwise
+            // an HTTP cache (CDN, reverse proxy) that fronts the API can serve a
+            // response generated for an allowed origin to a different,
+            // disallowed origin — the classic CORS cache-poisoning footgun
+            // called out in Aikido's "CORS Security: Beyond Basic Configuration"
+            // (section 6: Vary: Origin on cached preflight responses).
+            if (origin !== null)
+                appendVary(ctx.set.headers, "Origin");
             if (allowed) {
                 ctx.set.headers.set("access-control-allow-origin", allowed);
-                ctx.set.headers.set("vary", "Origin");
                 if (opts.credentials)
                     ctx.set.headers.set("access-control-allow-credentials", "true");
                 if (exposed)
@@ -414,15 +536,26 @@ export function cors(opts) {
             }
             if (ctx.request.method === "OPTIONS") {
                 const h = new Headers();
+                // Preflights are themselves cacheable by both browsers and shared
+                // caches; vary on Origin and on the preflight-specific request
+                // headers so a cache cannot serve one origin's preflight result
+                // to another. (See `Vary` discussion in MDN's CORS guide.)
+                appendVary(h, "Origin");
+                appendVary(h, "Access-Control-Request-Method");
+                appendVary(h, "Access-Control-Request-Headers");
                 if (allowed) {
                     h.set("access-control-allow-origin", allowed);
-                    h.set("vary", "Origin");
                     if (opts.credentials)
                         h.set("access-control-allow-credentials", "true");
+                    // Only advertise the configured method/header allowlist to
+                    // origins we actually trust. Echoing the policy back to a
+                    // disallowed origin leaks our CORS configuration to anyone who
+                    // can send an OPTIONS request and lets attackers map the API's
+                    // accepted surface area without ever being approved.
+                    h.set("access-control-allow-methods", methods);
+                    h.set("access-control-allow-headers", allowedHeaders);
+                    h.set("access-control-max-age", maxAge);
                 }
-                h.set("access-control-allow-methods", methods);
-                h.set("access-control-allow-headers", allowedHeaders);
-                h.set("access-control-max-age", maxAge);
                 return new Response(null, { status: 204, headers: h });
             }
             return undefined;
@@ -1119,4 +1252,3 @@ export function requireScopes(scopes) {
     return hooks;
 }
 export { timingSafeEqual };
-//# sourceMappingURL=middleware.js.map

package/dist/multipart.d.ts

@@ -166,4 +166,3 @@ export declare function getMultipartShape(s: unknown): {
 /** Internal: read the file-field options used for OpenAPI documentation. */
 export declare function getFileFieldOptions(s: unknown): (Required<Pick<FileFieldOptions, "format">> & FileFieldOptions) | undefined;
 export {};
-//# sourceMappingURL=multipart.d.ts.map

package/dist/multipart.js

@@ -384,4 +384,3 @@ export function getFileFieldOptions(s) {
         return undefined;
     return s[FILE_FIELD_MARKER];
 }
-//# sourceMappingURL=multipart.js.map

package/dist/openapi.d.ts

@@ -125,4 +125,3 @@ export declare function generateOpenAPI(app: App, options: OpenAPIOptions): Reco
  * artifacts. Reads/writes nothing; pure transform.
  */
 export declare function openapiToYAML(doc: Record<string, unknown>): string;
-//# sourceMappingURL=openapi.d.ts.map

package/dist/openapi.js

@@ -498,4 +498,3 @@ export function openapiToYAML(doc) {
     const result = yamlEmit(doc, "");
     return result.startsWith("\n") ? result.slice(1) : result;
 }
-//# sourceMappingURL=openapi.js.map

package/dist/rate-limit-redis.d.ts

@@ -98,4 +98,3 @@ export interface NodeRedisLike {
 }
 /** Wrap a [`node-redis`](https://github.com/redis/node-redis) v4+ client. */
 export declare function nodeRedisAdapter(client: NodeRedisLike): RedisCommands;
-//# sourceMappingURL=rate-limit-redis.d.ts.map

package/dist/rate-limit-redis.js

@@ -114,4 +114,3 @@ export function nodeRedisAdapter(client) {
         },
     };
 }
-//# sourceMappingURL=rate-limit-redis.js.map

package/dist/router.d.ts

@@ -36,4 +36,3 @@ export declare class Router<T> {
     allowedMethods(path: string): HttpMethod[];
     private walk;
 }
-//# sourceMappingURL=router.d.ts.map

package/dist/router.js

@@ -136,4 +136,3 @@ function splitPath(path) {
         return [];
     return clean.replace(/^\//, "").split("/");
 }
-//# sourceMappingURL=router.js.map

package/dist/safe-redirect.d.ts

@@ -0,0 +1,91 @@
+/**
+ * First-party `safeRedirect()` helper that refuses open-redirect inputs.
+ *
+ * Open redirects (Aikido "Top 10 app security problems" #10, OWASP
+ * "Unvalidated Redirects and Forwards") happen when an app blindly trusts
+ * a `?next=...` / `?returnTo=...` query parameter and emits a `Location`
+ * header pointing wherever the attacker wants. The fix the industry has
+ * settled on is the same one Daloy enforces here: validate every
+ * candidate URL against an explicit allowlist of internal paths and
+ * external origins **before** building the redirect response.
+ *
+ * Defaults are deliberately strict:
+ *
+ * - Same-origin paths must start with `/` and must not start with `//`
+ *   or `/\` (which browsers interpret as protocol-relative URLs that
+ *   escape your origin).
+ * - Backslashes, control characters, and `CR`/`LF` are rejected to
+ *   stop response-splitting and homograph tricks.
+ * - Absolute URLs are only allowed when their `origin` exactly matches
+ *   one of the entries in `allowedOrigins`.
+ * - `javascript:`, `data:`, `vbscript:`, and `file:` schemes are always
+ *   refused, even if the caller wrote a bug into the allowlist.
+ * - The default status is `303 See Other`, which is the
+ *   POST-redirect-GET-safe choice. Override with `status` when you
+ *   genuinely need `301`/`302`/`307`/`308`.
+ *
+ * @example
+ * ```ts
+ * import { safeRedirect } from "@daloyjs/core";
+ *
+ * app.get("/login/callback", (ctx) => {
+ *   const next = new URL(ctx.request.url).searchParams.get("next") ?? "/";
+ *   return safeRedirect(next, {
+ *     allowedPaths: ["/", "/dashboard", "/account"],
+ *     allowedOrigins: ["https://app.example.com"],
+ *     fallback: "/",
+ *   });
+ * });
+ * ```
+ *
+ * @since 0.35.1
+ */
+/** Reason an open-redirect candidate was refused. */
+export type SafeRedirectBlockReason = "empty-target" | "invalid-control-characters" | "protocol-relative" | "backslash-path" | "path-not-allowed" | "origin-not-allowed" | "scheme-not-allowed" | "parse-failed";
+/** Thrown when {@link safeRedirect} refuses a candidate URL and no `fallback` is configured. */
+export declare class OpenRedirectBlockedError extends Error {
+    readonly reason: SafeRedirectBlockReason;
+    readonly target: string;
+    constructor(reason: SafeRedirectBlockReason, target: string);
+}
+/** HTTP redirect status codes accepted by {@link safeRedirect}. */
+export type SafeRedirectStatus = 301 | 302 | 303 | 307 | 308;
+/** Options for {@link safeRedirect}. */
+export interface SafeRedirectOptions {
+    /**
+     * Internal paths that may be used as redirect targets. Each entry MUST
+     * begin with `/`. Matching is exact on `pathname` — query strings and
+     * fragments on the candidate are preserved but ignored for matching.
+     *
+     * Use `"/*"` as a wildcard only when you really mean "any same-origin
+     * path is fine" — it disables path-level allowlisting.
+     */
+    allowedPaths?: readonly string[];
+    /**
+     * External origins (scheme + host + optional port, e.g.
+     * `https://app.example.com`) that may be used as redirect targets.
+     * Compared with strict equality against `new URL(target).origin`.
+     */
+    allowedOrigins?: readonly string[];
+    /**
+     * Path to redirect to when the candidate is rejected. MUST begin with
+     * `/`. When omitted, rejected candidates throw
+     * {@link OpenRedirectBlockedError} instead.
+     */
+    fallback?: string;
+    /** HTTP status code. Defaults to `303` (See Other). */
+    status?: SafeRedirectStatus;
+    /** Extra response headers to merge in. `Location` is always overwritten. */
+    headers?: HeadersInit;
+}
+/**
+ * Build a redirect `Response` after validating the target against an
+ * explicit allowlist. Throws {@link OpenRedirectBlockedError} when the
+ * candidate fails validation and no `fallback` is configured.
+ *
+ * @param target - User-supplied URL candidate (path or absolute URL).
+ * @param options - Allowlist + response configuration.
+ *
+ * @since 0.35.1
+ */
+export declare function safeRedirect(target: string, options?: SafeRedirectOptions): Response;