@demiurgejs/core 0.2.0-beta.2 → 0.2.0-beta.4

package/dist/security/index.d.ts

@@ -1,19 +1,31 @@
 export { auditScriptDependencies, createSecurityAudit, } from "./audit";
 export { applyCorsHeaders, createCorsHeaders, createCorsPreflightResponse, validateCorsPolicy, } from "./cors";
+export { createSecureCookie, readSecureCookie, secureCookieName, validateSecureCookie, } from "./cookies";
+export type { CookieIssue, CookieIssueCode, CookieSameSite, CookieScope, SecureCookieDeclaration, SecureCookieDefinition, } from "./cookies";
+export { createEncryptedCookieSession, createSignedCookieSession, } from "./cookie-session";
+export type { CookieSession, CookieSessionCreateOptions, CookieSessionManager, CookieSessionOptions, SessionCookieDefinition, SessionCookieKey, } from "./cookie-session";
 export { createCsrfCookie, createCsrfToken, enforceCsrfProtection, issueCsrfToken, parseCookieHeader, } from "./csrf";
 export type { CsrfCookieOptions, IssuedCsrfToken } from "./csrf";
+export { applyFetchMetadataVary, checkFetchMetadata, enforceFetchMetadataPolicy, } from "./fetch-metadata";
+export type { FetchMetadataEnforcement } from "./fetch-metadata";
 export { EnvValidationError, defineEnvSchema, env, validateEnv, } from "./env";
+export { deserializeEnvSchema, readEnv, resetEnvironment as unstable_resetEnvironment, serializeEnvSchema, startEnvironment as unstable_startEnvironment, } from "./env-startup";
+export type { EnvStartupOptions, EnvStartupResult, } from "./env-startup";
 export { createSecurityHeaders, cspNonce, cspHash, defineRoutePolicy, defineSecurityPolicy, mergeRoutePolicies, mergeRouteSecurityPolicies, mergeSecurityPolicies, security, } from "./policy";
 export { createMemoryRateLimitStore, enforceRateLimit, parseRateLimitWindow, validateRateLimitPolicy, } from "./rate-limit";
+export { createMemorySessionStore, parseSessionRecord, serializeSessionNamespace, } from "./session-store";
+export { createSessionManager, SessionStoreConflictError, SessionStoreUnavailableError, } from "./session-manager";
+export type { ServerSession, SessionManager, SessionManagerOptions, } from "./session-manager";
+export type { MemorySessionStoreOptions, SessionData, SessionNamespace, SessionPrimitive, SessionRecord, SessionStore, SessionStoreCandidate, SessionStoreWriteResult, } from "./session-store";
 export { createSecurityReportHandler, } from "./report";
 export { enforceAllowedMethods, enforceRequestSecurity, parseBodySize, } from "./request";
 export { validateUploads, } from "./upload";
 export { validateRouteModules } from "./verification";
 export type { RouteModuleVerificationOptions } from "./verification";
 export { checkWebSocketOrigin, enforceWebSocketOrigin, } from "./websocket";
-export type { ContentSecurityPolicy, CorsPolicy, CorsRequestContext, CorsResponseOptions, CsrfPolicy, CspHashAlgorithm, CspDirectiveValue, CspDirectiveReplacement, CspSource, CspSourceDirective, MemoryRateLimitStoreOptions, RateLimitKey, RateLimitPolicy, RateLimitResult, RateLimitStore, ReferrerPolicy, ReportingEndpointUrl, ReportingEndpoints, SecurityAudit, SecurityAuditFinding, SecurityAuditOptions, ScriptDependencyAuditOptions, RequestSecurityPolicy, RoutePolicy, RouteSecurityNeeds, RouteSecurityPolicy, SecurityHeadersOptions, SecurityHeaderPolicy, SecurityPolicy, SecurityPreset, StrictTransportSecurityPolicy, TrustedTypesPolicy, } from "./types";
+export type { ContentSecurityPolicy, CorsPolicy, CorsRequestContext, CorsResponseOptions, CsrfPolicy, CspHashAlgorithm, CspDirectiveValue, CspDirectiveReplacement, CspSource, CspSourceDirective, FetchMetadataCheck, FetchMetadataDestination, FetchMetadataPolicy, FetchMetadataPolicyOptions, FetchMetadataReason, MemoryRateLimitStoreOptions, RateLimitKey, RateLimitPolicy, RateLimitResult, RateLimitStore, ReferrerPolicy, ReportingEndpointUrl, ReportingEndpoints, SecurityAudit, SecurityAuditFinding, SecurityAuditOptions, ScriptDependencyAuditOptions, RequestSecurityPolicy, RoutePolicy, RouteSecurityNeeds, RouteSecurityPolicy, SecurityHeadersOptions, SecurityHeaderPolicy, SecurityPolicy, SecurityPreset, StrictTransportSecurityPolicy, TrustedTypesPolicy, } from "./types";
 export type { UploadFilePolicy, UploadPolicy, UploadValidationIssue, UploadValidationResult, } from "./upload";
-export type { EnvSchema, EnvSource, EnvValidationIssue, EnvVariable, InferEnvSchema, } from "./env";
+export type { EnvSchema, EnvSchemaDescriptor, EnvSource, EnvValidationIssue, EnvVariable, EnvVariableDescriptor, EnvVariableKind, InferEnvSchema, } from "./env";
 export type { SecurityReportContext, SecurityReportHandlerOptions, SecurityReportPayload, } from "./report";
 export type { WebSocketOriginCheck, WebSocketOriginPolicy, } from "./websocket";
 //# sourceMappingURL=index.d.ts.map

package/dist/security/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,iBAAiB,GAClB,MAAM,QAAQ,CAAC;AAChB,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACjE,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,GAAG,EACH,WAAW,GACZ,MAAM,OAAO,CAAC;AACf,OAAO,EACL,qBAAqB,EACrB,QAAQ,EACR,OAAO,EACP,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAC1B,qBAAqB,EACrB,QAAQ,GACT,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,2BAA2B,GAC5B,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,aAAa,GACd,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,eAAe,GAChB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,YAAY,EAAE,8BAA8B,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,qBAAqB,EACrB,UAAU,EACV,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,EACvB,SAAS,EACT,kBAAkB,EAClB,2BAA2B,EAC3B,YAAY,EACZ,eAAe,EACf,eAAe,EACf,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,4BAA4B,EAC5B,qBAAqB,EACrB,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,cAAc,EACd,cAAc,EACd,6BAA6B,EAC7B,kBAAkB,GACnB,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,SAAS,EACT,SAAS,EACT,kBAAkB,EAClB,WAAW,EACX,cAAc,GACf,MAAM,OAAO,CAAC;AACf,YAAY,EACV,qBAAqB,EACrB,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,WAAW,EACX,eAAe,EACf,cAAc,EACd,WAAW,EACX,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,aAAa,EACb,0BAA0B,EAC1B,oBAAoB,EACpB,oBAAoB,EACpB,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,iBAAiB,GAClB,MAAM,QAAQ,CAAC;AAChB,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACjE,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,GAAG,EACH,WAAW,GACZ,MAAM,OAAO,CAAC;AACf,OAAO,EACL,oBAAoB,EACpB,OAAO,EACP,gBAAgB,IAAI,yBAAyB,EAC7C,kBAAkB,EAClB,gBAAgB,IAAI,yBAAyB,GAC9C,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,qBAAqB,EACrB,QAAQ,EACR,OAAO,EACP,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAC1B,qBAAqB,EACrB,QAAQ,GACT,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,aAAa,EACb,cAAc,EACd,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,yBAAyB,EACzB,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,2BAA2B,GAC5B,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,aAAa,GACd,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,eAAe,GAChB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,YAAY,EAAE,8BAA8B,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,qBAAqB,EACrB,UAAU,EACV,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,EACvB,SAAS,EACT,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,EAC1B,mBAAmB,EACnB,2BAA2B,EAC3B,YAAY,EACZ,eAAe,EACf,eAAe,EACf,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,4BAA4B,EAC5B,qBAAqB,EACrB,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,cAAc,EACd,cAAc,EACd,6BAA6B,EAC7B,kBAAkB,GACnB,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,SAAS,EACT,mBAAmB,EACnB,SAAS,EACT,kBAAkB,EAClB,WAAW,EACX,qBAAqB,EACrB,eAAe,EACf,cAAc,GACf,MAAM,OAAO,CAAC;AACf,YAAY,EACV,qBAAqB,EACrB,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,aAAa,CAAC"}

package/dist/security/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/security/policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,gBAAgB,EAGhB,WAAW,EAEX,mBAAmB,EACnB,sBAAsB,EAEtB,cAAc,EACd,cAAc,EAGf,MAAM,SAAS,CAAC;AAIjB,eAAO,MAAM,QAAQ,mBAAmC,CAAC;AAyCzD,eAAO,MAAM,QAAQ;kBACN,cAAc;iBAQd,cAAc,YAAW,cAAc;qBAepC,cAAc;qBASd,cAAc;kCASD,cAAc;CAW5C,CAAC;AAEF,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,cAAc,kBAE1D;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,eAEpD;AAED,wBAAgB,qBAAqB,CACnC,GAAG,QAAQ,EAAE,KAAK,CAAC,cAAc,GAAG,KAAK,GAAG,SAAS,CAAC,kBASvD;AAED,wBAAgB,kBAAkB,CAChC,GAAG,QAAQ,EAAE,KAAK,CAAC,WAAW,GAAG,KAAK,GAAG,SAAS,CAAC;;;EAiBpD;AAED,wBAAgB,0BAA0B,CACxC,GAAG,QAAQ,EAAE,KAAK,CAAC,mBAAmB,GAAG,KAAK,GAAG,SAAS,CAAC,uBAc5D;AAwFD,wBAAsB,OAAO,CAC3B,MAAM,EAAE,MAAM,EACd,SAAS,GAAE,gBAA2B,mBAQvC;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,sBAA2B,WAsCrC;AAED,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,cAAc,GAAG,KAAK,GAAG,SAAS,WAY3C;AAED,wBAAgB,cAAc,WAK7B"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/security/policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,gBAAgB,EAGhB,WAAW,EAEX,mBAAmB,EACnB,sBAAsB,EAEtB,cAAc,EACd,cAAc,EAGf,MAAM,SAAS,CAAC;AAKjB,eAAO,MAAM,QAAQ,mBAAmC,CAAC;AAyCzD,eAAO,MAAM,QAAQ;kBACN,cAAc;iBAQd,cAAc,YAAW,cAAc;qBAepC,cAAc;qBASd,cAAc;kCASD,cAAc;CAW5C,CAAC;AAEF,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,cAAc,kBAE1D;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,eAEpD;AAED,wBAAgB,qBAAqB,CACnC,GAAG,QAAQ,EAAE,KAAK,CAAC,cAAc,GAAG,KAAK,GAAG,SAAS,CAAC,kBASvD;AAED,wBAAgB,kBAAkB,CAChC,GAAG,QAAQ,EAAE,KAAK,CAAC,WAAW,GAAG,KAAK,GAAG,SAAS,CAAC;;;EAiBpD;AAED,wBAAgB,0BAA0B,CACxC,GAAG,QAAQ,EAAE,KAAK,CAAC,mBAAmB,GAAG,KAAK,GAAG,SAAS,CAAC,uBAe5D;AAyFD,wBAAsB,OAAO,CAC3B,MAAM,EAAE,MAAM,EACd,SAAS,GAAE,gBAA2B,mBAQvC;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,sBAA2B,WAsCrC;AAED,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,cAAc,GAAG,KAAK,GAAG,SAAS,WAY3C;AAED,wBAAgB,cAAc,WAK7B"}

package/dist/security/rate-limit.d.ts

@@ -1,6 +1,9 @@
-import type { MemoryRateLimitStoreOptions, RateLimitPolicy, RateLimitStore } from "./types";
-export declare function createMemoryRateLimitStore(options?: MemoryRateLimitStoreOptions): RateLimitStore;
-export declare function enforceRateLimit(policy: RateLimitPolicy | undefined, request: Request, store: RateLimitStore, now?: number): Response | null;
+import type { MemoryRateLimitStoreOptions, RateLimitPolicy, RateLimitResult, RateLimitStore } from "./types";
+export type MemoryRateLimitStore = {
+    increment: (key: string, windowMs: number, now: number) => RateLimitResult;
+};
+export declare function createMemoryRateLimitStore(options?: MemoryRateLimitStoreOptions): MemoryRateLimitStore;
+export declare function enforceRateLimit(policy: RateLimitPolicy | undefined, request: Request, store: RateLimitStore, now?: number): Promise<Response | null>;
 export declare function parseRateLimitWindow(value: number | string): number;
 export declare function validateRateLimitPolicy(policy: RateLimitPolicy): void;
 //# sourceMappingURL=rate-limit.d.ts.map

package/dist/security/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/security/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,2BAA2B,EAE3B,eAAe,EACf,cAAc,EACf,MAAM,SAAS,CAAC;AAgBjB,wBAAgB,0BAA0B,CACxC,OAAO,GAAE,2BAAgC,GACxC,cAAc,CAwChB;AA+BD,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,eAAe,GAAG,SAAS,EACnC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,cAAc,EACrB,GAAG,SAAa,mBA2BjB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,UAwB1D;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,eAAe,QAM9D"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/security/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,2BAA2B,EAE3B,eAAe,EACf,eAAe,EACf,cAAc,EACf,MAAM,SAAS,CAAC;AAqBjB,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,eAAe,CAAC;CAC5E,CAAC;AAEF,wBAAgB,0BAA0B,CACxC,OAAO,GAAE,2BAAgC,GACxC,oBAAoB,CA6CtB;AA+BD,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,eAAe,GAAG,SAAS,EACnC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,cAAc,EACrB,GAAG,SAAa,4BA2BjB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,UAyB1D;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,eAAe,QAM9D"}

package/dist/security/report.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../src/security/report.ts"],"names":[],"mappings":"AAMA,KAAK,YAAY,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAEtC,MAAM,MAAM,qBAAqB,GAAG,OAAO,CAAC;AAE5C,MAAM,MAAM,4BAA4B,GAAG;IACzC,WAAW,CAAC,EAAE,MAAM,GAAG,GAAG,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;IAC9D,QAAQ,CAAC,EAAE,CACT,MAAM,EAAE,qBAAqB,EAC7B,OAAO,EAAE,qBAAqB,KAC3B,YAAY,CAAC,IAAI,CAAC,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,wBAAgB,2BAA2B,CACzC,OAAO,GAAE,4BAAiC,IAEC,SAAS,OAAO,uBAqD5D"}
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../src/security/report.ts"],"names":[],"mappings":"AAOA,KAAK,YAAY,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAEtC,MAAM,MAAM,qBAAqB,GAAG,OAAO,CAAC;AAE5C,MAAM,MAAM,4BAA4B,GAAG;IACzC,WAAW,CAAC,EAAE,MAAM,GAAG,GAAG,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;IAC9D,QAAQ,CAAC,EAAE,CACT,MAAM,EAAE,qBAAqB,EAC7B,OAAO,EAAE,qBAAqB,KAC3B,YAAY,CAAC,IAAI,CAAC,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,wBAAgB,2BAA2B,CACzC,OAAO,GAAE,4BAAiC,IAEC,SAAS,OAAO,uBAqD5D"}

package/dist/security/request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../src/security/request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAUrD,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,qBAAqB,GAAG,SAAS,EACzC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,UAAU,mBAmCnB;AAED,qBAAa,wBAAyB,SAAQ,KAAK;;CAKlD;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,qBAAqB,GAAG,SAAS,EACzC,OAAO,EAAE,OAAO,WAmDjB;AAED,wBAAgB,2BAA2B,aAE1C;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,qBAAqB,GAAG,SAAS,EACzC,MAAM,EAAE,UAAU,mBAgBnB;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,UA0BnD"}
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../src/security/request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAUrD,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,qBAAqB,GAAG,SAAS,EACzC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,UAAU,mBAmCnB;AAED,qBAAa,wBAAyB,SAAQ,KAAK;;CAKlD;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,qBAAqB,GAAG,SAAS,EACzC,OAAO,EAAE,OAAO,WAoDjB;AAED,wBAAgB,2BAA2B,aAE1C;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,qBAAqB,GAAG,SAAS,EACzC,MAAM,EAAE,UAAU,mBAgBnB;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,UA2BnD"}

package/dist/security/session-manager.d.ts

@@ -0,0 +1,32 @@
+import type { CookieSessionCreateOptions, SessionCookieDefinition, SessionCookieKey } from "./cookie-session";
+import type { SessionData, SessionRecord, SessionStore } from "./session-store";
+export type SessionManagerOptions<TData extends SessionData> = {
+    absoluteExpirationMs?: number;
+    cookie?: SessionCookieDefinition;
+    idleExpirationMs?: false | number;
+    keys: readonly SessionCookieKey[];
+    now?: () => number;
+    randomBytes?: (length: number) => Uint8Array;
+    renewal?: boolean;
+    store: SessionStore<TData>;
+};
+export type ServerSession<TData extends SessionData> = {
+    commit: () => Promise<readonly string[]>;
+    create: (data: TData, options?: CookieSessionCreateOptions) => Promise<SessionRecord<TData>>;
+    destroy: () => Promise<void>;
+    get: () => SessionRecord<TData> | undefined;
+    rotate: (data?: TData) => Promise<SessionRecord<TData>>;
+    update: (data: TData) => Promise<SessionRecord<TData>>;
+};
+export type SessionManager<TData extends SessionData> = {
+    cookieName: string;
+    open: (request: Request) => Promise<ServerSession<TData>>;
+};
+export declare class SessionStoreConflictError extends Error {
+    constructor(operation: string);
+}
+export declare class SessionStoreUnavailableError extends Error {
+    constructor(operation: string);
+}
+export declare function createSessionManager<TData extends SessionData>(input: SessionManagerOptions<TData>): SessionManager<TData>;
+//# sourceMappingURL=session-manager.d.ts.map

package/dist/security/session-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-manager.d.ts","sourceRoot":"","sources":["../../src/security/session-manager.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,0BAA0B,EAC1B,uBAAuB,EACvB,gBAAgB,EACjB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EACV,WAAW,EACX,aAAa,EACb,YAAY,EAEb,MAAM,iBAAiB,CAAC;AAKzB,MAAM,MAAM,qBAAqB,CAAC,KAAK,SAAS,WAAW,IAAI;IAC7D,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,MAAM,CAAC,EAAE,uBAAuB,CAAC;IACjC,gBAAgB,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IAClC,IAAI,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAClC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,UAAU,CAAC;IAC7C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,aAAa,CAAC,KAAK,SAAS,WAAW,IAAI;IACrD,MAAM,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IACzC,MAAM,EAAE,CACN,IAAI,EAAE,KAAK,EACX,OAAO,CAAC,EAAE,0BAA0B,KACjC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IACnC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,GAAG,EAAE,MAAM,aAAa,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC;IAC5C,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,MAAM,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;CACxD,CAAC;AAEF,MAAM,MAAM,cAAc,CAAC,KAAK,SAAS,WAAW,IAAI;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;CAC3D,CAAC;AAEF,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,SAAS,EAAE,MAAM;CAM9B;AAED,qBAAa,4BAA6B,SAAQ,KAAK;gBACzC,SAAS,EAAE,MAAM;CAM9B;AAED,wBAAgB,oBAAoB,CAAC,KAAK,SAAS,WAAW,EAC5D,KAAK,EAAE,qBAAqB,CAAC,KAAK,CAAC,GAClC,cAAc,CAAC,KAAK,CAAC,CAkKvB"}

package/dist/security/session-store.d.ts

@@ -0,0 +1,51 @@
+export type SessionPrimitive = boolean | null | number | string;
+export type SessionData = SessionPrimitive | {
+    readonly [key: string]: SessionData;
+} | readonly SessionData[];
+export type SessionNamespace = {
+    app: string;
+    environment: string;
+    schemaVersion: number | string;
+};
+export type SessionRecord<TData extends SessionData = SessionData> = {
+    createdAt: number;
+    data: TData;
+    expiresAt: number;
+    id: string;
+    idleExpiresAt?: number;
+    version: number;
+};
+export type SessionStoreCandidate<TData extends SessionData = SessionData> = Omit<SessionRecord<TData>, "version">;
+export type SessionStoreWriteResult<TData extends SessionData = SessionData> = {
+    record: SessionRecord<TData>;
+    status: "stored";
+} | {
+    status: "conflict";
+} | {
+    status: "unavailable";
+};
+type MaybePromise<T> = T | Promise<T>;
+export type SessionStore<TData extends SessionData = SessionData> = {
+    create: (candidate: SessionStoreCandidate<TData>) => MaybePromise<SessionStoreWriteResult<TData>>;
+    destroy: (id: string) => MaybePromise<boolean>;
+    read: (id: string, now: number) => MaybePromise<SessionRecord<TData> | undefined>;
+    rotate: (currentId: string, candidate: SessionStoreCandidate<TData>, expectedVersion: number) => MaybePromise<SessionStoreWriteResult<TData>>;
+    update: (candidate: SessionStoreCandidate<TData>, expectedVersion: number) => MaybePromise<SessionStoreWriteResult<TData>>;
+};
+export type MemorySessionStoreOptions<TData extends SessionData = SessionData> = {
+    entries?: Map<string, SessionRecord<TData>>;
+    namespace: SessionNamespace;
+};
+export declare function createMemorySessionStore<TData extends SessionData = SessionData>(options: MemorySessionStoreOptions<TData>): SessionStore<TData>;
+/**
+ * Validates that an untrusted parsed value conforms to the `SessionRecord`
+ * envelope before it is trusted as a session. Backend session stores read
+ * raw JSON from shared infrastructure (KV, Redis) that a corrupted entry,
+ * manual edit, or deployment version skew could have produced, so the shape
+ * must be proven rather than assumed. Mirrors the validation cookie-session
+ * applies to its own decoded payloads.
+ */
+export declare function parseSessionRecord<TData extends SessionData = SessionData>(value: unknown): SessionRecord<TData> | undefined;
+export declare function serializeSessionNamespace(namespace: SessionNamespace): string;
+export {};
+//# sourceMappingURL=session-store.d.ts.map

package/dist/security/session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../src/security/session-store.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AAEhE,MAAM,MAAM,WAAW,GACnB,gBAAgB,GAChB;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,WAAW,CAAA;CAAE,GACvC,SAAS,WAAW,EAAE,CAAC;AAE3B,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,aAAa,CAAC,KAAK,SAAS,WAAW,GAAG,WAAW,IAAI;IACnE,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,KAAK,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,qBAAqB,CAAC,KAAK,SAAS,WAAW,GAAG,WAAW,IACvE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;AAExC,MAAM,MAAM,uBAAuB,CAAC,KAAK,SAAS,WAAW,GAAG,WAAW,IACvE;IAAE,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAA;CAAE,GAClD;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,GACtB;IAAE,MAAM,EAAE,aAAa,CAAA;CAAE,CAAC;AAE9B,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;AAEtC,MAAM,MAAM,YAAY,CAAC,KAAK,SAAS,WAAW,GAAG,WAAW,IAAI;IAClE,MAAM,EAAE,CACN,SAAS,EAAE,qBAAqB,CAAC,KAAK,CAAC,KACpC,YAAY,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC;IAClD,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,EAAE,CACJ,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,MAAM,KACR,YAAY,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,CAAC;IACpD,MAAM,EAAE,CACN,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,qBAAqB,CAAC,KAAK,CAAC,EACvC,eAAe,EAAE,MAAM,KACpB,YAAY,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC;IAClD,MAAM,EAAE,CACN,SAAS,EAAE,qBAAqB,CAAC,KAAK,CAAC,EACvC,eAAe,EAAE,MAAM,KACpB,YAAY,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC;CACnD,CAAC;AAEF,MAAM,MAAM,yBAAyB,CACnC,KAAK,SAAS,WAAW,GAAG,WAAW,IACrC;IACF,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5C,SAAS,EAAE,gBAAgB,CAAC;CAC7B,CAAC;AAEF,wBAAgB,wBAAwB,CACtC,KAAK,SAAS,WAAW,GAAG,WAAW,EACvC,OAAO,EAAE,yBAAyB,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAkEhE;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,SAAS,WAAW,GAAG,WAAW,EACxE,KAAK,EAAE,OAAO,GACb,aAAa,CAAC,KAAK,CAAC,GAAG,SAAS,CAiBlC;AAkCD,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,gBAAgB,UAsBpE"}

package/dist/security/testing.d.ts

@@ -0,0 +1,10 @@
+import type { SessionData, SessionNamespace, SessionStore } from "./session-store";
+type MaybePromise<T> = T | Promise<T>;
+export type SessionStoreFactory<TData extends SessionData = SessionData> = (namespace: SessionNamespace) => MaybePromise<SessionStore<TData>>;
+type ContractData = {
+    authenticated: boolean;
+    name: string;
+};
+export declare function verifySessionStoreContract(createStore: SessionStoreFactory<ContractData>): Promise<void>;
+export {};
+//# sourceMappingURL=testing.d.ts.map

package/dist/security/testing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../../src/security/testing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,gBAAgB,EAEhB,YAAY,EAEb,MAAM,iBAAiB,CAAC;AAEzB,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;AAEtC,MAAM,MAAM,mBAAmB,CAAC,KAAK,SAAS,WAAW,GAAG,WAAW,IAAI,CACzE,SAAS,EAAE,gBAAgB,KACxB,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAEvC,KAAK,YAAY,GAAG;IAClB,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,mBAAmB,CAAC,YAAY,CAAC,iBAsJ/C"}

package/dist/security/testing.js

@@ -0,0 +1,145 @@
+async function S(o) {
+  const t = `${Date.now()}-${Math.random()}`, n = {
+    app: `contract-${t}`,
+    environment: "test",
+    schemaVersion: 1
+  }, m = {
+    ...n,
+    environment: "isolated"
+  }, a = await o(n), l = await o(n), f = await o(m), r = Date.now(), i = p(`session-${t}`, r, {
+    authenticated: !1,
+    name: "alpha"
+  }), d = p(`rotated-${t}`, r, {
+    authenticated: !0,
+    name: "alpha"
+  });
+  try {
+    e(
+      await a.read(i.id, r) === void 0,
+      "read() must return undefined for a missing identifier"
+    );
+    const x = await a.create(i);
+    s(x, "create() must store a missing identifier"), b(
+      await l.read(i.id, r),
+      { ...i, version: 0 },
+      "create() must make a record available to another store instance"
+    ), e(
+      (await a.create(i)).status === "conflict",
+      "create() must report a conflict for an existing identifier"
+    ), e(
+      await f.read(i.id, r) === void 0,
+      "a namespace must not read another namespace's record"
+    );
+    const g = await f.create({
+      ...i,
+      data: { authenticated: !1, name: "isolated" }
+    });
+    s(
+      g,
+      "create() must allow the same identifier in another namespace"
+    );
+    const $ = {
+      ...i,
+      data: { authenticated: !0, name: "beta" }
+    }, h = await l.update($, 0);
+    s(h, "update() must replace the expected version"), e(
+      h.record.version === 1,
+      "update() must increment the stored version"
+    ), e(
+      (await a.update(i, 0)).status === "conflict",
+      "update() must reject an obsolete version"
+    );
+    const w = await Promise.all([
+      a.rotate(i.id, d, 1),
+      l.rotate(
+        i.id,
+        { ...d, id: `${d.id}-competitor` },
+        1
+      )
+    ]);
+    e(
+      w.filter((u) => u.status === "stored").length === 1,
+      "only one concurrent rotation can succeed"
+    ), e(
+      w.filter((u) => u.status === "conflict").length === 1,
+      "one concurrent rotation must report a conflict"
+    ), e(
+      await a.read(i.id, r) === void 0,
+      "rotation must invalidate the previous identifier"
+    );
+    const c = w.find(
+      (u) => u.status === "stored"
+    );
+    s(c, "rotation must return its stored record"), e(
+      c.record.version === 2,
+      "rotation must increment the stored version"
+    ), e(
+      await l.destroy(c.record.id),
+      "destroy() must remove an existing identifier"
+    ), e(
+      await a.read(c.record.id, r) === void 0,
+      "destroy() must revoke a session for another store instance"
+    ), e(
+      !await a.destroy(c.record.id),
+      "destroy() must report a missing identifier"
+    );
+    const v = p(`expired-${t}`, r, {
+      authenticated: !1,
+      name: "expired"
+    }, -1);
+    s(
+      await a.create(v),
+      "create() must accept a record before read-time expiration checks"
+    ), e(
+      await a.read(v.id, r) === void 0,
+      "read() must not return an absolutely expired record"
+    );
+    const y = {
+      ...p(`idle-${t}`, r, {
+        authenticated: !1,
+        name: "idle"
+      }),
+      idleExpiresAt: r - 1
+    };
+    s(
+      await a.create(y),
+      "create() must accept a record with idle expiration"
+    ), e(
+      await a.read(y.id, r) === void 0,
+      "read() must not return an idle-expired record"
+    );
+  } finally {
+    await Promise.all([
+      a.destroy(i.id),
+      a.destroy(d.id),
+      a.destroy(`${d.id}-competitor`),
+      f.destroy(i.id)
+    ]);
+  }
+}
+function p(o, t, n, m = 6e4) {
+  return {
+    createdAt: t,
+    data: n,
+    expiresAt: t + m,
+    id: o,
+    idleExpiresAt: t + m
+  };
+}
+function s(o, t) {
+  e(o?.status === "stored", t);
+}
+function b(o, t, n) {
+  e(
+    JSON.stringify(o) === JSON.stringify(t),
+    n
+  );
+}
+function e(o, t) {
+  if (!o)
+    throw new Error(`Session store contract failed: ${t}.`);
+}
+export {
+  S as verifySessionStoreContract
+};
+//# sourceMappingURL=testing.js.map

package/dist/security/testing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.js","sources":["../../src/security/testing.ts"],"sourcesContent":["import type {\n  SessionData,\n  SessionNamespace,\n  SessionRecord,\n  SessionStore,\n  SessionStoreCandidate,\n} from \"./session-store\";\n\ntype MaybePromise<T> = T | Promise<T>;\n\nexport type SessionStoreFactory<TData extends SessionData = SessionData> = (\n  namespace: SessionNamespace,\n) => MaybePromise<SessionStore<TData>>;\n\ntype ContractData = {\n  authenticated: boolean;\n  name: string;\n};\n\nexport async function verifySessionStoreContract(\n  createStore: SessionStoreFactory<ContractData>,\n) {\n  const token = `${Date.now()}-${Math.random()}`;\n  const namespace = {\n    app: `contract-${token}`,\n    environment: \"test\",\n    schemaVersion: 1,\n  } satisfies SessionNamespace;\n  const isolatedNamespace = {\n    ...namespace,\n    environment: \"isolated\",\n  } satisfies SessionNamespace;\n  const store = await createStore(namespace);\n  const secondReplica = await createStore(namespace);\n  const isolatedStore = await createStore(isolatedNamespace);\n  const now = Date.now();\n  const original = candidate(`session-${token}`, now, {\n    authenticated: false,\n    name: \"alpha\",\n  });\n  const rotated = candidate(`rotated-${token}`, now, {\n    authenticated: true,\n    name: \"alpha\",\n  });\n\n  try {\n    assert(\n      await store.read(original.id, now) === undefined,\n      \"read() must return undefined for a missing identifier\",\n    );\n\n    const created = await store.create(original);\n    assertStored(created, \"create() must store a missing identifier\");\n    assertRecord(\n      await secondReplica.read(original.id, now),\n      { ...original, version: 0 },\n      \"create() must make a record available to another store instance\",\n    );\n\n    assert(\n      (await store.create(original)).status === \"conflict\",\n      \"create() must report a conflict for an existing identifier\",\n    );\n    assert(\n      await isolatedStore.read(original.id, now) === undefined,\n      \"a namespace must not read another namespace's record\",\n    );\n\n    const isolatedCreated = await isolatedStore.create({\n      ...original,\n      data: { authenticated: false, name: \"isolated\" },\n    });\n    assertStored(\n      isolatedCreated,\n      \"create() must allow the same identifier in another namespace\",\n    );\n\n    const updatedCandidate = {\n      ...original,\n      data: { authenticated: true, name: \"beta\" },\n    } satisfies SessionStoreCandidate<ContractData>;\n    const updated = await secondReplica.update(updatedCandidate, 0);\n    assertStored(updated, \"update() must replace the expected version\");\n    assert(\n      updated.record.version === 1,\n      \"update() must increment the stored version\",\n    );\n    assert(\n      (await store.update(original, 0)).status === \"conflict\",\n      \"update() must reject an obsolete version\",\n    );\n\n    const rotations = await Promise.all([\n      store.rotate(original.id, rotated, 1),\n      secondReplica.rotate(\n        original.id,\n        { ...rotated, id: `${rotated.id}-competitor` },\n        1,\n      ),\n    ]);\n    assert(\n      rotations.filter((result) => result.status === \"stored\").length === 1,\n      \"only one concurrent rotation can succeed\",\n    );\n    assert(\n      rotations.filter((result) => result.status === \"conflict\").length === 1,\n      \"one concurrent rotation must report a conflict\",\n    );\n    assert(\n      await store.read(original.id, now) === undefined,\n      \"rotation must invalidate the previous identifier\",\n    );\n\n    const successfulRotation = rotations.find(\n      (result) => result.status === \"stored\",\n    );\n    assertStored(successfulRotation, \"rotation must return its stored record\");\n    assert(\n      successfulRotation.record.version === 2,\n      \"rotation must increment the stored version\",\n    );\n    assert(\n      await secondReplica.destroy(successfulRotation.record.id),\n      \"destroy() must remove an existing identifier\",\n    );\n    assert(\n      await store.read(successfulRotation.record.id, now) === undefined,\n      \"destroy() must revoke a session for another store instance\",\n    );\n    assert(\n      !await store.destroy(successfulRotation.record.id),\n      \"destroy() must report a missing identifier\",\n    );\n\n    const expired = candidate(`expired-${token}`, now, {\n      authenticated: false,\n      name: \"expired\",\n    }, -1);\n    assertStored(\n      await store.create(expired),\n      \"create() must accept a record before read-time expiration checks\",\n    );\n    assert(\n      await store.read(expired.id, now) === undefined,\n      \"read() must not return an absolutely expired record\",\n    );\n\n    const idleExpired = {\n      ...candidate(`idle-${token}`, now, {\n        authenticated: false,\n        name: \"idle\",\n      }),\n      idleExpiresAt: now - 1,\n    };\n    assertStored(\n      await store.create(idleExpired),\n      \"create() must accept a record with idle expiration\",\n    );\n    assert(\n      await store.read(idleExpired.id, now) === undefined,\n      \"read() must not return an idle-expired record\",\n    );\n  } finally {\n    await Promise.all([\n      store.destroy(original.id),\n      store.destroy(rotated.id),\n      store.destroy(`${rotated.id}-competitor`),\n      isolatedStore.destroy(original.id),\n    ]);\n  }\n}\n\nfunction candidate(\n  id: string,\n  now: number,\n  data: ContractData,\n  expirationOffset = 60_000,\n): SessionStoreCandidate<ContractData> {\n  return {\n    createdAt: now,\n    data,\n    expiresAt: now + expirationOffset,\n    id,\n    idleExpiresAt: now + expirationOffset,\n  };\n}\n\nfunction assertStored<TData extends SessionData>(\n  result:\n    | Awaited<ReturnType<SessionStore<TData>[\"create\"]>>\n    | undefined,\n  requirement: string,\n): asserts result is { record: SessionRecord<TData>; status: \"stored\" } {\n  assert(result?.status === \"stored\", requirement);\n}\n\nfunction assertRecord<TData extends SessionData>(\n  actual: SessionRecord<TData> | undefined,\n  expected: SessionRecord<TData>,\n  requirement: string,\n) {\n  assert(\n    JSON.stringify(actual) === JSON.stringify(expected),\n    requirement,\n  );\n}\n\nfunction assert(condition: boolean, requirement: string): asserts condition {\n  if (!condition) {\n    throw new Error(`Session store contract failed: ${requirement}.`);\n  }\n}\n"],"names":["verifySessionStoreContract","createStore","token","namespace","isolatedNamespace","store","secondReplica","isolatedStore","now","original","candidate","rotated","assert","created","assertStored","assertRecord","isolatedCreated","updatedCandidate","updated","rotations","result","successfulRotation","expired","idleExpired","id","data","expirationOffset","requirement","actual","expected","condition"],"mappings":"AAmBA,eAAsBA,EACpBC,GACA;AACA,QAAMC,IAAQ,GAAG,KAAK,IAAA,CAAK,IAAI,KAAK,QAAQ,IACtCC,IAAY;AAAA,IAChB,KAAK,YAAYD,CAAK;AAAA,IACtB,aAAa;AAAA,IACb,eAAe;AAAA,EAAA,GAEXE,IAAoB;AAAA,IACxB,GAAGD;AAAA,IACH,aAAa;AAAA,EAAA,GAETE,IAAQ,MAAMJ,EAAYE,CAAS,GACnCG,IAAgB,MAAML,EAAYE,CAAS,GAC3CI,IAAgB,MAAMN,EAAYG,CAAiB,GACnDI,IAAM,KAAK,IAAA,GACXC,IAAWC,EAAU,WAAWR,CAAK,IAAIM,GAAK;AAAA,IAClD,eAAe;AAAA,IACf,MAAM;AAAA,EAAA,CACP,GACKG,IAAUD,EAAU,WAAWR,CAAK,IAAIM,GAAK;AAAA,IACjD,eAAe;AAAA,IACf,MAAM;AAAA,EAAA,CACP;AAED,MAAI;AACF,IAAAI;AAAA,MACE,MAAMP,EAAM,KAAKI,EAAS,IAAID,CAAG,MAAM;AAAA,MACvC;AAAA,IAAA;AAGF,UAAMK,IAAU,MAAMR,EAAM,OAAOI,CAAQ;AAC3C,IAAAK,EAAaD,GAAS,0CAA0C,GAChEE;AAAA,MACE,MAAMT,EAAc,KAAKG,EAAS,IAAID,CAAG;AAAA,MACzC,EAAE,GAAGC,GAAU,SAAS,EAAA;AAAA,MACxB;AAAA,IAAA,GAGFG;AAAA,OACG,MAAMP,EAAM,OAAOI,CAAQ,GAAG,WAAW;AAAA,MAC1C;AAAA,IAAA,GAEFG;AAAA,MACE,MAAML,EAAc,KAAKE,EAAS,IAAID,CAAG,MAAM;AAAA,MAC/C;AAAA,IAAA;AAGF,UAAMQ,IAAkB,MAAMT,EAAc,OAAO;AAAA,MACjD,GAAGE;AAAA,MACH,MAAM,EAAE,eAAe,IAAO,MAAM,WAAA;AAAA,IAAW,CAChD;AACD,IAAAK;AAAA,MACEE;AAAA,MACA;AAAA,IAAA;AAGF,UAAMC,IAAmB;AAAA,MACvB,GAAGR;AAAA,MACH,MAAM,EAAE,eAAe,IAAM,MAAM,OAAA;AAAA,IAAO,GAEtCS,IAAU,MAAMZ,EAAc,OAAOW,GAAkB,CAAC;AAC9D,IAAAH,EAAaI,GAAS,4CAA4C,GAClEN;AAAA,MACEM,EAAQ,OAAO,YAAY;AAAA,MAC3B;AAAA,IAAA,GAEFN;AAAA,OACG,MAAMP,EAAM,OAAOI,GAAU,CAAC,GAAG,WAAW;AAAA,MAC7C;AAAA,IAAA;AAGF,UAAMU,IAAY,MAAM,QAAQ,IAAI;AAAA,MAClCd,EAAM,OAAOI,EAAS,IAAIE,GAAS,CAAC;AAAA,MACpCL,EAAc;AAAA,QACZG,EAAS;AAAA,QACT,EAAE,GAAGE,GAAS,IAAI,GAAGA,EAAQ,EAAE,cAAA;AAAA,QAC/B;AAAA,MAAA;AAAA,IACF,CACD;AACD,IAAAC;AAAA,MACEO,EAAU,OAAO,CAACC,MAAWA,EAAO,WAAW,QAAQ,EAAE,WAAW;AAAA,MACpE;AAAA,IAAA,GAEFR;AAAA,MACEO,EAAU,OAAO,CAACC,MAAWA,EAAO,WAAW,UAAU,EAAE,WAAW;AAAA,MACtE;AAAA,IAAA,GAEFR;AAAA,MACE,MAAMP,EAAM,KAAKI,EAAS,IAAID,CAAG,MAAM;AAAA,MACvC;AAAA,IAAA;AAGF,UAAMa,IAAqBF,EAAU;AAAA,MACnC,CAACC,MAAWA,EAAO,WAAW;AAAA,IAAA;AAEhC,IAAAN,EAAaO,GAAoB,wCAAwC,GACzET;AAAA,MACES,EAAmB,OAAO,YAAY;AAAA,MACtC;AAAA,IAAA,GAEFT;AAAA,MACE,MAAMN,EAAc,QAAQe,EAAmB,OAAO,EAAE;AAAA,MACxD;AAAA,IAAA,GAEFT;AAAA,MACE,MAAMP,EAAM,KAAKgB,EAAmB,OAAO,IAAIb,CAAG,MAAM;AAAA,MACxD;AAAA,IAAA,GAEFI;AAAA,MACE,CAAC,MAAMP,EAAM,QAAQgB,EAAmB,OAAO,EAAE;AAAA,MACjD;AAAA,IAAA;AAGF,UAAMC,IAAUZ,EAAU,WAAWR,CAAK,IAAIM,GAAK;AAAA,MACjD,eAAe;AAAA,MACf,MAAM;AAAA,IAAA,GACL,EAAE;AACL,IAAAM;AAAA,MACE,MAAMT,EAAM,OAAOiB,CAAO;AAAA,MAC1B;AAAA,IAAA,GAEFV;AAAA,MACE,MAAMP,EAAM,KAAKiB,EAAQ,IAAId,CAAG,MAAM;AAAA,MACtC;AAAA,IAAA;AAGF,UAAMe,IAAc;AAAA,MAClB,GAAGb,EAAU,QAAQR,CAAK,IAAIM,GAAK;AAAA,QACjC,eAAe;AAAA,QACf,MAAM;AAAA,MAAA,CACP;AAAA,MACD,eAAeA,IAAM;AAAA,IAAA;AAEvB,IAAAM;AAAA,MACE,MAAMT,EAAM,OAAOkB,CAAW;AAAA,MAC9B;AAAA,IAAA,GAEFX;AAAA,MACE,MAAMP,EAAM,KAAKkB,EAAY,IAAIf,CAAG,MAAM;AAAA,MAC1C;AAAA,IAAA;AAAA,EAEJ,UAAA;AACE,UAAM,QAAQ,IAAI;AAAA,MAChBH,EAAM,QAAQI,EAAS,EAAE;AAAA,MACzBJ,EAAM,QAAQM,EAAQ,EAAE;AAAA,MACxBN,EAAM,QAAQ,GAAGM,EAAQ,EAAE,aAAa;AAAA,MACxCJ,EAAc,QAAQE,EAAS,EAAE;AAAA,IAAA,CAClC;AAAA,EACH;AACF;AAEA,SAASC,EACPc,GACAhB,GACAiB,GACAC,IAAmB,KACkB;AACrC,SAAO;AAAA,IACL,WAAWlB;AAAA,IACX,MAAAiB;AAAA,IACA,WAAWjB,IAAMkB;AAAA,IACjB,IAAAF;AAAA,IACA,eAAehB,IAAMkB;AAAA,EAAA;AAEzB;AAEA,SAASZ,EACPM,GAGAO,GACsE;AACtE,EAAAf,EAAOQ,GAAQ,WAAW,UAAUO,CAAW;AACjD;AAEA,SAASZ,EACPa,GACAC,GACAF,GACA;AACA,EAAAf;AAAA,IACE,KAAK,UAAUgB,CAAM,MAAM,KAAK,UAAUC,CAAQ;AAAA,IAClDF;AAAA,EAAA;AAEJ;AAEA,SAASf,EAAOkB,GAAoBH,GAAwC;AAC1E,MAAI,CAACG;AACH,UAAM,IAAI,MAAM,kCAAkCH,CAAW,GAAG;AAEpE;"}

package/dist/security/types.d.ts

@@ -5,7 +5,14 @@ export type CspDirectiveReplacement<Source extends string = CspSource> = {
     replace: readonly Source[];
 };
 export type CspSourceDirective = readonly CspSource[] | CspDirectiveReplacement | false;
-export type CspDirectiveValue = CspSourceDirective | CspDirectiveReplacement<ReportingEndpointUrl> | readonly ReportingEndpointUrl[] | boolean;
+export type CspSandboxToken = "allow-downloads" | "allow-forms" | "allow-modals" | "allow-orientation-lock" | "allow-pointer-lock" | "allow-popups" | "allow-popups-to-escape-sandbox" | "allow-presentation" | "allow-same-origin" | "allow-scripts" | "allow-top-navigation" | "allow-top-navigation-by-user-activation" | "allow-top-navigation-to-custom-protocols" | (string & {});
+/**
+ * `true` renders a bare `sandbox` (the maximally restrictive sandbox). An
+ * array renders `sandbox <tokens>`, relaxing only the listed capabilities.
+ * `false` omits the directive.
+ */
+export type CspSandboxDirective = readonly CspSandboxToken[] | boolean;
+export type CspDirectiveValue = CspSourceDirective | CspSandboxDirective | CspDirectiveReplacement<ReportingEndpointUrl> | readonly ReportingEndpointUrl[] | boolean;
 export type ContentSecurityPolicy = {
     baseUri?: CspSourceDirective;
     childSrc?: CspSourceDirective;
@@ -23,7 +30,15 @@ export type ContentSecurityPolicy = {
     reportUri?: readonly ReportingEndpointUrl[] | CspDirectiveReplacement<ReportingEndpointUrl> | false;
     /** A named member of `headers.reportingEndpoints`. */
     reportTo?: string;
+    /**
+     * Not part of any preset. A route that renders content it does not
+     * control (user-generated HTML, a rendered comment body, an embed) opts
+     * into this explicitly rather than inheriting it from `strict`/`static`.
+     */
+    sandbox?: CspSandboxDirective;
     scriptSrc?: CspSourceDirective;
+    scriptSrcAttr?: CspSourceDirective;
+    scriptSrcElem?: CspSourceDirective;
     styleSrc?: CspSourceDirective;
     styleSrcAttr?: CspSourceDirective;
     styleSrcElem?: CspSourceDirective;
@@ -39,8 +54,23 @@ export type StrictTransportSecurityPolicy = {
     preload?: boolean;
 };
 export type TrustedTypesPolicy = {
+    /**
+     * Permits the `default` policy, which the browser applies to every raw
+     * string that reaches a guarded sink. The `default` policy is one global
+     * relaxation of the guarantee, so no preset turns it on. An application
+     * declares it here when legacy or third-party code cannot use a named
+     * policy.
+     */
+    allowDefaultPolicy?: boolean;
     mode: "enforce" | "report-only";
-    policies: readonly string[];
+    /**
+     * Policy names the document may create, beyond the framework-owned
+     * `demiurge` policy that the framework always permits.
+     *
+     * An absent list permits the framework policy only. An empty list renders
+     * `trusted-types 'none'`, which refuses every policy name.
+     */
+    policies?: readonly string[];
     requireFor?: readonly ["script"];
 };
 export type CorsPolicy = {
@@ -63,8 +93,47 @@ export type CorsResponseOptions = {
 };
 export type CsrfPolicy = false | true | {
     cookie?: string;
+    field?: string;
     header?: string;
 };
+/**
+ * A value of the `Sec-Fetch-Dest` header. The list holds the destinations that
+ * a cross-site exemption usually names. Any other string stays valid.
+ */
+export type FetchMetadataDestination = "audio" | "document" | "embed" | "empty" | "font" | "frame" | "iframe" | "image" | "manifest" | "object" | "script" | "style" | "track" | "video" | "worker" | (string & {});
+export type FetchMetadataPolicyOptions = {
+    /**
+     * Allows every cross-site request. Use this for a route that intentionally
+     * serves another site, such as a CORS API or a public embed.
+     */
+    allowCrossSite?: boolean;
+    /**
+     * Allows a safe top-level navigation, so a person can enter the site from a
+     * link on another site. The default is `true`.
+     */
+    allowNavigation?: boolean;
+    /**
+     * Allows `Sec-Fetch-Site: same-site`. Trust of a sibling subdomain must be
+     * explicit, because another team or an attacker can control that subdomain.
+     */
+    allowSameSite?: boolean;
+    /**
+     * Cross-site destinations that stay allowed, for example `"image"`.
+     */
+    allowedDestinations?: readonly FetchMetadataDestination[];
+};
+/**
+ * `true` uses the default resource-isolation rules. `false` and an omitted
+ * value keep the route unguarded, because the policy is opt-in.
+ */
+export type FetchMetadataPolicy = boolean | FetchMetadataPolicyOptions;
+export type FetchMetadataReason = "cors-preflight" | "cross-site-denied" | "cross-site-exempt" | "destination-exempt" | "metadata-absent" | "same-origin" | "same-site-denied" | "same-site-trusted" | "top-level-navigation" | "user-initiated";
+export type FetchMetadataCheck = {
+    allowed: boolean;
+    reason: FetchMetadataReason;
+    /** The `Sec-Fetch-*` fields that this decision read. */
+    vary: readonly string[];
+};
 export type RequestSecurityPolicy = {
     allowedMethods?: readonly HttpMethod[];
     maxBodySize?: number | `${number}${"b" | "gb" | "kb" | "mb"}`;
@@ -85,7 +154,7 @@ export type MemoryRateLimitStoreOptions = {
     maximumEntries?: number;
 };
 export type RateLimitStore = {
-    increment: (key: string, windowMs: number, now: number) => RateLimitResult;
+    increment: (key: string, windowMs: number, now: number) => RateLimitResult | Promise<RateLimitResult>;
 };
 /**
  * Sources a route needs beyond its inherited policy. Each entry widens one
@@ -98,6 +167,7 @@ export type RouteSecurityNeeds = {
 };
 export type RouteSecurityPolicy = {
     csrf?: CsrfPolicy;
+    fetchMetadata?: FetchMetadataPolicy;
     needs?: RouteSecurityNeeds;
     rateLimit?: RateLimitPolicy;
     request?: RequestSecurityPolicy;

package/dist/security/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/security/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,MAAM,MAAM,SAAS,GACjB,QAAQ,GACR,QAAQ,GACR,iBAAiB,GACjB,eAAe,GACf,kBAAkB,GAClB,OAAO,GACP,OAAO,GACP,QAAQ,GACR,OAAO,GACP,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,MAAM,MAAM,uBAAuB,CAAC,MAAM,SAAS,MAAM,GAAG,SAAS,IAAI;IACvE,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B,SAAS,SAAS,EAAE,GACpB,uBAAuB,GACvB,KAAK,CAAC;AAEV,MAAM,MAAM,iBAAiB,GACzB,kBAAkB,GAClB,uBAAuB,CAAC,oBAAoB,CAAC,GAC7C,SAAS,oBAAoB,EAAE,GAC/B,OAAO,CAAC;AAEZ,MAAM,MAAM,qBAAqB,GAAG;IAClC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,kEAAkE;IAClE,SAAS,CAAC,EACN,SAAS,oBAAoB,EAAE,GAC/B,uBAAuB,CAAC,oBAAoB,CAAC,GAC7C,KAAK,CAAC;IACV,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,SAAS,CAAC,EAAE,kBAAkB,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,IAAI,MAAM,EAAE,GAAG,WAAW,MAAM,EAAE,CAAC;AAEtE,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAEhF,MAAM,MAAM,cAAc,GACtB,aAAa,GACb,4BAA4B,GAC5B,QAAQ,GACR,0BAA0B,GAC1B,aAAa,GACb,eAAe,GACf,iCAAiC,GACjC,YAAY,CAAC;AAEjB,MAAM,MAAM,6BAA6B,GAAG;IAC1C,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,SAAS,GAAG,aAAa,CAAC;IAChC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,UAAU,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IAChC,OAAO,EAAE,GAAG,GAAG,SAAS,MAAM,EAAE,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC3B;IACA,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IAC/B,SAAS,EAAE,IAAI,CAAC;CACjB,GACC;IACA,OAAO,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IAChC,SAAS,CAAC,EAAE,KAAK,CAAC;CACnB,CAAC;AAEJ,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,IAAI,GAAG;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,cAAc,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IACvC,WAAW,CAAC,EAAE,MAAM,GAAG,GAAG,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;CAC/D,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG;IAChC,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,EAAE,YAAY,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,GAAG,GAAG,MAAM,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE,CAAC;CAChD,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,SAAS,EAAE,CACT,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,KACR,eAAe,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;IAC/B,GAAG,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;IAC3B,MAAM,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,OAAO,CAAC,EAAE,qBAAqB,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,EAAE;QACT,OAAO,CAAC,EAAE,sBAAsB,CAAC;QACjC,MAAM,EAAE,cAAc,CAAC;QACvB,kBAAkB,CAAC,EAAE,OAAO,GAAG,4BAA4B,CAAC;QAC5D,OAAO,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;KAChC,CAAC;IACF,KAAK,CAAC,EAAE;QACN,IAAI,CAAC,EAAE,UAAU,CAAC;QAClB,MAAM,EAAE,UAAU,CAAC;QACnB,QAAQ,CAAC,EAAE,mBAAmB,CAAC;KAChC,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,KAAK,CAAC,EAAE,oBAAoB,CAAC,OAAO,CAAC,CAAC;CACvC,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,gCAAgC,CAAC,EAAE,OAAO,CAAC;IAC3C,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,kBAAkB,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC;IACvC,yBAAyB,CAAC,EAAE,cAAc,GAAG,gBAAgB,GAAG,KAAK,CAAC;IACtE,uBAAuB,CAAC,EAAE,aAAa,GAAG,0BAA0B,GAAG,KAAK,CAAC;IAC7E,yBAAyB,CAAC,EAAE,aAAa,GAAG,WAAW,GAAG,cAAc,GAAG,KAAK,CAAC;IACjF,iBAAiB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACnC,cAAc,CAAC,EAAE,cAAc,GAAG,KAAK,CAAC;IACxC,kBAAkB,CAAC,EAAE,kBAAkB,GAAG,KAAK,CAAC;IAChD,uBAAuB,CAAC,EAAE,6BAA6B,GAAG,KAAK,CAAC;CACjE,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,CAAC,EAAE,qBAAqB,GAAG,KAAK,CAAC;IACpC,OAAO,CAAC,EAAE,oBAAoB,CAAC;IAC/B,YAAY,CAAC,EAAE,kBAAkB,GAAG,KAAK,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,uBAAuB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AACnF,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE9D,MAAM,MAAM,sBAAsB,GAAG;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/security/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,MAAM,MAAM,SAAS,GACjB,QAAQ,GACR,QAAQ,GACR,iBAAiB,GACjB,eAAe,GACf,kBAAkB,GAClB,OAAO,GACP,OAAO,GACP,QAAQ,GACR,OAAO,GACP,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,MAAM,MAAM,uBAAuB,CAAC,MAAM,SAAS,MAAM,GAAG,SAAS,IAAI;IACvE,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B,SAAS,SAAS,EAAE,GACpB,uBAAuB,GACvB,KAAK,CAAC;AAEV,MAAM,MAAM,eAAe,GACvB,iBAAiB,GACjB,aAAa,GACb,cAAc,GACd,wBAAwB,GACxB,oBAAoB,GACpB,cAAc,GACd,gCAAgC,GAChC,oBAAoB,GACpB,mBAAmB,GACnB,eAAe,GACf,sBAAsB,GACtB,yCAAyC,GACzC,0CAA0C,GAC1C,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,SAAS,eAAe,EAAE,GAAG,OAAO,CAAC;AAEvE,MAAM,MAAM,iBAAiB,GACzB,kBAAkB,GAClB,mBAAmB,GACnB,uBAAuB,CAAC,oBAAoB,CAAC,GAC7C,SAAS,oBAAoB,EAAE,GAC/B,OAAO,CAAC;AAEZ,MAAM,MAAM,qBAAqB,GAAG;IAClC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,kEAAkE;IAClE,SAAS,CAAC,EACN,SAAS,oBAAoB,EAAE,GAC/B,uBAAuB,CAAC,oBAAoB,CAAC,GAC7C,KAAK,CAAC;IACV,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,SAAS,CAAC,EAAE,kBAAkB,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,IAAI,MAAM,EAAE,GAAG,WAAW,MAAM,EAAE,CAAC;AAEtE,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAEhF,MAAM,MAAM,cAAc,GACtB,aAAa,GACb,4BAA4B,GAC5B,QAAQ,GACR,0BAA0B,GAC1B,aAAa,GACb,eAAe,GACf,iCAAiC,GACjC,YAAY,CAAC;AAEjB,MAAM,MAAM,6BAA6B,GAAG;IAC1C,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,IAAI,EAAE,SAAS,GAAG,aAAa,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,UAAU,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IAChC,OAAO,EAAE,GAAG,GAAG,SAAS,MAAM,EAAE,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC3B;IACA,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IAC/B,SAAS,EAAE,IAAI,CAAC;CACjB,GACC;IACA,OAAO,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IAChC,SAAS,CAAC,EAAE,KAAK,CAAC;CACnB,CAAC;AAEJ,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,IAAI,GAAG;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAChC,OAAO,GACP,UAAU,GACV,OAAO,GACP,OAAO,GACP,MAAM,GACN,OAAO,GACP,QAAQ,GACR,OAAO,GACP,UAAU,GACV,QAAQ,GACR,QAAQ,GACR,OAAO,GACP,OAAO,GACP,OAAO,GACP,QAAQ,GACR,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,MAAM,MAAM,0BAA0B,GAAG;IACvC;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;OAEG;IACH,mBAAmB,CAAC,EAAE,SAAS,wBAAwB,EAAE,CAAC;CAC3D,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,0BAA0B,CAAC;AAEvE,MAAM,MAAM,mBAAmB,GAC3B,gBAAgB,GAChB,mBAAmB,GACnB,mBAAmB,GACnB,oBAAoB,GACpB,iBAAiB,GACjB,aAAa,GACb,kBAAkB,GAClB,mBAAmB,GACnB,sBAAsB,GACtB,gBAAgB,CAAC;AAErB,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,wDAAwD;IACxD,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,cAAc,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IACvC,WAAW,CAAC,EAAE,MAAM,GAAG,GAAG,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;CAC/D,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG;IAChC,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,EAAE,YAAY,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,GAAG,GAAG,MAAM,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE,CAAC;CAChD,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAI3B,SAAS,EAAE,CACT,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,KACR,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CACjD,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;IAC/B,GAAG,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;IAC3B,MAAM,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,OAAO,CAAC,EAAE,qBAAqB,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,EAAE;QACT,OAAO,CAAC,EAAE,sBAAsB,CAAC;QACjC,MAAM,EAAE,cAAc,CAAC;QACvB,kBAAkB,CAAC,EAAE,OAAO,GAAG,4BAA4B,CAAC;QAC5D,OAAO,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;KAChC,CAAC;IACF,KAAK,CAAC,EAAE;QACN,IAAI,CAAC,EAAE,UAAU,CAAC;QAClB,MAAM,EAAE,UAAU,CAAC;QACnB,QAAQ,CAAC,EAAE,mBAAmB,CAAC;KAChC,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,KAAK,CAAC,EAAE,oBAAoB,CAAC,OAAO,CAAC,CAAC;CACvC,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,gCAAgC,CAAC,EAAE,OAAO,CAAC;IAC3C,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,kBAAkB,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC;IACvC,yBAAyB,CAAC,EAAE,cAAc,GAAG,gBAAgB,GAAG,KAAK,CAAC;IACtE,uBAAuB,CAAC,EAAE,aAAa,GAAG,0BAA0B,GAAG,KAAK,CAAC;IAC7E,yBAAyB,CAAC,EAAE,aAAa,GAAG,WAAW,GAAG,cAAc,GAAG,KAAK,CAAC;IACjF,iBAAiB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACnC,cAAc,CAAC,EAAE,cAAc,GAAG,KAAK,CAAC;IACxC,kBAAkB,CAAC,EAAE,kBAAkB,GAAG,KAAK,CAAC;IAChD,uBAAuB,CAAC,EAAE,6BAA6B,GAAG,KAAK,CAAC;CACjE,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,CAAC,EAAE,qBAAqB,GAAG,KAAK,CAAC;IACpC,OAAO,CAAC,EAAE,oBAAoB,CAAC;IAC/B,YAAY,CAAC,EAAE,kBAAkB,GAAG,KAAK,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,uBAAuB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AACnF,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE9D,MAAM,MAAM,sBAAsB,GAAG;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC"}

package/dist/server/document-shell.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"document-shell.d.ts","sourceRoot":"","sources":["../../src/server/document-shell.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,OAAO,CAAC;AAK9C,eAAO,MAAM,kBAAkB,yDACuB,CAAC;AAEvD,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,gBAAgB,GAAG;IAAE,OAAO,CAAC,EAAE,SAAS,EAAE,CAAA;CAAE,GACpD,OAAO,CAAC,aAAa,CAAC,CAsCxB"}
+{"version":3,"file":"document-shell.d.ts","sourceRoot":"","sources":["../../src/server/document-shell.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,OAAO,CAAC;AAK9C,eAAO,MAAM,kBAAkB,yDACuB,CAAC;AAEvD,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,gBAAgB,GAAG;IAAE,OAAO,CAAC,EAAE,SAAS,EAAE,CAAA;CAAE,GACpD,OAAO,CAAC,aAAa,CAAC,CAuCxB"}

package/dist/server/errors.d.ts

@@ -4,6 +4,7 @@ import type { SsrRenderOptions } from "./ssr";
 export type ErrorRenderOptions = SsrRenderOptions & {
     dev?: boolean;
     onError?: (error: unknown, site: FailureSite) => void;
+    pathname?: string;
     transformDocument?: (html: string) => string | Promise<string>;
 };
 export declare function isDevErrorRendering(dev: boolean | undefined): boolean;

package/dist/server/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/server/errors.ts"],"names":[],"mappings":"AAIA,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAIlE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAGlD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,OAAO,CAAC;AAE9C,MAAM,MAAM,kBAAkB,GAAG,gBAAgB,GAAG;IAClD,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,KAAK,IAAI,CAAC;IACtD,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAChE,CAAC;AAMF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,SAAS,WAE3D;AAED,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,aAAa,EACvB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,WAAW,EACjB,OAAO,GAAE,kBAAuB,qBAiBjC;AAED,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,GAAG,EACR,KAAK,EAAE,OAAO,EACd,OAAO,GAAE,kBAAuB,YA0BjC;AAqCD,wBAAgB,4BAA4B,aAK3C"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/server/errors.ts"],"names":[],"mappings":"AAQA,OAAO,EAKL,KAAK,aAAa,EACnB,MAAM,WAAW,CAAC;AAInB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAGlD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,OAAO,CAAC;AAE9C,MAAM,MAAM,kBAAkB,GAAG,gBAAgB,GAAG;IAClD,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,KAAK,IAAI,CAAC;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAChE,CAAC;AAMF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,SAAS,WAE3D;AAED,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,aAAa,EACvB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,WAAW,EACjB,OAAO,GAAE,kBAAuB,qBA6CjC;AAED,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,GAAG,EACR,KAAK,EAAE,OAAO,EACd,OAAO,GAAE,kBAAuB,YA0BjC;AAqCD,wBAAgB,4BAA4B,aAK3C"}

package/dist/server/index.d.ts

@@ -1,4 +1,5 @@
-export { createRequestHandler, handleRequestWithManifest, } from "./request-handler";
+export { createRequestHandler, handleRequestWithManifest, loadInheritedRoutePolicy, } from "./request-handler";
+export { getRequestClientAddress } from "./request-metadata";
 export { renderPageDocument, renderPageResponse } from "./ssr";
 export { createErrorProblemResponse, createPlainTextErrorResponse, isDevErrorRendering, renderFailureResponse, } from "./errors";
 export { BuiltInError, BuiltInNotFound, DevError } from "./fallbacks";

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,OAAO,CAAC;AAC/D,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EACL,6BAA6B,EAC7B,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,OAAO,CAAC;AAC1D,YAAY,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AACnD,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,YAAY,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACzD,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAChD,YAAY,EACV,YAAY,EACZ,wBAAwB,EACxB,oBAAoB,EACpB,cAAc,EACd,qBAAqB,GACtB,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,OAAO,CAAC;AAC/D,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EACL,6BAA6B,EAC7B,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,OAAO,CAAC;AAC1D,YAAY,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AACnD,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,YAAY,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACzD,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAChD,YAAY,EACV,YAAY,EACZ,wBAAwB,EACxB,oBAAoB,EACpB,cAAc,EACd,qBAAqB,GACtB,MAAM,mBAAmB,CAAC"}

package/dist/server/not-found.d.ts

@@ -3,6 +3,7 @@ import type { FailureSite } from "./failure-site";
 import type { SsrRenderOptions } from "./ssr";
 export type NotFoundRenderOptions = SsrRenderOptions & {
     onError?: (error: unknown, site: FailureSite) => void;
+    pathname?: string;
     transformDocument?: (html: string) => string | Promise<string>;
 };
 export declare function createNotFoundProblemResponse(url: URL): Response;

package/dist/server/not-found.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"not-found.d.ts","sourceRoot":"","sources":["../../src/server/not-found.ts"],"names":[],"mappings":"AAIA,OAAO,EAGL,KAAK,mBAAmB,EACxB,KAAK,aAAa,EACnB,MAAM,WAAW,CAAC;AAQnB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAGlD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,OAAO,CAAC;AAE9C,MAAM,MAAM,qBAAqB,GAAG,gBAAgB,GAAG;IACrD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,KAAK,IAAI,CAAC;IAGtD,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAChE,CAAC;AAEF,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,GAAG,YAMrD;AAKD,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,aAAa,EACvB,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,qBAA0B,qBA6BpC;AAaD,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,mBAAmB,EAC1B,OAAO,GAAE,qBAA0B,UAoBpC"}
+{"version":3,"file":"not-found.d.ts","sourceRoot":"","sources":["../../src/server/not-found.ts"],"names":[],"mappings":"AAIA,OAAO,EAML,KAAK,mBAAmB,EACxB,KAAK,aAAa,EACnB,MAAM,WAAW,CAAC;AAQnB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAGlD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,OAAO,CAAC;AAE9C,MAAM,MAAM,qBAAqB,GAAG,gBAAgB,GAAG;IACrD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,KAAK,IAAI,CAAC;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAGlB,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAChE,CAAC;AAEF,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,GAAG,YAMrD;AAKD,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,aAAa,EACvB,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,qBAA0B,qBA+CpC;AAaD,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,mBAAmB,EAC1B,OAAO,GAAE,qBAA0B,UAoBpC"}

package/dist/server/render-tree.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render-tree.d.ts","sourceRoot":"","sources":["../../src/server/render-tree.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AACtD,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,gBAAgB,EACvB,OAAO,CAAC,EAAE,mBAAmB,yeAmB9B;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,gBAAgB,EACvB,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,uBAOhD"}
+{"version":3,"file":"render-tree.d.ts","sourceRoot":"","sources":["../../src/server/render-tree.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AACtD,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,gBAAgB,EACvB,OAAO,CAAC,EAAE,mBAAmB,yeAqB9B;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,gBAAgB,EACvB,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,uBAOhD"}