@engjts/nexus 0.1.0

package/dist/security/csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../../src/security/csrf.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AA8FH,oBAoDC;AAiBD,8CAoCC;AAKD,wCAWC;AAjND;;;GAGG;AACH,MAAM,kBAAkB;IACH,WAAW,CAAS;IAErC,YAAY,cAAsB,EAAE;QAChC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACnC,CAAC;IAED,aAAa,CAAC,IAAa;QACvB,wBAAwB;QACxB,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QACvE,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;aACnB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aACzC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IAED,aAAa,CAAC,GAAY,EAAE,KAAa;QACrC,qFAAqF;QACrF,MAAM,WAAW,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAErD,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,qDAAqD;QACrD,OAAO,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACxD,CAAC;IAED,YAAY,CAAC,GAAY;QACrB,mBAAmB;QACnB,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC9E,IAAI,UAAU,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QAClE,CAAC;QAED,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC/E,IAAI,eAAe,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;QACjF,CAAC;QAED,WAAW;QACX,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3C,OAAQ,GAAG,CAAC,IAAY,CAAC,KAAK,IAAK,GAAG,CAAC,IAAY,CAAC,UAAU,IAAI,IAAI,CAAC;QAC3E,CAAC;QAED,OAAO,IAAI,CAAC;IAChB,CAAC;IAEO,sBAAsB,CAAC,GAAY;QACvC,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,CAAC,eAAe,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;QAE3F,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC;IAEO,mBAAmB,CAAC,CAAS,EAAE,CAAS;QAC5C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC;QAED,OAAO,MAAM,KAAK,CAAC,CAAC;IACxB,CAAC;CACJ;AAED;;;;;;;;;;GAUG;AACH,SAAgB,IAAI,CAChB,SAAqB,EAAE,EACvB,OAAqB;IAErB,MAAM,WAAW,GAAG,OAAO,IAAI,IAAI,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC;IACnC,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAC3E,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;IAEjD,OAAO,KAAK,EAAE,GAAY,EAAE,IAAU,EAAE,KAAU,EAAE,EAAE;QAClD,oBAAoB;QACpB,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QAED,uBAAuB;QACvB,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;YACjE,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC;QACL,CAAC;QAED,sBAAsB;QACtB,IAAI,IAAI,EAAE,CAAC;YACP,MAAM,KAAK,GAAG,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAE5C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,OAAO;oBACH,UAAU,EAAE,GAAG;oBACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACjB,KAAK,EAAE,oBAAoB;qBAC9B,CAAC;iBACL,CAAC;YACN,CAAC;YAED,MAAM,KAAK,GAAG,WAAW,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAEpD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,OAAO;oBACH,UAAU,EAAE,GAAG;oBACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACjB,KAAK,EAAE,oBAAoB;qBAC9B,CAAC;iBACL,CAAC;YACN,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,iBAAiB,CAC7B,SAAqB,EAAE,EACvB,OAAqB;IAErB,MAAM,WAAW,GAAG,OAAO,IAAI,IAAI,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC1E,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,OAAO,CAAC;IAClD,MAAM,aAAa,GAAG;QAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,IAAI,QAAQ;QAC7C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,KAAK,KAAK;QACvC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,KAAK,KAAK;KAC9C,CAAC;IAEF,OAAO,KAAK,EAAE,GAAY,EAAE,IAAU,EAAE,KAAU,EAAE,EAAE;QAClD,iBAAiB;QACjB,MAAM,KAAK,GAAG,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAE7C,oBAAoB;QACnB,GAAW,CAAC,SAAS,GAAG,KAAK,CAAC;QAE/B,kBAAkB;QAClB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;QAEjC,aAAa;QACb,MAAM,WAAW,GAAG,GAAG,UAAU,IAAI,KAAK,cAAc,aAAa,CAAC,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC;QAE/K,oCAAoC;QACpC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YAClC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,WAAW,CAAC;QACjD,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;YACvD,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACJ,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,CAAC;QACnF,CAAC;QAED,OAAO,QAAQ,CAAC;IACpB,CAAC,CAAC;AACN,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,SAAqB,EAAE;IAClD,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,kBAAkB,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAExC,OAAO,KAAK,EAAE,GAAY,EAAE,IAAU,EAAE,IAAS,EAAE,EAAE;QACjD,uBAAuB;QACvB,OAAO,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,YAAqB,EAAE,EAAE;YAC3D,kCAAkC;YAClC,OAAO,kBAAkB,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACxD,CAAC,EAAE,IAAI,CAAC,CAAC;IACb,CAAC,CAAC;AACN,CAAC"}

package/dist/security/headers.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Security Headers Middleware
+ *
+ * Automatically applies security headers to responses
+ */
+import type { Middleware } from '../core/types';
+import type { SecurityHeadersConfig } from './types';
+import type { SecurityHeadersAdapter } from './adapter';
+/**
+ * Create security headers middleware
+ *
+ * @example
+ * ```ts
+ * app.use(securityHeaders({
+ *   mode: 'strict',
+ *   csp: {
+ *     directives: {
+ *       'default-src': ["'self'"],
+ *       'script-src': ["'self'", "'nonce'"]
+ *     }
+ *   }
+ * }));
+ * ```
+ */
+export declare function securityHeaders(config?: SecurityHeadersConfig, adapter?: SecurityHeadersAdapter): Middleware;
+/**
+ * Strict security headers preset
+ */
+export declare function strictSecurityHeaders(customConfig?: Partial<SecurityHeadersConfig>): Middleware;
+/**
+ * Moderate security headers preset
+ */
+export declare function moderateSecurityHeaders(customConfig?: Partial<SecurityHeadersConfig>): Middleware;
+//# sourceMappingURL=headers.d.ts.map

package/dist/security/headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"headers.d.ts","sourceRoot":"","sources":["../../src/security/headers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAiB,UAAU,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAGxD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAC3B,MAAM,GAAE,qBAA0B,EAClC,OAAO,CAAC,EAAE,sBAAsB,GACjC,UAAU,CAoCZ;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,GAAE,OAAO,CAAC,qBAAqB,CAAM,GAAG,UAAU,CAkBnG;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,YAAY,GAAE,OAAO,CAAC,qBAAqB,CAAM,GAAG,UAAU,CAarG"}

package/dist/security/headers.js

@@ -0,0 +1,95 @@
+"use strict";
+/**
+ * Security Headers Middleware
+ *
+ * Automatically applies security headers to responses
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.securityHeaders = securityHeaders;
+exports.strictSecurityHeaders = strictSecurityHeaders;
+exports.moderateSecurityHeaders = moderateSecurityHeaders;
+const adapter_1 = require("./adapter");
+/**
+ * Create security headers middleware
+ *
+ * @example
+ * ```ts
+ * app.use(securityHeaders({
+ *   mode: 'strict',
+ *   csp: {
+ *     directives: {
+ *       'default-src': ["'self'"],
+ *       'script-src': ["'self'", "'nonce'"]
+ *     }
+ *   }
+ * }));
+ * ```
+ */
+function securityHeaders(config = {}, adapter) {
+    const adapterInstance = adapter || new adapter_1.DefaultSecurityHeadersAdapter();
+    const nonces = new WeakMap();
+    return async (ctx, next, _deps) => {
+        // Generate nonce if CSP uses it
+        if (config.autoNonce && config.csp) {
+            const nonce = adapterInstance.generateNonce?.() || crypto.randomUUID();
+            nonces.set(ctx, nonce);
+            // Replace 'nonce' placeholder in CSP directives
+            if (config.csp.directives) {
+                for (const [key, values] of Object.entries(config.csp.directives)) {
+                    config.csp.directives[key] = values.map(v => v === "'nonce'" ? `'nonce-${nonce}'` : v);
+                }
+            }
+            // Attach nonce to context for use in templates
+            ctx.nonce = nonce;
+        }
+        // Generate headers
+        const headers = adapterInstance.generateHeaders(ctx, config);
+        // Execute handler
+        const response = await next(ctx);
+        // Apply headers to response
+        for (const [name, value] of Object.entries(headers)) {
+            response.headers[name] = value;
+        }
+        return response;
+    };
+}
+/**
+ * Strict security headers preset
+ */
+function strictSecurityHeaders(customConfig = {}) {
+    return securityHeaders({
+        mode: 'strict',
+        csp: {
+            directives: {
+                'default-src': ["'self'"],
+                'script-src': ["'self'"],
+                'style-src': ["'self'"],
+                'img-src': ["'self'", 'data:', 'https:'],
+                'font-src': ["'self'"],
+                'connect-src': ["'self'"],
+                'frame-ancestors': ["'none'"],
+                'base-uri': ["'self'"],
+                'form-action': ["'self'"]
+            }
+        },
+        ...customConfig
+    });
+}
+/**
+ * Moderate security headers preset
+ */
+function moderateSecurityHeaders(customConfig = {}) {
+    return securityHeaders({
+        mode: 'moderate',
+        csp: {
+            directives: {
+                'default-src': ["'self'"],
+                'script-src': ["'self'", "'unsafe-inline'"],
+                'style-src': ["'self'", "'unsafe-inline'"],
+                'img-src': ["'self'", 'data:', 'https:']
+            }
+        },
+        ...customConfig
+    });
+}
+//# sourceMappingURL=headers.js.map

package/dist/security/headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"headers.js","sourceRoot":"","sources":["../../src/security/headers.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAuBH,0CAuCC;AAKD,sDAkBC;AAKD,0DAaC;AAlGD,uCAA0D;AAE1D;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,eAAe,CAC3B,SAAgC,EAAE,EAClC,OAAgC;IAEhC,MAAM,eAAe,GAAG,OAAO,IAAI,IAAI,uCAA6B,EAAE,CAAC;IACvE,MAAM,MAAM,GAAG,IAAI,OAAO,EAAmB,CAAC;IAE9C,OAAO,KAAK,EAAE,GAAY,EAAE,IAAU,EAAE,KAAU,EAAE,EAAE;QAClD,gCAAgC;QAChC,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,eAAe,CAAC,aAAa,EAAE,EAAE,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACvE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAEvB,gDAAgD;YAChD,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;gBACxB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;oBAChE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CACxC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAC3C,CAAC;gBACN,CAAC;YACL,CAAC;YAED,+CAA+C;YAC9C,GAAW,CAAC,KAAK,GAAG,KAAK,CAAC;QAC/B,CAAC;QAED,mBAAmB;QACnB,MAAM,OAAO,GAAG,eAAe,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAE7D,kBAAkB;QAClB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;QAEjC,4BAA4B;QAC5B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACnC,CAAC;QAED,OAAO,QAAQ,CAAC;IACpB,CAAC,CAAC;AACN,CAAC;AAED;;GAEG;AACH,SAAgB,qBAAqB,CAAC,eAA+C,EAAE;IACnF,OAAO,eAAe,CAAC;QACnB,IAAI,EAAE,QAAQ;QACd,GAAG,EAAE;YACD,UAAU,EAAE;gBACR,aAAa,EAAE,CAAC,QAAQ,CAAC;gBACzB,YAAY,EAAE,CAAC,QAAQ,CAAC;gBACxB,WAAW,EAAE,CAAC,QAAQ,CAAC;gBACvB,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC;gBACxC,UAAU,EAAE,CAAC,QAAQ,CAAC;gBACtB,aAAa,EAAE,CAAC,QAAQ,CAAC;gBACzB,iBAAiB,EAAE,CAAC,QAAQ,CAAC;gBAC7B,UAAU,EAAE,CAAC,QAAQ,CAAC;gBACtB,aAAa,EAAE,CAAC,QAAQ,CAAC;aAC5B;SACJ;QACD,GAAG,YAAY;KAClB,CAAC,CAAC;AACP,CAAC;AAED;;GAEG;AACH,SAAgB,uBAAuB,CAAC,eAA+C,EAAE;IACrF,OAAO,eAAe,CAAC;QACnB,IAAI,EAAE,UAAU;QAChB,GAAG,EAAE;YACD,UAAU,EAAE;gBACR,aAAa,EAAE,CAAC,QAAQ,CAAC;gBACzB,YAAY,EAAE,CAAC,QAAQ,EAAE,iBAAiB,CAAC;gBAC3C,WAAW,EAAE,CAAC,QAAQ,EAAE,iBAAiB,CAAC;gBAC1C,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC;aAC3C;SACJ;QACD,GAAG,YAAY;KAClB,CAAC,CAAC;AACP,CAAC"}

package/dist/security/index.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Security Module Entry Point
+ *
+ * Exports all security features
+ */
+export * from './types';
+export * from './adapter';
+export { securityHeaders, strictSecurityHeaders, moderateSecurityHeaders } from './headers';
+export { sanitizeInput, strictSanitization, lenientSanitization } from './sanitization';
+export { authenticate, optionalAuth, requireAuth, requirePermissions, requireRoles } from './auth/middleware';
+export { JWTAuthAdapter } from './auth/jwt';
+export { JWTProvider, createJWTProvider } from './auth/JWTProvider';
+export type { JWTProviderConfig, TokenPayload, VerifyResult } from './auth/JWTProvider';
+export { jwtPlugin } from './auth/JWTPlugin';
+export type { JWTPluginConfig, JWTPluginExports } from './auth/JWTPlugin';
+export { rateLimit, strictRateLimit, lenientRateLimit } from './rate-limit/middleware';
+export { MemoryRateLimiter } from './rate-limit/memory';
+export { csrf, generateCSRFToken, csrfProtection } from './csrf';
+//# sourceMappingURL=index.d.ts.map

package/dist/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,cAAc,SAAS,CAAC;AAGxB,cAAc,WAAW,CAAC;AAG1B,OAAO,EACH,eAAe,EACf,qBAAqB,EACrB,uBAAuB,EAC1B,MAAM,WAAW,CAAC;AAGnB,OAAO,EACH,aAAa,EACb,kBAAkB,EAClB,mBAAmB,EACtB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACH,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,YAAY,EACf,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAG5C,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACpE,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGxF,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAG1E,OAAO,EACH,SAAS,EACT,eAAe,EACf,gBAAgB,EACnB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAGxD,OAAO,EACH,IAAI,EACJ,iBAAiB,EACjB,cAAc,EACjB,MAAM,QAAQ,CAAC"}

package/dist/security/index.js

@@ -0,0 +1,65 @@
+"use strict";
+/**
+ * Security Module Entry Point
+ *
+ * Exports all security features
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.csrfProtection = exports.generateCSRFToken = exports.csrf = exports.MemoryRateLimiter = exports.lenientRateLimit = exports.strictRateLimit = exports.rateLimit = exports.jwtPlugin = exports.createJWTProvider = exports.JWTProvider = exports.JWTAuthAdapter = exports.requireRoles = exports.requirePermissions = exports.requireAuth = exports.optionalAuth = exports.authenticate = exports.lenientSanitization = exports.strictSanitization = exports.sanitizeInput = exports.moderateSecurityHeaders = exports.strictSecurityHeaders = exports.securityHeaders = void 0;
+// Types
+__exportStar(require("./types"), exports);
+// Adapters
+__exportStar(require("./adapter"), exports);
+// Security Headers
+var headers_1 = require("./headers");
+Object.defineProperty(exports, "securityHeaders", { enumerable: true, get: function () { return headers_1.securityHeaders; } });
+Object.defineProperty(exports, "strictSecurityHeaders", { enumerable: true, get: function () { return headers_1.strictSecurityHeaders; } });
+Object.defineProperty(exports, "moderateSecurityHeaders", { enumerable: true, get: function () { return headers_1.moderateSecurityHeaders; } });
+// Input Sanitization
+var sanitization_1 = require("./sanitization");
+Object.defineProperty(exports, "sanitizeInput", { enumerable: true, get: function () { return sanitization_1.sanitizeInput; } });
+Object.defineProperty(exports, "strictSanitization", { enumerable: true, get: function () { return sanitization_1.strictSanitization; } });
+Object.defineProperty(exports, "lenientSanitization", { enumerable: true, get: function () { return sanitization_1.lenientSanitization; } });
+// Authentication
+var middleware_1 = require("./auth/middleware");
+Object.defineProperty(exports, "authenticate", { enumerable: true, get: function () { return middleware_1.authenticate; } });
+Object.defineProperty(exports, "optionalAuth", { enumerable: true, get: function () { return middleware_1.optionalAuth; } });
+Object.defineProperty(exports, "requireAuth", { enumerable: true, get: function () { return middleware_1.requireAuth; } });
+Object.defineProperty(exports, "requirePermissions", { enumerable: true, get: function () { return middleware_1.requirePermissions; } });
+Object.defineProperty(exports, "requireRoles", { enumerable: true, get: function () { return middleware_1.requireRoles; } });
+var jwt_1 = require("./auth/jwt");
+Object.defineProperty(exports, "JWTAuthAdapter", { enumerable: true, get: function () { return jwt_1.JWTAuthAdapter; } });
+// JWT Provider (for DI)
+var JWTProvider_1 = require("./auth/JWTProvider");
+Object.defineProperty(exports, "JWTProvider", { enumerable: true, get: function () { return JWTProvider_1.JWTProvider; } });
+Object.defineProperty(exports, "createJWTProvider", { enumerable: true, get: function () { return JWTProvider_1.createJWTProvider; } });
+// JWT Plugin
+var JWTPlugin_1 = require("./auth/JWTPlugin");
+Object.defineProperty(exports, "jwtPlugin", { enumerable: true, get: function () { return JWTPlugin_1.jwtPlugin; } });
+// Rate Limiting
+var middleware_2 = require("./rate-limit/middleware");
+Object.defineProperty(exports, "rateLimit", { enumerable: true, get: function () { return middleware_2.rateLimit; } });
+Object.defineProperty(exports, "strictRateLimit", { enumerable: true, get: function () { return middleware_2.strictRateLimit; } });
+Object.defineProperty(exports, "lenientRateLimit", { enumerable: true, get: function () { return middleware_2.lenientRateLimit; } });
+var memory_1 = require("./rate-limit/memory");
+Object.defineProperty(exports, "MemoryRateLimiter", { enumerable: true, get: function () { return memory_1.MemoryRateLimiter; } });
+// CSRF Protection
+var csrf_1 = require("./csrf");
+Object.defineProperty(exports, "csrf", { enumerable: true, get: function () { return csrf_1.csrf; } });
+Object.defineProperty(exports, "generateCSRFToken", { enumerable: true, get: function () { return csrf_1.generateCSRFToken; } });
+Object.defineProperty(exports, "csrfProtection", { enumerable: true, get: function () { return csrf_1.csrfProtection; } });
+//# sourceMappingURL=index.js.map

package/dist/security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;;;;;;;;;;;;;;AAEH,QAAQ;AACR,0CAAwB;AAExB,WAAW;AACX,4CAA0B;AAE1B,mBAAmB;AACnB,qCAImB;AAHf,0GAAA,eAAe,OAAA;AACf,gHAAA,qBAAqB,OAAA;AACrB,kHAAA,uBAAuB,OAAA;AAG3B,qBAAqB;AACrB,+CAIwB;AAHpB,6GAAA,aAAa,OAAA;AACb,kHAAA,kBAAkB,OAAA;AAClB,mHAAA,mBAAmB,OAAA;AAGvB,iBAAiB;AACjB,gDAM2B;AALvB,0GAAA,YAAY,OAAA;AACZ,0GAAA,YAAY,OAAA;AACZ,yGAAA,WAAW,OAAA;AACX,gHAAA,kBAAkB,OAAA;AAClB,0GAAA,YAAY,OAAA;AAGhB,kCAA4C;AAAnC,qGAAA,cAAc,OAAA;AAEvB,wBAAwB;AACxB,kDAAoE;AAA3D,0GAAA,WAAW,OAAA;AAAE,gHAAA,iBAAiB,OAAA;AAGvC,aAAa;AACb,8CAA6C;AAApC,sGAAA,SAAS,OAAA;AAGlB,gBAAgB;AAChB,sDAIiC;AAH7B,uGAAA,SAAS,OAAA;AACT,6GAAA,eAAe,OAAA;AACf,8GAAA,gBAAgB,OAAA;AAGpB,8CAAwD;AAA/C,2GAAA,iBAAiB,OAAA;AAE1B,kBAAkB;AAClB,+BAIgB;AAHZ,4FAAA,IAAI,OAAA;AACJ,yGAAA,iBAAiB,OAAA;AACjB,sGAAA,cAAc,OAAA"}

package/dist/security/rate-limit/adapter.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Rate Limit Adapter Interface
+ *
+ * Extensible rate limiting storage backends
+ */
+export type { RateLimitAdapter } from '../adapter';
+//# sourceMappingURL=adapter.d.ts.map

package/dist/security/rate-limit/adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../../src/security/rate-limit/adapter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}

package/dist/security/rate-limit/adapter.js

@@ -0,0 +1,8 @@
+"use strict";
+/**
+ * Rate Limit Adapter Interface
+ *
+ * Extensible rate limiting storage backends
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=adapter.js.map

package/dist/security/rate-limit/adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../../../src/security/rate-limit/adapter.ts"],"names":[],"mappings":";AAAA;;;;GAIG"}

package/dist/security/rate-limit/memory.d.ts

@@ -0,0 +1,28 @@
+/**
+ * In-Memory Rate Limiter
+ *
+ * Simple in-memory rate limiting implementation
+ */
+import type { RateLimitAdapter } from '../adapter';
+import type { RateLimitInfo } from '../types';
+/**
+ * In-memory rate limit storage
+ * Uses sliding window algorithm
+ */
+export declare class MemoryRateLimiter implements RateLimitAdapter {
+    private store;
+    private cleanupInterval;
+    constructor(cleanupIntervalMs?: number);
+    increment(key: string, windowMs: number): Promise<{
+        count: number;
+        resetTime: number;
+    }>;
+    get(key: string): Promise<RateLimitInfo | null>;
+    reset(key: string): Promise<void>;
+    cleanup(): Promise<void>;
+    /**
+     * Stop cleanup interval
+     */
+    destroy(): void;
+}
+//# sourceMappingURL=memory.d.ts.map

package/dist/security/rate-limit/memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../../src/security/rate-limit/memory.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAQ9C;;;GAGG;AACH,qBAAa,iBAAkB,YAAW,gBAAgB;IACtD,OAAO,CAAC,KAAK,CAAqC;IAClD,OAAO,CAAC,eAAe,CAA+B;gBAE1C,iBAAiB,GAAE,MAAc;IAOvC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QACpD,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;KACrB,CAAC;IA4BI,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAuB/C,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAU9B;;OAEG;IACH,OAAO,IAAI,IAAI;CAMlB"}

package/dist/security/rate-limit/memory.js

@@ -0,0 +1,85 @@
+"use strict";
+/**
+ * In-Memory Rate Limiter
+ *
+ * Simple in-memory rate limiting implementation
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MemoryRateLimiter = void 0;
+/**
+ * In-memory rate limit storage
+ * Uses sliding window algorithm
+ */
+class MemoryRateLimiter {
+    store = new Map();
+    cleanupInterval = null;
+    constructor(cleanupIntervalMs = 60000) {
+        // Periodic cleanup of expired entries
+        this.cleanupInterval = setInterval(() => {
+            this.cleanup();
+        }, cleanupIntervalMs);
+    }
+    async increment(key, windowMs) {
+        const now = Date.now();
+        const entry = this.store.get(key);
+        // No existing entry or expired
+        if (!entry || now >= entry.resetTime) {
+            const newEntry = {
+                count: 1,
+                resetTime: now + windowMs,
+                firstRequest: now
+            };
+            this.store.set(key, newEntry);
+            return {
+                count: 1,
+                resetTime: newEntry.resetTime
+            };
+        }
+        // Increment existing entry
+        entry.count++;
+        return {
+            count: entry.count,
+            resetTime: entry.resetTime
+        };
+    }
+    async get(key) {
+        const entry = this.store.get(key);
+        if (!entry) {
+            return null;
+        }
+        const now = Date.now();
+        // Expired
+        if (now >= entry.resetTime) {
+            this.store.delete(key);
+            return null;
+        }
+        return {
+            limit: -1, // Will be set by middleware
+            remaining: -1, // Will be calculated by middleware
+            reset: Math.floor(entry.resetTime / 1000),
+            retryAfter: Math.ceil((entry.resetTime - now) / 1000)
+        };
+    }
+    async reset(key) {
+        this.store.delete(key);
+    }
+    async cleanup() {
+        const now = Date.now();
+        for (const [key, entry] of this.store.entries()) {
+            if (now >= entry.resetTime) {
+                this.store.delete(key);
+            }
+        }
+    }
+    /**
+     * Stop cleanup interval
+     */
+    destroy() {
+        if (this.cleanupInterval) {
+            clearInterval(this.cleanupInterval);
+            this.cleanupInterval = null;
+        }
+    }
+}
+exports.MemoryRateLimiter = MemoryRateLimiter;
+//# sourceMappingURL=memory.js.map

package/dist/security/rate-limit/memory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../../src/security/rate-limit/memory.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAWH;;;GAGG;AACH,MAAa,iBAAiB;IAClB,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC1C,eAAe,GAA0B,IAAI,CAAC;IAEtD,YAAY,oBAA4B,KAAK;QACzC,sCAAsC;QACtC,IAAI,CAAC,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE;YACpC,IAAI,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,QAAgB;QAIzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAElC,+BAA+B;QAC/B,IAAI,CAAC,KAAK,IAAI,GAAG,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAmB;gBAC7B,KAAK,EAAE,CAAC;gBACR,SAAS,EAAE,GAAG,GAAG,QAAQ;gBACzB,YAAY,EAAE,GAAG;aACpB,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAE9B,OAAO;gBACH,KAAK,EAAE,CAAC;gBACR,SAAS,EAAE,QAAQ,CAAC,SAAS;aAChC,CAAC;QACN,CAAC;QAED,2BAA2B;QAC3B,KAAK,CAAC,KAAK,EAAE,CAAC;QAEd,OAAO;YACH,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC7B,CAAC;IACN,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACjB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAElC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,UAAU;QACV,IAAI,GAAG,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,OAAO;YACH,KAAK,EAAE,CAAC,CAAC,EAAE,4BAA4B;YACvC,SAAS,EAAE,CAAC,CAAC,EAAE,mCAAmC;YAClD,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;YACzC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC;SACxD,CAAC;IACN,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW;QACnB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,OAAO;QACT,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9C,IAAI,GAAG,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACzB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;QACL,CAAC;IACL,CAAC;IAED;;OAEG;IACH,OAAO;QACH,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACpC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAChC,CAAC;IACL,CAAC;CACJ;AAxFD,8CAwFC"}

package/dist/security/rate-limit/middleware.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Rate Limiting Middleware
+ *
+ * Adaptive rate limiting with various strategies
+ */
+import type { Middleware } from '../../core/types';
+import type { RateLimitConfig } from '../types';
+import type { RateLimitAdapter } from '../adapter';
+/**
+ * Create rate limiting middleware
+ *
+ * @example
+ * ```ts
+ * app.use(rateLimit({
+ *   window: '15m',
+ *   max: 100,
+ *   routes: {
+ *     'POST /api/login': { max: 5, window: '5m' }
+ *   }
+ * }));
+ * ```
+ */
+export declare function rateLimit(config: RateLimitConfig, adapter?: RateLimitAdapter): Middleware;
+/**
+ * Strict rate limiting for sensitive endpoints
+ */
+export declare function strictRateLimit(max?: number, window?: string | number): Middleware;
+/**
+ * Lenient rate limiting for public endpoints
+ */
+export declare function lenientRateLimit(max?: number, window?: string | number): Middleware;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/security/rate-limit/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../../src/security/rate-limit/middleware.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAiB,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,KAAK,EAAE,eAAe,EAAiB,MAAM,UAAU,CAAC;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAsDnD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,SAAS,CACrB,MAAM,EAAE,eAAe,EACvB,OAAO,CAAC,EAAE,gBAAgB,GAC3B,UAAU,CAgFZ;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAU,EAAE,MAAM,GAAE,MAAM,GAAG,MAAa,GAAG,UAAU,CAM3F;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAa,EAAE,MAAM,GAAE,MAAM,GAAG,MAAc,GAAG,UAAU,CAKhG"}

package/dist/security/rate-limit/middleware.js

@@ -0,0 +1,159 @@
+"use strict";
+/**
+ * Rate Limiting Middleware
+ *
+ * Adaptive rate limiting with various strategies
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rateLimit = rateLimit;
+exports.strictRateLimit = strictRateLimit;
+exports.lenientRateLimit = lenientRateLimit;
+const memory_1 = require("./memory");
+/**
+ * Parse time window string to milliseconds
+ */
+function parseWindow(window) {
+    if (typeof window === 'number') {
+        return window;
+    }
+    const match = window.match(/^(\d+)([smhd])$/);
+    if (!match) {
+        throw new Error('Invalid window format');
+    }
+    const value = parseInt(match[1]);
+    const unit = match[2];
+    const multipliers = {
+        s: 1000,
+        m: 60000,
+        h: 3600000,
+        d: 86400000
+    };
+    return value * multipliers[unit];
+}
+/**
+ * Default key generator - uses IP address
+ */
+function defaultKeyGenerator(ctx) {
+    // Try to get real IP from headers
+    const forwardedRaw = ctx.headers['x-forwarded-for'] || ctx.headers['X-Forwarded-For'];
+    if (forwardedRaw) {
+        const forwarded = Array.isArray(forwardedRaw) ? forwardedRaw[0] : forwardedRaw;
+        if (forwarded) {
+            return forwarded.split(',')[0].trim();
+        }
+    }
+    const realIpRaw = ctx.headers['x-real-ip'] || ctx.headers['X-Real-IP'];
+    if (realIpRaw) {
+        const realIp = Array.isArray(realIpRaw) ? realIpRaw[0] : realIpRaw;
+        if (realIp) {
+            return realIp;
+        }
+    }
+    // Fallback to generic key
+    return 'unknown';
+}
+/**
+ * Create rate limiting middleware
+ *
+ * @example
+ * ```ts
+ * app.use(rateLimit({
+ *   window: '15m',
+ *   max: 100,
+ *   routes: {
+ *     'POST /api/login': { max: 5, window: '5m' }
+ *   }
+ * }));
+ * ```
+ */
+function rateLimit(config, adapter) {
+    const store = adapter || new memory_1.MemoryRateLimiter();
+    const keyGenerator = config.keyGenerator || defaultKeyGenerator;
+    const message = config.message || 'Too many requests';
+    const statusCode = config.statusCode || 429;
+    return async (ctx, next, _deps) => {
+        // Generate rate limit key
+        const baseKey = keyGenerator(ctx);
+        // Check for route-specific limits
+        let routeConfig = config;
+        if (config.routes) {
+            const routeKey = `${ctx.method} ${ctx.path}`;
+            // Try exact match
+            if (config.routes[routeKey]) {
+                routeConfig = {
+                    ...config,
+                    ...config.routes[routeKey]
+                };
+            }
+            else {
+                // Try wildcard match
+                for (const [pattern, limits] of Object.entries(config.routes)) {
+                    const regex = new RegExp('^' + pattern.replace('*', '.*') + '$');
+                    if (regex.test(routeKey)) {
+                        routeConfig = {
+                            ...config,
+                            ...limits
+                        };
+                        break;
+                    }
+                }
+            }
+        }
+        const finalWindowMs = parseWindow(routeConfig.window);
+        const finalMax = routeConfig.max;
+        const key = `ratelimit:${baseKey}:${ctx.path}`;
+        // Increment counter
+        const { count, resetTime } = await store.increment(key, finalWindowMs);
+        // Attach rate limit info to context
+        const rateLimitInfo = {
+            limit: finalMax,
+            remaining: Math.max(0, finalMax - count),
+            reset: Math.floor(resetTime / 1000),
+            retryAfter: count > finalMax ? Math.ceil((resetTime - Date.now()) / 1000) : undefined
+        };
+        ctx.rateLimit = rateLimitInfo;
+        // Check if limit exceeded
+        if (count > finalMax) {
+            return {
+                statusCode,
+                headers: {
+                    'Content-Type': 'application/json',
+                    'X-RateLimit-Limit': finalMax.toString(),
+                    'X-RateLimit-Remaining': '0',
+                    'X-RateLimit-Reset': rateLimitInfo.reset.toString(),
+                    'Retry-After': rateLimitInfo.retryAfter?.toString() || '60'
+                },
+                body: JSON.stringify({
+                    error: message,
+                    retryAfter: rateLimitInfo.retryAfter
+                })
+            };
+        }
+        // Add rate limit headers
+        const response = await next(ctx);
+        response.headers['X-RateLimit-Limit'] = finalMax.toString();
+        response.headers['X-RateLimit-Remaining'] = rateLimitInfo.remaining.toString();
+        response.headers['X-RateLimit-Reset'] = rateLimitInfo.reset.toString();
+        return response;
+    };
+}
+/**
+ * Strict rate limiting for sensitive endpoints
+ */
+function strictRateLimit(max = 5, window = '5m') {
+    return rateLimit({
+        window,
+        max,
+        message: 'Too many attempts, please try again later'
+    });
+}
+/**
+ * Lenient rate limiting for public endpoints
+ */
+function lenientRateLimit(max = 1000, window = '15m') {
+    return rateLimit({
+        window,
+        max
+    });
+}
+//# sourceMappingURL=middleware.js.map

package/dist/security/rate-limit/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../../src/security/rate-limit/middleware.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAwEH,8BAmFC;AAKD,0CAMC;AAKD,4CAKC;AA3KD,qCAA6C;AAE7C;;GAEG;AACH,SAAS,WAAW,CAAC,MAAuB;IACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAEtB,MAAM,WAAW,GAA2B;QACxC,CAAC,EAAE,IAAI;QACP,CAAC,EAAE,KAAK;QACR,CAAC,EAAE,OAAO;QACV,CAAC,EAAE,QAAQ;KACd,CAAC;IAEF,OAAO,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,GAAY;IACrC,kCAAkC;IAClC,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACtF,IAAI,YAAY,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;QAC/E,IAAI,SAAS,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1C,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACvE,IAAI,SAAS,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,IAAI,MAAM,EAAE,CAAC;YACT,OAAO,MAAM,CAAC;QAClB,CAAC;IACL,CAAC;IAED,0BAA0B;IAC1B,OAAO,SAAS,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAgB,SAAS,CACrB,MAAuB,EACvB,OAA0B;IAE1B,MAAM,KAAK,GAAG,OAAO,IAAI,IAAI,0BAAiB,EAAE,CAAC;IACjD,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,mBAAmB,CAAC;IAChE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,mBAAmB,CAAC;IACtD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC;IAE5C,OAAO,KAAK,EAAE,GAAY,EAAE,IAAU,EAAE,KAAU,EAAE,EAAE;QAClD,0BAA0B;QAC1B,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAElC,kCAAkC;QAClC,IAAI,WAAW,GAAG,MAAM,CAAC;QACzB,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,QAAQ,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAE7C,kBAAkB;YAClB,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1B,WAAW,GAAG;oBACV,GAAG,MAAM;oBACT,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;iBAC7B,CAAC;YACN,CAAC;iBAAM,CAAC;gBACJ,qBAAqB;gBACrB,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC5D,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;oBACjE,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;wBACvB,WAAW,GAAG;4BACV,GAAG,MAAM;4BACT,GAAG,MAAM;yBACZ,CAAC;wBACF,MAAM;oBACV,CAAC;gBACL,CAAC;YACL,CAAC;QACL,CAAC;QAED,MAAM,aAAa,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC;QACjC,MAAM,GAAG,GAAG,aAAa,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAE/C,oBAAoB;QACpB,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAEvE,oCAAoC;QACpC,MAAM,aAAa,GAAkB;YACjC,KAAK,EAAE,QAAQ;YACf,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC;YACxC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;YACnC,UAAU,EAAE,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SACxF,CAAC;QAED,GAAW,CAAC,SAAS,GAAG,aAAa,CAAC;QAEvC,0BAA0B;QAC1B,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;YACnB,OAAO;gBACH,UAAU;gBACV,OAAO,EAAE;oBACL,cAAc,EAAE,kBAAkB;oBAClC,mBAAmB,EAAE,QAAQ,CAAC,QAAQ,EAAE;oBACxC,uBAAuB,EAAE,GAAG;oBAC5B,mBAAmB,EAAE,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE;oBACnD,aAAa,EAAE,aAAa,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,IAAI;iBAC9D;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACjB,KAAK,EAAE,OAAO;oBACd,UAAU,EAAE,aAAa,CAAC,UAAU;iBACvC,CAAC;aACL,CAAC;QACN,CAAC;QAED,yBAAyB;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;QAEjC,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC5D,QAAQ,CAAC,OAAO,CAAC,uBAAuB,CAAC,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;QAC/E,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QAEvE,OAAO,QAAQ,CAAC;IACpB,CAAC,CAAC;AACN,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAAC,MAAc,CAAC,EAAE,SAA0B,IAAI;IAC3E,OAAO,SAAS,CAAC;QACb,MAAM;QACN,GAAG;QACH,OAAO,EAAE,2CAA2C;KACvD,CAAC,CAAC;AACP,CAAC;AAED;;GAEG;AACH,SAAgB,gBAAgB,CAAC,MAAc,IAAI,EAAE,SAA0B,KAAK;IAChF,OAAO,SAAS,CAAC;QACb,MAAM;QACN,GAAG;KACN,CAAC,CAAC;AACP,CAAC"}

package/dist/security/sanitization.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Input Sanitization Middleware
+ *
+ * Automatically sanitizes request inputs to prevent common attacks
+ */
+import type { Middleware } from '../core/types';
+import type { SanitizationConfig } from './types';
+import type { SanitizationAdapter } from './adapter';
+/**
+ * Create input sanitization middleware
+ *
+ * @example
+ * ```ts
+ * app.use(sanitizeInput({
+ *   fields: ['body', 'query', 'params'],
+ *   strict: false
+ * }));
+ * ```
+ */
+export declare function sanitizeInput(config?: SanitizationConfig, adapter?: SanitizationAdapter): Middleware;
+/**
+ * Strict sanitization - throws on malicious input
+ */
+export declare function strictSanitization(customConfig?: Partial<SanitizationConfig>): Middleware;
+/**
+ * Lenient sanitization - silently removes malicious content
+ */
+export declare function lenientSanitization(customConfig?: Partial<SanitizationConfig>): Middleware;
+//# sourceMappingURL=sanitization.d.ts.map

package/dist/security/sanitization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitization.d.ts","sourceRoot":"","sources":["../../src/security/sanitization.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAiB,UAAU,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAGrD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CACzB,MAAM,GAAE,kBAAuB,EAC/B,OAAO,CAAC,EAAE,mBAAmB,GAC9B,UAAU,CA2BZ;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,GAAE,OAAO,CAAC,kBAAkB,CAAM,GAAG,UAAU,CAM7F;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,GAAE,OAAO,CAAC,kBAAkB,CAAM,GAAG,UAAU,CAM9F"}