@erenthedeveloper0/zen-middleware 0.1.0-alpha.1

package/LICENSE

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2026 Eren Sümer
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -0,0 +1,85 @@
+<p align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/erenthedeveloper0/zen/main/.github/images/logo-with-text-white.png">
+    <img alt="zen.js" src="https://raw.githubusercontent.com/erenthedeveloper0/zen/main/.github/images/logo-with-text-black.png" width="220">
+  </picture>
+</p>
+
+# @erenthedeveloper0/zen-middleware
+
+CORS, security headers, request ids and rate limiting for
+[Zen](https://github.com/erenthedeveloper0/zen) — built so that they run on the
+requests that matter most, which are the ones most middleware never sees.
+
+> **Alpha.** Also re-exported by
+> [`@erenthedeveloper0/zen`](https://www.npmjs.com/package/@erenthedeveloper0/zen).
+
+```bash
+npm install @erenthedeveloper0/zen-middleware@alpha
+```
+
+```ts
+import { zen } from '@erenthedeveloper0/zen'
+import { cors, rateLimit, requestId, securityHeaders } from '@erenthedeveloper0/zen-middleware'
+
+const app = zen({ trustProxy: 1 })          // one load balancer in front — see below
+
+app.use(securityHeaders())
+app.use(cors({ origin: ['https://app.example.com'], credentials: true }))
+app.use(rateLimit({ limit: 120, window: '1m' }))
+app.use(requestId())
+```
+
+## The one thing this package is about
+
+**Route middleware does not run on a request that matched no route.** A browser
+sends `OPTIONS /api/notes` before any cross-origin write; almost no application
+declares an `OPTIONS` route; so a CORS middleware registered on routes never
+sees the preflight, and the browser reports the failure on the *next* request,
+in code that is correct. Counted over a matched `GET`, an unmatched path and a
+preflight: route middleware ran **1 of 3**. For rate limiting the same gap is a
+bypass — request a path that does not exist, and nothing counts it.
+
+So each of these is a plugin that registers a **global `onRequest` hook**, which
+Zen runs on every request, matched or not: **3 of 3**. And each *stages* its
+headers rather than writing them, so they appear on the 404, the 429, the 422
+and the 500 as well as the 200 — which is the difference between an API that
+works in the browser and one that works only in Postman.
+
+## What each one decides
+
+- **`cors()`** — the allowlist is required (the secure default is not
+  registering the plugin at all). `Vary: Origin` is sent on every response,
+  including those without an `Origin`, because a shared cache needs it.
+  `Access-Control-Allow-Methods` is read from the routes you actually declared.
+  `origin: '*'` with `credentials: true` is refused at boot. The allowlist can
+  come from configuration (`config.cors.origin`).
+- **`securityHeaders()`** — `nosniff`, `X-Frame-Options: DENY`,
+  `Referrer-Policy: no-referrer`, conservative `Cross-Origin-*` policies. HSTS is
+  off until you configure it, because it cannot be taken back. A CORS allowlist
+  that contradicts `Cross-Origin-Resource-Policy` is a boot error naming both.
+- **`requestId()`** — echoes the request's id. Adopting an inbound
+  `X-Request-Id` is off by default, and validated when on.
+- **`rateLimit()`** — a fixed-window counter keyed by `ctx.ip`, refusing with an
+  ordinary 429 problem document *before* the body is read, with `RateLimit`
+  headers. The in-memory store evicts a whole window at once, so memory is
+  bounded even when the key is attacker-chosen; `Store` is the seam for Redis.
+
+The pack orders itself: register them in any order and they run request id →
+security headers → CORS → rate limit.
+
+## Behind a proxy
+
+`ctx.ip` — and so the rate limiter — reads `X-Forwarded-For` only when the app
+sets `trustProxy`. Set it to **the number of proxies** in front of the process:
+`trustProxy: 1` for one load balancer. That reads the address your proxy saw,
+which no client can forge. `trustProxy: true` reads the leftmost entry, which
+the client writes itself when a proxy appends to the header — and then a client
+rotating a fake address gets a fresh rate-limit budget on every request.
+
+## Documentation
+
+[ARCHITECTURE.md §32](https://github.com/erenthedeveloper0/zen/blob/main/ARCHITECTURE.md#32-first-party-middleware) ·
+[`examples/middleware`](https://github.com/erenthedeveloper0/zen/tree/main/examples/middleware).
+
+[MIT](https://github.com/erenthedeveloper0/zen/blob/main/LICENSE) © [Eren Sümer](https://github.com/erenthedeveloper0) · [contributors](https://github.com/erenthedeveloper0/zen/blob/main/CONTRIBUTORS.md)

package/dist/consistency.d.ts

@@ -0,0 +1,30 @@
+import type { CorsExports } from './cors.ts';
+/**
+ * Cross-plugin consistency — the check §2.4 makes possible.
+ *
+ * `Cross-Origin-Resource-Policy: same-origin` tells the browser to refuse
+ * cross-origin reads of this response. `cors({ origin: [...] })` tells it to
+ * permit them. Together they are a configuration that says two opposite things,
+ * the CORP one wins, and the symptom is a CORS setup that "does not work" for
+ * reasons that appear nowhere in the CORS configuration.
+ *
+ * In a framework where middleware is a list of opaque functions there is
+ * nothing to check. Here both are plugins on one graph and `exportsOf` lets
+ * each read the other's decision, so it is a boot error naming both settings.
+ *
+ * ### Why this is its own module rather than a function in `security.ts`
+ *
+ * Because only the plugin that runs **second** can see both, and which one that
+ * is now depends on hook ordering rather than on this check. `securityHeaders`
+ * has to register its hook *first* — its headers must be staged before anything
+ * can short-circuit, or a preflight and a 429 go out without `nosniff` — so it
+ * can no longer be the one that reads `cors`'s exports.
+ *
+ * Rather than move the check to `cors.ts` and leave it there until the next
+ * ordering change moves it back, both plugins call this with whatever they can
+ * see. The one that ran first passes `undefined` for the other half and returns;
+ * the one that ran second has both and decides. Order-independent by
+ * construction, which is the property that was actually wanted.
+ */
+export declare function assertCorsCorpConsistent(corp: string | false, cors: CorsExports | undefined, reporter: string): void;
+//# sourceMappingURL=consistency.d.ts.map

package/dist/consistency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consistency.d.ts","sourceRoot":"","sources":["../src/consistency.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,GAAG,KAAK,EACpB,IAAI,EAAE,WAAW,GAAG,SAAS,EAC7B,QAAQ,EAAE,MAAM,GACf,IAAI,CA2BN"}

package/dist/consistency.js

@@ -0,0 +1,49 @@
+import { Codes, ZenError } from '@erenthedeveloper0/zen-core';
+/**
+ * Cross-plugin consistency — the check §2.4 makes possible.
+ *
+ * `Cross-Origin-Resource-Policy: same-origin` tells the browser to refuse
+ * cross-origin reads of this response. `cors({ origin: [...] })` tells it to
+ * permit them. Together they are a configuration that says two opposite things,
+ * the CORP one wins, and the symptom is a CORS setup that "does not work" for
+ * reasons that appear nowhere in the CORS configuration.
+ *
+ * In a framework where middleware is a list of opaque functions there is
+ * nothing to check. Here both are plugins on one graph and `exportsOf` lets
+ * each read the other's decision, so it is a boot error naming both settings.
+ *
+ * ### Why this is its own module rather than a function in `security.ts`
+ *
+ * Because only the plugin that runs **second** can see both, and which one that
+ * is now depends on hook ordering rather than on this check. `securityHeaders`
+ * has to register its hook *first* — its headers must be staged before anything
+ * can short-circuit, or a preflight and a 429 go out without `nosniff` — so it
+ * can no longer be the one that reads `cors`'s exports.
+ *
+ * Rather than move the check to `cors.ts` and leave it there until the next
+ * ordering change moves it back, both plugins call this with whatever they can
+ * see. The one that ran first passes `undefined` for the other half and returns;
+ * the one that ran second has both and decides. Order-independent by
+ * construction, which is the property that was actually wanted.
+ */
+export function assertCorsCorpConsistent(corp, cors, reporter) {
+    if (cors === undefined || corp !== 'same-origin')
+        return;
+    const allowing = cors.origins === 'any' || cors.origins === 'dynamic' || cors.origins.length > 0;
+    if (!allowing)
+        return;
+    const described = cors.origins === 'any' ? "'*'"
+        : cors.origins === 'dynamic' ? 'origins chosen by a predicate'
+            : cors.origins.join(', ');
+    throw new ZenError(Codes.CONFIG_INVALID, `security-headers sets Cross-Origin-Resource-Policy: same-origin while cors allows ${described}. ` +
+        'The two instruct the browser to do opposite things, and the CORP header wins.', {
+        status: 500,
+        expose: false,
+        hint: "Use crossOriginResource: 'same-site' (the default) or 'cross-origin' if these responses are " +
+            'meant to be read cross-origin, or narrow the CORS allowlist if they are not.',
+        consequence: 'Left as configured, every allowed origin still fails in the browser — and it fails with a ' +
+            'message naming CORS, so the search starts in the file that is correct. ' +
+            `Reported by ${reporter}, whichever of the two was registered second.`,
+    });
+}
+//# sourceMappingURL=consistency.js.map

package/dist/consistency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consistency.js","sourceRoot":"","sources":["../src/consistency.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AAG7D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAoB,EACpB,IAA6B,EAC7B,QAAgB;IAEhB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,aAAa;QAAE,OAAM;IAExD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAA;IAChG,IAAI,CAAC,QAAQ;QAAE,OAAM;IAErB,MAAM,SAAS,GACb,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK;QAC9B,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,+BAA+B;YAC9D,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAE3B,MAAM,IAAI,QAAQ,CAChB,KAAK,CAAC,cAAc,EACpB,qFAAqF,SAAS,IAAI;QAChG,+EAA+E,EACjF;QACE,MAAM,EAAE,GAAG;QACX,MAAM,EAAE,KAAK;QACb,IAAI,EACF,8FAA8F;YAC9F,8EAA8E;QAChF,WAAW,EACT,4FAA4F;YAC5F,yEAAyE;YACzE,eAAe,QAAQ,+CAA+C;KACzE,CACF,CAAA;AACH,CAAC"}

package/dist/cors.d.ts

@@ -0,0 +1,110 @@
+import { type Duration, type HttpMethod, type Plugin } from '@erenthedeveloper0/zen-core';
+/**
+ * CORS — rfcs/0001 §19.2, §4.2 stage 5, §9.2.
+ *
+ * ### Why this is a hook and not middleware
+ *
+ * `app.use(corsMiddleware)` — the shape every other framework uses — is
+ * **bypassable**, and not in a subtle way. Phase middleware lives inside a
+ * route's compiled pipeline, so it runs only when a route matched. A browser's
+ * preflight is `OPTIONS /api/things`, and almost no application registers an
+ * `OPTIONS` route; the request matches nothing, the pipeline never exists, and
+ * the middleware never runs. Measured on this codebase before the design was
+ * settled: over a matched `GET`, an unmatched path and a preflight, a `.use()`
+ * middleware ran **1 of 3** times and a global `onRequest` hook ran **3 of 3**.
+ *
+ * §9.2 already says this in the paragraph that made global `onRequest` hooks
+ * run on unmatched requests — "`onRequest` is the documented home for rate
+ * limiting, CORS and auth, and a rate limiter that only sees matched routes is
+ * bypassed by requesting a path that does not exist". CORS is the same defect
+ * with a different symptom: not a bypass, but a preflight that never gets an
+ * answer, which the browser reports as a CORS failure on the *actual* request
+ * and which is therefore debugged in the wrong place.
+ *
+ * So every member of this pack is a global `onRequest` hook, and therefore a
+ * plugin: a plugin is the only registration surface that reaches global scope
+ * while still carrying a manifest, a version and a config namespace (§10.1).
+ *
+ * ### Why it stages headers instead of writing them
+ *
+ * The response half of CORS is `Access-Control-Allow-Origin` on the *actual*
+ * response — including the 404, the 429, the 422 and the 500. A middleware that
+ * stamps the reply on the way out misses all of them: §4.6 says the error path
+ * never re-enters user middleware, and an `after` middleware on a route that
+ * did not match never runs at all. The classic symptom is a service whose
+ * errors show up in the browser as CORS failures, so every error looks like a
+ * configuration problem and nobody sees the actual status.
+ *
+ * `ctx.res` already solves this. Staged metadata is applied by `prepareForWire`
+ * at egress (§13.6), which is downstream of *every* path — success, error,
+ * timeout, and unmatched. So this hook stages, and one invariant covers all of
+ * them: **CORS never writes a reply's headers.** The consequence is asserted in
+ * `cors.test.ts` against a 404, a 500 and a rate-limited 429.
+ *
+ * ### The default is the absence of this plugin
+ *
+ * §19.2 says CORS is "deny all until configured", and that default is what a
+ * Zen app already has: with no plugin registered, no `Access-Control-Allow-*`
+ * header is ever emitted and every browser denies. Registering the plugin
+ * *without* an allowlist is therefore not "the secure default" — it is a line
+ * of code that asks for cross-origin access and does not say from where, which
+ * is indistinguishable from a bug. It is a boot error naming the fix.
+ */
+export type CorsOrigin = '*' | string | readonly string[] | RegExp | ((origin: string) => boolean);
+export interface CorsOptions {
+    /**
+     * Who may read the response. **Required** — see the note above on why the
+     * secure default is not registering this plugin at all.
+     *
+     * A string or list is matched by exact, case-sensitive comparison against the
+     * whole `Origin` header (`https://app.acme.com`), because that is what the
+     * header contains: a scheme, a host and an optional port, with no path and no
+     * trailing slash. A trailing slash is the single most common way an allowlist
+     * silently matches nothing, so it is a boot error rather than a mystery.
+     */
+    readonly origin?: CorsOrigin | undefined;
+    /**
+     * Methods advertised on a preflight.
+     *
+     * Defaults to **the methods this application actually serves**, read off the
+     * frozen `AppGraph` at boot. Every other framework hardcodes the same six
+     * verbs, which advertises `DELETE` on a read-only API and `PUT` on a service
+     * that has never had one — a small thing, but it is free here and it is the
+     * kind of answer only a framework with a graph can give (§2.4).
+     */
+    readonly methods?: readonly HttpMethod[] | undefined;
+    /**
+     * Request headers a cross-origin caller may send. `'reflect'` (the default)
+     * echoes `Access-Control-Request-Headers`.
+     *
+     * Reflecting is safe and is not the same as trusting: the browser only asks
+     * for headers the page itself set, and the server still validates every one
+     * of them. What it costs is a `Vary`, which is why an explicit list is the
+     * better answer for a cacheable API and why the two differ in what they emit.
+     */
+    readonly allowedHeaders?: readonly string[] | 'reflect' | undefined;
+    /** Response headers JavaScript may read. `Content-Type` and the other CORS-safelisted ones are always readable. */
+    readonly exposedHeaders?: readonly string[] | undefined;
+    /** Allow cookies and `Authorization`. Cannot be combined with `origin: '*'`. */
+    readonly credentials?: boolean | undefined;
+    /**
+     * How long a browser may cache a preflight.
+     *
+     * Defaults to **10 minutes**, which is a deliberate non-zero. With no
+     * `Access-Control-Max-Age` a browser re-preflights every few seconds, and
+     * "my API is twice as slow from the browser" is the most common CORS
+     * complaint that is not a misconfiguration. Ten minutes bounds how long a
+     * revoked origin stays cached in one browser; Chrome caps the value at two
+     * hours regardless.
+     */
+    readonly maxAge?: Duration | undefined;
+    /** `204` by default. Some legacy XHR stacks require `200` with a body. */
+    readonly preflightStatus?: 200 | 204 | undefined;
+}
+/** What `cors` publishes for other plugins to read — see `security.ts`. */
+export interface CorsExports {
+    readonly origins: readonly string[] | 'any' | 'dynamic';
+    readonly credentials: boolean;
+}
+export declare function cors(options?: CorsOptions): Plugin<void, {}>;
+//# sourceMappingURL=cors.d.ts.map

package/dist/cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../src/cors.ts"],"names":[],"mappings":"AAAA,OAAO,EAEU,KAAK,QAAQ,EAAE,KAAK,UAAU,EAAE,KAAK,MAAM,EAC3D,MAAM,6BAA6B,CAAA;AAIpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,MAAM,MAAM,UAAU,GAClB,GAAG,GACH,MAAM,GACN,SAAS,MAAM,EAAE,GACjB,MAAM,GACN,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,CAAA;AAEjC,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;OASG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,SAAS,CAAA;IACxC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,UAAU,EAAE,GAAG,SAAS,CAAA;IACpD;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,SAAS,CAAA;IACnE,mHAAmH;IACnH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;IACvD,gFAAgF;IAChF,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IAC1C;;;;;;;;;OASG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAA;IACtC,0EAA0E;IAC1E,QAAQ,CAAC,eAAe,CAAC,EAAE,GAAG,GAAG,GAAG,GAAG,SAAS,CAAA;CACjD;AAID,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,KAAK,GAAG,SAAS,CAAA;IACvD,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAC9B;AA2BD,wBAAgB,IAAI,CAAC,OAAO,GAAE,WAAgB,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAqGhE"}

package/dist/cors.js

@@ -0,0 +1,276 @@
+import { definePlugin, parseDuration, Codes, ZenError, } from '@erenthedeveloper0/zen-core';
+import { assertCorsCorpConsistent } from "./consistency.js";
+import { headerOf, isPreflight } from "./shared.js";
+const DEFAULT_METHODS = ['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE'];
+export function cors(options = {}) {
+    return definePlugin({
+        name: 'cors',
+        version: '0.1.0',
+        // The pack orders itself (§10.5 step 4). A 429 or a 404 must carry
+        // `Access-Control-Allow-Origin` or the browser reports a rate limit as a
+        // CORS failure, so this hook has to be staged before the limiter can
+        // short-circuit — whichever order the two `use()` calls appear in.
+        before: ['rate-limit'],
+        config: { namespace: 'cors', env: ['CORS_ORIGINS'] },
+        setup(app) {
+            const compiled = compile(options, app.config, app.pluginName);
+            const exports = {
+                origins: compiled.origins,
+                credentials: compiled.credentials,
+            };
+            // The reciprocal half of the check in `consistency.ts`: whichever of the
+            // two plugins is registered second sees both sides. `securityHeaders`
+            // declares `before: ['cors']`, so in practice that is this one.
+            const security = app.exportsOf('security-headers');
+            if (security !== undefined) {
+                assertCorsCorpConsistent(security.crossOriginResource ?? 'same-site', exports, app.pluginName);
+            }
+            app.hook('onRequest', function cors(ctx) {
+                // `Vary: Origin` first, and **before** the early return.
+                //
+                // The tempting shape is to read `Origin`, bail when it is absent, and
+                // only then vary — every CORS library does it that way and it is
+                // wrong for caching. A request with no `Origin` produces a response
+                // with no `Access-Control-Allow-Origin`, which is a *different*
+                // response; a shared cache that stored it without `Vary` would replay
+                // it to a browser request that needed the header, and the browser
+                // would deny a caller that is on the allowlist. The failure only
+                // appears behind a CDN, only for some users, and never in a test.
+                //
+                // So the cost is one array push on every request in the application,
+                // paid for a correctness property, and §32.3 measures it rather than
+                // asserting it is small. The one configuration that skips it is a
+                // literal `*` with no credentials, where the answer genuinely does not
+                // depend on the origin.
+                if (!compiled.anyOrigin)
+                    ctx.res.appendHeader('vary', 'origin');
+                // Read through `raw` rather than `ctx.headers`, which materialises a
+                // record of every header on first touch (§7.2). This hook runs on every
+                // request in the application and must not be the reason that exists.
+                const origin = headerOf(ctx, 'origin');
+                if (origin === undefined)
+                    return undefined;
+                const preflight = isPreflight(ctx);
+                const allowed = compiled.matcher(origin);
+                if (allowed) {
+                    ctx.res.header('access-control-allow-origin', compiled.anyOrigin ? '*' : origin);
+                    if (compiled.credentials)
+                        ctx.res.header('access-control-allow-credentials', 'true');
+                    if (!preflight && compiled.exposeHeaders !== null) {
+                        ctx.res.header('access-control-expose-headers', compiled.exposeHeaders);
+                    }
+                }
+                if (!preflight)
+                    return undefined;
+                // ── preflight ───────────────────────────────────────────────────────
+                // Answered here, before routing, body intake, validation and the
+                // handler — which is the point of §4.2 stage 5. A preflight that
+                // reached a route would have to be a route somebody wrote.
+                ctx.res.appendHeader('vary', 'access-control-request-method');
+                if (allowed) {
+                    ctx.res.header('access-control-allow-methods', compiled.allowMethods);
+                    if (compiled.allowHeaders === 'reflect') {
+                        const asked = headerOf(ctx, 'access-control-request-headers');
+                        ctx.res.appendHeader('vary', 'access-control-request-headers');
+                        if (asked !== undefined)
+                            ctx.res.header('access-control-allow-headers', asked);
+                    }
+                    else if (compiled.allowHeaders !== null) {
+                        ctx.res.header('access-control-allow-headers', compiled.allowHeaders);
+                    }
+                    if (compiled.maxAge !== null)
+                        ctx.res.header('access-control-max-age', compiled.maxAge);
+                }
+                // A disallowed origin still gets a well-formed 204 with no CORS
+                // headers, which is what makes the browser deny. A 403 would say
+                // "this origin is not on the list", and an allowlist that reports its
+                // own contents is an allowlist you can enumerate.
+                return ctx.empty(compiled.preflightStatus);
+            }, 'cors');
+            // §2.4 — the graph is the one structure everything reads. The advertised
+            // method set is a projection of it, computed once, so it cannot claim a
+            // verb the router would answer 405 for.
+            app.onBoot((graph) => {
+                if (compiled.methodsPinned)
+                    return;
+                compiled.allowMethods = servedMethods(graph).join(', ');
+            });
+            // Spread rather than passed by reference: `PluginResult.exports` is a
+            // `Record<string, unknown>`, and a named interface has no index signature.
+            return { exports: { ...exports } };
+        },
+    });
+}
+/**
+ * The verbs this application answers, `OPTIONS` excluded.
+ *
+ * `HEAD` is added whenever any `GET` exists, because §4.2 gives every `GET`
+ * route a free `HEAD` that never appears as a `RouteRecord` — advertising the
+ * declared set alone would omit a method the server demonstrably serves.
+ */
+function servedMethods(graph) {
+    const seen = new Set();
+    for (const route of graph.routes)
+        seen.add(route.method);
+    if (seen.has('GET'))
+        seen.add('HEAD');
+    seen.delete('OPTIONS');
+    const order = ['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE', 'TRACE'];
+    const out = order.filter((m) => seen.has(m));
+    return out.length === 0 ? [...DEFAULT_METHODS] : out;
+}
+/**
+ * Options → the decided form, with everything that can be wrong reported here.
+ *
+ * Thrown rather than collected, because §12.7's aggregation is the *app's*
+ * list and a plugin reaches it by throwing from `setup` — `ready()` wraps it
+ * into a `ZEN_PLUGIN_OPTIONS` diagnostic that names the plugin and everything
+ * that will now not load.
+ */
+function compile(written, config, pluginName) {
+    const options = merge(written, config, pluginName);
+    const origin = options.origin;
+    if (origin === undefined) {
+        throw new ZenError(Codes.CONFIG_INVALID, `${pluginName} needs an origin allowlist, and refuses to guess one.`, {
+            status: 500,
+            expose: false,
+            hint: "Pass one — cors({ origin: ['https://app.example.com'] }) — or set `cors.origin` in " +
+                'configuration so a deployment can supply it from CORS_ORIGINS.',
+            consequence: 'Not registering this plugin at all is the deny-everything default (§19.2): with no ' +
+                'Access-Control-Allow-Origin header, every browser already denies. Registering it ' +
+                'without a list is a request for cross-origin access that does not say from where.',
+        });
+    }
+    const anyOrigin = origin === '*';
+    const credentials = options.credentials === true;
+    if (anyOrigin && credentials) {
+        throw new ZenError(Codes.CONFIG_INVALID, `${pluginName} cannot combine origin: '*' with credentials: true.`, {
+            status: 500,
+            expose: false,
+            hint: 'Name the origins that may send credentials, or drop credentials.',
+            consequence: 'Browsers reject the pair outright. The usual library "fix" is to reflect whatever ' +
+                'Origin arrives, which turns an allowlist into allow-everyone while still reading ' +
+                "like an allowlist — so this is refused rather than quietly repaired.",
+        });
+    }
+    const list = typeof origin === 'string' && !anyOrigin ? [origin]
+        : Array.isArray(origin) ? origin
+            : null;
+    if (list !== null) {
+        for (const entry of list) {
+            if (entry.endsWith('/') || entry.includes('/', 8)) {
+                throw new ZenError(Codes.CONFIG_INVALID, `${pluginName}: "${entry}" is not an origin — an Origin header carries a scheme, host and optional port, and no path.`, {
+                    status: 500,
+                    expose: false,
+                    hint: `Use "${entry.replace(/\/+$/, '').replace(/^(\w+:\/\/[^/]+).*$/, '$1')}".`,
+                    consequence: 'A trailing slash matches no origin, so the allowlist would silently allow nothing.',
+                });
+            }
+        }
+    }
+    const matcher = anyOrigin ? () => true
+        : list !== null
+            ? list.length === 1
+                // One origin is the common case and deserves a comparison rather than
+                // a Set lookup; more than one, and the Set wins from about four.
+                ? ((only) => (o) => o === only)(list[0])
+                : ((set) => (o) => set.has(o))(new Set(list))
+            : origin instanceof RegExp
+                // A fresh test each call: a global regex carries `lastIndex` between
+                // calls and would match every other request. §19.3 forbids unbounded
+                // backtracking in framework source; a user's own pattern is their
+                // choice, and it is named in `explainRoute` as `cors`.
+                ? ((re) => (o) => new RegExp(re.source, re.flags.replace('g', '')).test(o))(origin)
+                : origin;
+    return {
+        anyOrigin,
+        matcher,
+        credentials,
+        allowHeaders: options.allowedHeaders === undefined ? 'reflect'
+            : options.allowedHeaders === 'reflect' ? 'reflect'
+                : options.allowedHeaders.length === 0 ? null
+                    : options.allowedHeaders.join(', '),
+        exposeHeaders: options.exposedHeaders === undefined || options.exposedHeaders.length === 0
+            ? null
+            : options.exposedHeaders.join(', '),
+        maxAge: maxAgeOf(options.maxAge),
+        preflightStatus: options.preflightStatus ?? 204,
+        origins: anyOrigin ? 'any'
+            : list !== null ? [...list]
+                : 'dynamic',
+        methodsPinned: options.methods !== undefined,
+        allowMethods: (options.methods ?? DEFAULT_METHODS).join(', '),
+    };
+}
+function maxAgeOf(value) {
+    const ms = parseDuration(value ?? '10m');
+    return ms <= 0 ? null : String(Math.floor(ms / 1000));
+}
+/**
+ * `config.cors.*` under what the call site wrote — §16.1's precedence, applied
+ * field by field.
+ *
+ * The first draft read only `origin` from configuration, and the example caught
+ * it immediately: `zen.config.ts` declared `cors.credentials: true`, `cors()`
+ * was called with no arguments, and the header was silently absent. Half a
+ * feature is worse than none here, because "configuration is ignored" is
+ * indistinguishable from "the browser is wrong" from the outside.
+ *
+ * Field by field rather than a spread for the same reason plugin defaults merge
+ * that way (§16.1 layer 2): `cors({ credentials: true })` next to a config that
+ * names the origins should end up with both, not with whichever object was
+ * spread last.
+ *
+ * A config value of the wrong *shape* is a boot error rather than something
+ * quietly dropped. `cors.origin: 42` is a mistake somebody made, and the two
+ * ways to not report it — ignore it, or coerce it — are how an allowlist ends
+ * up meaning something nobody wrote.
+ */
+function merge(written, config, pluginName) {
+    const namespace = config['cors'];
+    if (namespace === undefined || namespace === null)
+        return written;
+    if (typeof namespace !== 'object' || Array.isArray(namespace)) {
+        throw new ZenError(Codes.CONFIG_INVALID, `${pluginName}: config.cors must be an object of options, and is ${describe(namespace)}.`, {
+            status: 500,
+            expose: false,
+            hint: 'Give it a namespace: `cors: { origin: env => env.CORS_ORIGINS.split(",") }`.',
+            consequence: 'Nothing under config.cors can be read while it is not an object.',
+        });
+    }
+    const from = namespace;
+    const take = (key, ok) => {
+        const value = from[key];
+        if (value === undefined)
+            return undefined;
+        if (!ok(value)) {
+            throw new ZenError(Codes.CONFIG_INVALID, `${pluginName}: config.cors.${key} is ${describe(value)}, which is not a valid ${key}.`, {
+                status: 500,
+                expose: false,
+                hint: `Fix the value in the configuration file, or pass ${key} to cors() directly.`,
+                consequence: 'Ignoring it would make the running configuration differ from the written one.',
+            });
+        }
+        return value;
+    };
+    const isStringList = (v) => Array.isArray(v) && v.every((e) => typeof e === 'string');
+    return {
+        origin: written.origin ?? take('origin', (v) => typeof v === 'string' || isStringList(v) || v instanceof RegExp || typeof v === 'function'),
+        methods: written.methods ?? take('methods', isStringList),
+        allowedHeaders: written.allowedHeaders ?? take('allowedHeaders', (v) => v === 'reflect' || isStringList(v)),
+        exposedHeaders: written.exposedHeaders ?? take('exposedHeaders', isStringList),
+        credentials: written.credentials ?? take('credentials', (v) => typeof v === 'boolean'),
+        maxAge: written.maxAge ?? take('maxAge', (v) => typeof v === 'number' || typeof v === 'string'),
+        preflightStatus: written.preflightStatus ?? take('preflightStatus', (v) => v === 200 || v === 204),
+    };
+}
+function describe(value) {
+    if (value === null)
+        return 'null';
+    if (Array.isArray(value))
+        return `an array (${JSON.stringify(value).slice(0, 40)})`;
+    if (typeof value === 'object')
+        return 'an object';
+    return `${typeof value} ${JSON.stringify(value)}`;
+}
+//# sourceMappingURL=cors.js.map

package/dist/cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../src/cors.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,GAE7C,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EAAkC,QAAQ,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAgHnF,MAAM,eAAe,GAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;AAiChG,MAAM,UAAU,IAAI,CAAC,UAAuB,EAAE;IAC5C,OAAO,YAAY,CAAW;QAC5B,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,OAAO;QAChB,mEAAmE;QACnE,yEAAyE;QACzE,qEAAqE;QACrE,mEAAmE;QACnE,MAAM,EAAE,CAAC,YAAY,CAAC;QACtB,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,EAAE;QAEpD,KAAK,CAAC,GAAG;YACP,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC,CAAA;YAC7D,MAAM,OAAO,GAAgB;gBAC3B,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,WAAW,EAAE,QAAQ,CAAC,WAAW;aAClC,CAAA;YACD,yEAAyE;YACzE,sEAAsE;YACtE,gEAAgE;YAChE,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAyD,CAAA;YAC1G,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,wBAAwB,CAAC,QAAQ,CAAC,mBAAmB,IAAI,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,CAAA;YAChG,CAAC;YAED,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,IAAI,CAAC,GAA0B;gBAC5D,yDAAyD;gBACzD,EAAE;gBACF,sEAAsE;gBACtE,iEAAiE;gBACjE,oEAAoE;gBACpE,gEAAgE;gBAChE,sEAAsE;gBACtE,kEAAkE;gBAClE,iEAAiE;gBACjE,kEAAkE;gBAClE,EAAE;gBACF,qEAAqE;gBACrE,qEAAqE;gBACrE,kEAAkE;gBAClE,uEAAuE;gBACvE,wBAAwB;gBACxB,IAAI,CAAC,QAAQ,CAAC,SAAS;oBAAE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;gBAE/D,qEAAqE;gBACrE,wEAAwE;gBACxE,qEAAqE;gBACrE,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;gBACtC,IAAI,MAAM,KAAK,SAAS;oBAAE,OAAO,SAAS,CAAA;gBAE1C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;gBAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;gBAExC,IAAI,OAAO,EAAE,CAAC;oBACZ,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,6BAA6B,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;oBAChF,IAAI,QAAQ,CAAC,WAAW;wBAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAA;oBACpF,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;wBAClD,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,+BAA+B,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAA;oBACzE,CAAC;gBACH,CAAC;gBAED,IAAI,CAAC,SAAS;oBAAE,OAAO,SAAS,CAAA;gBAEhC,uEAAuE;gBACvE,iEAAiE;gBACjE,iEAAiE;gBACjE,2DAA2D;gBAC3D,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,+BAA+B,CAAC,CAAA;gBAE7D,IAAI,OAAO,EAAE,CAAC;oBACZ,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,8BAA8B,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAA;oBACrE,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;wBACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAA;wBAC7D,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,gCAAgC,CAAC,CAAA;wBAC9D,IAAI,KAAK,KAAK,SAAS;4BAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAA;oBAChF,CAAC;yBAAM,IAAI,QAAQ,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;wBAC1C,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,8BAA8B,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAA;oBACvE,CAAC;oBACD,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI;wBAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,wBAAwB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;gBACzF,CAAC;gBAED,gEAAgE;gBAChE,iEAAiE;gBACjE,sEAAsE;gBACtE,kDAAkD;gBAClD,OAAO,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAsB,CAAC,CAAA;YACnD,CAAC,EAAE,MAAM,CAAC,CAAA;YAEV,yEAAyE;YACzE,wEAAwE;YACxE,wCAAwC;YACxC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;gBACnB,IAAI,QAAQ,CAAC,aAAa;oBAAE,OAAM;gBAClC,QAAQ,CAAC,YAAY,GAAG,aAAa,CAAC,KAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACrE,CAAC,CAAC,CAAA;YAEF,sEAAsE;YACtE,2EAA2E;YAC3E,OAAO,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,EAAE,CAAA;QACpC,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,KAAe;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM;QAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACxD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACrC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACtB,MAAM,KAAK,GAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC/F,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5C,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,OAAO,CACd,OAAoB,EACpB,MAAyC,EACzC,UAAkB;IAElB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;IAE7B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,QAAQ,CAChB,KAAK,CAAC,cAAc,EACpB,GAAG,UAAU,uDAAuD,EACpE;YACE,MAAM,EAAE,GAAG;YACX,MAAM,EAAE,KAAK;YACb,IAAI,EACF,qFAAqF;gBACrF,gEAAgE;YAClE,WAAW,EACT,qFAAqF;gBACrF,mFAAmF;gBACnF,mFAAmF;SACtF,CACF,CAAA;IACH,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,KAAK,GAAG,CAAA;IAChC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,KAAK,IAAI,CAAA;IAEhD,IAAI,SAAS,IAAI,WAAW,EAAE,CAAC;QAC7B,MAAM,IAAI,QAAQ,CAChB,KAAK,CAAC,cAAc,EACpB,GAAG,UAAU,qDAAqD,EAClE;YACE,MAAM,EAAE,GAAG;YACX,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,kEAAkE;YACxE,WAAW,EACT,oFAAoF;gBACpF,mFAAmF;gBACnF,sEAAsE;SACzE,CACF,CAAA;IACH,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC9D,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAA4B;YACvD,CAAC,CAAC,IAAI,CAAA;IAER,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;gBAClD,MAAM,IAAI,QAAQ,CAChB,KAAK,CAAC,cAAc,EACpB,GAAG,UAAU,MAAM,KAAK,8FAA8F,EACtH;oBACE,MAAM,EAAE,GAAG;oBACX,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,QAAQ,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,IAAI,CAAC,IAAI;oBAChF,WAAW,EAAE,oFAAoF;iBAClG,CACF,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GACX,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI;QACtB,CAAC,CAAC,IAAI,KAAK,IAAI;YACb,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBACjB,sEAAsE;gBACtE,iEAAiE;gBACjE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAW,CAAC;gBAClD,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;YACjD,CAAC,CAAC,MAAM,YAAY,MAAM;gBACxB,qEAAqE;gBACrE,qEAAqE;gBACrE,kEAAkE;gBAClE,uDAAuD;gBACvD,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gBACnF,CAAC,CAAE,MAAiC,CAAA;IAExC,OAAO;QACL,SAAS;QACT,OAAO;QACP,WAAW;QACX,YAAY,EACV,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS;YAChD,CAAC,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS;gBAClD,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;oBAC5C,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QACrC,aAAa,EACX,OAAO,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;YACzE,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QACvC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QAChC,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,GAAG;QAC/C,OAAO,EACL,SAAS,CAAC,CAAC,CAAC,KAAK;YACjB,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;gBAC3B,CAAC,CAAC,SAAS;QACb,aAAa,EAAE,OAAO,CAAC,OAAO,KAAK,SAAS;QAC5C,YAAY,EAAE,CAAC,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;KAC9D,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAA2B;IAC3C,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,IAAI,KAAK,CAAC,CAAA;IACxC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAA;AACvD,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,KAAK,CACZ,OAAoB,EACpB,MAAyC,EACzC,UAAkB;IAElB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;IAChC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,OAAO,CAAA;IACjE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,QAAQ,CAChB,KAAK,CAAC,cAAc,EACpB,GAAG,UAAU,sDAAsD,QAAQ,CAAC,SAAS,CAAC,GAAG,EACzF;YACE,MAAM,EAAE,GAAG;YACX,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,8EAA8E;YACpF,WAAW,EAAE,kEAAkE;SAChF,CACF,CAAA;IACH,CAAC;IAED,MAAM,IAAI,GAAG,SAAoC,CAAA;IACjD,MAAM,IAAI,GAAG,CAA8B,GAAM,EAAE,EAA+B,EAA8B,EAAE;QAChH,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAA;QACvB,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACzC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;YACf,MAAM,IAAI,QAAQ,CAChB,KAAK,CAAC,cAAc,EACpB,GAAG,UAAU,iBAAiB,GAAG,OAAO,QAAQ,CAAC,KAAK,CAAC,0BAA0B,GAAG,GAAG,EACvF;gBACE,MAAM,EAAE,GAAG;gBACX,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,oDAAoD,GAAG,sBAAsB;gBACnF,WAAW,EAAE,+EAA+E;aAC7F,CACF,CAAA;QACH,CAAC;QACD,OAAO,KAAuB,CAAA;IAChC,CAAC,CAAA;IAED,MAAM,YAAY,GAAG,CAAC,CAAU,EAAW,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAA;IAEvG,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAC7C,OAAO,CAAC,KAAK,QAAQ,IAAI,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,MAAM,IAAI,OAAO,CAAC,KAAK,UAAU,CAAC;QAC7F,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC;QACzD,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC;QAC3G,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC;QAC9E,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC;QACtF,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC;QAC/F,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;KACnG,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAA;IACjC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,aAAa,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAA;IACnF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAA;IACjD,OAAO,GAAG,OAAO,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAA;AACnD,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,28 @@
+/**
+ * `@erenthedeveloper0/zen-middleware` — the first-party pack (rfcs/0001 §24.2, §25 M4, §32).
+ *
+ * Four plugins, one shape: **a global `onRequest` hook that stages response
+ * metadata**. Both halves of that sentence are load-bearing and both were
+ * decided by measurement rather than by taste — see §32.1 and §32.2, or the
+ * header comment on `cors.ts`, which carries the numbers.
+ *
+ * What is *not* here, named rather than left as a silent gap:
+ *
+ * - **`compression` and `static`.** Both need a platform: `node:zlib` and
+ *   `node:fs`. §14.1 already puts compression on the adapter boundary as a
+ *   capability (`compression: 'native' | 'library' | 'none'`), which is the
+ *   right home for it — a middleware package that imported `node:zlib` would
+ *   be a package the edge adapters cannot load. They belong to an
+ *   adapter-coupled package and are recorded in §28.8.
+ * - **`timeout` and `body-limit`**, which §24.2 lists here. Both are already
+ *   built into core as first-class route policy — §4.4's deadlines and §19.2's
+ *   body limits — and a middleware wrapping them would be a second way to say
+ *   the same thing, with its own precedence rules for the case where both are
+ *   set. §24.2's row predates both features.
+ */
+export { cors, type CorsOptions, type CorsOrigin, type CorsExports } from './cors.ts';
+export { securityHeaders, type SecurityHeadersOptions, type ReferrerPolicy, } from './security.ts';
+export { requestId, type RequestIdOptions } from './request-id.ts';
+export { rateLimit, type RateLimitOptions, type RateLimitContext, } from './rate-limit.ts';
+export { MemoryStore, ReferenceStore, type Store, type Tally, type MemoryStoreOptions, } from './store.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,IAAI,EAAE,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAA;AACrF,OAAO,EACL,eAAe,EAAE,KAAK,sBAAsB,EAAE,KAAK,cAAc,GAClE,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAClE,OAAO,EACL,SAAS,EAAE,KAAK,gBAAgB,EAAE,KAAK,gBAAgB,GACxD,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,WAAW,EAAE,cAAc,EAAE,KAAK,KAAK,EAAE,KAAK,KAAK,EAAE,KAAK,kBAAkB,GAC7E,MAAM,YAAY,CAAA"}