@holo-js/security 0.2.6 → 0.3.1

package/dist/{chunk-EWQKJSFA.mjs → chunk-AGICNQRJ.mjs}

@@ -1,8 +1,9 @@
-// src/contracts.ts
 import {
   normalizeCorsConfig,
   normalizeSecurityConfig
-} from "@holo-js/config";
+} from "./chunk-WDTNP5YU.mjs";
+
+// src/contracts.ts
 var SecurityCsrfError = class extends Error {
   status = 419;
   constructor(message = "CSRF token mismatch.") {

package/dist/{chunk-QGBGZ2GI.mjs → chunk-NKKBOLDI.mjs}

@@ -3,13 +3,16 @@ import {
   SecurityRateLimitError,
   ip,
   limit
-} from "./chunk-EWQKJSFA.mjs";
+} from "./chunk-AGICNQRJ.mjs";
+import {
+  normalizeCorsConfig,
+  normalizeSecurityConfig
+} from "./chunk-WDTNP5YU.mjs";
 
 // src/csrf.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
 
 // src/runtime.ts
-import { normalizeCorsConfig, normalizeSecurityConfig } from "@holo-js/config";
 function getSecurityRuntimeState() {
   const runtime = globalThis;
   runtime.__holoSecurityRuntime__ ??= {};
@@ -46,6 +49,12 @@ var securityRuntimeInternals = {
   getSecurityRuntimeState
 };
 
+// src/proxy.ts
+function shouldTrustProxyHeaders() {
+  const trustedProxy = typeof process !== "undefined" ? process.env.HOLO_SECURITY_TRUST_PROXY?.trim().toLowerCase() : void 0;
+  return trustedProxy === "1" || trustedProxy === "true" || trustedProxy === "yes" || trustedProxy === "on";
+}
+
 // src/rate-limit.ts
 function encodeBucketPart(value) {
   return encodeURIComponent(value);
@@ -79,10 +88,6 @@ function normalizeResolvedLimiterKey(value, label) {
   }
   throw new TypeError(`[@holo-js/security] ${label} must resolve a non-empty string key.`);
 }
-function shouldTrustProxyHeaders() {
-  const trustedProxy = typeof process !== "undefined" ? process.env.HOLO_SECURITY_TRUST_PROXY?.trim().toLowerCase() : void 0;
-  return trustedProxy === "1" || trustedProxy === "true" || trustedProxy === "yes" || trustedProxy === "on";
-}
 async function defaultRateLimitKey(request) {
   const runtimeDefaultKey = await getSecurityRuntime().defaultKeyResolver?.(request);
   if (typeof runtimeDefaultKey !== "undefined" && runtimeDefaultKey !== null) {
@@ -205,7 +210,7 @@ function serializeCookie(name, value, options = {}) {
 }
 function isSafeMethod(method) {
   const normalized = method.trim().toUpperCase();
-  return normalized === "GET" || normalized === "HEAD" || normalized === "OPTIONS" || normalized === "TRACE";
+  return normalized === "GET" || normalized === "HEAD" || normalized === "OPTIONS";
 }
 function escapeRegex(value) {
   return value.replace(/[|\\{}()[\]^$+?.]/g, "\\$&");
@@ -240,7 +245,7 @@ function getForwardedProto(request) {
   return void 0;
 }
 function isSecureRequest(request) {
-  return getForwardedProto(request) === "https" || new URL(request.url).protocol === "https:";
+  return new URL(request.url).protocol === "https:" || shouldTrustProxyHeaders() && getForwardedProto(request) === "https";
 }
 function createCsrfToken() {
   return randomBytes(32).toString("base64url");
@@ -577,7 +582,6 @@ var corsInternals = {
 
 // src/store.ts
 import { resolve } from "path";
-import { normalizeSecurityConfig as normalizeSecurityConfig2 } from "@holo-js/config";
 
 // src/drivers/file.ts
 import { createHash, randomUUID } from "crypto";
@@ -1091,7 +1095,7 @@ function isNormalizedSecurityConfig(config) {
   return typeof candidate.rateLimit?.memory?.driver === "string" && candidate.rateLimit.memory.driver === "memory" && typeof candidate.rateLimit.file?.path === "string" && typeof candidate.rateLimit.redis?.host === "string" && typeof candidate.rateLimit.redis.port === "number" && typeof candidate.rateLimit.redis.db === "number" && typeof candidate.rateLimit.redis.connection === "string" && typeof candidate.rateLimit.redis.prefix === "string" && typeof candidate.rateLimit.limiters === "object";
 }
 function normalizeStoreConfig(config) {
-  return isNormalizedSecurityConfig(config) ? config : normalizeSecurityConfig2(config);
+  return isNormalizedSecurityConfig(config) ? config : normalizeSecurityConfig(config);
 }
 function createRateLimitStoreFromConfig(config, options = {}) {
   const normalized = normalizeStoreConfig(config);
@@ -1116,7 +1120,6 @@ var securityStoreInternals = {
 };
 
 // src/index.ts
-import { defineSecurityConfig } from "@holo-js/config";
 var security = Object.freeze({
   configureSecurityRuntime,
   getSecurityRuntime,
@@ -1166,6 +1169,5 @@ export {
   redisRateLimitDriverInternals,
   createRateLimitStoreFromConfig,
   securityStoreInternals,
-  src_default,
-  defineSecurityConfig
+  src_default
 };

package/dist/chunk-WDTNP5YU.mjs

@@ -0,0 +1,235 @@
+// src/config.ts
+import {
+  DEFAULT_REDIS_DB,
+  DEFAULT_REDIS_HOST,
+  DEFAULT_REDIS_PORT,
+  resolveNormalizedRedisConnection
+} from "@holo-js/kernel";
+import { registerConfigNormalizer } from "@holo-js/config/registry";
+var DEFAULT_CORS_PATHS = Object.freeze(["/api/*"]);
+var DEFAULT_CORS_METHODS = Object.freeze(["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"]);
+var DEFAULT_CORS_HEADERS = Object.freeze(["Content-Type", "Authorization", "X-CSRF-TOKEN", "X-Requested-With"]);
+var DEFAULT_CORS_MAX_AGE = 7200;
+var holoCorsDefaults = Object.freeze({
+  paths: DEFAULT_CORS_PATHS,
+  origins: Object.freeze([]),
+  methods: DEFAULT_CORS_METHODS,
+  headers: DEFAULT_CORS_HEADERS,
+  credentials: false,
+  maxAge: DEFAULT_CORS_MAX_AGE,
+  statefulDomains: Object.freeze([])
+});
+var DEFAULT_SECURITY_CSRF_FIELD = "_token";
+var DEFAULT_SECURITY_CSRF_HEADER = "X-CSRF-TOKEN";
+var DEFAULT_SECURITY_CSRF_COOKIE = "XSRF-TOKEN";
+var DEFAULT_SECURITY_RATE_LIMIT_DRIVER = "memory";
+var DEFAULT_SECURITY_RATE_LIMIT_FILE_PATH = "./storage/framework/rate-limits";
+var DEFAULT_SECURITY_RATE_LIMIT_REDIS_CONNECTION = "default";
+var DEFAULT_SECURITY_RATE_LIMIT_REDIS_PREFIX = "holo:rate-limit:";
+var DEFAULT_SECURITY_CSRF_CONFIG = Object.freeze({
+  enabled: false,
+  field: DEFAULT_SECURITY_CSRF_FIELD,
+  header: DEFAULT_SECURITY_CSRF_HEADER,
+  cookie: DEFAULT_SECURITY_CSRF_COOKIE,
+  except: Object.freeze([])
+});
+var DEFAULT_SECURITY_RATE_LIMIT_CONFIG = Object.freeze({
+  driver: DEFAULT_SECURITY_RATE_LIMIT_DRIVER,
+  memory: Object.freeze({
+    driver: "memory"
+  }),
+  file: Object.freeze({
+    path: DEFAULT_SECURITY_RATE_LIMIT_FILE_PATH
+  }),
+  redis: Object.freeze({
+    host: DEFAULT_REDIS_HOST,
+    port: DEFAULT_REDIS_PORT,
+    password: void 0,
+    username: void 0,
+    db: DEFAULT_REDIS_DB,
+    connection: DEFAULT_SECURITY_RATE_LIMIT_REDIS_CONNECTION,
+    prefix: DEFAULT_SECURITY_RATE_LIMIT_REDIS_PREFIX
+  }),
+  limiters: Object.freeze({})
+});
+var holoSecurityDefaults = Object.freeze({
+  csrf: DEFAULT_SECURITY_CSRF_CONFIG,
+  rateLimit: DEFAULT_SECURITY_RATE_LIMIT_CONFIG
+});
+function parseScopedInteger(value, fallback, namespace, label, options = {}) {
+  const normalized = typeof value === "undefined" ? fallback : typeof value === "number" ? value : value.trim() ? Number(value.trim()) : Number.NaN;
+  if (!Number.isFinite(normalized) || !Number.isInteger(normalized)) throw new Error(`[${namespace}] ${label} must be an integer.`);
+  if (typeof options.minimum === "number" && normalized < options.minimum) throw new Error(`[${namespace}] ${label} must be greater than or equal to ${options.minimum}.`);
+  return normalized;
+}
+function normalizeScopedName(value, namespace, label) {
+  const normalized = value?.trim();
+  if (!normalized) throw new Error(`[${namespace}] ${label} must be a non-empty string.`);
+  return normalized;
+}
+function parseSecurityInteger(value, fallback, label, options = {}) {
+  return parseScopedInteger(value, fallback, "Holo Security", label, options);
+}
+function normalizeSecurityName(value, label) {
+  return normalizeScopedName(value, "Holo Security", label);
+}
+function normalizeSecurityOptionalString(value) {
+  const normalized = value?.trim();
+  return normalized || void 0;
+}
+function normalizeCorsStringList(values, defaults, label) {
+  if (!values) {
+    return defaults;
+  }
+  return Object.freeze(values.map((value, index) => {
+    const normalized = value.trim();
+    if (!normalized) {
+      throw new Error(`[Holo CORS] ${label} entry at index ${index} must be a non-empty string.`);
+    }
+    return normalized;
+  }));
+}
+function normalizeCorsMethods(values) {
+  return Object.freeze(normalizeCorsStringList(values, DEFAULT_CORS_METHODS, "methods").map((value) => value.toUpperCase()));
+}
+function normalizeCorsMaxAge(value) {
+  return parseSecurityInteger(value ?? DEFAULT_CORS_MAX_AGE, DEFAULT_CORS_MAX_AGE, "cors maxAge", {
+    minimum: 0
+  });
+}
+function normalizeCorsConfig(config = {}) {
+  return Object.freeze({
+    paths: normalizeCorsStringList(config.paths, DEFAULT_CORS_PATHS, "paths"),
+    origins: normalizeCorsStringList(config.origins, holoCorsDefaults.origins, "origins"),
+    methods: normalizeCorsMethods(config.methods),
+    headers: normalizeCorsStringList(config.headers, DEFAULT_CORS_HEADERS, "headers"),
+    credentials: config.credentials ?? holoCorsDefaults.credentials,
+    maxAge: normalizeCorsMaxAge(config.maxAge),
+    statefulDomains: normalizeCorsStringList(config.statefulDomains, holoCorsDefaults.statefulDomains, "statefulDomains")
+  });
+}
+function normalizeSecurityLimiter(name, config) {
+  const key = typeof config.key === "function" ? config.key : void 0;
+  if (typeof config.key !== "undefined" && typeof config.key !== "function") {
+    throw new Error(`[Holo Security] rate limiter "${name}" key resolver must be a function when provided.`);
+  }
+  return Object.freeze({
+    name,
+    maxAttempts: parseSecurityInteger(config.maxAttempts, 0, `rate limiter "${name}" maxAttempts`, {
+      minimum: 1
+    }),
+    decaySeconds: parseSecurityInteger(config.decaySeconds, 0, `rate limiter "${name}" decaySeconds`, {
+      minimum: 1
+    }),
+    ...key ? { key } : {}
+  });
+}
+function normalizeSecurityRateLimitConfig(config, redisConfig) {
+  const driver = normalizeSecurityOptionalString(config?.driver) || DEFAULT_SECURITY_RATE_LIMIT_DRIVER;
+  if (driver !== "memory" && driver !== "file" && driver !== "redis") {
+    throw new Error(`[Holo Security] Unsupported rate limit driver "${driver}".`);
+  }
+  const file = config?.file ?? {};
+  const redis = config?.redis ?? {};
+  const limiters = !config?.limiters || Object.keys(config.limiters).length === 0 ? holoSecurityDefaults.rateLimit.limiters : Object.freeze(Object.fromEntries(Object.entries(config.limiters).map(([name, limiter]) => {
+    const normalizedName = normalizeSecurityName(name, "Rate limiter name");
+    return [normalizedName, normalizeSecurityLimiter(normalizedName, limiter)];
+  })));
+  return Object.freeze({
+    driver,
+    memory: Object.freeze({
+      driver: "memory"
+    }),
+    file: Object.freeze({
+      path: normalizeSecurityOptionalString(file.path) || DEFAULT_SECURITY_RATE_LIMIT_FILE_PATH
+    }),
+    redis: Object.freeze((() => {
+      const connectionName = normalizeSecurityOptionalString(redis.connection) || redisConfig?.default || DEFAULT_SECURITY_RATE_LIMIT_REDIS_CONNECTION;
+      const resolvedConnection = redisConfig ? resolveNormalizedRedisConnection(
+        redisConfig,
+        connectionName,
+        "Security rate-limit Redis connection"
+      ) : driver === "redis" ? (() => {
+        throw new Error(
+          `[@holo-js/security] Rate-limit Redis config references shared connection "${connectionName}" without top-level Redis config.`
+        );
+      })() : {
+        name: connectionName,
+        host: DEFAULT_REDIS_HOST,
+        port: DEFAULT_REDIS_PORT,
+        password: void 0,
+        username: void 0,
+        db: DEFAULT_REDIS_DB
+      };
+      return {
+        ...typeof resolvedConnection.url === "undefined" ? {} : { url: resolvedConnection.url },
+        ...typeof resolvedConnection.clusters === "undefined" ? {} : { clusters: resolvedConnection.clusters },
+        host: resolvedConnection.host,
+        port: resolvedConnection.port,
+        password: resolvedConnection.password,
+        username: resolvedConnection.username,
+        db: resolvedConnection.db,
+        connection: resolvedConnection.name,
+        prefix: normalizeSecurityOptionalString(redis.prefix) || DEFAULT_SECURITY_RATE_LIMIT_REDIS_PREFIX
+      };
+    })()),
+    limiters
+  });
+}
+function normalizeSecurityConfig(config = {}, redisConfig) {
+  const csrf = typeof config.csrf === "boolean" ? { enabled: config.csrf } : config.csrf ?? {};
+  const except = csrf.except ? Object.freeze(csrf.except.map((value, index) => {
+    const normalized = value.trim();
+    if (!normalized) {
+      throw new Error(`[Holo Security] csrf except entry at index ${index} must be a non-empty string.`);
+    }
+    return normalized;
+  })) : DEFAULT_SECURITY_CSRF_CONFIG.except;
+  return Object.freeze({
+    csrf: Object.freeze({
+      enabled: csrf.enabled ?? DEFAULT_SECURITY_CSRF_CONFIG.enabled,
+      field: normalizeSecurityOptionalString(csrf.field) || DEFAULT_SECURITY_CSRF_FIELD,
+      header: normalizeSecurityOptionalString(csrf.header) || DEFAULT_SECURITY_CSRF_HEADER,
+      cookie: normalizeSecurityOptionalString(csrf.cookie) || DEFAULT_SECURITY_CSRF_COOKIE,
+      except
+    }),
+    rateLimit: normalizeSecurityRateLimitConfig(config.rateLimit, redisConfig)
+  });
+}
+function defineSecurityConfig(config) {
+  return Object.freeze({ ...config });
+}
+function defineCorsConfig(config) {
+  return Object.freeze({ ...config });
+}
+registerConfigNormalizer({
+  name: "cors",
+  normalize: normalizeCorsConfig
+});
+registerConfigNormalizer({
+  name: "security",
+  dependencies: ["redis"],
+  normalize(config, context) {
+    return normalizeSecurityConfig(config, context.has("redis") ? context.get("redis") : void 0);
+  }
+});
+
+export {
+  DEFAULT_CORS_PATHS,
+  DEFAULT_CORS_METHODS,
+  DEFAULT_CORS_HEADERS,
+  DEFAULT_CORS_MAX_AGE,
+  holoCorsDefaults,
+  DEFAULT_SECURITY_CSRF_FIELD,
+  DEFAULT_SECURITY_CSRF_HEADER,
+  DEFAULT_SECURITY_CSRF_COOKIE,
+  DEFAULT_SECURITY_RATE_LIMIT_DRIVER,
+  DEFAULT_SECURITY_RATE_LIMIT_FILE_PATH,
+  DEFAULT_SECURITY_RATE_LIMIT_REDIS_CONNECTION,
+  DEFAULT_SECURITY_RATE_LIMIT_REDIS_PREFIX,
+  holoSecurityDefaults,
+  normalizeCorsConfig,
+  normalizeSecurityConfig,
+  defineSecurityConfig,
+  defineCorsConfig
+};

package/dist/client.d.ts

@@ -1,5 +1,6 @@
+import './config.js';
 import { SecurityClientConfig } from './contracts.js';
-import '@holo-js/config';
+import '@holo-js/kernel';
 
 declare function getDefaultSecurityClientConfig(): SecurityClientConfig;
 declare function readSecurityClientConfigFromCookies(cookieHeader: string | null | undefined): SecurityClientConfig | undefined;

package/dist/config.d.ts

@@ -0,0 +1,136 @@
+import { NormalizedHoloRedisClusterNodeConfig, NormalizedHoloRedisConfig, HoloRedisClusterNodeConfig } from '@holo-js/kernel';
+
+interface HoloCorsConfig {
+    readonly paths?: readonly string[];
+    readonly origins?: readonly string[];
+    readonly methods?: readonly string[];
+    readonly headers?: readonly string[];
+    readonly credentials?: boolean;
+    readonly maxAge?: number | string;
+    readonly statefulDomains?: readonly string[];
+}
+declare module '@holo-js/config' {
+    interface HoloConfigRegistry {
+        cors: NormalizedHoloCorsConfig;
+        security: NormalizedHoloSecurityConfig;
+    }
+}
+interface NormalizedHoloCorsConfig {
+    readonly paths: readonly string[];
+    readonly origins: readonly string[];
+    readonly methods: readonly string[];
+    readonly headers: readonly string[];
+    readonly credentials: boolean;
+    readonly maxAge: number;
+    readonly statefulDomains: readonly string[];
+}
+type SecurityRateLimitDriver = 'memory' | 'file' | 'redis';
+interface HoloSecurityCsrfConfig {
+    readonly enabled?: boolean;
+    readonly field?: string;
+    readonly header?: string;
+    readonly cookie?: string;
+    readonly except?: readonly string[];
+}
+interface NormalizedHoloSecurityCsrfConfig {
+    readonly enabled: boolean;
+    readonly field: string;
+    readonly header: string;
+    readonly cookie: string;
+    readonly except: readonly string[];
+}
+interface SecurityRateLimitContext<TValues extends Readonly<Record<string, unknown>> | undefined = Readonly<Record<string, unknown>> | undefined> {
+    readonly request: Request;
+    readonly values?: TValues;
+}
+interface SecurityRateLimitKeyResolver<TValues extends Readonly<Record<string, unknown>> | undefined = Readonly<Record<string, unknown>> | undefined> {
+    (context: SecurityRateLimitContext<TValues>): string | Promise<string>;
+}
+interface SecurityLimiterConfig<TValues extends Readonly<Record<string, unknown>> | undefined = Readonly<Record<string, unknown>> | undefined> {
+    readonly maxAttempts: number | string;
+    readonly decaySeconds: number | string;
+    readonly key?: SecurityRateLimitKeyResolver<TValues>;
+}
+interface NormalizedSecurityLimiterConfig<TValues extends Readonly<Record<string, unknown>> | undefined = Readonly<Record<string, unknown>> | undefined> {
+    readonly name: string;
+    readonly maxAttempts: number;
+    readonly decaySeconds: number;
+    readonly key?: SecurityRateLimitKeyResolver<TValues>;
+}
+interface SecurityRateLimitMemoryConfig {
+    readonly driver?: 'memory';
+}
+interface SecurityRateLimitFileConfig {
+    readonly path?: string;
+}
+interface SecurityRateLimitRedisConnectionConfig {
+    readonly url?: string;
+    readonly clusters?: readonly HoloRedisClusterNodeConfig[];
+    readonly host?: string;
+    readonly port?: number | string;
+    readonly password?: string;
+    readonly username?: string;
+    readonly db?: number | string;
+}
+interface SecurityRateLimitRedisConfig {
+    readonly connection?: string;
+    readonly prefix?: string;
+}
+interface HoloSecurityRateLimitConfig {
+    readonly driver?: SecurityRateLimitDriver;
+    readonly memory?: SecurityRateLimitMemoryConfig;
+    readonly file?: SecurityRateLimitFileConfig;
+    readonly redis?: SecurityRateLimitRedisConfig;
+    readonly limiters?: Readonly<Record<string, SecurityLimiterConfig>>;
+}
+interface NormalizedSecurityRateLimitMemoryConfig {
+    readonly driver: 'memory';
+}
+interface NormalizedSecurityRateLimitFileConfig {
+    readonly path: string;
+}
+interface NormalizedSecurityRateLimitRedisConfig {
+    readonly url?: string;
+    readonly clusters?: readonly NormalizedHoloRedisClusterNodeConfig[];
+    readonly host: string;
+    readonly port: number;
+    readonly password?: string;
+    readonly username?: string;
+    readonly db: number;
+    readonly connection: string;
+    readonly prefix: string;
+}
+interface NormalizedHoloSecurityRateLimitConfig {
+    readonly driver: SecurityRateLimitDriver;
+    readonly memory: NormalizedSecurityRateLimitMemoryConfig;
+    readonly file: NormalizedSecurityRateLimitFileConfig;
+    readonly redis: NormalizedSecurityRateLimitRedisConfig;
+    readonly limiters: Readonly<Record<string, NormalizedSecurityLimiterConfig>>;
+}
+interface HoloSecurityConfig {
+    readonly csrf?: boolean | HoloSecurityCsrfConfig;
+    readonly rateLimit?: HoloSecurityRateLimitConfig;
+}
+interface NormalizedHoloSecurityConfig {
+    readonly csrf: NormalizedHoloSecurityCsrfConfig;
+    readonly rateLimit: NormalizedHoloSecurityRateLimitConfig;
+}
+declare const DEFAULT_CORS_PATHS: readonly ["/api/*"];
+declare const DEFAULT_CORS_METHODS: readonly ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"];
+declare const DEFAULT_CORS_HEADERS: readonly ["Content-Type", "Authorization", "X-CSRF-TOKEN", "X-Requested-With"];
+declare const DEFAULT_CORS_MAX_AGE = 7200;
+declare const holoCorsDefaults: Readonly<NormalizedHoloCorsConfig>;
+declare const DEFAULT_SECURITY_CSRF_FIELD = "_token";
+declare const DEFAULT_SECURITY_CSRF_HEADER = "X-CSRF-TOKEN";
+declare const DEFAULT_SECURITY_CSRF_COOKIE = "XSRF-TOKEN";
+declare const DEFAULT_SECURITY_RATE_LIMIT_DRIVER: SecurityRateLimitDriver;
+declare const DEFAULT_SECURITY_RATE_LIMIT_FILE_PATH = "./storage/framework/rate-limits";
+declare const DEFAULT_SECURITY_RATE_LIMIT_REDIS_CONNECTION = "default";
+declare const DEFAULT_SECURITY_RATE_LIMIT_REDIS_PREFIX = "holo:rate-limit:";
+declare const holoSecurityDefaults: Readonly<NormalizedHoloSecurityConfig>;
+declare function normalizeCorsConfig(config?: HoloCorsConfig): NormalizedHoloCorsConfig;
+declare function normalizeSecurityConfig(config?: HoloSecurityConfig, redisConfig?: NormalizedHoloRedisConfig): NormalizedHoloSecurityConfig;
+declare function defineSecurityConfig<TConfig extends HoloSecurityConfig>(config: TConfig): Readonly<TConfig>;
+declare function defineCorsConfig<TConfig extends HoloCorsConfig>(config: TConfig): Readonly<TConfig>;
+
+export { DEFAULT_CORS_HEADERS, DEFAULT_CORS_MAX_AGE, DEFAULT_CORS_METHODS, DEFAULT_CORS_PATHS, DEFAULT_SECURITY_CSRF_COOKIE, DEFAULT_SECURITY_CSRF_FIELD, DEFAULT_SECURITY_CSRF_HEADER, DEFAULT_SECURITY_RATE_LIMIT_DRIVER, DEFAULT_SECURITY_RATE_LIMIT_FILE_PATH, DEFAULT_SECURITY_RATE_LIMIT_REDIS_CONNECTION, DEFAULT_SECURITY_RATE_LIMIT_REDIS_PREFIX, type HoloCorsConfig, type HoloSecurityConfig, type HoloSecurityCsrfConfig, type HoloSecurityRateLimitConfig, type NormalizedHoloCorsConfig, type NormalizedHoloSecurityConfig, type NormalizedHoloSecurityCsrfConfig, type NormalizedHoloSecurityRateLimitConfig, type NormalizedSecurityLimiterConfig, type NormalizedSecurityRateLimitFileConfig, type NormalizedSecurityRateLimitMemoryConfig, type NormalizedSecurityRateLimitRedisConfig, type SecurityLimiterConfig, type SecurityRateLimitContext, type SecurityRateLimitDriver, type SecurityRateLimitFileConfig, type SecurityRateLimitKeyResolver, type SecurityRateLimitMemoryConfig, type SecurityRateLimitRedisConfig, type SecurityRateLimitRedisConnectionConfig, defineCorsConfig, defineSecurityConfig, holoCorsDefaults, holoSecurityDefaults, normalizeCorsConfig, normalizeSecurityConfig };

package/dist/config.mjs

@@ -0,0 +1,38 @@
+import {
+  DEFAULT_CORS_HEADERS,
+  DEFAULT_CORS_MAX_AGE,
+  DEFAULT_CORS_METHODS,
+  DEFAULT_CORS_PATHS,
+  DEFAULT_SECURITY_CSRF_COOKIE,
+  DEFAULT_SECURITY_CSRF_FIELD,
+  DEFAULT_SECURITY_CSRF_HEADER,
+  DEFAULT_SECURITY_RATE_LIMIT_DRIVER,
+  DEFAULT_SECURITY_RATE_LIMIT_FILE_PATH,
+  DEFAULT_SECURITY_RATE_LIMIT_REDIS_CONNECTION,
+  DEFAULT_SECURITY_RATE_LIMIT_REDIS_PREFIX,
+  defineCorsConfig,
+  defineSecurityConfig,
+  holoCorsDefaults,
+  holoSecurityDefaults,
+  normalizeCorsConfig,
+  normalizeSecurityConfig
+} from "./chunk-WDTNP5YU.mjs";
+export {
+  DEFAULT_CORS_HEADERS,
+  DEFAULT_CORS_MAX_AGE,
+  DEFAULT_CORS_METHODS,
+  DEFAULT_CORS_PATHS,
+  DEFAULT_SECURITY_CSRF_COOKIE,
+  DEFAULT_SECURITY_CSRF_FIELD,
+  DEFAULT_SECURITY_CSRF_HEADER,
+  DEFAULT_SECURITY_RATE_LIMIT_DRIVER,
+  DEFAULT_SECURITY_RATE_LIMIT_FILE_PATH,
+  DEFAULT_SECURITY_RATE_LIMIT_REDIS_CONNECTION,
+  DEFAULT_SECURITY_RATE_LIMIT_REDIS_PREFIX,
+  defineCorsConfig,
+  defineSecurityConfig,
+  holoCorsDefaults,
+  holoSecurityDefaults,
+  normalizeCorsConfig,
+  normalizeSecurityConfig
+};

package/dist/contracts.d.ts

@@ -1,5 +1,6 @@
-import { HoloSecurityConfig, NormalizedHoloSecurityConfig, HoloCorsConfig, NormalizedHoloCorsConfig, SecurityRateLimitFileConfig, SecurityRateLimitMemoryConfig, SecurityRateLimitRedisConfig, SecurityLimiterConfig, SecurityRateLimitKeyResolver } from '@holo-js/config';
-export { HoloCorsConfig, HoloSecurityConfig, HoloSecurityCsrfConfig, HoloSecurityRateLimitConfig, NormalizedHoloCorsConfig, NormalizedHoloSecurityConfig, NormalizedHoloSecurityCsrfConfig, NormalizedHoloSecurityRateLimitConfig, NormalizedSecurityLimiterConfig, SecurityLimiterConfig, SecurityRateLimitContext, SecurityRateLimitDriver, SecurityRateLimitFileConfig, SecurityRateLimitKeyResolver, SecurityRateLimitMemoryConfig, SecurityRateLimitRedisConfig } from '@holo-js/config';
+import { HoloSecurityConfig, NormalizedHoloSecurityConfig, HoloCorsConfig, NormalizedHoloCorsConfig, SecurityRateLimitFileConfig, SecurityRateLimitMemoryConfig, SecurityRateLimitRedisConfig, SecurityLimiterConfig, SecurityRateLimitKeyResolver } from './config.js';
+export { HoloSecurityCsrfConfig, HoloSecurityRateLimitConfig, NormalizedHoloSecurityCsrfConfig, NormalizedHoloSecurityRateLimitConfig, NormalizedSecurityLimiterConfig, SecurityRateLimitContext, SecurityRateLimitDriver } from './config.js';
+import '@holo-js/kernel';
 
 interface SecurityRuntimeBindings {
     readonly config: HoloSecurityConfig | NormalizedHoloSecurityConfig;
@@ -141,4 +142,4 @@ declare const securityInternals: {
     normalizeLimiterAttempts: typeof normalizeLimiterAttempts;
 };
 
-export { type SecurityClearRateLimitOptions, type SecurityClientConfig, type SecurityCorsFacade, SecurityCsrfError, type SecurityCsrfFacade, type SecurityCsrfField, type SecurityCsrfInput, type SecurityDefaultRateLimitKeyResolver, type SecurityProtectOptions, type SecurityRateLimitBucketSnapshot, type SecurityRateLimitCallOptions, SecurityRateLimitError, type SecurityRateLimitHitResult, type SecurityRateLimitRedisDriverAdapter, type SecurityRateLimitStore, type SecurityRateLimitStoreFactoryOptions, type SecurityRuntimeBindings, type SecurityRuntimeFacade, createFileRateLimitStoreConfig, createMemoryRateLimitStoreConfig, createRedisRateLimitStoreConfig, defineRateLimiter, defineSecurityRuntimeBindings, ip, limit, securityInternals };
+export { HoloCorsConfig, HoloSecurityConfig, NormalizedHoloCorsConfig, NormalizedHoloSecurityConfig, type SecurityClearRateLimitOptions, type SecurityClientConfig, type SecurityCorsFacade, SecurityCsrfError, type SecurityCsrfFacade, type SecurityCsrfField, type SecurityCsrfInput, type SecurityDefaultRateLimitKeyResolver, SecurityLimiterConfig, type SecurityProtectOptions, type SecurityRateLimitBucketSnapshot, type SecurityRateLimitCallOptions, SecurityRateLimitError, SecurityRateLimitFileConfig, type SecurityRateLimitHitResult, SecurityRateLimitKeyResolver, SecurityRateLimitMemoryConfig, SecurityRateLimitRedisConfig, type SecurityRateLimitRedisDriverAdapter, type SecurityRateLimitStore, type SecurityRateLimitStoreFactoryOptions, type SecurityRuntimeBindings, type SecurityRuntimeFacade, createFileRateLimitStoreConfig, createMemoryRateLimitStoreConfig, createRedisRateLimitStoreConfig, defineRateLimiter, defineSecurityRuntimeBindings, ip, limit, securityInternals };

package/dist/contracts.mjs

@@ -9,7 +9,8 @@ import {
   ip,
   limit,
   securityInternals
-} from "./chunk-EWQKJSFA.mjs";
+} from "./chunk-AGICNQRJ.mjs";
+import "./chunk-WDTNP5YU.mjs";
 export {
   SecurityCsrfError,
   SecurityRateLimitError,

package/dist/drivers/redis-adapter.d.ts

@@ -1,5 +1,6 @@
-import { NormalizedSecurityRateLimitRedisConfig } from '@holo-js/config';
+import { NormalizedSecurityRateLimitRedisConfig } from '../config.js';
 import { SecurityRateLimitRedisDriverAdapter } from '../contracts.js';
+import '@holo-js/kernel';
 
 interface SecurityRedisAdapterOptions {
     readonly now?: () => Date;

package/dist/index.d.ts

@@ -1,8 +1,8 @@
-import * as _holo_js_config from '@holo-js/config';
-import { NormalizedHoloCorsConfig, NormalizedSecurityLimiterConfig, HoloSecurityConfig, NormalizedHoloSecurityConfig } from '@holo-js/config';
-export { HoloCorsConfig, HoloSecurityConfig, HoloSecurityCsrfConfig, HoloSecurityRateLimitConfig, NormalizedHoloCorsConfig, NormalizedHoloSecurityConfig, NormalizedHoloSecurityCsrfConfig, NormalizedHoloSecurityRateLimitConfig, NormalizedSecurityLimiterConfig, SecurityLimiterConfig, SecurityRateLimitContext, SecurityRateLimitDriver, SecurityRateLimitFileConfig, SecurityRateLimitKeyResolver, SecurityRateLimitMemoryConfig, SecurityRateLimitRedisConfig, defineSecurityConfig } from '@holo-js/config';
+import { NormalizedHoloCorsConfig, NormalizedSecurityLimiterConfig, HoloSecurityConfig, NormalizedHoloSecurityConfig, SecurityRateLimitKeyResolver, SecurityLimiterConfig } from './config.js';
+export { HoloCorsConfig, HoloSecurityCsrfConfig, HoloSecurityRateLimitConfig, NormalizedHoloSecurityCsrfConfig, NormalizedHoloSecurityRateLimitConfig, SecurityRateLimitContext, SecurityRateLimitDriver, SecurityRateLimitFileConfig, SecurityRateLimitMemoryConfig, SecurityRateLimitRedisConfig, defineCorsConfig, defineSecurityConfig, holoCorsDefaults, holoSecurityDefaults, normalizeCorsConfig, normalizeSecurityConfig } from './config.js';
 import { SecurityCsrfField, SecurityCsrfInput, SecurityProtectOptions, SecurityClearRateLimitOptions, SecurityRateLimitCallOptions, SecurityRateLimitHitResult, SecurityRateLimitStore, SecurityRateLimitStoreFactoryOptions, SecurityRateLimitRedisDriverAdapter, SecurityRuntimeBindings, SecurityRuntimeFacade, ip } from './contracts.js';
 export { SecurityClientConfig, SecurityCorsFacade, SecurityCsrfError, SecurityCsrfFacade, SecurityDefaultRateLimitKeyResolver, SecurityRateLimitBucketSnapshot, SecurityRateLimitError, createFileRateLimitStoreConfig, createMemoryRateLimitStoreConfig, createRedisRateLimitStoreConfig, defineRateLimiter, defineSecurityRuntimeBindings, limit, securityInternals } from './contracts.js';
+import '@holo-js/kernel';
 
 declare function parseCookieHeader(header: string | null | undefined): Readonly<Record<string, string>>;
 declare function serializeCookie(name: string, value: string, options?: {
@@ -235,17 +235,17 @@ declare const security: Readonly<{
         perMinute(maxAttempts: number): {
             readonly maxAttempts: number;
             readonly decaySeconds: number;
-            by(key: _holo_js_config.SecurityRateLimitKeyResolver<Readonly<Record<string, unknown>> | undefined>): _holo_js_config.SecurityLimiterConfig<Readonly<Record<string, unknown>> | undefined>;
-            define(): _holo_js_config.SecurityLimiterConfig<Readonly<Record<string, unknown>> | undefined>;
+            by(key: SecurityRateLimitKeyResolver<Readonly<Record<string, unknown>> | undefined>): SecurityLimiterConfig<Readonly<Record<string, unknown>> | undefined>;
+            define(): SecurityLimiterConfig<Readonly<Record<string, unknown>> | undefined>;
         };
         perHour(maxAttempts: number): {
             readonly maxAttempts: number;
             readonly decaySeconds: number;
-            by(key: _holo_js_config.SecurityRateLimitKeyResolver<Readonly<Record<string, unknown>> | undefined>): _holo_js_config.SecurityLimiterConfig<Readonly<Record<string, unknown>> | undefined>;
-            define(): _holo_js_config.SecurityLimiterConfig<Readonly<Record<string, unknown>> | undefined>;
+            by(key: SecurityRateLimitKeyResolver<Readonly<Record<string, unknown>> | undefined>): SecurityLimiterConfig<Readonly<Record<string, unknown>> | undefined>;
+            define(): SecurityLimiterConfig<Readonly<Record<string, unknown>> | undefined>;
         };
     }>;
     ip: typeof ip;
 }>;
 
-export { SecurityClearRateLimitOptions, SecurityCsrfField, SecurityCsrfInput, SecurityProtectOptions, SecurityRateLimitCallOptions, SecurityRateLimitHitResult, SecurityRateLimitRedisDriverAdapter, SecurityRateLimitStore, SecurityRateLimitStoreFactoryOptions, SecurityRuntimeBindings, SecurityRuntimeFacade, SecurityRuntimeNotConfiguredError, apply as applyCors, clearRateLimit, configureSecurityRuntime, cors, corsInternals, headers as createCorsHeaders, preflight as createCorsPreflightResponse, cookie as createCsrfCookie, field as createCsrfField, input as createCsrfInput, token as createCsrfToken, createFileRateLimitStore, createMemoryRateLimitStore, createRateLimitStoreFromConfig, createRedisRateLimitStore, csrf, csrfInternals, security as default, defaultRateLimitKey, fileRateLimitDriverInternals, getSecurityRuntime, getSecurityRuntimeBindings, ip, isSecureRequest, memoryRateLimitDriverInternals, protect, rateLimit, rateLimitInternals, redisRateLimitDriverInternals, resetSecurityRuntime, securityRuntimeInternals, securityStoreInternals, verify as verifyCsrfRequest };
+export { HoloSecurityConfig, NormalizedHoloCorsConfig, NormalizedHoloSecurityConfig, NormalizedSecurityLimiterConfig, SecurityClearRateLimitOptions, SecurityCsrfField, SecurityCsrfInput, SecurityLimiterConfig, SecurityProtectOptions, SecurityRateLimitCallOptions, SecurityRateLimitHitResult, SecurityRateLimitKeyResolver, SecurityRateLimitRedisDriverAdapter, SecurityRateLimitStore, SecurityRateLimitStoreFactoryOptions, SecurityRuntimeBindings, SecurityRuntimeFacade, SecurityRuntimeNotConfiguredError, apply as applyCors, clearRateLimit, configureSecurityRuntime, cors, corsInternals, headers as createCorsHeaders, preflight as createCorsPreflightResponse, cookie as createCsrfCookie, field as createCsrfField, input as createCsrfInput, token as createCsrfToken, createFileRateLimitStore, createMemoryRateLimitStore, createRateLimitStoreFromConfig, createRedisRateLimitStore, csrf, csrfInternals, security as default, defaultRateLimitKey, fileRateLimitDriverInternals, getSecurityRuntime, getSecurityRuntimeBindings, ip, isSecureRequest, memoryRateLimitDriverInternals, protect, rateLimit, rateLimitInternals, redisRateLimitDriverInternals, resetSecurityRuntime, securityRuntimeInternals, securityStoreInternals, verify as verifyCsrfRequest };

package/dist/index.mjs

@@ -13,7 +13,6 @@ import {
   csrf,
   csrfInternals,
   defaultRateLimitKey,
-  defineSecurityConfig,
   field,
   fileRateLimitDriverInternals,
   getSecurityRuntime,
@@ -33,7 +32,7 @@ import {
   src_default,
   token,
   verify
-} from "./chunk-QGBGZ2GI.mjs";
+} from "./chunk-NKKBOLDI.mjs";
 import {
   SecurityCsrfError,
   SecurityRateLimitError,
@@ -45,7 +44,15 @@ import {
   ip,
   limit,
   securityInternals
-} from "./chunk-EWQKJSFA.mjs";
+} from "./chunk-AGICNQRJ.mjs";
+import {
+  defineCorsConfig,
+  defineSecurityConfig,
+  holoCorsDefaults,
+  holoSecurityDefaults,
+  normalizeCorsConfig,
+  normalizeSecurityConfig
+} from "./chunk-WDTNP5YU.mjs";
 export {
   SecurityCsrfError,
   SecurityRateLimitError,
@@ -72,16 +79,21 @@ export {
   csrfInternals,
   src_default as default,
   defaultRateLimitKey,
+  defineCorsConfig,
   defineRateLimiter,
   defineSecurityConfig,
   defineSecurityRuntimeBindings,
   fileRateLimitDriverInternals,
   getSecurityRuntime,
   getSecurityRuntimeBindings,
+  holoCorsDefaults,
+  holoSecurityDefaults,
   ip,
   isSecureRequest,
   limit,
   memoryRateLimitDriverInternals,
+  normalizeCorsConfig,
+  normalizeSecurityConfig,
   protect,
   rateLimit,
   rateLimitInternals,

package/dist/next/server.mjs

@@ -4,7 +4,7 @@ import {
   getSecurityRuntime,
   isSecureRequest,
   protect
-} from "../chunk-QGBGZ2GI.mjs";
+} from "../chunk-NKKBOLDI.mjs";
 import {
   SECURITY_CLIENT_CONFIG_COOKIE,
   createSecurityClientConfig,
@@ -12,7 +12,8 @@ import {
 } from "../chunk-FUOZWKHK.mjs";
 import {
   SecurityCsrfError
-} from "../chunk-EWQKJSFA.mjs";
+} from "../chunk-AGICNQRJ.mjs";
+import "../chunk-WDTNP5YU.mjs";
 
 // src/next/server.ts
 function isSafeMethod(method) {
@@ -64,6 +65,12 @@ async function issueCsrfCookie(request) {
 }
 function csrfProtection() {
   return async (request) => {
+    if (request.method.trim().toUpperCase() === "TRACE") {
+      return new Response("Method Not Allowed", {
+        status: 405,
+        headers: { Allow: "GET, HEAD, OPTIONS, POST, PUT, PATCH, DELETE" }
+      });
+    }
     try {
       await protect(request);
     } catch (error) {

package/dist/nuxt/server.mjs

@@ -4,7 +4,7 @@ import {
   getSecurityRuntime,
   isSecureRequest,
   protect
-} from "../chunk-QGBGZ2GI.mjs";
+} from "../chunk-NKKBOLDI.mjs";
 import {
   SECURITY_CLIENT_CONFIG_COOKIE,
   createSecurityClientConfig,
@@ -12,7 +12,8 @@ import {
 } from "../chunk-FUOZWKHK.mjs";
 import {
   SecurityCsrfError
-} from "../chunk-EWQKJSFA.mjs";
+} from "../chunk-AGICNQRJ.mjs";
+import "../chunk-WDTNP5YU.mjs";
 
 // src/nuxt/server.ts
 import {
@@ -83,6 +84,12 @@ async function issueCsrfCookie(event, request) {
 }
 function csrfProtection() {
   return defineEventHandler(async (event) => {
+    if (getMethod(event).trim().toUpperCase() === "TRACE") {
+      return new Response("Method Not Allowed", {
+        status: 405,
+        headers: { Allow: "GET, HEAD, OPTIONS, POST, PUT, PATCH, DELETE" }
+      });
+    }
     const request = await createRequest(event);
     try {
       await protect(request);
@@ -97,6 +104,7 @@ function csrfProtection() {
       throw error;
     }
     await issueCsrfCookie(event, request);
+    return void 0;
   });
 }
 var nuxtSecurityInternals = {

package/dist/sveltekit/server.mjs

@@ -3,7 +3,7 @@ import {
   getSecurityRuntime,
   isSecureRequest,
   protect
-} from "../chunk-QGBGZ2GI.mjs";
+} from "../chunk-NKKBOLDI.mjs";
 import {
   SECURITY_CLIENT_CONFIG_COOKIE,
   createSecurityClientConfig,
@@ -11,7 +11,8 @@ import {
 } from "../chunk-FUOZWKHK.mjs";
 import {
   SecurityCsrfError
-} from "../chunk-EWQKJSFA.mjs";
+} from "../chunk-AGICNQRJ.mjs";
+import "../chunk-WDTNP5YU.mjs";
 
 // src/sveltekit/server.ts
 function isSafeMethod(method) {
@@ -47,6 +48,12 @@ function createCsrfErrorResponse(error) {
 }
 function csrfProtection() {
   return async ({ event, resolve }) => {
+    if (event.request.method.trim().toUpperCase() === "TRACE") {
+      return new Response("Method Not Allowed", {
+        status: 405,
+        headers: { Allow: "GET, HEAD, OPTIONS, POST, PUT, PATCH, DELETE" }
+      });
+    }
     try {
       await protect(event.request);
     } catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@holo-js/security",
-  "version": "0.2.6",
+  "version": "0.3.1",
   "description": "Holo-JS Framework - CSRF and rate-limit contracts, config, and runtime seams",
   "type": "module",
   "license": "MIT",
@@ -10,6 +10,11 @@
       "import": "./dist/index.mjs",
       "default": "./dist/index.mjs"
     },
+    "./config": {
+      "types": "./dist/config.d.ts",
+      "import": "./dist/config.mjs",
+      "default": "./dist/config.mjs"
+    },
     "./client": {
       "types": "./dist/client.d.ts",
       "import": "./dist/client.mjs",
@@ -53,7 +58,8 @@
     "test": "vitest --run --coverage"
   },
   "dependencies": {
-    "@holo-js/config": "^0.2.6"
+    "@holo-js/config": "^0.3.1",
+    "@holo-js/kernel": "^0.3.1"
   },
   "peerDependencies": {
     "h3": "^1.15.11",