@holo-js/security 0.3.27 → 0.4.0

package/dist/{chunk-FQ4X7X6L.mjs → chunk-U25HSHLJ.mjs}

@@ -1,7 +1,7 @@
 import {
   normalizeCorsConfig,
   normalizeSecurityConfig
-} from "./chunk-WRMZRO77.mjs";
+} from "./chunk-D3ZN5MLJ.mjs";
 
 // src/contracts.ts
 var SecurityCsrfError = class extends Error {
@@ -27,6 +27,8 @@ var PendingSecurityLimiterDefinition = class {
     this.maxAttempts = maxAttempts;
     this.decaySeconds = decaySeconds;
   }
+  maxAttempts;
+  decaySeconds;
   by(key) {
     if (typeof key !== "function") {
       throw new TypeError("[@holo-js/security] Rate limiter key resolvers must be functions.");
@@ -64,20 +66,6 @@ var limit = Object.freeze({
     );
   }
 });
-function ip(request, trustedProxy = false) {
-  if (!trustedProxy) {
-    return "unknown";
-  }
-  const forwarded = request.headers.get("x-forwarded-for")?.split(",", 1)[0]?.trim();
-  if (forwarded) {
-    return forwarded;
-  }
-  const realIp = request.headers.get("x-real-ip")?.trim();
-  if (realIp) {
-    return realIp;
-  }
-  return "unknown";
-}
 function normalizeLimiterIntegerInput(value, label) {
   if (typeof value === "undefined") {
     throw new TypeError(`[@holo-js/security] ${label} is required.`);
@@ -117,6 +105,7 @@ function defineSecurityRuntimeBindings(bindings) {
     cors: normalizeCorsConfig(bindings.cors),
     rateLimitStore: bindings.rateLimitStore,
     csrfSigningKey: bindings.csrfSigningKey,
+    csrfSession: bindings.csrfSession,
     defaultKeyResolver: bindings.defaultKeyResolver
   });
 }
@@ -144,7 +133,6 @@ export {
   SecurityCsrfError,
   SecurityRateLimitError,
   limit,
-  ip,
   defineRateLimiter,
   defineSecurityRuntimeBindings,
   createMemoryRateLimitStoreConfig,

package/dist/client.d.ts

@@ -1,4 +1,4 @@
-import './config.js';
+import './config-BK6q6Yh9.js';
 import { SecurityClientConfig } from './contracts.js';
 import '@holo-js/kernel';
 

package/dist/client.mjs

@@ -2,13 +2,13 @@ import {
   getDefaultSecurityClientConfig,
   readSecurityClientConfigFromCookies,
   securityClientConfigInternals
-} from "./chunk-PC2YCWDH.mjs";
+} from "./chunk-EINZXLC2.mjs";
 
 // src/client.ts
 function getSecurityClientConfig() {
   const runtime = globalThis;
   const config = readSecurityClientConfigFromCookies(runtime.document?.cookie) ?? getDefaultSecurityClientConfig();
-  return Object.freeze({ csrf: Object.freeze({ field: config.csrf.field, cookie: config.csrf.cookie }) });
+  return Object.freeze({ csrf: Object.freeze({ field: config.csrf.field, header: config.csrf.header, cookie: config.csrf.cookie }) });
 }
 var securityClientInternals = {
   getDefaultSecurityClientConfig,

package/dist/config-BK6q6Yh9.d.ts

@@ -0,0 +1,145 @@
+import { NormalizedHoloRedisClusterNodeConfig, HoloRedisClusterNodeConfig, NormalizedHoloRedisConfig } from '@holo-js/kernel';
+
+type SecurityTrustedProxies = readonly string[] | '*';
+
+interface HoloCorsConfig {
+    readonly paths?: readonly string[];
+    readonly origins?: readonly string[];
+    readonly methods?: readonly string[];
+    readonly headers?: readonly string[];
+    readonly credentials?: boolean;
+    readonly maxAge?: number | string;
+    readonly statefulDomains?: readonly string[];
+}
+declare module '@holo-js/config' {
+    interface HoloConfigRegistry {
+        cors: NormalizedHoloCorsConfig;
+        security: NormalizedHoloSecurityConfig;
+    }
+}
+interface NormalizedHoloCorsConfig {
+    readonly paths: readonly string[];
+    readonly origins: readonly string[];
+    readonly methods: readonly string[];
+    readonly headers: readonly string[];
+    readonly credentials: boolean;
+    readonly maxAge: number;
+    readonly statefulDomains: readonly string[];
+}
+type SecurityRateLimitDriver = 'memory' | 'file' | 'redis';
+interface HoloSecurityCsrfConfig {
+    readonly enabled?: boolean;
+    readonly field?: string;
+    readonly header?: string;
+    readonly cookie?: string;
+    readonly except?: readonly string[];
+}
+interface NormalizedHoloSecurityCsrfConfig {
+    readonly enabled: boolean;
+    readonly field: string;
+    readonly header: string;
+    readonly cookie: string;
+    readonly except: readonly string[];
+}
+interface SecurityRateLimitContext<TValues extends Readonly<Record<string, unknown>> | undefined = Readonly<Record<string, unknown>> | undefined> {
+    readonly request: Request;
+    readonly values?: TValues;
+}
+interface SecurityRateLimitKeyResolver<TValues extends Readonly<Record<string, unknown>> | undefined = Readonly<Record<string, unknown>> | undefined> {
+    (context: SecurityRateLimitContext<TValues>): string | Promise<string>;
+}
+interface SecurityLimiterConfig<TValues extends Readonly<Record<string, unknown>> | undefined = Readonly<Record<string, unknown>> | undefined> {
+    readonly maxAttempts: number | string;
+    readonly decaySeconds: number | string;
+    readonly key?: SecurityRateLimitKeyResolver<TValues>;
+}
+interface NormalizedSecurityLimiterConfig<TValues extends Readonly<Record<string, unknown>> | undefined = Readonly<Record<string, unknown>> | undefined> {
+    readonly name: string;
+    readonly maxAttempts: number;
+    readonly decaySeconds: number;
+    readonly key?: SecurityRateLimitKeyResolver<TValues>;
+}
+interface SecurityRateLimitMemoryConfig {
+    readonly driver?: 'memory';
+}
+interface SecurityRateLimitFileConfig {
+    readonly path?: string;
+}
+interface SecurityRateLimitRedisConnectionConfig {
+    readonly url?: string;
+    readonly clusters?: readonly HoloRedisClusterNodeConfig[];
+    readonly host?: string;
+    readonly port?: number | string;
+    readonly password?: string;
+    readonly username?: string;
+    readonly db?: number | string;
+}
+interface SecurityRateLimitRedisConfig {
+    readonly connection?: string;
+    readonly prefix?: string;
+}
+interface HoloSecurityRateLimitConfig {
+    readonly driver?: SecurityRateLimitDriver;
+    readonly memory?: SecurityRateLimitMemoryConfig;
+    readonly file?: SecurityRateLimitFileConfig;
+    readonly redis?: SecurityRateLimitRedisConfig;
+    readonly limiters?: Readonly<Record<string, SecurityLimiterConfig>>;
+}
+interface NormalizedSecurityRateLimitMemoryConfig {
+    readonly driver: 'memory';
+}
+interface NormalizedSecurityRateLimitFileConfig {
+    readonly path: string;
+}
+interface NormalizedSecurityRateLimitRedisConfig {
+    readonly url?: string;
+    readonly clusters?: readonly NormalizedHoloRedisClusterNodeConfig[];
+    readonly host: string;
+    readonly port: number;
+    readonly password?: string;
+    readonly username?: string;
+    readonly db: number;
+    readonly connection: string;
+    readonly prefix: string;
+}
+interface NormalizedHoloSecurityRateLimitConfig {
+    readonly driver: SecurityRateLimitDriver;
+    readonly memory: NormalizedSecurityRateLimitMemoryConfig;
+    readonly file: NormalizedSecurityRateLimitFileConfig;
+    readonly redis: NormalizedSecurityRateLimitRedisConfig;
+    readonly limiters: Readonly<Record<string, NormalizedSecurityLimiterConfig>>;
+}
+interface HoloSecurityConfig {
+    readonly csrf?: boolean | HoloSecurityCsrfConfig;
+    readonly rateLimit?: HoloSecurityRateLimitConfig;
+    readonly trustedProxies?: SecurityTrustedProxies;
+    readonly maxBodyBytes?: number | string;
+    readonly maxUploadBodyBytes?: number | string;
+}
+interface NormalizedHoloSecurityConfig {
+    readonly csrf: NormalizedHoloSecurityCsrfConfig;
+    readonly rateLimit: NormalizedHoloSecurityRateLimitConfig;
+    readonly trustedProxies: SecurityTrustedProxies;
+    readonly maxBodyBytes: number;
+    readonly maxUploadBodyBytes: number;
+}
+declare const DEFAULT_CORS_PATHS: readonly ["/api/*"];
+declare const DEFAULT_CORS_METHODS: readonly ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"];
+declare const DEFAULT_CORS_HEADERS: readonly ["Content-Type", "Authorization", "X-CSRF-TOKEN", "X-XSRF-TOKEN", "X-Requested-With"];
+declare const DEFAULT_CORS_MAX_AGE = 7200;
+declare const holoCorsDefaults: Readonly<NormalizedHoloCorsConfig>;
+declare const DEFAULT_SECURITY_CSRF_FIELD = "_token";
+declare const DEFAULT_SECURITY_CSRF_HEADER = "X-CSRF-TOKEN";
+declare const DEFAULT_SECURITY_CSRF_COOKIE = "XSRF-TOKEN";
+declare const DEFAULT_SECURITY_RATE_LIMIT_DRIVER: SecurityRateLimitDriver;
+declare const DEFAULT_SECURITY_RATE_LIMIT_FILE_PATH = "./storage/framework/rate-limits";
+declare const DEFAULT_SECURITY_RATE_LIMIT_REDIS_CONNECTION = "default";
+declare const DEFAULT_SECURITY_RATE_LIMIT_REDIS_PREFIX = "holo:rate-limit:";
+declare const holoSecurityDefaults: Readonly<NormalizedHoloSecurityConfig>;
+declare function normalizeCorsConfig(config?: HoloCorsConfig): NormalizedHoloCorsConfig;
+declare function normalizeSecurityConfig(config?: HoloSecurityConfig, redisConfig?: NormalizedHoloRedisConfig): NormalizedHoloSecurityConfig;
+declare function defineSecurityConfig<TConfig extends HoloSecurityConfig>(config: TConfig): Readonly<TConfig>;
+declare function defineCorsConfig<TConfig extends HoloCorsConfig>(config: TConfig): Readonly<TConfig>;
+
+export { DEFAULT_SECURITY_CSRF_HEADER as A, DEFAULT_SECURITY_RATE_LIMIT_DRIVER as B, DEFAULT_SECURITY_RATE_LIMIT_FILE_PATH as C, DEFAULT_CORS_HEADERS as D, DEFAULT_SECURITY_RATE_LIMIT_REDIS_CONNECTION as E, DEFAULT_SECURITY_RATE_LIMIT_REDIS_PREFIX as F, defineCorsConfig as p, defineSecurityConfig as q, holoCorsDefaults as r, holoSecurityDefaults as s, normalizeCorsConfig as t, normalizeSecurityConfig as u, DEFAULT_CORS_MAX_AGE as v, DEFAULT_CORS_METHODS as w, DEFAULT_CORS_PATHS as x, DEFAULT_SECURITY_CSRF_COOKIE as y, DEFAULT_SECURITY_CSRF_FIELD as z };
+export type { NormalizedSecurityRateLimitFileConfig as G, HoloSecurityConfig as H, NormalizedSecurityRateLimitMemoryConfig as I, SecurityRateLimitRedisConnectionConfig as J, NormalizedSecurityRateLimitRedisConfig as N, SecurityRateLimitKeyResolver as S, NormalizedHoloCorsConfig as a, NormalizedSecurityLimiterConfig as b, NormalizedHoloSecurityConfig as c, SecurityLimiterConfig as d, HoloCorsConfig as e, HoloSecurityCsrfConfig as f, HoloSecurityRateLimitConfig as g, NormalizedHoloSecurityCsrfConfig as h, NormalizedHoloSecurityRateLimitConfig as i, SecurityRateLimitContext as j, SecurityRateLimitDriver as k, SecurityRateLimitFileConfig as l, SecurityRateLimitMemoryConfig as m, SecurityRateLimitRedisConfig as n, SecurityTrustedProxies as o };

package/dist/config.d.ts

@@ -1,136 +1,2 @@
-import { NormalizedHoloRedisClusterNodeConfig, NormalizedHoloRedisConfig, HoloRedisClusterNodeConfig } from '@holo-js/kernel';
-
-interface HoloCorsConfig {
-    readonly paths?: readonly string[];
-    readonly origins?: readonly string[];
-    readonly methods?: readonly string[];
-    readonly headers?: readonly string[];
-    readonly credentials?: boolean;
-    readonly maxAge?: number | string;
-    readonly statefulDomains?: readonly string[];
-}
-declare module '@holo-js/config' {
-    interface HoloConfigRegistry {
-        cors: NormalizedHoloCorsConfig;
-        security: NormalizedHoloSecurityConfig;
-    }
-}
-interface NormalizedHoloCorsConfig {
-    readonly paths: readonly string[];
-    readonly origins: readonly string[];
-    readonly methods: readonly string[];
-    readonly headers: readonly string[];
-    readonly credentials: boolean;
-    readonly maxAge: number;
-    readonly statefulDomains: readonly string[];
-}
-type SecurityRateLimitDriver = 'memory' | 'file' | 'redis';
-interface HoloSecurityCsrfConfig {
-    readonly enabled?: boolean;
-    readonly field?: string;
-    readonly header?: string;
-    readonly cookie?: string;
-    readonly except?: readonly string[];
-}
-interface NormalizedHoloSecurityCsrfConfig {
-    readonly enabled: boolean;
-    readonly field: string;
-    readonly header: string;
-    readonly cookie: string;
-    readonly except: readonly string[];
-}
-interface SecurityRateLimitContext<TValues extends Readonly<Record<string, unknown>> | undefined = Readonly<Record<string, unknown>> | undefined> {
-    readonly request: Request;
-    readonly values?: TValues;
-}
-interface SecurityRateLimitKeyResolver<TValues extends Readonly<Record<string, unknown>> | undefined = Readonly<Record<string, unknown>> | undefined> {
-    (context: SecurityRateLimitContext<TValues>): string | Promise<string>;
-}
-interface SecurityLimiterConfig<TValues extends Readonly<Record<string, unknown>> | undefined = Readonly<Record<string, unknown>> | undefined> {
-    readonly maxAttempts: number | string;
-    readonly decaySeconds: number | string;
-    readonly key?: SecurityRateLimitKeyResolver<TValues>;
-}
-interface NormalizedSecurityLimiterConfig<TValues extends Readonly<Record<string, unknown>> | undefined = Readonly<Record<string, unknown>> | undefined> {
-    readonly name: string;
-    readonly maxAttempts: number;
-    readonly decaySeconds: number;
-    readonly key?: SecurityRateLimitKeyResolver<TValues>;
-}
-interface SecurityRateLimitMemoryConfig {
-    readonly driver?: 'memory';
-}
-interface SecurityRateLimitFileConfig {
-    readonly path?: string;
-}
-interface SecurityRateLimitRedisConnectionConfig {
-    readonly url?: string;
-    readonly clusters?: readonly HoloRedisClusterNodeConfig[];
-    readonly host?: string;
-    readonly port?: number | string;
-    readonly password?: string;
-    readonly username?: string;
-    readonly db?: number | string;
-}
-interface SecurityRateLimitRedisConfig {
-    readonly connection?: string;
-    readonly prefix?: string;
-}
-interface HoloSecurityRateLimitConfig {
-    readonly driver?: SecurityRateLimitDriver;
-    readonly memory?: SecurityRateLimitMemoryConfig;
-    readonly file?: SecurityRateLimitFileConfig;
-    readonly redis?: SecurityRateLimitRedisConfig;
-    readonly limiters?: Readonly<Record<string, SecurityLimiterConfig>>;
-}
-interface NormalizedSecurityRateLimitMemoryConfig {
-    readonly driver: 'memory';
-}
-interface NormalizedSecurityRateLimitFileConfig {
-    readonly path: string;
-}
-interface NormalizedSecurityRateLimitRedisConfig {
-    readonly url?: string;
-    readonly clusters?: readonly NormalizedHoloRedisClusterNodeConfig[];
-    readonly host: string;
-    readonly port: number;
-    readonly password?: string;
-    readonly username?: string;
-    readonly db: number;
-    readonly connection: string;
-    readonly prefix: string;
-}
-interface NormalizedHoloSecurityRateLimitConfig {
-    readonly driver: SecurityRateLimitDriver;
-    readonly memory: NormalizedSecurityRateLimitMemoryConfig;
-    readonly file: NormalizedSecurityRateLimitFileConfig;
-    readonly redis: NormalizedSecurityRateLimitRedisConfig;
-    readonly limiters: Readonly<Record<string, NormalizedSecurityLimiterConfig>>;
-}
-interface HoloSecurityConfig {
-    readonly csrf?: boolean | HoloSecurityCsrfConfig;
-    readonly rateLimit?: HoloSecurityRateLimitConfig;
-}
-interface NormalizedHoloSecurityConfig {
-    readonly csrf: NormalizedHoloSecurityCsrfConfig;
-    readonly rateLimit: NormalizedHoloSecurityRateLimitConfig;
-}
-declare const DEFAULT_CORS_PATHS: readonly ["/api/*"];
-declare const DEFAULT_CORS_METHODS: readonly ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"];
-declare const DEFAULT_CORS_HEADERS: readonly ["Content-Type", "Authorization", "X-CSRF-TOKEN", "X-Requested-With"];
-declare const DEFAULT_CORS_MAX_AGE = 7200;
-declare const holoCorsDefaults: Readonly<NormalizedHoloCorsConfig>;
-declare const DEFAULT_SECURITY_CSRF_FIELD = "_token";
-declare const DEFAULT_SECURITY_CSRF_HEADER = "X-CSRF-TOKEN";
-declare const DEFAULT_SECURITY_CSRF_COOKIE = "XSRF-TOKEN";
-declare const DEFAULT_SECURITY_RATE_LIMIT_DRIVER: SecurityRateLimitDriver;
-declare const DEFAULT_SECURITY_RATE_LIMIT_FILE_PATH = "./storage/framework/rate-limits";
-declare const DEFAULT_SECURITY_RATE_LIMIT_REDIS_CONNECTION = "default";
-declare const DEFAULT_SECURITY_RATE_LIMIT_REDIS_PREFIX = "holo:rate-limit:";
-declare const holoSecurityDefaults: Readonly<NormalizedHoloSecurityConfig>;
-declare function normalizeCorsConfig(config?: HoloCorsConfig): NormalizedHoloCorsConfig;
-declare function normalizeSecurityConfig(config?: HoloSecurityConfig, redisConfig?: NormalizedHoloRedisConfig): NormalizedHoloSecurityConfig;
-declare function defineSecurityConfig<TConfig extends HoloSecurityConfig>(config: TConfig): Readonly<TConfig>;
-declare function defineCorsConfig<TConfig extends HoloCorsConfig>(config: TConfig): Readonly<TConfig>;
-
-export { DEFAULT_CORS_HEADERS, DEFAULT_CORS_MAX_AGE, DEFAULT_CORS_METHODS, DEFAULT_CORS_PATHS, DEFAULT_SECURITY_CSRF_COOKIE, DEFAULT_SECURITY_CSRF_FIELD, DEFAULT_SECURITY_CSRF_HEADER, DEFAULT_SECURITY_RATE_LIMIT_DRIVER, DEFAULT_SECURITY_RATE_LIMIT_FILE_PATH, DEFAULT_SECURITY_RATE_LIMIT_REDIS_CONNECTION, DEFAULT_SECURITY_RATE_LIMIT_REDIS_PREFIX, type HoloCorsConfig, type HoloSecurityConfig, type HoloSecurityCsrfConfig, type HoloSecurityRateLimitConfig, type NormalizedHoloCorsConfig, type NormalizedHoloSecurityConfig, type NormalizedHoloSecurityCsrfConfig, type NormalizedHoloSecurityRateLimitConfig, type NormalizedSecurityLimiterConfig, type NormalizedSecurityRateLimitFileConfig, type NormalizedSecurityRateLimitMemoryConfig, type NormalizedSecurityRateLimitRedisConfig, type SecurityLimiterConfig, type SecurityRateLimitContext, type SecurityRateLimitDriver, type SecurityRateLimitFileConfig, type SecurityRateLimitKeyResolver, type SecurityRateLimitMemoryConfig, type SecurityRateLimitRedisConfig, type SecurityRateLimitRedisConnectionConfig, defineCorsConfig, defineSecurityConfig, holoCorsDefaults, holoSecurityDefaults, normalizeCorsConfig, normalizeSecurityConfig };
+import '@holo-js/kernel';
+export { D as DEFAULT_CORS_HEADERS, v as DEFAULT_CORS_MAX_AGE, w as DEFAULT_CORS_METHODS, x as DEFAULT_CORS_PATHS, y as DEFAULT_SECURITY_CSRF_COOKIE, z as DEFAULT_SECURITY_CSRF_FIELD, A as DEFAULT_SECURITY_CSRF_HEADER, B as DEFAULT_SECURITY_RATE_LIMIT_DRIVER, C as DEFAULT_SECURITY_RATE_LIMIT_FILE_PATH, E as DEFAULT_SECURITY_RATE_LIMIT_REDIS_CONNECTION, F as DEFAULT_SECURITY_RATE_LIMIT_REDIS_PREFIX, e as HoloCorsConfig, H as HoloSecurityConfig, f as HoloSecurityCsrfConfig, g as HoloSecurityRateLimitConfig, a as NormalizedHoloCorsConfig, c as NormalizedHoloSecurityConfig, h as NormalizedHoloSecurityCsrfConfig, i as NormalizedHoloSecurityRateLimitConfig, b as NormalizedSecurityLimiterConfig, G as NormalizedSecurityRateLimitFileConfig, I as NormalizedSecurityRateLimitMemoryConfig, N as NormalizedSecurityRateLimitRedisConfig, d as SecurityLimiterConfig, j as SecurityRateLimitContext, k as SecurityRateLimitDriver, l as SecurityRateLimitFileConfig, S as SecurityRateLimitKeyResolver, m as SecurityRateLimitMemoryConfig, n as SecurityRateLimitRedisConfig, J as SecurityRateLimitRedisConnectionConfig, p as defineCorsConfig, q as defineSecurityConfig, r as holoCorsDefaults, s as holoSecurityDefaults, t as normalizeCorsConfig, u as normalizeSecurityConfig } from './config-BK6q6Yh9.js';

package/dist/config.mjs

@@ -16,7 +16,7 @@ import {
   holoSecurityDefaults,
   normalizeCorsConfig,
   normalizeSecurityConfig
-} from "./chunk-WRMZRO77.mjs";
+} from "./chunk-D3ZN5MLJ.mjs";
 export {
   DEFAULT_CORS_HEADERS,
   DEFAULT_CORS_MAX_AGE,

package/dist/contracts.d.ts

@@ -1,12 +1,20 @@
-import { HoloSecurityConfig, NormalizedHoloSecurityConfig, HoloCorsConfig, NormalizedHoloCorsConfig, SecurityRateLimitFileConfig, SecurityRateLimitMemoryConfig, SecurityRateLimitRedisConfig, SecurityLimiterConfig, SecurityRateLimitKeyResolver } from './config.js';
-export { HoloSecurityCsrfConfig, HoloSecurityRateLimitConfig, NormalizedHoloSecurityCsrfConfig, NormalizedHoloSecurityRateLimitConfig, NormalizedSecurityLimiterConfig, SecurityRateLimitContext, SecurityRateLimitDriver } from './config.js';
+import { H as HoloSecurityConfig, c as NormalizedHoloSecurityConfig, e as HoloCorsConfig, a as NormalizedHoloCorsConfig, l as SecurityRateLimitFileConfig, m as SecurityRateLimitMemoryConfig, n as SecurityRateLimitRedisConfig, d as SecurityLimiterConfig, S as SecurityRateLimitKeyResolver } from './config-BK6q6Yh9.js';
+export { f as HoloSecurityCsrfConfig, g as HoloSecurityRateLimitConfig, h as NormalizedHoloSecurityCsrfConfig, i as NormalizedHoloSecurityRateLimitConfig, b as NormalizedSecurityLimiterConfig, j as SecurityRateLimitContext, k as SecurityRateLimitDriver } from './config-BK6q6Yh9.js';
 import '@holo-js/kernel';
 
+interface SecurityCsrfSessionAccessor {
+    read(request: Request): Promise<string | undefined>;
+    write(request: Request, token: string): Promise<{
+        readonly token: string;
+        readonly cookies: readonly string[];
+    }>;
+}
 interface SecurityRuntimeBindings {
     readonly config: HoloSecurityConfig | NormalizedHoloSecurityConfig;
     readonly cors?: HoloCorsConfig | NormalizedHoloCorsConfig;
     readonly rateLimitStore?: SecurityRateLimitStore;
     readonly csrfSigningKey?: string;
+    readonly csrfSession?: SecurityCsrfSessionAccessor;
     readonly defaultKeyResolver?: SecurityDefaultRateLimitKeyResolver;
 }
 interface SecurityRuntimeFacade {
@@ -14,11 +22,13 @@ interface SecurityRuntimeFacade {
     readonly cors: NormalizedHoloCorsConfig;
     readonly rateLimitStore?: SecurityRateLimitStore;
     readonly csrfSigningKey?: string;
+    readonly csrfSession?: SecurityCsrfSessionAccessor;
     readonly defaultKeyResolver?: SecurityDefaultRateLimitKeyResolver;
 }
 interface SecurityClientConfig {
     readonly csrf: {
         readonly field: string;
+        readonly header: string;
         readonly cookie: string;
     };
 }
@@ -125,13 +135,13 @@ declare const limit: Readonly<{
     perMinute(maxAttempts: number): PendingSecurityLimiterDefinition<Readonly<Record<string, unknown>> | undefined>;
     perHour(maxAttempts: number): PendingSecurityLimiterDefinition<Readonly<Record<string, unknown>> | undefined>;
 }>;
-declare function ip(request: Request, trustedProxy?: boolean): string;
 declare function defineRateLimiter<TValues extends Readonly<Record<string, unknown>> | undefined = Readonly<Record<string, unknown>> | undefined>(definition: SecurityLimiterConfig<TValues>): SecurityLimiterConfig<TValues>;
 declare function defineSecurityRuntimeBindings(bindings: SecurityRuntimeBindings): Readonly<{
     config: NormalizedHoloSecurityConfig;
     cors: NormalizedHoloCorsConfig;
     rateLimitStore?: SecurityRateLimitStore;
     csrfSigningKey?: string;
+    csrfSession?: SecurityCsrfSessionAccessor;
     defaultKeyResolver?: SecurityDefaultRateLimitKeyResolver;
 }>;
 declare function createMemoryRateLimitStoreConfig(config?: SecurityRateLimitMemoryConfig): Readonly<SecurityRateLimitMemoryConfig>;
@@ -142,4 +152,5 @@ declare const securityInternals: {
     normalizeLimiterAttempts: typeof normalizeLimiterAttempts;
 };
 
-export { HoloCorsConfig, HoloSecurityConfig, NormalizedHoloCorsConfig, NormalizedHoloSecurityConfig, type SecurityClearRateLimitOptions, type SecurityClientConfig, type SecurityCorsFacade, SecurityCsrfError, type SecurityCsrfFacade, type SecurityCsrfField, type SecurityCsrfInput, type SecurityDefaultRateLimitKeyResolver, SecurityLimiterConfig, type SecurityProtectOptions, type SecurityRateLimitBucketSnapshot, type SecurityRateLimitCallOptions, SecurityRateLimitError, SecurityRateLimitFileConfig, type SecurityRateLimitHitResult, SecurityRateLimitKeyResolver, SecurityRateLimitMemoryConfig, SecurityRateLimitRedisConfig, type SecurityRateLimitRedisDriverAdapter, type SecurityRateLimitStore, type SecurityRateLimitStoreFactoryOptions, type SecurityRuntimeBindings, type SecurityRuntimeFacade, createFileRateLimitStoreConfig, createMemoryRateLimitStoreConfig, createRedisRateLimitStoreConfig, defineRateLimiter, defineSecurityRuntimeBindings, ip, limit, securityInternals };
+export { HoloCorsConfig, HoloSecurityConfig, NormalizedHoloCorsConfig, NormalizedHoloSecurityConfig, SecurityCsrfError, SecurityLimiterConfig, SecurityRateLimitError, SecurityRateLimitFileConfig, SecurityRateLimitKeyResolver, SecurityRateLimitMemoryConfig, SecurityRateLimitRedisConfig, createFileRateLimitStoreConfig, createMemoryRateLimitStoreConfig, createRedisRateLimitStoreConfig, defineRateLimiter, defineSecurityRuntimeBindings, limit, securityInternals };
+export type { SecurityClearRateLimitOptions, SecurityClientConfig, SecurityCorsFacade, SecurityCsrfFacade, SecurityCsrfField, SecurityCsrfInput, SecurityCsrfSessionAccessor, SecurityDefaultRateLimitKeyResolver, SecurityProtectOptions, SecurityRateLimitBucketSnapshot, SecurityRateLimitCallOptions, SecurityRateLimitHitResult, SecurityRateLimitRedisDriverAdapter, SecurityRateLimitStore, SecurityRateLimitStoreFactoryOptions, SecurityRuntimeBindings, SecurityRuntimeFacade };

package/dist/contracts.mjs

@@ -6,11 +6,10 @@ import {
   createRedisRateLimitStoreConfig,
   defineRateLimiter,
   defineSecurityRuntimeBindings,
-  ip,
   limit,
   securityInternals
-} from "./chunk-FQ4X7X6L.mjs";
-import "./chunk-WRMZRO77.mjs";
+} from "./chunk-U25HSHLJ.mjs";
+import "./chunk-D3ZN5MLJ.mjs";
 export {
   SecurityCsrfError,
   SecurityRateLimitError,
@@ -19,7 +18,6 @@ export {
   createRedisRateLimitStoreConfig,
   defineRateLimiter,
   defineSecurityRuntimeBindings,
-  ip,
   limit,
   securityInternals
 };

package/dist/drivers/redis-adapter.d.ts

@@ -2,9 +2,6 @@ import { NormalizedSecurityRateLimitRedisConfig } from '../config.js';
 import { SecurityRateLimitRedisDriverAdapter } from '../contracts.js';
 import '@holo-js/kernel';
 
-interface SecurityRedisAdapterOptions {
-    readonly now?: () => Date;
-}
 type RedisClientOptions = {
     readonly host?: string;
     readonly port?: number;
@@ -35,16 +32,14 @@ declare function resolveClusterStartupNodes(config: NormalizedSecurityRateLimitR
 declare function createRedisClusterOptions(config: NormalizedSecurityRateLimitRedisConfig): RedisClusterOptions;
 declare class RedisSecurityAdapter implements SecurityRateLimitRedisDriverAdapter {
     private readonly client;
-    private readonly now;
     private readonly prefix;
-    constructor(config: NormalizedSecurityRateLimitRedisConfig, options?: SecurityRedisAdapterOptions);
+    constructor(config: NormalizedSecurityRateLimitRedisConfig);
     private qualifyKey;
     private qualifyPattern;
     private normalizeScanResponse;
     private clearMatchingKeysForClient;
     private clearMatchingKeysForCluster;
     private clearMatchingKeys;
-    private parseOldestScore;
     private getCommandValue;
     connect(): Promise<void>;
     increment(key: string, options: {
@@ -58,7 +53,7 @@ declare class RedisSecurityAdapter implements SecurityRateLimitRedisDriverAdapte
     clearAll(): Promise<number>;
     close(): Promise<void>;
 }
-declare function createSecurityRedisAdapter(config: NormalizedSecurityRateLimitRedisConfig, options?: SecurityRedisAdapterOptions): RedisSecurityAdapter;
+declare function createSecurityRedisAdapter(config: NormalizedSecurityRateLimitRedisConfig): RedisSecurityAdapter;
 declare const securityRedisAdapterInternals: {
     REDIS_SCAN_COUNT: number;
     RedisSecurityAdapter: typeof RedisSecurityAdapter;
@@ -72,4 +67,4 @@ declare const securityRedisAdapterInternals: {
     toRedisSocketPath: typeof toRedisSocketPath;
 };
 
-export { RedisSecurityAdapter, type SecurityRedisAdapterOptions, createSecurityRedisAdapter, securityRedisAdapterInternals };
+export { RedisSecurityAdapter, createSecurityRedisAdapter, securityRedisAdapterInternals };

package/dist/drivers/redis-adapter.mjs

@@ -1,5 +1,4 @@
 // src/drivers/redis-adapter.ts
-import { randomUUID } from "crypto";
 import Redis from "ioredis";
 var REDIS_SCAN_COUNT = 100;
 function isRedisClusterClientLike(client) {
@@ -46,7 +45,7 @@ function parseClusterNodeUrl(url, label) {
       ...parsed.protocol === "rediss:" ? { tls: {} } : {}
     };
   } catch (error) {
-    throw new Error(`[@holo-js/security] ${label} is invalid: ${error instanceof Error ? error.message : String(error)}`);
+    throw new Error(`[@holo-js/security] ${label} is invalid: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
   }
 }
 function resolveClusterStartupNodes(config) {
@@ -82,11 +81,9 @@ function createRedisClusterOptions(config) {
 }
 var RedisSecurityAdapter = class {
   client;
-  now;
   prefix;
-  constructor(config, options = {}) {
+  constructor(config) {
     this.prefix = config.prefix;
-    this.now = options.now ?? (() => /* @__PURE__ */ new Date());
     const clientOptions = createRedisClientOptions(config);
     const RedisConstructor = Redis;
     this.client = typeof config.url === "string" ? new RedisConstructor(config.url, clientOptions) : config.clusters && config.clusters.length > 0 ? new RedisConstructor.Cluster(resolveClusterStartupNodes(config), createRedisClusterOptions(config)) : isRedisConnectionTarget(config.connection) ? new RedisConstructor(config.connection, clientOptions) : new RedisConstructor(clientOptions);
@@ -154,17 +151,6 @@ var RedisSecurityAdapter = class {
     }
     return await this.clearMatchingKeysForClient(this.client, pattern);
   }
-  parseOldestScore(result) {
-    if (!Array.isArray(result) || result.length < 2) {
-      throw new Error("[@holo-js/security] Redis transaction failed to return the oldest rate-limit hit.");
-    }
-    const value = result[1];
-    const score = typeof value === "number" ? value : typeof value === "string" ? Number.parseInt(value, 10) : Number.NaN;
-    if (!Number.isFinite(score)) {
-      throw new Error("[@holo-js/security] Redis transaction returned an invalid oldest-hit score.");
-    }
-    return score;
-  }
   getCommandValue(result, index, operation) {
     const entry = result[index];
     if (!entry) {
@@ -183,23 +169,21 @@ var RedisSecurityAdapter = class {
     await this.client.connect();
   }
   async increment(key, options) {
-    const now = this.now().getTime();
-    const ttlMs = options.decaySeconds * 1e3;
     const qualifiedKey = this.qualifyKey(key);
-    const member = `${now}:${randomUUID()}`;
-    const result = await this.client.multi().zadd(qualifiedKey, now, member).zremrangebyscore(qualifiedKey, "-inf", now - ttlMs).zcard(qualifiedKey).zrange(qualifiedKey, 0, 0, "WITHSCORES").exec();
+    const result = await this.client.multi().set(qualifiedKey, 0, "PX", options.decaySeconds * 1e3, "NX").incr(qualifiedKey).pttl(qualifiedKey).exec();
     if (!result) {
       throw new Error("[@holo-js/security] Redis transaction failed for increment.");
     }
-    const attemptsValue = this.getCommandValue(result, 2, "attempt count");
-    if (typeof attemptsValue !== "number") {
+    const replies = result;
+    const attempts = this.getCommandValue(replies, 1, "attempt count");
+    if (typeof attempts !== "number") {
       throw new Error("[@holo-js/security] Redis transaction returned an invalid attempt count.");
     }
-    const attempts = attemptsValue;
-    const oldestScore = this.parseOldestScore(this.getCommandValue(result, 3, "oldest rate-limit hit"));
-    await this.client.pexpireat(qualifiedKey, now + ttlMs);
-    const ttlSeconds = Math.max(0, Math.ceil((oldestScore + ttlMs - now) / 1e3));
-    return { attempts, ttlSeconds };
+    const remainingMs = this.getCommandValue(replies, 2, "window time to live");
+    if (typeof remainingMs !== "number" || remainingMs < 0) {
+      throw new Error("[@holo-js/security] Redis transaction returned an invalid window time to live.");
+    }
+    return { attempts, ttlSeconds: Math.ceil(remainingMs / 1e3) };
   }
   async del(key) {
     return this.client.del(this.qualifyKey(key));
@@ -220,8 +204,8 @@ var RedisSecurityAdapter = class {
     }
   }
 };
-function createSecurityRedisAdapter(config, options) {
-  return new RedisSecurityAdapter(config, options);
+function createSecurityRedisAdapter(config) {
+  return new RedisSecurityAdapter(config);
 }
 var securityRedisAdapterInternals = {
   REDIS_SCAN_COUNT,