@jango-blockchained/hoox-shared 1.0.9 → 1.1.0

package/dist/middleware/auth.d.ts

@@ -6,14 +6,47 @@ import type { Env } from "../types";
 import type { MiddlewareHandler } from "../types/router";
 /**
  * Constant-time string comparison to prevent timing attacks.
- * Uses crypto.timingSafeEqual for edge-native constant-time comparison.
+ *
+ * Length is NOT short-circuited: both strings are hashed to fixed-size
+ * digests via a simple XOR-fold into equal-length buffers so that
+ * unequal lengths do not leak via early return (length oracle).
+ *
+ * Note: true crypto.subtle.timingSafeEqual needs equal-length ArrayBuffers;
+ * we pad both encodings to the same max length before XOR comparison.
  */
 export declare function timingSafeEqual(a: string, b: string): boolean;
+/**
+ * Environment bindings accepted for operator Bearer auth.
+ * Prefer OPERATOR_API_KEY; INTERNAL_API_KEY remains a legacy alias.
+ */
+export interface OperatorAuthEnv {
+    OPERATOR_API_KEY?: string;
+    INTERNAL_API_KEY?: string;
+    [key: string]: unknown;
+}
+/**
+ * Resolve the operator API secret from Worker env.
+ * Order: OPERATOR_API_KEY → INTERNAL_API_KEY (legacy).
+ */
+export declare function resolveOperatorApiKey(env: OperatorAuthEnv | Env): string | undefined;
 /**
  * Require Bearer token authentication via Authorization header.
- * Use for external API endpoints that need token-based auth.
+ * Use for external operator / management API endpoints.
+ *
+ * Secret resolution: `OPERATOR_API_KEY` (preferred) or `INTERNAL_API_KEY` (legacy).
+ * Client should send the same value as `HOOX_API_TOKEN`.
+ */
+export declare function requireAuth(request: Request, env: Env | OperatorAuthEnv): Promise<Response | null>;
+/**
+ * Explicit operator-plane auth (alias of requireAuth with clearer naming).
+ * Fail-closed when no operator key is configured.
+ */
+export declare function requireOperatorAuth(request: Request, env: OperatorAuthEnv | Env): Promise<Response | null>;
+/**
+ * Router middleware that enforces operator Bearer auth.
+ * Usage: router.get("/v1/workers", handler, [createOperatorAuthMiddleware()])
  */
-export declare function requireAuth(request: Request, env: Env): Promise<Response | null>;
+export declare function createOperatorAuthMiddleware(): MiddlewareHandler<OperatorAuthEnv>;
 /**
  * Environment with an internal auth key binding.
  * Workers that accept internal service-to-service requests should extend this.
@@ -24,6 +57,9 @@ export declare function requireAuth(request: Request, env: Env): Promise<Respons
 export interface InternalAuthEnv {
     [key: string]: unknown;
 }
+export type InternalAuthKeyName = string | readonly string[];
+/** Collect configured secrets for one or more env binding names (first wins for callers). */
+export declare function collectInternalAuthKeys(env: InternalAuthEnv, keyNames: InternalAuthKeyName): string[];
 /**
  * Require internal service-to-service authentication via X-Internal-Auth-Key header.
  * Use for endpoints called by other workers via Service Bindings.
@@ -36,7 +72,7 @@ export interface InternalAuthEnv {
  * @param keyName - The env binding name for the internal key (default: 'INTERNAL_KEY_BINDING')
  * @returns Response if unauthorized, null if authorized
  */
-export declare function requireInternalAuth(request: Request, env: InternalAuthEnv, keyName?: string): Response | null;
+export declare function requireInternalAuth(request: Request, env: InternalAuthEnv, keyName?: InternalAuthKeyName): Response | null;
 /**
  * Create a middleware function for the router that enforces internal auth.
  * Returns a Response (401) when unauthorized, or void when authorized.
@@ -45,7 +81,7 @@ export declare function requireInternalAuth(request: Request, env: InternalAuthE
  *
  * @param keyName - The env binding name for the internal key (default: 'INTERNAL_KEY_BINDING')
  */
-export declare function createInternalAuthMiddleware(keyName?: string): MiddlewareHandler<any>;
+export declare function createInternalAuthMiddleware(keyName?: InternalAuthKeyName): MiddlewareHandler<InternalAuthEnv>;
 /**
  * Check internal auth and return a result object (non-throwing pattern).
  * Useful when you need to check auth without immediately returning a response.
@@ -55,7 +91,7 @@ export declare function createInternalAuthMiddleware(keyName?: string): Middlewa
  * @param keyName - The env binding name for the internal key (default: 'INTERNAL_KEY_BINDING')
  * @returns Object with authorized flag and optional error message
  */
-export declare function checkInternalAuth(request: Request, env: InternalAuthEnv, keyName?: string): {
+export declare function checkInternalAuth(request: Request, env: InternalAuthEnv, keyName?: InternalAuthKeyName): {
     authorized: boolean;
     error?: string;
 };

package/dist/middleware/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAa7D;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAkB1B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,eAAe,EACpB,OAAO,GAAE,MAA+B,GACvC,QAAQ,GAAG,IAAI,CAqBjB;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,GAAE,MAA+B,GACvC,iBAAiB,CAAC,GAAG,CAAC,CA0BxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,eAAe,EACpB,OAAO,GAAE,MAA+B,GACvC;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAYzC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAe7D;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,eAAe,GAAG,GAAG,GACzB,MAAM,GAAG,SAAS,CAUpB;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,GAAG,eAAe,GACzB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAE1B;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,eAAe,GAAG,GAAG,GACzB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAqB1B;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,IAAI,iBAAiB,CAAC,eAAe,CAAC,CAUjF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;AAS7D,6FAA6F;AAC7F,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,eAAe,EACpB,QAAQ,EAAE,mBAAmB,GAC5B,MAAM,EAAE,CASV;AA2BD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,eAAe,EACpB,OAAO,GAAE,mBAA4C,GACpD,QAAQ,GAAG,IAAI,CAcjB;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,GAAE,mBAA4C,GACpD,iBAAiB,CAAC,eAAe,CAAC,CAoBpC;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,eAAe,EACpB,OAAO,GAAE,mBAA4C,GACpD;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAezC"}

package/dist/middleware/auth.js

@@ -0,0 +1,151 @@
+// @bun
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+
+// src/middleware/auth.ts
+function timingSafeEqual(a, b) {
+  const encoder = new TextEncoder;
+  const aBuf = encoder.encode(a);
+  const bBuf = encoder.encode(b);
+  const len = Math.max(aBuf.length, bBuf.length);
+  let result = aBuf.length === bBuf.length ? 0 : 1;
+  for (let i = 0;i < len; i++) {
+    const av = i < aBuf.length ? aBuf[i] : 0;
+    const bv = i < bBuf.length ? bBuf[i] : 0;
+    result |= av ^ bv;
+  }
+  return result === 0;
+}
+function resolveOperatorApiKey(env) {
+  const preferred = env.OPERATOR_API_KEY;
+  if (typeof preferred === "string" && preferred.length > 0) {
+    return preferred;
+  }
+  const legacy = env.INTERNAL_API_KEY;
+  if (typeof legacy === "string" && legacy.length > 0) {
+    return legacy;
+  }
+  return;
+}
+async function requireAuth(request, env) {
+  return requireOperatorAuth(request, env);
+}
+async function requireOperatorAuth(request, env) {
+  const apiKey = resolveOperatorApiKey(env);
+  if (!apiKey) {
+    return new Response(JSON.stringify({
+      error: "Operator API key not configured",
+      hint: "Set OPERATOR_API_KEY (preferred) or INTERNAL_API_KEY on the Worker"
+    }), { status: 401, headers: { "Content-Type": "application/json" } });
+  }
+  const authHeader = request.headers.get("Authorization");
+  const expectedHeader = `Bearer ${apiKey}`;
+  if (!authHeader || !timingSafeEqual(authHeader, expectedHeader)) {
+    return new Response(JSON.stringify({ error: "Unauthorized" }), {
+      status: 401,
+      headers: { "Content-Type": "application/json" }
+    });
+  }
+  return null;
+}
+function createOperatorAuthMiddleware() {
+  return async (request, env, _ctx) => {
+    const denied = await requireOperatorAuth(request, env);
+    if (denied)
+      return denied;
+    return;
+  };
+}
+function normalizeKeyNames(keyName) {
+  if (typeof keyName === "string") {
+    return [keyName];
+  }
+  return [...keyName];
+}
+function collectInternalAuthKeys(env, keyNames) {
+  const keys = [];
+  for (const name of normalizeKeyNames(keyNames)) {
+    const value = env[name];
+    if (typeof value === "string" && value.length > 0) {
+      keys.push(value);
+    }
+  }
+  return keys;
+}
+function matchesAnyInternalAuthKey(providedKey, expectedKeys) {
+  for (const expected of expectedKeys) {
+    if (timingSafeEqual(providedKey, expected)) {
+      return true;
+    }
+  }
+  return false;
+}
+function internalAuthNotConfiguredResponse(keyNames) {
+  const label = normalizeKeyNames(keyNames).join(" | ");
+  return new Response(JSON.stringify({
+    success: false,
+    error: `Internal auth key(s) not configured: ${label}`
+  }), { status: 401, headers: { "Content-Type": "application/json" } });
+}
+function requireInternalAuth(request, env, keyName = "INTERNAL_KEY_BINDING") {
+  const expectedKeys = collectInternalAuthKeys(env, keyName);
+  if (expectedKeys.length === 0) {
+    return internalAuthNotConfiguredResponse(keyName);
+  }
+  const providedKey = request.headers.get("X-Internal-Auth-Key");
+  if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+    return new Response(JSON.stringify({ success: false, error: "Unauthorized" }), { status: 401, headers: { "Content-Type": "application/json" } });
+  }
+  return null;
+}
+function createInternalAuthMiddleware(keyName = "INTERNAL_KEY_BINDING") {
+  return async (request, env, _ctx) => {
+    const expectedKeys = collectInternalAuthKeys(env, keyName);
+    if (expectedKeys.length === 0) {
+      return internalAuthNotConfiguredResponse(keyName);
+    }
+    const providedKey = request.headers.get("X-Internal-Auth-Key");
+    if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+      return new Response(JSON.stringify({ success: false, error: "Unauthorized" }), { status: 401, headers: { "Content-Type": "application/json" } });
+    }
+    return;
+  };
+}
+function checkInternalAuth(request, env, keyName = "INTERNAL_KEY_BINDING") {
+  const expectedKeys = collectInternalAuthKeys(env, keyName);
+  if (expectedKeys.length === 0) {
+    return {
+      authorized: false,
+      error: `${normalizeKeyNames(keyName).join(" | ")} not configured`
+    };
+  }
+  const providedKey = request.headers.get("X-Internal-Auth-Key");
+  if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+    return { authorized: false, error: "Unauthorized" };
+  }
+  return { authorized: true };
+}
+export {
+  timingSafeEqual,
+  resolveOperatorApiKey,
+  requireOperatorAuth,
+  requireInternalAuth,
+  requireAuth,
+  createOperatorAuthMiddleware,
+  createInternalAuthMiddleware,
+  collectInternalAuthKeys,
+  checkInternalAuth
+};

package/dist/middleware/cors.d.ts

@@ -2,14 +2,24 @@
  * CORS middleware for Cloudflare Workers
  * Provides standardized CORS headers and preflight handling
  *
+ * Security default: NO open origin (*). Internal service-binding workers
+ * should not advertise browser CORS at all. Public endpoints must pass
+ * an explicit allowOrigin (or use publicCorsHeaders()).
+ *
  * @available — Available for consumer use. Import from "@jango-blockchained/hoox-shared/middleware".
  */
+export interface CorsEnv {
+    CORS_ALLOW_ORIGIN?: string;
+}
 export interface CorsOptions {
-    /** Allowed origins (default: "*") */
+    /**
+     * Allowed origins. Empty / omitted = no Access-Control-Allow-Origin header
+     * (fail-closed). Never defaults to "*".
+     */
     allowOrigin?: string;
     /** Allowed methods (default: "GET, POST, OPTIONS, PUT, DELETE") */
     allowMethods?: string;
-    /** Allowed headers (default: "Content-Type, Authorization, X-Request-ID, X-Internal-Auth-Key") */
+    /** Allowed headers (default: "Content-Type, Authorization, X-Request-ID") */
     allowHeaders?: string;
     /** Whether to include credentials (default: false) */
     allowCredentials?: boolean;
@@ -18,8 +28,24 @@ export interface CorsOptions {
 }
 /**
  * Create CORS headers object for use in responses.
+ * Omits Access-Control-Allow-Origin when allowOrigin is empty.
  */
 export declare function corsHeaders(options?: CorsOptions): Record<string, string>;
+/**
+ * CORS headers for truly public browser-facing APIs.
+ * Prefer a concrete origin over "*" whenever possible.
+ */
+export declare function publicCorsHeaders(origin?: string, options?: Omit<CorsOptions, "allowOrigin">): Record<string, string>;
+/**
+ * CORS headers for internal workers (service bindings only).
+ * Returns an empty object — no browser CORS surface.
+ */
+export declare function internalCorsHeaders(): Record<string, string>;
+/**
+ * Resolve CORS from env + request for dashboard-facing workers.
+ * Set CORS_ALLOW_ORIGIN to a comma-separated browser origin allowlist.
+ */
+export declare function resolveCorsOptions(request: Request, env?: unknown): CorsOptions;
 /**
  * Handle CORS preflight (OPTIONS) requests.
  * Returns a Response for OPTIONS, or null for non-OPTIONS requests.

package/dist/middleware/cors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../src/middleware/cors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,WAAW;IAC1B,qCAAqC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kGAAkG;IAClG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sDAAsD;IACtD,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAWD;;GAEG;AACH,wBAAgB,WAAW,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYzE;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,WAAW,GACpB,QAAQ,GAAG,IAAI,CAOjB"}
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../src/middleware/cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,WAAW,OAAO;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sDAAsD;IACtD,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAcD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAczE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,GAAE,MAAY,EACpB,OAAO,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,GACzC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAExB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE5D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,OAAO,EAGhB,GAAG,CAAC,EAAE,OAAO,GACZ,WAAW,CA4Bb;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,WAAW,GACpB,QAAQ,GAAG,IAAI,CAOjB"}

package/dist/middleware/cors.js

@@ -0,0 +1,77 @@
+// @bun
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+
+// src/middleware/cors.ts
+var DEFAULT_OPTIONS = {
+  allowOrigin: "",
+  allowMethods: "GET, POST, OPTIONS, PUT, DELETE",
+  allowHeaders: "Content-Type, Authorization, X-Request-ID",
+  allowCredentials: false,
+  maxAge: 86400
+};
+function corsHeaders(options) {
+  const opts = { ...DEFAULT_OPTIONS, ...options };
+  const headers = {
+    "Access-Control-Allow-Methods": opts.allowMethods,
+    "Access-Control-Allow-Headers": opts.allowHeaders,
+    "Access-Control-Max-Age": String(opts.maxAge)
+  };
+  if (opts.allowOrigin) {
+    headers["Access-Control-Allow-Origin"] = opts.allowOrigin;
+  }
+  if (opts.allowCredentials) {
+    headers["Access-Control-Allow-Credentials"] = "true";
+  }
+  return headers;
+}
+function publicCorsHeaders(origin = "*", options) {
+  return corsHeaders({ ...options, allowOrigin: origin });
+}
+function internalCorsHeaders() {
+  return {};
+}
+function resolveCorsOptions(request, env) {
+  const raw = env && typeof env === "object" && "CORS_ALLOW_ORIGIN" in env && typeof env.CORS_ALLOW_ORIGIN === "string" ? env.CORS_ALLOW_ORIGIN : undefined;
+  const configured = raw?.trim();
+  if (!configured) {
+    return {};
+  }
+  const allowed = configured.split(",").map((entry) => entry.trim()).filter(Boolean);
+  const origin = request.headers.get("Origin");
+  if (origin && allowed.includes(origin)) {
+    return { allowOrigin: origin, allowCredentials: true };
+  }
+  if (!origin && allowed.length === 1) {
+    return { allowOrigin: allowed[0] };
+  }
+  return {};
+}
+function handleCorsPreflightRequest(request, options) {
+  if (request.method !== "OPTIONS")
+    return null;
+  return new Response(null, {
+    status: 204,
+    headers: corsHeaders(options)
+  });
+}
+export {
+  resolveCorsOptions,
+  publicCorsHeaders,
+  internalCorsHeaders,
+  handleCorsPreflightRequest,
+  corsHeaders
+};

package/dist/middleware/index.d.ts

@@ -2,9 +2,9 @@
  * Barrel exports for shared middleware
  */
 export { createLogger, withRequestLog, type Logger, type LogContext, } from "./logger";
-export { requireAuth, requireInternalAuth, createInternalAuthMiddleware, checkInternalAuth, timingSafeEqual, type InternalAuthEnv, } from "./auth";
+export { requireAuth, requireOperatorAuth, createOperatorAuthMiddleware, resolveOperatorApiKey, requireInternalAuth, createInternalAuthMiddleware, checkInternalAuth, timingSafeEqual, collectInternalAuthKeys, type InternalAuthEnv, type InternalAuthKeyName, type OperatorAuthEnv, } from "./auth";
 export { createRateLimiter, type RateLimiter, type RateLimitConfig, } from "./rate-limit";
 export { validateJson, validateJsonLegacy, requireField, optionalField, } from "./validate";
-export { corsHeaders, handleCorsPreflightRequest, type CorsOptions, } from "./cors";
+export { corsHeaders, resolveCorsOptions, type CorsEnv, publicCorsHeaders, internalCorsHeaders, handleCorsPreflightRequest, type CorsOptions, } from "./cors";
 export { secureHeaders, wrapWithSecurityHeaders, type SecurityHeadersOptions, SECURITY_HEADERS_DEFAULTS, } from "./security-headers";
 //# sourceMappingURL=index.d.ts.map

package/dist/middleware/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,YAAY,EACZ,cAAc,EACd,KAAK,MAAM,EACX,KAAK,UAAU,GAChB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EACf,KAAK,eAAe,GACrB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACL,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,eAAe,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,WAAW,EACX,0BAA0B,EAC1B,KAAK,WAAW,GACjB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,KAAK,sBAAsB,EAC3B,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,YAAY,EACZ,cAAc,EACd,KAAK,MAAM,EACX,KAAK,UAAU,GAChB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,EACnB,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,eAAe,GACrB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACL,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,eAAe,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,KAAK,OAAO,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,EAC1B,KAAK,WAAW,GACjB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,KAAK,sBAAsB,EAC3B,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC"}