@kabyeon/nexusjs 0.6.5

package/dist/shield/index.js

@@ -0,0 +1,728 @@
+// @bun
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toCommonJS = (from) => {
+  var entry = (__moduleCache ??= new WeakMap).get(from), desc;
+  if (entry)
+    return entry;
+  entry = __defProp({}, "__esModule", { value: true });
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (var key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(entry, key))
+        __defProp(entry, key, {
+          get: __accessProp.bind(from, key),
+          enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+        });
+  }
+  __moduleCache.set(from, entry);
+  return entry;
+};
+var __moduleCache;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __legacyDecorateClassTS = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
+    r = Reflect.decorate(decorators, target, key, desc);
+  else
+    for (var i = decorators.length - 1;i >= 0; i--)
+      if (d = decorators[i])
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __legacyDecorateParamTS = (index, decorator) => (target, key) => decorator(target, key, index);
+var __legacyMetadataTS = (k, v) => {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function")
+    return Reflect.metadata(k, v);
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __require = import.meta.require;
+
+// src/core/constants.ts
+var METADATA_KEY, PARAM_TYPES, HTTP_METHODS;
+var init_constants = __esm(() => {
+  METADATA_KEY = {
+    CONTROLLER: "nexus:controller",
+    INJECTABLE: "nexus:injectable",
+    REPOSITORY: "nexus:repository",
+    MODULE: "nexus:module",
+    ROUTES: "nexus:routes",
+    PARAMS: "nexus:params",
+    VALIDATE: "nexus:validate",
+    PARAMTYPES: "design:paramtypes",
+    TYPE: "design:type",
+    RETURNTYPE: "design:returntype",
+    INJECT: "nexus:inject"
+  };
+  PARAM_TYPES = {
+    REQUEST: 0,
+    RESPONSE: 1,
+    NEXT: 2,
+    BODY: 3,
+    QUERY: 4,
+    PARAM: 5,
+    HEADERS: 6,
+    CTX: 7,
+    USER: 8
+  };
+  HTTP_METHODS = [
+    "GET",
+    "POST",
+    "PUT",
+    "DELETE",
+    "PATCH",
+    "OPTIONS",
+    "HEAD"
+  ];
+});
+
+// src/core/decorators/controller.ts
+import"reflect-metadata";
+function Controller(prefix = "/") {
+  return (target) => {
+    const normalized = normalizePrefix(prefix);
+    const meta = { prefix: normalized };
+    Reflect.defineMetadata(METADATA_KEY.CONTROLLER, meta, target);
+  };
+}
+function getControllerMetadata(target) {
+  return Reflect.getMetadata(METADATA_KEY.CONTROLLER, target) ?? { prefix: "/" };
+}
+function isController(target) {
+  return Reflect.hasMetadata(METADATA_KEY.CONTROLLER, target);
+}
+function normalizePrefix(prefix) {
+  if (!prefix)
+    return "";
+  if (prefix !== "/" && prefix.endsWith("/")) {
+    return prefix.slice(0, -1);
+  }
+  return prefix;
+}
+var init_controller = __esm(() => {
+  init_constants();
+});
+
+// src/core/decorators/http-methods.ts
+import"reflect-metadata";
+function defineRoute(method, path) {
+  return (target, propertyKey, descriptor) => {
+    const routes = Reflect.getMetadata(METADATA_KEY.ROUTES, target.constructor) ?? [];
+    routes.push({
+      method,
+      path: normalizePath(path),
+      propertyKey,
+      handler: descriptor.value
+    });
+    Reflect.defineMetadata(METADATA_KEY.ROUTES, routes, target.constructor);
+  };
+}
+function normalizePath(path) {
+  if (!path || path === "/")
+    return "/";
+  return path.startsWith("/") ? path : `/${path}`;
+}
+function getRoutes(target) {
+  return Reflect.getMetadata(METADATA_KEY.ROUTES, target) ?? [];
+}
+var Get = (path = "/") => defineRoute("GET", path), Post = (path = "/") => defineRoute("POST", path), Put = (path = "/") => defineRoute("PUT", path), Delete = (path = "/") => defineRoute("DELETE", path), Patch = (path = "/") => defineRoute("PATCH", path), Options = (path = "/") => defineRoute("OPTIONS", path), Head = (path = "/") => defineRoute("HEAD", path);
+var init_http_methods = __esm(() => {
+  init_constants();
+});
+
+// src/core/decorators/params.ts
+import"reflect-metadata";
+function createParamDecorator(type, data) {
+  return (target, propertyKey, parameterIndex) => {
+    if (propertyKey !== undefined) {
+      const params = Reflect.getMetadata(METADATA_KEY.PARAMS, target, propertyKey) ?? [];
+      params.push({
+        index: parameterIndex,
+        type,
+        name: typeof data === "string" ? data : undefined,
+        data: typeof data === "object" ? data : undefined
+      });
+      Reflect.defineMetadata(METADATA_KEY.PARAMS, params, target, propertyKey);
+    } else {
+      const params = Reflect.getMetadata(METADATA_KEY.PARAMS, target) ?? [];
+      params.push({
+        index: parameterIndex,
+        type,
+        name: typeof data === "string" ? data : undefined,
+        data: typeof data === "object" ? data : undefined
+      });
+      Reflect.defineMetadata(METADATA_KEY.PARAMS, params, target);
+    }
+  };
+}
+function getParamMetadata(target, propertyKey) {
+  return Reflect.getMetadata(METADATA_KEY.PARAMS, target, propertyKey) ?? [];
+}
+var Req = () => createParamDecorator(PARAM_TYPES.REQUEST), Res = () => createParamDecorator(PARAM_TYPES.RESPONSE), Next = () => createParamDecorator(PARAM_TYPES.NEXT), Body = (key) => createParamDecorator(PARAM_TYPES.BODY, key), Query = (key) => createParamDecorator(PARAM_TYPES.QUERY, key), Param = (key) => createParamDecorator(PARAM_TYPES.PARAM, key), Headers = (key) => createParamDecorator(PARAM_TYPES.HEADERS, key), Ctx = () => createParamDecorator(PARAM_TYPES.CTX), User = () => createParamDecorator(PARAM_TYPES.USER);
+var init_params = __esm(() => {
+  init_constants();
+});
+
+// src/core/decorators/validate.ts
+import"reflect-metadata";
+function Validate(options) {
+  return (target, propertyKey, descriptor) => {
+    Reflect.defineMetadata(METADATA_KEY.VALIDATE, options, target.constructor, propertyKey);
+  };
+}
+function getValidationMetadata(target, propertyKey) {
+  return Reflect.getMetadata(METADATA_KEY.VALIDATE, target, propertyKey);
+}
+var init_validate = __esm(() => {
+  init_constants();
+});
+
+// src/shield/types.ts
+import"reflect-metadata";
+import { randomBytes as randomBytes2 } from "crypto";
+
+// src/crypto/encryption.ts
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHmac,
+  hkdfSync,
+  randomBytes,
+  timingSafeEqual
+} from "crypto";
+var VERSION = "v1";
+var IV_BYTES = 12;
+var TAG_BYTES = 16;
+
+class EncryptionService {
+  aesKey;
+  hmacKey;
+  constructor(masterKey) {
+    const derived = deriveKeys(masterKey);
+    this.aesKey = derived.aes;
+    this.hmacKey = derived.hmac;
+  }
+  encrypt(value, options = {}) {
+    const iv = randomBytes(IV_BYTES);
+    const cipher = createCipheriv("aes-256-gcm", this.aesKey, iv);
+    const plaintext = Buffer.from(value, "utf8");
+    const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    const expiry = encodeExpiry(options.expiresAt);
+    const purposeBuf = Buffer.from(options.purpose ?? "", "utf8");
+    const mac = this.macOver([VERSION, iv, tag, ciphertext, expiry, purposeBuf]);
+    return [
+      VERSION,
+      b64(iv),
+      b64(tag),
+      b64(ciphertext),
+      b64(expiry),
+      b64(purposeBuf),
+      b64(mac)
+    ].join(".");
+  }
+  decrypt(payload) {
+    const parsed = parseV1(payload);
+    if (!parsed)
+      throw new Error("Encrypted payload is malformed");
+    const expectedMac = this.macOver([
+      VERSION,
+      parsed.iv,
+      parsed.tag,
+      parsed.ciphertext,
+      parsed.expiry,
+      parsed.purpose
+    ]);
+    if (!constantTimeEqual(expectedMac, parsed.mac)) {
+      throw new Error("Encrypted payload failed integrity check");
+    }
+    if (parsed.expiry.length > 0) {
+      const expiryMs = parseExpiry(parsed.expiry.toString("utf8"));
+      if (expiryMs > 0 && Date.now() > expiryMs) {
+        throw new Error("Encrypted payload has expired");
+      }
+    }
+    const decipher = createDecipheriv("aes-256-gcm", this.aesKey, parsed.iv);
+    decipher.setAuthTag(parsed.tag);
+    const plaintext = Buffer.concat([
+      decipher.update(parsed.ciphertext),
+      decipher.final()
+    ]);
+    return plaintext.toString("utf8");
+  }
+  isEncrypted(value) {
+    if (typeof value !== "string")
+      return false;
+    return value.startsWith(VERSION + ".");
+  }
+  sign(value, purpose = "") {
+    const mac = createHmac("sha256", this.hmacKey).update(purpose).update("|").update(value).digest();
+    return `${b64(Buffer.from(value, "utf8"))}.${b64(mac)}`;
+  }
+  signRaw(value, purpose = "") {
+    const mac = createHmac("sha256", this.hmacKey).update(purpose).update("|").update(value).digest();
+    return b64(mac);
+  }
+  verifyRaw(value, signature, purpose = "") {
+    const expected = createHmac("sha256", this.hmacKey).update(purpose).update("|").update(value).digest();
+    const given = fromB64(signature);
+    if (!given)
+      return false;
+    return constantTimeEqual(given, expected);
+  }
+  unsign(signed, purpose = "") {
+    const dot = signed.lastIndexOf(".");
+    if (dot < 1 || dot === signed.length - 1)
+      return null;
+    const valueB64 = signed.slice(0, dot);
+    const macB64 = signed.slice(dot + 1);
+    const value = fromB64(valueB64);
+    const mac = fromB64(macB64);
+    if (!value || !mac)
+      return null;
+    const expected = createHmac("sha256", this.hmacKey).update(purpose).update("|").update(value).digest();
+    if (!constantTimeEqual(mac, expected))
+      return null;
+    return value.toString("utf8");
+  }
+  macOver(parts) {
+    const h = createHmac("sha256", this.hmacKey);
+    for (const p of parts) {
+      h.update("|");
+      h.update(p);
+    }
+    return h.digest();
+  }
+}
+function b64(buf) {
+  return buf.toString("base64url");
+}
+function fromB64(s) {
+  try {
+    return Buffer.from(s, "base64url");
+  } catch {
+    return null;
+  }
+}
+function constantTimeEqual(a, b) {
+  if (a.length !== b.length)
+    return false;
+  return timingSafeEqual(a, b);
+}
+function encodeExpiry(expiresAt) {
+  if (expiresAt === undefined)
+    return Buffer.alloc(0);
+  let ms;
+  if (typeof expiresAt === "number") {
+    ms = expiresAt > 1000000000000 ? expiresAt : Date.now() + expiresAt * 1000;
+  } else if (typeof expiresAt === "string") {
+    const asNum = Number(expiresAt);
+    if (!isNaN(asNum) && asNum > 0) {
+      ms = asNum > 1000000000000 ? asNum : Date.now() + asNum * 1000;
+    } else {
+      ms = Date.parse(expiresAt);
+    }
+  } else {
+    ms = expiresAt.getTime();
+  }
+  if (!isFinite(ms))
+    return Buffer.alloc(0);
+  return Buffer.from(String(ms), "utf8");
+}
+function parseExpiry(s) {
+  const n = Number(s);
+  return isFinite(n) ? n : 0;
+}
+function parseV1(s) {
+  if (typeof s !== "string" || !s.startsWith(VERSION + "."))
+    return null;
+  const parts = s.split(".");
+  if (parts.length !== 7)
+    return null;
+  const [, ivB64, tagB64, ctB64, expB64, purposeB64, macB64] = parts;
+  const iv = fromB64(ivB64);
+  const tag = fromB64(tagB64);
+  const ct = fromB64(ctB64);
+  const exp = fromB64(expB64);
+  const purpose = fromB64(purposeB64);
+  const mac = fromB64(macB64);
+  if (!iv || !tag || !ct || !exp || !purpose || !mac)
+    return null;
+  if (iv.length !== IV_BYTES)
+    return null;
+  if (tag.length !== TAG_BYTES)
+    return null;
+  return { iv, tag, ciphertext: ct, expiry: exp, purpose, mac };
+}
+function deriveKeys(masterKey) {
+  let input;
+  try {
+    const decoded = Buffer.from(masterKey, "base64");
+    if (decoded.length >= 32 && masterKey.length % 4 === 0) {
+      input = decoded;
+    } else {
+      input = Buffer.from(masterKey, "utf8");
+    }
+  } catch {
+    input = Buffer.from(masterKey, "utf8");
+  }
+  const ikm = input.length < 32 ? padKey(input) : input;
+  const out = hkdfSync("sha256", ikm, Buffer.alloc(0), "nexus:crypto:v1", 64);
+  const outBuf = Buffer.from(out);
+  return {
+    aes: Buffer.from(outBuf.subarray(0, 32)),
+    hmac: Buffer.from(outBuf.subarray(32, 64))
+  };
+}
+function padKey(input) {
+  const hash = createHmac("sha256", "nexus:crypto:pad").update(input).digest();
+  const out = Buffer.alloc(32);
+  input.copy(out, 0, 0, Math.min(input.length, 32));
+  hash.copy(out, input.length < 32 ? input.length : 0, 0, 32 - Math.min(input.length, 32));
+  return out;
+}
+
+// src/shield/types.ts
+function randomToken(bytes = 24) {
+  return randomBytes2(bytes).toString("base64url");
+}
+function sign(value, secret) {
+  const sig = new EncryptionService(secret).signRaw(value, "csrf");
+  return `${value}.${sig}`;
+}
+function verify(signed, secret) {
+  const lastDot = signed.lastIndexOf(".");
+  if (lastDot < 1)
+    return null;
+  const value = signed.slice(0, lastDot);
+  const sig = signed.slice(lastDot + 1);
+  if (!new EncryptionService(secret).verifyRaw(value, sig, "csrf"))
+    return null;
+  return value;
+}
+var ShieldInternals = {
+  sign,
+  verify,
+  randomToken
+};
+// src/shield/guards/csrf.ts
+class CsrfGuard {
+  config;
+  secret;
+  constructor(config, secret) {
+    this.config = {
+      enabled: config.enabled,
+      cookieName: config.cookieName ?? "nexus-csrf",
+      headerName: config.headerName ?? "x-csrf-token",
+      fieldName: config.fieldName ?? "_csrf",
+      protectGet: config.protectGet ?? false,
+      cookie: {
+        sameSite: config.cookie?.sameSite ?? "Lax",
+        secure: config.cookie?.secure ?? true,
+        httpOnly: config.cookie?.httpOnly ?? false,
+        path: config.cookie?.path ?? "/"
+      },
+      ignoreMethods: config.ignoreMethods ?? ["GET", "HEAD", "OPTIONS"]
+    };
+    this.secret = secret;
+  }
+  issue(res) {
+    const raw = ShieldInternals.randomToken();
+    const signed = ShieldInternals.sign(raw, this.secret);
+    const cookieParts = [
+      `${this.config.cookieName}=${raw}`,
+      `Path=${this.config.cookie.path}`,
+      `SameSite=${this.config.cookie.sameSite}`
+    ];
+    if (this.config.cookie.secure)
+      cookieParts.push("Secure");
+    if (this.config.cookie.httpOnly)
+      cookieParts.push("HttpOnly");
+    res.append("Set-Cookie", cookieParts.join("; "));
+    return {
+      token: signed,
+      html: `<meta name="csrf-token" content="${signed}">`
+    };
+  }
+  verify(req) {
+    const method = req.method.toUpperCase();
+    if (this.config.ignoreMethods.map((m) => m.toUpperCase()).includes(method)) {
+      return true;
+    }
+    if (this.config.protectGet) {}
+    const cookieHeader = req.headers.get("cookie") ?? "";
+    const cookieToken = this.extractCookie(cookieHeader, this.config.cookieName);
+    if (!cookieToken)
+      return false;
+    const headerToken = req.headers.get(this.config.headerName);
+    if (headerToken && ShieldInternals.verify(headerToken, this.secret) === cookieToken) {
+      return true;
+    }
+    const fieldToken = req.headers.get("x-csrf-field");
+    if (fieldToken && ShieldInternals.verify(fieldToken, this.secret) === cookieToken) {
+      return true;
+    }
+    return false;
+  }
+  middleware() {
+    return async (c, next) => {
+      const method = c.req.method.toUpperCase();
+      if (this.config.ignoreMethods.map((m) => m.toUpperCase()).includes(method)) {
+        const cookieHeader = c.req.header("cookie") ?? "";
+        if (!this.extractCookie(cookieHeader, this.config.cookieName)) {
+          this.issue(c.res.headers);
+        }
+        return next();
+      }
+      if (!this.verify(c.req.raw)) {
+        return c.text("Invalid CSRF token", 403);
+      }
+      return next();
+    };
+  }
+  extractCookie(cookieHeader, name) {
+    for (const part of cookieHeader.split(";")) {
+      const [k, ...rest] = part.trim().split("=");
+      if (k === name)
+        return rest.join("=");
+    }
+    return null;
+  }
+}
+// src/shield/guards/headers.ts
+class HeadersGuard {
+  hsts;
+  csp;
+  xFrameOptions;
+  xContentTypeOptions;
+  referrerPolicy;
+  constructor(hsts, csp, xFrameOptions, xContentTypeOptions, referrerPolicy) {
+    this.hsts = hsts;
+    this.csp = csp;
+    this.xFrameOptions = xFrameOptions;
+    this.xContentTypeOptions = xContentTypeOptions;
+    this.referrerPolicy = referrerPolicy;
+  }
+  apply(headers) {
+    if (this.hsts) {
+      const h = this.buildHstsHeader(this.hsts);
+      if (h)
+        headers.set("Strict-Transport-Security", h);
+    }
+    if (this.csp) {
+      const header = this.buildCspHeader(this.csp);
+      const name = this.csp.reportOnly ? "Content-Security-Policy-Report-Only" : "Content-Security-Policy";
+      headers.set(name, header);
+    }
+    if (this.xFrameOptions) {
+      headers.set("X-Frame-Options", this.xFrameOptions);
+    }
+    if (this.xContentTypeOptions) {
+      headers.set("X-Content-Type-Options", "nosniff");
+    }
+    if (this.referrerPolicy) {
+      headers.set("Referrer-Policy", this.referrerPolicy);
+    }
+  }
+  middleware() {
+    return async (_c, next) => {
+      this.apply(_c.res.headers);
+      return next();
+    };
+  }
+  buildHstsHeader(cfg) {
+    let v = `max-age=${cfg.maxAge}`;
+    if (cfg.includeSubDomains)
+      v += "; includeSubDomains";
+    if (cfg.preload)
+      v += "; preload";
+    return v;
+  }
+  buildCspHeader(cfg) {
+    const parts = [];
+    for (const [name, values] of Object.entries(cfg.directives)) {
+      if (!values || values.length === 0)
+        continue;
+      parts.push(`${camelToKebab(name)} ${values.join(" ")}`);
+    }
+    if (cfg.reportUri)
+      parts.push(`report-uri ${cfg.reportUri}`);
+    return parts.join("; ");
+  }
+}
+function camelToKebab(s) {
+  return s.replace(/[A-Z]/g, (m) => `-${m.toLowerCase()}`);
+}
+// src/core/decorators/module.ts
+init_constants();
+import"reflect-metadata";
+function Module(options = {}) {
+  return (target) => {
+    Reflect.defineMetadata(METADATA_KEY.MODULE, options, target);
+  };
+}
+function getModuleOptions(target) {
+  return Reflect.getMetadata(METADATA_KEY.MODULE, target) ?? {};
+}
+
+// src/core/decorators/index.ts
+init_controller();
+
+// src/core/decorators/injectable.ts
+init_constants();
+import"reflect-metadata";
+function Injectable(options = {}) {
+  return (target) => {
+    Reflect.defineMetadata(METADATA_KEY.INJECTABLE, true, target);
+    if (options.scope) {
+      Reflect.defineMetadata("nexus:di:scope", options.scope, target);
+    }
+  };
+}
+function isInjectable(target) {
+  return Reflect.hasMetadata(METADATA_KEY.INJECTABLE, target);
+}
+function getScope(target) {
+  return Reflect.getMetadata("nexus:di:scope", target);
+}
+function Inject(token) {
+  return (target, propertyKey, parameterIndex) => {
+    const existing = Reflect.getMetadata(METADATA_KEY.INJECT, target) ?? new Map;
+    existing.set(parameterIndex, token);
+    Reflect.defineMetadata(METADATA_KEY.INJECT, existing, target);
+  };
+}
+
+// src/core/decorators/index.ts
+init_http_methods();
+init_params();
+init_validate();
+
+// src/core/decorators/repository.ts
+init_constants();
+import"reflect-metadata";
+function Repository(entityToken) {
+  return (target) => {
+    Reflect.defineMetadata(METADATA_KEY.REPOSITORY, { entity: entityToken }, target);
+    Reflect.defineMetadata(METADATA_KEY.INJECTABLE, true, target);
+  };
+}
+function getRepositoryMetadata(target) {
+  return Reflect.getMetadata(METADATA_KEY.REPOSITORY, target);
+}
+function isRepository(target) {
+  return Reflect.hasMetadata(METADATA_KEY.REPOSITORY, target);
+}
+// src/core/decorators/metadata.ts
+init_constants();
+// src/shield/shield.service.ts
+class ShieldService {
+  static TOKEN = Symbol.for("nexus:ShieldService");
+  csrf;
+  headers;
+  constructor(config = {}) {
+    if (config.csrf) {
+      const secret = config.secret ?? process.env["NEXUS_SHIELD_SECRET"] ?? "change-me-in-production-please";
+      this.csrf = new CsrfGuard(config.csrf, secret);
+    }
+    this.headers = new HeadersGuard(config.hsts ?? false, config.csp ?? false, config.xFrameOptions ?? "SAMEORIGIN", config.xContentTypeOptions ?? true, config.referrerPolicy);
+  }
+  middleware() {
+    return async (c, next) => {
+      if (this.csrf) {
+        const method = c.req.method.toUpperCase();
+        const ignoreMethods = this.csrf.config.ignoreMethods;
+        if (ignoreMethods.map((m) => m.toUpperCase()).includes(method)) {
+          const cookieHeader = c.req.header("cookie") ?? "";
+          const cookieName = this.csrf.config.cookieName;
+          if (!this.extractCookie(cookieHeader, cookieName)) {
+            this.csrf.issue(c.res.headers);
+          }
+        } else if (!this.csrf.verify(c.req.raw)) {
+          const resp = c.text("Invalid CSRF token", 403);
+          this.headers.apply(resp.headers);
+          return resp;
+        }
+      }
+      this.headers.apply(c.res.headers);
+      return next();
+    };
+  }
+  issueToken(headers) {
+    if (!this.csrf)
+      throw new Error("CSRF guard is not enabled");
+    return this.csrf.issue(headers);
+  }
+  extractCookie(cookieHeader, name) {
+    for (const part of cookieHeader.split(";")) {
+      const [k, ...rest] = part.trim().split("=");
+      if (k === name)
+        return rest.join("=");
+    }
+    return null;
+  }
+}
+ShieldService = __legacyDecorateClassTS([
+  Injectable(),
+  __legacyDecorateParamTS(0, Inject("SHIELD_CONFIG")),
+  __legacyMetadataTS("design:paramtypes", [
+    typeof ShieldConfig === "undefined" ? Object : ShieldConfig
+  ])
+], ShieldService);
+// src/shield/shield.module.ts
+import"reflect-metadata";
+class ShieldModule {
+  static forRoot(config = {}) {
+    class ConfiguredShieldModule {
+    }
+    ConfiguredShieldModule = __legacyDecorateClassTS([
+      Module({
+        providers: [
+          ShieldService,
+          { provide: ShieldService.TOKEN, useExisting: ShieldService },
+          { provide: "SHIELD_CONFIG", useValue: config }
+        ],
+        exports: [ShieldService, ShieldService.TOKEN]
+      })
+    ], ConfiguredShieldModule);
+    Object.defineProperty(ConfiguredShieldModule, "name", {
+      value: "ConfiguredShieldModule"
+    });
+    return ConfiguredShieldModule;
+  }
+}
+ShieldModule = __legacyDecorateClassTS([
+  Module({
+    providers: [
+      ShieldService,
+      { provide: ShieldService.TOKEN, useExisting: ShieldService }
+    ],
+    exports: [ShieldService, ShieldService.TOKEN]
+  })
+], ShieldModule);
+export {
+  ShieldService,
+  ShieldModule,
+  ShieldInternals,
+  HeadersGuard,
+  CsrfGuard
+};
+
+//# debugId=7A47D07A1DF4CCC164756E2164756E21
+//# sourceMappingURL=index.js.map