@kabyeon/nexusjs 0.6.5

package/dist/shield/index.js.map

@@ -0,0 +1,25 @@
+{
+  "version": 3,
+  "sources": ["../src/core/constants.ts", "../src/core/decorators/controller.ts", "../src/core/decorators/http-methods.ts", "../src/core/decorators/params.ts", "../src/core/decorators/validate.ts", "../src/shield/types.ts", "../src/crypto/encryption.ts", "../src/shield/guards/csrf.ts", "../src/shield/guards/headers.ts", "../src/core/decorators/module.ts", "../src/core/decorators/index.ts", "../src/core/decorators/injectable.ts", "../src/core/decorators/repository.ts", "../src/core/decorators/metadata.ts", "../src/shield/shield.service.ts", "../src/shield/shield.module.ts"],
+  "sourcesContent": [
+    "/**\n * Metadata keys used by reflect-metadata for storing decorator data.\n *\n * These constants are the contract between decorators and the framework\n * core (DI container, router, validator).\n */\nexport const METADATA_KEY = {\n\t/** Marks a class as a Nest-style controller, stores route prefix. */\n\tCONTROLLER: \"nexus:controller\",\n\n\t/** Marks a class as an injectable provider. */\n\tINJECTABLE: \"nexus:injectable\",\n\n\t/** Marks a class as a repository. */\n\tREPOSITORY: \"nexus:repository\",\n\n\t/** Marks a class as a module. Stores module options. */\n\tMODULE: \"nexus:module\",\n\n\t/** HTTP method routes registered on a controller (Get/Post/...). */\n\tROUTES: \"nexus:routes\",\n\n\t/** Method parameter type metadata (body/query/param/headers/ctx). */\n\tPARAMS: \"nexus:params\",\n\n\t/** Validation schema per method (Zod schema or class). */\n\tVALIDATE: \"nexus:validate\",\n\n\t/** Class-level design:paramtypes (built-in). */\n\tPARAMTYPES: \"design:paramtypes\",\n\n\t/** Class-level design:type (built-in). */\n\tTYPE: \"design:type\",\n\n\t/** Class-level design:returntype (built-in). */\n\tRETURNTYPE: \"design:returntype\",\n\n\t/** Provider token to inject for a parameter (for custom tokens). */\n\tINJECT: \"nexus:inject\",\n} as const;\n\nexport type MetadataKey = (typeof METADATA_KEY)[keyof typeof METADATA_KEY];\n\n/** Available parameter decorator locations. */\nexport const PARAM_TYPES = {\n\tREQUEST: 0,\n\tRESPONSE: 1,\n\tNEXT: 2,\n\tBODY: 3,\n\tQUERY: 4,\n\tPARAM: 5,\n\tHEADERS: 6,\n\tCTX: 7,\n\tUSER: 8,\n} as const;\n\nexport type ParamType = (typeof PARAM_TYPES)[keyof typeof PARAM_TYPES];\n\n/** HTTP methods supported by the router. */\nexport const HTTP_METHODS = [\n\t\"GET\",\n\t\"POST\",\n\t\"PUT\",\n\t\"DELETE\",\n\t\"PATCH\",\n\t\"OPTIONS\",\n\t\"HEAD\",\n] as const;\nexport type HttpMethod = (typeof HTTP_METHODS)[number];\n",
+    "/**\n * @Controller decorator.\n *\n * Marks a class as a controller and registers a route prefix.\n * Routes inside the controller class are decorated with @Get/@Post/etc.\n *\n * @example\n * ```ts\n * @Controller('/users')\n * class UserController {\n *   @Get('/')\n *   list() { ... }\n * }\n * ```\n */\nimport \"reflect-metadata\";\nimport { METADATA_KEY } from \"../constants.js\";\nimport type { ControllerMetadata } from \"../di/tokens.js\";\n\nexport function Controller(prefix: string = \"/\"): ClassDecorator {\n\treturn (target: object) => {\n\t\tconst normalized = normalizePrefix(prefix);\n\t\tconst meta: ControllerMetadata = { prefix: normalized };\n\t\tReflect.defineMetadata(METADATA_KEY.CONTROLLER, meta, target);\n\t};\n}\n\nexport function getControllerMetadata(target: any): ControllerMetadata {\n\treturn (\n\t\tReflect.getMetadata(METADATA_KEY.CONTROLLER, target) ?? { prefix: \"/\" }\n\t);\n}\n\nexport function isController(target: any): boolean {\n\treturn Reflect.hasMetadata(METADATA_KEY.CONTROLLER, target);\n}\n\n/**\n * Normalize a prefix so we can safely concatenate it with handler paths.\n * - Empty string becomes '/'.\n * - Trailing slashes are trimmed (we re-add them on the join).\n * - No leading slash is added; the router always joins with `/`.\n */\nfunction normalizePrefix(prefix: string): string {\n\tif (!prefix) return \"\";\n\tif (prefix !== \"/\" && prefix.endsWith(\"/\")) {\n\t\treturn prefix.slice(0, -1);\n\t}\n\treturn prefix;\n}\n",
+    "/**\n * HTTP method decorators.\n *\n * `@Get`, `@Post`, `@Put`, `@Delete`, `@Patch`, `@Options`, `@Head` mark a\n * controller method as a route handler. The path argument is appended to\n * the controller's prefix.\n *\n * @example\n * ```ts\n * @Controller('/users')\n * class UserController {\n *   @Get('/')\n *   list() {}\n *\n *   @Post('/')\n *   create(@Body() body: CreateUserDto) {}\n * }\n * ```\n */\nimport \"reflect-metadata\";\nimport { HTTP_METHODS, METADATA_KEY, type HttpMethod } from \"../constants.js\";\nimport type { RouteMetadata } from \"../di/tokens.js\";\n\nfunction defineRoute(method: HttpMethod, path: string): MethodDecorator {\n\treturn (\n\t\ttarget: object,\n\t\tpropertyKey: string | symbol,\n\t\tdescriptor: PropertyDescriptor,\n\t) => {\n\t\tconst routes: RouteMetadata[] =\n\t\t\tReflect.getMetadata(METADATA_KEY.ROUTES, target.constructor) ?? [];\n\n\t\troutes.push({\n\t\t\tmethod,\n\t\t\tpath: normalizePath(path),\n\t\t\tpropertyKey,\n\t\t\thandler: descriptor.value,\n\t\t});\n\n\t\tReflect.defineMetadata(METADATA_KEY.ROUTES, routes, target.constructor);\n\t};\n}\n\nfunction normalizePath(path: string): string {\n\tif (!path || path === \"/\") return \"/\";\n\treturn path.startsWith(\"/\") ? path : `/${path}`;\n}\n\nexport const Get = (path: string = \"/\") => defineRoute(\"GET\", path);\nexport const Post = (path: string = \"/\") => defineRoute(\"POST\", path);\nexport const Put = (path: string = \"/\") => defineRoute(\"PUT\", path);\nexport const Delete = (path: string = \"/\") => defineRoute(\"DELETE\", path);\nexport const Patch = (path: string = \"/\") => defineRoute(\"PATCH\", path);\nexport const Options = (path: string = \"/\") => defineRoute(\"OPTIONS\", path);\nexport const Head = (path: string = \"/\") => defineRoute(\"HEAD\", path);\n\nexport function getRoutes(target: any): RouteMetadata[] {\n\treturn Reflect.getMetadata(METADATA_KEY.ROUTES, target) ?? [];\n}\n\nexport { HTTP_METHODS };\nexport type { RouteMetadata };\n",
+    "/**\n * Parameter decorators.\n *\n * These mark a controller method argument as a source of request data:\n *   - `@Req()`        → Hono context\n *   - `@Res()`        → Response helper\n *   - `@Next()`       → next() callback (for middleware-style handlers)\n *   - `@Body()`       → request body (parsed)\n *   - `@Query('key')` → a single query param, or full query object\n *   - `@Param('key')` → a single path param, or full params object\n *   - `@Headers('k')` → a single header, or full headers object\n *   - `@Ctx()`        → Hono context (alias for @Req)\n *   - `@User()`       → authenticated user (resolved via auth provider)\n *\n * The metadata is read by the router at mount time to build the\n * handler invocation list.\n */\nimport \"reflect-metadata\";\nimport { METADATA_KEY, PARAM_TYPES } from \"../constants.js\";\nimport type { ParamMetadata } from \"../di/tokens.js\";\n\nexport function createParamDecorator(\n\ttype: number,\n\tdata?: string | object,\n): ParameterDecorator {\n\treturn (\n\t\ttarget: object,\n\t\tpropertyKey: string | symbol | undefined,\n\t\tparameterIndex: number,\n\t) => {\n\t\t// Method parameter: target is the prototype, propertyKey is the method name.\n\t\t// Constructor parameter: target is the class, propertyKey is undefined.\n\t\tif (propertyKey !== undefined) {\n\t\t\tconst params: ParamMetadata[] =\n\t\t\t\tReflect.getMetadata(METADATA_KEY.PARAMS, target, propertyKey) ?? [];\n\t\t\tparams.push({\n\t\t\t\tindex: parameterIndex,\n\t\t\t\ttype,\n\t\t\t\tname: typeof data === \"string\" ? data : undefined,\n\t\t\t\tdata: typeof data === \"object\" ? data : undefined,\n\t\t\t});\n\t\t\tReflect.defineMetadata(METADATA_KEY.PARAMS, params, target, propertyKey);\n\t\t} else {\n\t\t\tconst params: ParamMetadata[] =\n\t\t\t\tReflect.getMetadata(METADATA_KEY.PARAMS, target) ?? [];\n\t\t\tparams.push({\n\t\t\t\tindex: parameterIndex,\n\t\t\t\ttype,\n\t\t\t\tname: typeof data === \"string\" ? data : undefined,\n\t\t\t\tdata: typeof data === \"object\" ? data : undefined,\n\t\t\t});\n\t\t\tReflect.defineMetadata(METADATA_KEY.PARAMS, params, target);\n\t\t}\n\t};\n}\n\nexport const Req = () => createParamDecorator(PARAM_TYPES.REQUEST);\nexport const Res = () => createParamDecorator(PARAM_TYPES.RESPONSE);\nexport const Next = () => createParamDecorator(PARAM_TYPES.NEXT);\nexport const Body = (key?: string) =>\n\tcreateParamDecorator(PARAM_TYPES.BODY, key);\nexport const Query = (key?: string) =>\n\tcreateParamDecorator(PARAM_TYPES.QUERY, key);\nexport const Param = (key?: string) =>\n\tcreateParamDecorator(PARAM_TYPES.PARAM, key);\nexport const Headers = (key?: string) =>\n\tcreateParamDecorator(PARAM_TYPES.HEADERS, key);\nexport const Ctx = () => createParamDecorator(PARAM_TYPES.CTX);\nexport const User = () => createParamDecorator(PARAM_TYPES.USER);\n\nexport function getParamMetadata(\n\ttarget: any,\n\tpropertyKey: string | symbol,\n): ParamMetadata[] {\n\treturn Reflect.getMetadata(METADATA_KEY.PARAMS, target, propertyKey) ?? [];\n}\n\nexport { PARAM_TYPES };\n",
+    "/**\n * @Validate decorator.\n *\n * Attaches Zod schemas (or class validators) to a route handler. Each\n * schema is run against the corresponding request part before the handler\n * executes; failed validation throws or returns a 400 response.\n *\n * @example\n * ```ts\n * const UserSchema = z.object({ name: z.string(), email: z.email() });\n *\n * @Post('/')\n * @Validate({ body: UserSchema })\n * create(@Body() body: z.infer<typeof UserSchema>) { ... }\n * ```\n */\nimport \"reflect-metadata\";\nimport { METADATA_KEY } from \"../constants.js\";\nimport type { ValidationMetadata } from \"../di/tokens.js\";\n\nexport function Validate(options: ValidationMetadata): MethodDecorator {\n\treturn (\n\t\ttarget: object,\n\t\tpropertyKey: string | symbol,\n\t\tdescriptor: PropertyDescriptor,\n\t) => {\n\t\tReflect.defineMetadata(\n\t\t\tMETADATA_KEY.VALIDATE,\n\t\t\toptions,\n\t\t\ttarget.constructor,\n\t\t\tpropertyKey,\n\t\t);\n\t};\n}\n\nexport function getValidationMetadata(\n\ttarget: any,\n\tpropertyKey: string | symbol,\n): ValidationMetadata | undefined {\n\treturn Reflect.getMetadata(METADATA_KEY.VALIDATE, target, propertyKey);\n}\n",
+    "/**\n * `nexusjs/shield` — security middleware suite.\n *\n * Inspired by AdonisJS Shield. Provides:\n *   - CSRF protection (synchronizer token pattern)\n *   - Security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy)\n *   - HSTS (Strict-Transport-Security)\n *   - CSP (Content-Security-Policy) — optional\n *   - XSS filter (browser-level, for legacy browsers)\n *\n *   @Module({\n *     imports: [\n *       ShieldModule.forRoot({\n *         csrf: { enabled: true },\n *         hsts: { maxAge: 31_536_000, includeSubDomains: true },\n *         csp: { directives: { defaultSrc: [\"'self'\"] } },\n *       }),\n *     ],\n *   })\n *   export class AppModule {}\n */\n\nimport \"reflect-metadata\";\nimport { randomBytes } from \"node:crypto\";\nimport { EncryptionService } from \"../crypto/encryption.js\";\n\n/** CSRF protection configuration. */\nexport interface CsrfConfig {\n\tenabled: boolean;\n\t/** Cookie name. Default: 'nexus-csrf'. */\n\tcookieName?: string;\n\t/** Header name expected from clients. Default: 'x-csrf-token'. */\n\theaderName?: string;\n\t/** Form field name. Default: '_csrf'. */\n\tfieldName?: string;\n\t/** Whether to require the token on GET. Default: false. */\n\tprotectGet?: boolean;\n\t/** Cookie attributes. */\n\tcookie?: {\n\t\tsameSite?: \"Strict\" | \"Lax\" | \"None\";\n\t\tsecure?: boolean;\n\t\thttpOnly?: boolean;\n\t\tpath?: string;\n\t};\n\t/** Methods that bypass CSRF check. Default: ['GET', 'HEAD', 'OPTIONS']. */\n\tignoreMethods?: string[];\n}\n\n/** HSTS configuration. */\nexport interface HstsConfig {\n\tmaxAge: number;\n\tincludeSubDomains?: boolean;\n\tpreload?: boolean;\n}\n\n/** CSP configuration. */\nexport interface CspConfig {\n\tdirectives: Record<string, string[]>;\n\treportOnly?: boolean;\n\treportUri?: string;\n}\n\n/** Top-level Shield config. */\nexport interface ShieldConfig {\n\tcsrf?: CsrfConfig | false;\n\thsts?: HstsConfig | false;\n\tcsp?: CspConfig | false;\n\txFrameOptions?: \"DENY\" | \"SAMEORIGIN\" | false;\n\txContentTypeOptions?: boolean;\n\treferrerPolicy?: string;\n\t/** Secret used to sign CSRF tokens. */\n\tsecret?: string;\n}\n\n/** CSRF token (synchronizer pattern). */\nexport interface CsrfToken {\n\t/** The token to embed in forms/headers. */\n\ttoken: string;\n\t/** A pre-formed <meta> tag. */\n\thtml: string;\n}\n\n/** Generate a random base64url string. */\nfunction randomToken(bytes = 24): string {\n\treturn randomBytes(bytes).toString(\"base64url\");\n}\n\n/**\n * Sign `value` with `secret` using EncryptionService.\n *\n * Returns the signed value in `<value>.<signature>` format. The\n * HMAC is HKDF-derived from the secret + purpose tag (\"csrf\"), so\n * a CSRF token can't be replayed as another-purpose token.\n */\nfunction sign(value: string, secret: string): string {\n\tconst sig = new EncryptionService(secret).signRaw(value, \"csrf\");\n\treturn `${value}.${sig}`;\n}\n\n/**\n * Verify a signed token. Returns the original value on success,\n * `null` on failure (tampered, wrong purpose, malformed).\n */\nfunction verify(signed: string, secret: string): string | null {\n\tconst lastDot = signed.lastIndexOf(\".\");\n\tif (lastDot < 1) return null;\n\tconst value = signed.slice(0, lastDot);\n\tconst sig = signed.slice(lastDot + 1);\n\tif (!new EncryptionService(secret).verifyRaw(value, sig, \"csrf\")) return null;\n\treturn value;\n}\n\nexport const ShieldInternals = {\n\tsign,\n\tverify,\n\trandomToken,\n};\n",
+    "/**\n * `EncryptionService` — AES-256-GCM symmetric encryption + HMAC\n * sign/unsign helpers.\n *\n * Use cases:\n * - **Encrypt** sensitive data before storing it (e.g. session\n *   blobs in cookies or DB).\n * - **Sign** stateless values that need to be tamper-proof (e.g.\n *   session IDs, CSRF tokens, password-reset links, signed URLs).\n *\n * The service derives two 32-byte keys from the user's master\n * `key` config: one for AES-GCM, one for HMAC. The keys are\n * distinct (HKDF-SHA256 with a per-purpose salt) so a leak of one\n * doesn't compromise the other.\n *\n * Encrypted format (v1):\n *   `v1.<base64url(iv)>.<base64url(tag)>.<base64url(ciphertext)>`\n *   where `iv` is 12 bytes and `tag` is 16 bytes (GCM auth tag).\n *\n * Signed format:\n *   `<base64url(value)>.<base64url(hmac)>`\n */\n\nimport {\n\tcreateCipheriv,\n\tcreateDecipheriv,\n\tcreateHmac,\n\thkdfSync,\n\trandomBytes,\n\ttimingSafeEqual,\n} from \"node:crypto\";\nimport type { EncryptedValue, EncryptOptions, SignedValue } from \"./types.js\";\n\nconst VERSION = \"v1\";\nconst IV_BYTES = 12;\nconst TAG_BYTES = 16;\n\nexport class EncryptionService {\n\tprivate readonly aesKey: Buffer;\n\tprivate readonly hmacKey: Buffer;\n\n\tconstructor(masterKey: string) {\n\t\tconst derived = deriveKeys(masterKey);\n\t\tthis.aesKey = derived.aes;\n\t\tthis.hmacKey = derived.hmac;\n\t}\n\n\t/* ---------------- encrypt / decrypt ---------------- */\n\n\t/**\n\t * Encrypt a string. The output is self-describing and includes\n\t * the IV, auth tag, expiry, and purpose (if any) in the MAC.\n\t *\n\t * Format: `v1.<iv>.<tag>.<ciphertext>.<mac>`\n\t */\n\tencrypt(value: string, options: EncryptOptions = {}): EncryptedValue {\n\t\tconst iv = randomBytes(IV_BYTES);\n\t\tconst cipher = createCipheriv(\"aes-256-gcm\", this.aesKey, iv);\n\t\tconst plaintext = Buffer.from(value, \"utf8\");\n\t\tconst ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);\n\t\tconst tag = cipher.getAuthTag();\n\n\t\tconst expiry = encodeExpiry(options.expiresAt);\n\t\tconst purposeBuf = Buffer.from(options.purpose ?? \"\", \"utf8\");\n\t\tconst mac = this.macOver([VERSION, iv, tag, ciphertext, expiry, purposeBuf]);\n\n\t\treturn [\n\t\t\tVERSION,\n\t\t\tb64(iv),\n\t\t\tb64(tag),\n\t\t\tb64(ciphertext),\n\t\t\tb64(expiry),\n\t\t\tb64(purposeBuf),\n\t\t\tb64(mac),\n\t\t].join(\".\");\n\t}\n\n\t/**\n\t * Decrypt a value previously produced by `encrypt()`. Throws\n\t * if the value is malformed, the MAC doesn't match, the\n\t * purpose doesn't match, or the expiry has passed.\n\t */\n\tdecrypt<T = string>(payload: string): T {\n\t\tconst parsed = parseV1(payload);\n\t\tif (!parsed) throw new Error(\"Encrypted payload is malformed\");\n\n\t\t// Verify MAC over the canonical (VERSION, IV, tag, ct, expiry, purpose) tuple.\n\t\tconst expectedMac = this.macOver([\n\t\t\tVERSION,\n\t\t\tparsed.iv,\n\t\t\tparsed.tag,\n\t\t\tparsed.ciphertext,\n\t\t\tparsed.expiry,\n\t\t\tparsed.purpose,\n\t\t]);\n\t\tif (!constantTimeEqual(expectedMac, parsed.mac)) {\n\t\t\tthrow new Error(\"Encrypted payload failed integrity check\");\n\t\t}\n\n\t\t// Check expiry.\n\t\tif (parsed.expiry.length > 0) {\n\t\t\tconst expiryMs = parseExpiry(parsed.expiry.toString(\"utf8\"));\n\t\t\tif (expiryMs > 0 && Date.now() > expiryMs) {\n\t\t\t\tthrow new Error(\"Encrypted payload has expired\");\n\t\t\t}\n\t\t}\n\n\t\tconst decipher = createDecipheriv(\"aes-256-gcm\", this.aesKey, parsed.iv);\n\t\tdecipher.setAuthTag(parsed.tag);\n\t\tconst plaintext = Buffer.concat([\n\t\t\tdecipher.update(parsed.ciphertext),\n\t\t\tdecipher.final(),\n\t\t]);\n\t\treturn plaintext.toString(\"utf8\") as unknown as T;\n\t}\n\n\t/** True if the string was produced by `encrypt()`. */\n\tisEncrypted(value: string): boolean {\n\t\tif (typeof value !== \"string\") return false;\n\t\treturn value.startsWith(VERSION + \".\");\n\t}\n\n\t/* ---------------- HMAC sign / unsign ---------------- */\n\n\t/**\n\t * Sign a string with the framework's HMAC key. The output is\n\t * `<base64url(value)>.<base64url(hmac)>`.\n\t *\n\t * Useful for stateless session cookies, CSRF tokens, etc.\n\t */\n\tsign(value: string, purpose = \"\"): SignedValue {\n\t\tconst mac = createHmac(\"sha256\", this.hmacKey)\n\t\t\t.update(purpose)\n\t\t\t.update(\"|\")\n\t\t\t.update(value)\n\t\t\t.digest();\n\t\treturn `${b64(Buffer.from(value, \"utf8\"))}.${b64(mac)}`;\n\t}\n\n\t/**\n\t * Sign a pre-encoded value (no extra b64-encoding). The output\n\t * is just the base64url MAC. Useful for cookie / token formats\n\t * where the value is already b64-encoded.\n\t *\n\t * The caller is responsible for joining the value and signature.\n\t */\n\tsignRaw(value: string, purpose = \"\"): string {\n\t\tconst mac = createHmac(\"sha256\", this.hmacKey)\n\t\t\t.update(purpose)\n\t\t\t.update(\"|\")\n\t\t\t.update(value)\n\t\t\t.digest();\n\t\treturn b64(mac);\n\t}\n\n\t/**\n\t * Verify a raw signature (from `signRaw`) against a pre-encoded\n\t * value. Returns `true` on match, `false` otherwise.\n\t */\n\tverifyRaw(value: string, signature: string, purpose = \"\"): boolean {\n\t\tconst expected = createHmac(\"sha256\", this.hmacKey)\n\t\t\t.update(purpose)\n\t\t\t.update(\"|\")\n\t\t\t.update(value)\n\t\t\t.digest();\n\t\tconst given = fromB64(signature);\n\t\tif (!given) return false;\n\t\treturn constantTimeEqual(given, expected);\n\t}\n\n\t/**\n\t * Verify and extract a previously signed value. Returns the\n\t * original value on success, `null` on failure (malformed,\n\t * wrong purpose, MAC mismatch).\n\t */\n\tunsign(signed: string, purpose = \"\"): string | null {\n\t\tconst dot = signed.lastIndexOf(\".\");\n\t\tif (dot < 1 || dot === signed.length - 1) return null;\n\t\tconst valueB64 = signed.slice(0, dot);\n\t\tconst macB64 = signed.slice(dot + 1);\n\t\tconst value = fromB64(valueB64);\n\t\tconst mac = fromB64(macB64);\n\t\tif (!value || !mac) return null;\n\t\tconst expected = createHmac(\"sha256\", this.hmacKey)\n\t\t\t.update(purpose)\n\t\t\t.update(\"|\")\n\t\t\t.update(value)\n\t\t\t.digest();\n\t\tif (!constantTimeEqual(mac, expected)) return null;\n\t\treturn value.toString(\"utf8\");\n\t}\n\n\t/* ---------------- internals ---------------- */\n\n\tprivate macOver(parts: Array<Buffer | string>): Buffer {\n\t\tconst h = createHmac(\"sha256\", this.hmacKey);\n\t\tfor (const p of parts) {\n\t\t\th.update(\"|\");\n\t\t\th.update(p as Buffer);\n\t\t}\n\t\treturn h.digest();\n\t}\n}\n\n/* ------------------------------------------------------------------ *\n * Helpers\n * ------------------------------------------------------------------ */\n\nfunction b64(buf: Buffer): string {\n\treturn buf.toString(\"base64url\");\n}\n\nfunction fromB64(s: string): Buffer | null {\n\ttry {\n\t\treturn Buffer.from(s, \"base64url\");\n\t} catch {\n\t\treturn null;\n\t}\n}\n\nfunction constantTimeEqual(a: Buffer, b: Buffer): boolean {\n\tif (a.length !== b.length) return false;\n\treturn timingSafeEqual(a, b);\n}\n\nfunction encodeExpiry(expiresAt: number | string | Date | undefined): Buffer {\n\tif (expiresAt === undefined) return Buffer.alloc(0);\n\tlet ms: number;\n\tif (typeof expiresAt === \"number\") {\n\t\tms = expiresAt > 1e12 ? expiresAt : Date.now() + expiresAt * 1000;\n\t} else if (typeof expiresAt === \"string\") {\n\t\t// Numeric string = seconds from now\n\t\tconst asNum = Number(expiresAt);\n\t\tif (!isNaN(asNum) && asNum > 0) {\n\t\t\tms = asNum > 1e12 ? asNum : Date.now() + asNum * 1000;\n\t\t} else {\n\t\t\tms = Date.parse(expiresAt);\n\t\t}\n\t} else {\n\t\tms = expiresAt.getTime();\n\t}\n\tif (!isFinite(ms)) return Buffer.alloc(0);\n\treturn Buffer.from(String(ms), \"utf8\");\n}\n\nfunction parseExpiry(s: string): number {\n\tconst n = Number(s);\n\treturn isFinite(n) ? n : 0;\n}\n\ninterface ParsedV1 {\n\tiv: Buffer;\n\ttag: Buffer;\n\tciphertext: Buffer;\n\texpiry: Buffer;\n\tpurpose: Buffer;\n\tmac: Buffer;\n}\n\nfunction parseV1(s: string): ParsedV1 | null {\n\tif (typeof s !== \"string\" || !s.startsWith(VERSION + \".\")) return null;\n\tconst parts = s.split(\".\");\n\t// v1, iv, tag, ct, expiry, purpose, mac = 7 parts\n\tif (parts.length !== 7) return null;\n\tconst [, ivB64, tagB64, ctB64, expB64, purposeB64, macB64] = parts;\n\tconst iv = fromB64(ivB64);\n\tconst tag = fromB64(tagB64);\n\tconst ct = fromB64(ctB64);\n\tconst exp = fromB64(expB64);\n\tconst purpose = fromB64(purposeB64);\n\tconst mac = fromB64(macB64);\n\tif (!iv || !tag || !ct || !exp || !purpose || !mac) return null;\n\tif (iv.length !== IV_BYTES) return null;\n\tif (tag.length !== TAG_BYTES) return null;\n\treturn { iv, tag, ciphertext: ct, expiry: exp, purpose, mac };\n}\n\n/* ------------------------------------------------------------------ *\n * Key derivation — HKDF-SHA256, two sub-keys\n * ------------------------------------------------------------------ */\n\nfunction deriveKeys(masterKey: string): { aes: Buffer; hmac: Buffer } {\n\t// Convert the master to bytes. We accept any string; if it\n\t// happens to be base64 and is at least 32 bytes, decode it.\n\tlet input: Buffer;\n\ttry {\n\t\tconst decoded = Buffer.from(masterKey, \"base64\");\n\t\tif (\n\t\t\tdecoded.length >= 32 &&\n\t\t\t// The \"decoded\" path is valid only if the string is\n\t\t\t// actually base64 (would be a real try/catch).\n\t\t\tmasterKey.length % 4 === 0\n\t\t) {\n\t\t\tinput = decoded;\n\t\t} else {\n\t\t\tinput = Buffer.from(masterKey, \"utf8\");\n\t\t}\n\t} catch {\n\t\tinput = Buffer.from(masterKey, \"utf8\");\n\t}\n\n\tconst ikm = input.length < 32 ? padKey(input) : input;\n\tconst out = hkdfSync(\"sha256\", ikm, Buffer.alloc(0), \"nexus:crypto:v1\", 64);\n\tconst outBuf = Buffer.from(out);\n\treturn {\n\t\taes: Buffer.from(outBuf.subarray(0, 32)),\n\t\thmac: Buffer.from(outBuf.subarray(32, 64)),\n\t};\n}\n\nfunction padKey(input: Buffer): Buffer {\n\t// Pad to 32 bytes by appending SHA-256 of the key (so the\n\t// result is deterministic and at least 32 bytes long).\n\tconst hash = createHmac(\"sha256\", \"nexus:crypto:pad\").update(input).digest();\n\tconst out = Buffer.alloc(32);\n\tinput.copy(out, 0, 0, Math.min(input.length, 32));\n\thash.copy(out, input.length < 32 ? input.length : 0, 0, 32 - Math.min(input.length, 32));\n\treturn out;\n}\n",
+    "/**\n * CSRF guard — synchronizer token pattern.\n *\n * On `GET` (or any non-mutating request) we ensure a `nexus-csrf` cookie\n * is set. On `POST`/`PUT`/`DELETE`/`PATCH` we read the cookie, then\n * compare it against the `X-CSRF-Token` header (or `_csrf` form field).\n *\n * Both values must match (constant-time compare) for the request to pass.\n */\nimport type { CsrfConfig, CsrfToken } from \"../types.js\";\nimport { ShieldInternals } from \"../types.js\";\n\nexport class CsrfGuard {\n\tprivate config: Required<CsrfConfig>;\n\tprivate secret: string;\n\n\tconstructor(config: CsrfConfig, secret: string) {\n\t\tthis.config = {\n\t\t\tenabled: config.enabled,\n\t\t\tcookieName: config.cookieName ?? \"nexus-csrf\",\n\t\t\theaderName: config.headerName ?? \"x-csrf-token\",\n\t\t\tfieldName: config.fieldName ?? \"_csrf\",\n\t\t\tprotectGet: config.protectGet ?? false,\n\t\t\tcookie: {\n\t\t\t\tsameSite: config.cookie?.sameSite ?? \"Lax\",\n\t\t\t\tsecure: config.cookie?.secure ?? true,\n\t\t\t\thttpOnly: config.cookie?.httpOnly ?? false,\n\t\t\t\tpath: config.cookie?.path ?? \"/\",\n\t\t\t},\n\t\t\tignoreMethods: config.ignoreMethods ?? [\"GET\", \"HEAD\", \"OPTIONS\"],\n\t\t};\n\t\tthis.secret = secret;\n\t}\n\n\t/**\n\t * Issue a CSRF token. Sets the cookie on the response.\n\t */\n\tissue(res: Headers): CsrfToken {\n\t\tconst raw = ShieldInternals.randomToken();\n\t\tconst signed = ShieldInternals.sign(raw, this.secret);\n\t\t// Set the cookie. The unsigned value is stored.\n\t\tconst cookieParts = [\n\t\t\t`${this.config.cookieName}=${raw}`,\n\t\t\t`Path=${this.config.cookie.path}`,\n\t\t\t`SameSite=${this.config.cookie.sameSite}`,\n\t\t];\n\t\tif (this.config.cookie.secure) cookieParts.push(\"Secure\");\n\t\tif (this.config.cookie.httpOnly) cookieParts.push(\"HttpOnly\");\n\t\tres.append(\"Set-Cookie\", cookieParts.join(\"; \"));\n\t\treturn {\n\t\t\ttoken: signed,\n\t\t\thtml: `<meta name=\"csrf-token\" content=\"${signed}\">`,\n\t\t};\n\t}\n\n\t/**\n\t * Verify a request. Returns `true` if the request is allowed.\n\t */\n\tverify(req: { method: string; headers: Headers }): boolean {\n\t\tconst method = req.method.toUpperCase();\n\t\tif (\n\t\t\tthis.config.ignoreMethods.map((m) => m.toUpperCase()).includes(method)\n\t\t) {\n\t\t\treturn true;\n\t\t}\n\t\tif (this.config.protectGet) {\n\t\t\t// (no-op; protectGet currently shares ignoreMethods logic)\n\t\t}\n\t\tconst cookieHeader = req.headers.get(\"cookie\") ?? \"\";\n\t\tconst cookieToken = this.extractCookie(\n\t\t\tcookieHeader,\n\t\t\tthis.config.cookieName,\n\t\t);\n\t\tif (!cookieToken) return false;\n\t\t// Header value\n\t\tconst headerToken = req.headers.get(this.config.headerName);\n\t\tif (\n\t\t\theaderToken &&\n\t\t\tShieldInternals.verify(headerToken, this.secret) === cookieToken\n\t\t) {\n\t\t\treturn true;\n\t\t}\n\t\t// Form field (parsed from x-www-form-urlencoded body or multipart)\n\t\t// For simplicity, we accept a custom header `x-csrf-field` with the value.\n\t\tconst fieldToken = req.headers.get(\"x-csrf-field\");\n\t\tif (\n\t\t\tfieldToken &&\n\t\t\tShieldInternals.verify(fieldToken, this.secret) === cookieToken\n\t\t) {\n\t\t\treturn true;\n\t\t}\n\t\treturn false;\n\t}\n\n\t/**\n\t * Build a Hono middleware. Sets the cookie on every safe request and\n\t * enforces the check on mutating ones.\n\t */\n\tmiddleware() {\n\t\treturn async (c: any, next: () => Promise<any>) => {\n\t\t\tconst method = (c.req.method as string).toUpperCase();\n\t\t\tif (\n\t\t\t\tthis.config.ignoreMethods.map((m) => m.toUpperCase()).includes(method)\n\t\t\t) {\n\t\t\t\t// Safe method: ensure a cookie is present.\n\t\t\t\tconst cookieHeader = c.req.header(\"cookie\") ?? \"\";\n\t\t\t\tif (!this.extractCookie(cookieHeader, this.config.cookieName)) {\n\t\t\t\t\tthis.issue(c.res.headers);\n\t\t\t\t}\n\t\t\t\treturn next();\n\t\t\t}\n\t\t\tif (!this.verify(c.req.raw)) {\n\t\t\t\treturn c.text(\"Invalid CSRF token\", 403);\n\t\t\t}\n\t\t\treturn next();\n\t\t};\n\t}\n\n\tprivate extractCookie(cookieHeader: string, name: string): string | null {\n\t\tfor (const part of cookieHeader.split(\";\")) {\n\t\t\tconst [k, ...rest] = part.trim().split(\"=\");\n\t\t\tif (k === name) return rest.join(\"=\");\n\t\t}\n\t\treturn null;\n\t}\n}\n",
+    "/**\n * Security headers middleware. Sets HSTS, X-Frame-Options,\n * X-Content-Type-Options, Referrer-Policy, and CSP on every response.\n */\nimport type { CspConfig, HstsConfig } from \"../types.js\";\n\nexport class HeadersGuard {\n\thsts: HstsConfig | false;\n\tcsp: CspConfig | false;\n\txFrameOptions: \"DENY\" | \"SAMEORIGIN\" | false;\n\txContentTypeOptions: boolean;\n\treferrerPolicy: string | undefined;\n\n\tconstructor(\n\t\thsts: HstsConfig | false,\n\t\tcsp: CspConfig | false,\n\t\txFrameOptions: \"DENY\" | \"SAMEORIGIN\" | false,\n\t\txContentTypeOptions: boolean,\n\t\treferrerPolicy: string | undefined,\n\t) {\n\t\tthis.hsts = hsts;\n\t\tthis.csp = csp;\n\t\tthis.xFrameOptions = xFrameOptions;\n\t\tthis.xContentTypeOptions = xContentTypeOptions;\n\t\tthis.referrerPolicy = referrerPolicy;\n\t}\n\n\t/**\n\t * Apply configured headers to the given `Headers` instance in place.\n\t * Useful when you already have a Response and want to enrich it.\n\t */\n\tapply(headers: Headers): void {\n\t\tif (this.hsts) {\n\t\t\tconst h = this.buildHstsHeader(this.hsts);\n\t\t\tif (h) headers.set(\"Strict-Transport-Security\", h);\n\t\t}\n\t\tif (this.csp) {\n\t\t\tconst header = this.buildCspHeader(this.csp);\n\t\t\tconst name = this.csp.reportOnly\n\t\t\t\t? \"Content-Security-Policy-Report-Only\"\n\t\t\t\t: \"Content-Security-Policy\";\n\t\t\theaders.set(name, header);\n\t\t}\n\t\tif (this.xFrameOptions) {\n\t\t\theaders.set(\"X-Frame-Options\", this.xFrameOptions);\n\t\t}\n\t\tif (this.xContentTypeOptions) {\n\t\t\theaders.set(\"X-Content-Type-Options\", \"nosniff\");\n\t\t}\n\t\tif (this.referrerPolicy) {\n\t\t\theaders.set(\"Referrer-Policy\", this.referrerPolicy);\n\t\t}\n\t}\n\n\tmiddleware() {\n\t\treturn async (_c: any, next: () => Promise<any>) => {\n\t\t\t// Apply headers to c.res BEFORE next() so the handler inherits them.\n\t\t\tthis.apply(_c.res.headers as Headers);\n\t\t\treturn next();\n\t\t};\n\t}\n\n\tprivate buildHstsHeader(cfg: HstsConfig): string {\n\t\tlet v = `max-age=${cfg.maxAge}`;\n\t\tif (cfg.includeSubDomains) v += \"; includeSubDomains\";\n\t\tif (cfg.preload) v += \"; preload\";\n\t\treturn v;\n\t}\n\n\tprivate buildCspHeader(cfg: CspConfig): string {\n\t\tconst parts: string[] = [];\n\t\tfor (const [name, values] of Object.entries(cfg.directives)) {\n\t\t\tif (!values || values.length === 0) continue;\n\t\t\tparts.push(`${camelToKebab(name)} ${values.join(\" \")}`);\n\t\t}\n\t\tif (cfg.reportUri) parts.push(`report-uri ${cfg.reportUri}`);\n\t\treturn parts.join(\"; \");\n\t}\n}\n\n/** Convert `defaultSrc` → `default-src`. Already-kebab names pass through. */\nfunction camelToKebab(s: string): string {\n\treturn s.replace(/[A-Z]/g, (m) => `-${m.toLowerCase()}`);\n}\n",
+    "/**\n * @Module decorator.\n *\n * Marks a class as a Nest-style module: a logical grouping of\n * controllers and providers with explicit imports/exports.\n *\n * @example\n * ```ts\n * @Module({\n *   imports: [UserModule],\n *   controllers: [UserController],\n *   providers: [UserService],\n *   exports: [UserService],\n * })\n * class AppModule {}\n * ```\n */\nimport \"reflect-metadata\";\nimport { METADATA_KEY } from \"../constants.js\";\nimport type { ModuleOptions, Type } from \"../di/tokens.js\";\n\nexport function Module(options: ModuleOptions = {}): ClassDecorator {\n\treturn (target: object) => {\n\t\tReflect.defineMetadata(METADATA_KEY.MODULE, options, target);\n\t};\n}\n\n/** Read the @Module options from a class. */\nexport function getModuleOptions(target: Type<any>): ModuleOptions {\n\treturn Reflect.getMetadata(METADATA_KEY.MODULE, target) ?? {};\n}\n",
+    "/**\n * Convenience barrel for all decorators.\n */\nexport * from \"./module.js\";\nexport * from \"./controller.js\";\nexport * from \"./injectable.js\";\nexport * from \"./http-methods.js\";\nexport * from \"./params.js\";\nexport * from \"./validate.js\";\nexport * from \"./repository.js\";\nexport * from \"./metadata.js\";\n",
+    "/**\n * @Injectable decorator.\n *\n * Marks a class as available for DI. The container uses reflect-metadata's\n * `design:paramtypes` to read constructor parameter types and resolve them\n * automatically.\n *\n * @example\n * ```ts\n * @Injectable()\n * class UserService {\n *   constructor(private repo: UserRepository) {}\n * }\n *\n * @Injectable({ scope: 'request' })\n * class RequestContext {\n *   constructor(@Inject(REQUEST) private req: any) {}\n * }\n * ```\n */\nimport \"reflect-metadata\";\nimport { METADATA_KEY } from \"../constants.js\";\n\nexport interface InjectableOptions {\n\tscope?: \"singleton\" | \"request\" | \"transient\";\n}\n\nexport function Injectable(options: InjectableOptions = {}): ClassDecorator {\n\treturn (target: object) => {\n\t\tReflect.defineMetadata(METADATA_KEY.INJECTABLE, true, target);\n\t\tif (options.scope) {\n\t\t\tReflect.defineMetadata(\n\t\t\t\t\"nexus:di:scope\",\n\t\t\t\toptions.scope,\n\t\t\t\ttarget,\n\t\t\t);\n\t\t}\n\t};\n}\n\nexport function isInjectable(target: any): boolean {\n\treturn Reflect.hasMetadata(METADATA_KEY.INJECTABLE, target);\n}\n\n/**\n * Read the scope declared on a class via `@Injectable({ scope })`.\n * Returns undefined when no scope is declared (defaults to singleton).\n */\nexport function getScope(\n\ttarget: any,\n): \"singleton\" | \"request\" | \"transient\" | undefined {\n\treturn Reflect.getMetadata(\"nexus:di:scope\", target);\n}\n\n/**\n * Mark a parameter as resolved by a specific token instead of its declared\n * type. Useful for interfaces, abstract classes, or string tokens.\n *\n * @example\n * ```ts\n * constructor(@Inject('CONFIG') private config: AppConfig) {}\n * ```\n */\nexport function Inject<T = any>(token: any): ParameterDecorator {\n\treturn (\n\t\ttarget: object,\n\t\tpropertyKey: string | symbol | undefined,\n\t\tparameterIndex: number,\n\t) => {\n\t\tconst existing: Map<number, any> =\n\t\t\tReflect.getMetadata(METADATA_KEY.INJECT, target) ?? new Map();\n\t\texisting.set(parameterIndex, token);\n\t\tReflect.defineMetadata(METADATA_KEY.INJECT, existing, target);\n\t};\n}",
+    "/**\n * @Repository decorator.\n *\n * Marks a class as a Spring-style repository. Repositories are normal\n * `@Injectable()` classes; the decorator is a marker so the framework\n * can register them with a database adapter (Drizzle/Prisma) and emit\n * a friendly error if you forget to wire one.\n *\n * @example\n * ```ts\n * @Repository()\n * class UserRepository {\n *   findAll() { return db.select().from(users); }\n * }\n * ```\n */\nimport \"reflect-metadata\";\nimport { METADATA_KEY } from \"../constants.js\";\nimport type { InjectionToken } from \"../di/tokens.js\";\n\nexport function Repository(entityToken?: InjectionToken<any>): ClassDecorator {\n\treturn (target: object) => {\n\t\tReflect.defineMetadata(\n\t\t\tMETADATA_KEY.REPOSITORY,\n\t\t\t{ entity: entityToken },\n\t\t\ttarget,\n\t\t);\n\t\tReflect.defineMetadata(METADATA_KEY.INJECTABLE, true, target);\n\t};\n}\n\nexport function getRepositoryMetadata(\n\ttarget: any,\n): { entity?: InjectionToken<any> } | undefined {\n\treturn Reflect.getMetadata(METADATA_KEY.REPOSITORY, target);\n}\n\nexport function isRepository(target: any): boolean {\n\treturn Reflect.hasMetadata(METADATA_KEY.REPOSITORY, target);\n}\n",
+    "/**\n * Reflect-metadata helper. Centralizes the keys the framework uses so\n * decorator files stay clean.\n */\nexport { METADATA_KEY, PARAM_TYPES, HTTP_METHODS } from \"../constants.js\";\nexport type { MetadataKey, ParamType, HttpMethod } from \"../constants.js\";\n",
+    "/**\n * `ShieldService` — orchestrator. Aggregates the per-feature guards\n * into a single Hono middleware that can be mounted globally.\n */\nimport { Inject, Injectable } from \"../core/decorators/index.js\";\nimport type { CsrfConfig, ShieldConfig } from \"./types.js\";\nimport { CsrfGuard, HeadersGuard } from \"./guards/index.js\";\n\n@Injectable()\nexport class ShieldService {\n\t/** DI token. */\n\tstatic readonly TOKEN = Symbol.for(\"nexus:ShieldService\");\n\n\tcsrf?: CsrfGuard;\n\theaders: HeadersGuard;\n\n\tconstructor(@Inject(\"SHIELD_CONFIG\") config: ShieldConfig = {}) {\n\t\tif (config.csrf) {\n\t\t\tconst secret =\n\t\t\t\tconfig.secret ??\n\t\t\t\tprocess.env[\"NEXUS_SHIELD_SECRET\"] ??\n\t\t\t\t\"change-me-in-production-please\";\n\t\t\tthis.csrf = new CsrfGuard(config.csrf as CsrfConfig, secret);\n\t\t}\n\t\tthis.headers = new HeadersGuard(\n\t\t\tconfig.hsts ?? false,\n\t\t\tconfig.csp ?? false,\n\t\t\tconfig.xFrameOptions ?? \"SAMEORIGIN\",\n\t\t\tconfig.xContentTypeOptions ?? true,\n\t\t\tconfig.referrerPolicy,\n\t\t);\n\t}\n\n\t/**\n\t * Returns a Hono middleware that applies all configured guards.\n\t *\n\t * Order:\n\t *   1. CSRF check on mutating requests (rejects with 403 + security headers)\n\t *   2. Security headers applied to the final response\n\t */\n\tmiddleware() {\n\t\treturn async (c: any, next: () => Promise<any>) => {\n\t\t\t// 1. CSRF check — must run before `next()` so we can short-circuit.\n\t\t\tif (this.csrf) {\n\t\t\t\tconst method = (c.req.method as string).toUpperCase();\n\t\t\t\tconst ignoreMethods = (this.csrf as any).config.ignoreMethods as string[];\n\t\t\t\tif (ignoreMethods.map((m) => m.toUpperCase()).includes(method)) {\n\t\t\t\t\t// Safe method: ensure a CSRF cookie is present.\n\t\t\t\t\tconst cookieHeader = c.req.header(\"cookie\") ?? \"\";\n\t\t\t\t\tconst cookieName = (this.csrf as any).config.cookieName as string;\n\t\t\t\t\tif (!this.extractCookie(cookieHeader, cookieName)) {\n\t\t\t\t\t\t(this.csrf as any).issue(c.res.headers);\n\t\t\t\t\t}\n\t\t\t\t} else if (!(this.csrf as any).verify(c.req.raw)) {\n\t\t\t\t\t// 403 — apply security headers and return.\n\t\t\t\t\tconst resp = c.text(\"Invalid CSRF token\", 403);\n\t\t\t\t\tthis.headers.apply(resp.headers as Headers);\n\t\t\t\t\treturn resp;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// 2. Apply security headers to c.res BEFORE the handler runs.\n\t\t\t//    Hono's c.text()/c.json() etc. create a new Response but\n\t\t\t//    inherit existing headers from c.res.headers.\n\t\t\tthis.headers.apply(c.res.headers as Headers);\n\n\t\t\t// 3. Continue to next middleware/handler.\n\t\t\treturn next();\n\t\t};\n\t}\n\n\t/** Generate a CSRF token and set the cookie. Useful for forms. */\n\tissueToken(headers: Headers) {\n\t\tif (!this.csrf) throw new Error(\"CSRF guard is not enabled\");\n\t\treturn this.csrf.issue(headers);\n\t}\n\n\tprivate extractCookie(cookieHeader: string, name: string): string | null {\n\t\tfor (const part of cookieHeader.split(\";\")) {\n\t\t\tconst [k, ...rest] = part.trim().split(\"=\");\n\t\t\tif (k === name) return rest.join(\"=\");\n\t\t}\n\t\treturn null;\n\t}\n}\n",
+    "/**\n * `ShieldModule` — drop-in security middleware suite.\n *\n *   @Module({\n *     imports: [\n *       ShieldModule.forRoot({\n *         csrf: { enabled: true },\n *         hsts: { maxAge: 31_536_000, includeSubDomains: true },\n *         csp: { directives: { defaultSrc: [\"'self'\"] } },\n *         xFrameOptions: 'SAMEORIGIN',\n *         xContentTypeOptions: true,\n *         referrerPolicy: 'strict-origin-when-cross-origin',\n *       }),\n *     ],\n *   })\n *   export class AppModule {}\n */\nimport \"reflect-metadata\";\nimport { Module } from \"../core/decorators/module.js\";\nimport { ShieldService } from \"./shield.service.js\";\nimport type { ShieldConfig } from \"./types.js\";\n\n@Module({\n\tproviders: [\n\t\tShieldService,\n\t\t{ provide: ShieldService.TOKEN, useExisting: ShieldService },\n\t],\n\texports: [ShieldService, ShieldService.TOKEN],\n})\nexport class ShieldModule {\n\tstatic forRoot(config: ShieldConfig = {}) {\n\t\t@Module({\n\t\t\tproviders: [\n\t\t\t\tShieldService,\n\t\t\t\t{ provide: ShieldService.TOKEN, useExisting: ShieldService },\n\t\t\t\t{ provide: \"SHIELD_CONFIG\", useValue: config },\n\t\t\t],\n\t\t\texports: [ShieldService, ShieldService.TOKEN],\n\t\t})\n\t\tclass ConfiguredShieldModule {}\n\t\tObject.defineProperty(ConfiguredShieldModule, \"name\", {\n\t\t\tvalue: \"ConfiguredShieldModule\",\n\t\t});\n\t\treturn ConfiguredShieldModule;\n\t}\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAMa,cAsCA,aAeA;AAAA;AAAA,EArDA,eAAe;AAAA,IAE3B,YAAY;AAAA,IAGZ,YAAY;AAAA,IAGZ,YAAY;AAAA,IAGZ,QAAQ;AAAA,IAGR,QAAQ;AAAA,IAGR,QAAQ;AAAA,IAGR,UAAU;AAAA,IAGV,YAAY;AAAA,IAGZ,MAAM;AAAA,IAGN,YAAY;AAAA,IAGZ,QAAQ;AAAA,EACT;AAAA,EAKa,cAAc;AAAA,IAC1B,SAAS;AAAA,IACT,UAAU;AAAA,IACV,MAAM;AAAA,IACN,MAAM;AAAA,IACN,OAAO;AAAA,IACP,OAAO;AAAA,IACP,SAAS;AAAA,IACT,KAAK;AAAA,IACL,MAAM;AAAA,EACP;AAAA,EAKa,eAAe;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA;;;ACpDA;AAIO,SAAS,UAAU,CAAC,SAAiB,KAAqB;AAAA,EAChE,OAAO,CAAC,WAAmB;AAAA,IAC1B,MAAM,aAAa,gBAAgB,MAAM;AAAA,IACzC,MAAM,OAA2B,EAAE,QAAQ,WAAW;AAAA,IACtD,QAAQ,eAAe,aAAa,YAAY,MAAM,MAAM;AAAA;AAAA;AAIvD,SAAS,qBAAqB,CAAC,QAAiC;AAAA,EACtE,OACC,QAAQ,YAAY,aAAa,YAAY,MAAM,KAAK,EAAE,QAAQ,IAAI;AAAA;AAIjE,SAAS,YAAY,CAAC,QAAsB;AAAA,EAClD,OAAO,QAAQ,YAAY,aAAa,YAAY,MAAM;AAAA;AAS3D,SAAS,eAAe,CAAC,QAAwB;AAAA,EAChD,IAAI,CAAC;AAAA,IAAQ,OAAO;AAAA,EACpB,IAAI,WAAW,OAAO,OAAO,SAAS,GAAG,GAAG;AAAA,IAC3C,OAAO,OAAO,MAAM,GAAG,EAAE;AAAA,EAC1B;AAAA,EACA,OAAO;AAAA;AAAA;AAAA,EAhCR;AAAA;;;ACGA;AAIA,SAAS,WAAW,CAAC,QAAoB,MAA+B;AAAA,EACvE,OAAO,CACN,QACA,aACA,eACI;AAAA,IACJ,MAAM,SACL,QAAQ,YAAY,aAAa,QAAQ,OAAO,WAAW,KAAK,CAAC;AAAA,IAElE,OAAO,KAAK;AAAA,MACX;AAAA,MACA,MAAM,cAAc,IAAI;AAAA,MACxB;AAAA,MACA,SAAS,WAAW;AAAA,IACrB,CAAC;AAAA,IAED,QAAQ,eAAe,aAAa,QAAQ,QAAQ,OAAO,WAAW;AAAA;AAAA;AAIxE,SAAS,aAAa,CAAC,MAAsB;AAAA,EAC5C,IAAI,CAAC,QAAQ,SAAS;AAAA,IAAK,OAAO;AAAA,EAClC,OAAO,KAAK,WAAW,GAAG,IAAI,OAAO,IAAI;AAAA;AAWnC,SAAS,SAAS,CAAC,QAA8B;AAAA,EACvD,OAAO,QAAQ,YAAY,aAAa,QAAQ,MAAM,KAAK,CAAC;AAAA;AAAA,IAThD,MAAM,CAAC,OAAe,QAAQ,YAAY,OAAO,IAAI,GACrD,OAAO,CAAC,OAAe,QAAQ,YAAY,QAAQ,IAAI,GACvD,MAAM,CAAC,OAAe,QAAQ,YAAY,OAAO,IAAI,GACrD,SAAS,CAAC,OAAe,QAAQ,YAAY,UAAU,IAAI,GAC3D,QAAQ,CAAC,OAAe,QAAQ,YAAY,SAAS,IAAI,GACzD,UAAU,CAAC,OAAe,QAAQ,YAAY,WAAW,IAAI,GAC7D,OAAO,CAAC,OAAe,QAAQ,YAAY,QAAQ,IAAI;AAAA;AAAA,EAlCpE;AAAA;;;ACHA;AAIO,SAAS,oBAAoB,CACnC,MACA,MACqB;AAAA,EACrB,OAAO,CACN,QACA,aACA,mBACI;AAAA,IAGJ,IAAI,gBAAgB,WAAW;AAAA,MAC9B,MAAM,SACL,QAAQ,YAAY,aAAa,QAAQ,QAAQ,WAAW,KAAK,CAAC;AAAA,MACnE,OAAO,KAAK;AAAA,QACX,OAAO;AAAA,QACP;AAAA,QACA,MAAM,OAAO,SAAS,WAAW,OAAO;AAAA,QACxC,MAAM,OAAO,SAAS,WAAW,OAAO;AAAA,MACzC,CAAC;AAAA,MACD,QAAQ,eAAe,aAAa,QAAQ,QAAQ,QAAQ,WAAW;AAAA,IACxE,EAAO;AAAA,MACN,MAAM,SACL,QAAQ,YAAY,aAAa,QAAQ,MAAM,KAAK,CAAC;AAAA,MACtD,OAAO,KAAK;AAAA,QACX,OAAO;AAAA,QACP;AAAA,QACA,MAAM,OAAO,SAAS,WAAW,OAAO;AAAA,QACxC,MAAM,OAAO,SAAS,WAAW,OAAO;AAAA,MACzC,CAAC;AAAA,MACD,QAAQ,eAAe,aAAa,QAAQ,QAAQ,MAAM;AAAA;AAAA;AAAA;AAmBtD,SAAS,gBAAgB,CAC/B,QACA,aACkB;AAAA,EAClB,OAAO,QAAQ,YAAY,aAAa,QAAQ,QAAQ,WAAW,KAAK,CAAC;AAAA;AAAA,IAlB7D,MAAM,MAAM,qBAAqB,YAAY,OAAO,GACpD,MAAM,MAAM,qBAAqB,YAAY,QAAQ,GACrD,OAAO,MAAM,qBAAqB,YAAY,IAAI,GAClD,OAAO,CAAC,QACpB,qBAAqB,YAAY,MAAM,GAAG,GAC9B,QAAQ,CAAC,QACrB,qBAAqB,YAAY,OAAO,GAAG,GAC/B,QAAQ,CAAC,QACrB,qBAAqB,YAAY,OAAO,GAAG,GAC/B,UAAU,CAAC,QACvB,qBAAqB,YAAY,SAAS,GAAG,GACjC,MAAM,MAAM,qBAAqB,YAAY,GAAG,GAChD,OAAO,MAAM,qBAAqB,YAAY,IAAI;AAAA;AAAA,EAlD/D;AAAA;;;ACFA;AAIO,SAAS,QAAQ,CAAC,SAA8C;AAAA,EACtE,OAAO,CACN,QACA,aACA,eACI;AAAA,IACJ,QAAQ,eACP,aAAa,UACb,SACA,OAAO,aACP,WACD;AAAA;AAAA;AAIK,SAAS,qBAAqB,CACpC,QACA,aACiC;AAAA,EACjC,OAAO,QAAQ,YAAY,aAAa,UAAU,QAAQ,WAAW;AAAA;AAAA;AAAA,EAtBtE;AAAA;;;ACKA;AACA,wBAAS;;;ACAT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUA,IAAM,UAAU;AAChB,IAAM,WAAW;AACjB,IAAM,YAAY;AAAA;AAEX,MAAM,kBAAkB;AAAA,EACb;AAAA,EACA;AAAA,EAEjB,WAAW,CAAC,WAAmB;AAAA,IAC9B,MAAM,UAAU,WAAW,SAAS;AAAA,IACpC,KAAK,SAAS,QAAQ;AAAA,IACtB,KAAK,UAAU,QAAQ;AAAA;AAAA,EAWxB,OAAO,CAAC,OAAe,UAA0B,CAAC,GAAmB;AAAA,IACpE,MAAM,KAAK,YAAY,QAAQ;AAAA,IAC/B,MAAM,SAAS,eAAe,eAAe,KAAK,QAAQ,EAAE;AAAA,IAC5D,MAAM,YAAY,OAAO,KAAK,OAAO,MAAM;AAAA,IAC3C,MAAM,aAAa,OAAO,OAAO,CAAC,OAAO,OAAO,SAAS,GAAG,OAAO,MAAM,CAAC,CAAC;AAAA,IAC3E,MAAM,MAAM,OAAO,WAAW;AAAA,IAE9B,MAAM,SAAS,aAAa,QAAQ,SAAS;AAAA,IAC7C,MAAM,aAAa,OAAO,KAAK,QAAQ,WAAW,IAAI,MAAM;AAAA,IAC5D,MAAM,MAAM,KAAK,QAAQ,CAAC,SAAS,IAAI,KAAK,YAAY,QAAQ,UAAU,CAAC;AAAA,IAE3E,OAAO;AAAA,MACN;AAAA,MACA,IAAI,EAAE;AAAA,MACN,IAAI,GAAG;AAAA,MACP,IAAI,UAAU;AAAA,MACd,IAAI,MAAM;AAAA,MACV,IAAI,UAAU;AAAA,MACd,IAAI,GAAG;AAAA,IACR,EAAE,KAAK,GAAG;AAAA;AAAA,EAQX,OAAmB,CAAC,SAAoB;AAAA,IACvC,MAAM,SAAS,QAAQ,OAAO;AAAA,IAC9B,IAAI,CAAC;AAAA,MAAQ,MAAM,IAAI,MAAM,gCAAgC;AAAA,IAG7D,MAAM,cAAc,KAAK,QAAQ;AAAA,MAChC;AAAA,MACA,OAAO;AAAA,MACP,OAAO;AAAA,MACP,OAAO;AAAA,MACP,OAAO;AAAA,MACP,OAAO;AAAA,IACR,CAAC;AAAA,IACD,IAAI,CAAC,kBAAkB,aAAa,OAAO,GAAG,GAAG;AAAA,MAChD,MAAM,IAAI,MAAM,0CAA0C;AAAA,IAC3D;AAAA,IAGA,IAAI,OAAO,OAAO,SAAS,GAAG;AAAA,MAC7B,MAAM,WAAW,YAAY,OAAO,OAAO,SAAS,MAAM,CAAC;AAAA,MAC3D,IAAI,WAAW,KAAK,KAAK,IAAI,IAAI,UAAU;AAAA,QAC1C,MAAM,IAAI,MAAM,+BAA+B;AAAA,MAChD;AAAA,IACD;AAAA,IAEA,MAAM,WAAW,iBAAiB,eAAe,KAAK,QAAQ,OAAO,EAAE;AAAA,IACvE,SAAS,WAAW,OAAO,GAAG;AAAA,IAC9B,MAAM,YAAY,OAAO,OAAO;AAAA,MAC/B,SAAS,OAAO,OAAO,UAAU;AAAA,MACjC,SAAS,MAAM;AAAA,IAChB,CAAC;AAAA,IACD,OAAO,UAAU,SAAS,MAAM;AAAA;AAAA,EAIjC,WAAW,CAAC,OAAwB;AAAA,IACnC,IAAI,OAAO,UAAU;AAAA,MAAU,OAAO;AAAA,IACtC,OAAO,MAAM,WAAW,UAAU,GAAG;AAAA;AAAA,EAWtC,IAAI,CAAC,OAAe,UAAU,IAAiB;AAAA,IAC9C,MAAM,MAAM,WAAW,UAAU,KAAK,OAAO,EAC3C,OAAO,OAAO,EACd,OAAO,GAAG,EACV,OAAO,KAAK,EACZ,OAAO;AAAA,IACT,OAAO,GAAG,IAAI,OAAO,KAAK,OAAO,MAAM,CAAC,KAAK,IAAI,GAAG;AAAA;AAAA,EAUrD,OAAO,CAAC,OAAe,UAAU,IAAY;AAAA,IAC5C,MAAM,MAAM,WAAW,UAAU,KAAK,OAAO,EAC3C,OAAO,OAAO,EACd,OAAO,GAAG,EACV,OAAO,KAAK,EACZ,OAAO;AAAA,IACT,OAAO,IAAI,GAAG;AAAA;AAAA,EAOf,SAAS,CAAC,OAAe,WAAmB,UAAU,IAAa;AAAA,IAClE,MAAM,WAAW,WAAW,UAAU,KAAK,OAAO,EAChD,OAAO,OAAO,EACd,OAAO,GAAG,EACV,OAAO,KAAK,EACZ,OAAO;AAAA,IACT,MAAM,QAAQ,QAAQ,SAAS;AAAA,IAC/B,IAAI,CAAC;AAAA,MAAO,OAAO;AAAA,IACnB,OAAO,kBAAkB,OAAO,QAAQ;AAAA;AAAA,EAQzC,MAAM,CAAC,QAAgB,UAAU,IAAmB;AAAA,IACnD,MAAM,MAAM,OAAO,YAAY,GAAG;AAAA,IAClC,IAAI,MAAM,KAAK,QAAQ,OAAO,SAAS;AAAA,MAAG,OAAO;AAAA,IACjD,MAAM,WAAW,OAAO,MAAM,GAAG,GAAG;AAAA,IACpC,MAAM,SAAS,OAAO,MAAM,MAAM,CAAC;AAAA,IACnC,MAAM,QAAQ,QAAQ,QAAQ;AAAA,IAC9B,MAAM,MAAM,QAAQ,MAAM;AAAA,IAC1B,IAAI,CAAC,SAAS,CAAC;AAAA,MAAK,OAAO;AAAA,IAC3B,MAAM,WAAW,WAAW,UAAU,KAAK,OAAO,EAChD,OAAO,OAAO,EACd,OAAO,GAAG,EACV,OAAO,KAAK,EACZ,OAAO;AAAA,IACT,IAAI,CAAC,kBAAkB,KAAK,QAAQ;AAAA,MAAG,OAAO;AAAA,IAC9C,OAAO,MAAM,SAAS,MAAM;AAAA;AAAA,EAKrB,OAAO,CAAC,OAAuC;AAAA,IACtD,MAAM,IAAI,WAAW,UAAU,KAAK,OAAO;AAAA,IAC3C,WAAW,KAAK,OAAO;AAAA,MACtB,EAAE,OAAO,GAAG;AAAA,MACZ,EAAE,OAAO,CAAW;AAAA,IACrB;AAAA,IACA,OAAO,EAAE,OAAO;AAAA;AAElB;AAMA,SAAS,GAAG,CAAC,KAAqB;AAAA,EACjC,OAAO,IAAI,SAAS,WAAW;AAAA;AAGhC,SAAS,OAAO,CAAC,GAA0B;AAAA,EAC1C,IAAI;AAAA,IACH,OAAO,OAAO,KAAK,GAAG,WAAW;AAAA,IAChC,MAAM;AAAA,IACP,OAAO;AAAA;AAAA;AAIT,SAAS,iBAAiB,CAAC,GAAW,GAAoB;AAAA,EACzD,IAAI,EAAE,WAAW,EAAE;AAAA,IAAQ,OAAO;AAAA,EAClC,OAAO,gBAAgB,GAAG,CAAC;AAAA;AAG5B,SAAS,YAAY,CAAC,WAAuD;AAAA,EAC5E,IAAI,cAAc;AAAA,IAAW,OAAO,OAAO,MAAM,CAAC;AAAA,EAClD,IAAI;AAAA,EACJ,IAAI,OAAO,cAAc,UAAU;AAAA,IAClC,KAAK,YAAY,gBAAO,YAAY,KAAK,IAAI,IAAI,YAAY;AAAA,EAC9D,EAAO,SAAI,OAAO,cAAc,UAAU;AAAA,IAEzC,MAAM,QAAQ,OAAO,SAAS;AAAA,IAC9B,IAAI,CAAC,MAAM,KAAK,KAAK,QAAQ,GAAG;AAAA,MAC/B,KAAK,QAAQ,gBAAO,QAAQ,KAAK,IAAI,IAAI,QAAQ;AAAA,IAClD,EAAO;AAAA,MACN,KAAK,KAAK,MAAM,SAAS;AAAA;AAAA,EAE3B,EAAO;AAAA,IACN,KAAK,UAAU,QAAQ;AAAA;AAAA,EAExB,IAAI,CAAC,SAAS,EAAE;AAAA,IAAG,OAAO,OAAO,MAAM,CAAC;AAAA,EACxC,OAAO,OAAO,KAAK,OAAO,EAAE,GAAG,MAAM;AAAA;AAGtC,SAAS,WAAW,CAAC,GAAmB;AAAA,EACvC,MAAM,IAAI,OAAO,CAAC;AAAA,EAClB,OAAO,SAAS,CAAC,IAAI,IAAI;AAAA;AAY1B,SAAS,OAAO,CAAC,GAA4B;AAAA,EAC5C,IAAI,OAAO,MAAM,YAAY,CAAC,EAAE,WAAW,UAAU,GAAG;AAAA,IAAG,OAAO;AAAA,EAClE,MAAM,QAAQ,EAAE,MAAM,GAAG;AAAA,EAEzB,IAAI,MAAM,WAAW;AAAA,IAAG,OAAO;AAAA,EAC/B,SAAS,OAAO,QAAQ,OAAO,QAAQ,YAAY,UAAU;AAAA,EAC7D,MAAM,KAAK,QAAQ,KAAK;AAAA,EACxB,MAAM,MAAM,QAAQ,MAAM;AAAA,EAC1B,MAAM,KAAK,QAAQ,KAAK;AAAA,EACxB,MAAM,MAAM,QAAQ,MAAM;AAAA,EAC1B,MAAM,UAAU,QAAQ,UAAU;AAAA,EAClC,MAAM,MAAM,QAAQ,MAAM;AAAA,EAC1B,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;AAAA,IAAK,OAAO;AAAA,EAC3D,IAAI,GAAG,WAAW;AAAA,IAAU,OAAO;AAAA,EACnC,IAAI,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EACrC,OAAO,EAAE,IAAI,KAAK,YAAY,IAAI,QAAQ,KAAK,SAAS,IAAI;AAAA;AAO7D,SAAS,UAAU,CAAC,WAAkD;AAAA,EAGrE,IAAI;AAAA,EACJ,IAAI;AAAA,IACH,MAAM,UAAU,OAAO,KAAK,WAAW,QAAQ;AAAA,IAC/C,IACC,QAAQ,UAAU,MAGlB,UAAU,SAAS,MAAM,GACxB;AAAA,MACD,QAAQ;AAAA,IACT,EAAO;AAAA,MACN,QAAQ,OAAO,KAAK,WAAW,MAAM;AAAA;AAAA,IAErC,MAAM;AAAA,IACP,QAAQ,OAAO,KAAK,WAAW,MAAM;AAAA;AAAA,EAGtC,MAAM,MAAM,MAAM,SAAS,KAAK,OAAO,KAAK,IAAI;AAAA,EAChD,MAAM,MAAM,SAAS,UAAU,KAAK,OAAO,MAAM,CAAC,GAAG,mBAAmB,EAAE;AAAA,EAC1E,MAAM,SAAS,OAAO,KAAK,GAAG;AAAA,EAC9B,OAAO;AAAA,IACN,KAAK,OAAO,KAAK,OAAO,SAAS,GAAG,EAAE,CAAC;AAAA,IACvC,MAAM,OAAO,KAAK,OAAO,SAAS,IAAI,EAAE,CAAC;AAAA,EAC1C;AAAA;AAGD,SAAS,MAAM,CAAC,OAAuB;AAAA,EAGtC,MAAM,OAAO,WAAW,UAAU,kBAAkB,EAAE,OAAO,KAAK,EAAE,OAAO;AAAA,EAC3E,MAAM,MAAM,OAAO,MAAM,EAAE;AAAA,EAC3B,MAAM,KAAK,KAAK,GAAG,GAAG,KAAK,IAAI,MAAM,QAAQ,EAAE,CAAC;AAAA,EAChD,KAAK,KAAK,KAAK,MAAM,SAAS,KAAK,MAAM,SAAS,GAAG,GAAG,KAAK,KAAK,IAAI,MAAM,QAAQ,EAAE,CAAC;AAAA,EACvF,OAAO;AAAA;;;AD1OR,SAAS,WAAW,CAAC,QAAQ,IAAY;AAAA,EACxC,OAAO,aAAY,KAAK,EAAE,SAAS,WAAW;AAAA;AAU/C,SAAS,IAAI,CAAC,OAAe,QAAwB;AAAA,EACpD,MAAM,MAAM,IAAI,kBAAkB,MAAM,EAAE,QAAQ,OAAO,MAAM;AAAA,EAC/D,OAAO,GAAG,SAAS;AAAA;AAOpB,SAAS,MAAM,CAAC,QAAgB,QAA+B;AAAA,EAC9D,MAAM,UAAU,OAAO,YAAY,GAAG;AAAA,EACtC,IAAI,UAAU;AAAA,IAAG,OAAO;AAAA,EACxB,MAAM,QAAQ,OAAO,MAAM,GAAG,OAAO;AAAA,EACrC,MAAM,MAAM,OAAO,MAAM,UAAU,CAAC;AAAA,EACpC,IAAI,CAAC,IAAI,kBAAkB,MAAM,EAAE,UAAU,OAAO,KAAK,MAAM;AAAA,IAAG,OAAO;AAAA,EACzE,OAAO;AAAA;AAGD,IAAM,kBAAkB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AACD;;AExGO,MAAM,UAAU;AAAA,EACd;AAAA,EACA;AAAA,EAER,WAAW,CAAC,QAAoB,QAAgB;AAAA,IAC/C,KAAK,SAAS;AAAA,MACb,SAAS,OAAO;AAAA,MAChB,YAAY,OAAO,cAAc;AAAA,MACjC,YAAY,OAAO,cAAc;AAAA,MACjC,WAAW,OAAO,aAAa;AAAA,MAC/B,YAAY,OAAO,cAAc;AAAA,MACjC,QAAQ;AAAA,QACP,UAAU,OAAO,QAAQ,YAAY;AAAA,QACrC,QAAQ,OAAO,QAAQ,UAAU;AAAA,QACjC,UAAU,OAAO,QAAQ,YAAY;AAAA,QACrC,MAAM,OAAO,QAAQ,QAAQ;AAAA,MAC9B;AAAA,MACA,eAAe,OAAO,iBAAiB,CAAC,OAAO,QAAQ,SAAS;AAAA,IACjE;AAAA,IACA,KAAK,SAAS;AAAA;AAAA,EAMf,KAAK,CAAC,KAAyB;AAAA,IAC9B,MAAM,MAAM,gBAAgB,YAAY;AAAA,IACxC,MAAM,SAAS,gBAAgB,KAAK,KAAK,KAAK,MAAM;AAAA,IAEpD,MAAM,cAAc;AAAA,MACnB,GAAG,KAAK,OAAO,cAAc;AAAA,MAC7B,QAAQ,KAAK,OAAO,OAAO;AAAA,MAC3B,YAAY,KAAK,OAAO,OAAO;AAAA,IAChC;AAAA,IACA,IAAI,KAAK,OAAO,OAAO;AAAA,MAAQ,YAAY,KAAK,QAAQ;AAAA,IACxD,IAAI,KAAK,OAAO,OAAO;AAAA,MAAU,YAAY,KAAK,UAAU;AAAA,IAC5D,IAAI,OAAO,cAAc,YAAY,KAAK,IAAI,CAAC;AAAA,IAC/C,OAAO;AAAA,MACN,OAAO;AAAA,MACP,MAAM,oCAAoC;AAAA,IAC3C;AAAA;AAAA,EAMD,MAAM,CAAC,KAAoD;AAAA,IAC1D,MAAM,SAAS,IAAI,OAAO,YAAY;AAAA,IACtC,IACC,KAAK,OAAO,cAAc,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,SAAS,MAAM,GACpE;AAAA,MACD,OAAO;AAAA,IACR;AAAA,IACA,IAAI,KAAK,OAAO,YAAY,CAE5B;AAAA,IACA,MAAM,eAAe,IAAI,QAAQ,IAAI,QAAQ,KAAK;AAAA,IAClD,MAAM,cAAc,KAAK,cACxB,cACA,KAAK,OAAO,UACb;AAAA,IACA,IAAI,CAAC;AAAA,MAAa,OAAO;AAAA,IAEzB,MAAM,cAAc,IAAI,QAAQ,IAAI,KAAK,OAAO,UAAU;AAAA,IAC1D,IACC,eACA,gBAAgB,OAAO,aAAa,KAAK,MAAM,MAAM,aACpD;AAAA,MACD,OAAO;AAAA,IACR;AAAA,IAGA,MAAM,aAAa,IAAI,QAAQ,IAAI,cAAc;AAAA,IACjD,IACC,cACA,gBAAgB,OAAO,YAAY,KAAK,MAAM,MAAM,aACnD;AAAA,MACD,OAAO;AAAA,IACR;AAAA,IACA,OAAO;AAAA;AAAA,EAOR,UAAU,GAAG;AAAA,IACZ,OAAO,OAAO,GAAQ,SAA6B;AAAA,MAClD,MAAM,SAAU,EAAE,IAAI,OAAkB,YAAY;AAAA,MACpD,IACC,KAAK,OAAO,cAAc,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,SAAS,MAAM,GACpE;AAAA,QAED,MAAM,eAAe,EAAE,IAAI,OAAO,QAAQ,KAAK;AAAA,QAC/C,IAAI,CAAC,KAAK,cAAc,cAAc,KAAK,OAAO,UAAU,GAAG;AAAA,UAC9D,KAAK,MAAM,EAAE,IAAI,OAAO;AAAA,QACzB;AAAA,QACA,OAAO,KAAK;AAAA,MACb;AAAA,MACA,IAAI,CAAC,KAAK,OAAO,EAAE,IAAI,GAAG,GAAG;AAAA,QAC5B,OAAO,EAAE,KAAK,sBAAsB,GAAG;AAAA,MACxC;AAAA,MACA,OAAO,KAAK;AAAA;AAAA;AAAA,EAIN,aAAa,CAAC,cAAsB,MAA6B;AAAA,IACxE,WAAW,QAAQ,aAAa,MAAM,GAAG,GAAG;AAAA,MAC3C,OAAO,MAAM,QAAQ,KAAK,KAAK,EAAE,MAAM,GAAG;AAAA,MAC1C,IAAI,MAAM;AAAA,QAAM,OAAO,KAAK,KAAK,GAAG;AAAA,IACrC;AAAA,IACA,OAAO;AAAA;AAET;;ACvHO,MAAM,aAAa;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA,WAAW,CACV,MACA,KACA,eACA,qBACA,gBACC;AAAA,IACD,KAAK,OAAO;AAAA,IACZ,KAAK,MAAM;AAAA,IACX,KAAK,gBAAgB;AAAA,IACrB,KAAK,sBAAsB;AAAA,IAC3B,KAAK,iBAAiB;AAAA;AAAA,EAOvB,KAAK,CAAC,SAAwB;AAAA,IAC7B,IAAI,KAAK,MAAM;AAAA,MACd,MAAM,IAAI,KAAK,gBAAgB,KAAK,IAAI;AAAA,MACxC,IAAI;AAAA,QAAG,QAAQ,IAAI,6BAA6B,CAAC;AAAA,IAClD;AAAA,IACA,IAAI,KAAK,KAAK;AAAA,MACb,MAAM,SAAS,KAAK,eAAe,KAAK,GAAG;AAAA,MAC3C,MAAM,OAAO,KAAK,IAAI,aACnB,wCACA;AAAA,MACH,QAAQ,IAAI,MAAM,MAAM;AAAA,IACzB;AAAA,IACA,IAAI,KAAK,eAAe;AAAA,MACvB,QAAQ,IAAI,mBAAmB,KAAK,aAAa;AAAA,IAClD;AAAA,IACA,IAAI,KAAK,qBAAqB;AAAA,MAC7B,QAAQ,IAAI,0BAA0B,SAAS;AAAA,IAChD;AAAA,IACA,IAAI,KAAK,gBAAgB;AAAA,MACxB,QAAQ,IAAI,mBAAmB,KAAK,cAAc;AAAA,IACnD;AAAA;AAAA,EAGD,UAAU,GAAG;AAAA,IACZ,OAAO,OAAO,IAAS,SAA6B;AAAA,MAEnD,KAAK,MAAM,GAAG,IAAI,OAAkB;AAAA,MACpC,OAAO,KAAK;AAAA;AAAA;AAAA,EAIN,eAAe,CAAC,KAAyB;AAAA,IAChD,IAAI,IAAI,WAAW,IAAI;AAAA,IACvB,IAAI,IAAI;AAAA,MAAmB,KAAK;AAAA,IAChC,IAAI,IAAI;AAAA,MAAS,KAAK;AAAA,IACtB,OAAO;AAAA;AAAA,EAGA,cAAc,CAAC,KAAwB;AAAA,IAC9C,MAAM,QAAkB,CAAC;AAAA,IACzB,YAAY,MAAM,WAAW,OAAO,QAAQ,IAAI,UAAU,GAAG;AAAA,MAC5D,IAAI,CAAC,UAAU,OAAO,WAAW;AAAA,QAAG;AAAA,MACpC,MAAM,KAAK,GAAG,aAAa,IAAI,KAAK,OAAO,KAAK,GAAG,GAAG;AAAA,IACvD;AAAA,IACA,IAAI,IAAI;AAAA,MAAW,MAAM,KAAK,cAAc,IAAI,WAAW;AAAA,IAC3D,OAAO,MAAM,KAAK,IAAI;AAAA;AAExB;AAGA,SAAS,YAAY,CAAC,GAAmB;AAAA,EACxC,OAAO,EAAE,QAAQ,UAAU,CAAC,MAAM,IAAI,EAAE,YAAY,GAAG;AAAA;;AChExD;AADA;AAIO,SAAS,MAAM,CAAC,UAAyB,CAAC,GAAmB;AAAA,EACnE,OAAO,CAAC,WAAmB;AAAA,IAC1B,QAAQ,eAAe,aAAa,QAAQ,SAAS,MAAM;AAAA;AAAA;AAKtD,SAAS,gBAAgB,CAAC,QAAkC;AAAA,EAClE,OAAO,QAAQ,YAAY,aAAa,QAAQ,MAAM,KAAK,CAAC;AAAA;;;ACzB7D;;;ACiBA;AADA;AAOO,SAAS,UAAU,CAAC,UAA6B,CAAC,GAAmB;AAAA,EAC3E,OAAO,CAAC,WAAmB;AAAA,IAC1B,QAAQ,eAAe,aAAa,YAAY,MAAM,MAAM;AAAA,IAC5D,IAAI,QAAQ,OAAO;AAAA,MAClB,QAAQ,eACP,kBACA,QAAQ,OACR,MACD;AAAA,IACD;AAAA;AAAA;AAIK,SAAS,YAAY,CAAC,QAAsB;AAAA,EAClD,OAAO,QAAQ,YAAY,aAAa,YAAY,MAAM;AAAA;AAOpD,SAAS,QAAQ,CACvB,QACoD;AAAA,EACpD,OAAO,QAAQ,YAAY,kBAAkB,MAAM;AAAA;AAY7C,SAAS,MAAe,CAAC,OAAgC;AAAA,EAC/D,OAAO,CACN,QACA,aACA,mBACI;AAAA,IACJ,MAAM,WACL,QAAQ,YAAY,aAAa,QAAQ,MAAM,KAAK,IAAI;AAAA,IACzD,SAAS,IAAI,gBAAgB,KAAK;AAAA,IAClC,QAAQ,eAAe,aAAa,QAAQ,UAAU,MAAM;AAAA;AAAA;;;ADlE9D;AACA;AACA;;;AESA;AADA;AAIO,SAAS,UAAU,CAAC,aAAmD;AAAA,EAC7E,OAAO,CAAC,WAAmB;AAAA,IAC1B,QAAQ,eACP,aAAa,YACb,EAAE,QAAQ,YAAY,GACtB,MACD;AAAA,IACA,QAAQ,eAAe,aAAa,YAAY,MAAM,MAAM;AAAA;AAAA;AAIvD,SAAS,qBAAqB,CACpC,QAC+C;AAAA,EAC/C,OAAO,QAAQ,YAAY,aAAa,YAAY,MAAM;AAAA;AAGpD,SAAS,YAAY,CAAC,QAAsB;AAAA,EAClD,OAAO,QAAQ,YAAY,aAAa,YAAY,MAAM;AAAA;;AClC3D;;ACKO,MAAM,cAAc;AAAA,SAEV,QAAQ,OAAO,IAAI,qBAAqB;AAAA,EAExD;AAAA,EACA;AAAA,EAEA,WAAW,CAA0B,SAAuB,CAAC,GAAG;AAAA,IAC/D,IAAI,OAAO,MAAM;AAAA,MAChB,MAAM,SACL,OAAO,UACP,QAAQ,IAAI,0BACZ;AAAA,MACD,KAAK,OAAO,IAAI,UAAU,OAAO,MAAoB,MAAM;AAAA,IAC5D;AAAA,IACA,KAAK,UAAU,IAAI,aAClB,OAAO,QAAQ,OACf,OAAO,OAAO,OACd,OAAO,iBAAiB,cACxB,OAAO,uBAAuB,MAC9B,OAAO,cACR;AAAA;AAAA,EAUD,UAAU,GAAG;AAAA,IACZ,OAAO,OAAO,GAAQ,SAA6B;AAAA,MAElD,IAAI,KAAK,MAAM;AAAA,QACd,MAAM,SAAU,EAAE,IAAI,OAAkB,YAAY;AAAA,QACpD,MAAM,gBAAiB,KAAK,KAAa,OAAO;AAAA,QAChD,IAAI,cAAc,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,SAAS,MAAM,GAAG;AAAA,UAE/D,MAAM,eAAe,EAAE,IAAI,OAAO,QAAQ,KAAK;AAAA,UAC/C,MAAM,aAAc,KAAK,KAAa,OAAO;AAAA,UAC7C,IAAI,CAAC,KAAK,cAAc,cAAc,UAAU,GAAG;AAAA,YACjD,KAAK,KAAa,MAAM,EAAE,IAAI,OAAO;AAAA,UACvC;AAAA,QACD,EAAO,SAAI,CAAE,KAAK,KAAa,OAAO,EAAE,IAAI,GAAG,GAAG;AAAA,UAEjD,MAAM,OAAO,EAAE,KAAK,sBAAsB,GAAG;AAAA,UAC7C,KAAK,QAAQ,MAAM,KAAK,OAAkB;AAAA,UAC1C,OAAO;AAAA,QACR;AAAA,MACD;AAAA,MAKA,KAAK,QAAQ,MAAM,EAAE,IAAI,OAAkB;AAAA,MAG3C,OAAO,KAAK;AAAA;AAAA;AAAA,EAKd,UAAU,CAAC,SAAkB;AAAA,IAC5B,IAAI,CAAC,KAAK;AAAA,MAAM,MAAM,IAAI,MAAM,2BAA2B;AAAA,IAC3D,OAAO,KAAK,KAAK,MAAM,OAAO;AAAA;AAAA,EAGvB,aAAa,CAAC,cAAsB,MAA6B;AAAA,IACxE,WAAW,QAAQ,aAAa,MAAM,GAAG,GAAG;AAAA,MAC3C,OAAO,MAAM,QAAQ,KAAK,KAAK,EAAE,MAAM,GAAG;AAAA,MAC1C,IAAI,MAAM;AAAA,QAAM,OAAO,KAAK,KAAK,GAAG;AAAA,IACrC;AAAA,IACA,OAAO;AAAA;AAET;AA3Ea,gBAAN;AAAA,EADN,WAAW;AAAA,EAQE,kCAAO,eAAe;AAAA,EAP7B;AAAA;AAAA;AAAA,GAAM;;ACQb;AAYO,MAAM,aAAa;AAAA,SAClB,OAAO,CAAC,SAAuB,CAAC,GAAG;AAAA,IASzC,MAAM,uBAAuB;AAAA,IAAC;AAAA,IAAxB,yBAAN;AAAA,MARC,OAAO;AAAA,QACP,WAAW;AAAA,UACV;AAAA,UACA,EAAE,SAAS,cAAc,OAAO,aAAa,cAAc;AAAA,UAC3D,EAAE,SAAS,iBAAiB,UAAU,OAAO;AAAA,QAC9C;AAAA,QACA,SAAS,CAAC,eAAe,cAAc,KAAK;AAAA,MAC7C,CAAC;AAAA,OACK;AAAA,IACN,OAAO,eAAe,wBAAwB,QAAQ;AAAA,MACrD,OAAO;AAAA,IACR,CAAC;AAAA,IACD,OAAO;AAAA;AAET;AAhBa,eAAN;AAAA,EAPN,OAAO;AAAA,IACP,WAAW;AAAA,MACV;AAAA,MACA,EAAE,SAAS,cAAc,OAAO,aAAa,cAAc;AAAA,IAC5D;AAAA,IACA,SAAS,CAAC,eAAe,cAAc,KAAK;AAAA,EAC7C,CAAC;AAAA,GACY;",
+  "debugId": "7A47D07A1DF4CCC164756E2164756E21",
+  "names": []
+}

package/dist/shield/shield.module.d.ts

@@ -0,0 +1,25 @@
+/**
+ * `ShieldModule` — drop-in security middleware suite.
+ *
+ *   @Module({
+ *     imports: [
+ *       ShieldModule.forRoot({
+ *         csrf: { enabled: true },
+ *         hsts: { maxAge: 31_536_000, includeSubDomains: true },
+ *         csp: { directives: { defaultSrc: ["'self'"] } },
+ *         xFrameOptions: 'SAMEORIGIN',
+ *         xContentTypeOptions: true,
+ *         referrerPolicy: 'strict-origin-when-cross-origin',
+ *       }),
+ *     ],
+ *   })
+ *   export class AppModule {}
+ */
+import "reflect-metadata";
+import type { ShieldConfig } from "./types.js";
+export declare class ShieldModule {
+    static forRoot(config?: ShieldConfig): {
+        new (): {};
+    };
+}
+//# sourceMappingURL=shield.module.d.ts.map

package/dist/shield/shield.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shield.module.d.ts","sourceRoot":"","sources":["../../src/shield/shield.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,qBAOa,YAAY;IACxB,MAAM,CAAC,OAAO,CAAC,MAAM,GAAE,YAAiB;;;CAexC"}

package/dist/shield/shield.service.d.ts

@@ -0,0 +1,21 @@
+import type { ShieldConfig } from "./types.js";
+import { CsrfGuard, HeadersGuard } from "./guards/index.js";
+export declare class ShieldService {
+    /** DI token. */
+    static readonly TOKEN: unique symbol;
+    csrf?: CsrfGuard;
+    headers: HeadersGuard;
+    constructor(config?: ShieldConfig);
+    /**
+     * Returns a Hono middleware that applies all configured guards.
+     *
+     * Order:
+     *   1. CSRF check on mutating requests (rejects with 403 + security headers)
+     *   2. Security headers applied to the final response
+     */
+    middleware(): (c: any, next: () => Promise<any>) => Promise<any>;
+    /** Generate a CSRF token and set the cookie. Useful for forms. */
+    issueToken(headers: Headers): import("./types.js").CsrfToken;
+    private extractCookie;
+}
+//# sourceMappingURL=shield.service.d.ts.map

package/dist/shield/shield.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shield.service.d.ts","sourceRoot":"","sources":["../../src/shield/shield.service.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAc,YAAY,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE5D,qBACa,aAAa;IACzB,gBAAgB;IAChB,MAAM,CAAC,QAAQ,CAAC,KAAK,gBAAqC;IAE1D,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,OAAO,EAAE,YAAY,CAAC;gBAEe,MAAM,GAAE,YAAiB;IAiB9D;;;;;;OAMG;IACH,UAAU,KACK,GAAG,GAAG,EAAE,MAAM,MAAM,OAAO,CAAC,GAAG,CAAC;IA8B/C,kEAAkE;IAClE,UAAU,CAAC,OAAO,EAAE,OAAO;IAK3B,OAAO,CAAC,aAAa;CAOrB"}

package/dist/shield/types.d.ts

@@ -0,0 +1,95 @@
+/**
+ * `nexusjs/shield` — security middleware suite.
+ *
+ * Inspired by AdonisJS Shield. Provides:
+ *   - CSRF protection (synchronizer token pattern)
+ *   - Security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy)
+ *   - HSTS (Strict-Transport-Security)
+ *   - CSP (Content-Security-Policy) — optional
+ *   - XSS filter (browser-level, for legacy browsers)
+ *
+ *   @Module({
+ *     imports: [
+ *       ShieldModule.forRoot({
+ *         csrf: { enabled: true },
+ *         hsts: { maxAge: 31_536_000, includeSubDomains: true },
+ *         csp: { directives: { defaultSrc: ["'self'"] } },
+ *       }),
+ *     ],
+ *   })
+ *   export class AppModule {}
+ */
+import "reflect-metadata";
+/** CSRF protection configuration. */
+export interface CsrfConfig {
+    enabled: boolean;
+    /** Cookie name. Default: 'nexus-csrf'. */
+    cookieName?: string;
+    /** Header name expected from clients. Default: 'x-csrf-token'. */
+    headerName?: string;
+    /** Form field name. Default: '_csrf'. */
+    fieldName?: string;
+    /** Whether to require the token on GET. Default: false. */
+    protectGet?: boolean;
+    /** Cookie attributes. */
+    cookie?: {
+        sameSite?: "Strict" | "Lax" | "None";
+        secure?: boolean;
+        httpOnly?: boolean;
+        path?: string;
+    };
+    /** Methods that bypass CSRF check. Default: ['GET', 'HEAD', 'OPTIONS']. */
+    ignoreMethods?: string[];
+}
+/** HSTS configuration. */
+export interface HstsConfig {
+    maxAge: number;
+    includeSubDomains?: boolean;
+    preload?: boolean;
+}
+/** CSP configuration. */
+export interface CspConfig {
+    directives: Record<string, string[]>;
+    reportOnly?: boolean;
+    reportUri?: string;
+}
+/** Top-level Shield config. */
+export interface ShieldConfig {
+    csrf?: CsrfConfig | false;
+    hsts?: HstsConfig | false;
+    csp?: CspConfig | false;
+    xFrameOptions?: "DENY" | "SAMEORIGIN" | false;
+    xContentTypeOptions?: boolean;
+    referrerPolicy?: string;
+    /** Secret used to sign CSRF tokens. */
+    secret?: string;
+}
+/** CSRF token (synchronizer pattern). */
+export interface CsrfToken {
+    /** The token to embed in forms/headers. */
+    token: string;
+    /** A pre-formed <meta> tag. */
+    html: string;
+}
+/** Generate a random base64url string. */
+declare function randomToken(bytes?: number): string;
+/**
+ * Sign `value` with `secret` using EncryptionService.
+ *
+ * Returns the signed value in `<value>.<signature>` format. The
+ * HMAC is HKDF-derived from the secret + purpose tag ("csrf"), so
+ * a CSRF token can't be replayed as another-purpose token.
+ */
+declare function sign(value: string, secret: string): string;
+/**
+ * Verify a signed token. Returns the original value on success,
+ * `null` on failure (tampered, wrong purpose, malformed).
+ */
+declare function verify(signed: string, secret: string): string | null;
+export declare const ShieldInternals: {
+    sign: typeof sign;
+    verify: typeof verify;
+    randomToken: typeof randomToken;
+};
+export {};
+//# sourceMappingURL=types.d.ts.map

package/dist/shield/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/shield/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,kBAAkB,CAAC;AAI1B,qCAAqC;AACrC,MAAM,WAAW,UAAU;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,0CAA0C;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2DAA2D;IAC3D,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,yBAAyB;IACzB,MAAM,CAAC,EAAE;QACR,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;QACrC,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;IACF,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,0BAA0B;AAC1B,MAAM,WAAW,UAAU;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,OAAO,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,yBAAyB;AACzB,MAAM,WAAW,SAAS;IACzB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACrC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,+BAA+B;AAC/B,MAAM,WAAW,YAAY;IAC5B,IAAI,CAAC,EAAE,UAAU,GAAG,KAAK,CAAC;IAC1B,IAAI,CAAC,EAAE,UAAU,GAAG,KAAK,CAAC;IAC1B,GAAG,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,KAAK,CAAC;IAC9C,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,yCAAyC;AACzC,MAAM,WAAW,SAAS;IACzB,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;CACb;AAED,0CAA0C;AAC1C,iBAAS,WAAW,CAAC,KAAK,SAAK,GAAG,MAAM,CAEvC;AAED;;;;;;GAMG;AACH,iBAAS,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAGnD;AAED;;;GAGG;AACH,iBAAS,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAO7D;AAED,eAAO,MAAM,eAAe;;;;CAI3B,CAAC"}

package/dist/sse/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Public entry point for `nexusjs/sse`.
+ */
+export * from "./types.js";
+export { SseStream } from "./sse-stream.js";
+export { sse, sseJson, getLastEventId } from "./sse.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/sse/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sse/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC"}

package/dist/sse/index.js

@@ -0,0 +1,214 @@
+// @bun
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toCommonJS = (from) => {
+  var entry = (__moduleCache ??= new WeakMap).get(from), desc;
+  if (entry)
+    return entry;
+  entry = __defProp({}, "__esModule", { value: true });
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (var key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(entry, key))
+        __defProp(entry, key, {
+          get: __accessProp.bind(from, key),
+          enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+        });
+  }
+  __moduleCache.set(from, entry);
+  return entry;
+};
+var __moduleCache;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __legacyDecorateClassTS = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
+    r = Reflect.decorate(decorators, target, key, desc);
+  else
+    for (var i = decorators.length - 1;i >= 0; i--)
+      if (d = decorators[i])
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __legacyDecorateParamTS = (index, decorator) => (target, key) => decorator(target, key, index);
+var __legacyMetadataTS = (k, v) => {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function")
+    return Reflect.metadata(k, v);
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __require = import.meta.require;
+
+// src/core/constants.ts
+var METADATA_KEY, PARAM_TYPES, HTTP_METHODS;
+var init_constants = __esm(() => {
+  METADATA_KEY = {
+    CONTROLLER: "nexus:controller",
+    INJECTABLE: "nexus:injectable",
+    REPOSITORY: "nexus:repository",
+    MODULE: "nexus:module",
+    ROUTES: "nexus:routes",
+    PARAMS: "nexus:params",
+    VALIDATE: "nexus:validate",
+    PARAMTYPES: "design:paramtypes",
+    TYPE: "design:type",
+    RETURNTYPE: "design:returntype",
+    INJECT: "nexus:inject"
+  };
+  PARAM_TYPES = {
+    REQUEST: 0,
+    RESPONSE: 1,
+    NEXT: 2,
+    BODY: 3,
+    QUERY: 4,
+    PARAM: 5,
+    HEADERS: 6,
+    CTX: 7,
+    USER: 8
+  };
+  HTTP_METHODS = [
+    "GET",
+    "POST",
+    "PUT",
+    "DELETE",
+    "PATCH",
+    "OPTIONS",
+    "HEAD"
+  ];
+});
+
+// src/sse/types.ts
+init_constants();
+import"reflect-metadata";
+function SseEventMeta(options = {}) {
+  return (target, propertyKey) => {
+    Reflect.defineMetadata("nexus:sse:event", options, target.constructor, propertyKey);
+  };
+}
+function LastEventId() {
+  return (target, propertyKey, parameterIndex) => {
+    const t = propertyKey === undefined ? target : target.constructor;
+    const existing = Reflect.getMetadata("nexus:sse:lastEventId", t, propertyKey) ?? [];
+    existing.push(parameterIndex);
+    Reflect.defineMetadata("nexus:sse:lastEventId", existing, t, propertyKey);
+  };
+}
+var SSE_META = "nexus:sse:event";
+var SSE_LAST_EVENT_ID_META = "nexus:sse:lastEventId";
+// src/sse/sse-stream.ts
+class SseStream {
+  #api;
+  #closed = false;
+  #onClose = [];
+  #pendingWrites = new Set;
+  constructor(api) {
+    this.#api = api;
+    this.#api.onAbort(() => this.#fireClose());
+  }
+  get closed() {
+    return this.#closed;
+  }
+  send(event) {
+    if (this.#closed)
+      return;
+    const e = typeof event === "string" ? { data: event } : event;
+    const dataStr = typeof e.data === "string" ? e.data : JSON.stringify(e.data);
+    const promise = this.#api.writeSSE({
+      id: e.id !== undefined ? String(e.id) : undefined,
+      event: e.event,
+      data: dataStr,
+      retry: e.retry
+    }).catch(() => {}).finally(() => {
+      this.#pendingWrites.delete(promise);
+    });
+    this.#pendingWrites.add(promise);
+  }
+  async close() {
+    if (this.#closed)
+      return;
+    this.#closed = true;
+    if (this.#pendingWrites.size > 0) {
+      await Promise.allSettled([...this.#pendingWrites]);
+    }
+    await this.#api.close();
+    this.#fireClose();
+  }
+  onClose(cb) {
+    if (this.#closed) {
+      try {
+        cb();
+      } catch {}
+      return;
+    }
+    this.#onClose.push(cb);
+  }
+  sleep(ms) {
+    return this.#api.sleep(ms);
+  }
+  #fireClose() {
+    if (!this.#closed) {
+      this.#closed = true;
+    }
+    const cbs = this.#onClose;
+    this.#onClose = [];
+    for (const cb of cbs) {
+      try {
+        cb();
+      } catch {}
+    }
+  }
+  _internal() {
+    return this.#api;
+  }
+  _internalAbort() {
+    this.#api.abort();
+    this.#fireClose();
+  }
+}
+// src/sse/sse.ts
+function sse(c, handler) {
+  const mod = __require("hono/streaming");
+  const response = mod.streamSSE(c, async (api) => {
+    const stream = new SseStream(api);
+    try {
+      await handler(stream);
+    } finally {
+      await stream.close();
+    }
+  });
+  return response;
+}
+var sseJson = sse;
+function getLastEventId(c) {
+  const v = c.req.header("Last-Event-ID");
+  return v ?? null;
+}
+export {
+  sseJson,
+  sse,
+  getLastEventId,
+  SseStream,
+  SseEventMeta,
+  SSE_META,
+  SSE_LAST_EVENT_ID_META,
+  METADATA_KEY,
+  LastEventId
+};
+
+//# debugId=7C517B7E2AD740C864756E2164756E21
+//# sourceMappingURL=index.js.map

package/dist/sse/index.js.map

@@ -0,0 +1,13 @@
+{
+  "version": 3,
+  "sources": ["../src/core/constants.ts", "../src/sse/types.ts", "../src/sse/sse-stream.ts", "../src/sse/sse.ts"],
+  "sourcesContent": [
+    "/**\n * Metadata keys used by reflect-metadata for storing decorator data.\n *\n * These constants are the contract between decorators and the framework\n * core (DI container, router, validator).\n */\nexport const METADATA_KEY = {\n\t/** Marks a class as a Nest-style controller, stores route prefix. */\n\tCONTROLLER: \"nexus:controller\",\n\n\t/** Marks a class as an injectable provider. */\n\tINJECTABLE: \"nexus:injectable\",\n\n\t/** Marks a class as a repository. */\n\tREPOSITORY: \"nexus:repository\",\n\n\t/** Marks a class as a module. Stores module options. */\n\tMODULE: \"nexus:module\",\n\n\t/** HTTP method routes registered on a controller (Get/Post/...). */\n\tROUTES: \"nexus:routes\",\n\n\t/** Method parameter type metadata (body/query/param/headers/ctx). */\n\tPARAMS: \"nexus:params\",\n\n\t/** Validation schema per method (Zod schema or class). */\n\tVALIDATE: \"nexus:validate\",\n\n\t/** Class-level design:paramtypes (built-in). */\n\tPARAMTYPES: \"design:paramtypes\",\n\n\t/** Class-level design:type (built-in). */\n\tTYPE: \"design:type\",\n\n\t/** Class-level design:returntype (built-in). */\n\tRETURNTYPE: \"design:returntype\",\n\n\t/** Provider token to inject for a parameter (for custom tokens). */\n\tINJECT: \"nexus:inject\",\n} as const;\n\nexport type MetadataKey = (typeof METADATA_KEY)[keyof typeof METADATA_KEY];\n\n/** Available parameter decorator locations. */\nexport const PARAM_TYPES = {\n\tREQUEST: 0,\n\tRESPONSE: 1,\n\tNEXT: 2,\n\tBODY: 3,\n\tQUERY: 4,\n\tPARAM: 5,\n\tHEADERS: 6,\n\tCTX: 7,\n\tUSER: 8,\n} as const;\n\nexport type ParamType = (typeof PARAM_TYPES)[keyof typeof PARAM_TYPES];\n\n/** HTTP methods supported by the router. */\nexport const HTTP_METHODS = [\n\t\"GET\",\n\t\"POST\",\n\t\"PUT\",\n\t\"DELETE\",\n\t\"PATCH\",\n\t\"OPTIONS\",\n\t\"HEAD\",\n] as const;\nexport type HttpMethod = (typeof HTTP_METHODS)[number];\n",
+    "/**\n * `nexusjs/sse` — Server-Sent Events.\n *\n *   @Get('/events')\n *   events() {\n *     return sse((stream) => {\n *       const id = setInterval(() => {\n *         stream.send({ event: 'tick', data: Date.now() });\n *       }, 1000);\n *       stream.onClose(() => clearInterval(id));\n *     });\n *   }\n *\n *   // Or with reconnection support:\n *   @Get('/events')\n *   events(@LastEventId() lastId: string | null) {\n *     return sse(async (stream) => {\n *       // Replay events with id > lastId (if you have them).\n *       // Then continue with the live stream.\n *     });\n *   }\n *\n * Features:\n *   - Type-safe event payloads\n *   - Auto-cleanup on client disconnect\n *   - Last-Event-ID support for reconnection\n *   - JSON helpers (auto-stringify objects)\n *   - `retry:` hint to control client reconnect timing\n */\n\nimport \"reflect-metadata\";\nimport { METADATA_KEY } from \"../core/constants.js\";\n\n// ---------------------------------------------------------------------------\n// Public types\n// ---------------------------------------------------------------------------\n\n/**\n * A single SSE event. The shape mirrors the wire format:\n *\n *   - `id`    — event id (used for `Last-Event-ID` reconnection)\n *   - `event` — event name (client subscribes via EventSource.addEventListener)\n *   - `data`  — payload (string, object, or number)\n *   - `retry` — reconnect delay in ms (sent as `retry: <ms>`)\n *\n * `data` accepts anything JSON-serializable. Objects are auto-stringified\n * via `JSON.stringify`. Strings are sent verbatim (one `data:` line per\n * newline).\n */\nexport interface SseEvent<T = unknown> {\n\tid?: string | number;\n\tevent?: string;\n\tdata: T;\n\t/** Reconnect delay (ms) hint. */\n\tretry?: number;\n}\n\n/**\n * Per-stream controller. Returned to the `sse()` callback.\n *\n *   const stream = new SseStream(api);\n *   stream.send({ data: 'hello' });                // data-only event\n *   stream.send({ event: 'tick', data: { x: 1 } });\n *   stream.close();\n */\nexport interface SseStreamController {\n\t/** Push an event. Safe to call after `close()` (no-op). */\n\tsend<T = unknown>(event: SseEvent<T> | string): void;\n\t/** Close the stream. Idempotent. Awaits pending writes. */\n\tclose(): void | Promise<void>;\n\t/** True after `close()` has been called. */\n\tget closed(): boolean;\n\t/** Register a callback to run on client disconnect (or `close()`). */\n\tonClose(cb: () => void): void;\n\t/** Sleep for `ms` milliseconds (preserves the connection). */\n\tsleep(ms: number): Promise<void>;\n}\n\n// ---------------------------------------------------------------------------\n// Decorator\n// ---------------------------------------------------------------------------\n\n/** Marks a controller method as an SSE endpoint. OpenAPI hint. */\nexport function SseEventMeta(options: { name?: string; description?: string } = {}): MethodDecorator {\n\treturn (target: object, propertyKey: string | symbol) => {\n\t\tReflect.defineMetadata(\n\t\t\t\"nexus:sse:event\",\n\t\t\toptions,\n\t\t\ttarget.constructor,\n\t\t\tpropertyKey,\n\t\t);\n\t};\n}\n\n/**\n * `@LastEventId()` — inject the `Last-Event-ID` header from the\n * client's reconnect attempt. `null` if the header is missing.\n */\nexport function LastEventId(): ParameterDecorator {\n\treturn (target: object, propertyKey: string | symbol | undefined, parameterIndex: number) => {\n\t\tconst t = propertyKey === undefined ? (target as Function) : (target.constructor as Function);\n\t\tconst existing: number[] =\n\t\t\tReflect.getMetadata(\"nexus:sse:lastEventId\", t, propertyKey as string | symbol) ?? [];\n\t\texisting.push(parameterIndex);\n\t\tReflect.defineMetadata(\"nexus:sse:lastEventId\", existing, t, propertyKey as string | symbol);\n\t};\n}\n\nexport const SSE_META = \"nexus:sse:event\";\nexport const SSE_LAST_EVENT_ID_META = \"nexus:sse:lastEventId\";\nexport { METADATA_KEY };\n",
+    "/**\n * `SseStream` — per-stream controller exposed to the `sse()` callback.\n *\n * The class wraps Hono's `SSEStreamingApi` so user code never sees\n * the Hono-specific shape. It owns:\n *\n *   - A `closed` flag (idempotent `close()`)\n *   - A list of `onClose` callbacks fired on disconnect OR close\n *   - JSON auto-serialization for object payloads\n *\n * Instances are created by `sse()` and passed to the user callback.\n * They should not be constructed directly.\n */\nimport type { SseEvent, SseStreamController } from \"./types.js\";\n\n/** Minimal subset of Hono's `SSEStreamingApi` we depend on. */\ninterface HonoSSEApi {\n\twriteSSE(message: { id?: string; event?: string; data: string; retry?: number }): Promise<void>;\n\tsleep(ms: number): Promise<void>;\n\tonAbort(callback: () => void): void;\n\tclose(): Promise<void>;\n\tabort(): void;\n}\n\nexport class SseStream implements SseStreamController {\n\t#api: HonoSSEApi;\n\t#closed = false;\n\t#onClose: Array<() => void> = [];\n\t#pendingWrites: Set<Promise<void>> = new Set();\n\n\tconstructor(api: HonoSSEApi) {\n\t\tthis.#api = api;\n\t\t// When the client disconnects, Hono calls onAbort.\n\t\t// Run our user-facing cleanup chain.\n\t\tthis.#api.onAbort(() => this.#fireClose());\n\t}\n\n\tget closed(): boolean {\n\t\treturn this.#closed;\n\t}\n\n\t/** Push an event. No-op after `close()`. */\n\tsend<T = unknown>(event: SseEvent<T> | string): void {\n\t\tif (this.#closed) return;\n\t\tconst e: SseEvent<unknown> = typeof event === \"string\" ? { data: event } : event;\n\t\tconst dataStr =\n\t\t\ttypeof e.data === \"string\" ? e.data : JSON.stringify(e.data);\n\t\tconst promise = this.#api\n\t\t\t.writeSSE({\n\t\t\t\tid: e.id !== undefined ? String(e.id) : undefined,\n\t\t\t\tevent: e.event,\n\t\t\t\tdata: dataStr,\n\t\t\t\tretry: e.retry,\n\t\t\t})\n\t\t\t.catch(() => {\n\t\t\t\t/* swallow — abort happened mid-write */\n\t\t\t})\n\t\t\t.finally(() => {\n\t\t\t\tthis.#pendingWrites.delete(promise);\n\t\t\t});\n\t\tthis.#pendingWrites.add(promise);\n\t}\n\n\t/** Close the stream. Idempotent. Waits for pending writes. */\n\tasync close(): Promise<void> {\n\t\tif (this.#closed) return;\n\t\tthis.#closed = true;\n\t\t// Wait for all pending writes to flush.\n\t\tif (this.#pendingWrites.size > 0) {\n\t\t\tawait Promise.allSettled([...this.#pendingWrites]);\n\t\t}\n\t\tawait this.#api.close();\n\t\tthis.#fireClose();\n\t}\n\n\t/** Register a cleanup callback. */\n\tonClose(cb: () => void): void {\n\t\tif (this.#closed) {\n\t\t\ttry {\n\t\t\t\tcb();\n\t\t\t} catch {\n\t\t\t\t/* ignore */\n\t\t\t}\n\t\t\treturn;\n\t\t}\n\t\tthis.#onClose.push(cb);\n\t}\n\n\t/** Sleep for `ms` (preserves the open connection). */\n\tsleep(ms: number): Promise<void> {\n\t\treturn this.#api.sleep(ms);\n\t}\n\n\t#fireClose(): void {\n\t\tif (!this.#closed) {\n\t\t\tthis.#closed = true;\n\t\t}\n\t\tconst cbs = this.#onClose;\n\t\tthis.#onClose = [];\n\t\tfor (const cb of cbs) {\n\t\t\ttry {\n\t\t\t\tcb();\n\t\t\t} catch {\n\t\t\t\t/* swallow — we are tearing down */\n\t\t\t}\n\t\t}\n\t}\n\n\t/** Internal escape hatch. Do not use from user code. */\n\t_internal(): HonoSSEApi {\n\t\treturn this.#api;\n\t}\n\n\t/** Internal: indicate that the underlying API was aborted by Hono. */\n\t_internalAbort(): void {\n\t\tthis.#api.abort();\n\t\tthis.#fireClose();\n\t}\n}\n",
+    "/**\n * `sse()` — wrap a stream-producing callback in a Hono `streamSSE()`\n * call. Returns a `Response` with `text/event-stream` content type.\n *\n *   import { sse } from 'nexusjs/sse';\n *\n *   @Get('/events')\n *   events(@Req() c: any) {\n *     return sse(c, (stream) => {\n *       const t = setInterval(() => {\n *         stream.send({ event: 'tick', data: Date.now() });\n *       }, 1000);\n *       stream.onClose(() => clearInterval(t));\n *     });\n *   }\n *\n * The callback may be sync or async. When the client disconnects,\n * `onClose` callbacks fire and the Hono streaming context closes.\n *\n * Implementation: we use Hono's `streamSSE()` helper. The returned\n * `Response` is wired into the framework's existing response\n * pipeline — the framework just passes it through to the client.\n */\nimport { SseStream } from \"./sse-stream.js\";\nimport type { SseStreamController } from \"./types.js\";\n\n/**\n * The `sse()` helper.\n *\n * @param c  Hono context. Pass via `@Req()` in a controller.\n * @param handler  Callback that pushes events onto the stream.\n * @returns A `Response` with `text/event-stream` content type.\n */\nexport function sse(\n\tc: any,\n\thandler: (stream: SseStreamController) => void | Promise<void>,\n): Response {\n\t// Lazy import keeps the top-level `nexusjs/sse` module from\n\t// hard-depending on `hono/streaming` (Hono is already a peer).\n\tconst mod = require(\"hono/streaming\") as typeof import(\"hono/streaming\");\n\tconst response = mod.streamSSE(c, async (api) => {\n\t\tconst stream = new SseStream(api);\n\t\ttry {\n\t\t\tawait handler(stream);\n\t\t} finally {\n\t\t\tawait stream.close();\n\t\t}\n\t});\n\treturn response as unknown as Response;\n}\n\n/**\n * `sseJson()` — convenience alias for `sse()`. Object payloads are\n * auto-JSON-stringified in either form.\n */\nexport const sseJson = sse;\n\n/**\n * Extract the `Last-Event-ID` header from a Hono context. Returns\n * `null` if the header is missing.\n */\nexport function getLastEventId(c: { req: { header(name: string): string | undefined } }): string | null {\n\tconst v = c.req.header(\"Last-Event-ID\");\n\treturn v ?? null;\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAMa,cAsCA,aAeA;AAAA;AAAA,EArDA,eAAe;AAAA,IAE3B,YAAY;AAAA,IAGZ,YAAY;AAAA,IAGZ,YAAY;AAAA,IAGZ,QAAQ;AAAA,IAGR,QAAQ;AAAA,IAGR,QAAQ;AAAA,IAGR,UAAU;AAAA,IAGV,YAAY;AAAA,IAGZ,MAAM;AAAA,IAGN,YAAY;AAAA,IAGZ,QAAQ;AAAA,EACT;AAAA,EAKa,cAAc;AAAA,IAC1B,SAAS;AAAA,IACT,UAAU;AAAA,IACV,MAAM;AAAA,IACN,MAAM;AAAA,IACN,OAAO;AAAA,IACP,OAAO;AAAA,IACP,SAAS;AAAA,IACT,KAAK;AAAA,IACL,MAAM;AAAA,EACP;AAAA,EAKa,eAAe;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA;;;ACpCA;AADA;AAqDO,SAAS,YAAY,CAAC,UAAmD,CAAC,GAAoB;AAAA,EACpG,OAAO,CAAC,QAAgB,gBAAiC;AAAA,IACxD,QAAQ,eACP,mBACA,SACA,OAAO,aACP,WACD;AAAA;AAAA;AAQK,SAAS,WAAW,GAAuB;AAAA,EACjD,OAAO,CAAC,QAAgB,aAA0C,mBAA2B;AAAA,IAC5F,MAAM,IAAI,gBAAgB,YAAa,SAAuB,OAAO;AAAA,IACrE,MAAM,WACL,QAAQ,YAAY,yBAAyB,GAAG,WAA8B,KAAK,CAAC;AAAA,IACrF,SAAS,KAAK,cAAc;AAAA,IAC5B,QAAQ,eAAe,yBAAyB,UAAU,GAAG,WAA8B;AAAA;AAAA;AAItF,IAAM,WAAW;AACjB,IAAM,yBAAyB;;ACrF/B,MAAM,UAAyC;AAAA,EACrD;AAAA,EACA,UAAU;AAAA,EACV,WAA8B,CAAC;AAAA,EAC/B,iBAAqC,IAAI;AAAA,EAEzC,WAAW,CAAC,KAAiB;AAAA,IAC5B,KAAK,OAAO;AAAA,IAGZ,KAAK,KAAK,QAAQ,MAAM,KAAK,WAAW,CAAC;AAAA;AAAA,MAGtC,MAAM,GAAY;AAAA,IACrB,OAAO,KAAK;AAAA;AAAA,EAIb,IAAiB,CAAC,OAAmC;AAAA,IACpD,IAAI,KAAK;AAAA,MAAS;AAAA,IAClB,MAAM,IAAuB,OAAO,UAAU,WAAW,EAAE,MAAM,MAAM,IAAI;AAAA,IAC3E,MAAM,UACL,OAAO,EAAE,SAAS,WAAW,EAAE,OAAO,KAAK,UAAU,EAAE,IAAI;AAAA,IAC5D,MAAM,UAAU,KAAK,KACnB,SAAS;AAAA,MACT,IAAI,EAAE,OAAO,YAAY,OAAO,EAAE,EAAE,IAAI;AAAA,MACxC,OAAO,EAAE;AAAA,MACT,MAAM;AAAA,MACN,OAAO,EAAE;AAAA,IACV,CAAC,EACA,MAAM,MAAM,EAEZ,EACA,QAAQ,MAAM;AAAA,MACd,KAAK,eAAe,OAAO,OAAO;AAAA,KAClC;AAAA,IACF,KAAK,eAAe,IAAI,OAAO;AAAA;AAAA,OAI1B,MAAK,GAAkB;AAAA,IAC5B,IAAI,KAAK;AAAA,MAAS;AAAA,IAClB,KAAK,UAAU;AAAA,IAEf,IAAI,KAAK,eAAe,OAAO,GAAG;AAAA,MACjC,MAAM,QAAQ,WAAW,CAAC,GAAG,KAAK,cAAc,CAAC;AAAA,IAClD;AAAA,IACA,MAAM,KAAK,KAAK,MAAM;AAAA,IACtB,KAAK,WAAW;AAAA;AAAA,EAIjB,OAAO,CAAC,IAAsB;AAAA,IAC7B,IAAI,KAAK,SAAS;AAAA,MACjB,IAAI;AAAA,QACH,GAAG;AAAA,QACF,MAAM;AAAA,MAGR;AAAA,IACD;AAAA,IACA,KAAK,SAAS,KAAK,EAAE;AAAA;AAAA,EAItB,KAAK,CAAC,IAA2B;AAAA,IAChC,OAAO,KAAK,KAAK,MAAM,EAAE;AAAA;AAAA,EAG1B,UAAU,GAAS;AAAA,IAClB,IAAI,CAAC,KAAK,SAAS;AAAA,MAClB,KAAK,UAAU;AAAA,IAChB;AAAA,IACA,MAAM,MAAM,KAAK;AAAA,IACjB,KAAK,WAAW,CAAC;AAAA,IACjB,WAAW,MAAM,KAAK;AAAA,MACrB,IAAI;AAAA,QACH,GAAG;AAAA,QACF,MAAM;AAAA,IAGT;AAAA;AAAA,EAID,SAAS,GAAe;AAAA,IACvB,OAAO,KAAK;AAAA;AAAA,EAIb,cAAc,GAAS;AAAA,IACtB,KAAK,KAAK,MAAM;AAAA,IAChB,KAAK,WAAW;AAAA;AAElB;;ACrFO,SAAS,GAAG,CAClB,GACA,SACW;AAAA,EAGX,MAAM;AAAA,EACN,MAAM,WAAW,IAAI,UAAU,GAAG,OAAO,QAAQ;AAAA,IAChD,MAAM,SAAS,IAAI,UAAU,GAAG;AAAA,IAChC,IAAI;AAAA,MACH,MAAM,QAAQ,MAAM;AAAA,cACnB;AAAA,MACD,MAAM,OAAO,MAAM;AAAA;AAAA,GAEpB;AAAA,EACD,OAAO;AAAA;AAOD,IAAM,UAAU;AAMhB,SAAS,cAAc,CAAC,GAAyE;AAAA,EACvG,MAAM,IAAI,EAAE,IAAI,OAAO,eAAe;AAAA,EACtC,OAAO,KAAK;AAAA;",
+  "debugId": "7C517B7E2AD740C864756E2164756E21",
+  "names": []
+}

package/dist/sse/sse-stream.d.ts

@@ -0,0 +1,46 @@
+/**
+ * `SseStream` — per-stream controller exposed to the `sse()` callback.
+ *
+ * The class wraps Hono's `SSEStreamingApi` so user code never sees
+ * the Hono-specific shape. It owns:
+ *
+ *   - A `closed` flag (idempotent `close()`)
+ *   - A list of `onClose` callbacks fired on disconnect OR close
+ *   - JSON auto-serialization for object payloads
+ *
+ * Instances are created by `sse()` and passed to the user callback.
+ * They should not be constructed directly.
+ */
+import type { SseEvent, SseStreamController } from "./types.js";
+/** Minimal subset of Hono's `SSEStreamingApi` we depend on. */
+interface HonoSSEApi {
+    writeSSE(message: {
+        id?: string;
+        event?: string;
+        data: string;
+        retry?: number;
+    }): Promise<void>;
+    sleep(ms: number): Promise<void>;
+    onAbort(callback: () => void): void;
+    close(): Promise<void>;
+    abort(): void;
+}
+export declare class SseStream implements SseStreamController {
+    #private;
+    constructor(api: HonoSSEApi);
+    get closed(): boolean;
+    /** Push an event. No-op after `close()`. */
+    send<T = unknown>(event: SseEvent<T> | string): void;
+    /** Close the stream. Idempotent. Waits for pending writes. */
+    close(): Promise<void>;
+    /** Register a cleanup callback. */
+    onClose(cb: () => void): void;
+    /** Sleep for `ms` (preserves the open connection). */
+    sleep(ms: number): Promise<void>;
+    /** Internal escape hatch. Do not use from user code. */
+    _internal(): HonoSSEApi;
+    /** Internal: indicate that the underlying API was aborted by Hono. */
+    _internalAbort(): void;
+}
+export {};
+//# sourceMappingURL=sse-stream.d.ts.map

package/dist/sse/sse-stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse-stream.d.ts","sourceRoot":"","sources":["../../src/sse/sse-stream.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEhE,+DAA+D;AAC/D,UAAU,UAAU;IACnB,QAAQ,CAAC,OAAO,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChG,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,OAAO,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IACpC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,KAAK,IAAI,IAAI,CAAC;CACd;AAED,qBAAa,SAAU,YAAW,mBAAmB;;gBAMxC,GAAG,EAAE,UAAU;IAO3B,IAAI,MAAM,IAAI,OAAO,CAEpB;IAED,4CAA4C;IAC5C,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,IAAI;IAqBpD,8DAA8D;IACxD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAW5B,mCAAmC;IACnC,OAAO,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI;IAY7B,sDAAsD;IACtD,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBhC,wDAAwD;IACxD,SAAS,IAAI,UAAU;IAIvB,sEAAsE;IACtE,cAAc,IAAI,IAAI;CAItB"}