@kamod-ch/otok-security 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Kamod
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,99 @@
+# @kamod-ch/otok-security
+
+Secure defaults and configurable security middleware for [Otok](https://github.com/kamod-ch/otok).
+
+Uses Hono's `secure-headers`, `cors`, and `body-limit` with Otok-specific host validation, CSRF, redirect protection, and rate-limit hooks.
+
+## Install
+
+```bash
+pnpm add @kamod-ch/otok-security hono @kamod-ch/otok
+```
+
+## Plugin setup
+
+```ts
+import { defineConfig } from "@kamod-ch/otok";
+import security from "@kamod-ch/otok-security";
+
+export default defineConfig({
+  plugins: [
+    security({
+      trustedHosts: ["example.com", "www.example.com"],
+      trustedOrigins: ["https://example.com"],
+      cors: {
+        origin: ["https://example.com"],
+        credentials: true,
+      },
+      bodyLimit: 2 * 1024 * 1024,
+      rateLimit: createMemoryRateLimitProvider({ limit: 100, windowMs: 60_000 }),
+    }),
+  ],
+});
+```
+
+## Middleware order
+
+Register `security()` **first** among plugins so headers, CSRF, and body limits apply before auth, i18n, SEO, and SSR:
+
+```ts
+plugins: [security(), observability(), i18n(), auth(), seo()];
+```
+
+Auth CSRF (`@kamod-ch/otok-auth/csrf`) can replace the built-in CSRF by setting `csrf: false` only in non-production with `strict: false`.
+
+## Secure cookies
+
+```ts
+import { secureCookieOptions } from "@kamod-ch/otok-security/cookies";
+
+setCookie(c, "pref", value, secureCookieOptions({ maxAge: 3600 }));
+```
+
+Production rejects `secure: false` on cookies.
+
+## Open redirects
+
+```ts
+import { safeRedirectTarget } from "@kamod-ch/otok-security/redirect";
+
+return redirect(safeRedirectTarget(nextPath, c));
+```
+
+Query params `redirect`, `returnTo`, `next`, and `url` are validated automatically.
+
+## Rate limiting
+
+Implement `RateLimitProvider` for Redis, Cloudflare, or other backends:
+
+```ts
+const rateLimit: RateLimitProvider = {
+  async check(ctx) {
+    // return { allowed: false, retryAfterSeconds: 30 }
+    return { allowed: true, limit: 100, remaining: 99 };
+  },
+};
+```
+
+## Defaults
+
+| Feature        | Development          | Production    |
+| -------------- | -------------------- | ------------- |
+| Secure headers | on                   | on            |
+| CSP            | baseline restrictive | on (required) |
+| CSRF           | on when enabled      | on (required) |
+| Body limit     | 1 MB                 | 1 MB          |
+| Secure cookies | off unless HTTPS     | secure        |
+
+Disabling CSP or CSRF in production throws unless `strict: false`.
+
+## API
+
+| Export                          | Purpose                    |
+| ------------------------------- | -------------------------- |
+| `security()`                    | Plugin factory             |
+| `configureSecurityApp`          | Manual Hono wiring         |
+| `createSecurityCsrfMiddleware`  | Standalone CSRF            |
+| `createOpenRedirectGuard`       | Query param redirect guard |
+| `createMemoryRateLimitProvider` | Dev/test rate limiter      |
+| `secureCookieOptions`           | Safe cookie defaults       |

package/dist/cookies.d.ts

@@ -0,0 +1,9 @@
+import type { Context } from "hono";
+import type { CookieOptions } from "hono/utils/cookie";
+import type { SecureCookieDefaults } from "./types.js";
+export declare function resolveSecureCookieDefaults(options: boolean | SecureCookieDefaults | undefined): SecureCookieDefaults;
+/** Apply secure cookie defaults to Hono setCookie options. */
+export declare function secureCookieOptions(partial?: CookieOptions, defaults?: SecureCookieDefaults): CookieOptions;
+export declare function attachSecureCookieDefaults(c: Context, defaults: SecureCookieDefaults): void;
+export declare function readSecureCookieDefaults(c: Context): SecureCookieDefaults | undefined;
+//# sourceMappingURL=cookies.d.ts.map

package/dist/cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../src/cookies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAMvD,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,OAAO,GAAG,oBAAoB,GAAG,SAAS,GAAG,oBAAoB,CAcrH;AAED,8DAA8D;AAC9D,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,aAAkB,EAAE,QAAQ,CAAC,EAAE,oBAAoB,GAAG,aAAa,CAY/G;AAED,wBAAgB,0BAA0B,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAE3F;AAED,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,OAAO,GAAG,oBAAoB,GAAG,SAAS,CAErF"}

package/dist/cookies.js

@@ -0,0 +1,36 @@
+function isProduction() {
+    return process.env.NODE_ENV === "production";
+}
+export function resolveSecureCookieDefaults(options) {
+    if (options === false) {
+        throw new Error("otok-security: secureCookies cannot be disabled in production. Pass explicit SecureCookieDefaults instead.");
+    }
+    const overrides = typeof options === "object" ? options : {};
+    return {
+        secure: overrides.secure ?? isProduction(),
+        httpOnly: overrides.httpOnly ?? true,
+        sameSite: overrides.sameSite ?? "Lax",
+        path: overrides.path ?? "/",
+    };
+}
+/** Apply secure cookie defaults to Hono setCookie options. */
+export function secureCookieOptions(partial = {}, defaults) {
+    const base = defaults ?? resolveSecureCookieDefaults(true);
+    if (isProduction() && partial.secure === false) {
+        throw new Error("otok-security: setting secure: false on cookies is not allowed in production");
+    }
+    return {
+        path: base.path,
+        secure: partial.secure ?? base.secure,
+        httpOnly: partial.httpOnly ?? base.httpOnly,
+        sameSite: partial.sameSite ?? base.sameSite,
+        ...partial,
+    };
+}
+export function attachSecureCookieDefaults(c, defaults) {
+    c.set("securityCookieDefaults", defaults);
+}
+export function readSecureCookieDefaults(c) {
+    return c.get("securityCookieDefaults");
+}
+//# sourceMappingURL=cookies.js.map

package/dist/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../src/cookies.ts"],"names":[],"mappings":"AAIA,SAAS,YAAY;IACnB,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,OAAmD;IAC7F,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,4GAA4G,CAC7G,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,OAAO;QACL,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,YAAY,EAAE;QAC1C,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,IAAI;QACpC,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,KAAK;QACrC,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,GAAG;KAC5B,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,mBAAmB,CAAC,UAAyB,EAAE,EAAE,QAA+B;IAC9F,MAAM,IAAI,GAAG,QAAQ,IAAI,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAC3D,IAAI,YAAY,EAAE,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM;QACrC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;QAC3C,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;QAC3C,GAAG,OAAO;KACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,CAAU,EAAE,QAA8B;IACnF,CAAC,CAAC,GAAG,CAAC,wBAAwB,EAAE,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,CAAU;IACjD,OAAO,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAqC,CAAC;AAC7E,CAAC"}

package/dist/csrf.d.ts

@@ -0,0 +1,5 @@
+import { type OtokMiddleware } from "@kamod-ch/otok/server";
+import type { CsrfOptions } from "./types.js";
+export declare const CSRF_FIELD = "_csrf";
+export declare function createSecurityCsrfMiddleware(options?: CsrfOptions): OtokMiddleware;
+//# sourceMappingURL=csrf.d.ts.map

package/dist/csrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAG9E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,eAAO,MAAM,UAAU,UAAU,CAAC;AASlC,wBAAgB,4BAA4B,CAAC,OAAO,GAAE,WAAgB,GAAG,cAAc,CAoCtF"}

package/dist/csrf.js

@@ -0,0 +1,40 @@
+import { defineMiddleware } from "@kamod-ch/otok/server";
+import { getCookie, setCookie } from "hono/cookie";
+import { secureCookieOptions } from "./cookies.js";
+export const CSRF_FIELD = "_csrf";
+const PRODUCTION = () => process.env.NODE_ENV === "production";
+function randomToken() {
+    const bytes = new Uint8Array(32);
+    crypto.getRandomValues(bytes);
+    return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+export function createSecurityCsrfMiddleware(options = {}) {
+    const cookieName = options.cookieName ?? "otok_csrf";
+    const secure = options.secure ?? PRODUCTION();
+    if (PRODUCTION() && secure === false) {
+        throw new Error("otok-security: CSRF cookies must be secure in production");
+    }
+    return defineMiddleware(async (c, next) => {
+        const method = c.req.method.toUpperCase();
+        if (method === "GET" || method === "HEAD") {
+            if (!getCookie(c, cookieName)) {
+                setCookie(c, cookieName, randomToken(), secureCookieOptions({ secure, sameSite: options.sameSite ?? "Lax", httpOnly: false }));
+            }
+            await next();
+            return;
+        }
+        if (["POST", "PUT", "PATCH", "DELETE"].includes(method)) {
+            const contentType = c.req.header("content-type") ?? "";
+            if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
+                const cookieToken = getCookie(c, cookieName);
+                const formData = await c.req.raw.clone().formData();
+                const formToken = formData.get(CSRF_FIELD);
+                if (!cookieToken || typeof formToken !== "string" || formToken !== cookieToken) {
+                    return c.text("CSRF token invalid", 403);
+                }
+            }
+        }
+        await next();
+    });
+}
+//# sourceMappingURL=csrf.js.map

package/dist/csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAuB,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAGnD,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC;AAClC,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAE/D,SAAS,WAAW;IAClB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,UAAuB,EAAE;IACpE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,WAAW,CAAC;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;IAC9C,IAAI,UAAU,EAAE,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IAED,OAAO,gBAAgB,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACxC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1C,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC;gBAC9B,SAAS,CACP,CAAC,EACD,UAAU,EACV,WAAW,EAAE,EACb,mBAAmB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CACtF,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACxD,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YACvD,IAAI,WAAW,CAAC,QAAQ,CAAC,mCAAmC,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBAC7G,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;gBAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC;gBACpD,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAC3C,IAAI,CAAC,WAAW,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;oBAC/E,OAAO,CAAC,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export { secureCookieOptions, resolveSecureCookieDefaults, readSecureCookieDefaults } from "./cookies.js";
+export { CSRF_FIELD, createSecurityCsrfMiddleware } from "./csrf.js";
+export { configureSecurityApp, createOpenRedirectGuard, createRateLimitMiddleware, assertSecureConfiguration, } from "./middleware.js";
+export { default } from "./plugin.js";
+export { safeRedirectTarget, isSafeRedirect } from "./redirect.js";
+export { createMemoryRateLimitProvider } from "./rate-limit.js";
+export type { ContentSecurityPolicyOptionHandler, CorsOptions, CspOptions, CsrfOptions, OpenRedirectOptions, ProxyOptions, RateLimitContext, RateLimitProvider, RateLimitResult, SecureCookieDefaults, SecureHeadersOptions, SecurityPluginOptions, } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAC1G,OAAO,EAAE,UAAU,EAAE,4BAA4B,EAAE,MAAM,WAAW,CAAC;AACrE,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,iBAAiB,CAAC;AAChE,YAAY,EACV,kCAAkC,EAClC,WAAW,EACX,UAAU,EACV,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,7 @@
+export { secureCookieOptions, resolveSecureCookieDefaults, readSecureCookieDefaults } from "./cookies.js";
+export { CSRF_FIELD, createSecurityCsrfMiddleware } from "./csrf.js";
+export { configureSecurityApp, createOpenRedirectGuard, createRateLimitMiddleware, assertSecureConfiguration, } from "./middleware.js";
+export { default } from "./plugin.js";
+export { safeRedirectTarget, isSafeRedirect } from "./redirect.js";
+export { createMemoryRateLimitProvider } from "./rate-limit.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAC1G,OAAO,EAAE,UAAU,EAAE,4BAA4B,EAAE,MAAM,WAAW,CAAC;AACrE,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/middleware.d.ts

@@ -0,0 +1,10 @@
+import type { Hono } from "hono";
+import { createSecurityCsrfMiddleware } from "./csrf.js";
+import { createOpenRedirectGuard } from "./redirect.js";
+import { createRateLimitMiddleware } from "./rate-limit.js";
+import type { SecurityPluginOptions } from "./types.js";
+export declare function assertSecureConfiguration(options: SecurityPluginOptions): void;
+/** Apply security middleware stack to a Hono app. Order: rate limit → host → redirect guard → body limit → CORS → CSRF → headers/CSP. */
+export declare function configureSecurityApp(app: Hono, options: SecurityPluginOptions): void;
+export { createOpenRedirectGuard, createRateLimitMiddleware, createSecurityCsrfMiddleware };
+//# sourceMappingURL=middleware.d.ts.map

package/dist/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAMjC,OAAO,EAAE,4BAA4B,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,KAAK,EAAc,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAuDpE,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAa9E;AAED,yIAAyI;AACzI,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,GAAG,IAAI,CA+DpF;AAED,OAAO,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,CAAC"}

package/dist/middleware.js

@@ -0,0 +1,120 @@
+import { cors } from "hono/cors";
+import { bodyLimit } from "hono/body-limit";
+import { secureHeaders } from "hono/secure-headers";
+import { defineMiddleware } from "@kamod-ch/otok/server";
+import { attachSecureCookieDefaults, resolveSecureCookieDefaults } from "./cookies.js";
+import { createSecurityCsrfMiddleware } from "./csrf.js";
+import { createOpenRedirectGuard } from "./redirect.js";
+import { createRateLimitMiddleware } from "./rate-limit.js";
+function isProduction() {
+    return process.env.NODE_ENV === "production";
+}
+const DEFAULT_CSP = {
+    "default-src": "'self'",
+    "base-uri": "'self'",
+    "font-src": "'self'",
+    "form-action": "'self'",
+    "frame-ancestors": "'none'",
+    "img-src": "'self' data: https:",
+    "object-src": "'none'",
+    "script-src": "'self'",
+    "style-src": "'self' 'unsafe-inline'",
+    "upgrade-insecure-requests": "",
+};
+function normalizeHosts(hosts) {
+    return (hosts ?? []).map((host) => host.toLowerCase());
+}
+function buildCspDirectives(options) {
+    const base = { ...DEFAULT_CSP };
+    if (!options || options === true)
+        return base;
+    for (const [key, value] of Object.entries(options.directives ?? {})) {
+        base[key] = Array.isArray(value) ? value.join(" ") : value;
+    }
+    if (options.reportUri)
+        base["report-uri"] = options.reportUri;
+    return base;
+}
+function createHostValidationMiddleware(trustedHosts, trustedOrigins) {
+    const hosts = normalizeHosts(trustedHosts);
+    const origins = new Set(trustedOrigins.map((o) => o.replace(/\/$/, "")));
+    return defineMiddleware(async (c, next) => {
+        const host = c.req.header("host")?.split(":")[0]?.toLowerCase();
+        if (hosts.length > 0 && host && !hosts.includes(host)) {
+            return c.text("Invalid Host", 400);
+        }
+        const method = c.req.method.toUpperCase();
+        if (origins.size > 0 && ["POST", "PUT", "PATCH", "DELETE"].includes(method)) {
+            const origin = c.req.header("origin");
+            if (origin && !origins.has(origin.replace(/\/$/, ""))) {
+                return c.text("Invalid Origin", 403);
+            }
+        }
+        await next();
+    });
+}
+export function assertSecureConfiguration(options) {
+    if (options.strict === false)
+        return;
+    if (!isProduction())
+        return;
+    if (options.csp === false) {
+        throw new Error("otok-security: CSP cannot be disabled in production (set strict: false to override)");
+    }
+    if (options.csrf === false) {
+        throw new Error("otok-security: CSRF cannot be disabled in production (set strict: false to override)");
+    }
+    if (options.secureHeaders === false) {
+        throw new Error("otok-security: secureHeaders cannot be disabled in production");
+    }
+}
+/** Apply security middleware stack to a Hono app. Order: rate limit → host → redirect guard → body limit → CORS → CSRF → headers/CSP. */
+export function configureSecurityApp(app, options) {
+    assertSecureConfiguration(options);
+    const cookieDefaults = resolveSecureCookieDefaults(options.secureCookies ?? true);
+    app.use("*", async (c, next) => {
+        attachSecureCookieDefaults(c, cookieDefaults);
+        await next();
+    });
+    if (options.rateLimit) {
+        app.use("*", createRateLimitMiddleware(options.rateLimit, options.proxy?.clientIpHeader));
+    }
+    const trustedHosts = options.trustedHosts ?? (isProduction() ? [] : undefined);
+    const trustedOrigins = options.trustedOrigins ?? [];
+    if (trustedHosts && trustedHosts.length > 0) {
+        app.use("*", createHostValidationMiddleware(trustedHosts, trustedOrigins));
+    }
+    else if (isProduction() && options.strict !== false) {
+        console.warn("otok-security: trustedHosts is empty in production. Set trustedHosts to your public hostnames.");
+    }
+    if (options.openRedirectGuard !== false) {
+        app.use("*", createOpenRedirectGuard(typeof options.openRedirectGuard === "object" ? options.openRedirectGuard : {}));
+    }
+    if (options.bodyLimit !== false) {
+        app.use("*", bodyLimit({ maxSize: typeof options.bodyLimit === "number" ? options.bodyLimit : 1024 * 1024 }));
+    }
+    if (options.cors) {
+        app.use("*", cors({
+            origin: options.cors.origin,
+            allowMethods: options.cors.allowMethods ?? ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"],
+            allowHeaders: options.cors.allowHeaders,
+            exposeHeaders: options.cors.exposeHeaders,
+            maxAge: options.cors.maxAge,
+            credentials: options.cors.credentials ?? false,
+        }));
+    }
+    const csrfEnabled = options.csrf !== false && (options.csrf === true || isProduction() || typeof options.csrf === "object");
+    if (csrfEnabled) {
+        app.use("*", createSecurityCsrfMiddleware(typeof options.csrf === "object" ? options.csrf : {}));
+    }
+    if (options.secureHeaders !== false) {
+        const cspEnabled = options.csp !== false;
+        const directives = cspEnabled ? buildCspDirectives(typeof options.csp === "object" ? options.csp : {}) : undefined;
+        app.use("*", secureHeaders({
+            contentSecurityPolicy: directives,
+            ...(typeof options.secureHeaders === "object" ? options.secureHeaders.overrides : {}),
+        }));
+    }
+}
+export { createOpenRedirectGuard, createRateLimitMiddleware, createSecurityCsrfMiddleware };
+//# sourceMappingURL=middleware.js.map

package/dist/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAuB,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AACvF,OAAO,EAAE,4BAA4B,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAG5D,SAAS,YAAY;IACnB,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAC/C,CAAC;AAED,MAAM,WAAW,GAA2B;IAC1C,aAAa,EAAE,QAAQ;IACvB,UAAU,EAAE,QAAQ;IACpB,UAAU,EAAE,QAAQ;IACpB,aAAa,EAAE,QAAQ;IACvB,iBAAiB,EAAE,QAAQ;IAC3B,SAAS,EAAE,qBAAqB;IAChC,YAAY,EAAE,QAAQ;IACtB,YAAY,EAAE,QAAQ;IACtB,WAAW,EAAE,wBAAwB;IACrC,2BAA2B,EAAE,EAAE;CAChC,CAAC;AAEF,SAAS,cAAc,CAAC,KAA2B;IACjD,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAsC;IAChE,MAAM,IAAI,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;IAChC,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7D,CAAC;IACD,IAAI,OAAO,CAAC,SAAS;QAAE,IAAI,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;IAC9D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,8BAA8B,CAAC,YAAsB,EAAE,cAAwB;IACtF,MAAM,KAAK,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAEzE,OAAO,gBAAgB,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACxC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QAChE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5E,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;gBACtD,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAA8B;IACtE,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO;IACrC,IAAI,CAAC,YAAY,EAAE;QAAE,OAAO;IAE5B,IAAI,OAAO,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;IAC1G,CAAC;IACD,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,yIAAyI;AACzI,MAAM,UAAU,oBAAoB,CAAC,GAAS,EAAE,OAA8B;IAC5E,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAEnC,MAAM,cAAc,GAAG,2BAA2B,CAAC,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC;IAClF,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC7B,0BAA0B,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAC9C,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,yBAAyB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC/E,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;IACpD,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,8BAA8B,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;IAC7E,CAAC;SAAM,IAAI,YAAY,EAAE,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC,gGAAgG,CAAC,CAAC;IACjH,CAAC;IAED,IAAI,OAAO,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;QACxC,GAAG,CAAC,GAAG,CACL,GAAG,EACH,uBAAuB,CAAC,OAAO,OAAO,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,CACxG,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;QAChC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;IAChH,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,GAAG,CAAC,GAAG,CACL,GAAG,EACH,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;YAC3B,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC;YACvG,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY;YACvC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa;YACzC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;YAC3B,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,KAAK;SAC/C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GACf,OAAO,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,YAAY,EAAE,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IAC1G,IAAI,WAAW,EAAE,CAAC;QAChB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,4BAA4B,CAAC,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnG,CAAC;IAED,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC;QACzC,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnH,GAAG,CAAC,GAAG,CACL,GAAG,EACH,aAAa,CAAC;YACZ,qBAAqB,EAAE,UAAU;YACjC,GAAG,CAAC,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;SACtF,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,OAAO,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,CAAC"}

package/dist/plugin.d.ts

@@ -0,0 +1,16 @@
+import { configureSecurityApp } from "./middleware.js";
+import type { SecurityPluginOptions } from "./types.js";
+/**
+ * Otok security plugin — secure defaults with explicit opt-out.
+ *
+ * ```ts
+ * import security from "@kamod-ch/otok-security";
+ *
+ * export default defineConfig({
+ *   plugins: [security({ trustedHosts: ["example.com"], cors: { origin: "https://app.example.com" } })],
+ * });
+ * ```
+ */
+export default function security(options?: SecurityPluginOptions): import("@kamod-ch/otok-config").OtokPlugin<unknown>;
+export { configureSecurityApp };
+//# sourceMappingURL=plugin.d.ts.map

package/dist/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAexD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,OAAO,UAAU,QAAQ,CAAC,OAAO,GAAE,qBAA0B,uDAMnE;AAED,OAAO,EAAE,oBAAoB,EAAE,CAAC"}

package/dist/plugin.js

@@ -0,0 +1,34 @@
+import { definePlugin } from "@kamod-ch/otok";
+import { configureSecurityApp } from "./middleware.js";
+const securityPluginFactory = definePlugin({
+    name: "@kamod-ch/otok-security",
+    version: "1.0.0",
+    schema: {
+        parse(input) {
+            if (input != null && typeof input !== "object") {
+                throw new Error("security() options must be an object");
+            }
+            return (input ?? {});
+        },
+    },
+});
+/**
+ * Otok security plugin — secure defaults with explicit opt-out.
+ *
+ * ```ts
+ * import security from "@kamod-ch/otok-security";
+ *
+ * export default defineConfig({
+ *   plugins: [security({ trustedHosts: ["example.com"], cors: { origin: "https://app.example.com" } })],
+ * });
+ * ```
+ */
+export default function security(options = {}) {
+    const plugin = securityPluginFactory(options);
+    plugin.configureApp = ({ app }) => {
+        configureSecurityApp(app, options);
+    };
+    return plugin;
+}
+export { configureSecurityApp };
+//# sourceMappingURL=plugin.js.map

package/dist/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAGvD,MAAM,qBAAqB,GAAG,YAAY,CAAwB;IAChE,IAAI,EAAE,yBAAyB;IAC/B,OAAO,EAAE,OAAO;IAChB,MAAM,EAAE;QACN,KAAK,CAAC,KAAK;YACT,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,CAAC,KAAK,IAAI,EAAE,CAA0B,CAAC;QAChD,CAAC;KACF;CACF,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,OAAO,UAAU,QAAQ,CAAC,UAAiC,EAAE;IAClE,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;QAChC,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,OAAO,EAAE,oBAAoB,EAAE,CAAC"}

package/dist/rate-limit.d.ts

@@ -0,0 +1,9 @@
+import { type OtokMiddleware } from "@kamod-ch/otok/server";
+import type { RateLimitProvider } from "./types.js";
+export declare function createRateLimitMiddleware(provider: RateLimitProvider, ipHeader?: string): OtokMiddleware;
+/** In-memory rate limit provider for development and tests. */
+export declare function createMemoryRateLimitProvider(options: {
+    limit: number;
+    windowMs: number;
+}): RateLimitProvider;
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../src/rate-limit.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,QAAQ,SAAoB,GAAG,cAAc,CAwBnH;AAQD,+DAA+D;AAC/D,wBAAgB,6BAA6B,CAAC,OAAO,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,iBAAiB,CA6B7G"}

package/dist/rate-limit.js

@@ -0,0 +1,65 @@
+import { defineMiddleware } from "@kamod-ch/otok/server";
+export function createRateLimitMiddleware(provider, ipHeader = "x-forwarded-for") {
+    return defineMiddleware(async (c, next) => {
+        const ip = resolveClientIp(c, ipHeader);
+        const result = await provider.check({
+            key: ip ?? c.req.header("cf-connecting-ip") ?? "unknown",
+            method: c.req.method,
+            path: new URL(c.req.url).pathname,
+            ip,
+        });
+        if (!result.allowed) {
+            if (result.limit != null)
+                c.header("x-ratelimit-limit", String(result.limit));
+            if (result.remaining != null)
+                c.header("x-ratelimit-remaining", String(result.remaining));
+            if (result.resetAt != null)
+                c.header("x-ratelimit-reset", String(result.resetAt));
+            const retry = result.retryAfterSeconds ?? 60;
+            c.header("retry-after", String(retry));
+            return c.text("Too Many Requests", 429);
+        }
+        if (result.limit != null)
+            c.header("x-ratelimit-limit", String(result.limit));
+        if (result.remaining != null)
+            c.header("x-ratelimit-remaining", String(result.remaining));
+        await next();
+    });
+}
+function resolveClientIp(c, header) {
+    const raw = c.req.header(header);
+    if (!raw)
+        return undefined;
+    return raw.split(",")[0]?.trim();
+}
+/** In-memory rate limit provider for development and tests. */
+export function createMemoryRateLimitProvider(options) {
+    const buckets = new Map();
+    return {
+        check(ctx) {
+            const now = Date.now();
+            const bucket = buckets.get(ctx.key);
+            if (!bucket || bucket.resetAt <= now) {
+                buckets.set(ctx.key, { count: 1, resetAt: now + options.windowMs });
+                return { allowed: true, limit: options.limit, remaining: options.limit - 1, resetAt: now + options.windowMs };
+            }
+            bucket.count += 1;
+            if (bucket.count > options.limit) {
+                return {
+                    allowed: false,
+                    limit: options.limit,
+                    remaining: 0,
+                    resetAt: bucket.resetAt,
+                    retryAfterSeconds: Math.ceil((bucket.resetAt - now) / 1000),
+                };
+            }
+            return {
+                allowed: true,
+                limit: options.limit,
+                remaining: options.limit - bucket.count,
+                resetAt: bucket.resetAt,
+            };
+        },
+    };
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../src/rate-limit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAuB,MAAM,uBAAuB,CAAC;AAG9E,MAAM,UAAU,yBAAyB,CAAC,QAA2B,EAAE,QAAQ,GAAG,iBAAiB;IACjG,OAAO,gBAAgB,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACxC,MAAM,EAAE,GAAG,eAAe,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC;YAClC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,SAAS;YACxD,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;YACpB,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ;YACjC,EAAE;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI;gBAAE,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9E,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI;gBAAE,CAAC,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YAC1F,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI;gBAAE,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAClF,MAAM,KAAK,GAAG,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC;YAC7C,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACvC,OAAO,CAAC,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI;YAAE,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9E,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI;YAAE,CAAC,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAE1F,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,CAAU,EAAE,MAAc;IACjD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AACnC,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,6BAA6B,CAAC,OAA4C;IACxF,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8C,CAAC;IAEtE,OAAO;QACL,KAAK,CAAC,GAAG;YACP,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;gBACrC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACpE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;YAChH,CAAC;YACD,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;YAClB,IAAI,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;gBACjC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,SAAS,EAAE,CAAC;oBACZ,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC;iBAC5D,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK;gBACvC,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/redirect.d.ts

@@ -0,0 +1,9 @@
+import type { Context } from "hono";
+import { type OtokMiddleware } from "@kamod-ch/otok/server";
+import type { OpenRedirectOptions } from "./types.js";
+declare function isSafeRedirect(target: string, origin: string): boolean;
+export declare function createOpenRedirectGuard(options?: OpenRedirectOptions): OtokMiddleware;
+/** Validate a redirect URL before sending a Location header. */
+export declare function safeRedirectTarget(target: string, c: Context): string;
+export { isSafeRedirect };
+//# sourceMappingURL=redirect.d.ts.map

package/dist/redirect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect.d.ts","sourceRoot":"","sources":["../src/redirect.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAoB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAItD,iBAAS,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAU/D;AAED,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,mBAAwB,GAAG,cAAc,CAazF;AAED,gEAAgE;AAChE,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,GAAG,MAAM,CAMrE;AAED,OAAO,EAAE,cAAc,EAAE,CAAC"}

package/dist/redirect.js

@@ -0,0 +1,39 @@
+import { defineMiddleware } from "@kamod-ch/otok/server";
+const DEFAULT_PARAMS = ["redirect", "returnTo", "next", "url", "return", "continue"];
+function isSafeRedirect(target, origin) {
+    if (!target)
+        return false;
+    if (target.startsWith("/") && !target.startsWith("//"))
+        return true;
+    try {
+        const parsed = new URL(target, origin);
+        const base = new URL(origin);
+        return parsed.origin === base.origin;
+    }
+    catch {
+        return false;
+    }
+}
+export function createOpenRedirectGuard(options = {}) {
+    const params = options.params ?? DEFAULT_PARAMS;
+    return defineMiddleware(async (c, next) => {
+        const url = new URL(c.req.url);
+        for (const name of params) {
+            const value = url.searchParams.get(name);
+            if (value && !isSafeRedirect(value, url.origin)) {
+                return c.text("Invalid redirect target", 400);
+            }
+        }
+        await next();
+    });
+}
+/** Validate a redirect URL before sending a Location header. */
+export function safeRedirectTarget(target, c) {
+    const origin = new URL(c.req.url).origin;
+    if (!isSafeRedirect(target, origin)) {
+        throw new Error(`otok-security: unsafe redirect target "${target}"`);
+    }
+    return target;
+}
+export { isSafeRedirect };
+//# sourceMappingURL=redirect.js.map

package/dist/redirect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect.js","sourceRoot":"","sources":["../src/redirect.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAuB,MAAM,uBAAuB,CAAC;AAG9E,MAAM,cAAc,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;AAErF,SAAS,cAAc,CAAC,MAAc,EAAE,MAAc;IACpD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,UAA+B,EAAE;IACvE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC;IAEhD,OAAO,gBAAgB,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACxC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,KAAK,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChD,OAAO,CAAC,CAAC,IAAI,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,CAAU;IAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,0CAA0C,MAAM,GAAG,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,OAAO,EAAE,cAAc,EAAE,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,87 @@
+import type { Context } from "hono";
+import type { ContentSecurityPolicyOptionHandler } from "hono/secure-headers";
+export interface SecurityPluginOptions {
+    /** Enable secure response headers. Default: true. */
+    secureHeaders?: boolean | SecureHeadersOptions;
+    /** Content Security Policy. Default: restrictive baseline. Set `false` to disable (not recommended). */
+    csp?: boolean | CspOptions;
+    /** CSRF protection for form submissions. Default: true in production. */
+    csrf?: boolean | CsrfOptions;
+    /** CORS configuration. Default: disabled (same-origin only). */
+    cors?: false | CorsOptions;
+    /** Request body size limit. Default: 1mb. */
+    bodyLimit?: number | false;
+    /** Trusted hostnames. Requests with mismatched Host are rejected when set. */
+    trustedHosts?: string[];
+    /** Trusted origins for Origin/Referer validation on state-changing requests. */
+    trustedOrigins?: string[];
+    /** Rate limit provider. No limit when omitted. */
+    rateLimit?: RateLimitProvider;
+    /** Block open redirects from query params. Default: true. */
+    openRedirectGuard?: boolean | OpenRedirectOptions;
+    /** Proxy / forwarded header configuration. */
+    proxy?: ProxyOptions;
+    /** Secure cookie defaults applied via middleware hints. Default: true in production. */
+    secureCookies?: boolean | SecureCookieDefaults;
+    /** When true, reject obviously insecure production configuration. Default: true. */
+    strict?: boolean;
+}
+export interface SecureHeadersOptions {
+    /** Override individual secure-headers options from Hono. */
+    overrides?: Record<string, string | boolean>;
+}
+export interface CspOptions {
+    /** CSP directives merged onto secure defaults. */
+    directives?: Record<string, string | string[]>;
+    /** Report-only mode. */
+    reportOnly?: boolean;
+    reportUri?: string;
+}
+export interface CsrfOptions {
+    cookieName?: string;
+    /** Set explicitly — never defaults to false in production when csrf is enabled. */
+    secure?: boolean;
+    sameSite?: "Strict" | "Lax" | "None";
+}
+export interface CorsOptions {
+    origin: string | string[] | ((origin: string, c: Context) => string | null | undefined | Promise<string | null | undefined>);
+    allowMethods?: string[];
+    allowHeaders?: string[];
+    exposeHeaders?: string[];
+    maxAge?: number;
+    credentials?: boolean;
+}
+export interface OpenRedirectOptions {
+    /** Query parameter names to inspect. Default: ["redirect", "returnTo", "next", "url"]. */
+    params?: string[];
+}
+export interface ProxyOptions {
+    /** Trust X-Forwarded-* headers from these proxy hops. Default: 1 when behind a reverse proxy. */
+    trustProxy?: boolean | number;
+    /** Header used for client IP when rate limiting. Default: `x-forwarded-for`. */
+    clientIpHeader?: string;
+}
+export interface SecureCookieDefaults {
+    secure?: boolean;
+    httpOnly?: boolean;
+    sameSite?: "Strict" | "Lax" | "None";
+    path?: string;
+}
+export interface RateLimitContext {
+    key: string;
+    method: string;
+    path: string;
+    ip?: string;
+}
+export interface RateLimitResult {
+    allowed: boolean;
+    limit?: number;
+    remaining?: number;
+    resetAt?: number;
+    retryAfterSeconds?: number;
+}
+export interface RateLimitProvider {
+    check(ctx: RateLimitContext): RateLimitResult | Promise<RateLimitResult>;
+}
+export type { ContentSecurityPolicyOptionHandler };
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,qBAAqB,CAAC;AAE9E,MAAM,WAAW,qBAAqB;IACpC,qDAAqD;IACrD,aAAa,CAAC,EAAE,OAAO,GAAG,oBAAoB,CAAC;IAC/C,wGAAwG;IACxG,GAAG,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IAC3B,yEAAyE;IACzE,IAAI,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC;IAC7B,gEAAgE;IAChE,IAAI,CAAC,EAAE,KAAK,GAAG,WAAW,CAAC;IAC3B,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC3B,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,gFAAgF;IAChF,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,kDAAkD;IAClD,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,6DAA6D;IAC7D,iBAAiB,CAAC,EAAE,OAAO,GAAG,mBAAmB,CAAC;IAClD,8CAA8C;IAC9C,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,wFAAwF;IACxF,aAAa,CAAC,EAAE,OAAO,GAAG,oBAAoB,CAAC;IAC/C,oFAAoF;IACpF,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,UAAU;IACzB,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC/C,wBAAwB;IACxB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mFAAmF;IACnF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;CACtC;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EACF,MAAM,GACN,MAAM,EAAE,GACR,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC;IACrG,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,0FAA0F;IAC1F,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,iGAAiG;IACjG,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC9B,gFAAgF;IAChF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,GAAG,EAAE,gBAAgB,GAAG,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC1E;AAED,YAAY,EAAE,kCAAkC,EAAE,CAAC"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,61 @@
+{
+  "name": "@kamod-ch/otok-security",
+  "version": "1.0.0",
+  "description": "Secure defaults and configurable security middleware for Otok apps.",
+  "homepage": "https://github.com/kamod-ch/otok/tree/main/packages/otok-security#readme",
+  "bugs": {
+    "url": "https://github.com/kamod-ch/otok/issues"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kamod-ch/otok.git",
+    "directory": "packages/otok-security"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./middleware": {
+      "types": "./dist/middleware.d.ts",
+      "default": "./dist/middleware.js"
+    },
+    "./cookies": {
+      "types": "./dist/cookies.d.ts",
+      "default": "./dist/cookies.js"
+    },
+    "./redirect": {
+      "types": "./dist/redirect.d.ts",
+      "default": "./dist/redirect.js"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "devDependencies": {
+    "@kamod-ch/otok": "1.0.0",
+    "@kamod-ch/otok-test": "1.0.0",
+    "@types/node": "^24.12.2",
+    "hono": "^4.13.8",
+    "typescript": "~6.0.2",
+    "vitest": "^4.1.2"
+  },
+  "peerDependencies": {
+    "@kamod-ch/otok": ">=0.6.1",
+    "hono": ">=4"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  }
+}