@lovrozagar/honey 0.7.2 → 1.0.0-rc.1

package/dist/cookie-sign.js

@@ -1,104 +0,0 @@
-const encoder = new TextEncoder();
-/**
- * Signed value formats:
- *
- * - v2 (current): `<value>.~<sig>`, where `sig` is the HMAC-SHA256 of
- *   `"honey-cookie-v2\0" + name + "\0" + value`. The cookie name is bound into
- *   the MAC, so a signature cannot be replayed under another cookie that shares
- *   the secret. `~` is outside the base64url alphabet, so the two formats never
- *   overlap.
- * - v1 (legacy): `<value>.<sig>`, the HMAC of the value alone. `verify` accepts
- *   it while `legacy` is true (the default) so cookies issued before the change
- *   keep working during a migration window.
- */
-const V2_MARKER = "~";
-const V2_DOMAIN = "honey-cookie-v2\0";
-/* An HMAC-SHA256 tag is 32 bytes: 43 base64url characters, no padding. */
-const SIG_RE = /^[A-Za-z0-9_-]{43}$/;
-const MAX_CACHED_KEYS = 32;
-const keyCache = new Map();
-function importKey(secret) {
-    let key = keyCache.get(secret);
-    if (key === undefined) {
-        key = crypto.subtle.importKey("raw", encoder.encode(secret), { hash: "SHA-256", name: "HMAC" }, false, [
-            "sign",
-            "verify",
-        ]);
-        if (keyCache.size >= MAX_CACHED_KEYS) {
-            const oldest = keyCache.keys().next().value;
-            if (oldest !== undefined)
-                keyCache.delete(oldest);
-        }
-        keyCache.set(secret, key);
-        /* A rejected import must not stay cached. */
-        key.catch(() => keyCache.delete(secret));
-    }
-    return key;
-}
-function toBase64Url(buffer) {
-    const bytes = new Uint8Array(buffer);
-    let binary = "";
-    for (let i = 0; i < bytes.length; i++) {
-        binary += String.fromCharCode(bytes[i]);
-    }
-    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-/** Strict decode: the input must be the canonical encoding of a 32-byte tag. */
-function fromBase64Url(str) {
-    if (!SIG_RE.test(str))
-        return null;
-    let binary;
-    try {
-        binary = atob(str.replace(/-/g, "+").replace(/_/g, "/"));
-    }
-    catch {
-        return null;
-    }
-    const bytes = new Uint8Array(binary.length);
-    for (let i = 0; i < binary.length; i++) {
-        bytes[i] = binary.charCodeAt(i);
-    }
-    /* Reject non-zero trailing bits, which would make signatures malleable. */
-    if (toBase64Url(bytes.buffer) !== str)
-        return null;
-    return bytes;
-}
-function v2Payload(name, value) {
-    return encoder.encode(`${V2_DOMAIN}${name}\0${value}`);
-}
-export async function sign(value, secret, opts = {}) {
-    const key = await importKey(secret);
-    const signature = await crypto.subtle.sign("HMAC", key, v2Payload(opts.name ?? "", value));
-    return `${value}.${V2_MARKER}${toBase64Url(signature)}`;
-}
-/** Returns the original value, or `null` when no secret verifies it or the input is malformed. */
-export async function verify(signed, secrets, opts = {}) {
-    if (typeof signed !== "string" || signed.length === 0)
-        return null;
-    const lastDot = signed.lastIndexOf(".");
-    if (lastDot === -1)
-        return null;
-    const value = signed.slice(0, lastDot);
-    let sigText = signed.slice(lastDot + 1);
-    const isV2 = sigText.startsWith(V2_MARKER);
-    if (isV2)
-        sigText = sigText.slice(V2_MARKER.length);
-    else if (opts.legacy === false)
-        return null;
-    const sig = fromBase64Url(sigText);
-    if (sig === null)
-        return null;
-    const payload = isV2 ? v2Payload(opts.name ?? "", value) : encoder.encode(value);
-    for (const secret of secrets) {
-        try {
-            const key = await importKey(secret);
-            if (await crypto.subtle.verify("HMAC", key, sig, payload))
-                return value;
-        }
-        catch {
-            /* An unusable secret never verifies. */
-        }
-    }
-    return null;
-}
-//# sourceMappingURL=cookie-sign.js.map

package/dist/cookie-sign.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cookie-sign.js","sourceRoot":"","sources":["../src/cookie-sign.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AAEjC;;;;;;;;;;;GAWG;AACH,MAAM,SAAS,GAAG,GAAG,CAAA;AACrB,MAAM,SAAS,GAAG,mBAAmB,CAAA;AACrC,0EAA0E;AAC1E,MAAM,MAAM,GAAG,qBAAqB,CAAA;AAiBpC,MAAM,eAAe,GAAG,EAAE,CAAA;AAC1B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAA;AAEtD,SAAS,SAAS,CAAC,MAAc;IAChC,IAAI,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAC9B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACvB,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE;YACtG,MAAM;YACN,QAAQ;SACR,CAAC,CAAA;QACF,IAAI,QAAQ,CAAC,IAAI,IAAI,eAAe,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YAC3C,IAAI,MAAM,KAAK,SAAS;gBAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAClD,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACzB,6CAA6C;QAC7C,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IACzC,CAAC;IACD,OAAO,GAAG,CAAA;AACX,CAAC;AAED,SAAS,WAAW,CAAC,MAAmB;IACvC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;IACpC,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACxC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AAC/E,CAAC;AAED,gFAAgF;AAChF,SAAS,aAAa,CAAC,GAAW;IACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,IAAI,MAAc,CAAA;IAClB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;IACzD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAChC,CAAC;IACD,2EAA2E;IAC3E,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAClD,OAAO,KAAK,CAAA;AACb,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,KAAa;IAC7C,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,SAAS,GAAG,IAAI,KAAK,KAAK,EAAE,CAAC,CAAA;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,KAAa,EAAE,MAAc,EAAE,IAAI,GAAgB,EAAE;IAC/E,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAA;IACnC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC,CAAA;IAC1F,OAAO,GAAG,KAAK,IAAI,SAAS,GAAG,WAAW,CAAC,SAAS,CAAC,EAAE,CAAA;AACxD,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,MAAc,EAAE,OAAiB,EAAE,IAAI,GAAkB,EAAE;IACvF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAClE,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACvC,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAE/B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;IACtC,IAAI,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAA;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;IAC1C,IAAI,IAAI;QAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;SAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IAE3C,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;IAClC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAEhF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAA;YACnC,IAAI,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC;gBAAE,OAAO,KAAK,CAAA;QACxE,CAAC;QAAC,MAAM,CAAC;YACR,wCAAwC;QACzC,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAA;AACZ,CAAC"}

package/dist/cookie.d.ts

@@ -1,24 +0,0 @@
-export type CookieOptions = {
-    domain?: string;
-    expires?: Date;
-    httpOnly?: boolean;
-    maxAge?: number;
-    path?: string;
-    sameSite?: "lax" | "none" | "strict";
-    secure?: boolean;
-    value: string;
-};
-/**
- * Decode `%XX` sequences that form valid UTF-8 and keep every other byte as
- * sent. A stray `%` in a foreign cookie no longer disables decoding for the
- * whole value.
- */
-export declare function decodeCookieValue(value: string): string;
-/**
- * Parse a `Cookie` request header. When a name repeats, the first value wins:
- * browsers send the cookie with the most specific path first (RFC 6265 §5.4).
- * Names are trimmed on both sides; empty names and prototype keys are skipped.
- */
-export declare function parseCookieHeader(header: string): Record<string, string>;
-export declare function serializeCookie(name: string, opts: CookieOptions): string;
-//# sourceMappingURL=cookie.d.ts.map

package/dist/cookie.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cookie.d.ts","sourceRoot":"","sources":["../src/cookie.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,IAAI,CAAA;IACd,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAA;IACpC,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;CACb,CAAA;AA+BD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAavD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgBxE;AAMD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,MAAM,CAuDzE"}

package/dist/cookie.js

@@ -1,138 +0,0 @@
-const UNSAFE_KEYS = new Set(["__proto__", "constructor", "prototype"]);
-/**
- * Percent-encode characters outside the RFC 6265 cookie-octet range, plus `%`
- * itself so the value always decodes back to what was set.
- * Cookie-octets: 0x21, 0x23-0x2B, 0x2D-0x3A, 0x3C-0x5B, 0x5D-0x7E
- */
-function encodeCookieValue(value) {
-    let encoded = "";
-    for (const ch of value) {
-        const c = ch.codePointAt(0) ?? 0;
-        if (c !== 0x25 &&
-            (c === 0x21 ||
-                (c >= 0x23 && c <= 0x2b) ||
-                (c >= 0x2d && c <= 0x3a) ||
-                (c >= 0x3c && c <= 0x5b) ||
-                (c >= 0x5d && c <= 0x7e))) {
-            encoded += ch;
-        }
-        else if (c >= 0xd800 && c <= 0xdfff) {
-            throw new TypeError("Cookie value contains a lone surrogate and cannot be encoded");
-        }
-        else {
-            encoded += encodeURIComponent(ch);
-        }
-    }
-    return encoded;
-}
-/**
- * Decode `%XX` sequences that form valid UTF-8 and keep every other byte as
- * sent. A stray `%` in a foreign cookie no longer disables decoding for the
- * whole value.
- */
-export function decodeCookieValue(value) {
-    if (value.indexOf("%") === -1)
-        return value;
-    try {
-        return decodeURIComponent(value);
-    }
-    catch {
-        return value.replace(/(?:%[0-9A-Fa-f]{2})+/g, (run) => {
-            try {
-                return decodeURIComponent(run);
-            }
-            catch {
-                return run;
-            }
-        });
-    }
-}
-/**
- * Parse a `Cookie` request header. When a name repeats, the first value wins:
- * browsers send the cookie with the most specific path first (RFC 6265 §5.4).
- * Names are trimmed on both sides; empty names and prototype keys are skipped.
- */
-export function parseCookieHeader(header) {
-    const result = {};
-    if (header.length === 0)
-        return result;
-    for (const pair of header.split(";")) {
-        const eqIdx = pair.indexOf("=");
-        if (eqIdx === -1)
-            continue;
-        const name = pair.slice(0, eqIdx).trim();
-        if (name.length === 0 || UNSAFE_KEYS.has(name) || Object.hasOwn(result, name))
-            continue;
-        let value = pair.slice(eqIdx + 1).trim();
-        /* RFC 6265: strip surrounding double quotes before decoding, so an encoded quote survives. */
-        if (value.length >= 2 && value.charCodeAt(0) === 34 && value.charCodeAt(value.length - 1) === 34) {
-            value = value.slice(1, -1);
-        }
-        result[name] = decodeCookieValue(value);
-    }
-    return result;
-}
-const validCookieNameRe = /^[\w!#$%&'*.^`|~+-]+$/;
-/* A host name or IP literal, optionally with a leading dot. */
-const validDomainRe = /^\.?(?:[A-Za-z0-9-]+\.)*[A-Za-z0-9-]+$|^\[[0-9A-Fa-f:.]+\]$/;
-export function serializeCookie(name, opts) {
-    if (!validCookieNameRe.test(name)) {
-        throw new Error(`Invalid cookie name: ${JSON.stringify(name)}`);
-    }
-    let secure = opts.secure;
-    let path = opts.path;
-    /* Browsers match the prefixes case-insensitively (RFC 6265bis §4.1.3). */
-    const lower = name.toLowerCase();
-    if (lower.startsWith("__host-")) {
-        if (!opts.secure)
-            throw new Error("__Host- cookies require secure: true");
-        if (opts.domain)
-            throw new Error("__Host- cookies must not set domain");
-        if (opts.path !== "/" && opts.path !== undefined) {
-            throw new Error("__Host- cookies must have path: '/'");
-        }
-        secure = true;
-        path = path ?? "/";
-    }
-    else if (lower.startsWith("__secure-")) {
-        if (!opts.secure)
-            throw new Error("__Secure- cookies require secure: true");
-        secure = true;
-    }
-    if (opts.sameSite === "none" && !secure) {
-        throw new Error("SameSite=None cookies require secure: true");
-    }
-    if (opts.domain && !validDomainRe.test(opts.domain)) {
-        throw new Error("Cookie domain contains invalid characters");
-    }
-    /* av-value: any CHAR except CTLs or ";" (RFC 6265 §4.1.1). */
-    if (path && /[^\x20-\x3a\x3c-\x7e]/.test(path)) {
-        throw new Error("Cookie path contains invalid characters");
-    }
-    let cookie = `${name}=${encodeCookieValue(opts.value)}`;
-    if (opts.domain)
-        cookie += `; Domain=${opts.domain}`;
-    if (path)
-        cookie += `; Path=${path}`;
-    if (opts.maxAge !== undefined) {
-        if (!Number.isFinite(opts.maxAge) || opts.maxAge < 0) {
-            throw new Error(`Invalid cookie Max-Age: ${opts.maxAge}`);
-        }
-        /* Clamp so the value prints as digits; browsers cap Max-Age at 400 days anyway. */
-        cookie += `; Max-Age=${Math.min(Math.floor(opts.maxAge), Number.MAX_SAFE_INTEGER)}`;
-    }
-    if (opts.expires) {
-        if (Number.isNaN(opts.expires.getTime())) {
-            throw new Error("Invalid cookie Expires: date is invalid");
-        }
-        cookie += `; Expires=${opts.expires.toUTCString()}`;
-    }
-    if (opts.httpOnly)
-        cookie += "; HttpOnly";
-    if (secure)
-        cookie += "; Secure";
-    if (opts.sameSite)
-        cookie += `; SameSite=${opts.sameSite.charAt(0).toUpperCase()}${opts.sameSite.slice(1)}`;
-    return cookie;
-}
-//# sourceMappingURL=cookie.js.map

package/dist/cookie.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cookie.js","sourceRoot":"","sources":["../src/cookie.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;AAEtE;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,KAAa;IACvC,IAAI,OAAO,GAAG,EAAE,CAAA;IAChB,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAChC,IACC,CAAC,KAAK,IAAI;YACV,CAAC,CAAC,KAAK,IAAI;gBACV,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC;gBACxB,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC;gBACxB,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC;gBACxB,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,EACzB,CAAC;YACF,OAAO,IAAI,EAAE,CAAA;QACd,CAAC;aAAM,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC;YACvC,MAAM,IAAI,SAAS,CAAC,8DAA8D,CAAC,CAAA;QACpF,CAAC;aAAM,CAAC;YACP,OAAO,IAAI,kBAAkB,CAAC,EAAE,CAAC,CAAA;QAClC,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAA;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IAC3C,IAAI,CAAC;QACJ,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC,GAAG,EAAE,EAAE;YACrD,IAAI,CAAC;gBACJ,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAA;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,GAAG,CAAA;YACX,CAAC;QACF,CAAC,CAAC,CAAA;IACH,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC/C,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAA;IACtC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAQ;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAA;QACxC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;YAAE,SAAQ;QACvF,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACxC,8FAA8F;QAC9F,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAClG,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAC3B,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAA;IACxC,CAAC;IACD,OAAO,MAAM,CAAA;AACd,CAAC;AAED,MAAM,iBAAiB,GAAG,uBAAuB,CAAA;AACjD,+DAA+D;AAC/D,MAAM,aAAa,GAAG,6DAA6D,CAAA;AAEnF,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,IAAmB;IAChE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IACxB,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;IAEpB,0EAA0E;IAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IAChC,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;QACzE,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QACvE,IAAI,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QACvD,CAAC;QACD,MAAM,GAAG,IAAI,CAAA;QACb,IAAI,GAAG,IAAI,IAAI,GAAG,CAAA;IACnB,CAAC;SAAM,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;QAC3E,MAAM,GAAG,IAAI,CAAA;IACd,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;IAC9D,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;IAC7D,CAAC;IACD,8DAA8D;IAC9D,IAAI,IAAI,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC3D,CAAC;IAED,IAAI,MAAM,GAAG,GAAG,IAAI,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAA;IACvD,IAAI,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,YAAY,IAAI,CAAC,MAAM,EAAE,CAAA;IACpD,IAAI,IAAI;QAAE,MAAM,IAAI,UAAU,IAAI,EAAE,CAAA;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;QAC1D,CAAC;QACD,mFAAmF;QACnF,MAAM,IAAI,aAAa,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAA;IACpF,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;QAC3D,CAAC;QACD,MAAM,IAAI,aAAa,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAA;IACpD,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,YAAY,CAAA;IACzC,IAAI,MAAM;QAAE,MAAM,IAAI,UAAU,CAAA;IAChC,IAAI,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,cAAc,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;IAC3G,OAAO,MAAM,CAAA;AACd,CAAC"}

package/dist/cors.d.ts

@@ -1,14 +0,0 @@
-import type { MiddlewareFn } from "./middleware.ts";
-export type CORSOptions = {
-    /** Requires an explicit `origin` list, string or predicate; `"*"` or no origin throws. */
-    credentials?: boolean;
-    exposeHeaders?: string[];
-    headers?: string[];
-    maxAge?: number;
-    methods?: string[];
-    origin?: "*" | ((origin: string) => boolean) | string | string[];
-};
-export declare function cors(options?: CORSOptions): MiddlewareFn<{
-    req: Request;
-}, {}>;
-//# sourceMappingURL=cors.d.ts.map

package/dist/cors.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../src/cors.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAGnD,MAAM,MAAM,WAAW,GAAG;IACzB,0FAA0F;IAC1F,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,MAAM,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;CAChE,CAAA;AA8BD,wBAAgB,IAAI,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,YAAY,CAAC;IAAE,GAAG,EAAE,OAAO,CAAA;CAAE,EAAE,EAAE,CAAC,CAoD9E"}

package/dist/cors.js

@@ -1,87 +0,0 @@
-import { namedMiddleware } from "./middleware.js";
-import { withHeaders } from "./with-headers.js";
-const DEFAULT_METHODS = ["GET", "HEAD", "PUT", "PATCH", "POST", "DELETE"];
-const DEFAULT_MAX_AGE = 86400;
-/**
- * Returns the value for `Access-Control-Allow-Origin`, or null when the origin
- * is not allowed. The opaque origin `null` (sandboxed iframes, `file:`, some
- * redirects) is never reflected: any page can produce it.
- */
-function matchOrigin(origin, config) {
-    if (config === undefined || config === "*")
-        return "*";
-    if (origin === "null")
-        return null;
-    if (typeof config === "string")
-        return config === origin ? origin : null;
-    if (Array.isArray(config))
-        return config.includes(origin) ? origin : null;
-    return config(origin) ? origin : null;
-}
-/** Append `value` to `Vary` unless it is already listed (or `*`). */
-function addVary(headers, value) {
-    const current = headers.get("vary");
-    if (current === null || current.trim() === "") {
-        headers.set("vary", value);
-        return;
-    }
-    const tokens = current.split(",").map((t) => t.trim().toLowerCase());
-    if (tokens.includes("*") || tokens.includes(value.toLowerCase()))
-        return;
-    headers.set("vary", `${current}, ${value}`);
-}
-export function cors(options) {
-    const opts = options ?? {};
-    if (opts.credentials === true && (opts.origin === undefined || opts.origin === "*")) {
-        throw new TypeError("cors: `credentials: true` needs an explicit `origin` (string, list or predicate). A wildcard would let every site make credentialed requests and read the response.");
-    }
-    /* `Vary: Origin` whenever the answer depends on the request's Origin — that is,
-     * on every response unless the policy is a plain wildcard. Without it a shared
-     * cache can serve one origin's ACAO (or its absence) to another. */
-    const varies = !(opts.origin === undefined || opts.origin === "*");
-    const methods = (opts.methods ?? DEFAULT_METHODS).join(", ");
-    const allowHeaders = opts.headers && opts.headers.length > 0 ? opts.headers.join(", ") : null;
-    const exposeHeaders = opts.exposeHeaders && opts.exposeHeaders.length > 0 ? opts.exposeHeaders.join(", ") : null;
-    const maxAge = String(opts.maxAge ?? DEFAULT_MAX_AGE);
-    const mw = async (ctx, next) => {
-        const req = ctx.req;
-        const requestOrigin = req.headers.get("origin");
-        const allowedOrigin = requestOrigin === null ? null : matchOrigin(requestOrigin, opts.origin);
-        if (allowedOrigin !== null && req.method === "OPTIONS" && req.headers.has("access-control-request-method")) {
-            const headers = new Headers();
-            headers.set("access-control-allow-origin", allowedOrigin);
-            headers.set("access-control-allow-methods", methods);
-            if (allowHeaders !== null) {
-                headers.set("access-control-allow-headers", allowHeaders);
-            }
-            else {
-                const requested = req.headers.get("access-control-request-headers");
-                if (requested)
-                    headers.set("access-control-allow-headers", requested);
-                addVary(headers, "Access-Control-Request-Headers");
-            }
-            headers.set("access-control-max-age", maxAge);
-            if (opts.credentials)
-                headers.set("access-control-allow-credentials", "true");
-            if (varies)
-                addVary(headers, "Origin");
-            return new Response(null, { headers, status: 204 });
-        }
-        const response = await next();
-        if (allowedOrigin === null && !varies)
-            return response;
-        return withHeaders(response, (headers) => {
-            if (varies)
-                addVary(headers, "Origin");
-            if (allowedOrigin === null)
-                return;
-            headers.set("access-control-allow-origin", allowedOrigin);
-            if (opts.credentials)
-                headers.set("access-control-allow-credentials", "true");
-            if (exposeHeaders !== null)
-                headers.set("access-control-expose-headers", exposeHeaders);
-        });
-    };
-    return namedMiddleware("cors", mw);
-}
-//# sourceMappingURL=cors.js.map

package/dist/cors.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cors.js","sourceRoot":"","sources":["../src/cors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAEjD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAY/C,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;AACzE,MAAM,eAAe,GAAG,KAAK,CAAA;AAE7B;;;;GAIG;AACH,SAAS,WAAW,CAAC,MAAc,EAAE,MAA6B;IACjE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,GAAG,CAAA;IACtD,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAA;IAClC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;IACxE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;IACzE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;AACtC,CAAC;AAED,qEAAqE;AACrE,SAAS,OAAO,CAAC,OAAgB,EAAE,KAAa;IAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACnC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QAC1B,OAAM;IACP,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;IACpE,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAAE,OAAM;IACxE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,OAAO,KAAK,KAAK,EAAE,CAAC,CAAA;AAC5C,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,OAAqB;IACzC,MAAM,IAAI,GAAG,OAAO,IAAI,EAAE,CAAA;IAE1B,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,SAAS,CAClB,qKAAqK,CACrK,CAAA;IACF,CAAC;IAED;;wEAEoE;IACpE,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,CAAA;IAClE,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC7F,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAChH,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,CAAA;IAErD,MAAM,EAAE,GAAuC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAClE,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAA;QACnB,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC/C,MAAM,aAAa,GAAG,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QAE7F,IAAI,aAAa,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,EAAE,CAAC;YAC5G,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;YAC7B,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,aAAa,CAAC,CAAA;YACzD,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,OAAO,CAAC,CAAA;YACpD,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;gBAC3B,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,YAAY,CAAC,CAAA;YAC1D,CAAC;iBAAM,CAAC;gBACP,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAA;gBACnE,IAAI,SAAS;oBAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,SAAS,CAAC,CAAA;gBACrE,OAAO,CAAC,OAAO,EAAE,gCAAgC,CAAC,CAAA;YACnD,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAA;YAC7C,IAAI,IAAI,CAAC,WAAW;gBAAE,OAAO,CAAC,GAAG,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAA;YAC7E,IAAI,MAAM;gBAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YACtC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAA;QAC7B,IAAI,aAAa,KAAK,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,QAAQ,CAAA;QACtD,OAAO,WAAW,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE;YACxC,IAAI,MAAM;gBAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YACtC,IAAI,aAAa,KAAK,IAAI;gBAAE,OAAM;YAClC,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,aAAa,CAAC,CAAA;YACzD,IAAI,IAAI,CAAC,WAAW;gBAAE,OAAO,CAAC,GAAG,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAA;YAC7E,IAAI,aAAa,KAAK,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,aAAa,CAAC,CAAA;QACxF,CAAC,CAAC,CAAA;IACH,CAAC,CAAA;IAED,OAAO,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AACnC,CAAC"}

package/dist/crypto.d.ts

@@ -1,7 +0,0 @@
-/**
- * Constant-time equality. Both sides are MACed with a per-process random key and
- * the MACs are compared by `crypto.subtle.verify`, so neither content nor length
- * leaks through timing.
- */
-export declare function timingSafeEqual(a: string | Uint8Array, b: string | Uint8Array): Promise<boolean>;
-//# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAyBA;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,EAAE,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAOtG"}

package/dist/crypto.js

@@ -1,38 +0,0 @@
-let cachedKey = null;
-async function getKey() {
-    if (cachedKey === null) {
-        cachedKey = await crypto.subtle.generateKey({ hash: "SHA-256", name: "HMAC" }, false, ["sign", "verify"]);
-    }
-    return cachedKey;
-}
-/**
- * Strings are compared by UTF-16 code unit, not by their UTF-8 encoding: UTF-8
- * replaces every lone surrogate with U+FFFD, so two different strings would
- * compare equal.
- */
-function toBytes(value) {
-    if (typeof value !== "string")
-        return new Uint8Array(value);
-    const bytes = new Uint8Array(value.length * 2);
-    for (let i = 0; i < value.length; i++) {
-        const unit = value.charCodeAt(i);
-        bytes[i * 2] = unit >> 8;
-        bytes[i * 2 + 1] = unit & 0xff;
-    }
-    return bytes;
-}
-/**
- * Constant-time equality. Both sides are MACed with a per-process random key and
- * the MACs are compared by `crypto.subtle.verify`, so neither content nor length
- * leaks through timing.
- */
-export async function timingSafeEqual(a, b) {
-    /* A string never equals bytes: tag the kind so "ab" and its code units differ. */
-    const aIsString = typeof a === "string";
-    if (aIsString !== (typeof b === "string"))
-        return false;
-    const key = await getKey();
-    const sig = await crypto.subtle.sign("HMAC", key, toBytes(a));
-    return crypto.subtle.verify("HMAC", key, sig, toBytes(b));
-}
-//# sourceMappingURL=crypto.js.map

package/dist/crypto.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,IAAI,SAAS,GAAqB,IAAI,CAAA;AAEtC,KAAK,UAAU,MAAM;IACpB,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACxB,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;IAC1G,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAS,OAAO,CAAC,KAA0B;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IAC3D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QAChC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAA;QACxB,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;IAC/B,CAAC;IACD,OAAO,KAAK,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,CAAsB,EAAE,CAAsB;IACnF,kFAAkF;IAClF,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAA;IACvC,IAAI,SAAS,KAAK,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAA;IACvD,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAA;IAC1B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;IAC7D,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;AAC1D,CAAC"}

package/dist/csrf.d.ts

@@ -1,28 +0,0 @@
-import type { MiddlewareFn } from "./middleware.ts";
-type CSRFOptions = {
-    /**
-     * Cross-origin callers allowed to make unsafe requests, matched against the
-     * full `Origin` (`https://app.example.com`). Same-origin requests never need
-     * to be listed.
-     */
-    origin?: ((origin: string) => boolean) | string | string[];
-};
-/**
- * Rejects cross-origin unsafe requests, whatever their content type.
- *
- * 1. `GET`, `HEAD` and `OPTIONS` pass.
- * 2. With `Sec-Fetch-Site` (every current browser sends it): `same-origin` and
- *    `none` (user-initiated) pass. `same-site` and `cross-site` pass only for an
- *    allow-listed `Origin`. A sibling subdomain is same-site but not trusted.
- * 3. Without it: no `Origin` passes (curl, server-to-server, old clients that
- *    cannot be driven cross-site), an `Origin` whose host equals `Host` passes,
- *    an allow-listed `Origin` passes, anything else is rejected.
- *
- * Failure is 403 `forbidden`. This is the algorithm of Go's
- * `http.CrossOriginProtection`.
- */
-export declare function csrf(options?: CSRFOptions): MiddlewareFn<{
-    req: Request;
-}, {}>;
-export {};
-//# sourceMappingURL=csrf.d.ts.map

package/dist/csrf.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAGnD,KAAK,WAAW,GAAG;IAClB;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;CAC1D,CAAA;AAmCD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,IAAI,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,YAAY,CAAC;IAAE,GAAG,EAAE,OAAO,CAAA;CAAE,EAAE,EAAE,CAAC,CAwB9E"}

package/dist/csrf.js

@@ -1,79 +0,0 @@
-import { namedMiddleware } from "./middleware.js";
-import { HoneyError } from "./error.js";
-import { EK, SK } from "./types.js";
-const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
-function matchOrigin(origin, config) {
-    if (config === undefined)
-        return false;
-    if (typeof config === "string")
-        return config === origin;
-    if (Array.isArray(config))
-        return config.includes(origin);
-    return config(origin);
-}
-/** Host of the request as the client addressed it: `Host`, else the URL's host. */
-function requestHost(req) {
-    const host = req.headers.get("host");
-    if (host !== null && host !== "")
-        return host.toLowerCase();
-    try {
-        return new URL(req.url).host.toLowerCase();
-    }
-    catch {
-        return null;
-    }
-}
-function originHost(origin) {
-    if (origin === "null")
-        return null;
-    try {
-        return new URL(origin).host.toLowerCase();
-    }
-    catch {
-        return null;
-    }
-}
-function reject() {
-    throw new HoneyError({ errorKey: EK.forbidden, status: SK.forbidden });
-}
-/**
- * Rejects cross-origin unsafe requests, whatever their content type.
- *
- * 1. `GET`, `HEAD` and `OPTIONS` pass.
- * 2. With `Sec-Fetch-Site` (every current browser sends it): `same-origin` and
- *    `none` (user-initiated) pass. `same-site` and `cross-site` pass only for an
- *    allow-listed `Origin`. A sibling subdomain is same-site but not trusted.
- * 3. Without it: no `Origin` passes (curl, server-to-server, old clients that
- *    cannot be driven cross-site), an `Origin` whose host equals `Host` passes,
- *    an allow-listed `Origin` passes, anything else is rejected.
- *
- * Failure is 403 `forbidden`. This is the algorithm of Go's
- * `http.CrossOriginProtection`.
- */
-export function csrf(options) {
-    const allow = options?.origin;
-    const mw = (ctx, next) => {
-        const req = ctx.req;
-        if (SAFE_METHODS.has(req.method))
-            return next();
-        const origin = req.headers.get("origin");
-        const site = req.headers.get("sec-fetch-site");
-        if (site !== null) {
-            if (site === "same-origin" || site === "none")
-                return next();
-            if (origin !== null && matchOrigin(origin, allow))
-                return next();
-            return reject();
-        }
-        if (origin === null)
-            return next();
-        const host = originHost(origin);
-        if (host !== null && host === requestHost(req))
-            return next();
-        if (matchOrigin(origin, allow))
-            return next();
-        return reject();
-    };
-    return namedMiddleware("csrf", mw);
-}
-//# sourceMappingURL=csrf.js.map

package/dist/csrf.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAEvC,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,YAAY,CAAA;AAWnC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAA;AAExD,SAAS,WAAW,CAAC,MAAc,EAAE,MAA6B;IACjE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IACtC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,KAAK,MAAM,CAAA;IACxD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACzD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAA;AACtB,CAAC;AAED,mFAAmF;AACnF,SAAS,WAAW,CAAC,GAAY;IAChC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACpC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC,WAAW,EAAE,CAAA;IAC3D,IAAI,CAAC;QACJ,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAA;IAC3C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IACjC,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAA;IAClC,IAAI,CAAC;QACJ,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,SAAS,MAAM;IACd,MAAM,IAAI,UAAU,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC,CAAA;AACvE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,IAAI,CAAC,OAAqB;IACzC,MAAM,KAAK,GAAG,OAAO,EAAE,MAAM,CAAA;IAE7B,MAAM,EAAE,GAAuC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;QAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAA;QACnB,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,EAAE,CAAA;QAE/C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACxC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;QAE9C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,MAAM;gBAAE,OAAO,IAAI,EAAE,CAAA;YAC5D,IAAI,MAAM,KAAK,IAAI,IAAI,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAA;YAChE,OAAO,MAAM,EAAE,CAAA;QAChB,CAAC;QAED,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,EAAE,CAAA;QAClC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;QAC/B,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,EAAE,CAAA;QAC7D,IAAI,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,EAAE,CAAA;QAC7C,OAAO,MAAM,EAAE,CAAA;IAChB,CAAC,CAAA;IAED,OAAO,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AACnC,CAAC"}

package/dist/curl-logger.d.ts

@@ -1,44 +0,0 @@
-import type { MiddlewareFn } from "./middleware.ts";
-import type { LoggerInstance } from "./logger.ts";
-type BodyOmittedReason = "content-type" | "disabled" | "missing" | "read-error" | "too-large";
-type CurlLogData = {
-    bodyIncluded: boolean;
-    bodyOmittedReason: BodyOmittedReason | null;
-    curl: string;
-    duration: number;
-    method: string;
-    path: string;
-    requestId: string | null;
-    status: number;
-};
-/** What `skip` sees: everything known before the curl command is built. */
-type CurlSkipData = Pick<CurlLogData, "duration" | "method" | "path" | "requestId" | "status">;
-type CurlLoggerBodyOptions = {
-    allowContentTypes?: string[];
-    maxBytes?: number;
-};
-type CurlLoggerOptions = {
-    body?: boolean | CurlLoggerBodyOptions;
-    instance?: LoggerInstance;
-    log?: (data: CurlLogData) => void;
-    /**
-     * Return the value to log, or null to drop the header. Replaces the default,
-     * which masks `authorization`, `proxy-authorization`, `cookie`, `set-cookie`
-     * and API-key/token headers. Call `defaultRedactHeader` to keep it and add more.
-     */
-    redactHeader?: (name: string, value: string) => string | null;
-    /** Same for query parameters. The default masks token-, key-, secret- and password-like names. */
-    redactQueryParam?: (name: string, value: string) => string | null;
-    /** Runs before the curl command is built; returning true skips all of that work. */
-    skip?: (data: CurlSkipData) => boolean;
-};
-declare function defaultRedactHeader(name: string, value: string): string | null;
-declare function defaultRedactQueryParam(name: string, value: string): string | null;
-declare function buildCurlLogData(request: Request, options?: Pick<CurlLoggerOptions, "body" | "redactHeader" | "redactQueryParam">): Promise<Pick<CurlLogData, "bodyIncluded" | "bodyOmittedReason" | "curl">>;
-declare function curlLogger(options?: CurlLoggerOptions): MiddlewareFn<{
-    path: string;
-    req: Request;
-}, {}>;
-export { buildCurlLogData, curlLogger, defaultRedactHeader, defaultRedactQueryParam };
-export type { BodyOmittedReason, CurlLogData, CurlLoggerBodyOptions, CurlLoggerOptions, CurlSkipData };
-//# sourceMappingURL=curl-logger.d.ts.map

package/dist/curl-logger.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"curl-logger.d.ts","sourceRoot":"","sources":["../src/curl-logger.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAGjD,KAAK,iBAAiB,GAAG,cAAc,GAAG,UAAU,GAAG,SAAS,GAAG,YAAY,GAAG,WAAW,CAAA;AAE7F,KAAK,WAAW,GAAG;IAClB,YAAY,EAAE,OAAO,CAAA;IACrB,iBAAiB,EAAE,iBAAiB,GAAG,IAAI,CAAA;IAC3C,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;CACd,CAAA;AAED,2EAA2E;AAC3E,KAAK,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAC,CAAA;AAE9F,KAAK,qBAAqB,GAAG;IAC5B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,KAAK,iBAAiB,GAAG;IACxB,IAAI,CAAC,EAAE,OAAO,GAAG,qBAAqB,CAAA;IACtC,QAAQ,CAAC,EAAE,cAAc,CAAA;IACzB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,IAAI,CAAA;IACjC;;;;OAIG;IACH,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAA;IAC7D,kGAAkG;IAClG,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAA;IACjE,oFAAoF;IACpF,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,OAAO,CAAA;CACtC,CAAA;AAsBD,iBAAS,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIvE;AAED,iBAAS,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE3E;AAyHD,iBAAe,gBAAgB,CAC9B,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,GAAG,cAAc,GAAG,kBAAkB,CAAC,GAC7E,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,GAAG,mBAAmB,GAAG,MAAM,CAAC,CAAC,CAW3E;AAED,iBAAS,UAAU,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,YAAY,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,OAAO,CAAA;CAAE,EAAE,EAAE,CAAC,CA+CjG;AAED,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,CAAA;AACrF,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,YAAY,EAAE,CAAA"}