@morojs/moro 1.7.30 → 1.8.1

package/dist/core/http/utils/lazy-event-emitter.js

@@ -0,0 +1,69 @@
+// Minimal Node-compatible event emitter with lazy listener storage: nothing
+// allocates until the first listener is added, so request/response objects on
+// the plain JSON fast path pay a single null field for the capability.
+// Backs req.on('close') (SSE/monitor cleanup) and the response lifecycle
+// events ('finish'/'close'/'drain') that stream-oriented middleware needs.
+//
+// Shared, transport-neutral: used by both the uWS adapter (uws-http-server.ts)
+// and the Moro engine adapter (moro-engine-server.ts).
+export class LazyEventEmitter {
+    _events = null;
+    on(event, listener) {
+        const events = (this._events ??= {});
+        (events[event] ??= []).push(listener);
+        return this;
+    }
+    addListener(event, listener) {
+        return this.on(event, listener);
+    }
+    once(event, listener) {
+        const wrapper = (...args) => {
+            this.removeListener(event, wrapper);
+            listener(...args);
+        };
+        wrapper._original = listener;
+        return this.on(event, wrapper);
+    }
+    emit(event, ...args) {
+        const listeners = this._events?.[event];
+        if (!listeners || listeners.length === 0) {
+            // Node EventEmitter contract: an unhandled 'error' event throws instead
+            // of vanishing - code relying on that backstop must not silently no-op.
+            if (event === 'error') {
+                throw args[0] instanceof Error
+                    ? args[0]
+                    : new Error(`Unhandled 'error' event: ${String(args[0])}`);
+            }
+            return false;
+        }
+        // Copy so listeners removing themselves (once) don't skip siblings
+        for (const listener of listeners.slice())
+            listener(...args);
+        return true;
+    }
+    removeListener(event, listener) {
+        const listeners = this._events?.[event];
+        if (listeners) {
+            const index = listeners.findIndex(l => l === listener || l._original === listener);
+            if (index !== -1)
+                listeners.splice(index, 1);
+        }
+        return this;
+    }
+    off(event, listener) {
+        return this.removeListener(event, listener);
+    }
+    removeAllListeners(event) {
+        if (this._events) {
+            if (event)
+                delete this._events[event];
+            else
+                this._events = null;
+        }
+        return this;
+    }
+    listenerCount(event) {
+        return this._events?.[event]?.length ?? 0;
+    }
+}
+//# sourceMappingURL=lazy-event-emitter.js.map

package/dist/core/http/utils/lazy-event-emitter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lazy-event-emitter.js","sourceRoot":"","sources":["../../../../src/core/http/utils/lazy-event-emitter.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,8EAA8E;AAC9E,uEAAuE;AACvE,yEAAyE;AACzE,2EAA2E;AAC3E,EAAE;AACF,+EAA+E;AAC/E,uDAAuD;AACvD,MAAM,OAAO,gBAAgB;IAC3B,OAAO,GAA2D,IAAI,CAAC;IAEvE,EAAE,CAAC,KAAa,EAAE,QAAkC;QAClD,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;QACrC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,WAAW,CAAC,KAAa,EAAE,QAAkC;QAC3D,OAAO,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,CAAC,KAAa,EAAE,QAAkC;QACpD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAW,EAAE,EAAE;YACjC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACpC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;QACpB,CAAC,CAAC;QACD,OAAe,CAAC,SAAS,GAAG,QAAQ,CAAC;QACtC,OAAO,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,CAAC,KAAa,EAAE,GAAG,IAAW;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,wEAAwE;YACxE,wEAAwE;YACxE,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;gBACtB,MAAM,IAAI,CAAC,CAAC,CAAC,YAAY,KAAK;oBAC5B,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;oBACT,CAAC,CAAC,IAAI,KAAK,CAAC,4BAA4B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,mEAAmE;QACnE,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,KAAK,EAAE;YAAE,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,cAAc,CAAC,KAAa,EAAE,QAAkC;QAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,QAAQ,IAAK,CAAS,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC;YAC5F,IAAI,KAAK,KAAK,CAAC,CAAC;gBAAE,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,KAAa,EAAE,QAAkC;QACnD,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAED,kBAAkB,CAAC,KAAc;QAC/B,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,KAAK;gBAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;;gBACjC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QAC3B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,aAAa,CAAC,KAAa;QACzB,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC;IAC5C,CAAC;CACF","sourcesContent":["// Minimal Node-compatible event emitter with lazy listener storage: nothing\n// allocates until the first listener is added, so request/response objects on\n// the plain JSON fast path pay a single null field for the capability.\n// Backs req.on('close') (SSE/monitor cleanup) and the response lifecycle\n// events ('finish'/'close'/'drain') that stream-oriented middleware needs.\n//\n// Shared, transport-neutral: used by both the uWS adapter (uws-http-server.ts)\n// and the Moro engine adapter (moro-engine-server.ts).\nexport class LazyEventEmitter {\n  _events: Record<string, Array<(...args: any[]) => void>> | null = null;\n\n  on(event: string, listener: (...args: any[]) => void): this {\n    const events = (this._events ??= {});\n    (events[event] ??= []).push(listener);\n    return this;\n  }\n\n  addListener(event: string, listener: (...args: any[]) => void): this {\n    return this.on(event, listener);\n  }\n\n  once(event: string, listener: (...args: any[]) => void): this {\n    const wrapper = (...args: any[]) => {\n      this.removeListener(event, wrapper);\n      listener(...args);\n    };\n    (wrapper as any)._original = listener;\n    return this.on(event, wrapper);\n  }\n\n  emit(event: string, ...args: any[]): boolean {\n    const listeners = this._events?.[event];\n    if (!listeners || listeners.length === 0) {\n      // Node EventEmitter contract: an unhandled 'error' event throws instead\n      // of vanishing - code relying on that backstop must not silently no-op.\n      if (event === 'error') {\n        throw args[0] instanceof Error\n          ? args[0]\n          : new Error(`Unhandled 'error' event: ${String(args[0])}`);\n      }\n      return false;\n    }\n    // Copy so listeners removing themselves (once) don't skip siblings\n    for (const listener of listeners.slice()) listener(...args);\n    return true;\n  }\n\n  removeListener(event: string, listener: (...args: any[]) => void): this {\n    const listeners = this._events?.[event];\n    if (listeners) {\n      const index = listeners.findIndex(l => l === listener || (l as any)._original === listener);\n      if (index !== -1) listeners.splice(index, 1);\n    }\n    return this;\n  }\n\n  off(event: string, listener: (...args: any[]) => void): this {\n    return this.removeListener(event, listener);\n  }\n\n  removeAllListeners(event?: string): this {\n    if (this._events) {\n      if (event) delete this._events[event];\n      else this._events = null;\n    }\n    return this;\n  }\n\n  listenerCount(event: string): number {\n    return this._events?.[event]?.length ?? 0;\n  }\n}\n"]}

package/dist/core/http/utils/multipart-parser.d.ts

@@ -0,0 +1,32 @@
+export interface ParsedMultipart {
+    fields: Record<string, string>;
+    files: Record<string, {
+        filename: string;
+        mimetype: string;
+        data: Buffer;
+        size: number;
+    }>;
+}
+export interface MultipartLimits {
+    /** Maximum number of parts (fields + files) before parsing aborts */
+    maxParts?: number;
+    /** Maximum size of one part's header block in bytes */
+    maxPartHeaderBytes?: number;
+    /** Maximum number of file parts before parsing aborts (0/undefined = no limit) */
+    maxFiles?: number;
+    /** Maximum size in bytes of a single file part (0/undefined = no limit) */
+    maxFileSize?: number;
+}
+/** Error thrown when a multipart limit is exceeded; carries a 413 statusCode
+ *  so every server's existing entity-too-large handling picks it up. */
+export declare class MultipartLimitError extends Error {
+    statusCode: number;
+    constructor(message: string);
+}
+/**
+ * Parse a buffered multipart/form-data payload into fields and files.
+ * Duplicate part names are last-wins (matching URLSearchParams-style access).
+ * @throws Error when the content type carries no boundary or the part count
+ *   exceeds the limit
+ */
+export declare function parseMultipart(buffer: Buffer, contentType: string, limits?: MultipartLimits): ParsedMultipart;

package/dist/core/http/utils/multipart-parser.js

@@ -0,0 +1,215 @@
+// Shared multipart/form-data parser used by both the Node http server and the
+// native engine server, so uploads behave identically on either transport.
+// Operates on Buffers throughout - converting the payload to a string would
+// corrupt binary file content.
+//
+// RFC 7578 (multipart/form-data) over RFC 2046 §5.1.1 framing:
+//   - boundary parameter may be quoted and may be followed by other
+//     Content-Type parameters
+//   - parts are delimited by CRLF "--" boundary; the first delimiter may
+//     appear without the leading CRLF (no preamble)
+//   - Content-Disposition parameters are parsed with real quoted-string
+//     handling (a `filename` containing `name=` must not corrupt the field
+//     name) and RFC 5987 `filename*` extended values are honored
+//   - part/header counts are capped so a crafted body cannot amplify one
+//     bounded upload into millions of allocations
+const DEFAULT_MAX_PARTS = 1000;
+const DEFAULT_MAX_PART_HEADER_BYTES = 16 * 1024;
+/** Error thrown when a multipart limit is exceeded; carries a 413 statusCode
+ *  so every server's existing entity-too-large handling picks it up. */
+export class MultipartLimitError extends Error {
+    statusCode = 413;
+    constructor(message) {
+        super(message);
+        this.name = 'MultipartLimitError';
+    }
+}
+const HEADER_SEPARATOR = Buffer.from('\r\n\r\n');
+const CRLF_BUF = Buffer.from('\r\n');
+/**
+ * Extract the boundary parameter from a Content-Type value, honoring quoted
+ * boundaries and ignoring any parameters that follow it.
+ */
+function extractBoundary(contentType) {
+    const match = /;\s*boundary\s*=\s*(?:"([^"]*)"|([^;]+))/i.exec(contentType);
+    if (!match)
+        return null;
+    const raw = (match[1] ?? match[2] ?? '').trim();
+    return raw || null;
+}
+/**
+ * Parse the parameters of a Content-Disposition value with quoted-string and
+ * quoted-pair handling. Returns a Map (not a plain object) so parameter names
+ * like __proto__ cannot interfere with lookups. First occurrence wins.
+ */
+function parseDispositionParams(value) {
+    const params = new Map();
+    let i = value.indexOf(';');
+    while (i !== -1 && i < value.length) {
+        i++; // past ';'
+        while (i < value.length && (value[i] === ' ' || value[i] === '\t'))
+            i++;
+        const eq = value.indexOf('=', i);
+        if (eq === -1)
+            break;
+        const key = value.slice(i, eq).trim().toLowerCase();
+        let val;
+        let j = eq + 1;
+        while (j < value.length && (value[j] === ' ' || value[j] === '\t'))
+            j++;
+        if (value[j] === '"') {
+            j++;
+            const start = j;
+            while (j < value.length && value[j] !== '"') {
+                if (value[j] === '\\' && j + 1 < value.length)
+                    j++; // quoted-pair
+                j++;
+            }
+            val = value.slice(start, j).replace(/\\(.)/g, '$1');
+            i = value.indexOf(';', j + 1);
+        }
+        else {
+            const end = value.indexOf(';', j);
+            val = (end === -1 ? value.slice(j) : value.slice(j, end)).trim();
+            i = end;
+        }
+        if (key && !params.has(key))
+            params.set(key, val);
+    }
+    return params;
+}
+/** Decode an RFC 5987 extended value (charset'lang'percent-encoded). */
+function decodeExtendedValue(value) {
+    const match = /^(utf-8|iso-8859-1)'[^']*'(.+)$/i.exec(value);
+    if (!match)
+        return null;
+    const charset = match[1];
+    const encoded = match[2];
+    if (charset === undefined || encoded === undefined)
+        return null;
+    try {
+        if (charset.toLowerCase() === 'utf-8') {
+            return decodeURIComponent(encoded);
+        }
+        return encoded.replace(/%([0-9a-fA-F]{2})/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Parse a buffered multipart/form-data payload into fields and files.
+ * Duplicate part names are last-wins (matching URLSearchParams-style access).
+ * @throws Error when the content type carries no boundary or the part count
+ *   exceeds the limit
+ */
+export function parseMultipart(buffer, contentType, limits) {
+    const boundary = extractBoundary(contentType);
+    if (!boundary) {
+        throw new Error('Invalid multipart boundary');
+    }
+    const maxParts = limits?.maxParts ?? DEFAULT_MAX_PARTS;
+    const maxHeaderBytes = limits?.maxPartHeaderBytes ?? DEFAULT_MAX_PART_HEADER_BYTES;
+    const maxFiles = limits?.maxFiles ?? 0; // 0 = no limit
+    const maxFileSize = limits?.maxFileSize ?? 0; // 0 = no limit
+    const fileCount = { n: 0 };
+    // Null-prototype objects: a part named "__proto__" is stored as a plain own
+    // key instead of silently vanishing into the prototype setter.
+    const fields = Object.create(null);
+    const files = Object.create(null);
+    const dashBoundary = Buffer.from(`--${boundary}`);
+    const delimiter = Buffer.from(`\r\n--${boundary}`);
+    // Locate the first delimiter: at the very start it appears without the
+    // leading CRLF; otherwise a preamble precedes it (RFC 2046 §5.1.1).
+    let pos;
+    if (buffer.subarray(0, dashBoundary.length).equals(dashBoundary)) {
+        pos = dashBoundary.length;
+    }
+    else {
+        const first = buffer.indexOf(delimiter);
+        if (first === -1)
+            return { fields, files };
+        pos = first + delimiter.length;
+    }
+    let partCount = 0;
+    for (;;) {
+        // After the boundary token: "--" marks the closing delimiter; otherwise
+        // optional padding then CRLF starts the part.
+        if (buffer[pos] === 0x2d && buffer[pos + 1] === 0x2d)
+            break;
+        const lineEnd = buffer.indexOf(CRLF_BUF, pos);
+        if (lineEnd === -1)
+            break;
+        const partStart = lineEnd + 2;
+        const next = buffer.indexOf(delimiter, partStart);
+        const partEnd = next === -1 ? buffer.length : next;
+        if (++partCount > maxParts) {
+            throw new MultipartLimitError(`Multipart payload exceeds ${maxParts} parts`);
+        }
+        // The delimiter includes the part's trailing CRLF, so the slice is the
+        // exact content - no trailing-byte trimming needed.
+        parsePart(buffer.subarray(partStart, partEnd), fields, files, maxHeaderBytes, {
+            maxFiles,
+            maxFileSize,
+            fileCount,
+        });
+        if (next === -1)
+            break;
+        pos = next + delimiter.length;
+    }
+    return { fields, files };
+}
+function parsePart(part, fields, files, maxHeaderBytes, fileLimits) {
+    const headerEndPos = part.indexOf(HEADER_SEPARATOR);
+    if (headerEndPos === -1 || headerEndPos > maxHeaderBytes)
+        return;
+    // Headers are always text - safe to convert to string
+    const headerText = part.subarray(0, headerEndPos).toString('utf8');
+    // Content stays as Buffer to preserve binary data
+    const content = part.subarray(headerEndPos + HEADER_SEPARATOR.length);
+    let disposition;
+    let partContentType;
+    for (const line of headerText.split('\r\n')) {
+        const colon = line.indexOf(':');
+        if (colon === -1)
+            continue;
+        const headerName = line.slice(0, colon).trim().toLowerCase();
+        if (headerName === 'content-disposition') {
+            disposition = line.slice(colon + 1).trim();
+        }
+        else if (headerName === 'content-type') {
+            partContentType = line.slice(colon + 1).trim();
+        }
+    }
+    if (!disposition)
+        return;
+    const params = parseDispositionParams(disposition);
+    const name = params.get('name');
+    // A part without a name cannot be keyed - never fall back to the
+    // (attacker-controlled) filename as the key.
+    if (!name)
+        return;
+    // filename* (RFC 5987) takes precedence over filename (RFC 6266 §4.3)
+    const extendedFilename = params.has('filename*')
+        ? decodeExtendedValue(params.get('filename*'))
+        : null;
+    const filename = extendedFilename ?? params.get('filename');
+    if (filename !== undefined && filename !== null) {
+        if (fileLimits.maxFileSize && content.length > fileLimits.maxFileSize) {
+            throw new MultipartLimitError(`Uploaded file '${filename}' exceeds ${fileLimits.maxFileSize} bytes`);
+        }
+        if (fileLimits.maxFiles && ++fileLimits.fileCount.n > fileLimits.maxFiles) {
+            throw new MultipartLimitError(`Multipart payload exceeds ${fileLimits.maxFiles} files`);
+        }
+        files[name] = {
+            filename,
+            mimetype: partContentType || 'application/octet-stream',
+            data: content,
+            size: content.length,
+        };
+    }
+    else {
+        fields[name] = content.toString('utf8');
+    }
+}
+//# sourceMappingURL=multipart-parser.js.map

package/dist/core/http/utils/multipart-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"multipart-parser.js","sourceRoot":"","sources":["../../../../src/core/http/utils/multipart-parser.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,2EAA2E;AAC3E,4EAA4E;AAC5E,+BAA+B;AAC/B,EAAE;AACF,+DAA+D;AAC/D,oEAAoE;AACpE,8BAA8B;AAC9B,yEAAyE;AACzE,oDAAoD;AACpD,wEAAwE;AACxE,2EAA2E;AAC3E,iEAAiE;AACjE,yEAAyE;AACzE,kDAAkD;AA0BlD,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,MAAM,6BAA6B,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD;wEACwE;AACxE,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,UAAU,GAAG,GAAG,CAAC;IACjB,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAErC;;;GAGG;AACH,SAAS,eAAe,CAAC,WAAmB;IAC1C,MAAM,KAAK,GAAG,2CAA2C,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC5E,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,KAAa;IAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACpC,CAAC,EAAE,CAAC,CAAC,WAAW;QAChB,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;YAAE,CAAC,EAAE,CAAC;QACxE,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACjC,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,MAAM;QACrB,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACf,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;YAAE,CAAC,EAAE,CAAC;QACxE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,CAAC,EAAE,CAAC;YACJ,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC5C,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM;oBAAE,CAAC,EAAE,CAAC,CAAC,cAAc;gBAClE,CAAC,EAAE,CAAC;YACN,CAAC;YACD,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACpD,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAClC,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACjE,CAAC,GAAG,GAAG,CAAC;QACV,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,wEAAwE;AACxE,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,KAAK,GAAG,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAChE,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;YACtC,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,GAAW,EAAE,EAAE,CAC9D,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CACvC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAc,EACd,WAAmB,EACnB,MAAwB;IAExB,MAAM,QAAQ,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,iBAAiB,CAAC;IACvD,MAAM,cAAc,GAAG,MAAM,EAAE,kBAAkB,IAAI,6BAA6B,CAAC;IACnF,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,CAAC,CAAC,CAAC,eAAe;IACvD,MAAM,WAAW,GAAG,MAAM,EAAE,WAAW,IAAI,CAAC,CAAC,CAAC,eAAe;IAC7D,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IAE3B,4EAA4E;IAC5E,+DAA+D;IAC/D,MAAM,MAAM,GAA8B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9D,MAAM,KAAK,GAA6B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAE5D,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAC;IAEnD,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,GAAW,CAAC;IAChB,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QACjE,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC;IAC5B,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC3C,GAAG,GAAG,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC;IACjC,CAAC;IAED,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,SAAS,CAAC;QACR,wEAAwE;QACxE,8CAA8C;QAC9C,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI;YAAE,MAAM;QAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC9C,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,MAAM;QAC1B,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAEnD,IAAI,EAAE,SAAS,GAAG,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,mBAAmB,CAAC,6BAA6B,QAAQ,QAAQ,CAAC,CAAC;QAC/E,CAAC;QACD,uEAAuE;QACvE,oDAAoD;QACpD,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE;YAC5E,QAAQ;YACR,WAAW;YACX,SAAS;SACV,CAAC,CAAC;QAEH,IAAI,IAAI,KAAK,CAAC,CAAC;YAAE,MAAM;QACvB,GAAG,GAAG,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC;IAChC,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,SAAS,CAChB,IAAY,EACZ,MAAiC,EACjC,KAA+B,EAC/B,cAAsB,EACtB,UAA+E;IAE/E,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpD,IAAI,YAAY,KAAK,CAAC,CAAC,IAAI,YAAY,GAAG,cAAc;QAAE,OAAO;IAEjE,sDAAsD;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnE,kDAAkD;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAEtE,IAAI,WAA+B,CAAC;IACpC,IAAI,eAAmC,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAS;QAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC7D,IAAI,UAAU,KAAK,qBAAqB,EAAE,CAAC;YACzC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,CAAC;aAAM,IAAI,UAAU,KAAK,cAAc,EAAE,CAAC;YACzC,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,WAAW;QAAE,OAAO;IAEzB,MAAM,MAAM,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,iEAAiE;IACjE,6CAA6C;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAO;IAElB,sEAAsE;IACtE,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;QAC9C,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAW,CAAC;QACxD,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,QAAQ,GAAG,gBAAgB,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAE5D,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAChD,IAAI,UAAU,CAAC,WAAW,IAAI,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;YACtE,MAAM,IAAI,mBAAmB,CAC3B,kBAAkB,QAAQ,aAAa,UAAU,CAAC,WAAW,QAAQ,CACtE,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,QAAQ,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC;YAC1E,MAAM,IAAI,mBAAmB,CAAC,6BAA6B,UAAU,CAAC,QAAQ,QAAQ,CAAC,CAAC;QAC1F,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG;YACZ,QAAQ;YACR,QAAQ,EAAE,eAAe,IAAI,0BAA0B;YACvD,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,OAAO,CAAC,MAAM;SACrB,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC","sourcesContent":["// Shared multipart/form-data parser used by both the Node http server and the\n// native engine server, so uploads behave identically on either transport.\n// Operates on Buffers throughout - converting the payload to a string would\n// corrupt binary file content.\n//\n// RFC 7578 (multipart/form-data) over RFC 2046 §5.1.1 framing:\n//   - boundary parameter may be quoted and may be followed by other\n//     Content-Type parameters\n//   - parts are delimited by CRLF \"--\" boundary; the first delimiter may\n//     appear without the leading CRLF (no preamble)\n//   - Content-Disposition parameters are parsed with real quoted-string\n//     handling (a `filename` containing `name=` must not corrupt the field\n//     name) and RFC 5987 `filename*` extended values are honored\n//   - part/header counts are capped so a crafted body cannot amplify one\n//     bounded upload into millions of allocations\n\nexport interface ParsedMultipart {\n  fields: Record<string, string>;\n  files: Record<\n    string,\n    {\n      filename: string;\n      mimetype: string;\n      data: Buffer;\n      size: number;\n    }\n  >;\n}\n\nexport interface MultipartLimits {\n  /** Maximum number of parts (fields + files) before parsing aborts */\n  maxParts?: number;\n  /** Maximum size of one part's header block in bytes */\n  maxPartHeaderBytes?: number;\n  /** Maximum number of file parts before parsing aborts (0/undefined = no limit) */\n  maxFiles?: number;\n  /** Maximum size in bytes of a single file part (0/undefined = no limit) */\n  maxFileSize?: number;\n}\n\nconst DEFAULT_MAX_PARTS = 1000;\nconst DEFAULT_MAX_PART_HEADER_BYTES = 16 * 1024;\n\n/** Error thrown when a multipart limit is exceeded; carries a 413 statusCode\n *  so every server's existing entity-too-large handling picks it up. */\nexport class MultipartLimitError extends Error {\n  statusCode = 413;\n  constructor(message: string) {\n    super(message);\n    this.name = 'MultipartLimitError';\n  }\n}\n\nconst HEADER_SEPARATOR = Buffer.from('\\r\\n\\r\\n');\nconst CRLF_BUF = Buffer.from('\\r\\n');\n\n/**\n * Extract the boundary parameter from a Content-Type value, honoring quoted\n * boundaries and ignoring any parameters that follow it.\n */\nfunction extractBoundary(contentType: string): string | null {\n  const match = /;\\s*boundary\\s*=\\s*(?:\"([^\"]*)\"|([^;]+))/i.exec(contentType);\n  if (!match) return null;\n  const raw = (match[1] ?? match[2] ?? '').trim();\n  return raw || null;\n}\n\n/**\n * Parse the parameters of a Content-Disposition value with quoted-string and\n * quoted-pair handling. Returns a Map (not a plain object) so parameter names\n * like __proto__ cannot interfere with lookups. First occurrence wins.\n */\nfunction parseDispositionParams(value: string): Map<string, string> {\n  const params = new Map<string, string>();\n  let i = value.indexOf(';');\n  while (i !== -1 && i < value.length) {\n    i++; // past ';'\n    while (i < value.length && (value[i] === ' ' || value[i] === '\\t')) i++;\n    const eq = value.indexOf('=', i);\n    if (eq === -1) break;\n    const key = value.slice(i, eq).trim().toLowerCase();\n    let val: string;\n    let j = eq + 1;\n    while (j < value.length && (value[j] === ' ' || value[j] === '\\t')) j++;\n    if (value[j] === '\"') {\n      j++;\n      const start = j;\n      while (j < value.length && value[j] !== '\"') {\n        if (value[j] === '\\\\' && j + 1 < value.length) j++; // quoted-pair\n        j++;\n      }\n      val = value.slice(start, j).replace(/\\\\(.)/g, '$1');\n      i = value.indexOf(';', j + 1);\n    } else {\n      const end = value.indexOf(';', j);\n      val = (end === -1 ? value.slice(j) : value.slice(j, end)).trim();\n      i = end;\n    }\n    if (key && !params.has(key)) params.set(key, val);\n  }\n  return params;\n}\n\n/** Decode an RFC 5987 extended value (charset'lang'percent-encoded). */\nfunction decodeExtendedValue(value: string): string | null {\n  const match = /^(utf-8|iso-8859-1)'[^']*'(.+)$/i.exec(value);\n  if (!match) return null;\n  const charset = match[1];\n  const encoded = match[2];\n  if (charset === undefined || encoded === undefined) return null;\n  try {\n    if (charset.toLowerCase() === 'utf-8') {\n      return decodeURIComponent(encoded);\n    }\n    return encoded.replace(/%([0-9a-fA-F]{2})/g, (_, hex: string) =>\n      String.fromCharCode(parseInt(hex, 16))\n    );\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Parse a buffered multipart/form-data payload into fields and files.\n * Duplicate part names are last-wins (matching URLSearchParams-style access).\n * @throws Error when the content type carries no boundary or the part count\n *   exceeds the limit\n */\nexport function parseMultipart(\n  buffer: Buffer,\n  contentType: string,\n  limits?: MultipartLimits\n): ParsedMultipart {\n  const boundary = extractBoundary(contentType);\n  if (!boundary) {\n    throw new Error('Invalid multipart boundary');\n  }\n  const maxParts = limits?.maxParts ?? DEFAULT_MAX_PARTS;\n  const maxHeaderBytes = limits?.maxPartHeaderBytes ?? DEFAULT_MAX_PART_HEADER_BYTES;\n  const maxFiles = limits?.maxFiles ?? 0; // 0 = no limit\n  const maxFileSize = limits?.maxFileSize ?? 0; // 0 = no limit\n  const fileCount = { n: 0 };\n\n  // Null-prototype objects: a part named \"__proto__\" is stored as a plain own\n  // key instead of silently vanishing into the prototype setter.\n  const fields: ParsedMultipart['fields'] = Object.create(null);\n  const files: ParsedMultipart['files'] = Object.create(null);\n\n  const dashBoundary = Buffer.from(`--${boundary}`);\n  const delimiter = Buffer.from(`\\r\\n--${boundary}`);\n\n  // Locate the first delimiter: at the very start it appears without the\n  // leading CRLF; otherwise a preamble precedes it (RFC 2046 §5.1.1).\n  let pos: number;\n  if (buffer.subarray(0, dashBoundary.length).equals(dashBoundary)) {\n    pos = dashBoundary.length;\n  } else {\n    const first = buffer.indexOf(delimiter);\n    if (first === -1) return { fields, files };\n    pos = first + delimiter.length;\n  }\n\n  let partCount = 0;\n  for (;;) {\n    // After the boundary token: \"--\" marks the closing delimiter; otherwise\n    // optional padding then CRLF starts the part.\n    if (buffer[pos] === 0x2d && buffer[pos + 1] === 0x2d) break;\n    const lineEnd = buffer.indexOf(CRLF_BUF, pos);\n    if (lineEnd === -1) break;\n    const partStart = lineEnd + 2;\n    const next = buffer.indexOf(delimiter, partStart);\n    const partEnd = next === -1 ? buffer.length : next;\n\n    if (++partCount > maxParts) {\n      throw new MultipartLimitError(`Multipart payload exceeds ${maxParts} parts`);\n    }\n    // The delimiter includes the part's trailing CRLF, so the slice is the\n    // exact content - no trailing-byte trimming needed.\n    parsePart(buffer.subarray(partStart, partEnd), fields, files, maxHeaderBytes, {\n      maxFiles,\n      maxFileSize,\n      fileCount,\n    });\n\n    if (next === -1) break;\n    pos = next + delimiter.length;\n  }\n\n  return { fields, files };\n}\n\nfunction parsePart(\n  part: Buffer,\n  fields: ParsedMultipart['fields'],\n  files: ParsedMultipart['files'],\n  maxHeaderBytes: number,\n  fileLimits: { maxFiles: number; maxFileSize: number; fileCount: { n: number } }\n): void {\n  const headerEndPos = part.indexOf(HEADER_SEPARATOR);\n  if (headerEndPos === -1 || headerEndPos > maxHeaderBytes) return;\n\n  // Headers are always text - safe to convert to string\n  const headerText = part.subarray(0, headerEndPos).toString('utf8');\n  // Content stays as Buffer to preserve binary data\n  const content = part.subarray(headerEndPos + HEADER_SEPARATOR.length);\n\n  let disposition: string | undefined;\n  let partContentType: string | undefined;\n  for (const line of headerText.split('\\r\\n')) {\n    const colon = line.indexOf(':');\n    if (colon === -1) continue;\n    const headerName = line.slice(0, colon).trim().toLowerCase();\n    if (headerName === 'content-disposition') {\n      disposition = line.slice(colon + 1).trim();\n    } else if (headerName === 'content-type') {\n      partContentType = line.slice(colon + 1).trim();\n    }\n  }\n  if (!disposition) return;\n\n  const params = parseDispositionParams(disposition);\n  const name = params.get('name');\n  // A part without a name cannot be keyed - never fall back to the\n  // (attacker-controlled) filename as the key.\n  if (!name) return;\n\n  // filename* (RFC 5987) takes precedence over filename (RFC 6266 §4.3)\n  const extendedFilename = params.has('filename*')\n    ? decodeExtendedValue(params.get('filename*') as string)\n    : null;\n  const filename = extendedFilename ?? params.get('filename');\n\n  if (filename !== undefined && filename !== null) {\n    if (fileLimits.maxFileSize && content.length > fileLimits.maxFileSize) {\n      throw new MultipartLimitError(\n        `Uploaded file '${filename}' exceeds ${fileLimits.maxFileSize} bytes`\n      );\n    }\n    if (fileLimits.maxFiles && ++fileLimits.fileCount.n > fileLimits.maxFiles) {\n      throw new MultipartLimitError(`Multipart payload exceeds ${fileLimits.maxFiles} files`);\n    }\n    files[name] = {\n      filename,\n      mimetype: partContentType || 'application/octet-stream',\n      data: content,\n      size: content.length,\n    };\n  } else {\n    fields[name] = content.toString('utf8');\n  }\n}\n"]}

package/dist/core/http/utils/query-parser.d.ts

@@ -0,0 +1 @@
+export declare function parseRawQueryString(queryString: string): Record<string, string>;

package/dist/core/http/utils/query-parser.js

@@ -0,0 +1,44 @@
+// Parse a raw query string ("a=1&b=2") into an object. Transport-neutral: the
+// single canonical implementation for the Node http server, the uWS adapter,
+// and the Moro engine adapter, so req.query is identical on every transport.
+//
+// Semantics follow application/x-www-form-urlencoded (WHATWG):
+//   - '+' decodes to a space in keys and values
+//   - malformed percent-escapes never throw (the raw text is kept)
+//   - a key without '=' yields '' ("?flag" -> { flag: '' })
+//   - duplicate keys are last-wins
+// The result has a null prototype (like node:querystring), so a key named
+// "__proto__" is stored as an own property instead of vanishing.
+function decodeComponent(component) {
+    const plusDecoded = component.indexOf('+') === -1 ? component : component.replace(/\+/g, ' ');
+    if (plusDecoded.indexOf('%') === -1)
+        return plusDecoded;
+    try {
+        return decodeURIComponent(plusDecoded);
+    }
+    catch {
+        return plusDecoded;
+    }
+}
+export function parseRawQueryString(queryString) {
+    const result = Object.create(null);
+    if (!queryString)
+        return result;
+    if (queryString[0] === '?')
+        queryString = queryString.substring(1);
+    const pairs = queryString.split('&');
+    for (let i = 0; i < pairs.length; i++) {
+        const pair = pairs[i];
+        if (!pair)
+            continue;
+        const eqIdx = pair.indexOf('=');
+        if (eqIdx === -1) {
+            result[decodeComponent(pair)] = '';
+        }
+        else {
+            result[decodeComponent(pair.substring(0, eqIdx))] = decodeComponent(pair.substring(eqIdx + 1));
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=query-parser.js.map

package/dist/core/http/utils/query-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query-parser.js","sourceRoot":"","sources":["../../../../src/core/http/utils/query-parser.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,EAAE;AACF,+DAA+D;AAC/D,gDAAgD;AAChD,mEAAmE;AACnE,4DAA4D;AAC5D,mCAAmC;AACnC,0EAA0E;AAC1E,iEAAiE;AAEjE,SAAS,eAAe,CAAC,SAAiB;IACxC,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9F,IAAI,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,WAAW,CAAC;IACxD,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,MAAM,MAAM,GAA2B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3D,IAAI,CAAC,WAAW;QAAE,OAAO,MAAM,CAAC;IAChC,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,WAAW,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,eAAe,CACjE,IAAI,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,CAC1B,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["// Parse a raw query string (\"a=1&b=2\") into an object. Transport-neutral: the\n// single canonical implementation for the Node http server, the uWS adapter,\n// and the Moro engine adapter, so req.query is identical on every transport.\n//\n// Semantics follow application/x-www-form-urlencoded (WHATWG):\n//   - '+' decodes to a space in keys and values\n//   - malformed percent-escapes never throw (the raw text is kept)\n//   - a key without '=' yields '' (\"?flag\" -> { flag: '' })\n//   - duplicate keys are last-wins\n// The result has a null prototype (like node:querystring), so a key named\n// \"__proto__\" is stored as an own property instead of vanishing.\n\nfunction decodeComponent(component: string): string {\n  const plusDecoded = component.indexOf('+') === -1 ? component : component.replace(/\\+/g, ' ');\n  if (plusDecoded.indexOf('%') === -1) return plusDecoded;\n  try {\n    return decodeURIComponent(plusDecoded);\n  } catch {\n    return plusDecoded;\n  }\n}\n\nexport function parseRawQueryString(queryString: string): Record<string, string> {\n  const result: Record<string, string> = Object.create(null);\n  if (!queryString) return result;\n  if (queryString[0] === '?') queryString = queryString.substring(1);\n  const pairs = queryString.split('&');\n  for (let i = 0; i < pairs.length; i++) {\n    const pair = pairs[i];\n    if (!pair) continue;\n    const eqIdx = pair.indexOf('=');\n    if (eqIdx === -1) {\n      result[decodeComponent(pair)] = '';\n    } else {\n      result[decodeComponent(pair.substring(0, eqIdx))] = decodeComponent(\n        pair.substring(eqIdx + 1)\n      );\n    }\n  }\n  return result;\n}\n"]}

package/dist/core/http/utils/size.d.ts

@@ -0,0 +1,33 @@
+export declare function parseSizeToBytes(size: string | number, fallback?: number): number;
+/**
+ * Flattened, size-resolved runtime limits passed from the framework to every
+ * HTTP server. undefined = use that server's own documented default. Mirrors
+ * the RuntimeLimits built in framework.ts (kept here so the servers can import
+ * it without depending on framework.ts).
+ */
+export interface HttpRuntimeLimits {
+    maxBodySize?: number;
+    maxUploadSize?: number;
+    maxConnections?: number;
+    backlog?: number;
+    timeouts?: {
+        request?: number;
+        idle?: number;
+        keepAlive?: number;
+        headers?: number;
+    };
+    maxHeaderSize?: number;
+    maxHeaders?: number;
+    wsMaxMessageSize?: number;
+    wsBackpressureLimit?: number;
+    writeHighWaterMark?: number;
+    maxPendingBytes?: number;
+    multipart?: {
+        maxParts?: number;
+        maxPartHeaderBytes?: number;
+        maxFiles?: number;
+        maxFileSize?: number;
+    };
+}
+/** True when `size` is a number, or a string parseable by parseSizeToBytes. */
+export declare function isValidSize(size: unknown): boolean;

package/dist/core/http/utils/size.js

@@ -0,0 +1,37 @@
+/**
+ * Parse a human size string ("10mb", "5gb", "16kb") or a raw number of bytes
+ * into bytes. Shared by config validation, the runtime-limits builder, and
+ * every HTTP server so `bodySizeLimit: '10mb'` means the same thing
+ * everywhere.
+ *
+ * A number passes through unchanged. An unparseable string falls back to
+ * `fallback` (10 MB by default) so a typo degrades to a safe default rather
+ * than 0/NaN.
+ */
+const UNITS = {
+    b: 1,
+    kb: 1024,
+    mb: 1024 * 1024,
+    gb: 1024 * 1024 * 1024,
+};
+export function parseSizeToBytes(size, fallback = 10 * 1024 * 1024) {
+    if (typeof size === 'number')
+        return size;
+    if (typeof size !== 'string')
+        return fallback;
+    const match = size.toLowerCase().match(/^(\d+(?:\.\d+)?)\s*(b|kb|mb|gb)?$/);
+    if (!match)
+        return fallback;
+    const value = parseFloat(match[1] ?? '');
+    const unit = match[2] || 'b';
+    return Math.round(value * (UNITS[unit] ?? 1));
+}
+/** True when `size` is a number, or a string parseable by parseSizeToBytes. */
+export function isValidSize(size) {
+    if (typeof size === 'number')
+        return Number.isFinite(size) && size >= 0;
+    if (typeof size !== 'string')
+        return false;
+    return /^(\d+(?:\.\d+)?)\s*(b|kb|mb|gb)?$/i.test(size.trim());
+}
+//# sourceMappingURL=size.js.map

package/dist/core/http/utils/size.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"size.js","sourceRoot":"","sources":["../../../../src/core/http/utils/size.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,KAAK,GAA8B;IACvC,CAAC,EAAE,CAAC;IACJ,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI,GAAG,IAAI;IACf,EAAE,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI;CACvB,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAC9B,IAAqB,EACrB,WAAmB,EAAE,GAAG,IAAI,GAAG,IAAI;IAEnC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC5E,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAE5B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;IAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAiCD,+EAA+E;AAC/E,MAAM,UAAU,WAAW,CAAC,IAAa;IACvC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;IACxE,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3C,OAAO,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AAChE,CAAC","sourcesContent":["/**\n * Parse a human size string (\"10mb\", \"5gb\", \"16kb\") or a raw number of bytes\n * into bytes. Shared by config validation, the runtime-limits builder, and\n * every HTTP server so `bodySizeLimit: '10mb'` means the same thing\n * everywhere.\n *\n * A number passes through unchanged. An unparseable string falls back to\n * `fallback` (10 MB by default) so a typo degrades to a safe default rather\n * than 0/NaN.\n */\nconst UNITS: { [key: string]: number } = {\n  b: 1,\n  kb: 1024,\n  mb: 1024 * 1024,\n  gb: 1024 * 1024 * 1024,\n};\n\nexport function parseSizeToBytes(\n  size: string | number,\n  fallback: number = 10 * 1024 * 1024\n): number {\n  if (typeof size === 'number') return size;\n  if (typeof size !== 'string') return fallback;\n\n  const match = size.toLowerCase().match(/^(\\d+(?:\\.\\d+)?)\\s*(b|kb|mb|gb)?$/);\n  if (!match) return fallback;\n\n  const value = parseFloat(match[1] ?? '');\n  const unit = match[2] || 'b';\n  return Math.round(value * (UNITS[unit] ?? 1));\n}\n\n/**\n * Flattened, size-resolved runtime limits passed from the framework to every\n * HTTP server. undefined = use that server's own documented default. Mirrors\n * the RuntimeLimits built in framework.ts (kept here so the servers can import\n * it without depending on framework.ts).\n */\nexport interface HttpRuntimeLimits {\n  maxBodySize?: number;\n  maxUploadSize?: number;\n  maxConnections?: number;\n  backlog?: number;\n  timeouts?: {\n    request?: number;\n    idle?: number;\n    keepAlive?: number;\n    headers?: number;\n  };\n  maxHeaderSize?: number;\n  maxHeaders?: number;\n  wsMaxMessageSize?: number;\n  wsBackpressureLimit?: number;\n  writeHighWaterMark?: number;\n  maxPendingBytes?: number;\n  multipart?: {\n    maxParts?: number;\n    maxPartHeaderBytes?: number;\n    maxFiles?: number;\n    maxFileSize?: number;\n  };\n}\n\n/** True when `size` is a number, or a string parseable by parseSizeToBytes. */\nexport function isValidSize(size: unknown): boolean {\n  if (typeof size === 'number') return Number.isFinite(size) && size >= 0;\n  if (typeof size !== 'string') return false;\n  return /^(\\d+(?:\\.\\d+)?)\\s*(b|kb|mb|gb)?$/i.test(size.trim());\n}\n"]}

package/dist/core/http/utils/ssl-config.d.ts

@@ -0,0 +1,69 @@
+import type { MoroLogger } from '../../logger/index.js';
+/** Raw, un-normalized SSL config as a user may supply it (either shape). */
+export interface SSLConfigInput {
+    key_file_name?: string;
+    cert_file_name?: string;
+    ca_file_name?: string | string[];
+    keyFile?: string;
+    certFile?: string;
+    caFile?: string | string[];
+    key?: string | Buffer;
+    cert?: string | Buffer;
+    ca?: string | Buffer | Array<string | Buffer>;
+    passphrase?: string;
+    minVersion?: 'TLSv1.2' | 'TLSv1.3';
+    requestCert?: boolean;
+    rejectUnauthorized?: boolean;
+}
+/** Canonical internal SSL config after normalization. */
+export interface NormalizedSSLConfig {
+    keyFile?: string | undefined;
+    certFile?: string | undefined;
+    caFile?: string[] | undefined;
+    key?: string | Buffer | undefined;
+    cert?: string | Buffer | undefined;
+    ca?: Array<string | Buffer> | undefined;
+    passphrase?: string | undefined;
+    minVersion?: 'TLSv1.2' | 'TLSv1.3' | undefined;
+    requestCert?: boolean | undefined;
+    rejectUnauthorized?: boolean | undefined;
+}
+/**
+ * Normalize the two historical SSL shapes into one. `serverSsl`
+ * (config.server.ssl) wins over `optionsHttps` (options.https) when both are
+ * present, matching the pre-existing precedence in framework.ts. Returns null
+ * when neither carries any key/cert material (TLS simply off).
+ */
+export declare function normalizeSSLConfig(serverSsl?: SSLConfigInput | null, optionsHttps?: SSLConfigInput | null, logger?: MoroLogger): NormalizedSSLConfig | null;
+/** True when the config actually carries a key+cert (complete TLS material). */
+export declare function sslIsComplete(ssl: NormalizedSSLConfig): boolean;
+/**
+ * Project for the Node http/https and HTTP/2 servers: node's tls API wants
+ * key/cert/ca as strings or Buffers, so any file paths are read here.
+ */
+export declare function sslForNode(ssl: NormalizedSSLConfig): {
+    key: string | Buffer;
+    cert: string | Buffer;
+    ca?: Array<string | Buffer>;
+    passphrase?: string;
+    minVersion?: string;
+    requestCert?: boolean;
+    rejectUnauthorized?: boolean;
+};
+/**
+ * Project for uWebSockets.js SSLApp, which requires FILE PATHS (it has no
+ * inline-PEM option). Returns null when only inline PEM is available so the
+ * caller can log a clear error instead of silently booting plain HTTP.
+ */
+export declare function sslForUws(ssl: NormalizedSSLConfig): {
+    key_file_name: string;
+    cert_file_name: string;
+    ca_file_name?: string;
+    passphrase?: string;
+} | null;
+/**
+ * Project for the native @morojs/engine serve() options.ssl, which accepts
+ * BOTH shapes (file paths and inline PEM) and prefers inline. Pass everything
+ * through; the engine decides.
+ */
+export declare function sslForEngine(ssl: NormalizedSSLConfig): Record<string, unknown>;