@nifrajs/core 5.5.0 → 5.6.0

package/dist/file-type.js

@@ -0,0 +1,118 @@
+/**
+ * Magic-byte file-type detection - trust the bytes, not the `Content-Type` header (which a client
+ * sets freely). Reads only the leading bytes; imports nothing, so it is edge-safe. Covers the common
+ * upload types; returns `null` for anything unrecognized (incl. text formats like SVG/CSV that have no
+ * magic number - handle those explicitly if you accept them).
+ *
+ * The shared owner for every type-by-bytes check: `@nifrajs/schema/form`'s `t.file({ accept })` and
+ * `@nifrajs/uploads`'s `validateUpload` must give one file one verdict, so both read this module.
+ */
+/**
+ * How many leading bytes {@link detectFileType} looks at. Reading this many from the start of a file
+ * (`file.slice(0, FILE_TYPE_PREFIX_BYTES)`) is enough for every type it knows: it reaches the first four
+ * compatible brands of an ISO-BMFF `ftyp` box, where an AVIF with the generic `mif1` brand says `avif`.
+ */
+export const FILE_TYPE_PREFIX_BYTES = 32;
+/**
+ * Every MIME type {@link detectFileType} can return. An allow-list entry outside this set (and
+ * outside a `type/*` wildcard that covers one of them) can never match, so check a configured
+ * allow-list against it up front instead of rejecting every upload at request time.
+ */
+export const DETECTABLE_MIME_TYPES = [
+    "image/jpeg",
+    "image/png",
+    "image/gif",
+    "image/webp",
+    "audio/wav",
+    "video/x-msvideo",
+    "image/avif",
+    "image/heic",
+    "audio/mp4",
+    "video/mp4",
+    "video/webm",
+    "audio/ogg",
+    "audio/mpeg",
+    "application/pdf",
+    "application/zip",
+    "application/gzip",
+];
+/**
+ * An MPEG audio frame header: an 11-bit frame sync, then a version, layer, bitrate and sample rate that
+ * are not reserved values. An MP3 needs no ID3 tag, so this is how an untagged one starts. AAC's ADTS
+ * sync shares the first 12 bits, but its layer is always the reserved `00`.
+ */
+function mpegAudioFrame(bytes) {
+    const [b0 = 0, b1 = 0, b2 = 0] = bytes;
+    if (bytes.length < 4 || b0 !== 0xff || (b1 & 0xe0) !== 0xe0)
+        return false;
+    const version = (b1 >> 3) & 0b11;
+    const layer = (b1 >> 1) & 0b11;
+    const bitrate = b2 >> 4;
+    const sampleRate = (b2 >> 2) & 0b11;
+    return version !== 0b01 && layer !== 0b00 && bitrate !== 0b1111 && sampleRate !== 0b11;
+}
+/** Detect a file's type from its magic bytes, or `null` if unrecognized. */
+export function detectFileType(bytes) {
+    const at = (offset, ...sig) => sig.every((byte, i) => bytes[offset + i] === byte);
+    // Images
+    if (at(0, 0xff, 0xd8, 0xff))
+        return { mime: "image/jpeg", ext: "jpg" };
+    if (at(0, 0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a))
+        return { mime: "image/png", ext: "png" };
+    if (at(0, 0x47, 0x49, 0x46, 0x38))
+        return { mime: "image/gif", ext: "gif" };
+    // RIFF container (bytes 0-3 "RIFF", 8-11 the form type)
+    if (at(0, 0x52, 0x49, 0x46, 0x46)) {
+        if (at(8, 0x57, 0x45, 0x42, 0x50))
+            return { mime: "image/webp", ext: "webp" };
+        if (at(8, 0x57, 0x41, 0x56, 0x45))
+            return { mime: "audio/wav", ext: "wav" };
+        if (at(8, 0x41, 0x56, 0x49, 0x20))
+            return { mime: "video/x-msvideo", ext: "avi" };
+    }
+    // ISO-BMFF (`ftyp` box at offset 4) - mp4 / avif / heic / m4a, disambiguated by the major brand.
+    if (at(4, 0x66, 0x74, 0x79, 0x70)) {
+        const brandAt = (offset) => String.fromCharCode(bytes[offset] ?? 0, bytes[offset + 1] ?? 0, bytes[offset + 2] ?? 0, bytes[offset + 3] ?? 0);
+        const brand = brandAt(8);
+        // The compatible brands follow the minor version, to the end of the ftyp box. Only those inside the
+        // prefix count: the box size is the sender's claim, and a verdict must not depend on bytes a caller
+        // that sniffs `FILE_TYPE_PREFIX_BYTES` never reads.
+        const boxEnd = Math.min(bytes.length, FILE_TYPE_PREFIX_BYTES, ((bytes[0] ?? 0) << 24) | ((bytes[1] ?? 0) << 16) | ((bytes[2] ?? 0) << 8) | (bytes[3] ?? 0));
+        const compatible = [];
+        for (let offset = 16; offset + 4 <= boxEnd; offset += 4)
+            compatible.push(brandAt(offset));
+        // A HEIF-family file whose major brand is the generic `mif1`/`msf1`/`miaf` names its codec among
+        // the compatible brands: AVIF says `avif`/`avis`.
+        const avif = (name) => name === "avif" || name === "avis";
+        const generic = brand === "mif1" || brand === "msf1" || brand === "miaf";
+        if (avif(brand) || (generic && compatible.some(avif)))
+            return { mime: "image/avif", ext: "avif" };
+        if (brand.startsWith("hei") || brand.startsWith("hev") || generic) {
+            return { mime: "image/heic", ext: "heic" };
+        }
+        // Audio brands share the ISO-BMFF container but are NOT video - labeling them `video/mp4` would
+        // both reject real audio under an `audio/*` allow-list and admit it under `video/*`. `M4A `/`M4B `
+        // are AAC audio / audiobooks.
+        if (brand === "M4A " || brand === "M4B ")
+            return { mime: "audio/mp4", ext: "m4a" };
+        return { mime: "video/mp4", ext: "mp4" };
+    }
+    // A/V + archives
+    if (at(0, 0x1a, 0x45, 0xdf, 0xa3))
+        return { mime: "video/webm", ext: "webm" }; // Matroska/WebM
+    if (at(0, 0x4f, 0x67, 0x67, 0x53))
+        return { mime: "audio/ogg", ext: "ogg" };
+    if (at(0, 0x49, 0x44, 0x33))
+        return { mime: "audio/mpeg", ext: "mp3" }; // ID3 tag
+    if (mpegAudioFrame(bytes))
+        return { mime: "audio/mpeg", ext: "mp3" }; // an untagged MP3
+    if (at(0, 0x25, 0x50, 0x44, 0x46))
+        return { mime: "application/pdf", ext: "pdf" }; // "%PDF"
+    if (at(0, 0x50, 0x4b, 0x03, 0x04) || at(0, 0x50, 0x4b, 0x05, 0x06)) {
+        return { mime: "application/zip", ext: "zip" }; // also docx/xlsx/odt containers
+    }
+    if (at(0, 0x1f, 0x8b))
+        return { mime: "application/gzip", ext: "gz" };
+    return null;
+}
+//# sourceMappingURL=file-type.js.map

package/dist/file-type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-type.js","sourceRoot":"","sources":["../src/file-type.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AASH;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAA;AAExC;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,YAAY;IACZ,WAAW;IACX,WAAW;IACX,YAAY;IACZ,WAAW;IACX,iBAAiB;IACjB,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,WAAW;IACX,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,iBAAiB;IACjB,iBAAiB;IACjB,kBAAkB;CACnB,CAAA;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAiB;IACvC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,KAAK,CAAA;IACtC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IACzE,MAAM,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,CAAA;IAChC,MAAM,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,CAAA;IAC9B,MAAM,OAAO,GAAG,EAAE,IAAI,CAAC,CAAA;IACvB,MAAM,UAAU,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,CAAA;IACnC,OAAO,OAAO,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,MAAM,IAAI,UAAU,KAAK,IAAI,CAAA;AACxF,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAAC,KAAiB;IAC9C,MAAM,EAAE,GAAG,CAAC,MAAc,EAAE,GAAG,GAAa,EAAW,EAAE,CACvD,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAA;IAEpD,SAAS;IACT,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;IACtE,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QACvD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;IAC1C,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;IAE3E,wDAAwD;IACxD,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAClC,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;QAC7E,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;QAC3E,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;IACnF,CAAC;IAED,iGAAiG;IACjG,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,CAAC,MAAc,EAAU,EAAE,CACzC,MAAM,CAAC,YAAY,CACjB,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAClB,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,EACtB,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,EACtB,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CACvB,CAAA;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;QACxB,oGAAoG;QACpG,oGAAoG;QACpG,oDAAoD;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CACrB,KAAK,CAAC,MAAM,EACZ,sBAAsB,EACtB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAC7F,CAAA;QACD,MAAM,UAAU,GAAa,EAAE,CAAA;QAC/B,KAAK,IAAI,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,CAAC,IAAI,MAAM,EAAE,MAAM,IAAI,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;QACzF,iGAAiG;QACjG,kDAAkD;QAClD,MAAM,IAAI,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,CAAA;QAC1E,MAAM,OAAO,GAAG,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,CAAA;QACxE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;QAC5C,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YAClE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;QAC5C,CAAC;QACD,gGAAgG;QAChG,mGAAmG;QACnG,8BAA8B;QAC9B,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;QAClF,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;IAC1C,CAAC;IAED,iBAAiB;IACjB,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA,CAAC,gBAAgB;IAC9F,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;IAC3E,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA,CAAC,UAAU;IACjF,IAAI,cAAc,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA,CAAC,kBAAkB;IACvF,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA,CAAC,SAAS;IAC3F,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA,CAAC,gCAAgC;IACjF,CAAC;IACD,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,IAAI,EAAE,CAAA;IAErE,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/index.d.ts

@@ -15,7 +15,7 @@
  * read its own package.json at runtime. `scripts/version.ts` rewrites it on every release bump and
  * `check:publish` asserts it equals `@nifrajs/core`'s package version.
  */
-export declare const VERSION: "5.5.0";
+export declare const VERSION: "5.6.0";
 export type Version = typeof VERSION;
 export { FrameworkError, RouteConfigError, type RouteConfigErrorCode } from "./errors.js";
 export { FRAMEWORK_NAME, type FrameworkName } from "./internal/brand.js";
@@ -24,6 +24,7 @@ export { ROUTE_PATTERN_OVERLAP_MAX_STATES, RoutePatternOverlapLimitError, routeP
 export { METHODS, type Method, type RouteMethod, Router, type RouterMatch, } from "./router/router.js";
 export type { InferInput, InferOutput, StandardIssue, StandardResult, StandardSchemaV1, StandardTypes, ValidationOutcome, } from "./schema/standard.js";
 export { type AuthenticationFailure, type AuthenticationFailureReason, type AuthenticationInput, type AuthenticationResult, type AuthenticationStage, type AuthenticationSuccess, type AuthHeaders, type AuthMaybePromise, authenticated, isAuthenticatedRequest, markAuthenticatedRequest, rejected, } from "./server/auth.js";
+export { beforeHandler } from "./server/before-handler.js";
 export type { Context, Params, Platform, Prettify, RequestPath, ResponseControls, RouteSchema, } from "./server/context.js";
 export { type CookieOptions, type CookieSecret, cookieNamePrefix, hasDuplicateCookie, parseCookies, serializeCookie, signValue, unsignValue, } from "./server/cookies.js";
 export { type DurableObjectNamespaceLike, type ExecutionContext, type ScheduledController, type ScheduledHandler, toFetchHandler, } from "./server/edge.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;GAIG;AACH,eAAO,MAAM,OAAO,EAAG,OAAgB,CAAA;AAEvC,MAAM,MAAM,OAAO,GAAG,OAAO,OAAO,CAAA;AAEpC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACzF,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACxE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AACjF,OAAO,EACL,gCAAgC,EAChC,6BAA6B,EAC7B,mBAAmB,GACpB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,OAAO,EACP,KAAK,MAAM,EACX,KAAK,WAAW,EAChB,MAAM,EACN,KAAK,WAAW,GACjB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,UAAU,EACV,WAAW,EACX,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,iBAAiB,GAClB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,aAAa,EACb,sBAAsB,EACtB,wBAAwB,EACxB,QAAQ,GACT,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,OAAO,EACP,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,WAAW,EACX,gBAAgB,EAChB,WAAW,GACZ,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,eAAe,EACf,SAAS,EACT,WAAW,GACZ,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,cAAc,GACf,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,KAAK,QAAQ,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC1F,OAAO,EACL,oBAAoB,EACpB,UAAU,EACV,KAAK,SAAS,EACd,KAAK,MAAM,EACX,KAAK,aAAa,EAClB,eAAe,EACf,YAAY,GACb,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,KAAK,aAAa,GACnB,MAAM,+BAA+B,CAAA;AACtC,YAAY,EACV,aAAa,EACb,cAAc,EACd,QAAQ,EACR,cAAc,EACd,SAAS,EACT,YAAY,GACb,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,MAAM,GACP,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,YAAY,EACZ,kBAAkB,EAClB,KAAK,OAAO,EACZ,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,MAAM,EACN,KAAK,aAAa,EAClB,MAAM,EACN,KAAK,eAAe,GACrB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,UAAU,EACV,OAAO,EACP,UAAU,EACV,SAAS,EACT,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,YAAY,EACV,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,uBAAuB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;GAIG;AACH,eAAO,MAAM,OAAO,EAAG,OAAgB,CAAA;AAEvC,MAAM,MAAM,OAAO,GAAG,OAAO,OAAO,CAAA;AAEpC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACzF,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACxE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AACjF,OAAO,EACL,gCAAgC,EAChC,6BAA6B,EAC7B,mBAAmB,GACpB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,OAAO,EACP,KAAK,MAAM,EACX,KAAK,WAAW,EAChB,MAAM,EACN,KAAK,WAAW,GACjB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,UAAU,EACV,WAAW,EACX,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,iBAAiB,GAClB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,aAAa,EACb,sBAAsB,EACtB,wBAAwB,EACxB,QAAQ,GACT,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAC1D,YAAY,EACV,OAAO,EACP,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,WAAW,EACX,gBAAgB,EAChB,WAAW,GACZ,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,eAAe,EACf,SAAS,EACT,WAAW,GACZ,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,cAAc,GACf,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,KAAK,QAAQ,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC1F,OAAO,EACL,oBAAoB,EACpB,UAAU,EACV,KAAK,SAAS,EACd,KAAK,MAAM,EACX,KAAK,aAAa,EAClB,eAAe,EACf,YAAY,GACb,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,KAAK,aAAa,GACnB,MAAM,+BAA+B,CAAA;AACtC,YAAY,EACV,aAAa,EACb,cAAc,EACd,QAAQ,EACR,cAAc,EACd,SAAS,EACT,YAAY,GACb,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,MAAM,GACP,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,YAAY,EACZ,kBAAkB,EAClB,KAAK,OAAO,EACZ,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,MAAM,EACN,KAAK,aAAa,EAClB,MAAM,EACN,KAAK,eAAe,GACrB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,UAAU,EACV,OAAO,EACP,UAAU,EACV,SAAS,EACT,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,YAAY,EACV,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,uBAAuB,CAAA"}

package/dist/index.js

@@ -15,13 +15,14 @@
  * read its own package.json at runtime. `scripts/version.ts` rewrites it on every release bump and
  * `check:publish` asserts it equals `@nifrajs/core`'s package version.
  */
-export const VERSION = "5.5.0";
+export const VERSION = "5.6.0";
 export { FrameworkError, RouteConfigError } from "./errors.js";
 export { FRAMEWORK_NAME } from "./internal/brand.js";
 export { isSameOriginForm, isSameOriginRequest } from "./internal/same-origin.js";
 export { ROUTE_PATTERN_OVERLAP_MAX_STATES, RoutePatternOverlapLimitError, routePatternOverlap, } from "./router/overlap.js";
 export { METHODS, Router, } from "./router/router.js";
 export { authenticated, isAuthenticatedRequest, markAuthenticatedRequest, rejected, } from "./server/auth.js";
+export { beforeHandler } from "./server/before-handler.js";
 export { cookieNamePrefix, hasDuplicateCookie, parseCookies, serializeCookie, signValue, unsignValue, } from "./server/cookies.js";
 export { toFetchHandler, } from "./server/edge.js";
 export { isSameOriginPath, pathnameOf, urlPartsOf } from "./server/http.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,OAAgB,CAAA;AAIvC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAA6B,MAAM,aAAa,CAAA;AACzF,OAAO,EAAE,cAAc,EAAsB,MAAM,qBAAqB,CAAA;AACxE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AACjF,OAAO,EACL,gCAAgC,EAChC,6BAA6B,EAC7B,mBAAmB,GACpB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,OAAO,EAGP,MAAM,GAEP,MAAM,oBAAoB,CAAA;AAU3B,OAAO,EASL,aAAa,EACb,sBAAsB,EACtB,wBAAwB,EACxB,QAAQ,GACT,MAAM,kBAAkB,CAAA;AAUzB,OAAO,EAGL,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,eAAe,EACf,SAAS,EACT,WAAW,GACZ,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAKL,cAAc,GACf,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAiB,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC1F,OAAO,EACL,oBAAoB,EACpB,UAAU,EAIV,eAAe,EACf,YAAY,GACb,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAUL,eAAe,EACf,gBAAgB,EAChB,eAAe,GAEhB,MAAM,+BAA+B,CAAA;AAStC,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAIL,MAAM,GACP,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAOL,mBAAmB,EACnB,oBAAoB,EACpB,YAAY,EACZ,kBAAkB,EA8BlB,MAAM,EAEN,MAAM,GAEP,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,OAAgB,CAAA;AAIvC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAA6B,MAAM,aAAa,CAAA;AACzF,OAAO,EAAE,cAAc,EAAsB,MAAM,qBAAqB,CAAA;AACxE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AACjF,OAAO,EACL,gCAAgC,EAChC,6BAA6B,EAC7B,mBAAmB,GACpB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,OAAO,EAGP,MAAM,GAEP,MAAM,oBAAoB,CAAA;AAU3B,OAAO,EASL,aAAa,EACb,sBAAsB,EACtB,wBAAwB,EACxB,QAAQ,GACT,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAU1D,OAAO,EAGL,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,eAAe,EACf,SAAS,EACT,WAAW,GACZ,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAKL,cAAc,GACf,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAiB,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC1F,OAAO,EACL,oBAAoB,EACpB,UAAU,EAIV,eAAe,EACf,YAAY,GACb,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAUL,eAAe,EACf,gBAAgB,EAChB,eAAe,GAEhB,MAAM,+BAA+B,CAAA;AAStC,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAIL,MAAM,GACP,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAOL,mBAAmB,EACnB,oBAAoB,EACpB,YAAY,EACZ,kBAAkB,EA8BlB,MAAM,EAEN,MAAM,GAEP,MAAM,oBAAoB,CAAA"}

package/dist/internal/route-program.d.ts

@@ -7,6 +7,7 @@
  * of rediscovering which lifecycle features are present.
  */
 import type { StandardSchemaV1 } from "../schema/standard.js";
+import type { Logger } from "../server/logger.js";
 import type { Registry } from "../server/registry.js";
 import { type ResponseResult } from "../server/runtime-core.js";
 import type { CtxSet, MaybePromise, RawContext, RequestSource, Server } from "../server/server.js";
@@ -73,6 +74,16 @@ export declare function compileRouteProgram(input: RouteProgramInput): RouteProg
  * buffered, and with a replay entry and program when the key already holds a response.
  */
 export type IdempotencyResume<T> = (entry: RouteEntry, program: RouteProgram) => ProgramResult<T>;
+/**
+ * Run the `authenticate()` stages a mount was registered after, in order, against the request the
+ * mount would receive: `undefined` once each one authenticated, else the response that refuses it. A
+ * stage that throws or decides nothing valid answers 503, and its cause goes to `logger`, as a route
+ * error no hook answers does.
+ */
+export declare function authenticateMount(stages: readonly RawAuthStage[], request: Request, platform: {
+    readonly env?: unknown;
+    readonly clientIp?: string | undefined;
+} | undefined, logger: Logger): MaybePromise<Response | undefined>;
 type ProgramResult<T> = MaybePromise<T>;
 /** Execute the general program. The first synchronous stage sequence stays synchronous. */
 export declare function executeRouteProgram<T, R extends Registry, Ctx>(runtime: Server<R, Ctx>, entry: RouteEntry, program: RouteProgram, source: RequestSource, ctx: RawContext, finalize: (result: unknown, set: CtxSet, ctx?: RawContext) => T, wrapResponse: (response: Response | ResponseResult) => T): ProgramResult<T>;

package/dist/internal/route-program.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-program.d.ts","sourceRoot":"","sources":["../../src/internal/route-program.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAK7D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAKL,KAAK,cAAc,EAGpB,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAClG,OAAO,KAAK,EACV,eAAe,EACf,cAAc,EACd,YAAY,EACZ,eAAe,EACf,SAAS,EACT,eAAe,EACf,UAAU,EACX,MAAM,sBAAsB,CAAA;AAE7B,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAA;AAEvF,MAAM,MAAM,iBAAiB,GACzB;IACE,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAA;IACpC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;IACjC,kFAAkF;IAClF,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;CAC/C,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAA;CAAE,CAAA;AAE5D,6EAA6E;AAC7E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC7C,QAAQ,CAAC,eAAe,EAAE,sBAAsB,GAAG,wBAAwB,CAAA;IAC3E,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAA;IACtC,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,CAAA;IAC5C,gGAAgG;IAChG,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,SAAS,OAAO,CAAC,iBAAiB,EAAE;QAAE,IAAI,EAAE,qBAAqB,CAAA;KAAE,CAAC,EAAE,CAAA;IACjG,QAAQ,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,CAAA;IACtC,QAAQ,CAAC,YAAY,EAAE,SAAS,eAAe,EAAE,CAAA;IACjD,QAAQ,CAAC,WAAW,EAAE,SAAS,cAAc,EAAE,CAAA;IAC/C,QAAQ,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAA;IAC5C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IAClD,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,CAAA;IACjD,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;IAC3C,QAAQ,CAAC,gBAAgB,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAA;CAC1D;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAA;IACrC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,CAAA;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,CAAA;IAC7C,QAAQ,CAAC,YAAY,EAAE,SAAS,eAAe,EAAE,CAAA;IACjD,QAAQ,CAAC,WAAW,EAAE,SAAS,cAAc,EAAE,CAAA;IAC/C,QAAQ,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAA;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IAClD,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,CAAA;IACjD,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;IAC3C,QAAQ,CAAC,gBAAgB,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAA;CAC1D;AAED,uFAAuF;AACvF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,GAAG,YAAY,CA6C1E;AAyCD;;;GAGG;AACH,MAAM,MAAM,iBAAiB,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,KAAK,aAAa,CAAC,CAAC,CAAC,CAAA;AAubjG,KAAK,aAAa,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,CAAA;AAmEvC,2FAA2F;AAC3F,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,CAAC,SAAS,QAAQ,EAAE,GAAG,EAC5D,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,EACvB,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,aAAa,EACrB,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,UAAU,KAAK,CAAC,EAC/D,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,KAAK,CAAC,GACvD,aAAa,CAAC,CAAC,CAAC,CAgClB"}
+{"version":3,"file":"route-program.d.ts","sourceRoot":"","sources":["../../src/internal/route-program.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAI7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAEjD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAErD,OAAO,EAKL,KAAK,cAAc,EAGpB,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAClG,OAAO,KAAK,EACV,eAAe,EACf,cAAc,EACd,YAAY,EACZ,eAAe,EACf,SAAS,EACT,eAAe,EACf,UAAU,EACX,MAAM,sBAAsB,CAAA;AAE7B,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAA;AAEvF,MAAM,MAAM,iBAAiB,GACzB;IACE,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAA;IACpC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;IACjC,kFAAkF;IAClF,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;CAC/C,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAA;CAAE,CAAA;AAE5D,6EAA6E;AAC7E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC7C,QAAQ,CAAC,eAAe,EAAE,sBAAsB,GAAG,wBAAwB,CAAA;IAC3E,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAA;IACtC,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,CAAA;IAC5C,gGAAgG;IAChG,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,SAAS,OAAO,CAAC,iBAAiB,EAAE;QAAE,IAAI,EAAE,qBAAqB,CAAA;KAAE,CAAC,EAAE,CAAA;IACjG,QAAQ,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,CAAA;IACtC,QAAQ,CAAC,YAAY,EAAE,SAAS,eAAe,EAAE,CAAA;IACjD,QAAQ,CAAC,WAAW,EAAE,SAAS,cAAc,EAAE,CAAA;IAC/C,QAAQ,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAA;IAC5C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IAClD,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,CAAA;IACjD,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;IAC3C,QAAQ,CAAC,gBAAgB,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAA;CAC1D;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAA;IACrC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,CAAA;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,CAAA;IAC7C,QAAQ,CAAC,YAAY,EAAE,SAAS,eAAe,EAAE,CAAA;IACjD,QAAQ,CAAC,WAAW,EAAE,SAAS,cAAc,EAAE,CAAA;IAC/C,QAAQ,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAA;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IAClD,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,CAAA;IACjD,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;IAC3C,QAAQ,CAAC,gBAAgB,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAA;CAC1D;AAED,uFAAuF;AACvF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,GAAG,YAAY,CA6C1E;AAyCD;;;GAGG;AACH,MAAM,MAAM,iBAAiB,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,KAAK,aAAa,CAAC,CAAC,CAAC,CAAA;AAwFjG;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,SAAS,YAAY,EAAE,EAC/B,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAAG,SAAS,EACxF,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,QAAQ,GAAG,SAAS,CAAC,CA0DpC;AA2WD,KAAK,aAAa,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,CAAA;AAuHvC,2FAA2F;AAC3F,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,CAAC,SAAS,QAAQ,EAAE,GAAG,EAC5D,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,EACvB,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,aAAa,EACrB,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,UAAU,KAAK,CAAC,EAC/D,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,KAAK,CAAC,GACvD,aAAa,CAAC,CAAC,CAAC,CAgClB"}

package/dist/internal/route-program.js

@@ -10,6 +10,7 @@ import { markAuthenticatedRequest } from "../server/auth.js";
 import { declaredHeaderNames } from "../server/headers.js";
 import { pathnameOf } from "../server/http.js";
 import { queryObjectOf } from "../server/query.js";
+import { toResponse } from "../server/respond.js";
 import { CONTEXT_SEARCH, CONTEXT_SET, EMPTY_RESPONSE_CONTROLS, isResponseResult, requestOf, status, } from "../server/runtime-core.js";
 /** Build the immutable stage sequence once, while the server is still configurable. */
 export function compileRouteProgram(input) {
@@ -119,6 +120,70 @@ function authenticationInputOf(source, ctx) {
         signal: ctx.signal,
     });
 }
+/**
+ * Run the `authenticate()` stages a mount was registered after, in order, against the request the
+ * mount would receive: `undefined` once each one authenticated, else the response that refuses it. A
+ * stage that throws or decides nothing valid answers 503, and its cause goes to `logger`, as a route
+ * error no hook answers does.
+ */
+export function authenticateMount(stages, request, platform, logger) {
+    let query;
+    const search = (() => {
+        const at = request.url.indexOf("?");
+        return at === -1 ? "" : request.url.slice(at);
+    })();
+    const input = Object.freeze({
+        method: request.method,
+        pathname: pathnameOf(request.url),
+        headers: authHeadersOf(request),
+        params: Object.freeze({}),
+        search,
+        get query() {
+            query ??= frozenQueryOf(search);
+            return query;
+        },
+        request,
+        env: platform?.env,
+        clientIp: platform?.clientIp,
+        signal: request.signal,
+    });
+    const unavailable = (error) => {
+        logger.error("authenticate() stage failed before a mount", {
+            method: request.method,
+            path: input.pathname,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return toResponse(defaultAuthenticationResponse("unavailable"), EMPTY_RESPONSE_CONTROLS);
+    };
+    const decide = (index, result) => {
+        if (!isAuthenticationDecision(result)) {
+            const id = stages[index]?.id;
+            return unavailable(new TypeError(`authenticate() stage "${id}" returned an invalid decision`));
+        }
+        if (result.kind === "rejected") {
+            const refusal = result.response ?? defaultAuthenticationResponse(result.reason);
+            return refusal instanceof Response ? refusal : toResponse(refusal, EMPTY_RESPONSE_CONTROLS);
+        }
+        markAuthenticatedRequest(request);
+        return run(index + 1);
+    };
+    const run = (index) => {
+        const stage = stages[index];
+        if (stage === undefined)
+            return undefined;
+        let outcome;
+        try {
+            outcome = stage.run(input);
+        }
+        catch (error) {
+            return unavailable(error);
+        }
+        return outcome instanceof Promise
+            ? outcome.then((settled) => decide(index, settled), unavailable)
+            : decide(index, outcome);
+    };
+    return run(0);
+}
 function defaultAuthenticationResponse(reason) {
     if (reason === "forbidden")
         return status(403, { ok: false, error: "forbidden" });
@@ -126,6 +191,20 @@ function defaultAuthenticationResponse(reason) {
         return status(503, { ok: false, error: "auth_unavailable" });
     return status(401, { ok: false, error: "unauthorized" });
 }
+/** Whether a stage returned a decision it may: a rejection with a known reason and a response, if
+ * any, that answers; or a principal. */
+function isAuthenticationDecision(result) {
+    return (result !== null &&
+        typeof result === "object" &&
+        (result.kind === "rejected"
+            ? validAuthenticationFailureReason(result.reason) &&
+                (result.response === undefined ||
+                    result.response instanceof Response ||
+                    isResponseResult(result.response))
+            : result.kind === "authenticated" &&
+                result.principal !== null &&
+                result.principal !== undefined));
+}
 function validAuthenticationFailureReason(value) {
     return (value === undefined ||
         value === "unauthenticated" ||
@@ -176,16 +255,7 @@ function runAuthenticationStages(host, entry, program, source, ctx, finalize, wr
     return finishAuthentication(host, entry, program, source, ctx, finalize, wrapResponse, outcome, start + 1, validationComplete);
 }
 function finishAuthentication(host, entry, program, source, ctx, finalize, wrapResponse, result, next, validationComplete = false) {
-    if (result === null ||
-        typeof result !== "object" ||
-        (result.kind === "rejected"
-            ? !validAuthenticationFailureReason(result.reason) ||
-                (result.response !== undefined &&
-                    !(result.response instanceof Response) &&
-                    !isResponseResult(result.response))
-            : result.kind !== "authenticated" ||
-                result.principal === null ||
-                result.principal === undefined)) {
+    if (!isAuthenticationDecision(result)) {
         const id = program.authStages[next - 1].id;
         const error = new TypeError(`authenticate() stage "${id}" returned an invalid decision`);
         return failAuthentication(host, entry, ctx, finalize, wrapResponse, error);
@@ -223,7 +293,8 @@ async function continueFastAuthenticatedProgram(host, entry, program, source, ct
         const settled = await pending;
         if (settled !== undefined)
             return wrapResponse(settled);
-        return await runFastAuthenticatedProgram(host, entry, program, source, ctx, finalize, wrapResponse, validationIndex);
+        const outcome = runFastAuthenticatedProgram(host, entry, program, source, ctx, finalize, wrapResponse, validationIndex);
+        return outcome instanceof Promise ? await outcome : outcome;
     }
     catch (error) {
         return await host.handleProgramError(entry, error, ctx, finalize, wrapResponse);
@@ -261,7 +332,8 @@ async function continueValidationBeforeAuthentication(host, entry, program, sour
         const settled = await pending;
         if (settled !== undefined)
             return wrapResponse(settled);
-        return await runValidationBeforeAuthentication(host, entry, program, source, ctx, finalize, wrapResponse, validationIndex);
+        const outcome = runValidationBeforeAuthentication(host, entry, program, source, ctx, finalize, wrapResponse, validationIndex);
+        return outcome instanceof Promise ? await outcome : outcome;
     }
     catch (error) {
         return await host.handleProgramError(entry, error, ctx, finalize, wrapResponse);
@@ -273,23 +345,27 @@ function runValidatedProgram(host, entry, program, source, ctx, finalize, wrapRe
     return runSync(host, entry, program, source, ctx, finalize, wrapResponse, 0, undefined);
 }
 /** Opt-in sensitive-route lane: run authentication/policy hooks before parsing untrusted input. */
-async function runAuthBeforeValidation(host, entry, program, source, ctx, finalize, wrapResponse, gated = false) {
+function runAuthBeforeValidation(host, entry, program, source, ctx, finalize, wrapResponse, gated = false, deriveStart = 0, beforeStart = 0, validationStart = 0) {
     try {
         if (!gated) {
-            if (program.hasDecorations)
+            if (deriveStart === 0 && beforeStart === 0 && program.hasDecorations)
                 Object.assign(ctx, program.decorations);
-            for (const derive of program.derives) {
-                const result = derive(ctx);
-                const settled = result instanceof Promise ? await result : result;
-                if (isEarly(settled))
-                    return finishEarly(host, entry, ctx, settled, finalize, wrapResponse);
-                Object.assign(ctx, settled);
+            for (let i = deriveStart; i < program.derives.length; i++) {
+                const result = program.derives[i](ctx);
+                if (result instanceof Promise) {
+                    return continueProgram(host, entry, program, source, ctx, finalize, wrapResponse, { kind: "derive", next: i + 1, policy: true }, result, undefined);
+                }
+                if (isEarly(result))
+                    return finishEarly(host, entry, ctx, result, finalize, wrapResponse);
+                Object.assign(ctx, result);
             }
-            for (const before of program.beforeHandle) {
-                const result = before(ctx);
-                const settled = result instanceof Promise ? await result : result;
-                if (settled !== undefined)
-                    return finishEarly(host, entry, ctx, settled, finalize, wrapResponse);
+            for (let i = beforeStart; i < program.beforeHandle.length; i++) {
+                const result = program.beforeHandle[i](ctx);
+                if (result instanceof Promise) {
+                    return continueProgram(host, entry, program, source, ctx, finalize, wrapResponse, { kind: "before", next: i + 1, policy: true }, result, undefined);
+                }
+                if (result !== undefined)
+                    return finishEarly(host, entry, ctx, result, finalize, wrapResponse);
             }
             // The policy hooks have passed, so the idempotency gate may buffer the body now. Not awaited:
             // the gate reports its own failures, and one the resumed program let escape must skip this catch.
@@ -297,23 +373,23 @@ async function runAuthBeforeValidation(host, entry, program, source, ctx, finali
                 return runIdempotencyGate(host, entry, ctx, finalize, wrapResponse, (e, p) => runAuthBeforeValidation(host, e, p, source, ctx, finalize, wrapResponse, true));
             }
         }
-        for (const stage of program.validationStages) {
+        for (let i = validationStart; i < program.validationStages.length; i++) {
+            const stage = program.validationStages[i];
             const result = stage.kind === "body"
-                ? await host.readProgramBody(entry, source, ctx)
+                ? host.readProgramBody(entry, source, ctx)
                 : host.validateProgramStage(entry, stage, source, ctx);
-            const settled = result instanceof Promise ? await result : result;
-            if (settled !== undefined)
-                return wrapResponse(settled);
-        }
-        let result = await program.handler(ctx);
-        for (const after of program.afterHandle) {
-            const transformed = after(result, ctx);
-            result = transformed instanceof Promise ? await transformed : transformed;
+            if (result instanceof Promise) {
+                return continueProgram(host, entry, program, source, ctx, finalize, wrapResponse, { kind: "validation", next: i + 1, policy: true }, result, undefined);
+            }
+            if (result !== undefined)
+                return wrapResponse(result);
         }
-        return await host.finishProgramResult(entry, ctx, result, finalize, wrapResponse);
+        // A pending outcome here already met the error boundary (continueProgram or the response
+        // contract), so wrapping it in another catch would only add a promise.
+        return runHooksSync(host, entry, program, source, ctx, finalize, wrapResponse, program.derives.length, program.beforeHandle.length, undefined);
     }
     catch (error) {
-        return await host.handleProgramError(entry, error, ctx, finalize, wrapResponse);
+        return host.handleProgramError(entry, error, ctx, finalize, wrapResponse);
     }
 }
 /** Execute the general program. The first synchronous stage sequence stays synchronous. */
@@ -356,9 +432,9 @@ function runSync(host, entry, program, source, ctx, finalize, wrapResponse, vali
         if (outcome !== undefined)
             return wrapResponse(outcome);
     }
-    return runHooksSync(host, entry, program, source, ctx, finalize, wrapResponse, 0, 0, 0, initial);
+    return runHooksSync(host, entry, program, source, ctx, finalize, wrapResponse, 0, 0, initial);
 }
-function runHooksSync(host, entry, program, source, ctx, finalize, wrapResponse, deriveIndex, beforeIndex, afterIndex, initial) {
+function runHooksSync(host, entry, program, source, ctx, finalize, wrapResponse, deriveIndex, beforeIndex, initial) {
     for (let i = deriveIndex; i < program.derives.length; i++) {
         const outcome = program.derives[i](ctx);
         if (outcome instanceof Promise) {
@@ -380,7 +456,9 @@ function runHooksSync(host, entry, program, source, ctx, finalize, wrapResponse,
     if (output instanceof Promise) {
         return continueProgram(host, entry, program, source, ctx, finalize, wrapResponse, { kind: "handler" }, output, initial);
     }
-    let result = output;
+    return runAfterSync(host, entry, program, source, ctx, finalize, wrapResponse, 0, output);
+}
+function runAfterSync(host, entry, program, source, ctx, finalize, wrapResponse, afterIndex, result) {
     for (let i = afterIndex; i < program.afterHandle.length; i++) {
         const outcome = program.afterHandle[i](result, ctx);
         if (outcome instanceof Promise) {
@@ -413,58 +491,28 @@ async function continueProgram(host, entry, program, source, ctx, finalize, wrap
         else {
             result = settled;
         }
-        return await runAsyncStages(host, entry, program, source, ctx, finalize, wrapResponse, pendingPhase, result);
+        const outcome = runAsyncStages(host, entry, program, source, ctx, finalize, wrapResponse, pendingPhase, result);
+        return outcome instanceof Promise ? await outcome : outcome;
     }
     catch (error) {
         return await host.handleProgramError(entry, error, ctx, finalize, wrapResponse);
     }
 }
-async function runAsyncStages(host, entry, program, source, ctx, finalize, wrapResponse, pendingPhase, result) {
-    try {
-        if (pendingPhase.kind === "validation") {
-            const validations = program.validationStages;
-            for (let i = pendingPhase.next; i < validations.length; i++) {
-                const stage = validations[i];
-                const outcome = stage.kind === "body"
-                    ? await host.readProgramBody(entry, source, ctx)
-                    : host.validateProgramStage(entry, stage, source, ctx);
-                const settled = outcome instanceof Promise ? await outcome : outcome;
-                if (settled !== undefined)
-                    return wrapResponse(settled);
-            }
+function runAsyncStages(host, entry, program, source, ctx, finalize, wrapResponse, pendingPhase, result) {
+    // After an actual async boundary, resume the same sync runner until the next pending stage.
+    // Sync hooks and finalization need no async function wrapper or additional microtask turn.
+    if (pendingPhase.kind === "validation") {
+        if (pendingPhase.policy) {
+            return runAuthBeforeValidation(host, entry, program, source, ctx, finalize, wrapResponse, true, 0, 0, pendingPhase.next);
         }
-        const deriveStart = pendingPhase.kind === "derive" ? pendingPhase.next : 0;
-        if (pendingPhase.kind === "validation" || pendingPhase.kind === "derive") {
-            for (let i = deriveStart; i < program.derives.length; i++) {
-                const outcome = program.derives[i](ctx);
-                const settled = outcome instanceof Promise ? await outcome : outcome;
-                if (isEarly(settled))
-                    return finishEarly(host, entry, ctx, settled, finalize, wrapResponse);
-                Object.assign(ctx, settled);
-            }
-        }
-        const beforeStart = pendingPhase.kind === "before" ? pendingPhase.next : 0;
-        if (pendingPhase.kind === "validation" ||
-            pendingPhase.kind === "derive" ||
-            pendingPhase.kind === "before") {
-            for (let i = beforeStart; i < program.beforeHandle.length; i++) {
-                const outcome = program.beforeHandle[i](ctx);
-                const settled = outcome instanceof Promise ? await outcome : outcome;
-                if (settled !== undefined)
-                    return finishEarly(host, entry, ctx, settled, finalize, wrapResponse);
-            }
-            const output = program.handler(ctx);
-            result = output instanceof Promise ? await output : output;
-        }
-        const afterStart = pendingPhase.kind === "after" ? pendingPhase.next : 0;
-        for (let i = afterStart; i < program.afterHandle.length; i++) {
-            const outcome = program.afterHandle[i](result, ctx);
-            result = outcome instanceof Promise ? await outcome : outcome;
-        }
-        return await host.finishProgramResult(entry, ctx, result, finalize, wrapResponse);
+        return runSync(host, entry, program, source, ctx, finalize, wrapResponse, pendingPhase.next, result);
     }
-    catch (error) {
-        return await host.handleProgramError(entry, error, ctx, finalize, wrapResponse);
+    if (pendingPhase.kind === "derive" || pendingPhase.kind === "before") {
+        if (pendingPhase.policy) {
+            return runAuthBeforeValidation(host, entry, program, source, ctx, finalize, wrapResponse, false, pendingPhase.kind === "derive" ? pendingPhase.next : program.derives.length, pendingPhase.kind === "before" ? pendingPhase.next : 0);
+        }
+        return runHooksSync(host, entry, program, source, ctx, finalize, wrapResponse, pendingPhase.kind === "derive" ? pendingPhase.next : program.derives.length, pendingPhase.kind === "before" ? pendingPhase.next : 0, result);
     }
+    return runAfterSync(host, entry, program, source, ctx, finalize, wrapResponse, pendingPhase.kind === "after" ? pendingPhase.next : 0, result);
 }
 //# sourceMappingURL=route-program.js.map