@nifrajs/middleware 0.1.0-alpha.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Nifra Authors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,79 @@
+# @nifrajs/middleware
+
+Composable, dependency-light middleware for [nifra](../../README.md) — CORS, security headers, body
+limits, auth, CSRF, JWT/JWKS, IP restriction, response caching, timing, and ops helpers — applied with
+`app.use()`.
+
+```sh
+bun add @nifrajs/middleware
+```
+
+```ts
+import { server } from "@nifrajs/core"
+import {
+  bodyLimit,
+  cors,
+  MemoryStore,
+  rateLimit,
+  securityHeaders,
+  timing,
+} from "@nifrajs/middleware"
+
+const app = server()
+  .use(securityHeaders())
+  .use(cors({ origin: ["https://app.example.com"], credentials: true }))
+  .use(bodyLimit({ maxBytes: 1_000_000 }))
+  .use(rateLimit({
+    store: new MemoryStore(),
+    max: 100,
+    windowMs: 60_000,
+    key: (req) => req.headers.get("x-user-id") ?? "anonymous",
+  }))
+  .use(timing())
+  .get("/", () => ({ ok: true }))
+```
+
+- **`bodyLimit({ maxBytes })`** — fail-closed `Content-Length` gate before routing. Lengthless
+  bodies are rejected with `411` by default; use route-level `c.boundedBody()` / schema validation
+  for intentionally streamed endpoints.
+- **`basicAuth(options)`** — Basic Auth plugin with constant-time static credential comparison or
+  a custom verifier.
+- **`bearer(options)` / `apiKey(options)`** — token auth plugins with typed principals.
+- **`csrf({ secret })`** — signed double-submit CSRF protection plus Origin/Referer checking.
+- **`jwt(options)` + `verifyJwt()` / `tryVerifyJwt()` + `jwk()` / `jwks()`** — JWT auth
+  with explicit algorithm allowlists, required expiration by default, issuer/audience checks,
+  direct JWK, HTTPS JWKS, and an additive no-throw Result helper for manual verification.
+- **`ipRestriction(options)`** — allow/deny IPv4/IPv6 exact and CIDR matches. Fails closed unless
+  you provide `clientIp`, trusted proxy extraction, or a trusted single-IP header.
+- **`cors(options)`** — preflight handling + headers on *every* response (errors and
+  404s included). Origin as `"*"` / exact / list / predicate. **Throws** if
+  `credentials: true` is paired with `origin: "*"` (the browser rejects it).
+- **`securityHeaders(options)`** — `X-Content-Type-Options`, `X-Frame-Options`,
+  `Referrer-Policy` by default; opt-in HSTS and CSP.
+- **`rateLimit(options)`** — `429` + `Retry-After` + `RateLimit-*` headers, with a
+  pluggable `RateLimitStore`. Configure a trusted `key`, trusted single-IP `header`, or
+  `trustedProxies`; a missing key source fails closed instead of silently sharing one
+  bucket. The bundled `MemoryStore` **refuses to run in production** (a per-instance
+  limiter is unsafe across instances) — provide a shared store (Redis, etc.) there.
+- **`cache({ store, ttlMs })` / `responseCache(...)`** — full response cache with a pluggable
+  store, `Vary`-aware keys, `Age`, byte caps, and `Cache-Control` / `Set-Cookie` safety defaults.
+  `MemoryResponseCache` is dev/single-instance only unless explicitly allowed in production.
+- **`timing()`** — `Server-Timing` plus typed `c.timing.metric/mark/measure` controls.
+- **`prettyJson()`** — capped, JSON-only pretty printing for debugging and developer-facing APIs.
+- **`methodOverride()`** — header/query method tunneling for clients that can only send `POST`.
+  Header override is on by default; query override is opt-in.
+- **`trimTrailingSlash()` / `appendTrailingSlash()`** — redirect or rewrite URL canonicalization.
+- **`poweredBy()`** — opt-in product/framework header; Nifra emits no powered-by header by default.
+- **`language()` / `pickLanguage()`** — `Accept-Language` negotiation with typed `c.language`.
+- **`combine()` / `namedCombine()`** — reusable runtime bundles for middleware/plugins.
+- **`requestId()` / `logger()` / `etag()` / `compression()` / `cacheControl()` /
+  `idempotency()` / `healthcheck()` / `openapi()`** — additional operational middleware for APIs.
+
+Request timeouts are configured at the core server boundary so they can abort `c.signal` and race the
+whole lifecycle:
+
+```ts
+const app = server({ requestTimeoutMs: 5_000 })
+```
+
+`@nifrajs/core` is a peer dependency. ESM-only. MIT.

package/dist/_utils.d.ts

@@ -0,0 +1,27 @@
+export type MaybePromise<T> = T | Promise<T>;
+export declare const SAFE_METHODS: Set<string>;
+export declare function jsonError(status: number, error: string, headers?: Record<string, string>): Response;
+export declare function parseCookies(header: string | null | undefined): Record<string, string>;
+export declare function quotedHeaderValue(value: string): string;
+export declare function utf8Bytes(value: string): Uint8Array<ArrayBuffer>;
+export declare function secretBytes(secret: string | Uint8Array, label: string): Uint8Array<ArrayBuffer>;
+export declare function sha256(input: string | Uint8Array): Promise<Uint8Array<ArrayBuffer>>;
+export declare function timingSafeEqualBytes(a: Uint8Array, b: Uint8Array): boolean;
+export declare function timingSafeEqualString(a: string, b: string): Promise<boolean>;
+export declare function base64UrlEncode(bytes: ArrayBuffer | Uint8Array): string;
+export declare function base64UrlDecode(input: string): Uint8Array<ArrayBuffer> | null;
+export declare function decodeBase64(input: string): Uint8Array<ArrayBuffer> | null;
+export declare function importHmacKey(secret: string | Uint8Array, hash?: string): Promise<CryptoKey>;
+export declare function hmacSha256(input: string, secret: string | Uint8Array): Promise<string>;
+export declare function verifyHmacSha256(input: string, signature: string, secret: string | Uint8Array): Promise<boolean>;
+/**
+ * Apply header mutations to a response, in place when possible. Framework-built responses
+ * (`new Response`, `Response.json`) have mutable headers across every runtime — so the common path
+ * mutates `res` directly and returns it, allocating nothing. Only an *immutable*-headers response
+ * (`Response.redirect()`/`Response.error()`, or a proxied `fetch()` response on Node/Deno/workerd —
+ * never on Bun) makes `.set`/`.append` throw; that path clones into a fresh `Headers` + `Response`,
+ * exactly the old always-clone behavior. `apply` runs once either way (immutability is all-or-nothing
+ * — the first mutation throws before any partial change), so a mutation chain is safe to pass.
+ */
+export declare function withHeaders(res: Response, apply: (headers: Headers) => void): Response;
+//# sourceMappingURL=_utils.d.ts.map

package/dist/_utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_utils.d.ts","sourceRoot":"","sources":["../src/_utils.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;AAE5C,eAAO,MAAM,YAAY,aAA+C,CAAA;AAIxE,wBAAgB,SAAS,CACvB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,QAAQ,CAKV;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAqBtF;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CASvD;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAEhE;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAM/F;AAED,wBAAsB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAGzF;AAED,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAK1E;AAED,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGlF;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,UAAU,GAAG,MAAM,CAKvE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,IAAI,CAc7E;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,IAAI,CAS1E;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,GAAG,UAAU,EAC3B,IAAI,SAAY,GACf,OAAO,CAAC,SAAS,CAAC,CAQpB;AAED,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAI5F;AAED,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GAAG,UAAU,GAC1B,OAAO,CAAC,OAAO,CAAC,CAKlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,GAAG,QAAQ,CAStF"}

package/dist/_utils.js

@@ -0,0 +1,141 @@
+export const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS", "TRACE"]);
+const TEXT = new TextEncoder();
+export function jsonError(status, error, headers) {
+    return Response.json({ ok: false, error }, headers === undefined ? { status } : { status, headers });
+}
+export function parseCookies(header) {
+    // Null-prototype: an untrusted cookie name (`constructor`/`__proto__`/…) is an inert own key,
+    // never a prototype-member shadow. Mirrors core's parseCookies + the query/form parsers.
+    const out = Object.create(null);
+    if (!header)
+        return out;
+    for (const part of header.split(";")) {
+        const eq = part.indexOf("=");
+        if (eq < 1)
+            continue;
+        const name = part.slice(0, eq).trim();
+        if (name === "")
+            continue;
+        let value = part.slice(eq + 1).trim();
+        if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) {
+            value = value.slice(1, -1);
+        }
+        try {
+            out[name] = decodeURIComponent(value);
+        }
+        catch {
+            out[name] = value;
+        }
+    }
+    return out;
+}
+export function quotedHeaderValue(value) {
+    let out = "";
+    for (let i = 0; i < value.length; i++) {
+        const c = value.charCodeAt(i);
+        if (c < 0x20 || c === 0x7f)
+            continue;
+        const ch = value[i] ?? "";
+        out += ch === "\\" || ch === '"' ? `\\${ch}` : ch;
+    }
+    return out;
+}
+export function utf8Bytes(value) {
+    return TEXT.encode(value);
+}
+export function secretBytes(secret, label) {
+    const bytes = typeof secret === "string" ? utf8Bytes(secret) : new Uint8Array(secret);
+    if (bytes.byteLength < 32) {
+        throw new Error(`${label}: secret must be at least 32 bytes`);
+    }
+    return bytes;
+}
+export async function sha256(input) {
+    const bytes = typeof input === "string" ? utf8Bytes(input) : new Uint8Array(input);
+    return new Uint8Array(await crypto.subtle.digest("SHA-256", bytes));
+}
+export function timingSafeEqualBytes(a, b) {
+    if (a.byteLength !== b.byteLength)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.byteLength; i++)
+        diff |= (a[i] ?? 0) ^ (b[i] ?? 0);
+    return diff === 0;
+}
+export async function timingSafeEqualString(a, b) {
+    const [left, right] = await Promise.all([sha256(a), sha256(b)]);
+    return timingSafeEqualBytes(left, right);
+}
+export function base64UrlEncode(bytes) {
+    const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+    let bin = "";
+    for (const b of view)
+        bin += String.fromCharCode(b);
+    return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+export function base64UrlDecode(input) {
+    if (!/^[A-Za-z0-9_-]*$/.test(input) || input.length % 4 === 1)
+        return null;
+    const padded = input
+        .replace(/-/g, "+")
+        .replace(/_/g, "/")
+        .padEnd(Math.ceil(input.length / 4) * 4, "=");
+    try {
+        const bin = atob(padded);
+        const bytes = new Uint8Array(bin.length);
+        for (let i = 0; i < bin.length; i++)
+            bytes[i] = bin.charCodeAt(i);
+        return bytes;
+    }
+    catch {
+        return null;
+    }
+}
+export function decodeBase64(input) {
+    try {
+        const bin = atob(input);
+        const bytes = new Uint8Array(bin.length);
+        for (let i = 0; i < bin.length; i++)
+            bytes[i] = bin.charCodeAt(i);
+        return bytes;
+    }
+    catch {
+        return null;
+    }
+}
+export async function importHmacKey(secret, hash = "SHA-256") {
+    return crypto.subtle.importKey("raw", secretBytes(secret, "hmac"), { name: "HMAC", hash }, false, ["sign", "verify"]);
+}
+export async function hmacSha256(input, secret) {
+    const key = await importHmacKey(secret, "SHA-256");
+    const sig = await crypto.subtle.sign("HMAC", key, utf8Bytes(input));
+    return base64UrlEncode(sig);
+}
+export async function verifyHmacSha256(input, signature, secret) {
+    const sig = base64UrlDecode(signature);
+    if (sig === null)
+        return false;
+    const key = await importHmacKey(secret, "SHA-256");
+    return crypto.subtle.verify("HMAC", key, sig, utf8Bytes(input));
+}
+/**
+ * Apply header mutations to a response, in place when possible. Framework-built responses
+ * (`new Response`, `Response.json`) have mutable headers across every runtime — so the common path
+ * mutates `res` directly and returns it, allocating nothing. Only an *immutable*-headers response
+ * (`Response.redirect()`/`Response.error()`, or a proxied `fetch()` response on Node/Deno/workerd —
+ * never on Bun) makes `.set`/`.append` throw; that path clones into a fresh `Headers` + `Response`,
+ * exactly the old always-clone behavior. `apply` runs once either way (immutability is all-or-nothing
+ * — the first mutation throws before any partial change), so a mutation chain is safe to pass.
+ */
+export function withHeaders(res, apply) {
+    try {
+        apply(res.headers);
+        return res;
+    }
+    catch {
+        const headers = new Headers(res.headers);
+        apply(headers);
+        return new Response(res.body, { status: res.status, statusText: res.statusText, headers });
+    }
+}
+//# sourceMappingURL=_utils.js.map

package/dist/_utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_utils.js","sourceRoot":"","sources":["../src/_utils.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;AAExE,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAA;AAE9B,MAAM,UAAU,SAAS,CACvB,MAAc,EACd,KAAa,EACb,OAAgC;IAEhC,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EACpB,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CACzD,CAAA;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAiC;IAC5D,8FAA8F;IAC9F,yFAAyF;IACzF,MAAM,GAAG,GAA2B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACvD,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAA;IACvB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,EAAE,GAAG,CAAC;YAAE,SAAQ;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QACrC,IAAI,IAAI,KAAK,EAAE;YAAE,SAAQ;QACzB,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACrC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAC5B,CAAC;QACD,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;QACnB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,IAAI;YAAE,SAAQ;QACpC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACzB,GAAG,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACnD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAA2B,EAAE,KAAa;IACpE,MAAM,KAAK,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;IACrF,IAAI,KAAK,CAAC,UAAU,GAAG,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAA;IAC/D,CAAC;IACD,OAAO,KAAgC,CAAA;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,KAA0B;IACrD,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IAClF,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAA4B,CAAA;AAChG,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,CAAa,EAAE,CAAa;IAC/D,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;QAAE,OAAO,KAAK,CAAA;IAC/C,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IACxE,OAAO,IAAI,KAAK,CAAC,CAAA;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,CAAS,EAAE,CAAS;IAC9D,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/D,OAAO,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AAC1C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAA+B;IAC7D,MAAM,IAAI,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IACxE,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IACnD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AAC7E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1E,MAAM,MAAM,GAAG,KAAK;SACjB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;QACxB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QACjE,OAAO,KAAgC,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;QACvB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QACjE,OAAO,KAAgC,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAA2B,EAC3B,IAAI,GAAG,SAAS;IAEhB,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EACtB,KAAK,EACL,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAa,EAAE,MAA2B;IACzE,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAClD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;IACnE,OAAO,eAAe,CAAC,GAAG,CAAC,CAAA;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,SAAiB,EACjB,MAA2B;IAE3B,MAAM,GAAG,GAAG,eAAe,CAAC,SAAS,CAAC,CAAA;IACtC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC9B,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAClD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;AACjE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,GAAa,EAAE,KAAiC;IAC1E,IAAI,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAClB,OAAO,GAAG,CAAA;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACxC,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;IAC5F,CAAC;AACH,CAAC"}

package/dist/basic-auth.d.ts

@@ -0,0 +1,27 @@
+import { type NifraPlugin } from "@nifrajs/core";
+import { type MaybePromise } from "./_utils.js";
+export type BasicAuthPlugin<P> = NifraPlugin & {
+    principal(request: Request): P | null;
+    requirePrincipal(request: Request): P;
+};
+export interface BasicAuthStaticOptions<P = string> {
+    readonly username: string;
+    readonly password: string;
+    readonly principal?: P;
+    readonly realm?: string;
+    readonly optional?: boolean;
+}
+export interface BasicAuthVerifyOptions<P> {
+    readonly verify: (username: string, password: string) => MaybePromise<P | null | undefined>;
+    readonly realm?: string;
+    readonly optional?: boolean;
+}
+/**
+ * HTTP Basic authentication. Prefer short-lived Basic Auth for internal tools and staging gates, not
+ * public user login. Static credentials are compared in constant time after SHA-256 hashing; the
+ * callback form is available for external stores.
+ */
+export declare function basicAuth(options: BasicAuthStaticOptions): BasicAuthPlugin<string>;
+export declare function basicAuth<P>(options: BasicAuthStaticOptions<P>): BasicAuthPlugin<P>;
+export declare function basicAuth<P>(options: BasicAuthVerifyOptions<P>): BasicAuthPlugin<P>;
+//# sourceMappingURL=basic-auth.d.ts.map

package/dist/basic-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"basic-auth.d.ts","sourceRoot":"","sources":["../src/basic-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,WAAW,EAAE,MAAM,eAAe,CAAA;AAC9D,OAAO,EAGL,KAAK,YAAY,EAIlB,MAAM,aAAa,CAAA;AAEpB,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI,WAAW,GAAG;IAC7C,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,CAAC,GAAG,IAAI,CAAA;IACrC,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,CAAC,CAAA;CACtC,CAAA;AAED,MAAM,WAAW,sBAAsB,CAAC,CAAC,GAAG,MAAM;IAChD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,sBAAsB,CAAC,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,YAAY,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,CAAA;IAC3F,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAC5B;AA0CD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,sBAAsB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;AACnF,wBAAgB,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAA;AACpF,wBAAgB,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAA"}

package/dist/basic-auth.js

@@ -0,0 +1,64 @@
+import { definePlugin } from "@nifrajs/core";
+import { decodeBase64, jsonError, quotedHeaderValue, sha256, timingSafeEqualBytes, } from "./_utils.js";
+const UTF8 = new TextDecoder("utf-8", { fatal: true });
+function challenge(realm) {
+    return `Basic realm="${quotedHeaderValue(realm)}", charset="UTF-8"`;
+}
+function reject(realm) {
+    return jsonError(401, "unauthorized", { "www-authenticate": challenge(realm) });
+}
+function credentials(request) {
+    const header = request.headers.get("authorization");
+    if (header?.startsWith("Basic ") !== true)
+        return null;
+    const raw = decodeBase64(header.slice(6).trim());
+    if (raw === null)
+        return null;
+    let decoded;
+    try {
+        decoded = UTF8.decode(raw);
+    }
+    catch {
+        return null;
+    }
+    const colon = decoded.indexOf(":");
+    if (colon < 0)
+        return null;
+    return { username: decoded.slice(0, colon), password: decoded.slice(colon + 1) };
+}
+async function staticVerifier(username, password, principal) {
+    const [expectedUser, expectedPass] = await Promise.all([sha256(username), sha256(password)]);
+    return async (u, p) => {
+        const [gotUser, gotPass] = await Promise.all([sha256(u), sha256(p)]);
+        const userOk = timingSafeEqualBytes(gotUser, expectedUser);
+        const passOk = timingSafeEqualBytes(gotPass, expectedPass);
+        return userOk && passOk ? principal : null;
+    };
+}
+export function basicAuth(options) {
+    const realm = options.realm ?? "api";
+    const optional = options.optional === true;
+    const store = new WeakMap();
+    const verifyPromise = "verify" in options
+        ? Promise.resolve(options.verify)
+        : staticVerifier(options.username, options.password, options.principal ?? options.username);
+    const plugin = definePlugin("basicAuth", (app) => app.beforeHandle(async (c) => {
+        const parsed = credentials(c.req);
+        const principal = parsed === null ? null : await (await verifyPromise)(parsed.username, parsed.password);
+        if (principal !== null && principal !== undefined) {
+            store.set(c.req, principal);
+            return undefined;
+        }
+        return optional ? undefined : reject(realm);
+    }));
+    return Object.assign(plugin, {
+        principal: (request) => store.get(request) ?? null,
+        requirePrincipal: (request) => {
+            const principal = store.get(request);
+            if (principal === undefined)
+                throw reject(realm);
+            return principal;
+        },
+    });
+}
+//# sourceMappingURL=basic-auth.js.map

package/dist/basic-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"basic-auth.js","sourceRoot":"","sources":["../src/basic-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAoB,MAAM,eAAe,CAAA;AAC9D,OAAO,EACL,YAAY,EACZ,SAAS,EAET,iBAAiB,EACjB,MAAM,EACN,oBAAoB,GACrB,MAAM,aAAa,CAAA;AAqBpB,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AAEtD,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,gBAAgB,iBAAiB,CAAC,KAAK,CAAC,oBAAoB,CAAA;AACrE,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,SAAS,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,kBAAkB,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;AACjF,CAAC;AAED,SAAS,WAAW,CAAC,OAAgB;IACnC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IACnD,IAAI,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACtD,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IAChD,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC7B,IAAI,OAAe,CAAA;IACnB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAClC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1B,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAA;AAClF,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,QAAgB,EAChB,QAAgB,EAChB,SAAY;IAEZ,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;IAC5F,OAAO,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE;QACpB,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACpE,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;QAC1D,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;QAC1D,OAAO,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;IAC5C,CAAC,CAAA;AACH,CAAC;AAUD,MAAM,UAAU,SAAS,CACvB,OAA8D;IAE9D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAA;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAA;IAC1C,MAAM,KAAK,GAAG,IAAI,OAAO,EAAuB,CAAA;IAChD,MAAM,aAAa,GACjB,QAAQ,IAAI,OAAO;QACjB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;QACjC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAA;IAE/F,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CAC/C,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,CAA4B,EAAE,EAAE;QACtD,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QACjC,MAAM,SAAS,GACb,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,aAAa,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;QACxF,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAClD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;YAC3B,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,OAAO,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC7C,CAAC,CAAC,CACH,CAAA;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE;QAC3B,SAAS,EAAE,CAAC,OAAgB,EAAqB,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI;QAC9E,gBAAgB,EAAE,CAAC,OAAgB,EAAc,EAAE;YACjD,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACpC,IAAI,SAAS,KAAK,SAAS;gBAAE,MAAM,MAAM,CAAC,KAAK,CAAC,CAAA;YAChD,OAAO,SAAS,CAAA;QAClB,CAAC;KACF,CAAgC,CAAA;AACnC,CAAC"}

package/dist/body-limit.d.ts

@@ -0,0 +1,19 @@
+import type { Middleware } from "@nifrajs/core";
+export interface BodyLimitOptions {
+    /** Maximum raw request-body bytes accepted. */
+    readonly maxBytes: number;
+    /** Methods to inspect. Default: every method except GET/HEAD/OPTIONS/TRACE. */
+    readonly methods?: readonly string[];
+    /** Response error name for over-limit bodies. Default `"payload_too_large"`. */
+    readonly error?: string;
+    /** Allow bodies without Content-Length. Default false (fail closed with 411). */
+    readonly allowLengthless?: boolean;
+}
+/**
+ * Enforce a raw byte cap for request bodies before routing. This middleware is intentionally
+ * Content-Length based: reading a cloned Web body is not transparent on every runtime. Lengthless
+ * bodies fail closed by default; use route-level `c.boundedBody()` / schema validation for endpoints
+ * that intentionally accept streamed bodies.
+ */
+export declare function bodyLimit(options: BodyLimitOptions): Middleware;
+//# sourceMappingURL=body-limit.d.ts.map

package/dist/body-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-limit.d.ts","sourceRoot":"","sources":["../src/body-limit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAG/C,MAAM,WAAW,gBAAgB;IAC/B,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,gFAAgF;IAChF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,iFAAiF;IACjF,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CACnC;AASD;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,UAAU,CAyB/D"}

package/dist/body-limit.js

@@ -0,0 +1,42 @@
+import { jsonError, SAFE_METHODS } from "./_utils.js";
+function parseContentLength(value) {
+    if (value === null)
+        return undefined;
+    if (!/^\d+$/.test(value))
+        return null;
+    const n = Number(value);
+    return Number.isSafeInteger(n) ? n : Infinity;
+}
+/**
+ * Enforce a raw byte cap for request bodies before routing. This middleware is intentionally
+ * Content-Length based: reading a cloned Web body is not transparent on every runtime. Lengthless
+ * bodies fail closed by default; use route-level `c.boundedBody()` / schema validation for endpoints
+ * that intentionally accept streamed bodies.
+ */
+export function bodyLimit(options) {
+    const { maxBytes } = options;
+    if (!Number.isSafeInteger(maxBytes) || maxBytes < 0) {
+        throw new Error("bodyLimit: maxBytes must be a non-negative safe integer");
+    }
+    const methods = options.methods !== undefined ? new Set(options.methods.map((m) => m.toUpperCase())) : undefined;
+    const error = options.error ?? "payload_too_large";
+    const allowLengthless = options.allowLengthless === true;
+    return {
+        name: "body-limit",
+        onRequest(req) {
+            if (methods !== undefined ? !methods.has(req.method) : SAFE_METHODS.has(req.method)) {
+                return undefined;
+            }
+            const contentLength = parseContentLength(req.headers.get("content-length"));
+            if (contentLength === null)
+                return jsonError(400, "invalid_content_length");
+            if (contentLength === undefined && req.body !== null && !allowLengthless) {
+                return jsonError(411, "length_required");
+            }
+            if (contentLength !== undefined && contentLength > maxBytes)
+                return jsonError(413, error);
+            return undefined;
+        },
+    };
+}
+//# sourceMappingURL=body-limit.js.map

package/dist/body-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-limit.js","sourceRoot":"","sources":["../src/body-limit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAarD,SAAS,kBAAkB,CAAC,KAAoB;IAC9C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IACpC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACrC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IACvB,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,OAAyB;IACjD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;IAC5B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IACD,MAAM,OAAO,GACX,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAClG,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,mBAAmB,CAAA;IAClD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,KAAK,IAAI,CAAA;IAExD,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,SAAS,CAAC,GAAG;YACX,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpF,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,MAAM,aAAa,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAA;YAC3E,IAAI,aAAa,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAA;YAC3E,IAAI,aAAa,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBACzE,OAAO,SAAS,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAA;YAC1C,CAAC;YACD,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,GAAG,QAAQ;gBAAE,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YACzF,OAAO,SAAS,CAAA;QAClB,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/cache-control.d.ts

@@ -0,0 +1,23 @@
+export interface CacheControlOptions {
+    /** Methods whose responses get the header. Default `["GET", "HEAD"]`. */
+    readonly methods?: readonly string[];
+    /** Predicate over the response status. Default: 2xx only. */
+    readonly status?: (status: number) => boolean;
+    /** When `true` (default), don't overwrite a `Cache-Control` the handler already set. */
+    readonly respectExisting?: boolean;
+}
+/**
+ * Set a `Cache-Control` header on matching responses. `value` is either a fixed directive string or a
+ * function of the request (return `undefined` to leave a response untouched — e.g. cache by path).
+ * Defaults to `GET`/`HEAD` + 2xx, and never clobbers a `Cache-Control` the handler set itself.
+ *
+ * ```ts
+ * app.use(cacheControl("public, max-age=3600, stale-while-revalidate=60"))
+ * // or per-path:
+ * app.use(cacheControl((req) =>
+ *   new URL(req.url).pathname.startsWith("/assets/") ? "public, max-age=31536000, immutable" : undefined,
+ * ))
+ * ```
+ */
+export declare function cacheControl(value: string | ((request: Request) => string | undefined), options?: CacheControlOptions): import("@nifrajs/core").NifraPlugin<import("@nifrajs/core").AnyServer, import("@nifrajs/core").AnyServer>;
+//# sourceMappingURL=cache-control.d.ts.map

package/dist/cache-control.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-control.d.ts","sourceRoot":"","sources":["../src/cache-control.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,mBAAmB;IAClC,yEAAyE;IACzE,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAA;IAC7C,wFAAwF;IACxF,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CACnC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAC,EAC1D,OAAO,GAAE,mBAAwB,6GAkBlC"}

package/dist/cache-control.js

@@ -0,0 +1,35 @@
+import { definePlugin } from "@nifrajs/core";
+/**
+ * Set a `Cache-Control` header on matching responses. `value` is either a fixed directive string or a
+ * function of the request (return `undefined` to leave a response untouched — e.g. cache by path).
+ * Defaults to `GET`/`HEAD` + 2xx, and never clobbers a `Cache-Control` the handler set itself.
+ *
+ * ```ts
+ * app.use(cacheControl("public, max-age=3600, stale-while-revalidate=60"))
+ * // or per-path:
+ * app.use(cacheControl((req) =>
+ *   new URL(req.url).pathname.startsWith("/assets/") ? "public, max-age=31536000, immutable" : undefined,
+ * ))
+ * ```
+ */
+export function cacheControl(value, options = {}) {
+    const methods = new Set((options.methods ?? ["GET", "HEAD"]).map((m) => m.toUpperCase()));
+    const statusOk = options.status ?? ((status) => status >= 200 && status < 300);
+    const respectExisting = options.respectExisting !== false;
+    const resolve = typeof value === "function" ? value : () => value;
+    return definePlugin("cacheControl", (app) => app.onResponse((res, req) => {
+        if (!methods.has(req.method))
+            return res;
+        if (!statusOk(res.status))
+            return res;
+        if (respectExisting && res.headers.has("cache-control"))
+            return res;
+        const directive = resolve(req);
+        if (directive === undefined)
+            return res;
+        const headers = new Headers(res.headers);
+        headers.set("cache-control", directive);
+        return new Response(res.body, { status: res.status, statusText: res.statusText, headers });
+    }));
+}
+//# sourceMappingURL=cache-control.js.map

package/dist/cache-control.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-control.js","sourceRoot":"","sources":["../src/cache-control.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAW5C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAC1B,KAA0D,EAC1D,UAA+B,EAAE;IAEjC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;IACzF,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,MAAc,EAAE,EAAE,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC,CAAA;IACtF,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,KAAK,KAAK,CAAA;IACzD,MAAM,OAAO,GAAG,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAA;IACjE,OAAO,YAAY,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CAC1C,GAAG,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,GAAG,CAAA;QACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,GAAG,CAAA;QACrC,IAAI,eAAe,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;YAAE,OAAO,GAAG,CAAA;QACnE,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,GAAG,CAAA;QACvC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACxC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,CAAC,CAAA;QACvC,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;IAC5F,CAAC,CAAC,CACH,CAAA;AACH,CAAC"}

package/dist/cache.d.ts

@@ -0,0 +1,60 @@
+import type { Middleware } from "@nifrajs/core";
+import type { MaybePromise } from "./_utils.js";
+export interface CachedResponse {
+    readonly status: number;
+    readonly statusText: string;
+    readonly headers: readonly [string, string][];
+    readonly body: Uint8Array;
+    readonly expiresAt: number;
+    readonly storedAt: number;
+}
+export interface ResponseCacheStore {
+    get(key: string): MaybePromise<CachedResponse | undefined>;
+    set(key: string, response: CachedResponse): MaybePromise<void>;
+    delete?(key: string): MaybePromise<void>;
+}
+export interface MemoryResponseCacheOptions {
+    /** Maximum entries retained. Default `1000`. Oldest entries are evicted first. */
+    readonly maxEntries?: number;
+    /** Allow in-process cache in production. Off by default because it is per-instance. */
+    readonly allowInProduction?: boolean;
+}
+export declare class MemoryResponseCache implements ResponseCacheStore {
+    private readonly entries;
+    private readonly maxEntries;
+    constructor(options?: MemoryResponseCacheOptions);
+    get(key: string): CachedResponse | undefined;
+    set(key: string, response: CachedResponse): void;
+    delete(key: string): void;
+}
+export interface CacheOptions {
+    readonly store: ResponseCacheStore;
+    /** Time to live in milliseconds. */
+    readonly ttlMs: number;
+    /** Methods cached. Default `["GET", "HEAD"]`. */
+    readonly methods?: readonly string[];
+    /** Status predicate. Default: `200` only. */
+    readonly status?: (status: number) => boolean;
+    /** Header names included in the cache key and emitted in `Vary`. */
+    readonly vary?: readonly string[];
+    /** Custom cache key. Receives the normalized `vary` headers through the request itself. */
+    readonly key?: (request: Request) => string;
+    /** Maximum response bytes to store. Default `1_000_000`. Larger responses pass through. */
+    readonly maxBytes?: number;
+    /** Respect request `Cache-Control: no-cache/no-store`. Default `true`. */
+    readonly respectRequestCacheControl?: boolean;
+    /** Respect response `Cache-Control: private/no-store`. Default `true`. */
+    readonly respectResponseCacheControl?: boolean;
+    /** Cache responses with `Set-Cookie`. Default `false`. */
+    readonly cacheSetCookie?: boolean;
+    /** Response header for cache status. Default `"x-nifra-cache"`; set `false` to disable. */
+    readonly cacheStatusHeader?: string | false;
+}
+/**
+ * Full response cache for small, cacheable responses. Use a shared `store` in production. The
+ * middleware honors `Cache-Control` by default, avoids `Set-Cookie`, caps stored bytes, emits `Age`,
+ * and keeps `Vary` headers aligned with the cache key.
+ */
+export declare function cache(options: CacheOptions): Middleware;
+export declare const responseCache: typeof cache;
+//# sourceMappingURL=cache.d.ts.map

package/dist/cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE/C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAA;IAC7C,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAAC,cAAc,GAAG,SAAS,CAAC,CAAA;IAC1D,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IAC9D,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;CACzC;AAED,MAAM,WAAW,0BAA0B;IACzC,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,uFAAuF;IACvF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;CACrC;AAED,qBAAa,mBAAoB,YAAW,kBAAkB;IAC5D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAC5D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAQ;gBAEvB,OAAO,GAAE,0BAA+B;IAcpD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAU5C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,IAAI;IAQhD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;CAG1B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAA;IAClC,oCAAoC;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,iDAAiD;IACjD,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,6CAA6C;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAA;IAC7C,oEAAoE;IACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,2FAA2F;IAC3F,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,MAAM,CAAA;IAC3C,2FAA2F;IAC3F,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,0BAA0B,CAAC,EAAE,OAAO,CAAA;IAC7C,0EAA0E;IAC1E,QAAQ,CAAC,2BAA2B,CAAC,EAAE,OAAO,CAAA;IAC9C,0DAA0D;IAC1D,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,2FAA2F;IAC3F,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;CAC5C;AAwFD;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,UAAU,CA6FvD;AAED,eAAO,MAAM,aAAa,cAAQ,CAAA"}