@nifrajs/middleware 0.1.0-alpha.1

package/dist/cache.js

@@ -0,0 +1,224 @@
+export class MemoryResponseCache {
+    entries = new Map();
+    maxEntries;
+    constructor(options = {}) {
+        const env = globalThis.process?.env?.NODE_ENV;
+        if (options.allowInProduction !== true && env === "production") {
+            throw new Error("MemoryResponseCache is per-instance and unsafe in production. Use a shared cache store, " +
+                "or pass { allowInProduction: true } for a single-instance deploy.");
+        }
+        this.maxEntries = options.maxEntries ?? 1000;
+        if (!Number.isInteger(this.maxEntries) || this.maxEntries < 1) {
+            throw new Error("MemoryResponseCache: maxEntries must be a positive integer");
+        }
+    }
+    get(key) {
+        const entry = this.entries.get(key);
+        if (entry === undefined)
+            return undefined;
+        if (Date.now() >= entry.expiresAt) {
+            this.entries.delete(key);
+            return undefined;
+        }
+        return entry;
+    }
+    set(key, response) {
+        if (!this.entries.has(key) && this.entries.size >= this.maxEntries) {
+            const oldest = this.entries.keys().next().value;
+            if (oldest !== undefined)
+                this.entries.delete(oldest);
+        }
+        this.entries.set(key, response);
+    }
+    delete(key) {
+        this.entries.delete(key);
+    }
+}
+function parseLength(value) {
+    if (value === null)
+        return undefined;
+    if (!/^(?:0|[1-9]\d*)$/.test(value))
+        return undefined;
+    return Number(value);
+}
+function cacheControlHas(headers, names) {
+    const value = headers.get("cache-control");
+    if (value === null)
+        return false;
+    const parts = value
+        .toLowerCase()
+        .split(",")
+        .map((part) => part.trim().split("=", 1)[0]);
+    return names.some((name) => parts.includes(name));
+}
+function appendVary(headers, vary) {
+    if (vary.length === 0)
+        return;
+    const existing = headers
+        .get("vary")
+        ?.split(",")
+        .map((v) => v.trim().toLowerCase());
+    const seen = new Set(existing ?? []);
+    const additions = [];
+    for (const header of vary) {
+        const normalized = header.toLowerCase();
+        if (!seen.has(normalized)) {
+            seen.add(normalized);
+            additions.push(header);
+        }
+    }
+    if (additions.length === 0)
+        return;
+    const current = headers.get("vary");
+    headers.set("vary", current === null ? additions.join(", ") : `${current}, ${additions.join(", ")}`);
+}
+function defaultKey(req, vary) {
+    let key = `${req.method.toUpperCase()} ${req.url}`;
+    for (const header of vary)
+        key += `\n${header.toLowerCase()}:${req.headers.get(header) ?? ""}`;
+    return key;
+}
+async function readBytesCapped(res, maxBytes) {
+    const body = res.clone().body;
+    if (body === null)
+        return new Uint8Array();
+    const reader = body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done) {
+                const out = new Uint8Array(total);
+                let offset = 0;
+                for (const chunk of chunks) {
+                    out.set(chunk, offset);
+                    offset += chunk.byteLength;
+                }
+                return out;
+            }
+            total += value.byteLength;
+            if (total > maxBytes) {
+                await reader.cancel();
+                return null;
+            }
+            chunks.push(value);
+        }
+    }
+    catch {
+        return null;
+    }
+}
+function withStatusHeader(res, header, status) {
+    if (header === false)
+        return res;
+    const headers = new Headers(res.headers);
+    headers.set(header, status);
+    return new Response(res.body, { status: res.status, statusText: res.statusText, headers });
+}
+/**
+ * Full response cache for small, cacheable responses. Use a shared `store` in production. The
+ * middleware honors `Cache-Control` by default, avoids `Set-Cookie`, caps stored bytes, emits `Age`,
+ * and keeps `Vary` headers aligned with the cache key.
+ */
+export function cache(options) {
+    const { store } = options;
+    const ttlMs = options.ttlMs;
+    if (!Number.isInteger(ttlMs) || ttlMs < 1)
+        throw new Error("cache: ttlMs must be a positive integer");
+    const methods = new Set((options.methods ?? ["GET", "HEAD"]).map((m) => m.toUpperCase()));
+    const statusOk = options.status ?? ((status) => status === 200);
+    const vary = options.vary ?? [];
+    const keyOf = options.key ?? ((req) => defaultKey(req, vary));
+    const maxBytes = options.maxBytes ?? 1_000_000;
+    if (!Number.isInteger(maxBytes) || maxBytes < 0) {
+        throw new Error("cache: maxBytes must be a non-negative integer");
+    }
+    const respectRequestCacheControl = options.respectRequestCacheControl !== false;
+    const respectResponseCacheControl = options.respectResponseCacheControl !== false;
+    const cacheSetCookie = options.cacheSetCookie === true;
+    const cacheStatusHeader = options.cacheStatusHeader === undefined ? "x-nifra-cache" : options.cacheStatusHeader;
+    if (cacheStatusHeader !== false && cacheStatusHeader.trim() === "") {
+        throw new Error("cache: cacheStatusHeader is empty");
+    }
+    const hits = new WeakSet();
+    return {
+        name: "cache",
+        async onRequest(req) {
+            if (!methods.has(req.method.toUpperCase()))
+                return undefined;
+            if (respectRequestCacheControl && cacheControlHas(req.headers, ["no-cache", "no-store"])) {
+                return undefined;
+            }
+            const key = keyOf(req);
+            const entry = await store.get(key);
+            if (entry === undefined)
+                return undefined;
+            if (Date.now() >= entry.expiresAt) {
+                await store.delete?.(key);
+                return undefined;
+            }
+            hits.add(req);
+            const headers = new Headers([...entry.headers]);
+            headers.set("age", String(Math.max(0, Math.floor((Date.now() - entry.storedAt) / 1000))));
+            if (cacheStatusHeader !== false)
+                headers.set(cacheStatusHeader, "HIT");
+            return new Response(req.method === "HEAD" ? null : entry.body.slice(), {
+                status: entry.status,
+                statusText: entry.statusText,
+                headers,
+            });
+        },
+        async onResponse(res, req) {
+            if (hits.has(req)) {
+                hits.delete(req);
+                return res;
+            }
+            if (!methods.has(req.method.toUpperCase()))
+                return res;
+            if (!statusOk(res.status))
+                return res;
+            if (respectRequestCacheControl && cacheControlHas(req.headers, ["no-store"])) {
+                return withStatusHeader(res, cacheStatusHeader, "BYPASS");
+            }
+            if (respectResponseCacheControl && cacheControlHas(res.headers, ["private", "no-store"])) {
+                return withStatusHeader(res, cacheStatusHeader, "BYPASS");
+            }
+            if (!cacheSetCookie && res.headers.has("set-cookie")) {
+                return withStatusHeader(res, cacheStatusHeader, "BYPASS");
+            }
+            const declared = parseLength(res.headers.get("content-length"));
+            if (declared !== undefined && declared > maxBytes) {
+                return withStatusHeader(res, cacheStatusHeader, "BYPASS");
+            }
+            const body = await readBytesCapped(res, maxBytes);
+            if (body === null)
+                return withStatusHeader(res, cacheStatusHeader, "BYPASS");
+            const headers = new Headers(res.headers);
+            headers.delete("age");
+            if (cacheStatusHeader !== false)
+                headers.delete(cacheStatusHeader);
+            appendVary(headers, vary);
+            const now = Date.now();
+            await store.set(keyOf(req), {
+                status: res.status,
+                statusText: res.statusText,
+                headers: [...headers.entries()],
+                body,
+                expiresAt: now + ttlMs,
+                storedAt: now,
+            });
+            const outgoing = new Headers(res.headers);
+            appendVary(outgoing, vary);
+            if (cacheStatusHeader !== false)
+                outgoing.set(cacheStatusHeader, "MISS");
+            return new Response(res.body, {
+                status: res.status,
+                statusText: res.statusText,
+                headers: outgoing,
+            });
+        },
+    };
+}
+export const responseCache = cache;
+//# sourceMappingURL=cache.js.map

package/dist/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAyBA,MAAM,OAAO,mBAAmB;IACb,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAA;IAC3C,UAAU,CAAQ;IAEnC,YAAY,UAAsC,EAAE;QAClD,MAAM,GAAG,GAAI,UAA4D,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAA;QAChG,IAAI,OAAO,CAAC,iBAAiB,KAAK,IAAI,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CACb,0FAA0F;gBACxF,mEAAmE,CACtE,CAAA;QACH,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAA;QAC5C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;QAC/E,CAAC;IACH,CAAC;IAED,GAAG,CAAC,GAAW;QACb,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACzC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACxB,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,QAAwB;QACvC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACnE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YAC/C,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACvD,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACjC,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAC1B,CAAC;CACF;AA0BD,SAAS,WAAW,CAAC,KAAoB;IACvC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IACpC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACrD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;AACtB,CAAC;AAED,SAAS,eAAe,CAAC,OAAgB,EAAE,KAAwB;IACjE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IAC1C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAChC,MAAM,KAAK,GAAG,KAAK;SAChB,WAAW,EAAE;SACb,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;AACnD,CAAC;AAED,SAAS,UAAU,CAAC,OAAgB,EAAE,IAAuB;IAC3D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAC7B,MAAM,QAAQ,GAAG,OAAO;SACrB,GAAG,CAAC,MAAM,CAAC;QACZ,EAAE,KAAK,CAAC,GAAG,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAA;IACpC,MAAM,SAAS,GAAa,EAAE,CAAA;IAC9B,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,EAAE,CAAA;QACvC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;YACpB,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACxB,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACnC,OAAO,CAAC,GAAG,CACT,MAAM,EACN,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChF,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAY,EAAE,IAAuB;IACvD,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,GAAG,EAAE,CAAA;IAClD,KAAK,MAAM,MAAM,IAAI,IAAI;QAAE,GAAG,IAAI,KAAK,MAAM,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAA;IAC9F,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,GAAa,EAAE,QAAgB;IAC5D,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,CAAA;IAC7B,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,UAAU,EAAE,CAAA;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAA;IAC/B,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;YAC3C,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;gBACjC,IAAI,MAAM,GAAG,CAAC,CAAA;gBACd,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAC3B,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;oBACtB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAA;gBAC5B,CAAC;gBACD,OAAO,GAAG,CAAA;YACZ,CAAC;YACD,KAAK,IAAI,KAAK,CAAC,UAAU,CAAA;YACzB,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAA;gBACrB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACvB,GAAa,EACb,MAAsB,EACtB,MAAiC;IAEjC,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,GAAG,CAAA;IAChC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACxC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC3B,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;AAC5F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,KAAK,CAAC,OAAqB;IACzC,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAA;IACzB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;IAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;IACzF,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,MAAc,EAAE,EAAE,CAAC,MAAM,KAAK,GAAG,CAAC,CAAA;IACvE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAA;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAA;IACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAA;IAC9C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,CAAC;IACD,MAAM,0BAA0B,GAAG,OAAO,CAAC,0BAA0B,KAAK,KAAK,CAAA;IAC/E,MAAM,2BAA2B,GAAG,OAAO,CAAC,2BAA2B,KAAK,KAAK,CAAA;IACjF,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,KAAK,IAAI,CAAA;IACtD,MAAM,iBAAiB,GACrB,OAAO,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAA;IACvF,IAAI,iBAAiB,KAAK,KAAK,IAAI,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IACtD,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,OAAO,EAAW,CAAA;IAEnC,OAAO;QACL,IAAI,EAAE,OAAO;QACb,KAAK,CAAC,SAAS,CAAC,GAAG;YACjB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBAAE,OAAO,SAAS,CAAA;YAC5D,IAAI,0BAA0B,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;gBACzF,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;YACtB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAClC,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YACzC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBAClC,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAA;gBACzB,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACb,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;YAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;YACzF,IAAI,iBAAiB,KAAK,KAAK;gBAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAA;YACtE,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE;gBACrE,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,OAAO;aACR,CAAC,CAAA;QACJ,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG;YACvB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBAChB,OAAO,GAAG,CAAA;YACZ,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBAAE,OAAO,GAAG,CAAA;YACtD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,GAAG,CAAA;YACrC,IAAI,0BAA0B,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;gBAC7E,OAAO,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAA;YAC3D,CAAC;YACD,IAAI,2BAA2B,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;gBACzF,OAAO,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAA;YAC3D,CAAC;YACD,IAAI,CAAC,cAAc,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;gBACrD,OAAO,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAA;YAC3D,CAAC;YACD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAA;YAC/D,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;gBAClD,OAAO,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAA;YAC3D,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;YACjD,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAA;YAE5E,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACrB,IAAI,iBAAiB,KAAK,KAAK;gBAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAA;YAClE,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YACtB,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;gBAC1B,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;gBAC/B,IAAI;gBACJ,SAAS,EAAE,GAAG,GAAG,KAAK;gBACtB,QAAQ,EAAE,GAAG;aACd,CAAC,CAAA;YACF,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACzC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;YAC1B,IAAI,iBAAiB,KAAK,KAAK;gBAAE,QAAQ,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAA;YACxE,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE;gBAC5B,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,OAAO,EAAE,QAAQ;aAClB,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAA"}

package/dist/combine.d.ts

@@ -0,0 +1,7 @@
+import { type Middleware, type NifraPlugin } from "@nifrajs/core";
+export type Composable = Middleware | NifraPlugin;
+/** Compose middleware/plugins into one reusable bundle. Individual named plugins still dedupe. */
+export declare function combine(...items: readonly Composable[]): NifraPlugin;
+/** Compose middleware/plugins into one idempotent named bundle. */
+export declare function namedCombine(name: string, ...items: readonly Composable[]): NifraPlugin;
+//# sourceMappingURL=combine.d.ts.map

package/dist/combine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"combine.d.ts","sourceRoot":"","sources":["../src/combine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,eAAe,CAAA;AAE/E,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,WAAW,CAAA;AAYjD,kGAAkG;AAClG,wBAAgB,OAAO,CAAC,GAAG,KAAK,EAAE,SAAS,UAAU,EAAE,GAAG,WAAW,CAEpE;AAED,mEAAmE;AACnE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,SAAS,UAAU,EAAE,GAAG,WAAW,CAGvF"}

package/dist/combine.js

@@ -0,0 +1,21 @@
+import { definePlugin } from "@nifrajs/core";
+function applyAll(app, items) {
+    let current = app;
+    for (const item of items) {
+        // The public `use` overload accepts both shapes; this helper intentionally preserves runtime
+        // composition while leaving advanced context type threading to direct `.use(...)` chains.
+        current = current.use(item);
+    }
+    return current;
+}
+/** Compose middleware/plugins into one reusable bundle. Individual named plugins still dedupe. */
+export function combine(...items) {
+    return ((app) => applyAll(app, items));
+}
+/** Compose middleware/plugins into one idempotent named bundle. */
+export function namedCombine(name, ...items) {
+    if (name.trim() === "")
+        throw new Error("namedCombine: name is empty");
+    return definePlugin(name, (app) => applyAll(app, items));
+}
+//# sourceMappingURL=combine.js.map

package/dist/combine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"combine.js","sourceRoot":"","sources":["../src/combine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAqC,MAAM,eAAe,CAAA;AAI/E,SAAS,QAAQ,CAAC,GAA+B,EAAE,KAA4B;IAC7E,IAAI,OAAO,GAAG,GAAG,CAAA;IACjB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,6FAA6F;QAC7F,0FAA0F;QAC1F,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAa,CAAC,CAAA;IACtC,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,OAAO,CAAC,GAAG,KAA4B;IACrD,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAgB,CAAA;AACvD,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,GAAG,KAA4B;IACxE,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;IACtE,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;AAC1D,CAAC"}

package/dist/compression.d.ts

@@ -0,0 +1,29 @@
+export interface CompressionOptions {
+    /** Don't compress bodies smaller than this many bytes. Default `1024`. Enforced by peeking the body
+     * (see below) since runtimes rarely expose `Content-Length` on a constructed `Response`. */
+    readonly threshold?: number;
+    /** Decide whether a `Content-Type` is worth compressing. Default: text, JSON/+json, JS, XML/+xml,
+     * NDJSON, wasm, SVG. Already-compressed media (images, video, archives) is skipped. */
+    readonly compressible?: (contentType: string) => boolean;
+}
+/**
+ * Transparently **gzip** responses when the client sends `Accept-Encoding: gzip` and the body is a
+ * compressible type larger than `threshold`. Uses the Web-standard `CompressionStream` (streaming, no
+ * full-body buffering), so it runs on every nifra runtime including the edge. gzip is the one encoding
+ * `CompressionStream` guarantees everywhere; brotli isn't part of the standard, so it's not offered.
+ *
+ * The body is **peeked** up to `threshold` bytes to enforce the size floor: a response that ends below
+ * the threshold is sent uncompressed (gzip's ~20-byte overhead would enlarge it), and only larger
+ * bodies are compressed — the buffered prefix is replayed and the remainder streamed. (Runtimes rarely
+ * set `Content-Length` on a constructed `Response`, so the header alone can't gate this.)
+ *
+ * Skips: clients that don't accept gzip, already-encoded responses, bodyless responses (204/304/HEAD),
+ * `Range` responses (206 / `Content-Range`), `Cache-Control: no-transform`, and non-compressible types.
+ * Adds `Vary: Accept-Encoding`.
+ *
+ * ```ts
+ * app.use(compression())
+ * ```
+ */
+export declare function compression(options?: CompressionOptions): import("@nifrajs/core").NifraPlugin<import("@nifrajs/core").AnyServer, import("@nifrajs/core").AnyServer>;
+//# sourceMappingURL=compression.d.ts.map

package/dist/compression.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compression.d.ts","sourceRoot":"","sources":["../src/compression.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,kBAAkB;IACjC;gGAC4F;IAC5F,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B;2FACuF;IACvF,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAA;CACzD;AA6BD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,WAAW,CAAC,OAAO,GAAE,kBAAuB,6GAqD3D"}

package/dist/compression.js

@@ -0,0 +1,105 @@
+import { definePlugin } from "@nifrajs/core";
+// Text-like payloads benefit from gzip; binary media (images/video/archives) is already compressed.
+const COMPRESSIBLE = /^(?:text\/|application\/(?:json|[\w.-]+\+json|javascript|xml|[\w.-]+\+xml|wasm|x-ndjson)|image\/svg\+xml)/i;
+const defaultCompressible = (contentType) => COMPRESSIBLE.test(contentType);
+const concat = (chunks, total) => {
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        out.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return out;
+};
+const gzipHeaders = (source) => {
+    const headers = new Headers(source);
+    headers.set("content-encoding", "gzip");
+    headers.delete("content-length"); // compressed length is unknown up front → chunked
+    const vary = headers.get("vary");
+    if (vary === null)
+        headers.set("vary", "Accept-Encoding");
+    else if (!vary.toLowerCase().split(",").includes("accept-encoding"))
+        headers.set("vary", `${vary}, Accept-Encoding`);
+    return headers;
+};
+/**
+ * Transparently **gzip** responses when the client sends `Accept-Encoding: gzip` and the body is a
+ * compressible type larger than `threshold`. Uses the Web-standard `CompressionStream` (streaming, no
+ * full-body buffering), so it runs on every nifra runtime including the edge. gzip is the one encoding
+ * `CompressionStream` guarantees everywhere; brotli isn't part of the standard, so it's not offered.
+ *
+ * The body is **peeked** up to `threshold` bytes to enforce the size floor: a response that ends below
+ * the threshold is sent uncompressed (gzip's ~20-byte overhead would enlarge it), and only larger
+ * bodies are compressed — the buffered prefix is replayed and the remainder streamed. (Runtimes rarely
+ * set `Content-Length` on a constructed `Response`, so the header alone can't gate this.)
+ *
+ * Skips: clients that don't accept gzip, already-encoded responses, bodyless responses (204/304/HEAD),
+ * `Range` responses (206 / `Content-Range`), `Cache-Control: no-transform`, and non-compressible types.
+ * Adds `Vary: Accept-Encoding`.
+ *
+ * ```ts
+ * app.use(compression())
+ * ```
+ */
+export function compression(options = {}) {
+    const threshold = options.threshold ?? 1024;
+    const isCompressible = options.compressible ?? defaultCompressible;
+    return definePlugin("compression", (app) => app.onResponse(async (res, req) => {
+        const body = res.body;
+        if (body === null)
+            return res; // 204/304/HEAD — nothing to compress
+        if (!(req.headers.get("accept-encoding") ?? "").toLowerCase().includes("gzip"))
+            return res;
+        if (res.headers.has("content-encoding"))
+            return res; // already encoded
+        if (res.status === 206 || res.headers.has("content-range"))
+            return res; // ranges pass through
+        if ((res.headers.get("cache-control") ?? "").includes("no-transform"))
+            return res;
+        if (!isCompressible(res.headers.get("content-type") ?? ""))
+            return res;
+        const declared = res.headers.get("content-length");
+        if (declared !== null && Number(declared) < threshold)
+            return res; // fast path when length is known
+        // Peek up to `threshold` bytes to decide whether compressing is worth it.
+        const reader = body.getReader();
+        const buffered = [];
+        let total = 0;
+        while (total < threshold) {
+            const { done, value } = await reader.read();
+            if (done) {
+                // Body ended below the threshold — too small to be worth gzipping. Emit as-is.
+                return new Response(concat(buffered, total), {
+                    status: res.status,
+                    statusText: res.statusText,
+                    headers: res.headers,
+                });
+            }
+            buffered.push(value);
+            total += value.byteLength;
+        }
+        // Over the threshold: replay the buffered prefix, then stream the rest — all through gzip.
+        // (No explicit generic: it lets the chunk type infer from the non-shared reader so the stream
+        // matches `CompressionStream`'s `Uint8Array` typing.)
+        const source = new ReadableStream({
+            start(controller) {
+                for (const chunk of buffered)
+                    controller.enqueue(chunk);
+            },
+            async pull(controller) {
+                const { done, value } = await reader.read();
+                if (done)
+                    controller.close();
+                else
+                    controller.enqueue(value);
+            },
+            cancel: (reason) => reader.cancel(reason),
+        });
+        return new Response(source.pipeThrough(new CompressionStream("gzip")), {
+            status: res.status,
+            statusText: res.statusText,
+            headers: gzipHeaders(res.headers),
+        });
+    }));
+}
+//# sourceMappingURL=compression.js.map

package/dist/compression.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compression.js","sourceRoot":"","sources":["../src/compression.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAW5C,oGAAoG;AACpG,MAAM,YAAY,GAChB,4GAA4G,CAAA;AAE9G,MAAM,mBAAmB,GAAG,CAAC,WAAmB,EAAW,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;AAE5F,MAAM,MAAM,GAAG,CAAC,MAA6B,EAAE,KAAa,EAAc,EAAE;IAC1E,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IACjC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACtB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAA;IAC5B,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,MAAe,EAAW,EAAE;IAC/C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;IACnC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAA;IACvC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA,CAAC,kDAAkD;IACnF,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAChC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;SACpD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACjE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,IAAI,mBAAmB,CAAC,CAAA;IACjD,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,WAAW,CAAC,UAA8B,EAAE;IAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAA;IAC3C,MAAM,cAAc,GAAG,OAAO,CAAC,YAAY,IAAI,mBAAmB,CAAA;IAClE,OAAO,YAAY,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,EAAE,CACzC,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;QACrB,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,GAAG,CAAA,CAAC,qCAAqC;QACnE,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,GAAG,CAAA;QAC1F,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAAE,OAAO,GAAG,CAAA,CAAC,kBAAkB;QACtE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;YAAE,OAAO,GAAG,CAAA,CAAC,sBAAsB;QAC7F,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;YAAE,OAAO,GAAG,CAAA;QACjF,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YAAE,OAAO,GAAG,CAAA;QACtE,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;QAClD,IAAI,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;YAAE,OAAO,GAAG,CAAA,CAAC,iCAAiC;QAEnG,0EAA0E;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAA;QAC/B,MAAM,QAAQ,GAAiB,EAAE,CAAA;QACjC,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,OAAO,KAAK,GAAG,SAAS,EAAE,CAAC;YACzB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;YAC3C,IAAI,IAAI,EAAE,CAAC;gBACT,+EAA+E;gBAC/E,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE;oBAC3C,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;iBACrB,CAAC,CAAA;YACJ,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACpB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAA;QAC3B,CAAC;QACD,2FAA2F;QAC3F,8FAA8F;QAC9F,sDAAsD;QACtD,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC;YAChC,KAAK,CAAC,UAAU;gBACd,KAAK,MAAM,KAAK,IAAI,QAAQ;oBAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YACzD,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,UAAU;gBACnB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;gBAC3C,IAAI,IAAI;oBAAE,UAAU,CAAC,KAAK,EAAE,CAAA;;oBACvB,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YAChC,CAAC;YACD,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;SAC1C,CAAC,CAAA;QACF,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,EAAE;YACrE,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC;SAClC,CAAC,CAAA;IACJ,CAAC,CAAC,CACH,CAAA;AACH,CAAC"}

package/dist/context-storage.d.ts

@@ -0,0 +1,14 @@
+import type { Context, Middleware } from "@nifrajs/core";
+/**
+ * Store the current nifra `Context` in `AsyncLocalStorage` for helpers that run away from the handler
+ * argument, e.g. repository/logger functions called deep in the stack.
+ *
+ * Import from `@nifrajs/middleware/context-storage` so ordinary `@nifrajs/middleware` imports stay
+ * node-compat-free on edge runtimes. The runtime must support `node:async_hooks` AsyncLocalStorage.
+ */
+export declare function contextStorage(): Middleware;
+/** Return the current request context, or throw when no context-storage wrapper is active. */
+export declare function getContext<C extends Context = Context>(): C;
+/** Return the current request context, or `undefined` outside a context-storage request. */
+export declare function tryGetContext<C extends Context = Context>(): C | undefined;
+//# sourceMappingURL=context-storage.d.ts.map

package/dist/context-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-storage.d.ts","sourceRoot":"","sources":["../src/context-storage.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAIxD;;;;;;GAMG;AACH,wBAAgB,cAAc,IAAI,UAAU,CAO3C;AAED,8FAA8F;AAC9F,wBAAgB,UAAU,CAAC,CAAC,SAAS,OAAO,GAAG,OAAO,KAAK,CAAC,CAQ3D;AAED,4FAA4F;AAC5F,wBAAgB,aAAa,CAAC,CAAC,SAAS,OAAO,GAAG,OAAO,KAAK,CAAC,GAAG,SAAS,CAE1E"}

package/dist/context-storage.js

@@ -0,0 +1,30 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+const storage = new AsyncLocalStorage();
+/**
+ * Store the current nifra `Context` in `AsyncLocalStorage` for helpers that run away from the handler
+ * argument, e.g. repository/logger functions called deep in the stack.
+ *
+ * Import from `@nifrajs/middleware/context-storage` so ordinary `@nifrajs/middleware` imports stay
+ * node-compat-free on edge runtimes. The runtime must support `node:async_hooks` AsyncLocalStorage.
+ */
+export function contextStorage() {
+    return {
+        name: "context-storage",
+        around(context, next) {
+            return storage.run(context, next);
+        },
+    };
+}
+/** Return the current request context, or throw when no context-storage wrapper is active. */
+export function getContext() {
+    const context = tryGetContext();
+    if (context === undefined) {
+        throw new Error("contextStorage: no active context. Add app.use(contextStorage()) before the route and call getContext() during that request.");
+    }
+    return context;
+}
+/** Return the current request context, or `undefined` outside a context-storage request. */
+export function tryGetContext() {
+    return storage.getStore();
+}
+//# sourceMappingURL=context-storage.js.map

package/dist/context-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-storage.js","sourceRoot":"","sources":["../src/context-storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAGpD,MAAM,OAAO,GAAG,IAAI,iBAAiB,EAAW,CAAA;AAEhD;;;;;;GAMG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,MAAM,CAAC,OAAO,EAAE,IAAI;YAClB,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QACnC,CAAC;KACF,CAAA;AACH,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,UAAU;IACxB,MAAM,OAAO,GAAG,aAAa,EAAK,CAAA;IAClC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,8HAA8H,CAC/H,CAAA;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,aAAa;IAC3B,OAAO,OAAO,CAAC,QAAQ,EAAmB,CAAA;AAC5C,CAAC"}

package/dist/cors.d.ts

@@ -0,0 +1,25 @@
+import type { Middleware } from "@nifrajs/core";
+export interface CorsOptions {
+    /** Allowed origin(s): `"*"`, an exact origin, a list, or a predicate. Default `"*"`. */
+    readonly origin?: string | ReadonlyArray<string> | ((origin: string) => boolean);
+    /** Methods advertised in the preflight response. Default the common verbs. */
+    readonly methods?: ReadonlyArray<string>;
+    /** Headers allowed on the actual request. Default: reflect the preflight's requested headers. */
+    readonly allowedHeaders?: ReadonlyArray<string>;
+    /** Response headers exposed to the browser. */
+    readonly exposedHeaders?: ReadonlyArray<string>;
+    /** Allow credentials (cookies / `Authorization`). Cannot be combined with `origin: "*"`. Default false. */
+    readonly credentials?: boolean;
+    /** Preflight cache duration, in seconds. */
+    readonly maxAge?: number;
+}
+/**
+ * CORS as a {@link Middleware}. Preflight (`OPTIONS` + `Access-Control-Request-Method`)
+ * short-circuits to `204` via `onRequest`; the origin/credentials headers are added in
+ * `onResponse`, so they also land on errors, 404s, and the preflight itself.
+ *
+ * Throws at construction if `credentials: true` is paired with `origin: "*"` — the
+ * browser rejects that combination, so we fail loud instead of shipping dead CORS.
+ */
+export declare function cors(options?: CorsOptions): Middleware;
+//# sourceMappingURL=cors.d.ts.map

package/dist/cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../src/cors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAG/C,MAAM,WAAW,WAAW;IAC1B,wFAAwF;IACxF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,CAAA;IAChF,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACxC,iGAAiG;IACjG,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IAC/C,+CAA+C;IAC/C,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IAC/C,2GAA2G;IAC3G,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;IAC9B,4CAA4C;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAwBD;;;;;;;GAOG;AACH,wBAAgB,IAAI,CAAC,OAAO,GAAE,WAAgB,GAAG,UAAU,CAyC1D"}

package/dist/cors.js

@@ -0,0 +1,75 @@
+import { withHeaders } from "./_utils.js";
+const DEFAULT_METHODS = [
+    "GET",
+    "HEAD",
+    "POST",
+    "PUT",
+    "PATCH",
+    "DELETE",
+    "OPTIONS",
+];
+/** Resolve the `Access-Control-Allow-Origin` value for a request, or `null` to omit it. */
+function resolveAllowOrigin(option, requestOrigin) {
+    if (option === "*")
+        return "*";
+    if (requestOrigin === null)
+        return null;
+    if (typeof option === "function")
+        return option(requestOrigin) ? requestOrigin : null;
+    if (Array.isArray(option))
+        return option.includes(requestOrigin) ? requestOrigin : null;
+    return option === requestOrigin ? requestOrigin : null;
+}
+/**
+ * CORS as a {@link Middleware}. Preflight (`OPTIONS` + `Access-Control-Request-Method`)
+ * short-circuits to `204` via `onRequest`; the origin/credentials headers are added in
+ * `onResponse`, so they also land on errors, 404s, and the preflight itself.
+ *
+ * Throws at construction if `credentials: true` is paired with `origin: "*"` — the
+ * browser rejects that combination, so we fail loud instead of shipping dead CORS.
+ */
+export function cors(options = {}) {
+    const origin = options.origin ?? "*";
+    const credentials = options.credentials ?? false;
+    if (credentials && origin === "*") {
+        throw new Error('cors: `credentials: true` cannot be combined with `origin: "*"` — list explicit origin(s).');
+    }
+    const methods = (options.methods ?? DEFAULT_METHODS).join(", ");
+    const allowedHeaders = options.allowedHeaders?.join(", ");
+    const exposedHeaders = options.exposedHeaders?.join(", ");
+    const maxAge = options.maxAge;
+    return {
+        name: "cors",
+        onRequest(req) {
+            const isPreflight = req.method === "OPTIONS" && req.headers.has("access-control-request-method");
+            if (!isPreflight)
+                return undefined;
+            const headers = new Headers();
+            headers.set("Access-Control-Allow-Methods", methods);
+            const requested = allowedHeaders ?? req.headers.get("access-control-request-headers");
+            if (requested)
+                headers.set("Access-Control-Allow-Headers", requested);
+            if (maxAge !== undefined)
+                headers.set("Access-Control-Max-Age", String(maxAge));
+            // Allow-Origin / Allow-Credentials are added by onResponse (runs on every response).
+            return new Response(null, { status: 204, headers });
+        },
+        onResponse(res, req) {
+            const allowOrigin = resolveAllowOrigin(origin, req.headers.get("origin"));
+            if (allowOrigin === null)
+                return res;
+            // Mutate in place on the common (mutable-headers) response; clone only for an immutable one.
+            return withHeaders(res, (headers) => {
+                headers.set("Access-Control-Allow-Origin", allowOrigin);
+                if (allowOrigin !== "*")
+                    headers.append("Vary", "Origin");
+                if (credentials)
+                    headers.set("Access-Control-Allow-Credentials", "true");
+                if (exposedHeaders !== undefined) {
+                    headers.set("Access-Control-Expose-Headers", exposedHeaders);
+                }
+            });
+        },
+    };
+}
+//# sourceMappingURL=cors.js.map

package/dist/cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../src/cors.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAiBzC,MAAM,eAAe,GAA0B;IAC7C,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,OAAO;IACP,QAAQ;IACR,SAAS;CACV,CAAA;AAED,2FAA2F;AAC3F,SAAS,kBAAkB,CACzB,MAA0C,EAC1C,aAA4B;IAE5B,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,GAAG,CAAA;IAC9B,IAAI,aAAa,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACvC,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAA;IACrF,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAA;IACvF,OAAO,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAA;AACxD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,IAAI,CAAC,UAAuB,EAAE;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAA;IACpC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,KAAK,CAAA;IAChD,IAAI,WAAW,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,4FAA4F,CAC7F,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/D,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IACzD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;IAE7B,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,SAAS,CAAC,GAAG;YACX,MAAM,WAAW,GACf,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAA;YAC9E,IAAI,CAAC,WAAW;gBAAE,OAAO,SAAS,CAAA;YAClC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;YAC7B,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,OAAO,CAAC,CAAA;YACpD,MAAM,SAAS,GAAG,cAAc,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAA;YACrF,IAAI,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,SAAS,CAAC,CAAA;YACrE,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;YAC/E,qFAAqF;YACrF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;QACrD,CAAC;QACD,UAAU,CAAC,GAAG,EAAE,GAAG;YACjB,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA;YACzE,IAAI,WAAW,KAAK,IAAI;gBAAE,OAAO,GAAG,CAAA;YACpC,6FAA6F;YAC7F,OAAO,WAAW,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE;gBAClC,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,WAAW,CAAC,CAAA;gBACvD,IAAI,WAAW,KAAK,GAAG;oBAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;gBACzD,IAAI,WAAW;oBAAE,OAAO,CAAC,GAAG,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAA;gBACxE,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;oBACjC,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,cAAc,CAAC,CAAA;gBAC9D,CAAC;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/csrf.d.ts

@@ -0,0 +1,23 @@
+import type { Middleware } from "@nifrajs/core";
+export interface CsrfOptions {
+    /** HMAC secret. Must be at least 32 bytes. */
+    readonly secret: string | Uint8Array;
+    /** Cookie carrying the signed token. Default `"csrf-token"`. */
+    readonly cookie?: string;
+    /** Header carrying the same signed token. Default `"x-csrf-token"`. */
+    readonly header?: string;
+    /** Unsafe methods to protect. Default: every method except GET/HEAD/OPTIONS/TRACE. */
+    readonly methods?: readonly string[];
+    /** Allowed request origins. Default: same-origin derived from the request URL. */
+    readonly origins?: readonly string[];
+    /** Check Origin/Referer on protected requests. Default true. */
+    readonly checkOrigin?: boolean;
+}
+export declare function createCsrfToken(secret: string | Uint8Array, nonce?: string): Promise<string>;
+export declare function verifyCsrfToken(token: string, secret: string | Uint8Array): Promise<boolean>;
+/**
+ * Signed double-submit CSRF protection. A protected request must carry the same signed token in a
+ * cookie and a header, and must come from an allowed Origin/Referer unless `checkOrigin:false` is set.
+ */
+export declare function csrf(options: CsrfOptions): Middleware;
+//# sourceMappingURL=csrf.d.ts.map

package/dist/csrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAY/C,MAAM,WAAW,WAAW;IAC1B,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAA;IACpC,gEAAgE;IAChE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,uEAAuE;IACvE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,sFAAsF;IACtF,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,kFAAkF;IAClF,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,gEAAgE;IAChE,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAC/B;AAsBD,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,GAAG,UAAU,EAC3B,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GAAG,UAAU,GAC1B,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED;;;GAGG;AACH,wBAAgB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CAwBrD"}