@nifrajs/middleware 3.3.0 → 4.0.0

package/README.md

@@ -41,12 +41,16 @@ const app = server()
 - **`basicAuth(options)`** - Basic Auth plugin with constant-time static credential comparison or
   a custom verifier.
 - **`bearer(options)` / `apiKey(options)`** - token auth plugins with typed principals.
-- **`csrf({ secret })`** - signed double-submit CSRF protection plus Origin/Referer checking.
+- **`csrf({ secret })`** - signed double-submit CSRF protection plus Origin/Referer checking. The
+  token travels in the `x-csrf-token` header; set `field: "_csrf"` to also accept it from a plain
+  HTML form's hidden input (urlencoded or multipart, bodies up to `fieldMaxBytes`, default 64 KiB).
 - **`jwt(options)` + `verifyJwt()` / `tryVerifyJwt()` + `jwk()` / `jwks()`** - JWT auth
   with explicit algorithm allowlists, required expiration by default, issuer/audience checks,
   direct JWK, HTTPS JWKS, and an additive no-throw Result helper for manual verification.
-- **`ipRestriction(options)`** - allow/deny IPv4/IPv6 exact and CIDR matches. Fails closed unless
-  you provide `clientIp`, trusted proxy extraction, or a trusted single-IP header.
+- **`ipRestriction(options)`** - allow/deny IPv4/IPv6 exact and CIDR matches, judged against the
+  caller IP the server resolved (the socket peer, or the app's `clientIp` trust declaration). A
+  custom `clientIp`, `trustedProxies`, or trusted single-IP `header` overrides it; with no caller IP
+  it fails closed.
 - **`cors(options)`** - preflight handling + headers on *every* response (errors and
   404s included). Origin as `"*"` / exact / list / predicate. **Throws** if
   `credentials: true` is paired with `origin: "*"` (the browser rejects it).
@@ -54,9 +58,10 @@ const app = server()
   `Referrer-Policy` by default; opt-in HSTS and CSP. Every value is fixed, so they are **declared**
   (see below) rather than written by a hook - the app keeps its fused/native lanes.
 - **`rateLimit(options)`** - `429` + `Retry-After` + `RateLimit-*` headers, with a
-  pluggable `RateLimitStore`. Configure a trusted `key`, trusted single-IP `header`, or
-  `trustedProxies`; a missing key source fails closed instead of silently sharing one
-  bucket. The bundled `MemoryStore` **refuses to run in production** (a per-instance
+  pluggable `RateLimitStore`. The default bucket key is the caller IP the server resolved (the
+  socket peer, or the app's `clientIp` trust declaration behind a proxy); a custom `key`, trusted
+  single-IP `header`, or `trustedProxies` overrides it. With no caller IP it fails closed (`500`)
+  instead of silently sharing one bucket. The bundled `MemoryStore` **refuses to run in production** (a per-instance
   limiter is unsafe across instances) - provide a shared store (Redis, etc.) there.
 - **`cache({ store, ttlMs })` / `responseCache(...)`** - full response cache with a pluggable
   store, `Vary`-aware keys, `Age`, byte caps, and `Cache-Control` / `Set-Cookie` safety defaults.

package/dist/_ip.d.ts

@@ -0,0 +1,17 @@
+export interface ParsedIp {
+    readonly version: 4 | 6;
+    readonly value: bigint;
+}
+/**
+ * An IPv4 or IPv6 address, bracketed or not. An IPv4-mapped IPv6 address (`::ffff:a.b.c.d`) is the
+ * IPv4 address it carries: Bun and Node report every IPv4 peer that way on their default dual-stack
+ * listener, and IPv4 rules must still match it.
+ */
+export declare function parseIp(input: string): ParsedIp | null;
+/**
+ * The rate-limit bucket for a client address: an IPv4 address as itself (unmapped), an IPv6 address
+ * as its /64. One subscriber is routinely assigned a whole /64 and can send every request from a new
+ * address inside it, so a per-address bucket never fills. Anything that is not an address is kept.
+ */
+export declare function ipBucket(ip: string): string;
+//# sourceMappingURL=_ip.d.ts.map

package/dist/_ip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_ip.d.ts","sourceRoot":"","sources":["../src/_ip.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAiDD;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAStD;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAa3C"}

package/dist/_ip.js

@@ -0,0 +1,91 @@
+function parseIPv4(input) {
+    const parts = input.split(".");
+    if (parts.length !== 4)
+        return null;
+    let out = 0n;
+    for (const part of parts) {
+        if (!/^\d{1,3}$/.test(part))
+            return null;
+        const n = Number(part);
+        if (n > 255)
+            return null;
+        out = (out << 8n) | BigInt(n);
+    }
+    return out;
+}
+function parseIPv6(input) {
+    if (input.includes("%"))
+        return null;
+    let source = input.toLowerCase();
+    if (source.includes(".")) {
+        const lastColon = source.lastIndexOf(":");
+        if (lastColon < 0)
+            return null;
+        const ipv4 = parseIPv4(source.slice(lastColon + 1));
+        if (ipv4 === null)
+            return null;
+        const hi = Number((ipv4 >> 16n) & 0xffffn).toString(16);
+        const lo = Number(ipv4 & 0xffffn).toString(16);
+        source = `${source.slice(0, lastColon)}:${hi}:${lo}`;
+    }
+    const halves = source.split("::");
+    if (halves.length > 2)
+        return null;
+    const left = halves[0] === "" ? [] : halves[0].split(":");
+    const right = halves.length === 1 || halves[1] === "" ? [] : halves[1].split(":");
+    const groups = [...left, ...right];
+    if (groups.some((g) => !/^[0-9a-f]{1,4}$/.test(g)))
+        return null;
+    const missing = 8 - groups.length;
+    if (halves.length === 1) {
+        if (missing !== 0)
+            return null;
+    }
+    else if (missing < 1)
+        return null;
+    const expanded = halves.length === 1
+        ? groups
+        : [...left, ...Array.from({ length: missing }, () => "0"), ...right];
+    let out = 0n;
+    for (const group of expanded)
+        out = (out << 16n) | BigInt(Number.parseInt(group, 16));
+    return out;
+}
+/**
+ * An IPv4 or IPv6 address, bracketed or not. An IPv4-mapped IPv6 address (`::ffff:a.b.c.d`) is the
+ * IPv4 address it carries: Bun and Node report every IPv4 peer that way on their default dual-stack
+ * listener, and IPv4 rules must still match it.
+ */
+export function parseIp(input) {
+    const trimmed = input.trim();
+    const unbracketed = trimmed.startsWith("[") && trimmed.endsWith("]") ? trimmed.slice(1, -1) : trimmed;
+    const v4 = parseIPv4(unbracketed);
+    if (v4 !== null)
+        return { version: 4, value: v4 };
+    const v6 = parseIPv6(unbracketed);
+    if (v6 === null)
+        return null;
+    return v6 >> 32n === 0xffffn ? { version: 4, value: v6 & 0xffffffffn } : { version: 6, value: v6 };
+}
+/**
+ * The rate-limit bucket for a client address: an IPv4 address as itself (unmapped), an IPv6 address
+ * as its /64. One subscriber is routinely assigned a whole /64 and can send every request from a new
+ * address inside it, so a per-address bucket never fills. Anything that is not an address is kept.
+ */
+export function ipBucket(ip) {
+    if (!ip.includes(":"))
+        return ip;
+    // Every IPv4 peer of a default Bun or Node listener: skip the full parse on that per-request path.
+    if (ip.startsWith("::ffff:") && ip.includes(".", 7) && ip.indexOf(":", 7) === -1)
+        return ip.slice(7);
+    const parsed = parseIp(ip);
+    if (parsed === null)
+        return ip;
+    const value = parsed.value;
+    if (parsed.version === 4) {
+        return `${(value >> 24n) & 255n}.${(value >> 16n) & 255n}.${(value >> 8n) & 255n}.${value & 255n}`;
+    }
+    const prefix = (value >> 64n).toString(16).padStart(16, "0");
+    return `${prefix.slice(0, 4)}:${prefix.slice(4, 8)}:${prefix.slice(8, 12)}:${prefix.slice(12)}::/64`;
+}
+//# sourceMappingURL=_ip.js.map

package/dist/_ip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_ip.js","sourceRoot":"","sources":["../src/_ip.ts"],"names":[],"mappings":"AAKA,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QACxC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;QACtB,IAAI,CAAC,GAAG,GAAG;YAAE,OAAO,IAAI,CAAA;QACxB,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;IAC/B,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACpC,IAAI,MAAM,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;IAChC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACzC,IAAI,SAAS,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;QAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAA;QACnD,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAC9B,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QACvD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAA;IACtD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAClF,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,CAAA;IAClC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAE/D,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAA;IACjC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,IAAI,OAAO,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;IAChC,CAAC;SAAM,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAEnC,MAAM,QAAQ,GACZ,MAAM,CAAC,MAAM,KAAK,CAAC;QACjB,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,CAAC,CAAA;IACxE,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,MAAM,KAAK,IAAI,QAAQ;QAAE,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAA;IACrF,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAC5B,MAAM,WAAW,GACf,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;IACnF,MAAM,EAAE,GAAG,SAAS,CAAC,WAAW,CAAC,CAAA;IACjC,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IACjD,MAAM,EAAE,GAAG,SAAS,CAAC,WAAW,CAAC,CAAA;IACjC,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC5B,OAAO,EAAE,IAAI,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;AACpG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,EAAU;IACjC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAA;IAChC,mGAAmG;IACnG,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAC9E,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACpB,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,CAAA;IAC1B,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,CAAA;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAA;IAC1B,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,EAAE,CAAA;IACpG,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC5D,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAA;AACtG,CAAC"}

package/dist/_utils.d.ts

@@ -3,8 +3,19 @@ import type { NodeResponseContext } from "@nifrajs/core/server";
 import { parseCookies as parseCoreCookies } from "@nifrajs/core/server";
 export declare const SAFE_METHODS: Set<string>;
 export declare function jsonError(status: number, error: string, headers?: Record<string, string>): Response;
+/**
+ * A guard's plugin name, unique to each instance. `use()` skips a name it already applied, so one
+ * shared name would silently drop a second, stricter guard (another `bearer()` before admin routes,
+ * a tighter `rateLimit()` inside a `group()`). The same instance applied twice still dedupes.
+ */
+export declare function guardName(base: string): string;
 /** Shared with core so auth/CSRF middleware gets the allocation-light cookie scanner too. */
 export declare const parseCookies: typeof parseCoreCookies;
+/**
+ * The credential of an `Authorization: Bearer <token>` header, or `null`. The auth-scheme is
+ * case-insensitive (RFC 9110 section 11.1), so `bearer x` and `BEARER x` carry a token too.
+ */
+export declare function bearerToken(header: string | null | undefined): string | null;
 export declare function quotedHeaderValue(value: string): string;
 export declare function utf8Bytes(value: string): Uint8Array<ArrayBuffer>;
 export declare function secretBytes(secret: string | Uint8Array, label: string): Uint8Array<ArrayBuffer>;
@@ -12,6 +23,11 @@ export declare function sha256(input: string | Uint8Array): Promise<Uint8Array<A
 export declare function timingSafeEqualBytes(a: Uint8Array, b: Uint8Array): boolean;
 export declare function timingSafeEqualString(a: string, b: string): Promise<boolean>;
 export declare function base64UrlEncode(bytes: ArrayBuffer | Uint8Array): string;
+/**
+ * Decode unpadded base64url, rejecting non-canonical spellings. `atob` ignores the unused low bits of
+ * a final 2- or 3-character group, so without this check a JWT or CSRF signature has several textual
+ * forms that verify identically - the same rule core applies to signed cookies.
+ */
 export declare function base64UrlDecode(input: string): Uint8Array<ArrayBuffer> | null;
 export declare function decodeBase64(input: string): Uint8Array<ArrayBuffer> | null;
 export declare function importHmacKey(secret: string | Uint8Array, hash?: string): Promise<CryptoKey>;

package/dist/_utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"_utils.d.ts","sourceRoot":"","sources":["../src/_utils.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;AAE5C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAC/D,OAAO,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAEvE,eAAO,MAAM,YAAY,aAA+C,CAAA;AAIxE,wBAAgB,SAAS,CACvB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,QAAQ,CAKV;AAED,6FAA6F;AAC7F,eAAO,MAAM,YAAY,yBAAmB,CAAA;AAE5C,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CASvD;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAEhE;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAM/F;AAED,wBAAsB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAGzF;AAED,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAK1E;AAED,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGlF;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,UAAU,GAAG,MAAM,CAKvE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,IAAI,CAc7E;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,IAAI,CAS1E;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,GAAG,UAAU,EAC3B,IAAI,SAAY,GACf,OAAO,CAAC,SAAS,CAAC,CAQpB;AAED,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAI5F;AAED,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GAAG,UAAU,GAC1B,OAAO,CAAC,OAAO,CAAC,CAKlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,GAAG,QAAQ,CA0BtF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,mBAAmB,EACxB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAChC,IAAI,CAaN"}
+{"version":3,"file":"_utils.d.ts","sourceRoot":"","sources":["../src/_utils.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;AAE5C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAC/D,OAAO,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAEvE,eAAO,MAAM,YAAY,aAA+C,CAAA;AAIxE,wBAAgB,SAAS,CACvB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,QAAQ,CAKV;AAID;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG9C;AAED,6FAA6F;AAC7F,eAAO,MAAM,YAAY,yBAAmB,CAAA;AAE5C;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAK5E;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CASvD;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAEhE;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAM/F;AAED,wBAAsB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAGzF;AAED,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAK1E;AAED,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGlF;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,UAAU,GAAG,MAAM,CAKvE;AAID;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,IAAI,CAqB7E;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,IAAI,CAS1E;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,GAAG,UAAU,EAC3B,IAAI,SAAY,GACf,OAAO,CAAC,SAAS,CAAC,CAQpB;AAED,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAI5F;AAED,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GAAG,UAAU,GAC1B,OAAO,CAAC,OAAO,CAAC,CAKlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,GAAG,QAAQ,CA0BtF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,mBAAmB,EACxB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAChC,IAAI,CAaN"}

package/dist/_utils.js

@@ -4,8 +4,28 @@ const TEXT = new TextEncoder();
 export function jsonError(status, error, headers) {
     return Response.json({ ok: false, error }, headers === undefined ? { status } : { status, headers });
 }
+let guardInstances = 0;
+/**
+ * A guard's plugin name, unique to each instance. `use()` skips a name it already applied, so one
+ * shared name would silently drop a second, stricter guard (another `bearer()` before admin routes,
+ * a tighter `rateLimit()` inside a `group()`). The same instance applied twice still dedupes.
+ */
+export function guardName(base) {
+    guardInstances += 1;
+    return `${base}#${guardInstances}`;
+}
 /** Shared with core so auth/CSRF middleware gets the allocation-light cookie scanner too. */
 export const parseCookies = parseCoreCookies;
+/**
+ * The credential of an `Authorization: Bearer <token>` header, or `null`. The auth-scheme is
+ * case-insensitive (RFC 9110 section 11.1), so `bearer x` and `BEARER x` carry a token too.
+ */
+export function bearerToken(header) {
+    if (header == null || header.length < 7 || header.slice(0, 7).toLowerCase() !== "bearer ") {
+        return null;
+    }
+    return header.slice(7).trim() || null;
+}
 export function quotedHeaderValue(value) {
     let out = "";
     for (let i = 0; i < value.length; i++) {
@@ -50,9 +70,22 @@ export function base64UrlEncode(bytes) {
         bin += String.fromCharCode(b);
     return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
+const BASE64URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+/**
+ * Decode unpadded base64url, rejecting non-canonical spellings. `atob` ignores the unused low bits of
+ * a final 2- or 3-character group, so without this check a JWT or CSRF signature has several textual
+ * forms that verify identically - the same rule core applies to signed cookies.
+ */
 export function base64UrlDecode(input) {
     if (!/^[A-Za-z0-9_-]*$/.test(input) || input.length % 4 === 1)
         return null;
+    const remainder = input.length % 4;
+    if (remainder !== 0) {
+        const last = BASE64URL_ALPHABET.indexOf(input[input.length - 1]);
+        if ((remainder === 2 && (last & 0x0f) !== 0) || (remainder === 3 && (last & 0x03) !== 0)) {
+            return null;
+        }
+    }
     const padded = input
         .replace(/-/g, "+")
         .replace(/_/g, "/")

package/dist/_utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"_utils.js","sourceRoot":"","sources":["../src/_utils.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAEvE,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;AAExE,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAA;AAE9B,MAAM,UAAU,SAAS,CACvB,MAAc,EACd,KAAa,EACb,OAAgC;IAEhC,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EACpB,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CACzD,CAAA;AACH,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,MAAM,YAAY,GAAG,gBAAgB,CAAA;AAE5C,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,IAAI;YAAE,SAAQ;QACpC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACzB,GAAG,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACnD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAA2B,EAAE,KAAa;IACpE,MAAM,KAAK,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;IACrF,IAAI,KAAK,CAAC,UAAU,GAAG,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAA;IAC/D,CAAC;IACD,OAAO,KAAgC,CAAA;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,KAA0B;IACrD,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IAClF,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAA4B,CAAA;AAChG,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,CAAa,EAAE,CAAa;IAC/D,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;QAAE,OAAO,KAAK,CAAA;IAC/C,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IACxE,OAAO,IAAI,KAAK,CAAC,CAAA;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,CAAS,EAAE,CAAS;IAC9D,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/D,OAAO,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AAC1C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAA+B;IAC7D,MAAM,IAAI,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IACxE,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IACnD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AAC7E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1E,MAAM,MAAM,GAAG,KAAK;SACjB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;QACxB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QACjE,OAAO,KAAgC,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;QACvB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QACjE,OAAO,KAAgC,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAA2B,EAC3B,IAAI,GAAG,SAAS;IAEhB,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EACtB,KAAK,EACL,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAa,EAAE,MAA2B;IACzE,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAClD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;IACnE,OAAO,eAAe,CAAC,GAAG,CAAC,CAAA;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,SAAiB,EACjB,MAA2B;IAE3B,MAAM,GAAG,GAAG,eAAe,CAAC,SAAS,CAAC,CAAA;IACtC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC9B,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAClD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;AACjE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,GAAa,EAAE,KAAiC;IAC1E,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,CAAA;IACnC,MAAM,KAAK,GAAG,sBAAsB,CAAA;IACpC,IAAI,QAAQ,GAAkB,IAAI,CAAA;IAClC,IAAI,OAAO,GAAG,IAAI,CAAA;IAClB,IAAI,CAAC;QACH,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACrC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QAC/B,IAAI,QAAQ,KAAK,IAAI;YAAE,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;;YAC/C,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,KAAK,CAAA;QACf,IAAI,CAAC;YACH,IAAI,QAAQ,KAAK,IAAI;gBAAE,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;;gBAC/C,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;QAC7E,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACxC,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;IAC5F,CAAC;IACD,KAAK,CAAC,eAAe,CAAC,CAAA;IACtB,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAwB,EACxB,IAAY,EACZ,KAAiC;IAEjC,GAAG,CAAC,OAAO,KAAK,EAAE,CAAA;IAClB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAA;IAC3B,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE;YACnC,KAAK;YACL,QAAQ,EAAE,IAAI;YACd,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,IAAI;SACnB,CAAC,CAAA;QACF,OAAM;IACR,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;AACvB,CAAC"}
+{"version":3,"file":"_utils.js","sourceRoot":"","sources":["../src/_utils.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAEvE,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;AAExE,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAA;AAE9B,MAAM,UAAU,SAAS,CACvB,MAAc,EACd,KAAa,EACb,OAAgC;IAEhC,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EACpB,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CACzD,CAAA;AACH,CAAC;AAED,IAAI,cAAc,GAAG,CAAC,CAAA;AAEtB;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,cAAc,IAAI,CAAC,CAAA;IACnB,OAAO,GAAG,IAAI,IAAI,cAAc,EAAE,CAAA;AACpC,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,MAAM,YAAY,GAAG,gBAAgB,CAAA;AAE5C;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,MAAiC;IAC3D,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,SAAS,EAAE,CAAC;QAC1F,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAA;AACvC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,IAAI;YAAE,SAAQ;QACpC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACzB,GAAG,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACnD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAA2B,EAAE,KAAa;IACpE,MAAM,KAAK,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;IACrF,IAAI,KAAK,CAAC,UAAU,GAAG,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAA;IAC/D,CAAC;IACD,OAAO,KAAgC,CAAA;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,KAA0B;IACrD,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IAClF,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAA4B,CAAA;AAChG,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,CAAa,EAAE,CAAa;IAC/D,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;QAAE,OAAO,KAAK,CAAA;IAC/C,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IACxE,OAAO,IAAI,KAAK,CAAC,CAAA;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,CAAS,EAAE,CAAS;IAC9D,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/D,OAAO,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AAC1C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAA+B;IAC7D,MAAM,IAAI,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IACxE,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IACnD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AAC7E,CAAC;AAED,MAAM,kBAAkB,GAAG,kEAAkE,CAAA;AAE7F;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1E,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;IAClC,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,CAAA;QACjE,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACzF,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,KAAK;SACjB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;QACxB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QACjE,OAAO,KAAgC,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;QACvB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QACjE,OAAO,KAAgC,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAA2B,EAC3B,IAAI,GAAG,SAAS;IAEhB,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EACtB,KAAK,EACL,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAa,EAAE,MAA2B;IACzE,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAClD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;IACnE,OAAO,eAAe,CAAC,GAAG,CAAC,CAAA;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,SAAiB,EACjB,MAA2B;IAE3B,MAAM,GAAG,GAAG,eAAe,CAAC,SAAS,CAAC,CAAA;IACtC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC9B,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAClD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;AACjE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,GAAa,EAAE,KAAiC;IAC1E,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,CAAA;IACnC,MAAM,KAAK,GAAG,sBAAsB,CAAA;IACpC,IAAI,QAAQ,GAAkB,IAAI,CAAA;IAClC,IAAI,OAAO,GAAG,IAAI,CAAA;IAClB,IAAI,CAAC;QACH,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACrC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QAC/B,IAAI,QAAQ,KAAK,IAAI;YAAE,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;;YAC/C,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,KAAK,CAAA;QACf,IAAI,CAAC;YACH,IAAI,QAAQ,KAAK,IAAI;gBAAE,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;;gBAC/C,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;QAC7E,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACxC,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;IAC5F,CAAC;IACD,KAAK,CAAC,eAAe,CAAC,CAAA;IACtB,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAwB,EACxB,IAAY,EACZ,KAAiC;IAEjC,GAAG,CAAC,OAAO,KAAK,EAAE,CAAA;IAClB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAA;IAC3B,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE;YACnC,KAAK;YACL,QAAQ,EAAE,IAAI;YACd,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,IAAI;SACnB,CAAC,CAAA;QACF,OAAM;IACR,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;AACvB,CAAC"}

package/dist/basic-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"basic-auth.d.ts","sourceRoot":"","sources":["../src/basic-auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAChF,OAAO,EAGL,KAAK,YAAY,EAIlB,MAAM,aAAa,CAAA;AAEpB,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI,cAAc,GAAG;IAChD,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,CAAC,GAAG,IAAI,CAAA;IACrC,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,CAAC,CAAA;CACtC,CAAA;AAED,MAAM,WAAW,sBAAsB,CAAC,CAAC,GAAG,MAAM;IAChD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,sBAAsB,CAAC,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,YAAY,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,CAAA;IAC3F,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAC5B;AA0CD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,sBAAsB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;AACnF,wBAAgB,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAA;AACpF,wBAAgB,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAA"}
+{"version":3,"file":"basic-auth.d.ts","sourceRoot":"","sources":["../src/basic-auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAChF,OAAO,EAIL,KAAK,YAAY,EAIlB,MAAM,aAAa,CAAA;AAEpB,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI,cAAc,GAAG;IAChD,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,CAAC,GAAG,IAAI,CAAA;IACrC,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,CAAC,CAAA;CACtC,CAAA;AAED,MAAM,WAAW,sBAAsB,CAAC,CAAC,GAAG,MAAM;IAChD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,sBAAsB,CAAC,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,YAAY,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,CAAA;IAC3F,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAC5B;AA0CD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,sBAAsB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;AACnF,wBAAgB,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAA;AACpF,wBAAgB,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAA"}

package/dist/basic-auth.js

@@ -1,6 +1,6 @@
 import { NIFRA_ASSURANCE, withRouteAssurance } from "@nifrajs/core/assurance";
 import { defineIdentityPlugin } from "@nifrajs/core/server";
-import { decodeBase64, jsonError, quotedHeaderValue, sha256, timingSafeEqualBytes, } from "./_utils.js";
+import { decodeBase64, guardName, jsonError, quotedHeaderValue, sha256, timingSafeEqualBytes, } from "./_utils.js";
 const UTF8 = new TextDecoder("utf-8", { fatal: true });
 function challenge(realm) {
     return `Basic realm="${quotedHeaderValue(realm)}", charset="UTF-8"`;
@@ -43,7 +43,7 @@ export function basicAuth(options) {
     const verifyPromise = "verify" in options
         ? Promise.resolve(options.verify)
         : staticVerifier(options.username, options.password, options.principal ?? options.username);
-    const plugin = defineIdentityPlugin("basicAuth", (app) => app.beforeHandle(async (c) => {
+    const plugin = defineIdentityPlugin(guardName("basicAuth"), (app) => app.beforeHandle(async (c) => {
         const parsed = credentials(c.req);
         const principal = parsed === null ? null : await (await verifyPromise)(parsed.username, parsed.password);
         if (principal !== null && principal !== undefined) {

package/dist/basic-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"basic-auth.js","sourceRoot":"","sources":["../src/basic-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC7E,OAAO,EAAE,oBAAoB,EAAuB,MAAM,sBAAsB,CAAA;AAChF,OAAO,EACL,YAAY,EACZ,SAAS,EAET,iBAAiB,EACjB,MAAM,EACN,oBAAoB,GACrB,MAAM,aAAa,CAAA;AAqBpB,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AAEtD,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,gBAAgB,iBAAiB,CAAC,KAAK,CAAC,oBAAoB,CAAA;AACrE,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,SAAS,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,kBAAkB,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;AACjF,CAAC;AAED,SAAS,WAAW,CAAC,OAAgB;IACnC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IACnD,IAAI,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACtD,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IAChD,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC7B,IAAI,OAAe,CAAA;IACnB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAClC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1B,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAA;AAClF,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,QAAgB,EAChB,QAAgB,EAChB,SAAY;IAEZ,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;IAC5F,OAAO,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE;QACpB,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACpE,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;QAC1D,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;QAC1D,OAAO,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;IAC5C,CAAC,CAAA;AACH,CAAC;AAUD,MAAM,UAAU,SAAS,CACvB,OAA8D;IAE9D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAA;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAA;IAC1C,MAAM,KAAK,GAAG,IAAI,OAAO,EAAuB,CAAA;IAChD,MAAM,aAAa,GACjB,QAAQ,IAAI,OAAO;QACjB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;QACjC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAA;IAE/F,MAAM,MAAM,GAAG,oBAAoB,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CACvD,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,CAA4B,EAAE,EAAE;QACtD,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QACjC,MAAM,SAAS,GACb,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,aAAa,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;QACxF,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAClD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;YAC3B,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,OAAO,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC7C,CAAC,CAAC,CACH,CAAA;IACD,MAAM,YAAY,GAAG,QAAQ;QAC3B,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;YACzB,EAAE,EAAE,eAAe,CAAC,aAAa;YACjC,MAAM,EAAE,WAAW;YACnB,KAAK,EAAE,YAAY;SACpB,CAAC,CAAA;IACN,OAAO,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE;QACjC,SAAS,EAAE,CAAC,OAAgB,EAAqB,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI;QAC9E,gBAAgB,EAAE,CAAC,OAAgB,EAAc,EAAE;YACjD,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACpC,IAAI,SAAS,KAAK,SAAS;gBAAE,MAAM,MAAM,CAAC,KAAK,CAAC,CAAA;YAChD,OAAO,SAAS,CAAA;QAClB,CAAC;KACF,CAAgC,CAAA;AACnC,CAAC"}
+{"version":3,"file":"basic-auth.js","sourceRoot":"","sources":["../src/basic-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC7E,OAAO,EAAE,oBAAoB,EAAuB,MAAM,sBAAsB,CAAA;AAChF,OAAO,EACL,YAAY,EACZ,SAAS,EACT,SAAS,EAET,iBAAiB,EACjB,MAAM,EACN,oBAAoB,GACrB,MAAM,aAAa,CAAA;AAqBpB,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AAEtD,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,gBAAgB,iBAAiB,CAAC,KAAK,CAAC,oBAAoB,CAAA;AACrE,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,SAAS,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,kBAAkB,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;AACjF,CAAC;AAED,SAAS,WAAW,CAAC,OAAgB;IACnC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IACnD,IAAI,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACtD,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IAChD,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC7B,IAAI,OAAe,CAAA;IACnB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAClC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1B,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAA;AAClF,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,QAAgB,EAChB,QAAgB,EAChB,SAAY;IAEZ,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;IAC5F,OAAO,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE;QACpB,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACpE,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;QAC1D,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;QAC1D,OAAO,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;IAC5C,CAAC,CAAA;AACH,CAAC;AAUD,MAAM,UAAU,SAAS,CACvB,OAA8D;IAE9D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAA;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAA;IAC1C,MAAM,KAAK,GAAG,IAAI,OAAO,EAAuB,CAAA;IAChD,MAAM,aAAa,GACjB,QAAQ,IAAI,OAAO;QACjB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;QACjC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAA;IAE/F,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAClE,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,CAA4B,EAAE,EAAE;QACtD,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QACjC,MAAM,SAAS,GACb,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,aAAa,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;QACxF,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAClD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;YAC3B,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,OAAO,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC7C,CAAC,CAAC,CACH,CAAA;IACD,MAAM,YAAY,GAAG,QAAQ;QAC3B,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;YACzB,EAAE,EAAE,eAAe,CAAC,aAAa;YACjC,MAAM,EAAE,WAAW;YACnB,KAAK,EAAE,YAAY;SACpB,CAAC,CAAA;IACN,OAAO,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE;QACjC,SAAS,EAAE,CAAC,OAAgB,EAAqB,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI;QAC9E,gBAAgB,EAAE,CAAC,OAAgB,EAAc,EAAE;YACjD,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACpC,IAAI,SAAS,KAAK,SAAS;gBAAE,MAAM,MAAM,CAAC,KAAK,CAAC,CAAA;YAChD,OAAO,SAAS,CAAA;QAClB,CAAC;KACF,CAAgC,CAAA;AACnC,CAAC"}

package/dist/body-limit.js

@@ -1,6 +1,6 @@
 import { NIFRA_ASSURANCE, withRouteAssurance } from "@nifrajs/core/assurance";
 import { METHODS } from "@nifrajs/core/server";
-import { jsonError, SAFE_METHODS } from "./_utils.js";
+import { guardName, jsonError, SAFE_METHODS } from "./_utils.js";
 function parseContentLength(value) {
     if (value === null)
         return undefined;
@@ -24,7 +24,7 @@ export function bodyLimit(options) {
     const error = options.error ?? "payload_too_large";
     const allowLengthless = options.allowLengthless === true;
     const middleware = {
-        name: "body-limit",
+        name: guardName("body-limit"),
         onRequest(req) {
             if (methods !== undefined ? !methods.has(req.method) : SAFE_METHODS.has(req.method)) {
                 return undefined;

package/dist/body-limit.js.map

@@ -1 +1 @@
-{"version":3,"file":"body-limit.js","sourceRoot":"","sources":["../src/body-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC7E,OAAO,EAAE,OAAO,EAAmB,MAAM,sBAAsB,CAAA;AAC/D,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAarD,SAAS,kBAAkB,CAAC,KAAoB;IAC9C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IACpC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACrC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IACvB,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,OAAyB;IACjD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;IAC5B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IACD,MAAM,OAAO,GACX,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAClG,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,mBAAmB,CAAA;IAClD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,KAAK,IAAI,CAAA;IAExD,MAAM,UAAU,GAAe;QAC7B,IAAI,EAAE,YAAY;QAClB,SAAS,CAAC,GAAG;YACX,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpF,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,MAAM,aAAa,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAA;YAC3E,IAAI,aAAa,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAA;YAC3E,IAAI,aAAa,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBACzE,OAAO,SAAS,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAA;YAC1C,CAAC;YACD,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,GAAG,QAAQ;gBAAE,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YACzF,OAAO,SAAS,CAAA;QAClB,CAAC;KACF,CAAA;IACD,4FAA4F;IAC5F,gGAAgG;IAChG,IAAI,eAAe;QAAE,OAAO,UAAU,CAAA;IACtC,OAAO,kBAAkB,CAAC,UAAU,EAAE;QACpC,EAAE,EAAE,eAAe,CAAC,YAAY;QAChC,MAAM,EAAE,YAAY;QACpB,KAAK,EAAE,QAAQ;QACf,OAAO,EACL,OAAO,CAAC,OAAO,KAAK,SAAS;YAC3B,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC;YACpC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;KACvD,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"body-limit.js","sourceRoot":"","sources":["../src/body-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC7E,OAAO,EAAE,OAAO,EAAmB,MAAM,sBAAsB,CAAA;AAC/D,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAahE,SAAS,kBAAkB,CAAC,KAAoB;IAC9C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IACpC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACrC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IACvB,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,OAAyB;IACjD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;IAC5B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IACD,MAAM,OAAO,GACX,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAClG,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,mBAAmB,CAAA;IAClD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,KAAK,IAAI,CAAA;IAExD,MAAM,UAAU,GAAe;QAC7B,IAAI,EAAE,SAAS,CAAC,YAAY,CAAC;QAC7B,SAAS,CAAC,GAAG;YACX,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpF,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,MAAM,aAAa,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAA;YAC3E,IAAI,aAAa,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAA;YAC3E,IAAI,aAAa,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBACzE,OAAO,SAAS,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAA;YAC1C,CAAC;YACD,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,GAAG,QAAQ;gBAAE,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YACzF,OAAO,SAAS,CAAA;QAClB,CAAC;KACF,CAAA;IACD,4FAA4F;IAC5F,gGAAgG;IAChG,IAAI,eAAe;QAAE,OAAO,UAAU,CAAA;IACtC,OAAO,kBAAkB,CAAC,UAAU,EAAE;QACpC,EAAE,EAAE,eAAe,CAAC,YAAY;QAChC,MAAM,EAAE,YAAY;QACpB,KAAK,EAAE,QAAQ;QACf,OAAO,EACL,OAAO,CAAC,OAAO,KAAK,SAAS;YAC3B,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC;YACpC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;KACvD,CAAC,CAAA;AACJ,CAAC"}

package/dist/cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,KAAK,YAAY,EAAe,MAAM,aAAa,CAAA;AAE5D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAA;IAC7C,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAAC,cAAc,GAAG,SAAS,CAAC,CAAA;IAC1D,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IAC9D,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;CACzC;AAED,MAAM,WAAW,0BAA0B;IACzC,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,uFAAuF;IACvF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;CACrC;AAED,qBAAa,mBAAoB,YAAW,kBAAkB;IAC5D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAC5D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAQ;gBAEvB,OAAO,GAAE,0BAA+B;IAcpD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAU5C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,IAAI;IAQhD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;CAG1B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAA;IAClC,oCAAoC;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,iDAAiD;IACjD,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,6CAA6C;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAA;IAC7C,oEAAoE;IACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,2FAA2F;IAC3F,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,MAAM,CAAA;IAC3C,2FAA2F;IAC3F,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,0BAA0B,CAAC,EAAE,OAAO,CAAA;IAC7C,0EAA0E;IAC1E,QAAQ,CAAC,2BAA2B,CAAC,EAAE,OAAO,CAAA;IAC9C,0DAA0D;IAC1D,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC;;;kEAG8D;IAC9D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;IACrC,wGAAwG;IACxG,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACjD,2FAA2F;IAC3F,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;CAC5C;AAsFD;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,UAAU,CAyHvD;AAED,eAAO,MAAM,aAAa,cAAQ,CAAA"}
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,KAAK,YAAY,EAAe,MAAM,aAAa,CAAA;AAE5D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAA;IAC7C,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAAC,cAAc,GAAG,SAAS,CAAC,CAAA;IAC1D,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IAC9D,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;CACzC;AAED,MAAM,WAAW,0BAA0B;IACzC,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,uFAAuF;IACvF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;CACrC;AAED,qBAAa,mBAAoB,YAAW,kBAAkB;IAC5D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAC5D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAQ;gBAEvB,OAAO,GAAE,0BAA+B;IAcpD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAU5C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,IAAI;IAQhD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;CAG1B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAA;IAClC,oCAAoC;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,iDAAiD;IACjD,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,6CAA6C;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAA;IAC7C,oEAAoE;IACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,2FAA2F;IAC3F,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,MAAM,CAAA;IAC3C,2FAA2F;IAC3F,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,0BAA0B,CAAC,EAAE,OAAO,CAAA;IAC7C,0EAA0E;IAC1E,QAAQ,CAAC,2BAA2B,CAAC,EAAE,OAAO,CAAA;IAC9C,0DAA0D;IAC1D,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC;;;kEAG8D;IAC9D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;IACrC,wGAAwG;IACxG,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACjD,2FAA2F;IAC3F,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;CAC5C;AAyKD;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,UAAU,CAwIvD;AAED,eAAO,MAAM,aAAa,cAAQ,CAAA"}

package/dist/cache.js

@@ -79,10 +79,64 @@ function defaultKey(req, vary) {
         key += `\n${header.toLowerCase()}:${req.headers.get(header) ?? ""}`;
     return key;
 }
+const concatBytes = (chunks, total) => {
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        out.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return out;
+};
+function replayFrom(res, chunks, reader) {
+    let released = false;
+    const release = () => {
+        if (!released) {
+            released = true;
+            reader.releaseLock();
+        }
+    };
+    const stream = new ReadableStream({
+        start(controller) {
+            for (const chunk of chunks)
+                controller.enqueue(chunk);
+        },
+        async pull(controller) {
+            try {
+                const { done, value } = await reader.read();
+                if (done || value === undefined) {
+                    release();
+                    controller.close();
+                }
+                else {
+                    controller.enqueue(value);
+                }
+            }
+            catch (error) {
+                release();
+                controller.error(error);
+            }
+        },
+        cancel: (reason) => reader.cancel(reason).finally(release),
+    });
+    return new Response(stream, {
+        status: res.status,
+        statusText: res.statusText,
+        headers: res.headers,
+    });
+}
 async function readBytesCapped(res, maxBytes) {
-    const body = res.clone().body;
-    if (body === null)
-        return new Uint8Array();
+    const body = res.body;
+    if (body === null) {
+        return {
+            bytes: new Uint8Array(),
+            response: new Response(null, {
+                status: res.status,
+                statusText: res.statusText,
+                headers: res.headers,
+            }),
+        };
+    }
     const reader = body.getReader();
     const chunks = [];
     let total = 0;
@@ -90,26 +144,46 @@ async function readBytesCapped(res, maxBytes) {
         while (true) {
             const { done, value } = await reader.read();
             if (done) {
-                const out = new Uint8Array(total);
-                let offset = 0;
-                for (const chunk of chunks) {
-                    out.set(chunk, offset);
-                    offset += chunk.byteLength;
-                }
-                return out;
+                reader.releaseLock();
+                const bytes = concatBytes(chunks, total);
+                return {
+                    bytes,
+                    response: new Response(bytes.byteLength === 0 ? null : bytes.slice(), {
+                        status: res.status,
+                        statusText: res.statusText,
+                        headers: res.headers,
+                    }),
+                };
             }
+            if (value === undefined)
+                return { response: replayFrom(res, chunks, reader) };
             total += value.byteLength;
             if (total > maxBytes) {
-                await reader.cancel();
-                return null;
+                return { response: replayFrom(res, chunks.concat([value]), reader) };
             }
             chunks.push(value);
         }
     }
     catch {
-        return null;
+        return { response: replayFrom(res, chunks, reader) };
     }
 }
+function responseVary(headers) {
+    const value = headers.get("vary");
+    if (value === null)
+        return [];
+    return value
+        .split(",")
+        .map((part) => part.trim().toLowerCase())
+        .filter((part) => part !== "");
+}
+function responseVaryMatchesKey(headers, configured) {
+    const declared = responseVary(headers);
+    if (declared.includes("*"))
+        return false;
+    const configuredSet = new Set(configured.map((header) => header.toLowerCase()));
+    return declared.every((header) => configuredSet.has(header));
+}
 function withStatusHeader(res, header, status) {
     if (header === false)
         return res;
@@ -143,6 +217,7 @@ export function cache(options) {
         throw new Error("cache: cacheStatusHeader is empty");
     }
     const hits = new WeakSet();
+    const requestKeys = new WeakMap();
     const hasAuthentication = (req) => authenticatedHeaders.some((header) => req.headers.has(header));
     return {
         name: "cache",
@@ -153,6 +228,7 @@ export function cache(options) {
                 return undefined;
             }
             const key = keyOf(req);
+            requestKeys.set(req, key);
             const entry = await store.get(key);
             if (entry === undefined)
                 return undefined;
@@ -184,6 +260,7 @@ export function cache(options) {
         async onResponse(res, req) {
             if (hits.has(req)) {
                 hits.delete(req);
+                requestKeys.delete(req);
                 return res;
             }
             if (!methods.has(req.method.toUpperCase()))
@@ -199,6 +276,12 @@ export function cache(options) {
             if (!cacheSetCookie && res.headers.has("set-cookie")) {
                 return withStatusHeader(res, cacheStatusHeader, "BYPASS");
             }
+            // A response-declared Vary must be represented in the lookup key. If the caller did not opt
+            // those request headers into `vary`, bypass storage instead of replaying one representation to
+            // another request. `Vary: *` is never cacheable by a shared cache.
+            if (!responseVaryMatchesKey(res.headers, vary)) {
+                return withStatusHeader(res, cacheStatusHeader, "BYPASS");
+            }
             // Shared-cache safety (RFC 9111 §3.5): never store a response to an authenticated request
             // (Authorization or Cookie) unless it's explicitly public - otherwise a personalized 200 leaks
             // across users. Opt in with `cacheAuthenticated: true` for a route that's the same for everyone.
@@ -211,16 +294,21 @@ export function cache(options) {
             if (declared !== undefined && declared > maxBytes) {
                 return withStatusHeader(res, cacheStatusHeader, "BYPASS");
             }
-            const body = await readBytesCapped(res, maxBytes);
-            if (body === null)
-                return withStatusHeader(res, cacheStatusHeader, "BYPASS");
-            const headers = new Headers(res.headers);
+            const captured = await readBytesCapped(res, maxBytes);
+            if (!("bytes" in captured)) {
+                return withStatusHeader(captured.response, cacheStatusHeader, "BYPASS");
+            }
+            const body = captured.bytes;
+            const capturedResponse = captured.response;
+            const headers = new Headers(capturedResponse.headers);
             headers.delete("age");
             if (cacheStatusHeader !== false)
                 headers.delete(cacheStatusHeader);
             appendVary(headers, vary);
             const now = Date.now();
-            await store.set(keyOf(req), {
+            const key = requestKeys.get(req) ?? keyOf(req);
+            requestKeys.delete(req);
+            await store.set(key, {
                 status: res.status,
                 statusText: res.statusText,
                 headers: [...headers.entries()],
@@ -228,13 +316,13 @@ export function cache(options) {
                 expiresAt: now + ttlMs,
                 storedAt: now,
             });
-            const outgoing = new Headers(res.headers);
+            const outgoing = new Headers(capturedResponse.headers);
             appendVary(outgoing, vary);
             if (cacheStatusHeader !== false)
                 outgoing.set(cacheStatusHeader, "MISS");
-            return new Response(res.body, {
-                status: res.status,
-                statusText: res.statusText,
+            return new Response(capturedResponse.body, {
+                status: capturedResponse.status,
+                statusText: capturedResponse.statusText,
                 headers: outgoing,
             });
         },