@shohaghinfo/aerojs 0.1.0

package/dist/security/hash.js

@@ -0,0 +1,86 @@
+/**
+ * @file hash.ts
+ * @description Zero-dependency, memory-hard Password Hashing & Verification Engine (scrypt) for AeroJS.
+ * Powered by Node.js built-in `node:crypto`. Implements OWASP-recommended parameters and timing-safe comparison.
+ */
+import crypto from 'node:crypto';
+export class Hash {
+    static defaultOptions = {
+        N: 16384,
+        r: 8,
+        p: 1,
+        keyLen: 32,
+        saltLen: 16,
+    };
+    /**
+     * Hashes a plaintext password using crypto.scrypt with a cryptographically secure random salt.
+     */
+    static async make(password, options = {}) {
+        const opts = { ...this.defaultOptions, ...options };
+        const salt = crypto.randomBytes(opts.saltLen);
+        return new Promise((resolve, reject) => {
+            crypto.scrypt(password, salt, opts.keyLen, { N: opts.N, r: opts.r, p: opts.p }, (err, derivedKey) => {
+                if (err)
+                    return reject(err);
+                const saltHex = salt.toString('hex');
+                const hashHex = derivedKey.toString('hex');
+                // Standard crypt format: $scrypt$N=16384,r=8,p=1$<saltHex>$<hashHex>
+                resolve(`$scrypt$N=${opts.N},r=${opts.r},p=${opts.p}$${saltHex}$${hashHex}`);
+            });
+        });
+    }
+    /**
+     * Verifies a plaintext password against a stored scrypt hash using constant-time timingSafeEqual.
+     */
+    static async verify(hash, password) {
+        if (!hash || !password || !hash.startsWith('$scrypt$')) {
+            return false;
+        }
+        try {
+            const parts = hash.split('$');
+            // Format: ["", "scrypt", "N=16384,r=8,p=1", "saltHex", "hashHex"]
+            if (parts.length !== 5)
+                return false;
+            const paramsStr = parts[2];
+            const saltHex = parts[3];
+            const originalHashHex = parts[4];
+            const params = {};
+            for (const pair of paramsStr.split(',')) {
+                const [k, v] = pair.split('=');
+                if (k && v)
+                    params[k] = parseInt(v, 10);
+            }
+            const salt = Buffer.from(saltHex, 'hex');
+            const expectedBuffer = Buffer.from(originalHashHex, 'hex');
+            return new Promise((resolve) => {
+                crypto.scrypt(password, salt, expectedBuffer.length, { N: params['N'] || 16384, r: params['r'] || 8, p: params['p'] || 1 }, (err, derivedKey) => {
+                    if (err)
+                        return resolve(false);
+                    if (derivedKey.length !== expectedBuffer.length)
+                        return resolve(false);
+                    resolve(crypto.timingSafeEqual(derivedKey, expectedBuffer));
+                });
+            });
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Checks if the given hash needs to be rehashed with updated work factors.
+     */
+    static needsRehash(hash, options = {}) {
+        const opts = { ...this.defaultOptions, ...options };
+        if (!hash.startsWith('$scrypt$'))
+            return true;
+        const parts = hash.split('$');
+        if (parts.length !== 5)
+            return true;
+        const paramsStr = parts[2];
+        const expected = `N=${opts.N},r=${opts.r},p=${opts.p}`;
+        return paramsStr !== expected;
+    }
+}
+export const hash = (password, options) => Hash.make(password, options);
+export const hashVerify = (hashStr, password) => Hash.verify(hashStr, password);
+//# sourceMappingURL=hash.js.map

package/dist/security/hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.js","sourceRoot":"","sources":["../../src/security/hash.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAUjC,MAAM,OAAO,IAAI;IACP,MAAM,CAAC,cAAc,GAAkB;QAC7C,CAAC,EAAE,KAAK;QACR,CAAC,EAAE,CAAC;QACJ,CAAC,EAAE,CAAC;QACJ,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,EAAE;KACZ,CAAC;IAEF;;OAEG;IACI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,QAAgB,EAAE,UAAyB,EAAE;QACpE,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,GAAG,OAAO,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,OAAQ,CAAC,CAAC;QAE/C,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7C,MAAM,CAAC,MAAM,CACX,QAAQ,EACR,IAAI,EACJ,IAAI,CAAC,MAAO,EACZ,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,EACnC,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE;gBAClB,IAAI,GAAG;oBAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBACrC,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAC3C,qEAAqE;gBACrE,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC,CAAC;YAC/E,CAAC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,QAAgB;QACvD,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACvD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9B,kEAAkE;YAClE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAErC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YAC1B,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YAElC,MAAM,MAAM,GAA2B,EAAE,CAAC;YAC1C,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC/B,IAAI,CAAC,IAAI,CAAC;oBAAE,MAAM,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1C,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACzC,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;YAE3D,OAAO,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;gBACtC,MAAM,CAAC,MAAM,CACX,QAAQ,EACR,IAAI,EACJ,cAAc,CAAC,MAAM,EACrB,EAAE,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EACrE,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE;oBAClB,IAAI,GAAG;wBAAE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;oBAC/B,IAAI,UAAU,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM;wBAAE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;oBACvE,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;gBAC9D,CAAC,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,WAAW,CAAC,IAAY,EAAE,UAAyB,EAAE;QACjE,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,GAAG,OAAO,EAAE,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QAE9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEpC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,KAAK,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC;QACvD,OAAO,SAAS,KAAK,QAAQ,CAAC;IAChC,CAAC;;AAGH,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,QAAgB,EAAE,OAAuB,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAChG,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,QAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC"}

package/dist/security/headers.d.ts

@@ -0,0 +1,56 @@
+/**
+ * @file headers.ts
+ * @description Zero-dependency HTTP security headers middleware (Helmet-like) for Aero.
+ */
+import type { Middleware } from '../core/types.js';
+import type { DefaultState } from '../core/context.js';
+export interface HstsOptions {
+    maxAge?: number;
+    includeSubDomains?: boolean;
+    preload?: boolean;
+}
+export type ContentSecurityPolicyDirectives = Record<string, string | string[] | boolean>;
+export interface SecurityHeadersOptions {
+    /**
+     * Prevents MIME type sniffing. Default: true ('nosniff')
+     */
+    contentTypeOptions?: boolean;
+    /**
+     * Clickjacking defense: 'DENY', 'SAMEORIGIN', or false to disable. Default: 'SAMEORIGIN'
+     */
+    frameOptions?: 'DENY' | 'SAMEORIGIN' | false;
+    /**
+     * XSS Auditor protection header. Default: '0' (per modern security standards)
+     */
+    xssProtection?: string | boolean;
+    /**
+     * HTTP Strict Transport Security. Set to false to disable. Default: enabled
+     */
+    hsts?: HstsOptions | boolean;
+    /**
+     * Controls Referer header behavior. Default: 'no-referrer'
+     */
+    referrerPolicy?: string | false;
+    /**
+     * Cross-Origin-Opener-Policy header. Default: 'same-origin'
+     */
+    crossOriginOpenerPolicy?: 'same-origin' | 'same-origin-allow-popups' | 'unsafe-none' | false;
+    /**
+     * Cross-Origin-Resource-Policy header. Default: 'same-origin'
+     */
+    crossOriginResourcePolicy?: 'same-origin' | 'same-site' | 'cross-origin' | false;
+    /**
+     * Cross-Origin-Embedder-Policy header. Default: false
+     */
+    crossOriginEmbedderPolicy?: 'require-corp' | 'credentialless' | false;
+    /**
+     * Content Security Policy header. Directives object or raw string. Default: false
+     */
+    contentSecurityPolicy?: string | ContentSecurityPolicyDirectives | false;
+    /**
+     * Removes or hides the X-Powered-By header. Default: true
+     */
+    hidePoweredBy?: boolean;
+}
+export declare function securityHeaders<State = DefaultState>(options?: SecurityHeadersOptions): Middleware<State>;
+//# sourceMappingURL=headers.d.ts.map

package/dist/security/headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"headers.d.ts","sourceRoot":"","sources":["../../src/security/headers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAgB,MAAM,kBAAkB,CAAC;AACjE,OAAO,KAAK,EAAe,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEpE,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,MAAM,+BAA+B,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC;AAE1F,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,KAAK,CAAC;IAE7C;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAEjC;;OAEG;IACH,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;IAE7B;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAEhC;;OAEG;IACH,uBAAuB,CAAC,EAAE,aAAa,GAAG,0BAA0B,GAAG,aAAa,GAAG,KAAK,CAAC;IAE7F;;OAEG;IACH,yBAAyB,CAAC,EAAE,aAAa,GAAG,WAAW,GAAG,cAAc,GAAG,KAAK,CAAC;IAEjF;;OAEG;IACH,yBAAyB,CAAC,EAAE,cAAc,GAAG,gBAAgB,GAAG,KAAK,CAAC;IAEtE;;OAEG;IACH,qBAAqB,CAAC,EAAE,MAAM,GAAG,+BAA+B,GAAG,KAAK,CAAC;IAEzE;;OAEG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAmBD,wBAAgB,eAAe,CAAC,KAAK,GAAG,YAAY,EAAE,OAAO,GAAE,sBAA2B,GAAG,UAAU,CAAC,KAAK,CAAC,CAiF7G"}

package/dist/security/headers.js

@@ -0,0 +1,81 @@
+/**
+ * @file headers.ts
+ * @description Zero-dependency HTTP security headers middleware (Helmet-like) for Aero.
+ */
+function buildCsp(directives) {
+    const parts = [];
+    for (const [key, value] of Object.entries(directives)) {
+        const directiveName = key.replace(/[A-Z]/g, (m) => `-${m.toLowerCase()}`);
+        if (typeof value === 'boolean') {
+            if (value)
+                parts.push(directiveName);
+        }
+        else if (Array.isArray(value)) {
+            parts.push(`${directiveName} ${value.join(' ')}`);
+        }
+        else if (typeof value === 'string') {
+            parts.push(`${directiveName} ${value}`);
+        }
+    }
+    return parts.join('; ');
+}
+export function securityHeaders(options = {}) {
+    const { contentTypeOptions = true, frameOptions = 'SAMEORIGIN', xssProtection = '0', hsts = { maxAge: 15552000, includeSubDomains: true }, referrerPolicy = 'no-referrer', crossOriginOpenerPolicy = 'same-origin', crossOriginResourcePolicy = 'same-origin', crossOriginEmbedderPolicy = false, contentSecurityPolicy = false, hidePoweredBy = true, } = options;
+    return async (ctx, next) => {
+        // 1. Hide X-Powered-By
+        if (hidePoweredBy) {
+            ctx.res.removeHeader('X-Powered-By');
+        }
+        // 2. X-Content-Type-Options
+        if (contentTypeOptions) {
+            ctx.res.setHeader('X-Content-Type-Options', 'nosniff');
+        }
+        // 3. X-Frame-Options
+        if (frameOptions) {
+            ctx.res.setHeader('X-Frame-Options', frameOptions);
+        }
+        // 4. X-XSS-Protection
+        if (xssProtection) {
+            const val = typeof xssProtection === 'string' ? xssProtection : '0';
+            ctx.res.setHeader('X-XSS-Protection', val);
+        }
+        // 5. Strict-Transport-Security (HSTS)
+        if (hsts) {
+            const opts = typeof hsts === 'object' ? hsts : { maxAge: 15552000, includeSubDomains: true };
+            const maxAge = opts.maxAge ?? 15552000;
+            let val = `max-age=${maxAge}`;
+            if (opts.includeSubDomains ?? true) {
+                val += '; includeSubDomains';
+            }
+            if (opts.preload) {
+                val += '; preload';
+            }
+            ctx.res.setHeader('Strict-Transport-Security', val);
+        }
+        // 6. Referrer-Policy
+        if (referrerPolicy) {
+            ctx.res.setHeader('Referrer-Policy', referrerPolicy);
+        }
+        // 7. Cross-Origin-Opener-Policy
+        if (crossOriginOpenerPolicy) {
+            ctx.res.setHeader('Cross-Origin-Opener-Policy', crossOriginOpenerPolicy);
+        }
+        // 8. Cross-Origin-Resource-Policy
+        if (crossOriginResourcePolicy) {
+            ctx.res.setHeader('Cross-Origin-Resource-Policy', crossOriginResourcePolicy);
+        }
+        // 9. Cross-Origin-Embedder-Policy
+        if (crossOriginEmbedderPolicy) {
+            ctx.res.setHeader('Cross-Origin-Embedder-Policy', crossOriginEmbedderPolicy);
+        }
+        // 10. Content-Security-Policy
+        if (contentSecurityPolicy) {
+            const cspVal = typeof contentSecurityPolicy === 'string'
+                ? contentSecurityPolicy
+                : buildCsp(contentSecurityPolicy);
+            ctx.res.setHeader('Content-Security-Policy', cspVal);
+        }
+        await next();
+    };
+}
+//# sourceMappingURL=headers.js.map

package/dist/security/headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"headers.js","sourceRoot":"","sources":["../../src/security/headers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAiEH,SAAS,QAAQ,CAAC,UAA2C;IAC3D,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACtD,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC1E,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACvC,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,GAAG,aAAa,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC,GAAG,aAAa,IAAI,KAAK,EAAE,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,eAAe,CAAuB,UAAkC,EAAE;IACxF,MAAM,EACJ,kBAAkB,GAAG,IAAI,EACzB,YAAY,GAAG,YAAY,EAC3B,aAAa,GAAG,GAAG,EACnB,IAAI,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,EACpD,cAAc,GAAG,aAAa,EAC9B,uBAAuB,GAAG,aAAa,EACvC,yBAAyB,GAAG,aAAa,EACzC,yBAAyB,GAAG,KAAK,EACjC,qBAAqB,GAAG,KAAK,EAC7B,aAAa,GAAG,IAAI,GACrB,GAAG,OAAO,CAAC;IAEZ,OAAO,KAAK,EAAE,GAAuB,EAAE,IAAkB,EAAE,EAAE;QAC3D,uBAAuB;QACvB,IAAI,aAAa,EAAE,CAAC;YAClB,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;QACvC,CAAC;QAED,4BAA4B;QAC5B,IAAI,kBAAkB,EAAE,CAAC;YACvB,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACzD,CAAC;QAED,qBAAqB;QACrB,IAAI,YAAY,EAAE,CAAC;YACjB,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;QACrD,CAAC;QAED,sBAAsB;QACtB,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC;YACpE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;QAED,sCAAsC;QACtC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,IAAI,GAAgB,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;YAC1G,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC;YACvC,IAAI,GAAG,GAAG,WAAW,MAAM,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,EAAE,CAAC;gBACnC,GAAG,IAAI,qBAAqB,CAAC;YAC/B,CAAC;YACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjB,GAAG,IAAI,WAAW,CAAC;YACrB,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QAED,qBAAqB;QACrB,IAAI,cAAc,EAAE,CAAC;YACnB,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC;QACvD,CAAC;QAED,gCAAgC;QAChC,IAAI,uBAAuB,EAAE,CAAC;YAC5B,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,4BAA4B,EAAE,uBAAuB,CAAC,CAAC;QAC3E,CAAC;QAED,kCAAkC;QAClC,IAAI,yBAAyB,EAAE,CAAC;YAC9B,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,yBAAyB,CAAC,CAAC;QAC/E,CAAC;QAED,kCAAkC;QAClC,IAAI,yBAAyB,EAAE,CAAC;YAC9B,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,yBAAyB,CAAC,CAAC;QAC/E,CAAC;QAED,8BAA8B;QAC9B,IAAI,qBAAqB,EAAE,CAAC;YAC1B,MAAM,MAAM,GACV,OAAO,qBAAqB,KAAK,QAAQ;gBACvC,CAAC,CAAC,qBAAqB;gBACvB,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;YACtC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,MAAM,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/security/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * @file index.ts
+ * @description Security modules for Aero Web Framework: JWT, Rate Limiter, Security Headers, and CSRF.
+ */
+export { jwt, sign, verify, decode, jwtAuth, parseTimespan, JsonWebTokenError, TokenExpiredError, NotBeforeError, type JwtAlgorithm, type JwtHeader, type JwtPayload, type JwtSignOptions, type JwtVerifyOptions, type JwtAuthOptions, } from './jwt.js';
+export { rateLimit, MemoryRateLimitStore, TooManyRequestsError, type RateLimitOptions, type RateLimitStore, type RateLimitInfo, } from './rate-limiter.js';
+export { securityHeaders, type SecurityHeadersOptions, type HstsOptions, type ContentSecurityPolicyDirectives, } from './headers.js';
+export { csrf, type CsrfOptions, } from './csrf.js';
+export { Hash, hash, hashVerify, type ScryptOptions, } from './hash.js';
+export { cors, type CorsOptions, } from '../middleware/cors.js';
+export * from './totp.js';
+export * from './vault.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,GAAG,EACH,IAAI,EACJ,MAAM,EACN,MAAM,EACN,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,cAAc,GACpB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,SAAS,EACT,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,eAAe,EACf,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,KAAK,+BAA+B,GACrC,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,IAAI,EACJ,KAAK,WAAW,GACjB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,IAAI,EACJ,IAAI,EACJ,UAAU,EACV,KAAK,aAAa,GACnB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,IAAI,EACJ,KAAK,WAAW,GACjB,MAAM,uBAAuB,CAAC;AAE/B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC"}

package/dist/security/index.js

@@ -0,0 +1,13 @@
+/**
+ * @file index.ts
+ * @description Security modules for Aero Web Framework: JWT, Rate Limiter, Security Headers, and CSRF.
+ */
+export { jwt, sign, verify, decode, jwtAuth, parseTimespan, JsonWebTokenError, TokenExpiredError, NotBeforeError, } from './jwt.js';
+export { rateLimit, MemoryRateLimitStore, TooManyRequestsError, } from './rate-limiter.js';
+export { securityHeaders, } from './headers.js';
+export { csrf, } from './csrf.js';
+export { Hash, hash, hashVerify, } from './hash.js';
+export { cors, } from '../middleware/cors.js';
+export * from './totp.js';
+export * from './vault.js';
+//# sourceMappingURL=index.js.map

package/dist/security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,GAAG,EACH,IAAI,EACJ,MAAM,EACN,MAAM,EACN,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,GAOf,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,SAAS,EACT,oBAAoB,EACpB,oBAAoB,GAIrB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,eAAe,GAIhB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,IAAI,GAEL,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,IAAI,EACJ,IAAI,EACJ,UAAU,GAEX,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,IAAI,GAEL,MAAM,uBAAuB,CAAC;AAE/B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC"}

package/dist/security/jwt.d.ts

@@ -0,0 +1,96 @@
+/**
+ * @file jwt.ts
+ * @description Zero-dependency JSON Web Token (JWT) signing, verification, and authentication middleware for Aero.
+ * Powered purely by Node.js built-in `node:crypto`.
+ */
+import type { Middleware } from '../core/types.js';
+import type { AeroContext } from '../core/context.js';
+export type JwtAlgorithm = 'HS256' | 'HS384' | 'HS512';
+export interface JwtHeader {
+    alg: JwtAlgorithm;
+    typ?: string;
+    [key: string]: unknown;
+}
+export interface JwtPayload {
+    iss?: string;
+    sub?: string;
+    aud?: string | string[];
+    exp?: number;
+    nbf?: number;
+    iat?: number;
+    jti?: string;
+    [key: string]: unknown;
+}
+export interface JwtSignOptions {
+    algorithm?: JwtAlgorithm;
+    expiresIn?: string | number;
+    notBefore?: string | number;
+    audience?: string | string[];
+    issuer?: string;
+    subject?: string;
+    jwtid?: string;
+    header?: Record<string, unknown>;
+    noTimestamp?: boolean;
+}
+export interface JwtVerifyOptions {
+    algorithms?: JwtAlgorithm[];
+    audience?: string | string[];
+    issuer?: string | string[];
+    subject?: string;
+    clockTolerance?: number;
+    ignoreExpiration?: boolean;
+    ignoreNotBefore?: boolean;
+}
+export interface JwtAuthOptions {
+    secret: string | Buffer | ((header: JwtHeader, payload: JwtPayload) => Promise<string | Buffer> | string | Buffer);
+    algorithms?: JwtAlgorithm[];
+    credentialsRequired?: boolean;
+    userProperty?: string;
+    getToken?: (ctx: AeroContext) => string | undefined | null | Promise<string | undefined | null>;
+    cookie?: string;
+}
+export declare class JsonWebTokenError extends Error {
+    name: string;
+    constructor(message: string);
+}
+export declare class TokenExpiredError extends JsonWebTokenError {
+    name: string;
+    expiredAt: Date;
+    constructor(message: string, expiredAt: Date);
+}
+export declare class NotBeforeError extends JsonWebTokenError {
+    name: string;
+    date: Date;
+    constructor(message: string, date: Date);
+}
+/**
+ * Parses timespan string (e.g. '15m', '2h', '7d') or numeric seconds into seconds.
+ */
+export declare function parseTimespan(val: string | number): number;
+/**
+ * Signs a payload and returns a signed JWT token string.
+ */
+export declare function sign(payload: Record<string, unknown>, secret: string | Buffer, options?: JwtSignOptions): string;
+/**
+ * Decodes a JWT token without verifying the signature.
+ */
+export declare function decode<T = JwtPayload>(token: string): {
+    header: JwtHeader;
+    payload: T;
+    signature: string;
+} | null;
+/**
+ * Cryptographically verifies a JWT token and returns its decoded payload.
+ */
+export declare function verify<T = JwtPayload>(token: string, secret: string | Buffer, options?: JwtVerifyOptions): T;
+export declare const jwt: {
+    sign: typeof sign;
+    verify: typeof verify;
+    decode: typeof decode;
+    parseTimespan: typeof parseTimespan;
+};
+/**
+ * Aero Middleware for zero-dependency JWT authentication.
+ */
+export declare function jwtAuth<T = JwtPayload>(options: JwtAuthOptions): Middleware;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/security/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/security/jwt.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAEvD,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,YAAY,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,YAAY,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,MAAM,GAAG,MAAM,CAAC,CAAC;IACnH,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC;IAC5B,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC;IAChG,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAC1B,IAAI,SAAuB;gBAC/B,OAAO,EAAE,MAAM;CAG5B;AAED,qBAAa,iBAAkB,SAAQ,iBAAiB;IACtC,IAAI,SAAuB;IACpC,SAAS,EAAE,IAAI,CAAC;gBAEX,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI;CAI7C;AAED,qBAAa,cAAe,SAAQ,iBAAiB;IACnC,IAAI,SAAoB;IACjC,IAAI,EAAE,IAAI,CAAC;gBAEN,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI;CAIxC;AAQD;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAwB1D;AA4BD;;GAEG;AACH,wBAAgB,IAAI,CAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,MAAM,EAAE,MAAM,GAAG,MAAM,EACvB,OAAO,GAAE,cAAmB,GAC3B,MAAM,CAuDR;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,CAAC,GAAG,UAAU,EACnC,KAAK,EAAE,MAAM,GACZ;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,CAAC,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAkB7D;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,CAAC,GAAG,UAAU,EACnC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GAAG,MAAM,EACvB,OAAO,GAAE,gBAAqB,GAC7B,CAAC,CAmGH;AAED,eAAO,MAAM,GAAG;;;;;CAKf,CAAC;AAEF;;GAEG;AACH,wBAAgB,OAAO,CAAC,CAAC,GAAG,UAAU,EAAE,OAAO,EAAE,cAAc,GAAG,UAAU,CAkE3E"}