@sixthsummit/ship-api 0.0.0-stage → 4.1.1

package/lib/http/app/health.js

@@ -0,0 +1,104 @@
+import { healthCheckRegistry as defaultRegistry, } from "../../app/health/HealthCheck.js";
+import { logger } from "../../observability/logger.js";
+import { safeErrorFields } from "../../observability/safeErrorFields.js";
+/** Longest returned `error` string copied into the readiness failure log. */
+const MAX_LOGGED_REASON_LENGTH = 200;
+/** Apps that already have the health routes mounted, keyed by app instance. */
+const mountedHealthRoutes = new WeakMap();
+/** Whether `/livez` + `/readyz` are already mounted on this app instance. */
+export function hasHealthRoutes(app) {
+    return mountedHealthRoutes.has(app);
+}
+/**
+ * Mount `/livez` + `/readyz` on `app`, once per app instance.
+ *
+ * On an app that already has them (every `createApp()` app unless it passed
+ * `health: false`), this never mounts a second copy and never throws. A
+ * `registry` or `readyzTimeoutMs` passed to the later call is applied to the
+ * routes already mounted, so an app that wires its own registry this way keeps
+ * the readiness checks it had before `createApp` mounted the routes. That late
+ * configuration is deprecated: it logs a warning once per app, and will be
+ * removed in the next major version — pass it to `createApp({ health })`. A
+ * different `prefix` cannot be honoured without mounting again; it is ignored
+ * with a warning (configure it with `createApp({ health: { prefix } })`).
+ */
+export function registerHealthRoutes(app, opts = {}) {
+    const existing = mountedHealthRoutes.get(app);
+    if (existing) {
+        applyToMountedRoutes(existing, opts);
+        return;
+    }
+    const state = {
+        registry: opts.registry ?? defaultRegistry,
+        timeoutMs: opts.readyzTimeoutMs,
+        prefix: opts.prefix ?? "",
+    };
+    app.get(`${state.prefix}/livez`, (c) => c.json({ ok: true }, 200));
+    app.get(`${state.prefix}/readyz`, async (c) => {
+        const failures = [];
+        const result = await state.registry.runAll({
+            timeoutMs: state.timeoutMs,
+            onCheckFailure: (failure) => failures.push(failure),
+        });
+        if (!result.ok) {
+            logger.warn({ checks: failures.map(describeFailure) }, "Readiness check failed");
+        }
+        const timedOut = new Set(failures.filter((f) => f.timedOut).map((f) => f.name));
+        const body = {
+            ok: result.ok,
+            checks: result.checks.map((check) => check.ok
+                ? { name: check.name, ok: true, latencyMs: check.latencyMs }
+                : {
+                    name: check.name,
+                    ok: false,
+                    latencyMs: check.latencyMs,
+                    error: timedOut.has(check.name) ? "timeout" : "unavailable",
+                }),
+        };
+        return c.json(body, result.ok ? 200 : 503);
+    });
+    mountedHealthRoutes.set(app, state);
+}
+function applyToMountedRoutes(state, opts) {
+    const updated = [];
+    if (opts.registry !== undefined && opts.registry !== state.registry) {
+        state.registry = opts.registry;
+        updated.push("registry");
+    }
+    if (opts.readyzTimeoutMs !== undefined && opts.readyzTimeoutMs !== state.timeoutMs) {
+        state.timeoutMs = opts.readyzTimeoutMs;
+        updated.push("readyzTimeoutMs");
+    }
+    if (opts.prefix !== undefined && opts.prefix !== state.prefix) {
+        logger.warn({ mountedPrefix: state.prefix, ignoredPrefix: opts.prefix }, "registerHealthRoutes: health routes are already mounted on this app (createApp mounts them by default); " +
+            "the prefix is ignored. Configure it with createApp({ health: { prefix } }) instead");
+    }
+    if (updated.length > 0 && !state.deprecationWarned) {
+        state.deprecationWarned = true;
+        logger.warn({ updated }, "registerHealthRoutes: configuring health routes after createApp is deprecated and will be removed " +
+            "in the next major version. Pass these options to createApp({ health: { ... } }) instead");
+    }
+    logger.debug({ updated }, "registerHealthRoutes: health routes are already mounted on this app; not mounting them again");
+}
+/**
+ * Log-safe summary of a failed check.
+ *
+ * - A check that *returned* `{ ok: false, error }` wrote that string itself, so
+ *   it is logged as `reason`, truncated to {@link MAX_LOGGED_REASON_LENGTH}
+ *   characters. App authors must keep secrets out of it (documented).
+ * - A *thrown* error keeps only its `code`, `name` and `syscall` — never the
+ *   message, which for database and network errors can contain the host,
+ *   port, user or database name.
+ */
+function describeFailure(failure) {
+    const summary = { name: failure.name, timedOut: failure.timedOut };
+    if (failure.reason !== undefined) {
+        summary.reason = truncate(failure.reason, MAX_LOGGED_REASON_LENGTH);
+        return summary;
+    }
+    return { ...summary, ...safeErrorFields(failure.error) };
+}
+function truncate(value, max) {
+    return value.length <= max ? value : `${value.slice(0, max)}…`;
+}
+//# sourceMappingURL=health.js.map

package/lib/http/app/health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../../../src/http/app/health.ts"],"names":[],"mappings":"AACA,OAAO,EACL,mBAAmB,IAAI,eAAe,GAGvC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AAEzE,6EAA6E;AAC7E,MAAM,wBAAwB,GAAG,GAAG,CAAC;AA8DrC,+EAA+E;AAC/E,MAAM,mBAAmB,GAAG,IAAI,OAAO,EAA+B,CAAC;AAEvE,6EAA6E;AAC7E,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAS,EAAE,OAAoC,EAAE;IACpF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,QAAQ,EAAE,CAAC;QACb,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACrC,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAwB;QACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,eAAe;QAC1C,SAAS,EAAE,IAAI,CAAC,eAAe;QAC/B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;KAC1B,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IAEnE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,MAAM,QAAQ,GAAyB,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;YACzC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;SACpD,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,EAAE,wBAAwB,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAChF,MAAM,IAAI,GAAe;YACvB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAClC,KAAK,CAAC,EAAE;gBACN,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;gBAC5D,CAAC,CAAC;oBACE,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,EAAE,EAAE,KAAK;oBACT,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa;iBAC5D,CACN;SACF,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,oBAAoB,CAAC,KAA0B,EAAE,IAAiC;IACzF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpE,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,IAAI,CAAC,eAAe,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;QACnF,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,CAAC,IAAI,CACT,EAAE,aAAa,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,EAC3D,0GAA0G;YACxG,oFAAoF,CACvF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;QACnD,KAAK,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAC/B,MAAM,CAAC,IAAI,CACT,EAAE,OAAO,EAAE,EACX,oGAAoG;YAClG,yFAAyF,CAC5F,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,KAAK,CACV,EAAE,OAAO,EAAE,EACX,8FAA8F,CAC/F,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,OAA2B;IAClD,MAAM,OAAO,GAA4B,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC5F,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;QACpE,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,GAAW;IAC1C,OAAO,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC;AACjE,CAAC"}

package/lib/http/errors/AppError.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Base error class for application-specific errors
+ */
+export declare class AppError extends Error {
+    readonly statusCode: number;
+    readonly code: string;
+    readonly isOperational: boolean;
+    constructor(message: string, statusCode?: number, code?: string, isOperational?: boolean);
+}
+//# sourceMappingURL=AppError.d.ts.map

package/lib/http/errors/AppError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AppError.d.ts","sourceRoot":"","sources":["../../../src/http/errors/AppError.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,SAAgB,UAAU,EAAE,MAAM,CAAC;IACnC,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,aAAa,EAAE,OAAO,CAAC;gBAGrC,OAAO,EAAE,MAAM,EACf,UAAU,GAAE,MAAY,EACxB,IAAI,GAAE,MAAgC,EACtC,aAAa,GAAE,OAAc;CAahC"}

package/lib/http/errors/AppError.js

@@ -0,0 +1,19 @@
+/**
+ * Base error class for application-specific errors
+ */
+export class AppError extends Error {
+    statusCode;
+    code;
+    isOperational;
+    constructor(message, statusCode = 500, code = "INTERNAL_SERVER_ERROR", isOperational = true) {
+        super(message);
+        this.statusCode = statusCode;
+        this.code = code;
+        this.isOperational = isOperational;
+        // Maintains proper stack trace for where our error was thrown (only available on V8)
+        if (Error.captureStackTrace) {
+            Error.captureStackTrace(this, AppError);
+        }
+    }
+}
+//# sourceMappingURL=AppError.js.map

package/lib/http/errors/AppError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AppError.js","sourceRoot":"","sources":["../../../src/http/errors/AppError.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjB,UAAU,CAAS;IACnB,IAAI,CAAS;IACb,aAAa,CAAU;IAEvC,YACE,OAAe,EACf,aAAqB,GAAG,EACxB,OAAe,uBAAuB,EACtC,gBAAyB,IAAI;QAE7B,KAAK,CAAC,OAAO,CAAC,CAAC;QAEf,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QAEnC,qFAAqF;QACrF,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC5B,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;CACF"}

package/lib/http/errors/AuthenticationError.d.ts

@@ -0,0 +1,8 @@
+import { AppError } from "./AppError.js";
+/**
+ * Error thrown when authentication is required or fails
+ */
+export declare class AuthenticationError extends AppError {
+    constructor(message?: string);
+}
+//# sourceMappingURL=AuthenticationError.d.ts.map

package/lib/http/errors/AuthenticationError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthenticationError.d.ts","sourceRoot":"","sources":["../../../src/http/errors/AuthenticationError.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;gBACnC,OAAO,GAAE,MAAkC;CAGxD"}

package/lib/http/errors/AuthenticationError.js

@@ -0,0 +1,10 @@
+import { AppError } from "./AppError.js";
+/**
+ * Error thrown when authentication is required or fails
+ */
+export class AuthenticationError extends AppError {
+    constructor(message = "Authentication required") {
+        super(message, 401, "AUTHENTICATION_ERROR");
+    }
+}
+//# sourceMappingURL=AuthenticationError.js.map

package/lib/http/errors/AuthenticationError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthenticationError.js","sourceRoot":"","sources":["../../../src/http/errors/AuthenticationError.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,UAAkB,yBAAyB;QACrD,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAC;IAC9C,CAAC;CACF"}

package/lib/http/errors/AuthorizationError.d.ts

@@ -0,0 +1,8 @@
+import { AppError } from "./AppError.js";
+/**
+ * Error thrown when user lacks sufficient permissions
+ */
+export declare class AuthorizationError extends AppError {
+    constructor(message?: string);
+}
+//# sourceMappingURL=AuthorizationError.d.ts.map

package/lib/http/errors/AuthorizationError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorizationError.d.ts","sourceRoot":"","sources":["../../../src/http/errors/AuthorizationError.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,QAAQ;gBAClC,OAAO,GAAE,MAAmC;CAGzD"}

package/lib/http/errors/AuthorizationError.js

@@ -0,0 +1,10 @@
+import { AppError } from "./AppError.js";
+/**
+ * Error thrown when user lacks sufficient permissions
+ */
+export class AuthorizationError extends AppError {
+    constructor(message = "Insufficient permissions") {
+        super(message, 403, "AUTHORIZATION_ERROR");
+    }
+}
+//# sourceMappingURL=AuthorizationError.js.map

package/lib/http/errors/AuthorizationError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorizationError.js","sourceRoot":"","sources":["../../../src/http/errors/AuthorizationError.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC;;GAEG;AACH,MAAM,OAAO,kBAAmB,SAAQ,QAAQ;IAC9C,YAAY,UAAkB,0BAA0B;QACtD,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;IAC7C,CAAC;CACF"}

package/lib/http/errors/BadRequestError.d.ts

@@ -0,0 +1,8 @@
+import { AppError } from "./AppError.js";
+/**
+ * Error thrown for general bad request scenarios
+ */
+export declare class BadRequestError extends AppError {
+    constructor(message?: string);
+}
+//# sourceMappingURL=BadRequestError.d.ts.map

package/lib/http/errors/BadRequestError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BadRequestError.d.ts","sourceRoot":"","sources":["../../../src/http/errors/BadRequestError.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC;;GAEG;AACH,qBAAa,eAAgB,SAAQ,QAAQ;gBAC/B,OAAO,GAAE,MAAsB;CAG5C"}

package/lib/http/errors/BadRequestError.js

@@ -0,0 +1,10 @@
+import { AppError } from "./AppError.js";
+/**
+ * Error thrown for general bad request scenarios
+ */
+export class BadRequestError extends AppError {
+    constructor(message = "Bad request") {
+        super(message, 400, "BAD_REQUEST_ERROR");
+    }
+}
+//# sourceMappingURL=BadRequestError.js.map

package/lib/http/errors/BadRequestError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BadRequestError.js","sourceRoot":"","sources":["../../../src/http/errors/BadRequestError.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,QAAQ;IAC3C,YAAY,UAAkB,aAAa;QACzC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC3C,CAAC;CACF"}

package/lib/http/errors/ConflictError.d.ts

@@ -0,0 +1,8 @@
+import { AppError } from "./AppError.js";
+/**
+ * Error thrown when there's a conflict with existing resources
+ */
+export declare class ConflictError extends AppError {
+    constructor(message?: string);
+}
+//# sourceMappingURL=ConflictError.d.ts.map

package/lib/http/errors/ConflictError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConflictError.d.ts","sourceRoot":"","sources":["../../../src/http/errors/ConflictError.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC;;GAEG;AACH,qBAAa,aAAc,SAAQ,QAAQ;gBAC7B,OAAO,GAAE,MAA4B;CAGlD"}

package/lib/http/errors/ConflictError.js

@@ -0,0 +1,10 @@
+import { AppError } from "./AppError.js";
+/**
+ * Error thrown when there's a conflict with existing resources
+ */
+export class ConflictError extends AppError {
+    constructor(message = "Resource conflict") {
+        super(message, 409, "CONFLICT_ERROR");
+    }
+}
+//# sourceMappingURL=ConflictError.js.map

package/lib/http/errors/ConflictError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConflictError.js","sourceRoot":"","sources":["../../../src/http/errors/ConflictError.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC;;GAEG;AACH,MAAM,OAAO,aAAc,SAAQ,QAAQ;IACzC,YAAY,UAAkB,mBAAmB;QAC/C,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;IACxC,CAAC;CACF"}

package/lib/http/errors/InternalServerError.d.ts

@@ -0,0 +1,8 @@
+import { AppError } from "./AppError.js";
+/**
+ * Error thrown for internal server errors
+ */
+export declare class InternalServerError extends AppError {
+    constructor(message?: string);
+}
+//# sourceMappingURL=InternalServerError.d.ts.map

package/lib/http/errors/InternalServerError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"InternalServerError.d.ts","sourceRoot":"","sources":["../../../src/http/errors/InternalServerError.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;gBACnC,OAAO,GAAE,MAAgC;CAGtD"}

package/lib/http/errors/InternalServerError.js

@@ -0,0 +1,10 @@
+import { AppError } from "./AppError.js";
+/**
+ * Error thrown for internal server errors
+ */
+export class InternalServerError extends AppError {
+    constructor(message = "Internal server error") {
+        super(message, 500, "INTERNAL_SERVER_ERROR");
+    }
+}
+//# sourceMappingURL=InternalServerError.js.map

package/lib/http/errors/InternalServerError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"InternalServerError.js","sourceRoot":"","sources":["../../../src/http/errors/InternalServerError.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,UAAkB,uBAAuB;QACnD,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAC/C,CAAC;CACF"}

package/lib/http/errors/NotFoundError.d.ts

@@ -0,0 +1,8 @@
+import { AppError } from "./AppError.js";
+/**
+ * Error thrown when a requested resource is not found
+ */
+export declare class NotFoundError extends AppError {
+    constructor(message?: string);
+}
+//# sourceMappingURL=NotFoundError.d.ts.map

package/lib/http/errors/NotFoundError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NotFoundError.d.ts","sourceRoot":"","sources":["../../../src/http/errors/NotFoundError.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC;;GAEG;AACH,qBAAa,aAAc,SAAQ,QAAQ;gBAC7B,OAAO,GAAE,MAA6B;CAGnD"}

package/lib/http/errors/NotFoundError.js

@@ -0,0 +1,10 @@
+import { AppError } from "./AppError.js";
+/**
+ * Error thrown when a requested resource is not found
+ */
+export class NotFoundError extends AppError {
+    constructor(message = "Resource not found") {
+        super(message, 404, "NOT_FOUND_ERROR");
+    }
+}
+//# sourceMappingURL=NotFoundError.js.map

package/lib/http/errors/NotFoundError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"NotFoundError.js","sourceRoot":"","sources":["../../../src/http/errors/NotFoundError.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC;;GAEG;AACH,MAAM,OAAO,aAAc,SAAQ,QAAQ;IACzC,YAAY,UAAkB,oBAAoB;QAChD,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACzC,CAAC;CACF"}

package/lib/http/errors/RateLimitError.d.ts

@@ -0,0 +1,13 @@
+import { AppError } from "./AppError.js";
+/**
+ * Error thrown when a rate-limit ceiling is exceeded.
+ *
+ * Mapped to 429 by `registerErrorHandlers`. The `retryAfterSec` field is
+ * surfaced as the `Retry-After` response header by the rate-limit
+ * middleware itself (set before throwing).
+ */
+export declare class RateLimitError extends AppError {
+    readonly retryAfterSec: number;
+    constructor(retryAfterSec: number, message?: string);
+}
+//# sourceMappingURL=RateLimitError.d.ts.map

package/lib/http/errors/RateLimitError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimitError.d.ts","sourceRoot":"","sources":["../../../src/http/errors/RateLimitError.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC;;;;;;GAMG;AACH,qBAAa,cAAe,SAAQ,QAAQ;IAC1C,SAAgB,aAAa,EAAE,MAAM,CAAC;gBAE1B,aAAa,EAAE,MAAM,EAAE,OAAO,SAAsB;CAIjE"}

package/lib/http/errors/RateLimitError.js

@@ -0,0 +1,16 @@
+import { AppError } from "./AppError.js";
+/**
+ * Error thrown when a rate-limit ceiling is exceeded.
+ *
+ * Mapped to 429 by `registerErrorHandlers`. The `retryAfterSec` field is
+ * surfaced as the `Retry-After` response header by the rate-limit
+ * middleware itself (set before throwing).
+ */
+export class RateLimitError extends AppError {
+    retryAfterSec;
+    constructor(retryAfterSec, message = "Too many requests") {
+        super(message, 429, "RATE_LIMIT_EXCEEDED");
+        this.retryAfterSec = retryAfterSec;
+    }
+}
+//# sourceMappingURL=RateLimitError.js.map

package/lib/http/errors/RateLimitError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimitError.js","sourceRoot":"","sources":["../../../src/http/errors/RateLimitError.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,OAAO,cAAe,SAAQ,QAAQ;IAC1B,aAAa,CAAS;IAEtC,YAAY,aAAqB,EAAE,OAAO,GAAG,mBAAmB;QAC9D,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;QAC3C,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;IACrC,CAAC;CACF"}

package/lib/http/errors/ServiceUnavailableError.d.ts

@@ -0,0 +1,8 @@
+import { AppError } from "./AppError.js";
+/**
+ * Error thrown when a service is temporarily unavailable
+ */
+export declare class ServiceUnavailableError extends AppError {
+    constructor(message?: string);
+}
+//# sourceMappingURL=ServiceUnavailableError.d.ts.map

package/lib/http/errors/ServiceUnavailableError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ServiceUnavailableError.d.ts","sourceRoot":"","sources":["../../../src/http/errors/ServiceUnavailableError.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,QAAQ;gBACvC,OAAO,GAAE,MAA0C;CAGhE"}

package/lib/http/errors/ServiceUnavailableError.js

@@ -0,0 +1,10 @@
+import { AppError } from "./AppError.js";
+/**
+ * Error thrown when a service is temporarily unavailable
+ */
+export class ServiceUnavailableError extends AppError {
+    constructor(message = "Service temporarily unavailable") {
+        super(message, 503, "SERVICE_UNAVAILABLE_ERROR");
+    }
+}
+//# sourceMappingURL=ServiceUnavailableError.js.map

package/lib/http/errors/ServiceUnavailableError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ServiceUnavailableError.js","sourceRoot":"","sources":["../../../src/http/errors/ServiceUnavailableError.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC;;GAEG;AACH,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;IACnD,YAAY,UAAkB,iCAAiC;QAC7D,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,2BAA2B,CAAC,CAAC;IACnD,CAAC;CACF"}

package/lib/http/errors/ValidationError.d.ts

@@ -0,0 +1,9 @@
+import { AppError } from "./AppError.js";
+/**
+ * Error thrown when input validation fails
+ */
+export declare class ValidationError extends AppError {
+    readonly details?: any;
+    constructor(message: string, details?: any);
+}
+//# sourceMappingURL=ValidationError.d.ts.map

package/lib/http/errors/ValidationError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ValidationError.d.ts","sourceRoot":"","sources":["../../../src/http/errors/ValidationError.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC;;GAEG;AACH,qBAAa,eAAgB,SAAQ,QAAQ;IAC3C,SAAgB,OAAO,CAAC,EAAE,GAAG,CAAC;gBAElB,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG;CAI3C"}

package/lib/http/errors/ValidationError.js

@@ -0,0 +1,12 @@
+import { AppError } from "./AppError.js";
+/**
+ * Error thrown when input validation fails
+ */
+export class ValidationError extends AppError {
+    details;
+    constructor(message, details) {
+        super(message, 400, "VALIDATION_ERROR");
+        this.details = details;
+    }
+}
+//# sourceMappingURL=ValidationError.js.map

package/lib/http/errors/ValidationError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ValidationError.js","sourceRoot":"","sources":["../../../src/http/errors/ValidationError.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,QAAQ;IAC3B,OAAO,CAAO;IAE9B,YAAY,OAAe,EAAE,OAAa;QACxC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF"}

package/lib/http/errors/index.d.ts

@@ -0,0 +1,11 @@
+export { AppError } from "./AppError.js";
+export { AuthenticationError } from "./AuthenticationError.js";
+export { AuthorizationError } from "./AuthorizationError.js";
+export { BadRequestError } from "./BadRequestError.js";
+export { ConflictError } from "./ConflictError.js";
+export { InternalServerError } from "./InternalServerError.js";
+export { NotFoundError } from "./NotFoundError.js";
+export { RateLimitError } from "./RateLimitError.js";
+export { ServiceUnavailableError } from "./ServiceUnavailableError.js";
+export { ValidationError } from "./ValidationError.js";
+//# sourceMappingURL=index.d.ts.map

package/lib/http/errors/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/http/errors/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC"}

package/lib/http/errors/index.js

@@ -0,0 +1,12 @@
+// Export all error classes for convenient importing
+export { AppError } from "./AppError.js";
+export { AuthenticationError } from "./AuthenticationError.js";
+export { AuthorizationError } from "./AuthorizationError.js";
+export { BadRequestError } from "./BadRequestError.js";
+export { ConflictError } from "./ConflictError.js";
+export { InternalServerError } from "./InternalServerError.js";
+export { NotFoundError } from "./NotFoundError.js";
+export { RateLimitError } from "./RateLimitError.js";
+export { ServiceUnavailableError } from "./ServiceUnavailableError.js";
+export { ValidationError } from "./ValidationError.js";
+//# sourceMappingURL=index.js.map

package/lib/http/errors/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/http/errors/index.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC"}

package/lib/http/middleware/apiKey.d.ts

@@ -0,0 +1,9 @@
+import type { MiddlewareHandler } from "hono";
+export interface ApiKeyOptions {
+    /** The expected secret. Required. */
+    secret: string;
+    /** Header name to read. Default `"x-api-key"`. */
+    headerName?: string;
+}
+export declare function apiKey(opts: ApiKeyOptions): MiddlewareHandler;
+//# sourceMappingURL=apiKey.d.ts.map

package/lib/http/middleware/apiKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiKey.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/apiKey.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AA0B9C,MAAM,WAAW,aAAa;IAC5B,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAyBD,wBAAgB,MAAM,CAAC,IAAI,EAAE,aAAa,GAAG,iBAAiB,CA6B7D"}

package/lib/http/middleware/apiKey.js

@@ -0,0 +1,71 @@
+import { AuthenticationError } from "../errors/AuthenticationError.js";
+import { AUTH_META, setMetaTag } from "../utils/metaTags.js";
+/**
+ * `apiKey({ secret, headerName? })` — minimal API-key gate for webhook /
+ * machine-to-machine endpoints where Firebase token auth doesn't apply.
+ *
+ * Replaces v3's `ApiKeyMiddleware`. Differences:
+ *
+ * 1. Secret is passed in by the consumer (typically `env.WEBHOOKS_API_KEY`
+ *    via `defineEnv`) rather than read directly from `process.env` —
+ *    cleaner test stories, better stack tracing of misconfig.
+ * 2. Throws `AuthenticationError` (mapped by `app.onError`) instead of
+ *    returning a JSON response inline — keeps the response shape consistent
+ *    with the rest of the framework.
+ * 3. Tagged with `AUTH_META` (`providerName: "api-key"`) so the route
+ *    registry shows the route is authenticated even though no AuthProvider
+ *    is involved.
+ *
+ * Constant-time comparison via `crypto.timingSafeEqual` to avoid leaking
+ * the secret length / first-mismatch position via timing side-channel.
+ */
+import { timingSafeEqual } from "node:crypto";
+/**
+ * Constant-time-ish compare. F22: the mismatch-path dummy compares
+ * the EXPECTED buffer against itself rather than the presented
+ * buffer — so wall-clock execution time doesn't leak the *presented*
+ * value's length (which an attacker controls). The secret's length is
+ * fixed across requests and is not itself sensitive (length alone
+ * doesn't reveal the secret), but biasing the timing channel toward
+ * the controlled side is unambiguously better.
+ *
+ * `expected` MUST be the trusted side (the server-side secret).
+ */
+function safeCompare(expected, presented) {
+    const expectedBuf = Buffer.from(expected);
+    const presentedBuf = Buffer.from(presented);
+    if (expectedBuf.length !== presentedBuf.length) {
+        // Fixed-cost comparison over the *expected* buffer so the
+        // attacker's input length can't bias the timing observation.
+        timingSafeEqual(expectedBuf, expectedBuf);
+        return false;
+    }
+    return timingSafeEqual(expectedBuf, presentedBuf);
+}
+export function apiKey(opts) {
+    if (!opts.secret) {
+        throw new Error("apiKey(): `secret` is required");
+    }
+    const headerName = (opts.headerName ?? "x-api-key").toLowerCase();
+    const expected = opts.secret;
+    const middleware = async (c, next) => {
+        const presented = c.req.header(headerName);
+        if (!presented) {
+            throw new AuthenticationError(`Missing ${headerName} header`);
+        }
+        // F22: pass expected as the first arg so the timing dummy on
+        // mismatch operates over the trusted secret's length, not the
+        // attacker-controlled presented value's length.
+        if (!safeCompare(expected, presented)) {
+            throw new AuthenticationError("Invalid API key");
+        }
+        return next();
+    };
+    const tag = {
+        required: true,
+        providerName: "api-key",
+    };
+    setMetaTag(middleware, AUTH_META, tag);
+    return middleware;
+}
+//# sourceMappingURL=apiKey.js.map

package/lib/http/middleware/apiKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiKey.js","sourceRoot":"","sources":["../../../src/http/middleware/apiKey.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,SAAS,EAAiB,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAE5E;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAS9C;;;;;;;;;;GAUG;AACH,SAAS,WAAW,CAAC,QAAgB,EAAE,SAAiB;IACtD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,WAAW,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;QAC/C,0DAA0D;QAC1D,6DAA6D;QAC7D,eAAe,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,IAAmB;IACxC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;IAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC;IAE7B,MAAM,UAAU,GAAsB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACtD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,mBAAmB,CAAC,WAAW,UAAU,SAAS,CAAC,CAAC;QAChE,CAAC;QACD,6DAA6D;QAC7D,8DAA8D;QAC9D,gDAAgD;QAChD,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;IAEF,MAAM,GAAG,GAAa;QACpB,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,SAAS;KACxB,CAAC;IACF,UAAU,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IAEvC,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/lib/http/middleware/csrf.d.ts

@@ -0,0 +1,63 @@
+import type { MiddlewareHandler } from "hono";
+export interface CsrfOptions {
+    /**
+     * Origins permitted to make mutating requests. Compared exactly (scheme +
+     * host + port). Required.
+     */
+    allowedOrigins: readonly string[];
+    /**
+     * Enable the double-submit cookie pattern. Default `false` (Origin check
+     * only).
+     *
+     * **F27 — threat model note.** The double-submit cookie is intentionally
+     * readable by JavaScript (`httpOnly: false`) so the SPA can echo it
+     * into the request header. This means **an XSS bug becomes a CSRF
+     * defense bypass**: attacker-controlled script reads the cookie,
+     * sets the matching header, and submits a mutating request. The
+     * double-submit pattern is therefore **defense-in-depth on top of
+     * CSP-defended XSS**, not a standalone bulwark.
+     *
+     * Operators should pair this middleware with:
+     *   - A strict Content-Security-Policy (`default-src 'self'`,
+     *     `script-src 'self' 'strict-dynamic'`, nonced inline scripts).
+     *   - Subresource integrity for third-party scripts.
+     *   - Trusted Types where the runtime supports it.
+     *
+     * If your XSS posture is uncertain, prefer header-only mode (see
+     * `headerOnly` below) — clients track the token in memory + reply
+     * via the header, never as a cookie.
+     */
+    doubleSubmit?: boolean;
+    /**
+     * **F27 — header-only mode.** When `true` (and `doubleSubmit: true`),
+     * the framework does NOT set a cookie on safe requests. The client
+     * is responsible for fetching a token via an out-of-band channel
+     * (a `GET /api/csrf-token` route the consumer defines, or the same-
+     * response-as-the-page approach) and storing it in memory only.
+     * Header-only mode trades client-side complexity for an
+     * XSS-doesn't-bypass-CSRF property.
+     *
+     * Default `false` (cookie-based double-submit — backwards-compatible).
+     */
+    headerOnly?: boolean;
+    /**
+     * Override the cookie name. Default `"ship_csrf"`.
+     */
+    cookieName?: string;
+    /**
+     * Override the header name clients echo the cookie into. Default
+     * `"x-csrf-token"`.
+     */
+    headerName?: string;
+    /**
+     * Cookie attribute overrides for the double-submit token.
+     */
+    cookie?: {
+        domain?: string;
+        sameSite?: "Strict" | "Lax" | "None";
+        secure?: boolean;
+        maxAge?: number;
+    };
+}
+export declare function csrf(opts: CsrfOptions): MiddlewareHandler;
+//# sourceMappingURL=csrf.d.ts.map

package/lib/http/middleware/csrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/csrf.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAkC9C,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;QACrC,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAyDD,wBAAgB,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,iBAAiB,CA2FzD"}