@sixthsummit/ship-api 0.0.0-stage → 4.1.1

package/lib/http/streaming/streamLLM.js

@@ -0,0 +1,94 @@
+import { logger as defaultLogger } from "../../observability/logger.js";
+import { getFrameworkMeter } from "../../observability/metrics.js";
+import { streamSSE } from "./sse.js";
+/**
+ * Default maximum bytes per SSE event payload (F15). 256 KB is far
+ * above any reasonable single LLM stream chunk (a typical Claude /
+ * GPT token-delta is ~1–200 bytes; a tool-call argument blob is
+ * ~kilobytes) and well below the bandwidth-amplification threshold
+ * that turns one bad upstream event into a DoS surface.
+ *
+ * Per-stream override via `StreamLLMOptions.maxEventBytes`.
+ */
+const DEFAULT_MAX_EVENT_BYTES = 256 * 1024;
+/**
+ * OTel counter incremented every time a streaming event exceeds the
+ * size cap and is dropped. Operators alert on this — a nonzero rate
+ * indicates either a misbehaving provider or an under-sized cap.
+ */
+const droppedOversizedCounter = (() => {
+    const meter = getFrameworkMeter("ship-api.streaming");
+    return meter.createCounter("stream.event.dropped_oversized", {
+        description: "Streaming events skipped by streamLLM/streamSSE because their " +
+            "serialized payload exceeded maxEventBytes. Tag `provider` is " +
+            "the LLM provider id when known, else the event's `type`.",
+    });
+})();
+export function streamLLM(c, events, opts = {}) {
+    const spanName = opts.spanName ?? "llm.stream";
+    const maxEventBytes = opts.maxEventBytes ?? DEFAULT_MAX_EVENT_BYTES;
+    const log = opts.logger ?? defaultLogger;
+    return streamSSE(c, async (stream) => {
+        let index = 0;
+        const iterator = events[Symbol.asyncIterator]();
+        try {
+            while (true) {
+                if (stream.aborted) {
+                    // Client disconnected — give the provider iterator a chance
+                    // to clean up (close upstream HTTP, abort SDK request).
+                    await iterator.return?.();
+                    return;
+                }
+                const next = await iterator.next();
+                if (next.done)
+                    return;
+                await writeEvent(stream, next.value, index, opts.generateEventId, maxEventBytes, opts.provider, log);
+                index++;
+            }
+        }
+        catch (err) {
+            const error = err instanceof Error ? err : new Error(String(err));
+            if (opts.onError) {
+                try {
+                    await opts.onError(error);
+                }
+                catch {
+                    // Swallow — caller-provided hook must not break the close.
+                }
+            }
+            if (!stream.aborted) {
+                await stream.writeSSE({
+                    event: "error",
+                    data: JSON.stringify({ message: error.message }),
+                });
+            }
+            // Best-effort upstream cleanup.
+            await iterator.return?.().catch(() => undefined);
+        }
+    }, { spanName });
+}
+async function writeEvent(stream, event, index, generateEventId, maxEventBytes, provider, log) {
+    const { type, ...payload } = event;
+    const id = generateEventId ? generateEventId(event, index) : String(index);
+    const data = JSON.stringify(payload);
+    const eventBytes = Buffer.byteLength(data, "utf8");
+    if (eventBytes > maxEventBytes) {
+        const providerTag = provider ?? type;
+        const sampleTail = data.slice(Math.max(0, data.length - 256));
+        log.warn({
+            provider: providerTag,
+            eventType: type,
+            eventBytes,
+            maxEventBytes,
+            sampleTail,
+        }, "stream.event.dropped_oversized");
+        droppedOversizedCounter.add(1, { provider: providerTag });
+        return;
+    }
+    await stream.writeSSE({
+        id,
+        event: type,
+        data,
+    });
+}
+//# sourceMappingURL=streamLLM.js.map

package/lib/http/streaming/streamLLM.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"streamLLM.js","sourceRoot":"","sources":["../../../src/http/streaming/streamLLM.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAwB,SAAS,EAAE,MAAM,UAAU,CAAC;AAE3D;;;;;;;;GAQG;AACH,MAAM,uBAAuB,GAAG,GAAG,GAAG,IAAI,CAAC;AAE3C;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE;IACpC,MAAM,KAAK,GAAG,iBAAiB,CAAC,oBAAoB,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC,aAAa,CAAC,gCAAgC,EAAE;QAC3D,WAAW,EACT,gEAAgE;YAChE,+DAA+D;YAC/D,0DAA0D;KAC7D,CAAC,CAAC;AACL,CAAC,CAAC,EAAE,CAAC;AA+FL,MAAM,UAAU,SAAS,CACvB,CAAU,EACV,MAAqC,EACrC,OAAyB,EAAE;IAE3B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC;IAC/C,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,uBAAuB,CAAC;IACpE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC;IAEzC,OAAO,SAAS,CACd,CAAC,EACD,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC;YACH,OAAO,IAAI,EAAE,CAAC;gBACZ,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnB,4DAA4D;oBAC5D,wDAAwD;oBACxD,MAAM,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;oBAC1B,OAAO;gBACT,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnC,IAAI,IAAI,CAAC,IAAI;oBAAE,OAAO;gBACtB,MAAM,UAAU,CACd,MAAM,EACN,IAAI,CAAC,KAAK,EACV,KAAK,EACL,IAAI,CAAC,eAAe,EACpB,aAAa,EACb,IAAI,CAAC,QAAQ,EACb,GAAG,CACJ,CAAC;gBACF,KAAK,EAAE,CAAC;YACV,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAClE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjB,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC5B,CAAC;gBAAC,MAAM,CAAC;oBACP,2DAA2D;gBAC7D,CAAC;YACH,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,MAAM,CAAC,QAAQ,CAAC;oBACpB,KAAK,EAAE,OAAO;oBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;iBACjD,CAAC,CAAC;YACL,CAAC;YACD,gCAAgC;YAChC,MAAM,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACnD,CAAC;IACH,CAAC,EACD,EAAE,QAAQ,EAAE,CACb,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,MAAuB,EACvB,KAAqB,EACrB,KAAa,EACb,eAA+E,EAC/E,aAAqB,EACrB,QAA4B,EAC5B,GAAyB;IAEzB,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC;IACnC,MAAM,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEnD,IAAI,UAAU,GAAG,aAAa,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,QAAQ,IAAI,IAAI,CAAC;QACrC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC;QAC9D,GAAG,CAAC,IAAI,CACN;YACE,QAAQ,EAAE,WAAW;YACrB,SAAS,EAAE,IAAI;YACf,UAAU;YACV,aAAa;YACb,UAAU;SACX,EACD,gCAAgC,CACjC,CAAC;QACF,uBAAuB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IAED,MAAM,MAAM,CAAC,QAAQ,CAAC;QACpB,EAAE;QACF,KAAK,EAAE,IAAI;QACX,IAAI;KACL,CAAC,CAAC;AACL,CAAC"}

package/lib/http/utils/authCookies.d.ts

@@ -0,0 +1,74 @@
+import type { Context } from "hono";
+import type { AuthTokenPair } from "../../app/auth/jwt/AuthFlow.js";
+/**
+ * `authCookies` — set / clear / read the access + refresh cookie pair.
+ *
+ * The framework's locked default for stateless cookie auth:
+ *
+ *   • Two cookies — `ship_access` (the JWT) and `ship_refresh` (the opaque
+ *     refresh token).
+ *   • Both `httpOnly: true`, `secure: true` in production, `sameSite: 'lax'`
+ *     by default — protects top-level navigation CSRF.
+ *   • Refresh cookie scoped to `path: '/auth/refresh'` so it only ships to
+ *     the rotation endpoint. Limits the blast radius if `httpOnly` is ever
+ *     bypassed by a runtime bug or a consumer mis-configuring CORS.
+ *   • `maxAge` mirrors the token's `expiresAt` so browsers drop the cookie
+ *     at the same moment the server stops accepting it.
+ *
+ * Hardened CSRF mode (double-submit) is in `csrf.ts`. This file is purely
+ * about cookie I/O — does not enforce policy.
+ */
+/** Default cookie names. Overridable per-call. */
+export declare const AUTH_COOKIE_NAMES: {
+    readonly access: "ship_access";
+    readonly refresh: "ship_refresh";
+};
+/** Default refresh-cookie path scope. */
+export declare const REFRESH_COOKIE_PATH = "/auth/refresh";
+export interface AuthCookieConfig {
+    /** Override the access-cookie name. Default `"ship_access"`. */
+    accessCookieName?: string;
+    /** Override the refresh-cookie name. Default `"ship_refresh"`. */
+    refreshCookieName?: string;
+    /** Override the refresh-cookie path scope. Default `"/auth/refresh"`. */
+    refreshCookiePath?: string;
+    /**
+     * `secure` flag. Default: `true` in production, `false` otherwise — but
+     * **always set `true`** in any environment that issues real tokens. The
+     * "false in dev" default exists for `localhost` HTTP only.
+     */
+    secure?: boolean;
+    /** `sameSite` attribute. Default `"Lax"`. */
+    sameSite?: "Strict" | "Lax" | "None";
+    /**
+     * Optional cookie `Domain` attribute. Defaults to host-only
+     * (attribute omitted) — the secure default for single-host
+     * deployments. Set to `".your-org.tld"` only when you genuinely
+     * need cookies to span multiple subdomains.
+     *
+     * **Validated against a public-suffix list.** Values that are
+     * themselves a public suffix (`".com"`, `".co.uk"`, `".com.au"`,
+     * etc.) throw at config time — those would leak the cookie to
+     * every site under the suffix and breach tenant isolation. Pass a
+     * registrable domain (`".example.com"`, `".my-org.co.uk"`)
+     * instead.
+     */
+    domain?: string;
+}
+/**
+ * Set both cookies on the response after a successful issue/rotate. The
+ * `expiresAt` values from the `AuthTokenPair` are converted into `maxAge`
+ * (seconds) so the browser drops them in lock-step with the server.
+ */
+export declare function setAuthCookies(c: Context, pair: AuthTokenPair, cfg?: AuthCookieConfig): void;
+/**
+ * Clear both cookies on logout. Sets identical attributes to `setAuthCookies`
+ * so browsers reliably overwrite the existing cookies (browsers match on
+ * name+path+domain, not value).
+ */
+export declare function clearAuthCookies(c: Context, cfg?: AuthCookieConfig): void;
+/** Read the access cookie value. Returns `undefined` if absent. */
+export declare function readAccessCookie(c: Context, cfg?: AuthCookieConfig): string | undefined;
+/** Read the refresh cookie value. Returns `undefined` if absent. */
+export declare function readRefreshCookie(c: Context, cfg?: AuthCookieConfig): string | undefined;
+//# sourceMappingURL=authCookies.d.ts.map

package/lib/http/utils/authCookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authCookies.d.ts","sourceRoot":"","sources":["../../../src/http/utils/authCookies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAGpC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAGpE;;;;;;;;;;;;;;;;;GAiBG;AAEH,kDAAkD;AAClD,eAAO,MAAM,iBAAiB;;;CAGpB,CAAC;AAEX,yCAAyC;AACzC,eAAO,MAAM,mBAAmB,kBAAkB,CAAC;AAEnD,MAAM,WAAW,gBAAgB;IAC/B,gEAAgE;IAChE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACrC;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAyBD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAwB5F;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAYzE;AAED,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAGvF;AAED,oEAAoE;AACpE,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAGxF"}

package/lib/http/utils/authCookies.js

@@ -0,0 +1,102 @@
+import { deleteCookie, getCookie, setCookie } from "hono/cookie";
+import { checkCookieDomainAgainstPublicSuffix } from "./publicSuffix.js";
+/**
+ * `authCookies` — set / clear / read the access + refresh cookie pair.
+ *
+ * The framework's locked default for stateless cookie auth:
+ *
+ *   • Two cookies — `ship_access` (the JWT) and `ship_refresh` (the opaque
+ *     refresh token).
+ *   • Both `httpOnly: true`, `secure: true` in production, `sameSite: 'lax'`
+ *     by default — protects top-level navigation CSRF.
+ *   • Refresh cookie scoped to `path: '/auth/refresh'` so it only ships to
+ *     the rotation endpoint. Limits the blast radius if `httpOnly` is ever
+ *     bypassed by a runtime bug or a consumer mis-configuring CORS.
+ *   • `maxAge` mirrors the token's `expiresAt` so browsers drop the cookie
+ *     at the same moment the server stops accepting it.
+ *
+ * Hardened CSRF mode (double-submit) is in `csrf.ts`. This file is purely
+ * about cookie I/O — does not enforce policy.
+ */
+/** Default cookie names. Overridable per-call. */
+export const AUTH_COOKIE_NAMES = {
+    access: "ship_access",
+    refresh: "ship_refresh",
+};
+/** Default refresh-cookie path scope. */
+export const REFRESH_COOKIE_PATH = "/auth/refresh";
+const DEFAULT_CONFIG = {
+    accessCookieName: AUTH_COOKIE_NAMES.access,
+    refreshCookieName: AUTH_COOKIE_NAMES.refresh,
+    refreshCookiePath: REFRESH_COOKIE_PATH,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "Lax",
+};
+function resolveConfig(cfg) {
+    const domainFailure = checkCookieDomainAgainstPublicSuffix(cfg?.domain);
+    if (domainFailure) {
+        throw new Error(`authCookies: invalid AuthCookieConfig.domain — ${domainFailure}`);
+    }
+    return {
+        ...DEFAULT_CONFIG,
+        ...cfg,
+        secure: cfg?.secure ?? DEFAULT_CONFIG.secure,
+        sameSite: cfg?.sameSite ?? DEFAULT_CONFIG.sameSite,
+    };
+}
+/**
+ * Set both cookies on the response after a successful issue/rotate. The
+ * `expiresAt` values from the `AuthTokenPair` are converted into `maxAge`
+ * (seconds) so the browser drops them in lock-step with the server.
+ */
+export function setAuthCookies(c, pair, cfg) {
+    const config = resolveConfig(cfg);
+    const nowSec = Math.floor(Date.now() / 1000);
+    const accessOpts = {
+        httpOnly: true,
+        secure: config.secure,
+        sameSite: config.sameSite,
+        path: "/",
+        maxAge: Math.max(0, pair.accessTokenExpiresAt - nowSec),
+        ...(config.domain ? { domain: config.domain } : {}),
+    };
+    const refreshOpts = {
+        httpOnly: true,
+        secure: config.secure,
+        sameSite: config.sameSite,
+        path: config.refreshCookiePath,
+        maxAge: Math.max(0, pair.refreshTokenExpiresAt - nowSec),
+        ...(config.domain ? { domain: config.domain } : {}),
+    };
+    setCookie(c, config.accessCookieName, pair.accessToken, accessOpts);
+    setCookie(c, config.refreshCookieName, pair.refreshToken, refreshOpts);
+}
+/**
+ * Clear both cookies on logout. Sets identical attributes to `setAuthCookies`
+ * so browsers reliably overwrite the existing cookies (browsers match on
+ * name+path+domain, not value).
+ */
+export function clearAuthCookies(c, cfg) {
+    const config = resolveConfig(cfg);
+    const baseOpts = {
+        secure: config.secure,
+        sameSite: config.sameSite,
+        ...(config.domain ? { domain: config.domain } : {}),
+    };
+    deleteCookie(c, config.accessCookieName, { ...baseOpts, path: "/" });
+    deleteCookie(c, config.refreshCookieName, {
+        ...baseOpts,
+        path: config.refreshCookiePath,
+    });
+}
+/** Read the access cookie value. Returns `undefined` if absent. */
+export function readAccessCookie(c, cfg) {
+    const config = resolveConfig(cfg);
+    return getCookie(c, config.accessCookieName);
+}
+/** Read the refresh cookie value. Returns `undefined` if absent. */
+export function readRefreshCookie(c, cfg) {
+    const config = resolveConfig(cfg);
+    return getCookie(c, config.refreshCookieName);
+}
+//# sourceMappingURL=authCookies.js.map

package/lib/http/utils/authCookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authCookies.js","sourceRoot":"","sources":["../../../src/http/utils/authCookies.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGjE,OAAO,EAAE,oCAAoC,EAAE,MAAM,mBAAmB,CAAC;AAEzE;;;;;;;;;;;;;;;;;GAiBG;AAEH,kDAAkD;AAClD,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,MAAM,EAAE,aAAa;IACrB,OAAO,EAAE,cAAc;CACf,CAAC;AAEX,yCAAyC;AACzC,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAiCnD,MAAM,cAAc,GAA+C;IACjE,gBAAgB,EAAE,iBAAiB,CAAC,MAAM;IAC1C,iBAAiB,EAAE,iBAAiB,CAAC,OAAO;IAC5C,iBAAiB,EAAE,mBAAmB;IACtC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;IAC7C,QAAQ,EAAE,KAAK;CAChB,CAAC;AAEF,SAAS,aAAa,CACpB,GAAiC;IAEjC,MAAM,aAAa,GAAG,oCAAoC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACxE,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,kDAAkD,aAAa,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO;QACL,GAAG,cAAc;QACjB,GAAG,GAAG;QACN,MAAM,EAAE,GAAG,EAAE,MAAM,IAAI,cAAc,CAAC,MAAM;QAC5C,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,cAAc,CAAC,QAAQ;KACnD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,CAAU,EAAE,IAAmB,EAAE,GAAsB;IACpF,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE7C,MAAM,UAAU,GAAkB;QAChC,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,oBAAoB,GAAG,MAAM,CAAC;QACvD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC;IAEF,MAAM,WAAW,GAAkB;QACjC,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI,EAAE,MAAM,CAAC,iBAAiB;QAC9B,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,qBAAqB,GAAG,MAAM,CAAC;QACxD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC;IAEF,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,gBAAgB,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACpE,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAU,EAAE,GAAsB;IACjE,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAkB;QAC9B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC;IACF,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,gBAAgB,EAAE,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IACrE,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,iBAAiB,EAAE;QACxC,GAAG,QAAQ;QACX,IAAI,EAAE,MAAM,CAAC,iBAAiB;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,gBAAgB,CAAC,CAAU,EAAE,GAAsB;IACjE,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAC/C,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,iBAAiB,CAAC,CAAU,EAAE,GAAsB;IAClE,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAChD,CAAC"}

package/lib/http/utils/clientIp.d.ts

@@ -0,0 +1,85 @@
+/**
+ * `clientIp` — derive the client IP for trust-sensitive decisions.
+ *
+ * The framework default — used by `rateLimit()` and any other middleware
+ * that needs a per-client key — refuses to trust `X-Forwarded-For`
+ * unless the operator declares the upstream proxy ranges via
+ * `trustProxy: string[]` (CIDR list). Without that declaration the
+ * peer IP is used directly, even if XFF is present.
+ *
+ * The algorithm (rightmost-untrusted-IP) is the industry-standard
+ * defense against XFF spoofing:
+ *
+ *   1. If the immediate peer is NOT in any `trustProxy` CIDR, the
+ *      peer's IP wins — XFF is rejected entirely. An attacker
+ *      contacting the server directly cannot inject XFF values that
+ *      look like an internal proxy chain.
+ *
+ *   2. If the peer IS in the trust list, walk XFF right-to-left.
+ *      Each rightmost entry that is also in the trust list is treated
+ *      as a known proxy and skipped. The first entry that is NOT in
+ *      the trust list is the *real* client IP.
+ *
+ *   3. If every XFF entry is in the trust list (i.e., the chain is
+ *      composed entirely of internal proxies), fall back to the
+ *      leftmost XFF entry. This is the rare case where the original
+ *      client is itself inside the trust ring; we still return *some*
+ *      identifier so the rate limiter has a key.
+ *
+ * Compare with the simpler "trust the leftmost XFF entry" pattern —
+ * which is what the framework used before this defense landed and what
+ * most tutorials still show. That pattern lets any anonymous attacker
+ * rotate `X-Forwarded-For: <random>` per request and trivially bypass
+ * per-IP rate limits on login / signup / password-reset endpoints.
+ *
+ * No new package dependency — IPv4 and IPv6 CIDR matching is inline.
+ * IPv4-mapped IPv6 (`::ffff:1.2.3.4`) is normalized to IPv4 before
+ * matching so a trust list of `10.0.0.0/8` covers `::ffff:10.0.0.1`.
+ */
+export interface ParsedCidr {
+    readonly raw: string;
+    readonly ip: bigint;
+    readonly bits: number;
+    readonly v4: boolean;
+}
+/**
+ * Parse a CIDR (e.g. `10.0.0.0/8`, `::1/128`, `2001:db8::/32`) or a
+ * bare IP (treated as `/32` for v4, `/128` for v6). Returns `null`
+ * for malformed input — callers decide whether to throw or skip.
+ */
+export declare function parseCidr(input: string): ParsedCidr | null;
+/**
+ * Parse an IP literal (v4 or v6) into a bigint. Returns `null` for
+ * malformed input. IPv4 occupies the low 32 bits of the resulting
+ * bigint (treated as v4); IPv6 is the full 128 bits.
+ */
+export declare function ipToBigInt(input: string): {
+    ip: bigint;
+    v4: boolean;
+} | null;
+/** Check whether `ip` (literal) is contained by `cidr` (parsed). */
+export declare function isInCidr(ip: string, cidr: ParsedCidr): boolean;
+/** True if `ip` is contained by any CIDR in the parsed trust list. */
+export declare function isTrustedProxy(ip: string, trustList: readonly ParsedCidr[]): boolean;
+/**
+ * Compile a `trustProxy: string[]` config (CIDRs) once at middleware
+ * construction time. Malformed entries are dropped silently — the
+ * caller already had a chance to validate inputs and an
+ * over-broad-but-typo'd list should not bring down request handling.
+ */
+export declare function compileTrustProxy(trustProxy: readonly string[] | undefined): ParsedCidr[];
+export interface ResolveClientIpOpts {
+    /** The immediate peer IP (e.g. Node's `socket.remoteAddress`). */
+    peerIp?: string;
+    /** Raw `X-Forwarded-For` header value as the proxy chain sent it. */
+    xff?: string;
+    /** Compiled trust list. Empty list disables XFF trust entirely. */
+    trustProxy: readonly ParsedCidr[];
+}
+/**
+ * Resolve the client IP from peer + XFF + trust list. Returns
+ * `"unknown"` only when no peer can be determined AND no XFF entry
+ * survives the trust check — both should be rare in practice.
+ */
+export declare function resolveClientIp(opts: ResolveClientIpOpts): string;
+//# sourceMappingURL=clientIp.d.ts.map

package/lib/http/utils/clientIp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientIp.d.ts","sourceRoot":"","sources":["../../../src/http/utils/clientIp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;CACtB;AAKD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CA6B1D;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAe5E;AAkDD,oEAAoE;AACpE,wBAAgB,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAU9D;AAED,sEAAsE;AACtE,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,UAAU,EAAE,GAAG,OAAO,CAKpF;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,UAAU,EAAE,CAQzF;AAED,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,UAAU,EAAE,SAAS,UAAU,EAAE,CAAC;CACnC;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAmCjE"}

package/lib/http/utils/clientIp.js

@@ -0,0 +1,249 @@
+/**
+ * `clientIp` — derive the client IP for trust-sensitive decisions.
+ *
+ * The framework default — used by `rateLimit()` and any other middleware
+ * that needs a per-client key — refuses to trust `X-Forwarded-For`
+ * unless the operator declares the upstream proxy ranges via
+ * `trustProxy: string[]` (CIDR list). Without that declaration the
+ * peer IP is used directly, even if XFF is present.
+ *
+ * The algorithm (rightmost-untrusted-IP) is the industry-standard
+ * defense against XFF spoofing:
+ *
+ *   1. If the immediate peer is NOT in any `trustProxy` CIDR, the
+ *      peer's IP wins — XFF is rejected entirely. An attacker
+ *      contacting the server directly cannot inject XFF values that
+ *      look like an internal proxy chain.
+ *
+ *   2. If the peer IS in the trust list, walk XFF right-to-left.
+ *      Each rightmost entry that is also in the trust list is treated
+ *      as a known proxy and skipped. The first entry that is NOT in
+ *      the trust list is the *real* client IP.
+ *
+ *   3. If every XFF entry is in the trust list (i.e., the chain is
+ *      composed entirely of internal proxies), fall back to the
+ *      leftmost XFF entry. This is the rare case where the original
+ *      client is itself inside the trust ring; we still return *some*
+ *      identifier so the rate limiter has a key.
+ *
+ * Compare with the simpler "trust the leftmost XFF entry" pattern —
+ * which is what the framework used before this defense landed and what
+ * most tutorials still show. That pattern lets any anonymous attacker
+ * rotate `X-Forwarded-For: <random>` per request and trivially bypass
+ * per-IP rate limits on login / signup / password-reset endpoints.
+ *
+ * No new package dependency — IPv4 and IPv6 CIDR matching is inline.
+ * IPv4-mapped IPv6 (`::ffff:1.2.3.4`) is normalized to IPv4 before
+ * matching so a trust list of `10.0.0.0/8` covers `::ffff:10.0.0.1`.
+ */
+const V4_MAX_BITS = 32;
+const V6_MAX_BITS = 128;
+/**
+ * Parse a CIDR (e.g. `10.0.0.0/8`, `::1/128`, `2001:db8::/32`) or a
+ * bare IP (treated as `/32` for v4, `/128` for v6). Returns `null`
+ * for malformed input — callers decide whether to throw or skip.
+ */
+export function parseCidr(input) {
+    if (typeof input !== "string" || input.length === 0)
+        return null;
+    const trimmed = input.trim();
+    if (trimmed.length === 0)
+        return null;
+    const slash = trimmed.lastIndexOf("/");
+    let ipPart;
+    let bitsPart;
+    if (slash === -1) {
+        ipPart = trimmed;
+    }
+    else {
+        ipPart = trimmed.slice(0, slash);
+        bitsPart = trimmed.slice(slash + 1);
+    }
+    const parsed = ipToBigInt(ipPart);
+    if (parsed == null)
+        return null;
+    const maxBits = parsed.v4 ? V4_MAX_BITS : V6_MAX_BITS;
+    let bits;
+    if (bitsPart == null) {
+        bits = maxBits;
+    }
+    else {
+        if (!/^\d{1,3}$/.test(bitsPart))
+            return null;
+        bits = Number.parseInt(bitsPart, 10);
+        if (!Number.isFinite(bits) || bits < 0 || bits > maxBits)
+            return null;
+    }
+    return { raw: trimmed, ip: parsed.ip, bits, v4: parsed.v4 };
+}
+/**
+ * Parse an IP literal (v4 or v6) into a bigint. Returns `null` for
+ * malformed input. IPv4 occupies the low 32 bits of the resulting
+ * bigint (treated as v4); IPv6 is the full 128 bits.
+ */
+export function ipToBigInt(input) {
+    if (typeof input !== "string" || input.length === 0)
+        return null;
+    const ip = input.trim();
+    if (ip.length === 0)
+        return null;
+    // IPv4-mapped IPv6: `::ffff:1.2.3.4`. Strip the prefix and parse the
+    // tail as v4 so trust lists declared in v4 still match.
+    if (/^::ffff:\d{1,3}(\.\d{1,3}){3}$/i.test(ip)) {
+        return parseV4(ip.slice("::ffff:".length));
+    }
+    if (ip.includes(":")) {
+        return parseV6(ip);
+    }
+    return parseV4(ip);
+}
+function parseV4(s) {
+    const parts = s.split(".");
+    if (parts.length !== 4)
+        return null;
+    let acc = 0n;
+    for (const part of parts) {
+        if (!/^\d{1,3}$/.test(part))
+            return null;
+        const n = Number.parseInt(part, 10);
+        if (n < 0 || n > 255)
+            return null;
+        acc = (acc << 8n) | BigInt(n);
+    }
+    return { ip: acc, v4: true };
+}
+function parseV6(s) {
+    // Reject obviously malformed shapes up front.
+    if (s.includes(":::"))
+        return null;
+    // Bracketed addresses (`[::1]`) are stripped in URL parsing; the
+    // caller should pass the inner literal.
+    if (s.startsWith("[") || s.endsWith("]"))
+        return null;
+    // Embedded IPv4 (`::1:2:3:4:5:6:7.8.9.10` etc.) is rare and not
+    // emitted by anything sensible inside XFF; reject for simplicity.
+    if (/\d+\.\d+\.\d+\.\d+/.test(s))
+        return null;
+    const doubleColon = s.indexOf("::");
+    let groups;
+    if (doubleColon === -1) {
+        groups = s.split(":");
+        if (groups.length !== 8)
+            return null;
+    }
+    else {
+        if (s.indexOf("::", doubleColon + 2) !== -1)
+            return null;
+        const left = s.slice(0, doubleColon);
+        const right = s.slice(doubleColon + 2);
+        const leftGroups = left.length === 0 ? [] : left.split(":");
+        const rightGroups = right.length === 0 ? [] : right.split(":");
+        const fill = 8 - (leftGroups.length + rightGroups.length);
+        if (fill < 0)
+            return null;
+        groups = [...leftGroups, ...new Array(fill).fill("0"), ...rightGroups];
+    }
+    let acc = 0n;
+    for (const group of groups) {
+        if (!/^[0-9a-f]{1,4}$/i.test(group))
+            return null;
+        acc = (acc << 16n) | BigInt(Number.parseInt(group, 16));
+    }
+    return { ip: acc, v4: false };
+}
+/** Check whether `ip` (literal) is contained by `cidr` (parsed). */
+export function isInCidr(ip, cidr) {
+    const parsed = ipToBigInt(ip);
+    if (!parsed)
+        return false;
+    // Family must match (after IPv4-mapped IPv6 normalization in
+    // ipToBigInt, both sides agree on v4-vs-v6).
+    if (parsed.v4 !== cidr.v4)
+        return false;
+    const maxBits = cidr.v4 ? V4_MAX_BITS : V6_MAX_BITS;
+    const shift = BigInt(maxBits - cidr.bits);
+    const mask = cidr.bits === 0 ? 0n : ((1n << BigInt(cidr.bits)) - 1n) << shift;
+    return (parsed.ip & mask) === (cidr.ip & mask);
+}
+/** True if `ip` is contained by any CIDR in the parsed trust list. */
+export function isTrustedProxy(ip, trustList) {
+    for (const cidr of trustList) {
+        if (isInCidr(ip, cidr))
+            return true;
+    }
+    return false;
+}
+/**
+ * Compile a `trustProxy: string[]` config (CIDRs) once at middleware
+ * construction time. Malformed entries are dropped silently — the
+ * caller already had a chance to validate inputs and an
+ * over-broad-but-typo'd list should not bring down request handling.
+ */
+export function compileTrustProxy(trustProxy) {
+    if (!trustProxy || trustProxy.length === 0)
+        return [];
+    const out = [];
+    for (const entry of trustProxy) {
+        const parsed = parseCidr(entry);
+        if (parsed)
+            out.push(parsed);
+    }
+    return out;
+}
+/**
+ * Resolve the client IP from peer + XFF + trust list. Returns
+ * `"unknown"` only when no peer can be determined AND no XFF entry
+ * survives the trust check — both should be rare in practice.
+ */
+export function resolveClientIp(opts) {
+    const { peerIp, xff, trustProxy } = opts;
+    // No trust list → no XFF trust. Peer wins (or "unknown" if absent).
+    if (trustProxy.length === 0) {
+        return normalizeIp(peerIp) ?? "unknown";
+    }
+    // Peer must be in the trust list for XFF to be honored. An untrusted
+    // peer cannot inject hops by setting its own XFF header.
+    const normalizedPeer = normalizeIp(peerIp);
+    if (!normalizedPeer || !isTrustedProxy(normalizedPeer, trustProxy)) {
+        return normalizedPeer ?? "unknown";
+    }
+    // Walk XFF right-to-left, skipping trusted hops, returning the
+    // first untrusted hop (the real client). If every hop is trusted,
+    // fall back to the leftmost entry.
+    if (xff) {
+        const hops = xff
+            .split(",")
+            .map((s) => normalizeIp(s.trim()))
+            .filter((s) => Boolean(s));
+        for (let i = hops.length - 1; i >= 0; i--) {
+            const hop = hops[i];
+            if (!isTrustedProxy(hop, trustProxy)) {
+                return hop;
+            }
+        }
+        if (hops.length > 0)
+            return hops[0];
+    }
+    // No XFF (or empty after parsing) → trusted-peer is the best we have.
+    return normalizedPeer;
+}
+/** Strip brackets and whitespace; reject obviously-malformed values. */
+function normalizeIp(raw) {
+    if (raw == null)
+        return undefined;
+    const trimmed = raw.trim();
+    if (trimmed.length === 0)
+        return undefined;
+    // Strip `[::1]` brackets if present.
+    const inner = trimmed.startsWith("[") && trimmed.endsWith("]") ? trimmed.slice(1, -1) : trimmed;
+    // Strip ::ffff: IPv4-mapped prefix for consistency with ipToBigInt.
+    if (/^::ffff:\d{1,3}(\.\d{1,3}){3}$/i.test(inner)) {
+        return inner.slice("::ffff:".length);
+    }
+    // Validate it actually parses; otherwise it's garbage from a buggy
+    // proxy and we should not treat it as an IP.
+    if (ipToBigInt(inner) == null)
+        return undefined;
+    return inner;
+}
+//# sourceMappingURL=clientIp.js.map

package/lib/http/utils/clientIp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientIp.js","sourceRoot":"","sources":["../../../src/http/utils/clientIp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AASH,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,MAAc,CAAC;IACnB,IAAI,QAA4B,CAAC;IACjC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,MAAM,GAAG,OAAO,CAAC;IACnB,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACjC,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,MAAM,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAEhC,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC;IACtD,IAAI,IAAY,CAAC;IACjB,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,GAAG,OAAO,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,OAAO;YAAE,OAAO,IAAI,CAAC;IACxE,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjC,qEAAqE;IACrE,wDAAwD;IACxD,IAAI,iCAAiC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/C,OAAO,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACzC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;QAClC,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,8CAA8C;IAC9C,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,iEAAiE;IACjE,wCAAwC;IACxC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtD,gEAAgE;IAChE,kEAAkE;IAClE,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,MAAM,WAAW,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,MAAgB,CAAC;IACrB,IAAI,WAAW,KAAK,CAAC,CAAC,EAAE,CAAC;QACvB,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IACvC,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACzD,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5D,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,IAAI,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,GAAG,CAAC,GAAG,UAAU,EAAE,GAAG,IAAI,KAAK,CAAS,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACjD,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;AAChC,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,QAAQ,CAAC,EAAU,EAAE,IAAgB;IACnD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,6DAA6D;IAC7D,6CAA6C;IAC7C,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC;IAC9E,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;AACjD,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,cAAc,CAAC,EAAU,EAAE,SAAgC;IACzE,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAyC;IACzE,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACtD,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAyB;IACvD,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAEzC,oEAAoE;IACpE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,WAAW,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;IAC1C,CAAC;IAED,qEAAqE;IACrE,yDAAyD;IACzD,MAAM,cAAc,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,cAAc,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,UAAU,CAAC,EAAE,CAAC;QACnE,OAAO,cAAc,IAAI,SAAS,CAAC;IACrC,CAAC;IAED,+DAA+D;IAC/D,kEAAkE;IAClE,mCAAmC;IACnC,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,IAAI,GAAG,GAAG;aACb,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;aACjC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAE1C,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;YACrB,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC;gBACrC,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,CAAE,CAAC;IACvC,CAAC;IAED,sEAAsE;IACtE,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,wEAAwE;AACxE,SAAS,WAAW,CAAC,GAAuB;IAC1C,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,qCAAqC;IACrC,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAChG,oEAAoE;IACpE,IAAI,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,mEAAmE;IACnE,6CAA6C;IAC7C,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IAChD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/lib/http/utils/index.d.ts

@@ -0,0 +1,4 @@
+export { parseUpload } from "./uploads.js";
+export { validate } from "./validate.js";
+export { parseWebhook } from "./webhooks.js";
+//# sourceMappingURL=index.d.ts.map

package/lib/http/utils/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/http/utils/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC"}

package/lib/http/utils/index.js

@@ -0,0 +1,5 @@
+// Export utility helpers
+export { parseUpload } from "./uploads.js";
+export { validate } from "./validate.js";
+export { parseWebhook } from "./webhooks.js";
+//# sourceMappingURL=index.js.map

package/lib/http/utils/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/http/utils/index.ts"],"names":[],"mappings":"AAAA,yBAAyB;AAEzB,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC"}