@sleepy-hollow/framework 0.3.0

package/dist/chunk-DGTHFZPZ.js

@@ -0,0 +1,830 @@
+import {
+  createValidatedRouter
+} from "./chunk-CAPFDC25.js";
+import {
+  platform
+} from "./chunk-53TZY5YP.js";
+
+// core/security/declaration.ts
+import { isAbsolute, resolve, sep } from "path";
+import { pathToFileURL } from "url";
+
+// core/security/redact.ts
+var SECRET_FIELD = /^(authorization|proxyauthorization|cookie|setcookie|.*token.*|.*secret.*|.*password.*|.*session.*|.*apikey.*|.*credential.*)$/i;
+function normalizedField(value) {
+  return String(value).replace(/[^a-z0-9]/gi, "");
+}
+function redactSecurityData(value) {
+  const active = /* @__PURE__ */ new WeakSet();
+  function visit(current, depth) {
+    if (current === null || typeof current !== "object") return current;
+    if (depth > 12) return "[Truncated]";
+    if (current instanceof Request) {
+      const url = new URL(current.url);
+      return { kind: "Request", method: current.method, path: url.pathname };
+    }
+    if (current instanceof Headers) return "[REDACTED_HEADERS]";
+    if (current instanceof Response) {
+      return { kind: "Response", status: current.status };
+    }
+    if (current instanceof Error) return { name: current.name };
+    if (current instanceof Date) return current.toISOString();
+    if (active.has(current)) return "[Circular]";
+    active.add(current);
+    let result;
+    if (Array.isArray(current)) {
+      result = current.map((item) => visit(item, depth + 1));
+    } else {
+      const object = {};
+      for (const [key, item] of Object.entries(current)) {
+        object[key] = SECRET_FIELD.test(normalizedField(key)) ? "[REDACTED]" : visit(item, depth + 1);
+      }
+      result = object;
+    }
+    active.delete(current);
+    return result;
+  }
+  return visit(value, 0);
+}
+
+// core/security/types.ts
+var SecurityConfigurationError = class extends Error {
+  /**
+   * Builds an error whose message lists every diagnostic, one per line.
+   *
+   * @param diagnostics Every fault found, in the order detected.
+   */
+  constructor(diagnostics) {
+    super(
+      diagnostics.map(
+        (diagnostic2) => `${diagnostic2.code}: ${diagnostic2.summary}`
+      ).join("\n")
+    );
+    this.diagnostics = diagnostics;
+    this.name = "SecurityConfigurationError";
+  }
+  diagnostics;
+};
+
+// core/security/normalize.ts
+function routeName(route) {
+  return `${route.method} ${route.path}`;
+}
+function diagnostic(code, summary, correction, route, policy) {
+  return {
+    code,
+    severity: "error",
+    summary,
+    ...route ? { route: routeName(route), source: route.source } : {},
+    ...policy ? { policy } : {},
+    correction
+  };
+}
+function nonempty(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
+function hasResponse(route, status) {
+  const schemas = route.operation.schemas;
+  return Boolean(
+    schemas?.responses && Object.hasOwn(schemas.responses, status)
+  );
+}
+function validOrigin(origin) {
+  try {
+    const url = new URL(origin);
+    return (url.protocol === "https:" || url.protocol === "http:") && url.origin === origin && url.pathname === "/" && !url.search && !url.hash;
+  } catch {
+    return false;
+  }
+}
+function validHeaderValue(value) {
+  try {
+    new Headers({ "www-authenticate": value });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function normalizeCors(options, diagnostics) {
+  const raw = options.cors;
+  if (!options.cors) {
+    if (options.mode === "production") {
+      diagnostics.push(diagnostic(
+        "SH_CORS_REQUIRED",
+        "Production requires an explicit CORS decision",
+        "Set cors to { mode: 'deny' } or an explicit allow configuration."
+      ));
+    }
+    return { mode: "deny" };
+  }
+  if (!raw || typeof raw !== "object") {
+    diagnostics.push(diagnostic(
+      "SH_CORS_CONFIGURATION_INVALID",
+      "CORS configuration is malformed",
+      "Declare mode 'deny' or a complete allow configuration."
+    ));
+    return { mode: "deny" };
+  }
+  const rawCors = raw;
+  if (rawCors.mode === "deny") return { mode: "deny" };
+  if (rawCors.mode !== "allow" || !(rawCors.origins === "*" || Array.isArray(rawCors.origins)) || !Array.isArray(rawCors.methods) || !Array.isArray(rawCors.headers) || typeof rawCors.credentials !== "boolean") {
+    diagnostics.push(diagnostic(
+      "SH_CORS_CONFIGURATION_INVALID",
+      "CORS allow configuration is incomplete or malformed",
+      "Declare origins, methods, headers, and a credentials decision."
+    ));
+    return { mode: "deny" };
+  }
+  const cors = options.cors;
+  if (cors.origins === "*" && cors.credentials) {
+    diagnostics.push(diagnostic(
+      "SH_CORS_WILDCARD_CREDENTIALS",
+      "Credentialed CORS cannot use the wildcard origin",
+      "List exact origins or disable credentials."
+    ));
+  }
+  if (Array.isArray(cors.origins) && (cors.origins.length === 0 || cors.origins.some((origin) => !validOrigin(origin)))) {
+    diagnostics.push(diagnostic(
+      "SH_CORS_ORIGIN_INVALID",
+      "CORS origins must be non-empty exact HTTP origins",
+      "Use origins such as https://app.example without paths, queries, or fragments."
+    ));
+  }
+  if (cors.methods.length === 0 || cors.methods.some(
+    (method) => !/^(DELETE|GET|HEAD|OPTIONS|PATCH|POST|PUT)$/.test(method)
+  )) {
+    diagnostics.push(diagnostic(
+      "SH_CORS_METHOD_INVALID",
+      "CORS methods must be explicit supported uppercase HTTP methods",
+      "Declare at least one supported uppercase method."
+    ));
+  }
+  if (cors.headers.some((header) => !/^[!#$%&'*+.^_`|~0-9a-z-]+$/i.test(header))) {
+    diagnostics.push(diagnostic(
+      "SH_CORS_HEADER_INVALID",
+      "CORS headers must contain valid HTTP field names",
+      "Declare only valid header field names."
+    ));
+  }
+  return cors;
+}
+function validatePolicy(route, name, policy, options, diagnostics) {
+  if (!policy) {
+    diagnostics.push(diagnostic(
+      "SH_SECURITY_RATE_LIMIT_REQUIRED",
+      `Route references missing rate-limit policy '${name}'`,
+      "Register the named policy before starting the router.",
+      route,
+      name
+    ));
+    return;
+  }
+  if (!Number.isSafeInteger(policy.limit) || policy.limit <= 0 || !Number.isSafeInteger(policy.windowMs) || policy.windowMs <= 0 || typeof policy.key !== "function" || typeof policy.limiter?.consume !== "function" || !["process", "shared"].includes(policy.limiter?.scope)) {
+    diagnostics.push(diagnostic(
+      "SH_SECURITY_RATE_LIMIT_INVALID",
+      `Rate-limit policy '${name}' is malformed`,
+      "Provide positive integer limits, a key function, and a declared limiter scope.",
+      route,
+      name
+    ));
+  } else if (options.mode === "production" && policy.limiter.scope === "process") {
+    diagnostics.push(diagnostic(
+      "SH_SECURITY_RATE_LIMIT_PROCESS_SCOPE",
+      `Production route uses process-scoped rate-limit policy '${name}'`,
+      "Inject a shared-scope production limiter.",
+      route,
+      name
+    ));
+  }
+}
+function prepareSecurity(routes, options) {
+  const diagnostics = [];
+  if (!["development", "production", "test"].includes(options.mode)) {
+    diagnostics.push(diagnostic(
+      "SH_SECURITY_MODE_INVALID",
+      "Security mode must be explicit",
+      "Set mode to development, test, or production."
+    ));
+  }
+  const cors = normalizeCors(options, diagnostics);
+  const prepared = [];
+  for (const route of routes) {
+    const security = route.operation.security;
+    const authentication = security?.authentication;
+    if (!authentication || !["none", "required"].includes(authentication.mode)) {
+      diagnostics.push(diagnostic(
+        "SH_SECURITY_AUTHENTICATION_REQUIRED",
+        "Route must declare exactly one authentication mode",
+        "Declare authentication mode 'none' or 'required'.",
+        route
+      ));
+      continue;
+    }
+    if (authentication.mode === "required") {
+      const provider = options.providers?.[authentication.provider];
+      if (!nonempty(authentication.provider) || !nonempty(authentication.requirementId) || !provider || !nonempty(provider.challenge) || !validHeaderValue(provider.challenge) || typeof provider.authenticate !== "function") {
+        diagnostics.push(diagnostic(
+          "SH_SECURITY_PROVIDER_REQUIRED",
+          `Route requires unresolved provider '${authentication.provider}'`,
+          "Register a well-formed named provider and requirement ID.",
+          route
+        ));
+      }
+      if (!hasResponse(route, 401)) {
+        diagnostics.push(diagnostic(
+          "SH_SECURITY_RESPONSE_REQUIRED",
+          "Required-authentication route lacks a 401 response schema",
+          "Declare schemas.responses[401].",
+          route
+        ));
+      }
+    }
+    if (security.authorization) {
+      if (authentication.mode !== "required" || !nonempty(security.authorization.name) || !nonempty(security.authorization.requirementId) || typeof security.authorization.guard !== "function") {
+        diagnostics.push(diagnostic(
+          "SH_SECURITY_GUARD_INVALID",
+          "Authorization requires a named guard, requirement ID, and required authentication",
+          "Attach a well-formed guard only to a required-authentication route.",
+          route
+        ));
+      }
+      if (!hasResponse(route, 403)) {
+        diagnostics.push(diagnostic(
+          "SH_SECURITY_RESPONSE_REQUIRED",
+          "Authorization route lacks a 403 response schema",
+          "Declare schemas.responses[403].",
+          route
+        ));
+      }
+    }
+    if (security.rateLimit) {
+      if (!hasResponse(route, 429) || !hasResponse(route, 503)) {
+        diagnostics.push(diagnostic(
+          "SH_SECURITY_RESPONSE_REQUIRED",
+          "Rate-limited route lacks 429 or 503 response schemas",
+          "Declare schemas.responses[429] and schemas.responses[503].",
+          route,
+          security.rateLimit
+        ));
+      }
+      validatePolicy(
+        route,
+        security.rateLimit,
+        options.rateLimits?.[security.rateLimit],
+        options,
+        diagnostics
+      );
+    }
+    prepared.push({
+      source: route,
+      security,
+      metadata: {
+        method: route.method,
+        path: route.path,
+        source: route.source,
+        authentication: authentication.mode,
+        ...authentication.mode === "required" ? {
+          provider: authentication.provider,
+          authenticationRequirementId: authentication.requirementId
+        } : {},
+        ...security.authorization ? {
+          authorizationGuard: security.authorization.name,
+          authorizationRequirementId: security.authorization.requirementId
+        } : {},
+        ...security.rateLimit ? { rateLimitPolicy: security.rateLimit } : {},
+        corsMode: cors.mode,
+        secureHeaders: true,
+        requestId: true,
+        bodyLimits: "SH-F003",
+        boundedData: "SH-F004"
+      }
+    });
+  }
+  if (diagnostics.length > 0) {
+    for (const item of diagnostics) {
+      options.onDiagnostic?.({
+        ...item,
+        context: redactSecurityData(item.context)
+      });
+    }
+    throw new SecurityConfigurationError(diagnostics);
+  }
+  return { routes: prepared, cors };
+}
+
+// core/security/security_router.ts
+var REQUEST_ID = /^[A-Za-z0-9._:-]{1,128}$/;
+var RATE_KEY = /^[A-Za-z0-9._:-]{1,256}$/;
+function problem(request, status, title, slug, headers = {}) {
+  return Response.json({
+    type: `https://sleepyhollow.dev/problems/${slug}`,
+    title,
+    status,
+    instance: new URL(request.url).pathname
+  }, {
+    status,
+    headers: {
+      "content-type": "application/problem+json",
+      ...headers
+    }
+  });
+}
+function emit(options, route, code, summary, correction, context, policy) {
+  const diagnostic2 = {
+    code,
+    severity: "error",
+    summary,
+    route: `${route.method} ${route.path}`,
+    source: route.source,
+    ...policy ? { policy } : {},
+    correction,
+    ...context === void 0 ? {} : { context: redactSecurityData(context) }
+  };
+  options.onDiagnostic?.(diagnostic2);
+}
+function validPrincipal(value) {
+  if (!value || typeof value !== "object") return false;
+  const principal = value;
+  if (typeof principal.id !== "string" || !principal.id.trim() || typeof principal.type !== "string" || !principal.type.trim()) return false;
+  if (principal.claims === void 0) return true;
+  if (principal.claims === null || typeof principal.claims !== "object" || Array.isArray(principal.claims)) return false;
+  const prototype = Object.getPrototypeOf(principal.claims);
+  return prototype === Object.prototype || prototype === null;
+}
+function validDecision(value) {
+  if (!value || typeof value !== "object") return false;
+  const decision = value;
+  return typeof decision.allowed === "boolean" && Number.isSafeInteger(decision.remaining) && Number(decision.remaining) >= 0 && typeof decision.resetAt === "number" && Number.isFinite(decision.resetAt);
+}
+function rawCredential(request, key) {
+  for (const [name, value] of request.headers) {
+    const normalized = name.replace(/[^a-z0-9]/gi, "");
+    if (/(authorization|cookie|token|secret|password|session|apikey|credential)/i.test(normalized) && value === key) return true;
+  }
+  return false;
+}
+async function enforceRateLimit(request, route, name, policy, options) {
+  try {
+    const key = await policy.key(request);
+    if (!RATE_KEY.test(key) || rawCredential(request, key)) {
+      throw new Error("invalid rate-limit key");
+    }
+    const decision = await policy.limiter.consume({
+      policy: name,
+      key,
+      limit: policy.limit,
+      windowMs: policy.windowMs
+    });
+    if (!validDecision(decision)) throw new Error("invalid limiter decision");
+    if (decision.allowed) return void 0;
+    const retryAfter = Math.max(
+      1,
+      Math.ceil((decision.resetAt - Date.now()) / 1e3)
+    );
+    return problem(request, 429, "Too Many Requests", "rate-limit", {
+      "cache-control": "no-store",
+      "retry-after": String(retryAfter)
+    });
+  } catch (error) {
+    emit(
+      options,
+      route,
+      "SH_RATE_LIMIT_FAILED",
+      "Rate-limit enforcement failed closed",
+      "Inspect the protected limiter diagnostic and restore the policy adapter.",
+      { error, request },
+      name
+    );
+    return problem(
+      request,
+      503,
+      "Service Unavailable",
+      "rate-limit-unavailable",
+      { "cache-control": "no-store" }
+    );
+  }
+}
+async function securedHandler(context, route, security, options) {
+  if (security.rateLimit) {
+    const limited = await enforceRateLimit(
+      context.request,
+      route,
+      security.rateLimit,
+      options.rateLimits[security.rateLimit],
+      options
+    );
+    if (limited) return limited;
+  }
+  let principal = null;
+  if (security.authentication.mode === "required") {
+    const provider = options.providers[security.authentication.provider];
+    try {
+      principal = await provider.authenticate(context.request);
+    } catch (error) {
+      emit(
+        options,
+        route,
+        "SH_AUTH_PROVIDER_FAILED",
+        "Authentication provider execution failed",
+        "Inspect the protected provider diagnostic and repair the adapter.",
+        { error, request: context.request }
+      );
+      throw error;
+    }
+    if (principal === null) {
+      return problem(context.request, 401, "Unauthorized", "unauthorized", {
+        "cache-control": "no-store",
+        "www-authenticate": provider.challenge
+      });
+    }
+    if (!validPrincipal(principal)) {
+      emit(
+        options,
+        route,
+        "SH_AUTH_PROVIDER_INVALID",
+        "Authentication provider returned a malformed principal",
+        "Return a principal with non-empty id and type fields.",
+        { principal }
+      );
+      throw new Error("SH_AUTH_PROVIDER_INVALID");
+    }
+  }
+  if (security.authorization) {
+    try {
+      const allowed = await security.authorization.guard({
+        principal,
+        request: context.request,
+        params: context.params
+      });
+      if (!allowed) {
+        return problem(context.request, 403, "Forbidden", "forbidden", {
+          "cache-control": "no-store"
+        });
+      }
+    } catch (error) {
+      emit(
+        options,
+        route,
+        "SH_AUTHORIZATION_FAILED",
+        "Authorization guard execution failed",
+        "Inspect the protected guard diagnostic and repair the guard.",
+        { error, request: context.request }
+      );
+      throw error;
+    }
+  }
+  const handler = route.operation.handler;
+  return await handler({
+    ...context,
+    principal,
+    requestId: context.request.headers.get("x-request-id")
+  });
+}
+function pathMatches(routePath, requestPath) {
+  let requestSegments;
+  try {
+    requestSegments = requestPath.split("/").filter(Boolean).map(
+      decodeURIComponent
+    );
+  } catch {
+    return false;
+  }
+  const routeSegments = routePath.split("/").filter(Boolean);
+  return routeSegments.length === requestSegments.length && routeSegments.every(
+    (segment, index) => segment.startsWith(":") || segment === requestSegments[index]
+  );
+}
+function allowedOrigin(cors, origin) {
+  return cors.mode === "allow" && (cors.origins === "*" || cors.origins.includes(origin));
+}
+function appendVary(headers, value) {
+  const current = headers.get("vary");
+  const values = current?.split(",").map((item) => item.trim()) ?? [];
+  if (!values.some((item) => item.toLowerCase() === value.toLowerCase())) {
+    headers.set("vary", [...values, value].filter(Boolean).join(", "));
+  }
+}
+function corsHeaders(headers, request, cors, preflight) {
+  if (cors.mode !== "allow") return;
+  const origin = request.headers.get("origin");
+  if (!origin || !allowedOrigin(cors, origin)) return;
+  headers.set(
+    "access-control-allow-origin",
+    cors.origins === "*" ? "*" : origin
+  );
+  if (cors.origins !== "*") appendVary(headers, "Origin");
+  if (cors.credentials) headers.set("access-control-allow-credentials", "true");
+  if (preflight) {
+    headers.set("access-control-allow-methods", cors.methods.join(", "));
+    if (cors.headers.length > 0) {
+      headers.set("access-control-allow-headers", cors.headers.join(", "));
+    }
+  }
+}
+function knownPreflight(request, routes, cors) {
+  if (cors.mode !== "allow" || request.method !== "OPTIONS") return false;
+  const origin = request.headers.get("origin");
+  const method = request.headers.get("access-control-request-method")?.toUpperCase();
+  if (!origin || !method || !allowedOrigin(cors, origin) || !cors.methods.includes(method)) return false;
+  const requestedHeaders = request.headers.get("access-control-request-headers")?.split(",").map((header) => header.trim().toLowerCase()).filter(Boolean) ?? [];
+  const allowedHeaders = new Set(
+    cors.headers.map((header) => header.toLowerCase())
+  );
+  if (requestedHeaders.some((header) => !allowedHeaders.has(header))) {
+    return false;
+  }
+  const path = new URL(request.url).pathname;
+  return routes.some(
+    (route) => route.method === method && pathMatches(route.path, path)
+  );
+}
+function isPreflight(request) {
+  return request.method === "OPTIONS" && request.headers.has("origin") && request.headers.has("access-control-request-method");
+}
+function requestWithId(request, options) {
+  const inbound = request.headers.get("x-request-id");
+  let requestId = inbound && REQUEST_ID.test(inbound) ? inbound : void 0;
+  if (!requestId && options.requestId) {
+    try {
+      requestId = options.requestId();
+    } catch {
+      requestId = void 0;
+    }
+  }
+  if (!requestId || !REQUEST_ID.test(requestId)) {
+    requestId = crypto.randomUUID();
+  }
+  const headers = new Headers(request.headers);
+  headers.set("x-request-id", requestId);
+  return { request: new Request(request, { headers }), requestId };
+}
+function hardenedResponse(response, request, requestId, cors, preflight = false) {
+  const headers = new Headers(response.headers);
+  headers.set("x-content-type-options", "nosniff");
+  headers.set("referrer-policy", "no-referrer");
+  headers.set(
+    "content-security-policy",
+    "default-src 'none'; frame-ancestors 'none'"
+  );
+  headers.set("x-request-id", requestId);
+  corsHeaders(headers, request, cors, preflight);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+function createSecurityRouter(routes, options) {
+  const prepared = prepareSecurity(routes, options);
+  const wrapped = prepared.routes.map((item) => ({
+    ...item.source,
+    operation: {
+      ...item.source.operation,
+      handler: (context) => securedHandler(context, item.source, item.security, options)
+    }
+  }));
+  const validated = createValidatedRouter(wrapped, {
+    mode: options.mode,
+    onDiagnostic: options.onDiagnostic
+  });
+  return {
+    routes: prepared.routes.map((route) => route.metadata),
+    async fetch(originalRequest) {
+      const selected = requestWithId(originalRequest, options);
+      const preflight = isPreflight(selected.request);
+      if (preflight && knownPreflight(selected.request, routes, prepared.cors)) {
+        return hardenedResponse(
+          new Response(null, { status: 204 }),
+          selected.request,
+          selected.requestId,
+          prepared.cors,
+          true
+        );
+      }
+      const response = await validated.fetch(selected.request);
+      return hardenedResponse(
+        response,
+        selected.request,
+        selected.requestId,
+        preflight ? { mode: "deny" } : prepared.cors
+      );
+    }
+  };
+}
+
+// core/security/declaration.ts
+function failure(code, summary, correction, source) {
+  const diagnostic2 = {
+    code,
+    severity: "error",
+    summary,
+    ...source ? { source } : {},
+    correction
+  };
+  return new SecurityConfigurationError([diagnostic2]);
+}
+function record(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function defineSecurity(declaration) {
+  if (!record(declaration)) {
+    throw failure(
+      "SH_SECURITY_DECLARATION_INVALID",
+      "A security declaration must be one object",
+      "Pass one object of providers, rate limits, and CORS to defineSecurity."
+    );
+  }
+  for (const key of ["providers", "rateLimits"]) {
+    const value = declaration[key];
+    if (value !== void 0) Object.freeze(value);
+  }
+  return Object.freeze(declaration);
+}
+function validate(declaration, source) {
+  if (!record(declaration)) {
+    throw failure(
+      "SH_SECURITY_DECLARATION_INVALID",
+      `The security module ${source} has no default declaration object`,
+      "Default-export the result of defineSecurity.",
+      source
+    );
+  }
+  const providers = declaration.providers;
+  if (providers !== void 0) {
+    if (!record(providers)) {
+      throw failure(
+        "SH_SECURITY_DECLARATION_INVALID",
+        `The security module ${source} declares malformed providers`,
+        "Declare providers as a record of named authentication providers.",
+        source
+      );
+    }
+    for (const [name, provider] of Object.entries(providers)) {
+      if (!record(provider) || typeof provider.challenge !== "string" || typeof provider.authenticate !== "function") {
+        throw failure(
+          "SH_SECURITY_DECLARATION_INVALID",
+          `Provider '${name}' in ${source} is not a well-formed provider`,
+          "Declare a string challenge and an authenticate function.",
+          source
+        );
+      }
+    }
+  }
+  const rateLimits = declaration.rateLimits;
+  if (rateLimits !== void 0 && !record(rateLimits)) {
+    throw failure(
+      "SH_SECURITY_DECLARATION_INVALID",
+      `The security module ${source} declares malformed rate limits`,
+      "Declare rateLimits as a record of named policies.",
+      source
+    );
+  }
+  const cors = declaration.cors;
+  if (cors !== void 0 && !record(cors)) {
+    throw failure(
+      "SH_SECURITY_DECLARATION_INVALID",
+      `The security module ${source} declares malformed CORS`,
+      "Declare cors as one explicit deny or allow decision.",
+      source
+    );
+  }
+  return declaration;
+}
+async function declared(options) {
+  const named = options.securityModule;
+  if (named === void 0) return {};
+  if (typeof named !== "string" || named.trim() === "" || isAbsolute(named)) {
+    throw failure(
+      "SH_SECURITY_MODULE_INVALID",
+      "The declared security module is not a safe project-relative path",
+      "Name one project-contained module in securityModule.",
+      typeof named === "string" ? named : void 0
+    );
+  }
+  const root = resolve(options.root);
+  const target = resolve(root, named);
+  if (target !== root && !target.startsWith(root + sep)) {
+    throw failure(
+      "SH_SECURITY_MODULE_ESCAPE",
+      `The declared security module ${named} resolves outside the project`,
+      "Keep the security module inside the project.",
+      named
+    );
+  }
+  if (options.load === void 0) {
+    let real;
+    try {
+      real = await platform.realPath(target);
+    } catch {
+      throw failure(
+        "SH_SECURITY_MODULE_UNRESOLVED",
+        `The declared security module ${named} could not be resolved`,
+        "Create the named module or correct securityModule.",
+        named
+      );
+    }
+    const realRoot = await platform.realPath(root).catch(() => root);
+    if (real !== realRoot && !real.startsWith(realRoot + sep)) {
+      throw failure(
+        "SH_SECURITY_MODULE_ESCAPE",
+        `The declared security module ${named} resolves outside the project through a symlink`,
+        "Keep the security module and anything it links to inside the project.",
+        named
+      );
+    }
+  }
+  const specifier = pathToFileURL(target).href;
+  let loaded;
+  try {
+    loaded = await (options.load ? options.load(specifier) : import(specifier));
+  } catch (error) {
+    const failedToLoad = options.load === void 0;
+    throw failure(
+      failedToLoad ? "SH_SECURITY_MODULE_FAILED" : "SH_SECURITY_MODULE_UNRESOLVED",
+      failedToLoad ? `The declared security module ${named} threw ${error instanceof Error ? error.name : "an error"} while loading` : `The declared security module ${named} could not be resolved`,
+      failedToLoad ? "Repair the security module so it loads without throwing." : "Create the named module or correct securityModule.",
+      named
+    );
+  }
+  const value = record(loaded) && "default" in loaded ? loaded.default : void 0;
+  if (value === void 0) {
+    throw failure(
+      "SH_SECURITY_DECLARATION_INVALID",
+      `The security module ${named} has no default export`,
+      "Default-export the result of defineSecurity.",
+      named
+    );
+  }
+  return validate(value, named);
+}
+async function composeProjectSecurity(routes, options) {
+  const declaration = await declared(options);
+  return createSecurityRouter(routes, {
+    mode: options.mode,
+    ...declaration.providers ? { providers: declaration.providers } : {},
+    ...declaration.rateLimits ? { rateLimits: declaration.rateLimits } : {},
+    ...declaration.cors ? { cors: declaration.cors } : {},
+    ...options.onDiagnostic ? { onDiagnostic: options.onDiagnostic } : {},
+    ...options.requestId ? { requestId: options.requestId } : {}
+  });
+}
+
+// core/security/rate_limit.ts
+var RATE_KEY2 = /^[A-Za-z0-9._:-]{1,256}$/;
+function createMemoryRateLimiter(options) {
+  if (!Number.isSafeInteger(options.maxKeys) || options.maxKeys <= 0) {
+    throw new TypeError("maxKeys must be a positive integer");
+  }
+  const clock = options.clock ?? Date.now;
+  const windows = /* @__PURE__ */ new Map();
+  function validate2(input) {
+    if (!input.policy || !RATE_KEY2.test(input.key)) {
+      throw new TypeError("policy and a valid bounded key are required");
+    }
+    if (!Number.isSafeInteger(input.limit) || input.limit <= 0) {
+      throw new TypeError("limit must be a positive integer");
+    }
+    if (!Number.isSafeInteger(input.windowMs) || input.windowMs <= 0) {
+      throw new TypeError("windowMs must be a positive integer");
+    }
+  }
+  return {
+    scope: "process",
+    async consume(input) {
+      await Promise.resolve();
+      validate2(input);
+      const now = clock();
+      if (!Number.isFinite(now)) {
+        throw new TypeError("clock must return a finite value");
+      }
+      for (const [key, window2] of windows) {
+        if (window2.resetAt <= now) windows.delete(key);
+      }
+      const storageKey = `${input.policy}\0${input.key}`;
+      let window = windows.get(storageKey);
+      if (!window) {
+        if (windows.size >= options.maxKeys) {
+          throw new Error("SH_RATE_LIMIT_CAPACITY_EXHAUSTED");
+        }
+        window = { count: 0, resetAt: now + input.windowMs };
+        windows.set(storageKey, window);
+      }
+      window.count += 1;
+      return {
+        allowed: window.count <= input.limit,
+        remaining: Math.max(0, input.limit - window.count),
+        resetAt: window.resetAt
+      };
+    }
+  };
+}
+
+export {
+  redactSecurityData,
+  SecurityConfigurationError,
+  createSecurityRouter,
+  defineSecurity,
+  composeProjectSecurity,
+  createMemoryRateLimiter
+};
+//# sourceMappingURL=chunk-DGTHFZPZ.js.map