@stacksjs/bun-router 0.0.16 → 0.0.17

package/dist/auth.d.ts

@@ -1,4 +1,4 @@
-import type { EnhancedRequest, JwtPayload } from './types';
+import type { EnhancedRequest, JwtHeader, JwtPayload } from './types';
 export interface JwtVerifyOptions {
     issuer?: string;
     audience?: string;
@@ -19,9 +19,23 @@ export interface JwtSignOptions {
     keyid?: string;
     jwtid?: string;
     noTimestamp?: boolean;
-    header?: Record<string, any>;
+    header?: Partial<JwtHeader>;
     encoding?: string;
 }
+/**
+ * Token endpoint response for the OAuth2 authorization-code flow
+ * (RFC 6749 §5.1). Providers may include extra fields — they're preserved
+ * under the index signature.
+ */
+export interface OAuth2TokenResponse {
+    access_token: string;
+    token_type: string;
+    expires_in?: number;
+    refresh_token?: string;
+    scope?: string;
+    id_token?: string;
+    [key: string]: string | number | undefined;
+}
 export interface ApiKeyOptions {
     source?: 'header' | 'query' | 'cookie';
     keyName?: string;
@@ -46,17 +60,17 @@ export declare class JWT {
     /**
      * Sign payload into a JWT token
      */
-    sign(payload: Record<string, any>, options?: JwtSignOptions): string;
+    sign(payload: JwtPayload, options?: JwtSignOptions): string;
     /**
      * Verify a JWT token and return the decoded payload
      */
-    verify(token: string, options?: JwtVerifyOptions): Record<string, any> | null;
+    verify(token: string, options?: JwtVerifyOptions): JwtPayload | null;
     /**
      * Decode a JWT token without verifying the signature
      */
     decode(token: string): {
-        header: Record<string, any>;
-        payload: Record<string, any>;
+        header: JwtHeader;
+        payload: JwtPayload;
     } | null;
     /**
      * Simple signature creation - Note: This is NOT secure for production
@@ -117,11 +131,11 @@ export declare class OAuth2Helper {
     /**
      * Exchange authorization code for access token
      */
-    exchangeCodeForToken(code: string): Promise<Record<string, any>>;
+    exchangeCodeForToken(code: string): Promise<OAuth2TokenResponse>;
     /**
      * Refresh an access token using a refresh token
      */
-    refreshToken(refreshToken: string): Promise<Record<string, any>>;
+    refreshToken(refreshToken: string): Promise<OAuth2TokenResponse>;
 }
 /**
  * Authentication helpers namespace

package/dist/chunk-1ahs68ys.js

@@ -0,0 +1,18 @@
+// @bun
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __require = import.meta.require;
+
+export { __export, __require };

package/dist/{chunk-0145g1me.js → chunk-cgptvjdf.js}

@@ -1,19 +1,7 @@
 // @bun
-var __defProp = Object.defineProperty;
-var __returnValue = (v) => v;
-function __exportSetter(name, newValue) {
-  this[name] = __returnValue.bind(null, newValue);
-}
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, {
-      get: all[name],
-      enumerable: true,
-      configurable: true,
-      set: __exportSetter.bind(all, name)
-    });
-};
-var __require = import.meta.require;
+import {
+  __require
+} from "./chunk-1ahs68ys.js";
 
 // src/config.ts
 import process19 from "process";
@@ -40,7 +28,7 @@ import process2 from "process";
 import { existsSync as existsSync22, mkdirSync, readdirSync, writeFileSync } from "fs";
 import { dirname, resolve } from "path";
 import process from "process";
-import { Buffer } from "buffer";
+import { Buffer as Buffer2 } from "buffer";
 import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
 import { closeSync, createReadStream, createWriteStream, existsSync as existsSync222, fsyncSync, openSync, writeFileSync as writeFileSync2 } from "fs";
 import { access, constants, mkdir, readdir, rename, stat, unlink, writeFile } from "fs/promises";
@@ -50,7 +38,7 @@ import { pipeline } from "stream/promises";
 import { createGzip } from "zlib";
 import process4 from "process";
 import process3 from "process";
-import { Buffer as Buffer2 } from "buffer";
+import { Buffer as Buffer22 } from "buffer";
 import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes2 } from "crypto";
 import { closeSync as closeSync2, createReadStream as createReadStream2, createWriteStream as createWriteStream2, existsSync as existsSync4, fsyncSync as fsyncSync2, openSync as openSync2, writeFileSync as writeFileSync4 } from "fs";
 import { access as access2, constants as constants2, mkdir as mkdir2, readdir as readdir2, rename as rename2, stat as stat2, unlink as unlink2, writeFile as writeFile2 } from "fs/promises";
@@ -323,23 +311,23 @@ class PerformanceMonitor {
 }
 var globalCache = new ConfigCache;
 var globalPerformanceMonitor = new PerformanceMonitor;
-var __defProp2 = Object.defineProperty;
-var __returnValue2 = (v) => v;
-function __exportSetter2(name, newValue) {
-  this[name] = __returnValue2.bind(null, newValue);
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
 }
-var __export2 = (target, all) => {
+var __export = (target, all) => {
   for (var name in all)
-    __defProp2(target, name, {
+    __defProp(target, name, {
       get: all[name],
       enumerable: true,
       configurable: true,
-      set: __exportSetter2.bind(all, name)
+      set: __exportSetter.bind(all, name)
     });
 };
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var exports_dist = {};
-__export2(exports_dist, {
+__export(exports_dist, {
   withErrorRecovery: () => withErrorRecovery,
   tryLoadConfig: () => tryLoadConfig3,
   loadConfigWithResult: () => loadConfigWithResult,
@@ -1028,7 +1016,7 @@ class Logger {
           }
           if (cancelled)
             throw new Error("Operation cancelled: Logger was destroyed");
-          const dataToWrite = this.validateEncryptionConfig() ? (await this.encrypt(data)).encrypted : Buffer.from(data);
+          const dataToWrite = this.validateEncryptionConfig() ? (await this.encrypt(data)).encrypted : Buffer2.from(data);
           try {
             if (!existsSync222(this.currentLogFile)) {
               await writeFile(this.currentLogFile, "", { mode: 420 });
@@ -1196,13 +1184,13 @@ class Logger {
     const { key } = this.getCurrentKey();
     const iv = randomBytes(16);
     const cipher = createCipheriv("aes-256-gcm", key, iv);
-    const encrypted = Buffer.concat([
+    const encrypted = Buffer2.concat([
       cipher.update(data, "utf8"),
       cipher.final()
     ]);
     const authTag = cipher.getAuthTag();
     return {
-      encrypted: Buffer.concat([iv, encrypted, authTag]),
+      encrypted: Buffer2.concat([iv, encrypted, authTag]),
       iv
     };
   }
@@ -1211,7 +1199,7 @@ class Logger {
       const gzip = createGzip();
       const chunks = [];
       gzip.on("data", (chunk2) => chunks.push(chunk2));
-      gzip.on("end", () => resolve32(Buffer.from(Buffer.concat(chunks))));
+      gzip.on("end", () => resolve32(Buffer2.from(Buffer2.concat(chunks))));
       gzip.on("error", reject);
       gzip.write(data);
       gzip.end();
@@ -1700,13 +1688,13 @@ class Logger {
       throw new Error("No valid encryption key available");
     const key = this.keys.get(this.currentKeyId);
     try {
-      const encryptedData = Buffer.isBuffer(data) ? data : Buffer.from(data, "base64");
+      const encryptedData = Buffer2.isBuffer(data) ? data : Buffer2.from(data, "base64");
       const iv = encryptedData.slice(0, 16);
       const authTag = encryptedData.slice(-16);
       const ciphertext = encryptedData.slice(16, -16);
       const decipher = createDecipheriv("aes-256-gcm", key, iv);
       decipher.setAuthTag(authTag);
-      const decrypted = Buffer.concat([
+      const decrypted = Buffer2.concat([
         decipher.update(ciphertext),
         decipher.final()
       ]);
@@ -2603,7 +2591,7 @@ class Logger2 {
           }
           if (cancelled)
             throw new Error("Operation cancelled: Logger was destroyed");
-          const dataToWrite = this.validateEncryptionConfig() ? (await this.encrypt(data)).encrypted : Buffer2.from(data);
+          const dataToWrite = this.validateEncryptionConfig() ? (await this.encrypt(data)).encrypted : Buffer22.from(data);
           try {
             if (!existsSync4(this.currentLogFile)) {
               await writeFile2(this.currentLogFile, "", { mode: 420 });
@@ -2773,12 +2761,12 @@ class Logger2 {
     const { key } = this.getCurrentKey();
     const iv = randomBytes2(16);
     const cipher = createCipheriv2("aes-256-gcm", key, iv);
-    const input = Buffer2.isBuffer(data) ? data : Buffer2.from(data, "utf8");
+    const input = Buffer22.isBuffer(data) ? data : Buffer22.from(data, "utf8");
     const part1 = cipher.update(input);
     const part2 = cipher.final();
     const totalCipherLen = part1.length + part2.length;
     const authTag = cipher.getAuthTag();
-    const out = Buffer2.allocUnsafe(16 + totalCipherLen + 16);
+    const out = Buffer22.allocUnsafe(16 + totalCipherLen + 16);
     iv.copy(out, 0);
     part1.copy(out, 16);
     part2.copy(out, 16 + part1.length);
@@ -2793,7 +2781,7 @@ class Logger2 {
       const gzip = createGzip2();
       const chunks = [];
       gzip.on("data", (chunk2) => chunks.push(chunk2));
-      gzip.on("end", () => resolve52(Buffer2.from(Buffer2.concat(chunks))));
+      gzip.on("end", () => resolve52(Buffer22.from(Buffer22.concat(chunks))));
       gzip.on("error", reject);
       gzip.write(data);
       gzip.end();
@@ -3388,7 +3376,7 @@ class Logger2 {
       throw new Error("No valid encryption key available");
     const key = this.keys.get(this.currentKeyId);
     try {
-      const encryptedData = Buffer2.isBuffer(data) ? data : Buffer2.from(data, "base64");
+      const encryptedData = Buffer22.isBuffer(data) ? data : Buffer22.from(data, "base64");
       const iv = encryptedData.subarray(0, 16);
       const authTag = encryptedData.subarray(encryptedData.length - 16);
       const ciphertext = encryptedData.subarray(16, encryptedData.length - 16);
@@ -3397,7 +3385,7 @@ class Logger2 {
       const d1 = decipher.update(ciphertext);
       const d2 = decipher.final();
       const totalLen = d1.length + d2.length;
-      const out = Buffer2.allocUnsafe(totalLen);
+      const out = Buffer22.allocUnsafe(totalLen);
       d1.copy(out, 0);
       d2.copy(out, d1.length);
       return out.toString("utf8");
@@ -9138,26 +9126,55 @@ var DEFAULT_CORS_HEADERS = {
   "Access-Control-Allow-Origin": "*",
   "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, PATCH, OPTIONS",
   "Access-Control-Allow-Headers": "Content-Type, Authorization, X-Requested-With, Accept, Origin",
-  "Access-Control-Max-Age": "86400",
-  "Access-Control-Allow-Credentials": "true"
+  "Access-Control-Max-Age": "86400"
 };
 
 class Cors {
-  getCorsHeaders() {
+  resolveAllowOrigin(configuredOrigin, credentials, requestOrigin) {
+    if (Array.isArray(configuredOrigin)) {
+      if (requestOrigin && configuredOrigin.includes(requestOrigin)) {
+        return { value: requestOrigin, vary: true };
+      }
+      return { value: null, vary: true };
+    }
+    const origin = configuredOrigin || "*";
+    if (origin === "*") {
+      if (credentials) {
+        if (requestOrigin) {
+          return { value: requestOrigin, vary: true };
+        }
+        return { value: null, vary: true };
+      }
+      return { value: "*", vary: false };
+    }
+    return { value: origin, vary: false };
+  }
+  getCorsHeaders(req) {
     const corsConfig = config5.server?.cors;
+    const requestOrigin = req.headers.get("origin");
     if (corsConfig && corsConfig.enabled) {
-      return {
-        "Access-Control-Allow-Origin": corsConfig.origin || "*",
+      const credentials = Boolean(corsConfig.credentials);
+      const { value: allowOrigin, vary } = this.resolveAllowOrigin(corsConfig.origin, credentials, requestOrigin);
+      const headers = {
         "Access-Control-Allow-Methods": Array.isArray(corsConfig.methods) ? corsConfig.methods.join(", ") : DEFAULT_CORS_HEADERS["Access-Control-Allow-Methods"],
         "Access-Control-Allow-Headers": Array.isArray(corsConfig.allowedHeaders) ? corsConfig.allowedHeaders.join(", ") : DEFAULT_CORS_HEADERS["Access-Control-Allow-Headers"],
-        "Access-Control-Max-Age": String(corsConfig.maxAge || 86400),
-        "Access-Control-Allow-Credentials": String(corsConfig.credentials || false)
+        "Access-Control-Max-Age": String(corsConfig.maxAge || 86400)
       };
+      if (allowOrigin !== null) {
+        headers["Access-Control-Allow-Origin"] = allowOrigin;
+      }
+      if (credentials && allowOrigin !== null && allowOrigin !== "*") {
+        headers["Access-Control-Allow-Credentials"] = "true";
+      }
+      if (vary) {
+        headers.Vary = "Origin";
+      }
+      return headers;
     }
     return { ...DEFAULT_CORS_HEADERS };
   }
   async handle(req, next) {
-    const corsHeaders = this.getCorsHeaders();
+    const corsHeaders = this.getCorsHeaders(req);
     if (req.method === "OPTIONS") {
       return new Response(null, { status: 204, headers: corsHeaders });
     }
@@ -9195,15 +9212,14 @@ class Cors {
 }
 
 // src/middleware/csrf.ts
-import { createHash, randomBytes as randomBytes4 } from "crypto";
+import { createHash, randomBytes as randomBytes4, timingSafeEqual } from "crypto";
+var MAX_TOKENS = 1e4;
+var TOKEN_TTL_MS = 2 * 60 * 60 * 1000;
+
 class Csrf {
   static tokens = new Map;
   async handle(req, next) {
-    const csrfConfig = config5.server?.security?.csrf || {};
-    if (["GET", "HEAD", "OPTIONS"].includes(req.method)) {
-      const response2 = await next();
-      return response2 || new Response("Not Found", { status: 404 });
-    }
+    const csrfConfig = config5.server?.security?.csrf ?? {};
     const method = req.method.toUpperCase();
     const ignoredMethods = ["GET", "HEAD", "OPTIONS", ...csrfConfig?.ignoreMethods || []];
     if (ignoredMethods.includes(method)) {
@@ -9227,7 +9243,7 @@ class Csrf {
       }
       const newHeaders = new Headers(response2.headers);
       newHeaders.append("Set-Cookie", cookieOptions.join("; "));
-      Csrf.tokens.set(token2, token2);
+      Csrf.storeToken(token2);
       return new Response(response2.body, {
         status: response2.status,
         statusText: response2.statusText,
@@ -9239,10 +9255,11 @@ class Csrf {
       const response2 = await next();
       return response2 || new Response("Not Found", { status: 404 });
     }
-    const token = req.headers.get("X-CSRF-TOKEN") || req.jsonBody?.csrf_token || req.jsonBody?._token || null;
+    const rawToken = req.headers.get("X-CSRF-TOKEN") || req.jsonBody?.csrf_token || req.jsonBody?._token || null;
+    const token = typeof rawToken === "string" ? rawToken : null;
     const cookies = this.parseCookies(req);
     const cookieToken = cookies[csrfConfig?.cookie?.name || "csrf-token"];
-    if (!token || !cookieToken || token !== cookieToken || !Csrf.tokens.has(token)) {
+    if (!token || !cookieToken || !Csrf.safeCompare(token, cookieToken) || !Csrf.isTokenValid(token)) {
       return new Response(JSON.stringify({ error: "CSRF token validation failed" }), {
         status: 403,
         headers: { "Content-Type": "application/json" }
@@ -9251,6 +9268,34 @@ class Csrf {
     const response = await next();
     return response || new Response("Not Found", { status: 404 });
   }
+  static safeCompare(a, b) {
+    const bufA = Buffer.from(a);
+    const bufB = Buffer.from(b);
+    if (bufA.length !== bufB.length) {
+      return false;
+    }
+    return timingSafeEqual(bufA, bufB);
+  }
+  static storeToken(token) {
+    if (Csrf.tokens.size >= MAX_TOKENS) {
+      const oldest = Csrf.tokens.keys().next().value;
+      if (oldest !== undefined) {
+        Csrf.tokens.delete(oldest);
+      }
+    }
+    Csrf.tokens.set(token, Date.now());
+  }
+  static isTokenValid(token) {
+    const issuedAt = Csrf.tokens.get(token);
+    if (issuedAt === undefined) {
+      return false;
+    }
+    if (Date.now() - issuedAt > TOKEN_TTL_MS) {
+      Csrf.tokens.delete(token);
+      return false;
+    }
+    return true;
+  }
   generateToken(secret) {
     const randomString = randomBytes4(16).toString("hex");
     return createHash("sha256").update(`${randomString}${secret}`).digest("hex");
@@ -9259,11 +9304,17 @@ class Csrf {
     const cookieHeader = req.headers.get("cookie");
     if (!cookieHeader)
       return {};
-    return cookieHeader.split(";").reduce((cookies, cookie) => {
-      const [name, value] = cookie.trim().split("=");
-      cookies[name] = value;
-      return cookies;
-    }, {});
+    const cookies = {};
+    for (const cookie of cookieHeader.split(";")) {
+      const eqIndex = cookie.indexOf("=");
+      if (eqIndex === -1)
+        continue;
+      const name = cookie.slice(0, eqIndex).trim();
+      if (!name)
+        continue;
+      cookies[name] = cookie.slice(eqIndex + 1).trim();
+    }
+    return cookies;
   }
 }
 
@@ -9318,18 +9369,18 @@ import process72 from "process";
 import { existsSync as existsSync62, readdirSync as readdirSync22 } from "fs";
 import { extname as extname2, resolve as resolve62 } from "path";
 import process82 from "process";
-var __defProp3 = Object.defineProperty;
-var __returnValue3 = (v) => v;
-function __exportSetter3(name, newValue) {
-  this[name] = __returnValue3.bind(null, newValue);
+var __defProp2 = Object.defineProperty;
+var __returnValue2 = (v) => v;
+function __exportSetter2(name, newValue) {
+  this[name] = __returnValue2.bind(null, newValue);
 }
-var __export3 = (target, all) => {
+var __export2 = (target, all) => {
   for (var name in all)
-    __defProp3(target, name, {
+    __defProp2(target, name, {
       get: all[name],
       enumerable: true,
       configurable: true,
-      set: __exportSetter3.bind(all, name)
+      set: __exportSetter2.bind(all, name)
     });
 };
 var __esm2 = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
@@ -12880,7 +12931,7 @@ export type ConfigOf = Config
 }
 var init_plugin = () => {};
 var exports_src = {};
-__export3(exports_src, {
+__export2(exports_src, {
   withErrorRecovery: () => withErrorRecovery3,
   tryLoadConfig: () => tryLoadConfig4,
   loadConfigWithResult: () => loadConfigWithResult2,
@@ -13748,6 +13799,7 @@ class InMemoryNonceStore {
   cleanupInterval = null;
   constructor(cleanupIntervalMs = 60000) {
     this.cleanupInterval = setInterval(() => this.cleanup(), cleanupIntervalMs);
+    this.cleanupInterval.unref?.();
   }
   has(nonce) {
     const expiry = this.nonces.get(nonce);
@@ -14753,6 +14805,7 @@ class DDoSProtection {
         }
       }
     }, this.options.windowSize / 2);
+    this.cleanupInterval.unref?.();
   }
   isWhitelisted(ip) {
     return this.options.whitelistedIPs?.includes(ip) ?? false;
@@ -14763,6 +14816,15 @@ class DDoSProtection {
   getRateLimitInfo(key, now) {
     let info = this.requestStore.get(key);
     if (!info) {
+      if (this.requestStore.size >= 1e5) {
+        let toEvict = Math.ceil(this.requestStore.size / 10);
+        for (const oldestKey of this.requestStore.keys()) {
+          this.requestStore.delete(oldestKey);
+          if (--toEvict <= 0) {
+            break;
+          }
+        }
+      }
       info = {
         count: 0,
         firstRequest: now,
@@ -15350,6 +15412,9 @@ class Helmet {
 }
 
 // src/middleware/input_validation.ts
+var EMAIL_REGEX = /^[^\s@]+@[^\s@][^\s.@]*\.[^\s@]+$/;
+var UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
 class InputValidation {
   options;
   constructor(options = {}) {
@@ -15446,8 +15511,7 @@ class InputValidation {
         }
         break;
       case "email": {
-        const emailRegex = /^[^\s@]+@[^\s@][^\s.@]*\.[^\s@]+$/;
-        if (typeof value === "string" && !emailRegex.test(value)) {
+        if (typeof value === "string" && !EMAIL_REGEX.test(value)) {
           errors.push({
             field: fieldPath,
             message: "Must be a valid email address",
@@ -15470,8 +15534,7 @@ class InputValidation {
         }
         break;
       case "uuid": {
-        const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-        if (typeof value === "string" && !uuidRegex.test(value)) {
+        if (typeof value === "string" && !UUID_REGEX.test(value)) {
           errors.push({
             field: fieldPath,
             message: "Must be a valid UUID",
@@ -15525,7 +15588,7 @@ class InputValidation {
         rule: "enum"
       });
     }
-    if (rule.pattern && typeof value === "string" && !rule.pattern.test(value)) {
+    if (rule.type !== "regex" && rule.pattern && typeof value === "string" && !rule.pattern.test(value)) {
       errors.push({
         field: fieldPath,
         message: "Does not match required pattern",
@@ -15808,6 +15871,7 @@ class PerformanceAlerting {
       this.cleanupOldNotifications();
       this.autoResolveAlerts();
     }, 1e4);
+    this.checkInterval.unref?.();
   }
   evaluateRules() {
     const now = Date.now();
@@ -16692,6 +16756,7 @@ class PerformanceMonitor5 {
     this.cleanupInterval = setInterval(() => {
       this.cleanupOldMetrics();
     }, 60000);
+    this.cleanupInterval.unref?.();
   }
   cleanupOldMetrics() {
     const now = Date.now();
@@ -17194,6 +17259,7 @@ class RequestTracer {
         console.warn("Error exporting spans:", error);
       }
     }, 100);
+    this.exportInterval.unref?.();
   }
   shouldSample() {
     return Math.random() < (this.options.sampleRate || 1);
@@ -17314,11 +17380,17 @@ class RequestTracer {
     }
   }
   async exportSpans() {
-    console.warn(`[RequestTracer] Exporting spans, queue size: ${this.exportQueue.length}, active spans: ${this.spans.size}`);
+    if (this.spans.size > 0) {
+      const cutoff = performance.now() - 60000;
+      for (const [spanId, span] of this.spans) {
+        if (span.endTime === undefined && span.startTime < cutoff) {
+          this.spans.delete(spanId);
+        }
+      }
+    }
     if (this.exportQueue.length === 0) {
       const finishedSpans = Array.from(this.spans.values()).filter((span) => span.endTime !== undefined);
       if (finishedSpans.length > 0) {
-        console.warn(`[RequestTracer] Found ${finishedSpans.length} finished spans to export`);
         this.exportQueue.push(...finishedSpans);
         for (const span of finishedSpans) {
           this.spans.delete(span.spanId);
@@ -18056,4 +18128,4 @@ var middleware = new Proxy({}, {
   }
 });
 
-export { __export, __require, defaultConfig4 as defaultConfig, getConfig, config5 as config, extractBasicAuth, extractBearerToken, extractApiKey, basicAuth, bearerAuth, jwtAuth, apiKeyAuth, oauth2Auth, Cors, Csrf, JsonBody, RateLimit, rateLimit, RequestId, SignatureError, InMemoryNonceStore, RequestSigning, requestSigning, signRequest, verifySignature, MemorySessionStore, FileSessionStore, RedisSessionStore, DatabaseSessionStore, createSessionStore, SessionManager, generateSessionId, Session, ContentSecurityPolicy, contentSecurityPolicy, DDoSProtection, ddosProtection, FileSecurity, FileUpload, fileUpload, singleFileUpload, multipleFileUpload, imageUpload, documentUpload, Helmet, InputValidation, inputValidation, PerformanceAlerting, performanceAlerting, PerformanceDashboard, performanceDashboard, PerformanceMonitor5 as PerformanceMonitor, performanceMonitor, RequestTracer, requestTracer, Security, security, SecuritySuite, securitySuite, cors, jsonBody, requestId, session, csrf, auth, middleware };
+export { defaultConfig4 as defaultConfig, getConfig, config5 as config, extractBasicAuth, extractBearerToken, extractApiKey, basicAuth, bearerAuth, jwtAuth, apiKeyAuth, oauth2Auth, Cors, Csrf, JsonBody, RateLimit, rateLimit, RequestId, SignatureError, InMemoryNonceStore, RequestSigning, requestSigning, signRequest, verifySignature, MemorySessionStore, FileSessionStore, RedisSessionStore, DatabaseSessionStore, createSessionStore, SessionManager, generateSessionId, Session, ContentSecurityPolicy, contentSecurityPolicy, DDoSProtection, ddosProtection, FileSecurity, FileUpload, fileUpload, singleFileUpload, multipleFileUpload, imageUpload, documentUpload, Helmet, InputValidation, inputValidation, PerformanceAlerting, performanceAlerting, PerformanceDashboard, performanceDashboard, PerformanceMonitor5 as PerformanceMonitor, performanceMonitor, RequestTracer, requestTracer, Security, security, SecuritySuite, securitySuite, cors, jsonBody, requestId, session, csrf, auth, middleware };