@ysk-kit/api-http 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 YSK Limited
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/envelope-error.d.ts

@@ -0,0 +1,14 @@
+export type EnvelopeErrorJson = {
+    status: number;
+    body: {
+        ok: false;
+        error: {
+            code: string;
+            message: string;
+            details?: unknown;
+            requestId: string;
+        };
+    };
+};
+export declare const envelopeError: (error: unknown, requestId: string) => EnvelopeErrorJson;
+//# sourceMappingURL=envelope-error.d.ts.map

package/dist/envelope-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope-error.d.ts","sourceRoot":"","sources":["../src/envelope-error.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE;QACJ,EAAE,EAAE,KAAK,CAAC;QACV,KAAK,EAAE;YACL,IAAI,EAAE,MAAM,CAAC;YACb,OAAO,EAAE,MAAM,CAAC;YAChB,OAAO,CAAC,EAAE,OAAO,CAAC;YAClB,SAAS,EAAE,MAAM,CAAC;SACnB,CAAC;KACH,CAAC;CACH,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,OAAO,OAAO,EAAE,WAAW,MAAM,KAAG,iBAwCjE,CAAC"}

package/dist/envelope-error.js

@@ -0,0 +1,45 @@
+import { ERROR_MESSAGE } from '@ysk-kit/contracts';
+import { AppError } from '@ysk-kit/domain-kernel';
+import { ZodError } from 'zod';
+export const envelopeError = (error, requestId) => {
+    if (error instanceof ZodError) {
+        return {
+            status: 422,
+            body: {
+                ok: false,
+                error: {
+                    code: 'VALIDATION_FAILED',
+                    message: ERROR_MESSAGE.VALIDATION_FAILED['zh-HK'],
+                    details: error.flatten(),
+                    requestId,
+                },
+            },
+        };
+    }
+    if (error instanceof AppError) {
+        return {
+            status: error.status,
+            body: {
+                ok: false,
+                error: {
+                    code: error.code,
+                    message: error.message,
+                    ...(error.details !== undefined ? { details: error.details } : {}),
+                    requestId,
+                },
+            },
+        };
+    }
+    return {
+        status: 500,
+        body: {
+            ok: false,
+            error: {
+                code: 'INTERNAL',
+                message: ERROR_MESSAGE.INTERNAL['zh-HK'],
+                requestId,
+            },
+        },
+    };
+};
+//# sourceMappingURL=envelope-error.js.map

package/dist/envelope-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope-error.js","sourceRoot":"","sources":["../src/envelope-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAe/B,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAc,EAAE,SAAiB,EAAqB,EAAE;IACpF,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;QAC9B,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACJ,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACL,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,aAAa,CAAC,iBAAiB,CAAC,OAAO,CAAC;oBACjD,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE;oBACxB,SAAS;iBACV;aACF;SACF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;QAC9B,OAAO;YACL,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE;gBACJ,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACL,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClE,SAAS;iBACV;aACF;SACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE;YACJ,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACxC,SAAS;aACV;SACF;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/flatten.d.ts

@@ -0,0 +1,17 @@
+import type { z } from 'zod';
+export type HttpMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+export type ContractRoute = {
+    method: HttpMethod;
+    path: string;
+    query?: z.ZodType;
+    body?: z.ZodType;
+    pathParams?: z.ZodType;
+};
+export type ContractRouter = {
+    [key: string]: ContractRoute | ContractRouter;
+};
+export declare const flattenContract: (contract: ContractRouter) => {
+    key: string;
+    route: ContractRoute;
+}[];
+//# sourceMappingURL=flatten.d.ts.map

package/dist/flatten.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flatten.d.ts","sourceRoot":"","sources":["../src/flatten.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;AAErE,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,cAAc,CAAC;CAC/C,CAAC;AA2BF,eAAO,MAAM,eAAe,GAC1B,UAAU,cAAc,KACvB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,aAAa,CAAA;CAAE,EAIvC,CAAC"}

package/dist/flatten.js

@@ -0,0 +1,23 @@
+const isRoute = (value) => Boolean(value &&
+    typeof value === 'object' &&
+    'method' in value &&
+    'path' in value &&
+    typeof value.method === 'string' &&
+    typeof value.path === 'string');
+const walk = (node, prefix, acc) => {
+    for (const [key, value] of Object.entries(node)) {
+        const nextKey = prefix ? `${prefix}.${key}` : key;
+        if (isRoute(value)) {
+            acc.push({ key: nextKey, route: value });
+        }
+        else if (value && typeof value === 'object') {
+            walk(value, nextKey, acc);
+        }
+    }
+};
+export const flattenContract = (contract) => {
+    const acc = [];
+    walk(contract, '', acc);
+    return acc;
+};
+//# sourceMappingURL=flatten.js.map

package/dist/flatten.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flatten.js","sourceRoot":"","sources":["../src/flatten.ts"],"names":[],"mappings":"AAgBA,MAAM,OAAO,GAAG,CAAC,KAAc,EAA0B,EAAE,CACzD,OAAO,CACL,KAAK;IACH,OAAO,KAAK,KAAK,QAAQ;IACzB,QAAQ,IAAI,KAAK;IACjB,MAAM,IAAI,KAAK;IACf,OAAQ,KAAuB,CAAC,MAAM,KAAK,QAAQ;IACnD,OAAQ,KAAuB,CAAC,IAAI,KAAK,QAAQ,CACpD,CAAC;AAEJ,MAAM,IAAI,GAAG,CACX,IAAoB,EACpB,MAAc,EACd,GAA4C,EACtC,EAAE;IACR,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAClD,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACnB,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3C,CAAC;aAAM,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAuB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,QAAwB,EACiB,EAAE;IAC3C,MAAM,GAAG,GAA4C,EAAE,CAAC;IACxD,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IACxB,OAAO,GAAG,CAAC;AACb,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export { type EnvelopeErrorJson, envelopeError } from './envelope-error';
+export { type ContractRoute, type ContractRouter, flattenContract, type HttpMethod, } from './flatten';
+export { buildOpenApiDocument, type OpenApiDocument, scalarDocsHtml, } from './openapi';
+export { clientIp, createMemoryRateLimit, isRateLimitSkipped, type RateLimitOpts, } from './rate-limit';
+export { REQUEST_ID_HEADER } from './request-id';
+export { applySecurityHeaders, securityHeaders } from './security-headers';
+export { type HttpCtx, type HttpHandler, type HttpResult, headerValue } from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,iBAAiB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,eAAe,EACf,KAAK,UAAU,GAChB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,oBAAoB,EACpB,KAAK,eAAe,EACpB,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,QAAQ,EACR,qBAAqB,EACrB,kBAAkB,EAClB,KAAK,aAAa,GACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -0,0 +1,8 @@
+export { envelopeError } from './envelope-error';
+export { flattenContract, } from './flatten';
+export { buildOpenApiDocument, scalarDocsHtml, } from './openapi';
+export { clientIp, createMemoryRateLimit, isRateLimitSkipped, } from './rate-limit';
+export { REQUEST_ID_HEADER } from './request-id';
+export { applySecurityHeaders, securityHeaders } from './security-headers';
+export { headerValue } from './types';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAGL,eAAe,GAEhB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,oBAAoB,EAEpB,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,QAAQ,EACR,qBAAqB,EACrB,kBAAkB,GAEnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAmD,WAAW,EAAE,MAAM,SAAS,CAAC"}

package/dist/openapi.d.ts

@@ -0,0 +1,12 @@
+import { type ContractRouter } from './flatten';
+export type OpenApiDocument = {
+    openapi: string;
+    info: {
+        title: string;
+        version: string;
+    };
+    paths: Record<string, Record<string, unknown>>;
+};
+export declare const buildOpenApiDocument: (contract: ContractRouter) => OpenApiDocument;
+export declare const scalarDocsHtml: (specUrl?: string) => string;
+//# sourceMappingURL=openapi.d.ts.map

package/dist/openapi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../src/openapi.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,cAAc,EAAmB,MAAM,WAAW,CAAC;AAUjE,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAChD,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAAI,UAAU,cAAc,KAAG,eAkC/D,CAAC;AAEF,eAAO,MAAM,cAAc,GAAI,gBAAyB,KAAG,MAY1D,CAAC"}

package/dist/openapi.js

@@ -0,0 +1,59 @@
+import { z } from 'zod';
+import { flattenContract } from './flatten';
+const toJsonSchema = (schema) => {
+    try {
+        return z.toJSONSchema(schema);
+    }
+    catch {
+        return { type: 'object' };
+    }
+};
+export const buildOpenApiDocument = (contract) => {
+    const paths = {};
+    for (const { key, route } of flattenContract(contract)) {
+        const path = route.path.replace(/:([A-Za-z0-9_]+)/g, '{$1}');
+        const method = route.method.toLowerCase();
+        const operation = {
+            operationId: key,
+            responses: {
+                '200': { description: 'OK' },
+            },
+        };
+        if (route.body) {
+            operation.requestBody = {
+                required: true,
+                content: { 'application/json': { schema: toJsonSchema(route.body) } },
+            };
+        }
+        if (route.query) {
+            operation.parameters = [
+                {
+                    in: 'query',
+                    name: 'query',
+                    schema: toJsonSchema(route.query),
+                },
+            ];
+        }
+        paths[path] ??= {};
+        paths[path][method] = operation;
+    }
+    return {
+        openapi: '3.1.0',
+        info: { title: 'YSK Kit API', version: '0.1.0' },
+        paths,
+    };
+};
+export const scalarDocsHtml = (specUrl = '/openapi.json') => `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>YSK Kit API</title>
+</head>
+<body>
+  <script id="api-reference" data-url="${specUrl}"></script>
+  <script src="https://cdn.jsdelivr.net/npm/@scalar/api-reference"></script>
+</body>
+</html>
+`;
+//# sourceMappingURL=openapi.js.map

package/dist/openapi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.js","sourceRoot":"","sources":["../src/openapi.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAuB,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjE,MAAM,YAAY,GAAG,CAAC,MAAiB,EAA2B,EAAE;IAClE,IAAI,CAAC;QACH,OAAO,CAAC,CAAC,YAAY,CAAC,MAAM,CAA4B,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC;AAQF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,QAAwB,EAAmB,EAAE;IAChF,MAAM,KAAK,GAA4C,EAAE,CAAC;IAC1D,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,SAAS,GAA4B;YACzC,WAAW,EAAE,GAAG;YAChB,SAAS,EAAE;gBACT,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE;aAC7B;SACF,CAAC;QACF,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACf,SAAS,CAAC,WAAW,GAAG;gBACtB,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE;aACtE,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,SAAS,CAAC,UAAU,GAAG;gBACrB;oBACE,EAAE,EAAE,OAAO;oBACX,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC;iBAClC;aACF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IAClC,CAAC;IACD,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE;QAChD,KAAK;KACN,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAO,GAAG,eAAe,EAAU,EAAE,CAAC;;;;;;;;yCAQ5B,OAAO;;;;CAI/C,CAAC"}

package/dist/rate-limit.d.ts

@@ -0,0 +1,11 @@
+export type RateLimitOpts = {
+    windowMs: number;
+    max: number;
+    skipPath?: (path: string) => boolean;
+};
+export declare const clientIp: (forwarded: string | string[] | undefined, remote: string | undefined) => string;
+export declare const isRateLimitSkipped: (path: string) => boolean;
+export declare const createMemoryRateLimit: (opts: RateLimitOpts) => {
+    check(ip: string, path: string): void;
+};
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../src/rate-limit.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CACtC,CAAC;AAEF,eAAO,MAAM,QAAQ,GACnB,WAAW,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,EACxC,QAAQ,MAAM,GAAG,SAAS,KACzB,MAKF,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,KAAG,OACc,CAAC;AAEjE,eAAO,MAAM,qBAAqB,GAAI,MAAM,aAAa;cAK3C,MAAM,QAAQ,MAAM,GAAG,IAAI;CAaxC,CAAC"}

package/dist/rate-limit.js

@@ -0,0 +1,29 @@
+import { AppError } from '@ysk-kit/domain-kernel';
+export const clientIp = (forwarded, remote) => {
+    const raw = Array.isArray(forwarded) ? forwarded[0] : forwarded;
+    const first = raw?.split(',')[0]?.trim();
+    if (first && first.length > 0)
+        return first;
+    return remote ?? 'unknown';
+};
+export const isRateLimitSkipped = (path) => path === '/metrics' || path === '/health' || path === '/ready';
+export const createMemoryRateLimit = (opts) => {
+    const hits = new Map();
+    const skip = opts.skipPath ?? isRateLimitSkipped;
+    return {
+        check(ip, path) {
+            if (skip(path))
+                return;
+            const now = Date.now();
+            const windowStart = now - opts.windowMs;
+            const recent = (hits.get(ip) ?? []).filter((at) => at > windowStart);
+            if (recent.length >= opts.max) {
+                hits.set(ip, recent);
+                throw new AppError('RATE_LIMITED');
+            }
+            recent.push(now);
+            hits.set(ip, recent);
+        },
+    };
+};
+//# sourceMappingURL=rate-limit.js.map

package/dist/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../src/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAQlD,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,SAAwC,EACxC,MAA0B,EAClB,EAAE;IACV,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,MAAM,KAAK,GAAG,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACzC,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,MAAM,IAAI,SAAS,CAAC;AAC7B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,IAAY,EAAW,EAAE,CAC1D,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ,CAAC;AAEjE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,IAAmB,EAAE,EAAE;IAC3D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,kBAAkB,CAAC;IAEjD,OAAO;QACL,KAAK,CAAC,EAAU,EAAE,IAAY;YAC5B,IAAI,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO;YACvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,WAAW,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC;YACxC,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC;YACrE,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBACrB,MAAM,IAAI,QAAQ,CAAC,cAAc,CAAC,CAAC;YACrC,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjB,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/request-id.d.ts

@@ -0,0 +1,2 @@
+export declare const REQUEST_ID_HEADER = "x-request-id";
+//# sourceMappingURL=request-id.d.ts.map

package/dist/request-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-id.d.ts","sourceRoot":"","sources":["../src/request-id.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iBAAiB,iBAAiB,CAAC"}

package/dist/request-id.js

@@ -0,0 +1,2 @@
+export const REQUEST_ID_HEADER = 'x-request-id';
+//# sourceMappingURL=request-id.js.map

package/dist/request-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-id.js","sourceRoot":"","sources":["../src/request-id.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC"}

package/dist/security-headers.d.ts

@@ -0,0 +1,9 @@
+export declare const securityHeaders: (opts: {
+    production: boolean;
+    docs?: boolean;
+}) => Record<string, string>;
+export declare const applySecurityHeaders: (set: (name: string, value: string) => void, opts: {
+    production: boolean;
+    docs?: boolean;
+}) => void;
+//# sourceMappingURL=security-headers.d.ts.map

package/dist/security-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-headers.d.ts","sourceRoot":"","sources":["../src/security-headers.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,GAAI,MAAM;IACpC,UAAU,EAAE,OAAO,CAAC;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAgBxB,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAC/B,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,EAC1C,MAAM;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,KAC5C,IAIF,CAAC"}

package/dist/security-headers.js

@@ -0,0 +1,23 @@
+export const securityHeaders = (opts) => {
+    const csp = opts.docs
+        ? "default-src 'self'; script-src 'self' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; img-src 'self' data:; font-src 'self' https://cdn.jsdelivr.net; connect-src 'self'; frame-ancestors 'none'"
+        : "default-src 'none'; frame-ancestors 'none'";
+    const headers = {
+        'X-Content-Type-Options': 'nosniff',
+        'X-Frame-Options': 'DENY',
+        'Referrer-Policy': 'no-referrer',
+        'Permissions-Policy': 'camera=(), microphone=(), geolocation=()',
+        'Cross-Origin-Opener-Policy': 'same-origin',
+        'Content-Security-Policy': csp,
+    };
+    if (opts.production) {
+        headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains';
+    }
+    return headers;
+};
+export const applySecurityHeaders = (set, opts) => {
+    for (const [name, value] of Object.entries(securityHeaders(opts))) {
+        set(name, value);
+    }
+};
+//# sourceMappingURL=security-headers.js.map

package/dist/security-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-headers.js","sourceRoot":"","sources":["../src/security-headers.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAG/B,EAA0B,EAAE;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI;QACnB,CAAC,CAAC,uOAAuO;QACzO,CAAC,CAAC,4CAA4C,CAAC;IACjD,MAAM,OAAO,GAA2B;QACtC,wBAAwB,EAAE,SAAS;QACnC,iBAAiB,EAAE,MAAM;QACzB,iBAAiB,EAAE,aAAa;QAChC,oBAAoB,EAAE,0CAA0C;QAChE,4BAA4B,EAAE,aAAa;QAC3C,yBAAyB,EAAE,GAAG;KAC/B,CAAC;IACF,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,OAAO,CAAC,2BAA2B,CAAC,GAAG,qCAAqC,CAAC;IAC/E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,GAA0C,EAC1C,IAA6C,EACvC,EAAE;IACR,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnB,CAAC;AACH,CAAC,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,21 @@
+import type { AccessClaims } from '@ysk-kit/auth';
+import type { Permission } from '@ysk-kit/contracts';
+export type HttpCtx = {
+    auth?: AccessClaims;
+    body: unknown;
+    query: unknown;
+    params: unknown;
+    requestId: string;
+    headers: Record<string, string | string[] | undefined>;
+};
+export type HttpResult = {
+    status: number;
+    body: unknown;
+};
+export type HttpHandler = {
+    auth?: 'required';
+    permission?: Permission;
+    handle: (ctx: HttpCtx) => Promise<HttpResult>;
+};
+export declare const headerValue: (headers: HttpCtx["headers"], name: string) => string | undefined;
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,MAAM,OAAO,GAAG;IACpB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;CACxD,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;CAC/C,CAAC;AAEF,eAAO,MAAM,WAAW,GAAI,SAAS,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,MAAM,KAAG,MAAM,GAAG,SAIhF,CAAC"}

package/dist/types.js

@@ -0,0 +1,7 @@
+export const headerValue = (headers, name) => {
+    const value = headers[name] ?? headers[name.toLowerCase()];
+    if (Array.isArray(value))
+        return value[0];
+    return value;
+};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAuBA,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAA2B,EAAE,IAAY,EAAsB,EAAE;IAC3F,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC;AACf,CAAC,CAAC"}

package/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@ysk-kit/api-http",
+  "version": "1.0.0",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "dependencies": {
+    "@ysk-kit/auth": "1.0.0",
+    "@ysk-kit/contracts": "1.0.0",
+    "@ysk-kit/domain-kernel": "1.0.0",
+    "zod": "^4.6.5"
+  },
+  "devDependencies": {
+    "@types/node": "^24.5.2",
+    "typescript": "^6.0.3",
+    "vitest": "^5.0.2"
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public"
+  },
+  "scripts": {
+    "typecheck": "tsc --noEmit -p tsconfig.json",
+    "test": "vitest run --passWithNoTests",
+    "build": "tsc -p tsconfig.build.json"
+  }
+}