@zarex/bun 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Kodjogbe
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,97 @@
-# Temporary Holding Version
+# @zarex/bun
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Enveloppe Zarex pour le serveur HTTP natif de Bun (`Bun.serve`) — protège votre application contre les bots, les abus de trafic, les injections (SQL, XSS, SSRF...) et les fuites de données sensibles, en quelques lignes.
+
+## Installation
+
+```bash
+bun add @zarex/bun
+```
+
+## Démarrage rapide
+
+```ts
+import { zarexBun, shield, rateLimit } from "@zarex/bun";
+
+const wrap = zarexBun({
+  key: process.env.ZAREX_KEY!,
+  ipSource: "socket", // Bun donne l'adresse de la connexion : toutes les sources d'IP fonctionnent
+  rules: [shield(), rateLimit({ max: 100, window: "1m" })],
+});
+
+Bun.serve({
+  fetch: wrap(async (request) => new Response("ok")),
+});
+```
+
+Une requête refusée reçoit automatiquement `403 Forbidden` (ou `429 Too Many Requests` avec l'en-tête `retry-after` pour une limite de débit) — sans aucun code supplémentaire.
+
+**Fail-open** : si Zarex est injoignable, lent ou répond de façon inattendue, la requête passe toujours. Une panne chez Zarex ne doit jamais faire tomber votre application.
+
+## L'adresse IP du visiteur
+
+Bun expose nativement l'adresse de la connexion TCP via `server.requestIP(request)` — contrairement à Next.js ou à d'autres runtimes edge, **toutes** les valeurs d'`ipSource` fonctionnent ici, y compris `"socket"` (recommandé si rien ne se trouve devant votre serveur Bun) :
+
+| `ipSource` | Quand l'utiliser |
+|---|---|
+| `"socket"` | Pas de proxy devant Bun : l'adresse de la connexion TCP. |
+| `"cloudflare"` | Derrière Cloudflare : lit `CF-Connecting-IP`, seulement si la connexion vient réellement de Cloudflare. |
+| `{ proxies: n }` / `{ trustedProxies: [...] }` | Un nombre connu de proxys de confiance devant Bun, ou leurs plages CIDR exactes. |
+
+## Options
+
+```ts
+zarexBun({
+  key: string,              // obligatoire : clé API du projet
+  rules: Rule[],            // obligatoire : 1 à 10 règles, voir ci-dessous
+  ipSource: IpSource,       // obligatoire — voir ci-dessus
+  inspectBody?: boolean,
+  secureHeaders?: boolean | SecureHeadersOptions,
+  responseGuard?: boolean | ResponseGuardOptions,
+  onDeny?: (request, decision) => Response | undefined,
+  onDegraded?: (request, decision) => void,
+  call?: (request: Request) => ProtectCall | undefined,
+  timeoutMs?: number,       // défaut 500 ms
+  breaker?: BreakerOptions | false,
+})
+```
+
+### En-têtes de sécurité et surveillance des réponses
+
+```ts
+const wrap = zarexBun({ ..., secureHeaders: true, responseGuard: true });
+```
+
+Appliqués automatiquement à toute réponse produite par votre gestionnaire — aucun appel supplémentaire à faire.
+
+### Identifiants personnalisés (`call`)
+
+```ts
+const wrap = zarexBun({
+  key, ipSource: "socket",
+  rules: [rateLimit({ max: 100, window: "1m", characteristics: ["userId"] })],
+  call: (request) => ({ characteristics: { userId: request.headers.get("x-user-id") ?? undefined } }),
+});
+```
+
+Les valeurs sont hachées en SHA-256 avant l'envoi à Zarex. Une erreur dans cette fonction est silencieusement ignorée. `call` peut aussi fournir `tokensRequested`, `email`/`phone` ou `text` (voir [`@zarex/core`](https://www.npmjs.com/package/@zarex/core)).
+
+## Règles disponibles
+
+| Fonction | Résumé |
+|---|---|
+| `shield(opts?)` | Pare-feu applicatif : injection SQL, XSS, traversée de répertoires, SSRF, SSTI... |
+| `rateLimit({ max, window, ... })` | Limite de requêtes par visiteur sur une fenêtre de temps. |
+| `tokenBucket({ capacity, refillRate, interval })` | Budget de jetons avec pics autorisés. |
+| `detectBot(opts?)` | Détecte les robots connus, avec vérification DNS inversée. |
+| `requestFilter({ expressions, logic })` | Règles personnalisées sur IP, chemin, en-têtes, cookies, pays... |
+| `sensitiveInfo(opts?)` | Refuse une requête contenant une donnée sensible (nécessite `inspectBody`). |
+| `emailValidation(opts?)` | Valide un email donné via `call: () => ({ email })`. |
+| `phoneValidation(opts?)` | Valide un numéro donné, orienté opérateurs africains (MTN, Moov, Orange, Wave...). |
+| `promptInjection(opts?)` | Détecte les tentatives de manipulation d'un assistant IA, via `call: () => ({ text })`. |
+
+Chaque règle accepte `mode: "LIVE" | "DRY_RUN" | "OFF"`. Détails complets des options : voir [`@zarex/core`](https://www.npmjs.com/package/@zarex/core).
+
+## Licence
+
+MIT

package/dist/index.cjs

@@ -0,0 +1,103 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  CLOUDFLARE_RANGES: () => import_core2.CLOUDFLARE_RANGES,
+  PRIVATE_NETWORKS: () => import_core2.PRIVATE_NETWORKS,
+  createZarex: () => import_core2.createZarex,
+  detectBot: () => import_core2.detectBot,
+  emailValidation: () => import_core2.emailValidation,
+  phoneValidation: () => import_core2.phoneValidation,
+  promptInjection: () => import_core2.promptInjection,
+  rateLimit: () => import_core2.rateLimit,
+  requestFilter: () => import_core2.requestFilter,
+  secureHeaders: () => import_core2.secureHeaders,
+  sensitiveInfo: () => import_core2.sensitiveInfo,
+  shield: () => import_core2.shield,
+  tokenBucket: () => import_core2.tokenBucket,
+  withSecureHeaders: () => import_core2.withSecureHeaders,
+  zarexBun: () => zarexBun
+});
+module.exports = __toCommonJS(index_exports);
+var import_core = require("@zarex/core");
+var import_core2 = require("@zarex/core");
+function zarexBun(options, extra = {}) {
+  const isInstance = typeof options.protect === "function";
+  const instance = isInstance ? options : (0, import_core.createZarex)(options);
+  const opts = isInstance ? extra : options;
+  const finalizer = (0, import_core.createWebFinalizer)({ secureHeaders: opts.secureHeaders, responseGuard: opts.responseGuard });
+  const finalize = async (res, request) => {
+    if (!finalizer || !res) return res;
+    try {
+      return await finalizer(res, request);
+    } catch {
+      return res;
+    }
+  };
+  return function wrap(handler) {
+    return async function fetchWithZarex(request, server) {
+      let deny;
+      try {
+        let socketIp;
+        try {
+          socketIp = server?.requestIP?.(request)?.address;
+        } catch {
+          socketIp = void 0;
+        }
+        let call;
+        try {
+          call = opts.call?.(request);
+        } catch {
+          call = void 0;
+        }
+        ({ deny } = await (0, import_core.guardWebRequest)(instance, request, {
+          socketIp,
+          ...opts.inspectBody ? { inspectBody: true } : {},
+          ...opts.onDeny ? { onDeny: opts.onDeny } : {},
+          ...opts.onDegraded ? { onDegraded: opts.onDegraded } : {},
+          ...call ? { call } : {}
+        }));
+      } catch {
+        deny = void 0;
+      }
+      return finalize(deny ?? await handler(request, server), request);
+    };
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CLOUDFLARE_RANGES,
+  PRIVATE_NETWORKS,
+  createZarex,
+  detectBot,
+  emailValidation,
+  phoneValidation,
+  promptInjection,
+  rateLimit,
+  requestFilter,
+  secureHeaders,
+  sensitiveInfo,
+  shield,
+  tokenBucket,
+  withSecureHeaders,
+  zarexBun
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { createWebFinalizer, createZarex, guardWebRequest, type ResponseGuardOptions, type SecureHeadersOptions, type Decision, type ProtectCall, type WebGuardOptions, type Zarex, type ZarexOptions } from \"@zarex/core\";\r\n\r\n/** Ce que Bun fournit comme second argument de `fetch` : l'adresse de la connexion. */\r\nexport interface BunServerLike {\r\n  requestIP(request: Request): { address: string } | null;\r\n}\r\n\r\nexport interface BunZarexOptions extends ZarexOptions {\r\n  inspectBody?: boolean;\r\n  /** En-têtes de sécurité ajoutés à chaque réponse (true = défauts prudents). */\r\n  secureHeaders?: SecureHeadersOptions | boolean;\r\n  /** Surveille les réponses : masque les cartes bancaires, clés d'API, etc. */\r\n  responseGuard?: ResponseGuardOptions | boolean;\r\n  onDeny?: WebGuardOptions[\"onDeny\"];\r\n  onDegraded?: WebGuardOptions[\"onDegraded\"];\r\n  call?: (request: Request) => ProtectCall | undefined;\r\n}\r\n\r\ntype Fetch<S> = (request: Request, server: S) => Response | Promise<Response> | undefined | Promise<Response | undefined>;\r\n\r\n/**\r\n *   Bun.serve({ fetch: zarexBun({ key, baseUrl, ipSource: { proxies: 1 }, rules: [shield()] })(handler) })\r\n *\r\n * Bun donne l'adresse de la connexion (server.requestIP) : toutes les sources d'IP fonctionnent.\r\n * Le résultat de la décision est dans `(request as any).zarex` uniquement si vous le lisez via `onDegraded`.\r\n */\r\nexport function zarexBun(options: BunZarexOptions | Zarex, extra: Pick<BunZarexOptions, \"inspectBody\" | \"onDeny\" | \"onDegraded\" | \"call\" | \"secureHeaders\" | \"responseGuard\"> = {}) {\r\n  const isInstance = typeof (options as Zarex).protect === \"function\";\r\n  const instance: Zarex = isInstance ? (options as Zarex) : createZarex(options as BunZarexOptions);\r\n  const opts = (isInstance ? extra : options) as BunZarexOptions;\r\n\r\n  const finalizer = createWebFinalizer({ secureHeaders: opts.secureHeaders, responseGuard: opts.responseGuard });\r\n  const finalize = async (res: Response | undefined, request: Request): Promise<Response | undefined> => {\r\n    if (!finalizer || !res) return res;\r\n    try {\r\n      return await finalizer(res, request);\r\n    } catch {\r\n      return res;\r\n    }\r\n  };\r\n\r\n  return function wrap<S extends BunServerLike>(handler: Fetch<S>): Fetch<S> {\r\n    return async function fetchWithZarex(request, server) {\r\n      let deny: Response | undefined;\r\n      try {\r\n        let socketIp: string | undefined;\r\n        try {\r\n          socketIp = server?.requestIP?.(request)?.address;\r\n        } catch {\r\n          socketIp = undefined;\r\n        }\r\n        let call: ProtectCall | undefined;\r\n        try {\r\n          call = opts.call?.(request);\r\n        } catch {\r\n          call = undefined;\r\n        }\r\n        ({ deny } = await guardWebRequest(instance, request, {\r\n          socketIp,\r\n          ...(opts.inspectBody ? { inspectBody: true } : {}),\r\n          ...(opts.onDeny ? { onDeny: opts.onDeny } : {}),\r\n          ...(opts.onDegraded ? { onDegraded: opts.onDegraded } : {}),\r\n          ...(call ? { call } : {}),\r\n        }));\r\n      } catch {\r\n        deny = undefined;\r\n      }\r\n      return finalize(deny ?? (await handler(request, server)), request);\r\n    };\r\n  };\r\n}\r\n\r\nexport {\r\n  shield,\r\n  rateLimit,\r\n  tokenBucket,\r\n  detectBot,\r\n  requestFilter,\r\n  sensitiveInfo,\r\n  emailValidation,\r\n  phoneValidation,\r\n  promptInjection,\r\n  secureHeaders,\r\n  withSecureHeaders,\r\n  createZarex,\r\n  PRIVATE_NETWORKS,\r\n  CLOUDFLARE_RANGES,\r\n} from \"@zarex/core\";\r\nexport type { SecureHeadersOptions, ResponseGuardOptions, ResponseGuardEvent } from \"@zarex/core\";\r\nexport type { Decision, Zarex, ZarexOptions, IpSource, Rule, ProtectCall } from \"@zarex/core\";"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAA6M;AAwE7M,IAAAA,eAeO;AA7DA,SAAS,SAAS,SAAkC,QAAqH,CAAC,GAAG;AAClL,QAAM,aAAa,OAAQ,QAAkB,YAAY;AACzD,QAAM,WAAkB,aAAc,cAAoB,yBAAY,OAA0B;AAChG,QAAM,OAAQ,aAAa,QAAQ;AAEnC,QAAM,gBAAY,gCAAmB,EAAE,eAAe,KAAK,eAAe,eAAe,KAAK,cAAc,CAAC;AAC7G,QAAM,WAAW,OAAO,KAA2B,YAAoD;AACrG,QAAI,CAAC,aAAa,CAAC,IAAK,QAAO;AAC/B,QAAI;AACF,aAAO,MAAM,UAAU,KAAK,OAAO;AAAA,IACrC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO,SAAS,KAA8B,SAA6B;AACzE,WAAO,eAAe,eAAe,SAAS,QAAQ;AACpD,UAAI;AACJ,UAAI;AACF,YAAI;AACJ,YAAI;AACF,qBAAW,QAAQ,YAAY,OAAO,GAAG;AAAA,QAC3C,QAAQ;AACN,qBAAW;AAAA,QACb;AACA,YAAI;AACJ,YAAI;AACF,iBAAO,KAAK,OAAO,OAAO;AAAA,QAC5B,QAAQ;AACN,iBAAO;AAAA,QACT;AACA,SAAC,EAAE,KAAK,IAAI,UAAM,6BAAgB,UAAU,SAAS;AAAA,UACnD;AAAA,UACA,GAAI,KAAK,cAAc,EAAE,aAAa,KAAK,IAAI,CAAC;AAAA,UAChD,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;AAAA,UAC7C,GAAI,KAAK,aAAa,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,UACzD,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,QACzB,CAAC;AAAA,MACH,QAAQ;AACN,eAAO;AAAA,MACT;AACA,aAAO,SAAS,QAAS,MAAM,QAAQ,SAAS,MAAM,GAAI,OAAO;AAAA,IACnE;AAAA,EACF;AACF;","names":["import_core"]}

package/dist/index.d.cts

@@ -0,0 +1,29 @@
+import { ZarexOptions, SecureHeadersOptions, ResponseGuardOptions, WebGuardOptions, ProtectCall, Zarex } from '@zarex/core';
+export { CLOUDFLARE_RANGES, Decision, IpSource, PRIVATE_NETWORKS, ProtectCall, ResponseGuardEvent, ResponseGuardOptions, Rule, SecureHeadersOptions, Zarex, ZarexOptions, createZarex, detectBot, emailValidation, phoneValidation, promptInjection, rateLimit, requestFilter, secureHeaders, sensitiveInfo, shield, tokenBucket, withSecureHeaders } from '@zarex/core';
+
+/** Ce que Bun fournit comme second argument de `fetch` : l'adresse de la connexion. */
+interface BunServerLike {
+    requestIP(request: Request): {
+        address: string;
+    } | null;
+}
+interface BunZarexOptions extends ZarexOptions {
+    inspectBody?: boolean;
+    /** En-têtes de sécurité ajoutés à chaque réponse (true = défauts prudents). */
+    secureHeaders?: SecureHeadersOptions | boolean;
+    /** Surveille les réponses : masque les cartes bancaires, clés d'API, etc. */
+    responseGuard?: ResponseGuardOptions | boolean;
+    onDeny?: WebGuardOptions["onDeny"];
+    onDegraded?: WebGuardOptions["onDegraded"];
+    call?: (request: Request) => ProtectCall | undefined;
+}
+type Fetch<S> = (request: Request, server: S) => Response | Promise<Response> | undefined | Promise<Response | undefined>;
+/**
+ *   Bun.serve({ fetch: zarexBun({ key, baseUrl, ipSource: { proxies: 1 }, rules: [shield()] })(handler) })
+ *
+ * Bun donne l'adresse de la connexion (server.requestIP) : toutes les sources d'IP fonctionnent.
+ * Le résultat de la décision est dans `(request as any).zarex` uniquement si vous le lisez via `onDegraded`.
+ */
+declare function zarexBun(options: BunZarexOptions | Zarex, extra?: Pick<BunZarexOptions, "inspectBody" | "onDeny" | "onDegraded" | "call" | "secureHeaders" | "responseGuard">): <S extends BunServerLike>(handler: Fetch<S>) => Fetch<S>;
+
+export { type BunServerLike, type BunZarexOptions, zarexBun };

package/dist/index.d.ts

@@ -0,0 +1,29 @@
+import { ZarexOptions, SecureHeadersOptions, ResponseGuardOptions, WebGuardOptions, ProtectCall, Zarex } from '@zarex/core';
+export { CLOUDFLARE_RANGES, Decision, IpSource, PRIVATE_NETWORKS, ProtectCall, ResponseGuardEvent, ResponseGuardOptions, Rule, SecureHeadersOptions, Zarex, ZarexOptions, createZarex, detectBot, emailValidation, phoneValidation, promptInjection, rateLimit, requestFilter, secureHeaders, sensitiveInfo, shield, tokenBucket, withSecureHeaders } from '@zarex/core';
+
+/** Ce que Bun fournit comme second argument de `fetch` : l'adresse de la connexion. */
+interface BunServerLike {
+    requestIP(request: Request): {
+        address: string;
+    } | null;
+}
+interface BunZarexOptions extends ZarexOptions {
+    inspectBody?: boolean;
+    /** En-têtes de sécurité ajoutés à chaque réponse (true = défauts prudents). */
+    secureHeaders?: SecureHeadersOptions | boolean;
+    /** Surveille les réponses : masque les cartes bancaires, clés d'API, etc. */
+    responseGuard?: ResponseGuardOptions | boolean;
+    onDeny?: WebGuardOptions["onDeny"];
+    onDegraded?: WebGuardOptions["onDegraded"];
+    call?: (request: Request) => ProtectCall | undefined;
+}
+type Fetch<S> = (request: Request, server: S) => Response | Promise<Response> | undefined | Promise<Response | undefined>;
+/**
+ *   Bun.serve({ fetch: zarexBun({ key, baseUrl, ipSource: { proxies: 1 }, rules: [shield()] })(handler) })
+ *
+ * Bun donne l'adresse de la connexion (server.requestIP) : toutes les sources d'IP fonctionnent.
+ * Le résultat de la décision est dans `(request as any).zarex` uniquement si vous le lisez via `onDegraded`.
+ */
+declare function zarexBun(options: BunZarexOptions | Zarex, extra?: Pick<BunZarexOptions, "inspectBody" | "onDeny" | "onDegraded" | "call" | "secureHeaders" | "responseGuard">): <S extends BunServerLike>(handler: Fetch<S>) => Fetch<S>;
+
+export { type BunServerLike, type BunZarexOptions, zarexBun };

package/dist/index.js

@@ -0,0 +1,79 @@
+// src/index.ts
+import { createWebFinalizer, createZarex, guardWebRequest } from "@zarex/core";
+import {
+  shield,
+  rateLimit,
+  tokenBucket,
+  detectBot,
+  requestFilter,
+  sensitiveInfo,
+  emailValidation,
+  phoneValidation,
+  promptInjection,
+  secureHeaders,
+  withSecureHeaders,
+  createZarex as createZarex2,
+  PRIVATE_NETWORKS,
+  CLOUDFLARE_RANGES
+} from "@zarex/core";
+function zarexBun(options, extra = {}) {
+  const isInstance = typeof options.protect === "function";
+  const instance = isInstance ? options : createZarex(options);
+  const opts = isInstance ? extra : options;
+  const finalizer = createWebFinalizer({ secureHeaders: opts.secureHeaders, responseGuard: opts.responseGuard });
+  const finalize = async (res, request) => {
+    if (!finalizer || !res) return res;
+    try {
+      return await finalizer(res, request);
+    } catch {
+      return res;
+    }
+  };
+  return function wrap(handler) {
+    return async function fetchWithZarex(request, server) {
+      let deny;
+      try {
+        let socketIp;
+        try {
+          socketIp = server?.requestIP?.(request)?.address;
+        } catch {
+          socketIp = void 0;
+        }
+        let call;
+        try {
+          call = opts.call?.(request);
+        } catch {
+          call = void 0;
+        }
+        ({ deny } = await guardWebRequest(instance, request, {
+          socketIp,
+          ...opts.inspectBody ? { inspectBody: true } : {},
+          ...opts.onDeny ? { onDeny: opts.onDeny } : {},
+          ...opts.onDegraded ? { onDegraded: opts.onDegraded } : {},
+          ...call ? { call } : {}
+        }));
+      } catch {
+        deny = void 0;
+      }
+      return finalize(deny ?? await handler(request, server), request);
+    };
+  };
+}
+export {
+  CLOUDFLARE_RANGES,
+  PRIVATE_NETWORKS,
+  createZarex2 as createZarex,
+  detectBot,
+  emailValidation,
+  phoneValidation,
+  promptInjection,
+  rateLimit,
+  requestFilter,
+  secureHeaders,
+  sensitiveInfo,
+  shield,
+  tokenBucket,
+  withSecureHeaders,
+  zarexBun
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { createWebFinalizer, createZarex, guardWebRequest, type ResponseGuardOptions, type SecureHeadersOptions, type Decision, type ProtectCall, type WebGuardOptions, type Zarex, type ZarexOptions } from \"@zarex/core\";\r\n\r\n/** Ce que Bun fournit comme second argument de `fetch` : l'adresse de la connexion. */\r\nexport interface BunServerLike {\r\n  requestIP(request: Request): { address: string } | null;\r\n}\r\n\r\nexport interface BunZarexOptions extends ZarexOptions {\r\n  inspectBody?: boolean;\r\n  /** En-têtes de sécurité ajoutés à chaque réponse (true = défauts prudents). */\r\n  secureHeaders?: SecureHeadersOptions | boolean;\r\n  /** Surveille les réponses : masque les cartes bancaires, clés d'API, etc. */\r\n  responseGuard?: ResponseGuardOptions | boolean;\r\n  onDeny?: WebGuardOptions[\"onDeny\"];\r\n  onDegraded?: WebGuardOptions[\"onDegraded\"];\r\n  call?: (request: Request) => ProtectCall | undefined;\r\n}\r\n\r\ntype Fetch<S> = (request: Request, server: S) => Response | Promise<Response> | undefined | Promise<Response | undefined>;\r\n\r\n/**\r\n *   Bun.serve({ fetch: zarexBun({ key, baseUrl, ipSource: { proxies: 1 }, rules: [shield()] })(handler) })\r\n *\r\n * Bun donne l'adresse de la connexion (server.requestIP) : toutes les sources d'IP fonctionnent.\r\n * Le résultat de la décision est dans `(request as any).zarex` uniquement si vous le lisez via `onDegraded`.\r\n */\r\nexport function zarexBun(options: BunZarexOptions | Zarex, extra: Pick<BunZarexOptions, \"inspectBody\" | \"onDeny\" | \"onDegraded\" | \"call\" | \"secureHeaders\" | \"responseGuard\"> = {}) {\r\n  const isInstance = typeof (options as Zarex).protect === \"function\";\r\n  const instance: Zarex = isInstance ? (options as Zarex) : createZarex(options as BunZarexOptions);\r\n  const opts = (isInstance ? extra : options) as BunZarexOptions;\r\n\r\n  const finalizer = createWebFinalizer({ secureHeaders: opts.secureHeaders, responseGuard: opts.responseGuard });\r\n  const finalize = async (res: Response | undefined, request: Request): Promise<Response | undefined> => {\r\n    if (!finalizer || !res) return res;\r\n    try {\r\n      return await finalizer(res, request);\r\n    } catch {\r\n      return res;\r\n    }\r\n  };\r\n\r\n  return function wrap<S extends BunServerLike>(handler: Fetch<S>): Fetch<S> {\r\n    return async function fetchWithZarex(request, server) {\r\n      let deny: Response | undefined;\r\n      try {\r\n        let socketIp: string | undefined;\r\n        try {\r\n          socketIp = server?.requestIP?.(request)?.address;\r\n        } catch {\r\n          socketIp = undefined;\r\n        }\r\n        let call: ProtectCall | undefined;\r\n        try {\r\n          call = opts.call?.(request);\r\n        } catch {\r\n          call = undefined;\r\n        }\r\n        ({ deny } = await guardWebRequest(instance, request, {\r\n          socketIp,\r\n          ...(opts.inspectBody ? { inspectBody: true } : {}),\r\n          ...(opts.onDeny ? { onDeny: opts.onDeny } : {}),\r\n          ...(opts.onDegraded ? { onDegraded: opts.onDegraded } : {}),\r\n          ...(call ? { call } : {}),\r\n        }));\r\n      } catch {\r\n        deny = undefined;\r\n      }\r\n      return finalize(deny ?? (await handler(request, server)), request);\r\n    };\r\n  };\r\n}\r\n\r\nexport {\r\n  shield,\r\n  rateLimit,\r\n  tokenBucket,\r\n  detectBot,\r\n  requestFilter,\r\n  sensitiveInfo,\r\n  emailValidation,\r\n  phoneValidation,\r\n  promptInjection,\r\n  secureHeaders,\r\n  withSecureHeaders,\r\n  createZarex,\r\n  PRIVATE_NETWORKS,\r\n  CLOUDFLARE_RANGES,\r\n} from \"@zarex/core\";\r\nexport type { SecureHeadersOptions, ResponseGuardOptions, ResponseGuardEvent } from \"@zarex/core\";\r\nexport type { Decision, Zarex, ZarexOptions, IpSource, Rule, ProtectCall } from \"@zarex/core\";"],"mappings":";AAAA,SAAS,oBAAoB,aAAa,uBAAmK;AAwE7M;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,eAAAA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA7DA,SAAS,SAAS,SAAkC,QAAqH,CAAC,GAAG;AAClL,QAAM,aAAa,OAAQ,QAAkB,YAAY;AACzD,QAAM,WAAkB,aAAc,UAAoB,YAAY,OAA0B;AAChG,QAAM,OAAQ,aAAa,QAAQ;AAEnC,QAAM,YAAY,mBAAmB,EAAE,eAAe,KAAK,eAAe,eAAe,KAAK,cAAc,CAAC;AAC7G,QAAM,WAAW,OAAO,KAA2B,YAAoD;AACrG,QAAI,CAAC,aAAa,CAAC,IAAK,QAAO;AAC/B,QAAI;AACF,aAAO,MAAM,UAAU,KAAK,OAAO;AAAA,IACrC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO,SAAS,KAA8B,SAA6B;AACzE,WAAO,eAAe,eAAe,SAAS,QAAQ;AACpD,UAAI;AACJ,UAAI;AACF,YAAI;AACJ,YAAI;AACF,qBAAW,QAAQ,YAAY,OAAO,GAAG;AAAA,QAC3C,QAAQ;AACN,qBAAW;AAAA,QACb;AACA,YAAI;AACJ,YAAI;AACF,iBAAO,KAAK,OAAO,OAAO;AAAA,QAC5B,QAAQ;AACN,iBAAO;AAAA,QACT;AACA,SAAC,EAAE,KAAK,IAAI,MAAM,gBAAgB,UAAU,SAAS;AAAA,UACnD;AAAA,UACA,GAAI,KAAK,cAAc,EAAE,aAAa,KAAK,IAAI,CAAC;AAAA,UAChD,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;AAAA,UAC7C,GAAI,KAAK,aAAa,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,UACzD,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,QACzB,CAAC;AAAA,MACH,QAAQ;AACN,eAAO;AAAA,MACT;AACA,aAAO,SAAS,QAAS,MAAM,QAAQ,SAAS,MAAM,GAAI,OAAO;AAAA,IACnE;AAAA,EACF;AACF;","names":["createZarex"]}

package/package.json

@@ -1,6 +1,35 @@
 {
   "name": "@zarex/bun",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.1",
+  "description": "Zarex — Bun.serve",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "sideEffects": false,
+  "dependencies": {
+    "@zarex/core": "^0.1.1"
+  },
+  "scripts": {
+    "build": "tsup"
+  }
 }