@zarex/fastify 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Kodjogbe
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.cjs

@@ -0,0 +1,176 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  CLOUDFLARE_RANGES: () => import_core2.CLOUDFLARE_RANGES,
+  PRIVATE_NETWORKS: () => import_core2.PRIVATE_NETWORKS,
+  createZarex: () => import_core2.createZarex,
+  detectBot: () => import_core2.detectBot,
+  emailValidation: () => import_core2.emailValidation,
+  phoneValidation: () => import_core2.phoneValidation,
+  promptInjection: () => import_core2.promptInjection,
+  rateLimit: () => import_core2.rateLimit,
+  requestFilter: () => import_core2.requestFilter,
+  secureHeaders: () => import_core2.secureHeaders,
+  sensitiveInfo: () => import_core2.sensitiveInfo,
+  shield: () => import_core2.shield,
+  tokenBucket: () => import_core2.tokenBucket,
+  withSecureHeaders: () => import_core2.withSecureHeaders,
+  zarexFastify: () => zarexFastify,
+  zarexFastifyOnSend: () => zarexFastifyOnSend
+});
+module.exports = __toCommonJS(index_exports);
+var import_core = require("@zarex/core");
+var import_core2 = require("@zarex/core");
+function requestLooksLikeItHasAnUnparsedBody(req) {
+  if (req.body !== void 0) return false;
+  const te = req.headers["transfer-encoding"];
+  if (typeof te === "string" ? te.length > 0 : Array.isArray(te) && te.length > 0) return true;
+  const cl = req.headers["content-length"];
+  const clNum = typeof cl === "string" ? Number(cl) : Array.isArray(cl) ? Number(cl[0]) : NaN;
+  return Number.isFinite(clNum) && clNum > 0;
+}
+function bodyToString(body) {
+  if (body === void 0 || body === null) return void 0;
+  if (typeof body === "string") return body;
+  try {
+    const s = JSON.stringify(body);
+    return typeof s === "string" ? s : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function defaultDeny(_req, reply, d) {
+  const limited = d.deniedBy?.ruleType === "RATE_LIMIT" || d.deniedBy?.ruleType === "TOKEN_BUCKET";
+  if (limited) {
+    if (d.retryAfterSeconds !== void 0) reply.header("retry-after", String(d.retryAfterSeconds));
+    reply.code(429).send({ error: { code: "rate_limited", message: "Too many requests", request_id: d.id } });
+  } else {
+    reply.code(403).send({ error: { code: "forbidden", message: "Request blocked", request_id: d.id } });
+  }
+}
+function zarexFastify(options, extra = {}) {
+  const isInstance = typeof options.protect === "function";
+  const opts = isInstance ? extra : options;
+  const instance = isInstance ? options : (0, import_core.createZarex)({ ...options, ipSource: options.ipSource ?? "framework" });
+  const prepared = (0, import_core.prepareSecureHeaders)(opts.secureHeaders);
+  let warnedAboutUnparsedBody = false;
+  return async function zarexHook(req, reply) {
+    let decision;
+    try {
+      if (prepared) {
+        const set = (0, import_core.isLocalHost)(req.hostname ?? (typeof req.headers["host"] === "string" ? req.headers["host"] : void 0)) ? prepared.http : prepared.https;
+        for (const [k, v] of Object.entries(set)) reply.header(k, v);
+        if (prepared.removePoweredBy) reply.removeHeader?.("x-powered-by");
+      }
+    } catch {
+    }
+    try {
+      let call;
+      try {
+        call = opts.call?.(req);
+      } catch {
+        call = void 0;
+      }
+      const host = typeof req.headers["host"] === "string" ? req.headers["host"] : req.hostname;
+      if (opts.inspectBody && !warnedAboutUnparsedBody && requestLooksLikeItHasAnUnparsedBody(req)) {
+        warnedAboutUnparsedBody = true;
+        console.warn(
+          '[zarex] fastify: `inspectBody: true` but request.body is still undefined on a request that has one. This hook is probably registered on "onRequest", where Fastify has not parsed the body yet \u2014 register it as "preHandler" instead, otherwise the body is silently never sent to the engine.'
+        );
+      }
+      decision = await instance.protect(
+        {
+          method: req.method,
+          path: req.url,
+          host,
+          headers: req.headers,
+          socketIp: req.raw?.socket?.remoteAddress,
+          frameworkIp: req.ip,
+          body: opts.inspectBody ? bodyToString(req.body) : void 0
+        },
+        call
+      );
+      req.zarex = decision;
+    } catch {
+      return;
+    }
+    if (decision.denied) {
+      try {
+        (opts.onDeny ?? defaultDeny)(req, reply, decision);
+      } catch {
+        if (!reply.sent) defaultDeny(req, reply, decision);
+      }
+      return;
+    }
+    if (decision.degraded && opts.onDegraded) {
+      try {
+        opts.onDegraded(req, decision);
+      } catch {
+      }
+    }
+  };
+}
+function zarexFastifyOnSend(options) {
+  const guard = (0, import_core.normalizeGuardOptions)(options.responseGuard);
+  const decoder = new TextDecoder("utf-8");
+  return async function onSend(_req, reply, payload) {
+    if (!guard) return payload;
+    try {
+      const ct = String(reply.getHeader?.("content-type") ?? "");
+      const isString = typeof payload === "string";
+      const isBytes = payload instanceof Uint8Array;
+      if (!(isString || isBytes) || !(0, import_core.isScannableContentType)(ct)) return payload;
+      const r = (0, import_core.applyGuard)(isString ? payload : decoder.decode(payload), ct, guard);
+      if (r.action === "masked" || r.action === "blocked") {
+        reply.removeHeader?.("content-length");
+        reply.removeHeader?.("etag");
+        if (r.action === "blocked") {
+          reply.code(500);
+          reply.header("content-type", "application/json; charset=utf-8");
+        }
+        return r.body;
+      }
+    } catch {
+    }
+    return payload;
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CLOUDFLARE_RANGES,
+  PRIVATE_NETWORKS,
+  createZarex,
+  detectBot,
+  emailValidation,
+  phoneValidation,
+  promptInjection,
+  rateLimit,
+  requestFilter,
+  secureHeaders,
+  sensitiveInfo,
+  shield,
+  tokenBucket,
+  withSecureHeaders,
+  zarexFastify,
+  zarexFastifyOnSend
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import {\r\n  applyGuard,\r\n  createZarex,\r\n  isLocalHost,\r\n  isScannableContentType,\r\n  normalizeGuardOptions,\r\n  prepareSecureHeaders,\r\n  type Decision,\r\n  type ProtectCall,\r\n  type ResponseGuardOptions,\r\n  type SecureHeadersOptions,\r\n  type Zarex,\r\n  type ZarexOptions,\r\n} from \"@zarex/core\";\r\n\r\n/** Types minimaux de Fastify (pas de dépendance à `fastify` à l'exécution : Fastify 4 et 5). */\r\nexport interface FastifyReqLike {\r\n  method: string;\r\n  url: string;\r\n  ip?: string | undefined;\r\n  hostname?: string;\r\n  headers: Record<string, string | string[] | undefined>;\r\n  raw?: { socket?: { remoteAddress?: string | undefined } | undefined };\r\n  body?: unknown;\r\n  zarex?: Decision;\r\n}\r\nexport interface FastifyReplyLike {\r\n  code(status: number): this;\r\n  header(name: string, value: string): this;\r\n  send(payload?: unknown): this;\r\n  getHeader?(name: string): unknown;\r\n  removeHeader?(name: string): unknown;\r\n  sent?: boolean;\r\n}\r\n\r\nexport interface FastifyZarexOptions extends Omit<ZarexOptions, \"ipSource\"> {\r\n  /**\r\n   * Défaut : \"framework\" — l'adresse est celle de `request.ip`, que Fastify calcule selon l'option\r\n   * `trustProxy` de VOTRE serveur (`Fastify({ trustProxy: 1 })`). Sans `trustProxy`, Fastify ignore X-Forwarded-For.\r\n   */\r\n  ipSource?: ZarexOptions[\"ipSource\"];\r\n  /** En-têtes de sécurité ajoutés à toutes les réponses (true = défauts prudents). Retire X-Powered-By. */\r\n  secureHeaders?: SecureHeadersOptions | boolean;\r\n  /** Surveillance des réponses : enregistrez aussi `zarexFastifyOnSend(options)` comme hook `onSend`. */\r\n  responseGuard?: ResponseGuardOptions | boolean;\r\n  /** Nécessite d'enregistrer le hook en `preHandler` (le corps n'est analysé qu'après `onRequest`). */\r\n  inspectBody?: boolean;\r\n  onDeny?: (req: FastifyReqLike, reply: FastifyReplyLike, decision: Decision) => void;\r\n  onDegraded?: (req: FastifyReqLike, decision: Decision) => void;\r\n  call?: (req: FastifyReqLike) => ProtectCall | undefined;\r\n}\r\n\r\n// Trouvé lors de l'audit du 04/11/2026 (voir AUDIT_SECURITE_COMPLET.md) : l'exemple JSDoc principal\r\n// de ce fichier montre le hook enregistré en \"onRequest\", où Fastify n'a pas encore analysé le\r\n// corps — `inspectBody: true` n'y transmet alors jamais rien au moteur, SANS AUCUN avertissement.\r\n// Heuristique : `req.body` indéfini alors que la requête annonce clairement un corps\r\n// (Content-Length > 0 ou Transfer-Encoding) signale presque certainement ce piège plutôt qu'une\r\n// requête sans corps (GET…), pour laquelle il n'y a rien à signaler.\r\nfunction requestLooksLikeItHasAnUnparsedBody(req: FastifyReqLike): boolean {\r\n  if (req.body !== undefined) return false;\r\n  const te = req.headers[\"transfer-encoding\"];\r\n  if (typeof te === \"string\" ? te.length > 0 : Array.isArray(te) && te.length > 0) return true;\r\n  const cl = req.headers[\"content-length\"];\r\n  const clNum = typeof cl === \"string\" ? Number(cl) : Array.isArray(cl) ? Number(cl[0]) : NaN;\r\n  return Number.isFinite(clNum) && clNum > 0;\r\n}\r\n\r\nfunction bodyToString(body: unknown): string | undefined {\r\n  if (body === undefined || body === null) return undefined;\r\n  if (typeof body === \"string\") return body;\r\n  try {\r\n    const s = JSON.stringify(body);\r\n    return typeof s === \"string\" ? s : undefined;\r\n  } catch {\r\n    return undefined;\r\n  }\r\n}\r\n\r\nfunction defaultDeny(_req: FastifyReqLike, reply: FastifyReplyLike, d: Decision): void {\r\n  const limited = d.deniedBy?.ruleType === \"RATE_LIMIT\" || d.deniedBy?.ruleType === \"TOKEN_BUCKET\";\r\n  if (limited) {\r\n    if (d.retryAfterSeconds !== undefined) reply.header(\"retry-after\", String(d.retryAfterSeconds));\r\n    reply.code(429).send({ error: { code: \"rate_limited\", message: \"Too many requests\", request_id: d.id } });\r\n  } else {\r\n    reply.code(403).send({ error: { code: \"forbidden\", message: \"Request blocked\", request_id: d.id } });\r\n  }\r\n}\r\n\r\n/**\r\n *   app.addHook(\"onRequest\", zarexFastify({ key, baseUrl, rules: [shield()] }));\r\n *\r\n * Avec `inspectBody: true`, enregistrez le hook en \"preHandler\" (pas \"onRequest\" ci-dessus) :\r\n * Fastify n'a pas encore lu le corps en \"onRequest\", le moteur ne verrait jamais rien.\r\n *   app.addHook(\"preHandler\", zarexFastify({ key, baseUrl, rules: [shield()], inspectBody: true }));\r\n *\r\n * Fonctionne aussi avec NestJS (plateforme Fastify) :\r\n *   (app.getHttpAdapter().getInstance() as FastifyInstance).addHook(\"onRequest\", zarexFastify({...}));\r\n */\r\nexport function zarexFastify(options: FastifyZarexOptions | Zarex, extra: Pick<FastifyZarexOptions, \"inspectBody\" | \"onDeny\" | \"onDegraded\" | \"call\" | \"secureHeaders\" | \"responseGuard\"> = {}) {\r\n  const isInstance = typeof (options as Zarex).protect === \"function\";\r\n  const opts = (isInstance ? extra : options) as FastifyZarexOptions;\r\n  const instance: Zarex = isInstance\r\n    ? (options as Zarex)\r\n    : createZarex({ ...(options as FastifyZarexOptions), ipSource: (options as FastifyZarexOptions).ipSource ?? \"framework\" });\r\n\r\n  const prepared = prepareSecureHeaders(opts.secureHeaders);\r\n  let warnedAboutUnparsedBody = false;\r\n\r\n  return async function zarexHook(req: FastifyReqLike, reply: FastifyReplyLike): Promise<void> {\r\n    let decision: Decision;\r\n    try {\r\n      if (prepared) {\r\n        const set = isLocalHost(req.hostname ?? (typeof req.headers[\"host\"] === \"string\" ? (req.headers[\"host\"] as string) : undefined)) ? prepared.http : prepared.https;\r\n        for (const [k, v] of Object.entries(set)) reply.header(k, v);\r\n        if (prepared.removePoweredBy) reply.removeHeader?.(\"x-powered-by\");\r\n      }\r\n    } catch {\r\n      /* sans effet sur la requête */\r\n    }\r\n    try {\r\n      let call: ProtectCall | undefined;\r\n      try {\r\n        call = opts.call?.(req);\r\n      } catch {\r\n        call = undefined;\r\n      }\r\n      const host = typeof req.headers[\"host\"] === \"string\" ? (req.headers[\"host\"] as string) : req.hostname;\r\n      if (opts.inspectBody && !warnedAboutUnparsedBody && requestLooksLikeItHasAnUnparsedBody(req)) {\r\n        warnedAboutUnparsedBody = true;\r\n        console.warn(\r\n          '[zarex] fastify: `inspectBody: true` but request.body is still undefined on a request that has one. ' +\r\n            'This hook is probably registered on \"onRequest\", where Fastify has not parsed the body yet — register it ' +\r\n            'as \"preHandler\" instead, otherwise the body is silently never sent to the engine.'\r\n        );\r\n      }\r\n      decision = await instance.protect(\r\n        {\r\n          method: req.method,\r\n          path: req.url,\r\n          host,\r\n          headers: req.headers,\r\n          socketIp: req.raw?.socket?.remoteAddress,\r\n          frameworkIp: req.ip,\r\n          body: opts.inspectBody ? bodyToString(req.body) : undefined,\r\n        },\r\n        call\r\n      );\r\n      req.zarex = decision;\r\n    } catch {\r\n      return;\r\n    }\r\n    if (decision.denied) {\r\n      try {\r\n        (opts.onDeny ?? defaultDeny)(req, reply, decision);\r\n      } catch {\r\n        /* si le refus personnalisé échoue, on retombe sur le refus par défaut */\r\n        if (!reply.sent) defaultDeny(req, reply, decision);\r\n      }\r\n      return; // async hook : la réponse est déjà envoyée, Fastify s'arrête là (reply.sent)\r\n    }\r\n    if (decision.degraded && opts.onDegraded) {\r\n      try {\r\n        opts.onDegraded(req, decision);\r\n      } catch {\r\n        /* sans effet sur la requête */\r\n      }\r\n    }\r\n  };\r\n}\r\n\r\n/**\r\n * Hook `onSend` : surveille les corps de réponse TEXTE (string / Buffer) et masque ou bloque les données sensibles.\r\n *\r\n *   app.addHook(\"onSend\", zarexFastifyOnSend({ responseGuard: true }));\r\n *\r\n * Les flux (streams) ne sont pas analysés.\r\n */\r\nexport function zarexFastifyOnSend(options: Pick<FastifyZarexOptions, \"responseGuard\">) {\r\n  const guard = normalizeGuardOptions(options.responseGuard);\r\n  const decoder = new TextDecoder(\"utf-8\");\r\n  return async function onSend(_req: unknown, reply: FastifyReplyLike, payload: unknown): Promise<unknown> {\r\n    if (!guard) return payload;\r\n    try {\r\n      const ct = String(reply.getHeader?.(\"content-type\") ?? \"\");\r\n      const isString = typeof payload === \"string\";\r\n      const isBytes = payload instanceof Uint8Array;\r\n      if (!(isString || isBytes) || !isScannableContentType(ct)) return payload;\r\n      const r = applyGuard(isString ? payload : decoder.decode(payload), ct, guard);\r\n      if (r.action === \"masked\" || r.action === \"blocked\") {\r\n        reply.removeHeader?.(\"content-length\"); // Fastify le recalcule\r\n        reply.removeHeader?.(\"etag\");\r\n        if (r.action === \"blocked\") {\r\n          reply.code(500);\r\n          reply.header(\"content-type\", \"application/json; charset=utf-8\");\r\n        }\r\n        return r.body;\r\n      }\r\n    } catch {\r\n      /* jamais casser la réponse */\r\n    }\r\n    return payload;\r\n  };\r\n}\r\n\r\nexport {\r\n  shield,\r\n  rateLimit,\r\n  tokenBucket,\r\n  detectBot,\r\n  requestFilter,\r\n  sensitiveInfo,\r\n  emailValidation,\r\n  phoneValidation,\r\n  promptInjection,\r\n  secureHeaders,\r\n  withSecureHeaders,\r\n  createZarex,\r\n  PRIVATE_NETWORKS,\r\n  CLOUDFLARE_RANGES,\r\n} from \"@zarex/core\";\r\nexport type { SecureHeadersOptions, ResponseGuardOptions, ResponseGuardEvent } from \"@zarex/core\";\r\nexport type { Decision, Zarex, ZarexOptions, IpSource, Rule, ProtectCall } from \"@zarex/core\";"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAaO;AA+LP,IAAAA,eAeO;AAjKP,SAAS,oCAAoC,KAA8B;AACzE,MAAI,IAAI,SAAS,OAAW,QAAO;AACnC,QAAM,KAAK,IAAI,QAAQ,mBAAmB;AAC1C,MAAI,OAAO,OAAO,WAAW,GAAG,SAAS,IAAI,MAAM,QAAQ,EAAE,KAAK,GAAG,SAAS,EAAG,QAAO;AACxF,QAAM,KAAK,IAAI,QAAQ,gBAAgB;AACvC,QAAM,QAAQ,OAAO,OAAO,WAAW,OAAO,EAAE,IAAI,MAAM,QAAQ,EAAE,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI;AACxF,SAAO,OAAO,SAAS,KAAK,KAAK,QAAQ;AAC3C;AAEA,SAAS,aAAa,MAAmC;AACvD,MAAI,SAAS,UAAa,SAAS,KAAM,QAAO;AAChD,MAAI,OAAO,SAAS,SAAU,QAAO;AACrC,MAAI;AACF,UAAM,IAAI,KAAK,UAAU,IAAI;AAC7B,WAAO,OAAO,MAAM,WAAW,IAAI;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,YAAY,MAAsB,OAAyB,GAAmB;AACrF,QAAM,UAAU,EAAE,UAAU,aAAa,gBAAgB,EAAE,UAAU,aAAa;AAClF,MAAI,SAAS;AACX,QAAI,EAAE,sBAAsB,OAAW,OAAM,OAAO,eAAe,OAAO,EAAE,iBAAiB,CAAC;AAC9F,UAAM,KAAK,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,SAAS,qBAAqB,YAAY,EAAE,GAAG,EAAE,CAAC;AAAA,EAC1G,OAAO;AACL,UAAM,KAAK,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,SAAS,mBAAmB,YAAY,EAAE,GAAG,EAAE,CAAC;AAAA,EACrG;AACF;AAYO,SAAS,aAAa,SAAsC,QAAyH,CAAC,GAAG;AAC9L,QAAM,aAAa,OAAQ,QAAkB,YAAY;AACzD,QAAM,OAAQ,aAAa,QAAQ;AACnC,QAAM,WAAkB,aACnB,cACD,yBAAY,EAAE,GAAI,SAAiC,UAAW,QAAgC,YAAY,YAAY,CAAC;AAE3H,QAAM,eAAW,kCAAqB,KAAK,aAAa;AACxD,MAAI,0BAA0B;AAE9B,SAAO,eAAe,UAAU,KAAqB,OAAwC;AAC3F,QAAI;AACJ,QAAI;AACF,UAAI,UAAU;AACZ,cAAM,UAAM,yBAAY,IAAI,aAAa,OAAO,IAAI,QAAQ,MAAM,MAAM,WAAY,IAAI,QAAQ,MAAM,IAAe,OAAU,IAAI,SAAS,OAAO,SAAS;AAC5J,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,GAAG,EAAG,OAAM,OAAO,GAAG,CAAC;AAC3D,YAAI,SAAS,gBAAiB,OAAM,eAAe,cAAc;AAAA,MACnE;AAAA,IACF,QAAQ;AAAA,IAER;AACA,QAAI;AACF,UAAI;AACJ,UAAI;AACF,eAAO,KAAK,OAAO,GAAG;AAAA,MACxB,QAAQ;AACN,eAAO;AAAA,MACT;AACA,YAAM,OAAO,OAAO,IAAI,QAAQ,MAAM,MAAM,WAAY,IAAI,QAAQ,MAAM,IAAe,IAAI;AAC7F,UAAI,KAAK,eAAe,CAAC,2BAA2B,oCAAoC,GAAG,GAAG;AAC5F,kCAA0B;AAC1B,gBAAQ;AAAA,UACN;AAAA,QAGF;AAAA,MACF;AACA,iBAAW,MAAM,SAAS;AAAA,QACxB;AAAA,UACE,QAAQ,IAAI;AAAA,UACZ,MAAM,IAAI;AAAA,UACV;AAAA,UACA,SAAS,IAAI;AAAA,UACb,UAAU,IAAI,KAAK,QAAQ;AAAA,UAC3B,aAAa,IAAI;AAAA,UACjB,MAAM,KAAK,cAAc,aAAa,IAAI,IAAI,IAAI;AAAA,QACpD;AAAA,QACA;AAAA,MACF;AACA,UAAI,QAAQ;AAAA,IACd,QAAQ;AACN;AAAA,IACF;AACA,QAAI,SAAS,QAAQ;AACnB,UAAI;AACF,SAAC,KAAK,UAAU,aAAa,KAAK,OAAO,QAAQ;AAAA,MACnD,QAAQ;AAEN,YAAI,CAAC,MAAM,KAAM,aAAY,KAAK,OAAO,QAAQ;AAAA,MACnD;AACA;AAAA,IACF;AACA,QAAI,SAAS,YAAY,KAAK,YAAY;AACxC,UAAI;AACF,aAAK,WAAW,KAAK,QAAQ;AAAA,MAC/B,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACF;AASO,SAAS,mBAAmB,SAAqD;AACtF,QAAM,YAAQ,mCAAsB,QAAQ,aAAa;AACzD,QAAM,UAAU,IAAI,YAAY,OAAO;AACvC,SAAO,eAAe,OAAO,MAAe,OAAyB,SAAoC;AACvG,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI;AACF,YAAM,KAAK,OAAO,MAAM,YAAY,cAAc,KAAK,EAAE;AACzD,YAAM,WAAW,OAAO,YAAY;AACpC,YAAM,UAAU,mBAAmB;AACnC,UAAI,EAAE,YAAY,YAAY,KAAC,oCAAuB,EAAE,EAAG,QAAO;AAClE,YAAM,QAAI,wBAAW,WAAW,UAAU,QAAQ,OAAO,OAAO,GAAG,IAAI,KAAK;AAC5E,UAAI,EAAE,WAAW,YAAY,EAAE,WAAW,WAAW;AACnD,cAAM,eAAe,gBAAgB;AACrC,cAAM,eAAe,MAAM;AAC3B,YAAI,EAAE,WAAW,WAAW;AAC1B,gBAAM,KAAK,GAAG;AACd,gBAAM,OAAO,gBAAgB,iCAAiC;AAAA,QAChE;AACA,eAAO,EAAE;AAAA,MACX;AAAA,IACF,QAAQ;AAAA,IAER;AACA,WAAO;AAAA,EACT;AACF;","names":["import_core"]}

package/dist/index.d.cts

@@ -0,0 +1,63 @@
+import { Decision, ZarexOptions, SecureHeadersOptions, ResponseGuardOptions, ProtectCall, Zarex } from '@zarex/core';
+export { CLOUDFLARE_RANGES, Decision, IpSource, PRIVATE_NETWORKS, ProtectCall, ResponseGuardEvent, ResponseGuardOptions, Rule, SecureHeadersOptions, Zarex, ZarexOptions, createZarex, detectBot, emailValidation, phoneValidation, promptInjection, rateLimit, requestFilter, secureHeaders, sensitiveInfo, shield, tokenBucket, withSecureHeaders } from '@zarex/core';
+
+/** Types minimaux de Fastify (pas de dépendance à `fastify` à l'exécution : Fastify 4 et 5). */
+interface FastifyReqLike {
+    method: string;
+    url: string;
+    ip?: string | undefined;
+    hostname?: string;
+    headers: Record<string, string | string[] | undefined>;
+    raw?: {
+        socket?: {
+            remoteAddress?: string | undefined;
+        } | undefined;
+    };
+    body?: unknown;
+    zarex?: Decision;
+}
+interface FastifyReplyLike {
+    code(status: number): this;
+    header(name: string, value: string): this;
+    send(payload?: unknown): this;
+    getHeader?(name: string): unknown;
+    removeHeader?(name: string): unknown;
+    sent?: boolean;
+}
+interface FastifyZarexOptions extends Omit<ZarexOptions, "ipSource"> {
+    /**
+     * Défaut : "framework" — l'adresse est celle de `request.ip`, que Fastify calcule selon l'option
+     * `trustProxy` de VOTRE serveur (`Fastify({ trustProxy: 1 })`). Sans `trustProxy`, Fastify ignore X-Forwarded-For.
+     */
+    ipSource?: ZarexOptions["ipSource"];
+    /** En-têtes de sécurité ajoutés à toutes les réponses (true = défauts prudents). Retire X-Powered-By. */
+    secureHeaders?: SecureHeadersOptions | boolean;
+    /** Surveillance des réponses : enregistrez aussi `zarexFastifyOnSend(options)` comme hook `onSend`. */
+    responseGuard?: ResponseGuardOptions | boolean;
+    /** Nécessite d'enregistrer le hook en `preHandler` (le corps n'est analysé qu'après `onRequest`). */
+    inspectBody?: boolean;
+    onDeny?: (req: FastifyReqLike, reply: FastifyReplyLike, decision: Decision) => void;
+    onDegraded?: (req: FastifyReqLike, decision: Decision) => void;
+    call?: (req: FastifyReqLike) => ProtectCall | undefined;
+}
+/**
+ *   app.addHook("onRequest", zarexFastify({ key, baseUrl, rules: [shield()] }));
+ *
+ * Avec `inspectBody: true`, enregistrez le hook en "preHandler" (pas "onRequest" ci-dessus) :
+ * Fastify n'a pas encore lu le corps en "onRequest", le moteur ne verrait jamais rien.
+ *   app.addHook("preHandler", zarexFastify({ key, baseUrl, rules: [shield()], inspectBody: true }));
+ *
+ * Fonctionne aussi avec NestJS (plateforme Fastify) :
+ *   (app.getHttpAdapter().getInstance() as FastifyInstance).addHook("onRequest", zarexFastify({...}));
+ */
+declare function zarexFastify(options: FastifyZarexOptions | Zarex, extra?: Pick<FastifyZarexOptions, "inspectBody" | "onDeny" | "onDegraded" | "call" | "secureHeaders" | "responseGuard">): (req: FastifyReqLike, reply: FastifyReplyLike) => Promise<void>;
+/**
+ * Hook `onSend` : surveille les corps de réponse TEXTE (string / Buffer) et masque ou bloque les données sensibles.
+ *
+ *   app.addHook("onSend", zarexFastifyOnSend({ responseGuard: true }));
+ *
+ * Les flux (streams) ne sont pas analysés.
+ */
+declare function zarexFastifyOnSend(options: Pick<FastifyZarexOptions, "responseGuard">): (_req: unknown, reply: FastifyReplyLike, payload: unknown) => Promise<unknown>;
+
+export { type FastifyReplyLike, type FastifyReqLike, type FastifyZarexOptions, zarexFastify, zarexFastifyOnSend };

package/dist/index.d.ts

@@ -0,0 +1,63 @@
+import { Decision, ZarexOptions, SecureHeadersOptions, ResponseGuardOptions, ProtectCall, Zarex } from '@zarex/core';
+export { CLOUDFLARE_RANGES, Decision, IpSource, PRIVATE_NETWORKS, ProtectCall, ResponseGuardEvent, ResponseGuardOptions, Rule, SecureHeadersOptions, Zarex, ZarexOptions, createZarex, detectBot, emailValidation, phoneValidation, promptInjection, rateLimit, requestFilter, secureHeaders, sensitiveInfo, shield, tokenBucket, withSecureHeaders } from '@zarex/core';
+
+/** Types minimaux de Fastify (pas de dépendance à `fastify` à l'exécution : Fastify 4 et 5). */
+interface FastifyReqLike {
+    method: string;
+    url: string;
+    ip?: string | undefined;
+    hostname?: string;
+    headers: Record<string, string | string[] | undefined>;
+    raw?: {
+        socket?: {
+            remoteAddress?: string | undefined;
+        } | undefined;
+    };
+    body?: unknown;
+    zarex?: Decision;
+}
+interface FastifyReplyLike {
+    code(status: number): this;
+    header(name: string, value: string): this;
+    send(payload?: unknown): this;
+    getHeader?(name: string): unknown;
+    removeHeader?(name: string): unknown;
+    sent?: boolean;
+}
+interface FastifyZarexOptions extends Omit<ZarexOptions, "ipSource"> {
+    /**
+     * Défaut : "framework" — l'adresse est celle de `request.ip`, que Fastify calcule selon l'option
+     * `trustProxy` de VOTRE serveur (`Fastify({ trustProxy: 1 })`). Sans `trustProxy`, Fastify ignore X-Forwarded-For.
+     */
+    ipSource?: ZarexOptions["ipSource"];
+    /** En-têtes de sécurité ajoutés à toutes les réponses (true = défauts prudents). Retire X-Powered-By. */
+    secureHeaders?: SecureHeadersOptions | boolean;
+    /** Surveillance des réponses : enregistrez aussi `zarexFastifyOnSend(options)` comme hook `onSend`. */
+    responseGuard?: ResponseGuardOptions | boolean;
+    /** Nécessite d'enregistrer le hook en `preHandler` (le corps n'est analysé qu'après `onRequest`). */
+    inspectBody?: boolean;
+    onDeny?: (req: FastifyReqLike, reply: FastifyReplyLike, decision: Decision) => void;
+    onDegraded?: (req: FastifyReqLike, decision: Decision) => void;
+    call?: (req: FastifyReqLike) => ProtectCall | undefined;
+}
+/**
+ *   app.addHook("onRequest", zarexFastify({ key, baseUrl, rules: [shield()] }));
+ *
+ * Avec `inspectBody: true`, enregistrez le hook en "preHandler" (pas "onRequest" ci-dessus) :
+ * Fastify n'a pas encore lu le corps en "onRequest", le moteur ne verrait jamais rien.
+ *   app.addHook("preHandler", zarexFastify({ key, baseUrl, rules: [shield()], inspectBody: true }));
+ *
+ * Fonctionne aussi avec NestJS (plateforme Fastify) :
+ *   (app.getHttpAdapter().getInstance() as FastifyInstance).addHook("onRequest", zarexFastify({...}));
+ */
+declare function zarexFastify(options: FastifyZarexOptions | Zarex, extra?: Pick<FastifyZarexOptions, "inspectBody" | "onDeny" | "onDegraded" | "call" | "secureHeaders" | "responseGuard">): (req: FastifyReqLike, reply: FastifyReplyLike) => Promise<void>;
+/**
+ * Hook `onSend` : surveille les corps de réponse TEXTE (string / Buffer) et masque ou bloque les données sensibles.
+ *
+ *   app.addHook("onSend", zarexFastifyOnSend({ responseGuard: true }));
+ *
+ * Les flux (streams) ne sont pas analysés.
+ */
+declare function zarexFastifyOnSend(options: Pick<FastifyZarexOptions, "responseGuard">): (_req: unknown, reply: FastifyReplyLike, payload: unknown) => Promise<unknown>;
+
+export { type FastifyReplyLike, type FastifyReqLike, type FastifyZarexOptions, zarexFastify, zarexFastifyOnSend };

package/dist/index.js

@@ -0,0 +1,158 @@
+// src/index.ts
+import {
+  applyGuard,
+  createZarex,
+  isLocalHost,
+  isScannableContentType,
+  normalizeGuardOptions,
+  prepareSecureHeaders
+} from "@zarex/core";
+import {
+  shield,
+  rateLimit,
+  tokenBucket,
+  detectBot,
+  requestFilter,
+  sensitiveInfo,
+  emailValidation,
+  phoneValidation,
+  promptInjection,
+  secureHeaders,
+  withSecureHeaders,
+  createZarex as createZarex2,
+  PRIVATE_NETWORKS,
+  CLOUDFLARE_RANGES
+} from "@zarex/core";
+function requestLooksLikeItHasAnUnparsedBody(req) {
+  if (req.body !== void 0) return false;
+  const te = req.headers["transfer-encoding"];
+  if (typeof te === "string" ? te.length > 0 : Array.isArray(te) && te.length > 0) return true;
+  const cl = req.headers["content-length"];
+  const clNum = typeof cl === "string" ? Number(cl) : Array.isArray(cl) ? Number(cl[0]) : NaN;
+  return Number.isFinite(clNum) && clNum > 0;
+}
+function bodyToString(body) {
+  if (body === void 0 || body === null) return void 0;
+  if (typeof body === "string") return body;
+  try {
+    const s = JSON.stringify(body);
+    return typeof s === "string" ? s : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function defaultDeny(_req, reply, d) {
+  const limited = d.deniedBy?.ruleType === "RATE_LIMIT" || d.deniedBy?.ruleType === "TOKEN_BUCKET";
+  if (limited) {
+    if (d.retryAfterSeconds !== void 0) reply.header("retry-after", String(d.retryAfterSeconds));
+    reply.code(429).send({ error: { code: "rate_limited", message: "Too many requests", request_id: d.id } });
+  } else {
+    reply.code(403).send({ error: { code: "forbidden", message: "Request blocked", request_id: d.id } });
+  }
+}
+function zarexFastify(options, extra = {}) {
+  const isInstance = typeof options.protect === "function";
+  const opts = isInstance ? extra : options;
+  const instance = isInstance ? options : createZarex({ ...options, ipSource: options.ipSource ?? "framework" });
+  const prepared = prepareSecureHeaders(opts.secureHeaders);
+  let warnedAboutUnparsedBody = false;
+  return async function zarexHook(req, reply) {
+    let decision;
+    try {
+      if (prepared) {
+        const set = isLocalHost(req.hostname ?? (typeof req.headers["host"] === "string" ? req.headers["host"] : void 0)) ? prepared.http : prepared.https;
+        for (const [k, v] of Object.entries(set)) reply.header(k, v);
+        if (prepared.removePoweredBy) reply.removeHeader?.("x-powered-by");
+      }
+    } catch {
+    }
+    try {
+      let call;
+      try {
+        call = opts.call?.(req);
+      } catch {
+        call = void 0;
+      }
+      const host = typeof req.headers["host"] === "string" ? req.headers["host"] : req.hostname;
+      if (opts.inspectBody && !warnedAboutUnparsedBody && requestLooksLikeItHasAnUnparsedBody(req)) {
+        warnedAboutUnparsedBody = true;
+        console.warn(
+          '[zarex] fastify: `inspectBody: true` but request.body is still undefined on a request that has one. This hook is probably registered on "onRequest", where Fastify has not parsed the body yet \u2014 register it as "preHandler" instead, otherwise the body is silently never sent to the engine.'
+        );
+      }
+      decision = await instance.protect(
+        {
+          method: req.method,
+          path: req.url,
+          host,
+          headers: req.headers,
+          socketIp: req.raw?.socket?.remoteAddress,
+          frameworkIp: req.ip,
+          body: opts.inspectBody ? bodyToString(req.body) : void 0
+        },
+        call
+      );
+      req.zarex = decision;
+    } catch {
+      return;
+    }
+    if (decision.denied) {
+      try {
+        (opts.onDeny ?? defaultDeny)(req, reply, decision);
+      } catch {
+        if (!reply.sent) defaultDeny(req, reply, decision);
+      }
+      return;
+    }
+    if (decision.degraded && opts.onDegraded) {
+      try {
+        opts.onDegraded(req, decision);
+      } catch {
+      }
+    }
+  };
+}
+function zarexFastifyOnSend(options) {
+  const guard = normalizeGuardOptions(options.responseGuard);
+  const decoder = new TextDecoder("utf-8");
+  return async function onSend(_req, reply, payload) {
+    if (!guard) return payload;
+    try {
+      const ct = String(reply.getHeader?.("content-type") ?? "");
+      const isString = typeof payload === "string";
+      const isBytes = payload instanceof Uint8Array;
+      if (!(isString || isBytes) || !isScannableContentType(ct)) return payload;
+      const r = applyGuard(isString ? payload : decoder.decode(payload), ct, guard);
+      if (r.action === "masked" || r.action === "blocked") {
+        reply.removeHeader?.("content-length");
+        reply.removeHeader?.("etag");
+        if (r.action === "blocked") {
+          reply.code(500);
+          reply.header("content-type", "application/json; charset=utf-8");
+        }
+        return r.body;
+      }
+    } catch {
+    }
+    return payload;
+  };
+}
+export {
+  CLOUDFLARE_RANGES,
+  PRIVATE_NETWORKS,
+  createZarex2 as createZarex,
+  detectBot,
+  emailValidation,
+  phoneValidation,
+  promptInjection,
+  rateLimit,
+  requestFilter,
+  secureHeaders,
+  sensitiveInfo,
+  shield,
+  tokenBucket,
+  withSecureHeaders,
+  zarexFastify,
+  zarexFastifyOnSend
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import {\r\n  applyGuard,\r\n  createZarex,\r\n  isLocalHost,\r\n  isScannableContentType,\r\n  normalizeGuardOptions,\r\n  prepareSecureHeaders,\r\n  type Decision,\r\n  type ProtectCall,\r\n  type ResponseGuardOptions,\r\n  type SecureHeadersOptions,\r\n  type Zarex,\r\n  type ZarexOptions,\r\n} from \"@zarex/core\";\r\n\r\n/** Types minimaux de Fastify (pas de dépendance à `fastify` à l'exécution : Fastify 4 et 5). */\r\nexport interface FastifyReqLike {\r\n  method: string;\r\n  url: string;\r\n  ip?: string | undefined;\r\n  hostname?: string;\r\n  headers: Record<string, string | string[] | undefined>;\r\n  raw?: { socket?: { remoteAddress?: string | undefined } | undefined };\r\n  body?: unknown;\r\n  zarex?: Decision;\r\n}\r\nexport interface FastifyReplyLike {\r\n  code(status: number): this;\r\n  header(name: string, value: string): this;\r\n  send(payload?: unknown): this;\r\n  getHeader?(name: string): unknown;\r\n  removeHeader?(name: string): unknown;\r\n  sent?: boolean;\r\n}\r\n\r\nexport interface FastifyZarexOptions extends Omit<ZarexOptions, \"ipSource\"> {\r\n  /**\r\n   * Défaut : \"framework\" — l'adresse est celle de `request.ip`, que Fastify calcule selon l'option\r\n   * `trustProxy` de VOTRE serveur (`Fastify({ trustProxy: 1 })`). Sans `trustProxy`, Fastify ignore X-Forwarded-For.\r\n   */\r\n  ipSource?: ZarexOptions[\"ipSource\"];\r\n  /** En-têtes de sécurité ajoutés à toutes les réponses (true = défauts prudents). Retire X-Powered-By. */\r\n  secureHeaders?: SecureHeadersOptions | boolean;\r\n  /** Surveillance des réponses : enregistrez aussi `zarexFastifyOnSend(options)` comme hook `onSend`. */\r\n  responseGuard?: ResponseGuardOptions | boolean;\r\n  /** Nécessite d'enregistrer le hook en `preHandler` (le corps n'est analysé qu'après `onRequest`). */\r\n  inspectBody?: boolean;\r\n  onDeny?: (req: FastifyReqLike, reply: FastifyReplyLike, decision: Decision) => void;\r\n  onDegraded?: (req: FastifyReqLike, decision: Decision) => void;\r\n  call?: (req: FastifyReqLike) => ProtectCall | undefined;\r\n}\r\n\r\n// Trouvé lors de l'audit du 04/11/2026 (voir AUDIT_SECURITE_COMPLET.md) : l'exemple JSDoc principal\r\n// de ce fichier montre le hook enregistré en \"onRequest\", où Fastify n'a pas encore analysé le\r\n// corps — `inspectBody: true` n'y transmet alors jamais rien au moteur, SANS AUCUN avertissement.\r\n// Heuristique : `req.body` indéfini alors que la requête annonce clairement un corps\r\n// (Content-Length > 0 ou Transfer-Encoding) signale presque certainement ce piège plutôt qu'une\r\n// requête sans corps (GET…), pour laquelle il n'y a rien à signaler.\r\nfunction requestLooksLikeItHasAnUnparsedBody(req: FastifyReqLike): boolean {\r\n  if (req.body !== undefined) return false;\r\n  const te = req.headers[\"transfer-encoding\"];\r\n  if (typeof te === \"string\" ? te.length > 0 : Array.isArray(te) && te.length > 0) return true;\r\n  const cl = req.headers[\"content-length\"];\r\n  const clNum = typeof cl === \"string\" ? Number(cl) : Array.isArray(cl) ? Number(cl[0]) : NaN;\r\n  return Number.isFinite(clNum) && clNum > 0;\r\n}\r\n\r\nfunction bodyToString(body: unknown): string | undefined {\r\n  if (body === undefined || body === null) return undefined;\r\n  if (typeof body === \"string\") return body;\r\n  try {\r\n    const s = JSON.stringify(body);\r\n    return typeof s === \"string\" ? s : undefined;\r\n  } catch {\r\n    return undefined;\r\n  }\r\n}\r\n\r\nfunction defaultDeny(_req: FastifyReqLike, reply: FastifyReplyLike, d: Decision): void {\r\n  const limited = d.deniedBy?.ruleType === \"RATE_LIMIT\" || d.deniedBy?.ruleType === \"TOKEN_BUCKET\";\r\n  if (limited) {\r\n    if (d.retryAfterSeconds !== undefined) reply.header(\"retry-after\", String(d.retryAfterSeconds));\r\n    reply.code(429).send({ error: { code: \"rate_limited\", message: \"Too many requests\", request_id: d.id } });\r\n  } else {\r\n    reply.code(403).send({ error: { code: \"forbidden\", message: \"Request blocked\", request_id: d.id } });\r\n  }\r\n}\r\n\r\n/**\r\n *   app.addHook(\"onRequest\", zarexFastify({ key, baseUrl, rules: [shield()] }));\r\n *\r\n * Avec `inspectBody: true`, enregistrez le hook en \"preHandler\" (pas \"onRequest\" ci-dessus) :\r\n * Fastify n'a pas encore lu le corps en \"onRequest\", le moteur ne verrait jamais rien.\r\n *   app.addHook(\"preHandler\", zarexFastify({ key, baseUrl, rules: [shield()], inspectBody: true }));\r\n *\r\n * Fonctionne aussi avec NestJS (plateforme Fastify) :\r\n *   (app.getHttpAdapter().getInstance() as FastifyInstance).addHook(\"onRequest\", zarexFastify({...}));\r\n */\r\nexport function zarexFastify(options: FastifyZarexOptions | Zarex, extra: Pick<FastifyZarexOptions, \"inspectBody\" | \"onDeny\" | \"onDegraded\" | \"call\" | \"secureHeaders\" | \"responseGuard\"> = {}) {\r\n  const isInstance = typeof (options as Zarex).protect === \"function\";\r\n  const opts = (isInstance ? extra : options) as FastifyZarexOptions;\r\n  const instance: Zarex = isInstance\r\n    ? (options as Zarex)\r\n    : createZarex({ ...(options as FastifyZarexOptions), ipSource: (options as FastifyZarexOptions).ipSource ?? \"framework\" });\r\n\r\n  const prepared = prepareSecureHeaders(opts.secureHeaders);\r\n  let warnedAboutUnparsedBody = false;\r\n\r\n  return async function zarexHook(req: FastifyReqLike, reply: FastifyReplyLike): Promise<void> {\r\n    let decision: Decision;\r\n    try {\r\n      if (prepared) {\r\n        const set = isLocalHost(req.hostname ?? (typeof req.headers[\"host\"] === \"string\" ? (req.headers[\"host\"] as string) : undefined)) ? prepared.http : prepared.https;\r\n        for (const [k, v] of Object.entries(set)) reply.header(k, v);\r\n        if (prepared.removePoweredBy) reply.removeHeader?.(\"x-powered-by\");\r\n      }\r\n    } catch {\r\n      /* sans effet sur la requête */\r\n    }\r\n    try {\r\n      let call: ProtectCall | undefined;\r\n      try {\r\n        call = opts.call?.(req);\r\n      } catch {\r\n        call = undefined;\r\n      }\r\n      const host = typeof req.headers[\"host\"] === \"string\" ? (req.headers[\"host\"] as string) : req.hostname;\r\n      if (opts.inspectBody && !warnedAboutUnparsedBody && requestLooksLikeItHasAnUnparsedBody(req)) {\r\n        warnedAboutUnparsedBody = true;\r\n        console.warn(\r\n          '[zarex] fastify: `inspectBody: true` but request.body is still undefined on a request that has one. ' +\r\n            'This hook is probably registered on \"onRequest\", where Fastify has not parsed the body yet — register it ' +\r\n            'as \"preHandler\" instead, otherwise the body is silently never sent to the engine.'\r\n        );\r\n      }\r\n      decision = await instance.protect(\r\n        {\r\n          method: req.method,\r\n          path: req.url,\r\n          host,\r\n          headers: req.headers,\r\n          socketIp: req.raw?.socket?.remoteAddress,\r\n          frameworkIp: req.ip,\r\n          body: opts.inspectBody ? bodyToString(req.body) : undefined,\r\n        },\r\n        call\r\n      );\r\n      req.zarex = decision;\r\n    } catch {\r\n      return;\r\n    }\r\n    if (decision.denied) {\r\n      try {\r\n        (opts.onDeny ?? defaultDeny)(req, reply, decision);\r\n      } catch {\r\n        /* si le refus personnalisé échoue, on retombe sur le refus par défaut */\r\n        if (!reply.sent) defaultDeny(req, reply, decision);\r\n      }\r\n      return; // async hook : la réponse est déjà envoyée, Fastify s'arrête là (reply.sent)\r\n    }\r\n    if (decision.degraded && opts.onDegraded) {\r\n      try {\r\n        opts.onDegraded(req, decision);\r\n      } catch {\r\n        /* sans effet sur la requête */\r\n      }\r\n    }\r\n  };\r\n}\r\n\r\n/**\r\n * Hook `onSend` : surveille les corps de réponse TEXTE (string / Buffer) et masque ou bloque les données sensibles.\r\n *\r\n *   app.addHook(\"onSend\", zarexFastifyOnSend({ responseGuard: true }));\r\n *\r\n * Les flux (streams) ne sont pas analysés.\r\n */\r\nexport function zarexFastifyOnSend(options: Pick<FastifyZarexOptions, \"responseGuard\">) {\r\n  const guard = normalizeGuardOptions(options.responseGuard);\r\n  const decoder = new TextDecoder(\"utf-8\");\r\n  return async function onSend(_req: unknown, reply: FastifyReplyLike, payload: unknown): Promise<unknown> {\r\n    if (!guard) return payload;\r\n    try {\r\n      const ct = String(reply.getHeader?.(\"content-type\") ?? \"\");\r\n      const isString = typeof payload === \"string\";\r\n      const isBytes = payload instanceof Uint8Array;\r\n      if (!(isString || isBytes) || !isScannableContentType(ct)) return payload;\r\n      const r = applyGuard(isString ? payload : decoder.decode(payload), ct, guard);\r\n      if (r.action === \"masked\" || r.action === \"blocked\") {\r\n        reply.removeHeader?.(\"content-length\"); // Fastify le recalcule\r\n        reply.removeHeader?.(\"etag\");\r\n        if (r.action === \"blocked\") {\r\n          reply.code(500);\r\n          reply.header(\"content-type\", \"application/json; charset=utf-8\");\r\n        }\r\n        return r.body;\r\n      }\r\n    } catch {\r\n      /* jamais casser la réponse */\r\n    }\r\n    return payload;\r\n  };\r\n}\r\n\r\nexport {\r\n  shield,\r\n  rateLimit,\r\n  tokenBucket,\r\n  detectBot,\r\n  requestFilter,\r\n  sensitiveInfo,\r\n  emailValidation,\r\n  phoneValidation,\r\n  promptInjection,\r\n  secureHeaders,\r\n  withSecureHeaders,\r\n  createZarex,\r\n  PRIVATE_NETWORKS,\r\n  CLOUDFLARE_RANGES,\r\n} from \"@zarex/core\";\r\nexport type { SecureHeadersOptions, ResponseGuardOptions, ResponseGuardEvent } from \"@zarex/core\";\r\nexport type { Decision, Zarex, ZarexOptions, IpSource, Rule, ProtectCall } from \"@zarex/core\";"],"mappings":";AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAOK;AA+LP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,eAAAA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAjKP,SAAS,oCAAoC,KAA8B;AACzE,MAAI,IAAI,SAAS,OAAW,QAAO;AACnC,QAAM,KAAK,IAAI,QAAQ,mBAAmB;AAC1C,MAAI,OAAO,OAAO,WAAW,GAAG,SAAS,IAAI,MAAM,QAAQ,EAAE,KAAK,GAAG,SAAS,EAAG,QAAO;AACxF,QAAM,KAAK,IAAI,QAAQ,gBAAgB;AACvC,QAAM,QAAQ,OAAO,OAAO,WAAW,OAAO,EAAE,IAAI,MAAM,QAAQ,EAAE,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI;AACxF,SAAO,OAAO,SAAS,KAAK,KAAK,QAAQ;AAC3C;AAEA,SAAS,aAAa,MAAmC;AACvD,MAAI,SAAS,UAAa,SAAS,KAAM,QAAO;AAChD,MAAI,OAAO,SAAS,SAAU,QAAO;AACrC,MAAI;AACF,UAAM,IAAI,KAAK,UAAU,IAAI;AAC7B,WAAO,OAAO,MAAM,WAAW,IAAI;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,YAAY,MAAsB,OAAyB,GAAmB;AACrF,QAAM,UAAU,EAAE,UAAU,aAAa,gBAAgB,EAAE,UAAU,aAAa;AAClF,MAAI,SAAS;AACX,QAAI,EAAE,sBAAsB,OAAW,OAAM,OAAO,eAAe,OAAO,EAAE,iBAAiB,CAAC;AAC9F,UAAM,KAAK,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,SAAS,qBAAqB,YAAY,EAAE,GAAG,EAAE,CAAC;AAAA,EAC1G,OAAO;AACL,UAAM,KAAK,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,SAAS,mBAAmB,YAAY,EAAE,GAAG,EAAE,CAAC;AAAA,EACrG;AACF;AAYO,SAAS,aAAa,SAAsC,QAAyH,CAAC,GAAG;AAC9L,QAAM,aAAa,OAAQ,QAAkB,YAAY;AACzD,QAAM,OAAQ,aAAa,QAAQ;AACnC,QAAM,WAAkB,aACnB,UACD,YAAY,EAAE,GAAI,SAAiC,UAAW,QAAgC,YAAY,YAAY,CAAC;AAE3H,QAAM,WAAW,qBAAqB,KAAK,aAAa;AACxD,MAAI,0BAA0B;AAE9B,SAAO,eAAe,UAAU,KAAqB,OAAwC;AAC3F,QAAI;AACJ,QAAI;AACF,UAAI,UAAU;AACZ,cAAM,MAAM,YAAY,IAAI,aAAa,OAAO,IAAI,QAAQ,MAAM,MAAM,WAAY,IAAI,QAAQ,MAAM,IAAe,OAAU,IAAI,SAAS,OAAO,SAAS;AAC5J,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,GAAG,EAAG,OAAM,OAAO,GAAG,CAAC;AAC3D,YAAI,SAAS,gBAAiB,OAAM,eAAe,cAAc;AAAA,MACnE;AAAA,IACF,QAAQ;AAAA,IAER;AACA,QAAI;AACF,UAAI;AACJ,UAAI;AACF,eAAO,KAAK,OAAO,GAAG;AAAA,MACxB,QAAQ;AACN,eAAO;AAAA,MACT;AACA,YAAM,OAAO,OAAO,IAAI,QAAQ,MAAM,MAAM,WAAY,IAAI,QAAQ,MAAM,IAAe,IAAI;AAC7F,UAAI,KAAK,eAAe,CAAC,2BAA2B,oCAAoC,GAAG,GAAG;AAC5F,kCAA0B;AAC1B,gBAAQ;AAAA,UACN;AAAA,QAGF;AAAA,MACF;AACA,iBAAW,MAAM,SAAS;AAAA,QACxB;AAAA,UACE,QAAQ,IAAI;AAAA,UACZ,MAAM,IAAI;AAAA,UACV;AAAA,UACA,SAAS,IAAI;AAAA,UACb,UAAU,IAAI,KAAK,QAAQ;AAAA,UAC3B,aAAa,IAAI;AAAA,UACjB,MAAM,KAAK,cAAc,aAAa,IAAI,IAAI,IAAI;AAAA,QACpD;AAAA,QACA;AAAA,MACF;AACA,UAAI,QAAQ;AAAA,IACd,QAAQ;AACN;AAAA,IACF;AACA,QAAI,SAAS,QAAQ;AACnB,UAAI;AACF,SAAC,KAAK,UAAU,aAAa,KAAK,OAAO,QAAQ;AAAA,MACnD,QAAQ;AAEN,YAAI,CAAC,MAAM,KAAM,aAAY,KAAK,OAAO,QAAQ;AAAA,MACnD;AACA;AAAA,IACF;AACA,QAAI,SAAS,YAAY,KAAK,YAAY;AACxC,UAAI;AACF,aAAK,WAAW,KAAK,QAAQ;AAAA,MAC/B,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACF;AASO,SAAS,mBAAmB,SAAqD;AACtF,QAAM,QAAQ,sBAAsB,QAAQ,aAAa;AACzD,QAAM,UAAU,IAAI,YAAY,OAAO;AACvC,SAAO,eAAe,OAAO,MAAe,OAAyB,SAAoC;AACvG,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI;AACF,YAAM,KAAK,OAAO,MAAM,YAAY,cAAc,KAAK,EAAE;AACzD,YAAM,WAAW,OAAO,YAAY;AACpC,YAAM,UAAU,mBAAmB;AACnC,UAAI,EAAE,YAAY,YAAY,CAAC,uBAAuB,EAAE,EAAG,QAAO;AAClE,YAAM,IAAI,WAAW,WAAW,UAAU,QAAQ,OAAO,OAAO,GAAG,IAAI,KAAK;AAC5E,UAAI,EAAE,WAAW,YAAY,EAAE,WAAW,WAAW;AACnD,cAAM,eAAe,gBAAgB;AACrC,cAAM,eAAe,MAAM;AAC3B,YAAI,EAAE,WAAW,WAAW;AAC1B,gBAAM,KAAK,GAAG;AACd,gBAAM,OAAO,gBAAgB,iCAAiC;AAAA,QAChE;AACA,eAAO,EAAE;AAAA,MACX;AAAA,IACF,QAAQ;AAAA,IAER;AACA,WAAO;AAAA,EACT;AACF;","names":["createZarex"]}

package/package.json

@@ -1,6 +1,43 @@
 {
   "name": "@zarex/fastify",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "Zarex — Fastify (et NestJS avec Fastify)",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "sideEffects": false,
+  "dependencies": {
+    "@zarex/core": "^0.1.0"
+  },
+  "peerDependencies": {
+    "fastify": ">=4"
+  },
+  "peerDependenciesMeta": {
+    "fastify": {
+      "optional": true
+    }
+  },
+  "scripts": {
+    "build": "tsup"
+  }
 }

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.