@zarex/fastify 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Kodjogbe
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,158 @@
-# Temporary Holding Version
+# @zarex/fastify
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Hook Zarex pour Fastify — protège votre application contre les bots, les abus de trafic, les injections (SQL, XSS, SSRF...) et les fuites de données sensibles, en quelques lignes.
+
+Compatible Fastify 4 et 5 (aucune dépendance à `fastify` à l'exécution). Fonctionne aussi avec NestJS (plateforme Fastify).
+
+## Installation
+
+```bash
+npm install @zarex/fastify
+```
+
+## Démarrage rapide
+
+```ts
+import Fastify from "fastify";
+import { zarexFastify, shield, rateLimit } from "@zarex/fastify";
+
+const app = Fastify();
+
+app.addHook(
+  "onRequest",
+  zarexFastify({
+    key: process.env.ZAREX_KEY!,
+    rules: [shield(), rateLimit({ max: 100, window: "1m" })],
+  })
+);
+
+app.get("/", async () => ({ ok: true }));
+app.listen({ port: 3000 });
+```
+
+Une requête refusée reçoit automatiquement `403 Forbidden` (ou `429 Too Many Requests` avec l'en-tête `retry-after` pour une limite de débit) — sans aucun code supplémentaire.
+
+**Fail-open** : si Zarex est injoignable, lent ou répond de façon inattendue, la requête passe toujours. Une panne chez Zarex ne doit jamais faire tomber votre application.
+
+### Avec NestJS (plateforme Fastify)
+
+```ts
+import type { FastifyInstance } from "fastify";
+(app.getHttpAdapter().getInstance() as FastifyInstance).addHook(
+  "onRequest",
+  zarexFastify({ key, rules: [shield()] })
+);
+```
+
+## L'adresse IP du visiteur
+
+Par défaut (`ipSource` non renseigné), l'adaptateur utilise `request.ip`, calculé par Fastify selon l'option [`trustProxy`](https://fastify.dev/docs/latest/Reference/Server/#trustproxy) de votre serveur :
+
+```ts
+const app = Fastify({ trustProxy: 1 }); // 1 proxy de confiance devant Fastify
+```
+
+Sans `trustProxy`, Fastify ignore `X-Forwarded-For` — configurez-le pour correspondre à **votre** infrastructure réelle, sinon tous vos visiteurs apparaissent sous la même adresse IP et toute règle de limite de débit basée sur l'IP devient inutile.
+
+## Options
+
+```ts
+zarexFastify({
+  key: string,              // obligatoire : clé API du projet
+  rules: Rule[],            // obligatoire : 1 à 10 règles, voir ci-dessous
+  ipSource?: IpSource,      // défaut "framework" (voir ci-dessus)
+  inspectBody?: boolean,    // défaut false — voir "Inspecter le corps"
+  secureHeaders?: boolean | SecureHeadersOptions,
+  responseGuard?: boolean | ResponseGuardOptions, // voir zarexFastifyOnSend ci-dessous
+  onDeny?: (req, reply, decision) => void,
+  onDegraded?: (req, decision) => void,
+  call?: (req) => ProtectCall | undefined,
+  timeoutMs?: number,       // défaut 500 ms
+  breaker?: BreakerOptions | false,
+})
+```
+
+### Inspecter le corps de la requête (`inspectBody`) — attention au hook choisi
+
+```ts
+// ⚠️ "onRequest" : Fastify n'a PAS ENCORE lu le corps à ce stade — inspectBody ne verrait jamais rien.
+app.addHook("onRequest", zarexFastify({ ..., inspectBody: true })); // piège
+
+// ✅ "preHandler" : le corps est déjà disponible.
+app.addHook("preHandler", zarexFastify({ ..., inspectBody: true }));
+```
+
+Si vous enregistrez le hook en `onRequest` avec `inspectBody: true` alors qu'une requête a manifestement un corps (`Content-Length` > 0), un avertissement unique s'affiche dans la console (`console.warn`) pour éviter que cette erreur passe inaperçue.
+
+### En-têtes de sécurité (`secureHeaders`)
+
+```ts
+app.addHook("onRequest", zarexFastify({ ..., secureHeaders: true }));
+```
+
+Ajoutés à **toutes** les réponses, y compris les refus. `true` applique des défauts prudents (HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy...). Retire aussi `x-powered-by`.
+
+### Surveillance des réponses (`responseGuard`) — un hook séparé
+
+```ts
+app.addHook("onSend", zarexFastifyOnSend({ responseGuard: true }));
+```
+
+Contrairement aux autres adaptateurs, Fastify demande d'enregistrer un **second hook** (`onSend`) pour surveiller les réponses de votre application et masquer (ou bloquer) les cartes bancaires, clés d'API, jetons JWT, mots de passe... qui s'y retrouveraient par erreur. Les flux (streams) ne sont pas analysés.
+
+### Identifiants personnalisés (`call`)
+
+```ts
+app.addHook(
+  "preHandler",
+  zarexFastify({
+    key,
+    rules: [rateLimit({ max: 100, window: "1m", characteristics: ["userId"] })],
+    call: (req) => ({ characteristics: { userId: (req as any).user?.id } }),
+  })
+);
+```
+
+Les valeurs sont hachées en SHA-256 avant l'envoi à Zarex. Une erreur dans cette fonction est silencieusement ignorée. `call` peut aussi fournir `tokensRequested`, `email`/`phone` ou `text` (voir [`@zarex/core`](https://www.npmjs.com/package/@zarex/core)).
+
+### Lire le résultat de la décision
+
+```ts
+app.get("/", async (req) => {
+  console.log(req.zarex?.verdict); // "ALLOW" | "DENY" | "ERROR"
+  return { ok: true };
+});
+```
+
+## Règles disponibles
+
+| Fonction | Résumé |
+|---|---|
+| `shield(opts?)` | Pare-feu applicatif : injection SQL, XSS, traversée de répertoires, SSRF, SSTI... |
+| `rateLimit({ max, window, ... })` | Limite de requêtes par visiteur sur une fenêtre de temps. |
+| `tokenBucket({ capacity, refillRate, interval })` | Budget de jetons avec pics autorisés. |
+| `detectBot(opts?)` | Détecte les robots connus, avec vérification DNS inversée. |
+| `requestFilter({ expressions, logic })` | Règles personnalisées sur IP, chemin, en-têtes, cookies, pays... |
+| `sensitiveInfo(opts?)` | Refuse une requête contenant une donnée sensible (nécessite `inspectBody`). |
+| `emailValidation(opts?)` | Valide un email donné via `call: () => ({ email })`. |
+| `phoneValidation(opts?)` | Valide un numéro donné, orienté opérateurs africains (MTN, Moov, Orange, Wave...). |
+| `promptInjection(opts?)` | Détecte les tentatives de manipulation d'un assistant IA, via `call: () => ({ text })`. |
+
+Chaque règle accepte `mode: "LIVE" | "DRY_RUN" | "OFF"`. Détails complets des options : voir [`@zarex/core`](https://www.npmjs.com/package/@zarex/core).
+
+## Réponse de refus personnalisée (`onDeny`)
+
+```ts
+zarexFastify({
+  ...,
+  onDeny: (req, reply, decision) => {
+    reply.code(403).send({ message: "Accès refusé", id: decision.id });
+  },
+});
+```
+
+Sans `onDeny`, la réponse par défaut est `403` (ou `429` + `retry-after`), au format `{ error: { code, message, request_id } }`.
+
+## Licence
+
+MIT

package/dist/index.cjs

@@ -0,0 +1,176 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  CLOUDFLARE_RANGES: () => import_core2.CLOUDFLARE_RANGES,
+  PRIVATE_NETWORKS: () => import_core2.PRIVATE_NETWORKS,
+  createZarex: () => import_core2.createZarex,
+  detectBot: () => import_core2.detectBot,
+  emailValidation: () => import_core2.emailValidation,
+  phoneValidation: () => import_core2.phoneValidation,
+  promptInjection: () => import_core2.promptInjection,
+  rateLimit: () => import_core2.rateLimit,
+  requestFilter: () => import_core2.requestFilter,
+  secureHeaders: () => import_core2.secureHeaders,
+  sensitiveInfo: () => import_core2.sensitiveInfo,
+  shield: () => import_core2.shield,
+  tokenBucket: () => import_core2.tokenBucket,
+  withSecureHeaders: () => import_core2.withSecureHeaders,
+  zarexFastify: () => zarexFastify,
+  zarexFastifyOnSend: () => zarexFastifyOnSend
+});
+module.exports = __toCommonJS(index_exports);
+var import_core = require("@zarex/core");
+var import_core2 = require("@zarex/core");
+function requestLooksLikeItHasAnUnparsedBody(req) {
+  if (req.body !== void 0) return false;
+  const te = req.headers["transfer-encoding"];
+  if (typeof te === "string" ? te.length > 0 : Array.isArray(te) && te.length > 0) return true;
+  const cl = req.headers["content-length"];
+  const clNum = typeof cl === "string" ? Number(cl) : Array.isArray(cl) ? Number(cl[0]) : NaN;
+  return Number.isFinite(clNum) && clNum > 0;
+}
+function bodyToString(body) {
+  if (body === void 0 || body === null) return void 0;
+  if (typeof body === "string") return body;
+  try {
+    const s = JSON.stringify(body);
+    return typeof s === "string" ? s : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function defaultDeny(_req, reply, d) {
+  const limited = d.deniedBy?.ruleType === "RATE_LIMIT" || d.deniedBy?.ruleType === "TOKEN_BUCKET";
+  if (limited) {
+    if (d.retryAfterSeconds !== void 0) reply.header("retry-after", String(d.retryAfterSeconds));
+    reply.code(429).send({ error: { code: "rate_limited", message: "Too many requests", request_id: d.id } });
+  } else {
+    reply.code(403).send({ error: { code: "forbidden", message: "Request blocked", request_id: d.id } });
+  }
+}
+function zarexFastify(options, extra = {}) {
+  const isInstance = typeof options.protect === "function";
+  const opts = isInstance ? extra : options;
+  const instance = isInstance ? options : (0, import_core.createZarex)({ ...options, ipSource: options.ipSource ?? "framework" });
+  const prepared = (0, import_core.prepareSecureHeaders)(opts.secureHeaders);
+  let warnedAboutUnparsedBody = false;
+  return async function zarexHook(req, reply) {
+    let decision;
+    try {
+      if (prepared) {
+        const set = (0, import_core.isLocalHost)(req.hostname ?? (typeof req.headers["host"] === "string" ? req.headers["host"] : void 0)) ? prepared.http : prepared.https;
+        for (const [k, v] of Object.entries(set)) reply.header(k, v);
+        if (prepared.removePoweredBy) reply.removeHeader?.("x-powered-by");
+      }
+    } catch {
+    }
+    try {
+      let call;
+      try {
+        call = opts.call?.(req);
+      } catch {
+        call = void 0;
+      }
+      const host = typeof req.headers["host"] === "string" ? req.headers["host"] : req.hostname;
+      if (opts.inspectBody && !warnedAboutUnparsedBody && requestLooksLikeItHasAnUnparsedBody(req)) {
+        warnedAboutUnparsedBody = true;
+        console.warn(
+          '[zarex] fastify: `inspectBody: true` but request.body is still undefined on a request that has one. This hook is probably registered on "onRequest", where Fastify has not parsed the body yet \u2014 register it as "preHandler" instead, otherwise the body is silently never sent to the engine.'
+        );
+      }
+      decision = await instance.protect(
+        {
+          method: req.method,
+          path: req.url,
+          host,
+          headers: req.headers,
+          socketIp: req.raw?.socket?.remoteAddress,
+          frameworkIp: req.ip,
+          body: opts.inspectBody ? bodyToString(req.body) : void 0
+        },
+        call
+      );
+      req.zarex = decision;
+    } catch {
+      return;
+    }
+    if (decision.denied) {
+      try {
+        (opts.onDeny ?? defaultDeny)(req, reply, decision);
+      } catch {
+        if (!reply.sent) defaultDeny(req, reply, decision);
+      }
+      return;
+    }
+    if (decision.degraded && opts.onDegraded) {
+      try {
+        opts.onDegraded(req, decision);
+      } catch {
+      }
+    }
+  };
+}
+function zarexFastifyOnSend(options) {
+  const guard = (0, import_core.normalizeGuardOptions)(options.responseGuard);
+  const decoder = new TextDecoder("utf-8");
+  return async function onSend(_req, reply, payload) {
+    if (!guard) return payload;
+    try {
+      const ct = String(reply.getHeader?.("content-type") ?? "");
+      const isString = typeof payload === "string";
+      const isBytes = payload instanceof Uint8Array;
+      if (!(isString || isBytes) || !(0, import_core.isScannableContentType)(ct)) return payload;
+      const r = (0, import_core.applyGuard)(isString ? payload : decoder.decode(payload), ct, guard);
+      if (r.action === "masked" || r.action === "blocked") {
+        reply.removeHeader?.("content-length");
+        reply.removeHeader?.("etag");
+        if (r.action === "blocked") {
+          reply.code(500);
+          reply.header("content-type", "application/json; charset=utf-8");
+        }
+        return r.body;
+      }
+    } catch {
+    }
+    return payload;
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CLOUDFLARE_RANGES,
+  PRIVATE_NETWORKS,
+  createZarex,
+  detectBot,
+  emailValidation,
+  phoneValidation,
+  promptInjection,
+  rateLimit,
+  requestFilter,
+  secureHeaders,
+  sensitiveInfo,
+  shield,
+  tokenBucket,
+  withSecureHeaders,
+  zarexFastify,
+  zarexFastifyOnSend
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import {\r\n  applyGuard,\r\n  createZarex,\r\n  isLocalHost,\r\n  isScannableContentType,\r\n  normalizeGuardOptions,\r\n  prepareSecureHeaders,\r\n  type Decision,\r\n  type ProtectCall,\r\n  type ResponseGuardOptions,\r\n  type SecureHeadersOptions,\r\n  type Zarex,\r\n  type ZarexOptions,\r\n} from \"@zarex/core\";\r\n\r\n/** Types minimaux de Fastify (pas de dépendance à `fastify` à l'exécution : Fastify 4 et 5). */\r\nexport interface FastifyReqLike {\r\n  method: string;\r\n  url: string;\r\n  ip?: string | undefined;\r\n  hostname?: string;\r\n  headers: Record<string, string | string[] | undefined>;\r\n  raw?: { socket?: { remoteAddress?: string | undefined } | undefined };\r\n  body?: unknown;\r\n  zarex?: Decision;\r\n}\r\nexport interface FastifyReplyLike {\r\n  code(status: number): this;\r\n  header(name: string, value: string): this;\r\n  send(payload?: unknown): this;\r\n  getHeader?(name: string): unknown;\r\n  removeHeader?(name: string): unknown;\r\n  sent?: boolean;\r\n}\r\n\r\nexport interface FastifyZarexOptions extends Omit<ZarexOptions, \"ipSource\"> {\r\n  /**\r\n   * Défaut : \"framework\" — l'adresse est celle de `request.ip`, que Fastify calcule selon l'option\r\n   * `trustProxy` de VOTRE serveur (`Fastify({ trustProxy: 1 })`). Sans `trustProxy`, Fastify ignore X-Forwarded-For.\r\n   */\r\n  ipSource?: ZarexOptions[\"ipSource\"];\r\n  /** En-têtes de sécurité ajoutés à toutes les réponses (true = défauts prudents). Retire X-Powered-By. */\r\n  secureHeaders?: SecureHeadersOptions | boolean;\r\n  /** Surveillance des réponses : enregistrez aussi `zarexFastifyOnSend(options)` comme hook `onSend`. */\r\n  responseGuard?: ResponseGuardOptions | boolean;\r\n  /** Nécessite d'enregistrer le hook en `preHandler` (le corps n'est analysé qu'après `onRequest`). */\r\n  inspectBody?: boolean;\r\n  onDeny?: (req: FastifyReqLike, reply: FastifyReplyLike, decision: Decision) => void;\r\n  onDegraded?: (req: FastifyReqLike, decision: Decision) => void;\r\n  call?: (req: FastifyReqLike) => ProtectCall | undefined;\r\n}\r\n\r\n// Trouvé lors de l'audit du 04/11/2026 (voir AUDIT_SECURITE_COMPLET.md) : l'exemple JSDoc principal\r\n// de ce fichier montre le hook enregistré en \"onRequest\", où Fastify n'a pas encore analysé le\r\n// corps — `inspectBody: true` n'y transmet alors jamais rien au moteur, SANS AUCUN avertissement.\r\n// Heuristique : `req.body` indéfini alors que la requête annonce clairement un corps\r\n// (Content-Length > 0 ou Transfer-Encoding) signale presque certainement ce piège plutôt qu'une\r\n// requête sans corps (GET…), pour laquelle il n'y a rien à signaler.\r\nfunction requestLooksLikeItHasAnUnparsedBody(req: FastifyReqLike): boolean {\r\n  if (req.body !== undefined) return false;\r\n  const te = req.headers[\"transfer-encoding\"];\r\n  if (typeof te === \"string\" ? te.length > 0 : Array.isArray(te) && te.length > 0) return true;\r\n  const cl = req.headers[\"content-length\"];\r\n  const clNum = typeof cl === \"string\" ? Number(cl) : Array.isArray(cl) ? Number(cl[0]) : NaN;\r\n  return Number.isFinite(clNum) && clNum > 0;\r\n}\r\n\r\nfunction bodyToString(body: unknown): string | undefined {\r\n  if (body === undefined || body === null) return undefined;\r\n  if (typeof body === \"string\") return body;\r\n  try {\r\n    const s = JSON.stringify(body);\r\n    return typeof s === \"string\" ? s : undefined;\r\n  } catch {\r\n    return undefined;\r\n  }\r\n}\r\n\r\nfunction defaultDeny(_req: FastifyReqLike, reply: FastifyReplyLike, d: Decision): void {\r\n  const limited = d.deniedBy?.ruleType === \"RATE_LIMIT\" || d.deniedBy?.ruleType === \"TOKEN_BUCKET\";\r\n  if (limited) {\r\n    if (d.retryAfterSeconds !== undefined) reply.header(\"retry-after\", String(d.retryAfterSeconds));\r\n    reply.code(429).send({ error: { code: \"rate_limited\", message: \"Too many requests\", request_id: d.id } });\r\n  } else {\r\n    reply.code(403).send({ error: { code: \"forbidden\", message: \"Request blocked\", request_id: d.id } });\r\n  }\r\n}\r\n\r\n/**\r\n *   app.addHook(\"onRequest\", zarexFastify({ key, baseUrl, rules: [shield()] }));\r\n *\r\n * Avec `inspectBody: true`, enregistrez le hook en \"preHandler\" (pas \"onRequest\" ci-dessus) :\r\n * Fastify n'a pas encore lu le corps en \"onRequest\", le moteur ne verrait jamais rien.\r\n *   app.addHook(\"preHandler\", zarexFastify({ key, baseUrl, rules: [shield()], inspectBody: true }));\r\n *\r\n * Fonctionne aussi avec NestJS (plateforme Fastify) :\r\n *   (app.getHttpAdapter().getInstance() as FastifyInstance).addHook(\"onRequest\", zarexFastify({...}));\r\n */\r\nexport function zarexFastify(options: FastifyZarexOptions | Zarex, extra: Pick<FastifyZarexOptions, \"inspectBody\" | \"onDeny\" | \"onDegraded\" | \"call\" | \"secureHeaders\" | \"responseGuard\"> = {}) {\r\n  const isInstance = typeof (options as Zarex).protect === \"function\";\r\n  const opts = (isInstance ? extra : options) as FastifyZarexOptions;\r\n  const instance: Zarex = isInstance\r\n    ? (options as Zarex)\r\n    : createZarex({ ...(options as FastifyZarexOptions), ipSource: (options as FastifyZarexOptions).ipSource ?? \"framework\" });\r\n\r\n  const prepared = prepareSecureHeaders(opts.secureHeaders);\r\n  let warnedAboutUnparsedBody = false;\r\n\r\n  return async function zarexHook(req: FastifyReqLike, reply: FastifyReplyLike): Promise<void> {\r\n    let decision: Decision;\r\n    try {\r\n      if (prepared) {\r\n        const set = isLocalHost(req.hostname ?? (typeof req.headers[\"host\"] === \"string\" ? (req.headers[\"host\"] as string) : undefined)) ? prepared.http : prepared.https;\r\n        for (const [k, v] of Object.entries(set)) reply.header(k, v);\r\n        if (prepared.removePoweredBy) reply.removeHeader?.(\"x-powered-by\");\r\n      }\r\n    } catch {\r\n      /* sans effet sur la requête */\r\n    }\r\n    try {\r\n      let call: ProtectCall | undefined;\r\n      try {\r\n        call = opts.call?.(req);\r\n      } catch {\r\n        call = undefined;\r\n      }\r\n      const host = typeof req.headers[\"host\"] === \"string\" ? (req.headers[\"host\"] as string) : req.hostname;\r\n      if (opts.inspectBody && !warnedAboutUnparsedBody && requestLooksLikeItHasAnUnparsedBody(req)) {\r\n        warnedAboutUnparsedBody = true;\r\n        console.warn(\r\n          '[zarex] fastify: `inspectBody: true` but request.body is still undefined on a request that has one. ' +\r\n            'This hook is probably registered on \"onRequest\", where Fastify has not parsed the body yet — register it ' +\r\n            'as \"preHandler\" instead, otherwise the body is silently never sent to the engine.'\r\n        );\r\n      }\r\n      decision = await instance.protect(\r\n        {\r\n          method: req.method,\r\n          path: req.url,\r\n          host,\r\n          headers: req.headers,\r\n          socketIp: req.raw?.socket?.remoteAddress,\r\n          frameworkIp: req.ip,\r\n          body: opts.inspectBody ? bodyToString(req.body) : undefined,\r\n        },\r\n        call\r\n      );\r\n      req.zarex = decision;\r\n    } catch {\r\n      return;\r\n    }\r\n    if (decision.denied) {\r\n      try {\r\n        (opts.onDeny ?? defaultDeny)(req, reply, decision);\r\n      } catch {\r\n        /* si le refus personnalisé échoue, on retombe sur le refus par défaut */\r\n        if (!reply.sent) defaultDeny(req, reply, decision);\r\n      }\r\n      return; // async hook : la réponse est déjà envoyée, Fastify s'arrête là (reply.sent)\r\n    }\r\n    if (decision.degraded && opts.onDegraded) {\r\n      try {\r\n        opts.onDegraded(req, decision);\r\n      } catch {\r\n        /* sans effet sur la requête */\r\n      }\r\n    }\r\n  };\r\n}\r\n\r\n/**\r\n * Hook `onSend` : surveille les corps de réponse TEXTE (string / Buffer) et masque ou bloque les données sensibles.\r\n *\r\n *   app.addHook(\"onSend\", zarexFastifyOnSend({ responseGuard: true }));\r\n *\r\n * Les flux (streams) ne sont pas analysés.\r\n */\r\nexport function zarexFastifyOnSend(options: Pick<FastifyZarexOptions, \"responseGuard\">) {\r\n  const guard = normalizeGuardOptions(options.responseGuard);\r\n  const decoder = new TextDecoder(\"utf-8\");\r\n  return async function onSend(_req: unknown, reply: FastifyReplyLike, payload: unknown): Promise<unknown> {\r\n    if (!guard) return payload;\r\n    try {\r\n      const ct = String(reply.getHeader?.(\"content-type\") ?? \"\");\r\n      const isString = typeof payload === \"string\";\r\n      const isBytes = payload instanceof Uint8Array;\r\n      if (!(isString || isBytes) || !isScannableContentType(ct)) return payload;\r\n      const r = applyGuard(isString ? payload : decoder.decode(payload), ct, guard);\r\n      if (r.action === \"masked\" || r.action === \"blocked\") {\r\n        reply.removeHeader?.(\"content-length\"); // Fastify le recalcule\r\n        reply.removeHeader?.(\"etag\");\r\n        if (r.action === \"blocked\") {\r\n          reply.code(500);\r\n          reply.header(\"content-type\", \"application/json; charset=utf-8\");\r\n        }\r\n        return r.body;\r\n      }\r\n    } catch {\r\n      /* jamais casser la réponse */\r\n    }\r\n    return payload;\r\n  };\r\n}\r\n\r\nexport {\r\n  shield,\r\n  rateLimit,\r\n  tokenBucket,\r\n  detectBot,\r\n  requestFilter,\r\n  sensitiveInfo,\r\n  emailValidation,\r\n  phoneValidation,\r\n  promptInjection,\r\n  secureHeaders,\r\n  withSecureHeaders,\r\n  createZarex,\r\n  PRIVATE_NETWORKS,\r\n  CLOUDFLARE_RANGES,\r\n} from \"@zarex/core\";\r\nexport type { SecureHeadersOptions, ResponseGuardOptions, ResponseGuardEvent } from \"@zarex/core\";\r\nexport type { Decision, Zarex, ZarexOptions, IpSource, Rule, ProtectCall } from \"@zarex/core\";"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAaO;AA+LP,IAAAA,eAeO;AAjKP,SAAS,oCAAoC,KAA8B;AACzE,MAAI,IAAI,SAAS,OAAW,QAAO;AACnC,QAAM,KAAK,IAAI,QAAQ,mBAAmB;AAC1C,MAAI,OAAO,OAAO,WAAW,GAAG,SAAS,IAAI,MAAM,QAAQ,EAAE,KAAK,GAAG,SAAS,EAAG,QAAO;AACxF,QAAM,KAAK,IAAI,QAAQ,gBAAgB;AACvC,QAAM,QAAQ,OAAO,OAAO,WAAW,OAAO,EAAE,IAAI,MAAM,QAAQ,EAAE,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI;AACxF,SAAO,OAAO,SAAS,KAAK,KAAK,QAAQ;AAC3C;AAEA,SAAS,aAAa,MAAmC;AACvD,MAAI,SAAS,UAAa,SAAS,KAAM,QAAO;AAChD,MAAI,OAAO,SAAS,SAAU,QAAO;AACrC,MAAI;AACF,UAAM,IAAI,KAAK,UAAU,IAAI;AAC7B,WAAO,OAAO,MAAM,WAAW,IAAI;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,YAAY,MAAsB,OAAyB,GAAmB;AACrF,QAAM,UAAU,EAAE,UAAU,aAAa,gBAAgB,EAAE,UAAU,aAAa;AAClF,MAAI,SAAS;AACX,QAAI,EAAE,sBAAsB,OAAW,OAAM,OAAO,eAAe,OAAO,EAAE,iBAAiB,CAAC;AAC9F,UAAM,KAAK,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,SAAS,qBAAqB,YAAY,EAAE,GAAG,EAAE,CAAC;AAAA,EAC1G,OAAO;AACL,UAAM,KAAK,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,SAAS,mBAAmB,YAAY,EAAE,GAAG,EAAE,CAAC;AAAA,EACrG;AACF;AAYO,SAAS,aAAa,SAAsC,QAAyH,CAAC,GAAG;AAC9L,QAAM,aAAa,OAAQ,QAAkB,YAAY;AACzD,QAAM,OAAQ,aAAa,QAAQ;AACnC,QAAM,WAAkB,aACnB,cACD,yBAAY,EAAE,GAAI,SAAiC,UAAW,QAAgC,YAAY,YAAY,CAAC;AAE3H,QAAM,eAAW,kCAAqB,KAAK,aAAa;AACxD,MAAI,0BAA0B;AAE9B,SAAO,eAAe,UAAU,KAAqB,OAAwC;AAC3F,QAAI;AACJ,QAAI;AACF,UAAI,UAAU;AACZ,cAAM,UAAM,yBAAY,IAAI,aAAa,OAAO,IAAI,QAAQ,MAAM,MAAM,WAAY,IAAI,QAAQ,MAAM,IAAe,OAAU,IAAI,SAAS,OAAO,SAAS;AAC5J,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,GAAG,EAAG,OAAM,OAAO,GAAG,CAAC;AAC3D,YAAI,SAAS,gBAAiB,OAAM,eAAe,cAAc;AAAA,MACnE;AAAA,IACF,QAAQ;AAAA,IAER;AACA,QAAI;AACF,UAAI;AACJ,UAAI;AACF,eAAO,KAAK,OAAO,GAAG;AAAA,MACxB,QAAQ;AACN,eAAO;AAAA,MACT;AACA,YAAM,OAAO,OAAO,IAAI,QAAQ,MAAM,MAAM,WAAY,IAAI,QAAQ,MAAM,IAAe,IAAI;AAC7F,UAAI,KAAK,eAAe,CAAC,2BAA2B,oCAAoC,GAAG,GAAG;AAC5F,kCAA0B;AAC1B,gBAAQ;AAAA,UACN;AAAA,QAGF;AAAA,MACF;AACA,iBAAW,MAAM,SAAS;AAAA,QACxB;AAAA,UACE,QAAQ,IAAI;AAAA,UACZ,MAAM,IAAI;AAAA,UACV;AAAA,UACA,SAAS,IAAI;AAAA,UACb,UAAU,IAAI,KAAK,QAAQ;AAAA,UAC3B,aAAa,IAAI;AAAA,UACjB,MAAM,KAAK,cAAc,aAAa,IAAI,IAAI,IAAI;AAAA,QACpD;AAAA,QACA;AAAA,MACF;AACA,UAAI,QAAQ;AAAA,IACd,QAAQ;AACN;AAAA,IACF;AACA,QAAI,SAAS,QAAQ;AACnB,UAAI;AACF,SAAC,KAAK,UAAU,aAAa,KAAK,OAAO,QAAQ;AAAA,MACnD,QAAQ;AAEN,YAAI,CAAC,MAAM,KAAM,aAAY,KAAK,OAAO,QAAQ;AAAA,MACnD;AACA;AAAA,IACF;AACA,QAAI,SAAS,YAAY,KAAK,YAAY;AACxC,UAAI;AACF,aAAK,WAAW,KAAK,QAAQ;AAAA,MAC/B,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACF;AASO,SAAS,mBAAmB,SAAqD;AACtF,QAAM,YAAQ,mCAAsB,QAAQ,aAAa;AACzD,QAAM,UAAU,IAAI,YAAY,OAAO;AACvC,SAAO,eAAe,OAAO,MAAe,OAAyB,SAAoC;AACvG,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI;AACF,YAAM,KAAK,OAAO,MAAM,YAAY,cAAc,KAAK,EAAE;AACzD,YAAM,WAAW,OAAO,YAAY;AACpC,YAAM,UAAU,mBAAmB;AACnC,UAAI,EAAE,YAAY,YAAY,KAAC,oCAAuB,EAAE,EAAG,QAAO;AAClE,YAAM,QAAI,wBAAW,WAAW,UAAU,QAAQ,OAAO,OAAO,GAAG,IAAI,KAAK;AAC5E,UAAI,EAAE,WAAW,YAAY,EAAE,WAAW,WAAW;AACnD,cAAM,eAAe,gBAAgB;AACrC,cAAM,eAAe,MAAM;AAC3B,YAAI,EAAE,WAAW,WAAW;AAC1B,gBAAM,KAAK,GAAG;AACd,gBAAM,OAAO,gBAAgB,iCAAiC;AAAA,QAChE;AACA,eAAO,EAAE;AAAA,MACX;AAAA,IACF,QAAQ;AAAA,IAER;AACA,WAAO;AAAA,EACT;AACF;","names":["import_core"]}

package/dist/index.d.cts

@@ -0,0 +1,63 @@
+import { Decision, ZarexOptions, SecureHeadersOptions, ResponseGuardOptions, ProtectCall, Zarex } from '@zarex/core';
+export { CLOUDFLARE_RANGES, Decision, IpSource, PRIVATE_NETWORKS, ProtectCall, ResponseGuardEvent, ResponseGuardOptions, Rule, SecureHeadersOptions, Zarex, ZarexOptions, createZarex, detectBot, emailValidation, phoneValidation, promptInjection, rateLimit, requestFilter, secureHeaders, sensitiveInfo, shield, tokenBucket, withSecureHeaders } from '@zarex/core';
+
+/** Types minimaux de Fastify (pas de dépendance à `fastify` à l'exécution : Fastify 4 et 5). */
+interface FastifyReqLike {
+    method: string;
+    url: string;
+    ip?: string | undefined;
+    hostname?: string;
+    headers: Record<string, string | string[] | undefined>;
+    raw?: {
+        socket?: {
+            remoteAddress?: string | undefined;
+        } | undefined;
+    };
+    body?: unknown;
+    zarex?: Decision;
+}
+interface FastifyReplyLike {
+    code(status: number): this;
+    header(name: string, value: string): this;
+    send(payload?: unknown): this;
+    getHeader?(name: string): unknown;
+    removeHeader?(name: string): unknown;
+    sent?: boolean;
+}
+interface FastifyZarexOptions extends Omit<ZarexOptions, "ipSource"> {
+    /**
+     * Défaut : "framework" — l'adresse est celle de `request.ip`, que Fastify calcule selon l'option
+     * `trustProxy` de VOTRE serveur (`Fastify({ trustProxy: 1 })`). Sans `trustProxy`, Fastify ignore X-Forwarded-For.
+     */
+    ipSource?: ZarexOptions["ipSource"];
+    /** En-têtes de sécurité ajoutés à toutes les réponses (true = défauts prudents). Retire X-Powered-By. */
+    secureHeaders?: SecureHeadersOptions | boolean;
+    /** Surveillance des réponses : enregistrez aussi `zarexFastifyOnSend(options)` comme hook `onSend`. */
+    responseGuard?: ResponseGuardOptions | boolean;
+    /** Nécessite d'enregistrer le hook en `preHandler` (le corps n'est analysé qu'après `onRequest`). */
+    inspectBody?: boolean;
+    onDeny?: (req: FastifyReqLike, reply: FastifyReplyLike, decision: Decision) => void;
+    onDegraded?: (req: FastifyReqLike, decision: Decision) => void;
+    call?: (req: FastifyReqLike) => ProtectCall | undefined;
+}
+/**
+ *   app.addHook("onRequest", zarexFastify({ key, baseUrl, rules: [shield()] }));
+ *
+ * Avec `inspectBody: true`, enregistrez le hook en "preHandler" (pas "onRequest" ci-dessus) :
+ * Fastify n'a pas encore lu le corps en "onRequest", le moteur ne verrait jamais rien.
+ *   app.addHook("preHandler", zarexFastify({ key, baseUrl, rules: [shield()], inspectBody: true }));
+ *
+ * Fonctionne aussi avec NestJS (plateforme Fastify) :
+ *   (app.getHttpAdapter().getInstance() as FastifyInstance).addHook("onRequest", zarexFastify({...}));
+ */
+declare function zarexFastify(options: FastifyZarexOptions | Zarex, extra?: Pick<FastifyZarexOptions, "inspectBody" | "onDeny" | "onDegraded" | "call" | "secureHeaders" | "responseGuard">): (req: FastifyReqLike, reply: FastifyReplyLike) => Promise<void>;
+/**
+ * Hook `onSend` : surveille les corps de réponse TEXTE (string / Buffer) et masque ou bloque les données sensibles.
+ *
+ *   app.addHook("onSend", zarexFastifyOnSend({ responseGuard: true }));
+ *
+ * Les flux (streams) ne sont pas analysés.
+ */
+declare function zarexFastifyOnSend(options: Pick<FastifyZarexOptions, "responseGuard">): (_req: unknown, reply: FastifyReplyLike, payload: unknown) => Promise<unknown>;
+
+export { type FastifyReplyLike, type FastifyReqLike, type FastifyZarexOptions, zarexFastify, zarexFastifyOnSend };

package/dist/index.d.ts

@@ -0,0 +1,63 @@
+import { Decision, ZarexOptions, SecureHeadersOptions, ResponseGuardOptions, ProtectCall, Zarex } from '@zarex/core';
+export { CLOUDFLARE_RANGES, Decision, IpSource, PRIVATE_NETWORKS, ProtectCall, ResponseGuardEvent, ResponseGuardOptions, Rule, SecureHeadersOptions, Zarex, ZarexOptions, createZarex, detectBot, emailValidation, phoneValidation, promptInjection, rateLimit, requestFilter, secureHeaders, sensitiveInfo, shield, tokenBucket, withSecureHeaders } from '@zarex/core';
+
+/** Types minimaux de Fastify (pas de dépendance à `fastify` à l'exécution : Fastify 4 et 5). */
+interface FastifyReqLike {
+    method: string;
+    url: string;
+    ip?: string | undefined;
+    hostname?: string;
+    headers: Record<string, string | string[] | undefined>;
+    raw?: {
+        socket?: {
+            remoteAddress?: string | undefined;
+        } | undefined;
+    };
+    body?: unknown;
+    zarex?: Decision;
+}
+interface FastifyReplyLike {
+    code(status: number): this;
+    header(name: string, value: string): this;
+    send(payload?: unknown): this;
+    getHeader?(name: string): unknown;
+    removeHeader?(name: string): unknown;
+    sent?: boolean;
+}
+interface FastifyZarexOptions extends Omit<ZarexOptions, "ipSource"> {
+    /**
+     * Défaut : "framework" — l'adresse est celle de `request.ip`, que Fastify calcule selon l'option
+     * `trustProxy` de VOTRE serveur (`Fastify({ trustProxy: 1 })`). Sans `trustProxy`, Fastify ignore X-Forwarded-For.
+     */
+    ipSource?: ZarexOptions["ipSource"];
+    /** En-têtes de sécurité ajoutés à toutes les réponses (true = défauts prudents). Retire X-Powered-By. */
+    secureHeaders?: SecureHeadersOptions | boolean;
+    /** Surveillance des réponses : enregistrez aussi `zarexFastifyOnSend(options)` comme hook `onSend`. */
+    responseGuard?: ResponseGuardOptions | boolean;
+    /** Nécessite d'enregistrer le hook en `preHandler` (le corps n'est analysé qu'après `onRequest`). */
+    inspectBody?: boolean;
+    onDeny?: (req: FastifyReqLike, reply: FastifyReplyLike, decision: Decision) => void;
+    onDegraded?: (req: FastifyReqLike, decision: Decision) => void;
+    call?: (req: FastifyReqLike) => ProtectCall | undefined;
+}
+/**
+ *   app.addHook("onRequest", zarexFastify({ key, baseUrl, rules: [shield()] }));
+ *
+ * Avec `inspectBody: true`, enregistrez le hook en "preHandler" (pas "onRequest" ci-dessus) :
+ * Fastify n'a pas encore lu le corps en "onRequest", le moteur ne verrait jamais rien.
+ *   app.addHook("preHandler", zarexFastify({ key, baseUrl, rules: [shield()], inspectBody: true }));
+ *
+ * Fonctionne aussi avec NestJS (plateforme Fastify) :
+ *   (app.getHttpAdapter().getInstance() as FastifyInstance).addHook("onRequest", zarexFastify({...}));
+ */
+declare function zarexFastify(options: FastifyZarexOptions | Zarex, extra?: Pick<FastifyZarexOptions, "inspectBody" | "onDeny" | "onDegraded" | "call" | "secureHeaders" | "responseGuard">): (req: FastifyReqLike, reply: FastifyReplyLike) => Promise<void>;
+/**
+ * Hook `onSend` : surveille les corps de réponse TEXTE (string / Buffer) et masque ou bloque les données sensibles.
+ *
+ *   app.addHook("onSend", zarexFastifyOnSend({ responseGuard: true }));
+ *
+ * Les flux (streams) ne sont pas analysés.
+ */
+declare function zarexFastifyOnSend(options: Pick<FastifyZarexOptions, "responseGuard">): (_req: unknown, reply: FastifyReplyLike, payload: unknown) => Promise<unknown>;
+
+export { type FastifyReplyLike, type FastifyReqLike, type FastifyZarexOptions, zarexFastify, zarexFastifyOnSend };

package/dist/index.js

@@ -0,0 +1,158 @@
+// src/index.ts
+import {
+  applyGuard,
+  createZarex,
+  isLocalHost,
+  isScannableContentType,
+  normalizeGuardOptions,
+  prepareSecureHeaders
+} from "@zarex/core";
+import {
+  shield,
+  rateLimit,
+  tokenBucket,
+  detectBot,
+  requestFilter,
+  sensitiveInfo,
+  emailValidation,
+  phoneValidation,
+  promptInjection,
+  secureHeaders,
+  withSecureHeaders,
+  createZarex as createZarex2,
+  PRIVATE_NETWORKS,
+  CLOUDFLARE_RANGES
+} from "@zarex/core";
+function requestLooksLikeItHasAnUnparsedBody(req) {
+  if (req.body !== void 0) return false;
+  const te = req.headers["transfer-encoding"];
+  if (typeof te === "string" ? te.length > 0 : Array.isArray(te) && te.length > 0) return true;
+  const cl = req.headers["content-length"];
+  const clNum = typeof cl === "string" ? Number(cl) : Array.isArray(cl) ? Number(cl[0]) : NaN;
+  return Number.isFinite(clNum) && clNum > 0;
+}
+function bodyToString(body) {
+  if (body === void 0 || body === null) return void 0;
+  if (typeof body === "string") return body;
+  try {
+    const s = JSON.stringify(body);
+    return typeof s === "string" ? s : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function defaultDeny(_req, reply, d) {
+  const limited = d.deniedBy?.ruleType === "RATE_LIMIT" || d.deniedBy?.ruleType === "TOKEN_BUCKET";
+  if (limited) {
+    if (d.retryAfterSeconds !== void 0) reply.header("retry-after", String(d.retryAfterSeconds));
+    reply.code(429).send({ error: { code: "rate_limited", message: "Too many requests", request_id: d.id } });
+  } else {
+    reply.code(403).send({ error: { code: "forbidden", message: "Request blocked", request_id: d.id } });
+  }
+}
+function zarexFastify(options, extra = {}) {
+  const isInstance = typeof options.protect === "function";
+  const opts = isInstance ? extra : options;
+  const instance = isInstance ? options : createZarex({ ...options, ipSource: options.ipSource ?? "framework" });
+  const prepared = prepareSecureHeaders(opts.secureHeaders);
+  let warnedAboutUnparsedBody = false;
+  return async function zarexHook(req, reply) {
+    let decision;
+    try {
+      if (prepared) {
+        const set = isLocalHost(req.hostname ?? (typeof req.headers["host"] === "string" ? req.headers["host"] : void 0)) ? prepared.http : prepared.https;
+        for (const [k, v] of Object.entries(set)) reply.header(k, v);
+        if (prepared.removePoweredBy) reply.removeHeader?.("x-powered-by");
+      }
+    } catch {
+    }
+    try {
+      let call;
+      try {
+        call = opts.call?.(req);
+      } catch {
+        call = void 0;
+      }
+      const host = typeof req.headers["host"] === "string" ? req.headers["host"] : req.hostname;
+      if (opts.inspectBody && !warnedAboutUnparsedBody && requestLooksLikeItHasAnUnparsedBody(req)) {
+        warnedAboutUnparsedBody = true;
+        console.warn(
+          '[zarex] fastify: `inspectBody: true` but request.body is still undefined on a request that has one. This hook is probably registered on "onRequest", where Fastify has not parsed the body yet \u2014 register it as "preHandler" instead, otherwise the body is silently never sent to the engine.'
+        );
+      }
+      decision = await instance.protect(
+        {
+          method: req.method,
+          path: req.url,
+          host,
+          headers: req.headers,
+          socketIp: req.raw?.socket?.remoteAddress,
+          frameworkIp: req.ip,
+          body: opts.inspectBody ? bodyToString(req.body) : void 0
+        },
+        call
+      );
+      req.zarex = decision;
+    } catch {
+      return;
+    }
+    if (decision.denied) {
+      try {
+        (opts.onDeny ?? defaultDeny)(req, reply, decision);
+      } catch {
+        if (!reply.sent) defaultDeny(req, reply, decision);
+      }
+      return;
+    }
+    if (decision.degraded && opts.onDegraded) {
+      try {
+        opts.onDegraded(req, decision);
+      } catch {
+      }
+    }
+  };
+}
+function zarexFastifyOnSend(options) {
+  const guard = normalizeGuardOptions(options.responseGuard);
+  const decoder = new TextDecoder("utf-8");
+  return async function onSend(_req, reply, payload) {
+    if (!guard) return payload;
+    try {
+      const ct = String(reply.getHeader?.("content-type") ?? "");
+      const isString = typeof payload === "string";
+      const isBytes = payload instanceof Uint8Array;
+      if (!(isString || isBytes) || !isScannableContentType(ct)) return payload;
+      const r = applyGuard(isString ? payload : decoder.decode(payload), ct, guard);
+      if (r.action === "masked" || r.action === "blocked") {
+        reply.removeHeader?.("content-length");
+        reply.removeHeader?.("etag");
+        if (r.action === "blocked") {
+          reply.code(500);
+          reply.header("content-type", "application/json; charset=utf-8");
+        }
+        return r.body;
+      }
+    } catch {
+    }
+    return payload;
+  };
+}
+export {
+  CLOUDFLARE_RANGES,
+  PRIVATE_NETWORKS,
+  createZarex2 as createZarex,
+  detectBot,
+  emailValidation,
+  phoneValidation,
+  promptInjection,
+  rateLimit,
+  requestFilter,
+  secureHeaders,
+  sensitiveInfo,
+  shield,
+  tokenBucket,
+  withSecureHeaders,
+  zarexFastify,
+  zarexFastifyOnSend
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import {\r\n  applyGuard,\r\n  createZarex,\r\n  isLocalHost,\r\n  isScannableContentType,\r\n  normalizeGuardOptions,\r\n  prepareSecureHeaders,\r\n  type Decision,\r\n  type ProtectCall,\r\n  type ResponseGuardOptions,\r\n  type SecureHeadersOptions,\r\n  type Zarex,\r\n  type ZarexOptions,\r\n} from \"@zarex/core\";\r\n\r\n/** Types minimaux de Fastify (pas de dépendance à `fastify` à l'exécution : Fastify 4 et 5). */\r\nexport interface FastifyReqLike {\r\n  method: string;\r\n  url: string;\r\n  ip?: string | undefined;\r\n  hostname?: string;\r\n  headers: Record<string, string | string[] | undefined>;\r\n  raw?: { socket?: { remoteAddress?: string | undefined } | undefined };\r\n  body?: unknown;\r\n  zarex?: Decision;\r\n}\r\nexport interface FastifyReplyLike {\r\n  code(status: number): this;\r\n  header(name: string, value: string): this;\r\n  send(payload?: unknown): this;\r\n  getHeader?(name: string): unknown;\r\n  removeHeader?(name: string): unknown;\r\n  sent?: boolean;\r\n}\r\n\r\nexport interface FastifyZarexOptions extends Omit<ZarexOptions, \"ipSource\"> {\r\n  /**\r\n   * Défaut : \"framework\" — l'adresse est celle de `request.ip`, que Fastify calcule selon l'option\r\n   * `trustProxy` de VOTRE serveur (`Fastify({ trustProxy: 1 })`). Sans `trustProxy`, Fastify ignore X-Forwarded-For.\r\n   */\r\n  ipSource?: ZarexOptions[\"ipSource\"];\r\n  /** En-têtes de sécurité ajoutés à toutes les réponses (true = défauts prudents). Retire X-Powered-By. */\r\n  secureHeaders?: SecureHeadersOptions | boolean;\r\n  /** Surveillance des réponses : enregistrez aussi `zarexFastifyOnSend(options)` comme hook `onSend`. */\r\n  responseGuard?: ResponseGuardOptions | boolean;\r\n  /** Nécessite d'enregistrer le hook en `preHandler` (le corps n'est analysé qu'après `onRequest`). */\r\n  inspectBody?: boolean;\r\n  onDeny?: (req: FastifyReqLike, reply: FastifyReplyLike, decision: Decision) => void;\r\n  onDegraded?: (req: FastifyReqLike, decision: Decision) => void;\r\n  call?: (req: FastifyReqLike) => ProtectCall | undefined;\r\n}\r\n\r\n// Trouvé lors de l'audit du 04/11/2026 (voir AUDIT_SECURITE_COMPLET.md) : l'exemple JSDoc principal\r\n// de ce fichier montre le hook enregistré en \"onRequest\", où Fastify n'a pas encore analysé le\r\n// corps — `inspectBody: true` n'y transmet alors jamais rien au moteur, SANS AUCUN avertissement.\r\n// Heuristique : `req.body` indéfini alors que la requête annonce clairement un corps\r\n// (Content-Length > 0 ou Transfer-Encoding) signale presque certainement ce piège plutôt qu'une\r\n// requête sans corps (GET…), pour laquelle il n'y a rien à signaler.\r\nfunction requestLooksLikeItHasAnUnparsedBody(req: FastifyReqLike): boolean {\r\n  if (req.body !== undefined) return false;\r\n  const te = req.headers[\"transfer-encoding\"];\r\n  if (typeof te === \"string\" ? te.length > 0 : Array.isArray(te) && te.length > 0) return true;\r\n  const cl = req.headers[\"content-length\"];\r\n  const clNum = typeof cl === \"string\" ? Number(cl) : Array.isArray(cl) ? Number(cl[0]) : NaN;\r\n  return Number.isFinite(clNum) && clNum > 0;\r\n}\r\n\r\nfunction bodyToString(body: unknown): string | undefined {\r\n  if (body === undefined || body === null) return undefined;\r\n  if (typeof body === \"string\") return body;\r\n  try {\r\n    const s = JSON.stringify(body);\r\n    return typeof s === \"string\" ? s : undefined;\r\n  } catch {\r\n    return undefined;\r\n  }\r\n}\r\n\r\nfunction defaultDeny(_req: FastifyReqLike, reply: FastifyReplyLike, d: Decision): void {\r\n  const limited = d.deniedBy?.ruleType === \"RATE_LIMIT\" || d.deniedBy?.ruleType === \"TOKEN_BUCKET\";\r\n  if (limited) {\r\n    if (d.retryAfterSeconds !== undefined) reply.header(\"retry-after\", String(d.retryAfterSeconds));\r\n    reply.code(429).send({ error: { code: \"rate_limited\", message: \"Too many requests\", request_id: d.id } });\r\n  } else {\r\n    reply.code(403).send({ error: { code: \"forbidden\", message: \"Request blocked\", request_id: d.id } });\r\n  }\r\n}\r\n\r\n/**\r\n *   app.addHook(\"onRequest\", zarexFastify({ key, baseUrl, rules: [shield()] }));\r\n *\r\n * Avec `inspectBody: true`, enregistrez le hook en \"preHandler\" (pas \"onRequest\" ci-dessus) :\r\n * Fastify n'a pas encore lu le corps en \"onRequest\", le moteur ne verrait jamais rien.\r\n *   app.addHook(\"preHandler\", zarexFastify({ key, baseUrl, rules: [shield()], inspectBody: true }));\r\n *\r\n * Fonctionne aussi avec NestJS (plateforme Fastify) :\r\n *   (app.getHttpAdapter().getInstance() as FastifyInstance).addHook(\"onRequest\", zarexFastify({...}));\r\n */\r\nexport function zarexFastify(options: FastifyZarexOptions | Zarex, extra: Pick<FastifyZarexOptions, \"inspectBody\" | \"onDeny\" | \"onDegraded\" | \"call\" | \"secureHeaders\" | \"responseGuard\"> = {}) {\r\n  const isInstance = typeof (options as Zarex).protect === \"function\";\r\n  const opts = (isInstance ? extra : options) as FastifyZarexOptions;\r\n  const instance: Zarex = isInstance\r\n    ? (options as Zarex)\r\n    : createZarex({ ...(options as FastifyZarexOptions), ipSource: (options as FastifyZarexOptions).ipSource ?? \"framework\" });\r\n\r\n  const prepared = prepareSecureHeaders(opts.secureHeaders);\r\n  let warnedAboutUnparsedBody = false;\r\n\r\n  return async function zarexHook(req: FastifyReqLike, reply: FastifyReplyLike): Promise<void> {\r\n    let decision: Decision;\r\n    try {\r\n      if (prepared) {\r\n        const set = isLocalHost(req.hostname ?? (typeof req.headers[\"host\"] === \"string\" ? (req.headers[\"host\"] as string) : undefined)) ? prepared.http : prepared.https;\r\n        for (const [k, v] of Object.entries(set)) reply.header(k, v);\r\n        if (prepared.removePoweredBy) reply.removeHeader?.(\"x-powered-by\");\r\n      }\r\n    } catch {\r\n      /* sans effet sur la requête */\r\n    }\r\n    try {\r\n      let call: ProtectCall | undefined;\r\n      try {\r\n        call = opts.call?.(req);\r\n      } catch {\r\n        call = undefined;\r\n      }\r\n      const host = typeof req.headers[\"host\"] === \"string\" ? (req.headers[\"host\"] as string) : req.hostname;\r\n      if (opts.inspectBody && !warnedAboutUnparsedBody && requestLooksLikeItHasAnUnparsedBody(req)) {\r\n        warnedAboutUnparsedBody = true;\r\n        console.warn(\r\n          '[zarex] fastify: `inspectBody: true` but request.body is still undefined on a request that has one. ' +\r\n            'This hook is probably registered on \"onRequest\", where Fastify has not parsed the body yet — register it ' +\r\n            'as \"preHandler\" instead, otherwise the body is silently never sent to the engine.'\r\n        );\r\n      }\r\n      decision = await instance.protect(\r\n        {\r\n          method: req.method,\r\n          path: req.url,\r\n          host,\r\n          headers: req.headers,\r\n          socketIp: req.raw?.socket?.remoteAddress,\r\n          frameworkIp: req.ip,\r\n          body: opts.inspectBody ? bodyToString(req.body) : undefined,\r\n        },\r\n        call\r\n      );\r\n      req.zarex = decision;\r\n    } catch {\r\n      return;\r\n    }\r\n    if (decision.denied) {\r\n      try {\r\n        (opts.onDeny ?? defaultDeny)(req, reply, decision);\r\n      } catch {\r\n        /* si le refus personnalisé échoue, on retombe sur le refus par défaut */\r\n        if (!reply.sent) defaultDeny(req, reply, decision);\r\n      }\r\n      return; // async hook : la réponse est déjà envoyée, Fastify s'arrête là (reply.sent)\r\n    }\r\n    if (decision.degraded && opts.onDegraded) {\r\n      try {\r\n        opts.onDegraded(req, decision);\r\n      } catch {\r\n        /* sans effet sur la requête */\r\n      }\r\n    }\r\n  };\r\n}\r\n\r\n/**\r\n * Hook `onSend` : surveille les corps de réponse TEXTE (string / Buffer) et masque ou bloque les données sensibles.\r\n *\r\n *   app.addHook(\"onSend\", zarexFastifyOnSend({ responseGuard: true }));\r\n *\r\n * Les flux (streams) ne sont pas analysés.\r\n */\r\nexport function zarexFastifyOnSend(options: Pick<FastifyZarexOptions, \"responseGuard\">) {\r\n  const guard = normalizeGuardOptions(options.responseGuard);\r\n  const decoder = new TextDecoder(\"utf-8\");\r\n  return async function onSend(_req: unknown, reply: FastifyReplyLike, payload: unknown): Promise<unknown> {\r\n    if (!guard) return payload;\r\n    try {\r\n      const ct = String(reply.getHeader?.(\"content-type\") ?? \"\");\r\n      const isString = typeof payload === \"string\";\r\n      const isBytes = payload instanceof Uint8Array;\r\n      if (!(isString || isBytes) || !isScannableContentType(ct)) return payload;\r\n      const r = applyGuard(isString ? payload : decoder.decode(payload), ct, guard);\r\n      if (r.action === \"masked\" || r.action === \"blocked\") {\r\n        reply.removeHeader?.(\"content-length\"); // Fastify le recalcule\r\n        reply.removeHeader?.(\"etag\");\r\n        if (r.action === \"blocked\") {\r\n          reply.code(500);\r\n          reply.header(\"content-type\", \"application/json; charset=utf-8\");\r\n        }\r\n        return r.body;\r\n      }\r\n    } catch {\r\n      /* jamais casser la réponse */\r\n    }\r\n    return payload;\r\n  };\r\n}\r\n\r\nexport {\r\n  shield,\r\n  rateLimit,\r\n  tokenBucket,\r\n  detectBot,\r\n  requestFilter,\r\n  sensitiveInfo,\r\n  emailValidation,\r\n  phoneValidation,\r\n  promptInjection,\r\n  secureHeaders,\r\n  withSecureHeaders,\r\n  createZarex,\r\n  PRIVATE_NETWORKS,\r\n  CLOUDFLARE_RANGES,\r\n} from \"@zarex/core\";\r\nexport type { SecureHeadersOptions, ResponseGuardOptions, ResponseGuardEvent } from \"@zarex/core\";\r\nexport type { Decision, Zarex, ZarexOptions, IpSource, Rule, ProtectCall } from \"@zarex/core\";"],"mappings":";AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAOK;AA+LP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,eAAAA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAjKP,SAAS,oCAAoC,KAA8B;AACzE,MAAI,IAAI,SAAS,OAAW,QAAO;AACnC,QAAM,KAAK,IAAI,QAAQ,mBAAmB;AAC1C,MAAI,OAAO,OAAO,WAAW,GAAG,SAAS,IAAI,MAAM,QAAQ,EAAE,KAAK,GAAG,SAAS,EAAG,QAAO;AACxF,QAAM,KAAK,IAAI,QAAQ,gBAAgB;AACvC,QAAM,QAAQ,OAAO,OAAO,WAAW,OAAO,EAAE,IAAI,MAAM,QAAQ,EAAE,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI;AACxF,SAAO,OAAO,SAAS,KAAK,KAAK,QAAQ;AAC3C;AAEA,SAAS,aAAa,MAAmC;AACvD,MAAI,SAAS,UAAa,SAAS,KAAM,QAAO;AAChD,MAAI,OAAO,SAAS,SAAU,QAAO;AACrC,MAAI;AACF,UAAM,IAAI,KAAK,UAAU,IAAI;AAC7B,WAAO,OAAO,MAAM,WAAW,IAAI;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,YAAY,MAAsB,OAAyB,GAAmB;AACrF,QAAM,UAAU,EAAE,UAAU,aAAa,gBAAgB,EAAE,UAAU,aAAa;AAClF,MAAI,SAAS;AACX,QAAI,EAAE,sBAAsB,OAAW,OAAM,OAAO,eAAe,OAAO,EAAE,iBAAiB,CAAC;AAC9F,UAAM,KAAK,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,SAAS,qBAAqB,YAAY,EAAE,GAAG,EAAE,CAAC;AAAA,EAC1G,OAAO;AACL,UAAM,KAAK,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,SAAS,mBAAmB,YAAY,EAAE,GAAG,EAAE,CAAC;AAAA,EACrG;AACF;AAYO,SAAS,aAAa,SAAsC,QAAyH,CAAC,GAAG;AAC9L,QAAM,aAAa,OAAQ,QAAkB,YAAY;AACzD,QAAM,OAAQ,aAAa,QAAQ;AACnC,QAAM,WAAkB,aACnB,UACD,YAAY,EAAE,GAAI,SAAiC,UAAW,QAAgC,YAAY,YAAY,CAAC;AAE3H,QAAM,WAAW,qBAAqB,KAAK,aAAa;AACxD,MAAI,0BAA0B;AAE9B,SAAO,eAAe,UAAU,KAAqB,OAAwC;AAC3F,QAAI;AACJ,QAAI;AACF,UAAI,UAAU;AACZ,cAAM,MAAM,YAAY,IAAI,aAAa,OAAO,IAAI,QAAQ,MAAM,MAAM,WAAY,IAAI,QAAQ,MAAM,IAAe,OAAU,IAAI,SAAS,OAAO,SAAS;AAC5J,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,GAAG,EAAG,OAAM,OAAO,GAAG,CAAC;AAC3D,YAAI,SAAS,gBAAiB,OAAM,eAAe,cAAc;AAAA,MACnE;AAAA,IACF,QAAQ;AAAA,IAER;AACA,QAAI;AACF,UAAI;AACJ,UAAI;AACF,eAAO,KAAK,OAAO,GAAG;AAAA,MACxB,QAAQ;AACN,eAAO;AAAA,MACT;AACA,YAAM,OAAO,OAAO,IAAI,QAAQ,MAAM,MAAM,WAAY,IAAI,QAAQ,MAAM,IAAe,IAAI;AAC7F,UAAI,KAAK,eAAe,CAAC,2BAA2B,oCAAoC,GAAG,GAAG;AAC5F,kCAA0B;AAC1B,gBAAQ;AAAA,UACN;AAAA,QAGF;AAAA,MACF;AACA,iBAAW,MAAM,SAAS;AAAA,QACxB;AAAA,UACE,QAAQ,IAAI;AAAA,UACZ,MAAM,IAAI;AAAA,UACV;AAAA,UACA,SAAS,IAAI;AAAA,UACb,UAAU,IAAI,KAAK,QAAQ;AAAA,UAC3B,aAAa,IAAI;AAAA,UACjB,MAAM,KAAK,cAAc,aAAa,IAAI,IAAI,IAAI;AAAA,QACpD;AAAA,QACA;AAAA,MACF;AACA,UAAI,QAAQ;AAAA,IACd,QAAQ;AACN;AAAA,IACF;AACA,QAAI,SAAS,QAAQ;AACnB,UAAI;AACF,SAAC,KAAK,UAAU,aAAa,KAAK,OAAO,QAAQ;AAAA,MACnD,QAAQ;AAEN,YAAI,CAAC,MAAM,KAAM,aAAY,KAAK,OAAO,QAAQ;AAAA,MACnD;AACA;AAAA,IACF;AACA,QAAI,SAAS,YAAY,KAAK,YAAY;AACxC,UAAI;AACF,aAAK,WAAW,KAAK,QAAQ;AAAA,MAC/B,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACF;AASO,SAAS,mBAAmB,SAAqD;AACtF,QAAM,QAAQ,sBAAsB,QAAQ,aAAa;AACzD,QAAM,UAAU,IAAI,YAAY,OAAO;AACvC,SAAO,eAAe,OAAO,MAAe,OAAyB,SAAoC;AACvG,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI;AACF,YAAM,KAAK,OAAO,MAAM,YAAY,cAAc,KAAK,EAAE;AACzD,YAAM,WAAW,OAAO,YAAY;AACpC,YAAM,UAAU,mBAAmB;AACnC,UAAI,EAAE,YAAY,YAAY,CAAC,uBAAuB,EAAE,EAAG,QAAO;AAClE,YAAM,IAAI,WAAW,WAAW,UAAU,QAAQ,OAAO,OAAO,GAAG,IAAI,KAAK;AAC5E,UAAI,EAAE,WAAW,YAAY,EAAE,WAAW,WAAW;AACnD,cAAM,eAAe,gBAAgB;AACrC,cAAM,eAAe,MAAM;AAC3B,YAAI,EAAE,WAAW,WAAW;AAC1B,gBAAM,KAAK,GAAG;AACd,gBAAM,OAAO,gBAAgB,iCAAiC;AAAA,QAChE;AACA,eAAO,EAAE;AAAA,MACX;AAAA,IACF,QAAQ;AAAA,IAER;AACA,WAAO;AAAA,EACT;AACF;","names":["createZarex"]}

package/package.json

@@ -1,6 +1,43 @@
 {
   "name": "@zarex/fastify",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.1",
+  "description": "Zarex — Fastify (et NestJS avec Fastify)",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "sideEffects": false,
+  "dependencies": {
+    "@zarex/core": "^0.1.1"
+  },
+  "peerDependencies": {
+    "fastify": ">=4"
+  },
+  "peerDependenciesMeta": {
+    "fastify": {
+      "optional": true
+    }
+  },
+  "scripts": {
+    "build": "tsup"
+  }
 }