@zintrust/core 0.1.28 → 0.1.30

package/src/middleware/JwtAuthMiddleware.js

@@ -0,0 +1,73 @@
+import { securityConfig } from '../config/security.js';
+import { RequestContext } from '../http/RequestContext.js';
+import { JwtManager } from '../security/JwtManager.js';
+import { TokenRevocation } from '../security/TokenRevocation.js';
+const getHeaderValue = (value) => {
+    if (Array.isArray(value))
+        return typeof value[0] === 'string' ? value[0] : '';
+    return typeof value === 'string' ? value : '';
+};
+const getBearerToken = (authorizationHeader) => {
+    const trimmed = authorizationHeader.trim();
+    if (trimmed === '')
+        return null;
+    const [scheme, token] = trimmed.split(' ');
+    if (scheme !== 'Bearer')
+        return null;
+    if (typeof token !== 'string' || token.trim() === '')
+        return null;
+    return token;
+};
+const getOptionalStringOrNumberClaim = (payload, key) => {
+    const value = payload[key];
+    if (typeof value === 'string')
+        return value;
+    if (typeof value === 'number')
+        return String(value);
+    return undefined;
+};
+export const JwtAuthMiddleware = Object.freeze({
+    create(options = {}) {
+        const algorithm = options.algorithm ?? securityConfig.jwt.algorithm;
+        const secret = options.secret ?? securityConfig.jwt.secret;
+        const jwt = JwtManager.create();
+        if (algorithm === 'HS256' || algorithm === 'HS512') {
+            jwt.setHmacSecret(secret);
+        }
+        return async (req, res, next) => {
+            const authorizationHeader = getHeaderValue(req.getHeader('authorization'));
+            if (authorizationHeader === '') {
+                res.setStatus(401).json({ error: 'Missing authorization header' });
+                return;
+            }
+            const token = getBearerToken(authorizationHeader);
+            if (token === null) {
+                res.setStatus(401).json({ error: 'Invalid authorization header format' });
+                return;
+            }
+            if (TokenRevocation.isRevoked(token)) {
+                res.setStatus(401).json({ error: 'Invalid or expired token' });
+                return;
+            }
+            try {
+                const payload = jwt.verify(token, algorithm);
+                req.user = payload;
+                // Standardize request-scoped context fields.
+                if (typeof payload.sub === 'string' && payload.sub.trim() !== '') {
+                    RequestContext.setUserId(req, payload.sub);
+                }
+                // Optional: if a tenant claim exists, attach it. (Apps may use a different claim name.)
+                const tenantId = getOptionalStringOrNumberClaim(payload, 'tenantId') ??
+                    getOptionalStringOrNumberClaim(payload, 'tenant_id');
+                if (tenantId !== undefined && tenantId.trim() !== '') {
+                    RequestContext.setTenantId(req, tenantId);
+                }
+                await next();
+            }
+            catch {
+                res.setStatus(401).json({ error: 'Invalid or expired token' });
+            }
+        };
+    },
+});
+export default JwtAuthMiddleware;

package/src/middleware/LoggingMiddleware.d.ts

@@ -0,0 +1,9 @@
+import type { Middleware } from './MiddlewareStack';
+export interface LoggingOptions {
+    enabled?: boolean;
+}
+export declare const LoggingMiddleware: Readonly<{
+    create(options?: LoggingOptions): Middleware;
+}>;
+export default LoggingMiddleware;
+//# sourceMappingURL=LoggingMiddleware.d.ts.map

package/src/middleware/LoggingMiddleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LoggingMiddleware.d.ts","sourceRoot":"","sources":["../../../src/middleware/LoggingMiddleware.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AASD,eAAO,MAAM,iBAAiB;qBACZ,cAAc,GAAQ,UAAU;EAiChD,CAAC;AAEH,eAAe,iBAAiB,CAAC"}

package/src/middleware/LoggingMiddleware.js

@@ -0,0 +1,41 @@
+import { Env } from '../config/env.js';
+import { Logger } from '../config/logger.js';
+import { RequestContext } from '../http/RequestContext.js';
+const getStatusSafe = (res) => {
+    const anyRes = res;
+    if (typeof anyRes.getStatus === 'function')
+        return anyRes.getStatus();
+    if (typeof anyRes.statusCode === 'number')
+        return anyRes.statusCode;
+    return 200;
+};
+export const LoggingMiddleware = Object.freeze({
+    create(options = {}) {
+        const enabled = typeof options.enabled === 'boolean' ? options.enabled : Boolean(Env.LOG_HTTP_REQUEST);
+        return async (req, res, next) => {
+            if (enabled === false) {
+                await next();
+                return;
+            }
+            const start = Date.now();
+            const method = req.getMethod();
+            const path = req.getPath();
+            const ctx = RequestContext.get(req);
+            const requestId = ctx?.requestId ?? req.context['requestId'];
+            const traceId = ctx?.traceId;
+            const prefix = typeof traceId === 'string' && traceId.trim() !== ''
+                ? `[${requestId} trace=${traceId}]`
+                : `[${requestId}]`;
+            Logger.info(`${prefix} ↓ ${method} ${path}`);
+            try {
+                await next();
+            }
+            finally {
+                const durationMs = Date.now() - start;
+                const status = getStatusSafe(res);
+                Logger.info(`${prefix} ↑ ${method} ${path} ${status} ${durationMs}ms`);
+            }
+        };
+    },
+});
+export default LoggingMiddleware;

package/src/middleware/MiddlewareStack.d.ts

@@ -0,0 +1,27 @@
+import type { IRequest } from '../http/Request';
+import type { IResponse } from '../http/Response';
+/**
+ * Middleware Stack
+ * Manages middleware execution pipeline
+ */
+export type Middleware = (req: IRequest, res: IResponse, next: () => Promise<void>) => Promise<void>;
+export interface IMiddlewareStack {
+    register(name: string, handler: Middleware): void;
+    execute(request: IRequest, response: IResponse, only?: string[] | Middleware[]): Promise<void>;
+    getMiddlewares(): Array<{
+        name: string;
+        handler: Middleware;
+    }>;
+}
+/**
+ * Middleware Stack
+ * Refactored to Functional Object pattern
+ */
+export declare const MiddlewareStack: Readonly<{
+    /**
+     * Create a new middleware stack instance
+     */
+    create(): IMiddlewareStack;
+}>;
+export default MiddlewareStack;
+//# sourceMappingURL=MiddlewareStack.d.ts.map

package/src/middleware/MiddlewareStack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MiddlewareStack.d.ts","sourceRoot":"","sources":["../../../src/middleware/MiddlewareStack.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD;;;GAGG;AAEH,MAAM,MAAM,UAAU,GAAG,CACvB,GAAG,EAAE,QAAQ,EACb,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KACtB,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,IAAI,CAAC;IAClD,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/F,cAAc,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;CAChE;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe;IAC1B;;OAEG;cACO,gBAAgB;EAsC1B,CAAC;AAEH,eAAe,eAAe,CAAC"}

package/src/middleware/MiddlewareStack.js

@@ -0,0 +1,43 @@
+/**
+ * Middleware Stack
+ * Refactored to Functional Object pattern
+ */
+export const MiddlewareStack = Object.freeze({
+    /**
+     * Create a new middleware stack instance
+     */
+    create() {
+        const middlewares = [];
+        return {
+            /**
+             * Register middleware
+             */
+            register(name, handler) {
+                middlewares.push({ name, handler });
+            },
+            /**
+             * Execute middleware stack
+             */
+            async execute(request, response, only) {
+                const filteredMiddlewares = only
+                    ? middlewares.filter((m) => only.includes(m.name))
+                    : middlewares;
+                let index = 0;
+                const next = async () => {
+                    if (index >= filteredMiddlewares.length)
+                        return;
+                    const middleware = filteredMiddlewares[index++];
+                    await middleware.handler(request, response, next);
+                };
+                await next();
+            },
+            /**
+             * Get all middleware
+             */
+            getMiddlewares() {
+                return middlewares;
+            },
+        };
+    },
+});
+export default MiddlewareStack;

package/src/middleware/RateLimiter.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Rate Limiter Middleware
+ * Token bucket implementation for request rate limiting
+ * Zero-dependency implementation
+ */
+import type { IRequest } from '../http/Request';
+import type { Middleware } from './MiddlewareStack';
+export interface RateLimitOptions {
+    windowMs: number;
+    max: number;
+    message?: string;
+    statusCode?: number;
+    headers?: boolean;
+    keyGenerator?: (req: IRequest) => string;
+    /**
+     * Optional store selection for this middleware instance.
+     * - 'memory' uses an in-process Map (default)
+     * - 'redis' uses Cache.store('redis')
+     * - 'kv' uses Cache.store('kv')
+     * - 'db' uses Cache.store('mongodb')
+     */
+    store?: RateLimitStoreName;
+}
+export type RateLimitStoreName = 'memory' | 'redis' | 'kv' | 'db';
+export declare const RateLimiter: Readonly<{
+    /**
+     * Configure the store used by the programmatic API (attempt/tooManyAttempts/till/clear).
+     * Defaults to 'memory'.
+     */
+    configure(config?: {
+        store?: RateLimitStoreName;
+    }): void;
+    /**
+     * Attempt to perform an action.
+     *
+     * Returns true if allowed (and records the hit), false if rate limited.
+     */
+    attempt(key: string, maxAttempts: number, decaySeconds: number): Promise<boolean>;
+    /**
+     * Check if the key is currently rate limited.
+     */
+    tooManyAttempts(key: string, maxAttempts: number): Promise<boolean>;
+    /**
+     * Seconds until the key is available again.
+     * Returns 0 if not rate limited.
+     */
+    till(key: string): Promise<number>;
+    /**
+     * Clear rate limit state for a key.
+     */
+    clear(key: string): Promise<void>;
+    /**
+     * Create rate limiter middleware
+     */
+    create(options?: RateLimitOptions): Middleware;
+}>;
+//# sourceMappingURL=RateLimiter.d.ts.map

package/src/middleware/RateLimiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimiter.d.ts","sourceRoot":"","sources":["../../../src/middleware/RateLimiter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,KAAK,MAAM,CAAC;IAEzC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,kBAAkB,CAAC;CAC5B;AAED,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,OAAO,GAAG,IAAI,GAAG,IAAI,CAAC;AAqKlE,eAAO,MAAM,WAAW;IACtB;;;OAGG;uBACgB;QAAE,KAAK,CAAC,EAAE,kBAAkB,CAAA;KAAE,GAAG,IAAI;IAKxD;;;;OAIG;iBACgB,MAAM,eAAe,MAAM,gBAAgB,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYvF;;OAEG;yBACwB,MAAM,eAAe,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQzE;;;OAGG;cACa,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQxC;;OAEG;eACc,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKvC;;OAEG;qBACa,gBAAgB,GAAqB,UAAU;EAgF/D,CAAC"}

package/src/middleware/RateLimiter.js

@@ -0,0 +1,270 @@
+/**
+ * Rate Limiter Middleware
+ * Token bucket implementation for request rate limiting
+ * Zero-dependency implementation
+ */
+import { Cache } from '../cache/Cache.js';
+import { Env } from '../config/env.js';
+import { Logger } from '../config/logger.js';
+const createMemoryStore = () => {
+    const entries = new Map();
+    let nextCleanupAt = Date.now() + 60_000;
+    const cleanupExpired = (now) => {
+        if (now < nextCleanupAt)
+            return;
+        for (const [k, state] of entries.entries()) {
+            if (now > state.resetTime)
+                entries.delete(k);
+        }
+        nextCleanupAt = now + 60_000;
+    };
+    return Object.freeze({
+        async get(key) {
+            await Promise.resolve();
+            const now = Date.now();
+            cleanupExpired(now);
+            const state = entries.get(key);
+            if (!state)
+                return null;
+            if (now > state.resetTime) {
+                entries.delete(key);
+                return null;
+            }
+            return { ...state };
+        },
+        async set(key, value) {
+            await Promise.resolve();
+            const now = Date.now();
+            cleanupExpired(now);
+            entries.set(key, { ...value });
+        },
+        async delete(key) {
+            await Promise.resolve();
+            entries.delete(key);
+        },
+    });
+};
+const createCacheStore = (storeName) => {
+    const store = Cache.store(storeName);
+    return Object.freeze({
+        async get(key) {
+            return store.get(key);
+        },
+        async set(key, value, ttlSeconds) {
+            await store.set(key, value, ttlSeconds);
+        },
+        async delete(key) {
+            await store.delete(key);
+        },
+    });
+};
+const normalizeStoreName = (name) => {
+    const raw = String(name ?? '')
+        .trim()
+        .toLowerCase();
+    if (raw === 'redis')
+        return 'redis';
+    if (raw === 'kv')
+        return 'kv';
+    if (raw === 'db' || raw === 'database' || raw === 'mongo' || raw === 'mongodb')
+        return 'db';
+    return 'memory';
+};
+const resolveStore = (name) => {
+    const selected = normalizeStoreName((name ?? Env.RATE_LIMIT_STORE) || Env.RATE_LIMIT_DRIVER || 'memory');
+    if (selected === 'redis')
+        return { storeName: 'redis', store: createCacheStore('redis') };
+    if (selected === 'kv')
+        return { storeName: 'kv', store: createCacheStore('kv') };
+    if (selected === 'db')
+        return { storeName: 'db', store: createCacheStore('mongodb') };
+    return { storeName: 'memory', store: createMemoryStore() };
+};
+let serviceStoreSelection = normalizeStoreName(Env.RATE_LIMIT_STORE || Env.RATE_LIMIT_DRIVER || 'memory');
+let serviceStore = resolveStore(serviceStoreSelection).store;
+const prefixKey = (purpose, key) => {
+    const prefix = Env.RATE_LIMIT_KEY_PREFIX.trim();
+    return `${prefix}${purpose}:${key}`;
+};
+const consume = async (params) => {
+    const now = Date.now();
+    const ttlSeconds = Math.max(1, Math.ceil(params.windowMs / 1000));
+    const existing = await params.store.get(params.key);
+    const state = existing === null || now > existing.resetTime
+        ? { count: 0, resetTime: now + params.windowMs }
+        : existing;
+    const nextCount = state.count + 1;
+    const nextState = { count: nextCount, resetTime: state.resetTime };
+    await params.store.set(params.key, nextState, ttlSeconds);
+    return {
+        count: nextCount,
+        resetTime: nextState.resetTime,
+        allowed: nextCount <= params.max,
+    };
+};
+const resolveRemoteAddress = (candidate) => {
+    if (candidate === null || candidate === undefined)
+        return undefined;
+    if (typeof candidate !== 'object')
+        return undefined;
+    const record = candidate;
+    const ip = record['remoteAddress'];
+    return typeof ip === 'string' && ip.length > 0 ? ip : undefined;
+};
+const resolveRemoteAddressFromRaw = (raw) => {
+    if (raw === null || raw === undefined)
+        return undefined;
+    if (typeof raw !== 'object')
+        return undefined;
+    const rawRecord = raw;
+    return (resolveRemoteAddress(rawRecord['socket']) ??
+        resolveRemoteAddress(rawRecord['connection']) ??
+        resolveRemoteAddress(raw));
+};
+const DEFAULT_OPTIONS = {
+    windowMs: 60 * 1000, // 1 minute
+    max: 100, // 100 requests per minute
+    message: 'Too many requests, please try again later.',
+    statusCode: 429,
+    headers: true,
+    keyGenerator: (req) => {
+        const forwardedFor = req.getHeader('x-forwarded-for');
+        const forwardedForIp = typeof forwardedFor === 'string' && forwardedFor.length > 0
+            ? forwardedFor.split(',')[0]?.trim()
+            : undefined;
+        const raw = req.getRaw();
+        const rawIp = resolveRemoteAddressFromRaw(raw);
+        return forwardedForIp ?? rawIp ?? 'unknown';
+    },
+};
+export const RateLimiter = Object.freeze({
+    /**
+     * Configure the store used by the programmatic API (attempt/tooManyAttempts/till/clear).
+     * Defaults to 'memory'.
+     */
+    configure(config) {
+        serviceStoreSelection = normalizeStoreName(config?.store);
+        serviceStore = resolveStore(serviceStoreSelection).store;
+    },
+    /**
+     * Attempt to perform an action.
+     *
+     * Returns true if allowed (and records the hit), false if rate limited.
+     */
+    async attempt(key, maxAttempts, decaySeconds) {
+        const windowMs = Math.max(1, Math.floor(decaySeconds * 1000));
+        const namespacedKey = prefixKey('service', key);
+        const out = await consume({
+            store: serviceStore,
+            key: namespacedKey,
+            max: maxAttempts,
+            windowMs,
+        });
+        return out.allowed;
+    },
+    /**
+     * Check if the key is currently rate limited.
+     */
+    async tooManyAttempts(key, maxAttempts) {
+        const now = Date.now();
+        const namespacedKey = prefixKey('service', key);
+        const state = await serviceStore.get(namespacedKey);
+        if (!state || now > state.resetTime)
+            return false;
+        return state.count >= maxAttempts;
+    },
+    /**
+     * Seconds until the key is available again.
+     * Returns 0 if not rate limited.
+     */
+    async till(key) {
+        const now = Date.now();
+        const namespacedKey = prefixKey('service', key);
+        const state = await serviceStore.get(namespacedKey);
+        if (!state || now > state.resetTime)
+            return 0;
+        return Math.max(0, Math.ceil((state.resetTime - now) / 1000));
+    },
+    /**
+     * Clear rate limit state for a key.
+     */
+    async clear(key) {
+        const namespacedKey = prefixKey('service', key);
+        await serviceStore.delete(namespacedKey);
+    },
+    /**
+     * Create rate limiter middleware
+     */
+    create(options = DEFAULT_OPTIONS) {
+        const config = { ...DEFAULT_OPTIONS, ...options };
+        const { storeName, store } = resolveStore(config.store);
+        const useMemoryInstanceStore = storeName === 'memory';
+        // Middleware store is per-instance (matches prior behavior).
+        const clients = new Map();
+        // Cleanup to prevent unbounded growth.
+        // Done lazily (on requests) to avoid background timers in serverless/test environments.
+        let nextCleanupAt = Date.now() + config.windowMs;
+        const cleanupExpiredClients = (now) => {
+            if (now < nextCleanupAt)
+                return;
+            for (const [k, state] of clients.entries()) {
+                if (now > state.resetTime) {
+                    clients.delete(k);
+                }
+            }
+            nextCleanupAt = now + config.windowMs;
+        };
+        const getOrInitClient = (key, now) => {
+            let client = clients.get(key);
+            if (!client || now > client.resetTime) {
+                client = { count: 0, resetTime: now + config.windowMs };
+                clients.set(key, client);
+            }
+            return client;
+        };
+        return async (req, res, next) => {
+            const key = config.keyGenerator ? config.keyGenerator(req) : 'unknown';
+            const now = Date.now();
+            let count;
+            let resetAt;
+            if (useMemoryInstanceStore) {
+                cleanupExpiredClients(now);
+                const client = getOrInitClient(key, now);
+                client.count++;
+                count = client.count;
+                resetAt = client.resetTime;
+            }
+            else {
+                // Include limiter config to avoid collisions between different middleware instances.
+                const middlewareKey = prefixKey('middleware', `${config.max}:${config.windowMs}:${key}`);
+                const out = await consume({
+                    store,
+                    key: middlewareKey,
+                    max: config.max,
+                    windowMs: config.windowMs,
+                });
+                count = out.count;
+                resetAt = out.resetTime;
+            }
+            const remaining = Math.max(0, config.max - count);
+            const resetTime = Math.ceil((resetAt - now) / 1000);
+            // Set headers
+            if (config.headers ?? false) {
+                res.setHeader('X-RateLimit-Limit', config.max.toString());
+                res.setHeader('X-RateLimit-Remaining', remaining.toString());
+                res.setHeader('X-RateLimit-Reset', resetTime.toString());
+            }
+            // Check limit
+            if (count > config.max) {
+                Logger.warn(`Rate limit exceeded for IP: ${key}`);
+                res.setStatus(config.statusCode ?? 429);
+                res.json({
+                    error: 'Too Many Requests',
+                    message: config.message,
+                });
+                return;
+            }
+            await next();
+        };
+    },
+});

package/src/middleware/SanitizeBodyMiddleware.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Sanitize Body Middleware
+ * Applies recursive XSS sanitization (tag stripping + entity escaping) to JSON request bodies.
+ *
+ * This is a defense-in-depth layer that normalizes untrusted input early.
+ */
+import type { Middleware } from './MiddlewareStack';
+export declare const SanitizeBodyMiddleware: Readonly<{
+    create(): Middleware;
+}>;
+export default SanitizeBodyMiddleware;
+//# sourceMappingURL=SanitizeBodyMiddleware.d.ts.map

package/src/middleware/SanitizeBodyMiddleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SanitizeBodyMiddleware.d.ts","sourceRoot":"","sources":["../../../src/middleware/SanitizeBodyMiddleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAG9D,eAAO,MAAM,sBAAsB;cACvB,UAAU;EAyBpB,CAAC;AAEH,eAAe,sBAAsB,CAAC"}

package/src/middleware/SanitizeBodyMiddleware.js

@@ -0,0 +1,31 @@
+/**
+ * Sanitize Body Middleware
+ * Applies recursive XSS sanitization (tag stripping + entity escaping) to JSON request bodies.
+ *
+ * This is a defense-in-depth layer that normalizes untrusted input early.
+ */
+import { Xss } from '../security/Xss.js';
+export const SanitizeBodyMiddleware = Object.freeze({
+    create() {
+        return async (req, _res, next) => {
+            const method = req.getMethod();
+            if (method === 'GET' || method === 'HEAD' || method === 'OPTIONS' || method === 'DELETE') {
+                await next();
+                return;
+            }
+            if (req.isJson() === false) {
+                await next();
+                return;
+            }
+            const rawBody = req.getBody();
+            if (rawBody === undefined || rawBody === null) {
+                await next();
+                return;
+            }
+            const sanitized = Xss.sanitize(rawBody);
+            req.setBody(sanitized);
+            await next();
+        };
+    },
+});
+export default SanitizeBodyMiddleware;

package/src/middleware/SecurityMiddleware.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Security Middleware
+ * Implements standard security headers and CORS protection
+ * Zero-dependency implementation replacing helmet/cors
+ */
+import type { Middleware } from './MiddlewareStack';
+export interface SecurityOptions {
+    hsts?: {
+        maxAge?: number;
+        includeSubDomains?: boolean;
+        preload?: boolean;
+    };
+    frameguard?: {
+        action?: 'DENY' | 'SAMEORIGIN';
+    };
+    cors?: {
+        origin?: string;
+        methods?: string[];
+        allowedHeaders?: string[];
+        credentials?: boolean;
+        maxAge?: number;
+    };
+    csp?: {
+        directives?: Record<string, string[]>;
+    };
+}
+export declare const SecurityMiddleware: Readonly<{
+    /**
+     * Create security middleware with options
+     */
+    create(options?: SecurityOptions): Middleware;
+}>;
+//# sourceMappingURL=SecurityMiddleware.d.ts.map

package/src/middleware/SecurityMiddleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityMiddleware.d.ts","sourceRoot":"","sources":["../../../src/middleware/SecurityMiddleware.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE;QACL,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,UAAU,CAAC,EAAE;QACX,MAAM,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;KAChC,CAAC;IACF,IAAI,CAAC,EAAE;QACL,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,GAAG,CAAC,EAAE;QACJ,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;KACvC,CAAC;CACH;AA+FD,eAAO,MAAM,kBAAkB;IAC7B;;OAEG;qBACa,eAAe,GAAQ,UAAU;EAgBjD,CAAC"}