@zintrust/core 0.4.15 → 0.4.17

package/src/middleware/BulletproofAuthMiddleware.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"BulletproofAuthMiddleware.d.ts","sourceRoot":"","sources":["../../../src/middleware/BulletproofAuthMiddleware.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAG9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAc,MAAM,sBAAsB,CAAC;AAGrE,OAAO,EAAe,KAAK,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAG9E,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,aAAa,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;CACH,CAAC;AAEF,MAAM,WAAW,sBAAsB;IACrC,SAAS,CAAC,EAAE,YAAY,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAElC;;;OAGG;IACH,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEpC;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IAEpC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEtC;;;OAGG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IAEpC;;;OAGG;IACH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAE3C;;;OAGG;IACH,iBAAiB,CAAC,EAAE,CAClB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,QAAQ,KACV,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAEtD;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAC;CACnC;AAkkBD,eAAO,MAAM,yBAAyB;qBACpB,sBAAsB,GAAQ,UAAU;EAIxD,CAAC;AAEH,eAAe,yBAAyB,CAAC"}

package/src/middleware/BulletproofAuthMiddleware.js

@@ -1,421 +0,0 @@
-import { Env } from '../config/env.js';
-import { Logger } from '../config/logger.js';
-import { securityConfig } from '../config/security.js';
-import { isMaxLength, isMinLength, isNonEmptyString } from '../helper/index.js';
-import { RequestContext } from '../http/RequestContext.js';
-import { JwtManager } from '../security/JwtManager.js';
-import { JwtSessions } from '../security/JwtSessions.js';
-import { NonceReplay } from '../security/NonceReplay.js';
-import { SignedRequest } from '../security/SignedRequest.js';
-const getHeaderString = (req, name) => {
-    const header = req.getHeader(name);
-    if (Array.isArray(header))
-        return typeof header[0] === 'string' ? header[0] : '';
-    return typeof header === 'string' ? header : '';
-};
-const getBearerToken = (authorizationHeader) => {
-    const trimmed = authorizationHeader.trim();
-    if (trimmed === '')
-        return null;
-    const [scheme, ...rest] = trimmed.split(/\s+/);
-    if (typeof scheme !== 'string' || scheme.toLowerCase() !== 'bearer')
-        return null;
-    const token = rest.join(' ').trim();
-    return token === '' ? null : token;
-};
-const pickOptionalStringClaim = (payload, keys) => {
-    const record = payload;
-    for (const key of keys) {
-        const value = record[key];
-        if (typeof value === 'string' && value.trim() !== '')
-            return value.trim();
-    }
-    return undefined;
-};
-const toBodyForSigning = (req) => {
-    const rawText = req.context?.['rawBodyText'];
-    if (typeof rawText === 'string')
-        return rawText;
-    const rawBytes = req.context?.['rawBodyBytes'];
-    if (rawBytes instanceof Uint8Array)
-        return rawBytes;
-    if (rawBytes instanceof ArrayBuffer)
-        return new Uint8Array(rawBytes);
-    return '';
-};
-const toUrlForSigning = (req) => {
-    const raw = req.getRaw?.();
-    const rawUrl = typeof raw?.url === 'string' ? raw.url : undefined;
-    const path = rawUrl ?? req.getPath?.() ?? '/';
-    try {
-        return new URL(path);
-    }
-    catch {
-        return new URL(path.startsWith('/') ? path : `/${path}`, 'http://localhost');
-    }
-};
-const markAuthContext = (req, ctx) => {
-    req.context ??= {};
-    req.context['auth'] = ctx;
-    req.context['authStrategy'] = 'bulletproof';
-};
-const respond401 = (res, message) => {
-    res.setStatus(401).json({ error: message });
-};
-const parseBulletproofHeaders = (params) => {
-    const deviceId = getHeaderString(params.req, params.deviceIdHeader).trim();
-    if (params.requireDeviceId) {
-        const ok = isNonEmptyString(deviceId) && isMaxLength(deviceId, 128);
-        if (!ok)
-            return { ok: false, message: 'Missing or invalid device id' };
-    }
-    const timezone = getHeaderString(params.req, params.timezoneHeader).trim();
-    if (params.requireTimezone) {
-        const ok = isNonEmptyString(timezone) && isMaxLength(timezone, 64);
-        if (!ok)
-            return { ok: false, message: 'Missing or invalid timezone' };
-    }
-    const signingHeaders = {
-        'x-zt-key-id': getHeaderString(params.req, 'x-zt-key-id').trim() || undefined,
-        'x-zt-timestamp': getHeaderString(params.req, 'x-zt-timestamp').trim() || undefined,
-        'x-zt-nonce': getHeaderString(params.req, 'x-zt-nonce').trim() || undefined,
-        'x-zt-body-sha256': getHeaderString(params.req, 'x-zt-body-sha256').trim() || undefined,
-        'x-zt-signature': getHeaderString(params.req, 'x-zt-signature').trim() || undefined,
-    };
-    return { ok: true, deviceId, timezone, signingHeaders };
-};
-const verifySignedRequest = async (params) => {
-    const baseParams = {
-        method: params.req.getMethod?.() ?? 'GET',
-        url: toUrlForSigning(params.req),
-        body: toBodyForSigning(params.req),
-        headers: params.signingHeaders,
-        nowMs: Date.now(),
-        windowMs: params.windowMs,
-        verifyNonce: async (keyId, nonce, ttlMs) => {
-            const ok = isNonEmptyString(nonce) && isMinLength(nonce, 8) && isMaxLength(nonce, 128);
-            if (!ok)
-                return false;
-            return params.verifyNonce(keyId, nonce, ttlMs);
-        },
-    };
-    const staticSecrets = params.staticSecrets
-        ?.map((s) => (typeof s === 'string' ? s.trim() : ''))
-        .filter((s) => s !== '');
-    const signed = staticSecrets !== undefined && staticSecrets.length > 0
-        ? await (async () => {
-            const attempts = await Promise.all(staticSecrets.map(async (secret) => SignedRequest.verify({
-                ...baseParams,
-                getSecretForKeyId: () => secret,
-            })));
-            // Preserve preference order based on provided secret list.
-            for (const attempt of attempts) {
-                if (attempt.ok === true)
-                    return attempt;
-            }
-            // If any attempt failed for a reason other than signature mismatch, return that.
-            for (const attempt of attempts) {
-                if (attempt.ok === false && attempt.code !== 'INVALID_SIGNATURE')
-                    return attempt;
-            }
-            return { ok: false, code: 'INVALID_SIGNATURE', message: 'Invalid signature' };
-        })()
-        : await SignedRequest.verify({
-            ...baseParams,
-            getSecretForKeyId: async (keyId) => {
-                const secretForKey = await params.getSecretForKeyId(keyId, params.req);
-                const normalized = typeof secretForKey === 'string' ? secretForKey.trim() : '';
-                return normalized === '' ? undefined : normalized;
-            },
-        });
-    if (!signed.ok) {
-        Logger.debug('Bulletproof auth signed-request verification failed', {
-            code: signed.code,
-            message: signed.message,
-        });
-        return { ok: false, message: 'Unauthorized' };
-    }
-    return {
-        ok: true,
-        keyId: signed.keyId,
-        timestampMs: signed.timestampMs,
-        nonce: signed.nonce,
-    };
-};
-const verifyJwtPayload = (params) => {
-    try {
-        return { ok: true, payload: params.jwt.verify(params.token, params.algorithm) };
-    }
-    catch (error) {
-        Logger.debug('Bulletproof auth JWT verification failed', {
-            algorithm: params.algorithm,
-            error: error instanceof Error ? error.message : String(error),
-        });
-        return { ok: false };
-    }
-};
-const enforceDeviceBindings = (params) => {
-    if (params.requireDeviceId && params.deviceId !== '' && params.deviceId !== params.keyId) {
-        return { ok: false, message: 'Device mismatch' };
-    }
-    if (params.requireDeviceClaimMatch) {
-        const claimedDevice = pickOptionalStringClaim(params.payload, params.deviceClaimKeys);
-        const mismatch = claimedDevice === undefined || (params.deviceId !== '' && claimedDevice !== params.deviceId);
-        if (mismatch)
-            return { ok: false, message: 'Device mismatch' };
-    }
-    return { ok: true };
-};
-const enforceTimezoneBindings = (params) => {
-    if (!params.requireTimezoneClaimMatch || params.timezone === '') {
-        return { ok: true };
-    }
-    const claimedTimezone = pickOptionalStringClaim(params.payload, params.timezoneClaimKeys);
-    if (claimedTimezone !== undefined && claimedTimezone !== params.timezone) {
-        return { ok: false, message: 'Timezone mismatch' };
-    }
-    return { ok: true };
-};
-const enforceUserAgentBindings = async (params) => {
-    if (!params.requireUserAgentHashMatch)
-        return { ok: true };
-    const claimedUaHash = pickOptionalStringClaim(params.payload, params.userAgentHashClaimKeys);
-    if (claimedUaHash === undefined)
-        return { ok: true };
-    const userAgent = getHeaderString(params.req, 'user-agent').trim();
-    const uaHash = await SignedRequest.sha256Hex(userAgent);
-    if (uaHash !== claimedUaHash) {
-        return { ok: false, message: 'User agent mismatch' };
-    }
-    return { ok: true };
-};
-const enforceJwtBindings = async (params) => {
-    const device = enforceDeviceBindings({
-        payload: params.payload,
-        deviceId: params.deviceId,
-        keyId: params.keyId,
-        requireDeviceId: params.requireDeviceId,
-        requireDeviceClaimMatch: params.requireDeviceClaimMatch,
-        deviceClaimKeys: params.deviceClaimKeys,
-    });
-    if (!device.ok)
-        return device;
-    const tz = enforceTimezoneBindings({
-        payload: params.payload,
-        timezone: params.timezone,
-        requireTimezoneClaimMatch: params.requireTimezoneClaimMatch,
-        timezoneClaimKeys: params.timezoneClaimKeys,
-    });
-    if (!tz.ok)
-        return tz;
-    return enforceUserAgentBindings({
-        req: params.req,
-        payload: params.payload,
-        requireUserAgentHashMatch: params.requireUserAgentHashMatch,
-        userAgentHashClaimKeys: params.userAgentHashClaimKeys,
-    });
-};
-const resolveJwtVerifier = (options) => {
-    const algorithm = options.algorithm ?? securityConfig.jwt.algorithm;
-    const secret = options.secret ?? securityConfig.jwt.secret;
-    const windowMs = options.windowMs ?? 60_000;
-    const jwt = JwtManager.create();
-    if (algorithm === 'HS256' || algorithm === 'HS512') {
-        jwt.setHmacSecret(secret);
-    }
-    return { algorithm, jwt, windowMs };
-};
-const resolveHeaderConfig = (options) => {
-    return {
-        deviceIdHeader: (options.deviceIdHeader ?? 'x-zt-device-id').toLowerCase(),
-        timezoneHeader: (options.timezoneHeader ?? 'x-zt-timezone').toLowerCase(),
-        requireDeviceId: options.requireDeviceId ?? true,
-        requireTimezone: options.requireTimezone ?? false,
-    };
-};
-const resolveClaimConfig = (options) => {
-    return {
-        requireDeviceClaimMatch: options.requireDeviceClaimMatch ?? true,
-        deviceClaimKeys: options.deviceClaimKeys ?? ['deviceId', 'device_id', 'did'],
-        requireTimezoneClaimMatch: options.requireTimezoneClaimMatch ?? true,
-        timezoneClaimKeys: options.timezoneClaimKeys ?? ['tz', 'timezone', 'timeZone'],
-        requireUserAgentHashMatch: options.requireUserAgentHashMatch ?? true,
-        userAgentHashClaimKeys: options.userAgentHashClaimKeys ?? ['uaHash', 'uah', 'userAgentHash'],
-    };
-};
-const parseBackupSecrets = (raw) => {
-    const value = raw.trim();
-    if (value === '')
-        return [];
-    // JSON array support: ["a","b"]
-    if (value.startsWith('[')) {
-        try {
-            const parsed = JSON.parse(value);
-            if (!Array.isArray(parsed))
-                return [];
-            return parsed
-                .filter((v) => typeof v === 'string')
-                .map((s) => s.trim())
-                .filter((s) => s !== '');
-        }
-        catch {
-            return [];
-        }
-    }
-    // Comma-separated support: a,b,c
-    return value
-        .split(',')
-        .map((s) => s.trim())
-        .filter((s) => s !== '');
-};
-const dedupeSecrets = (secrets) => {
-    const out = [];
-    const seen = new Set();
-    for (const secret of secrets) {
-        const trimmed = typeof secret === 'string' ? secret.trim() : '';
-        if (trimmed === '')
-            continue;
-        if (seen.has(trimmed))
-            continue;
-        seen.add(trimmed);
-        out.push(trimmed);
-    }
-    return out;
-};
-const resolveSigningConfig = (options) => {
-    const appKeyFallback = (Env.get('AUTH_KEY', '') || Env.get('APP_KEY', '')).trim();
-    const signingSecretFromEnv = Env.get('BULLETPROOF_SIGNING_SECRET', appKeyFallback).trim();
-    const signingSecret = (options.signingSecret ?? signingSecretFromEnv).trim();
-    const backupSecrets = parseBackupSecrets(Env.get('BULLETPROOF_SIGNING_SECRET_BK', ''));
-    const hasCustomResolver = typeof options.getSecretForKeyId === 'function';
-    const getSecretForKeyId = hasCustomResolver
-        ? options.getSecretForKeyId
-        : (_keyId) => (signingSecret === '' ? undefined : signingSecret);
-    const verifyNonce = options.verifyNonce ?? NonceReplay.createMemoryVerifier();
-    const staticSigningSecrets = hasCustomResolver
-        ? undefined
-        : dedupeSecrets([signingSecret, ...backupSecrets]);
-    return { getSecretForKeyId, verifyNonce, staticSigningSecrets };
-};
-const resolveBulletproof = (options) => {
-    return {
-        ...resolveJwtVerifier(options),
-        ...resolveHeaderConfig(options),
-        ...resolveClaimConfig(options),
-        ...resolveSigningConfig(options),
-    };
-};
-const getTokenOrFail = (req) => {
-    const authorizationHeader = getHeaderString(req, 'authorization');
-    if (authorizationHeader === '')
-        return { ok: false, message: 'Missing authorization header' };
-    const token = getBearerToken(authorizationHeader);
-    if (token === null)
-        return { ok: false, message: 'Invalid authorization header format' };
-    return { ok: true, token };
-};
-const authenticate = async (params) => {
-    const tokenResult = getTokenOrFail(params.req);
-    if (!tokenResult.ok)
-        return tokenResult;
-    const parsed = parseBulletproofHeaders({
-        req: params.req,
-        deviceIdHeader: params.resolved.deviceIdHeader,
-        timezoneHeader: params.resolved.timezoneHeader,
-        requireDeviceId: params.resolved.requireDeviceId,
-        requireTimezone: params.resolved.requireTimezone,
-    });
-    if (!parsed.ok)
-        return { ok: false, message: parsed.message };
-    const signed = await verifySignedRequest({
-        req: params.req,
-        signingHeaders: parsed.signingHeaders,
-        windowMs: params.resolved.windowMs,
-        verifyNonce: params.resolved.verifyNonce,
-        getSecretForKeyId: params.resolved.getSecretForKeyId,
-        staticSecrets: params.resolved.staticSigningSecrets,
-    });
-    if (!signed.ok)
-        return { ok: false, message: signed.message };
-    const jwtResult = verifyJwtPayload({
-        jwt: params.resolved.jwt,
-        token: tokenResult.token,
-        algorithm: params.resolved.algorithm,
-    });
-    if (!jwtResult.ok)
-        return { ok: false, message: 'Invalid or expired token' };
-    // Session allowlist: token must exist in the sessions store to be accepted.
-    if (!(await JwtSessions.isActive(tokenResult.token))) {
-        return { ok: false, message: 'Invalid or expired token' };
-    }
-    const binding = await enforceJwtBindings({
-        req: params.req,
-        payload: jwtResult.payload,
-        deviceId: parsed.deviceId,
-        timezone: parsed.timezone,
-        keyId: signed.keyId,
-        requireDeviceId: params.resolved.requireDeviceId,
-        requireDeviceClaimMatch: params.resolved.requireDeviceClaimMatch,
-        deviceClaimKeys: params.resolved.deviceClaimKeys,
-        requireTimezoneClaimMatch: params.resolved.requireTimezoneClaimMatch,
-        timezoneClaimKeys: params.resolved.timezoneClaimKeys,
-        requireUserAgentHashMatch: params.resolved.requireUserAgentHashMatch,
-        userAgentHashClaimKeys: params.resolved.userAgentHashClaimKeys,
-    });
-    if (!binding.ok)
-        return { ok: false, message: binding.message };
-    return {
-        ok: true,
-        token: tokenResult.token,
-        payload: jwtResult.payload,
-        parsed,
-        signed,
-    };
-};
-const attachAuth = (req, result) => {
-    req.user = result.payload;
-    if (typeof result.payload.sub === 'string' && result.payload.sub.trim() !== '') {
-        RequestContext.setUserId(req, result.payload.sub);
-    }
-    const anyPayload = result.payload;
-    const tenantId = anyPayload['tenantId'] ?? anyPayload['tenant_id'];
-    if ((typeof tenantId === 'string' && tenantId.trim() !== '') ||
-        (typeof tenantId === 'number' && Number.isFinite(tenantId))) {
-        RequestContext.setTenantId(req, String(tenantId));
-    }
-    markAuthContext(req, {
-        strategy: 'bulletproof',
-        deviceId: result.parsed.deviceId === '' ? result.signed.keyId : result.parsed.deviceId,
-        keyId: result.signed.keyId,
-        signedRequest: {
-            timestampMs: result.signed.timestampMs,
-            nonce: result.signed.nonce,
-        },
-    });
-    if (result.parsed.timezone !== '') {
-        req.context ??= {};
-        req.context['timezone'] = result.parsed.timezone;
-    }
-};
-const createHandler = (resolved) => {
-    return async (req, res, next) => {
-        if (req.context?.['authStrategy'] === 'bulletproof' && req.user !== undefined) {
-            await next();
-            return;
-        }
-        const result = await authenticate({ req, resolved });
-        if (!result.ok) {
-            respond401(res, result.message);
-            return;
-        }
-        attachAuth(req, result);
-        await next();
-    };
-};
-export const BulletproofAuthMiddleware = Object.freeze({
-    create(options = {}) {
-        const resolved = resolveBulletproof(options);
-        return createHandler(resolved);
-    },
-});
-export default BulletproofAuthMiddleware;

package/src/middleware/CsrfMiddleware.d.ts

@@ -1,28 +0,0 @@
-/**
- * CSRF Middleware
- * Protects against Cross-Site Request Forgery attacks
- * Uses CsrfTokenManager for token generation and validation
- */
-import type { Middleware } from './MiddlewareStack';
-export interface CsrfOptions {
-    cookieName?: string;
-    headerName?: string;
-    bodyKey?: string;
-    ignoreMethods?: string[];
-    /**
-     * Optional path patterns to bypass CSRF entirely.
-     *
-     * Supports simple glob-style matching where `*` matches any characters.
-     * Examples:
-     * - `/api/*`
-     * - `/api/v1/auth/login`
-     */
-    skipPaths?: string[];
-}
-export declare const CsrfMiddleware: Readonly<{
-    /**
-     * Create CSRF protection middleware
-     */
-    create(options?: CsrfOptions): Middleware;
-}>;
-//# sourceMappingURL=CsrfMiddleware.d.ts.map

package/src/middleware/CsrfMiddleware.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"CsrfMiddleware.d.ts","sourceRoot":"","sources":["../../../src/middleware/CsrfMiddleware.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAK9D,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAkDD,eAAO,MAAM,cAAc;IACzB;;OAEG;qBACa,WAAW,GAAQ,UAAU;EA6D7C,CAAC"}

package/src/middleware/CsrfMiddleware.js

@@ -1,168 +0,0 @@
-/**
- * CSRF Middleware
- * Protects against Cross-Site Request Forgery attacks
- * Uses CsrfTokenManager for token generation and validation
- */
-import { Logger } from '../config/logger.js';
-import { CsrfTokenManager } from '../security/CsrfTokenManager.js';
-import { SessionManager } from '../session/SessionManager.js';
-const DEFAULT_OPTIONS = {
-    cookieName: 'XSRF-TOKEN',
-    headerName: 'X-CSRF-Token',
-    bodyKey: '_csrf',
-    ignoreMethods: ['GET', 'HEAD', 'OPTIONS'],
-};
-// Global cleanup registry to avoid leaking intervals per middleware instance
-// We use WeakRef so the manager (and middleware) can be garbage collected
-// when no longer in use, even if this interval keeps running.
-const canUseWeakRef = typeof WeakRef === 'function';
-const managerRegistry = new Set();
-let globalCleanupTimer = null;
-let sharedSessionManager = null;
-const getSharedSessionManager = () => {
-    if (sharedSessionManager !== null)
-        return sharedSessionManager;
-    sharedSessionManager = SessionManager.create();
-    return sharedSessionManager;
-};
-const ensureCleanupTimer = () => {
-    if (globalCleanupTimer !== null)
-        return;
-    if (typeof setInterval !== 'function')
-        return;
-    if (globalThis.CF !== undefined)
-        return;
-    if (!canUseWeakRef)
-        return;
-    globalCleanupTimer = setInterval(() => {
-        if (managerRegistry.size === 0)
-            return;
-        for (const ref of managerRegistry) {
-            const mgr = ref.deref();
-            if (mgr) {
-                void mgr.cleanup().catch(() => undefined);
-            }
-            else {
-                managerRegistry.delete(ref);
-            }
-        }
-    }, 3600000);
-    // Use helper to handle runtime differences (Node vs others)
-    if (globalCleanupTimer !== null && isUnrefableTimer(globalCleanupTimer)) {
-        globalCleanupTimer.unref();
-    }
-};
-export const CsrfMiddleware = Object.freeze({
-    /**
-     * Create CSRF protection middleware
-     */
-    create(options = {}) {
-        const config = { ...DEFAULT_OPTIONS, ...options };
-        const manager = CsrfTokenManager.create();
-        const sessions = getSharedSessionManager();
-        ensureCleanupTimer();
-        // Register for global cleanup instead of creating a local timer
-        if (canUseWeakRef) {
-            managerRegistry.add(new WeakRef(manager));
-        }
-        return async (req, res, next) => {
-            if (shouldSkipCsrfForRequest(req, config)) {
-                await next();
-                return;
-            }
-            const cookieHeader = req.getHeader('cookie');
-            const cookies = parseCookies(typeof cookieHeader === 'string' ? cookieHeader : '');
-            // Guarantee a session id exists and a session cookie is set if missing.
-            // This allows CSRF tokens to be bound to a stable session identifier.
-            const sessionId = await sessions.ensureSessionId(req, res);
-            const method = req.getMethod();
-            // 1. Token Generation (for safe methods)
-            if (config.ignoreMethods?.includes(method) ?? false) {
-                const token = await manager.generateToken(sessionId);
-                // Set cookie for Double Submit Cookie pattern (readable by frontend)
-                appendSetCookie(res, `${config.cookieName}=${token}; Path=/; SameSite=Strict`);
-                // Also expose in locals for server-side rendering
-                res.locals['csrfToken'] = token;
-                await next();
-                return;
-            }
-            // 2. Token Validation (for unsafe methods)
-            const tokenFromHeader = req.getHeader(config.headerName ?? 'X-CSRF-Token');
-            const tokenFromBody = req.getBody()?.[config.bodyKey ?? '_csrf'];
-            const tokenFromCookie = cookies[config.cookieName ?? 'XSRF-TOKEN'];
-            const token = tokenFromHeader || tokenFromBody || tokenFromCookie;
-            if (!token || !(await manager.validateToken(sessionId, token))) {
-                Logger.warn(`CSRF validation failed for session ${sessionId}`);
-                res.setStatus(403);
-                res.json({
-                    error: 'Forbidden',
-                    message: 'Invalid CSRF token',
-                });
-                return;
-            }
-            await next();
-        };
-    },
-});
-function shouldSkipCsrfForRequest(req, config) {
-    const patterns = config.skipPaths;
-    if (patterns === undefined || patterns.length === 0)
-        return false;
-    const path = req.getPath();
-    for (const pattern of patterns) {
-        const trimmed = pattern.trim();
-        if (trimmed === '')
-            continue;
-        if (pathMatchesPattern(path, trimmed))
-            return true;
-    }
-    return false;
-}
-function pathMatchesPattern(path, pattern) {
-    if (pattern === '*')
-        return true;
-    if (pattern === path)
-        return true;
-    // Fast path: treat trailing "/*" as a prefix match.
-    if (pattern.endsWith('/*')) {
-        const prefix = pattern.slice(0, -1); // keep the trailing '/'
-        return path.startsWith(prefix);
-    }
-    // Generic glob-to-regex conversion where '*' matches any characters.
-    const escaped = pattern.replaceAll(/[.+?^${}()|[\]\\]/g, String.raw `\$&`);
-    const regex = new RegExp(`^${escaped.replaceAll('*', '.*')}$`);
-    return regex.test(path);
-}
-function appendSetCookie(res, cookie) {
-    const existing = res.getHeader('Set-Cookie');
-    if (existing === undefined) {
-        res.setHeader('Set-Cookie', cookie);
-        return;
-    }
-    if (Array.isArray(existing)) {
-        res.setHeader('Set-Cookie', [...existing, cookie]);
-        return;
-    }
-    res.setHeader('Set-Cookie', [existing, cookie]);
-}
-/**
- * Helper to parse cookies
- */
-function parseCookies(cookieHeader) {
-    const list = {};
-    if (!cookieHeader)
-        return list;
-    cookieHeader.split(';').forEach((cookie) => {
-        const parts = cookie.split('=');
-        const name = parts.shift()?.trim();
-        const value = parts.join('=');
-        if (name !== null && name !== undefined)
-            list[name] = decodeURIComponent(value);
-    });
-    return list;
-}
-function isUnrefableTimer(value) {
-    if (typeof value !== 'object' || value === null)
-        return false;
-    return 'unref' in value && typeof value.unref === 'function';
-}

package/src/middleware/ErrorHandlerMiddleware.d.ts

@@ -1,6 +0,0 @@
-import type { Middleware } from './MiddlewareStack';
-export declare const ErrorHandlerMiddleware: Readonly<{
-    create(): Middleware;
-}>;
-export default ErrorHandlerMiddleware;
-//# sourceMappingURL=ErrorHandlerMiddleware.d.ts.map

package/src/middleware/ErrorHandlerMiddleware.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ErrorHandlerMiddleware.d.ts","sourceRoot":"","sources":["../../../src/middleware/ErrorHandlerMiddleware.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAU9D,eAAO,MAAM,sBAAsB;cACvB,UAAU;EAsCpB,CAAC;AAEH,eAAe,sBAAsB,CAAC"}

package/src/middleware/ErrorHandlerMiddleware.js

@@ -1,42 +0,0 @@
-import { Env } from '../config/env.js';
-import { Logger } from '../config/logger.js';
-import ErrorRouting from '../routes/error.js';
-import { ErrorResponse } from '../http/ErrorResponse.js';
-import { RequestContext } from '../http/RequestContext.js';
-const isWritableEnded = (res) => {
-    if (typeof res.getRaw !== 'function')
-        return false;
-    const raw = res.getRaw();
-    if (typeof raw !== 'object' || raw === null)
-        return false;
-    if (!('writableEnded' in raw))
-        return false;
-    return Boolean(raw.writableEnded);
-};
-export const ErrorHandlerMiddleware = Object.freeze({
-    create() {
-        return async (req, res, next) => {
-            try {
-                await next();
-            }
-            catch (error) {
-                Logger.error('Unhandled request error:', error);
-                const requestId = RequestContext.get(req)?.requestId ?? req.context['requestId'];
-                const includeStack = Env.NODE_ENV !== 'production';
-                if (!isWritableEnded(res)) {
-                    const errorMode = Env.get('ERROR_MODE', 'html');
-                    res.setStatus(500);
-                    if (errorMode === 'html') {
-                        // Use HTML error page instead of JSON
-                        const handleInternalServerErrorWithWrappers = ErrorRouting.handleInternalServerErrorWithWrappers;
-                        await handleInternalServerErrorWithWrappers(req, res, error, requestId);
-                    }
-                    else {
-                        res.json(ErrorResponse.internalServerError('Internal server error', requestId, includeStack ? error?.stack : undefined));
-                    }
-                }
-            }
-        };
-    },
-});
-export default ErrorHandlerMiddleware;