@zipbul/cors 0.0.1

package/dist/index.js

@@ -0,0 +1,359 @@
+// @bun
+// src/cors.ts
+import { HttpHeader, HttpMethod as HttpMethod2 } from "@zipbul/shared";
+import { err as err2, isErr } from "@zipbul/result";
+
+// src/enums.ts
+var CorsAction;
+((CorsAction2) => {
+  CorsAction2[CorsAction2["Continue"] = 0] = "Continue";
+  CorsAction2[CorsAction2["RespondPreflight"] = 1] = "RespondPreflight";
+  CorsAction2[CorsAction2["Reject"] = 2] = "Reject";
+})(CorsAction ||= {});
+var CorsRejectionReason;
+((CorsRejectionReason2) => {
+  CorsRejectionReason2[CorsRejectionReason2["NoOrigin"] = 0] = "NoOrigin";
+  CorsRejectionReason2[CorsRejectionReason2["OriginNotAllowed"] = 1] = "OriginNotAllowed";
+  CorsRejectionReason2[CorsRejectionReason2["MethodNotAllowed"] = 2] = "MethodNotAllowed";
+  CorsRejectionReason2[CorsRejectionReason2["HeaderNotAllowed"] = 3] = "HeaderNotAllowed";
+})(CorsRejectionReason ||= {});
+var CorsErrorReason;
+((CorsErrorReason2) => {
+  CorsErrorReason2[CorsErrorReason2["CredentialsWithWildcardOrigin"] = 0] = "CredentialsWithWildcardOrigin";
+  CorsErrorReason2[CorsErrorReason2["InvalidMaxAge"] = 1] = "InvalidMaxAge";
+  CorsErrorReason2[CorsErrorReason2["InvalidStatusCode"] = 2] = "InvalidStatusCode";
+  CorsErrorReason2[CorsErrorReason2["OriginFunctionError"] = 3] = "OriginFunctionError";
+  CorsErrorReason2[CorsErrorReason2["InvalidOrigin"] = 4] = "InvalidOrigin";
+  CorsErrorReason2[CorsErrorReason2["InvalidMethods"] = 5] = "InvalidMethods";
+  CorsErrorReason2[CorsErrorReason2["InvalidAllowedHeaders"] = 6] = "InvalidAllowedHeaders";
+  CorsErrorReason2[CorsErrorReason2["InvalidExposedHeaders"] = 7] = "InvalidExposedHeaders";
+  CorsErrorReason2[CorsErrorReason2["UnsafeRegExp"] = 8] = "UnsafeRegExp";
+})(CorsErrorReason ||= {});
+
+// src/options.ts
+import { err } from "@zipbul/result";
+import safe from "safe-regex2";
+
+// src/constants.ts
+import { HttpMethod, HttpStatus } from "@zipbul/shared";
+var CORS_DEFAULT_METHODS = [
+  HttpMethod.Get,
+  HttpMethod.Head,
+  HttpMethod.Put,
+  HttpMethod.Patch,
+  HttpMethod.Post,
+  HttpMethod.Delete
+];
+var CORS_DEFAULT_OPTIONS_SUCCESS_STATUS = HttpStatus.NoContent;
+
+// src/options.ts
+function resolveCorsOptions(options) {
+  return {
+    origin: options?.origin ?? "*",
+    methods: options?.methods?.includes("*") ? ["*"] : (options?.methods ?? CORS_DEFAULT_METHODS).map((m) => m.toUpperCase()),
+    allowedHeaders: options?.allowedHeaders ?? null,
+    exposedHeaders: options?.exposedHeaders ?? null,
+    credentials: options?.credentials ?? false,
+    maxAge: options?.maxAge ?? null,
+    preflightContinue: options?.preflightContinue ?? false,
+    optionsSuccessStatus: options?.optionsSuccessStatus ?? CORS_DEFAULT_OPTIONS_SUCCESS_STATUS
+  };
+}
+function isBlank(value) {
+  return value.trim().length === 0;
+}
+function validateCorsOptions(resolved) {
+  if (typeof resolved.origin === "string" && resolved.origin !== "*" && isBlank(resolved.origin)) {
+    return err({
+      reason: 4 /* InvalidOrigin */,
+      message: "origin must not be an empty or blank string (RFC 6454)"
+    });
+  }
+  if (resolved.origin instanceof RegExp && !safe(resolved.origin)) {
+    return err({
+      reason: 8 /* UnsafeRegExp */,
+      message: "origin RegExp is potentially unsafe (exponential backtracking / ReDoS)"
+    });
+  }
+  if (Array.isArray(resolved.origin)) {
+    if (resolved.origin.length === 0) {
+      return err({
+        reason: 4 /* InvalidOrigin */,
+        message: "origin array must not be empty (RFC 6454)"
+      });
+    }
+    const hasBlankEntry = resolved.origin.some((entry) => typeof entry === "string" && isBlank(entry));
+    if (hasBlankEntry) {
+      return err({
+        reason: 4 /* InvalidOrigin */,
+        message: "origin array must not contain empty or blank string entries (RFC 6454)"
+      });
+    }
+    const hasUnsafeRegExp = resolved.origin.some((entry) => entry instanceof RegExp && !safe(entry));
+    if (hasUnsafeRegExp) {
+      return err({
+        reason: 8 /* UnsafeRegExp */,
+        message: "origin array contains an unsafe RegExp (exponential backtracking / ReDoS)"
+      });
+    }
+  }
+  if (resolved.methods.length === 0) {
+    return err({
+      reason: 5 /* InvalidMethods */,
+      message: "methods must not be an empty array (RFC 9110 \xA75.6.2)"
+    });
+  }
+  if (resolved.methods.some(isBlank)) {
+    return err({
+      reason: 5 /* InvalidMethods */,
+      message: "methods must not contain empty or blank string entries (RFC 9110 \xA75.6.2 token)"
+    });
+  }
+  if (resolved.allowedHeaders !== null && resolved.allowedHeaders.some(isBlank)) {
+    return err({
+      reason: 6 /* InvalidAllowedHeaders */,
+      message: "allowedHeaders must not contain empty or blank string entries (RFC 9110 \xA75.6.2 token)"
+    });
+  }
+  if (resolved.exposedHeaders !== null && resolved.exposedHeaders.some(isBlank)) {
+    return err({
+      reason: 7 /* InvalidExposedHeaders */,
+      message: "exposedHeaders must not contain empty or blank string entries (RFC 9110 \xA75.6.2 token)"
+    });
+  }
+  if (resolved.credentials === true && resolved.origin === "*") {
+    return err({
+      reason: 0 /* CredentialsWithWildcardOrigin */,
+      message: "credentials:true cannot be used with wildcard origin (*) per Fetch Standard"
+    });
+  }
+  if (resolved.maxAge !== null && (resolved.maxAge < 0 || !Number.isInteger(resolved.maxAge))) {
+    return err({
+      reason: 1 /* InvalidMaxAge */,
+      message: "maxAge must be a non-negative integer (delta-seconds per RFC 9111)"
+    });
+  }
+  if (!Number.isInteger(resolved.optionsSuccessStatus) || resolved.optionsSuccessStatus < 200 || resolved.optionsSuccessStatus > 299) {
+    return err({
+      reason: 2 /* InvalidStatusCode */,
+      message: "optionsSuccessStatus must be a 2xx integer status code (200\u2013299)"
+    });
+  }
+  return;
+}
+
+// src/cors.ts
+class Cors {
+  options;
+  constructor(options) {
+    this.options = options;
+  }
+  static create(options) {
+    const resolved = resolveCorsOptions(options);
+    const validationResult = validateCorsOptions(resolved);
+    if (isErr(validationResult)) {
+      return validationResult;
+    }
+    return new Cors(resolved);
+  }
+  async handle(request) {
+    const origin = request.headers.get(HttpHeader.Origin);
+    if (origin === null || origin.length === 0) {
+      return this.reject(0 /* NoOrigin */);
+    }
+    const allowedOrigin = await this.matchOrigin(origin, request);
+    if (isErr(allowedOrigin)) {
+      return allowedOrigin;
+    }
+    if (allowedOrigin === undefined) {
+      return this.reject(1 /* OriginNotAllowed */);
+    }
+    const headers = new Headers;
+    headers.set(HttpHeader.AccessControlAllowOrigin, allowedOrigin);
+    if (allowedOrigin !== "*") {
+      headers.append(HttpHeader.Vary, HttpHeader.Origin);
+    }
+    if (this.options.credentials) {
+      headers.set(HttpHeader.AccessControlAllowCredentials, "true");
+    }
+    if (request.method !== HttpMethod2.Options) {
+      if (this.options.exposedHeaders !== null && this.options.exposedHeaders.length > 0) {
+        const exposeHeadersValue = this.serializeExposeHeaders(this.options.exposedHeaders);
+        if (exposeHeadersValue !== undefined) {
+          headers.set(HttpHeader.AccessControlExposeHeaders, exposeHeadersValue);
+        }
+      }
+      return { action: 0 /* Continue */, headers };
+    }
+    const requestMethod = request.headers.get(HttpHeader.AccessControlRequestMethod);
+    if (requestMethod === null || requestMethod.length === 0) {
+      return { action: 0 /* Continue */, headers };
+    }
+    if (!this.isMethodAllowed(requestMethod, this.options.methods)) {
+      return this.reject(2 /* MethodNotAllowed */);
+    }
+    const allowMethodsValue = this.serializeAllowedMethods(this.options.methods, requestMethod);
+    headers.set(HttpHeader.AccessControlAllowMethods, allowMethodsValue);
+    headers.append(HttpHeader.Vary, HttpHeader.AccessControlRequestMethod);
+    const requestHeadersRaw = request.headers.get(HttpHeader.AccessControlRequestHeaders);
+    const requestHeaders = this.parseCommaSeparatedValues(requestHeadersRaw);
+    if (this.options.allowedHeaders !== null) {
+      if (!this.areRequestHeadersAllowed(requestHeaders, this.options.allowedHeaders)) {
+        return this.reject(3 /* HeaderNotAllowed */);
+      }
+      const allowHeadersValue = this.serializeAllowedHeaders(this.options.allowedHeaders, requestHeadersRaw);
+      if (allowHeadersValue !== undefined) {
+        headers.set(HttpHeader.AccessControlAllowHeaders, allowHeadersValue);
+        headers.append(HttpHeader.Vary, HttpHeader.AccessControlRequestHeaders);
+      }
+    } else {
+      if (requestHeadersRaw !== null && requestHeadersRaw.length > 0) {
+        headers.set(HttpHeader.AccessControlAllowHeaders, requestHeadersRaw);
+        headers.append(HttpHeader.Vary, HttpHeader.AccessControlRequestHeaders);
+      }
+    }
+    if (this.options.maxAge !== null) {
+      headers.set(HttpHeader.AccessControlMaxAge, this.options.maxAge.toString());
+    }
+    if (this.options.preflightContinue) {
+      return { action: 0 /* Continue */, headers };
+    }
+    return { action: 1 /* RespondPreflight */, headers, statusCode: this.options.optionsSuccessStatus };
+  }
+  reject(reason) {
+    return { action: 2 /* Reject */, reason };
+  }
+  async matchOrigin(origin, request) {
+    const originOption = this.options.origin;
+    if (originOption === false) {
+      return;
+    }
+    if (originOption === "*") {
+      return "*";
+    }
+    if (typeof originOption === "string") {
+      return originOption === origin ? originOption : undefined;
+    }
+    if (typeof originOption === "boolean") {
+      return originOption ? origin : undefined;
+    }
+    if (originOption instanceof RegExp) {
+      originOption.lastIndex = 0;
+      return originOption.test(origin) ? origin : undefined;
+    }
+    if (Array.isArray(originOption)) {
+      const matched = originOption.some((entry) => {
+        if (entry instanceof RegExp) {
+          entry.lastIndex = 0;
+          return entry.test(origin);
+        }
+        return entry === origin;
+      });
+      return matched ? origin : undefined;
+    }
+    try {
+      const originResult = await originOption(origin, request);
+      return this.resolveOriginResult(origin, originResult);
+    } catch {
+      return err2({
+        reason: 3 /* OriginFunctionError */,
+        message: "Origin function threw an error"
+      });
+    }
+  }
+  resolveOriginResult(origin, result) {
+    if (result === true) {
+      return origin;
+    }
+    if (typeof result === "string" && result.length > 0) {
+      return result;
+    }
+    return;
+  }
+  serializeExposeHeaders(exposedHeaders) {
+    if (this.options.credentials && this.includesWildcard(exposedHeaders)) {
+      const explicit = exposedHeaders.filter((header) => header.trim() !== "*");
+      return explicit.length > 0 ? explicit.join(",") : undefined;
+    }
+    return exposedHeaders.join(",");
+  }
+  isMethodAllowed(requestMethod, allowedMethods) {
+    if (this.includesWildcard(allowedMethods)) {
+      return true;
+    }
+    return allowedMethods.includes(requestMethod);
+  }
+  serializeAllowedMethods(allowedMethods, requestMethod) {
+    if (!this.includesWildcard(allowedMethods)) {
+      return allowedMethods.join(",");
+    }
+    if (this.options.credentials) {
+      return requestMethod;
+    }
+    return "*";
+  }
+  areRequestHeadersAllowed(requestHeaders, allowedHeaders) {
+    if (requestHeaders.length === 0) {
+      return true;
+    }
+    if (allowedHeaders.length === 0) {
+      return false;
+    }
+    const hasWildcard = this.includesWildcard(allowedHeaders);
+    if (hasWildcard) {
+      const explicitHeaders = allowedHeaders.filter((header) => header.trim() !== "*");
+      const hasAuthorization = requestHeaders.some((header) => header.toLowerCase() === "authorization");
+      if (hasAuthorization && !this.includesHeader(explicitHeaders, "authorization")) {
+        return false;
+      }
+      if (!this.options.credentials) {
+        return true;
+      }
+      return requestHeaders.every((header) => {
+        if (this.includesHeader(explicitHeaders, header)) {
+          return true;
+        }
+        return header.toLowerCase() !== "authorization";
+      });
+    }
+    return requestHeaders.every((header) => this.includesHeader(allowedHeaders, header));
+  }
+  serializeAllowedHeaders(allowedHeaders, requestHeadersRaw) {
+    if (allowedHeaders.length === 0) {
+      return;
+    }
+    if (!this.includesWildcard(allowedHeaders)) {
+      return allowedHeaders.join(",");
+    }
+    if (this.options.credentials) {
+      if (requestHeadersRaw !== null && requestHeadersRaw.length > 0) {
+        return requestHeadersRaw;
+      }
+      return;
+    }
+    return "*";
+  }
+  includesWildcard(values) {
+    return values.some((value) => value === "*");
+  }
+  includesHeader(allowedHeaders, requestHeader) {
+    return allowedHeaders.some((header) => header.toLowerCase() === requestHeader.toLowerCase());
+  }
+  parseCommaSeparatedValues(value) {
+    if (value === null || value.length === 0) {
+      return [];
+    }
+    return value.split(",").map((item) => item.trim()).filter((item) => item.length > 0);
+  }
+}
+export {
+  validateCorsOptions,
+  resolveCorsOptions,
+  CorsRejectionReason,
+  CorsErrorReason,
+  CorsAction,
+  Cors
+};
+
+//# debugId=A8102427CA89803164756E2164756E21
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1,13 @@
+{
+  "version": 3,
+  "sources": ["../src/cors.ts", "../src/enums.ts", "../src/options.ts", "../src/constants.ts"],
+  "sourcesContent": [
+    "import { HttpHeader, HttpMethod } from '@zipbul/shared';\nimport { err, isErr } from '@zipbul/result';\nimport type { Err, Result } from '@zipbul/result';\n\nimport { CorsAction, CorsErrorReason, CorsRejectionReason } from './enums';\nimport type { CorsError, CorsOptions, CorsPreflightResult, CorsRejectResult } from './interfaces';\nimport { resolveCorsOptions, validateCorsOptions } from './options';\nimport type { CorsResult, ResolvedCorsOptions } from './types';\nimport type { OriginResult } from './types';\n\n/**\n * Framework-agnostic CORS handler.\n * Evaluates CORS policy and returns a discriminated union result\n * instead of generating responses directly.\n */\nexport class Cors {\n  private constructor(private readonly options: ResolvedCorsOptions) {}\n\n  /**\n   * Creates a Cors instance after resolving and validating options.\n   *\n   * @returns Cors instance on success, Err<CorsError> on validation failure.\n   */\n  public static create(options?: CorsOptions): Result<Cors, CorsError> {\n    const resolved = resolveCorsOptions(options);\n    const validationResult = validateCorsOptions(resolved);\n\n    if (isErr(validationResult)) {\n      return validationResult;\n    }\n\n    return new Cors(resolved);\n  }\n\n  /**\n   * Evaluates CORS policy for the given request.\n   *\n   * @returns `Continue` — attach headers and proceed,\n   *          `RespondPreflight` — return preflight response,\n   *          `Reject` — deny with reason,\n   *          `Err<CorsError>` — origin function threw.\n   */\n  public async handle(request: Request): Promise<Result<CorsResult, CorsError>> {\n    const origin = request.headers.get(HttpHeader.Origin);\n\n    if (origin === null || origin.length === 0) {\n      return this.reject(CorsRejectionReason.NoOrigin);\n    }\n\n    const allowedOrigin = await this.matchOrigin(origin, request);\n\n    if (isErr(allowedOrigin)) {\n      return allowedOrigin;\n    }\n\n    if (allowedOrigin === undefined) {\n      return this.reject(CorsRejectionReason.OriginNotAllowed);\n    }\n\n    const headers = new Headers();\n\n    headers.set(HttpHeader.AccessControlAllowOrigin, allowedOrigin);\n\n    if (allowedOrigin !== '*') {\n      headers.append(HttpHeader.Vary, HttpHeader.Origin);\n    }\n\n    if (this.options.credentials) {\n      headers.set(HttpHeader.AccessControlAllowCredentials, 'true');\n    }\n\n    if (request.method !== HttpMethod.Options) {\n      if (this.options.exposedHeaders !== null && this.options.exposedHeaders.length > 0) {\n        const exposeHeadersValue = this.serializeExposeHeaders(this.options.exposedHeaders);\n\n        if (exposeHeadersValue !== undefined) {\n          headers.set(HttpHeader.AccessControlExposeHeaders, exposeHeadersValue);\n        }\n      }\n\n      return { action: CorsAction.Continue, headers };\n    }\n\n    const requestMethod = request.headers.get(HttpHeader.AccessControlRequestMethod);\n\n    if (requestMethod === null || requestMethod.length === 0) {\n      return { action: CorsAction.Continue, headers };\n    }\n\n    if (!this.isMethodAllowed(requestMethod, this.options.methods)) {\n      return this.reject(CorsRejectionReason.MethodNotAllowed);\n    }\n\n    const allowMethodsValue = this.serializeAllowedMethods(this.options.methods, requestMethod);\n\n    headers.set(HttpHeader.AccessControlAllowMethods, allowMethodsValue);\n\n    headers.append(HttpHeader.Vary, HttpHeader.AccessControlRequestMethod);\n\n    const requestHeadersRaw = request.headers.get(HttpHeader.AccessControlRequestHeaders);\n    const requestHeaders = this.parseCommaSeparatedValues(requestHeadersRaw);\n\n    if (this.options.allowedHeaders !== null) {\n      if (!this.areRequestHeadersAllowed(requestHeaders, this.options.allowedHeaders)) {\n        return this.reject(CorsRejectionReason.HeaderNotAllowed);\n      }\n\n      const allowHeadersValue = this.serializeAllowedHeaders(this.options.allowedHeaders, requestHeadersRaw);\n\n      if (allowHeadersValue !== undefined) {\n        headers.set(HttpHeader.AccessControlAllowHeaders, allowHeadersValue);\n        headers.append(HttpHeader.Vary, HttpHeader.AccessControlRequestHeaders);\n      }\n    } else {\n      if (requestHeadersRaw !== null && requestHeadersRaw.length > 0) {\n        headers.set(HttpHeader.AccessControlAllowHeaders, requestHeadersRaw);\n        headers.append(HttpHeader.Vary, HttpHeader.AccessControlRequestHeaders);\n      }\n    }\n\n    if (this.options.maxAge !== null) {\n      headers.set(HttpHeader.AccessControlMaxAge, this.options.maxAge.toString());\n    }\n\n    if (this.options.preflightContinue) {\n      return { action: CorsAction.Continue, headers };\n    }\n\n    return { action: CorsAction.RespondPreflight, headers, statusCode: this.options.optionsSuccessStatus };\n  }\n\n  private reject(reason: CorsRejectionReason): CorsRejectResult {\n    return { action: CorsAction.Reject, reason };\n  }\n\n  private async matchOrigin(origin: string, request: Request): Promise<string | undefined | Err<CorsError>> {\n    const originOption = this.options.origin;\n\n    if (originOption === false) {\n      return undefined;\n    }\n\n    if (originOption === '*') {\n      return '*';\n    }\n\n    if (typeof originOption === 'string') {\n      return originOption === origin ? originOption : undefined;\n    }\n\n    if (typeof originOption === 'boolean') {\n      return originOption ? origin : undefined;\n    }\n\n    if (originOption instanceof RegExp) {\n      originOption.lastIndex = 0;\n      return originOption.test(origin) ? origin : undefined;\n    }\n\n    if (Array.isArray(originOption)) {\n      const matched = originOption.some(entry => {\n        if (entry instanceof RegExp) {\n          entry.lastIndex = 0;\n          return entry.test(origin);\n        }\n\n        return entry === origin;\n      });\n\n      return matched ? origin : undefined;\n    }\n\n    try {\n      const originResult = await originOption(origin, request);\n\n      return this.resolveOriginResult(origin, originResult);\n    } catch {\n      return err<CorsError>({\n        reason: CorsErrorReason.OriginFunctionError,\n        message: 'Origin function threw an error',\n      });\n    }\n  }\n\n  private resolveOriginResult(origin: string, result: OriginResult): string | undefined {\n    if (result === true) {\n      return origin;\n    }\n\n    if (typeof result === 'string' && result.length > 0) {\n      return result;\n    }\n\n    return undefined;\n  }\n\n  private serializeExposeHeaders(exposedHeaders: string[]): string | undefined {\n    if (this.options.credentials && this.includesWildcard(exposedHeaders)) {\n      const explicit = exposedHeaders.filter(header => header.trim() !== '*');\n\n      return explicit.length > 0 ? explicit.join(',') : undefined;\n    }\n\n    return exposedHeaders.join(',');\n  }\n\n  private isMethodAllowed(requestMethod: string, allowedMethods: Array<string>): boolean {\n    if (this.includesWildcard(allowedMethods)) {\n      return true;\n    }\n\n    return allowedMethods.includes(requestMethod);\n  }\n\n  private serializeAllowedMethods(allowedMethods: Array<string>, requestMethod: string): string {\n    if (!this.includesWildcard(allowedMethods)) {\n      return allowedMethods.join(',');\n    }\n\n    if (this.options.credentials) {\n      return requestMethod;\n    }\n\n    return '*';\n  }\n\n  private areRequestHeadersAllowed(requestHeaders: string[], allowedHeaders: string[]): boolean {\n    if (requestHeaders.length === 0) {\n      return true;\n    }\n\n    if (allowedHeaders.length === 0) {\n      return false;\n    }\n\n    const hasWildcard = this.includesWildcard(allowedHeaders);\n\n    if (hasWildcard) {\n      const explicitHeaders = allowedHeaders.filter(header => header.trim() !== '*');\n\n      const hasAuthorization = requestHeaders.some(header => header.toLowerCase() === 'authorization');\n\n      if (hasAuthorization && !this.includesHeader(explicitHeaders, 'authorization')) {\n        return false;\n      }\n\n      if (!this.options.credentials) {\n        return true;\n      }\n\n      return requestHeaders.every(header => {\n        if (this.includesHeader(explicitHeaders, header)) {\n          return true;\n        }\n\n        return header.toLowerCase() !== 'authorization';\n      });\n    }\n\n    return requestHeaders.every(header => this.includesHeader(allowedHeaders, header));\n  }\n\n  private serializeAllowedHeaders(allowedHeaders: string[], requestHeadersRaw: string | null): string | undefined {\n    if (allowedHeaders.length === 0) {\n      return undefined;\n    }\n\n    if (!this.includesWildcard(allowedHeaders)) {\n      return allowedHeaders.join(',');\n    }\n\n    if (this.options.credentials) {\n      if (requestHeadersRaw !== null && requestHeadersRaw.length > 0) {\n        return requestHeadersRaw;\n      }\n\n      return undefined;\n    }\n\n    return '*';\n  }\n\n  private includesWildcard(values: string[]): boolean {\n    return values.some(value => value === '*');\n  }\n\n  private includesHeader(allowedHeaders: string[], requestHeader: string): boolean {\n    return allowedHeaders.some(header => header.toLowerCase() === requestHeader.toLowerCase());\n  }\n\n  private parseCommaSeparatedValues(value: string | null): string[] {\n    if (value === null || value.length === 0) {\n      return [];\n    }\n\n    return value\n      .split(',')\n      .map(item => item.trim())\n      .filter(item => item.length > 0);\n  }\n}\n",
+    "/**\n * Discriminant for {@link CorsResult}.\n * Determines how to handle the response.\n */\nexport enum CorsAction {\n  /** Attach CORS headers to the response and continue processing. */\n  Continue,\n  /** Return a preflight-only response immediately. */\n  RespondPreflight,\n  /** Reject the request. See {@link CorsRejectionReason} for details. */\n  Reject,\n}\n\n/**\n * Reason why a CORS request was rejected.\n */\nexport enum CorsRejectionReason {\n  /** `Origin` header is missing or empty. */\n  NoOrigin,\n  /** Origin is not in the allowed list. */\n  OriginNotAllowed,\n  /** Preflight request method is not allowed. */\n  MethodNotAllowed,\n  /** Preflight request header is not allowed. */\n  HeaderNotAllowed,\n}\n\n/**\n * Reason why CORS options validation failed.\n */\nexport enum CorsErrorReason {\n  /** credentials:true is incompatible with wildcard origin per Fetch Standard. */\n  CredentialsWithWildcardOrigin,\n  /** maxAge must be non-negative. */\n  InvalidMaxAge,\n  /** optionsSuccessStatus must be 200–299 (ok status). */\n  InvalidStatusCode,\n  /** Origin function threw at runtime. */\n  OriginFunctionError,\n  /** origin is an empty/blank string, empty array, or array containing empty/blank string entries (RFC 6454). */\n  InvalidOrigin,\n  /** methods is an empty array or contains empty/blank string entries (RFC 9110 §5.6.2 token). */\n  InvalidMethods,\n  /** allowedHeaders contains empty/blank string entries (RFC 9110 §5.6.2 token). */\n  InvalidAllowedHeaders,\n  /** exposedHeaders contains empty/blank string entries (RFC 9110 §5.6.2 token). */\n  InvalidExposedHeaders,\n  /** origin RegExp is potentially unsafe (exponential backtracking / ReDoS). */\n  UnsafeRegExp,\n}\n",
+    "import { err } from '@zipbul/result';\nimport type { Result } from '@zipbul/result';\nimport safe from 'safe-regex2';\n\nimport { CORS_DEFAULT_METHODS, CORS_DEFAULT_OPTIONS_SUCCESS_STATUS } from './constants';\nimport { CorsErrorReason } from './enums';\nimport type { CorsError, CorsOptions } from './interfaces';\nimport type { ResolvedCorsOptions } from './types';\n\n/**\n * Resolves partial {@link CorsOptions} into a fully populated\n * {@link ResolvedCorsOptions} by applying defaults via nullish coalescing.\n */\nexport function resolveCorsOptions(options?: CorsOptions): ResolvedCorsOptions {\n  return {\n    origin: options?.origin ?? '*',\n    methods: options?.methods?.includes('*')\n      ? ['*']\n      : (options?.methods ?? CORS_DEFAULT_METHODS).map(m => m.toUpperCase()),\n    allowedHeaders: options?.allowedHeaders ?? null,\n    exposedHeaders: options?.exposedHeaders ?? null,\n    credentials: options?.credentials ?? false,\n    maxAge: options?.maxAge ?? null,\n    preflightContinue: options?.preflightContinue ?? false,\n    optionsSuccessStatus: options?.optionsSuccessStatus ?? CORS_DEFAULT_OPTIONS_SUCCESS_STATUS,\n  };\n}\n\n/** Returns true when a string is empty or contains only whitespace (RFC 9110 §5.6.2 token). */\nfunction isBlank(value: string): boolean {\n  return value.trim().length === 0;\n}\n\n/**\n * Validates resolved CORS options against rules derived from the Fetch Standard and RFC 9110.\n *\n * - V0a: `origin` must not be an empty/blank string (RFC 6454).\n * - V_regex: `origin` RegExp must be safe (no exponential backtracking / ReDoS).\n * - V0b: `origin` array must not be empty, and must not contain empty/blank string entries (RFC 6454).\n *          Array RegExp entries are also checked for ReDoS safety.\n * - V0c: `methods` must not be empty, and must not contain empty/blank string entries (RFC 9110 §5.6.2).\n * - V0d: `allowedHeaders` must not contain empty/blank string entries (RFC 9110 §5.6.2).\n * - V0e: `exposedHeaders` must not contain empty/blank string entries (RFC 9110 §5.6.2).\n * - V1:  `credentials:true` with wildcard origin is forbidden (Fetch Standard §3.3.5).\n * - V2:  `maxAge` must be a non-negative integer when set (RFC 9111 §1.2.1 delta-seconds).\n * - V3:  `optionsSuccessStatus` must be a 2xx integer (Fetch Standard).\n *\n * @returns `undefined` (void) if valid, or `Err<CorsError>` on the first violated rule.\n */\nexport function validateCorsOptions(resolved: ResolvedCorsOptions): Result<void, CorsError> {\n  // V0a — origin: empty/blank string\n  if (typeof resolved.origin === 'string' && resolved.origin !== '*' && isBlank(resolved.origin)) {\n    return err<CorsError>({\n      reason: CorsErrorReason.InvalidOrigin,\n      message: 'origin must not be an empty or blank string (RFC 6454)',\n    });\n  }\n\n  // V_regex — origin: single unsafe RegExp (ReDoS)\n  if (resolved.origin instanceof RegExp && !safe(resolved.origin)) {\n    return err<CorsError>({\n      reason: CorsErrorReason.UnsafeRegExp,\n      message: 'origin RegExp is potentially unsafe (exponential backtracking / ReDoS)',\n    });\n  }\n\n  // V0b — origin: empty array or array containing empty/blank string entries\n  if (Array.isArray(resolved.origin)) {\n    if (resolved.origin.length === 0) {\n      return err<CorsError>({\n        reason: CorsErrorReason.InvalidOrigin,\n        message: 'origin array must not be empty (RFC 6454)',\n      });\n    }\n\n    const hasBlankEntry = resolved.origin.some(entry => typeof entry === 'string' && isBlank(entry));\n\n    if (hasBlankEntry) {\n      return err<CorsError>({\n        reason: CorsErrorReason.InvalidOrigin,\n        message: 'origin array must not contain empty or blank string entries (RFC 6454)',\n      });\n    }\n\n    // V_regex — origin array: unsafe RegExp entries (ReDoS)\n    const hasUnsafeRegExp = resolved.origin.some(entry => entry instanceof RegExp && !safe(entry));\n\n    if (hasUnsafeRegExp) {\n      return err<CorsError>({\n        reason: CorsErrorReason.UnsafeRegExp,\n        message: 'origin array contains an unsafe RegExp (exponential backtracking / ReDoS)',\n      });\n    }\n  }\n\n  // V0c — methods: empty array or blank entries\n  if (resolved.methods.length === 0) {\n    return err<CorsError>({\n      reason: CorsErrorReason.InvalidMethods,\n      message: 'methods must not be an empty array (RFC 9110 §5.6.2)',\n    });\n  }\n\n  if (resolved.methods.some(isBlank)) {\n    return err<CorsError>({\n      reason: CorsErrorReason.InvalidMethods,\n      message: 'methods must not contain empty or blank string entries (RFC 9110 §5.6.2 token)',\n    });\n  }\n\n  // V0d — allowedHeaders: blank entries (empty array is allowed — explicit \"deny all\" policy)\n  if (resolved.allowedHeaders !== null && resolved.allowedHeaders.some(isBlank)) {\n    return err<CorsError>({\n      reason: CorsErrorReason.InvalidAllowedHeaders,\n      message: 'allowedHeaders must not contain empty or blank string entries (RFC 9110 §5.6.2 token)',\n    });\n  }\n\n  // V0e — exposedHeaders: blank entries (empty array is allowed)\n  if (resolved.exposedHeaders !== null && resolved.exposedHeaders.some(isBlank)) {\n    return err<CorsError>({\n      reason: CorsErrorReason.InvalidExposedHeaders,\n      message: 'exposedHeaders must not contain empty or blank string entries (RFC 9110 §5.6.2 token)',\n    });\n  }\n\n  // V1 — credentials:true with wildcard origin\n  if (resolved.credentials === true && resolved.origin === '*') {\n    return err<CorsError>({\n      reason: CorsErrorReason.CredentialsWithWildcardOrigin,\n      message: 'credentials:true cannot be used with wildcard origin (*) per Fetch Standard',\n    });\n  }\n\n  // V2 — maxAge: non-negative integer\n  if (resolved.maxAge !== null && (resolved.maxAge < 0 || !Number.isInteger(resolved.maxAge))) {\n    return err<CorsError>({\n      reason: CorsErrorReason.InvalidMaxAge,\n      message: 'maxAge must be a non-negative integer (delta-seconds per RFC 9111)',\n    });\n  }\n\n  // V3 — optionsSuccessStatus: 2xx integer\n  if (!Number.isInteger(resolved.optionsSuccessStatus) || resolved.optionsSuccessStatus < 200 || resolved.optionsSuccessStatus > 299) {\n    return err<CorsError>({\n      reason: CorsErrorReason.InvalidStatusCode,\n      message: 'optionsSuccessStatus must be a 2xx integer status code (200–299)',\n    });\n  }\n\n  return undefined;\n}\n",
+    "import { HttpMethod, HttpStatus } from '@zipbul/shared';\n\nexport const CORS_DEFAULT_METHODS: string[] = [\n  HttpMethod.Get,\n  HttpMethod.Head,\n  HttpMethod.Put,\n  HttpMethod.Patch,\n  HttpMethod.Post,\n  HttpMethod.Delete,\n];\n\nexport const CORS_DEFAULT_OPTIONS_SUCCESS_STATUS = HttpStatus.NoContent;\n"
+  ],
+  "mappings": ";;AAAA,mCAAqB;AACrB,gBAAS;;;ACGF,IAAK;AAAA,CAAL,CAAK,gBAAL;AAAA,EAEL;AAAA,EAEA;AAAA,EAEA;AAAA,GANU;AAYL,IAAK;AAAA,CAAL,CAAK,yBAAL;AAAA,EAEL;AAAA,EAEA;AAAA,EAEA;AAAA,EAEA;AAAA,GARU;AAcL,IAAK;AAAA,CAAL,CAAK,qBAAL;AAAA,EAEL;AAAA,EAEA;AAAA,EAEA;AAAA,EAEA;AAAA,EAEA;AAAA,EAEA;AAAA,EAEA;AAAA,EAEA;AAAA,EAEA;AAAA,GAlBU;;;AC9BZ;AAEA;;;ACFA;AAEO,IAAM,uBAAiC;AAAA,EAC5C,WAAW;AAAA,EACX,WAAW;AAAA,EACX,WAAW;AAAA,EACX,WAAW;AAAA,EACX,WAAW;AAAA,EACX,WAAW;AACb;AAEO,IAAM,sCAAsC,WAAW;;;ADEvD,SAAS,kBAAkB,CAAC,SAA4C;AAAA,EAC7E,OAAO;AAAA,IACL,QAAQ,SAAS,UAAU;AAAA,IAC3B,SAAS,SAAS,SAAS,SAAS,GAAG,IACnC,CAAC,GAAG,KACH,SAAS,WAAW,sBAAsB,IAAI,OAAK,EAAE,YAAY,CAAC;AAAA,IACvE,gBAAgB,SAAS,kBAAkB;AAAA,IAC3C,gBAAgB,SAAS,kBAAkB;AAAA,IAC3C,aAAa,SAAS,eAAe;AAAA,IACrC,QAAQ,SAAS,UAAU;AAAA,IAC3B,mBAAmB,SAAS,qBAAqB;AAAA,IACjD,sBAAsB,SAAS,wBAAwB;AAAA,EACzD;AAAA;AAIF,SAAS,OAAO,CAAC,OAAwB;AAAA,EACvC,OAAO,MAAM,KAAK,EAAE,WAAW;AAAA;AAmB1B,SAAS,mBAAmB,CAAC,UAAwD;AAAA,EAE1F,IAAI,OAAO,SAAS,WAAW,YAAY,SAAS,WAAW,OAAO,QAAQ,SAAS,MAAM,GAAG;AAAA,IAC9F,OAAO,IAAe;AAAA,MACpB;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAAA,EAGA,IAAI,SAAS,kBAAkB,UAAU,CAAC,KAAK,SAAS,MAAM,GAAG;AAAA,IAC/D,OAAO,IAAe;AAAA,MACpB;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAAA,EAGA,IAAI,MAAM,QAAQ,SAAS,MAAM,GAAG;AAAA,IAClC,IAAI,SAAS,OAAO,WAAW,GAAG;AAAA,MAChC,OAAO,IAAe;AAAA,QACpB;AAAA,QACA,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,gBAAgB,SAAS,OAAO,KAAK,WAAS,OAAO,UAAU,YAAY,QAAQ,KAAK,CAAC;AAAA,IAE/F,IAAI,eAAe;AAAA,MACjB,OAAO,IAAe;AAAA,QACpB;AAAA,QACA,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,IAGA,MAAM,kBAAkB,SAAS,OAAO,KAAK,WAAS,iBAAiB,UAAU,CAAC,KAAK,KAAK,CAAC;AAAA,IAE7F,IAAI,iBAAiB;AAAA,MACnB,OAAO,IAAe;AAAA,QACpB;AAAA,QACA,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAGA,IAAI,SAAS,QAAQ,WAAW,GAAG;AAAA,IACjC,OAAO,IAAe;AAAA,MACpB;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAAA,EAEA,IAAI,SAAS,QAAQ,KAAK,OAAO,GAAG;AAAA,IAClC,OAAO,IAAe;AAAA,MACpB;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAAA,EAGA,IAAI,SAAS,mBAAmB,QAAQ,SAAS,eAAe,KAAK,OAAO,GAAG;AAAA,IAC7E,OAAO,IAAe;AAAA,MACpB;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAAA,EAGA,IAAI,SAAS,mBAAmB,QAAQ,SAAS,eAAe,KAAK,OAAO,GAAG;AAAA,IAC7E,OAAO,IAAe;AAAA,MACpB;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAAA,EAGA,IAAI,SAAS,gBAAgB,QAAQ,SAAS,WAAW,KAAK;AAAA,IAC5D,OAAO,IAAe;AAAA,MACpB;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAAA,EAGA,IAAI,SAAS,WAAW,SAAS,SAAS,SAAS,KAAK,CAAC,OAAO,UAAU,SAAS,MAAM,IAAI;AAAA,IAC3F,OAAO,IAAe;AAAA,MACpB;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAAA,EAGA,IAAI,CAAC,OAAO,UAAU,SAAS,oBAAoB,KAAK,SAAS,uBAAuB,OAAO,SAAS,uBAAuB,KAAK;AAAA,IAClI,OAAO,IAAe;AAAA,MACpB;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAAA,EAEA;AAAA;;;AFvIK,MAAM,KAAK;AAAA,EACqB;AAAA,EAA7B,WAAW,CAAkB,SAA8B;AAAA,IAA9B;AAAA;AAAA,SAOvB,MAAM,CAAC,SAAgD;AAAA,IACnE,MAAM,WAAW,mBAAmB,OAAO;AAAA,IAC3C,MAAM,mBAAmB,oBAAoB,QAAQ;AAAA,IAErD,IAAI,MAAM,gBAAgB,GAAG;AAAA,MAC3B,OAAO;AAAA,IACT;AAAA,IAEA,OAAO,IAAI,KAAK,QAAQ;AAAA;AAAA,OAWb,OAAM,CAAC,SAA0D;AAAA,IAC5E,MAAM,SAAS,QAAQ,QAAQ,IAAI,WAAW,MAAM;AAAA,IAEpD,IAAI,WAAW,QAAQ,OAAO,WAAW,GAAG;AAAA,MAC1C,OAAO,KAAK,uBAAmC;AAAA,IACjD;AAAA,IAEA,MAAM,gBAAgB,MAAM,KAAK,YAAY,QAAQ,OAAO;AAAA,IAE5D,IAAI,MAAM,aAAa,GAAG;AAAA,MACxB,OAAO;AAAA,IACT;AAAA,IAEA,IAAI,kBAAkB,WAAW;AAAA,MAC/B,OAAO,KAAK,+BAA2C;AAAA,IACzD;AAAA,IAEA,MAAM,UAAU,IAAI;AAAA,IAEpB,QAAQ,IAAI,WAAW,0BAA0B,aAAa;AAAA,IAE9D,IAAI,kBAAkB,KAAK;AAAA,MACzB,QAAQ,OAAO,WAAW,MAAM,WAAW,MAAM;AAAA,IACnD;AAAA,IAEA,IAAI,KAAK,QAAQ,aAAa;AAAA,MAC5B,QAAQ,IAAI,WAAW,+BAA+B,MAAM;AAAA,IAC9D;AAAA,IAEA,IAAI,QAAQ,WAAW,YAAW,SAAS;AAAA,MACzC,IAAI,KAAK,QAAQ,mBAAmB,QAAQ,KAAK,QAAQ,eAAe,SAAS,GAAG;AAAA,QAClF,MAAM,qBAAqB,KAAK,uBAAuB,KAAK,QAAQ,cAAc;AAAA,QAElF,IAAI,uBAAuB,WAAW;AAAA,UACpC,QAAQ,IAAI,WAAW,4BAA4B,kBAAkB;AAAA,QACvE;AAAA,MACF;AAAA,MAEA,OAAO,EAAE,0BAA6B,QAAQ;AAAA,IAChD;AAAA,IAEA,MAAM,gBAAgB,QAAQ,QAAQ,IAAI,WAAW,0BAA0B;AAAA,IAE/E,IAAI,kBAAkB,QAAQ,cAAc,WAAW,GAAG;AAAA,MACxD,OAAO,EAAE,0BAA6B,QAAQ;AAAA,IAChD;AAAA,IAEA,IAAI,CAAC,KAAK,gBAAgB,eAAe,KAAK,QAAQ,OAAO,GAAG;AAAA,MAC9D,OAAO,KAAK,+BAA2C;AAAA,IACzD;AAAA,IAEA,MAAM,oBAAoB,KAAK,wBAAwB,KAAK,QAAQ,SAAS,aAAa;AAAA,IAE1F,QAAQ,IAAI,WAAW,2BAA2B,iBAAiB;AAAA,IAEnE,QAAQ,OAAO,WAAW,MAAM,WAAW,0BAA0B;AAAA,IAErE,MAAM,oBAAoB,QAAQ,QAAQ,IAAI,WAAW,2BAA2B;AAAA,IACpF,MAAM,iBAAiB,KAAK,0BAA0B,iBAAiB;AAAA,IAEvE,IAAI,KAAK,QAAQ,mBAAmB,MAAM;AAAA,MACxC,IAAI,CAAC,KAAK,yBAAyB,gBAAgB,KAAK,QAAQ,cAAc,GAAG;AAAA,QAC/E,OAAO,KAAK,+BAA2C;AAAA,MACzD;AAAA,MAEA,MAAM,oBAAoB,KAAK,wBAAwB,KAAK,QAAQ,gBAAgB,iBAAiB;AAAA,MAErG,IAAI,sBAAsB,WAAW;AAAA,QACnC,QAAQ,IAAI,WAAW,2BAA2B,iBAAiB;AAAA,QACnE,QAAQ,OAAO,WAAW,MAAM,WAAW,2BAA2B;AAAA,MACxE;AAAA,IACF,EAAO;AAAA,MACL,IAAI,sBAAsB,QAAQ,kBAAkB,SAAS,GAAG;AAAA,QAC9D,QAAQ,IAAI,WAAW,2BAA2B,iBAAiB;AAAA,QACnE,QAAQ,OAAO,WAAW,MAAM,WAAW,2BAA2B;AAAA,MACxE;AAAA;AAAA,IAGF,IAAI,KAAK,QAAQ,WAAW,MAAM;AAAA,MAChC,QAAQ,IAAI,WAAW,qBAAqB,KAAK,QAAQ,OAAO,SAAS,CAAC;AAAA,IAC5E;AAAA,IAEA,IAAI,KAAK,QAAQ,mBAAmB;AAAA,MAClC,OAAO,EAAE,0BAA6B,QAAQ;AAAA,IAChD;AAAA,IAEA,OAAO,EAAE,kCAAqC,SAAS,YAAY,KAAK,QAAQ,qBAAqB;AAAA;AAAA,EAG/F,MAAM,CAAC,QAA+C;AAAA,IAC5D,OAAO,EAAE,wBAA2B,OAAO;AAAA;AAAA,OAG/B,YAAW,CAAC,QAAgB,SAAgE;AAAA,IACxG,MAAM,eAAe,KAAK,QAAQ;AAAA,IAElC,IAAI,iBAAiB,OAAO;AAAA,MAC1B;AAAA,IACF;AAAA,IAEA,IAAI,iBAAiB,KAAK;AAAA,MACxB,OAAO;AAAA,IACT;AAAA,IAEA,IAAI,OAAO,iBAAiB,UAAU;AAAA,MACpC,OAAO,iBAAiB,SAAS,eAAe;AAAA,IAClD;AAAA,IAEA,IAAI,OAAO,iBAAiB,WAAW;AAAA,MACrC,OAAO,eAAe,SAAS;AAAA,IACjC;AAAA,IAEA,IAAI,wBAAwB,QAAQ;AAAA,MAClC,aAAa,YAAY;AAAA,MACzB,OAAO,aAAa,KAAK,MAAM,IAAI,SAAS;AAAA,IAC9C;AAAA,IAEA,IAAI,MAAM,QAAQ,YAAY,GAAG;AAAA,MAC/B,MAAM,UAAU,aAAa,KAAK,WAAS;AAAA,QACzC,IAAI,iBAAiB,QAAQ;AAAA,UAC3B,MAAM,YAAY;AAAA,UAClB,OAAO,MAAM,KAAK,MAAM;AAAA,QAC1B;AAAA,QAEA,OAAO,UAAU;AAAA,OAClB;AAAA,MAED,OAAO,UAAU,SAAS;AAAA,IAC5B;AAAA,IAEA,IAAI;AAAA,MACF,MAAM,eAAe,MAAM,aAAa,QAAQ,OAAO;AAAA,MAEvD,OAAO,KAAK,oBAAoB,QAAQ,YAAY;AAAA,MACpD,MAAM;AAAA,MACN,OAAO,KAAe;AAAA,QACpB;AAAA,QACA,SAAS;AAAA,MACX,CAAC;AAAA;AAAA;AAAA,EAIG,mBAAmB,CAAC,QAAgB,QAA0C;AAAA,IACpF,IAAI,WAAW,MAAM;AAAA,MACnB,OAAO;AAAA,IACT;AAAA,IAEA,IAAI,OAAO,WAAW,YAAY,OAAO,SAAS,GAAG;AAAA,MACnD,OAAO;AAAA,IACT;AAAA,IAEA;AAAA;AAAA,EAGM,sBAAsB,CAAC,gBAA8C;AAAA,IAC3E,IAAI,KAAK,QAAQ,eAAe,KAAK,iBAAiB,cAAc,GAAG;AAAA,MACrE,MAAM,WAAW,eAAe,OAAO,YAAU,OAAO,KAAK,MAAM,GAAG;AAAA,MAEtE,OAAO,SAAS,SAAS,IAAI,SAAS,KAAK,GAAG,IAAI;AAAA,IACpD;AAAA,IAEA,OAAO,eAAe,KAAK,GAAG;AAAA;AAAA,EAGxB,eAAe,CAAC,eAAuB,gBAAwC;AAAA,IACrF,IAAI,KAAK,iBAAiB,cAAc,GAAG;AAAA,MACzC,OAAO;AAAA,IACT;AAAA,IAEA,OAAO,eAAe,SAAS,aAAa;AAAA;AAAA,EAGtC,uBAAuB,CAAC,gBAA+B,eAA+B;AAAA,IAC5F,IAAI,CAAC,KAAK,iBAAiB,cAAc,GAAG;AAAA,MAC1C,OAAO,eAAe,KAAK,GAAG;AAAA,IAChC;AAAA,IAEA,IAAI,KAAK,QAAQ,aAAa;AAAA,MAC5B,OAAO;AAAA,IACT;AAAA,IAEA,OAAO;AAAA;AAAA,EAGD,wBAAwB,CAAC,gBAA0B,gBAAmC;AAAA,IAC5F,IAAI,eAAe,WAAW,GAAG;AAAA,MAC/B,OAAO;AAAA,IACT;AAAA,IAEA,IAAI,eAAe,WAAW,GAAG;AAAA,MAC/B,OAAO;AAAA,IACT;AAAA,IAEA,MAAM,cAAc,KAAK,iBAAiB,cAAc;AAAA,IAExD,IAAI,aAAa;AAAA,MACf,MAAM,kBAAkB,eAAe,OAAO,YAAU,OAAO,KAAK,MAAM,GAAG;AAAA,MAE7E,MAAM,mBAAmB,eAAe,KAAK,YAAU,OAAO,YAAY,MAAM,eAAe;AAAA,MAE/F,IAAI,oBAAoB,CAAC,KAAK,eAAe,iBAAiB,eAAe,GAAG;AAAA,QAC9E,OAAO;AAAA,MACT;AAAA,MAEA,IAAI,CAAC,KAAK,QAAQ,aAAa;AAAA,QAC7B,OAAO;AAAA,MACT;AAAA,MAEA,OAAO,eAAe,MAAM,YAAU;AAAA,QACpC,IAAI,KAAK,eAAe,iBAAiB,MAAM,GAAG;AAAA,UAChD,OAAO;AAAA,QACT;AAAA,QAEA,OAAO,OAAO,YAAY,MAAM;AAAA,OACjC;AAAA,IACH;AAAA,IAEA,OAAO,eAAe,MAAM,YAAU,KAAK,eAAe,gBAAgB,MAAM,CAAC;AAAA;AAAA,EAG3E,uBAAuB,CAAC,gBAA0B,mBAAsD;AAAA,IAC9G,IAAI,eAAe,WAAW,GAAG;AAAA,MAC/B;AAAA,IACF;AAAA,IAEA,IAAI,CAAC,KAAK,iBAAiB,cAAc,GAAG;AAAA,MAC1C,OAAO,eAAe,KAAK,GAAG;AAAA,IAChC;AAAA,IAEA,IAAI,KAAK,QAAQ,aAAa;AAAA,MAC5B,IAAI,sBAAsB,QAAQ,kBAAkB,SAAS,GAAG;AAAA,QAC9D,OAAO;AAAA,MACT;AAAA,MAEA;AAAA,IACF;AAAA,IAEA,OAAO;AAAA;AAAA,EAGD,gBAAgB,CAAC,QAA2B;AAAA,IAClD,OAAO,OAAO,KAAK,WAAS,UAAU,GAAG;AAAA;AAAA,EAGnC,cAAc,CAAC,gBAA0B,eAAgC;AAAA,IAC/E,OAAO,eAAe,KAAK,YAAU,OAAO,YAAY,MAAM,cAAc,YAAY,CAAC;AAAA;AAAA,EAGnF,yBAAyB,CAAC,OAAgC;AAAA,IAChE,IAAI,UAAU,QAAQ,MAAM,WAAW,GAAG;AAAA,MACxC,OAAO,CAAC;AAAA,IACV;AAAA,IAEA,OAAO,MACJ,MAAM,GAAG,EACT,IAAI,UAAQ,KAAK,KAAK,CAAC,EACvB,OAAO,UAAQ,KAAK,SAAS,CAAC;AAAA;AAErC;",
+  "debugId": "A8102427CA89803164756E2164756E21",
+  "names": []
+}

package/dist/src/constants.d.ts

@@ -0,0 +1,3 @@
+import { HttpStatus } from '@zipbul/shared';
+export declare const CORS_DEFAULT_METHODS: string[];
+export declare const CORS_DEFAULT_OPTIONS_SUCCESS_STATUS = HttpStatus.NoContent;

package/dist/src/cors.d.ts

@@ -0,0 +1,38 @@
+import type { Result } from '@zipbul/result';
+import type { CorsError, CorsOptions } from './interfaces';
+import type { CorsResult } from './types';
+/**
+ * Framework-agnostic CORS handler.
+ * Evaluates CORS policy and returns a discriminated union result
+ * instead of generating responses directly.
+ */
+export declare class Cors {
+    private readonly options;
+    private constructor();
+    /**
+     * Creates a Cors instance after resolving and validating options.
+     *
+     * @returns Cors instance on success, Err<CorsError> on validation failure.
+     */
+    static create(options?: CorsOptions): Result<Cors, CorsError>;
+    /**
+     * Evaluates CORS policy for the given request.
+     *
+     * @returns `Continue` — attach headers and proceed,
+     *          `RespondPreflight` — return preflight response,
+     *          `Reject` — deny with reason,
+     *          `Err<CorsError>` — origin function threw.
+     */
+    handle(request: Request): Promise<Result<CorsResult, CorsError>>;
+    private reject;
+    private matchOrigin;
+    private resolveOriginResult;
+    private serializeExposeHeaders;
+    private isMethodAllowed;
+    private serializeAllowedMethods;
+    private areRequestHeadersAllowed;
+    private serializeAllowedHeaders;
+    private includesWildcard;
+    private includesHeader;
+    private parseCommaSeparatedValues;
+}

package/dist/src/enums.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Discriminant for {@link CorsResult}.
+ * Determines how to handle the response.
+ */
+export declare enum CorsAction {
+    /** Attach CORS headers to the response and continue processing. */
+    Continue = 0,
+    /** Return a preflight-only response immediately. */
+    RespondPreflight = 1,
+    /** Reject the request. See {@link CorsRejectionReason} for details. */
+    Reject = 2
+}
+/**
+ * Reason why a CORS request was rejected.
+ */
+export declare enum CorsRejectionReason {
+    /** `Origin` header is missing or empty. */
+    NoOrigin = 0,
+    /** Origin is not in the allowed list. */
+    OriginNotAllowed = 1,
+    /** Preflight request method is not allowed. */
+    MethodNotAllowed = 2,
+    /** Preflight request header is not allowed. */
+    HeaderNotAllowed = 3
+}
+/**
+ * Reason why CORS options validation failed.
+ */
+export declare enum CorsErrorReason {
+    /** credentials:true is incompatible with wildcard origin per Fetch Standard. */
+    CredentialsWithWildcardOrigin = 0,
+    /** maxAge must be non-negative. */
+    InvalidMaxAge = 1,
+    /** optionsSuccessStatus must be 200–299 (ok status). */
+    InvalidStatusCode = 2,
+    /** Origin function threw at runtime. */
+    OriginFunctionError = 3,
+    /** origin is an empty/blank string, empty array, or array containing empty/blank string entries (RFC 6454). */
+    InvalidOrigin = 4,
+    /** methods is an empty array or contains empty/blank string entries (RFC 9110 §5.6.2 token). */
+    InvalidMethods = 5,
+    /** allowedHeaders contains empty/blank string entries (RFC 9110 §5.6.2 token). */
+    InvalidAllowedHeaders = 6,
+    /** exposedHeaders contains empty/blank string entries (RFC 9110 §5.6.2 token). */
+    InvalidExposedHeaders = 7,
+    /** origin RegExp is potentially unsafe (exponential backtracking / ReDoS). */
+    UnsafeRegExp = 8
+}

package/dist/src/interfaces.d.ts

@@ -0,0 +1,90 @@
+import type { CorsAction, CorsErrorReason, CorsRejectionReason } from './enums';
+import type { CorsMethod, OriginOptions } from './types';
+/**
+ * Normal request or `preflightContinue` preflight.
+ * Merge `headers` into your response.
+ */
+export interface CorsContinueResult {
+    action: CorsAction.Continue;
+    headers: Headers;
+}
+/**
+ * Preflight response.
+ * Use `headers` and `statusCode` to build a response.
+ */
+export interface CorsPreflightResult {
+    action: CorsAction.RespondPreflight;
+    headers: Headers;
+    statusCode: number;
+}
+/**
+ * CORS validation failed.
+ * Inspect `reason` to build an error response.
+ */
+export interface CorsRejectResult {
+    action: CorsAction.Reject;
+    reason: CorsRejectionReason;
+}
+/**
+ * Error data returned when CORS validation fails.
+ */
+export interface CorsError {
+    reason: CorsErrorReason;
+    message: string;
+}
+/**
+ * Configuration for the {@link Cors} handler.
+ * All fields are optional.
+ */
+export interface CorsOptions {
+    /**
+     * Allowed origin(s).
+     * Accepts `'*'`, `false`, `true`, string, RegExp, array, or async function.
+     *
+     * @defaultValue `'*'`
+     */
+    origin?: OriginOptions;
+    /**
+     * HTTP methods allowed in preflight.
+     * Standard methods are autocompleted; any RFC 9110 §5.6.2 token is accepted.
+     * Values are normalized to uppercase internally.
+     *
+     * @defaultValue `['GET','HEAD','PUT','PATCH','POST','DELETE']`
+     * @example ['GET', 'POST', 'DELETE']
+     * @example ['*']  // allow all methods
+     * @example ['GET', 'PROPFIND']  // custom token
+     */
+    methods?: CorsMethod[];
+    /**
+     * Request headers allowed in preflight.
+     * When omitted, echoes `Access-Control-Request-Headers`.
+     */
+    allowedHeaders?: string[];
+    /**
+     * Response headers exposed to browser JavaScript.
+     */
+    exposedHeaders?: string[];
+    /**
+     * Whether to send `Access-Control-Allow-Credentials: true`.
+     *
+     * @defaultValue `false`
+     */
+    credentials?: boolean;
+    /**
+     * Preflight cache duration in seconds.
+     * When omitted, the header is not sent.
+     */
+    maxAge?: number;
+    /**
+     * When `true`, preflight returns `Continue` instead of `RespondPreflight`.
+     *
+     * @defaultValue `false`
+     */
+    preflightContinue?: boolean;
+    /**
+     * HTTP status for the preflight response.
+     *
+     * @defaultValue `204`
+     */
+    optionsSuccessStatus?: number;
+}

package/dist/src/options.d.ts

@@ -0,0 +1,25 @@
+import type { Result } from '@zipbul/result';
+import type { CorsError, CorsOptions } from './interfaces';
+import type { ResolvedCorsOptions } from './types';
+/**
+ * Resolves partial {@link CorsOptions} into a fully populated
+ * {@link ResolvedCorsOptions} by applying defaults via nullish coalescing.
+ */
+export declare function resolveCorsOptions(options?: CorsOptions): ResolvedCorsOptions;
+/**
+ * Validates resolved CORS options against rules derived from the Fetch Standard and RFC 9110.
+ *
+ * - V0a: `origin` must not be an empty/blank string (RFC 6454).
+ * - V_regex: `origin` RegExp must be safe (no exponential backtracking / ReDoS).
+ * - V0b: `origin` array must not be empty, and must not contain empty/blank string entries (RFC 6454).
+ *          Array RegExp entries are also checked for ReDoS safety.
+ * - V0c: `methods` must not be empty, and must not contain empty/blank string entries (RFC 9110 §5.6.2).
+ * - V0d: `allowedHeaders` must not contain empty/blank string entries (RFC 9110 §5.6.2).
+ * - V0e: `exposedHeaders` must not contain empty/blank string entries (RFC 9110 §5.6.2).
+ * - V1:  `credentials:true` with wildcard origin is forbidden (Fetch Standard §3.3.5).
+ * - V2:  `maxAge` must be a non-negative integer when set (RFC 9111 §1.2.1 delta-seconds).
+ * - V3:  `optionsSuccessStatus` must be a 2xx integer (Fetch Standard).
+ *
+ * @returns `undefined` (void) if valid, or `Err<CorsError>` on the first violated rule.
+ */
+export declare function validateCorsOptions(resolved: ResolvedCorsOptions): Result<void, CorsError>;

package/dist/src/types.d.ts

@@ -0,0 +1,39 @@
+import type { CorsContinueResult, CorsPreflightResult, CorsRejectResult } from './interfaces';
+/**
+ * HTTP method token accepted by the `methods` option.
+ * Provides autocomplete for standard RFC 9110 / RFC 5789 methods
+ * while allowing any RFC 9110 §5.6.2 token (e.g. `'PROPFIND'`, `'PURGE'`).
+ */
+export type CorsMethod = 'GET' | 'HEAD' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'OPTIONS' | (string & {});
+/**
+ * Return value of an origin function.
+ * `true` to reflect, a string to override, or `false` to reject.
+ */
+export type OriginResult = boolean | string;
+/**
+ * Function that dynamically resolves whether an origin is allowed.
+ */
+export type OriginFn = (origin: string, request: Request) => OriginResult | Promise<OriginResult>;
+/**
+ * All accepted forms for the `origin` option.
+ */
+export type OriginOptions = boolean | string | RegExp | Array<string | RegExp> | OriginFn;
+/**
+ * Discriminated union returned by {@link Cors.handle}.
+ * Branch on `action` to determine next step.
+ */
+export type CorsResult = CorsContinueResult | CorsPreflightResult | CorsRejectResult;
+/**
+ * Fully resolved CORS options with all defaults applied.
+ * `null` indicates "use default behavior" (e.g., echo mode for headers).
+ */
+export type ResolvedCorsOptions = {
+    origin: OriginOptions;
+    methods: string[];
+    allowedHeaders: string[] | null;
+    exposedHeaders: string[] | null;
+    credentials: boolean;
+    maxAge: number | null;
+    preflightContinue: boolean;
+    optionsSuccessStatus: number;
+};