@zudojs/security 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Zudojs Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,37 @@
+# @zudojs/security
+
+Security primitives for input validation, header security, CORS, CSRF protection, rate limiting, and security headers.
+
+## Installation
+
+```bash
+npm install @zudojs/security
+```
+
+## Quick Start
+
+```typescript
+import { createRateLimiter, cors, securityHeaders } from "@zudojs/security";
+
+const limiter = createRateLimiter({ windowMs: 60000, max: 100 });
+
+app.use(limiter);
+app.use(cors({ origin: "https://example.com" }));
+app.use(securityHeaders());
+```
+
+## Features
+
+- Input validation and sanitization
+- CORS configuration
+- CSRF token generation and validation
+- Rate limiting with sliding window
+- Security headers (CSP, HSTS, X-Frame-Options, etc.)
+- URL normalization and SSRF protection
+
+## Use Cases
+
+- Securing HTTP endpoints
+- Preventing injection attacks
+- Rate limiting public APIs
+- Compliance with security headers standards

package/dist/body/body.core.d.ts

@@ -0,0 +1,51 @@
+/**
+ * @zudojs/security — Body Validation
+ *
+ * Validates request body size and content type against configurable limits.
+ */
+import type { BodyLimitConfig, BodyLimitPresets } from "../types/security.type.js";
+/** Default body limits for common use cases. */
+export declare const DEFAULT_BODY_LIMITS: BodyLimitPresets;
+/**
+ * Validates the Content-Length header value.
+ *
+ * @param contentLength - The Content-Length header value.
+ * @returns An error message if invalid, or undefined.
+ */
+export declare function validateContentLength(contentLength: string | undefined): string | undefined;
+/**
+ * Validates that a body size is within the allowed limit.
+ *
+ * @param actualSize - The actual body size in bytes.
+ * @param maxSize - The maximum allowed size in bytes.
+ * @param contentType - Optional content type for context in error messages.
+ * @returns An error message if too large, or undefined.
+ */
+export declare function validateBodySize(actualSize: number, maxSize?: number, contentType?: string): string | undefined;
+/**
+ * Gets the appropriate body limit for a given content type.
+ *
+ * @param contentType - The Content-Type header value.
+ * @param presetLimits - Optional custom preset limits.
+ * @returns The maximum body size in bytes.
+ */
+export declare function getBodyLimitForContentType(contentType: string | undefined, presetLimits?: Partial<BodyLimitPresets>): number;
+/**
+ * Validates a body limit configuration.
+ *
+ * @param config - The body limit configuration to validate.
+ * @returns An error message if invalid, or undefined.
+ */
+export declare function validateBodyLimitConfig(config: BodyLimitConfig): string | undefined;
+/**
+ * Creates a body size checker function for use in middleware.
+ *
+ * @param maxSize - The maximum body size in bytes.
+ * @param contentType - Optional content type to check against.
+ * @returns A function that checks if a size is within limits.
+ */
+export declare function createBodySizeChecker(maxSize: number, contentType?: string): (size: number) => {
+    allowed: boolean;
+    error?: string;
+};
+//# sourceMappingURL=body.core.d.ts.map

package/dist/body/body.core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"body.core.d.ts","sourceRoot":"","sources":["../../src/body/body.core.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EACjB,MAAM,2BAA2B,CAAC;AAEnC,gDAAgD;AAChD,eAAO,MAAM,mBAAmB,EAAE,gBASjC,CAAC;AAKF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC,MAAM,GAAG,SAAS,CAoBpB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,EAChB,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,GAAG,SAAS,CASpB;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,YAAY,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GACvC,MAAM,CA8BR;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,eAAe,GACtB,MAAM,GAAG,SAAS,CAWpB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,WAAW,CAAC,EAAE,MAAM,GACnB,CAAC,IAAI,EAAE,MAAM,KAAK;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAQxD"}

package/dist/body/body.core.js

@@ -0,0 +1,120 @@
+/**
+ * @zudojs/security — Body Validation
+ *
+ * Validates request body size and content type against configurable limits.
+ */
+/** Default body limits for common use cases. */
+export const DEFAULT_BODY_LIMITS = {
+    /** JSON API: 1MB */
+    json: 1_048_576,
+    /** Authentication endpoints: 256KB */
+    auth: 262_144,
+    /** File upload: 100MB */
+    upload: 104_857_600,
+    /** Webhook payloads: 2MB */
+    webhook: 2_097_152,
+};
+/** Default maximum body size (1MB). */
+const DEFAULT_MAX_BODY_SIZE = 1_048_576;
+/**
+ * Validates the Content-Length header value.
+ *
+ * @param contentLength - The Content-Length header value.
+ * @returns An error message if invalid, or undefined.
+ */
+export function validateContentLength(contentLength) {
+    if (contentLength === undefined) {
+        return undefined; // No Content-Length is fine (chunked transfer)
+    }
+    const parsed = parseInt(contentLength, 10);
+    if (isNaN(parsed)) {
+        return `Content-Length is not a valid number: ${contentLength}`;
+    }
+    if (parsed < 0) {
+        return `Content-Length cannot be negative: ${parsed}`;
+    }
+    if (!Number.isSafeInteger(parsed)) {
+        return `Content-Length is not a safe integer: ${contentLength}`;
+    }
+    return undefined;
+}
+/**
+ * Validates that a body size is within the allowed limit.
+ *
+ * @param actualSize - The actual body size in bytes.
+ * @param maxSize - The maximum allowed size in bytes.
+ * @param contentType - Optional content type for context in error messages.
+ * @returns An error message if too large, or undefined.
+ */
+export function validateBodySize(actualSize, maxSize, contentType) {
+    const limit = maxSize ?? DEFAULT_MAX_BODY_SIZE;
+    if (actualSize > limit) {
+        const context = contentType ? ` for ${contentType}` : "";
+        return `Body size ${actualSize} bytes exceeds maximum ${limit} bytes${context}`;
+    }
+    return undefined;
+}
+/**
+ * Gets the appropriate body limit for a given content type.
+ *
+ * @param contentType - The Content-Type header value.
+ * @param presetLimits - Optional custom preset limits.
+ * @returns The maximum body size in bytes.
+ */
+export function getBodyLimitForContentType(contentType, presetLimits) {
+    const limits = { ...DEFAULT_BODY_LIMITS, ...presetLimits };
+    if (!contentType) {
+        return limits.json;
+    }
+    const type = contentType.toLowerCase();
+    if (type.includes("json")) {
+        return limits.json;
+    }
+    if (type.includes("x-www-form-urlencoded") || type.includes("multipart")) {
+        // Check if it's likely an auth form
+        if (type.includes("login") || type.includes("auth")) {
+            return limits.auth;
+        }
+        return limits.upload;
+    }
+    if (type.includes("octet-stream")) {
+        return limits.upload;
+    }
+    if (type.includes("xml")) {
+        return limits.webhook;
+    }
+    return limits.json;
+}
+/**
+ * Validates a body limit configuration.
+ *
+ * @param config - The body limit configuration to validate.
+ * @returns An error message if invalid, or undefined.
+ */
+export function validateBodyLimitConfig(config) {
+    if (config.maxSize <= 0) {
+        return `Body limit maxSize must be positive, got: ${config.maxSize}`;
+    }
+    if (config.maxSize > 1_073_741_824) {
+        // 1GB
+        return `Body limit maxSize ${config.maxSize} exceeds maximum allowed (1GB)`;
+    }
+    return undefined;
+}
+/**
+ * Creates a body size checker function for use in middleware.
+ *
+ * @param maxSize - The maximum body size in bytes.
+ * @param contentType - Optional content type to check against.
+ * @returns A function that checks if a size is within limits.
+ */
+export function createBodySizeChecker(maxSize, contentType) {
+    return (size) => {
+        const error = validateBodySize(size, maxSize, contentType);
+        return {
+            allowed: error === undefined,
+            error,
+        };
+    };
+}
+//# sourceMappingURL=body.core.js.map

package/dist/body/body.core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body.core.js","sourceRoot":"","sources":["../../src/body/body.core.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,gDAAgD;AAChD,MAAM,CAAC,MAAM,mBAAmB,GAAqB;IACnD,oBAAoB;IACpB,IAAI,EAAE,SAAS;IACf,sCAAsC;IACtC,IAAI,EAAE,OAAO;IACb,yBAAyB;IACzB,MAAM,EAAE,WAAW;IACnB,4BAA4B;IAC5B,OAAO,EAAE,SAAS;CACnB,CAAC;AAEF,uCAAuC;AACvC,MAAM,qBAAqB,GAAG,SAAS,CAAC;AAExC;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,aAAiC;IAEjC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC,CAAC,+CAA+C;IACnE,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAE3C,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAClB,OAAO,yCAAyC,aAAa,EAAE,CAAC;IAClE,CAAC;IAED,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,OAAO,sCAAsC,MAAM,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,OAAO,yCAAyC,aAAa,EAAE,CAAC;IAClE,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAAkB,EAClB,OAAgB,EAChB,WAAoB;IAEpB,MAAM,KAAK,GAAG,OAAO,IAAI,qBAAqB,CAAC;IAE/C,IAAI,UAAU,GAAG,KAAK,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,aAAa,UAAU,0BAA0B,KAAK,SAAS,OAAO,EAAE,CAAC;IAClF,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,WAA+B,EAC/B,YAAwC;IAExC,MAAM,MAAM,GAAG,EAAE,GAAG,mBAAmB,EAAE,GAAG,YAAY,EAAE,CAAC;IAE3D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IAEvC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACzE,oCAAoC;QACpC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACpD,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAuB;IAEvB,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,6CAA6C,MAAM,CAAC,OAAO,EAAE,CAAC;IACvE,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,GAAG,aAAa,EAAE,CAAC;QACnC,MAAM;QACN,OAAO,sBAAsB,MAAM,CAAC,OAAO,gCAAgC,CAAC;IAC9E,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,WAAoB;IAEpB,OAAO,CAAC,IAAY,EAAE,EAAE;QACtB,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QAC3D,OAAO;YACL,OAAO,EAAE,KAAK,KAAK,SAAS;YAC5B,KAAK;SACN,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/body/index.d.ts

@@ -0,0 +1,5 @@
+/**
+ * @zudojs/security — Body Validation Barrel
+ */
+export { DEFAULT_BODY_LIMITS, validateContentLength, validateBodySize, getBodyLimitForContentType, validateBodyLimitConfig, createBodySizeChecker, } from "./body.core.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/body/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/body/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,EAChB,0BAA0B,EAC1B,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,gBAAgB,CAAC"}

package/dist/body/index.js

@@ -0,0 +1,5 @@
+/**
+ * @zudojs/security — Body Validation Barrel
+ */
+export { DEFAULT_BODY_LIMITS, validateContentLength, validateBodySize, getBodyLimitForContentType, validateBodyLimitConfig, createBodySizeChecker, } from "./body.core.js";
+//# sourceMappingURL=index.js.map

package/dist/body/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/body/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,EAChB,0BAA0B,EAC1B,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,gBAAgB,CAAC"}

package/dist/cookie/cookie.core.d.ts

@@ -0,0 +1,58 @@
+/**
+ * @zudojs/security — Cookie Security
+ *
+ * Parses, validates, and serializes HTTP cookies with security best practices.
+ */
+import type { CookieSecurityConfig, ParsedCookie } from "../types/security.type.js";
+/**
+ * Parses a raw cookie header string into individual cookies.
+ *
+ * @param cookieHeader - The raw Cookie header value.
+ * @param config - Optional security configuration.
+ * @returns Array of parsed cookies, or error messages.
+ */
+export declare function parseCookieHeader(cookieHeader: string, config?: CookieSecurityConfig): {
+    cookies: ParsedCookie[];
+    errors: string[];
+};
+/**
+ * Serializes a parsed cookie into a Set-Cookie header value.
+ *
+ * @param cookie - The cookie to serialize.
+ * @param config - Optional security configuration for defaults.
+ * @returns The serialized Set-Cookie header value.
+ */
+export declare function serializeCookie(cookie: ParsedCookie, config?: CookieSecurityConfig): string;
+/**
+ * Creates a Set-Cookie header value with secure defaults.
+ *
+ * @param name - Cookie name.
+ * @param value - Cookie value.
+ * @param options - Optional cookie attributes.
+ * @param config - Optional security configuration.
+ * @returns The serialized Set-Cookie header value.
+ */
+export declare function createSecureCookie(name: string, value: string, options?: Partial<Omit<ParsedCookie, "name" | "value">>, config?: CookieSecurityConfig): string;
+/**
+ * Validates a cookie name for safety.
+ *
+ * @param name - The cookie name to validate.
+ * @returns An error message if invalid, or undefined.
+ */
+export declare function validateCookieName(name: string): string | undefined;
+/**
+ * Validates a cookie value for safety.
+ *
+ * @param value - The cookie value to validate.
+ * @returns An error message if invalid, or undefined.
+ */
+export declare function validateCookieValue(value: string): string | undefined;
+/**
+ * Strips security-sensitive cookies from a cookie header.
+ *
+ * @param cookieHeader - The raw Cookie header.
+ * @param sensitiveNames - Names of cookies to strip (case-insensitive).
+ * @returns The cleaned cookie header.
+ */
+export declare function stripSensitiveCookies(cookieHeader: string, sensitiveNames?: readonly string[]): string;
+//# sourceMappingURL=cookie.core.d.ts.map

package/dist/cookie/cookie.core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie.core.d.ts","sourceRoot":"","sources":["../../src/cookie/cookie.core.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,YAAY,EACb,MAAM,2BAA2B,CAAC;AAWnC;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,oBAAoB,GAC5B;IAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAqD/C;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,YAAY,EACpB,MAAM,CAAC,EAAE,oBAAoB,GAC5B,MAAM,CAwCR;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,EACvD,MAAM,CAAC,EAAE,oBAAoB,GAC5B,MAAM,CAER;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAenE;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAYrE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,MAAM,EACpB,cAAc,GAAE,SAAS,MAAM,EAAwC,GACtE,MAAM,CAaR"}

package/dist/cookie/cookie.core.js

@@ -0,0 +1,163 @@
+/**
+ * @zudojs/security — Cookie Security
+ *
+ * Parses, validates, and serializes HTTP cookies with security best practices.
+ */
+/** Maximum cookie header size (4KB). */
+const MAX_COOKIE_HEADER_SIZE = 4096;
+/** Maximum number of cookies. */
+const MAX_COOKIE_COUNT = 50;
+/** Maximum individual cookie size. */
+const MAX_COOKIE_SIZE = 1024;
+/**
+ * Parses a raw cookie header string into individual cookies.
+ *
+ * @param cookieHeader - The raw Cookie header value.
+ * @param config - Optional security configuration.
+ * @returns Array of parsed cookies, or error messages.
+ */
+export function parseCookieHeader(cookieHeader, config) {
+    const errors = [];
+    const maxSize = config?.maxSize ?? MAX_COOKIE_SIZE;
+    const maxCount = config?.maxCount ?? MAX_COOKIE_COUNT;
+    // Check total header size
+    if (Buffer.byteLength(cookieHeader, "utf8") > MAX_COOKIE_HEADER_SIZE) {
+        errors.push(`Cookie header size exceeds maximum ${MAX_COOKIE_HEADER_SIZE} bytes`);
+        return { cookies: [], errors };
+    }
+    // Split by semicolons
+    const parts = cookieHeader.split(";");
+    if (parts.length > maxCount) {
+        errors.push(`Too many cookies: ${parts.length} exceeds maximum ${maxCount}`);
+    }
+    const cookies = [];
+    for (let i = 0; i < Math.min(parts.length, maxCount); i++) {
+        const part = parts[i]?.trim();
+        if (!part)
+            continue;
+        const eqIndex = part.indexOf("=");
+        if (eqIndex === -1) {
+            errors.push(`Cookie ${i}: missing equals sign in "${part}"`);
+            continue;
+        }
+        const name = part.slice(0, eqIndex).trim();
+        const value = part.slice(eqIndex + 1).trim();
+        if (name.length === 0) {
+            errors.push(`Cookie ${i}: empty cookie name`);
+            continue;
+        }
+        if (Buffer.byteLength(value, "utf8") > maxSize) {
+            errors.push(`Cookie "${name}" value size exceeds maximum ${maxSize} bytes`);
+            continue;
+        }
+        cookies.push({ name, value });
+    }
+    return { cookies, errors };
+}
+/**
+ * Serializes a parsed cookie into a Set-Cookie header value.
+ *
+ * @param cookie - The cookie to serialize.
+ * @param config - Optional security configuration for defaults.
+ * @returns The serialized Set-Cookie header value.
+ */
+export function serializeCookie(cookie, config) {
+    const parts = [`${cookie.name}=${cookie.value}`];
+    if (cookie.path) {
+        parts.push(`Path=${cookie.path}`);
+    }
+    if (cookie.domain) {
+        parts.push(`Domain=${cookie.domain}`);
+    }
+    if (cookie.maxAge !== undefined) {
+        parts.push(`Max-Age=${cookie.maxAge}`);
+    }
+    if (cookie.expires) {
+        parts.push(`Expires=${cookie.expires.toUTCString()}`);
+    }
+    // Apply security defaults from config
+    const secure = cookie.secure ?? config?.secure ?? true;
+    if (secure) {
+        parts.push("Secure");
+    }
+    const httpOnly = cookie.httpOnly ?? config?.httpOnly ?? true;
+    if (httpOnly) {
+        parts.push("HttpOnly");
+    }
+    const sameSite = cookie.sameSite ?? config?.sameSite ?? "lax";
+    parts.push(`SameSite=${sameSite.charAt(0).toUpperCase() + sameSite.slice(1)}`);
+    if (cookie.partitioned) {
+        parts.push("Partitioned");
+    }
+    return parts.join("; ");
+}
+/**
+ * Creates a Set-Cookie header value with secure defaults.
+ *
+ * @param name - Cookie name.
+ * @param value - Cookie value.
+ * @param options - Optional cookie attributes.
+ * @param config - Optional security configuration.
+ * @returns The serialized Set-Cookie header value.
+ */
+export function createSecureCookie(name, value, options, config) {
+    return serializeCookie({ name, value, ...options }, config);
+}
+/**
+ * Validates a cookie name for safety.
+ *
+ * @param name - The cookie name to validate.
+ * @returns An error message if invalid, or undefined.
+ */
+export function validateCookieName(name) {
+    if (name.length === 0) {
+        return "Cookie name cannot be empty";
+    }
+    if (name.length > 256) {
+        return `Cookie name exceeds maximum length of 256: ${name.length}`;
+    }
+    // RFC 6265: cookie name cannot contain certain characters
+    if (/[\s,;=]/.test(name)) {
+        return `Cookie name contains invalid characters: ${name}`;
+    }
+    return undefined;
+}
+/**
+ * Validates a cookie value for safety.
+ *
+ * @param value - The cookie value to validate.
+ * @returns An error message if invalid, or undefined.
+ */
+export function validateCookieValue(value) {
+    // Check for semicolons (used as delimiter)
+    if (value.includes(";")) {
+        return "Cookie value cannot contain semicolons";
+    }
+    // Check for control characters
+    if (/[\x00-\x1F\x7F]/.test(value)) {
+        return "Cookie value contains control characters";
+    }
+    return undefined;
+}
+/**
+ * Strips security-sensitive cookies from a cookie header.
+ *
+ * @param cookieHeader - The raw Cookie header.
+ * @param sensitiveNames - Names of cookies to strip (case-insensitive).
+ * @returns The cleaned cookie header.
+ */
+export function stripSensitiveCookies(cookieHeader, sensitiveNames = ["session", "token", "auth", "jwt"]) {
+    const lowerSensitive = sensitiveNames.map((n) => n.toLowerCase());
+    return cookieHeader
+        .split(";")
+        .map((pair) => pair.trim())
+        .filter((pair) => {
+        const eqIndex = pair.indexOf("=");
+        if (eqIndex === -1)
+            return false;
+        const name = pair.slice(0, eqIndex).trim().toLowerCase();
+        return !lowerSensitive.includes(name);
+    })
+        .join("; ");
+}
+//# sourceMappingURL=cookie.core.js.map

package/dist/cookie/cookie.core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie.core.js","sourceRoot":"","sources":["../../src/cookie/cookie.core.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,wCAAwC;AACxC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAEpC,iCAAiC;AACjC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B,sCAAsC;AACtC,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,YAAoB,EACpB,MAA6B;IAE7B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,eAAe,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,gBAAgB,CAAC;IAEtD,0BAA0B;IAC1B,IAAI,MAAM,CAAC,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,GAAG,sBAAsB,EAAE,CAAC;QACrE,MAAM,CAAC,IAAI,CACT,sCAAsC,sBAAsB,QAAQ,CACrE,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;IACjC,CAAC;IAED,sBAAsB;IACtB,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEtC,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CACT,qBAAqB,KAAK,CAAC,MAAM,oBAAoB,QAAQ,EAAE,CAChE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAmB,EAAE,CAAC;IAEnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI;YAAE,SAAS;QAEpB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,6BAA6B,IAAI,GAAG,CAAC,CAAC;YAC7D,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAE7C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;YAC9C,SAAS;QACX,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CACT,WAAW,IAAI,gCAAgC,OAAO,QAAQ,CAC/D,CAAC;YACF,SAAS;QACX,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAoB,EACpB,MAA6B;IAE7B,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAEjD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,sCAAsC;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC;IACvD,IAAI,MAAM,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,EAAE,QAAQ,IAAI,IAAI,CAAC;IAC7D,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,EAAE,QAAQ,IAAI,KAAK,CAAC;IAC9D,KAAK,CAAC,IAAI,CACR,YAAY,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CACnE,CAAC;IAEF,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,KAAa,EACb,OAAuD,EACvD,MAA6B;IAE7B,OAAO,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,6BAA6B,CAAC;IACvC,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACtB,OAAO,8CAA8C,IAAI,CAAC,MAAM,EAAE,CAAC;IACrE,CAAC;IAED,0DAA0D;IAC1D,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,4CAA4C,IAAI,EAAE,CAAC;IAC5D,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,2CAA2C;IAC3C,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,wCAAwC,CAAC;IAClD,CAAC;IAED,+BAA+B;IAC/B,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,0CAA0C,CAAC;IACpD,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,YAAoB,EACpB,cAAc,GAAsB,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;IAEvE,MAAM,cAAc,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAElE,OAAO,YAAY;SAChB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QACf,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACzD,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}

package/dist/cookie/index.d.ts

@@ -0,0 +1,5 @@
+/**
+ * @zudojs/security — Cookie Security Barrel
+ */
+export { parseCookieHeader, serializeCookie, createSecureCookie, validateCookieName, validateCookieValue, stripSensitiveCookies, } from "./cookie.core.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/cookie/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cookie/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC"}

package/dist/cookie/index.js

@@ -0,0 +1,5 @@
+/**
+ * @zudojs/security — Cookie Security Barrel
+ */
+export { parseCookieHeader, serializeCookie, createSecureCookie, validateCookieName, validateCookieValue, stripSensitiveCookies, } from "./cookie.core.js";
+//# sourceMappingURL=index.js.map

package/dist/cookie/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cookie/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC"}

package/dist/cors/cors.core.d.ts

@@ -0,0 +1,58 @@
+/**
+ * @zudojs/security — CORS
+ *
+ * Validates and generates CORS headers for cross-origin requests.
+ */
+import type { CorsConfig } from "../types/security.type.js";
+/**
+ * CORS headers that should be set on responses.
+ */
+export interface CorsHeaders {
+    "Access-Control-Allow-Origin"?: string;
+    "Access-Control-Allow-Methods"?: string;
+    "Access-Control-Allow-Headers"?: string;
+    "Access-Control-Expose-Headers"?: string;
+    "Access-Control-Allow-Credentials"?: string;
+    "Access-Control-Max-Age"?: string;
+}
+/**
+ * Checks if a request origin is allowed.
+ *
+ * @param origin - The request Origin header value.
+ * @param config - CORS configuration.
+ * @returns The allowed origin value, or undefined if not allowed.
+ */
+export declare function isOriginAllowed(origin: string | undefined, config: CorsConfig): string | undefined;
+/**
+ * Generates CORS headers for a preflight request.
+ *
+ * @param requestOrigin - The request Origin header.
+ * @param config - CORS configuration.
+ * @returns CORS headers to set on the response.
+ */
+export declare function generatePreflightHeaders(requestOrigin: string | undefined, config: CorsConfig): CorsHeaders;
+/**
+ * Generates CORS headers for a simple request.
+ *
+ * @param requestOrigin - The request Origin header.
+ * @param config - CORS configuration.
+ * @returns CORS headers to set on the response.
+ */
+export declare function generateSimpleHeaders(requestOrigin: string | undefined, config: CorsConfig): CorsHeaders;
+/**
+ * Validates that a requested method is allowed.
+ *
+ * @param method - The HTTP method from Access-Control-Request-Method.
+ * @param config - CORS configuration.
+ * @returns True if the method is allowed.
+ */
+export declare function isMethodAllowed(method: string, config: CorsConfig): boolean;
+/**
+ * Validates that all requested headers are allowed.
+ *
+ * @param headers - Headers from Access-Control-Request-Headers.
+ * @param config - CORS configuration.
+ * @returns An array of disallowed headers, or empty array if all allowed.
+ */
+export declare function getDisallowedHeaders(headers: string[], config: CorsConfig): string[];
+//# sourceMappingURL=cors.core.d.ts.map

package/dist/cors/cors.core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.core.d.ts","sourceRoot":"","sources":["../../src/cors/cors.core.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAc5D;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,6BAA6B,CAAC,EAAE,MAAM,CAAC;IACvC,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACxC,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACxC,+BAA+B,CAAC,EAAE,MAAM,CAAC;IACzC,kCAAkC,CAAC,EAAE,MAAM,CAAC;IAC5C,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,MAAM,EAAE,UAAU,GACjB,MAAM,GAAG,SAAS,CA2CpB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,MAAM,EAAE,UAAU,GACjB,WAAW,CA0Bb;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,MAAM,EAAE,UAAU,GACjB,WAAW,CAkBb;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAG3E;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EAAE,EACjB,MAAM,EAAE,UAAU,GACjB,MAAM,EAAE,CAQV"}