@zudojs/security 0.0.1

package/dist/rateLimit/rateLimit.core.d.ts

@@ -0,0 +1,51 @@
+/**
+ * @zudojs/security — Rate Limiting
+ *
+ * Implements sliding window rate limiting to prevent abuse.
+ */
+import type { RateLimitConfig, RateLimitRequest, RateLimitResult } from "../types/security.type.js";
+/**
+ * Default key generator using IP address.
+ *
+ * @param request - The rate limit request.
+ * @returns The rate limit key.
+ */
+export declare function defaultKeyGenerator(request: RateLimitRequest): string;
+/**
+ * Default handler when rate limit is exceeded.
+ *
+ * @param _request - The rate limit request.
+ * @param response - The rate limit response to modify.
+ */
+export declare function defaultHandler(_request: RateLimitRequest, response: {
+    statusCode: number;
+    headers: Record<string, string>;
+    body?: string;
+}): void;
+/**
+ * Creates an in-memory rate limiter.
+ *
+ * @param config - Rate limit configuration.
+ * @returns A function that checks rate limits.
+ */
+export declare function createRateLimiter(config: RateLimitConfig): {
+    check: (request: RateLimitRequest) => RateLimitResult;
+    middleware: (request: RateLimitRequest, response?: {
+        statusCode: number;
+        headers: Record<string, string>;
+        body?: string;
+    }) => RateLimitResult;
+    reset: (key: string) => void;
+    clear: () => void;
+    getCount: (key: string) => number;
+    destroy: () => void;
+};
+/**
+ * Extracts the client IP from request headers.
+ * Used as a default key generator.
+ *
+ * @param headers - Request headers.
+ * @returns The client IP address.
+ */
+export declare function extractClientIp(headers: Record<string, string | string[] | undefined>): string;
+//# sourceMappingURL=rateLimit.core.d.ts.map

package/dist/rateLimit/rateLimit.core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimit.core.d.ts","sourceRoot":"","sources":["../../src/rateLimit/rateLimit.core.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EAChB,eAAe,EAChB,MAAM,2BAA2B,CAAC;AAoBnC;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAErE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE;IACR,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GACA,IAAI,CAUN;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,eAAe;qBAwB/B,gBAAgB,KAAG,eAAe;0BA4C/C,gBAAgB,aACd;QACT,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,KACA,eAAe;iBAaE,MAAM,KAAG,IAAI;iBAOf,IAAI;oBAOC,MAAM,KAAG,MAAM;mBAYlB,IAAI;EAazB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GACrD,MAAM,CAiBR"}

package/dist/rateLimit/rateLimit.core.js

@@ -0,0 +1,175 @@
+/**
+ * @zudojs/security — Rate Limiting
+ *
+ * Implements sliding window rate limiting to prevent abuse.
+ */
+/** Default rate limit: 100 requests per minute. */
+const DEFAULT_MAX = 100;
+/** Default window: 1 minute. */
+const DEFAULT_WINDOW_MS = 60_000;
+/** Default rate limit message. */
+const DEFAULT_MESSAGE = "Too many requests";
+/**
+ * Default key generator using IP address.
+ *
+ * @param request - The rate limit request.
+ * @returns The rate limit key.
+ */
+export function defaultKeyGenerator(request) {
+    return request.ip ?? "unknown";
+}
+/**
+ * Default handler when rate limit is exceeded.
+ *
+ * @param _request - The rate limit request.
+ * @param response - The rate limit response to modify.
+ */
+export function defaultHandler(_request, response) {
+    response.statusCode = 429;
+    response.headers["Retry-After"] = "60";
+    response.headers["X-RateLimit-Remaining"] = "0";
+    response.body = JSON.stringify({
+        error: {
+            code: "RATE_LIMIT_EXCEEDED",
+            message: DEFAULT_MESSAGE,
+        },
+    });
+}
+/**
+ * Creates an in-memory rate limiter.
+ *
+ * @param config - Rate limit configuration.
+ * @returns A function that checks rate limits.
+ */
+export function createRateLimiter(config) {
+    const store = new Map();
+    const keyGenerator = config.keyGenerator ?? defaultKeyGenerator;
+    const handler = config.handler;
+    const skip = config.skip;
+    // Cleanup old entries periodically
+    const cleanupInterval = setInterval(() => {
+        const now = Date.now();
+        for (const [key, entry] of store) {
+            if (now - entry.windowStart > config.windowMs * 2) {
+                store.delete(key);
+            }
+        }
+    }, config.windowMs);
+    // Allow cleanup to not keep process alive
+    if (cleanupInterval.unref) {
+        cleanupInterval.unref();
+    }
+    /**
+     * Checks if a request is allowed and updates the counter.
+     */
+    function check(request) {
+        // Skip if configured
+        if (skip && skip(request)) {
+            return {
+                allowed: true,
+                remaining: config.max,
+                resetAt: new Date(Date.now() + config.windowMs),
+                total: config.max,
+            };
+        }
+        const key = keyGenerator(request);
+        const now = Date.now();
+        const windowStart = now - config.windowMs;
+        let entry = store.get(key);
+        if (!entry || now - entry.windowStart >= config.windowMs) {
+            // New window
+            entry = { timestamps: [now], windowStart: now };
+            store.set(key, entry);
+        }
+        else {
+            // Existing window — remove expired timestamps
+            const validTimestamps = entry.timestamps.filter((t) => t > windowStart);
+            validTimestamps.push(now);
+            entry = { timestamps: validTimestamps, windowStart: entry.windowStart };
+            store.set(key, entry);
+        }
+        const remaining = Math.max(0, config.max - entry.timestamps.length);
+        const allowed = entry.timestamps.length <= config.max;
+        return {
+            allowed,
+            remaining,
+            resetAt: new Date(entry.windowStart + config.windowMs),
+            total: config.max,
+        };
+    }
+    /**
+     * Middleware-like function that checks and optionally handles rate limiting.
+     */
+    function middleware(request, response) {
+        const result = check(request);
+        if (!result.allowed && response && handler) {
+            handler(request, response);
+        }
+        return result;
+    }
+    /**
+     * Resets the rate limit for a specific key.
+     */
+    function reset(key) {
+        store.delete(key);
+    }
+    /**
+     * Clears all rate limit data.
+     */
+    function clear() {
+        store.clear();
+    }
+    /**
+     * Gets the current count for a key.
+     */
+    function getCount(key) {
+        const entry = store.get(key);
+        if (!entry)
+            return 0;
+        const now = Date.now();
+        const windowStart = now - config.windowMs;
+        return entry.timestamps.filter((t) => t > windowStart).length;
+    }
+    /**
+     * Destroys the rate limiter and cleans up resources.
+     */
+    function destroy() {
+        clearInterval(cleanupInterval);
+        store.clear();
+    }
+    return {
+        check,
+        middleware,
+        reset,
+        clear,
+        getCount,
+        destroy,
+    };
+}
+/**
+ * Extracts the client IP from request headers.
+ * Used as a default key generator.
+ *
+ * @param headers - Request headers.
+ * @returns The client IP address.
+ */
+export function extractClientIp(headers) {
+    // X-Forwarded-For (first entry)
+    const forwarded = headers["x-forwarded-for"];
+    if (typeof forwarded === "string") {
+        const first = forwarded.split(",")[0]?.trim();
+        if (first)
+            return first;
+    }
+    if (Array.isArray(forwarded) && forwarded.length > 0) {
+        const first = forwarded[0]?.split(",")[0]?.trim();
+        if (first)
+            return first;
+    }
+    // X-Real-IP
+    const realIp = headers["x-real-ip"];
+    if (typeof realIp === "string")
+        return realIp;
+    return "unknown";
+}
+//# sourceMappingURL=rateLimit.core.js.map

package/dist/rateLimit/rateLimit.core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimit.core.js","sourceRoot":"","sources":["../../src/rateLimit/rateLimit.core.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,mDAAmD;AACnD,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB,gCAAgC;AAChC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC,kCAAkC;AAClC,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAW5C;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAyB;IAC3D,OAAO,OAAO,CAAC,EAAE,IAAI,SAAS,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,QAA0B,EAC1B,QAIC;IAED,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,OAAO,CAAC,uBAAuB,CAAC,GAAG,GAAG,CAAC;IAChD,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,KAAK,EAAE;YACL,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,eAAe;SACzB;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAuB;IACvD,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAChD,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,mBAAmB,CAAC;IAChE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAEzB,mCAAmC;IACnC,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;YACjC,IAAI,GAAG,GAAG,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;gBAClD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;IACH,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEpB,0CAA0C;IAC1C,IAAI,eAAe,CAAC,KAAK,EAAE,CAAC;QAC1B,eAAe,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,SAAS,KAAK,CAAC,OAAyB;QACtC,qBAAqB;QACrB,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,MAAM,CAAC,GAAG;gBACrB,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;gBAC/C,KAAK,EAAE,MAAM,CAAC,GAAG;aAClB,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC;QAE1C,IAAI,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAE3B,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzD,aAAa;YACb,KAAK,GAAG,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;YAChD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,8CAA8C;YAC9C,MAAM,eAAe,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC;YACxE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1B,KAAK,GAAG,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;YACxE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxB,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC;QAEtD,OAAO;YACL,OAAO;YACP,SAAS;YACT,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC;YACtD,KAAK,EAAE,MAAM,CAAC,GAAG;SAClB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,SAAS,UAAU,CACjB,OAAyB,EACzB,QAIC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QAE9B,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,QAAQ,IAAI,OAAO,EAAE,CAAC;YAC3C,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC7B,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,SAAS,KAAK,CAAC,GAAW;QACxB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,SAAS,KAAK;QACZ,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,SAAS,QAAQ,CAAC,GAAW;QAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,CAAC;QAErB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC1C,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,MAAM,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,SAAS,OAAO;QACd,aAAa,CAAC,eAAe,CAAC,CAAC;QAC/B,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAED,OAAO;QACL,KAAK;QACL,UAAU;QACV,KAAK;QACL,KAAK;QACL,QAAQ;QACR,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAsD;IAEtD,gCAAgC;IAChC,MAAM,SAAS,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC7C,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAC9C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAClD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IAED,YAAY;IACZ,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACpC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAE9C,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/rateLimit/rateLimit.namespace.d.ts

@@ -0,0 +1,13 @@
+/**
+ * @zudojs/security — Rate Limit Namespace
+ *
+ * Convenience namespace for rate limiting utilities.
+ */
+import { defaultKeyGenerator, defaultHandler, createRateLimiter, extractClientIp } from "./rateLimit.core.js";
+export declare const rateLimit: {
+    defaultKeyGenerator: typeof defaultKeyGenerator;
+    defaultHandler: typeof defaultHandler;
+    createRateLimiter: typeof createRateLimiter;
+    extractClientIp: typeof extractClientIp;
+};
+//# sourceMappingURL=rateLimit.namespace.d.ts.map

package/dist/rateLimit/rateLimit.namespace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimit.namespace.d.ts","sourceRoot":"","sources":["../../src/rateLimit/rateLimit.namespace.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EACjB,eAAe,EAChB,MAAM,qBAAqB,CAAC;AAE7B,eAAO,MAAM,SAAS;;;;;CAKrB,CAAC"}

package/dist/rateLimit/rateLimit.namespace.js

@@ -0,0 +1,13 @@
+/**
+ * @zudojs/security — Rate Limit Namespace
+ *
+ * Convenience namespace for rate limiting utilities.
+ */
+import { defaultKeyGenerator, defaultHandler, createRateLimiter, extractClientIp, } from "./rateLimit.core.js";
+export const rateLimit = {
+    defaultKeyGenerator,
+    defaultHandler,
+    createRateLimiter,
+    extractClientIp,
+};
+//# sourceMappingURL=rateLimit.namespace.js.map

package/dist/rateLimit/rateLimit.namespace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimit.namespace.js","sourceRoot":"","sources":["../../src/rateLimit/rateLimit.namespace.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EACjB,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,mBAAmB;IACnB,cAAc;IACd,iBAAiB;IACjB,eAAe;CAChB,CAAC"}

package/dist/types/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @zudojs/security — Types Barrel
+ *
+ * Re-exports all security configuration and result types.
+ */
+export type { HeaderSecurityConfig, HeaderValidationResult, BodyLimitConfig, BodyLimitPresets, UrlValidationConfig, UrlValidationResult, CookieSecurityConfig, ParsedCookie, CorsConfig, CsrfConfig, RateLimitConfig, RateLimitRequest, RateLimitResponse, RateLimitResult, SecurityHeadersConfig, RequestValidationConfig, InputSanitizationConfig, } from "./security.type.js";
+export { PROTOTYPE_POLLUTION_KEYS, SQL_INJECTION_PATTERNS, XSS_PATTERNS, } from "./security.type.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,YAAY,EACV,oBAAoB,EACpB,sBAAsB,EACtB,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,YAAY,GACb,MAAM,oBAAoB,CAAC"}

package/dist/types/index.js

@@ -0,0 +1,7 @@
+/**
+ * @zudojs/security — Types Barrel
+ *
+ * Re-exports all security configuration and result types.
+ */
+export { PROTOTYPE_POLLUTION_KEYS, SQL_INJECTION_PATTERNS, XSS_PATTERNS, } from "./security.type.js";
+//# sourceMappingURL=index.js.map

package/dist/types/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAsBH,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,YAAY,GACb,MAAM,oBAAoB,CAAC"}

package/dist/types/security.type.d.ts

@@ -0,0 +1,203 @@
+/**
+ * @zudojs/security — Core Types
+ *
+ * Security configuration interfaces and type definitions.
+ */
+/** Configuration for header security validation. */
+export interface HeaderSecurityConfig {
+    /** Maximum size of a single header value in bytes. */
+    readonly maxValueSize?: number;
+    /** Maximum number of headers allowed. */
+    readonly maxHeaders?: number;
+    /** Maximum total size of all headers in bytes. */
+    readonly maxTotalSize?: number;
+    /** Headers that should be rejected entirely. */
+    readonly blockedHeaders?: readonly string[];
+}
+/** Result of header validation. */
+export interface HeaderValidationResult {
+    readonly valid: boolean;
+    readonly errors: readonly string[];
+}
+/** Configuration for body size limits. */
+export interface BodyLimitConfig {
+    /** Maximum body size in bytes. */
+    readonly maxSize: number;
+    /** Content types that use this limit (if empty, applies to all). */
+    readonly contentTypes?: readonly string[];
+}
+/** Preset body limits for common use cases. */
+export interface BodyLimitPresets {
+    /** JSON API body limit (default: 1MB). */
+    readonly json: number;
+    /** Authentication endpoint limit (default: 256KB). */
+    readonly auth: number;
+    /** File upload limit (default: 100MB). */
+    readonly upload: number;
+    /** Webhook payload limit (default: 2MB). */
+    readonly webhook: number;
+}
+/** Configuration for URL validation. */
+export interface UrlValidationConfig {
+    /** Allowed protocols (default: ["http", "https"]). */
+    readonly allowedProtocols?: readonly string[];
+    /** Maximum URL length in characters. */
+    readonly maxLength?: number;
+    /** Whether to normalize paths (resolve . and ..). */
+    readonly normalizePaths?: boolean;
+    /** Whether to block path traversal attempts. */
+    readonly blockTraversal?: boolean;
+}
+/** Result of URL validation. */
+export interface UrlValidationResult {
+    readonly valid: boolean;
+    readonly normalized?: string;
+    readonly errors: readonly string[];
+}
+/** Configuration for cookie security. */
+export interface CookieSecurityConfig {
+    /** Whether to set Secure flag by default. */
+    readonly secure?: boolean;
+    /** Whether to set HttpOnly flag by default. */
+    readonly httpOnly?: boolean;
+    /** Default SameSite policy. */
+    readonly sameSite?: "strict" | "lax" | "none";
+    /** Maximum cookie size in bytes. */
+    readonly maxSize?: number;
+    /** Maximum number of cookies. */
+    readonly maxCount?: number;
+}
+/** A parsed cookie with security metadata. */
+export interface ParsedCookie {
+    readonly name: string;
+    readonly value: string;
+    readonly secure?: boolean;
+    readonly httpOnly?: boolean;
+    readonly sameSite?: "strict" | "lax" | "none";
+    readonly path?: string;
+    readonly domain?: string;
+    readonly maxAge?: number;
+    readonly expires?: Date;
+    readonly partitioned?: boolean;
+}
+/** Configuration for CORS. */
+export interface CorsConfig {
+    /** Allowed origins (strings or regex patterns). */
+    readonly origin?: string | readonly string[] | RegExp | ((origin: string) => boolean);
+    /** Allowed HTTP methods. */
+    readonly methods?: readonly string[];
+    /** Allowed request headers. */
+    readonly allowedHeaders?: readonly string[];
+    /** Headers exposed to the browser. */
+    readonly exposedHeaders?: readonly string[];
+    /** Whether to include credentials. */
+    readonly credentials?: boolean;
+    /** Max age for preflight cache in seconds. */
+    readonly maxAge?: number;
+}
+/** Configuration for CSRF protection. */
+export interface CsrfConfig {
+    /** Secret key for token generation. */
+    readonly secret: string;
+    /** Token expiration in seconds. */
+    readonly expiration?: number;
+    /** Cookie name for the CSRF token. */
+    readonly cookieName?: string;
+    /** Header name for the CSRF token. */
+    readonly headerName?: string;
+    /** Methods that require CSRF protection. */
+    readonly methods?: readonly string[];
+}
+/** Configuration for rate limiting. */
+export interface RateLimitConfig {
+    /** Maximum requests per window. */
+    readonly max: number;
+    /** Window duration in milliseconds. */
+    readonly windowMs: number;
+    /** Key generator function (defaults to IP). */
+    readonly keyGenerator?: (request: RateLimitRequest) => string;
+    /** Custom handler when rate limit is exceeded. */
+    readonly handler?: (request: RateLimitRequest, response: RateLimitResponse) => void;
+    /** Skip certain requests. */
+    readonly skip?: (request: RateLimitRequest) => boolean;
+    /** Message returned when rate limited. */
+    readonly message?: string;
+}
+/** Request info for rate limiting. */
+export interface RateLimitRequest {
+    readonly ip?: string;
+    readonly method?: string;
+    readonly path?: string;
+    readonly headers?: Record<string, string | string[] | undefined>;
+}
+/** Response info for rate limiting. */
+export interface RateLimitResponse {
+    statusCode: number;
+    headers: Record<string, string>;
+    body?: string;
+}
+/** Result of rate limit check. */
+export interface RateLimitResult {
+    readonly allowed: boolean;
+    readonly remaining: number;
+    readonly resetAt: Date;
+    readonly total: number;
+}
+/** Configuration for security headers. */
+export interface SecurityHeadersConfig {
+    /** Content-Security-Policy directive. */
+    readonly contentSecurityPolicy?: string;
+    /** X-Content-Type-Options value (default: "nosniff"). */
+    readonly contentTypeOptions?: string;
+    /** X-Frame-Options value (default: "DENY"). */
+    readonly frameOptions?: string;
+    /** X-XSS-Protection value (default: "1; mode=block"). */
+    readonly xssProtection?: string;
+    /** Strict-Transport-Security value. */
+    readonly hsts?: string;
+    /** Referrer-Policy value (default: "strict-origin-when-cross-origin"). */
+    readonly referrerPolicy?: string;
+    /** Permissions-Policy value. */
+    readonly permissionsPolicy?: string;
+    /** X-DNS-Prefetch-Control value. */
+    readonly dnsPrefetchControl?: string;
+    /** Cross-Origin-Opener-Policy value. */
+    readonly openerPolicy?: string;
+    /** Cross-Origin-Resource-Policy value. */
+    readonly resourcePolicy?: string;
+}
+/** Configuration for request validation. */
+export interface RequestValidationConfig {
+    /** Allowed HTTP methods. */
+    readonly allowedMethods?: readonly string[];
+    /** Maximum request line size in bytes. */
+    readonly maxRequestLineSize?: number;
+    /** Allowed hosts (empty = allow all). */
+    readonly allowedHosts?: readonly string[];
+    /** Whether to validate the Host header. */
+    readonly validateHost?: boolean;
+    /** Whether to validate Content-Length. */
+    readonly validateContentLength?: boolean;
+    /** Maximum Content-Length value. */
+    readonly maxContentLength?: number;
+}
+/** Configuration for input sanitization. */
+export interface InputSanitizationConfig {
+    /** Whether to strip null bytes. */
+    readonly stripNullBytes?: boolean;
+    /** Whether to normalize Unicode. */
+    readonly normalizeUnicode?: boolean;
+    /** Maximum string length. */
+    readonly maxStringLength?: number;
+    /** Whether to prevent prototype pollution. */
+    readonly preventPrototypePollution?: boolean;
+    /** Custom sanitizer function. */
+    readonly customSanitizer?: (value: string) => string;
+}
+/** Keys that indicate prototype pollution attempts. */
+export declare const PROTOTYPE_POLLUTION_KEYS: readonly ["__proto__", "constructor", "prototype"];
+/** Common SQL injection patterns. */
+export declare const SQL_INJECTION_PATTERNS: readonly [RegExp, RegExp, RegExp, RegExp];
+/** Common XSS patterns. */
+export declare const XSS_PATTERNS: readonly [RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp];
+//# sourceMappingURL=security.type.d.ts.map

package/dist/types/security.type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.type.d.ts","sourceRoot":"","sources":["../../src/types/security.type.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,oDAAoD;AACpD,MAAM,WAAW,oBAAoB;IACnC,sDAAsD;IACtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,yCAAyC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,kDAAkD;IAClD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,gDAAgD;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAED,mCAAmC;AACnC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAID,0CAA0C;AAC1C,MAAM,WAAW,eAAe;IAC9B,kCAAkC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED,+CAA+C;AAC/C,MAAM,WAAW,gBAAgB;IAC/B,0CAA0C;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sDAAsD;IACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4CAA4C;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAID,wCAAwC;AACxC,MAAM,WAAW,mBAAmB;IAClC,sDAAsD;IACtD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,wCAAwC;IACxC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,qDAAqD;IACrD,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,gDAAgD;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC;AAED,gCAAgC;AAChC,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAID,yCAAyC;AACzC,MAAM,WAAW,oBAAoB;IACnC,6CAA6C;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,+BAA+B;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC9C,oCAAoC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,iCAAiC;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,8CAA8C;AAC9C,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC9C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AAID,8BAA8B;AAC9B,MAAM,WAAW,UAAU;IACzB,mDAAmD;IACnD,QAAQ,CAAC,MAAM,CAAC,EACd,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC;IACtE,4BAA4B;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,+BAA+B;IAC/B,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,sCAAsC;IACtC,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,sCAAsC;IACtC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAID,yCAAyC;AACzC,MAAM,WAAW,UAAU;IACzB,uCAAuC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mCAAmC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,sCAAsC;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,sCAAsC;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,4CAA4C;IAC5C,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAID,uCAAuC;AACvC,MAAM,WAAW,eAAe;IAC9B,mCAAmC;IACnC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,MAAM,CAAC;IAC9D,kDAAkD;IAClD,QAAQ,CAAC,OAAO,CAAC,EAAE,CACjB,OAAO,EAAE,gBAAgB,EACzB,QAAQ,EAAE,iBAAiB,KACxB,IAAI,CAAC;IACV,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC;IACvD,0CAA0C;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,sCAAsC;AACtC,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;CAClE;AAED,uCAAuC;AACvC,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,kCAAkC;AAClC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAID,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,yCAAyC;IACzC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,yDAAyD;IACzD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,yDAAyD;IACzD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,uCAAuC;IACvC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,gCAAgC;IAChC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,oCAAoC;IACpC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,wCAAwC;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,0CAA0C;IAC1C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAID,4CAA4C;AAC5C,MAAM,WAAW,uBAAuB;IACtC,4BAA4B;IAC5B,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,0CAA0C;IAC1C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,yCAAyC;IACzC,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,2CAA2C;IAC3C,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,0CAA0C;IAC1C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IACzC,oCAAoC;IACpC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAID,4CAA4C;AAC5C,MAAM,WAAW,uBAAuB;IACtC,mCAAmC;IACnC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,oCAAoC;IACpC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,6BAA6B;IAC7B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,8CAA8C;IAC9C,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAC;IAC7C,iCAAiC;IACjC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;CACtD;AAED,uDAAuD;AACvD,eAAO,MAAM,wBAAwB,YACnC,WAAW,EACX,aAAa,EACb,WAAW,CACH,CAAC;AAEX,qCAAqC;AACrC,eAAO,MAAM,sBAAsB,2CAKzB,CAAC;AAEX,2BAA2B;AAC3B,eAAO,MAAM,YAAY,mFAUf,CAAC"}

package/dist/types/security.type.js

@@ -0,0 +1,31 @@
+/**
+ * @zudojs/security — Core Types
+ *
+ * Security configuration interfaces and type definitions.
+ */
+/** Keys that indicate prototype pollution attempts. */
+export const PROTOTYPE_POLLUTION_KEYS = [
+    "__proto__",
+    "constructor",
+    "prototype",
+];
+/** Common SQL injection patterns. */
+export const SQL_INJECTION_PATTERNS = [
+    /(\b(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|EXEC|EXECUTE|UNION|FETCH|DECLARE|TRUNCATE|COMMENT|ALTER)\b)/i,
+    /(--|#|\/\*|\*\/)/,
+    /('\s*(OR|AND)\s*')/i,
+    /(;\s*(DROP|DELETE|INSERT|UPDATE))/i,
+];
+/** Common XSS patterns. */
+export const XSS_PATTERNS = [
+    /<script\b[^>]*>[\s\S]*?<\/script[^>]*>/gi,
+    /<script\b[^>]*>/gi,
+    /<\/script[^>]*>/gi,
+    /javascript:/gi,
+    /on\w+\s*=/gi,
+    /data:text\/html/gi,
+    /<iframe\b[^>]*>/gi,
+    /<object\b[^>]*>/gi,
+    /<embed\b[^>]*>/gi,
+];
+//# sourceMappingURL=security.type.js.map

package/dist/types/security.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.type.js","sourceRoot":"","sources":["../../src/types/security.type.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA0OH,uDAAuD;AACvD,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,WAAW;IACX,aAAa;IACb,WAAW;CACH,CAAC;AAEX,qCAAqC;AACrC,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,gHAAgH;IAChH,kBAAkB;IAClB,qBAAqB;IACrB,oCAAoC;CAC5B,CAAC;AAEX,2BAA2B;AAC3B,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,0CAA0C;IAC1C,mBAAmB;IACnB,mBAAmB;IACnB,eAAe;IACf,aAAa;IACb,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;IACnB,kBAAkB;CACV,CAAC"}

package/dist/url/index.d.ts

@@ -0,0 +1,5 @@
+/**
+ * @zudojs/security — URL Validation Barrel
+ */
+export { validateUrl, normalizePath, validateRequestTarget, isSafeUrl, } from "./url.core.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/url/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/url/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,SAAS,GACV,MAAM,eAAe,CAAC"}

package/dist/url/index.js

@@ -0,0 +1,5 @@
+/**
+ * @zudojs/security — URL Validation Barrel
+ */
+export { validateUrl, normalizePath, validateRequestTarget, isSafeUrl, } from "./url.core.js";
+//# sourceMappingURL=index.js.map

package/dist/url/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/url/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,SAAS,GACV,MAAM,eAAe,CAAC"}

package/dist/url/url.core.d.ts

@@ -0,0 +1,38 @@
+/**
+ * @zudojs/security — URL Validation
+ *
+ * Validates and normalizes URLs, prevents path traversal attacks,
+ * and ensures request targets are safe.
+ */
+import type { UrlValidationConfig, UrlValidationResult } from "../types/security.type.js";
+/**
+ * Validates a URL against security configuration.
+ *
+ * @param url - The URL string to validate.
+ * @param config - Optional validation configuration.
+ * @returns Validation result.
+ */
+export declare function validateUrl(url: string, config?: UrlValidationConfig): UrlValidationResult;
+/**
+ * Normalizes a URL path by resolving . and .. segments.
+ *
+ * @param pathname - The path to normalize.
+ * @returns The normalized path.
+ */
+export declare function normalizePath(pathname: string): string;
+/**
+ * Validates a request target (URI path + query).
+ *
+ * @param target - The request target (e.g., "/users?page=1").
+ * @param config - Optional validation configuration.
+ * @returns Validation result.
+ */
+export declare function validateRequestTarget(target: string, config?: UrlValidationConfig): UrlValidationResult;
+/**
+ * Checks if a URL is safe to follow (not pointing to internal resources).
+ *
+ * @param url - The URL to check.
+ * @returns True if the URL appears safe.
+ */
+export declare function isSafeUrl(url: string): boolean;
+//# sourceMappingURL=url.core.d.ts.map

package/dist/url/url.core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.core.d.ts","sourceRoot":"","sources":["../../src/url/url.core.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,2BAA2B,CAAC;AAiCnC;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,mBAAmB,GAC3B,mBAAmB,CAwDrB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAmBtD;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,mBAAmB,GAC3B,mBAAmB,CA0CrB;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CA0B9C"}