@zudojs/security 1.3.3 → 1.3.4

package/README.md

@@ -61,7 +61,10 @@ function handle(request, response) {
 A genuine sliding window: each check prunes entries older than `windowMs` and
 decides against what remains, so a client cannot spend a full allowance either
 side of a fixed boundary. Only allowed requests consume an allowance slot, so a
-client being limited cannot grow its own bucket.
+client being limited cannot grow its own bucket. Expiry is a binary search over
+an ordered hit log with amortised compaction, so a check costs O(log `max`)
+rather than O(`max`): a limiter with `max: 1_000_000` is as cheap per request
+as one with `max: 300`.
 
 ```typescript
 const limiter = createRateLimiter({

package/dist/body/body.core.d.ts

@@ -102,4 +102,3 @@ export declare function createBodySizeChecker(maxSize: number, contentType?: str
     allowed: boolean;
     error?: string;
 };
-//# sourceMappingURL=body.core.d.ts.map

package/dist/body/body.core.js

@@ -268,4 +268,3 @@ export function createBodySizeChecker(maxSize, contentType) {
         };
     };
 }
-//# sourceMappingURL=body.core.js.map

package/dist/body/body.guard.d.ts

@@ -16,4 +16,3 @@ export declare function isUsableBodyLimit(value: unknown): value is number;
  *   negative or not a number.
  */
 export declare function assertBodyLimit(value: unknown, name?: string): asserts value is number;
-//# sourceMappingURL=body.guard.d.ts.map

package/dist/body/body.guard.js

@@ -23,4 +23,3 @@ export function assertBodyLimit(value, name = "maxSize") {
         throw new ConfigurationError(`Body limit ${name} must be a finite number of bytes above 0, got: ${String(value)}`);
     }
 }
-//# sourceMappingURL=body.guard.js.map

package/dist/body/index.d.ts

@@ -2,4 +2,3 @@
  * @zudojs/security — Body Validation Barrel
  */
 export { DEFAULT_BODY_LIMITS, parseMediaType, validateBodyFraming, validateContentLength, validateBodySize, getBodyLimitForContentType, validateBodyLimitConfig, resolveBodyLimit, createBodySizeChecker, } from "./body.core.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/body/index.js

@@ -2,4 +2,3 @@
  * @zudojs/security — Body Validation Barrel
  */
 export { DEFAULT_BODY_LIMITS, parseMediaType, validateBodyFraming, validateContentLength, validateBodySize, getBodyLimitForContentType, validateBodyLimitConfig, resolveBodyLimit, createBodySizeChecker, } from "./body.core.js";
-//# sourceMappingURL=index.js.map

package/dist/cookie/cookie.attribute.d.ts

@@ -25,4 +25,3 @@ export declare function assertCookieDomain(domain: string): void;
  *   `;` or `,`. Space is allowed, as RFC 6265 allows it.
  */
 export declare function assertCookiePath(path: string): void;
-//# sourceMappingURL=cookie.attribute.d.ts.map

package/dist/cookie/cookie.attribute.js

@@ -60,4 +60,3 @@ export function assertCookiePath(path) {
             `and "," are not, got ${JSON.stringify(path)}`);
     }
 }
-//# sourceMappingURL=cookie.attribute.js.map

package/dist/cookie/cookie.core.d.ts

@@ -71,4 +71,3 @@ export declare function validateCookieValue(value: string): string | undefined;
  * @returns The cleaned cookie header.
  */
 export declare function stripSensitiveCookies(cookieHeader: string, sensitiveNames?: readonly string[]): string;
-//# sourceMappingURL=cookie.core.d.ts.map

package/dist/cookie/cookie.core.js

@@ -245,4 +245,3 @@ export function stripSensitiveCookies(cookieHeader, sensitiveNames = DEFAULT_SEN
     })
         .join("; ");
 }
-//# sourceMappingURL=cookie.core.js.map

package/dist/cookie/cookie.sensitive.d.ts

@@ -24,4 +24,3 @@ export declare function cookieNameWords(name: string): string[];
  * `__Host-session`. Word boundaries keep `theme` or `sidebar` from matching.
  */
 export declare function isSensitiveCookieName(name: string, sensitiveNames?: readonly string[]): boolean;
-//# sourceMappingURL=cookie.sensitive.d.ts.map

package/dist/cookie/cookie.sensitive.js

@@ -58,4 +58,3 @@ export function isSensitiveCookieName(name, sensitiveNames = DEFAULT_SENSITIVE_C
         return false;
     });
 }
-//# sourceMappingURL=cookie.sensitive.js.map

package/dist/cookie/index.d.ts

@@ -3,4 +3,3 @@
  */
 export { parseCookieHeader, serializeCookie, createSecureCookie, validateCookieName, validateCookieValue, stripSensitiveCookies, } from "./cookie.core.js";
 export { DEFAULT_SENSITIVE_COOKIE_NAMES, isSensitiveCookieName, } from "./cookie.sensitive.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/cookie/index.js

@@ -3,4 +3,3 @@
  */
 export { parseCookieHeader, serializeCookie, createSecureCookie, validateCookieName, validateCookieValue, stripSensitiveCookies, } from "./cookie.core.js";
 export { DEFAULT_SENSITIVE_COOKIE_NAMES, isSensitiveCookieName, } from "./cookie.sensitive.js";
-//# sourceMappingURL=index.js.map

package/dist/cors/cors.core.d.ts

@@ -62,4 +62,3 @@ export declare function isMethodAllowed(method: string, config: CorsConfig): boo
  * @returns An array of disallowed headers, or empty array if all allowed.
  */
 export declare function getDisallowedHeaders(headers: string[], config: CorsConfig): string[];
-//# sourceMappingURL=cors.core.d.ts.map

package/dist/cors/cors.core.js

@@ -186,4 +186,3 @@ export function getDisallowedHeaders(headers, config) {
     const allowedHeaders = new Set((config.allowedHeaders ?? DEFAULT_CORS_CONFIG.allowedHeaders).map((h) => h.toLowerCase()));
     return headers.filter((h) => !allowedHeaders.has(h.trim().toLowerCase()));
 }
-//# sourceMappingURL=cors.core.js.map

package/dist/cors/cors.namespace.d.ts

@@ -12,4 +12,3 @@ export declare const cors: {
     isMethodAllowed: typeof isMethodAllowed;
     getDisallowedHeaders: typeof getDisallowedHeaders;
 };
-//# sourceMappingURL=cors.namespace.d.ts.map

package/dist/cors/cors.namespace.js

@@ -11,4 +11,3 @@ export const cors = {
     isMethodAllowed,
     getDisallowedHeaders,
 };
-//# sourceMappingURL=cors.namespace.js.map

package/dist/cors/index.d.ts

@@ -3,4 +3,3 @@
  */
 export type { CorsHeaders } from "./cors.core.js";
 export { isOriginAllowed, generatePreflightHeaders, generateSimpleHeaders, isMethodAllowed, getDisallowedHeaders, } from "./cors.core.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/cors/index.js

@@ -2,4 +2,3 @@
  * @zudojs/security — CORS Barrel
  */
 export { isOriginAllowed, generatePreflightHeaders, generateSimpleHeaders, isMethodAllowed, getDisallowedHeaders, } from "./cors.core.js";
-//# sourceMappingURL=index.js.map

package/dist/csrf/csrf.core.d.ts

@@ -230,4 +230,3 @@ export interface CsrfProtection {
  * @throws {ValidationError} when `path` breaks the cookie `Path` rules.
  */
 export declare function createCsrfProtection(config: CsrfProtectionOptions): CsrfProtection;
-//# sourceMappingURL=csrf.core.d.ts.map

package/dist/csrf/csrf.core.js

@@ -405,4 +405,3 @@ export function createCsrfProtection(config) {
         },
     };
 }
-//# sourceMappingURL=csrf.core.js.map

package/dist/csrf/index.d.ts

@@ -3,4 +3,3 @@
  */
 export { generateCsrfToken, validateCsrfToken, verifyDoubleSubmit, requiresCsrfProtection, extractCsrfTokenFromHeaders, extractCsrfTokenFromCookies, generateCsrfCookie, createCsrfProtection, MIN_CSRF_SECRET_LENGTH, } from "./csrf.core.js";
 export type { CsrfTokenOptions, CsrfCookieOptions, CsrfProtection, CsrfProtectionOptions, IssuedCsrfToken, CsrfVerifiableRequest, } from "./csrf.core.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/csrf/index.js

@@ -2,4 +2,3 @@
  * @zudojs/security — CSRF Protection Barrel
  */
 export { generateCsrfToken, validateCsrfToken, verifyDoubleSubmit, requiresCsrfProtection, extractCsrfTokenFromHeaders, extractCsrfTokenFromCookies, generateCsrfCookie, createCsrfProtection, MIN_CSRF_SECRET_LENGTH, } from "./csrf.core.js";
-//# sourceMappingURL=index.js.map

package/dist/header/header.core.d.ts

@@ -44,4 +44,3 @@ export declare function sanitizeHeaderValue(value: string): string | undefined;
  * @returns True if the header is hop-by-hop.
  */
 export declare function isHopByHopHeader(name: string): boolean;
-//# sourceMappingURL=header.core.d.ts.map

package/dist/header/header.core.js

@@ -168,4 +168,3 @@ export function isHopByHopHeader(name) {
     ]);
     return hopByHop.has(name.toLowerCase());
 }
-//# sourceMappingURL=header.core.js.map

package/dist/header/index.d.ts

@@ -2,4 +2,3 @@
  * @zudojs/security — Header Security Barrel
  */
 export { validateHeaderName, validateHeaderValue, validateHeaders, sanitizeHeaderValue, isHopByHopHeader, } from "./header.core.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/header/index.js

@@ -2,4 +2,3 @@
  * @zudojs/security — Header Security Barrel
  */
 export { validateHeaderName, validateHeaderValue, validateHeaders, sanitizeHeaderValue, isHopByHopHeader, } from "./header.core.js";
-//# sourceMappingURL=index.js.map

package/dist/headers/headers.core.d.ts

@@ -45,4 +45,3 @@ export declare function generateCspNonce(nonceLength?: number): string;
  * @returns An error message if invalid, or undefined.
  */
 export declare function validateCspDirective(directive: string): string | undefined;
-//# sourceMappingURL=headers.core.d.ts.map

package/dist/headers/headers.core.js

@@ -154,4 +154,3 @@ export function validateCspDirective(directive) {
     // silent while `unsafe-eval` and `unsafe-hashes` were still in place.
     return warnings.length > 0 ? warnings.join("; ") : undefined;
 }
-//# sourceMappingURL=headers.core.js.map

package/dist/headers/index.d.ts

@@ -3,4 +3,3 @@
  */
 export { SECURITY_HEADER_NAMES } from "./headers.core.js";
 export { generateSecurityHeaders, getMissingSecurityHeaders, generateCspNonce, validateCspDirective, } from "./headers.core.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/headers/index.js

@@ -3,4 +3,3 @@
  */
 export { SECURITY_HEADER_NAMES } from "./headers.core.js";
 export { generateSecurityHeaders, getMissingSecurityHeaders, generateCspNonce, validateCspDirective, } from "./headers.core.js";
-//# sourceMappingURL=index.js.map

package/dist/index.d.ts

@@ -46,4 +46,3 @@ export { rateLimit } from "./rateLimit/rateLimit.namespace.js";
 export { SECURITY_HEADER_NAMES } from "./headers/index.js";
 export { generateSecurityHeaders, getMissingSecurityHeaders, generateCspNonce, validateCspDirective, } from "./headers/index.js";
 export { containsSqlInjection, containsXss, containsPrototypePollution, sanitizeString, sanitizeObject, isSafeString, withoutStickyFlags, detectThreats, escapeHtml, stripHtml, findUnsafeKey, } from "./input/index.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -49,4 +49,3 @@ export { SECURITY_HEADER_NAMES } from "./headers/index.js";
 export { generateSecurityHeaders, getMissingSecurityHeaders, generateCspNonce, validateCspDirective, } from "./headers/index.js";
 /* ─── Input Sanitization ─────────────────────────────────────────────────── */
 export { containsSqlInjection, containsXss, containsPrototypePollution, sanitizeString, sanitizeObject, isSafeString, withoutStickyFlags, detectThreats, escapeHtml, stripHtml, findUnsafeKey, } from "./input/index.js";
-//# sourceMappingURL=index.js.map

package/dist/input/index.d.ts

@@ -3,4 +3,3 @@
  */
 export { containsSqlInjection, containsXss, containsPrototypePollution, sanitizeString, sanitizeObject, isSafeString, withoutStickyFlags, detectThreats, escapeHtml, stripHtml, } from "./input.core.js";
 export { findUnsafeKey } from "./input.unsafeKey.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/input/index.js

@@ -3,4 +3,3 @@
  */
 export { containsSqlInjection, containsXss, containsPrototypePollution, sanitizeString, sanitizeObject, isSafeString, withoutStickyFlags, detectThreats, escapeHtml, stripHtml, } from "./input.core.js";
 export { findUnsafeKey } from "./input.unsafeKey.js";
-//# sourceMappingURL=index.js.map

package/dist/input/input.core.d.ts

@@ -99,4 +99,3 @@ export declare function escapeHtml(input: string): string;
  * @returns The string with HTML tags removed.
  */
 export declare function stripHtml(input: string): string;
-//# sourceMappingURL=input.core.d.ts.map

package/dist/input/input.core.js

@@ -300,4 +300,3 @@ export function stripHtml(input) {
     }
     return result;
 }
-//# sourceMappingURL=input.core.js.map

package/dist/input/input.decode.d.ts

@@ -22,4 +22,3 @@ export declare function decodeHtmlEntities(input: string): string;
  * @param decoded - Text that has already been entity-decoded.
  */
 export declare function containsObfuscatedScheme(decoded: string): boolean;
-//# sourceMappingURL=input.decode.d.ts.map

package/dist/input/input.decode.js

@@ -69,4 +69,3 @@ export function containsObfuscatedScheme(decoded) {
     const compact = decoded.replace(/[\u0000- \u007f- ]+/g, "");
     return /(?:javascript|vbscript|livescript):|data:text\/html/i.test(compact);
 }
-//# sourceMappingURL=input.decode.js.map

package/dist/input/input.unsafeKey.d.ts

@@ -16,4 +16,3 @@
  * and cycle-safe, so it is safe on any decoded or in-process value.
  */
 export declare function findUnsafeKey(value: unknown): string | undefined;
-//# sourceMappingURL=input.unsafeKey.d.ts.map

package/dist/input/input.unsafeKey.js

@@ -58,4 +58,3 @@ export function findUnsafeKey(value) {
     }
     return undefined;
 }
-//# sourceMappingURL=input.unsafeKey.js.map

package/dist/rateLimit/index.d.ts

@@ -10,4 +10,3 @@ export { extractClientIp } from "./rateLimit.clientIp.js";
 export type { ClientIpOptions } from "./rateLimit.clientIp.js";
 export { createIpKeyGenerator, ipRateLimitKey, parseClientIp, DEFAULT_IPV6_PREFIX_LENGTH, } from "./rateLimit.clientKey.js";
 export type { IpKeyOptions } from "./rateLimit.clientKey.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/rateLimit/index.js

@@ -7,4 +7,3 @@
 export { defaultKeyGenerator, defaultHandler, retryAfterSeconds, createRateLimiter, } from "./rateLimit.core.js";
 export { extractClientIp } from "./rateLimit.clientIp.js";
 export { createIpKeyGenerator, ipRateLimitKey, parseClientIp, DEFAULT_IPV6_PREFIX_LENGTH, } from "./rateLimit.clientKey.js";
-//# sourceMappingURL=index.js.map

package/dist/rateLimit/rateLimit.clientIp.d.ts

@@ -37,4 +37,3 @@ export interface ClientIpOptions {
  *   rate-limit key generator refuses `"unknown"`; pass `remoteAddress`.
  */
 export declare function extractClientIp(headers: Record<string, string | string[] | undefined>, options?: ClientIpOptions): string;
-//# sourceMappingURL=rateLimit.clientIp.d.ts.map

package/dist/rateLimit/rateLimit.clientIp.js

@@ -68,4 +68,3 @@ function lookupHeader(headers, name) {
     }
     return undefined;
 }
-//# sourceMappingURL=rateLimit.clientIp.js.map

package/dist/rateLimit/rateLimit.clientKey.d.ts

@@ -48,4 +48,3 @@ export declare function ipRateLimitKey(value: string, options?: IpKeyOptions): s
  * @throws {RangeError} when `ipv6PrefixLength` is not an integer in 1–128.
  */
 export declare function createIpKeyGenerator(options?: IpKeyOptions): (request: RateLimitRequest) => string;
-//# sourceMappingURL=rateLimit.clientKey.d.ts.map

package/dist/rateLimit/rateLimit.clientKey.js

@@ -101,4 +101,3 @@ export function createIpKeyGenerator(options) {
         return key;
     };
 }
-//# sourceMappingURL=rateLimit.clientKey.js.map

package/dist/rateLimit/rateLimit.core.d.ts

@@ -54,6 +54,8 @@ export interface RateLimiterOptions extends RateLimitConfig {
  * The window genuinely slides: each check prunes timestamps older than
  * `windowMs` and decides against what remains, so a client cannot spend a full
  * allowance either side of a fixed boundary and get `2 × max` back to back.
+ * Pruning is a binary search over an ordered log (see `rateLimit.window.ts`),
+ * so the cost of a check is O(log max), not O(max).
  *
  * @param config - Rate limit configuration.
  * @returns A function that checks rate limits.
@@ -68,4 +70,3 @@ export declare function createRateLimiter(config: RateLimiterOptions): {
     /** Number of keys currently tracked. */
     readonly size: number;
 };
-//# sourceMappingURL=rateLimit.core.d.ts.map

package/dist/rateLimit/rateLimit.core.js

@@ -4,6 +4,7 @@
  * Implements sliding window rate limiting to prevent abuse.
  */
 import { createIpKeyGenerator, ipRateLimitKey } from "./rateLimit.clientKey.js";
+import { createSlidingWindow, pruneWindow, recordHit, windowCount, windowOldest, } from "./rateLimit.window.js";
 /** Default window: 1 minute. */
 const DEFAULT_WINDOW_MS = 60_000;
 /** Default rate limit message. */
@@ -75,6 +76,8 @@ export function retryAfterSeconds(result, now = Date.now()) {
  * The window genuinely slides: each check prunes timestamps older than
  * `windowMs` and decides against what remains, so a client cannot spend a full
  * allowance either side of a fixed boundary and get `2 × max` back to back.
+ * Pruning is a binary search over an ordered log (see `rateLimit.window.ts`),
+ * so the cost of a check is O(log max), not O(max).
  *
  * @param config - Rate limit configuration.
  * @returns A function that checks rate limits.
@@ -155,7 +158,7 @@ export function createRateLimiter(config) {
         const windowStart = now - config.windowMs;
         let entry = store.get(key);
         if (!entry) {
-            entry = { timestamps: [], lastSeen: now };
+            entry = { window: createSlidingWindow(), lastSeen: now };
             store.set(key, entry);
             evictIfNeeded();
         }
@@ -165,19 +168,18 @@ export function createRateLimiter(config) {
             store.set(key, entry);
         }
         // Prune everything that has slid out of the window.
-        const timestamps = entry.timestamps.filter((t) => t > windowStart);
+        pruneWindow(entry.window, windowStart);
         entry.lastSeen = now;
-        const allowed = timestamps.length < config.max;
+        const allowed = windowCount(entry.window) < config.max;
         // Only an allowed request consumes an allowance slot. Recording denied
         // requests too would let a client already over the limit keep growing its
         // own bucket, so the cost of an attack would scale with the attack.
         if (allowed) {
-            timestamps.push(now);
+            recordHit(entry.window, now);
         }
-        entry.timestamps = timestamps;
-        const remaining = Math.max(0, config.max - timestamps.length);
+        const remaining = Math.max(0, config.max - windowCount(entry.window));
         // The window frees up when its oldest surviving request ages out.
-        const oldest = timestamps[0];
+        const oldest = windowOldest(entry.window);
         const resetAt = new Date((oldest ?? now) + config.windowMs);
         return {
             allowed,
@@ -215,8 +217,8 @@ export function createRateLimiter(config) {
         const entry = store.get(storeKey(key));
         if (!entry)
             return 0;
-        const windowStart = Date.now() - config.windowMs;
-        return entry.timestamps.filter((t) => t > windowStart).length;
+        pruneWindow(entry.window, Date.now() - config.windowMs);
+        return windowCount(entry.window);
     }
     /**
      * Destroys the rate limiter and cleans up resources.
@@ -238,4 +240,3 @@ export function createRateLimiter(config) {
         },
     };
 }
-//# sourceMappingURL=rateLimit.core.js.map

package/dist/rateLimit/rateLimit.namespace.d.ts

@@ -12,4 +12,3 @@ export declare const rateLimit: {
     createRateLimiter: typeof createRateLimiter;
     extractClientIp: typeof extractClientIp;
 };
-//# sourceMappingURL=rateLimit.namespace.d.ts.map

package/dist/rateLimit/rateLimit.namespace.js

@@ -12,4 +12,3 @@ export const rateLimit = {
     createRateLimiter,
     extractClientIp,
 };
-//# sourceMappingURL=rateLimit.namespace.js.map

package/dist/rateLimit/rateLimit.window.d.ts

@@ -0,0 +1,37 @@
+/**
+ * @zudojs/security — Sliding-window bookkeeping for the rate limiter.
+ *
+ * A key's allowed hits are kept in chronological order behind a head
+ * offset. Expiring old hits is a binary search that advances the head, and
+ * the array is compacted only once the dead prefix outgrows the live
+ * suffix, so every operation is O(log n) amortised. The previous
+ * `timestamps.filter(...)` copied the whole array on every check, which
+ * made the cost of one request proportional to `max`: a limiter with
+ * `max: 1e6` spent more than twenty percent of a core on a single busy
+ * client where `max: 300` spent three.
+ */
+/** Allowed hits inside a key's window, oldest first from `head`. */
+export interface SlidingWindow {
+    /** Monotonic hit timestamps; entries before `head` have expired. */
+    timestamps: number[];
+    /** Index of the oldest live hit. */
+    head: number;
+}
+/** Create an empty window. */
+export declare function createSlidingWindow(): SlidingWindow;
+/**
+ * Drop every hit at or before `windowStart`.
+ *
+ * Timestamps are appended in arrival order, so the live region is a suffix
+ * and its start can be found by binary search. Compaction copies the live
+ * suffix only when the dead prefix is at least as long, which bounds both
+ * the copy cost (amortised O(1) per hit) and the retained memory (at most
+ * twice the live hits).
+ */
+export declare function pruneWindow(window: SlidingWindow, windowStart: number): void;
+/** Number of live hits. */
+export declare function windowCount(window: SlidingWindow): number;
+/** Timestamp of the oldest live hit, if any. */
+export declare function windowOldest(window: SlidingWindow): number | undefined;
+/** Record an allowed hit at `now`. */
+export declare function recordHit(window: SlidingWindow, now: number): void;

package/dist/rateLimit/rateLimit.window.js

@@ -0,0 +1,60 @@
+/**
+ * @zudojs/security — Sliding-window bookkeeping for the rate limiter.
+ *
+ * A key's allowed hits are kept in chronological order behind a head
+ * offset. Expiring old hits is a binary search that advances the head, and
+ * the array is compacted only once the dead prefix outgrows the live
+ * suffix, so every operation is O(log n) amortised. The previous
+ * `timestamps.filter(...)` copied the whole array on every check, which
+ * made the cost of one request proportional to `max`: a limiter with
+ * `max: 1e6` spent more than twenty percent of a core on a single busy
+ * client where `max: 300` spent three.
+ */
+/** Create an empty window. */
+export function createSlidingWindow() {
+    return { timestamps: [], head: 0 };
+}
+/**
+ * Drop every hit at or before `windowStart`.
+ *
+ * Timestamps are appended in arrival order, so the live region is a suffix
+ * and its start can be found by binary search. Compaction copies the live
+ * suffix only when the dead prefix is at least as long, which bounds both
+ * the copy cost (amortised O(1) per hit) and the retained memory (at most
+ * twice the live hits).
+ */
+export function pruneWindow(window, windowStart) {
+    const { timestamps } = window;
+    let low = window.head;
+    let high = timestamps.length;
+    while (low < high) {
+        const middle = (low + high) >>> 1;
+        if (timestamps[middle] > windowStart) {
+            high = middle;
+        }
+        else {
+            low = middle + 1;
+        }
+    }
+    window.head = low;
+    if (low === timestamps.length) {
+        window.timestamps = [];
+        window.head = 0;
+    }
+    else if (low > 0 && low * 2 >= timestamps.length) {
+        window.timestamps = timestamps.slice(low);
+        window.head = 0;
+    }
+}
+/** Number of live hits. */
+export function windowCount(window) {
+    return window.timestamps.length - window.head;
+}
+/** Timestamp of the oldest live hit, if any. */
+export function windowOldest(window) {
+    return window.timestamps[window.head];
+}
+/** Record an allowed hit at `now`. */
+export function recordHit(window, now) {
+    window.timestamps.push(now);
+}

package/dist/types/index.d.ts

@@ -5,4 +5,3 @@
  */
 export type { HeaderSecurityConfig, HeaderValidationResult, BodyLimitConfig, BodyLimitPresets, UrlValidationConfig, UrlValidationResult, CookieSecurityConfig, ParsedCookie, CorsConfig, CsrfConfig, RateLimitConfig, RateLimitRequest, RateLimitResponse, RateLimitResult, SecurityHeadersConfig, InputSanitizationConfig, } from "./security.type.js";
 export { PROTOTYPE_POLLUTION_KEYS, SQL_INJECTION_PATTERNS, XSS_PATTERNS, } from "./security.type.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/types/index.js

@@ -4,4 +4,3 @@
  * Re-exports all security configuration and result types.
  */
 export { PROTOTYPE_POLLUTION_KEYS, SQL_INJECTION_PATTERNS, XSS_PATTERNS, } from "./security.type.js";
-//# sourceMappingURL=index.js.map

package/dist/types/security.type.d.ts

@@ -223,4 +223,3 @@ export declare const SQL_INJECTION_PATTERNS: readonly [RegExp, RegExp, RegExp, R
  * a payload it matched a moment earlier.
  */
 export declare const XSS_PATTERNS: readonly [RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp];
-//# sourceMappingURL=security.type.d.ts.map

package/dist/types/security.type.js

@@ -46,4 +46,3 @@ export const XSS_PATTERNS = [
     /<object\b[^>]*>/i,
     /<embed\b[^>]*>/i,
 ];
-//# sourceMappingURL=security.type.js.map

package/dist/url/index.d.ts

@@ -4,4 +4,3 @@
 export { validateUrl, normalizePath, validateRequestTarget, isSafeUrl, isPrivateHostname, containsTraversal, fullyDecodeUri, } from "./url.core.js";
 export type { RequestTargetConfig } from "./url.core.js";
 export { expandIpv6, embeddedIpv4, isNonPublicIpv6Range, } from "./url.ipv6.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/url/index.js

@@ -3,4 +3,3 @@
  */
 export { validateUrl, normalizePath, validateRequestTarget, isSafeUrl, isPrivateHostname, containsTraversal, fullyDecodeUri, } from "./url.core.js";
 export { expandIpv6, embeddedIpv4, isNonPublicIpv6Range, } from "./url.ipv6.js";
-//# sourceMappingURL=index.js.map

package/dist/url/url.core.d.ts

@@ -97,4 +97,3 @@ export declare function isPrivateHostname(hostname: string): boolean;
  * @returns True if the URL appears safe.
  */
 export declare function isSafeUrl(url: string, allowedProtocols?: readonly string[]): boolean;
-//# sourceMappingURL=url.core.d.ts.map

package/dist/url/url.core.js

@@ -410,4 +410,3 @@ export function isSafeUrl(url, allowedProtocols = DEFAULT_ALLOWED_PROTOCOLS) {
     }
     return !isPrivateHostname(parsed.hostname);
 }
-//# sourceMappingURL=url.core.js.map

package/dist/url/url.ipv6.d.ts

@@ -33,4 +33,3 @@ export declare function embeddedIpv4(groups: readonly number[]): number[] | unde
  * `64:ff9b:1::/48`, whose embedded address depends on local configuration.
  */
 export declare function isNonPublicIpv6Range(groups: readonly number[]): boolean;
-//# sourceMappingURL=url.ipv6.d.ts.map

package/dist/url/url.ipv6.js

@@ -85,4 +85,3 @@ export function isNonPublicIpv6Range(groups) {
         return true;
     return g0 === 0x64 && groups[1] === 0xff9b && groups[2] === 1;
 }
-//# sourceMappingURL=url.ipv6.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zudojs/security",
-  "version": "1.3.3",
+  "version": "1.3.4",
   "description": "Security primitives for input validation, header security, CORS, CSRF protection, rate limiting, and security headers.",
   "license": "MIT",
   "author": {
@@ -24,8 +24,8 @@
     "!dist/.tsbuildinfo"
   ],
   "dependencies": {
-    "@zudojs/errors": "1.3.2",
-    "@zudojs/constants": "1.1.4"
+    "@zudojs/errors": "1.4.0",
+    "@zudojs/constants": "1.2.0"
   },
   "devDependencies": {
     "typescript": "7.0.2",