actor-ts 0.10.0 → 0.11.0

package/dist/http/cache/RateLimitOptions.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Options for the {@link rateLimit} middleware.  Follows the repo's
+ * `XOptions.ts` convention (type / builder / validator / union), but the
+ * builder is purely ADDITIVE: `rateLimit(...)` still accepts a plain
+ * options object exactly as before.
+ */
+import { OptionsBuilder } from '../../util/OptionsBuilder.js';
+import { OptionsValidator } from '../../util/OptionsValidator.js';
+import type { Cache } from '../../cache/Cache.js';
+import type { HttpRequest, HttpResponse } from '../types.js';
+/** Context handed to a custom {@link RateLimitOptionsType.onLimit} builder. */
+export interface RateLimitContext {
+    readonly key: string;
+    readonly count: number;
+    readonly max: number;
+    readonly windowMs: number;
+    readonly retryAfterSeconds: number;
+}
+/** Plain options-object shape accepted by {@link rateLimit}. */
+export interface RateLimitOptionsType {
+    /** Backing cache.  Should be a shared/distributed one (Redis) in prod. */
+    readonly cache: Cache;
+    /** Length of the rolling window in milliseconds. */
+    readonly windowMs: number;
+    /** Maximum requests allowed per window per key. */
+    readonly max: number;
+    /** Identity function — typically derives from IP, user id, or API key. */
+    readonly key: (req: HttpRequest) => string | Promise<string>;
+    /**
+     * Cache-key namespace prepended to the user key.  Defaults to
+     * `'rl:'` so multiple rate-limiters in the same cache don't collide.
+     */
+    readonly keyPrefix?: string;
+    /**
+     * Custom 429 response builder.  Receives the limit context for
+     * full control over the body / headers.  Default: a plain 429 with
+     * `Retry-After` (seconds-rounded-up).
+     */
+    readonly onLimit?: (ctx: RateLimitContext) => HttpResponse;
+}
+/**
+ * Fluent builder for {@link RateLimitOptionsType}:
+ *
+ *     rateLimit(RateLimitOptions.create().withCache(cache).withWindowMs(60_000).withMax(100).withKey((req) => req.remoteAddress ?? '<anon>'))
+ */
+export declare class RateLimitOptionsBuilder extends OptionsBuilder<RateLimitOptionsType> {
+    /** Start a fresh builder.  Equivalent to `new RateLimitOptionsBuilder()`. */
+    static create(): RateLimitOptionsBuilder;
+    /** Backing cache.  Should be a shared/distributed one (Redis) in prod. */
+    withCache(cache: Cache): this;
+    /** Length of the rolling window in milliseconds. */
+    withWindowMs(windowMs: number): this;
+    /** Maximum requests allowed per window per key. */
+    withMax(max: number): this;
+    /** Identity function — typically derives from IP, user id, or API key. */
+    withKey(key: (req: HttpRequest) => string | Promise<string>): this;
+    /** Cache-key namespace prepended to the user key.  Default `'rl:'`. */
+    withKeyPrefix(keyPrefix: string): this;
+    /** Custom 429 response builder — full control over the limit response. */
+    withOnLimit(onLimit: (ctx: RateLimitContext) => HttpResponse): this;
+}
+/**
+ * Validates resolved {@link RateLimitOptionsType} settings: the rolling
+ * window (`windowMs`) must be a positive finite number of milliseconds and
+ * the per-window cap (`max`) a positive integer.  (Presence of `cache` /
+ * `key` is a required-field concern, not a domain-validity one.)
+ */
+export declare class RateLimitOptionsValidator extends OptionsValidator<RateLimitOptionsType> {
+    constructor();
+    protected rules(_s: Partial<RateLimitOptionsType>): void;
+}
+/**
+ * Accepted input for {@link rateLimit}: the fluent
+ * {@link RateLimitOptionsBuilder} OR a plain {@link RateLimitOptionsType}
+ * object.
+ */
+export type RateLimitOptions = RateLimitOptionsBuilder | Partial<RateLimitOptionsType>;
+/** Value alias so `RateLimitOptions.create()` / `new RateLimitOptions()` resolve to the builder. */
+export declare const RateLimitOptions: typeof RateLimitOptionsBuilder;
+//# sourceMappingURL=RateLimitOptions.d.ts.map

package/dist/http/cache/RateLimitOptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimitOptions.d.ts","sourceRoot":"","sources":["../../../src/http/cache/RateLimitOptions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE7D,+EAA+E;AAC/E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,gEAAgE;AAChE,MAAM,WAAW,oBAAoB;IACnC,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,oDAAoD;IACpD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,mDAAmD;IACnD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,YAAY,CAAC;CAC5D;AAED;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,cAAc,CAAC,oBAAoB,CAAC;IAC/E,6EAA6E;IAC7E,MAAM,CAAC,MAAM,IAAI,uBAAuB;IAIxC,0EAA0E;IAC1E,SAAS,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI;IAI7B,oDAAoD;IACpD,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAIpC,mDAAmD;IACnD,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAI1B,0EAA0E;IAC1E,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI;IAIlE,uEAAuE;IACvE,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAItC,0EAA0E;IAC1E,WAAW,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,YAAY,GAAG,IAAI;CAGpE;AAED;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,gBAAgB,CAAC,oBAAoB,CAAC;;IAInF,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,IAAI;CAIzD;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;AACvF,oGAAoG;AACpG,eAAO,MAAM,gBAAgB,gCAA0B,CAAC"}

package/dist/http/cache/RateLimitOptions.js

@@ -0,0 +1,61 @@
+/**
+ * Options for the {@link rateLimit} middleware.  Follows the repo's
+ * `XOptions.ts` convention (type / builder / validator / union), but the
+ * builder is purely ADDITIVE: `rateLimit(...)` still accepts a plain
+ * options object exactly as before.
+ */
+import { OptionsBuilder } from '../../util/OptionsBuilder.js';
+import { OptionsValidator } from '../../util/OptionsValidator.js';
+/**
+ * Fluent builder for {@link RateLimitOptionsType}:
+ *
+ *     rateLimit(RateLimitOptions.create().withCache(cache).withWindowMs(60_000).withMax(100).withKey((req) => req.remoteAddress ?? '<anon>'))
+ */
+export class RateLimitOptionsBuilder extends OptionsBuilder {
+    /** Start a fresh builder.  Equivalent to `new RateLimitOptionsBuilder()`. */
+    static create() {
+        return new RateLimitOptionsBuilder();
+    }
+    /** Backing cache.  Should be a shared/distributed one (Redis) in prod. */
+    withCache(cache) {
+        return this.set('cache', cache);
+    }
+    /** Length of the rolling window in milliseconds. */
+    withWindowMs(windowMs) {
+        return this.set('windowMs', windowMs);
+    }
+    /** Maximum requests allowed per window per key. */
+    withMax(max) {
+        return this.set('max', max);
+    }
+    /** Identity function — typically derives from IP, user id, or API key. */
+    withKey(key) {
+        return this.set('key', key);
+    }
+    /** Cache-key namespace prepended to the user key.  Default `'rl:'`. */
+    withKeyPrefix(keyPrefix) {
+        return this.set('keyPrefix', keyPrefix);
+    }
+    /** Custom 429 response builder — full control over the limit response. */
+    withOnLimit(onLimit) {
+        return this.set('onLimit', onLimit);
+    }
+}
+/**
+ * Validates resolved {@link RateLimitOptionsType} settings: the rolling
+ * window (`windowMs`) must be a positive finite number of milliseconds and
+ * the per-window cap (`max`) a positive integer.  (Presence of `cache` /
+ * `key` is a required-field concern, not a domain-validity one.)
+ */
+export class RateLimitOptionsValidator extends OptionsValidator {
+    constructor() {
+        super('RateLimitOptions');
+    }
+    rules(_s) {
+        this.positiveNumber('windowMs');
+        this.positiveInt('max');
+    }
+}
+/** Value alias so `RateLimitOptions.create()` / `new RateLimitOptions()` resolve to the builder. */
+export const RateLimitOptions = RateLimitOptionsBuilder;
+//# sourceMappingURL=RateLimitOptions.js.map

package/dist/http/cache/RateLimitOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimitOptions.js","sourceRoot":"","sources":["../../../src/http/cache/RateLimitOptions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAoClE;;;;GAIG;AACH,MAAM,OAAO,uBAAwB,SAAQ,cAAoC;IAC/E,6EAA6E;IAC7E,MAAM,CAAC,MAAM;QACX,OAAO,IAAI,uBAAuB,EAAE,CAAC;IACvC,CAAC;IAED,0EAA0E;IAC1E,SAAS,CAAC,KAAY;QACpB,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,oDAAoD;IACpD,YAAY,CAAC,QAAgB;QAC3B,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,mDAAmD;IACnD,OAAO,CAAC,GAAW;QACjB,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,0EAA0E;IAC1E,OAAO,CAAC,GAAmD;QACzD,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,uEAAuE;IACvE,aAAa,CAAC,SAAiB;QAC7B,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC1C,CAAC;IAED,0EAA0E;IAC1E,WAAW,CAAC,OAAgD;QAC1D,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,gBAAsC;IACnF;QACE,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC5B,CAAC;IACS,KAAK,CAAC,EAAiC;QAC/C,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAChC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;CACF;AAQD,oGAAoG;AACpG,MAAM,CAAC,MAAM,gBAAgB,GAAG,uBAAuB,CAAC"}

package/dist/http/cache/ResponseCache.js

@@ -67,10 +67,10 @@ function decodeResponse(c) {
 function bytesToBase64(bytes) {
     if (typeof Buffer !== 'undefined')
         return Buffer.from(bytes).toString('base64');
-    let s = '';
+    let binaryString = '';
     for (let i = 0; i < bytes.length; i++)
-        s += String.fromCharCode(bytes[i]);
-    return btoa(s);
+        binaryString += String.fromCharCode(bytes[i]);
+    return btoa(binaryString);
 }
 function base64ToBytes(b64) {
     if (typeof Buffer !== 'undefined')

package/dist/http/cache/ResponseCache.js.map

@@ -1 +1 @@
-{"version":3,"file":"ResponseCache.js","sourceRoot":"","sources":["../../../src/http/cache/ResponseCache.ts"],"names":[],"mappings":"AA0DA,MAAM,UAAU,MAAM,CAAC,IAA0B;IAC/C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,uDAAuD,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;IACxC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,kEAAkE;IAClE,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAiC,CAAC;IAE1D,OAAO,SAAS,IAAI,CAAC,OAAmE;QACtF,OAAO,KAAK,UAAU,aAAa,CAAC,GAAgB;YAClD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAG,GAAG,MAAM,GAAG,OAAO,EAAE,CAAC;YAEvC,gBAAgB;YAChB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,QAAQ,CAAC,CAAC;YAC3D,IAAI,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;gBACjB,OAAO,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;YAED,6DAA6D;YAC7D,MAAM,cAAc,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9C,IAAI,cAAc;gBAAE,OAAO,cAAc,CAAC;YAE1C,iEAAiE;YACjE,yCAAyC;YACzC,MAAM,IAAI,GAAG,CAAC,KAAK,IAA2B,EAAE;gBAC9C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;gBACpC,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBACvC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;gBACvF,CAAC;gBACD,OAAO,QAAQ,CAAC;YAClB,CAAC,CAAC,EAAE,CAAC;YACL,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC7B,IAAI,CAAC;gBAAC,OAAO,MAAM,IAAI,CAAC;YAAC,CAAC;oBAClB,CAAC;gBAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAAC,CAAC;QACxC,CAAC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,cAAc,CAAC,CAAe;IACrC,IAAI,IAAI,GAAY,CAAC,CAAC,IAAI,CAAC;IAC3B,IAAI,IAAI,YAAY,UAAU,EAAE,CAAC;QAC/B,IAAI,GAAG,EAAE,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;IACxC,CAAC;IACD,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAA6C;QACxD,IAAI;QACJ,WAAW,EAAE,CAAC,CAAC,WAAW;KAC3B,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,CAAiB;IACvC,IAAI,IAAI,GAAyB,CAAC,CAAC,IAA4B,CAAC;IAChE,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,IAAK,CAAC,CAAC,IAAe,EAAE,CAAC;QACnF,IAAI,GAAG,aAAa,CAAE,CAAC,CAAC,IAA0B,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,IAAI;QACJ,WAAW,EAAE,CAAC,CAAC,WAAW;KAC3B,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAiB;IACtC,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChF,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"ResponseCache.js","sourceRoot":"","sources":["../../../src/http/cache/ResponseCache.ts"],"names":[],"mappings":"AA0DA,MAAM,UAAU,MAAM,CAAC,IAA0B;IAC/C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,uDAAuD,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;IACxC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,kEAAkE;IAClE,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAiC,CAAC;IAE1D,OAAO,SAAS,IAAI,CAAC,OAAmE;QACtF,OAAO,KAAK,UAAU,aAAa,CAAC,GAAgB;YAClD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAG,GAAG,MAAM,GAAG,OAAO,EAAE,CAAC;YAEvC,gBAAgB;YAChB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,QAAQ,CAAC,CAAC;YAC3D,IAAI,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;gBACjB,OAAO,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;YAED,6DAA6D;YAC7D,MAAM,cAAc,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9C,IAAI,cAAc;gBAAE,OAAO,cAAc,CAAC;YAE1C,iEAAiE;YACjE,yCAAyC;YACzC,MAAM,IAAI,GAAG,CAAC,KAAK,IAA2B,EAAE;gBAC9C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;gBACpC,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBACvC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;gBACvF,CAAC;gBACD,OAAO,QAAQ,CAAC;YAClB,CAAC,CAAC,EAAE,CAAC;YACL,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC7B,IAAI,CAAC;gBAAC,OAAO,MAAM,IAAI,CAAC;YAAC,CAAC;oBAClB,CAAC;gBAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAAC,CAAC;QACxC,CAAC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,cAAc,CAAC,CAAe;IACrC,IAAI,IAAI,GAAY,CAAC,CAAC,IAAI,CAAC;IAC3B,IAAI,IAAI,YAAY,UAAU,EAAE,CAAC;QAC/B,IAAI,GAAG,EAAE,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;IACxC,CAAC;IACD,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAA6C;QACxD,IAAI;QACJ,WAAW,EAAE,CAAC,CAAC,WAAW;KAC3B,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,CAAiB;IACvC,IAAI,IAAI,GAAyB,CAAC,CAAC,IAA4B,CAAC;IAChE,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,IAAK,CAAC,CAAC,IAAe,EAAE,CAAC;QACnF,IAAI,GAAG,aAAa,CAAE,CAAC,CAAC,IAA0B,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,IAAI;QACJ,WAAW,EAAE,CAAC,CAAC,WAAW;KAC3B,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAiB;IACtC,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChF,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACtF,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/http/cache/index.d.ts

@@ -1,7 +1,9 @@
 export { rateLimit } from './RateLimit.js';
-export type { RateLimitOptions, RateLimitContext } from './RateLimit.js';
+export { RateLimitOptions, RateLimitOptionsBuilder, RateLimitOptionsValidator } from './RateLimitOptions.js';
+export type { RateLimitOptionsType, RateLimitContext } from './RateLimitOptions.js';
 export { idempotent } from './IdempotencyKey.js';
-export type { IdempotencyOptions } from './IdempotencyKey.js';
+export { IdempotencyOptions, IdempotencyOptionsBuilder, IdempotencyOptionsValidator } from './IdempotencyOptions.js';
+export type { IdempotencyOptionsType } from './IdempotencyOptions.js';
 export { cached } from './ResponseCache.js';
 export type { ResponseCacheOptions } from './ResponseCache.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/http/cache/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/http/cache/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,YAAY,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/http/cache/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAC7G,YAAY,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AACrH,YAAY,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/http/cache/index.js

@@ -1,4 +1,6 @@
 export { rateLimit } from './RateLimit.js';
+export { RateLimitOptions, RateLimitOptionsBuilder, RateLimitOptionsValidator } from './RateLimitOptions.js';
 export { idempotent } from './IdempotencyKey.js';
+export { IdempotencyOptions, IdempotencyOptionsBuilder, IdempotencyOptionsValidator } from './IdempotencyOptions.js';
 export { cached } from './ResponseCache.js';
 //# sourceMappingURL=index.js.map

package/dist/http/cache/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/http/cache/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/http/cache/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAE7G,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAErH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/http/cookies.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Minimal cookie parsing + serialisation.  The framework had no cookie
+ * helper; CSRF needs one, and handlers do too, so it lives at the HTTP
+ * root (not under middleware/) and is part of the public API.
+ *
+ * Security posture: parsing caps the number of pairs (untrusted input),
+ * and serialisation REJECTS values or names that could smuggle a second
+ * header or break out of the cookie (header-injection guard), plus
+ * enforces the `__Secure-` / `__Host-` prefix rules and the
+ * SameSite=None→Secure requirement.
+ */
+/** Attributes for a `Set-Cookie` value. */
+export interface CookieAttributes {
+    readonly maxAgeSeconds?: number;
+    readonly expires?: Date;
+    readonly domain?: string;
+    readonly path?: string;
+    readonly secure?: boolean;
+    readonly httpOnly?: boolean;
+    readonly sameSite?: 'strict' | 'lax' | 'none';
+}
+/**
+ * Parse a request `Cookie` header into a name→value map.  First
+ * occurrence of a name wins (RFC 6265 §5.4 ordering); malformed pairs are
+ * skipped, never thrown; values are best-effort %XX-decoded (kept raw on
+ * failure) with one layer of surrounding double quotes stripped.  At most
+ * {@link MAX_COOKIE_PAIRS} pairs are accepted.
+ */
+export declare function parseCookies(header: string | undefined): Readonly<Record<string, string>>;
+/**
+ * Serialise one `Set-Cookie` value.  THROWS on an invalid name, a value
+ * containing an illegal character (header-injection guard), a
+ * `SameSite=None` cookie that isn't `Secure`, or a violated cookie-prefix
+ * rule (`__Secure-` needs Secure; `__Host-` needs Secure + Path=/ + no
+ * Domain).  Value is emitted verbatim — pre-encode it yourself if needed.
+ */
+export declare function serializeCookie(name: string, value: string, attrs?: CookieAttributes): string;
+//# sourceMappingURL=cookies.d.ts.map

package/dist/http/cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../src/http/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,2CAA2C;AAC3C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;CAC/C;AAgBD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAmBzF;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,GAAE,gBAAqB,GAAG,MAAM,CAgCjG"}

package/dist/http/cookies.js

@@ -0,0 +1,102 @@
+/**
+ * Minimal cookie parsing + serialisation.  The framework had no cookie
+ * helper; CSRF needs one, and handlers do too, so it lives at the HTTP
+ * root (not under middleware/) and is part of the public API.
+ *
+ * Security posture: parsing caps the number of pairs (untrusted input),
+ * and serialisation REJECTS values or names that could smuggle a second
+ * header or break out of the cookie (header-injection guard), plus
+ * enforces the `__Secure-` / `__Host-` prefix rules and the
+ * SameSite=None→Secure requirement.
+ */
+/** Hard cap on parsed pairs — a client cannot make us build an unbounded map. */
+const MAX_COOKIE_PAIRS = 128;
+/** RFC 6265 cookie-name token characters. */
+const COOKIE_NAME_RE = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
+/**
+ * Illegal in a cookie value: anything outside printable ASCII (controls,
+ * space, DEL, non-ASCII) plus the structural delimiters `" , ; \`.  This
+ * is a superset-safe guard — it rejects everything RFC 6265 forbids and
+ * anything that could inject a header.
+ */
+const ILLEGAL_COOKIE_VALUE = /[^\x21-\x7e]|["(),;\\]/;
+/**
+ * Parse a request `Cookie` header into a name→value map.  First
+ * occurrence of a name wins (RFC 6265 §5.4 ordering); malformed pairs are
+ * skipped, never thrown; values are best-effort %XX-decoded (kept raw on
+ * failure) with one layer of surrounding double quotes stripped.  At most
+ * {@link MAX_COOKIE_PAIRS} pairs are accepted.
+ */
+export function parseCookies(header) {
+    const out = {};
+    if (!header)
+        return out;
+    let count = 0;
+    for (const part of header.split(';')) {
+        if (count >= MAX_COOKIE_PAIRS)
+            break;
+        const eq = part.indexOf('=');
+        if (eq < 0)
+            continue;
+        const name = part.slice(0, eq).trim();
+        if (!name || Object.prototype.hasOwnProperty.call(out, name))
+            continue;
+        let value = part.slice(eq + 1).trim();
+        if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) {
+            value = value.slice(1, -1);
+        }
+        try {
+            value = decodeURIComponent(value);
+        }
+        catch { /* not %-encoded — keep raw */ }
+        out[name] = value;
+        count++;
+    }
+    return out;
+}
+/**
+ * Serialise one `Set-Cookie` value.  THROWS on an invalid name, a value
+ * containing an illegal character (header-injection guard), a
+ * `SameSite=None` cookie that isn't `Secure`, or a violated cookie-prefix
+ * rule (`__Secure-` needs Secure; `__Host-` needs Secure + Path=/ + no
+ * Domain).  Value is emitted verbatim — pre-encode it yourself if needed.
+ */
+export function serializeCookie(name, value, attrs = {}) {
+    if (!COOKIE_NAME_RE.test(name)) {
+        throw new Error(`serializeCookie: invalid cookie name "${name}"`);
+    }
+    if (ILLEGAL_COOKIE_VALUE.test(value)) {
+        throw new Error('serializeCookie: cookie value contains an illegal character');
+    }
+    const secure = attrs.secure ?? false;
+    if (attrs.sameSite === 'none' && !secure) {
+        throw new Error('serializeCookie: SameSite=None requires Secure');
+    }
+    if (name.startsWith('__Secure-') && !secure) {
+        throw new Error('serializeCookie: the "__Secure-" prefix requires Secure');
+    }
+    if (name.startsWith('__Host-') && (!secure || attrs.path !== '/' || attrs.domain !== undefined)) {
+        throw new Error('serializeCookie: the "__Host-" prefix requires Secure, Path=/, and no Domain');
+    }
+    if (attrs.maxAgeSeconds !== undefined && !Number.isInteger(attrs.maxAgeSeconds)) {
+        throw new Error('serializeCookie: maxAgeSeconds must be an integer');
+    }
+    const parts = [`${name}=${value}`];
+    if (attrs.maxAgeSeconds !== undefined)
+        parts.push(`Max-Age=${attrs.maxAgeSeconds}`);
+    if (attrs.expires)
+        parts.push(`Expires=${attrs.expires.toUTCString()}`);
+    if (attrs.domain)
+        parts.push(`Domain=${attrs.domain}`);
+    if (attrs.path)
+        parts.push(`Path=${attrs.path}`);
+    if (attrs.httpOnly)
+        parts.push('HttpOnly');
+    if (secure)
+        parts.push('Secure');
+    if (attrs.sameSite) {
+        parts.push(`SameSite=${attrs.sameSite === 'strict' ? 'Strict' : attrs.sameSite === 'lax' ? 'Lax' : 'None'}`);
+    }
+    return parts.join('; ');
+}
+//# sourceMappingURL=cookies.js.map

package/dist/http/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../../src/http/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAaH,iFAAiF;AACjF,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B,6CAA6C;AAC7C,MAAM,cAAc,GAAG,+BAA+B,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;AAEtD;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,MAA0B;IACrD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IACxB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,IAAI,KAAK,IAAI,gBAAgB;YAAE,MAAM;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,GAAG,CAAC;YAAE,SAAS;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC;YAAE,SAAS;QACvE,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC;YAAC,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,8BAA8B,CAAC,CAAC;QACnF,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAClB,KAAK,EAAE,CAAC;IACV,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa,EAAE,QAA0B,EAAE;IACvF,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,GAAG,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC;IACrC,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;QAChG,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;IACpF,IAAI,KAAK,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACxE,IAAI,KAAK,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/G,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/http/index.d.ts

@@ -1,24 +1,30 @@
 export { HttpExtension, HttpExtensionId } from './HttpExtension.js';
 export type { ServerBuilder } from './HttpExtension.js';
-export { concat, complete, completeJson, completeText, compile, del, get, head, options, patch, path, pathParam, pathPrefix, post, put, queryParam, redirect, reject, withMiddleware, } from './Route.js';
-export type { CompiledRoute, CompiledWebSocketRoute, CompiledEndpoint, Middleware, Route, WebSocketConnectHandler, } from './Route.js';
-export { BearerTokenAuth, IpAllowlist } from './middleware/index.js';
-export type { BearerTokenAuthOptions, IpAllowlistOptions } from './middleware/index.js';
+export { concat, complete, completeJson, completeText, compile, defaultErrorResponse, del, fallback, get, handleErrors, head, options, patch, path, pathParam, pathPrefix, post, put, queryParam, redirect, reject, withMiddleware, } from './Route.js';
+export type { CompiledRoute, CompiledWebsocketRoute, CompiledFallback, CompiledEndpoint, ExceptionHandler, Middleware, Route, WebsocketConnectHandler, } from './Route.js';
+export { BearerTokenAuth, IpAllowlist, strictTransportSecurity, hsts, HstsOptions, HstsOptionsBuilder, HstsOptionsValidator, contentSecurityPolicy, CspOptions, CspOptionsBuilder, securityHeaders, SecurityHeadersOptions, SecurityHeadersOptionsBuilder, cors, CorsOptions, CorsOptionsBuilder, CorsOptionsValidator, csrfProtection, requireSameOrigin, readCsrfToken, CsrfOptions, CsrfOptionsBuilder, CsrfOptionsValidator, SameOriginOptions, SameOriginOptionsBuilder, requestId, RequestIdOptions, RequestIdOptionsBuilder, BasicAuth, BasicAuthOptions, BasicAuthOptionsBuilder, requestTimeout, TimeoutOptions, TimeoutOptionsBuilder, TimeoutOptionsValidator, } from './middleware/index.js';
+export type { BearerTokenAuthOptions, IpAllowlistOptions, HstsOptionsType, CspOptionsType, CspDirectives, SecurityHeadersOptionsType, CorsOptionsType, CorsOrigin, CsrfOptionsType, CsrfCookieOptions, SameOriginOptionsType, RequestIdOptionsType, BasicAuthOptionsType, TimeoutOptionsType, } from './middleware/index.js';
 export { entity, marshal, pickRequestSerializer, pickResponseSerializer } from './Marshalling.js';
+export { contentTypeFor, DEFAULT_MIME_TYPES } from './MimeTypes.js';
+export { getFromFile, getFromDirectory, getFromBrowseableDirectory, StaticFilesOptions, StaticFilesOptionsBuilder, StaticFilesOptionsValidator, } from './static/index.js';
+export type { StaticFilesOptionsType } from './static/index.js';
+export { escapeHtml, html, rawHtml, completeHtml, SafeHtml } from './Html.js';
+export { parseCookies, serializeCookie } from './cookies.js';
+export type { CookieAttributes } from './cookies.js';
 export { HttpClient } from './HttpClient.js';
 export type { HttpClientRequest, HttpClientResponse } from './HttpClient.js';
 export { FastifyBackend } from './backend/FastifyBackend.js';
 export { ExpressBackend } from './backend/ExpressBackend.js';
-export { ExpressBackendOptions, ExpressBackendOptionsBuilder } from './backend/ExpressBackendOptions.js';
+export { ExpressBackendOptions, ExpressBackendOptionsBuilder, ExpressBackendOptionsValidator } from './backend/ExpressBackendOptions.js';
 export type { ExpressBackendOptionsType } from './backend/ExpressBackendOptions.js';
 export { HonoBackend } from './backend/HonoBackend.js';
-export { HonoBackendOptions, HonoBackendOptionsBuilder } from './backend/HonoBackendOptions.js';
+export { HonoBackendOptions, HonoBackendOptionsBuilder, HonoBackendOptionsValidator } from './backend/HonoBackendOptions.js';
 export type { HonoBackendOptionsType } from './backend/HonoBackendOptions.js';
-export type { HttpServerBackend, RouteRegistration, WebSocketRouteRegistration, ServerBinding, } from './backend/HttpServerBackend.js';
-export type { WebSocketSocketAdapter, WebSocketListeners } from './ws/SocketAdapter.js';
-export * from './ws/index.js';
+export type { HttpServerBackend, RouteRegistration, WebsocketRouteRegistration, ServerBinding, } from './backend/HttpServerBackend.js';
+export type { WebsocketSocketAdapter, WebsocketListeners } from './websocket/SocketAdapter.js';
+export * from './websocket/index.js';
 export { HttpError, Status, } from './types.js';
 export type { HttpMethod, HttpRequest, HttpResponse } from './types.js';
-export { rateLimit, idempotent, cached } from './cache/index.js';
-export type { RateLimitOptions, RateLimitContext, IdempotencyOptions, ResponseCacheOptions, } from './cache/index.js';
+export { rateLimit, RateLimitOptions, RateLimitOptionsBuilder, RateLimitOptionsValidator, idempotent, IdempotencyOptions, IdempotencyOptionsBuilder, IdempotencyOptionsValidator, cached, } from './cache/index.js';
+export type { RateLimitOptionsType, RateLimitContext, IdempotencyOptionsType, ResponseCacheOptions, } from './cache/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/http/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACpE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EACL,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,OAAO,EACP,GAAG,EACH,GAAG,EACH,IAAI,EACJ,OAAO,EACP,KAAK,EACL,IAAI,EACJ,SAAS,EACT,UAAU,EACV,IAAI,EACJ,GAAG,EACH,UAAU,EACV,QAAQ,EACR,MAAM,EACN,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,aAAa,EACb,sBAAsB,EACtB,gBAAgB,EAChB,UAAU,EACV,KAAK,EACL,uBAAuB,GACxB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACrE,YAAY,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAExF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAElG,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE7E,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AACzG,YAAY,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AACpF,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAChG,YAAY,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAC9E,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,0BAA0B,EAC1B,aAAa,GACd,MAAM,gCAAgC,CAAC;AACxC,YAAY,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAGxF,cAAc,eAAe,CAAC;AAE9B,OAAO,EACL,SAAS,EACT,MAAM,GACP,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAGxE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACjE,YAAY,EACV,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACpE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EACL,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,OAAO,EACP,oBAAoB,EACpB,GAAG,EACH,QAAQ,EACR,GAAG,EACH,YAAY,EACZ,IAAI,EACJ,OAAO,EACP,KAAK,EACL,IAAI,EACJ,SAAS,EACT,UAAU,EACV,IAAI,EACJ,GAAG,EACH,UAAU,EACV,QAAQ,EACR,MAAM,EACN,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,aAAa,EACb,sBAAsB,EACtB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,KAAK,EACL,uBAAuB,GACxB,MAAM,YAAY,CAAC;AAIpB,OAAO,EACL,eAAe,EACf,WAAW,EACX,uBAAuB,EACvB,IAAI,EACJ,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,UAAU,EACV,iBAAiB,EACjB,eAAe,EACf,sBAAsB,EACtB,6BAA6B,EAC7B,IAAI,EACJ,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,wBAAwB,EACxB,SAAS,EACT,gBAAgB,EAChB,uBAAuB,EACvB,SAAS,EACT,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,cAAc,EACd,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,sBAAsB,EACtB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,aAAa,EACb,0BAA0B,EAC1B,eAAe,EACf,UAAU,EACV,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAGlG,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGpE,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,0BAA0B,EAC1B,kBAAkB,EAClB,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAGhE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAG9E,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7D,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE7E,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,8BAA8B,EAAE,MAAM,oCAAoC,CAAC;AACzI,YAAY,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AACpF,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAC7H,YAAY,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAC9E,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,0BAA0B,EAC1B,aAAa,GACd,MAAM,gCAAgC,CAAC;AACxC,YAAY,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAG/F,cAAc,sBAAsB,CAAC;AAErC,OAAO,EACL,SAAS,EACT,MAAM,GACP,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAGxE,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,uBAAuB,EACvB,yBAAyB,EACzB,UAAU,EACV,kBAAkB,EAClB,yBAAyB,EACzB,2BAA2B,EAC3B,MAAM,GACP,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,kBAAkB,CAAC"}

package/dist/http/index.js

@@ -1,18 +1,26 @@
 export { HttpExtension, HttpExtensionId } from './HttpExtension.js';
-export { concat, complete, completeJson, completeText, compile, del, get, head, options, patch, path, pathParam, pathPrefix, post, put, queryParam, redirect, reject, withMiddleware, } from './Route.js';
-// Auth + IP-allowlist middleware (#312).  Exported from
-// `./middleware/index.js`; barrel re-exports both for convenience.
-export { BearerTokenAuth, IpAllowlist } from './middleware/index.js';
+export { concat, complete, completeJson, completeText, compile, defaultErrorResponse, del, fallback, get, handleErrors, head, options, patch, path, pathParam, pathPrefix, post, put, queryParam, redirect, reject, withMiddleware, } from './Route.js';
+// Auth + IP-allowlist middleware (#312) and the security-header suite
+// (#353).  Exported from `./middleware/index.js`; the barrel re-exports.
+export { BearerTokenAuth, IpAllowlist, strictTransportSecurity, hsts, HstsOptions, HstsOptionsBuilder, HstsOptionsValidator, contentSecurityPolicy, CspOptions, CspOptionsBuilder, securityHeaders, SecurityHeadersOptions, SecurityHeadersOptionsBuilder, cors, CorsOptions, CorsOptionsBuilder, CorsOptionsValidator, csrfProtection, requireSameOrigin, readCsrfToken, CsrfOptions, CsrfOptionsBuilder, CsrfOptionsValidator, SameOriginOptions, SameOriginOptionsBuilder, requestId, RequestIdOptions, RequestIdOptionsBuilder, BasicAuth, BasicAuthOptions, BasicAuthOptionsBuilder, requestTimeout, TimeoutOptions, TimeoutOptionsBuilder, TimeoutOptionsValidator, } from './middleware/index.js';
 export { entity, marshal, pickRequestSerializer, pickResponseSerializer } from './Marshalling.js';
+// MIME-type registry — extension → content-type for static-file responses.
+export { contentTypeFor, DEFAULT_MIME_TYPES } from './MimeTypes.js';
+// Static file serving — getFromFile / getFromDirectory / directory browsing.
+export { getFromFile, getFromDirectory, getFromBrowseableDirectory, StaticFilesOptions, StaticFilesOptionsBuilder, StaticFilesOptionsValidator, } from './static/index.js';
+// HTML response helpers — escaping + the `html` tagged template (#352).
+export { escapeHtml, html, rawHtml, completeHtml, SafeHtml } from './Html.js';
+// Cookie parse/serialise helpers — used by CSRF, handy for handlers too.
+export { parseCookies, serializeCookie } from './cookies.js';
 export { HttpClient } from './HttpClient.js';
 export { FastifyBackend } from './backend/FastifyBackend.js';
 export { ExpressBackend } from './backend/ExpressBackend.js';
-export { ExpressBackendOptions, ExpressBackendOptionsBuilder } from './backend/ExpressBackendOptions.js';
+export { ExpressBackendOptions, ExpressBackendOptionsBuilder, ExpressBackendOptionsValidator } from './backend/ExpressBackendOptions.js';
 export { HonoBackend } from './backend/HonoBackend.js';
-export { HonoBackendOptions, HonoBackendOptionsBuilder } from './backend/HonoBackendOptions.js';
+export { HonoBackendOptions, HonoBackendOptionsBuilder, HonoBackendOptionsValidator } from './backend/HonoBackendOptions.js';
 // Typed WebSocket stack — websocket() directive, server actor, codecs.
-export * from './ws/index.js';
+export * from './websocket/index.js';
 export { HttpError, Status, } from './types.js';
 // HTTP caching middleware (response-cache, rate-limit, idempotency-key).
-export { rateLimit, idempotent, cached } from './cache/index.js';
+export { rateLimit, RateLimitOptions, RateLimitOptionsBuilder, RateLimitOptionsValidator, idempotent, IdempotencyOptions, IdempotencyOptionsBuilder, IdempotencyOptionsValidator, cached, } from './cache/index.js';
 //# sourceMappingURL=index.js.map

package/dist/http/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGpE,OAAO,EACL,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,OAAO,EACP,GAAG,EACH,GAAG,EACH,IAAI,EACJ,OAAO,EACP,KAAK,EACL,IAAI,EACJ,SAAS,EACT,UAAU,EACV,IAAI,EACJ,GAAG,EACH,UAAU,EACV,QAAQ,EACR,MAAM,EACN,cAAc,GACf,MAAM,YAAY,CAAC;AAUpB,wDAAwD;AACxD,mEAAmE;AACnE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGrE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAElG,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAG7C,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AAEzG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAUhG,uEAAuE;AACvE,cAAc,eAAe,CAAC;AAE9B,OAAO,EACL,SAAS,EACT,MAAM,GACP,MAAM,YAAY,CAAC;AAGpB,yEAAyE;AACzE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGpE,OAAO,EACL,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,OAAO,EACP,oBAAoB,EACpB,GAAG,EACH,QAAQ,EACR,GAAG,EACH,YAAY,EACZ,IAAI,EACJ,OAAO,EACP,KAAK,EACL,IAAI,EACJ,SAAS,EACT,UAAU,EACV,IAAI,EACJ,GAAG,EACH,UAAU,EACV,QAAQ,EACR,MAAM,EACN,cAAc,GACf,MAAM,YAAY,CAAC;AAYpB,sEAAsE;AACtE,yEAAyE;AACzE,OAAO,EACL,eAAe,EACf,WAAW,EACX,uBAAuB,EACvB,IAAI,EACJ,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,UAAU,EACV,iBAAiB,EACjB,eAAe,EACf,sBAAsB,EACtB,6BAA6B,EAC7B,IAAI,EACJ,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,wBAAwB,EACxB,SAAS,EACT,gBAAgB,EAChB,uBAAuB,EACvB,SAAS,EACT,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,cAAc,EACd,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAkB/B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAElG,2EAA2E;AAC3E,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpE,6EAA6E;AAC7E,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,0BAA0B,EAC1B,kBAAkB,EAClB,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAG3B,wEAAwE;AACxE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE9E,yEAAyE;AACzE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAG7D,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAG7C,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,8BAA8B,EAAE,MAAM,oCAAoC,CAAC;AAEzI,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAU7H,uEAAuE;AACvE,cAAc,sBAAsB,CAAC;AAErC,OAAO,EACL,SAAS,EACT,MAAM,GACP,MAAM,YAAY,CAAC;AAGpB,yEAAyE;AACzE,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,uBAAuB,EACvB,yBAAyB,EACzB,UAAU,EACV,kBAAkB,EAClB,yBAAyB,EACzB,2BAA2B,EAC3B,MAAM,GACP,MAAM,kBAAkB,CAAC"}

package/dist/http/middleware/BasicAuth.d.ts

@@ -0,0 +1,5 @@
+import type { Middleware } from '../Route.js';
+import type { BasicAuthOptions } from './BasicAuthOptions.js';
+/** Build a Basic-auth middleware.  Requires `users` or `validate`. */
+export declare function BasicAuth(options: BasicAuthOptions): Middleware;
+//# sourceMappingURL=BasicAuth.d.ts.map

package/dist/http/middleware/BasicAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BasicAuth.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/BasicAuth.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,KAAK,EAAE,gBAAgB,EAAwB,MAAM,uBAAuB,CAAC;AASpF,sEAAsE;AACtE,wBAAgB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,UAAU,CAqC/D"}

package/dist/http/middleware/BasicAuth.js

@@ -0,0 +1,58 @@
+/**
+ * HTTP Basic authentication middleware — the `Authorization: Basic` peer
+ * of {@link BearerTokenAuth}.  Credentials are compared constant-time, and
+ * a 401 advertises a real `WWW-Authenticate: Basic realm="…"` header (via
+ * HttpError.headers).
+ */
+import { timingSafeEqual } from 'node:crypto';
+import { HttpError, Status } from '../types.js';
+/** Constant-time compare (equal length only — the length pre-check is the one known leak). */
+function safeEqual(a, b) {
+    const ab = Buffer.from(a);
+    const bb = Buffer.from(b);
+    return ab.length === bb.length && timingSafeEqual(ab, bb);
+}
+/** Build a Basic-auth middleware.  Requires `users` or `validate`. */
+export function BasicAuth(options) {
+    const resolvedOptions = options;
+    const users = resolvedOptions.users;
+    const validate = resolvedOptions.validate;
+    if (!users && !validate) {
+        throw new Error('BasicAuth: provide either users or a validate function');
+    }
+    const realm = resolvedOptions.realm ?? 'actor-ts';
+    const challenge = { 'www-authenticate': `Basic realm="${realm}"` };
+    const unauthorized = (message) => {
+        throw new HttpError(Status.Unauthorized, message, undefined, challenge);
+    };
+    return async (req, next) => {
+        const header = req.headers['authorization'];
+        if (!header)
+            unauthorized('missing Authorization header');
+        const match = /^Basic\s+(.+)$/i.exec(header);
+        if (!match)
+            unauthorized('authorization scheme must be Basic');
+        const decoded = Buffer.from(match[1].trim(), 'base64').toString('utf8');
+        const sep = decoded.indexOf(':');
+        if (sep < 0)
+            unauthorized('malformed Basic credentials');
+        const user = decoded.slice(0, sep);
+        const pass = decoded.slice(sep + 1);
+        let ok = false;
+        if (validate) {
+            ok = (await validate(user, pass)) === true;
+        }
+        else if (users) {
+            // Iterate every entry (no early exit) so timing doesn't reveal which
+            // usernames exist; a miss still burns the same comparisons.
+            for (const [u, p] of Object.entries(users)) {
+                if (safeEqual(user, u) && safeEqual(pass, p))
+                    ok = true;
+            }
+        }
+        if (!ok)
+            unauthorized('invalid credentials');
+        return next();
+    };
+}
+//# sourceMappingURL=BasicAuth.js.map

package/dist/http/middleware/BasicAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BasicAuth.js","sourceRoot":"","sources":["../../../src/http/middleware/BasicAuth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAGhD,8FAA8F;AAC9F,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,IAAI,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,SAAS,CAAC,OAAyB;IACjD,MAAM,eAAe,GAAG,OAAwC,CAAC;IACjE,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC;IACpC,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC;IAC1C,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,IAAI,UAAU,CAAC;IAClD,MAAM,SAAS,GAAG,EAAE,kBAAkB,EAAE,gBAAgB,KAAK,GAAG,EAAE,CAAC;IACnE,MAAM,YAAY,GAAG,CAAC,OAAe,EAAS,EAAE;QAC9C,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAC1E,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM;YAAE,YAAY,CAAC,8BAA8B,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK;YAAE,YAAY,CAAC,oCAAoC,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAM,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,GAAG,CAAC;YAAE,YAAY,CAAC,6BAA6B,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAEpC,IAAI,EAAE,GAAG,KAAK,CAAC;QACf,IAAI,QAAQ,EAAE,CAAC;YACb,EAAE,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC;QAC7C,CAAC;aAAM,IAAI,KAAK,EAAE,CAAC;YACjB,qEAAqE;YACrE,4DAA4D;YAC5D,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3C,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;oBAAE,EAAE,GAAG,IAAI,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,IAAI,CAAC,EAAE;YAAE,YAAY,CAAC,qBAAqB,CAAC,CAAC;QAC7C,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/http/middleware/BasicAuthOptions.d.ts

@@ -0,0 +1,22 @@
+/** Options for the {@link BasicAuth} middleware.  Options-only. */
+import { OptionsBuilder } from '../../util/OptionsBuilder.js';
+/** Plain settings shape for HTTP Basic auth.  Provide `users` OR `validate`. */
+export interface BasicAuthOptionsType {
+    /** username→password map (constant-time compared). */
+    readonly users?: Readonly<Record<string, string>>;
+    /** Custom credential check (e.g. against a store). */
+    readonly validate?: (user: string, pass: string) => boolean | Promise<boolean>;
+    /** Realm advertised in `WWW-Authenticate` on 401.  Default `'actor-ts'`. */
+    readonly realm?: string;
+}
+/** Fluent builder for {@link BasicAuthOptionsType}. */
+export declare class BasicAuthOptionsBuilder extends OptionsBuilder<BasicAuthOptionsType> {
+    static create(): BasicAuthOptionsBuilder;
+    withUsers(users: Readonly<Record<string, string>>): this;
+    withValidate(fn: (user: string, pass: string) => boolean | Promise<boolean>): this;
+    withRealm(realm: string): this;
+}
+/** Accepted input: the builder or a plain object. */
+export type BasicAuthOptions = BasicAuthOptionsBuilder | Partial<BasicAuthOptionsType>;
+export declare const BasicAuthOptions: typeof BasicAuthOptionsBuilder;
+//# sourceMappingURL=BasicAuthOptions.d.ts.map

package/dist/http/middleware/BasicAuthOptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BasicAuthOptions.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/BasicAuthOptions.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9D,gFAAgF;AAChF,MAAM,WAAW,oBAAoB;IACnC,sDAAsD;IACtD,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/E,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,uDAAuD;AACvD,qBAAa,uBAAwB,SAAQ,cAAc,CAAC,oBAAoB,CAAC;IAC/E,MAAM,CAAC,MAAM,IAAI,uBAAuB;IAGxC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,IAAI;IAGxD,YAAY,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI;IAGlF,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;CAG/B;AAED,qDAAqD;AACrD,MAAM,MAAM,gBAAgB,GAAG,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;AACvF,eAAO,MAAM,gBAAgB,gCAA0B,CAAC"}

package/dist/http/middleware/BasicAuthOptions.js

@@ -0,0 +1,19 @@
+/** Options for the {@link BasicAuth} middleware.  Options-only. */
+import { OptionsBuilder } from '../../util/OptionsBuilder.js';
+/** Fluent builder for {@link BasicAuthOptionsType}. */
+export class BasicAuthOptionsBuilder extends OptionsBuilder {
+    static create() {
+        return new BasicAuthOptionsBuilder();
+    }
+    withUsers(users) {
+        return this.set('users', users);
+    }
+    withValidate(fn) {
+        return this.set('validate', fn);
+    }
+    withRealm(realm) {
+        return this.set('realm', realm);
+    }
+}
+export const BasicAuthOptions = BasicAuthOptionsBuilder;
+//# sourceMappingURL=BasicAuthOptions.js.map

package/dist/http/middleware/BasicAuthOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BasicAuthOptions.js","sourceRoot":"","sources":["../../../src/http/middleware/BasicAuthOptions.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAY9D,uDAAuD;AACvD,MAAM,OAAO,uBAAwB,SAAQ,cAAoC;IAC/E,MAAM,CAAC,MAAM;QACX,OAAO,IAAI,uBAAuB,EAAE,CAAC;IACvC,CAAC;IACD,SAAS,CAAC,KAAuC;QAC/C,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,YAAY,CAAC,EAA8D;QACzE,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,SAAS,CAAC,KAAa;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;CACF;AAID,MAAM,CAAC,MAAM,gBAAgB,GAAG,uBAAuB,CAAC"}