actor-ts 0.10.0 → 0.11.0

package/dist/http/middleware/BearerToken.js

@@ -33,16 +33,16 @@ export function BearerTokenAuth(opts) {
     return async (req, next) => {
         const header = req.headers[headerName];
         if (!header) {
-            throw new HttpError(Status.Unauthorized, 'missing Authorization header', {
-                wwwAuthenticate: `Bearer realm="${realm}"`,
+            throw new HttpError(Status.Unauthorized, 'missing Authorization header', undefined, {
+                'www-authenticate': `Bearer realm="${realm}"`,
             });
         }
         // Header value must look like `Bearer <token>`.  Reject anything else
         // to avoid accidental matches against scheme-prefixed values.
         const match = /^Bearer\s+(.+)$/.exec(header);
         if (!match) {
-            throw new HttpError(Status.Unauthorized, 'authorization scheme must be Bearer', {
-                wwwAuthenticate: `Bearer realm="${realm}"`,
+            throw new HttpError(Status.Unauthorized, 'authorization scheme must be Bearer', undefined, {
+                'www-authenticate': `Bearer realm="${realm}"`,
             });
         }
         const presented = new TextEncoder().encode(match[1].trim());
@@ -62,8 +62,8 @@ export function BearerTokenAuth(opts) {
                 matched = true;
         }
         if (!matched) {
-            throw new HttpError(Status.Unauthorized, 'invalid bearer token', {
-                wwwAuthenticate: `Bearer realm="${realm}"`,
+            throw new HttpError(Status.Unauthorized, 'invalid bearer token', undefined, {
+                'www-authenticate': `Bearer realm="${realm}"`,
             });
         }
         return next();

package/dist/http/middleware/BearerToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"BearerToken.js","sourceRoot":"","sources":["../../../src/http/middleware/BearerToken.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAuBhD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,IAA4B;IAC1D,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;IACtE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC;IAEvC,uDAAuD;IACvD,MAAM,QAAQ,GAAiB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnF,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,YAAY,EAAE,8BAA8B,EAAE;gBACvE,eAAe,EAAE,iBAAiB,KAAK,GAAG;aAC3C,CAAC,CAAC;QACL,CAAC;QACD,sEAAsE;QACtE,8DAA8D;QAC9D,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,YAAY,EAAE,qCAAqC,EAAE;gBAC9E,eAAe,EAAE,iBAAiB,KAAK,GAAG;aAC3C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,oEAAoE;QACpE,oEAAoE;QACpE,gEAAgE;QAChE,6DAA6D;QAC7D,kEAAkE;QAClE,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;mBAC9C,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAC3C,8DAA8D;YAC9D,gEAAgE;YAChE,wCAAwC;YACxC,IAAI,KAAK;gBAAE,OAAO,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,YAAY,EAAE,sBAAsB,EAAE;gBAC/D,eAAe,EAAE,iBAAiB,KAAK,GAAG;aAC3C,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"BearerToken.js","sourceRoot":"","sources":["../../../src/http/middleware/BearerToken.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAuBhD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,IAA4B;IAC1D,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;IACtE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC;IAEvC,uDAAuD;IACvD,MAAM,QAAQ,GAAiB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnF,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,YAAY,EAAE,8BAA8B,EAAE,SAAS,EAAE;gBAClF,kBAAkB,EAAE,iBAAiB,KAAK,GAAG;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,sEAAsE;QACtE,8DAA8D;QAC9D,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,YAAY,EAAE,qCAAqC,EAAE,SAAS,EAAE;gBACzF,kBAAkB,EAAE,iBAAiB,KAAK,GAAG;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,oEAAoE;QACpE,oEAAoE;QACpE,gEAAgE;QAChE,6DAA6D;QAC7D,kEAAkE;QAClE,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;mBAC9C,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAC3C,8DAA8D;YAC9D,gEAAgE;YAChE,wCAAwC;YACxC,IAAI,KAAK;gBAAE,OAAO,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,YAAY,EAAE,sBAAsB,EAAE,SAAS,EAAE;gBAC1E,kBAAkB,EAAE,iBAAiB,KAAK,GAAG;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/http/middleware/Cors.d.ts

@@ -0,0 +1,39 @@
+/**
+ * CORS as a route directive.  A plain middleware cannot do CORS correctly:
+ * a preflight `OPTIONS` to a `GET`-only pattern never matches a compiled
+ * route, so no middleware would run.  Instead `cors(options, child)` is a
+ * dedicated Route kind that the compiler expands via {@link expandCors} —
+ * decorating the real responses AND synthesising an `OPTIONS` preflight
+ * route per pattern.
+ *
+ * Ordering: place `cors()` OUTSIDE any auth middleware.  The synthesised
+ * preflight routes are ordinary children of an enclosing
+ * `withMiddleware(...)`, and preflights are anonymous by spec — wrapping
+ * them in auth would 401 every preflight.
+ */
+import type { CompiledEndpoint, Route } from '../Route.js';
+import type { HttpMethod } from '../types.js';
+import { type CorsOptions, type CorsOrigin } from './CorsOptions.js';
+/** Resolved CORS policy stored on the `cors` Route node. */
+export interface CorsRouteOptions {
+    readonly origins: CorsOrigin;
+    readonly methods?: ReadonlyArray<HttpMethod>;
+    readonly allowedHeaders?: ReadonlyArray<string>;
+    readonly exposedHeaders?: ReadonlyArray<string>;
+    readonly credentials: boolean;
+    readonly maxAge?: number;
+}
+/**
+ * Apply the CORS policy to `child`'s subtree.  Validates the options up
+ * front: `origins` is required, and `credentials` cannot be combined with
+ * `'*'` (the Fetch spec forbids `Access-Control-Allow-Origin: *` with
+ * credentials).
+ */
+export declare function cors(options: CorsOptions, child: Route): Route;
+/**
+ * Expand a `cors` node's compiled children: decorate real responses, fold
+ * an origin check into WebSocket upgrades, and synthesise a per-pattern
+ * `OPTIONS` preflight (or intercept a user-defined one).
+ */
+export declare function expandCors(children: CompiledEndpoint[], settings: CorsRouteOptions): CompiledEndpoint[];
+//# sourceMappingURL=Cors.d.ts.map

package/dist/http/middleware/Cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Cors.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/Cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,KAAK,EAAE,UAAU,EAA6B,MAAM,aAAa,CAAC;AAEzE,OAAO,EAAwB,KAAK,WAAW,EAAwB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEjH,4DAA4D;AAC5D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IAC7C,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,wBAAgB,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,GAAG,KAAK,CAe9D;AAmED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,GAAG,gBAAgB,EAAE,CA+DvG"}

package/dist/http/middleware/Cors.js

@@ -0,0 +1,164 @@
+import { applyHeaders, appendVary } from './headers.js';
+import { CorsOptionsValidator } from './CorsOptions.js';
+/**
+ * Apply the CORS policy to `child`'s subtree.  Validates the options up
+ * front: `origins` is required, and `credentials` cannot be combined with
+ * `'*'` (the Fetch spec forbids `Access-Control-Allow-Origin: *` with
+ * credentials).
+ */
+export function cors(options, child) {
+    const resolvedOptions = options;
+    if (resolvedOptions.origins === undefined) {
+        throw new Error('cors: origins is required — call withOrigins(...), withAnyOrigin(), or withOriginPredicate(...)');
+    }
+    new CorsOptionsValidator().validate(resolvedOptions);
+    const settings = {
+        origins: resolvedOptions.origins,
+        methods: resolvedOptions.methods,
+        allowedHeaders: resolvedOptions.allowedHeaders,
+        exposedHeaders: resolvedOptions.exposedHeaders,
+        credentials: resolvedOptions.credentials ?? false,
+        maxAge: resolvedOptions.maxAge,
+    };
+    return { kind: 'cors', settings, child };
+}
+function isAllowed(origins, origin) {
+    if (origins === '*')
+        return true;
+    if (typeof origins === 'function') {
+        try {
+            return origins(origin);
+        }
+        catch {
+            return false;
+        }
+    }
+    return origins.includes(origin);
+}
+/** Echo the request origin, or literal `*` only when wildcard AND not credentialed. */
+function allowOriginValue(settings, origin) {
+    return settings.origins === '*' && !settings.credentials ? '*' : origin;
+}
+/** Never echo raw client bytes into a response header: keep only token chars, cap length. */
+function sanitiseRequestHeaders(value) {
+    return value.replace(/[^A-Za-z0-9,\s-]/g, '').slice(0, 1024);
+}
+/** Decorate an actual (non-preflight) response with the CORS headers. */
+function decorateResponse(settings, res, req) {
+    const origin = req.headers['origin'];
+    if (!origin || !isAllowed(settings.origins, origin))
+        return res;
+    const acao = allowOriginValue(settings, origin);
+    const add = { 'access-control-allow-origin': acao };
+    if (settings.credentials)
+        add['access-control-allow-credentials'] = 'true';
+    if (settings.exposedHeaders && settings.exposedHeaders.length > 0) {
+        add['access-control-expose-headers'] = settings.exposedHeaders.join(', ');
+    }
+    let out = applyHeaders(res, add);
+    // A cache must not serve the wrong origin's response back.
+    if (acao !== '*') {
+        out = applyHeaders(out, { vary: appendVary(out.headers?.['vary'], 'Origin') }, { overwrite: true });
+    }
+    return out;
+}
+const PREFLIGHT_VARY = 'Origin, Access-Control-Request-Method, Access-Control-Request-Headers';
+/** Build the 204 preflight response for an allowed (or disallowed) origin. */
+function preflightResponse(settings, methods, req) {
+    const origin = req.headers['origin'];
+    if (!origin || !isAllowed(settings.origins, origin)) {
+        // No ACA-* headers → the browser fails the preflight; no info leak.
+        return { status: 204, headers: { vary: PREFLIGHT_VARY }, body: null };
+    }
+    const headers = {
+        vary: PREFLIGHT_VARY,
+        'access-control-allow-origin': allowOriginValue(settings, origin),
+        'access-control-allow-methods': (settings.methods ?? methods).join(', '),
+    };
+    if (settings.allowedHeaders && settings.allowedHeaders.length > 0) {
+        headers['access-control-allow-headers'] = settings.allowedHeaders.join(', ');
+    }
+    else {
+        const requested = req.headers['access-control-request-headers'];
+        if (requested)
+            headers['access-control-allow-headers'] = sanitiseRequestHeaders(requested);
+    }
+    if (settings.credentials)
+        headers['access-control-allow-credentials'] = 'true';
+    if (settings.maxAge !== undefined)
+        headers['access-control-max-age'] = String(settings.maxAge);
+    return { status: 204, headers, body: null };
+}
+function isPreflight(req) {
+    return req.headers['origin'] !== undefined && req.headers['access-control-request-method'] !== undefined;
+}
+/**
+ * Expand a `cors` node's compiled children: decorate real responses, fold
+ * an origin check into WebSocket upgrades, and synthesise a per-pattern
+ * `OPTIONS` preflight (or intercept a user-defined one).
+ */
+export function expandCors(children, settings) {
+    // Methods registered per pattern (a WS route occupies GET).
+    const methodsByPattern = new Map();
+    const record = (pattern, method) => {
+        const set = methodsByPattern.get(pattern) ?? new Set();
+        set.add(method);
+        methodsByPattern.set(pattern, set);
+    };
+    for (const c of children) {
+        if (c.kind === 'http')
+            record(c.pattern, c.method);
+        else if (c.kind === 'websocket')
+            record(c.pattern, 'GET');
+    }
+    const out = [];
+    const patternsWithOptions = new Set();
+    for (const c of children) {
+        if (c.kind === 'websocket') {
+            const inner = c.authorize;
+            out.push({
+                ...c,
+                authorize: async (req) => {
+                    const origin = req.headers['origin'];
+                    if (origin !== undefined && !isAllowed(settings.origins, origin)) {
+                        return { status: 403, body: { error: 'cross-origin WebSocket upgrade rejected' } };
+                    }
+                    return inner(req);
+                },
+            });
+            continue;
+        }
+        if (c.kind === 'fallback') {
+            const handler = c.handler;
+            out.push({ ...c, handler: async (req) => decorateResponse(settings, await handler(req), req) });
+            continue;
+        }
+        // http
+        if (c.method === 'OPTIONS') {
+            patternsWithOptions.add(c.pattern);
+            const methods = [...(methodsByPattern.get(c.pattern) ?? new Set())];
+            const userHandler = c.handler;
+            out.push({
+                ...c,
+                handler: async (req) => isPreflight(req) ? preflightResponse(settings, methods, req) : decorateResponse(settings, await userHandler(req), req),
+            });
+        }
+        else {
+            const handler = c.handler;
+            out.push({ ...c, handler: async (req) => decorateResponse(settings, await handler(req), req) });
+        }
+    }
+    for (const [pattern, methods] of methodsByPattern) {
+        if (patternsWithOptions.has(pattern))
+            continue;
+        const methodList = [...methods];
+        out.push({
+            kind: 'http',
+            method: 'OPTIONS',
+            pattern,
+            handler: (req) => preflightResponse(settings, methodList, req),
+        });
+    }
+    return out;
+}
+//# sourceMappingURL=Cors.js.map

package/dist/http/middleware/Cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Cors.js","sourceRoot":"","sources":["../../../src/http/middleware/Cors.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAA2D,MAAM,kBAAkB,CAAC;AAYjH;;;;;GAKG;AACH,MAAM,UAAU,IAAI,CAAC,OAAoB,EAAE,KAAY;IACrD,MAAM,eAAe,GAAG,OAAmC,CAAC;IAC5D,IAAI,eAAe,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,iGAAiG,CAAC,CAAC;IACrH,CAAC;IACD,IAAI,oBAAoB,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAqB;QACjC,OAAO,EAAE,eAAe,CAAC,OAAO;QAChC,OAAO,EAAE,eAAe,CAAC,OAAO;QAChC,cAAc,EAAE,eAAe,CAAC,cAAc;QAC9C,cAAc,EAAE,eAAe,CAAC,cAAc;QAC9C,WAAW,EAAE,eAAe,CAAC,WAAW,IAAI,KAAK;QACjD,MAAM,EAAE,eAAe,CAAC,MAAM;KAC/B,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,SAAS,CAAC,OAAmB,EAAE,MAAc;IACpD,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;QAClC,IAAI,CAAC;YAAC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;IACzD,CAAC;IACD,OAAO,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAED,uFAAuF;AACvF,SAAS,gBAAgB,CAAC,QAA0B,EAAE,MAAc;IAClE,OAAO,QAAQ,CAAC,OAAO,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;AAC1E,CAAC;AAED,6FAA6F;AAC7F,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED,yEAAyE;AACzE,SAAS,gBAAgB,CAAC,QAA0B,EAAE,GAAiB,EAAE,GAAgB;IACvF,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAE,OAAO,GAAG,CAAC;IAChE,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,GAAG,GAA2B,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC;IAC5E,IAAI,QAAQ,CAAC,WAAW;QAAE,GAAG,CAAC,kCAAkC,CAAC,GAAG,MAAM,CAAC;IAC3E,IAAI,QAAQ,CAAC,cAAc,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,+BAA+B,CAAC,GAAG,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjC,2DAA2D;IAC3D,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACjB,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,cAAc,GAAG,uEAAuE,CAAC;AAE/F,8EAA8E;AAC9E,SAAS,iBAAiB,CAAC,QAA0B,EAAE,OAA8B,EAAE,GAAgB;IACrG,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QACpD,oEAAoE;QACpE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxE,CAAC;IACD,MAAM,OAAO,GAA2B;QACtC,IAAI,EAAE,cAAc;QACpB,6BAA6B,EAAE,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC;QACjE,8BAA8B,EAAE,CAAC,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;KACzE,CAAC;IACF,IAAI,QAAQ,CAAC,cAAc,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,CAAC,8BAA8B,CAAC,GAAG,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/E,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;QAChE,IAAI,SAAS;YAAE,OAAO,CAAC,8BAA8B,CAAC,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,QAAQ,CAAC,WAAW;QAAE,OAAO,CAAC,kCAAkC,CAAC,GAAG,MAAM,CAAC;IAC/E,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,wBAAwB,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/F,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,WAAW,CAAC,GAAgB;IACnC,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,+BAA+B,CAAC,KAAK,SAAS,CAAC;AAC3G,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,QAA4B,EAAE,QAA0B;IACjF,4DAA4D;IAC5D,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAuB,CAAC;IACxD,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,MAAc,EAAQ,EAAE;QACvD,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QAC/D,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChB,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;YAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;aAC9C,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW;YAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE9C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,CAAC,CAAC,SAAS,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC;gBACP,GAAG,CAAC;gBACJ,SAAS,EAAE,KAAK,EAAE,GAAgB,EAAgC,EAAE;oBAClE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;oBACrC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;wBACjE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,yCAAyC,EAAE,EAAE,CAAC;oBACrF,CAAC;oBACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;gBACpB,CAAC;aACF,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAChG,SAAS;QACX,CAAC;QACD,OAAO;QACP,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC3B,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACnC,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC,CAAC,CAAC;YAC5E,MAAM,WAAW,GAAG,CAAC,CAAC,OAAO,CAAC;YAC9B,GAAG,CAAC,IAAI,CAAC;gBACP,GAAG,CAAC;gBACJ,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,WAAW,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC;aAC/I,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,gBAAgB,EAAE,CAAC;QAClD,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAC/C,MAAM,UAAU,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;QAChC,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,SAAS;YACjB,OAAO;YACP,OAAO,EAAE,CAAC,GAAgB,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC;SAC5E,CAAC,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/http/middleware/CorsOptions.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Options for the {@link cors} route directive.  CORS is a *directive*,
+ * not a plain middleware: preflight `OPTIONS` requests never match a
+ * method-specific route, so the compiler has to synthesise them (see
+ * `expandCors`).  Options-only (per-route policy; predicates can't live in
+ * HOCON anyway).
+ */
+import { OptionsBuilder } from '../../util/OptionsBuilder.js';
+import { OptionsValidator } from '../../util/OptionsValidator.js';
+import type { HttpMethod } from '../types.js';
+/** Allowed origins: `'*'`, an exact-match allowlist, or a predicate. */
+export type CorsOrigin = '*' | ReadonlyArray<string> | ((origin: string) => boolean);
+/** Plain settings shape for CORS. */
+export interface CorsOptionsType {
+    /** Required — call withOrigins/withAnyOrigin/withOriginPredicate. */
+    readonly origins?: CorsOrigin;
+    /** `Access-Control-Allow-Methods`.  Default: the methods registered at the pattern. */
+    readonly methods?: ReadonlyArray<HttpMethod>;
+    /** `Access-Control-Allow-Headers`.  Default: echo the (sanitised) request's. */
+    readonly allowedHeaders?: ReadonlyArray<string>;
+    /** `Access-Control-Expose-Headers`.  Default: none. */
+    readonly exposedHeaders?: ReadonlyArray<string>;
+    /** `Access-Control-Allow-Credentials`.  Default false; forbidden with `'*'`. */
+    readonly credentials?: boolean;
+    /** `Access-Control-Max-Age` in seconds.  Default: unset. */
+    readonly maxAge?: number;
+}
+/** Fluent builder for {@link CorsOptionsType}. */
+export declare class CorsOptionsBuilder extends OptionsBuilder<CorsOptionsType> {
+    static create(): CorsOptionsBuilder;
+    /** Exact-match origin allowlist. */
+    withOrigins(...origins: string[]): this;
+    /** Allow any origin (`*`).  Must be explicit — no accidental wildcard. */
+    withAnyOrigin(): this;
+    /** Decide per request; a throwing predicate denies. */
+    withOriginPredicate(fn: (origin: string) => boolean): this;
+    withMethods(...methods: HttpMethod[]): this;
+    withAllowedHeaders(...headers: string[]): this;
+    withExposedHeaders(...headers: string[]): this;
+    withCredentials(flag?: boolean): this;
+    withMaxAge(seconds: number): this;
+}
+/** Accepted input: the builder or a plain object. */
+export type CorsOptions = CorsOptionsBuilder | Partial<CorsOptionsType>;
+export declare const CorsOptions: typeof CorsOptionsBuilder;
+/**
+ * Validates resolved {@link CorsOptionsType} settings.  `maxAge` (the
+ * preflight cache lifetime, in seconds) must be non-negative; the
+ * cross-field rule enforces the Fetch spec's ban on combining
+ * `credentials` with a wildcard (`'*'`) origin.  (The required-ness of
+ * `origins` is a separate guard in `cors()`.)
+ */
+export declare class CorsOptionsValidator extends OptionsValidator<CorsOptionsType> {
+    constructor();
+    protected rules(s: Partial<CorsOptionsType>): void;
+}
+//# sourceMappingURL=CorsOptions.d.ts.map

package/dist/http/middleware/CorsOptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CorsOptions.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/CorsOptions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,wEAAwE;AACxE,MAAM,MAAM,UAAU,GAAG,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC;AAErF,qCAAqC;AACrC,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;IAC9B,uFAAuF;IACvF,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IAC7C,gFAAgF;IAChF,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD,uDAAuD;IACvD,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD,gFAAgF;IAChF,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,kDAAkD;AAClD,qBAAa,kBAAmB,SAAQ,cAAc,CAAC,eAAe,CAAC;IACrE,MAAM,CAAC,MAAM,IAAI,kBAAkB;IAGnC,oCAAoC;IACpC,WAAW,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI;IAGvC,0EAA0E;IAC1E,aAAa,IAAI,IAAI;IAGrB,uDAAuD;IACvD,mBAAmB,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI;IAG1D,WAAW,CAAC,GAAG,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI;IAG3C,kBAAkB,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI;IAG9C,kBAAkB,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI;IAG9C,eAAe,CAAC,IAAI,UAAO,GAAG,IAAI;IAGlC,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;CAGlC;AAED,qDAAqD;AACrD,MAAM,MAAM,WAAW,GAAG,kBAAkB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;AACxE,eAAO,MAAM,WAAW,2BAAqB,CAAC;AAE9C;;;;;;GAMG;AACH,qBAAa,oBAAqB,SAAQ,gBAAgB,CAAC,eAAe,CAAC;;IAIzE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI;CAMnD"}

package/dist/http/middleware/CorsOptions.js

@@ -0,0 +1,62 @@
+/**
+ * Options for the {@link cors} route directive.  CORS is a *directive*,
+ * not a plain middleware: preflight `OPTIONS` requests never match a
+ * method-specific route, so the compiler has to synthesise them (see
+ * `expandCors`).  Options-only (per-route policy; predicates can't live in
+ * HOCON anyway).
+ */
+import { OptionsBuilder } from '../../util/OptionsBuilder.js';
+import { OptionsValidator } from '../../util/OptionsValidator.js';
+/** Fluent builder for {@link CorsOptionsType}. */
+export class CorsOptionsBuilder extends OptionsBuilder {
+    static create() {
+        return new CorsOptionsBuilder();
+    }
+    /** Exact-match origin allowlist. */
+    withOrigins(...origins) {
+        return this.set('origins', origins);
+    }
+    /** Allow any origin (`*`).  Must be explicit — no accidental wildcard. */
+    withAnyOrigin() {
+        return this.set('origins', '*');
+    }
+    /** Decide per request; a throwing predicate denies. */
+    withOriginPredicate(fn) {
+        return this.set('origins', fn);
+    }
+    withMethods(...methods) {
+        return this.set('methods', methods);
+    }
+    withAllowedHeaders(...headers) {
+        return this.set('allowedHeaders', headers);
+    }
+    withExposedHeaders(...headers) {
+        return this.set('exposedHeaders', headers);
+    }
+    withCredentials(flag = true) {
+        return this.set('credentials', flag);
+    }
+    withMaxAge(seconds) {
+        return this.set('maxAge', seconds);
+    }
+}
+export const CorsOptions = CorsOptionsBuilder;
+/**
+ * Validates resolved {@link CorsOptionsType} settings.  `maxAge` (the
+ * preflight cache lifetime, in seconds) must be non-negative; the
+ * cross-field rule enforces the Fetch spec's ban on combining
+ * `credentials` with a wildcard (`'*'`) origin.  (The required-ness of
+ * `origins` is a separate guard in `cors()`.)
+ */
+export class CorsOptionsValidator extends OptionsValidator {
+    constructor() {
+        super('CorsOptions');
+    }
+    rules(s) {
+        this.nonNegativeNumber('maxAge');
+        if (s.credentials === true && s.origins === '*') {
+            this.fail('credentials', 'cannot be combined with "*" origins (the Fetch spec forbids it)', s.credentials);
+        }
+    }
+}
+//# sourceMappingURL=CorsOptions.js.map

package/dist/http/middleware/CorsOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CorsOptions.js","sourceRoot":"","sources":["../../../src/http/middleware/CorsOptions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAsBlE,kDAAkD;AAClD,MAAM,OAAO,kBAAmB,SAAQ,cAA+B;IACrE,MAAM,CAAC,MAAM;QACX,OAAO,IAAI,kBAAkB,EAAE,CAAC;IAClC,CAAC;IACD,oCAAoC;IACpC,WAAW,CAAC,GAAG,OAAiB;QAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,0EAA0E;IAC1E,aAAa;QACX,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAClC,CAAC;IACD,uDAAuD;IACvD,mBAAmB,CAAC,EAA+B;QACjD,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,WAAW,CAAC,GAAG,OAAqB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,kBAAkB,CAAC,GAAG,OAAiB;QACrC,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IACD,kBAAkB,CAAC,GAAG,OAAiB;QACrC,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IACD,eAAe,CAAC,IAAI,GAAG,IAAI;QACzB,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,UAAU,CAAC,OAAe;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;CACF;AAID,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,OAAO,oBAAqB,SAAQ,gBAAiC;IACzE;QACE,KAAK,CAAC,aAAa,CAAC,CAAC;IACvB,CAAC;IACS,KAAK,CAAC,CAA2B;QACzC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,GAAG,EAAE,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,iEAAiE,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;CACF"}

package/dist/http/middleware/Csp.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Content-Security-Policy middleware — a small, typed, helmet-parity CSP
+ * builder.  Nonce support is intentionally omitted for now (the framework
+ * has no template/SSR integration to consume a per-request nonce); a
+ * handler that needs one generates it and sets its own CSP header, and
+ * this middleware backs off because it never overwrites a header the
+ * handler already set.
+ */
+import type { Middleware } from '../Route.js';
+import type { CspOptions } from './CspOptions.js';
+/** Build a middleware that adds a Content-Security-Policy header. */
+export declare function contentSecurityPolicy(options?: CspOptions): Middleware;
+//# sourceMappingURL=Csp.d.ts.map

package/dist/http/middleware/Csp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Csp.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/Csp.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,KAAK,EAAiB,UAAU,EAAkB,MAAM,iBAAiB,CAAC;AA4DjF,qEAAqE;AACrE,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,UAAe,GAAG,UAAU,CAO1E"}

package/dist/http/middleware/Csp.js

@@ -0,0 +1,68 @@
+import { applyHeaders } from './headers.js';
+/** helmet-parity baseline, merged under user directives when `useDefaults`. */
+const BASELINE = {
+    defaultSrc: ["'self'"],
+    baseUri: ["'self'"],
+    fontSrc: ["'self'", 'https:', 'data:'],
+    formAction: ["'self'"],
+    frameAncestors: ["'self'"],
+    imgSrc: ["'self'", 'data:'],
+    objectSrc: ["'none'"],
+    scriptSrc: ["'self'"],
+    scriptSrcAttr: ["'none'"],
+    styleSrc: ["'self'", 'https:', "'unsafe-inline'"],
+    upgradeInsecureRequests: true,
+};
+/** Emission order + camelCase→kebab-case directive names for list-valued directives. */
+const LIST_DIRECTIVES = [
+    ['defaultSrc', 'default-src'],
+    ['scriptSrc', 'script-src'],
+    ['scriptSrcAttr', 'script-src-attr'],
+    ['styleSrc', 'style-src'],
+    ['imgSrc', 'img-src'],
+    ['connectSrc', 'connect-src'],
+    ['fontSrc', 'font-src'],
+    ['objectSrc', 'object-src'],
+    ['mediaSrc', 'media-src'],
+    ['frameSrc', 'frame-src'],
+    ['frameAncestors', 'frame-ancestors'],
+    ['baseUri', 'base-uri'],
+    ['formAction', 'form-action'],
+    ['workerSrc', 'worker-src'],
+    ['manifestSrc', 'manifest-src'],
+    ['reportUri', 'report-uri'],
+];
+/** A source token may not contain characters that would break out of the directive. */
+function assertSafeToken(token, directive) {
+    if (/[;,]/.test(token) || /\s/.test(token)) {
+        throw new Error(`contentSecurityPolicy: invalid source "${token}" in ${directive} (no ";", ",", or whitespace)`);
+    }
+}
+function serialize(directives) {
+    const parts = [];
+    for (const [key, name] of LIST_DIRECTIVES) {
+        const sources = directives[key];
+        if (!sources || sources.length === 0)
+            continue; // absent or explicitly emptied → dropped
+        for (const s of sources)
+            assertSafeToken(s, name);
+        parts.push(`${name} ${sources.join(' ')}`);
+    }
+    if (directives.reportTo) {
+        assertSafeToken(directives.reportTo, 'report-to');
+        parts.push(`report-to ${directives.reportTo}`);
+    }
+    if (directives.upgradeInsecureRequests)
+        parts.push('upgrade-insecure-requests');
+    return parts.join('; ');
+}
+/** Build a middleware that adds a Content-Security-Policy header. */
+export function contentSecurityPolicy(options = {}) {
+    const resolvedOptions = options;
+    const useDefaults = resolvedOptions.useDefaults ?? true;
+    const merged = useDefaults ? { ...BASELINE, ...(resolvedOptions.directives ?? {}) } : (resolvedOptions.directives ?? {});
+    const value = serialize(merged);
+    const header = (resolvedOptions.reportOnly ?? false) ? 'content-security-policy-report-only' : 'content-security-policy';
+    return async (_req, next) => applyHeaders(await next(), { [header]: value });
+}
+//# sourceMappingURL=Csp.js.map

package/dist/http/middleware/Csp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Csp.js","sourceRoot":"","sources":["../../../src/http/middleware/Csp.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5C,+EAA+E;AAC/E,MAAM,QAAQ,GAAkB;IAC9B,UAAU,EAAE,CAAC,QAAQ,CAAC;IACtB,OAAO,EAAE,CAAC,QAAQ,CAAC;IACnB,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC;IACtC,UAAU,EAAE,CAAC,QAAQ,CAAC;IACtB,cAAc,EAAE,CAAC,QAAQ,CAAC;IAC1B,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,SAAS,EAAE,CAAC,QAAQ,CAAC;IACrB,SAAS,EAAE,CAAC,QAAQ,CAAC;IACrB,aAAa,EAAE,CAAC,QAAQ,CAAC;IACzB,QAAQ,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,CAAC;IACjD,uBAAuB,EAAE,IAAI;CAC9B,CAAC;AAEF,wFAAwF;AACxF,MAAM,eAAe,GAA0D;IAC7E,CAAC,YAAY,EAAE,aAAa,CAAC;IAC7B,CAAC,WAAW,EAAE,YAAY,CAAC;IAC3B,CAAC,eAAe,EAAE,iBAAiB,CAAC;IACpC,CAAC,UAAU,EAAE,WAAW,CAAC;IACzB,CAAC,QAAQ,EAAE,SAAS,CAAC;IACrB,CAAC,YAAY,EAAE,aAAa,CAAC;IAC7B,CAAC,SAAS,EAAE,UAAU,CAAC;IACvB,CAAC,WAAW,EAAE,YAAY,CAAC;IAC3B,CAAC,UAAU,EAAE,WAAW,CAAC;IACzB,CAAC,UAAU,EAAE,WAAW,CAAC;IACzB,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IACrC,CAAC,SAAS,EAAE,UAAU,CAAC;IACvB,CAAC,YAAY,EAAE,aAAa,CAAC;IAC7B,CAAC,WAAW,EAAE,YAAY,CAAC;IAC3B,CAAC,aAAa,EAAE,cAAc,CAAC;IAC/B,CAAC,WAAW,EAAE,YAAY,CAAC;CAC5B,CAAC;AAEF,uFAAuF;AACvF,SAAS,eAAe,CAAC,KAAa,EAAE,SAAiB;IACvD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,0CAA0C,KAAK,QAAQ,SAAS,+BAA+B,CAAC,CAAC;IACnH,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,UAAyB;IAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,eAAe,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAkC,CAAC;QACjE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS,CAAC,yCAAyC;QACzF,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;QACxB,eAAe,CAAC,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,aAAa,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,UAAU,CAAC,uBAAuB;QAAE,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAChF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,qBAAqB,CAAC,UAAsB,EAAE;IAC5D,MAAM,eAAe,GAAG,OAAkC,CAAC;IAC3D,MAAM,WAAW,GAAG,eAAe,CAAC,WAAW,IAAI,IAAI,CAAC;IACxD,MAAM,MAAM,GAAkB,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,CAAC,eAAe,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACxI,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,CAAC,eAAe,CAAC,UAAU,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,yBAAyB,CAAC;IACzH,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,IAAI,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/E,CAAC"}

package/dist/http/middleware/CspOptions.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Options for the {@link contentSecurityPolicy} middleware.  Options-only
+ * (no HOCON — an app's CSP is code, and nested directive maps are awkward
+ * in config).
+ */
+import { OptionsBuilder } from '../../util/OptionsBuilder.js';
+/**
+ * Typed CSP directive map.  camelCase keys serialise to their kebab-case
+ * directive names.  A directive present with an empty array is dropped
+ * (lets you remove a baseline directive by setting it to `[]`).
+ */
+export interface CspDirectives {
+    readonly defaultSrc?: readonly string[];
+    readonly scriptSrc?: readonly string[];
+    readonly scriptSrcAttr?: readonly string[];
+    readonly styleSrc?: readonly string[];
+    readonly imgSrc?: readonly string[];
+    readonly connectSrc?: readonly string[];
+    readonly fontSrc?: readonly string[];
+    readonly objectSrc?: readonly string[];
+    readonly mediaSrc?: readonly string[];
+    readonly frameSrc?: readonly string[];
+    readonly frameAncestors?: readonly string[];
+    readonly baseUri?: readonly string[];
+    readonly formAction?: readonly string[];
+    readonly workerSrc?: readonly string[];
+    readonly manifestSrc?: readonly string[];
+    /** Valueless directive. */
+    readonly upgradeInsecureRequests?: boolean;
+    readonly reportUri?: readonly string[];
+    readonly reportTo?: string;
+}
+/** Plain settings shape for CSP. */
+export interface CspOptionsType {
+    /** Directives to emit; merged over the baseline unless `useDefaults` is false. */
+    readonly directives?: CspDirectives;
+    /** Merge over a helmet-parity baseline.  Default true. */
+    readonly useDefaults?: boolean;
+    /** Emit `Content-Security-Policy-Report-Only` instead of enforcing.  Default false. */
+    readonly reportOnly?: boolean;
+}
+/** Fluent builder for {@link CspOptionsType}. */
+export declare class CspOptionsBuilder extends OptionsBuilder<CspOptionsType> {
+    static create(): CspOptionsBuilder;
+    withDirectives(directives: CspDirectives): this;
+    /** Emit only the given directives — skip the baseline. */
+    withoutDefaults(): this;
+    withReportOnly(flag?: boolean): this;
+}
+/** Accepted input: the builder or a plain object. */
+export type CspOptions = CspOptionsBuilder | Partial<CspOptionsType>;
+export declare const CspOptions: typeof CspOptionsBuilder;
+//# sourceMappingURL=CspOptions.d.ts.map

package/dist/http/middleware/CspOptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CspOptions.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/CspOptions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9D;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,2BAA2B;IAC3B,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,oCAAoC;AACpC,MAAM,WAAW,cAAc;IAC7B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC;IACpC,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,uFAAuF;IACvF,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,iDAAiD;AACjD,qBAAa,iBAAkB,SAAQ,cAAc,CAAC,cAAc,CAAC;IACnE,MAAM,CAAC,MAAM,IAAI,iBAAiB;IAGlC,cAAc,CAAC,UAAU,EAAE,aAAa,GAAG,IAAI;IAG/C,0DAA0D;IAC1D,eAAe,IAAI,IAAI;IAGvB,cAAc,CAAC,IAAI,UAAO,GAAG,IAAI;CAGlC;AAED,qDAAqD;AACrD,MAAM,MAAM,UAAU,GAAG,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;AACrE,eAAO,MAAM,UAAU,0BAAoB,CAAC"}

package/dist/http/middleware/CspOptions.js

@@ -0,0 +1,24 @@
+/**
+ * Options for the {@link contentSecurityPolicy} middleware.  Options-only
+ * (no HOCON — an app's CSP is code, and nested directive maps are awkward
+ * in config).
+ */
+import { OptionsBuilder } from '../../util/OptionsBuilder.js';
+/** Fluent builder for {@link CspOptionsType}. */
+export class CspOptionsBuilder extends OptionsBuilder {
+    static create() {
+        return new CspOptionsBuilder();
+    }
+    withDirectives(directives) {
+        return this.set('directives', directives);
+    }
+    /** Emit only the given directives — skip the baseline. */
+    withoutDefaults() {
+        return this.set('useDefaults', false);
+    }
+    withReportOnly(flag = true) {
+        return this.set('reportOnly', flag);
+    }
+}
+export const CspOptions = CspOptionsBuilder;
+//# sourceMappingURL=CspOptions.js.map

package/dist/http/middleware/CspOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CspOptions.js","sourceRoot":"","sources":["../../../src/http/middleware/CspOptions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAuC9D,iDAAiD;AACjD,MAAM,OAAO,iBAAkB,SAAQ,cAA8B;IACnE,MAAM,CAAC,MAAM;QACX,OAAO,IAAI,iBAAiB,EAAE,CAAC;IACjC,CAAC;IACD,cAAc,CAAC,UAAyB;QACtC,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAC5C,CAAC;IACD,0DAA0D;IAC1D,eAAe;QACb,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;IACD,cAAc,CAAC,IAAI,GAAG,IAAI;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;CACF;AAID,MAAM,CAAC,MAAM,UAAU,GAAG,iBAAiB,CAAC"}

package/dist/http/middleware/Csrf.d.ts

@@ -0,0 +1,22 @@
+import type { Middleware } from '../Route.js';
+import { type HttpRequest } from '../types.js';
+import { type CsrfOptions, type SameOriginOptions } from './CsrfOptions.js';
+/**
+ * Reject unsafe-method requests (POST/PUT/PATCH/DELETE) whose
+ * Origin/Referer is cross-origin.  A lightweight standalone CSRF defence
+ * for modern browsers; {@link csrfProtection} is the belt-and-suspenders
+ * option.
+ */
+export declare function requireSameOrigin(options?: SameOriginOptions): Middleware;
+/**
+ * Read the CSRF token an SSR handler should template into its form/meta —
+ * the forwarded request header first (present from the very first GET),
+ * then the cookie.
+ */
+export declare function readCsrfToken(req: HttpRequest, opts?: {
+    cookieName?: string;
+    headerName?: string;
+}): string | null;
+/** Build the stateless double-submit CSRF middleware. */
+export declare function csrfProtection(options: CsrfOptions): Middleware;
+//# sourceMappingURL=Csrf.d.ts.map

package/dist/http/middleware/Csrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Csrf.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/Csrf.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAGlE,OAAO,EAEL,KAAK,WAAW,EAEhB,KAAK,iBAAiB,EAEvB,MAAM,kBAAkB,CAAC;AAuB1B;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,iBAAsB,GAAG,UAAU,CAS7E;AAsCD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,MAAM,GAAG,IAAI,CAItH;AAED,yDAAyD;AACzD,wBAAgB,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CAsD/D"}