actor-ts 0.10.0 → 0.11.0

package/dist/http/middleware/RequestIdOptions.d.ts

@@ -0,0 +1,22 @@
+/** Options for the {@link requestId} middleware.  Options-only. */
+import { OptionsBuilder } from '../../util/OptionsBuilder.js';
+/** Plain settings shape for request-id. */
+export interface RequestIdOptionsType {
+    /** Header carrying the id, in + out.  Default `'x-request-id'`. */
+    readonly headerName?: string;
+    /** Accept a well-formed incoming id instead of always generating.  Default true. */
+    readonly trustIncoming?: boolean;
+    /** Id generator.  Default `crypto.randomUUID()`. */
+    readonly generate?: () => string;
+}
+/** Fluent builder for {@link RequestIdOptionsType}. */
+export declare class RequestIdOptionsBuilder extends OptionsBuilder<RequestIdOptionsType> {
+    static create(): RequestIdOptionsBuilder;
+    withHeaderName(name: string): this;
+    withTrustIncoming(flag?: boolean): this;
+    withGenerate(fn: () => string): this;
+}
+/** Accepted input: the builder or a plain object. */
+export type RequestIdOptions = RequestIdOptionsBuilder | Partial<RequestIdOptionsType>;
+export declare const RequestIdOptions: typeof RequestIdOptionsBuilder;
+//# sourceMappingURL=RequestIdOptions.d.ts.map

package/dist/http/middleware/RequestIdOptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RequestIdOptions.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/RequestIdOptions.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9D,2CAA2C;AAC3C,MAAM,WAAW,oBAAoB;IACnC,mEAAmE;IACnE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,oDAAoD;IACpD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAC;CAClC;AAED,uDAAuD;AACvD,qBAAa,uBAAwB,SAAQ,cAAc,CAAC,oBAAoB,CAAC;IAC/E,MAAM,CAAC,MAAM,IAAI,uBAAuB;IAGxC,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAGlC,iBAAiB,CAAC,IAAI,UAAO,GAAG,IAAI;IAGpC,YAAY,CAAC,EAAE,EAAE,MAAM,MAAM,GAAG,IAAI;CAGrC;AAED,qDAAqD;AACrD,MAAM,MAAM,gBAAgB,GAAG,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;AACvF,eAAO,MAAM,gBAAgB,gCAA0B,CAAC"}

package/dist/http/middleware/RequestIdOptions.js

@@ -0,0 +1,19 @@
+/** Options for the {@link requestId} middleware.  Options-only. */
+import { OptionsBuilder } from '../../util/OptionsBuilder.js';
+/** Fluent builder for {@link RequestIdOptionsType}. */
+export class RequestIdOptionsBuilder extends OptionsBuilder {
+    static create() {
+        return new RequestIdOptionsBuilder();
+    }
+    withHeaderName(name) {
+        return this.set('headerName', name);
+    }
+    withTrustIncoming(flag = true) {
+        return this.set('trustIncoming', flag);
+    }
+    withGenerate(fn) {
+        return this.set('generate', fn);
+    }
+}
+export const RequestIdOptions = RequestIdOptionsBuilder;
+//# sourceMappingURL=RequestIdOptions.js.map

package/dist/http/middleware/RequestIdOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RequestIdOptions.js","sourceRoot":"","sources":["../../../src/http/middleware/RequestIdOptions.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAY9D,uDAAuD;AACvD,MAAM,OAAO,uBAAwB,SAAQ,cAAoC;IAC/E,MAAM,CAAC,MAAM;QACX,OAAO,IAAI,uBAAuB,EAAE,CAAC;IACvC,CAAC;IACD,cAAc,CAAC,IAAY;QACzB,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,iBAAiB,CAAC,IAAI,GAAG,IAAI;QAC3B,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IACD,YAAY,CAAC,EAAgB;QAC3B,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAClC,CAAC;CACF;AAID,MAAM,CAAC,MAAM,gBAAgB,GAAG,uBAAuB,CAAC"}

package/dist/http/middleware/SecurityHeaders.d.ts

@@ -0,0 +1,11 @@
+/**
+ * A small, typed, helmet-style bundle of sensible security response
+ * headers.  Every header is overridable and disable-able (`false`), the
+ * handler's own header always wins, and CSP is deliberately excluded (too
+ * app-specific — see {@link contentSecurityPolicy}).
+ */
+import type { Middleware } from '../Route.js';
+import type { SecurityHeadersOptions } from './SecurityHeadersOptions.js';
+/** Build a middleware that adds the configured security headers to every response. */
+export declare function securityHeaders(options?: SecurityHeadersOptions): Middleware;
+//# sourceMappingURL=SecurityHeaders.d.ts.map

package/dist/http/middleware/SecurityHeaders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityHeaders.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/SecurityHeaders.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG9C,OAAO,KAAK,EAAE,sBAAsB,EAA8B,MAAM,6BAA6B,CAAC;AAoBtG,sFAAsF;AACtF,wBAAgB,eAAe,CAAC,OAAO,GAAE,sBAA2B,GAAG,UAAU,CA8BhF"}

package/dist/http/middleware/SecurityHeaders.js

@@ -0,0 +1,50 @@
+import { applyHeaders } from './headers.js';
+import { hstsHeaderValue, resolveHsts } from './Hsts.js';
+const FEATURE_RE = /^[a-z][a-z-]*$/;
+function serializePermissionsPolicy(policy) {
+    const parts = [];
+    for (const [feature, allow] of Object.entries(policy)) {
+        if (!FEATURE_RE.test(feature)) {
+            throw new Error(`securityHeaders: invalid Permissions-Policy feature "${feature}"`);
+        }
+        for (const item of allow) {
+            if (/[,()]/.test(item)) {
+                throw new Error(`securityHeaders: invalid Permissions-Policy allowlist item "${item}" for "${feature}"`);
+            }
+        }
+        parts.push(`${feature}=(${allow.join(' ')})`);
+    }
+    return parts.join(', ');
+}
+/** Build a middleware that adds the configured security headers to every response. */
+export function securityHeaders(options = {}) {
+    const resolvedOptions = options;
+    const headers = {};
+    if (resolvedOptions.contentTypeOptions ?? true)
+        headers['x-content-type-options'] = 'nosniff';
+    const frame = resolvedOptions.frameOptions ?? 'DENY';
+    if (frame !== false)
+        headers['x-frame-options'] = frame;
+    const referrer = resolvedOptions.referrerPolicy ?? 'no-referrer';
+    if (referrer !== false)
+        headers['referrer-policy'] = referrer;
+    const coop = resolvedOptions.crossOriginOpenerPolicy ?? 'same-origin';
+    if (coop !== false)
+        headers['cross-origin-opener-policy'] = coop;
+    const corp = resolvedOptions.crossOriginResourcePolicy ?? 'same-origin';
+    if (corp !== false)
+        headers['cross-origin-resource-policy'] = corp;
+    const coep = resolvedOptions.crossOriginEmbedderPolicy ?? false;
+    if (coep !== false)
+        headers['cross-origin-embedder-policy'] = coep;
+    if (resolvedOptions.xssProtection ?? true)
+        headers['x-xss-protection'] = '0';
+    const pp = resolvedOptions.permissionsPolicy ?? false;
+    if (pp !== false)
+        headers['permissions-policy'] = serializePermissionsPolicy(pp);
+    const hstsOpt = resolvedOptions.hsts ?? false;
+    if (hstsOpt !== false)
+        headers['strict-transport-security'] = hstsHeaderValue(resolveHsts(hstsOpt));
+    return async (_req, next) => applyHeaders(await next(), headers);
+}
+//# sourceMappingURL=SecurityHeaders.js.map

package/dist/http/middleware/SecurityHeaders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityHeaders.js","sourceRoot":"","sources":["../../../src/http/middleware/SecurityHeaders.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAGzD,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAEpC,SAAS,0BAA0B,CAAC,MAAmD;IACrF,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,wDAAwD,OAAO,GAAG,CAAC,CAAC;QACtF,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,+DAA+D,IAAI,UAAU,OAAO,GAAG,CAAC,CAAC;YAC3G,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,eAAe,CAAC,UAAkC,EAAE;IAClE,MAAM,eAAe,GAAG,OAA8C,CAAC;IACvE,MAAM,OAAO,GAA2B,EAAE,CAAC;IAE3C,IAAI,eAAe,CAAC,kBAAkB,IAAI,IAAI;QAAE,OAAO,CAAC,wBAAwB,CAAC,GAAG,SAAS,CAAC;IAE9F,MAAM,KAAK,GAAG,eAAe,CAAC,YAAY,IAAI,MAAM,CAAC;IACrD,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,KAAK,CAAC;IAExD,MAAM,QAAQ,GAAG,eAAe,CAAC,cAAc,IAAI,aAAa,CAAC;IACjE,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,QAAQ,CAAC;IAE9D,MAAM,IAAI,GAAG,eAAe,CAAC,uBAAuB,IAAI,aAAa,CAAC;IACtE,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,CAAC,4BAA4B,CAAC,GAAG,IAAI,CAAC;IAEjE,MAAM,IAAI,GAAG,eAAe,CAAC,yBAAyB,IAAI,aAAa,CAAC;IACxE,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,CAAC,8BAA8B,CAAC,GAAG,IAAI,CAAC;IAEnE,MAAM,IAAI,GAAG,eAAe,CAAC,yBAAyB,IAAI,KAAK,CAAC;IAChE,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,CAAC,8BAA8B,CAAC,GAAG,IAAI,CAAC;IAEnE,IAAI,eAAe,CAAC,aAAa,IAAI,IAAI;QAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,GAAG,CAAC;IAE7E,MAAM,EAAE,GAAG,eAAe,CAAC,iBAAiB,IAAI,KAAK,CAAC;IACtD,IAAI,EAAE,KAAK,KAAK;QAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,0BAA0B,CAAC,EAAE,CAAC,CAAC;IAEjF,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,IAAI,KAAK,CAAC;IAC9C,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,CAAC,2BAA2B,CAAC,GAAG,eAAe,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IAEpG,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;AACnE,CAAC"}

package/dist/http/middleware/SecurityHeadersOptions.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Options for the {@link securityHeaders} bundle.  Every header is
+ * individually overridable, and `false` disables it.  Options-only.
+ */
+import { OptionsBuilder } from '../../util/OptionsBuilder.js';
+import type { HstsOptionsType } from './HstsOptions.js';
+/** Plain settings shape for the security-headers bundle. */
+export interface SecurityHeadersOptionsType {
+    /** `X-Content-Type-Options: nosniff`.  Default true. */
+    readonly contentTypeOptions?: boolean;
+    /** `X-Frame-Options`.  Default `'DENY'`; `false` omits it. */
+    readonly frameOptions?: 'DENY' | 'SAMEORIGIN' | false;
+    /** `Referrer-Policy`.  Default `'no-referrer'`; `false` omits it. */
+    readonly referrerPolicy?: string | false;
+    /** `Permissions-Policy` as feature→allowlist.  Default `false` (omitted). */
+    readonly permissionsPolicy?: Readonly<Record<string, readonly string[]>> | false;
+    /** `Cross-Origin-Opener-Policy`.  Default `'same-origin'`; `false` omits it. */
+    readonly crossOriginOpenerPolicy?: 'same-origin' | 'same-origin-allow-popups' | 'unsafe-none' | false;
+    /** `Cross-Origin-Resource-Policy`.  Default `'same-origin'`; `false` omits it. */
+    readonly crossOriginResourcePolicy?: 'same-origin' | 'same-site' | 'cross-origin' | false;
+    /** `Cross-Origin-Embedder-Policy`.  Default `false` (breaks embeds; opt-in). */
+    readonly crossOriginEmbedderPolicy?: 'require-corp' | 'credentialless' | false;
+    /** `X-XSS-Protection: 0` (disable the buggy legacy filter).  Default true. */
+    readonly xssProtection?: boolean;
+    /** Also emit HSTS with these options.  Default `false` (opt-in — see {@link strictTransportSecurity}). */
+    readonly hsts?: Partial<HstsOptionsType> | false;
+}
+/** Fluent builder for {@link SecurityHeadersOptionsType}. */
+export declare class SecurityHeadersOptionsBuilder extends OptionsBuilder<SecurityHeadersOptionsType> {
+    static create(): SecurityHeadersOptionsBuilder;
+    withContentTypeOptions(flag?: boolean): this;
+    withFrameOptions(value: 'DENY' | 'SAMEORIGIN' | false): this;
+    withReferrerPolicy(value: string | false): this;
+    withPermissionsPolicy(value: Readonly<Record<string, readonly string[]>> | false): this;
+    withCrossOriginOpenerPolicy(value: 'same-origin' | 'same-origin-allow-popups' | 'unsafe-none' | false): this;
+    withCrossOriginResourcePolicy(value: 'same-origin' | 'same-site' | 'cross-origin' | false): this;
+    withCrossOriginEmbedderPolicy(value: 'require-corp' | 'credentialless' | false): this;
+    withXssProtection(flag?: boolean): this;
+    withHsts(value?: Partial<HstsOptionsType> | false): this;
+}
+/** Accepted input: the builder or a plain object. */
+export type SecurityHeadersOptions = SecurityHeadersOptionsBuilder | Partial<SecurityHeadersOptionsType>;
+export declare const SecurityHeadersOptions: typeof SecurityHeadersOptionsBuilder;
+//# sourceMappingURL=SecurityHeadersOptions.d.ts.map

package/dist/http/middleware/SecurityHeadersOptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityHeadersOptions.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/SecurityHeadersOptions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,4DAA4D;AAC5D,MAAM,WAAW,0BAA0B;IACzC,wDAAwD;IACxD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,KAAK,CAAC;IACtD,qEAAqE;IACrE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACzC,6EAA6E;IAC7E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;IACjF,gFAAgF;IAChF,QAAQ,CAAC,uBAAuB,CAAC,EAAE,aAAa,GAAG,0BAA0B,GAAG,aAAa,GAAG,KAAK,CAAC;IACtG,kFAAkF;IAClF,QAAQ,CAAC,yBAAyB,CAAC,EAAE,aAAa,GAAG,WAAW,GAAG,cAAc,GAAG,KAAK,CAAC;IAC1F,gFAAgF;IAChF,QAAQ,CAAC,yBAAyB,CAAC,EAAE,cAAc,GAAG,gBAAgB,GAAG,KAAK,CAAC;IAC/E,8EAA8E;IAC9E,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,0GAA0G;IAC1G,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,KAAK,CAAC;CAClD;AAED,6DAA6D;AAC7D,qBAAa,6BAA8B,SAAQ,cAAc,CAAC,0BAA0B,CAAC;IAC3F,MAAM,CAAC,MAAM,IAAI,6BAA6B;IAG9C,sBAAsB,CAAC,IAAI,UAAO,GAAG,IAAI;IAGzC,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,KAAK,GAAG,IAAI;IAG5D,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,GAAG,IAAI;IAG/C,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI;IAGvF,2BAA2B,CAAC,KAAK,EAAE,aAAa,GAAG,0BAA0B,GAAG,aAAa,GAAG,KAAK,GAAG,IAAI;IAG5G,6BAA6B,CAAC,KAAK,EAAE,aAAa,GAAG,WAAW,GAAG,cAAc,GAAG,KAAK,GAAG,IAAI;IAGhG,6BAA6B,CAAC,KAAK,EAAE,cAAc,GAAG,gBAAgB,GAAG,KAAK,GAAG,IAAI;IAGrF,iBAAiB,CAAC,IAAI,UAAO,GAAG,IAAI;IAGpC,QAAQ,CAAC,KAAK,GAAE,OAAO,CAAC,eAAe,CAAC,GAAG,KAAU,GAAG,IAAI;CAG7D;AAED,qDAAqD;AACrD,MAAM,MAAM,sBAAsB,GAAG,6BAA6B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;AACzG,eAAO,MAAM,sBAAsB,sCAAgC,CAAC"}

package/dist/http/middleware/SecurityHeadersOptions.js

@@ -0,0 +1,40 @@
+/**
+ * Options for the {@link securityHeaders} bundle.  Every header is
+ * individually overridable, and `false` disables it.  Options-only.
+ */
+import { OptionsBuilder } from '../../util/OptionsBuilder.js';
+/** Fluent builder for {@link SecurityHeadersOptionsType}. */
+export class SecurityHeadersOptionsBuilder extends OptionsBuilder {
+    static create() {
+        return new SecurityHeadersOptionsBuilder();
+    }
+    withContentTypeOptions(flag = true) {
+        return this.set('contentTypeOptions', flag);
+    }
+    withFrameOptions(value) {
+        return this.set('frameOptions', value);
+    }
+    withReferrerPolicy(value) {
+        return this.set('referrerPolicy', value);
+    }
+    withPermissionsPolicy(value) {
+        return this.set('permissionsPolicy', value);
+    }
+    withCrossOriginOpenerPolicy(value) {
+        return this.set('crossOriginOpenerPolicy', value);
+    }
+    withCrossOriginResourcePolicy(value) {
+        return this.set('crossOriginResourcePolicy', value);
+    }
+    withCrossOriginEmbedderPolicy(value) {
+        return this.set('crossOriginEmbedderPolicy', value);
+    }
+    withXssProtection(flag = true) {
+        return this.set('xssProtection', flag);
+    }
+    withHsts(value = {}) {
+        return this.set('hsts', value);
+    }
+}
+export const SecurityHeadersOptions = SecurityHeadersOptionsBuilder;
+//# sourceMappingURL=SecurityHeadersOptions.js.map

package/dist/http/middleware/SecurityHeadersOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityHeadersOptions.js","sourceRoot":"","sources":["../../../src/http/middleware/SecurityHeadersOptions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAyB9D,6DAA6D;AAC7D,MAAM,OAAO,6BAA8B,SAAQ,cAA0C;IAC3F,MAAM,CAAC,MAAM;QACX,OAAO,IAAI,6BAA6B,EAAE,CAAC;IAC7C,CAAC;IACD,sBAAsB,CAAC,IAAI,GAAG,IAAI;QAChC,OAAO,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IACD,gBAAgB,CAAC,KAAoC;QACnD,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IACD,kBAAkB,CAAC,KAAqB;QACtC,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IACD,qBAAqB,CAAC,KAA0D;QAC9E,OAAO,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IACD,2BAA2B,CAAC,KAAyE;QACnG,OAAO,IAAI,CAAC,GAAG,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;IACD,6BAA6B,CAAC,KAA2D;QACvF,OAAO,IAAI,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;IACtD,CAAC;IACD,6BAA6B,CAAC,KAAgD;QAC5E,OAAO,IAAI,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;IACtD,CAAC;IACD,iBAAiB,CAAC,IAAI,GAAG,IAAI;QAC3B,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IACD,QAAQ,CAAC,QAA0C,EAAE;QACnD,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;CACF;AAID,MAAM,CAAC,MAAM,sBAAsB,GAAG,6BAA6B,CAAC"}

package/dist/http/middleware/Timeout.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Request-timeout middleware.  Races the handler against a deadline and
+ * returns 503 if it wins.
+ *
+ * Honest limitation: the handler is NOT cancelled — it keeps running, and
+ * its late result is discarded.  This bounds client-observed latency and
+ * how long a response is held open, nothing more.
+ */
+import type { Middleware } from '../Route.js';
+import { type TimeoutOptions } from './TimeoutOptions.js';
+/** Build a middleware that bounds handler latency.  Accepts a bare ms number or options. */
+export declare function requestTimeout(options: number | TimeoutOptions): Middleware;
+//# sourceMappingURL=Timeout.d.ts.map

package/dist/http/middleware/Timeout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Timeout.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/Timeout.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAA2B,KAAK,cAAc,EAA2B,MAAM,qBAAqB,CAAC;AAE5G,4FAA4F;AAC5F,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,UAAU,CAuB3E"}

package/dist/http/middleware/Timeout.js

@@ -0,0 +1,29 @@
+import { Status } from '../types.js';
+import { TimeoutOptionsValidator } from './TimeoutOptions.js';
+/** Build a middleware that bounds handler latency.  Accepts a bare ms number or options. */
+export function requestTimeout(options) {
+    const resolvedOptions = typeof options === 'number' ? { ms: options } : options;
+    new TimeoutOptionsValidator().validate(resolvedOptions);
+    const ms = resolvedOptions.ms ?? 30_000;
+    const onTimeout = resolvedOptions.onTimeout
+        ?? (() => ({ status: Status.ServiceUnavailable, body: { error: 'request timed out' } }));
+    return async (req, next) => {
+        let timer;
+        const work = Promise.resolve(next());
+        // If the timeout wins, the handler may still reject later — swallow it
+        // here so it doesn't surface as an unhandled rejection.
+        work.catch(() => { });
+        const timeout = new Promise((resolve) => {
+            timer = setTimeout(() => resolve(onTimeout(req)), ms);
+            timer.unref?.();
+        });
+        try {
+            return await Promise.race([work, timeout]);
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    };
+}
+//# sourceMappingURL=Timeout.js.map

package/dist/http/middleware/Timeout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Timeout.js","sourceRoot":"","sources":["../../../src/http/middleware/Timeout.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,MAAM,EAAuC,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAgD,MAAM,qBAAqB,CAAC;AAE5G,4FAA4F;AAC5F,MAAM,UAAU,cAAc,CAAC,OAAgC;IAC7D,MAAM,eAAe,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAE,OAAuC,CAAC;IACjH,IAAI,uBAAuB,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IACxD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,IAAI,MAAM,CAAC;IACxC,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS;WACtC,CAAC,GAAiB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,kBAAkB,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC,CAAC;IAEzG,OAAO,KAAK,EAAE,GAAgB,EAAE,IAAI,EAAE,EAAE;QACtC,IAAI,KAAgD,CAAC;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACrC,uEAAuE;QACvE,wDAAwD;QACxD,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAA8C,CAAC,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAe,CAAC,OAAO,EAAE,EAAE;YACpD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACrD,KAAgC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9C,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7C,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/http/middleware/TimeoutOptions.d.ts

@@ -0,0 +1,30 @@
+/** Options for the {@link requestTimeout} middleware.  Options-only. */
+import { OptionsBuilder } from '../../util/OptionsBuilder.js';
+import { OptionsValidator } from '../../util/OptionsValidator.js';
+import type { HttpRequest, HttpResponse } from '../types.js';
+/** Plain settings shape for the request-timeout middleware. */
+export interface TimeoutOptionsType {
+    /** Deadline in milliseconds.  Default 30000. */
+    readonly ms?: number;
+    /** Response produced on timeout.  Default 503 `{ error: 'request timed out' }`. */
+    readonly onTimeout?: (req: HttpRequest) => HttpResponse;
+}
+/** Fluent builder for {@link TimeoutOptionsType}. */
+export declare class TimeoutOptionsBuilder extends OptionsBuilder<TimeoutOptionsType> {
+    static create(): TimeoutOptionsBuilder;
+    withMs(ms: number): this;
+    withOnTimeout(fn: (req: HttpRequest) => HttpResponse): this;
+}
+/** Accepted input: the builder or a plain object. */
+export type TimeoutOptions = TimeoutOptionsBuilder | Partial<TimeoutOptionsType>;
+export declare const TimeoutOptions: typeof TimeoutOptionsBuilder;
+/**
+ * Validates resolved {@link TimeoutOptionsType} settings — a timeout
+ * deadline (`ms`) must be a positive finite number.  Runs from any input
+ * path (bare number, plain object, builder) since it checks the resolved bag.
+ */
+export declare class TimeoutOptionsValidator extends OptionsValidator<TimeoutOptionsType> {
+    constructor();
+    protected rules(_s: Partial<TimeoutOptionsType>): void;
+}
+//# sourceMappingURL=TimeoutOptions.d.ts.map

package/dist/http/middleware/TimeoutOptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TimeoutOptions.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/TimeoutOptions.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE7D,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,mFAAmF;IACnF,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,YAAY,CAAC;CACzD;AAED,qDAAqD;AACrD,qBAAa,qBAAsB,SAAQ,cAAc,CAAC,kBAAkB,CAAC;IAC3E,MAAM,CAAC,MAAM,IAAI,qBAAqB;IAGtC,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAGxB,aAAa,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,YAAY,GAAG,IAAI;CAG5D;AAED,qDAAqD;AACrD,MAAM,MAAM,cAAc,GAAG,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;AACjF,eAAO,MAAM,cAAc,8BAAwB,CAAC;AAEpD;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,gBAAgB,CAAC,kBAAkB,CAAC;;IAI/E,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,IAAI;CAGvD"}

package/dist/http/middleware/TimeoutOptions.js

@@ -0,0 +1,30 @@
+/** Options for the {@link requestTimeout} middleware.  Options-only. */
+import { OptionsBuilder } from '../../util/OptionsBuilder.js';
+import { OptionsValidator } from '../../util/OptionsValidator.js';
+/** Fluent builder for {@link TimeoutOptionsType}. */
+export class TimeoutOptionsBuilder extends OptionsBuilder {
+    static create() {
+        return new TimeoutOptionsBuilder();
+    }
+    withMs(ms) {
+        return this.set('ms', ms);
+    }
+    withOnTimeout(fn) {
+        return this.set('onTimeout', fn);
+    }
+}
+export const TimeoutOptions = TimeoutOptionsBuilder;
+/**
+ * Validates resolved {@link TimeoutOptionsType} settings — a timeout
+ * deadline (`ms`) must be a positive finite number.  Runs from any input
+ * path (bare number, plain object, builder) since it checks the resolved bag.
+ */
+export class TimeoutOptionsValidator extends OptionsValidator {
+    constructor() {
+        super('TimeoutOptions');
+    }
+    rules(_s) {
+        this.positiveNumber('ms');
+    }
+}
+//# sourceMappingURL=TimeoutOptions.js.map

package/dist/http/middleware/TimeoutOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TimeoutOptions.js","sourceRoot":"","sources":["../../../src/http/middleware/TimeoutOptions.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAWlE,qDAAqD;AACrD,MAAM,OAAO,qBAAsB,SAAQ,cAAkC;IAC3E,MAAM,CAAC,MAAM;QACX,OAAO,IAAI,qBAAqB,EAAE,CAAC;IACrC,CAAC;IACD,MAAM,CAAC,EAAU;QACf,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5B,CAAC;IACD,aAAa,CAAC,EAAsC;QAClD,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACnC,CAAC;CACF;AAID,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAEpD;;;;GAIG;AACH,MAAM,OAAO,uBAAwB,SAAQ,gBAAoC;IAC/E;QACE,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC1B,CAAC;IACS,KAAK,CAAC,EAA+B;QAC7C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF"}

package/dist/http/middleware/headers.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Internal header helpers shared by the response-decorating middleware
+ * (CORS, security headers, HSTS, …).  Not part of the public API.
+ */
+import type { HttpResponse } from '../types.js';
+/**
+ * Return a copy of `res` with `add` merged into its headers.  By default a
+ * key the response already carries (compared case-insensitively) is left
+ * untouched — so a handler's explicit header wins over a middleware
+ * default.  Pass `{ overwrite: true }` to force the middleware value.
+ */
+export declare function applyHeaders(res: HttpResponse, add: Readonly<Record<string, string>>, opts?: {
+    readonly overwrite?: boolean;
+}): HttpResponse;
+/**
+ * Merge `Vary` field names into an existing header value,
+ * case-insensitively de-duplicated (the first spelling is kept).  Caches
+ * must not cross-serve responses that vary by these fields.
+ */
+export declare function appendVary(existing: string | undefined, ...fields: string[]): string;
+//# sourceMappingURL=headers.d.ts.map

package/dist/http/middleware/headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"headers.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/headers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,YAAY,EACjB,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACrC,IAAI,GAAE;IAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GAC1C,YAAY,CASd;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAcpF"}

package/dist/http/middleware/headers.js

@@ -0,0 +1,43 @@
+/**
+ * Return a copy of `res` with `add` merged into its headers.  By default a
+ * key the response already carries (compared case-insensitively) is left
+ * untouched — so a handler's explicit header wins over a middleware
+ * default.  Pass `{ overwrite: true }` to force the middleware value.
+ */
+export function applyHeaders(res, add, opts = {}) {
+    const existing = res.headers ?? {};
+    const present = new Set(Object.keys(existing).map((k) => k.toLowerCase()));
+    const merged = { ...existing };
+    for (const [k, v] of Object.entries(add)) {
+        if (!opts.overwrite && present.has(k.toLowerCase()))
+            continue;
+        merged[k] = v;
+    }
+    return { ...res, headers: merged };
+}
+/**
+ * Merge `Vary` field names into an existing header value,
+ * case-insensitively de-duplicated (the first spelling is kept).  Caches
+ * must not cross-serve responses that vary by these fields.
+ */
+export function appendVary(existing, ...fields) {
+    const seen = new Set();
+    const out = [];
+    const push = (field) => {
+        const trimmed = field.trim();
+        if (!trimmed)
+            return;
+        const lower = trimmed.toLowerCase();
+        if (seen.has(lower))
+            return;
+        seen.add(lower);
+        out.push(trimmed);
+    };
+    if (existing)
+        for (const f of existing.split(','))
+            push(f);
+    for (const f of fields)
+        push(f);
+    return out.join(', ');
+}
+//# sourceMappingURL=headers.js.map

package/dist/http/middleware/headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"headers.js","sourceRoot":"","sources":["../../../src/http/middleware/headers.ts"],"names":[],"mappings":"AAMA;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,GAAiB,EACjB,GAAqC,EACrC,OAAyC,EAAE;IAE3C,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC3E,MAAM,MAAM,GAA2B,EAAE,GAAG,QAAQ,EAAE,CAAC;IACvD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAAE,SAAS;QAC9D,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,QAA4B,EAAE,GAAG,MAAgB;IAC1E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,KAAa,EAAQ,EAAE;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO;QAC5B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC,CAAC;IACF,IAAI,QAAQ;QAAE,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3D,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAChC,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC"}

package/dist/http/middleware/index.d.ts

@@ -2,4 +2,29 @@ export { BearerTokenAuth } from './BearerToken.js';
 export type { BearerTokenAuthOptions } from './BearerToken.js';
 export { IpAllowlist } from './IpAllowlist.js';
 export type { IpAllowlistOptions } from './IpAllowlist.js';
+export { strictTransportSecurity, hsts } from './Hsts.js';
+export { HstsOptions, HstsOptionsBuilder, HstsOptionsValidator } from './HstsOptions.js';
+export type { HstsOptionsType } from './HstsOptions.js';
+export { contentSecurityPolicy } from './Csp.js';
+export { CspOptions, CspOptionsBuilder } from './CspOptions.js';
+export type { CspOptionsType, CspDirectives } from './CspOptions.js';
+export { securityHeaders } from './SecurityHeaders.js';
+export { SecurityHeadersOptions, SecurityHeadersOptionsBuilder } from './SecurityHeadersOptions.js';
+export type { SecurityHeadersOptionsType } from './SecurityHeadersOptions.js';
+export { cors } from './Cors.js';
+export type { CorsRouteOptions } from './Cors.js';
+export { CorsOptions, CorsOptionsBuilder, CorsOptionsValidator } from './CorsOptions.js';
+export type { CorsOptionsType, CorsOrigin } from './CorsOptions.js';
+export { csrfProtection, requireSameOrigin, readCsrfToken } from './Csrf.js';
+export { CsrfOptions, CsrfOptionsBuilder, CsrfOptionsValidator, SameOriginOptions, SameOriginOptionsBuilder } from './CsrfOptions.js';
+export type { CsrfOptionsType, CsrfCookieOptions, SameOriginOptionsType } from './CsrfOptions.js';
+export { requestId } from './RequestId.js';
+export { RequestIdOptions, RequestIdOptionsBuilder } from './RequestIdOptions.js';
+export type { RequestIdOptionsType } from './RequestIdOptions.js';
+export { BasicAuth } from './BasicAuth.js';
+export { BasicAuthOptions, BasicAuthOptionsBuilder } from './BasicAuthOptions.js';
+export type { BasicAuthOptionsType } from './BasicAuthOptions.js';
+export { requestTimeout } from './Timeout.js';
+export { TimeoutOptions, TimeoutOptionsBuilder, TimeoutOptionsValidator } from './TimeoutOptions.js';
+export type { TimeoutOptionsType } from './TimeoutOptions.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/http/middleware/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,YAAY,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,YAAY,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAG3D,OAAO,EAAE,uBAAuB,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACzF,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAChE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AACpG,YAAY,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAG9E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACzF,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGpE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AACtI,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAGlG,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAClF,YAAY,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAClF,YAAY,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACrG,YAAY,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/http/middleware/index.js

@@ -1,3 +1,23 @@
 export { BearerTokenAuth } from './BearerToken.js';
 export { IpAllowlist } from './IpAllowlist.js';
+// Security headers — HSTS, CSP, and the securityHeaders bundle.
+export { strictTransportSecurity, hsts } from './Hsts.js';
+export { HstsOptions, HstsOptionsBuilder, HstsOptionsValidator } from './HstsOptions.js';
+export { contentSecurityPolicy } from './Csp.js';
+export { CspOptions, CspOptionsBuilder } from './CspOptions.js';
+export { securityHeaders } from './SecurityHeaders.js';
+export { SecurityHeadersOptions, SecurityHeadersOptionsBuilder } from './SecurityHeadersOptions.js';
+// CORS — a route directive (expanded by the compiler), not plain middleware.
+export { cors } from './Cors.js';
+export { CorsOptions, CorsOptionsBuilder, CorsOptionsValidator } from './CorsOptions.js';
+// CSRF — stateless double-submit + the lightweight same-origin check.
+export { csrfProtection, requireSameOrigin, readCsrfToken } from './Csrf.js';
+export { CsrfOptions, CsrfOptionsBuilder, CsrfOptionsValidator, SameOriginOptions, SameOriginOptionsBuilder } from './CsrfOptions.js';
+// Request id, HTTP Basic auth, request timeout.
+export { requestId } from './RequestId.js';
+export { RequestIdOptions, RequestIdOptionsBuilder } from './RequestIdOptions.js';
+export { BasicAuth } from './BasicAuth.js';
+export { BasicAuthOptions, BasicAuthOptionsBuilder } from './BasicAuthOptions.js';
+export { requestTimeout } from './Timeout.js';
+export { TimeoutOptions, TimeoutOptionsBuilder, TimeoutOptionsValidator } from './TimeoutOptions.js';
 //# sourceMappingURL=index.js.map

package/dist/http/middleware/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/http/middleware/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/http/middleware/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAG/C,gEAAgE;AAChE,OAAO,EAAE,uBAAuB,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAEzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEhE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAGpG,6EAA6E;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAGzF,sEAAsE;AACtE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAGtI,gDAAgD;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAElF,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAElF,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/http/static/DirectoryListing.d.ts

@@ -0,0 +1,16 @@
+export interface ListingEntry {
+    readonly name: string;
+    readonly isDirectory: boolean;
+    readonly size: number;
+    readonly mtime: Date;
+}
+export interface ListingInput {
+    /** Request path, for the heading (escaped). */
+    readonly urlPath: string;
+    /** Omit the `../` parent link at the mount root. */
+    readonly atMountRoot: boolean;
+    readonly entries: readonly ListingEntry[];
+}
+/** Render a directory listing as a self-contained HTML document. */
+export declare function renderDirectoryListing(input: ListingInput): string;
+//# sourceMappingURL=DirectoryListing.d.ts.map

package/dist/http/static/DirectoryListing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DirectoryListing.d.ts","sourceRoot":"","sources":["../../../src/http/static/DirectoryListing.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,+CAA+C;IAC/C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;CAC3C;AAOD,oEAAoE;AACpE,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CA0BlE"}

package/dist/http/static/DirectoryListing.js

@@ -0,0 +1,39 @@
+/**
+ * Minimal HTML directory listing.  Entry names are HTML-escaped in text
+ * and URL-encoded in hrefs, so a filename like `<script>x</script>` can
+ * neither break out of the markup nor the attribute (XSS defence).
+ */
+import { escapeHtml } from '../Html.js';
+function formatMtime(d) {
+    // YYYY-MM-DD HH:mm (UTC) — deterministic across runtimes.
+    return d.toISOString().slice(0, 16).replace('T', ' ');
+}
+/** Render a directory listing as a self-contained HTML document. */
+export function renderDirectoryListing(input) {
+    const sorted = [...input.entries].sort((a, b) => {
+        if (a.isDirectory !== b.isDirectory)
+            return a.isDirectory ? -1 : 1; // directories first
+        const an = a.name.toLowerCase();
+        const bn = b.name.toLowerCase();
+        return an < bn ? -1 : an > bn ? 1 : 0;
+    });
+    const rows = [];
+    if (!input.atMountRoot)
+        rows.push('<tr><td><a href="../">../</a></td><td></td><td></td></tr>');
+    for (const e of sorted) {
+        const suffix = e.isDirectory ? '/' : '';
+        const href = `${encodeURIComponent(e.name)}${suffix}`;
+        const label = `${escapeHtml(e.name)}${suffix}`;
+        const size = e.isDirectory ? '&ndash;' : String(e.size);
+        rows.push(`<tr><td><a href="${href}">${label}</a></td><td>${size}</td><td>${formatMtime(e.mtime)}</td></tr>`);
+    }
+    const title = `Index of ${escapeHtml(input.urlPath)}`;
+    return '<!doctype html><html lang="en"><head><meta charset="utf-8">'
+        + '<meta name="viewport" content="width=device-width, initial-scale=1">'
+        + `<title>${title}</title>`
+        + '<style>body{font-family:system-ui,sans-serif;margin:2rem}'
+        + 'table{border-collapse:collapse;width:100%}'
+        + 'td{padding:.25rem .75rem;border-bottom:1px solid #ddd;font-family:monospace}</style>'
+        + `</head><body><h1>${title}</h1><table><tbody>${rows.join('')}</tbody></table></body></html>`;
+}
+//# sourceMappingURL=DirectoryListing.js.map

package/dist/http/static/DirectoryListing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DirectoryListing.js","sourceRoot":"","sources":["../../../src/http/static/DirectoryListing.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAiBxC,SAAS,WAAW,CAAC,CAAO;IAC1B,0DAA0D;IAC1D,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,sBAAsB,CAAC,KAAmB;IACxD,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC9C,IAAI,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW;YAAE,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB;QACxF,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK,CAAC,WAAW;QAAE,IAAI,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;IAC/F,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,oBAAoB,IAAI,KAAK,KAAK,gBAAgB,IAAI,YAAY,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAChH,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,OAAO,6DAA6D;UAChE,sEAAsE;UACtE,UAAU,KAAK,UAAU;UACzB,2DAA2D;UAC3D,4CAA4C;UAC5C,sFAAsF;UACtF,oBAAoB,KAAK,sBAAsB,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,gCAAgC,CAAC;AACnG,CAAC"}

package/dist/http/static/StaticFiles.d.ts

@@ -0,0 +1,11 @@
+import { type Route } from '../Route.js';
+import { type StaticFilesOptions } from './StaticFilesOptions.js';
+/** Serve a single file at `filePath` with the correct content-type. */
+export declare function getFromFile(filePath: string, options?: StaticFilesOptions): Route;
+/** Serve files from a directory tree.  With `routePrefix`, mounts under it. */
+export declare function getFromDirectory(fsRoot: string, options?: StaticFilesOptions): Route;
+export declare function getFromDirectory(routePrefix: string, fsRoot: string, options?: StaticFilesOptions): Route;
+/** getFromDirectory with directory browsing forced on. */
+export declare function getFromBrowseableDirectory(fsRoot: string, options?: StaticFilesOptions): Route;
+export declare function getFromBrowseableDirectory(routePrefix: string, fsRoot: string, options?: StaticFilesOptions): Route;
+//# sourceMappingURL=StaticFiles.d.ts.map

package/dist/http/static/StaticFiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"StaticFiles.d.ts","sourceRoot":"","sources":["../../../src/http/static/StaticFiles.ts"],"names":[],"mappings":"AAOA,OAAO,EAA+B,KAAK,KAAK,EAAE,MAAM,aAAa,CAAC;AAMtE,OAAO,EAGL,KAAK,kBAAkB,EAExB,MAAM,yBAAyB,CAAC;AAgKjC,uEAAuE;AACvE,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,KAAK,CAOjF;AAED,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,KAAK,CAAC;AACtF,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,KAAK,CAAC;AAa3G,0DAA0D;AAC1D,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,KAAK,CAAC;AAChG,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,KAAK,CAAC"}