actor-ts 0.9.1 → 0.11.0

package/dist/http/cache/ResponseCache.js

@@ -67,10 +67,10 @@ function decodeResponse(c) {
 function bytesToBase64(bytes) {
     if (typeof Buffer !== 'undefined')
         return Buffer.from(bytes).toString('base64');
-    let s = '';
+    let binaryString = '';
     for (let i = 0; i < bytes.length; i++)
-        s += String.fromCharCode(bytes[i]);
-    return btoa(s);
+        binaryString += String.fromCharCode(bytes[i]);
+    return btoa(binaryString);
 }
 function base64ToBytes(b64) {
     if (typeof Buffer !== 'undefined')

package/dist/http/cache/ResponseCache.js.map

@@ -1 +1 @@
-{"version":3,"file":"ResponseCache.js","sourceRoot":"","sources":["../../../src/http/cache/ResponseCache.ts"],"names":[],"mappings":"AA0DA,MAAM,UAAU,MAAM,CAAC,IAA0B;IAC/C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,uDAAuD,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;IACxC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,kEAAkE;IAClE,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAiC,CAAC;IAE1D,OAAO,SAAS,IAAI,CAAC,OAAmE;QACtF,OAAO,KAAK,UAAU,aAAa,CAAC,GAAgB;YAClD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAG,GAAG,MAAM,GAAG,OAAO,EAAE,CAAC;YAEvC,gBAAgB;YAChB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,QAAQ,CAAC,CAAC;YAC3D,IAAI,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;gBACjB,OAAO,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;YAED,6DAA6D;YAC7D,MAAM,cAAc,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9C,IAAI,cAAc;gBAAE,OAAO,cAAc,CAAC;YAE1C,iEAAiE;YACjE,yCAAyC;YACzC,MAAM,IAAI,GAAG,CAAC,KAAK,IAA2B,EAAE;gBAC9C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;gBACpC,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBACvC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;gBACvF,CAAC;gBACD,OAAO,QAAQ,CAAC;YAClB,CAAC,CAAC,EAAE,CAAC;YACL,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC7B,IAAI,CAAC;gBAAC,OAAO,MAAM,IAAI,CAAC;YAAC,CAAC;oBAClB,CAAC;gBAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAAC,CAAC;QACxC,CAAC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,cAAc,CAAC,CAAe;IACrC,IAAI,IAAI,GAAY,CAAC,CAAC,IAAI,CAAC;IAC3B,IAAI,IAAI,YAAY,UAAU,EAAE,CAAC;QAC/B,IAAI,GAAG,EAAE,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;IACxC,CAAC;IACD,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAA6C;QACxD,IAAI;QACJ,WAAW,EAAE,CAAC,CAAC,WAAW;KAC3B,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,CAAiB;IACvC,IAAI,IAAI,GAAyB,CAAC,CAAC,IAA4B,CAAC;IAChE,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,IAAK,CAAC,CAAC,IAAe,EAAE,CAAC;QACnF,IAAI,GAAG,aAAa,CAAE,CAAC,CAAC,IAA0B,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,IAAI;QACJ,WAAW,EAAE,CAAC,CAAC,WAAW;KAC3B,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAiB;IACtC,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChF,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"ResponseCache.js","sourceRoot":"","sources":["../../../src/http/cache/ResponseCache.ts"],"names":[],"mappings":"AA0DA,MAAM,UAAU,MAAM,CAAC,IAA0B;IAC/C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,uDAAuD,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;IACxC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,kEAAkE;IAClE,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAiC,CAAC;IAE1D,OAAO,SAAS,IAAI,CAAC,OAAmE;QACtF,OAAO,KAAK,UAAU,aAAa,CAAC,GAAgB;YAClD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAG,GAAG,MAAM,GAAG,OAAO,EAAE,CAAC;YAEvC,gBAAgB;YAChB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,QAAQ,CAAC,CAAC;YAC3D,IAAI,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;gBACjB,OAAO,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;YAED,6DAA6D;YAC7D,MAAM,cAAc,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9C,IAAI,cAAc;gBAAE,OAAO,cAAc,CAAC;YAE1C,iEAAiE;YACjE,yCAAyC;YACzC,MAAM,IAAI,GAAG,CAAC,KAAK,IAA2B,EAAE;gBAC9C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;gBACpC,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBACvC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;gBACvF,CAAC;gBACD,OAAO,QAAQ,CAAC;YAClB,CAAC,CAAC,EAAE,CAAC;YACL,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC7B,IAAI,CAAC;gBAAC,OAAO,MAAM,IAAI,CAAC;YAAC,CAAC;oBAClB,CAAC;gBAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAAC,CAAC;QACxC,CAAC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,cAAc,CAAC,CAAe;IACrC,IAAI,IAAI,GAAY,CAAC,CAAC,IAAI,CAAC;IAC3B,IAAI,IAAI,YAAY,UAAU,EAAE,CAAC;QAC/B,IAAI,GAAG,EAAE,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;IACxC,CAAC;IACD,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAA6C;QACxD,IAAI;QACJ,WAAW,EAAE,CAAC,CAAC,WAAW;KAC3B,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,CAAiB;IACvC,IAAI,IAAI,GAAyB,CAAC,CAAC,IAA4B,CAAC;IAChE,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,IAAK,CAAC,CAAC,IAAe,EAAE,CAAC;QACnF,IAAI,GAAG,aAAa,CAAE,CAAC,CAAC,IAA0B,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,IAAI;QACJ,WAAW,EAAE,CAAC,CAAC,WAAW;KAC3B,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAiB;IACtC,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChF,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACtF,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/http/cache/index.d.ts

@@ -1,7 +1,9 @@
 export { rateLimit } from './RateLimit.js';
-export type { RateLimitOptions, RateLimitContext } from './RateLimit.js';
+export { RateLimitOptions, RateLimitOptionsBuilder, RateLimitOptionsValidator } from './RateLimitOptions.js';
+export type { RateLimitOptionsType, RateLimitContext } from './RateLimitOptions.js';
 export { idempotent } from './IdempotencyKey.js';
-export type { IdempotencyOptions } from './IdempotencyKey.js';
+export { IdempotencyOptions, IdempotencyOptionsBuilder, IdempotencyOptionsValidator } from './IdempotencyOptions.js';
+export type { IdempotencyOptionsType } from './IdempotencyOptions.js';
 export { cached } from './ResponseCache.js';
 export type { ResponseCacheOptions } from './ResponseCache.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/http/cache/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/http/cache/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,YAAY,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/http/cache/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAC7G,YAAY,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AACrH,YAAY,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/http/cache/index.js

@@ -1,4 +1,6 @@
 export { rateLimit } from './RateLimit.js';
+export { RateLimitOptions, RateLimitOptionsBuilder, RateLimitOptionsValidator } from './RateLimitOptions.js';
 export { idempotent } from './IdempotencyKey.js';
+export { IdempotencyOptions, IdempotencyOptionsBuilder, IdempotencyOptionsValidator } from './IdempotencyOptions.js';
 export { cached } from './ResponseCache.js';
 //# sourceMappingURL=index.js.map

package/dist/http/cache/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/http/cache/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/http/cache/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAE7G,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAErH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/http/cookies.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Minimal cookie parsing + serialisation.  The framework had no cookie
+ * helper; CSRF needs one, and handlers do too, so it lives at the HTTP
+ * root (not under middleware/) and is part of the public API.
+ *
+ * Security posture: parsing caps the number of pairs (untrusted input),
+ * and serialisation REJECTS values or names that could smuggle a second
+ * header or break out of the cookie (header-injection guard), plus
+ * enforces the `__Secure-` / `__Host-` prefix rules and the
+ * SameSite=None→Secure requirement.
+ */
+/** Attributes for a `Set-Cookie` value. */
+export interface CookieAttributes {
+    readonly maxAgeSeconds?: number;
+    readonly expires?: Date;
+    readonly domain?: string;
+    readonly path?: string;
+    readonly secure?: boolean;
+    readonly httpOnly?: boolean;
+    readonly sameSite?: 'strict' | 'lax' | 'none';
+}
+/**
+ * Parse a request `Cookie` header into a name→value map.  First
+ * occurrence of a name wins (RFC 6265 §5.4 ordering); malformed pairs are
+ * skipped, never thrown; values are best-effort %XX-decoded (kept raw on
+ * failure) with one layer of surrounding double quotes stripped.  At most
+ * {@link MAX_COOKIE_PAIRS} pairs are accepted.
+ */
+export declare function parseCookies(header: string | undefined): Readonly<Record<string, string>>;
+/**
+ * Serialise one `Set-Cookie` value.  THROWS on an invalid name, a value
+ * containing an illegal character (header-injection guard), a
+ * `SameSite=None` cookie that isn't `Secure`, or a violated cookie-prefix
+ * rule (`__Secure-` needs Secure; `__Host-` needs Secure + Path=/ + no
+ * Domain).  Value is emitted verbatim — pre-encode it yourself if needed.
+ */
+export declare function serializeCookie(name: string, value: string, attrs?: CookieAttributes): string;
+//# sourceMappingURL=cookies.d.ts.map

package/dist/http/cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../src/http/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,2CAA2C;AAC3C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;CAC/C;AAgBD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAmBzF;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,GAAE,gBAAqB,GAAG,MAAM,CAgCjG"}

package/dist/http/cookies.js

@@ -0,0 +1,102 @@
+/**
+ * Minimal cookie parsing + serialisation.  The framework had no cookie
+ * helper; CSRF needs one, and handlers do too, so it lives at the HTTP
+ * root (not under middleware/) and is part of the public API.
+ *
+ * Security posture: parsing caps the number of pairs (untrusted input),
+ * and serialisation REJECTS values or names that could smuggle a second
+ * header or break out of the cookie (header-injection guard), plus
+ * enforces the `__Secure-` / `__Host-` prefix rules and the
+ * SameSite=None→Secure requirement.
+ */
+/** Hard cap on parsed pairs — a client cannot make us build an unbounded map. */
+const MAX_COOKIE_PAIRS = 128;
+/** RFC 6265 cookie-name token characters. */
+const COOKIE_NAME_RE = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
+/**
+ * Illegal in a cookie value: anything outside printable ASCII (controls,
+ * space, DEL, non-ASCII) plus the structural delimiters `" , ; \`.  This
+ * is a superset-safe guard — it rejects everything RFC 6265 forbids and
+ * anything that could inject a header.
+ */
+const ILLEGAL_COOKIE_VALUE = /[^\x21-\x7e]|["(),;\\]/;
+/**
+ * Parse a request `Cookie` header into a name→value map.  First
+ * occurrence of a name wins (RFC 6265 §5.4 ordering); malformed pairs are
+ * skipped, never thrown; values are best-effort %XX-decoded (kept raw on
+ * failure) with one layer of surrounding double quotes stripped.  At most
+ * {@link MAX_COOKIE_PAIRS} pairs are accepted.
+ */
+export function parseCookies(header) {
+    const out = {};
+    if (!header)
+        return out;
+    let count = 0;
+    for (const part of header.split(';')) {
+        if (count >= MAX_COOKIE_PAIRS)
+            break;
+        const eq = part.indexOf('=');
+        if (eq < 0)
+            continue;
+        const name = part.slice(0, eq).trim();
+        if (!name || Object.prototype.hasOwnProperty.call(out, name))
+            continue;
+        let value = part.slice(eq + 1).trim();
+        if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) {
+            value = value.slice(1, -1);
+        }
+        try {
+            value = decodeURIComponent(value);
+        }
+        catch { /* not %-encoded — keep raw */ }
+        out[name] = value;
+        count++;
+    }
+    return out;
+}
+/**
+ * Serialise one `Set-Cookie` value.  THROWS on an invalid name, a value
+ * containing an illegal character (header-injection guard), a
+ * `SameSite=None` cookie that isn't `Secure`, or a violated cookie-prefix
+ * rule (`__Secure-` needs Secure; `__Host-` needs Secure + Path=/ + no
+ * Domain).  Value is emitted verbatim — pre-encode it yourself if needed.
+ */
+export function serializeCookie(name, value, attrs = {}) {
+    if (!COOKIE_NAME_RE.test(name)) {
+        throw new Error(`serializeCookie: invalid cookie name "${name}"`);
+    }
+    if (ILLEGAL_COOKIE_VALUE.test(value)) {
+        throw new Error('serializeCookie: cookie value contains an illegal character');
+    }
+    const secure = attrs.secure ?? false;
+    if (attrs.sameSite === 'none' && !secure) {
+        throw new Error('serializeCookie: SameSite=None requires Secure');
+    }
+    if (name.startsWith('__Secure-') && !secure) {
+        throw new Error('serializeCookie: the "__Secure-" prefix requires Secure');
+    }
+    if (name.startsWith('__Host-') && (!secure || attrs.path !== '/' || attrs.domain !== undefined)) {
+        throw new Error('serializeCookie: the "__Host-" prefix requires Secure, Path=/, and no Domain');
+    }
+    if (attrs.maxAgeSeconds !== undefined && !Number.isInteger(attrs.maxAgeSeconds)) {
+        throw new Error('serializeCookie: maxAgeSeconds must be an integer');
+    }
+    const parts = [`${name}=${value}`];
+    if (attrs.maxAgeSeconds !== undefined)
+        parts.push(`Max-Age=${attrs.maxAgeSeconds}`);
+    if (attrs.expires)
+        parts.push(`Expires=${attrs.expires.toUTCString()}`);
+    if (attrs.domain)
+        parts.push(`Domain=${attrs.domain}`);
+    if (attrs.path)
+        parts.push(`Path=${attrs.path}`);
+    if (attrs.httpOnly)
+        parts.push('HttpOnly');
+    if (secure)
+        parts.push('Secure');
+    if (attrs.sameSite) {
+        parts.push(`SameSite=${attrs.sameSite === 'strict' ? 'Strict' : attrs.sameSite === 'lax' ? 'Lax' : 'None'}`);
+    }
+    return parts.join('; ');
+}
+//# sourceMappingURL=cookies.js.map

package/dist/http/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../../src/http/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAaH,iFAAiF;AACjF,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B,6CAA6C;AAC7C,MAAM,cAAc,GAAG,+BAA+B,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;AAEtD;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,MAA0B;IACrD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IACxB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,IAAI,KAAK,IAAI,gBAAgB;YAAE,MAAM;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,GAAG,CAAC;YAAE,SAAS;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC;YAAE,SAAS;QACvE,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC;YAAC,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,8BAA8B,CAAC,CAAC;QACnF,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAClB,KAAK,EAAE,CAAC;IACV,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa,EAAE,QAA0B,EAAE;IACvF,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,GAAG,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC;IACrC,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;QAChG,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;IACpF,IAAI,KAAK,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACxE,IAAI,KAAK,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/G,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/http/index.d.ts

@@ -1,18 +1,30 @@
 export { HttpExtension, HttpExtensionId } from './HttpExtension.js';
 export type { ServerBuilder } from './HttpExtension.js';
-export { concat, complete, completeJson, completeText, compile, del, get, head, options, patch, path, pathParam, pathPrefix, post, put, queryParam, redirect, reject, } from './Route.js';
-export type { CompiledRoute, Route } from './Route.js';
+export { concat, complete, completeJson, completeText, compile, defaultErrorResponse, del, fallback, get, handleErrors, head, options, patch, path, pathParam, pathPrefix, post, put, queryParam, redirect, reject, withMiddleware, } from './Route.js';
+export type { CompiledRoute, CompiledWebsocketRoute, CompiledFallback, CompiledEndpoint, ExceptionHandler, Middleware, Route, WebsocketConnectHandler, } from './Route.js';
+export { BearerTokenAuth, IpAllowlist, strictTransportSecurity, hsts, HstsOptions, HstsOptionsBuilder, HstsOptionsValidator, contentSecurityPolicy, CspOptions, CspOptionsBuilder, securityHeaders, SecurityHeadersOptions, SecurityHeadersOptionsBuilder, cors, CorsOptions, CorsOptionsBuilder, CorsOptionsValidator, csrfProtection, requireSameOrigin, readCsrfToken, CsrfOptions, CsrfOptionsBuilder, CsrfOptionsValidator, SameOriginOptions, SameOriginOptionsBuilder, requestId, RequestIdOptions, RequestIdOptionsBuilder, BasicAuth, BasicAuthOptions, BasicAuthOptionsBuilder, requestTimeout, TimeoutOptions, TimeoutOptionsBuilder, TimeoutOptionsValidator, } from './middleware/index.js';
+export type { BearerTokenAuthOptions, IpAllowlistOptions, HstsOptionsType, CspOptionsType, CspDirectives, SecurityHeadersOptionsType, CorsOptionsType, CorsOrigin, CsrfOptionsType, CsrfCookieOptions, SameOriginOptionsType, RequestIdOptionsType, BasicAuthOptionsType, TimeoutOptionsType, } from './middleware/index.js';
 export { entity, marshal, pickRequestSerializer, pickResponseSerializer } from './Marshalling.js';
+export { contentTypeFor, DEFAULT_MIME_TYPES } from './MimeTypes.js';
+export { getFromFile, getFromDirectory, getFromBrowseableDirectory, StaticFilesOptions, StaticFilesOptionsBuilder, StaticFilesOptionsValidator, } from './static/index.js';
+export type { StaticFilesOptionsType } from './static/index.js';
+export { escapeHtml, html, rawHtml, completeHtml, SafeHtml } from './Html.js';
+export { parseCookies, serializeCookie } from './cookies.js';
+export type { CookieAttributes } from './cookies.js';
 export { HttpClient } from './HttpClient.js';
 export type { HttpClientRequest, HttpClientResponse } from './HttpClient.js';
 export { FastifyBackend } from './backend/FastifyBackend.js';
 export { ExpressBackend } from './backend/ExpressBackend.js';
-export type { ExpressBackendOptions } from './backend/ExpressBackend.js';
+export { ExpressBackendOptions, ExpressBackendOptionsBuilder, ExpressBackendOptionsValidator } from './backend/ExpressBackendOptions.js';
+export type { ExpressBackendOptionsType } from './backend/ExpressBackendOptions.js';
 export { HonoBackend } from './backend/HonoBackend.js';
-export type { HonoBackendOptions } from './backend/HonoBackend.js';
-export type { HttpServerBackend, RouteRegistration, ServerBinding, } from './backend/HttpServerBackend.js';
+export { HonoBackendOptions, HonoBackendOptionsBuilder, HonoBackendOptionsValidator } from './backend/HonoBackendOptions.js';
+export type { HonoBackendOptionsType } from './backend/HonoBackendOptions.js';
+export type { HttpServerBackend, RouteRegistration, WebsocketRouteRegistration, ServerBinding, } from './backend/HttpServerBackend.js';
+export type { WebsocketSocketAdapter, WebsocketListeners } from './websocket/SocketAdapter.js';
+export * from './websocket/index.js';
 export { HttpError, Status, } from './types.js';
 export type { HttpMethod, HttpRequest, HttpResponse } from './types.js';
-export { rateLimit, idempotent, cached } from './cache/index.js';
-export type { RateLimitOptions, RateLimitContext, IdempotencyOptions, ResponseCacheOptions, } from './cache/index.js';
+export { rateLimit, RateLimitOptions, RateLimitOptionsBuilder, RateLimitOptionsValidator, idempotent, IdempotencyOptions, IdempotencyOptionsBuilder, IdempotencyOptionsValidator, cached, } from './cache/index.js';
+export type { RateLimitOptionsType, RateLimitContext, IdempotencyOptionsType, ResponseCacheOptions, } from './cache/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/http/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACpE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EACL,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,OAAO,EACP,GAAG,EACH,GAAG,EACH,IAAI,EACJ,OAAO,EACP,KAAK,EACL,IAAI,EACJ,SAAS,EACT,UAAU,EACV,IAAI,EACJ,GAAG,EACH,UAAU,EACV,QAAQ,EACR,MAAM,GACP,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEvD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAElG,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE7E,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,YAAY,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,YAAY,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,GACd,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,SAAS,EACT,MAAM,GACP,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAGxE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACjE,YAAY,EACV,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACpE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EACL,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,OAAO,EACP,oBAAoB,EACpB,GAAG,EACH,QAAQ,EACR,GAAG,EACH,YAAY,EACZ,IAAI,EACJ,OAAO,EACP,KAAK,EACL,IAAI,EACJ,SAAS,EACT,UAAU,EACV,IAAI,EACJ,GAAG,EACH,UAAU,EACV,QAAQ,EACR,MAAM,EACN,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,aAAa,EACb,sBAAsB,EACtB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,KAAK,EACL,uBAAuB,GACxB,MAAM,YAAY,CAAC;AAIpB,OAAO,EACL,eAAe,EACf,WAAW,EACX,uBAAuB,EACvB,IAAI,EACJ,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,UAAU,EACV,iBAAiB,EACjB,eAAe,EACf,sBAAsB,EACtB,6BAA6B,EAC7B,IAAI,EACJ,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,wBAAwB,EACxB,SAAS,EACT,gBAAgB,EAChB,uBAAuB,EACvB,SAAS,EACT,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,cAAc,EACd,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,sBAAsB,EACtB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,aAAa,EACb,0BAA0B,EAC1B,eAAe,EACf,UAAU,EACV,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAGlG,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGpE,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,0BAA0B,EAC1B,kBAAkB,EAClB,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAGhE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAG9E,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7D,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE7E,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,8BAA8B,EAAE,MAAM,oCAAoC,CAAC;AACzI,YAAY,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AACpF,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAC7H,YAAY,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAC9E,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,0BAA0B,EAC1B,aAAa,GACd,MAAM,gCAAgC,CAAC;AACxC,YAAY,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAG/F,cAAc,sBAAsB,CAAC;AAErC,OAAO,EACL,SAAS,EACT,MAAM,GACP,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAGxE,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,uBAAuB,EACvB,yBAAyB,EACzB,UAAU,EACV,kBAAkB,EAClB,yBAAyB,EACzB,2BAA2B,EAC3B,MAAM,GACP,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,kBAAkB,CAAC"}

package/dist/http/index.js

@@ -1,11 +1,26 @@
 export { HttpExtension, HttpExtensionId } from './HttpExtension.js';
-export { concat, complete, completeJson, completeText, compile, del, get, head, options, patch, path, pathParam, pathPrefix, post, put, queryParam, redirect, reject, } from './Route.js';
+export { concat, complete, completeJson, completeText, compile, defaultErrorResponse, del, fallback, get, handleErrors, head, options, patch, path, pathParam, pathPrefix, post, put, queryParam, redirect, reject, withMiddleware, } from './Route.js';
+// Auth + IP-allowlist middleware (#312) and the security-header suite
+// (#353).  Exported from `./middleware/index.js`; the barrel re-exports.
+export { BearerTokenAuth, IpAllowlist, strictTransportSecurity, hsts, HstsOptions, HstsOptionsBuilder, HstsOptionsValidator, contentSecurityPolicy, CspOptions, CspOptionsBuilder, securityHeaders, SecurityHeadersOptions, SecurityHeadersOptionsBuilder, cors, CorsOptions, CorsOptionsBuilder, CorsOptionsValidator, csrfProtection, requireSameOrigin, readCsrfToken, CsrfOptions, CsrfOptionsBuilder, CsrfOptionsValidator, SameOriginOptions, SameOriginOptionsBuilder, requestId, RequestIdOptions, RequestIdOptionsBuilder, BasicAuth, BasicAuthOptions, BasicAuthOptionsBuilder, requestTimeout, TimeoutOptions, TimeoutOptionsBuilder, TimeoutOptionsValidator, } from './middleware/index.js';
 export { entity, marshal, pickRequestSerializer, pickResponseSerializer } from './Marshalling.js';
+// MIME-type registry — extension → content-type for static-file responses.
+export { contentTypeFor, DEFAULT_MIME_TYPES } from './MimeTypes.js';
+// Static file serving — getFromFile / getFromDirectory / directory browsing.
+export { getFromFile, getFromDirectory, getFromBrowseableDirectory, StaticFilesOptions, StaticFilesOptionsBuilder, StaticFilesOptionsValidator, } from './static/index.js';
+// HTML response helpers — escaping + the `html` tagged template (#352).
+export { escapeHtml, html, rawHtml, completeHtml, SafeHtml } from './Html.js';
+// Cookie parse/serialise helpers — used by CSRF, handy for handlers too.
+export { parseCookies, serializeCookie } from './cookies.js';
 export { HttpClient } from './HttpClient.js';
 export { FastifyBackend } from './backend/FastifyBackend.js';
 export { ExpressBackend } from './backend/ExpressBackend.js';
+export { ExpressBackendOptions, ExpressBackendOptionsBuilder, ExpressBackendOptionsValidator } from './backend/ExpressBackendOptions.js';
 export { HonoBackend } from './backend/HonoBackend.js';
+export { HonoBackendOptions, HonoBackendOptionsBuilder, HonoBackendOptionsValidator } from './backend/HonoBackendOptions.js';
+// Typed WebSocket stack — websocket() directive, server actor, codecs.
+export * from './websocket/index.js';
 export { HttpError, Status, } from './types.js';
 // HTTP caching middleware (response-cache, rate-limit, idempotency-key).
-export { rateLimit, idempotent, cached } from './cache/index.js';
+export { rateLimit, RateLimitOptions, RateLimitOptionsBuilder, RateLimitOptionsValidator, idempotent, IdempotencyOptions, IdempotencyOptionsBuilder, IdempotencyOptionsValidator, cached, } from './cache/index.js';
 //# sourceMappingURL=index.js.map

package/dist/http/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGpE,OAAO,EACL,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,OAAO,EACP,GAAG,EACH,GAAG,EACH,IAAI,EACJ,OAAO,EACP,KAAK,EACL,IAAI,EACJ,SAAS,EACT,UAAU,EACV,IAAI,EACJ,GAAG,EACH,UAAU,EACV,QAAQ,EACR,MAAM,GACP,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAElG,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAG7C,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAQvD,OAAO,EACL,SAAS,EACT,MAAM,GACP,MAAM,YAAY,CAAC;AAGpB,yEAAyE;AACzE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGpE,OAAO,EACL,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,OAAO,EACP,oBAAoB,EACpB,GAAG,EACH,QAAQ,EACR,GAAG,EACH,YAAY,EACZ,IAAI,EACJ,OAAO,EACP,KAAK,EACL,IAAI,EACJ,SAAS,EACT,UAAU,EACV,IAAI,EACJ,GAAG,EACH,UAAU,EACV,QAAQ,EACR,MAAM,EACN,cAAc,GACf,MAAM,YAAY,CAAC;AAYpB,sEAAsE;AACtE,yEAAyE;AACzE,OAAO,EACL,eAAe,EACf,WAAW,EACX,uBAAuB,EACvB,IAAI,EACJ,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,UAAU,EACV,iBAAiB,EACjB,eAAe,EACf,sBAAsB,EACtB,6BAA6B,EAC7B,IAAI,EACJ,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,wBAAwB,EACxB,SAAS,EACT,gBAAgB,EAChB,uBAAuB,EACvB,SAAS,EACT,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,cAAc,EACd,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAkB/B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAElG,2EAA2E;AAC3E,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpE,6EAA6E;AAC7E,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,0BAA0B,EAC1B,kBAAkB,EAClB,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAG3B,wEAAwE;AACxE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE9E,yEAAyE;AACzE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAG7D,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAG7C,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,8BAA8B,EAAE,MAAM,oCAAoC,CAAC;AAEzI,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAU7H,uEAAuE;AACvE,cAAc,sBAAsB,CAAC;AAErC,OAAO,EACL,SAAS,EACT,MAAM,GACP,MAAM,YAAY,CAAC;AAGpB,yEAAyE;AACzE,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,uBAAuB,EACvB,yBAAyB,EACzB,UAAU,EACV,kBAAkB,EAClB,yBAAyB,EACzB,2BAA2B,EAC3B,MAAM,GACP,MAAM,kBAAkB,CAAC"}

package/dist/http/middleware/BasicAuth.d.ts

@@ -0,0 +1,5 @@
+import type { Middleware } from '../Route.js';
+import type { BasicAuthOptions } from './BasicAuthOptions.js';
+/** Build a Basic-auth middleware.  Requires `users` or `validate`. */
+export declare function BasicAuth(options: BasicAuthOptions): Middleware;
+//# sourceMappingURL=BasicAuth.d.ts.map

package/dist/http/middleware/BasicAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BasicAuth.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/BasicAuth.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,KAAK,EAAE,gBAAgB,EAAwB,MAAM,uBAAuB,CAAC;AASpF,sEAAsE;AACtE,wBAAgB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,UAAU,CAqC/D"}

package/dist/http/middleware/BasicAuth.js

@@ -0,0 +1,58 @@
+/**
+ * HTTP Basic authentication middleware — the `Authorization: Basic` peer
+ * of {@link BearerTokenAuth}.  Credentials are compared constant-time, and
+ * a 401 advertises a real `WWW-Authenticate: Basic realm="…"` header (via
+ * HttpError.headers).
+ */
+import { timingSafeEqual } from 'node:crypto';
+import { HttpError, Status } from '../types.js';
+/** Constant-time compare (equal length only — the length pre-check is the one known leak). */
+function safeEqual(a, b) {
+    const ab = Buffer.from(a);
+    const bb = Buffer.from(b);
+    return ab.length === bb.length && timingSafeEqual(ab, bb);
+}
+/** Build a Basic-auth middleware.  Requires `users` or `validate`. */
+export function BasicAuth(options) {
+    const resolvedOptions = options;
+    const users = resolvedOptions.users;
+    const validate = resolvedOptions.validate;
+    if (!users && !validate) {
+        throw new Error('BasicAuth: provide either users or a validate function');
+    }
+    const realm = resolvedOptions.realm ?? 'actor-ts';
+    const challenge = { 'www-authenticate': `Basic realm="${realm}"` };
+    const unauthorized = (message) => {
+        throw new HttpError(Status.Unauthorized, message, undefined, challenge);
+    };
+    return async (req, next) => {
+        const header = req.headers['authorization'];
+        if (!header)
+            unauthorized('missing Authorization header');
+        const match = /^Basic\s+(.+)$/i.exec(header);
+        if (!match)
+            unauthorized('authorization scheme must be Basic');
+        const decoded = Buffer.from(match[1].trim(), 'base64').toString('utf8');
+        const sep = decoded.indexOf(':');
+        if (sep < 0)
+            unauthorized('malformed Basic credentials');
+        const user = decoded.slice(0, sep);
+        const pass = decoded.slice(sep + 1);
+        let ok = false;
+        if (validate) {
+            ok = (await validate(user, pass)) === true;
+        }
+        else if (users) {
+            // Iterate every entry (no early exit) so timing doesn't reveal which
+            // usernames exist; a miss still burns the same comparisons.
+            for (const [u, p] of Object.entries(users)) {
+                if (safeEqual(user, u) && safeEqual(pass, p))
+                    ok = true;
+            }
+        }
+        if (!ok)
+            unauthorized('invalid credentials');
+        return next();
+    };
+}
+//# sourceMappingURL=BasicAuth.js.map

package/dist/http/middleware/BasicAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BasicAuth.js","sourceRoot":"","sources":["../../../src/http/middleware/BasicAuth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAGhD,8FAA8F;AAC9F,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,IAAI,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,SAAS,CAAC,OAAyB;IACjD,MAAM,eAAe,GAAG,OAAwC,CAAC;IACjE,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC;IACpC,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC;IAC1C,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,IAAI,UAAU,CAAC;IAClD,MAAM,SAAS,GAAG,EAAE,kBAAkB,EAAE,gBAAgB,KAAK,GAAG,EAAE,CAAC;IACnE,MAAM,YAAY,GAAG,CAAC,OAAe,EAAS,EAAE;QAC9C,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAC1E,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM;YAAE,YAAY,CAAC,8BAA8B,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK;YAAE,YAAY,CAAC,oCAAoC,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAM,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,GAAG,CAAC;YAAE,YAAY,CAAC,6BAA6B,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAEpC,IAAI,EAAE,GAAG,KAAK,CAAC;QACf,IAAI,QAAQ,EAAE,CAAC;YACb,EAAE,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC;QAC7C,CAAC;aAAM,IAAI,KAAK,EAAE,CAAC;YACjB,qEAAqE;YACrE,4DAA4D;YAC5D,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3C,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;oBAAE,EAAE,GAAG,IAAI,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,IAAI,CAAC,EAAE;YAAE,YAAY,CAAC,qBAAqB,CAAC,CAAC;QAC7C,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/http/middleware/BasicAuthOptions.d.ts

@@ -0,0 +1,22 @@
+/** Options for the {@link BasicAuth} middleware.  Options-only. */
+import { OptionsBuilder } from '../../util/OptionsBuilder.js';
+/** Plain settings shape for HTTP Basic auth.  Provide `users` OR `validate`. */
+export interface BasicAuthOptionsType {
+    /** username→password map (constant-time compared). */
+    readonly users?: Readonly<Record<string, string>>;
+    /** Custom credential check (e.g. against a store). */
+    readonly validate?: (user: string, pass: string) => boolean | Promise<boolean>;
+    /** Realm advertised in `WWW-Authenticate` on 401.  Default `'actor-ts'`. */
+    readonly realm?: string;
+}
+/** Fluent builder for {@link BasicAuthOptionsType}. */
+export declare class BasicAuthOptionsBuilder extends OptionsBuilder<BasicAuthOptionsType> {
+    static create(): BasicAuthOptionsBuilder;
+    withUsers(users: Readonly<Record<string, string>>): this;
+    withValidate(fn: (user: string, pass: string) => boolean | Promise<boolean>): this;
+    withRealm(realm: string): this;
+}
+/** Accepted input: the builder or a plain object. */
+export type BasicAuthOptions = BasicAuthOptionsBuilder | Partial<BasicAuthOptionsType>;
+export declare const BasicAuthOptions: typeof BasicAuthOptionsBuilder;
+//# sourceMappingURL=BasicAuthOptions.d.ts.map

package/dist/http/middleware/BasicAuthOptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BasicAuthOptions.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/BasicAuthOptions.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9D,gFAAgF;AAChF,MAAM,WAAW,oBAAoB;IACnC,sDAAsD;IACtD,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/E,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,uDAAuD;AACvD,qBAAa,uBAAwB,SAAQ,cAAc,CAAC,oBAAoB,CAAC;IAC/E,MAAM,CAAC,MAAM,IAAI,uBAAuB;IAGxC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,IAAI;IAGxD,YAAY,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI;IAGlF,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;CAG/B;AAED,qDAAqD;AACrD,MAAM,MAAM,gBAAgB,GAAG,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;AACvF,eAAO,MAAM,gBAAgB,gCAA0B,CAAC"}

package/dist/http/middleware/BasicAuthOptions.js

@@ -0,0 +1,19 @@
+/** Options for the {@link BasicAuth} middleware.  Options-only. */
+import { OptionsBuilder } from '../../util/OptionsBuilder.js';
+/** Fluent builder for {@link BasicAuthOptionsType}. */
+export class BasicAuthOptionsBuilder extends OptionsBuilder {
+    static create() {
+        return new BasicAuthOptionsBuilder();
+    }
+    withUsers(users) {
+        return this.set('users', users);
+    }
+    withValidate(fn) {
+        return this.set('validate', fn);
+    }
+    withRealm(realm) {
+        return this.set('realm', realm);
+    }
+}
+export const BasicAuthOptions = BasicAuthOptionsBuilder;
+//# sourceMappingURL=BasicAuthOptions.js.map

package/dist/http/middleware/BasicAuthOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BasicAuthOptions.js","sourceRoot":"","sources":["../../../src/http/middleware/BasicAuthOptions.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAY9D,uDAAuD;AACvD,MAAM,OAAO,uBAAwB,SAAQ,cAAoC;IAC/E,MAAM,CAAC,MAAM;QACX,OAAO,IAAI,uBAAuB,EAAE,CAAC;IACvC,CAAC;IACD,SAAS,CAAC,KAAuC;QAC/C,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,YAAY,CAAC,EAA8D;QACzE,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,SAAS,CAAC,KAAa;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;CACF;AAID,MAAM,CAAC,MAAM,gBAAgB,GAAG,uBAAuB,CAAC"}

package/dist/http/middleware/BearerToken.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Shared-secret bearer-token authentication middleware (#312).
+ *
+ * Use this to gate routes that need to be accessible only to operators
+ * holding a pre-shared secret — typically the destructive management
+ * endpoints (`/cluster/down`, `/cluster/leave`).  Comparison is
+ * constant-time so an attacker probing tokens can't distinguish
+ * "first character wrong" from "last character wrong" by timing.
+ */
+import type { Middleware } from '../Route.js';
+export interface BearerTokenAuthOptions {
+    /**
+     * Acceptable tokens — at least one must match the
+     * `Authorization: Bearer <token>` header.  Multiple entries support
+     * rotation: emit a new token, deploy clients with the new token,
+     * then drop the old entry.
+     */
+    readonly tokens: ReadonlyArray<string>;
+    /**
+     * Header name to read the token from.  Default: `'authorization'`.
+     * HTTP header names are lower-cased by the framework — pass them
+     * lower-case here too.
+     */
+    readonly headerName?: string;
+    /**
+     * Realm advertised in `WWW-Authenticate` on 401.  Default: `'actor-ts'`.
+     */
+    readonly realm?: string;
+}
+/**
+ * Build a `Middleware` that 401s every request unless the
+ * `Authorization: Bearer <token>` header carries one of the configured
+ * tokens.  Pass it to `withMiddleware(BearerTokenAuth({tokens: [...]}), route)`.
+ *
+ *     const protected = withMiddleware(
+ *       BearerTokenAuth({ tokens: [process.env.MGMT_TOKEN!] }),
+ *       path('cluster', concat(
+ *         path('down', post(handleDown)),
+ *         path('leave', post(handleLeave)),
+ *       )),
+ *     );
+ */
+export declare function BearerTokenAuth(opts: BearerTokenAuthOptions): Middleware;
+//# sourceMappingURL=BearerToken.d.ts.map

package/dist/http/middleware/BearerToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BearerToken.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/BearerToken.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;OAEG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,UAAU,CA+CxE"}

package/dist/http/middleware/BearerToken.js

@@ -0,0 +1,72 @@
+/**
+ * Shared-secret bearer-token authentication middleware (#312).
+ *
+ * Use this to gate routes that need to be accessible only to operators
+ * holding a pre-shared secret — typically the destructive management
+ * endpoints (`/cluster/down`, `/cluster/leave`).  Comparison is
+ * constant-time so an attacker probing tokens can't distinguish
+ * "first character wrong" from "last character wrong" by timing.
+ */
+import { timingSafeEqual } from 'node:crypto';
+import { HttpError, Status } from '../types.js';
+/**
+ * Build a `Middleware` that 401s every request unless the
+ * `Authorization: Bearer <token>` header carries one of the configured
+ * tokens.  Pass it to `withMiddleware(BearerTokenAuth({tokens: [...]}), route)`.
+ *
+ *     const protected = withMiddleware(
+ *       BearerTokenAuth({ tokens: [process.env.MGMT_TOKEN!] }),
+ *       path('cluster', concat(
+ *         path('down', post(handleDown)),
+ *         path('leave', post(handleLeave)),
+ *       )),
+ *     );
+ */
+export function BearerTokenAuth(opts) {
+    if (opts.tokens.length === 0) {
+        throw new Error('BearerTokenAuth: tokens must be a non-empty list');
+    }
+    const headerName = (opts.headerName ?? 'authorization').toLowerCase();
+    const realm = opts.realm ?? 'actor-ts';
+    // Pre-encode tokens once for constant-time comparison.
+    const expected = opts.tokens.map((t) => new TextEncoder().encode(t));
+    return async (req, next) => {
+        const header = req.headers[headerName];
+        if (!header) {
+            throw new HttpError(Status.Unauthorized, 'missing Authorization header', undefined, {
+                'www-authenticate': `Bearer realm="${realm}"`,
+            });
+        }
+        // Header value must look like `Bearer <token>`.  Reject anything else
+        // to avoid accidental matches against scheme-prefixed values.
+        const match = /^Bearer\s+(.+)$/.exec(header);
+        if (!match) {
+            throw new HttpError(Status.Unauthorized, 'authorization scheme must be Bearer', undefined, {
+                'www-authenticate': `Bearer realm="${realm}"`,
+            });
+        }
+        const presented = new TextEncoder().encode(match[1].trim());
+        let matched = false;
+        // We MUST iterate every expected token regardless of an early match
+        // so the total comparison time is constant across the (legit-token,
+        // wrong-token, no-token) outcomes.  `timingSafeEqual` itself is
+        // constant-time only when buffers are the same length, so we
+        // length-mismatch any mismatched-length comparison after a probe.
+        for (const candidate of expected) {
+            const equal = candidate.length === presented.length
+                && timingSafeEqual(candidate, presented);
+            // OR the result without short-circuiting.  `||=` on a boolean
+            // doesn't short-circuit at the bytecode level here because both
+            // operands are already evaluated above.
+            if (equal)
+                matched = true;
+        }
+        if (!matched) {
+            throw new HttpError(Status.Unauthorized, 'invalid bearer token', undefined, {
+                'www-authenticate': `Bearer realm="${realm}"`,
+            });
+        }
+        return next();
+    };
+}
+//# sourceMappingURL=BearerToken.js.map

package/dist/http/middleware/BearerToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BearerToken.js","sourceRoot":"","sources":["../../../src/http/middleware/BearerToken.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAuBhD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,IAA4B;IAC1D,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;IACtE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC;IAEvC,uDAAuD;IACvD,MAAM,QAAQ,GAAiB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnF,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,YAAY,EAAE,8BAA8B,EAAE,SAAS,EAAE;gBAClF,kBAAkB,EAAE,iBAAiB,KAAK,GAAG;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,sEAAsE;QACtE,8DAA8D;QAC9D,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,YAAY,EAAE,qCAAqC,EAAE,SAAS,EAAE;gBACzF,kBAAkB,EAAE,iBAAiB,KAAK,GAAG;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,oEAAoE;QACpE,oEAAoE;QACpE,gEAAgE;QAChE,6DAA6D;QAC7D,kEAAkE;QAClE,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;mBAC9C,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAC3C,8DAA8D;YAC9D,gEAAgE;YAChE,wCAAwC;YACxC,IAAI,KAAK;gBAAE,OAAO,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,YAAY,EAAE,sBAAsB,EAAE,SAAS,EAAE;gBAC1E,kBAAkB,EAAE,iBAAiB,KAAK,GAAG;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/http/middleware/Cors.d.ts

@@ -0,0 +1,39 @@
+/**
+ * CORS as a route directive.  A plain middleware cannot do CORS correctly:
+ * a preflight `OPTIONS` to a `GET`-only pattern never matches a compiled
+ * route, so no middleware would run.  Instead `cors(options, child)` is a
+ * dedicated Route kind that the compiler expands via {@link expandCors} —
+ * decorating the real responses AND synthesising an `OPTIONS` preflight
+ * route per pattern.
+ *
+ * Ordering: place `cors()` OUTSIDE any auth middleware.  The synthesised
+ * preflight routes are ordinary children of an enclosing
+ * `withMiddleware(...)`, and preflights are anonymous by spec — wrapping
+ * them in auth would 401 every preflight.
+ */
+import type { CompiledEndpoint, Route } from '../Route.js';
+import type { HttpMethod } from '../types.js';
+import { type CorsOptions, type CorsOrigin } from './CorsOptions.js';
+/** Resolved CORS policy stored on the `cors` Route node. */
+export interface CorsRouteOptions {
+    readonly origins: CorsOrigin;
+    readonly methods?: ReadonlyArray<HttpMethod>;
+    readonly allowedHeaders?: ReadonlyArray<string>;
+    readonly exposedHeaders?: ReadonlyArray<string>;
+    readonly credentials: boolean;
+    readonly maxAge?: number;
+}
+/**
+ * Apply the CORS policy to `child`'s subtree.  Validates the options up
+ * front: `origins` is required, and `credentials` cannot be combined with
+ * `'*'` (the Fetch spec forbids `Access-Control-Allow-Origin: *` with
+ * credentials).
+ */
+export declare function cors(options: CorsOptions, child: Route): Route;
+/**
+ * Expand a `cors` node's compiled children: decorate real responses, fold
+ * an origin check into WebSocket upgrades, and synthesise a per-pattern
+ * `OPTIONS` preflight (or intercept a user-defined one).
+ */
+export declare function expandCors(children: CompiledEndpoint[], settings: CorsRouteOptions): CompiledEndpoint[];
+//# sourceMappingURL=Cors.d.ts.map

package/dist/http/middleware/Cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Cors.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/Cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,KAAK,EAAE,UAAU,EAA6B,MAAM,aAAa,CAAC;AAEzE,OAAO,EAAwB,KAAK,WAAW,EAAwB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEjH,4DAA4D;AAC5D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IAC7C,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,wBAAgB,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,GAAG,KAAK,CAe9D;AAmED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,GAAG,gBAAgB,EAAE,CA+DvG"}