actor-ts 0.9.1 → 0.11.0

package/dist/http/middleware/Csrf.js

@@ -0,0 +1,165 @@
+/**
+ * Cross-Site Request Forgery protection.
+ *
+ * The framework has no session concept, so this is a stateless
+ * double-submit scheme HARDENED with an HMAC: the token is
+ * `payload.hmac(secret, payload)`.  A plain double-submit is defeated by
+ * an attacker who can plant a cookie (from a sibling subdomain or a
+ * MITM'd http origin) and send a matching header; the HMAC binds validity
+ * to the server secret, so a planted pair fails verification.  On unsafe
+ * methods it also checks Origin/Referer as a second gate.
+ *
+ * The cookie is intentionally NOT HttpOnly: same-origin JS must read it to
+ * echo it into the header.  The token authenticates nothing on its own
+ * (auth still rides the session/auth cookie), and any XSS able to read it
+ * already defeats every CSRF scheme.
+ */
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { HttpError, Status } from '../types.js';
+import { parseCookies, serializeCookie } from '../cookies.js';
+import { applyHeaders } from './headers.js';
+import { CsrfOptionsValidator, } from './CsrfOptions.js';
+const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
+function hostOf(urlLike) {
+    try {
+        return new URL(urlLike).host;
+    }
+    catch {
+        return null;
+    }
+}
+/** Same-origin check for unsafe methods: the Origin/Referer host must match the request host (or an allowlisted origin). */
+function isSameOrigin(req, allowedOrigins, allowMissing) {
+    const source = req.headers['origin'] ?? req.headers['referer'];
+    if (!source)
+        return allowMissing;
+    const sourceHost = hostOf(source);
+    if (!sourceHost)
+        return false;
+    if (req.headers['host'] && sourceHost === req.headers['host'])
+        return true;
+    if (allowedOrigins) {
+        for (const allowed of allowedOrigins) {
+            if (allowed === source || hostOf(allowed) === sourceHost)
+                return true;
+        }
+    }
+    return false;
+}
+/**
+ * Reject unsafe-method requests (POST/PUT/PATCH/DELETE) whose
+ * Origin/Referer is cross-origin.  A lightweight standalone CSRF defence
+ * for modern browsers; {@link csrfProtection} is the belt-and-suspenders
+ * option.
+ */
+export function requireSameOrigin(options = {}) {
+    const resolvedOptions = options;
+    return async (req, next) => {
+        if (SAFE_METHODS.has(req.method))
+            return next();
+        if (!isSameOrigin(req, resolvedOptions.allowedOrigins, resolvedOptions.allowMissingOrigin ?? false)) {
+            throw new HttpError(Status.Forbidden, 'cross-origin request rejected');
+        }
+        return next();
+    };
+}
+function sign(secret, payload) {
+    return createHmac('sha256', secret).update(payload).digest('base64url');
+}
+function makeToken(secret) {
+    const payload = randomBytes(32).toString('base64url');
+    return `${payload}.${sign(secret, payload)}`;
+}
+/** Constant-time string compare (equal-length only; length is fixed for our tokens). */
+function safeEqual(a, b) {
+    const ab = Buffer.from(a);
+    const bb = Buffer.from(b);
+    return ab.length === bb.length && timingSafeEqual(ab, bb);
+}
+/** A token is valid iff its HMAC recomputes — a planted/unsigned token fails here. */
+function verifyToken(secret, token) {
+    const dot = token.lastIndexOf('.');
+    if (dot <= 0)
+        return false;
+    return safeEqual(token.slice(dot + 1), sign(secret, token.slice(0, dot)));
+}
+function hasSetCookie(headers) {
+    if (!headers)
+        return false;
+    return Object.keys(headers).some((k) => k.toLowerCase() === 'set-cookie');
+}
+function formFieldValue(req, field) {
+    const ct = req.headers['content-type'] ?? '';
+    if (!ct.includes('application/x-www-form-urlencoded') || !req.body)
+        return undefined;
+    try {
+        return new URLSearchParams(new TextDecoder().decode(req.body)).get(field) ?? undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Read the CSRF token an SSR handler should template into its form/meta —
+ * the forwarded request header first (present from the very first GET),
+ * then the cookie.
+ */
+export function readCsrfToken(req, opts = {}) {
+    const fromHeader = req.headers[(opts.headerName ?? 'x-csrf-token').toLowerCase()];
+    if (fromHeader)
+        return fromHeader;
+    return parseCookies(req.headers['cookie'])[opts.cookieName ?? 'csrf-token'] ?? null;
+}
+/** Build the stateless double-submit CSRF middleware. */
+export function csrfProtection(options) {
+    const resolvedOptions = options;
+    const secret = resolvedOptions.secret;
+    // Required-field guard stays a bare Error; the >= 16-byte validity of a
+    // PRESENT secret (and the nested cookie rules) move to the validator.
+    if (secret === undefined) {
+        throw new Error('csrfProtection: a secret of at least 16 bytes is required (32 recommended)');
+    }
+    new CsrfOptionsValidator().validate(resolvedOptions);
+    const cookieName = resolvedOptions.cookieName ?? 'csrf-token';
+    const headerName = (resolvedOptions.headerName ?? 'x-csrf-token').toLowerCase();
+    const cookie = resolvedOptions.cookie ?? {};
+    const cookieAttrs = {
+        path: cookie.path ?? '/',
+        secure: cookie.secure ?? true,
+        sameSite: cookie.sameSite ?? 'lax',
+        httpOnly: false, // JS must read it to echo it into the header
+        domain: cookie.domain,
+        maxAgeSeconds: cookie.maxAgeSeconds,
+    };
+    const verifyOrigin = resolvedOptions.verifyOrigin ?? true;
+    const formFieldName = resolvedOptions.formFieldName;
+    return async (req, next) => {
+        const cookies = parseCookies(req.headers['cookie']);
+        const cookieToken = cookies[cookieName];
+        if (SAFE_METHODS.has(req.method)) {
+            const token = cookieToken && verifyToken(secret, cookieToken) ? cookieToken : makeToken(secret);
+            // Forward the token to the handler as a request header so an SSR
+            // handler can read it via readCsrfToken() even on the first GET.
+            const res = await next({ ...req, headers: { ...req.headers, [headerName]: token } });
+            if (hasSetCookie(res.headers))
+                return res; // single-value Record — don't stomp
+            return applyHeaders(res, {
+                'set-cookie': serializeCookie(cookieName, token, cookieAttrs),
+            });
+        }
+        // Unsafe method: origin gate (token is the primary gate, so a missing
+        // Origin/Referer is allowed through to the token check), then the pair.
+        if (verifyOrigin && !isSameOrigin(req, resolvedOptions.allowedOrigins, true)) {
+            throw new HttpError(Status.Forbidden, 'CSRF verification failed');
+        }
+        const submitted = req.headers[headerName] ?? (formFieldName ? formFieldValue(req, formFieldName) : undefined);
+        if (!cookieToken
+            || submitted === undefined
+            || !verifyToken(secret, cookieToken)
+            || !safeEqual(cookieToken, submitted)) {
+            throw new HttpError(Status.Forbidden, 'CSRF verification failed');
+        }
+        return next();
+    };
+}
+//# sourceMappingURL=Csrf.js.map

package/dist/http/middleware/Csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Csrf.js","sourceRoot":"","sources":["../../../src/http/middleware/Csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAoB,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACL,oBAAoB,GAKrB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAEzD,SAAS,MAAM,CAAC,OAAe;IAC7B,IAAI,CAAC;QAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC9D,CAAC;AAED,4HAA4H;AAC5H,SAAS,YAAY,CAAC,GAAgB,EAAE,cAAiD,EAAE,YAAqB;IAC9G,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM;QAAE,OAAO,YAAY,CAAC;IACjC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,UAAU,KAAK,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,IAAI,cAAc,EAAE,CAAC;QACnB,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;YACrC,IAAI,OAAO,KAAK,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU;gBAAE,OAAO,IAAI,CAAC;QACxE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAA6B,EAAE;IAC/D,MAAM,eAAe,GAAG,OAAyC,CAAC;IAClE,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,eAAe,CAAC,cAAc,EAAE,eAAe,CAAC,kBAAkB,IAAI,KAAK,CAAC,EAAE,CAAC;YACpG,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,+BAA+B,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,MAA2B,EAAE,OAAe;IACxD,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,SAAS,CAAC,MAA2B;IAC5C,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACtD,OAAO,GAAG,OAAO,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,wFAAwF;AACxF,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,IAAI,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,sFAAsF;AACtF,SAAS,WAAW,CAAC,MAA2B,EAAE,KAAa;IAC7D,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,YAAY,CAAC,OAAqD;IACzE,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,YAAY,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,cAAc,CAAC,GAAgB,EAAE,KAAa;IACrD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IACrF,IAAI,CAAC;QACH,OAAO,IAAI,eAAe,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAgB,EAAE,OAAqD,EAAE;IACrG,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAClF,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,OAAO,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,YAAY,CAAC,IAAI,IAAI,CAAC;AACtF,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,cAAc,CAAC,OAAoB;IACjD,MAAM,eAAe,GAAG,OAAmC,CAAC;IAC5D,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC;IACtC,wEAAwE;IACxE,sEAAsE;IACtE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,oBAAoB,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU,IAAI,YAAY,CAAC;IAC9D,MAAM,UAAU,GAAG,CAAC,eAAe,CAAC,UAAU,IAAI,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC;IAChF,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,IAAI,EAAE,CAAC;IAC5C,MAAM,WAAW,GAAG;QAClB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,GAAG;QACxB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;QAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,KAAc;QAC3C,QAAQ,EAAE,KAAK,EAAE,6CAA6C;QAC9D,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,aAAa,EAAE,MAAM,CAAC,aAAa;KACpC,CAAC;IACF,MAAM,YAAY,GAAG,eAAe,CAAC,YAAY,IAAI,IAAI,CAAC;IAC1D,MAAM,aAAa,GAAG,eAAe,CAAC,aAAa,CAAC;IAEpD,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpD,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;QAExC,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,WAAW,IAAI,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAChG,iEAAiE;YACjE,iEAAiE;YACjE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YACrF,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,OAAO,GAAG,CAAC,CAAC,oCAAoC;YAC/E,OAAO,YAAY,CAAC,GAAG,EAAE;gBACvB,YAAY,EAAE,eAAe,CAAC,UAAU,EAAE,KAAK,EAAE,WAAW,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;QAED,sEAAsE;QACtE,wEAAwE;QACxE,IAAI,YAAY,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,eAAe,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC9G,IACE,CAAC,WAAW;eACT,SAAS,KAAK,SAAS;eACvB,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC;eACjC,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,EACrC,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/http/middleware/CsrfOptions.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Options for {@link csrfProtection} and {@link requireSameOrigin}.  Both
+ * option families live here (they are two facets of the same CSRF story).
+ * Options-only — the secret belongs in code / a secret manager, never a
+ * HOCON file.
+ */
+import { OptionsBuilder } from '../../util/OptionsBuilder.js';
+import { OptionsValidator } from '../../util/OptionsValidator.js';
+/** Attributes for the CSRF cookie (a subset of the general cookie attributes). */
+export interface CsrfCookieOptions {
+    readonly path?: string;
+    readonly secure?: boolean;
+    readonly sameSite?: 'strict' | 'lax' | 'none';
+    readonly domain?: string;
+    readonly maxAgeSeconds?: number;
+}
+/** Plain settings shape for {@link csrfProtection}. */
+export interface CsrfOptionsType {
+    /** REQUIRED — HMAC key, at least 16 bytes (32 recommended). */
+    readonly secret?: string | Uint8Array;
+    /** Cookie name.  Default `'csrf-token'`. */
+    readonly cookieName?: string;
+    /** Request header carrying the token.  Default `'x-csrf-token'`. */
+    readonly headerName?: string;
+    /** Cookie attributes.  Defaults: Path=/, Secure, SameSite=Lax, HttpOnly=false. */
+    readonly cookie?: CsrfCookieOptions;
+    /** Also require a same-origin Origin/Referer on unsafe methods.  Default true. */
+    readonly verifyOrigin?: boolean;
+    /** Extra full origins accepted by the origin check. */
+    readonly allowedOrigins?: ReadonlyArray<string>;
+    /** Also read the token from this urlencoded body field (classic forms).  Default off. */
+    readonly formFieldName?: string;
+}
+/** Fluent builder for {@link CsrfOptionsType}. */
+export declare class CsrfOptionsBuilder extends OptionsBuilder<CsrfOptionsType> {
+    static create(): CsrfOptionsBuilder;
+    withSecret(secret: string | Uint8Array): this;
+    withCookieName(name: string): this;
+    withHeaderName(name: string): this;
+    withCookie(cookie: CsrfCookieOptions): this;
+    withVerifyOrigin(flag?: boolean): this;
+    withAllowedOrigins(...origins: string[]): this;
+    withFormField(name: string): this;
+}
+/** Accepted input for {@link csrfProtection}. */
+export type CsrfOptions = CsrfOptionsBuilder | Partial<CsrfOptionsType>;
+export declare const CsrfOptions: typeof CsrfOptionsBuilder;
+/**
+ * Validates resolved {@link CsrfOptionsType} settings.  All rules are
+ * bespoke: `secret` is a `string | Uint8Array` union (byte length must be
+ * >= 16), and the cookie attributes are nested.  A `secret` that is simply
+ * absent is a REQUIRED-field error enforced by `csrfProtection`, not here —
+ * the validator only checks the validity of a PRESENT secret.
+ */
+export declare class CsrfOptionsValidator extends OptionsValidator<CsrfOptionsType> {
+    constructor();
+    protected rules(s: Partial<CsrfOptionsType>): void;
+}
+/** Plain settings shape for {@link requireSameOrigin}. */
+export interface SameOriginOptionsType {
+    /** Full origins accepted beyond the request's own host. */
+    readonly allowedOrigins?: ReadonlyArray<string>;
+    /** Allow unsafe methods that carry neither Origin nor Referer.  Default false. */
+    readonly allowMissingOrigin?: boolean;
+}
+/** Fluent builder for {@link SameOriginOptionsType}. */
+export declare class SameOriginOptionsBuilder extends OptionsBuilder<SameOriginOptionsType> {
+    static create(): SameOriginOptionsBuilder;
+    withAllowedOrigins(...origins: string[]): this;
+    withAllowMissingOrigin(flag?: boolean): this;
+}
+/** Accepted input for {@link requireSameOrigin}. */
+export type SameOriginOptions = SameOriginOptionsBuilder | Partial<SameOriginOptionsType>;
+export declare const SameOriginOptions: typeof SameOriginOptionsBuilder;
+//# sourceMappingURL=CsrfOptions.d.ts.map

package/dist/http/middleware/CsrfOptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CsrfOptions.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/CsrfOptions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAElE,kFAAkF;AAClF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC9C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,uDAAuD;AACvD,MAAM,WAAW,eAAe;IAC9B,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IACtC,4CAA4C;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,oEAAoE;IACpE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,kFAAkF;IAClF,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC,kFAAkF;IAClF,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,uDAAuD;IACvD,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD,yFAAyF;IACzF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,kDAAkD;AAClD,qBAAa,kBAAmB,SAAQ,cAAc,CAAC,eAAe,CAAC;IACrE,MAAM,CAAC,MAAM,IAAI,kBAAkB;IAGnC,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;IAG7C,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAGlC,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAGlC,UAAU,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI;IAG3C,gBAAgB,CAAC,IAAI,UAAO,GAAG,IAAI;IAGnC,kBAAkB,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI;IAG9C,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;CAGlC;AAED,iDAAiD;AACjD,MAAM,MAAM,WAAW,GAAG,kBAAkB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;AACxE,eAAO,MAAM,WAAW,2BAAqB,CAAC;AAE9C;;;;;;GAMG;AACH,qBAAa,oBAAqB,SAAQ,gBAAgB,CAAC,eAAe,CAAC;;IAIzE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI;CAmBnD;AAED,0DAA0D;AAC1D,MAAM,WAAW,qBAAqB;IACpC,2DAA2D;IAC3D,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD,kFAAkF;IAClF,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CACvC;AAED,wDAAwD;AACxD,qBAAa,wBAAyB,SAAQ,cAAc,CAAC,qBAAqB,CAAC;IACjF,MAAM,CAAC,MAAM,IAAI,wBAAwB;IAGzC,kBAAkB,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI;IAG9C,sBAAsB,CAAC,IAAI,UAAO,GAAG,IAAI;CAG1C;AAED,oDAAoD;AACpD,MAAM,MAAM,iBAAiB,GAAG,wBAAwB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAC1F,eAAO,MAAM,iBAAiB,iCAA2B,CAAC"}

package/dist/http/middleware/CsrfOptions.js

@@ -0,0 +1,80 @@
+/**
+ * Options for {@link csrfProtection} and {@link requireSameOrigin}.  Both
+ * option families live here (they are two facets of the same CSRF story).
+ * Options-only — the secret belongs in code / a secret manager, never a
+ * HOCON file.
+ */
+import { OptionsBuilder } from '../../util/OptionsBuilder.js';
+import { OptionsValidator } from '../../util/OptionsValidator.js';
+/** Fluent builder for {@link CsrfOptionsType}. */
+export class CsrfOptionsBuilder extends OptionsBuilder {
+    static create() {
+        return new CsrfOptionsBuilder();
+    }
+    withSecret(secret) {
+        return this.set('secret', secret);
+    }
+    withCookieName(name) {
+        return this.set('cookieName', name);
+    }
+    withHeaderName(name) {
+        return this.set('headerName', name);
+    }
+    withCookie(cookie) {
+        return this.set('cookie', cookie);
+    }
+    withVerifyOrigin(flag = true) {
+        return this.set('verifyOrigin', flag);
+    }
+    withAllowedOrigins(...origins) {
+        return this.set('allowedOrigins', origins);
+    }
+    withFormField(name) {
+        return this.set('formFieldName', name);
+    }
+}
+export const CsrfOptions = CsrfOptionsBuilder;
+/**
+ * Validates resolved {@link CsrfOptionsType} settings.  All rules are
+ * bespoke: `secret` is a `string | Uint8Array` union (byte length must be
+ * >= 16), and the cookie attributes are nested.  A `secret` that is simply
+ * absent is a REQUIRED-field error enforced by `csrfProtection`, not here —
+ * the validator only checks the validity of a PRESENT secret.
+ */
+export class CsrfOptionsValidator extends OptionsValidator {
+    constructor() {
+        super('CsrfOptions');
+    }
+    rules(s) {
+        const { secret } = s;
+        if (secret !== undefined) {
+            const len = typeof secret === 'string' ? new TextEncoder().encode(secret).length : secret.length;
+            if (len < 16)
+                this.fail('secret', 'must be at least 16 bytes', len);
+        }
+        const cookie = s.cookie;
+        if (cookie) {
+            if (cookie.sameSite !== undefined && !['strict', 'lax', 'none'].includes(cookie.sameSite)) {
+                this.fail('cookie.sameSite', 'must be one of strict, lax, none', cookie.sameSite);
+            }
+            if (cookie.maxAgeSeconds !== undefined &&
+                (typeof cookie.maxAgeSeconds !== 'number' || !Number.isFinite(cookie.maxAgeSeconds) || cookie.maxAgeSeconds < 0)) {
+                this.fail('cookie.maxAgeSeconds', 'must be a non-negative finite number', cookie.maxAgeSeconds);
+            }
+        }
+    }
+}
+/** Fluent builder for {@link SameOriginOptionsType}. */
+export class SameOriginOptionsBuilder extends OptionsBuilder {
+    static create() {
+        return new SameOriginOptionsBuilder();
+    }
+    withAllowedOrigins(...origins) {
+        return this.set('allowedOrigins', origins);
+    }
+    withAllowMissingOrigin(flag = true) {
+        return this.set('allowMissingOrigin', flag);
+    }
+}
+export const SameOriginOptions = SameOriginOptionsBuilder;
+//# sourceMappingURL=CsrfOptions.js.map

package/dist/http/middleware/CsrfOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CsrfOptions.js","sourceRoot":"","sources":["../../../src/http/middleware/CsrfOptions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AA6BlE,kDAAkD;AAClD,MAAM,OAAO,kBAAmB,SAAQ,cAA+B;IACrE,MAAM,CAAC,MAAM;QACX,OAAO,IAAI,kBAAkB,EAAE,CAAC;IAClC,CAAC;IACD,UAAU,CAAC,MAA2B;QACpC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IACD,cAAc,CAAC,IAAY;QACzB,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,cAAc,CAAC,IAAY;QACzB,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,UAAU,CAAC,MAAyB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IACD,gBAAgB,CAAC,IAAI,GAAG,IAAI;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,kBAAkB,CAAC,GAAG,OAAiB;QACrC,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IACD,aAAa,CAAC,IAAY;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;CACF;AAID,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,OAAO,oBAAqB,SAAQ,gBAAiC;IACzE;QACE,KAAK,CAAC,aAAa,CAAC,CAAC;IACvB,CAAC;IACS,KAAK,CAAC,CAA2B;QACzC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QACrB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;YACjG,IAAI,GAAG,GAAG,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,2BAA2B,EAAE,GAAG,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QACxB,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1F,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,kCAAkC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACpF,CAAC;YACD,IACE,MAAM,CAAC,aAAa,KAAK,SAAS;gBAClC,CAAC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,aAAa,GAAG,CAAC,CAAC,EAChH,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,sCAAsC,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAUD,wDAAwD;AACxD,MAAM,OAAO,wBAAyB,SAAQ,cAAqC;IACjF,MAAM,CAAC,MAAM;QACX,OAAO,IAAI,wBAAwB,EAAE,CAAC;IACxC,CAAC;IACD,kBAAkB,CAAC,GAAG,OAAiB;QACrC,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IACD,sBAAsB,CAAC,IAAI,GAAG,IAAI;QAChC,OAAO,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;CACF;AAID,MAAM,CAAC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC"}

package/dist/http/middleware/Hsts.d.ts

@@ -0,0 +1,28 @@
+/**
+ * HTTP Strict-Transport-Security middleware.
+ *
+ * Sets the `Strict-Transport-Security` header unconditionally (no HTTPS
+ * gating): an `HttpRequest` carries no scheme, framework servers usually
+ * sit behind a TLS-terminating proxy, and per RFC 6797 §8.1 browsers
+ * ignore the header over plain HTTP anyway — so a plain-HTTP dev server is
+ * a harmless no-op.
+ */
+import type { Middleware } from '../Route.js';
+import { type HstsOptions, type HstsOptionsType } from './HstsOptions.js';
+export interface ResolvedHsts {
+    readonly maxAge: number;
+    readonly includeSubDomains: boolean;
+    readonly preload: boolean;
+}
+/** Apply defaults + validate an HSTS options bag (shared with securityHeaders). */
+export declare function resolveHsts(options: Partial<HstsOptionsType>): ResolvedHsts;
+/** Format the resolved policy as the header value. */
+export declare function hstsHeaderValue(r: ResolvedHsts): string;
+/**
+ * Build a middleware that adds `Strict-Transport-Security` to every
+ * response (without clobbering one a handler already set).
+ */
+export declare function strictTransportSecurity(options?: HstsOptions): Middleware;
+/** Short alias for {@link strictTransportSecurity}. */
+export declare const hsts: typeof strictTransportSecurity;
+//# sourceMappingURL=Hsts.d.ts.map

package/dist/http/middleware/Hsts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Hsts.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/Hsts.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAwB,KAAK,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEhG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,YAAY,CAU3E;AAED,sDAAsD;AACtD,wBAAgB,eAAe,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,CAKvD;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,WAAgB,GAAG,UAAU,CAG7E;AAED,uDAAuD;AACvD,eAAO,MAAM,IAAI,gCAA0B,CAAC"}

package/dist/http/middleware/Hsts.js

@@ -0,0 +1,34 @@
+import { applyHeaders } from './headers.js';
+import { HstsOptionsValidator } from './HstsOptions.js';
+/** Apply defaults + validate an HSTS options bag (shared with securityHeaders). */
+export function resolveHsts(options) {
+    const resolved = {
+        maxAge: options.maxAge ?? 15_552_000, // 180 days
+        includeSubDomains: options.includeSubDomains ?? true,
+        preload: options.preload ?? false,
+    };
+    // hstspreload.org submission rules — refuse a policy that could never
+    // actually be preloaded rather than emitting a silently-useless header.
+    new HstsOptionsValidator().validate(resolved);
+    return resolved;
+}
+/** Format the resolved policy as the header value. */
+export function hstsHeaderValue(r) {
+    let value = `max-age=${r.maxAge}`;
+    if (r.includeSubDomains)
+        value += '; includeSubDomains';
+    if (r.preload)
+        value += '; preload';
+    return value;
+}
+/**
+ * Build a middleware that adds `Strict-Transport-Security` to every
+ * response (without clobbering one a handler already set).
+ */
+export function strictTransportSecurity(options = {}) {
+    const value = hstsHeaderValue(resolveHsts(options));
+    return async (_req, next) => applyHeaders(await next(), { 'strict-transport-security': value });
+}
+/** Short alias for {@link strictTransportSecurity}. */
+export const hsts = strictTransportSecurity;
+//# sourceMappingURL=Hsts.js.map

package/dist/http/middleware/Hsts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Hsts.js","sourceRoot":"","sources":["../../../src/http/middleware/Hsts.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAA0C,MAAM,kBAAkB,CAAC;AAQhG,mFAAmF;AACnF,MAAM,UAAU,WAAW,CAAC,OAAiC;IAC3D,MAAM,QAAQ,GAAiB;QAC7B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,UAAU,EAAE,WAAW;QACjD,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,IAAI;QACpD,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,KAAK;KAClC,CAAC;IACF,sEAAsE;IACtE,wEAAwE;IACxE,IAAI,oBAAoB,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC9C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,eAAe,CAAC,CAAe;IAC7C,IAAI,KAAK,GAAG,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC,IAAI,CAAC,CAAC,iBAAiB;QAAE,KAAK,IAAI,qBAAqB,CAAC;IACxD,IAAI,CAAC,CAAC,OAAO;QAAE,KAAK,IAAI,WAAW,CAAC;IACpC,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAAuB,EAAE;IAC/D,MAAM,KAAK,GAAG,eAAe,CAAC,WAAW,CAAC,OAAmC,CAAC,CAAC,CAAC;IAChF,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,IAAI,EAAE,EAAE,EAAE,2BAA2B,EAAE,KAAK,EAAE,CAAC,CAAC;AAClG,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,MAAM,IAAI,GAAG,uBAAuB,CAAC"}

package/dist/http/middleware/HstsOptions.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Options for the {@link strictTransportSecurity} middleware.  Three
+ * exports in the Options family (type / builder / union), per the repo
+ * convention.  Options-only — like the other HTTP middleware, this reads
+ * no HOCON (a middleware factory has no ActorSystem to resolve against).
+ */
+import { OptionsBuilder } from '../../util/OptionsBuilder.js';
+import { OptionsValidator } from '../../util/OptionsValidator.js';
+/**
+ * Minimum `max-age` (1 year, in seconds) the hstspreload.org submission
+ * rules require before a `preload` policy is accepted.
+ */
+export declare const HSTS_PRELOAD_MIN_MAX_AGE = 31536000;
+/** Plain settings shape for HSTS. */
+export interface HstsOptionsType {
+    /** `max-age` in seconds.  Default 15552000 (180 days). */
+    readonly maxAge?: number;
+    /** Emit `includeSubDomains`.  Default true. */
+    readonly includeSubDomains?: boolean;
+    /** Emit `preload`.  Default false; requires `maxAge >= 1 year` + `includeSubDomains`. */
+    readonly preload?: boolean;
+}
+/** Fluent builder for {@link HstsOptionsType}. */
+export declare class HstsOptionsBuilder extends OptionsBuilder<HstsOptionsType> {
+    static create(): HstsOptionsBuilder;
+    withMaxAge(seconds: number): this;
+    withIncludeSubDomains(flag?: boolean): this;
+    withPreload(flag?: boolean): this;
+}
+/** Accepted input: the builder or a plain object. */
+export type HstsOptions = HstsOptionsBuilder | Partial<HstsOptionsType>;
+export declare const HstsOptions: typeof HstsOptionsBuilder;
+/**
+ * Validates resolved {@link HstsOptionsType} settings.  `maxAge` must be a
+ * non-negative number of seconds; the cross-field rule mirrors the
+ * hstspreload.org submission requirements — a `preload` policy that could
+ * never actually be accepted (too-short `maxAge`, or `includeSubDomains`
+ * turned off) is rejected rather than emitting a silently-useless header.
+ */
+export declare class HstsOptionsValidator extends OptionsValidator<HstsOptionsType> {
+    constructor();
+    protected rules(s: Partial<HstsOptionsType>): void;
+}
+//# sourceMappingURL=HstsOptions.d.ts.map

package/dist/http/middleware/HstsOptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HstsOptions.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/HstsOptions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,wBAAwB,WAAa,CAAC;AAEnD,qCAAqC;AACrC,MAAM,WAAW,eAAe;IAC9B,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,+CAA+C;IAC/C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,yFAAyF;IACzF,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,kDAAkD;AAClD,qBAAa,kBAAmB,SAAQ,cAAc,CAAC,eAAe,CAAC;IACrE,MAAM,CAAC,MAAM,IAAI,kBAAkB;IAGnC,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAGjC,qBAAqB,CAAC,IAAI,UAAO,GAAG,IAAI;IAGxC,WAAW,CAAC,IAAI,UAAO,GAAG,IAAI;CAG/B;AAED,qDAAqD;AACrD,MAAM,MAAM,WAAW,GAAG,kBAAkB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;AACxE,eAAO,MAAM,WAAW,2BAAqB,CAAC;AAE9C;;;;;;GAMG;AACH,qBAAa,oBAAqB,SAAQ,gBAAgB,CAAC,eAAe,CAAC;;IAIzE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI;CASnD"}

package/dist/http/middleware/HstsOptions.js

@@ -0,0 +1,49 @@
+/**
+ * Options for the {@link strictTransportSecurity} middleware.  Three
+ * exports in the Options family (type / builder / union), per the repo
+ * convention.  Options-only — like the other HTTP middleware, this reads
+ * no HOCON (a middleware factory has no ActorSystem to resolve against).
+ */
+import { OptionsBuilder } from '../../util/OptionsBuilder.js';
+import { OptionsValidator } from '../../util/OptionsValidator.js';
+/**
+ * Minimum `max-age` (1 year, in seconds) the hstspreload.org submission
+ * rules require before a `preload` policy is accepted.
+ */
+export const HSTS_PRELOAD_MIN_MAX_AGE = 31_536_000;
+/** Fluent builder for {@link HstsOptionsType}. */
+export class HstsOptionsBuilder extends OptionsBuilder {
+    static create() {
+        return new HstsOptionsBuilder();
+    }
+    withMaxAge(seconds) {
+        return this.set('maxAge', seconds);
+    }
+    withIncludeSubDomains(flag = true) {
+        return this.set('includeSubDomains', flag);
+    }
+    withPreload(flag = true) {
+        return this.set('preload', flag);
+    }
+}
+export const HstsOptions = HstsOptionsBuilder;
+/**
+ * Validates resolved {@link HstsOptionsType} settings.  `maxAge` must be a
+ * non-negative number of seconds; the cross-field rule mirrors the
+ * hstspreload.org submission requirements — a `preload` policy that could
+ * never actually be accepted (too-short `maxAge`, or `includeSubDomains`
+ * turned off) is rejected rather than emitting a silently-useless header.
+ */
+export class HstsOptionsValidator extends OptionsValidator {
+    constructor() {
+        super('HstsOptions');
+    }
+    rules(s) {
+        this.nonNegativeNumber('maxAge');
+        if (s.preload === true &&
+            ((s.maxAge ?? 0) < HSTS_PRELOAD_MIN_MAX_AGE || s.includeSubDomains === false)) {
+            this.fail('preload', 'requires maxAge >= 31536000 (1 year) and includeSubDomains', s.preload);
+        }
+    }
+}
+//# sourceMappingURL=HstsOptions.js.map

package/dist/http/middleware/HstsOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"HstsOptions.js","sourceRoot":"","sources":["../../../src/http/middleware/HstsOptions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAElE;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,UAAU,CAAC;AAYnD,kDAAkD;AAClD,MAAM,OAAO,kBAAmB,SAAQ,cAA+B;IACrE,MAAM,CAAC,MAAM;QACX,OAAO,IAAI,kBAAkB,EAAE,CAAC;IAClC,CAAC;IACD,UAAU,CAAC,OAAe;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IACD,qBAAqB,CAAC,IAAI,GAAG,IAAI;QAC/B,OAAO,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IACD,WAAW,CAAC,IAAI,GAAG,IAAI;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;CACF;AAID,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,OAAO,oBAAqB,SAAQ,gBAAiC;IACzE;QACE,KAAK,CAAC,aAAa,CAAC,CAAC;IACvB,CAAC;IACS,KAAK,CAAC,CAA2B;QACzC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACjC,IACE,CAAC,CAAC,OAAO,KAAK,IAAI;YAClB,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,wBAAwB,IAAI,CAAC,CAAC,iBAAiB,KAAK,KAAK,CAAC,EAC7E,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,4DAA4D,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;CACF"}

package/dist/http/middleware/IpAllowlist.d.ts

@@ -0,0 +1,45 @@
+/**
+ * CIDR-based IP allowlist middleware (#312).
+ *
+ * Restricts a route subtree to clients whose IP falls inside one of
+ * the configured CIDRs.  Defence-in-depth on top of bearer-token auth
+ * (`BearerTokenAuth`): even if a token leaks, the attacker also needs
+ * to be on an allowlisted network to use it.
+ *
+ * Supports both IPv4 and IPv6 CIDRs in standard notation:
+ *   - `'10.0.0.0/8'` — RFC 1918 private space
+ *   - `'127.0.0.1/32'` — single host
+ *   - `'::1/128'` — IPv6 loopback
+ *   - `'fd00::/8'` — IPv6 ULA range
+ *
+ * IPv4-mapped IPv6 addresses (`::ffff:a.b.c.d`) are normalised so an
+ * IPv4 CIDR matches a request coming over a dual-stack socket.
+ *
+ * **Source of truth for the client IP** is the underlying socket
+ * (`req.remoteAddress`).  Operators behind a trusted reverse proxy
+ * (Cloudflare, AWS ALB, NGINX) that strip + set
+ * `x-forwarded-for` must pass a custom `getClientIp` that reads the
+ * header — the default DOES NOT trust `x-forwarded-for` because that
+ * header is client-spoofable when there's no proxy in front.
+ */
+import type { HttpRequest } from '../types.js';
+import type { Middleware } from '../Route.js';
+export interface IpAllowlistOptions {
+    /**
+     * One or more CIDR strings.  At least one must match the resolved
+     * client IP or the request gets a 403.
+     */
+    readonly allow: ReadonlyArray<string>;
+    /**
+     * Override the IP-extraction step.  Default: `req.remoteAddress`.
+     * Common override for deployments behind a trusted proxy:
+     *
+     *     getClientIp: (req) => req.headers['x-forwarded-for']?.split(',')[0]?.trim()
+     *
+     * Returning `null` / `undefined` makes the request fail closed
+     * (403) — no IP means no decision means deny.
+     */
+    readonly getClientIp?: (req: HttpRequest) => string | null | undefined;
+}
+export declare function IpAllowlist(opts: IpAllowlistOptions): Middleware;
+//# sourceMappingURL=IpAllowlist.d.ts.map

package/dist/http/middleware/IpAllowlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IpAllowlist.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/IpAllowlist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACxE;AAUD,wBAAgB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,UAAU,CAkBhE"}