flowingts 0.0.0 → 0.19.0

package/dist/decorators/log.js

@@ -0,0 +1,32 @@
+import { performance } from 'node:perf_hooks';
+/**
+ * Mede o tempo do handler, inclusive de handlers `async` (B-04).
+ * Uso: `@timer()` ou `@timer({ log: (msg, ms) => logger.info({ ms }, msg) })`.
+ */
+export function timer(opts = {}) {
+    const log = opts.log ?? ((msg) => console.debug(msg));
+    return (target, context) => {
+        const name = String(context.name);
+        const report = (start) => {
+            const ms = performance.now() - start;
+            log(`${name} took ${ms.toFixed(2)}ms`, ms);
+        };
+        return function (...args) {
+            const start = performance.now();
+            let result;
+            try {
+                result = target.call(this, ...args);
+            }
+            catch (err) {
+                report(start);
+                throw err;
+            }
+            if (result instanceof Promise) {
+                return result.finally(() => report(start));
+            }
+            report(start);
+            return result;
+        };
+    };
+}
+//# sourceMappingURL=log.js.map

package/dist/decorators/log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.js","sourceRoot":"","sources":["../../src/decorators/log.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAO9C;;;GAGG;AACH,MAAM,UAAU,KAAK,CAAC,IAAI,GAAiB,EAAE;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAE9D,OAAO,CACL,MAA6C,EAC7C,OAAiF,EACjF,EAAE;QACF,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE;YAC/B,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YACrC,GAAG,CAAC,GAAG,IAAI,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC7C,CAAC,CAAC;QAEF,OAAO,UAAsB,GAAG,IAAU;YACxC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAChC,IAAI,MAAc,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;YACtC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,CAAC;gBACd,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,IAAI,MAAM,YAAY,OAAO,EAAE,CAAC;gBAC9B,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAW,CAAC;YACvD,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,CAAC;YACd,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/decorators/middlewares.d.ts

@@ -0,0 +1,28 @@
+import type { Middleware } from '../core/compose.ts';
+import type { Guard } from '../core/guard.ts';
+type ClassOrMethodContext = ClassDecoratorContext | ClassMethodDecoratorContext;
+/**
+ * Middlewares para todas as rotas da classe ou para um método (F-01, F-30). Rodam depois dos globais
+ * e dos `middlewares` do `mount`, e antes dos guards. É o mesmo nome da opção `middlewares`.
+ *
+ * ```ts
+ * @Middlewares(rateLimit({ max: 10 }))   // todas as rotas da classe
+ * @Router('/auth')
+ * class AuthRoutes {
+ *   @Middlewares(audit) @Post('/login') login() {}
+ * }
+ * ```
+ */
+export declare function Middlewares(...middlewares: Middleware[]): (_value: unknown, context: ClassOrMethodContext) => void;
+/**
+ * Guards para todas as rotas da classe ou para um método (F-01, F-30). Rodam antes da validação;
+ * `false` responde 403. É o mesmo nome da opção `guards`.
+ *
+ * ```ts
+ * const isAdmin: Guard = (ctx) => ctx.state.user?.role === 'admin';
+ * @Guards(isAdmin) @Delete('/:id') remove() {}
+ * ```
+ */
+export declare function Guards(...guards: Guard[]): (_value: unknown, context: ClassOrMethodContext) => void;
+export {};
+//# sourceMappingURL=middlewares.d.ts.map

package/dist/decorators/middlewares.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middlewares.d.ts","sourceRoot":"","sources":["../../src/decorators/middlewares.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAG9C,KAAK,oBAAoB,GAAG,qBAAqB,GAAG,2BAA2B,CAAC;AAchF;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,GAAG,WAAW,EAAE,UAAU,EAAE,YAnBtC,OAAO,WAAW,oBAAoB,KAAG,IAAI,CAqB9D;AAED;;;;;;;;GAQG;AACH,wBAAgB,MAAM,CAAC,GAAG,MAAM,EAAE,KAAK,EAAE,YAhCvB,OAAO,WAAW,oBAAoB,KAAG,IAAI,CAkC9D"}

package/dist/decorators/middlewares.js

@@ -0,0 +1,40 @@
+import { getOrCreateMethod, metadataFor } from '../core/metadata.js';
+/**
+ * Aplica `items` na classe (todas as rotas) ou no método. Decorators são avaliados de baixo para
+ * cima; inserimos no início para que a ordem de execução siga a ordem de leitura (de cima para baixo).
+ */
+function register(decorator, pick, items) {
+    return (_value, context) => {
+        const meta = metadataFor(context, decorator);
+        const target = context.kind === 'class' ? meta : getOrCreateMethod(meta, context.name);
+        target[pick].unshift(...items);
+    };
+}
+/**
+ * Middlewares para todas as rotas da classe ou para um método (F-01, F-30). Rodam depois dos globais
+ * e dos `middlewares` do `mount`, e antes dos guards. É o mesmo nome da opção `middlewares`.
+ *
+ * ```ts
+ * @Middlewares(rateLimit({ max: 10 }))   // todas as rotas da classe
+ * @Router('/auth')
+ * class AuthRoutes {
+ *   @Middlewares(audit) @Post('/login') login() {}
+ * }
+ * ```
+ */
+export function Middlewares(...middlewares) {
+    return register('Middlewares', 'middlewares', middlewares);
+}
+/**
+ * Guards para todas as rotas da classe ou para um método (F-01, F-30). Rodam antes da validação;
+ * `false` responde 403. É o mesmo nome da opção `guards`.
+ *
+ * ```ts
+ * const isAdmin: Guard = (ctx) => ctx.state.user?.role === 'admin';
+ * @Guards(isAdmin) @Delete('/:id') remove() {}
+ * ```
+ */
+export function Guards(...guards) {
+    return register('Guards', 'guards', guards);
+}
+//# sourceMappingURL=middlewares.js.map

package/dist/decorators/middlewares.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middlewares.js","sourceRoot":"","sources":["../../src/decorators/middlewares.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAIrE;;;GAGG;AACH,SAAS,QAAQ,CAAC,SAAiB,EAAE,IAA8B,EAAE,KAAyB;IAC5F,OAAO,CAAC,MAAe,EAAE,OAA6B,EAAQ,EAAE;QAC9D,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACtF,MAAM,CAAC,IAAI,CAAe,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IAChD,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CAAC,GAAG,WAAyB;IACtD,OAAO,QAAQ,CAAC,aAAa,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,MAAM,CAAC,GAAG,MAAe;IACvC,OAAO,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC9C,CAAC"}

package/dist/decorators/router.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Marca a classe como um grupo de rotas que o app pode registrar com `app.mount()` (F-28)
+ * e define o prefixo padrão. Sem `@Router` próprio, a classe é recusada.
+ *
+ * ```ts
+ * @Router('/users')
+ * class UserRoutes { @Get('/:id') getById() {} }
+ * app.mount(UserRoutes);
+ * ```
+ */
+export declare function Router(prefix?: string): <T extends abstract new (...args: any[]) => object>(_value: T, context: ClassDecoratorContext<T>) => void;
+//# sourceMappingURL=router.d.ts.map

package/dist/decorators/router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/decorators/router.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,wBAAgB,MAAM,CAAC,MAAM,SAAK,IAExB,CAAC,SAAS,QAAQ,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,MAAM,UAAU,CAAC,WAAW,qBAAqB,CAAC,CAAC,CAAC,UAKxG"}

package/dist/decorators/router.js

@@ -0,0 +1,20 @@
+import { metadataFor } from '../core/metadata.js';
+/**
+ * Marca a classe como um grupo de rotas que o app pode registrar com `app.mount()` (F-28)
+ * e define o prefixo padrão. Sem `@Router` próprio, a classe é recusada.
+ *
+ * ```ts
+ * @Router('/users')
+ * class UserRoutes { @Get('/:id') getById() {} }
+ * app.mount(UserRoutes);
+ * ```
+ */
+export function Router(prefix = '') {
+    // biome-ignore lint/suspicious/noExplicitAny: aceita classes com qualquer construtor (instâncias com dependências).
+    return (_value, context) => {
+        const meta = metadataFor(context, 'Router');
+        meta.isRouter = true;
+        meta.prefix = prefix;
+    };
+}
+//# sourceMappingURL=router.js.map

package/dist/decorators/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/decorators/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD;;;;;;;;;GASG;AACH,MAAM,UAAU,MAAM,CAAC,MAAM,GAAG,EAAE;IAChC,oHAAoH;IACpH,OAAO,CAAoD,MAAS,EAAE,OAAiC,EAAE,EAAE;QACzG,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC"}

package/dist/decorators/schema.d.ts

@@ -0,0 +1,8 @@
+import { type RouteSchemas } from '../core/metadata.ts';
+/**
+ * Schemas da rota em um decorator separado, para quem prefere manter o verbo enxuto.
+ * Equivale ao segundo argumento de `@Get`/`@Post`/…; as duas formas podem conviver no mesmo método,
+ * desde que não declarem a mesma parte (ex.: `body`) duas vezes.
+ */
+export declare function Schema(schemas: RouteSchemas): <This, Args extends [any, ...unknown[]], Return>(_target: (this: This, ...args: Args) => Return, context: ClassMethodDecoratorContext<This, (this: This, ...args: Args) => Return>) => void;
+//# sourceMappingURL=schema.d.ts.map

package/dist/decorators/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/decorators/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgD,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEtG;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,OAAO,EAAE,YAAY,IAElC,IAAI,EAAE,IAAI,SAAS,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,EAAE,MAAM,WAC3C,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,IAAI,KAAK,MAAM,WACrC,2BAA2B,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,IAAI,KAAK,MAAM,CAAC,UAKpF"}

package/dist/decorators/schema.js

@@ -0,0 +1,14 @@
+import { getOrCreateMethod, mergeSchemas, metadataFor } from '../core/metadata.js';
+/**
+ * Schemas da rota em um decorator separado, para quem prefere manter o verbo enxuto.
+ * Equivale ao segundo argumento de `@Get`/`@Post`/…; as duas formas podem conviver no mesmo método,
+ * desde que não declarem a mesma parte (ex.: `body`) duas vezes.
+ */
+export function Schema(schemas) {
+    // biome-ignore lint/suspicious/noExplicitAny: o primeiro parâmetro precisa ser bivariante para aceitar Context<S> de qualquer S.
+    return (_target, context) => {
+        const meta = metadataFor(context, 'Schema');
+        mergeSchemas(getOrCreateMethod(meta, context.name), schemas, '@Schema');
+    };
+}
+//# sourceMappingURL=schema.js.map

package/dist/decorators/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/decorators/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,WAAW,EAAqB,MAAM,qBAAqB,CAAC;AAEtG;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,OAAqB;IAC1C,iIAAiI;IACjI,OAAO,CACL,OAA8C,EAC9C,OAAiF,EACjF,EAAE;QACF,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC5C,YAAY,CAAC,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1E,CAAC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+import './shims/symbol-metadata.ts';
+export * from './core/index.ts';
+export * from './decorators/index.ts';
+export * from './middlewares/index.ts';
+export { toOpenAPIPath, type OpenAPIOptions } from './openapi/generate.ts';
+export { Type, type Static, type TSchema } from '@sinclair/typebox';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,4BAA4B,CAAC;AAEpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAG3E,OAAO,EAAE,IAAI,EAAE,KAAK,MAAM,EAAE,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/index.js

@@ -0,0 +1,10 @@
+// Ponto de entrada público do FlowingTS.
+// O shim precisa ser avaliado antes de qualquer decorator rodar.
+import './shims/symbol-metadata.js';
+export * from './core/index.js';
+export * from './decorators/index.js';
+export * from './middlewares/index.js';
+export { toOpenAPIPath } from './openapi/generate.js';
+// Re-exporta TypeBox para que os usuários não precisem instalar como dependência separada
+export { Type } from '@sinclair/typebox';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,iEAAiE;AACjE,OAAO,4BAA4B,CAAC;AAEpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AACvC,OAAO,EAAE,aAAa,EAAuB,MAAM,uBAAuB,CAAC;AAE3E,0FAA0F;AAC1F,OAAO,EAAE,IAAI,EAA6B,MAAM,mBAAmB,CAAC"}

package/dist/middlewares/auth.d.ts

@@ -0,0 +1,41 @@
+import type { Context } from '../core/context.ts';
+import type { Guard } from '../core/guard.ts';
+/**
+ * Compara dois segredos em tempo constante (S-10). Os dois lados passam por SHA-256 antes, então o
+ * tempo também não revela o tamanho do segredo esperado.
+ */
+export declare function safeEqual(a: string, b: string): boolean;
+/** O que o `verify` devolve: o usuário autenticado (vai para `ctx.state.user`), ou `false`/`undefined` para recusar. */
+type Verified<U> = U | false | null | undefined;
+export interface BearerAuthOptions<U> {
+    /**
+     * Confere o token e devolve o usuário (ou `true`). A verificação é sua: JWT com a biblioteca da
+     * sua escolha, consulta ao banco, lista de chaves comparadas com {@link safeEqual}…
+     */
+    verify: (token: string, ctx: Context) => Verified<U> | Promise<Verified<U>>;
+    /** Vai no `WWW-Authenticate` do 401. Padrão: `'api'`. */
+    realm?: string;
+}
+export interface BasicAuthOptions<U> {
+    /** Confere usuário e senha (compare com {@link safeEqual}) e devolve o usuário (ou `true`). */
+    verify: (username: string, password: string, ctx: Context) => Verified<U> | Promise<Verified<U>>;
+    /** Padrão: `'api'`. */
+    realm?: string;
+}
+/**
+ * Guard de `Authorization: Bearer <token>` (S-10). Sem token, ou com token recusado, responde 401 com
+ * `WWW-Authenticate`. O usuário devolvido pelo `verify` fica em `ctx.state.user`.
+ *
+ * ```ts
+ * const auth = bearerAuth({ verify: (token) => sessions.get(token) });
+ * app.group({ guards: [auth] }, (g) => g.mount(UserRoutes));
+ * ```
+ */
+export declare function bearerAuth<U>(opts: BearerAuthOptions<U>): Guard;
+/**
+ * Guard de `Authorization: Basic` (S-10), para painéis internos e integrações simples. Use só sobre
+ * HTTPS: a senha vai em base64, que não é criptografia.
+ */
+export declare function basicAuth<U>(opts: BasicAuthOptions<U>): Guard;
+export {};
+//# sourceMappingURL=auth.d.ts.map

package/dist/middlewares/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middlewares/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C;;;GAGG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAIvD;AAED,wHAAwH;AACxH,KAAK,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,GAAG,SAAS,CAAC;AAEhD,MAAM,WAAW,iBAAiB,CAAC,CAAC;IAClC;;;OAGG;IACH,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC;IACjC,+FAA+F;IAC/F,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACjG,uBAAuB;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAwBD;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,GAAG,KAAK,CAS/D;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,KAAK,CAY7D"}

package/dist/middlewares/auth.js

@@ -0,0 +1,74 @@
+import { createHash, timingSafeEqual } from 'node:crypto';
+import { HttpError } from '../core/errors.js';
+/**
+ * Compara dois segredos em tempo constante (S-10). Os dois lados passam por SHA-256 antes, então o
+ * tempo também não revela o tamanho do segredo esperado.
+ */
+export function safeEqual(a, b) {
+    const x = createHash('sha256').update(a).digest();
+    const y = createHash('sha256').update(b).digest();
+    return timingSafeEqual(x, y) && a.length === b.length;
+}
+const quote = (realm) => `"${realm.replace(/["\\\r\n]/g, '')}"`;
+/** 401 padronizado: a mesma resposta para credencial ausente, malformada ou inválida, sem revelar o motivo. */
+function deny(ctx, scheme, realm) {
+    ctx.res.setHeader('WWW-Authenticate', `${scheme} realm=${quote(realm)}${scheme === 'Basic' ? ', charset="UTF-8"' : ''}`);
+    throw new HttpError(401, 'Unauthorized', 'UNAUTHORIZED');
+}
+function credentials(ctx, scheme) {
+    const header = ctx.get('authorization');
+    if (!header)
+        return undefined;
+    const space = header.indexOf(' ');
+    if (space === -1 || header.slice(0, space).toLowerCase() !== scheme.toLowerCase())
+        return undefined;
+    return header.slice(space + 1).trim() || undefined;
+}
+function accept(ctx, user) {
+    if (user === true)
+        return true;
+    ctx.state.user = user;
+    return true;
+}
+/**
+ * Guard de `Authorization: Bearer <token>` (S-10). Sem token, ou com token recusado, responde 401 com
+ * `WWW-Authenticate`. O usuário devolvido pelo `verify` fica em `ctx.state.user`.
+ *
+ * ```ts
+ * const auth = bearerAuth({ verify: (token) => sessions.get(token) });
+ * app.group({ guards: [auth] }, (g) => g.mount(UserRoutes));
+ * ```
+ */
+export function bearerAuth(opts) {
+    const realm = opts.realm ?? 'api';
+    return async (ctx) => {
+        const token = credentials(ctx, 'Bearer');
+        if (!token)
+            deny(ctx, 'Bearer', realm);
+        const user = await opts.verify(token, ctx);
+        if (user === false || user === null || user === undefined)
+            deny(ctx, 'Bearer', realm);
+        return accept(ctx, user);
+    };
+}
+/**
+ * Guard de `Authorization: Basic` (S-10), para painéis internos e integrações simples. Use só sobre
+ * HTTPS: a senha vai em base64, que não é criptografia.
+ */
+export function basicAuth(opts) {
+    const realm = opts.realm ?? 'api';
+    return async (ctx) => {
+        const encoded = credentials(ctx, 'Basic');
+        if (!encoded)
+            deny(ctx, 'Basic', realm);
+        const decoded = Buffer.from(encoded, 'base64').toString('utf8');
+        const colon = decoded.indexOf(':');
+        if (colon === -1)
+            deny(ctx, 'Basic', realm);
+        const user = await opts.verify(decoded.slice(0, colon), decoded.slice(colon + 1), ctx);
+        if (user === false || user === null || user === undefined)
+            deny(ctx, 'Basic', realm);
+        return accept(ctx, user);
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/middlewares/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middlewares/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAG9C;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,CAAS,EAAE,CAAS;IAC5C,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClD,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClD,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC;AACxD,CAAC;AAsBD,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,GAAG,CAAC;AAExE,+GAA+G;AAC/G,SAAS,IAAI,CAAC,GAAY,EAAE,MAA0B,EAAE,KAAa;IACnE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,GAAG,MAAM,UAAU,KAAK,CAAC,KAAK,CAAC,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzH,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,WAAW,CAAC,GAAY,EAAE,MAAc;IAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE;QAAE,OAAO,SAAS,CAAC;IACpG,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;AACrD,CAAC;AAED,SAAS,MAAM,CAAI,GAAY,EAAE,IAAiB;IAChD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,GAAG,CAAC,KAAiC,CAAC,IAAI,GAAG,IAAI,CAAC;IACnD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAI,IAA0B;IACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IAClC,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QACtF,OAAO,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAI,IAAyB;IACpD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IAClC,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACvF,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACrF,OAAO,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC;AACJ,CAAC"}

package/dist/middlewares/cors.d.ts

@@ -0,0 +1,30 @@
+import type { Middleware } from '../core/compose.ts';
+export type CorsOrigin = '*' | string | RegExp | readonly (string | RegExp)[] | ((origin: string) => boolean | Promise<boolean>);
+export interface CorsOptions {
+    /**
+     * Origens permitidas. Obrigatório: não existe default permissivo.
+     * - `'https://app.exemplo.com'`: igualdade exata depois de normalizar (esquema, host e porta);
+     * - `'https://*.exemplo.dev'`: só subdomínios, nunca o domínio em si nem `exemplo.dev.atacante.com`;
+     * - RegExp: precisa casar a origem **inteira** (como se tivesse `^…$`); prefira o curinga;
+     * - função: lógica própria, sob sua responsabilidade.
+     */
+    origin: CorsOrigin;
+    methods?: readonly string[];
+    allowedHeaders?: readonly string[];
+    exposedHeaders?: readonly string[];
+    /** Envia `Access-Control-Allow-Credentials: true`. Proibido com `origin: '*'`. */
+    credentials?: boolean;
+    /** Cache do preflight em segundos. Padrão: 600. */
+    maxAge?: number;
+}
+/**
+ * Middleware de CORS (S-01). Uso: `app.use(cors({ origin: 'https://app.exemplo.com' }))`.
+ *
+ * - Preflight (`OPTIONS` + `Access-Control-Request-Method`) é respondido com 204.
+ * - A origem só é refletida se estiver na lista permitida; `Vary: Origin` sempre que
+ *   a resposta depende da origem.
+ * - `origin: '*'` + `credentials: true` é rejeitado na criação (o navegador também recusaria,
+ *   e refletir qualquer origem com credenciais permitiria que qualquer site lesse dados do usuário).
+ */
+export declare function cors(opts: CorsOptions): Middleware;
+//# sourceMappingURL=cors.d.ts.map

package/dist/middlewares/cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../src/middlewares/cors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGrD,MAAM,MAAM,UAAU,GAAG,GAAG,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AAEjI,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,kFAAkF;IAClF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAKD;;;;;;;;GAQG;AACH,wBAAgB,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,UAAU,CA0ClD"}

package/dist/middlewares/cors.js

@@ -0,0 +1,69 @@
+import { compileOriginMatcher } from '../utils/origin-match.js';
+const DEFAULT_METHODS = ['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE'];
+const DEFAULT_HEADERS = ['Content-Type', 'Authorization'];
+/**
+ * Middleware de CORS (S-01). Uso: `app.use(cors({ origin: 'https://app.exemplo.com' }))`.
+ *
+ * - Preflight (`OPTIONS` + `Access-Control-Request-Method`) é respondido com 204.
+ * - A origem só é refletida se estiver na lista permitida; `Vary: Origin` sempre que
+ *   a resposta depende da origem.
+ * - `origin: '*'` + `credentials: true` é rejeitado na criação (o navegador também recusaria,
+ *   e refletir qualquer origem com credenciais permitiria que qualquer site lesse dados do usuário).
+ */
+export function cors(opts) {
+    if (opts.origin === '*' && opts.credentials) {
+        throw new Error("cors: `origin: '*'` cannot be combined with `credentials: true`. List the allowed origins.");
+    }
+    const wildcard = opts.origin === '*';
+    // `'*'` não passa pelo compilador de regras: é o modo "qualquer origem", tratado à parte.
+    const isAllowed = wildcard ? () => true : buildMatcher(opts.origin);
+    const methods = (opts.methods ?? DEFAULT_METHODS).join(', ');
+    const allowedHeaders = opts.allowedHeaders?.join(', ');
+    const exposed = opts.exposedHeaders?.join(', ');
+    const maxAge = String(opts.maxAge ?? 600);
+    return async (ctx, next) => {
+        const origin = ctx.req.headers.origin;
+        const res = ctx.res;
+        if (!wildcard)
+            res.appendHeader('Vary', 'Origin');
+        const preflight = ctx.method === 'OPTIONS' && ctx.req.headers['access-control-request-method'] !== undefined;
+        if (!origin)
+            return preflight ? void ctx.status(204).res.end() : next();
+        const allowed = wildcard || (await isAllowed(origin));
+        if (!allowed) {
+            // Sem headers CORS o navegador bloqueia a leitura; a requisição em si segue normalmente.
+            return preflight ? void ctx.status(204).res.end() : next();
+        }
+        res.setHeader('Access-Control-Allow-Origin', wildcard ? '*' : origin);
+        if (opts.credentials)
+            res.setHeader('Access-Control-Allow-Credentials', 'true');
+        if (preflight) {
+            res.setHeader('Access-Control-Allow-Methods', methods);
+            const requested = ctx.req.headers['access-control-request-headers'];
+            const headers = allowedHeaders ?? (typeof requested === 'string' ? filterHeaders(requested) : DEFAULT_HEADERS.join(', '));
+            if (headers)
+                res.setHeader('Access-Control-Allow-Headers', headers);
+            res.setHeader('Access-Control-Max-Age', maxAge);
+            return void ctx.status(204).res.end();
+        }
+        if (exposed)
+            res.setHeader('Access-Control-Expose-Headers', exposed);
+        await next();
+    };
+}
+/** Sem lista explícita, aceita apenas os headers padrão entre os pedidos pelo navegador. */
+function filterHeaders(requested) {
+    const safe = new Set(DEFAULT_HEADERS.map((h) => h.toLowerCase()));
+    return requested
+        .split(',')
+        .map((h) => h.trim())
+        .filter((h) => safe.has(h.toLowerCase()))
+        .join(', ');
+}
+function buildMatcher(origin) {
+    if (typeof origin === 'function')
+        return origin;
+    const list = Array.isArray(origin) ? origin : [origin];
+    return compileOriginMatcher(list);
+}
+//# sourceMappingURL=cors.js.map

package/dist/middlewares/cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/middlewares/cors.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAsBhE,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;AAC1E,MAAM,eAAe,GAAG,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;AAE1D;;;;;;;;GAQG;AACH,MAAM,UAAU,IAAI,CAAC,IAAiB;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,4FAA4F,CAAC,CAAC;IAChH,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC;IACrC,0FAA0F;IAC1F,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7D,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC;IAE1C,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QACtC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QACpB,IAAI,CAAC,QAAQ;YAAE,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAElD,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,+BAA+B,CAAC,KAAK,SAAS,CAAC;QAE7G,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAExE,MAAM,OAAO,GAAG,QAAQ,IAAI,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,yFAAyF;YACzF,OAAO,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7D,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACtE,IAAI,IAAI,CAAC,WAAW;YAAE,GAAG,CAAC,SAAS,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;QAEhF,IAAI,SAAS,EAAE,CAAC;YACd,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,OAAO,CAAC,CAAC;YACvD,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;YACpE,MAAM,OAAO,GAAG,cAAc,IAAI,CAAC,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1H,IAAI,OAAO;gBAAE,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,OAAO,CAAC,CAAC;YACpE,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;YAChD,OAAO,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QACxC,CAAC;QAED,IAAI,OAAO;YAAE,GAAG,CAAC,SAAS,CAAC,+BAA+B,EAAE,OAAO,CAAC,CAAC;QACrE,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,SAAS,aAAa,CAAC,SAAiB;IACtC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAClE,OAAO,SAAS;SACb,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;SACxC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,MAAkB;IACtC,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAyB,CAAC,CAAC;IAC1E,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC"}

package/dist/middlewares/csrf.d.ts

@@ -0,0 +1,42 @@
+import type { Middleware } from '../core/compose.ts';
+import { type CookieOptions } from '../utils/cookie.ts';
+import { type MatchRule } from '../utils/origin-match.ts';
+declare module '../core/context.ts' {
+    interface ContextState {
+        /** Token CSRF da requisição, com `csrf({ token: true })`. Envie-o ao front no header configurado. */
+        csrfToken?: string;
+    }
+}
+export interface CsrfTokenOptions {
+    /** Padrão: `'__Host-csrf'`, que não pode ser definido por subdomínios. */
+    cookieName?: string;
+    /** Header onde o cliente devolve o token. Padrão: `'X-CSRF-Token'`. */
+    headerName?: string;
+    /** Atributos do cookie. `httpOnly` é sempre `false` (o front precisa ler) e `SameSite` padrão é `Strict`. */
+    cookie?: Omit<CookieOptions, 'httpOnly'>;
+}
+export interface CsrfOptions {
+    /**
+     * Outras origens confiáveis além da própria (`ctx.protocol://ctx.host`), com as mesmas regras do
+     * `cors()`: `'https://app.exemplo.com'`, `'https://*.exemplo.dev'` ou RegExp de casamento inteiro.
+     */
+    trustedOrigins?: readonly MatchRule[];
+    /** Ativa também o double-submit token. `true` usa os padrões de {@link CsrfTokenOptions}. */
+    token?: boolean | CsrfTokenOptions;
+}
+/**
+ * Proteção contra CSRF. Use sempre que a autenticação for por cookie.
+ *
+ * Métodos que alteram estado (todos menos GET, HEAD e OPTIONS) são recusados com 403 quando vêm de
+ * outra origem:
+ * 1. `Sec-Fetch-Site: same-origin` ou `none` (navegação do próprio usuário) passa; `same-site` e
+ *    `cross-site` só passam se o `Origin` estiver em `trustedOrigins`;
+ * 2. sem `Sec-Fetch-Site`, o `Origin` precisa ser a própria origem ou uma confiável;
+ * 3. sem nenhum dos dois, a requisição não veio de um navegador (curl, servidor a servidor) e passa,
+ *    porque CSRF depende de um navegador que anexe os cookies da vítima.
+ *
+ * Com `token`, além disso, exige o double-submit: o valor do header deve ser igual ao do cookie.
+ * Por isso, rotas GET nunca devem alterar estado.
+ */
+export declare function csrf(opts?: CsrfOptions): Middleware;
+//# sourceMappingURL=csrf.d.ts.map

package/dist/middlewares/csrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/middlewares/csrf.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGrD,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAyC,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAEjG,OAAO,QAAQ,oBAAoB,CAAC;IAClC,UAAU,YAAY;QACpB,qGAAqG;QACrG,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB;CACF;AAED,MAAM,WAAW,gBAAgB;IAC/B,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6GAA6G;IAC7G,MAAM,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,cAAc,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;IACtC,6FAA6F;IAC7F,KAAK,CAAC,EAAE,OAAO,GAAG,gBAAgB,CAAC;CACpC;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAgB,IAAI,CAAC,IAAI,GAAE,WAAgB,GAAG,UAAU,CAgCvD"}

package/dist/middlewares/csrf.js

@@ -0,0 +1,70 @@
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { HttpError } from '../core/errors.js';
+import { serializeCookie } from '../utils/cookie.js';
+import { compileOriginMatcher, normalizeOrigin } from '../utils/origin-match.js';
+const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
+/**
+ * Proteção contra CSRF. Use sempre que a autenticação for por cookie.
+ *
+ * Métodos que alteram estado (todos menos GET, HEAD e OPTIONS) são recusados com 403 quando vêm de
+ * outra origem:
+ * 1. `Sec-Fetch-Site: same-origin` ou `none` (navegação do próprio usuário) passa; `same-site` e
+ *    `cross-site` só passam se o `Origin` estiver em `trustedOrigins`;
+ * 2. sem `Sec-Fetch-Site`, o `Origin` precisa ser a própria origem ou uma confiável;
+ * 3. sem nenhum dos dois, a requisição não veio de um navegador (curl, servidor a servidor) e passa,
+ *    porque CSRF depende de um navegador que anexe os cookies da vítima.
+ *
+ * Com `token`, além disso, exige o double-submit: o valor do header deve ser igual ao do cookie.
+ * Por isso, rotas GET nunca devem alterar estado.
+ */
+export function csrf(opts = {}) {
+    const trusted = compileOriginMatcher(opts.trustedOrigins ?? []);
+    const token = opts.token ? (opts.token === true ? {} : opts.token) : undefined;
+    const cookieName = token?.cookieName ?? '__Host-csrf';
+    const headerName = (token?.headerName ?? 'X-CSRF-Token').toLowerCase();
+    const cookieOpts = { sameSite: 'Strict', ...token?.cookie, httpOnly: false };
+    // Valida nome e atributos já na criação, e não na primeira requisição.
+    if (token)
+        serializeCookie(cookieName, 'x', cookieOpts);
+    return async (ctx, next) => {
+        const safe = SAFE_METHODS.has(ctx.method);
+        if (!safe && !originAllowed(ctx, trusted)) {
+            throw new HttpError(403, 'Cross-origin request blocked', 'CSRF_ORIGIN');
+        }
+        if (token) {
+            const current = ctx.cookies[cookieName];
+            if (!safe) {
+                const sent = ctx.get(headerName);
+                if (!current || !sent || !equal(current, sent)) {
+                    throw new HttpError(403, 'Invalid CSRF token', 'CSRF_TOKEN');
+                }
+            }
+            if (current && current.length >= 32) {
+                ctx.state.csrfToken = current;
+            }
+            else {
+                ctx.state.csrfToken = randomBytes(32).toString('base64url');
+                ctx.setCookie(cookieName, ctx.state.csrfToken, cookieOpts);
+            }
+        }
+        await next();
+    };
+}
+function originAllowed(ctx, trusted) {
+    const origin = ctx.get('origin');
+    const site = ctx.get('sec-fetch-site');
+    if (site === 'same-origin' || site === 'none')
+        return true;
+    if (site !== undefined)
+        return origin !== undefined && trusted(origin);
+    if (origin === undefined)
+        return true;
+    const own = ctx.host ? normalizeOrigin(`${ctx.protocol}://${ctx.host}`) : undefined;
+    return (own !== undefined && normalizeOrigin(origin) === own) || trusted(origin);
+}
+function equal(a, b) {
+    const x = Buffer.from(a);
+    const y = Buffer.from(b);
+    return x.length === y.length && timingSafeEqual(x, y);
+}
+//# sourceMappingURL=csrf.js.map

package/dist/middlewares/csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../../src/middlewares/csrf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG3D,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAsB,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAkB,MAAM,0BAA0B,CAAC;AA4BjG,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAEzD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,IAAI,CAAC,IAAI,GAAgB,EAAE;IACzC,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,MAAM,UAAU,GAAG,KAAK,EAAE,UAAU,IAAI,aAAa,CAAC;IACtD,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,UAAU,IAAI,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC;IACvE,MAAM,UAAU,GAAkB,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC5F,uEAAuE;IACvE,IAAI,KAAK;QAAE,eAAe,CAAC,UAAU,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IAExD,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,8BAA8B,EAAE,aAAa,CAAC,CAAC;QAC1E,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACxC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACjC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;oBAC/C,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,oBAAoB,EAAE,YAAY,CAAC,CAAC;gBAC/D,CAAC;YACH,CAAC;YACD,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;gBACpC,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAC5D,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,GAAY,EAAE,OAAoC;IACvE,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACvC,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACvE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,GAAG,CAAC,QAAQ,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpF,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,KAAK,CAAC,CAAS,EAAE,CAAS;IACjC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC"}

package/dist/middlewares/index.d.ts

@@ -0,0 +1,6 @@
+export { cors, type CorsOptions, type CorsOrigin } from './cors.ts';
+export { MemoryRateLimitStore, rateLimit, type RateLimitOptions, type RateLimitStore } from './rate-limit.ts';
+export { buildSecurityHeaders, type SecurityHeadersOptions, type SecurityPreset } from './security-headers.ts';
+export { csrf, type CsrfOptions, type CsrfTokenOptions } from './csrf.ts';
+export { basicAuth, bearerAuth, safeEqual, type BasicAuthOptions, type BearerAuthOptions } from './auth.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/middlewares/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middlewares/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC9G,OAAO,EAAE,oBAAoB,EAAE,KAAK,sBAAsB,EAAE,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC/G,OAAO,EAAE,IAAI,EAAE,KAAK,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAAE,MAAM,WAAW,CAAC"}

package/dist/middlewares/index.js

@@ -0,0 +1,6 @@
+export { cors } from './cors.js';
+export { MemoryRateLimitStore, rateLimit } from './rate-limit.js';
+export { buildSecurityHeaders } from './security-headers.js';
+export { csrf } from './csrf.js';
+export { basicAuth, bearerAuth, safeEqual } from './auth.js';
+//# sourceMappingURL=index.js.map

package/dist/middlewares/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middlewares/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAqC,MAAM,WAAW,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAA8C,MAAM,iBAAiB,CAAC;AAC9G,OAAO,EAAE,oBAAoB,EAAoD,MAAM,uBAAuB,CAAC;AAC/G,OAAO,EAAE,IAAI,EAA2C,MAAM,WAAW,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAiD,MAAM,WAAW,CAAC"}