route-scoped-cors 0.1.0

package/dist/core/middleware.d.ts

@@ -0,0 +1,30 @@
+import type { RouteScopedCorsOptions, ExpressMiddlewareFn } from '../types';
+/**
+ * Returns an Express middleware function that overrides
+ * `Access-Control-Allow-Methods` with the exact set of HTTP methods
+ * registered for the matched route.
+ *
+ * The route map is built lazily on the first request so all routes are
+ * guaranteed to be registered in the Express router before inspection.
+ *
+ * @example
+ * // Express
+ * app.use(routeScopedCors());
+ *
+ * // Express with options
+ * app.use(routeScopedCors({ fallbackMethods: ['GET', 'POST', 'OPTIONS'] }));
+ */
+export declare function routeScopedCors(options?: RouteScopedCorsOptions): ExpressMiddlewareFn;
+/**
+ * Installs `routeScopedCors` onto an Express (or Connect-compatible) app.
+ * Equivalent to calling `app.use(routeScopedCors(options))`.
+ *
+ * @example
+ * import express from 'express';
+ * import { install } from 'route-scoped-cors';
+ *
+ * const app = express();
+ * install(app);
+ */
+export declare function install(app: any, options?: RouteScopedCorsOptions): void;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/core/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/core/middleware.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAM5E;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,OAAO,GAAE,sBAA2B,GAAG,mBAAmB,CAmCzF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAOxE"}

package/dist/core/middleware.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.routeScopedCors = routeScopedCors;
+exports.install = install;
+const route_map_1 = require("./route-map");
+const path_matcher_1 = require("./path-matcher");
+const DEFAULT_FALLBACK_METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'];
+/**
+ * Returns an Express middleware function that overrides
+ * `Access-Control-Allow-Methods` with the exact set of HTTP methods
+ * registered for the matched route.
+ *
+ * The route map is built lazily on the first request so all routes are
+ * guaranteed to be registered in the Express router before inspection.
+ *
+ * @example
+ * // Express
+ * app.use(routeScopedCors());
+ *
+ * // Express with options
+ * app.use(routeScopedCors({ fallbackMethods: ['GET', 'POST', 'OPTIONS'] }));
+ */
+function routeScopedCors(options = {}) {
+    var _a;
+    const fallbackMethods = (_a = options.fallbackMethods) !== null && _a !== void 0 ? _a : DEFAULT_FALLBACK_METHODS;
+    let routeMap = null;
+    return function routeScopedCorsMiddleware(req, res, next) {
+        if (!routeMap) {
+            routeMap = (0, route_map_1.buildRouteMap)(req.app);
+        }
+        const allowedMethods = (0, path_matcher_1.matchAllowedMethods)(routeMap, req.path, fallbackMethods);
+        res.setHeader('Access-Control-Allow-Methods', allowedMethods.join(', '));
+        if (req.method === 'OPTIONS') {
+            res.status(204).end();
+            return;
+        }
+        if (!allowedMethods.includes(req.method.toUpperCase())) {
+            const actualMethods = allowedMethods.filter((m) => m !== 'OPTIONS');
+            res.setHeader('Allow', actualMethods.join(', '));
+            res.status(405).json({
+                statusCode: 405,
+                message: 'Method Not Allowed',
+                error: `${req.method} is not supported on this resource. Allowed: ${actualMethods.join(', ')}`,
+            });
+            return;
+        }
+        next();
+    };
+}
+/**
+ * Installs `routeScopedCors` onto an Express (or Connect-compatible) app.
+ * Equivalent to calling `app.use(routeScopedCors(options))`.
+ *
+ * @example
+ * import express from 'express';
+ * import { install } from 'route-scoped-cors';
+ *
+ * const app = express();
+ * install(app);
+ */
+function install(app, options) {
+    if (typeof (app === null || app === void 0 ? void 0 : app.use) !== 'function') {
+        throw new Error('[route-scoped-cors] install() requires an Express or Connect-compatible application instance.');
+    }
+    app.use(routeScopedCors(options));
+}
+//# sourceMappingURL=middleware.js.map

package/dist/core/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/core/middleware.ts"],"names":[],"mappings":";;AAsBA,0CAmCC;AAaD,0BAOC;AA3ED,2CAA4C;AAC5C,iDAAqD;AAErD,MAAM,wBAAwB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AAEtF;;;;;;;;;;;;;;GAcG;AACH,SAAgB,eAAe,CAAC,UAAkC,EAAE;;IAClE,MAAM,eAAe,GAAG,MAAA,OAAO,CAAC,eAAe,mCAAI,wBAAwB,CAAC;IAC5E,IAAI,QAAQ,GAAoC,IAAI,CAAC;IAErD,OAAO,SAAS,yBAAyB,CACvC,GAA4B,EAC5B,GAAa,EACb,IAAkB;QAElB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,IAAA,yBAAa,EAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,cAAc,GAAG,IAAA,kCAAmB,EAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QAEhF,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAEzE,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACvD,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;YACpE,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,oBAAoB;gBAC7B,KAAK,EAAE,GAAG,GAAG,CAAC,MAAM,gDAAgD,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aAC/F,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,OAAO,CAAC,GAAQ,EAAE,OAAgC;IAChE,IAAI,OAAO,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,GAAG,CAAA,KAAK,UAAU,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;AACpC,CAAC"}

package/dist/core/path-matcher.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Finds the allowed methods for `requestPath` by matching against the
+ * stored route map. Express path params (`:id`) are treated as wildcards.
+ * Returns `fallbackMethods` when no pattern matches.
+ */
+export declare function matchAllowedMethods(routeMap: Map<string, Set<string>>, requestPath: string, fallbackMethods: string[]): string[];
+//# sourceMappingURL=path-matcher.d.ts.map

package/dist/core/path-matcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-matcher.d.ts","sourceRoot":"","sources":["../../src/core/path-matcher.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,EAClC,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM,EAAE,GACxB,MAAM,EAAE,CAkBV"}

package/dist/core/path-matcher.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.matchAllowedMethods = matchAllowedMethods;
+/**
+ * Finds the allowed methods for `requestPath` by matching against the
+ * stored route map. Express path params (`:id`) are treated as wildcards.
+ * Returns `fallbackMethods` when no pattern matches.
+ */
+function matchAllowedMethods(routeMap, requestPath, fallbackMethods) {
+    for (const [pattern, methods] of routeMap.entries()) {
+        const regexStr = '^' +
+            pattern
+                .replace(/\//g, '\\/')
+                .replace(/:[^/]+/g, '[^/]+') // :param → any non-slash segment
+                .replace(/\*/g, '.*') + // wildcard support
+            '$';
+        try {
+            if (new RegExp(regexStr).test(requestPath)) {
+                return [...methods];
+            }
+        }
+        catch {
+            // Malformed pattern — skip rather than crash
+        }
+    }
+    return fallbackMethods;
+}
+//# sourceMappingURL=path-matcher.js.map

package/dist/core/path-matcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-matcher.js","sourceRoot":"","sources":["../../src/core/path-matcher.ts"],"names":[],"mappings":";;AAKA,kDAsBC;AA3BD;;;;GAIG;AACH,SAAgB,mBAAmB,CACjC,QAAkC,EAClC,WAAmB,EACnB,eAAyB;IAEzB,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QACpD,MAAM,QAAQ,GACZ,GAAG;YACH,OAAO;iBACJ,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;iBACrB,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,iCAAiC;iBAC7D,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAS,mBAAmB;YACnD,GAAG,CAAC;QACN,IAAI,CAAC;YACH,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC3C,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6CAA6C;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/core/route-map.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Walks the Express _router.stack recursively to build a map of
+ * route path-pattern → Set of uppercase HTTP methods.
+ *
+ * Built lazily on the first request so that all routes are guaranteed
+ * to be registered before inspection.
+ */
+export declare function buildRouteMap(expressApp: any): Map<string, Set<string>>;
+//# sourceMappingURL=route-map.d.ts.map

package/dist/core/route-map.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-map.d.ts","sourceRoot":"","sources":["../../src/core/route-map.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAmCvE"}

package/dist/core/route-map.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildRouteMap = buildRouteMap;
+/**
+ * Walks the Express _router.stack recursively to build a map of
+ * route path-pattern → Set of uppercase HTTP methods.
+ *
+ * Built lazily on the first request so that all routes are guaranteed
+ * to be registered before inspection.
+ */
+function buildRouteMap(expressApp) {
+    var _a, _b;
+    const map = new Map();
+    const walkLayer = (layer, prefix = '') => {
+        var _a, _b, _c;
+        if (layer.route) {
+            const path = (prefix + layer.route.path).replace(/\/+/g, '/');
+            const methods = new Set(Object.keys(layer.route.methods)
+                .filter((m) => m !== '_all' && layer.route.methods[m])
+                .map((m) => m.toUpperCase()));
+            // OPTIONS is always required for CORS preflight
+            methods.add('OPTIONS');
+            const existing = map.get(path);
+            if (existing) {
+                methods.forEach((m) => existing.add(m));
+            }
+            else {
+                map.set(path, methods);
+            }
+        }
+        else if ((_a = layer.handle) === null || _a === void 0 ? void 0 : _a.stack) {
+            // Nested router: extract the path segment from the compiled regexp.
+            // Express compiles router paths into regexps like: ^\/segment\/?(?=\/|$)
+            const src = (_c = (_b = layer.regexp) === null || _b === void 0 ? void 0 : _b.source) !== null && _c !== void 0 ? _c : '';
+            const match = src.match(/^\^\\\/([^\\?$/]*)/);
+            const segment = match ? `/${match[1].replace(/\\\//g, '/')}` : '';
+            layer.handle.stack.forEach((child) => walkLayer(child, prefix + segment));
+        }
+    };
+    const stack = (_b = (_a = expressApp === null || expressApp === void 0 ? void 0 : expressApp._router) === null || _a === void 0 ? void 0 : _a.stack) !== null && _b !== void 0 ? _b : [];
+    stack.forEach((layer) => walkLayer(layer));
+    return map;
+}
+//# sourceMappingURL=route-map.js.map

package/dist/core/route-map.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-map.js","sourceRoot":"","sources":["../../src/core/route-map.ts"],"names":[],"mappings":";;AAOA,sCAmCC;AA1CD;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,UAAe;;IAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE3C,MAAM,SAAS,GAAG,CAAC,KAAU,EAAE,MAAM,GAAG,EAAE,EAAQ,EAAE;;QAClD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAI,KAAK,CAAC,KAAK,CAAC,IAAe,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC1E,MAAM,OAAO,GAAG,IAAI,GAAG,CACpB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAc;iBAC3C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;iBACrD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAC/B,CAAC;YACF,gDAAgD;YAChD,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAEvB,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1C,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;aAAM,IAAI,MAAA,KAAK,CAAC,MAAM,0CAAE,KAAK,EAAE,CAAC;YAC/B,oEAAoE;YACpE,yEAAyE;YACzE,MAAM,GAAG,GAAW,MAAA,MAAA,KAAK,CAAC,MAAM,0CAAE,MAAM,mCAAI,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;YAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,KAAK,CAAC,MAAM,CAAC,KAAe,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAC9C,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CACnC,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,KAAK,GAAU,MAAA,MAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,OAAO,0CAAE,KAAK,mCAAI,EAAE,CAAC;IACtD,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3C,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { routeScopedCors, install } from './core/middleware';
+export type { RouteScopedCorsOptions, ExpressMiddlewareFn } from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC7D,YAAY,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.install = exports.routeScopedCors = void 0;
+var middleware_1 = require("./core/middleware");
+Object.defineProperty(exports, "routeScopedCors", { enumerable: true, get: function () { return middleware_1.routeScopedCors; } });
+Object.defineProperty(exports, "install", { enumerable: true, get: function () { return middleware_1.install; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,gDAA6D;AAApD,6GAAA,eAAe,OAAA;AAAE,qGAAA,OAAO,OAAA"}

package/dist/nestjs/index.d.ts

@@ -0,0 +1,5 @@
+export { RouteScopedCorsModule } from './module';
+export { RouteScopedCorsMiddleware } from './middleware';
+export { ROUTE_SCOPED_CORS_OPTIONS } from './tokens';
+export type { RouteScopedCorsOptions } from '../types';
+//# sourceMappingURL=index.d.ts.map

package/dist/nestjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/nestjs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAC;AACrD,YAAY,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC"}

package/dist/nestjs/index.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ROUTE_SCOPED_CORS_OPTIONS = exports.RouteScopedCorsMiddleware = exports.RouteScopedCorsModule = void 0;
+var module_1 = require("./module");
+Object.defineProperty(exports, "RouteScopedCorsModule", { enumerable: true, get: function () { return module_1.RouteScopedCorsModule; } });
+var middleware_1 = require("./middleware");
+Object.defineProperty(exports, "RouteScopedCorsMiddleware", { enumerable: true, get: function () { return middleware_1.RouteScopedCorsMiddleware; } });
+var tokens_1 = require("./tokens");
+Object.defineProperty(exports, "ROUTE_SCOPED_CORS_OPTIONS", { enumerable: true, get: function () { return tokens_1.ROUTE_SCOPED_CORS_OPTIONS; } });
+//# sourceMappingURL=index.js.map

package/dist/nestjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/nestjs/index.ts"],"names":[],"mappings":";;;AAAA,mCAAiD;AAAxC,+GAAA,qBAAqB,OAAA;AAC9B,2CAAyD;AAAhD,uHAAA,yBAAyB,OAAA;AAClC,mCAAqD;AAA5C,mHAAA,yBAAyB,OAAA"}

package/dist/nestjs/middleware.d.ts

@@ -0,0 +1,9 @@
+import { NestMiddleware } from '@nestjs/common';
+import type { Request, Response, NextFunction } from 'express';
+import type { RouteScopedCorsOptions } from '../types';
+export declare class RouteScopedCorsMiddleware implements NestMiddleware {
+    private readonly handler;
+    constructor(options?: RouteScopedCorsOptions);
+    use(req: Request, res: Response, next: NextFunction): void;
+}
+//# sourceMappingURL=middleware.d.ts.map

package/dist/nestjs/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/nestjs/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,cAAc,EAAY,MAAM,gBAAgB,CAAC;AAC9E,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE/D,OAAO,KAAK,EAAuB,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAG5E,qBACa,yBAA0B,YAAW,cAAc;IAC9D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsB;gBAGG,OAAO,CAAC,EAAE,sBAAsB;IAKjF,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI;CAG3D"}

package/dist/nestjs/middleware.js

@@ -0,0 +1,34 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RouteScopedCorsMiddleware = void 0;
+const common_1 = require("@nestjs/common");
+const middleware_1 = require("../core/middleware");
+const tokens_1 = require("./tokens");
+let RouteScopedCorsMiddleware = class RouteScopedCorsMiddleware {
+    constructor(options) {
+        this.handler = (0, middleware_1.routeScopedCors)(options !== null && options !== void 0 ? options : {});
+    }
+    use(req, res, next) {
+        this.handler(req, res, next);
+    }
+};
+exports.RouteScopedCorsMiddleware = RouteScopedCorsMiddleware;
+exports.RouteScopedCorsMiddleware = RouteScopedCorsMiddleware = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Optional)()),
+    __param(0, (0, common_1.Inject)(tokens_1.ROUTE_SCOPED_CORS_OPTIONS)),
+    __metadata("design:paramtypes", [Object])
+], RouteScopedCorsMiddleware);
+//# sourceMappingURL=middleware.js.map

package/dist/nestjs/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/nestjs/middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA8E;AAE9E,mDAAqD;AAErD,qCAAqD;AAG9C,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IAGpC,YACiD,OAAgC;QAE/E,IAAI,CAAC,OAAO,GAAG,IAAA,4BAAe,EAAC,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,GAAG,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QACjD,IAAI,CAAC,OAAO,CAAC,GAAU,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;CACF,CAAA;AAZY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,kCAAyB,CAAC,CAAA;;GAJrC,yBAAyB,CAYrC"}

package/dist/nestjs/module.d.ts

@@ -0,0 +1,23 @@
+import { DynamicModule, MiddlewareConsumer, NestModule } from '@nestjs/common';
+import type { RouteScopedCorsOptions } from '../types';
+/**
+ * Drop-in NestJS module that automatically applies per-route CORS method
+ * scoping to every route in the application.
+ *
+ * @example
+ * // app.module.ts
+ * import { RouteScopedCorsModule } from 'route-scoped-cors/nestjs';
+ *
+ * @Module({
+ *   imports: [RouteScopedCorsModule.forRoot()],
+ * })
+ * export class AppModule {}
+ *
+ * // With options:
+ * RouteScopedCorsModule.forRoot({ fallbackMethods: ['GET', 'POST', 'OPTIONS'] })
+ */
+export declare class RouteScopedCorsModule implements NestModule {
+    static forRoot(options?: RouteScopedCorsOptions): DynamicModule;
+    configure(consumer: MiddlewareConsumer): void;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/nestjs/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../src/nestjs/module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,kBAAkB,EAElB,UAAU,EAEX,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAIvD;;;;;;;;;;;;;;;GAeG;AACH,qBACa,qBAAsB,YAAW,UAAU;IACtD,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,sBAA2B,GAAG,aAAa;IAYnE,SAAS,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI;CAK9C"}

package/dist/nestjs/module.js

@@ -0,0 +1,52 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var RouteScopedCorsModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RouteScopedCorsModule = void 0;
+const common_1 = require("@nestjs/common");
+const middleware_1 = require("./middleware");
+const tokens_1 = require("./tokens");
+/**
+ * Drop-in NestJS module that automatically applies per-route CORS method
+ * scoping to every route in the application.
+ *
+ * @example
+ * // app.module.ts
+ * import { RouteScopedCorsModule } from 'route-scoped-cors/nestjs';
+ *
+ * @Module({
+ *   imports: [RouteScopedCorsModule.forRoot()],
+ * })
+ * export class AppModule {}
+ *
+ * // With options:
+ * RouteScopedCorsModule.forRoot({ fallbackMethods: ['GET', 'POST', 'OPTIONS'] })
+ */
+let RouteScopedCorsModule = RouteScopedCorsModule_1 = class RouteScopedCorsModule {
+    static forRoot(options = {}) {
+        return {
+            module: RouteScopedCorsModule_1,
+            global: true,
+            providers: [
+                { provide: tokens_1.ROUTE_SCOPED_CORS_OPTIONS, useValue: options },
+                middleware_1.RouteScopedCorsMiddleware,
+            ],
+            exports: [middleware_1.RouteScopedCorsMiddleware],
+        };
+    }
+    configure(consumer) {
+        consumer
+            .apply(middleware_1.RouteScopedCorsMiddleware)
+            .forRoutes({ path: '*', method: common_1.RequestMethod.ALL });
+    }
+};
+exports.RouteScopedCorsModule = RouteScopedCorsModule;
+exports.RouteScopedCorsModule = RouteScopedCorsModule = RouteScopedCorsModule_1 = __decorate([
+    (0, common_1.Module)({})
+], RouteScopedCorsModule);
+//# sourceMappingURL=module.js.map

package/dist/nestjs/module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../../src/nestjs/module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAMwB;AAExB,6CAAyD;AACzD,qCAAqD;AAErD;;;;;;;;;;;;;;;GAeG;AAEI,IAAM,qBAAqB,6BAA3B,MAAM,qBAAqB;IAChC,MAAM,CAAC,OAAO,CAAC,UAAkC,EAAE;QACjD,OAAO;YACL,MAAM,EAAE,uBAAqB;YAC7B,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE;gBACT,EAAE,OAAO,EAAE,kCAAyB,EAAE,QAAQ,EAAE,OAAO,EAAE;gBACzD,sCAAyB;aAC1B;YACD,OAAO,EAAE,CAAC,sCAAyB,CAAC;SACrC,CAAC;IACJ,CAAC;IAED,SAAS,CAAC,QAA4B;QACpC,QAAQ;aACL,KAAK,CAAC,sCAAyB,CAAC;aAChC,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,sBAAa,CAAC,GAAG,EAAE,CAAC,CAAC;IACzD,CAAC;CACF,CAAA;AAlBY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,qBAAqB,CAkBjC"}

package/dist/nestjs/tokens.d.ts

@@ -0,0 +1,2 @@
+export declare const ROUTE_SCOPED_CORS_OPTIONS = "ROUTE_SCOPED_CORS_OPTIONS";
+//# sourceMappingURL=tokens.d.ts.map

package/dist/nestjs/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/nestjs/tokens.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,yBAAyB,8BAA8B,CAAC"}

package/dist/nestjs/tokens.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ROUTE_SCOPED_CORS_OPTIONS = void 0;
+exports.ROUTE_SCOPED_CORS_OPTIONS = 'ROUTE_SCOPED_CORS_OPTIONS';
+//# sourceMappingURL=tokens.js.map

package/dist/nestjs/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/nestjs/tokens.ts"],"names":[],"mappings":";;;AAAa,QAAA,yBAAyB,GAAG,2BAA2B,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,10 @@
+import type { Request, Response, NextFunction } from 'express';
+export interface RouteScopedCorsOptions {
+    /**
+     * Methods returned for unmatched paths and preflight requests on unknown
+     * routes. Defaults to the standard set: GET POST PUT PATCH DELETE OPTIONS.
+     */
+    fallbackMethods?: string[];
+}
+export type ExpressMiddlewareFn = (req: Request, res: Response, next: NextFunction) => void;
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE/D,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,MAAM,mBAAmB,GAAG,CAChC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,YAAY,KACf,IAAI,CAAC"}

package/dist/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "route-scoped-cors",
+  "version": "0.1.0",
+  "description": "Per-route CORS method scoping middleware for Express and NestJS — prevents HTTP verb tampering by advertising only the methods each route actually handles.",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "exports": {
+    ".": {
+      "require": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    },
+    "./nestjs": {
+      "require": "./dist/nestjs/index.js",
+      "types": "./dist/nestjs/index.d.ts"
+    }
+  },
+  "typesVersions": {
+    "*": {
+      "nestjs": [
+        "dist/nestjs/index.d.ts"
+      ]
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "cors",
+    "express",
+    "nestjs",
+    "middleware",
+    "route-scoped",
+    "http-methods",
+    "verb-tampering"
+  ],
+  "license": "MIT",
+  "peerDependencies": {
+    "@nestjs/common": ">=9.0.0",
+    "@nestjs/core": ">=9.0.0",
+    "express": ">=4.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@nestjs/common": {
+      "optional": true
+    },
+    "@nestjs/core": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@nestjs/common": "^10.0.0",
+    "@nestjs/core": "^10.0.0",
+    "@types/express": "^4.17.21",
+    "@types/node": "^20.0.0",
+    "reflect-metadata": "^0.1.13",
+    "typescript": "^5.0.0"
+  }
+}