sashiko 0.0.0-stage → 0.2.0

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,4BAA4B,CAAC;AAEpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC"}

package/dist/index.js

@@ -0,0 +1,7 @@
+// Ponto de entrada público do Sashiko.
+// O shim precisa ser avaliado antes de qualquer decorator rodar.
+import './shims/symbol-metadata.js';
+export * from './core/index.js';
+export * from './decorators/index.js';
+export * from './middlewares/index.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,iEAAiE;AACjE,OAAO,4BAA4B,CAAC;AAEpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC"}

package/dist/middlewares/cors.d.ts

@@ -0,0 +1,24 @@
+import type { Middleware } from '../core/compose.ts';
+export type CorsOrigin = '*' | string | RegExp | readonly (string | RegExp)[] | ((origin: string) => boolean | Promise<boolean>);
+export interface CorsOptions {
+    /** Origens permitidas. Obrigatório: não existe default permissivo. */
+    origin: CorsOrigin;
+    methods?: readonly string[];
+    allowedHeaders?: readonly string[];
+    exposedHeaders?: readonly string[];
+    /** Envia `Access-Control-Allow-Credentials: true`. Proibido com `origin: '*'`. */
+    credentials?: boolean;
+    /** Cache do preflight em segundos. Padrão: 600. */
+    maxAge?: number;
+}
+/**
+ * Middleware de CORS (S-01). Uso: `app.use(cors({ origin: 'https://app.exemplo.com' }))`.
+ *
+ * - Preflight (`OPTIONS` + `Access-Control-Request-Method`) é respondido com 204.
+ * - A origem só é refletida se estiver na lista permitida; `Vary: Origin` sempre que
+ *   a resposta depende da origem.
+ * - `origin: '*'` + `credentials: true` é rejeitado na criação (o navegador também recusaria,
+ *   e refletir qualquer origem com credenciais permitiria que qualquer site lesse dados do usuário).
+ */
+export declare function cors(opts: CorsOptions): Middleware;
+//# sourceMappingURL=cors.d.ts.map

package/dist/middlewares/cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../src/middlewares/cors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,MAAM,UAAU,GAClB,GAAG,GACH,MAAM,GACN,MAAM,GACN,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,GAC5B,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AAErD,MAAM,WAAW,WAAW;IAC1B,sEAAsE;IACtE,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,kFAAkF;IAClF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAKD;;;;;;;;GAQG;AACH,wBAAgB,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,UAAU,CAyClD"}

package/dist/middlewares/cors.js

@@ -0,0 +1,63 @@
+const DEFAULT_METHODS = ['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE'];
+const DEFAULT_HEADERS = ['Content-Type', 'Authorization'];
+/**
+ * Middleware de CORS (S-01). Uso: `app.use(cors({ origin: 'https://app.exemplo.com' }))`.
+ *
+ * - Preflight (`OPTIONS` + `Access-Control-Request-Method`) é respondido com 204.
+ * - A origem só é refletida se estiver na lista permitida; `Vary: Origin` sempre que
+ *   a resposta depende da origem.
+ * - `origin: '*'` + `credentials: true` é rejeitado na criação (o navegador também recusaria,
+ *   e refletir qualquer origem com credenciais permitiria que qualquer site lesse dados do usuário).
+ */
+export function cors(opts) {
+    if (opts.origin === '*' && opts.credentials) {
+        throw new Error("cors: `origin: '*'` cannot be combined with `credentials: true`. List the allowed origins.");
+    }
+    const wildcard = opts.origin === '*';
+    const isAllowed = buildMatcher(opts.origin);
+    const methods = (opts.methods ?? DEFAULT_METHODS).join(', ');
+    const allowedHeaders = opts.allowedHeaders?.join(', ');
+    const exposed = opts.exposedHeaders?.join(', ');
+    const maxAge = String(opts.maxAge ?? 600);
+    return async (ctx, next) => {
+        const origin = ctx.req.headers.origin;
+        const res = ctx.res;
+        if (!wildcard)
+            res.appendHeader('Vary', 'Origin');
+        const preflight = ctx.method === 'OPTIONS' && ctx.req.headers['access-control-request-method'] !== undefined;
+        if (!origin)
+            return preflight ? void ctx.status(204).res.end() : next();
+        const allowed = wildcard || (await isAllowed(origin));
+        if (!allowed) {
+            // Sem headers CORS o navegador bloqueia a leitura; a requisição em si segue normalmente.
+            return preflight ? void ctx.status(204).res.end() : next();
+        }
+        res.setHeader('Access-Control-Allow-Origin', wildcard ? '*' : origin);
+        if (opts.credentials)
+            res.setHeader('Access-Control-Allow-Credentials', 'true');
+        if (preflight) {
+            res.setHeader('Access-Control-Allow-Methods', methods);
+            const requested = ctx.req.headers['access-control-request-headers'];
+            const headers = allowedHeaders ?? (typeof requested === 'string' ? filterHeaders(requested) : DEFAULT_HEADERS.join(', '));
+            if (headers)
+                res.setHeader('Access-Control-Allow-Headers', headers);
+            res.setHeader('Access-Control-Max-Age', maxAge);
+            return void ctx.status(204).res.end();
+        }
+        if (exposed)
+            res.setHeader('Access-Control-Expose-Headers', exposed);
+        await next();
+    };
+}
+/** Sem lista explícita, aceita apenas os headers padrão entre os pedidos pelo navegador. */
+function filterHeaders(requested) {
+    const safe = new Set(DEFAULT_HEADERS.map((h) => h.toLowerCase()));
+    return requested.split(',').map((h) => h.trim()).filter((h) => safe.has(h.toLowerCase())).join(', ');
+}
+function buildMatcher(origin) {
+    if (typeof origin === 'function')
+        return origin;
+    const list = Array.isArray(origin) ? origin : [origin];
+    return (o) => list.some((rule) => (typeof rule === 'string' ? rule === o : rule.test(o)));
+}
+//# sourceMappingURL=cors.js.map

package/dist/middlewares/cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/middlewares/cors.ts"],"names":[],"mappings":"AAqBA,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;AAC1E,MAAM,eAAe,GAAG,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;AAE1D;;;;;;;;GAQG;AACH,MAAM,UAAU,IAAI,CAAC,IAAiB;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,4FAA4F,CAAC,CAAC;IAChH,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC;IACrC,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7D,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC;IAE1C,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QACtC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QACpB,IAAI,CAAC,QAAQ;YAAE,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAElD,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,+BAA+B,CAAC,KAAK,SAAS,CAAC;QAE7G,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAExE,MAAM,OAAO,GAAG,QAAQ,IAAI,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,yFAAyF;YACzF,OAAO,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7D,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACtE,IAAI,IAAI,CAAC,WAAW;YAAE,GAAG,CAAC,SAAS,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;QAEhF,IAAI,SAAS,EAAE,CAAC;YACd,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,OAAO,CAAC,CAAC;YACvD,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;YACpE,MAAM,OAAO,GAAG,cAAc,IAAI,CAAC,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1H,IAAI,OAAO;gBAAE,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,OAAO,CAAC,CAAC;YACpE,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;YAChD,OAAO,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QACxC,CAAC;QAED,IAAI,OAAO;YAAE,GAAG,CAAC,SAAS,CAAC,+BAA+B,EAAE,OAAO,CAAC,CAAC;QACrE,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,SAAS,aAAa,CAAC,SAAiB;IACtC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAClE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvG,CAAC;AAED,SAAS,YAAY,CAAC,MAAkB;IACtC,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAyB,CAAC,CAAC;IAC1E,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC"}

package/dist/middlewares/index.d.ts

@@ -0,0 +1,4 @@
+export { cors, type CorsOptions, type CorsOrigin } from './cors.ts';
+export { MemoryRateLimitStore, rateLimit, type RateLimitOptions, type RateLimitStore } from './rate-limit.ts';
+export { buildSecurityHeaders, type SecurityHeadersOptions } from './security-headers.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/middlewares/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middlewares/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC9G,OAAO,EAAE,oBAAoB,EAAE,KAAK,sBAAsB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/middlewares/index.js

@@ -0,0 +1,4 @@
+export { cors } from './cors.js';
+export { MemoryRateLimitStore, rateLimit } from './rate-limit.js';
+export { buildSecurityHeaders } from './security-headers.js';
+//# sourceMappingURL=index.js.map

package/dist/middlewares/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middlewares/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAqC,MAAM,WAAW,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAA8C,MAAM,iBAAiB,CAAC;AAC9G,OAAO,EAAE,oBAAoB,EAA+B,MAAM,uBAAuB,CAAC"}

package/dist/middlewares/rate-limit.d.ts

@@ -0,0 +1,35 @@
+import type { Context } from '../core/context.ts';
+import type { Middleware } from '../core/compose.ts';
+export interface RateLimitStore {
+    /** Incrementa o contador da chave e retorna o total e quando a janela reinicia (epoch ms). */
+    hit(key: string, windowMs: number): {
+        count: number;
+        resetAt: number;
+    } | Promise<{
+        count: number;
+        resetAt: number;
+    }>;
+}
+export interface RateLimitOptions {
+    /** Máximo de requisições por janela. */
+    max: number;
+    /** Tamanho da janela em ms. Padrão: 60_000. */
+    windowMs?: number;
+    /** Chave de agrupamento. Padrão: IP do socket (`ctx.ip`). */
+    key?: (ctx: Context) => string;
+    /** Store plugável (Redis etc.). Padrão: memória local. */
+    store?: RateLimitStore;
+}
+/** Store em memória, janela fixa. Adequado para uma única instância. */
+export declare class MemoryRateLimitStore implements RateLimitStore {
+    private hits;
+    private sweeper;
+    constructor(sweepEveryMs?: number);
+    hit(key: string, windowMs: number): {
+        count: number;
+        resetAt: number;
+    };
+}
+/** Rate limiting por chave (S-06). Responde 429 com `Retry-After` ao exceder. */
+export declare function rateLimit(opts: RateLimitOptions): Middleware;
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/middlewares/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/middlewares/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGrD,MAAM,WAAW,cAAc;IAC7B,8FAA8F;IAC9F,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACtH;AAED,MAAM,WAAW,gBAAgB;IAC/B,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IAC/B,0DAA0D;IAC1D,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED,wEAAwE;AACxE,qBAAa,oBAAqB,YAAW,cAAc;IACzD,OAAO,CAAC,IAAI,CAAyD;IACrE,OAAO,CAAC,OAAO,CAAiB;IAEhC,YAAY,YAAY,SAAS,EAMhC;IAED,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;eAXO,MAAM;iBAAW,MAAM;MAoB9D;CACF;AAED,iFAAiF;AACjF,wBAAgB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,UAAU,CAkB5D"}

package/dist/middlewares/rate-limit.js

@@ -0,0 +1,45 @@
+import { HttpError } from '../core/errors.js';
+/** Store em memória, janela fixa. Adequado para uma única instância. */
+export class MemoryRateLimitStore {
+    hits = new Map();
+    sweeper;
+    constructor(sweepEveryMs = 60_000) {
+        this.sweeper = setInterval(() => {
+            const now = Date.now();
+            for (const [k, v] of this.hits)
+                if (v.resetAt <= now)
+                    this.hits.delete(k);
+        }, sweepEveryMs);
+        this.sweeper.unref();
+    }
+    hit(key, windowMs) {
+        const now = Date.now();
+        let entry = this.hits.get(key);
+        if (!entry || entry.resetAt <= now) {
+            entry = { count: 0, resetAt: now + windowMs };
+            this.hits.set(key, entry);
+        }
+        entry.count++;
+        return { ...entry };
+    }
+}
+/** Rate limiting por chave (S-06). Responde 429 com `Retry-After` ao exceder. */
+export function rateLimit(opts) {
+    const windowMs = opts.windowMs ?? 60_000;
+    const store = opts.store ?? new MemoryRateLimitStore();
+    const keyOf = opts.key ?? ((ctx) => ctx.ip);
+    return async (ctx, next) => {
+        const { count, resetAt } = await store.hit(keyOf(ctx), windowMs);
+        const remaining = Math.max(0, opts.max - count);
+        const resetSec = Math.max(0, Math.ceil((resetAt - Date.now()) / 1000));
+        ctx.res.setHeader('RateLimit-Limit', String(opts.max));
+        ctx.res.setHeader('RateLimit-Remaining', String(remaining));
+        ctx.res.setHeader('RateLimit-Reset', String(resetSec));
+        if (count > opts.max) {
+            ctx.res.setHeader('Retry-After', String(resetSec));
+            throw new HttpError(429, 'Too Many Requests', 'RATE_LIMITED');
+        }
+        await next();
+    };
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/middlewares/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../src/middlewares/rate-limit.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAkB9C,wEAAwE;AACxE,MAAM,OAAO,oBAAoB;IACvB,IAAI,GAAG,IAAI,GAAG,EAA8C,CAAC;IAC7D,OAAO,CAAiB;IAEhC,YAAY,YAAY,GAAG,MAAM;QAC/B,IAAI,CAAC,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE;YAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI;gBAAE,IAAI,CAAC,CAAC,OAAO,IAAI,GAAG;oBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC,EAAE,YAAY,CAAC,CAAC;QACjB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,QAAgB;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;YACnC,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,QAAQ,EAAE,CAAC;YAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;IACtB,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,UAAU,SAAS,CAAC,IAAsB;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,oBAAoB,EAAE,CAAC;IACvD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAErD,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QACvE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACvD,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,qBAAqB,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5D,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvD,IAAI,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YACnD,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,mBAAmB,EAAE,cAAc,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/middlewares/security-headers.d.ts

@@ -0,0 +1,26 @@
+import type { ServerResponse } from 'node:http';
+export interface SecurityHeadersOptions {
+    /** Padrão: `default-src 'none'; frame-ancestors 'none'` (adequado para APIs JSON). `false` desliga. */
+    contentSecurityPolicy?: string | false;
+    /** Padrão: `no-referrer`. */
+    referrerPolicy?: string | false;
+    /** Padrão: `DENY`. */
+    frameOptions?: 'DENY' | 'SAMEORIGIN' | false;
+    /** Padrão: `same-origin`. */
+    crossOriginResourcePolicy?: 'same-origin' | 'same-site' | 'cross-origin' | false;
+    /**
+     * HSTS é opt-in: só faz sentido atrás de HTTPS.
+     * `true` = `max-age=15552000; includeSubDomains` (180 dias).
+     */
+    strictTransportSecurity?: boolean | {
+        maxAge: number;
+        includeSubDomains?: boolean;
+        preload?: boolean;
+    };
+}
+/**
+ * Headers de segurança padrão (S-04) e proteções contra XSS em APIs JSON (S-02).
+ * Retorna uma função que aplica os headers pré-calculados na resposta.
+ */
+export declare function buildSecurityHeaders(opts?: SecurityHeadersOptions): (res: ServerResponse) => void;
+//# sourceMappingURL=security-headers.d.ts.map

package/dist/middlewares/security-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-headers.d.ts","sourceRoot":"","sources":["../../src/middlewares/security-headers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEhD,MAAM,WAAW,sBAAsB;IACrC,uGAAuG;IACvG,qBAAqB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACvC,6BAA6B;IAC7B,cAAc,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAChC,sBAAsB;IACtB,YAAY,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,KAAK,CAAC;IAC7C,6BAA6B;IAC7B,yBAAyB,CAAC,EAAE,aAAa,GAAG,WAAW,GAAG,cAAc,GAAG,KAAK,CAAC;IACjF;;;OAGG;IACH,uBAAuB,CAAC,EAAE,OAAO,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACxG;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,GAAE,sBAA2B,GAAG,CAAC,GAAG,EAAE,cAAc,KAAK,IAAI,CA2BrG"}

package/dist/middlewares/security-headers.js

@@ -0,0 +1,34 @@
+/**
+ * Headers de segurança padrão (S-04) e proteções contra XSS em APIs JSON (S-02).
+ * Retorna uma função que aplica os headers pré-calculados na resposta.
+ */
+export function buildSecurityHeaders(opts = {}) {
+    const headers = [['X-Content-Type-Options', 'nosniff']];
+    const csp = opts.contentSecurityPolicy ?? "default-src 'none'; frame-ancestors 'none'";
+    if (csp)
+        headers.push(['Content-Security-Policy', csp]);
+    const referrer = opts.referrerPolicy ?? 'no-referrer';
+    if (referrer)
+        headers.push(['Referrer-Policy', referrer]);
+    const frame = opts.frameOptions ?? 'DENY';
+    if (frame)
+        headers.push(['X-Frame-Options', frame]);
+    const corp = opts.crossOriginResourcePolicy ?? 'same-origin';
+    if (corp)
+        headers.push(['Cross-Origin-Resource-Policy', corp]);
+    const hsts = opts.strictTransportSecurity;
+    if (hsts) {
+        const cfg = hsts === true ? { maxAge: 15552000, includeSubDomains: true } : hsts;
+        let value = `max-age=${cfg.maxAge}`;
+        if (cfg.includeSubDomains)
+            value += '; includeSubDomains';
+        if ('preload' in cfg && cfg.preload)
+            value += '; preload';
+        headers.push(['Strict-Transport-Security', value]);
+    }
+    return (res) => {
+        for (const [name, value] of headers)
+            res.setHeader(name, value);
+    };
+}
+//# sourceMappingURL=security-headers.js.map

package/dist/middlewares/security-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-headers.js","sourceRoot":"","sources":["../../src/middlewares/security-headers.ts"],"names":[],"mappings":"AAkBA;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAI,GAA2B,EAAE;IACpE,MAAM,OAAO,GAAuB,CAAC,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC,CAAC;IAE5E,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,IAAI,4CAA4C,CAAC;IACvF,IAAI,GAAG;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC,CAAC;IAExD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,IAAI,aAAa,CAAC;IACtD,IAAI,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE1D,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC;IAC1C,IAAI,KAAK;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC;IAEpD,MAAM,IAAI,GAAG,IAAI,CAAC,yBAAyB,IAAI,aAAa,CAAC;IAC7D,IAAI,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC,CAAC;IAE/D,MAAM,IAAI,GAAG,IAAI,CAAC,uBAAuB,CAAC;IAC1C,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,GAAG,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACjF,IAAI,KAAK,GAAG,WAAW,GAAG,CAAC,MAAM,EAAE,CAAC;QACpC,IAAI,GAAG,CAAC,iBAAiB;YAAE,KAAK,IAAI,qBAAqB,CAAC;QAC1D,IAAI,SAAS,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO;YAAE,KAAK,IAAI,WAAW,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,EAAE;QACb,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO;YAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClE,CAAC,CAAC;AACJ,CAAC"}

package/dist/schema/serialization.d.ts

@@ -0,0 +1,2 @@
+export declare function serialize(schema: object, data: unknown): string;
+//# sourceMappingURL=serialization.d.ts.map

package/dist/schema/serialization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialization.d.ts","sourceRoot":"","sources":["../../src/schema/serialization.ts"],"names":[],"mappings":"AAIA,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,CAO/D"}

package/dist/schema/serialization.js

@@ -0,0 +1,11 @@
+import fastJson from 'fast-json-stringify';
+const cache = new WeakMap();
+export function serialize(schema, data) {
+    let fn = cache.get(schema);
+    if (!fn) {
+        fn = fastJson(schema);
+        cache.set(schema, fn);
+    }
+    return fn(data);
+}
+//# sourceMappingURL=serialization.js.map

package/dist/schema/serialization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialization.js","sourceRoot":"","sources":["../../src/schema/serialization.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,qBAAqB,CAAC;AAE3C,MAAM,KAAK,GAAG,IAAI,OAAO,EAAqC,CAAC;AAE/D,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,IAAa;IACrD,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,EAAE,GAAG,QAAQ,CAAC,MAAwC,CAAC,CAAC;QACxD,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;AAClB,CAAC"}

package/dist/schema/validation.d.ts

@@ -0,0 +1,11 @@
+import { type ErrorObject } from 'ajv';
+export type ValidationTarget = 'params' | 'query' | 'headers' | 'body';
+export interface ValidationIssue {
+    /** JSON Pointer do campo inválido (`/email`, `/items/0/id`). `/` = raiz. */
+    path: string;
+    message: string;
+}
+/** Valida `data` contra `schema`. Retorna `null` se válido, ou a lista de problemas (B-02). */
+export declare function validate(schema: object, data: unknown, target: ValidationTarget): ValidationIssue[] | null;
+export declare function formatErrors(errors: ErrorObject[]): ValidationIssue[];
+//# sourceMappingURL=validation.d.ts.map

package/dist/schema/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/schema/validation.ts"],"names":[],"mappings":"AAAA,OAAkB,EAAE,KAAK,WAAW,EAAyB,MAAM,KAAK,CAAC;AAYzE,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAEvE,MAAM,WAAW,eAAe;IAC9B,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAmCD,+FAA+F;AAC/F,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,GAAG,eAAe,EAAE,GAAG,IAAI,CAG1G;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,eAAe,EAAE,CAKrE"}

package/dist/schema/validation.js

@@ -0,0 +1,48 @@
+import AjvModule, {} from 'ajv';
+import addFormatsModule from 'ajv-formats';
+// Interop explícito: o TS em ESM + verbatimModuleSyntax resolve o default
+// como namespace; pegamos o `.default` real em runtime (que o Node injeta
+// via CJS interop) e caímos no próprio módulo se ele já for o valor.
+const Ajv = (AjvModule.default ?? AjvModule);
+const addFormats = (addFormatsModule.default ?? addFormatsModule);
+function createAjv(coerceTypes) {
+    const ajv = new Ajv({ allErrors: true, coerceTypes, useDefaults: true, removeAdditional: false });
+    addFormats(ajv);
+    return ajv;
+}
+/**
+ * Duas instâncias (B-06):
+ * - `coercing`: params/query/headers chegam sempre como string, então convertemos
+ *   para o tipo declarado (`"5"` → `5`).
+ * - `strict`: o body já é JSON tipado; coerção mascararia erros do cliente
+ *   (`"30"` virar `30`, `""` virar `0`).
+ */
+// 'array' também converte valor único em array quando o schema pede array (`?tag=a` → `['a']`, B-07)
+const coercing = createAjv('array');
+const strict = createAjv(false);
+const caches = new Map([
+    [coercing, new WeakMap()],
+    [strict, new WeakMap()],
+]);
+function compile(schema, target) {
+    const ajv = target === 'body' ? strict : coercing;
+    const cache = caches.get(ajv);
+    let fn = cache.get(schema);
+    if (!fn) {
+        fn = ajv.compile(schema);
+        cache.set(schema, fn);
+    }
+    return fn;
+}
+/** Valida `data` contra `schema`. Retorna `null` se válido, ou a lista de problemas (B-02). */
+export function validate(schema, data, target) {
+    const fn = compile(schema, target);
+    return fn(data) ? null : formatErrors(fn.errors ?? []);
+}
+export function formatErrors(errors) {
+    return errors.map((e) => {
+        const missing = e.keyword === 'required' ? `/${e.params.missingProperty}` : '';
+        return { path: `${e.instancePath}${missing}` || '/', message: e.message ?? 'invalid' };
+    });
+}
+//# sourceMappingURL=validation.js.map

package/dist/schema/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../src/schema/validation.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,EAAE,EAA2C,MAAM,KAAK,CAAC;AACzE,OAAO,gBAAgB,MAAM,aAAa,CAAC;AAE3C,0EAA0E;AAC1E,0EAA0E;AAC1E,qEAAqE;AACrE,MAAM,GAAG,GAAG,CAAE,SAAiB,CAAC,OAAO,IAAI,SAAS,CAAiC,CAAC;AACtF,MAAM,UAAU,GAAG,CAAE,gBAAwB,CAAC,OAAO,IAAI,gBAAgB,CAGhE,CAAC;AAUV,SAAS,SAAS,CAAC,WAA8B;IAC/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;IAClG,UAAU,CAAC,GAAG,CAAC,CAAC;IAChB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,qGAAqG;AACrG,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;AACpC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;AAEhC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC;IACrB,CAAC,QAAQ,EAAE,IAAI,OAAO,EAA4B,CAAC;IACnD,CAAC,MAAM,EAAE,IAAI,OAAO,EAA4B,CAAC;CAClD,CAAC,CAAC;AAEH,SAAS,OAAO,CAAC,MAAc,EAAE,MAAwB;IACvD,MAAM,GAAG,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;IAC/B,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzB,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,QAAQ,CAAC,MAAc,EAAE,IAAa,EAAE,MAAwB;IAC9E,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAqB;IAChD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACtB,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,IAAK,CAAC,CAAC,MAAsC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChH,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,YAAY,GAAG,OAAO,EAAE,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC;IACzF,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/shims/symbol-metadata.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=symbol-metadata.d.ts.map

package/dist/shims/symbol-metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"symbol-metadata.d.ts","sourceRoot":"","sources":["../../src/shims/symbol-metadata.ts"],"names":[],"mappings":""}

package/dist/shims/symbol-metadata.js

@@ -0,0 +1,8 @@
+// TC39 não cria Symbol.metadata automaticamente em todo runtime.
+// Este arquivo deve ser importado ANTES de qualquer decorator rodar.
+const S = Symbol;
+if (!S.metadata) {
+    S.metadata = Symbol.for('Symbol.metadata');
+}
+export {};
+//# sourceMappingURL=symbol-metadata.js.map

package/dist/shims/symbol-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"symbol-metadata.js","sourceRoot":"","sources":["../../src/shims/symbol-metadata.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,qEAAqE;AACrE,MAAM,CAAC,GAAG,MAA+B,CAAC;AAC1C,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChB,CAAC,CAAC,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;AAC7C,CAAC"}

package/dist/utils/content-type.d.ts

@@ -0,0 +1,5 @@
+/** Media type sem parâmetros e em minúsculas: `"Application/JSON; charset=utf-8"` → `"application/json"`. */
+export declare function mediaType(header: string | undefined): string;
+/** `application/json` ou `application/*+json`, com parâmetros opcionais (B-11). */
+export declare function isJsonContentType(header: string | undefined): boolean;
+//# sourceMappingURL=content-type.d.ts.map

package/dist/utils/content-type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-type.d.ts","sourceRoot":"","sources":["../../src/utils/content-type.ts"],"names":[],"mappings":"AAAA,6GAA6G;AAC7G,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAE5D;AAED,mFAAmF;AACnF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAGrE"}

package/dist/utils/content-type.js

@@ -0,0 +1,10 @@
+/** Media type sem parâmetros e em minúsculas: `"Application/JSON; charset=utf-8"` → `"application/json"`. */
+export function mediaType(header) {
+    return header ? header.split(';', 1)[0].trim().toLowerCase() : '';
+}
+/** `application/json` ou `application/*+json`, com parâmetros opcionais (B-11). */
+export function isJsonContentType(header) {
+    const type = mediaType(header);
+    return type === 'application/json' || /^application\/[a-z0-9!#$&^_.-]+\+json$/.test(type);
+}
+//# sourceMappingURL=content-type.js.map

package/dist/utils/content-type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-type.js","sourceRoot":"","sources":["../../src/utils/content-type.ts"],"names":[],"mappings":"AAAA,6GAA6G;AAC7G,MAAM,UAAU,SAAS,CAAC,MAA0B;IAClD,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,iBAAiB,CAAC,MAA0B;IAC1D,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC/B,OAAO,IAAI,KAAK,kBAAkB,IAAI,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5F,CAAC"}

package/dist/utils/index.d.ts

@@ -0,0 +1,4 @@
+export { isJsonContentType, mediaType } from './content-type.ts';
+export { joinPaths } from './path.ts';
+export { DEFAULT_MAX_QUERY_KEYS, parseQuery, type ParsedQuery } from './query.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/utils/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC"}

package/dist/utils/index.js

@@ -0,0 +1,4 @@
+export { isJsonContentType, mediaType } from './content-type.js';
+export { joinPaths } from './path.js';
+export { DEFAULT_MAX_QUERY_KEYS, parseQuery } from './query.js';
+//# sourceMappingURL=index.js.map

package/dist/utils/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAoB,MAAM,YAAY,CAAC"}

package/dist/utils/path.d.ts

@@ -0,0 +1,3 @@
+/** Junta prefixo e caminho com exatamente uma barra entre eles: `('/users/', 'id')` → `/users/id`. */
+export declare function joinPaths(prefix: string, path: string): string;
+//# sourceMappingURL=path.d.ts.map

package/dist/utils/path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../../src/utils/path.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAI9D"}

package/dist/utils/path.js

@@ -0,0 +1,7 @@
+/** Junta prefixo e caminho com exatamente uma barra entre eles: `('/users/', 'id')` → `/users/id`. */
+export function joinPaths(prefix, path) {
+    const p = prefix.replace(/\/$/, '');
+    const s = path.startsWith('/') ? path : `/${path}`;
+    return `${p}${s}` || '/';
+}
+//# sourceMappingURL=path.js.map

package/dist/utils/path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path.js","sourceRoot":"","sources":["../../src/utils/path.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,IAAY;IACpD,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IACnD,OAAO,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC;AAC3B,CAAC"}

package/dist/utils/query.d.ts

@@ -0,0 +1,13 @@
+/** Padrão do `node:querystring`: limita o custo de queries gigantes (S-06). */
+export declare const DEFAULT_MAX_QUERY_KEYS = 1000;
+export type ParsedQuery = Record<string, string | string[]>;
+/**
+ * Converte `URLSearchParams` em objeto (B-07):
+ * - chaves repetidas viram array (`?tag=a&tag=b` → `{ tag: ['a', 'b'] }`);
+ * - `__proto__`, `constructor` e `prototype` são descartadas (S-08);
+ * - pares além de `maxKeys` são ignorados (S-06).
+ *
+ * Usa `URLSearchParams` (WHATWG) em vez do `node:querystring`, que é legado.
+ */
+export declare function parseQuery(params: URLSearchParams, maxKeys?: number): ParsedQuery;
+//# sourceMappingURL=query.d.ts.map

package/dist/utils/query.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../src/utils/query.ts"],"names":[],"mappings":"AAEA,+EAA+E;AAC/E,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAE3C,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;AAE5D;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,SAAyB,GAAG,WAAW,CAYjG"}

package/dist/utils/query.js

@@ -0,0 +1,30 @@
+const UNSAFE_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+/** Padrão do `node:querystring`: limita o custo de queries gigantes (S-06). */
+export const DEFAULT_MAX_QUERY_KEYS = 1000;
+/**
+ * Converte `URLSearchParams` em objeto (B-07):
+ * - chaves repetidas viram array (`?tag=a&tag=b` → `{ tag: ['a', 'b'] }`);
+ * - `__proto__`, `constructor` e `prototype` são descartadas (S-08);
+ * - pares além de `maxKeys` são ignorados (S-06).
+ *
+ * Usa `URLSearchParams` (WHATWG) em vez do `node:querystring`, que é legado.
+ */
+export function parseQuery(params, maxKeys = DEFAULT_MAX_QUERY_KEYS) {
+    const out = {};
+    let count = 0;
+    for (const [key, value] of params) {
+        if (count++ >= maxKeys)
+            break;
+        if (UNSAFE_KEYS.has(key))
+            continue;
+        const prev = out[key];
+        if (prev === undefined)
+            out[key] = value;
+        else if (Array.isArray(prev))
+            prev.push(value);
+        else
+            out[key] = [prev, value];
+    }
+    return out;
+}
+//# sourceMappingURL=query.js.map

package/dist/utils/query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query.js","sourceRoot":"","sources":["../../src/utils/query.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;AAEvE,+EAA+E;AAC/E,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAI3C;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,MAAuB,EAAE,OAAO,GAAG,sBAAsB;IAClF,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QAClC,IAAI,KAAK,EAAE,IAAI,OAAO;YAAE,MAAM;QAC9B,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACnC,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,IAAI,KAAK,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;aACpC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;YAC1C,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}