sashiko 0.5.0 → 0.7.0

package/dist/middlewares/csrf.d.ts

@@ -0,0 +1,42 @@
+import type { Middleware } from '../core/compose.ts';
+import { type CookieOptions } from '../utils/cookie.ts';
+import { type MatchRule } from '../utils/origin-match.ts';
+declare module '../core/context.ts' {
+    interface ContextState {
+        /** Token CSRF da requisição, com `csrf({ token: true })`. Envie-o ao front no header configurado. */
+        csrfToken?: string;
+    }
+}
+export interface CsrfTokenOptions {
+    /** Padrão: `'__Host-csrf'`, que não pode ser definido por subdomínios. */
+    cookieName?: string;
+    /** Header onde o cliente devolve o token. Padrão: `'X-CSRF-Token'`. */
+    headerName?: string;
+    /** Atributos do cookie. `httpOnly` é sempre `false` (o front precisa ler) e `SameSite` padrão é `Strict`. */
+    cookie?: Omit<CookieOptions, 'httpOnly'>;
+}
+export interface CsrfOptions {
+    /**
+     * Outras origens confiáveis além da própria (`ctx.protocol://ctx.host`), com as mesmas regras do
+     * `cors()`: `'https://app.exemplo.com'`, `'https://*.exemplo.dev'` ou RegExp de casamento inteiro.
+     */
+    trustedOrigins?: readonly MatchRule[];
+    /** Ativa também o double-submit token. `true` usa os padrões de {@link CsrfTokenOptions}. */
+    token?: boolean | CsrfTokenOptions;
+}
+/**
+ * Proteção contra CSRF. Use sempre que a autenticação for por cookie.
+ *
+ * Métodos que alteram estado (todos menos GET, HEAD e OPTIONS) são recusados com 403 quando vêm de
+ * outra origem:
+ * 1. `Sec-Fetch-Site: same-origin` ou `none` (navegação do próprio usuário) passa; `same-site` e
+ *    `cross-site` só passam se o `Origin` estiver em `trustedOrigins`;
+ * 2. sem `Sec-Fetch-Site`, o `Origin` precisa ser a própria origem ou uma confiável;
+ * 3. sem nenhum dos dois, a requisição não veio de um navegador (curl, servidor a servidor) e passa,
+ *    porque CSRF depende de um navegador que anexe os cookies da vítima.
+ *
+ * Com `token`, além disso, exige o double-submit: o valor do header deve ser igual ao do cookie.
+ * Por isso, rotas GET nunca devem alterar estado.
+ */
+export declare function csrf(opts?: CsrfOptions): Middleware;
+//# sourceMappingURL=csrf.d.ts.map

package/dist/middlewares/csrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/middlewares/csrf.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGrD,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAyC,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAEjG,OAAO,QAAQ,oBAAoB,CAAC;IAClC,UAAU,YAAY;QACpB,qGAAqG;QACrG,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB;CACF;AAED,MAAM,WAAW,gBAAgB;IAC/B,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6GAA6G;IAC7G,MAAM,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,cAAc,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;IACtC,6FAA6F;IAC7F,KAAK,CAAC,EAAE,OAAO,GAAG,gBAAgB,CAAC;CACpC;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAgB,IAAI,CAAC,IAAI,GAAE,WAAgB,GAAG,UAAU,CAgCvD"}

package/dist/middlewares/csrf.js

@@ -0,0 +1,70 @@
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { HttpError } from '../core/errors.js';
+import { serializeCookie } from '../utils/cookie.js';
+import { compileOriginMatcher, normalizeOrigin } from '../utils/origin-match.js';
+const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
+/**
+ * Proteção contra CSRF. Use sempre que a autenticação for por cookie.
+ *
+ * Métodos que alteram estado (todos menos GET, HEAD e OPTIONS) são recusados com 403 quando vêm de
+ * outra origem:
+ * 1. `Sec-Fetch-Site: same-origin` ou `none` (navegação do próprio usuário) passa; `same-site` e
+ *    `cross-site` só passam se o `Origin` estiver em `trustedOrigins`;
+ * 2. sem `Sec-Fetch-Site`, o `Origin` precisa ser a própria origem ou uma confiável;
+ * 3. sem nenhum dos dois, a requisição não veio de um navegador (curl, servidor a servidor) e passa,
+ *    porque CSRF depende de um navegador que anexe os cookies da vítima.
+ *
+ * Com `token`, além disso, exige o double-submit: o valor do header deve ser igual ao do cookie.
+ * Por isso, rotas GET nunca devem alterar estado.
+ */
+export function csrf(opts = {}) {
+    const trusted = compileOriginMatcher(opts.trustedOrigins ?? []);
+    const token = opts.token ? (opts.token === true ? {} : opts.token) : undefined;
+    const cookieName = token?.cookieName ?? '__Host-csrf';
+    const headerName = (token?.headerName ?? 'X-CSRF-Token').toLowerCase();
+    const cookieOpts = { sameSite: 'Strict', ...token?.cookie, httpOnly: false };
+    // Valida nome e atributos já na criação, e não na primeira requisição.
+    if (token)
+        serializeCookie(cookieName, 'x', cookieOpts);
+    return async (ctx, next) => {
+        const safe = SAFE_METHODS.has(ctx.method);
+        if (!safe && !originAllowed(ctx, trusted)) {
+            throw new HttpError(403, 'Cross-origin request blocked', 'CSRF_ORIGIN');
+        }
+        if (token) {
+            const current = ctx.cookies[cookieName];
+            if (!safe) {
+                const sent = ctx.get(headerName);
+                if (!current || !sent || !equal(current, sent)) {
+                    throw new HttpError(403, 'Invalid CSRF token', 'CSRF_TOKEN');
+                }
+            }
+            if (current && current.length >= 32) {
+                ctx.state.csrfToken = current;
+            }
+            else {
+                ctx.state.csrfToken = randomBytes(32).toString('base64url');
+                ctx.setCookie(cookieName, ctx.state.csrfToken, cookieOpts);
+            }
+        }
+        await next();
+    };
+}
+function originAllowed(ctx, trusted) {
+    const origin = ctx.get('origin');
+    const site = ctx.get('sec-fetch-site');
+    if (site === 'same-origin' || site === 'none')
+        return true;
+    if (site !== undefined)
+        return origin !== undefined && trusted(origin);
+    if (origin === undefined)
+        return true;
+    const own = ctx.host ? normalizeOrigin(`${ctx.protocol}://${ctx.host}`) : undefined;
+    return (own !== undefined && normalizeOrigin(origin) === own) || trusted(origin);
+}
+function equal(a, b) {
+    const x = Buffer.from(a);
+    const y = Buffer.from(b);
+    return x.length === y.length && timingSafeEqual(x, y);
+}
+//# sourceMappingURL=csrf.js.map

package/dist/middlewares/csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../../src/middlewares/csrf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG3D,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAsB,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAkB,MAAM,0BAA0B,CAAC;AA4BjG,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAEzD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,IAAI,CAAC,IAAI,GAAgB,EAAE;IACzC,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,MAAM,UAAU,GAAG,KAAK,EAAE,UAAU,IAAI,aAAa,CAAC;IACtD,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,UAAU,IAAI,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC;IACvE,MAAM,UAAU,GAAkB,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC5F,uEAAuE;IACvE,IAAI,KAAK;QAAE,eAAe,CAAC,UAAU,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IAExD,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,8BAA8B,EAAE,aAAa,CAAC,CAAC;QAC1E,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACxC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACjC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;oBAC/C,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,oBAAoB,EAAE,YAAY,CAAC,CAAC;gBAC/D,CAAC;YACH,CAAC;YACD,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;gBACpC,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAC5D,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,GAAY,EAAE,OAAoC;IACvE,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACvC,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACvE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,GAAG,CAAC,QAAQ,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpF,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,KAAK,CAAC,CAAS,EAAE,CAAS;IACjC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC"}

package/dist/middlewares/index.d.ts

@@ -1,4 +1,5 @@
 export { cors, type CorsOptions, type CorsOrigin } from './cors.ts';
 export { MemoryRateLimitStore, rateLimit, type RateLimitOptions, type RateLimitStore } from './rate-limit.ts';
 export { buildSecurityHeaders, type SecurityHeadersOptions, type SecurityPreset } from './security-headers.ts';
+export { csrf, type CsrfOptions, type CsrfTokenOptions } from './csrf.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/middlewares/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middlewares/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC9G,OAAO,EAAE,oBAAoB,EAAE,KAAK,sBAAsB,EAAE,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middlewares/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC9G,OAAO,EAAE,oBAAoB,EAAE,KAAK,sBAAsB,EAAE,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC/G,OAAO,EAAE,IAAI,EAAE,KAAK,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,WAAW,CAAC"}

package/dist/middlewares/index.js

@@ -1,4 +1,5 @@
 export { cors } from './cors.js';
 export { MemoryRateLimitStore, rateLimit } from './rate-limit.js';
 export { buildSecurityHeaders } from './security-headers.js';
+export { csrf } from './csrf.js';
 //# sourceMappingURL=index.js.map

package/dist/middlewares/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middlewares/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAqC,MAAM,WAAW,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAA8C,MAAM,iBAAiB,CAAC;AAC9G,OAAO,EAAE,oBAAoB,EAAoD,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middlewares/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAqC,MAAM,WAAW,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAA8C,MAAM,iBAAiB,CAAC;AAC9G,OAAO,EAAE,oBAAoB,EAAoD,MAAM,uBAAuB,CAAC;AAC/G,OAAO,EAAE,IAAI,EAA2C,MAAM,WAAW,CAAC"}

package/dist/openapi/generate.d.ts

@@ -0,0 +1,43 @@
+import type { CompiledRoute } from '../core/compiler.ts';
+import type { Middleware } from '../core/compose.ts';
+import type { Guard } from '../core/guard.ts';
+/** Opções de `app.openapi()` (F-16). */
+export interface OpenAPIOptions {
+    /** Padrão: `{ title: 'API', version: '0.0.0' }`. */
+    info?: {
+        title: string;
+        version: string;
+        description?: string;
+        [key: string]: unknown;
+    };
+    servers?: readonly {
+        url: string;
+        description?: string;
+    }[];
+    /** Onde servir o documento JSON. Padrão: `'/openapi.json'`. */
+    path?: string;
+    /** Swagger UI. Desligado por padrão: `true` serve em `'/docs'`, uma string escolhe o path. */
+    docs?: string | boolean;
+    /** Rodam antes de servir o documento e a página, depois dos middlewares globais. */
+    middlewares?: readonly Middleware[];
+    /** Rodam depois dos `middlewares`, como nas rotas (401/403 antes de gerar o documento). */
+    guards?: readonly Guard[];
+}
+type Json = Record<string, unknown>;
+/** `/:org/users/:id(^\\d+)` → `/{org}/users/{id}`; `::` → `:`; `*` → `{*}`; sem barra final (o roteador a ignora). */
+export declare function toOpenAPIPath(path: string): string;
+/**
+ * Gera o documento OpenAPI 3.1 a partir das rotas registradas (F-16). Os schemas TypeBox já são
+ * JSON Schema, então entram como estão. Schemas que não são JSON Schema (Zod etc.) não são convertidos.
+ */
+export declare function generateOpenAPI(routes: readonly CompiledRoute[], opts: OpenAPIOptions, problemErrors: boolean): Json;
+/**
+ * Página do Swagger UI (versão fixada, com SRI) e a CSP própria dela: scripts só do CDN e o inline com
+ * `nonce`, `connect-src 'self'` para buscar o documento.
+ */
+export declare function docsPage(specUrl: string, title: string, nonce: string): {
+    html: string;
+    csp: string;
+};
+export {};
+//# sourceMappingURL=generate.d.ts.map

package/dist/openapi/generate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/openapi/generate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAG9C,wCAAwC;AACxC,MAAM,WAAW,cAAc;IAC7B,oDAAoD;IACpD,IAAI,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACxF,OAAO,CAAC,EAAE,SAAS;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC3D,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACxB,oFAAoF;IACpF,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IACpC,2FAA2F;IAC3F,MAAM,CAAC,EAAE,SAAS,KAAK,EAAE,CAAC;CAC3B;AAED,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAKpC,sHAAsH;AACtH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOlD;AAiED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO,GAAG,IAAI,CAoBpH;AASD;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CA2BrG"}

package/dist/openapi/generate.js

@@ -0,0 +1,136 @@
+import { STATUS_CODES } from 'node:http';
+import { isResponseContent } from '../core/metadata.js';
+/** Cópia em JSON puro: tira as chaves `Symbol` do TypeBox e qualquer coisa não serializável. */
+const plain = (schema) => JSON.parse(JSON.stringify(schema));
+/** `/:org/users/:id(^\\d+)` → `/{org}/users/{id}`; `::` → `:`; `*` → `{*}`; sem barra final (o roteador a ignora). */
+export function toOpenAPIPath(path) {
+    return path
+        .replace(/::/g, '\u0000')
+        .replace(/:([^/\-.(]+)(\((?:\\.|[^\\])*?\))?/g, '{$1}')
+        .replace(/\*$/, '{*}')
+        .replace(/\u0000/g, ':')
+        .replace(/(.)\/$/, '$1');
+}
+/** Problem Details (RFC 9457), o corpo padrão de todos os erros (F-15). */
+const PROBLEM_SCHEMA = {
+    type: 'object',
+    required: ['type', 'title', 'status'],
+    properties: {
+        type: { type: 'string' },
+        title: { type: 'string' },
+        status: { type: 'integer' },
+        detail: { type: 'string' },
+        code: { type: 'string' },
+        details: {},
+    },
+};
+function parameters(where, schema) {
+    const json = schema ? plain(schema) : undefined;
+    const props = json?.properties;
+    if (!props)
+        return [];
+    const required = new Set(json.required ?? []);
+    return Object.entries(props).map(([name, s]) => ({
+        name,
+        in: where,
+        required: where === 'path' || required.has(name),
+        schema: s,
+    }));
+}
+function responseContent(entry) {
+    if (isResponseContent(entry)) {
+        const types = typeof entry.contentType === 'string' ? [entry.contentType] : entry.contentType;
+        return Object.fromEntries(types.map((t) => [t, entry.schema ? { schema: plain(entry.schema) } : {}]));
+    }
+    return { 'application/json': { schema: plain(entry) } };
+}
+function operation(route, problemErrors) {
+    const { schemas } = route;
+    const params = [
+        ...parameters('path', schemas.params),
+        ...parameters('query', schemas.query),
+        ...parameters('header', schemas.headers),
+    ];
+    const responses = {};
+    for (const [status, entry] of Object.entries(schemas.response ?? {})) {
+        const content = Number(status) === 204 ? undefined : responseContent(entry);
+        responses[status] = { description: STATUS_CODES[Number(status)] ?? 'Response', ...(content ? { content } : {}) };
+    }
+    if (Object.keys(responses).length === 0)
+        responses['200'] = { description: 'OK' };
+    responses.default = problemErrors
+        ? { description: 'Error', content: { 'application/problem+json': { schema: { $ref: '#/components/schemas/ProblemDetails' } } } }
+        : { description: 'Error' };
+    return {
+        operationId: `${route.owner}.${route.handlerName}`,
+        tags: [route.owner],
+        ...(params.length ? { parameters: params } : {}),
+        ...(schemas.body
+            ? { requestBody: { required: true, content: { 'application/json': { schema: plain(schemas.body) } } } }
+            : {}),
+        responses,
+    };
+}
+/**
+ * Gera o documento OpenAPI 3.1 a partir das rotas registradas (F-16). Os schemas TypeBox já são
+ * JSON Schema, então entram como estão. Schemas que não são JSON Schema (Zod etc.) não são convertidos.
+ */
+export function generateOpenAPI(routes, opts, problemErrors) {
+    const paths = {};
+    const ids = new Map();
+    for (const route of routes) {
+        const path = toOpenAPIPath(route.path);
+        const op = operation(route, problemErrors);
+        // A mesma classe montada em dois prefixos gera o mesmo id; o OpenAPI exige ids únicos.
+        const base = op.operationId;
+        const n = (ids.get(base) ?? 0) + 1;
+        ids.set(base, n);
+        if (n > 1)
+            op.operationId = `${base}_${n}`;
+        (paths[path] ??= {})[route.method.toLowerCase()] = op;
+    }
+    return {
+        openapi: '3.1.0',
+        info: opts.info ?? { title: 'API', version: '0.0.0' },
+        ...(opts.servers ? { servers: opts.servers } : {}),
+        paths,
+        ...(problemErrors ? { components: { schemas: { ProblemDetails: PROBLEM_SCHEMA } } } : {}),
+    };
+}
+const SWAGGER = 'https://cdn.jsdelivr.net/npm/swagger-ui-dist@5.34.1';
+const SWAGGER_JS_SRI = 'sha384-XFYN47VzPiDY6qPtxYKg0nqUeW/upo20xf1j2SUE7gT/i35FJB4cuS/71Iegzk8Z';
+const SWAGGER_CSS_SRI = 'sha384-4c3vsE5f+trhFyHrFrLM1fFGUn531NIaC7dcqEWIJdoRQJ5CkJbSuSCwXLpaS1KF';
+const escapeHtml = (s) => s.replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);
+/**
+ * Página do Swagger UI (versão fixada, com SRI) e a CSP própria dela: scripts só do CDN e o inline com
+ * `nonce`, `connect-src 'self'` para buscar o documento.
+ */
+export function docsPage(specUrl, title, nonce) {
+    const html = `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escapeHtml(title)}</title>
+<link rel="stylesheet" href="${SWAGGER}/swagger-ui.css" integrity="${SWAGGER_CSS_SRI}" crossorigin="anonymous">
+</head>
+<body>
+<div id="swagger-ui"></div>
+<script src="${SWAGGER}/swagger-ui-bundle.js" integrity="${SWAGGER_JS_SRI}" crossorigin="anonymous"></script>
+<script nonce="${nonce}">SwaggerUIBundle({ url: ${JSON.stringify(specUrl).replace(/</g, '\\u003c')}, dom_id: '#swagger-ui' });</script>
+</body>
+</html>
+`;
+    const csp = [
+        "default-src 'none'",
+        `script-src https://cdn.jsdelivr.net 'nonce-${nonce}'`,
+        "style-src https://cdn.jsdelivr.net 'unsafe-inline'",
+        "img-src 'self' data: https:",
+        "connect-src 'self'",
+        "frame-ancestors 'none'",
+        "base-uri 'none'",
+        "form-action 'none'",
+    ].join('; ');
+    return { html, csp };
+}
+//# sourceMappingURL=generate.js.map

package/dist/openapi/generate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate.js","sourceRoot":"","sources":["../../src/openapi/generate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAIzC,OAAO,EAAE,iBAAiB,EAAsB,MAAM,qBAAqB,CAAC;AAmB5E,gGAAgG;AAChG,MAAM,KAAK,GAAG,CAAC,MAAc,EAAQ,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAS,CAAC;AAEnF,sHAAsH;AACtH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI;SACR,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC;SACxB,OAAO,CAAC,qCAAqC,EAAE,MAAM,CAAC;SACtD,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;SACrB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,2EAA2E;AAC3E,MAAM,cAAc,GAAS;IAC3B,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;IACrC,UAAU,EAAE;QACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACzB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,OAAO,EAAE,EAAE;KACZ;CACF,CAAC;AAEF,SAAS,UAAU,CAAC,KAAkC,EAAE,MAA0B;IAChF,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,EAAE,UAA8C,CAAC;IACnE,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAE,IAAK,CAAC,QAAiC,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI;QACJ,EAAE,EAAE,KAAK;QACT,QAAQ,EAAE,KAAK,KAAK,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QAChD,MAAM,EAAE,CAAC;KACV,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,eAAe,CAAC,KAAoB;IAC3C,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;QAC9F,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxG,CAAC;IACD,OAAO,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,SAAS,CAAC,KAAoB,EAAE,aAAsB;IAC7D,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,MAAM,MAAM,GAAG;QACb,GAAG,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC;QACrC,GAAG,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC;QACrC,GAAG,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC;KACzC,CAAC;IACF,MAAM,SAAS,GAAS,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;QACrE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC5E,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACnH,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAClF,SAAS,CAAC,OAAO,GAAG,aAAa;QAC/B,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,0BAA0B,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,qCAAqC,EAAE,EAAE,EAAE,EAAE;QAChI,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;IAE7B,OAAO;QACL,WAAW,EAAE,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,WAAW,EAAE;QAClD,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QACnB,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,OAAO,CAAC,IAAI;YACd,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE;YACvG,CAAC,CAAC,EAAE,CAAC;QACP,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,MAAgC,EAAE,IAAoB,EAAE,aAAsB;IAC5G,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QAC3C,uFAAuF;QACvF,MAAM,IAAI,GAAG,EAAE,CAAC,WAAqB,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACnC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACjB,IAAI,CAAC,GAAG,CAAC;YAAE,EAAE,CAAC,WAAW,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;QAC3C,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,CAAC;IACxD,CAAC;IACD,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE;QACrD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,KAAK;QACL,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1F,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,GAAG,qDAAqD,CAAC;AACtE,MAAM,cAAc,GAAG,yEAAyE,CAAC;AACjG,MAAM,eAAe,GAAG,yEAAyE,CAAC;AAElG,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,EAAE,CAC/B,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;AAE9G;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAe,EAAE,KAAa,EAAE,KAAa;IACpE,MAAM,IAAI,GAAG;;;;;SAKN,UAAU,CAAC,KAAK,CAAC;+BACK,OAAO,+BAA+B,eAAe;;;;eAIrE,OAAO,qCAAqC,cAAc;iBACxD,KAAK,4BAA4B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;;;CAGjG,CAAC;IACA,MAAM,GAAG,GAAG;QACV,oBAAoB;QACpB,8CAA8C,KAAK,GAAG;QACtD,oDAAoD;QACpD,6BAA6B;QAC7B,oBAAoB;QACpB,wBAAwB;QACxB,iBAAiB;QACjB,oBAAoB;KACrB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACvB,CAAC"}

package/dist/utils/cookie.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Leitura e escrita de cookies (RFC 6265), seguras por padrão.
+ *
+ * - **Leitura:** o resultado é um objeto sem protótipo (`__proto__` vira um cookie comum, sem poluir
+ *   nada); em nomes repetidos vale o primeiro, como nos navegadores; um valor com `%` inválido fica cru.
+ * - **Escrita:** `HttpOnly`, `Secure`, `SameSite=Lax` e `Path=/` por padrão. Nome, `Domain` e `Path`
+ *   são validados (sem `;`, quebra de linha nem caracteres de controle), então não dá para injetar
+ *   atributos. O valor é codificado com `encodeURIComponent`.
+ * - **Prefixos:** `__Host-` exige `Secure`, `Path=/` e nenhum `Domain`; `__Secure-` exige `Secure`.
+ *   `SameSite=None` exige `Secure`. Violações lançam erro na hora de definir o cookie.
+ */
+export interface CookieOptions {
+    /** Padrão: `true`. Impede a leitura por JavaScript no navegador. */
+    httpOnly?: boolean;
+    /** Padrão: `true`. Os navegadores aceitam cookies `Secure` em `http://localhost`. */
+    secure?: boolean;
+    /** Padrão: `'Lax'`. `'None'` exige `secure`. */
+    sameSite?: 'Strict' | 'Lax' | 'None' | false;
+    /** Padrão: `'/'`. */
+    path?: string;
+    /** Sem `domain`, o cookie vale só para o host atual (o mais restrito). */
+    domain?: string;
+    /** Duração em segundos. `0` remove o cookie. */
+    maxAge?: number;
+    expires?: Date;
+    /** Cookie particionado (CHIPS), para uso em iframes de terceiros. Exige `secure`. */
+    partitioned?: boolean;
+    priority?: 'Low' | 'Medium' | 'High';
+}
+/** Lê o header `Cookie` num objeto sem protótipo. */
+export declare function parseCookies(header: string | undefined): Record<string, string>;
+/** Monta o valor de um header `Set-Cookie`, aplicando os padrões seguros. */
+export declare function serializeCookie(name: string, value: string, opts?: CookieOptions): string;
+//# sourceMappingURL=cookie.d.ts.map

package/dist/utils/cookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie.d.ts","sourceRoot":"","sources":["../../src/utils/cookie.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,WAAW,aAAa;IAC5B,oEAAoE;IACpE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,qFAAqF;IACrF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gDAAgD;IAChD,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;IAC7C,qBAAqB;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,IAAI,CAAC;IACf,qFAAqF;IACrF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;CACtC;AAOD,qDAAqD;AACrD,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAa/E;AAWD,6EAA6E;AAC7E,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,GAAE,aAAkB,GAAG,MAAM,CAoC7F"}

package/dist/utils/cookie.js

@@ -0,0 +1,93 @@
+/**
+ * Leitura e escrita de cookies (RFC 6265), seguras por padrão.
+ *
+ * - **Leitura:** o resultado é um objeto sem protótipo (`__proto__` vira um cookie comum, sem poluir
+ *   nada); em nomes repetidos vale o primeiro, como nos navegadores; um valor com `%` inválido fica cru.
+ * - **Escrita:** `HttpOnly`, `Secure`, `SameSite=Lax` e `Path=/` por padrão. Nome, `Domain` e `Path`
+ *   são validados (sem `;`, quebra de linha nem caracteres de controle), então não dá para injetar
+ *   atributos. O valor é codificado com `encodeURIComponent`.
+ * - **Prefixos:** `__Host-` exige `Secure`, `Path=/` e nenhum `Domain`; `__Secure-` exige `Secure`.
+ *   `SameSite=None` exige `Secure`. Violações lançam erro na hora de definir o cookie.
+ */
+/** `token` da RFC 7230: o que um nome de cookie pode conter. */
+const TOKEN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+/** Domain e Path: nada de `;`, controle (inclui CR/LF) nem DEL. */
+const ATTR_VALUE = /^[^\x00-\x1f\x7f;]*$/;
+/** Lê o header `Cookie` num objeto sem protótipo. */
+export function parseCookies(header) {
+    const out = Object.create(null);
+    if (!header)
+        return out;
+    for (const part of header.split(';')) {
+        const eq = part.indexOf('=');
+        if (eq === -1)
+            continue;
+        const name = part.slice(0, eq).trim();
+        if (!name || name in out)
+            continue;
+        let value = part.slice(eq + 1).trim();
+        if (value.length >= 2 && value.startsWith('"') && value.endsWith('"'))
+            value = value.slice(1, -1);
+        out[name] = safeDecode(value);
+    }
+    return out;
+}
+function safeDecode(value) {
+    if (!value.includes('%'))
+        return value;
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}
+/** Monta o valor de um header `Set-Cookie`, aplicando os padrões seguros. */
+export function serializeCookie(name, value, opts = {}) {
+    if (!TOKEN.test(name))
+        throw new Error(`[sashiko] invalid cookie name "${name}".`);
+    const httpOnly = opts.httpOnly ?? true;
+    const secure = opts.secure ?? true;
+    const sameSite = opts.sameSite ?? 'Lax';
+    const path = opts.path ?? '/';
+    if (!ATTR_VALUE.test(path))
+        throw new Error(`[sashiko] invalid cookie path "${path}".`);
+    if (opts.domain !== undefined && (!opts.domain || !ATTR_VALUE.test(opts.domain))) {
+        throw new Error(`[sashiko] invalid cookie domain "${opts.domain}".`);
+    }
+    if (sameSite === 'None' && !secure)
+        throw new Error(`[sashiko] cookie "${name}": SameSite=None requires secure.`);
+    if (opts.partitioned && !secure)
+        throw new Error(`[sashiko] cookie "${name}": partitioned requires secure.`);
+    if (name.startsWith('__Secure-') && !secure)
+        throw new Error(`[sashiko] cookie "${name}": the __Secure- prefix requires secure.`);
+    if (name.startsWith('__Host-') && (!secure || path !== '/' || opts.domain !== undefined)) {
+        throw new Error(`[sashiko] cookie "${name}": the __Host- prefix requires secure, path "/" and no domain.`);
+    }
+    let out = `${name}=${encodeURIComponent(value)}`;
+    if (opts.maxAge !== undefined) {
+        if (!Number.isFinite(opts.maxAge))
+            throw new Error(`[sashiko] cookie "${name}": invalid maxAge.`);
+        out += `; Max-Age=${Math.floor(opts.maxAge)}`;
+    }
+    if (opts.expires) {
+        if (Number.isNaN(opts.expires.getTime()))
+            throw new Error(`[sashiko] cookie "${name}": invalid expires.`);
+        out += `; Expires=${opts.expires.toUTCString()}`;
+    }
+    if (opts.domain !== undefined)
+        out += `; Domain=${opts.domain}`;
+    out += `; Path=${path}`;
+    if (httpOnly)
+        out += '; HttpOnly';
+    if (secure)
+        out += '; Secure';
+    if (sameSite)
+        out += `; SameSite=${sameSite}`;
+    if (opts.partitioned)
+        out += '; Partitioned';
+    if (opts.priority)
+        out += `; Priority=${opts.priority}`;
+    return out;
+}
+//# sourceMappingURL=cookie.js.map

package/dist/utils/cookie.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie.js","sourceRoot":"","sources":["../../src/utils/cookie.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAqBH,gEAAgE;AAChE,MAAM,KAAK,GAAG,gCAAgC,CAAC;AAC/C,mEAAmE;AACnE,MAAM,UAAU,GAAG,sBAAsB,CAAC;AAE1C,qDAAqD;AACrD,MAAM,UAAU,YAAY,CAAC,MAA0B;IACrD,MAAM,GAAG,GAA2B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IACxB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,GAAG;YAAE,SAAS;QACnC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAClG,GAAG,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa,EAAE,IAAI,GAAkB,EAAE;IACnF,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,IAAI,CAAC,CAAC;IAEnF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC;IAE9B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,IAAI,CAAC,CAAC;IACxF,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,mCAAmC,CAAC,CAAC;IAClH,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,iCAAiC,CAAC,CAAC;IAC7G,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,0CAA0C,CAAC,CAAC;IAClI,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,gEAAgE,CAAC,CAAC;IAC7G,CAAC;IAED,IAAI,GAAG,GAAG,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;IACjD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,oBAAoB,CAAC,CAAC;QAClG,GAAG,IAAI,aAAa,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,qBAAqB,CAAC,CAAC;QAC1G,GAAG,IAAI,aAAa,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,GAAG,IAAI,YAAY,IAAI,CAAC,MAAM,EAAE,CAAC;IAChE,GAAG,IAAI,UAAU,IAAI,EAAE,CAAC;IACxB,IAAI,QAAQ;QAAE,GAAG,IAAI,YAAY,CAAC;IAClC,IAAI,MAAM;QAAE,GAAG,IAAI,UAAU,CAAC;IAC9B,IAAI,QAAQ;QAAE,GAAG,IAAI,cAAc,QAAQ,EAAE,CAAC;IAC9C,IAAI,IAAI,CAAC,WAAW;QAAE,GAAG,IAAI,eAAe,CAAC;IAC7C,IAAI,IAAI,CAAC,QAAQ;QAAE,GAAG,IAAI,cAAc,IAAI,CAAC,QAAQ,EAAE,CAAC;IACxD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/utils/index.d.ts

@@ -3,4 +3,5 @@ export { joinPaths } from './path.ts';
 export { DEFAULT_MAX_QUERY_KEYS, parseQuery, type ParsedQuery } from './query.ts';
 export { hostnameOf, isValidHost, parseRequestTarget, pickForwarded } from './request-target.ts';
 export { compileHostMatcher, compileOriginMatcher, normalizeOrigin, toFullMatch, type MatchRule } from './origin-match.ts';
+export { parseCookies, serializeCookie, type CookieOptions } from './cookie.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACzF,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAClF,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjG,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,eAAe,EAAE,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACzF,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAClF,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjG,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,eAAe,EAAE,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC3H,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC"}

package/dist/utils/index.js

@@ -3,4 +3,5 @@ export { joinPaths } from './path.js';
 export { DEFAULT_MAX_QUERY_KEYS, parseQuery } from './query.js';
 export { hostnameOf, isValidHost, parseRequestTarget, pickForwarded } from './request-target.js';
 export { compileHostMatcher, compileOriginMatcher, normalizeOrigin, toFullMatch } from './origin-match.js';
+export { parseCookies, serializeCookie } from './cookie.js';
 //# sourceMappingURL=index.js.map

package/dist/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACzF,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAoB,MAAM,YAAY,CAAC;AAClF,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjG,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,eAAe,EAAE,WAAW,EAAkB,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACzF,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAoB,MAAM,YAAY,CAAC;AAClF,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjG,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,eAAe,EAAE,WAAW,EAAkB,MAAM,mBAAmB,CAAC;AAC3H,OAAO,EAAE,YAAY,EAAE,eAAe,EAAsB,MAAM,aAAa,CAAC"}

package/dist/utils/path.d.ts

@@ -1,3 +1,8 @@
 /** Junta prefixo e caminho com exatamente uma barra entre eles: `('/users/', 'id')` → `/users/id`. */
 export declare function joinPaths(prefix: string, path: string): string;
+/**
+ * Parâmetros de um path na sintaxe do find-my-way (`/:org/users/:id(^\\d+)`, `/files/*`), em ordem (F-29).
+ * Lança erro para parâmetro sem nome (`/:`), nome repetido, regex sem fechamento e `*` fora do fim.
+ */
+export declare function pathParams(path: string): string[];
 //# sourceMappingURL=path.d.ts.map

package/dist/utils/path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../../src/utils/path.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAI9D"}
+{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../../src/utils/path.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAI9D;AAID;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CA6BjD"}

package/dist/utils/path.js

@@ -4,4 +4,53 @@ export function joinPaths(prefix, path) {
     const s = path.startsWith('/') ? path : `/${path}`;
     return `${p}${s}` || '/';
 }
+const NAME_END = new Set(['/', '-', '.', '(']);
+/**
+ * Parâmetros de um path na sintaxe do find-my-way (`/:org/users/:id(^\\d+)`, `/files/*`), em ordem (F-29).
+ * Lança erro para parâmetro sem nome (`/:`), nome repetido, regex sem fechamento e `*` fora do fim.
+ */
+export function pathParams(path) {
+    const names = [];
+    for (let i = 0; i < path.length; i++) {
+        const ch = path[i];
+        if (ch === '*') {
+            if (i !== path.length - 1)
+                throw new Error(`invalid path "${path}": "*" is only allowed at the end`);
+            names.push('*');
+            continue;
+        }
+        if (ch !== ':')
+            continue;
+        if (path[i + 1] === ':') {
+            i++;
+            continue;
+        } // `::` é um ':' literal
+        let j = i + 1;
+        while (j < path.length && !NAME_END.has(path[j]))
+            j++;
+        const name = path.slice(i + 1, j);
+        if (!name)
+            throw new Error(`invalid path "${path}": parameter without a name`);
+        if (names.includes(name))
+            throw new Error(`invalid path "${path}": parameter "${name}" is repeated`);
+        names.push(name);
+        if (path[j] === '(') {
+            let depth = 0;
+            for (; j < path.length; j++) {
+                if (path[j] === '\\') {
+                    j++;
+                    continue;
+                }
+                if (path[j] === '(')
+                    depth++;
+                else if (path[j] === ')' && --depth === 0)
+                    break;
+            }
+            if (depth !== 0)
+                throw new Error(`invalid path "${path}": unterminated regex for "${name}"`);
+        }
+        i = j - (path[j] === ')' ? 0 : 1);
+    }
+    return names;
+}
 //# sourceMappingURL=path.js.map

package/dist/utils/path.js.map

@@ -1 +1 @@
-{"version":3,"file":"path.js","sourceRoot":"","sources":["../../src/utils/path.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,IAAY;IACpD,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IACnD,OAAO,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"path.js","sourceRoot":"","sources":["../../src/utils/path.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,IAAY;IACpD,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IACnD,OAAO,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC;AAC3B,CAAC;AAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAE/C;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,mCAAmC,CAAC,CAAC;YACrG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG;YAAE,SAAS;QACzB,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAAC,CAAC,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC,CAAC,wBAAwB;QACpE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;YAAE,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,6BAA6B,CAAC,CAAC;QAC/E,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,iBAAiB,IAAI,eAAe,CAAC,CAAC;QACrG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACpB,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5B,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBAAC,CAAC,EAAE,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBACxC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;oBAAE,KAAK,EAAE,CAAC;qBACxB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,KAAK,CAAC;oBAAE,MAAM;YACnD,CAAC;YACD,IAAI,KAAK,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,8BAA8B,IAAI,GAAG,CAAC,CAAC;QAC/F,CAAC;QACD,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sashiko",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Micro-framework HTTP para Node.js com decorators TC39 nativos, schema-first (TypeBox + Ajv) e defaults seguros.",
   "keywords": [
     "http",