@bgord/bun 1.10.23 → 1.12.0

package/src/{setup.service.ts → setup-hono.service.ts}

@@ -1,60 +1,56 @@
 import * as tools from "@bgord/tools";
-import { bodyLimit } from "hono/body-limit";
 import { cors } from "hono/cors";
 import { languageDetector } from "hono/language";
-import { requestId } from "hono/request-id";
 import { secureHeaders } from "hono/secure-headers";
-import { timing } from "hono/timing";
-import { trimTrailingSlash } from "hono/trailing-slash";
-import { ApiVersion } from "./api-version.middleware";
+import { ApiVersionHonoMiddleware } from "./api-version-hono.middleware";
 import type { BuildInfoRepositoryStrategy } from "./build-info-repository.strategy";
 import type { CacheResolverStrategy } from "./cache-resolver.strategy";
 import type { ClockPort } from "./clock.port";
-import { Context } from "./context.middleware";
-import { CorrelationStorage } from "./correlation-storage.service";
-import { ETagExtractor } from "./etag-extractor.middleware";
+import { CorrelationHonoMiddleware } from "./correlation-hono.middleware";
+import { ETagExtractorHonoMiddleware } from "./etag-extractor-hono.middleware";
 import type { HashContentStrategy } from "./hash-content.strategy";
-import { HttpLogger, type HttpLoggerOptions } from "./http-logger.middleware";
-import type { I18nConfigType } from "./i18n.service";
+import type { HttpLoggerConfig } from "./http-logger.middleware";
+import { HttpLoggerHonoMiddleware } from "./http-logger-hono.middleware";
+import type { I18nConfig } from "./i18n.service";
 import type { IdProviderPort } from "./id-provider.port";
 import type { LoggerPort } from "./logger.port";
-import { MaintenanceMode, type MaintenanceModeConfigType } from "./maintenance-mode.middleware";
-import { type ShieldCsrfConfigType, ShieldCsrfStrategy } from "./shield-csrf.strategy";
-import { TimeZoneOffset } from "./time-zone-offset.middleware";
-import { WeakETagExtractor } from "./weak-etag-extractor.middleware";
-
-type SetupConfigType = {
-  csrf: ShieldCsrfConfigType;
-  cors?: Parameters<typeof cors>[0];
-  httpLogger?: HttpLoggerOptions;
-  maintenanceMode?: MaintenanceModeConfigType;
-  BODY_LIMIT_MAX_SIZE?: tools.Size;
-};
+import type { ShieldCsrfConfig } from "./shield-csrf.strategy";
+import { ShieldCsrfHonoStrategy } from "./shield-csrf-hono.strategy";
+import type { ShieldMaintenanceConfig } from "./shield-maintenance.strategy";
+import { ShieldMaintenanceHonoStrategy } from "./shield-maintenance-hono.strategy";
+import { TimeZoneOffsetHonoMiddleware } from "./time-zone-offset-hono.middleware";
+import { TimingHonoMiddleware } from "./timing-hono.middleware";
+import { TrailingSlashHonoMiddleware } from "./trailing-slash-hono.middleware";
+import { WeakETagExtractorHonoMiddleware } from "./weak-etag-extractor-hono.middleware";
 
 type Dependencies = {
   Logger: LoggerPort;
   IdProvider: IdProviderPort;
-  I18n: I18nConfigType;
+  I18n: I18nConfig;
   Clock: ClockPort;
   CacheResolver: CacheResolverStrategy;
   HashContent: HashContentStrategy;
   BuildInfoRepository: BuildInfoRepositoryStrategy;
 };
 
-export class Setup {
-  static essentials(config: SetupConfigType, deps: Dependencies) {
-    const BODY_LIMIT_MAX_SIZE = config.BODY_LIMIT_MAX_SIZE ?? tools.Size.fromKb(128);
+type Config = {
+  csrf: ShieldCsrfConfig;
+  cors?: Parameters<typeof cors>[0];
+  httpLogger?: HttpLoggerConfig;
+  maintenanceMode?: ShieldMaintenanceConfig;
+};
 
+export class SetupHono {
+  // Configure body size limit at the framework level
+  // - Bun: maxRequestBodySize in Bun.serve()
+  // - Express: limit in express.json()
+  static essentials(config: Config, deps: Dependencies) {
     return [
-      MaintenanceMode.build(config.maintenanceMode),
-      trimTrailingSlash({ alwaysRedirect: true }),
-      requestId({
-        limitLength: 36,
-        headerName: "x-correlation-id",
-        generator: () => deps.IdProvider.generate(),
-      }),
-      ApiVersion.build(deps),
-      new ShieldCsrfStrategy(config.csrf).verify,
+      new ShieldMaintenanceHonoStrategy(config.maintenanceMode).handle(),
+      new TrailingSlashHonoMiddleware().handle(),
+      new CorrelationHonoMiddleware(deps).handle(),
+      new ApiVersionHonoMiddleware(deps).handle(),
+      new ShieldCsrfHonoStrategy(config.csrf).handle(),
       secureHeaders({
         referrerPolicy: "no-referrer",
         xContentTypeOptions: "nosniff",
@@ -67,7 +63,6 @@ export class Setup {
         originAgentCluster: false,
         xFrameOptions: false,
       }),
-      bodyLimit({ maxSize: BODY_LIMIT_MAX_SIZE.toBytes() }),
       cors({
         // Stryker disable all
         origin: (origin, c) => {
@@ -92,13 +87,11 @@ export class Setup {
         caches: false,
         // Stryker restore all
       }),
-      TimeZoneOffset.attach,
-      Context.attach,
-      WeakETagExtractor.attach,
-      ETagExtractor.attach,
-      HttpLogger.build(deps, config.httpLogger),
-      timing(),
-      CorrelationStorage.handle(),
+      new TimeZoneOffsetHonoMiddleware().handle(),
+      new WeakETagExtractorHonoMiddleware().handle(),
+      new ETagExtractorHonoMiddleware().handle(),
+      new HttpLoggerHonoMiddleware(deps, config.httpLogger).handle(),
+      new TimingHonoMiddleware(deps).handle(),
     ];
   }
 }

package/src/shield-api-key-hono.strategy.ts

@@ -0,0 +1,28 @@
+import type { MiddlewareHandler } from "hono";
+import { HTTPException } from "hono/http-exception";
+import type { MiddlewareHonoPort } from "./middleware-hono.port";
+import { RequestContextHonoAdapter } from "./request-context-hono.adapter";
+import {
+  type ApiKeyShieldConfig,
+  ShieldApiKeyStrategy,
+  ShieldApiKeyStrategyError,
+} from "./shield-api-key.strategy";
+
+export const ShieldApiKeyError = new HTTPException(403, { message: ShieldApiKeyStrategyError.Rejected });
+
+export class ShieldApiKeyHonoStrategy implements MiddlewareHonoPort {
+  private readonly strategy: ShieldApiKeyStrategy;
+
+  constructor(config: ApiKeyShieldConfig) {
+    this.strategy = new ShieldApiKeyStrategy(config);
+  }
+
+  handle(): MiddlewareHandler {
+    return async (c, next) => {
+      const context = new RequestContextHonoAdapter(c);
+
+      if (this.strategy.evaluate(context)) return next();
+      throw ShieldApiKeyError;
+    };
+  }
+}

package/src/shield-api-key.strategy.ts

@@ -1,22 +1,16 @@
 import type * as tools from "@bgord/tools";
-import { createMiddleware } from "hono/factory";
-import { HTTPException } from "hono/http-exception";
-import { RequestContextAdapterHono } from "./request-context-hono.adapter";
-import type { ShieldStrategy } from "./shield.strategy";
+import type { HasRequestHeader } from "./request-context.port";
 
-type ApiKeyShieldConfigType = { API_KEY: tools.ApiKeyType };
+export type ApiKeyShieldConfig = { API_KEY: tools.ApiKeyType };
 
-export const ShieldApiKeyError = new HTTPException(403, { message: "shield.api.key" });
+export const ShieldApiKeyStrategyError = { Rejected: "shield.api.key.rejected" };
 
-export class ShieldApiKeyStrategy implements ShieldStrategy {
-  static readonly HEADER_NAME = "bgord-api-key";
+export class ShieldApiKeyStrategy {
+  static readonly HEADER_NAME = "api-key";
 
-  constructor(private readonly config: ApiKeyShieldConfigType) {}
+  constructor(private readonly config: ApiKeyShieldConfig) {}
 
-  verify = createMiddleware(async (c, next) => {
-    const context = new RequestContextAdapterHono(c);
-
-    if (context.request.header(ShieldApiKeyStrategy.HEADER_NAME) === this.config.API_KEY) return next();
-    throw ShieldApiKeyError;
-  });
+  evaluate(context: HasRequestHeader): boolean {
+    return context.request.header(ShieldApiKeyStrategy.HEADER_NAME) === this.config.API_KEY;
+  }
 }

package/src/shield-auth-hono.strategy.ts

@@ -0,0 +1,41 @@
+import type hono from "hono";
+import { createMiddleware } from "hono/factory";
+import { HTTPException } from "hono/http-exception";
+import type { AuthSessionReaderPort } from "./auth-session-reader.port";
+import { RequestContextHonoAdapter } from "./request-context-hono.adapter";
+import { ShieldAuthStrategy, ShieldAuthStrategyError } from "./shield-auth.strategy";
+
+type Dependencies<User, Session> = { AuthSessionReader: AuthSessionReaderPort<User, Session> };
+
+export const ShieldAuthError = new HTTPException(403, { message: ShieldAuthStrategyError.Rejected });
+
+export class ShieldAuthHonoStrategy<User, Session> {
+  private readonly strategy: ShieldAuthStrategy<User, Session>;
+
+  constructor(deps: Dependencies<User, Session>) {
+    this.strategy = new ShieldAuthStrategy(deps);
+  }
+
+  attach = createMiddleware(async (c: hono.Context, next: hono.Next) => {
+    const context = new RequestContextHonoAdapter(c);
+    const auth = await this.strategy.attach(context);
+
+    c.set("user", auth.user);
+    c.set("session", auth.session);
+    return next();
+  });
+
+  verify = createMiddleware(async (c: hono.Context, next: hono.Next) => {
+    const user = c.get("user");
+
+    if (this.strategy.verify(user)) return next();
+    throw ShieldAuthError;
+  });
+
+  reverse = createMiddleware(async (c: hono.Context, next: hono.Next) => {
+    const user = c.get("user");
+
+    if (this.strategy.reverse(user)) return next();
+    throw ShieldAuthError;
+  });
+}

package/src/shield-auth.strategy.ts

@@ -1,36 +1,22 @@
-import type hono from "hono";
-import { createMiddleware } from "hono/factory";
-import { HTTPException } from "hono/http-exception";
-import type { AuthSessionReaderPort } from "./auth-session-reader.port";
-import { RequestContextAdapterHono } from "./request-context-hono.adapter";
+import type { AuthSessionReaderPort, AuthSessionType } from "./auth-session-reader.port";
+import type { HasRequestHeaders } from "./request-context.port";
 
 type Dependencies<User, Session> = { AuthSessionReader: AuthSessionReaderPort<User, Session> };
 
-export const ShieldAuthError = new HTTPException(403, { message: "shield.auth" });
+export const ShieldAuthStrategyError = { Rejected: "shield.auth.rejected" };
 
 export class ShieldAuthStrategy<User, Session> {
   constructor(private readonly deps: Dependencies<User, Session>) {}
 
-  attach = createMiddleware(async (c: hono.Context, next: hono.Next) => {
-    const context = new RequestContextAdapterHono(c);
-    const auth = await this.deps.AuthSessionReader.getSession(context);
+  async attach(context: HasRequestHeaders): Promise<AuthSessionType<User, Session>> {
+    return await this.deps.AuthSessionReader.getSession(context);
+  }
 
-    c.set("user", auth.user);
-    c.set("session", auth.session);
-    return next();
-  });
+  verify(user: User | null): boolean {
+    return user !== null;
+  }
 
-  verify = createMiddleware(async (c: hono.Context, next: hono.Next) => {
-    const user = c.get("user");
-
-    if (!user) throw ShieldAuthError;
-    return next();
-  });
-
-  reverse = createMiddleware(async (c: hono.Context, next: hono.Next) => {
-    const user = c.get("user");
-
-    if (user) throw ShieldAuthError;
-    return next();
-  });
+  reverse(user: User | null): boolean {
+    return user === null;
+  }
 }

package/src/shield-basic-auth-hono.strategy.ts

@@ -0,0 +1,30 @@
+import type { MiddlewareHandler } from "hono";
+import { HTTPException } from "hono/http-exception";
+import type { MiddlewareHonoPort } from "./middleware-hono.port";
+import { RequestContextHonoAdapter } from "./request-context-hono.adapter";
+import {
+  type ShieldBasicAuthConfig,
+  ShieldBasicAuthStrategy,
+  ShieldBasicAuthStrategyError,
+} from "./shield-basic-auth.strategy";
+
+export const ShieldBasicAuthError = new HTTPException(401, {
+  message: ShieldBasicAuthStrategyError.Rejected,
+});
+
+export class ShieldBasicAuthHonoStrategy implements MiddlewareHonoPort {
+  private readonly strategy: ShieldBasicAuthStrategy;
+
+  constructor(config: ShieldBasicAuthConfig) {
+    this.strategy = new ShieldBasicAuthStrategy(config);
+  }
+
+  handle(): MiddlewareHandler {
+    return async (c, next) => {
+      const context = new RequestContextHonoAdapter(c);
+
+      if (this.strategy.evaluate(context)) return next();
+      throw ShieldBasicAuthError;
+    };
+  }
+}

package/src/shield-basic-auth.strategy.ts

@@ -1,17 +1,28 @@
-import { basicAuth } from "hono/basic-auth";
-import { createMiddleware } from "hono/factory";
 import type { BasicAuthPasswordType } from "./basic-auth-password.vo";
 import type { BasicAuthUsernameType } from "./basic-auth-username.vo";
-import type { ShieldStrategy } from "./shield.strategy";
+import type { HasRequestHeader } from "./request-context.port";
 
-type ShieldBasicAuthConfigType = { username: BasicAuthUsernameType; password: BasicAuthPasswordType };
+export type ShieldBasicAuthConfig = { username: BasicAuthUsernameType; password: BasicAuthPasswordType };
 
-export class ShieldBasicAuthStrategy implements ShieldStrategy {
-  private readonly basicAuth;
+export const ShieldBasicAuthStrategyError = { Rejected: "shield.basic.auth.rejected" };
 
-  constructor(config: ShieldBasicAuthConfigType) {
-    this.basicAuth = basicAuth(config);
-  }
+export class ShieldBasicAuthStrategy {
+  constructor(private readonly config: ShieldBasicAuthConfig) {}
+
+  evaluate(context: HasRequestHeader): boolean {
+    const header = context.request.header("authorization");
+
+    try {
+      const credentials = atob(String(header).replace("Basic ", ""));
 
-  verify = createMiddleware(async (context, next) => this.basicAuth(context, next));
+      const [username, password] = credentials.split(":");
+
+      if (username !== this.config.username) return false;
+      if (password !== this.config.password) return false;
+
+      return true;
+    } catch {
+      return false;
+    }
+  }
 }

package/src/shield-body-limit-hono.strategy.ts

@@ -0,0 +1,30 @@
+import { createMiddleware } from "hono/factory";
+import { HTTPException } from "hono/http-exception";
+import type { MiddlewareHonoPort } from "./middleware-hono.port";
+import { RequestContextHonoAdapter } from "./request-context-hono.adapter";
+import {
+  type ShieldBodyLimitConfig,
+  ShieldBodyLimitError,
+  ShieldBodyLimitStrategy,
+} from "./shield-body-limit.strategy";
+
+export const ShieldBodyLimitTooBigError = new HTTPException(413, { message: ShieldBodyLimitError.TooBig });
+
+export class ShieldBodyLimitHonoStrategy implements MiddlewareHonoPort {
+  private readonly strategy: ShieldBodyLimitStrategy;
+
+  constructor(config: ShieldBodyLimitConfig) {
+    this.strategy = new ShieldBodyLimitStrategy(config);
+  }
+
+  handle() {
+    return createMiddleware(async (c, next) => {
+      const context = new RequestContextHonoAdapter(c);
+
+      const result = this.strategy.evaluate(context);
+
+      if (!result) throw ShieldBodyLimitTooBigError;
+      return next();
+    });
+  }
+}

package/src/shield-body-limit.strategy.ts

@@ -0,0 +1,23 @@
+import * as tools from "@bgord/tools";
+import type { HasRequestHeader } from "./request-context.port";
+
+export type ShieldBodyLimitConfig = { maxSize: tools.Size };
+
+export const ShieldBodyLimitError = { TooBig: "shield.body.limit.rejected" };
+
+export class ShieldBodyLimitStrategy {
+  constructor(private readonly config: ShieldBodyLimitConfig) {}
+
+  evaluate(context: HasRequestHeader): boolean {
+    const header = context.request.header("content-length");
+
+    const contentLength = tools.SizeBytes.safeParse(Number(header));
+
+    if (!contentLength.success) return true;
+
+    const size = tools.Size.fromBytes(contentLength.data);
+
+    if (size.isGreaterThan(this.config.maxSize)) return false;
+    return true;
+  }
+}

package/src/shield-csrf-hono.strategy.ts

@@ -0,0 +1,24 @@
+import type { MiddlewareHandler } from "hono";
+import { HTTPException } from "hono/http-exception";
+import type { MiddlewareHonoPort } from "./middleware-hono.port";
+import { RequestContextHonoAdapter } from "./request-context-hono.adapter";
+import { type ShieldCsrfConfig, ShieldCsrfStrategy, ShieldCsrfStrategyError } from "./shield-csrf.strategy";
+
+export const ShieldCsrfError = new HTTPException(403, { message: ShieldCsrfStrategyError.Rejected });
+
+export class ShieldCsrfHonoStrategy implements MiddlewareHonoPort {
+  private readonly strategy: ShieldCsrfStrategy;
+
+  constructor(config: ShieldCsrfConfig) {
+    this.strategy = new ShieldCsrfStrategy(config);
+  }
+
+  handle(): MiddlewareHandler {
+    return async (c, next) => {
+      const context = new RequestContextHonoAdapter(c);
+
+      if (this.strategy.evaluate(context)) return next();
+      throw ShieldCsrfError;
+    };
+  }
+}

package/src/shield-csrf.strategy.ts

@@ -1,26 +1,21 @@
-import { createMiddleware } from "hono/factory";
-import { HTTPException } from "hono/http-exception";
-import { RequestContextAdapterHono } from "./request-context-hono.adapter";
-import type { ShieldStrategy } from "./shield.strategy";
+import type { HasRequestHeader, HasRequestMethod } from "./request-context.port";
 
 const STATE_CHANGING_METHODS = ["POST", "PUT", "PATCH", "DELETE"];
 
-export type ShieldCsrfConfigType = { origin: ReadonlyArray<string> };
+export type ShieldCsrfConfig = { origin: ReadonlyArray<string> };
 
-export const ShieldCsrfError = new HTTPException(403, { message: "shield.csrf" });
+export const ShieldCsrfStrategyError = { Rejected: "shield.csrf.rejected" };
 
-export class ShieldCsrfStrategy implements ShieldStrategy {
-  constructor(private readonly config: ShieldCsrfConfigType) {}
+export class ShieldCsrfStrategy {
+  constructor(private readonly config: ShieldCsrfConfig) {}
 
-  verify = createMiddleware(async (c, next) => {
-    const context = new RequestContextAdapterHono(c);
-
-    if (!STATE_CHANGING_METHODS.includes(context.request.method)) return next();
+  evaluate(context: HasRequestMethod & HasRequestHeader): boolean {
+    if (!STATE_CHANGING_METHODS.includes(context.request.method)) return true;
 
     const origin = context.request.header("origin");
 
-    if (!origin) return next();
-    if (!this.config.origin.includes(origin)) throw ShieldCsrfError;
-    return next();
-  });
+    if (!origin) return true;
+    if (!this.config.origin.includes(origin)) return false;
+    return true;
+  }
 }

package/src/shield-hcaptcha-hono-local.strategy.ts

@@ -0,0 +1,26 @@
+import type { MiddlewareHandler } from "hono";
+import { HTTPException } from "hono/http-exception";
+import type { HCaptchaSecretKeyType } from "./hcaptcha-secret-key.vo";
+import type { MiddlewareHonoPort } from "./middleware-hono.port";
+import { ShieldHcaptchaStrategy } from "./shield-hcaptcha.strategy";
+
+export const ShieldHcaptchaLocalStrategyError = { Rejected: "shield.hcaptcha.local.rejected" };
+
+export const ShieldHcaptchaLocalError = new HTTPException(403, {
+  message: ShieldHcaptchaLocalStrategyError.Rejected,
+});
+
+export class ShieldHcaptchaLocalHonoStrategy implements MiddlewareHonoPort {
+  private readonly strategy: ShieldHcaptchaStrategy;
+
+  constructor(secretKey: HCaptchaSecretKeyType) {
+    this.strategy = new ShieldHcaptchaStrategy(secretKey);
+  }
+
+  handle(): MiddlewareHandler {
+    return async (_c, next) => {
+      if (await this.strategy.evaluate("10000000-aaaa-bbbb-cccc-000000000001")) return next();
+      throw ShieldHcaptchaLocalError;
+    };
+  }
+}

package/src/shield-hcaptcha-hono.strategy.ts

@@ -0,0 +1,25 @@
+import type { MiddlewareHandler } from "hono";
+import { HTTPException } from "hono/http-exception";
+import type { HCaptchaSecretKeyType } from "./hcaptcha-secret-key.vo";
+import type { MiddlewareHonoPort } from "./middleware-hono.port";
+import { ShieldHcaptchaStrategy, ShieldHcaptchaStrategyError } from "./shield-hcaptcha.strategy";
+
+export const ShieldHcaptchaError = new HTTPException(403, { message: ShieldHcaptchaStrategyError.Rejected });
+
+export class ShieldHcaptchaHonoStrategy implements MiddlewareHonoPort {
+  private readonly strategy: ShieldHcaptchaStrategy;
+
+  constructor(secretKey: HCaptchaSecretKeyType) {
+    this.strategy = new ShieldHcaptchaStrategy(secretKey);
+  }
+
+  handle(): MiddlewareHandler {
+    return async (c, next) => {
+      const form = await c.req.formData();
+      const token = form.get("h-captcha-response")?.toString();
+
+      if (await this.strategy.evaluate(token)) return next();
+      throw ShieldHcaptchaError;
+    };
+  }
+}

package/src/shield-hcaptcha.strategy.ts

@@ -1,26 +1,20 @@
-import { createMiddleware } from "hono/factory";
-import { HTTPException } from "hono/http-exception";
 import { HCaptchaService } from "./hcaptcha.service";
 import type { HCaptchaSecretKeyType } from "./hcaptcha-secret-key.vo";
-import type { ShieldStrategy } from "./shield.strategy";
 
-export const ShieldHcaptchaError = new HTTPException(403, { message: "shield.hcaptcha" });
+export const ShieldHcaptchaStrategyError = { Rejected: "shield.hcaptcha.rejected" };
 
-export class ShieldHcaptchaStrategy implements ShieldStrategy {
+export class ShieldHcaptchaStrategy {
   private readonly hcaptcha = new HCaptchaService();
 
   constructor(private readonly secretKey: HCaptchaSecretKeyType) {}
 
-  verify = createMiddleware(async (context, next) => {
+  async evaluate(token: string | undefined): Promise<boolean> {
     try {
-      const form = await context.req.formData();
-      const hcaptchaTokenFormData = form.get("h-captcha-response")?.toString();
-      const result = await this.hcaptcha.verify(this.secretKey, hcaptchaTokenFormData);
+      const result = await this.hcaptcha.verify(this.secretKey, token);
 
-      if (!result.success) throw ShieldHcaptchaError;
-      return next();
+      return result.success;
     } catch {
-      throw ShieldHcaptchaError;
+      return false;
     }
-  });
+  }
 }

package/src/shield-maintenance-hono.strategy.ts

@@ -0,0 +1,23 @@
+import type { MiddlewareHandler } from "hono";
+import type { MiddlewareHonoPort } from "./middleware-hono.port";
+import { type ShieldMaintenanceConfig, ShieldMaintenanceStrategy } from "./shield-maintenance.strategy";
+
+export class ShieldMaintenanceHonoStrategy implements MiddlewareHonoPort {
+  private readonly strategy: ShieldMaintenanceStrategy;
+
+  constructor(config?: ShieldMaintenanceConfig) {
+    this.strategy = new ShieldMaintenanceStrategy(config);
+  }
+
+  handle(): MiddlewareHandler {
+    return async (c, next) => {
+      const maintenance = this.strategy.evaluate();
+
+      if (!maintenance.enabled) return next();
+
+      return c.json({ reason: "maintenance" }, 503, {
+        "Retry-After": maintenance.RetryAfter.seconds.toString(),
+      });
+    };
+  }
+}

package/src/shield-maintenance.strategy.ts

@@ -0,0 +1,17 @@
+import * as tools from "@bgord/tools";
+
+export type ShieldMaintenanceConfig = { enabled: boolean; RetryAfter?: tools.Duration };
+
+export class ShieldMaintenanceStrategy {
+  private readonly enabled: boolean;
+  private readonly RetryAfter: tools.Duration;
+
+  constructor(config?: ShieldMaintenanceConfig) {
+    this.enabled = config?.enabled ?? false;
+    this.RetryAfter = config?.RetryAfter ?? tools.Duration.Hours(1);
+  }
+
+  evaluate(): { enabled: boolean; RetryAfter: tools.Duration } {
+    return { enabled: this.enabled, RetryAfter: this.RetryAfter };
+  }
+}

package/src/shield-rate-limit-hono.strategy.ts

@@ -0,0 +1,34 @@
+import type { MiddlewareHandler } from "hono";
+import { HTTPException } from "hono/http-exception";
+import type { CacheResolverStrategy } from "./cache-resolver.strategy";
+import type { ClockPort } from "./clock.port";
+import type { MiddlewareHonoPort } from "./middleware-hono.port";
+import { RequestContextHonoAdapter } from "./request-context-hono.adapter";
+import {
+  type ShieldRateLimitConfig,
+  ShieldRateLimitStrategy,
+  ShieldRateLimitStrategyError,
+} from "./shield-rate-limit.strategy";
+
+type Dependencies = { Clock: ClockPort; CacheResolver: CacheResolverStrategy };
+
+export const ShieldRateLimitError = new HTTPException(429, {
+  message: ShieldRateLimitStrategyError.Rejected,
+});
+
+export class ShieldRateLimitHonoStrategy implements MiddlewareHonoPort {
+  private readonly strategy: ShieldRateLimitStrategy;
+
+  constructor(config: ShieldRateLimitConfig, deps: Dependencies) {
+    this.strategy = new ShieldRateLimitStrategy(config, deps);
+  }
+
+  handle(): MiddlewareHandler {
+    return async (c, next) => {
+      const context = new RequestContextHonoAdapter(c);
+
+      if (await this.strategy.evaluate(context)) return next();
+      throw ShieldRateLimitError;
+    };
+  }
+}