@bgord/bun 1.20.4 → 1.21.0

package/src/readiness-hono.handler.ts

@@ -13,10 +13,9 @@ export class ReadinessHonoHandler implements HandlerHonoPort {
 
   handle() {
     return factory.createHandlers(async (c) => {
-      const readiness = await this.handler.check();
-      const code = readiness.ok ? 200 : 503;
+      const result = await this.handler.check();
 
-      return c.json(readiness, code);
+      return c.json(result.details, result.code, result.headers);
     });
   }
 }

package/src/readiness.handler.ts

@@ -6,9 +6,15 @@ import {
 
 export type ReadinessConfig = { prerequisites: ReadonlyArray<Prerequisite> };
 
+export enum ReadinessStatusCode {
+  Ready = 200,
+  NotReady = 503,
+}
+
 type ReadinessResult = {
-  ok: boolean;
+  code: ReadinessStatusCode;
   details: ReadonlyArray<{ label: PrerequisiteLabelType; outcome: PrerequisiteVerificationResult }>;
+  headers: Record<string, string>;
 };
 
 export class ReadinessHandler {
@@ -26,8 +32,13 @@ export class ReadinessHandler {
       })),
     );
 
+    // Undetermined keeps traffic flowing here, unlike healthcheck where it degrades to 207
     const ok = details.every((detail) => detail.outcome.outcome !== PrerequisiteVerificationOutcome.failure);
 
-    return { ok, details };
+    return {
+      code: ok ? ReadinessStatusCode.Ready : ReadinessStatusCode.NotReady,
+      details,
+      headers: { "Cache-Control": "no-store" },
+    };
   }
 }

package/src/redactor-metadata-compact-array.strategy.ts

@@ -14,6 +14,7 @@ export class RedactorMetadataCompactArray implements RedactorStrategy {
 
   redact<T>(input: T): T {
     if (!tools.isPlainObject(input)) return input;
+    if (!("metadata" in input)) return input;
 
     return {
       ...input,

package/src/redactor-metadata-compact-object.strategy.ts

@@ -14,6 +14,7 @@ export class RedactorMetadataCompactObject implements RedactorStrategy {
 
   redact<T>(input: T): T {
     if (!tools.isPlainObject(input)) return input;
+    if (!("metadata" in input)) return input;
 
     return {
       ...input,

package/src/redactor-url-query.strategy.ts

@@ -0,0 +1,33 @@
+import * as tools from "@bgord/tools";
+import type { RedactorStrategy } from "./redactor.strategy";
+import { RedactorMask } from "./redactor-mask.strategy";
+
+export class RedactorUrlQuery implements RedactorStrategy {
+  private readonly keys: Set<string>;
+
+  constructor(keys?: ReadonlyArray<string>) {
+    this.keys = new Set((keys?.length ? keys : RedactorMask.DEFAULT_KEYS).map((key) => key.toLowerCase()));
+  }
+
+  redact<T>(input: T): T {
+    if (!tools.isPlainObject(input)) return input;
+    if (typeof input["url"] !== "string") return input;
+
+    return { ...input, url: this.mask(input["url"]) };
+  }
+
+  private mask(url: string): string {
+    const [base, query] = url.split("?");
+
+    if (!query) return url;
+
+    const masked = new URLSearchParams(
+      Array.from(new URLSearchParams(query), ([key, value]) => [
+        key,
+        this.keys.has(key.toLowerCase()) ? "***" : value,
+      ]),
+    );
+
+    return `${base}?${masked.toString()}`;
+  }
+}

package/src/remote-file-storage-disk.adapter.ts

@@ -3,6 +3,7 @@ import * as v from "valibot";
 import type { DirectoryEnsurerPort } from "./directory-ensurer.port";
 import type { FileCleanerPort } from "./file-cleaner.port";
 import type { FileCopierPort } from "./file-copier.port";
+import type { FileInspectionPort } from "./file-inspection.port";
 import type { FileRenamerPort } from "./file-renamer.port";
 import type { HashFilePort } from "./hash-file.port";
 import type { NonceProviderPort } from "./nonce-provider.port";
@@ -15,6 +16,7 @@ import type {
 
 type Dependencies = {
   HashFile: HashFilePort;
+  FileInspection: FileInspectionPort;
   FileCleaner: FileCleanerPort;
   FileRenamer: FileRenamerPort;
   FileCopier: FileCopierPort;
@@ -71,11 +73,9 @@ export class RemoteFileStorageDiskAdapter implements RemoteFileStoragePort {
   async getStream(key: tools.ObjectKeyType): Promise<ReadableStream | null> {
     const path = this.resolveKeyToAbsoluteFilePath(key);
 
-    try {
-      return Bun.file(path.get()).stream();
-    } catch {
-      return null;
-    }
+    if (!(await this.deps.FileInspection.exists(path))) return null;
+
+    return Bun.file(path.get()).stream();
   }
 
   async delete(key: tools.ObjectKeyType): Promise<tools.ObjectKeyType> {

package/src/request-context-hono.adapter.ts

@@ -1,3 +1,4 @@
+import * as tools from "@bgord/tools";
 import type { Context } from "hono";
 import { getConnInfo } from "hono/bun";
 import { getCookie } from "hono/cookie";
@@ -25,6 +26,7 @@ export class RequestContextHonoAdapter implements RequestContext {
         return headers;
       },
       query: () => context.req.query(),
+      queries: () => context.req.queries(),
       params: () => context.req.param(),
       param: (name: string) => context.req.param(name),
       cookie: (name) => getCookie(context)[name],
@@ -64,11 +66,15 @@ export class RequestContextHonoAdapter implements RequestContext {
         context.req.header("x-real-ip") ||
         context.req.header("x-forwarded-for")?.split(",")[0]?.trim() ||
         getConnInfo(context).remote.address,
+      remoteIp: () => getConnInfo(context).remote.address,
       ua: () => context.req.header("user-agent"),
     };
 
     this.middleware = {
-      weakETag: () => context.get("WeakETag"),
+      revision: {
+        fromWeakETag: () => tools.Revision.fromWeakETag(context.get("WeakETag")),
+        fromETag: () => tools.Revision.fromETag(context.get("ETag")),
+      },
       timeZoneOffset: () => context.get("timeZoneOffset"),
       language: () => context.get("language"),
     };

package/src/request-context.port.ts

@@ -8,6 +8,7 @@ export interface RequestContext {
     url(): string;
     header(name: string): string | undefined;
     query(): Record<string, string>;
+    queries(): Record<string, ReadonlyArray<string>>;
     params(): Record<string, string>;
     param(name: string): string | undefined;
     cookie(name: string): string | undefined;
@@ -21,11 +22,12 @@ export interface RequestContext {
   readonly identity: {
     userId(): UUIDType | undefined;
     ip(): string | undefined;
+    remoteIp(): string | undefined;
     ua(): string | undefined;
   };
 
   readonly middleware: {
-    weakETag(): tools.WeakETag | null;
+    revision: { fromWeakETag(): tools.Revision; fromETag(): tools.Revision };
     timeZoneOffset(): tools.Duration;
     language(): tools.LanguageType;
   };
@@ -59,6 +61,10 @@ export interface HasRequestQuery {
   readonly request: { query(): Record<string, string> };
 }
 
+export interface HasRequestQueries {
+  readonly request: { queries(): Record<string, ReadonlyArray<string>> };
+}
+
 export interface HasRequestParams {
   readonly request: { params(): Record<string, string> };
 }
@@ -71,7 +77,7 @@ export interface HasRequestCookie {
   readonly request: { cookie(name: string): string | undefined };
 }
 
-export interface HasRequestJSON {
+export interface HasRequestJson {
   readonly request: { json(): Promise<Record<string, unknown>> };
 }
 
@@ -91,12 +97,16 @@ export interface HasIdentityIp {
   readonly identity: { ip(): string | undefined };
 }
 
+export interface HasIdentityRemoteIp {
+  readonly identity: { remoteIp(): string | undefined };
+}
+
 export interface HasIdentityUa {
   readonly identity: { ua(): string | undefined };
 }
 
-export interface HasMiddlewareWeakETag {
-  readonly middleware: { weakETag(): tools.WeakETag | null };
+export interface HasMiddlewareRevision {
+  readonly middleware: { revision: { fromWeakETag(): tools.Revision; fromETag(): tools.Revision } };
 }
 
 export interface HasMiddlewareTimeZoneOffset {

package/src/sealer-aes-gcm.adapter.ts

@@ -5,7 +5,10 @@ import type { SealerPort } from "./sealer.port";
 
 type Dependencies = { CryptoKeyProvider: CryptoKeyProviderPort };
 
-export const SealerAesGcmAdapterError = { InvalidPayload: "sealer.aes.gcm.adapter.invalid.payload" };
+export const SealerAesGcmAdapterError = {
+  InvalidPayload: "sealer.aes.gcm.adapter.invalid.payload",
+  Undefined: "sealer.aes.gcm.adapter.undefined.value",
+};
 
 export class SealerAesGcmAdapter implements SealerPort {
   private static readonly PREFIX = "sealed:gcm:";
@@ -13,6 +16,8 @@ export class SealerAesGcmAdapter implements SealerPort {
   constructor(private readonly deps: Dependencies) {}
 
   async seal(value: unknown): Promise<string> {
+    if (value === undefined) throw new Error(SealerAesGcmAdapterError.Undefined);
+
     const key = await this.deps.CryptoKeyProvider.get();
     const iv = EncryptionIV.generate();
 

package/src/secure-key-generator-crypto.adapter.ts

@@ -2,9 +2,17 @@ import type * as tools from "@bgord/tools";
 import type { SecureKeyGeneratorPort } from "./secure-key-generator.port";
 
 export class SecureKeyGeneratorCryptoAdapter implements SecureKeyGeneratorPort {
+  // crypto.getRandomValues is spec-limited to a 65536-byte view
+  static readonly MAX_BYTES = 65_536;
+
   generate(bytes: tools.IntegerPositiveType): Uint8Array {
     const buffer = new Uint8Array(bytes);
-    crypto.getRandomValues(buffer);
+
+    // Stryker disable next-line EqualityOperator
+    for (let offset = 0; offset < bytes; offset += SecureKeyGeneratorCryptoAdapter.MAX_BYTES) {
+      crypto.getRandomValues(buffer.subarray(offset, offset + SecureKeyGeneratorCryptoAdapter.MAX_BYTES));
+    }
+
     return buffer;
   }
 }

package/src/security-rule-bait-routes.strategy.ts

@@ -7,7 +7,7 @@ export class SecurityRuleBaitRoutesStrategy implements SecurityRuleStrategy {
   constructor(private readonly routes: ReadonlyArray<string>) {}
 
   async isViolated(context: HasRequestPath): Promise<boolean> {
-    return this.routes.includes(context.request.path);
+    return this.routes.includes(context.request.path.toLowerCase().replace(/\/+$/, ""));
   }
 
   get name(): SecurityRuleNameType {

package/src/security-rule-honey-pot-field.strategy.ts

@@ -1,17 +1,18 @@
 import * as v from "valibot";
-import type { HasRequestJSON } from "./request-context.port";
+import type { HasRequestForm, HasRequestJson } from "./request-context.port";
 import type { SecurityRuleStrategy } from "./security-rule.strategy";
 import { SecurityRuleName, type SecurityRuleNameType } from "./security-rule-name.vo";
 
 export class SecurityRuleHoneyPotFieldStrategy implements SecurityRuleStrategy {
   constructor(private readonly field: string) {}
 
-  async isViolated(context: HasRequestJSON): Promise<boolean> {
+  async isViolated(context: HasRequestJson & HasRequestForm): Promise<boolean> {
     const body = await context.request.json();
+    const form = await context.request.form();
 
-    const value = body[this.field];
+    const value = body[this.field] ?? form.get(this.field);
 
-    return value !== undefined && value !== null && value !== "";
+    return value !== null && value !== "";
   }
 
   get name(): SecurityRuleNameType {

package/src/security-rule.strategy.ts

@@ -1,10 +1,8 @@
-import type { HasRequestJSON, HasRequestPath } from "./request-context.port";
+import type { HasRequestForm, HasRequestJson, HasRequestPath } from "./request-context.port";
 import type { SecurityRuleNameType } from "./security-rule-name.vo";
 
-type RequestContextCapabilities = HasRequestPath & HasRequestJSON;
-
 export interface SecurityRuleStrategy {
-  isViolated(context: RequestContextCapabilities): Promise<boolean>;
+  isViolated(context: HasRequestPath & HasRequestJson & HasRequestForm): Promise<boolean>;
 
   get name(): SecurityRuleNameType;
 }

package/src/semaphore.service.ts

@@ -3,24 +3,27 @@ import type * as tools from "@bgord/tools";
 export type SemaphoreConfig = { limit: tools.IntegerPositiveType };
 
 export class Semaphore {
-  private readonly slots: Array<Promise<void>>;
+  private readonly limit: tools.IntegerPositiveType;
+
+  private active = 0;
+
+  private readonly waiting: Array<() => void> = [];
 
   constructor(config: SemaphoreConfig) {
-    this.slots = Array.from({ length: config.limit }, () => Promise.resolve());
+    this.limit = config.limit;
   }
 
   async run<T>(action: () => Promise<T>): Promise<T> {
-    const slot = this.slots.shift();
-    const { promise, resolve } = Promise.withResolvers<void>();
-
-    this.slots.push(promise);
-
-    await slot;
+    if (this.active >= this.limit) await new Promise<void>((resolve) => this.waiting.push(resolve));
+    else this.active++;
 
     try {
       return await action();
     } finally {
-      resolve();
+      const next = this.waiting.shift();
+
+      if (next) next();
+      else this.active--;
     }
   }
 }

package/src/setup-hono.service.ts

@@ -53,6 +53,7 @@ export class SetupHono {
       new ShieldMaintenanceHonoStrategy(config.maintenanceMode).handle(),
       new TrailingSlashHonoMiddleware().handle(),
       new CorrelationHonoMiddleware(deps).handle(),
+      new TimingHonoMiddleware(deps).handle(),
       new ApiVersionHonoMiddleware(deps).handle(),
       new ShieldCsrfHonoStrategy(config.csrf).handle(),
       secureHeaders({
@@ -76,7 +77,6 @@ export class SetupHono {
       new LanguageDetectorHonoMiddleware(config.I18n).handle(),
       new TimeZoneOffsetHonoMiddleware().handle(),
       new HttpLoggerHonoMiddleware(deps, config.httpLogger).handle(),
-      new TimingHonoMiddleware(deps).handle(),
     ];
   }
 }

package/src/shield-api-key-hono.strategy.ts

@@ -20,7 +20,7 @@ export class ShieldApiKeyHonoStrategy implements MiddlewareHonoPort {
       const context = new RequestContextHonoAdapter(c);
 
       if (this.strategy.evaluate(context)) return next();
-      throw new HTTPException(403, { message: ShieldApiKeyStrategyError.Rejected });
+      throw new HTTPException(401, { message: ShieldApiKeyStrategyError.Rejected });
     };
   }
 }

package/src/shield-api-key.strategy.ts

@@ -1,5 +1,6 @@
 import { timingSafeEqual } from "node:crypto";
-import type * as tools from "@bgord/tools";
+import * as tools from "@bgord/tools";
+import * as v from "valibot";
 import type { HasRequestHeader } from "./request-context.port";
 
 export type ApiKeyShieldConfig = { API_KEY: tools.ApiKeyType };
@@ -12,11 +13,10 @@ export class ShieldApiKeyStrategy {
   constructor(private readonly config: ApiKeyShieldConfig) {}
 
   evaluate(context: HasRequestHeader): boolean {
-    const header = context.request.header(ShieldApiKeyStrategy.HEADER_NAME);
-    const config = this.config.API_KEY;
+    const header = v.safeParse(tools.ApiKey, context.request.header(ShieldApiKeyStrategy.HEADER_NAME));
 
-    if (header?.length !== config.length) return false;
+    if (!header.success) return false;
 
-    return timingSafeEqual(Buffer.from(header), Buffer.from(config));
+    return timingSafeEqual(Buffer.from(header.output), Buffer.from(this.config.API_KEY));
   }
 }

package/src/shield-auth.strategy.ts

@@ -3,7 +3,10 @@ import type { HasRequestHeaders } from "./request-context.port";
 
 type Dependencies<User, Session> = { AuthSessionReader: AuthSessionReaderPort<User, Session> };
 
-export const ShieldAuthStrategyError = { Rejected: "shield.auth.rejected" };
+export const ShieldAuthStrategyError = {
+  Rejected: "shield.auth.rejected",
+  NotAttached: "shield.auth.not.attached",
+};
 
 export class ShieldAuthStrategy<User, Session> {
   constructor(private readonly deps: Dependencies<User, Session>) {}
@@ -12,11 +15,13 @@ export class ShieldAuthStrategy<User, Session> {
     return await this.deps.AuthSessionReader.getSession(context);
   }
 
-  verify(user: User | null): boolean {
-    return user !== null && user !== undefined;
+  verify(user: User | null | undefined): boolean {
+    if (user === undefined) throw new Error(ShieldAuthStrategyError.NotAttached);
+    return user !== null;
   }
 
-  reverse(user: User | null): boolean {
-    return !user;
+  reverse(user: User | null | undefined): boolean {
+    if (user === undefined) throw new Error(ShieldAuthStrategyError.NotAttached);
+    return user === null;
   }
 }

package/src/shield-basic-auth-hono.strategy.ts

@@ -11,7 +11,7 @@ import {
 export class ShieldBasicAuthHonoStrategy implements MiddlewareHonoPort {
   private readonly strategy: ShieldBasicAuthStrategy;
 
-  constructor(config: ShieldBasicAuthConfig) {
+  constructor(private readonly config: ShieldBasicAuthConfig) {
     this.strategy = new ShieldBasicAuthStrategy(config);
   }
 
@@ -20,7 +20,13 @@ export class ShieldBasicAuthHonoStrategy implements MiddlewareHonoPort {
       const context = new RequestContextHonoAdapter(c);
 
       if (this.strategy.evaluate(context)) return next();
-      throw new HTTPException(401, { message: ShieldBasicAuthStrategyError.Rejected });
+
+      throw new HTTPException(401, {
+        message: ShieldBasicAuthStrategyError.Rejected,
+        res: new Response(ShieldBasicAuthStrategyError.Rejected, {
+          headers: { "WWW-Authenticate": `Basic realm="${this.config.realm}"` },
+        }),
+      });
     };
   }
 }

package/src/shield-basic-auth.strategy.ts

@@ -3,7 +3,11 @@ import type { BasicAuthPasswordType } from "./basic-auth-password.vo";
 import type { BasicAuthUsernameType } from "./basic-auth-username.vo";
 import type { HasRequestHeader } from "./request-context.port";
 
-export type ShieldBasicAuthConfig = { username: BasicAuthUsernameType; password: BasicAuthPasswordType };
+export type ShieldBasicAuthConfig = {
+  username: BasicAuthUsernameType;
+  password: BasicAuthPasswordType;
+  realm: string;
+};
 
 export const ShieldBasicAuthStrategyError = { Rejected: "shield.basic.auth.rejected" };
 
@@ -16,11 +20,20 @@ export class ShieldBasicAuthStrategy {
     try {
       const credentials = atob(String(header).replace("Basic ", ""));
 
-      const [username, password] = credentials.split(":");
+      const index = credentials.indexOf(":");
 
-      if (username !== this.config.username) return false;
+      if (index === -1) return false;
 
-      if (password?.length !== this.config.password.length) return false;
+      const username = credentials.slice(0, index);
+      const password = credentials.slice(index + 1);
+
+      // Stryker disable next-line ConditionalExpression
+      if (username.length !== this.config.username.length) return false;
+
+      if (!timingSafeEqual(Buffer.from(username), Buffer.from(this.config.username))) return false;
+
+      // Stryker disable next-line ConditionalExpression
+      if (password.length !== this.config.password.length) return false;
 
       return timingSafeEqual(Buffer.from(password), Buffer.from(this.config.password));
     } catch {

package/src/shield-csrf.strategy.ts

@@ -1,6 +1,6 @@
 import type { HasRequestHeader, HasRequestMethod } from "./request-context.port";
 
-const STATE_CHANGING_METHODS = ["POST", "PUT", "PATCH", "DELETE"];
+const SAFE_METHODS = ["GET", "HEAD", "OPTIONS", "TRACE"];
 
 export type ShieldCsrfConfig = { origin: ReadonlyArray<string> };
 
@@ -10,7 +10,7 @@ export class ShieldCsrfStrategy {
   constructor(private readonly config: ShieldCsrfConfig) {}
 
   evaluate(context: HasRequestMethod & HasRequestHeader): boolean {
-    if (!STATE_CHANGING_METHODS.includes(context.request.method)) return true;
+    if (SAFE_METHODS.includes(context.request.method)) return true;
 
     const origin = context.request.header("origin");
 

package/src/shield-hcaptcha-hono-local.strategy.ts

@@ -3,7 +3,7 @@ import { HTTPException } from "hono/http-exception";
 import * as v from "valibot";
 import { HCaptchaSecretKey } from "./hcaptcha-secret-key.vo";
 import type { MiddlewareHonoPort } from "./middleware-hono.port";
-import type { HasRequestForm } from "./request-context.port";
+import type { HasRequestForm, HasRequestJson } from "./request-context.port";
 import { ShieldHcaptchaStrategy, ShieldHcaptchaStrategyField } from "./shield-hcaptcha.strategy";
 
 export const ShieldHcaptchaLocalStrategyError = { Rejected: "shield.hcaptcha.local.rejected" };
@@ -26,7 +26,9 @@ export class ShieldHcaptchaLocalHonoStrategy implements MiddlewareHonoPort {
     return async (_c, next) => {
       const form = new FormData();
       form.set(ShieldHcaptchaStrategyField, ShieldHcaptchaLocalHonoStrategy.TOKEN_LOCAL);
-      const context: HasRequestForm = { request: { form: async () => form } };
+      const context: HasRequestForm & HasRequestJson = {
+        request: { form: async () => form, json: async () => ({}) },
+      };
 
       if (await this.strategy.evaluate(context)) return next();
       throw new HTTPException(403, { message: ShieldHcaptchaLocalStrategyError.Rejected });

package/src/shield-hcaptcha.strategy.ts

@@ -1,6 +1,6 @@
 import { HCaptchaService } from "./hcaptcha.service";
 import type { HCaptchaSecretKeyType } from "./hcaptcha-secret-key.vo";
-import type { HasRequestForm } from "./request-context.port";
+import type { HasRequestForm, HasRequestJson } from "./request-context.port";
 
 export const ShieldHcaptchaStrategyError = { Rejected: "shield.hcaptcha.rejected" };
 
@@ -11,10 +11,17 @@ export class ShieldHcaptchaStrategy {
 
   constructor(private readonly secretKey: HCaptchaSecretKeyType) {}
 
-  async evaluate(context: HasRequestForm): Promise<boolean> {
+  async evaluate(context: HasRequestForm & HasRequestJson): Promise<boolean> {
     try {
       const form = await context.request.form();
-      const token = form.get(ShieldHcaptchaStrategyField)?.toString();
+      const json = await context.request.json();
+
+      const fromForm = form.get(ShieldHcaptchaStrategyField)?.toString();
+      const fromJson = json[ShieldHcaptchaStrategyField];
+
+      const token = fromForm ?? (typeof fromJson === "string" ? fromJson : undefined);
+
+      if (!token) return false;
 
       const result = await this.hcaptcha.verify(this.secretKey, token);
 

package/src/shield-ip-blacklist.strategy.ts

@@ -1,6 +1,6 @@
 import * as v from "valibot";
 import { ClientIp, type ClientIpType } from "./client-ip.vo";
-import type { HasIdentityIp } from "./request-context.port";
+import type { HasIdentityRemoteIp } from "./request-context.port";
 
 export type ShieldIpBlacklistConfig = { blacklist: ReadonlyArray<ClientIpType> };
 
@@ -9,10 +9,10 @@ export const ShieldIpBlacklistStrategyError = { Rejected: "shield.ip.blacklist.r
 export class ShieldIpBlacklistStrategy {
   constructor(private readonly config: ShieldIpBlacklistConfig) {}
 
-  evaluate(context: HasIdentityIp): boolean {
-    const ip = v.safeParse(ClientIp, context.identity.ip());
+  evaluate(context: HasIdentityRemoteIp): boolean {
+    const ip = v.safeParse(ClientIp, context.identity.remoteIp());
 
-    if (!ip.success) return false;
+    if (!ip.success) return true;
     return !this.config.blacklist.includes(ip.output);
   }
 }

package/src/shield-ip-whitelist.strategy.ts

@@ -1,6 +1,6 @@
 import * as v from "valibot";
 import { ClientIp, type ClientIpType } from "./client-ip.vo";
-import type { HasIdentityIp } from "./request-context.port";
+import type { HasIdentityRemoteIp } from "./request-context.port";
 
 export type ShieldIpWhitelistConfig = { whitelist: ReadonlyArray<ClientIpType> };
 
@@ -9,8 +9,8 @@ export const ShieldIpWhitelistStrategyError = { Rejected: "shield.ip.whitelist.r
 export class ShieldIpWhitelistStrategy {
   constructor(private readonly config: ShieldIpWhitelistConfig) {}
 
-  evaluate(context: HasIdentityIp): boolean {
-    const ip = v.safeParse(ClientIp, context.identity.ip());
+  evaluate(context: HasIdentityRemoteIp): boolean {
+    const ip = v.safeParse(ClientIp, context.identity.remoteIp());
 
     if (!ip.success) return false;
     return this.config.whitelist.includes(ip.output);

package/src/shield-maintenance-hono.strategy.ts

@@ -1,5 +1,6 @@
 import type { MiddlewareHandler } from "hono";
 import type { MiddlewareHonoPort } from "./middleware-hono.port";
+import { RequestContextHonoAdapter } from "./request-context-hono.adapter";
 import { type ShieldMaintenanceConfig, ShieldMaintenanceStrategy } from "./shield-maintenance.strategy";
 
 export class ShieldMaintenanceHonoStrategy implements MiddlewareHonoPort {
@@ -11,13 +12,15 @@ export class ShieldMaintenanceHonoStrategy implements MiddlewareHonoPort {
 
   handle(): MiddlewareHandler {
     return async (c, next) => {
-      const maintenance = this.strategy.evaluate();
+      const context = new RequestContextHonoAdapter(c);
+
+      if (this.strategy.shouldSkip(context)) return next();
+
+      const maintenance = await this.strategy.evaluate();
 
       if (!maintenance.enabled) return next();
 
-      return c.json({ reason: "maintenance" }, 503, {
-        "Retry-After": maintenance.RetryAfter.seconds.toString(),
-      });
+      return c.json(maintenance.body, maintenance.code, maintenance.headers);
     };
   }
 }