@bgord/bun 1.23.1 → 1.23.3

package/dist/webhook-body-builder-signed-headers.strategy.d.ts

@@ -0,0 +1,8 @@
+import type { HasRequestHeader, HasRequestText } from "./request-context.port";
+import type { WebhookBodyBuilderStrategy } from "./webhook-body-builder.strategy";
+export declare class WebhookBodyBuilderSignedHeadersStrategy implements WebhookBodyBuilderStrategy {
+    private readonly headers;
+    constructor(headers: ReadonlyArray<string>);
+    build(context: HasRequestHeader & HasRequestText): Promise<string>;
+}
+//# sourceMappingURL=webhook-body-builder-signed-headers.strategy.d.ts.map

package/dist/webhook-body-builder-signed-headers.strategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-body-builder-signed-headers.strategy.d.ts","sourceRoot":"","sources":["../src/webhook-body-builder-signed-headers.strategy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC/E,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAElF,qBAAa,uCAAwC,YAAW,0BAA0B;IAC5E,OAAO,CAAC,QAAQ,CAAC,OAAO;IAApC,YAA6B,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,EAAI;IAEzD,KAAK,CAAC,OAAO,EAAE,gBAAgB,GAAG,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAIvE;CACF"}

package/dist/webhook-body-builder-signed-headers.strategy.js

@@ -0,0 +1,11 @@
+export class WebhookBodyBuilderSignedHeadersStrategy {
+    headers;
+    constructor(headers) {
+        this.headers = headers;
+    }
+    async build(context) {
+        const headers = this.headers.map((name) => [name, context.request.header(name) ?? null]);
+        return JSON.stringify([headers, await context.request.text()]);
+    }
+}
+//# sourceMappingURL=webhook-body-builder-signed-headers.strategy.js.map

package/dist/webhook-body-builder-signed-headers.strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-body-builder-signed-headers.strategy.js","sourceRoot":"","sources":["../src/webhook-body-builder-signed-headers.strategy.ts"],"names":[],"mappings":"AAGA,MAAM,OAAO,uCAAuC;IACrB,OAAO;IAApC,YAA6B,OAA8B;uBAA9B,OAAO;IAA0B,CAAC;IAE/D,KAAK,CAAC,KAAK,CAAC,OAA0C;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;QAEzF,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACjE,CAAC;CACF"}

package/dist/webhook-signature.vo.d.ts

@@ -2,7 +2,8 @@ import * as v from "valibot";
 export declare const WebhookSignatureError: {
     Type: string;
     Empty: string;
+    InvalidHex: string;
 };
-export declare const WebhookSignature: v.SchemaWithPipe<readonly [v.StringSchema<string>, v.NonEmptyAction<string, string>, v.BrandAction<string, "WebhookSignature">]>;
+export declare const WebhookSignature: v.SchemaWithPipe<readonly [v.StringSchema<string>, v.NonEmptyAction<string, string>, v.RegexAction<string, string>, v.BrandAction<string, "WebhookSignature">]>;
 export type WebhookSignatureType = v.InferOutput<typeof WebhookSignature>;
 //# sourceMappingURL=webhook-signature.vo.d.ts.map

package/dist/webhook-signature.vo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-signature.vo.d.ts","sourceRoot":"","sources":["../src/webhook-signature.vo.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAE7B,eAAO,MAAM,qBAAqB;IAChC,IAAI;IACJ,KAAK;CACN,CAAC;AAEF,eAAO,MAAM,gBAAgB,kIAK5B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,gBAAgB,CAAC,CAAC"}
+{"version":3,"file":"webhook-signature.vo.d.ts","sourceRoot":"","sources":["../src/webhook-signature.vo.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAE7B,eAAO,MAAM,qBAAqB;IAChC,IAAI;IACJ,KAAK;IACL,UAAU;CACX,CAAC;AAKF,eAAO,MAAM,gBAAgB,iKAM5B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,gBAAgB,CAAC,CAAC"}

package/dist/webhook-signature.vo.js

@@ -2,8 +2,11 @@ import * as v from "valibot";
 export const WebhookSignatureError = {
     Type: "webhook.signature.type",
     Empty: "webhook.signature.empty",
+    InvalidHex: "webhook.signature.invalid.hex",
 };
-export const WebhookSignature = v.pipe(v.string(WebhookSignatureError.Type), v.nonEmpty(WebhookSignatureError.Empty), 
+// Hex chars allowed
+const CHARS_WHITELIST = /^[a-fA-F0-9]+$/;
+export const WebhookSignature = v.pipe(v.string(WebhookSignatureError.Type), v.nonEmpty(WebhookSignatureError.Empty), v.regex(CHARS_WHITELIST, WebhookSignatureError.InvalidHex), 
 // Stryker disable next-line StringLiteral
 v.brand("WebhookSignature"));
 //# sourceMappingURL=webhook-signature.vo.js.map

package/dist/webhook-signature.vo.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-signature.vo.js","sourceRoot":"","sources":["../src/webhook-signature.vo.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAE7B,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,IAAI,EAAE,wBAAwB;IAC9B,KAAK,EAAE,yBAAyB;CACjC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CACpC,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,EACpC,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,KAAK,CAAC;AACvC,0CAA0C;AAC1C,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAC5B,CAAC"}
+{"version":3,"file":"webhook-signature.vo.js","sourceRoot":"","sources":["../src/webhook-signature.vo.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAE7B,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,IAAI,EAAE,wBAAwB;IAC9B,KAAK,EAAE,yBAAyB;IAChC,UAAU,EAAE,+BAA+B;CAC5C,CAAC;AAEF,oBAAoB;AACpB,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAEzC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CACpC,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,EACpC,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,KAAK,CAAC,EACvC,CAAC,CAAC,KAAK,CAAC,eAAe,EAAE,qBAAqB,CAAC,UAAU,CAAC;AAC1D,0CAA0C;AAC1C,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAC5B,CAAC"}

package/dist/webhook-verifier-sha256.strategy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-verifier-sha256.strategy.d.ts","sourceRoot":"","sources":["../src/webhook-verifier-sha256.strategy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AAC5F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,KAAK,MAAM,GAAG;IAAE,uBAAuB,EAAE,+BAA+B,CAAA;CAAE,CAAC;AAE3E,qBAAa,6BAA8B,YAAW,uBAAuB;IAC/D,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAnC,YAA6B,MAAM,EAAE,MAAM,EAAI;IAE/C,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,oBAAoB,GAAG,OAAO,CAK7D;CACF"}
+{"version":3,"file":"webhook-verifier-sha256.strategy.d.ts","sourceRoot":"","sources":["../src/webhook-verifier-sha256.strategy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AAC5F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,KAAK,MAAM,GAAG;IAAE,uBAAuB,EAAE,+BAA+B,CAAA;CAAE,CAAC;AAE3E,qBAAa,6BAA8B,YAAW,uBAAuB;IAC/D,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAnC,YAA6B,MAAM,EAAE,MAAM,EAAI;IAE/C,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,oBAAoB,GAAG,OAAO,CAM7D;CACF"}

package/dist/webhook-verifier-sha256.strategy.js

@@ -5,10 +5,11 @@ export class WebhookVerifierSha256Strategy {
         this.config = config;
     }
     verify(body, signature) {
-        const digest = this.config.WebhookSignatureCreator.create(body);
-        if (digest.length !== signature.length)
+        const digest = Buffer.from(this.config.WebhookSignatureCreator.create(body));
+        const candidate = Buffer.from(signature);
+        if (digest.length !== candidate.length)
             return false;
-        return timingSafeEqual(Buffer.from(digest), Buffer.from(signature));
+        return timingSafeEqual(digest, candidate);
     }
 }
 //# sourceMappingURL=webhook-verifier-sha256.strategy.js.map

package/dist/webhook-verifier-sha256.strategy.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-verifier-sha256.strategy.js","sourceRoot":"","sources":["../src/webhook-verifier-sha256.strategy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAO9C,MAAM,OAAO,6BAA6B;IACX,MAAM;IAAnC,YAA6B,MAAc;sBAAd,MAAM;IAAW,CAAC;IAE/C,MAAM,CAAC,IAAY,EAAE,SAA+B;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAEhE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACrD,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACtE,CAAC;CACF"}
+{"version":3,"file":"webhook-verifier-sha256.strategy.js","sourceRoot":"","sources":["../src/webhook-verifier-sha256.strategy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAO9C,MAAM,OAAO,6BAA6B;IACX,MAAM;IAAnC,YAA6B,MAAc;sBAAd,MAAM;IAAW,CAAC;IAE/C,MAAM,CAAC,IAAY,EAAE,SAA+B;QAClD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEzC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACrD,OAAO,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;CACF"}

package/dist/woodchopper.d.ts

@@ -10,7 +10,7 @@ export type WoodchopperConfig = {
     level: LogLevelEnum;
     environment: NodeEnvironmentEnum;
     dispatcher: WoodchopperDispatcher;
-    redactor?: RedactorStrategy;
+    redactor: RedactorStrategy;
     diagnostics?: WoodchopperDiagnosticsStrategy;
 };
 type Dependencies = {

package/dist/woodchopper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"woodchopper.d.ts","sourceRoot":"","sources":["../src/woodchopper.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EACL,KAAK,aAAa,EAIlB,KAAK,UAAU,EACf,YAAY,EACb,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAG/E,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,aAAa,CAAC;IACnB,KAAK,EAAE,YAAY,CAAC;IACpB,WAAW,EAAE,mBAAmB,CAAC;IACjC,UAAU,EAAE,qBAAqB,CAAC;IAClC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,WAAW,CAAC,EAAE,8BAA8B,CAAC;CAC9C,CAAC;AAEF,KAAK,YAAY,GAAG;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC;AAYzC,qBAAa,WAAY,YAAW,UAAU,EAAE,uBAAuB;IAKnE,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI;IALvB,OAAO,CAAC,KAAK,CAAc;IAC3B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0B;IAEhD,YACmB,MAAM,EAAE,iBAAiB,EACzB,IAAI,EAAE,YAAY,EAQpC;IAED,OAAO,CAAC,GAAG;IA4CX,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAkD;IAC5E,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAiD;IACzE,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAiD;IACzE,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAiD;IACzE,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,CAAoD;IAClF,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAkD;IAC5E,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAkD;IAE5E,KAAK,SAKJ;IAED,QAAQ,IAAI,mBAAmB,CAE9B;CACF"}
+{"version":3,"file":"woodchopper.d.ts","sourceRoot":"","sources":["../src/woodchopper.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EACL,KAAK,aAAa,EAIlB,KAAK,UAAU,EACf,YAAY,EACb,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAG/E,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,aAAa,CAAC;IACnB,KAAK,EAAE,YAAY,CAAC;IACpB,WAAW,EAAE,mBAAmB,CAAC;IACjC,UAAU,EAAE,qBAAqB,CAAC;IAClC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,WAAW,CAAC,EAAE,8BAA8B,CAAC;CAC9C,CAAC;AAEF,KAAK,YAAY,GAAG;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC;AAYzC,qBAAa,WAAY,YAAW,UAAU,EAAE,uBAAuB;IAKnE,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI;IALvB,OAAO,CAAC,KAAK,CAAc;IAC3B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0B;IAEhD,YACmB,MAAM,EAAE,iBAAiB,EACzB,IAAI,EAAE,YAAY,EAQpC;IAED,OAAO,CAAC,GAAG;IA0CX,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAkD;IAC5E,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAiD;IACzE,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAiD;IACzE,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAiD;IACzE,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,CAAoD;IAClF,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAkD;IAC5E,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAkD;IAE5E,KAAK,SAKJ;IAED,QAAQ,IAAI,mBAAmB,CAE9B;CACF"}

package/dist/woodchopper.js

@@ -58,9 +58,7 @@ export class Woodchopper {
         }
         let withRedaction;
         try {
-            withRedaction = this.config.redactor
-                ? this.config.redactor.redact(withInjectedFields)
-                : withInjectedFields;
+            withRedaction = this.config.redactor.redact(withInjectedFields);
         }
         catch (error) {
             this.stats.recordDropped();

package/dist/woodchopper.js.map

@@ -1 +1 @@
-{"version":3,"file":"woodchopper.js","sourceRoot":"","sources":["../src/woodchopper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,EAML,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,WAAW,GAGZ,MAAM,8BAA8B,CAAC;AAKtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAa/D,MAAM,kBAAkB,GAAuD;IAC7E,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IAC9C,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7C,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7C,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7C,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IAChD,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IAC9C,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;CAC/C,CAAC;AAEF,MAAM,OAAO,WAAW;IAKH,MAAM;IACN,IAAI;IALf,KAAK,CAAc;IACV,KAAK,GAAG,IAAI,gBAAgB,EAAE,CAAC;IAEhD,YACmB,MAAyB,EACzB,IAAkB;sBADlB,MAAM;oBACN,IAAI;QAErB,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC;QAE9B,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,GAAG,CAAC,KAAK,EAAE,EAAE;YACzC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACzD,IAAI,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC;QACrC,CAAC,CAAC;IACJ,CAAC;IAEO,GAAG,CAAC,KAAmB,EAAE,KAAsB;QACrD,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QACzE,IAAI,kBAAkB,CAAC,KAAK,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QAEzG,IAAI,iBAA6D,CAAC;QAClE,IAAI,CAAC;YACH,iBAAiB;gBACf,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QACjG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,IAAI,kBAA+B,CAAC;QACpC,IAAI,CAAC;YACH,kBAAkB,GAAG;gBACnB,oDAAoD;gBACpD,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;gBAC3D,KAAK;gBACL,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG;gBACpB,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;gBACpC,GAAG,iBAAiB;aACrB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,IAAI,aAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAClC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC;gBACjD,CAAC,CAAC,kBAAkB,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;IAC5G,CAAC;IAED,KAAK,GAAwB,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5E,IAAI,GAAuB,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzE,IAAI,GAAuB,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzE,IAAI,GAAuB,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzE,OAAO,GAA0B,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClF,KAAK,GAAwB,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5E,KAAK,GAAwB,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAE5E,KAAK;QACH,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC,MAAM;YAAE,OAAO;QAE9C,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IACjC,CAAC;IAED,QAAQ;QACN,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IACvD,CAAC;CACF"}
+{"version":3,"file":"woodchopper.js","sourceRoot":"","sources":["../src/woodchopper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,EAML,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,WAAW,GAGZ,MAAM,8BAA8B,CAAC;AAKtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAa/D,MAAM,kBAAkB,GAAuD;IAC7E,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IAC9C,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7C,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7C,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7C,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IAChD,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IAC9C,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;CAC/C,CAAC;AAEF,MAAM,OAAO,WAAW;IAKH,MAAM;IACN,IAAI;IALf,KAAK,CAAc;IACV,KAAK,GAAG,IAAI,gBAAgB,EAAE,CAAC;IAEhD,YACmB,MAAyB,EACzB,IAAkB;sBADlB,MAAM;oBACN,IAAI;QAErB,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC;QAE9B,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,GAAG,CAAC,KAAK,EAAE,EAAE;YACzC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACzD,IAAI,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC;QACrC,CAAC,CAAC;IACJ,CAAC;IAEO,GAAG,CAAC,KAAmB,EAAE,KAAsB;QACrD,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QACzE,IAAI,kBAAkB,CAAC,KAAK,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QAEzG,IAAI,iBAA6D,CAAC;QAClE,IAAI,CAAC;YACH,iBAAiB;gBACf,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QACjG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,IAAI,kBAA+B,CAAC;QACpC,IAAI,CAAC;YACH,kBAAkB,GAAG;gBACnB,oDAAoD;gBACpD,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;gBAC3D,KAAK;gBACL,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG;gBACpB,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;gBACpC,GAAG,iBAAiB;aACrB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,IAAI,aAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;IAC5G,CAAC;IAED,KAAK,GAAwB,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5E,IAAI,GAAuB,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzE,IAAI,GAAuB,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzE,IAAI,GAAuB,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzE,OAAO,GAA0B,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClF,KAAK,GAAwB,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5E,KAAK,GAAwB,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAE5E,KAAK;QACH,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC,MAAM;YAAE,OAAO;QAE9C,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IACjC,CAAC;IAED,QAAQ;QACN,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IACvD,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bgord/bun",
-  "version": "1.23.1",
+  "version": "1.23.3",
   "type": "module",
   "license": "MIT",
   "author": "Bartosz Gordon",

package/readme.md

@@ -207,6 +207,10 @@ src/
 ├── file-renamer-node.adapter.ts
 ├── file-renamer-noop.adapter.ts
 ├── file-renamer.port.ts
+├── file-type-detector-fixed.strategy.ts
+├── file-type-detector-magic-bytes.strategy.ts
+├── file-type-detector-text.strategy.ts
+├── file-type-detector.strategy.ts
 ├── file-uploader-hono.middleware.ts
 ├── file-uploader.middleware.ts
 ├── file-writer-forgiving.adapter.ts
@@ -615,6 +619,7 @@ src/
 ├── subject-segment-param.strategy.ts
 ├── subject-segment-path.strategy.ts
 ├── subject-segment-query.strategy.ts
+├── subject-segment-remote-ip.strategy.ts
 ├── subject-segment-request.strategy.ts
 ├── subject-segment-user.strategy.ts
 ├── temporary-file-absolute.adapter.ts
@@ -653,6 +658,7 @@ src/
 ├── weak-etag-extractor-param.strategy.ts
 ├── weak-etag-extractor.middleware.ts
 ├── weak-etag-extractor.strategy.ts
+├── webhook-body-builder-signed-headers.strategy.ts
 ├── webhook-body-builder-text.strategy.ts
 ├── webhook-body-builder.strategy.ts
 ├── webhook-id-extractor-header.strategy.ts

package/src/better-auth-logger.service.ts

@@ -11,13 +11,18 @@ export class BetterAuthLogger {
     return {
       disabled: false,
       level: "debug",
-      log: (level: LogLevel | undefined, message: string, ...args: ReadonlyArray<unknown>) => {
-        const entry = { component: "infra", operation: "better-auth", message, metadata: { args } } as const;
+      log: (level: LogLevel | undefined, message: string, ...params: ReadonlyArray<unknown>) => {
+        const entry = {
+          component: "infra",
+          operation: "better-auth",
+          message,
+          metadata: { params },
+        } as const;
 
         if (level === "error") {
           this.deps.Logger.error({
             ...entry,
-            error: args.find((arg) => arg instanceof Error) ?? new Error(message),
+            error: params.find((param) => param instanceof Error) ?? new Error(message),
           });
         } else if (level === "warn") {
           this.deps.Logger.warn(entry);

package/src/error-classifier-http-exception-hono.strategy.ts

@@ -15,7 +15,12 @@ export class ErrorClassifierHttpExceptionHonoStrategy implements ErrorClassifier
   classify(error: unknown): Response | null {
     if (!(error instanceof HTTPException)) return null;
 
-    if (!this.errors.has(error.message)) return error.getResponse();
+    if (!this.errors.has(error.message)) {
+      return Response.json(
+        { message: "general.unknown" },
+        { status: error.status, headers: error.res?.headers },
+      );
+    }
 
     return Response.json({ message: error.message }, { status: error.status, headers: error.res?.headers });
   }

package/src/event.types.ts

@@ -1,4 +1,5 @@
 import type * as tools from "@bgord/tools";
+import type { CommitShaValueType } from "./commit-sha-value.vo";
 import type { CorrelationIdType } from "./correlation-id.vo";
 import type { EventStreamType } from "./event-stream.vo";
 import type { UUIDType } from "./uuid.vo";
@@ -9,6 +10,7 @@ export type GenericEvent = {
   createdAt: number;
   stream: EventStreamType;
   revision?: tools.RevisionValueType;
+  commit: CommitShaValueType;
   name: string;
   version: number;
   payload: Record<string, unknown>;

package/src/file-type-detector-fixed.strategy.ts

@@ -0,0 +1,10 @@
+import type * as tools from "@bgord/tools";
+import type { FileTypeDetectorStrategy } from "./file-type-detector.strategy";
+
+export class FileTypeDetectorFixedStrategy implements FileTypeDetectorStrategy {
+  constructor(private readonly mime: tools.Mime | null) {}
+
+  async detect(_file: File): Promise<tools.Mime | null> {
+    return this.mime;
+  }
+}

package/src/file-type-detector-magic-bytes.strategy.ts

@@ -0,0 +1,32 @@
+// cSpell:ignore ftyp
+import * as tools from "@bgord/tools";
+import type { FileTypeDetectorStrategy } from "./file-type-detector.strategy";
+
+type Signature = { mime: tools.Mime; offset: number; bytes: ReadonlyArray<number> };
+
+const ASCII = (value: string): ReadonlyArray<number> => [...value].map((char) => char.charCodeAt(0));
+
+const SIGNATURES: ReadonlyArray<Signature> = [
+  { mime: tools.Mimes.png.mime, offset: 0, bytes: [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a] },
+  { mime: tools.Mimes.webp.mime, offset: 8, bytes: ASCII("WEBP") },
+  { mime: tools.Mimes.wav.mime, offset: 8, bytes: ASCII("WAVE") },
+  { mime: tools.Mimes.mp4.mime, offset: 4, bytes: ASCII("ftyp") },
+  { mime: tools.Mimes.pdf.mime, offset: 0, bytes: ASCII("%PDF-") },
+  { mime: tools.Mimes.zip.mime, offset: 0, bytes: [0x50, 0x4b, 0x03, 0x04] },
+  { mime: tools.Mimes.jpg.mime, offset: 0, bytes: [0xff, 0xd8, 0xff] },
+  { mime: tools.Mimes.tar.mime, offset: 0, bytes: [0x1f, 0x8b] },
+];
+
+export class FileTypeDetectorMagicBytesStrategy implements FileTypeDetectorStrategy {
+  async detect(file: File): Promise<tools.Mime | null> {
+    const bytes = new Uint8Array(await file.slice(0, 12).arrayBuffer());
+
+    for (const signature of SIGNATURES) {
+      if (signature.bytes.every((byte, index) => bytes[signature.offset + index] === byte)) {
+        return signature.mime;
+      }
+    }
+
+    return null;
+  }
+}

package/src/file-type-detector-text.strategy.ts

@@ -0,0 +1,25 @@
+import type * as tools from "@bgord/tools";
+import type { FileTypeDetectorStrategy } from "./file-type-detector.strategy";
+
+const ALLOWED_CONTROL_BYTES = [0x09, 0x0a, 0x0c, 0x0d];
+
+const isControlByte = (byte: number) =>
+  (byte < 0x20 && !ALLOWED_CONTROL_BYTES.includes(byte)) || byte === 0x7f;
+
+export class FileTypeDetectorTextStrategy implements FileTypeDetectorStrategy {
+  constructor(private readonly mime: tools.Mime) {}
+
+  async detect(file: File): Promise<tools.Mime | null> {
+    const bytes = new Uint8Array(await file.slice(0, 1445).arrayBuffer());
+
+    if (bytes.length === 0) return null;
+    if (bytes.some(isControlByte)) return null;
+
+    const text = new TextDecoder().decode(bytes);
+
+    if (text.includes("\ufffd")) return null;
+    if (text.trimStart().startsWith("<")) return null;
+
+    return this.mime;
+  }
+}

package/src/file-type-detector.strategy.ts

@@ -0,0 +1,5 @@
+import type * as tools from "@bgord/tools";
+
+export interface FileTypeDetectorStrategy {
+  detect(file: File): Promise<tools.Mime | null>;
+}

package/src/file-uploader-hono.middleware.ts

@@ -1,14 +1,17 @@
 import { createMiddleware } from "hono/factory";
 import { HTTPException } from "hono/http-exception";
+import type { FileTypeDetectorStrategy } from "./file-type-detector.strategy";
 import { type FileUploaderConfig, FileUploaderMiddleware } from "./file-uploader.middleware";
 import type { MiddlewareHonoPort } from "./middleware-hono.port";
 import { RequestContextHonoAdapter } from "./request-context-hono.adapter";
 
+type Dependencies = { FileTypeDetector: FileTypeDetectorStrategy };
+
 export class FileUploaderHonoMiddleware implements MiddlewareHonoPort {
   private readonly middleware: FileUploaderMiddleware;
 
-  constructor(config: FileUploaderConfig) {
-    this.middleware = new FileUploaderMiddleware(config);
+  constructor(config: FileUploaderConfig, deps: Dependencies) {
+    this.middleware = new FileUploaderMiddleware(config, deps);
   }
 
   handle() {

package/src/file-uploader.middleware.ts

@@ -1,8 +1,11 @@
 import * as tools from "@bgord/tools";
+import type { FileTypeDetectorStrategy } from "./file-type-detector.strategy";
 import type { HasRequestForm } from "./request-context.port";
 
 export type FileUploaderConfig = { MimeRegistry: tools.MimeRegistry; maxSize: tools.Size; field: string };
 
+type Dependencies = { FileTypeDetector: FileTypeDetectorStrategy };
+
 export const FileUploaderError = {
   MissingFile: "file.uploader.missing.file",
   EmptyFile: "file.uploader.empty.file",
@@ -15,7 +18,10 @@ export type FileValidationError = (typeof FileUploaderError)[keyof typeof FileUp
 export type FileValidationResult = { valid: true } | { valid: false; error: FileValidationError };
 
 export class FileUploaderMiddleware {
-  constructor(private readonly config: FileUploaderConfig) {}
+  constructor(
+    private readonly config: FileUploaderConfig,
+    private readonly deps: Dependencies,
+  ) {}
 
   async validate(context: HasRequestForm): Promise<FileValidationResult> {
     const form = await context.request.form();
@@ -28,8 +34,9 @@ export class FileUploaderMiddleware {
 
     if (size.isGreaterThan(this.config.maxSize)) return { valid: false, error: FileUploaderError.SizeLimit };
 
-    // TODO: MIME spoofing possible by reading client-supplied file.type
-    const mime = tools.Mime.fromString(file.type);
+    const mime = await this.deps.FileTypeDetector.detect(file);
+
+    if (!mime) return { valid: false, error: FileUploaderError.InvalidMime };
 
     if (!this.config.MimeRegistry.hasMime(mime)) {
       return { valid: false, error: FileUploaderError.InvalidMime };

package/src/hcaptcha.service.ts

@@ -4,14 +4,11 @@ export const HCaptchaServiceError = { Error: "hcaptcha.service.error" };
 
 type HcaptchaTokenType = string;
 
-export type HCaptchaVerificationResult = { success: boolean };
+export type HCaptchaVerificationResult = { success: boolean; hostname?: string };
 
 export class HCaptchaService {
-  async verify(
-    secretKey: HCaptchaSecretKeyType,
-    token: HcaptchaTokenType,
-  ): Promise<HCaptchaVerificationResult> {
-    const body = new URLSearchParams({ secret: secretKey, response: token });
+  async verify(secret: HCaptchaSecretKeyType, token: HcaptchaTokenType): Promise<HCaptchaVerificationResult> {
+    const body = new URLSearchParams({ secret, response: token });
 
     const response = await fetch("https://hcaptcha.com/siteverify", {
       method: "POST",

package/src/healthcheck.handler.ts

@@ -37,7 +37,7 @@ export type HealthcheckDependencies = {
 export type HealthcheckConfig = {
   Env: NodeEnvironmentEnum;
   prerequisites: ReadonlyArray<Prerequisite>;
-  redactor?: RedactorStrategy;
+  redactor: RedactorStrategy;
 };
 
 const self = new Prerequisite("self", new PrerequisiteVerifierSelfAdapter());
@@ -111,7 +111,7 @@ export class HealthcheckHandler {
 
         return {
           label: prerequisite.label,
-          outcome: this.config.redactor ? this.config.redactor.redact(outcome) : outcome,
+          outcome: this.config.redactor.redact(outcome),
           ms: stopwatch.stop().ms,
         };
       }),

package/src/index.ts

@@ -180,6 +180,10 @@ export * from "./file-renamer.port";
 export * from "./file-renamer-node.adapter";
 export * from "./file-renamer-node-forgiving.adapter";
 export * from "./file-renamer-noop.adapter";
+export * from "./file-type-detector.strategy";
+export * from "./file-type-detector-fixed.strategy";
+export * from "./file-type-detector-magic-bytes.strategy";
+export * from "./file-type-detector-text.strategy";
 export * from "./file-uploader.middleware";
 export * from "./file-uploader-hono.middleware";
 export * from "./file-writer.adapter";
@@ -537,6 +541,7 @@ export * from "./subject-segment-method.strategy";
 export * from "./subject-segment-param.strategy";
 export * from "./subject-segment-path.strategy";
 export * from "./subject-segment-query.strategy";
+export * from "./subject-segment-remote-ip.strategy";
 export * from "./subject-segment-request.strategy";
 export * from "./subject-segment-user.strategy";
 export * from "./temporary-file.port";
@@ -576,6 +581,7 @@ export * from "./weak-etag-extractor-header.strategy";
 export * from "./weak-etag-extractor-hono.middleware";
 export * from "./weak-etag-extractor-param.strategy";
 export * from "./webhook-body-builder.strategy";
+export * from "./webhook-body-builder-signed-headers.strategy";
 export * from "./webhook-body-builder-text.strategy";
 export * from "./webhook-id.vo";
 export * from "./webhook-id-extractor.strategy";

package/src/language-detector-header.strategy.ts

@@ -23,7 +23,6 @@ export class LanguageDetectorHeaderStrategy<T extends tools.LanguageType>
           quality: Number(quality.replace("q=", "")),
         };
       })
-      // Quality of 0 means the language is explicitly not acceptable
       .filter((candidate) => candidate.quality > 0)
       .sort((first, second) => second.quality - first.quality)
       .map((candidate) => candidate.language);

package/src/readiness.handler.ts

@@ -3,8 +3,12 @@ import {
   PrerequisiteVerificationOutcome,
   type PrerequisiteVerificationResult,
 } from "./prerequisite-verifier.port";
+import type { RedactorStrategy } from "./redactor.strategy";
 
-export type ReadinessConfig = { prerequisites: ReadonlyArray<Prerequisite> };
+export type ReadinessConfig = {
+  prerequisites: ReadonlyArray<Prerequisite>;
+  redactor: RedactorStrategy;
+};
 
 export enum ReadinessStatusCode {
   Ready = 200,
@@ -28,7 +32,7 @@ export class ReadinessHandler {
     const details = await Promise.all(
       prerequisites.map(async (prerequisite) => ({
         label: prerequisite.label,
-        outcome: await prerequisite.build().verify(),
+        outcome: this.config.redactor.redact(await prerequisite.build().verify()),
       })),
     );
 

package/src/remote-file-storage-disk.adapter.ts

@@ -37,7 +37,10 @@ export class RemoteFileStorageDiskAdapter implements RemoteFileStoragePort {
     const parts = key.split("/");
     const filename = tools.Filename.fromString(parts.pop() as string);
 
-    const directory = v.parse(tools.DirectoryPathAbsoluteSchema, `${this.config.root}/${parts.join("/")}`);
+    if (parts.length === 0) return tools.FilePathAbsolute.fromPartsSafe(this.config.root, filename);
+
+    const base = this.config.root === "/" ? "" : this.config.root;
+    const directory = v.parse(tools.DirectoryPathAbsoluteSchema, `${base}/${parts.join("/")}`);
 
     return tools.FilePathAbsolute.fromPartsSafe(directory, filename);
   }

package/src/sealer-aes-gcm.adapter.ts

@@ -34,9 +34,13 @@ export class SealerAesGcmAdapter implements SealerPort {
 
     const key = await this.deps.CryptoKeyProvider.get();
 
-    const encrypted = Uint8Array.fromBase64(value.slice(SealerAesGcmAdapter.PREFIX.length));
-    const plaintext = await CryptoAesGcm.decrypt(key, encrypted);
+    try {
+      const encrypted = Uint8Array.fromBase64(value.slice(SealerAesGcmAdapter.PREFIX.length));
+      const plaintext = await CryptoAesGcm.decrypt(key, encrypted);
 
-    return JSON.parse(new TextDecoder().decode(plaintext));
+      return JSON.parse(new TextDecoder().decode(plaintext));
+    } catch {
+      throw new Error(SealerAesGcmAdapterError.InvalidPayload);
+    }
   }
 }

package/src/security-rule-user-agent.strategy.ts

@@ -1,6 +1,5 @@
 import * as v from "valibot";
 import { ALL_BOTS } from "./bots.vo";
-import { Client } from "./client.vo";
 import type { RequestContext } from "./request-context.port";
 import type { SecurityRuleStrategy } from "./security-rule.strategy";
 import { SecurityRuleName, type SecurityRuleNameType } from "./security-rule-name.vo";
@@ -9,9 +8,11 @@ export class SecurityRuleUserAgentStrategy implements SecurityRuleStrategy {
   constructor(private readonly blacklist: ReadonlyArray<string> = ALL_BOTS) {}
 
   async isViolated(context: RequestContext): Promise<boolean> {
-    const client = Client.fromParts(context.identity.ip(), context.identity.ua());
+    const ua = context.identity.ua()?.toLowerCase();
 
-    return this.blacklist.some((bot) => client.hasSameUa(Client.fromParts(undefined, bot)));
+    if (!ua) return false;
+
+    return this.blacklist.some((bot) => ua.includes(bot.toLowerCase()));
   }
 
   get name(): SecurityRuleNameType {

package/src/security-rule-violation-threshold.strategy.ts

@@ -7,25 +7,31 @@ import type { SecurityRuleStrategy } from "./security-rule.strategy";
 import { SecurityRuleName, type SecurityRuleNameType } from "./security-rule-name.vo";
 import { SubjectRequestResolver } from "./subject-request-resolver.vo";
 import { SubjectSegmentFixedStrategy } from "./subject-segment-fixed.strategy";
-import { SubjectSegmentIpStrategy } from "./subject-segment-ip.strategy";
+import type { SubjectSegmentRequestStrategy } from "./subject-segment-request.strategy";
 
 type Dependencies = { CacheRepository: CacheRepositoryPort; HashContent: HashContentStrategy };
-type Config = { threshold: tools.IntegerPositiveType };
+type Config = {
+  threshold: tools.IntegerPositiveType;
+  segments: ReadonlyArray<SubjectSegmentRequestStrategy>;
+};
 
 export class SecurityRuleViolationThresholdStrategy implements SecurityRuleStrategy {
+  private readonly resolver: SubjectRequestResolver;
+
   constructor(
     private readonly rule: SecurityRuleStrategy,
     private readonly config: Config,
     private readonly deps: Dependencies,
-  ) {}
+  ) {
+    this.resolver = new SubjectRequestResolver(
+      [new SubjectSegmentFixedStrategy(this.name), ...this.config.segments],
+      this.deps,
+    );
+  }
 
   // Best-effort increment, occasional lost increments are acceptable for concurrent requests.
   async isViolated(context: RequestContext): Promise<boolean> {
-    const resolver = new SubjectRequestResolver(
-      [new SubjectSegmentFixedStrategy(this.name), new SubjectSegmentIpStrategy()],
-      this.deps,
-    );
-    const subject = await resolver.resolve(context);
+    const subject = await this.resolver.resolve(context);
 
     const violated = await this.rule.isViolated(context);
 

package/src/shield-body-limit.strategy.ts

@@ -12,9 +12,11 @@ export class ShieldBodyLimitStrategy {
   evaluate(context: HasRequestHeader): boolean {
     const header = context.request.header("content-length");
 
+    if (header === undefined) return true;
+
     const contentLength = v.safeParse(tools.SizeBytes, Number(header));
 
-    if (!contentLength.success) return true;
+    if (!contentLength.success) return false;
 
     const size = tools.Size.fromBytes(contentLength.output);
 

package/src/shield-hcaptcha-hono-local.strategy.ts

@@ -18,8 +18,13 @@ export class ShieldHcaptchaLocalHonoStrategy implements MiddlewareHonoPort {
 
   private static readonly TOKEN_LOCAL = "10000000-aaaa-bbbb-cccc-000000000001";
 
+  private static readonly HOSTNAME_LOCAL = "local-pass";
+
   constructor() {
-    this.strategy = new ShieldHcaptchaStrategy(ShieldHcaptchaLocalHonoStrategy.SECRET_KEY_LOCAL);
+    this.strategy = new ShieldHcaptchaStrategy({
+      secretKey: ShieldHcaptchaLocalHonoStrategy.SECRET_KEY_LOCAL,
+      hostname: ShieldHcaptchaLocalHonoStrategy.HOSTNAME_LOCAL,
+    });
   }
 
   handle(): MiddlewareHandler {

package/src/shield-hcaptcha-hono.strategy.ts

@@ -1,15 +1,18 @@
 import type { MiddlewareHandler } from "hono";
 import { HTTPException } from "hono/http-exception";
-import type { HCaptchaSecretKeyType } from "./hcaptcha-secret-key.vo";
 import type { MiddlewareHonoPort } from "./middleware-hono.port";
 import { RequestContextHonoAdapter } from "./request-context-hono.adapter";
-import { ShieldHcaptchaStrategy, ShieldHcaptchaStrategyError } from "./shield-hcaptcha.strategy";
+import {
+  type ShieldHcaptchaConfig,
+  ShieldHcaptchaStrategy,
+  ShieldHcaptchaStrategyError,
+} from "./shield-hcaptcha.strategy";
 
 export class ShieldHcaptchaHonoStrategy implements MiddlewareHonoPort {
   private readonly strategy: ShieldHcaptchaStrategy;
 
-  constructor(secretKey: HCaptchaSecretKeyType) {
-    this.strategy = new ShieldHcaptchaStrategy(secretKey);
+  constructor(config: ShieldHcaptchaConfig) {
+    this.strategy = new ShieldHcaptchaStrategy(config);
   }
 
   handle(): MiddlewareHandler {