@bgord/bun 1.9.0 → 1.9.2

package/src/security-rule-fail.strategy.ts

@@ -0,0 +1,12 @@
+import type { SecurityRuleStrategy } from "./security-rule.strategy";
+import { SecurityRuleName } from "./security-rule-name.vo";
+
+export class SecurityRuleFailStrategy implements SecurityRuleStrategy {
+  async isViolated() {
+    return true;
+  }
+
+  get name() {
+    return SecurityRuleName.parse("fail");
+  }
+}

package/src/security-rule-honey-pot-field.strategy.ts

@@ -0,0 +1,20 @@
+import type { Context } from "hono";
+import type { SecurityRuleStrategy } from "./security-rule.strategy";
+import { SecurityRuleName } from "./security-rule-name.vo";
+
+export class SecurityRuleHoneyPotFieldStrategy implements SecurityRuleStrategy {
+  constructor(private readonly field: string) {}
+
+  async isViolated(c: Context) {
+    const request = c.req.raw.clone();
+
+    const body = await request.json().catch(() => ({}));
+    const value = body[this.field];
+
+    return value !== undefined && value !== null && value !== "";
+  }
+
+  get name() {
+    return SecurityRuleName.parse("honey_pot_field");
+  }
+}

package/src/security-rule-name.vo.ts

@@ -0,0 +1,22 @@
+import * as z from "zod/v4";
+
+export const SecurityRuleNameError = {
+  Type: "security.rule.name.type",
+  Empty: "security.rule.name.empty",
+  TooLong: "security.rule.name.too.long",
+  BadChars: "security.rule.name.bad.chars",
+};
+
+// One to sixty four letters, digits, or underscores
+const CHARS_WHITELIST = /^[a-zA-Z0-9_]{1,512}$/;
+
+// Stryker disable all
+export const SecurityRuleName = z
+  // Stryker restore all
+  .string(SecurityRuleNameError.Type)
+  .min(1, SecurityRuleNameError.Empty)
+  .max(512, SecurityRuleNameError.TooLong)
+  .regex(CHARS_WHITELIST, SecurityRuleNameError.BadChars)
+  .brand("SecurityRuleName");
+
+export type SecurityRuleNameType = z.infer<typeof SecurityRuleName>;

package/src/security-rule-or.strategy.ts

@@ -0,0 +1,25 @@
+import type { Context } from "hono";
+import type { SecurityRuleStrategy } from "./security-rule.strategy";
+import { SecurityRuleName } from "./security-rule-name.vo";
+
+export const SecurityRuleOrStrategyError = {
+  MissingRules: "security.rule.or.adapter.error.missing.rules",
+  MaxRules: "security.rule.or.adapter.error.max.rules",
+};
+
+export class SecurityRuleOrStrategy implements SecurityRuleStrategy {
+  constructor(private readonly rules: SecurityRuleStrategy[]) {
+    if (rules.length === 0) throw new Error(SecurityRuleOrStrategyError.MissingRules);
+    if (rules.length > 5) throw new Error(SecurityRuleOrStrategyError.MaxRules);
+  }
+
+  async isViolated(c: Context) {
+    const reports = await Promise.all(this.rules.map((rule) => rule.isViolated(c)));
+
+    return reports.some(Boolean);
+  }
+
+  get name() {
+    return SecurityRuleName.parse(`or_${this.rules.map((rule) => rule.name).join("_")}`);
+  }
+}

package/src/security-rule-pass.strategy.ts

@@ -0,0 +1,12 @@
+import type { SecurityRuleStrategy } from "./security-rule.strategy";
+import { SecurityRuleName } from "./security-rule-name.vo";
+
+export class SecurityRulePassStrategy implements SecurityRuleStrategy {
+  async isViolated() {
+    return false;
+  }
+
+  get name() {
+    return SecurityRuleName.parse("pass");
+  }
+}

package/src/security-rule-user-agent.strategy.ts

@@ -0,0 +1,20 @@
+import type { Context } from "hono";
+import { ALL_BOTS } from "./bots.vo";
+import { ClientFromHono } from "./client-from-hono.adapter";
+import { ClientUserAgent } from "./client-user-agent.vo";
+import type { SecurityRuleStrategy } from "./security-rule.strategy";
+import { SecurityRuleName } from "./security-rule-name.vo";
+
+export class SecurityRuleUserAgentStrategy implements SecurityRuleStrategy {
+  constructor(private readonly blacklist: string[] = ALL_BOTS) {}
+
+  async isViolated(c: Context) {
+    const client = ClientFromHono.translate(c);
+
+    return this.blacklist.some((bot) => client.matchesUa(ClientUserAgent.parse(bot)));
+  }
+
+  get name() {
+    return SecurityRuleName.parse("user_agent");
+  }
+}

package/src/security-rule-violation-threshold.strategy.ts

@@ -0,0 +1,50 @@
+import * as tools from "@bgord/tools";
+import type { Context } from "hono";
+import type { CacheRepositoryPort } from "./cache-repository.port";
+import { CacheSubjectRequestResolver } from "./cache-subject-request-resolver.vo";
+import { CacheSubjectSegmentFixedStrategy } from "./cache-subject-segment-fixed.strategy";
+import { CacheSubjectSegmentIpStrategy } from "./cache-subject-segment-ip.strategy";
+import type { HashContentStrategy } from "./hash-content.strategy";
+import type { SecurityRuleStrategy } from "./security-rule.strategy";
+import { SecurityRuleName } from "./security-rule-name.vo";
+
+type Dependencies = { CacheRepository: CacheRepositoryPort; HashContent: HashContentStrategy };
+
+export class SecurityRuleViolationThresholdStrategy implements SecurityRuleStrategy {
+  constructor(
+    private readonly rule: SecurityRuleStrategy,
+    private readonly config: { threshold: tools.IntegerPositiveType },
+    private readonly deps: Dependencies,
+  ) {}
+
+  // Best-effort increment, occasional lost increments are acceptable for concurrent requests.
+  async isViolated(c: Context) {
+    const resolver = new CacheSubjectRequestResolver(
+      [new CacheSubjectSegmentFixedStrategy(this.name), new CacheSubjectSegmentIpStrategy()],
+      this.deps,
+    );
+    const subject = await resolver.resolve(c);
+
+    const violated = await this.rule.isViolated(c);
+
+    if (!violated) return false;
+
+    try {
+      const count = (await this.deps.CacheRepository.get<tools.IntegerNonNegativeType>(subject.hex)) ?? 0;
+
+      await this.deps.CacheRepository.set<tools.IntegerNonNegativeType>(
+        subject.hex,
+        tools.IntegerNonNegative.parse(count + 1),
+      );
+
+      if (count + 1 >= this.config.threshold) return true;
+      return false;
+    } catch {
+      return false;
+    }
+  }
+
+  get name() {
+    return SecurityRuleName.parse(`violation_threshold_${this.config.threshold}_${this.rule.name}`);
+  }
+}

package/src/security-rule.strategy.ts

@@ -0,0 +1,8 @@
+import type { Context } from "hono";
+import type { SecurityRuleNameType } from "./security-rule-name.vo";
+
+export interface SecurityRuleStrategy {
+  isViolated(c: Context): Promise<boolean>;
+
+  get name(): SecurityRuleNameType;
+}

package/src/setup.service.ts

@@ -0,0 +1,102 @@
+import * as tools from "@bgord/tools";
+import { bodyLimit } from "hono/body-limit";
+import { cors } from "hono/cors";
+import { languageDetector } from "hono/language";
+import { requestId } from "hono/request-id";
+import { secureHeaders } from "hono/secure-headers";
+import { timing } from "hono/timing";
+import { ApiVersion } from "./api-version.middleware";
+import type { BuildInfoRepositoryStrategy } from "./build-info-repository.strategy";
+import type { CacheResolverStrategy } from "./cache-resolver.strategy";
+import type { ClockPort } from "./clock.port";
+import { Context } from "./context.middleware";
+import { CorrelationStorage } from "./correlation-storage.service";
+import { ETagExtractor } from "./etag-extractor.middleware";
+import type { HashContentStrategy } from "./hash-content.strategy";
+import { HttpLogger, type HttpLoggerOptions } from "./http-logger.middleware";
+import type { I18nConfigType } from "./i18n.service";
+import type { IdProviderPort } from "./id-provider.port";
+import type { LoggerPort } from "./logger.port";
+import { MaintenanceMode, type MaintenanceModeConfigType } from "./maintenance-mode.middleware";
+import { type ShieldCsrfConfigType, ShieldCsrfStrategy } from "./shield-csrf.strategy";
+import { TimeZoneOffset } from "./time-zone-offset.middleware";
+import { WeakETagExtractor } from "./weak-etag-extractor.middleware";
+
+type SetupConfigType = {
+  csrf: ShieldCsrfConfigType;
+  cors?: Parameters<typeof cors>[0];
+  httpLogger?: HttpLoggerOptions;
+  maintenanceMode?: MaintenanceModeConfigType;
+  BODY_LIMIT_MAX_SIZE?: tools.Size;
+};
+
+type Dependencies = {
+  Logger: LoggerPort;
+  IdProvider: IdProviderPort;
+  I18n: I18nConfigType;
+  Clock: ClockPort;
+  CacheResolver: CacheResolverStrategy;
+  HashContent: HashContentStrategy;
+  BuildInfoRepository: BuildInfoRepositoryStrategy;
+};
+
+export class Setup {
+  static essentials(config: SetupConfigType, deps: Dependencies) {
+    const BODY_LIMIT_MAX_SIZE = config.BODY_LIMIT_MAX_SIZE ?? tools.Size.fromKb(128);
+
+    return [
+      MaintenanceMode.build(config.maintenanceMode),
+      requestId({
+        limitLength: 36,
+        headerName: "x-correlation-id",
+        generator: () => deps.IdProvider.generate(),
+      }),
+      ApiVersion.build(deps),
+      new ShieldCsrfStrategy(config.csrf).verify,
+      secureHeaders({
+        referrerPolicy: "no-referrer",
+        xContentTypeOptions: "nosniff",
+        xDnsPrefetchControl: false,
+        xDownloadOptions: true,
+        xPermittedCrossDomainPolicies: false,
+        crossOriginEmbedderPolicy: false,
+        crossOriginOpenerPolicy: false,
+        crossOriginResourcePolicy: false,
+        originAgentCluster: false,
+        xFrameOptions: false,
+      }),
+      bodyLimit({ maxSize: BODY_LIMIT_MAX_SIZE.toBytes() }),
+      cors({
+        // Stryker disable all
+        origin: (origin, c) => {
+          // server-to-server, curl, same-origin navigation
+          if (!origin) return undefined;
+
+          // same-origin fetch
+          if (origin === new URL(c.req.url).origin) return origin;
+
+          // deny cross-origin
+          return null;
+        },
+        // Stryker restore all
+        credentials: false,
+        maxAge: tools.Duration.Minutes(10).seconds,
+        ...config.cors,
+      }),
+      languageDetector({
+        supportedLanguages: Object.keys(deps.I18n.supportedLanguages),
+        fallbackLanguage: deps.I18n.defaultLanguage,
+        // Stryker disable all
+        caches: false,
+        // Stryker restore all
+      }),
+      TimeZoneOffset.attach,
+      Context.attach,
+      WeakETagExtractor.attach,
+      ETagExtractor.attach,
+      HttpLogger.build(deps, config.httpLogger),
+      timing(),
+      CorrelationStorage.handle(),
+    ];
+  }
+}

package/src/shield-api-key.strategy.ts

@@ -0,0 +1,20 @@
+import type * as tools from "@bgord/tools";
+import { createMiddleware } from "hono/factory";
+import { HTTPException } from "hono/http-exception";
+import type { ShieldStrategy } from "./shield.strategy";
+
+type ApiKeyShieldConfigType = { API_KEY: tools.ApiKeyType };
+
+export const ShieldApiKeyError = new HTTPException(403, { message: "shield.api.key" });
+
+export class ShieldApiKeyStrategy implements ShieldStrategy {
+  static readonly HEADER_NAME = "bgord-api-key";
+
+  constructor(private readonly config: ApiKeyShieldConfigType) {}
+
+  verify = createMiddleware(async (context, next) => {
+    if (context.req.header(ShieldApiKeyStrategy.HEADER_NAME) === this.config.API_KEY) return next();
+
+    throw ShieldApiKeyError;
+  });
+}

package/src/shield-auth.strategy.ts

@@ -0,0 +1,38 @@
+import type { betterAuth } from "better-auth";
+import type hono from "hono";
+import { createMiddleware } from "hono/factory";
+import { HTTPException } from "hono/http-exception";
+
+export const ShieldAuthError = new HTTPException(403, { message: "shield.auth" });
+
+export class ShieldAuthStrategy {
+  constructor(private readonly Auth: ReturnType<typeof betterAuth>) {}
+
+  attach = createMiddleware(async (c: hono.Context, next: hono.Next) => {
+    const session = await this.Auth.api.getSession({ headers: c.req.raw.headers });
+
+    if (!session) {
+      c.set("user", null);
+      c.set("session", null);
+      return next();
+    }
+
+    c.set("user", session.user);
+    c.set("session", session.session);
+    return next();
+  });
+
+  verify = createMiddleware(async (c: hono.Context, next: hono.Next) => {
+    const user = c.get("user");
+
+    if (!user) throw ShieldAuthError;
+    return next();
+  });
+
+  reverse = createMiddleware(async (c: hono.Context, next: hono.Next) => {
+    const user = c.get("user");
+
+    if (user) throw ShieldAuthError;
+    return next();
+  });
+}

package/src/shield-basic-auth.strategy.ts

@@ -0,0 +1,17 @@
+import { basicAuth } from "hono/basic-auth";
+import { createMiddleware } from "hono/factory";
+import type { BasicAuthPasswordType } from "./basic-auth-password.vo";
+import type { BasicAuthUsernameType } from "./basic-auth-username.vo";
+import type { ShieldStrategy } from "./shield.strategy";
+
+type ShieldBasicAuthConfigType = { username: BasicAuthUsernameType; password: BasicAuthPasswordType };
+
+export class ShieldBasicAuthStrategy implements ShieldStrategy {
+  private readonly basicAuth;
+
+  constructor(config: ShieldBasicAuthConfigType) {
+    this.basicAuth = basicAuth(config);
+  }
+
+  verify = createMiddleware(async (context, next) => this.basicAuth(context, next));
+}

package/src/shield-csrf.strategy.ts

@@ -0,0 +1,23 @@
+import { createMiddleware } from "hono/factory";
+import { HTTPException } from "hono/http-exception";
+import type { ShieldStrategy } from "./shield.strategy";
+
+const STATE_CHANGING_METHODS = ["POST", "PUT", "PATCH", "DELETE"];
+
+export type ShieldCsrfConfigType = { origin: string[] };
+
+export const ShieldCsrfError = new HTTPException(403, { message: "shield.csrf" });
+
+export class ShieldCsrfStrategy implements ShieldStrategy {
+  constructor(private readonly config: ShieldCsrfConfigType) {}
+
+  verify = createMiddleware(async (context, next) => {
+    if (!STATE_CHANGING_METHODS.includes(context.req.method)) return next();
+
+    const origin = context.req.header("origin");
+
+    if (!origin) return next();
+    if (!this.config.origin.includes(origin)) throw ShieldCsrfError;
+    return next();
+  });
+}

package/src/shield-hcaptcha-local.strategy.ts

@@ -0,0 +1,22 @@
+import hcaptcha from "hcaptcha";
+import { createMiddleware } from "hono/factory";
+import { HTTPException } from "hono/http-exception";
+import type { HCaptchaSecretKeyType } from "./hcaptcha-secret-key.vo";
+import type { ShieldStrategy } from "./shield.strategy";
+
+export const ShieldHcaptchaLocalError = new HTTPException(403, { message: "shield.hcaptcha.local" });
+
+export class ShieldHcaptchaLocalStrategy implements ShieldStrategy {
+  constructor(private readonly secretKey: HCaptchaSecretKeyType) {}
+
+  verify = createMiddleware(async (_, next) => {
+    try {
+      const result = await hcaptcha.verify(this.secretKey, "10000000-aaaa-bbbb-cccc-000000000001");
+
+      if (!result.success) throw ShieldHcaptchaLocalError;
+      return next();
+    } catch {
+      throw ShieldHcaptchaLocalError;
+    }
+  });
+}

package/src/shield-hcaptcha.strategy.ts

@@ -0,0 +1,24 @@
+import hcaptcha from "hcaptcha";
+import { createMiddleware } from "hono/factory";
+import { HTTPException } from "hono/http-exception";
+import type { HCaptchaSecretKeyType } from "./hcaptcha-secret-key.vo";
+import type { ShieldStrategy } from "./shield.strategy";
+
+export const ShieldHcaptchaError = new HTTPException(403, { message: "shield.hcaptcha" });
+
+export class ShieldHcaptchaStrategy implements ShieldStrategy {
+  constructor(private readonly secretKey: HCaptchaSecretKeyType) {}
+
+  verify = createMiddleware(async (context, next) => {
+    try {
+      const form = await context.req.formData();
+      const hcaptchaTokenFormData = form.get("h-captcha-response")?.toString() as string;
+      const result = await hcaptcha.verify(this.secretKey, hcaptchaTokenFormData);
+
+      if (!result.success) throw ShieldHcaptchaError;
+      return next();
+    } catch {
+      throw ShieldHcaptchaError;
+    }
+  });
+}

package/src/shield-noop.strategy.ts

@@ -0,0 +1,6 @@
+import { createMiddleware } from "hono/factory";
+import type { ShieldStrategy } from "./shield.strategy";
+
+export class ShieldNoopStrategy implements ShieldStrategy {
+  verify = createMiddleware(async (_, next) => next());
+}

package/src/shield-rate-limit.strategy.ts

@@ -0,0 +1,41 @@
+import * as tools from "@bgord/tools";
+import { createMiddleware } from "hono/factory";
+import { HTTPException } from "hono/http-exception";
+import type { CacheResolverStrategy } from "./cache-resolver.strategy";
+import type { CacheSubjectRequestResolver } from "./cache-subject-request-resolver.vo";
+import type { ClockPort } from "./clock.port";
+import type { ShieldStrategy } from "./shield.strategy";
+
+type ShieldRateLimitOptionsType = {
+  enabled: boolean;
+  resolver: CacheSubjectRequestResolver;
+  window: tools.Duration;
+};
+
+type Dependencies = { Clock: ClockPort; CacheResolver: CacheResolverStrategy };
+
+export const ShieldRateLimitError = new HTTPException(429, { message: "shield.rate.limit" });
+
+export class ShieldRateLimitStrategy implements ShieldStrategy {
+  constructor(
+    private readonly options: ShieldRateLimitOptionsType,
+    private readonly deps: Dependencies,
+  ) {}
+
+  verify = createMiddleware(async (context, next) => {
+    if (!this.options.enabled) return next();
+
+    const subject = await this.options.resolver.resolve(context);
+
+    const limiter = await this.deps.CacheResolver.resolve(
+      subject.hex,
+      async () => new tools.RateLimiter(this.options.window),
+    );
+
+    const result = limiter.verify(this.deps.Clock.now());
+
+    if (!result.allowed) throw ShieldRateLimitError;
+
+    return next();
+  });
+}

package/src/shield-recaptcha.strategy.ts

@@ -0,0 +1,49 @@
+import * as tools from "@bgord/tools";
+import { createMiddleware } from "hono/factory";
+import { HTTPException } from "hono/http-exception";
+import type { RecaptchaSecretKeyType } from "./recaptcha-secret-key.vo";
+import type { ShieldStrategy } from "./shield.strategy";
+
+export type RecaptchaVerifierConfigType = { secretKey: RecaptchaSecretKeyType };
+export type RecaptchaResultType = { success: boolean; score: number };
+
+export const ShieldRecaptchaError = new HTTPException(403, { message: "shield.recaptcha" });
+
+export class ShieldRecaptchaStrategy implements ShieldStrategy {
+  private static readonly URL = tools.UrlWithoutSlash.parse(
+    "https://www.google.com/recaptcha/api/siteverify",
+  );
+
+  constructor(private readonly config: RecaptchaVerifierConfigType) {}
+
+  verify = createMiddleware(async (context, next) => {
+    try {
+      const header = context.req.header("x-recaptcha-token");
+      const query = context.req.query("recaptchaToken");
+      const form = (await context.req.formData()).get("g-recaptcha-response")?.toString();
+
+      const token = header ?? query ?? form;
+
+      if (!token) throw ShieldRecaptchaError;
+
+      // cSpell:ignore remoteip
+      const remoteip = context.req.header("x-forwarded-for") ?? "";
+
+      const params = new URLSearchParams({ secret: this.config.secretKey, response: token, remoteip });
+
+      const response = await fetch(ShieldRecaptchaStrategy.URL, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: params,
+      });
+
+      const result: RecaptchaResultType = await response.json();
+
+      if (!result.success || result.score < 0.5) throw ShieldRecaptchaError;
+
+      await next();
+    } catch {
+      throw ShieldRecaptchaError;
+    }
+  });
+}

package/src/shield-security.strategy.ts

@@ -0,0 +1,80 @@
+import { createMiddleware } from "hono/factory";
+import type { ContentfulStatusCode } from "hono/utils/http-status";
+import { ClientFromHono } from "./client-from-hono.adapter";
+import { SecurityContext } from "./security-context.vo";
+import type { SecurityPolicy } from "./security-policy.vo";
+import type { ShieldStrategy } from "./shield.strategy";
+import type { SleeperPort } from "./sleeper.port";
+
+type Dependencies = { Sleeper: SleeperPort };
+
+export const ShieldSecurityAdapterError = {
+  Unhandled: "shield.security.adapter.error.unhandled",
+  MissingPolicies: "shield.security.adapter.error.missing.policies",
+  MaxPolicies: "shield.security.adapter.error.max.policies",
+};
+
+export class ShieldSecurityStrategy implements ShieldStrategy {
+  constructor(
+    private readonly policies: SecurityPolicy[],
+    private readonly deps: Dependencies,
+  ) {
+    if (policies.length === 0) throw new Error(ShieldSecurityAdapterError.MissingPolicies);
+    if (policies.length > 5) throw new Error(ShieldSecurityAdapterError.MaxPolicies);
+  }
+
+  verify = createMiddleware(async (c, next) => {
+    for (const policy of this.policies) {
+      const violation = await policy.rule.isViolated(c);
+
+      if (!violation) continue;
+
+      const context = new SecurityContext(
+        policy.rule.name,
+        policy.countermeasure.name,
+        ClientFromHono.translate(c),
+        // Stryker disable all
+        c.get("user")?.id,
+        // Stryker restore all
+      );
+
+      const action = await policy.countermeasure.execute(context);
+
+      // Stryker disable all
+      switch (action.kind) {
+        case "allow":
+          return next();
+
+        case "deny":
+          return c.text(action.reason, action.response.status as ContentfulStatusCode);
+
+        case "mirage":
+          return c.json({}, action.response.status as ContentfulStatusCode);
+
+        case "delay": {
+          await this.deps.Sleeper.wait(action.duration);
+
+          switch (action.after.kind) {
+            case "allow":
+              return next();
+
+            case "deny":
+              return c.text(action.after.reason, action.after.response.status as ContentfulStatusCode);
+
+            case "mirage":
+              return c.json({}, action.after.response.status as ContentfulStatusCode);
+
+            case "delay":
+              throw new Error(ShieldSecurityAdapterError.Unhandled);
+
+            default:
+              throw new Error(ShieldSecurityAdapterError.Unhandled);
+          }
+        }
+      }
+      // Stryker restore all
+    }
+
+    return next();
+  });
+}

package/src/shield-timeout.strategy.ts

@@ -0,0 +1,19 @@
+import type * as tools from "@bgord/tools";
+import { createMiddleware } from "hono/factory";
+import { HTTPException } from "hono/http-exception";
+import { timeout } from "hono/timeout";
+import type { ShieldStrategy } from "./shield.strategy";
+
+export const ShieldTimeoutError = new HTTPException(408, { message: "shield.timeout" });
+
+type ShieldTimeoutConfigType = { duration: tools.Duration };
+
+export class ShieldTimeoutStrategy implements ShieldStrategy {
+  private readonly timeout;
+
+  constructor(config: ShieldTimeoutConfigType) {
+    this.timeout = timeout(config.duration.ms, ShieldTimeoutError);
+  }
+
+  verify = createMiddleware(async (context, next) => this.timeout(context, next));
+}

package/src/shield.strategy.ts

@@ -0,0 +1,5 @@
+import type { MiddlewareHandler } from "hono";
+
+export interface ShieldStrategy {
+  verify: MiddlewareHandler;
+}

package/src/simulated-error.middleware.ts

@@ -0,0 +1,8 @@
+import { createMiddleware } from "hono/factory";
+
+export class SimulatedError {
+  static handle = () =>
+    createMiddleware(async (_, _next) => {
+      throw new Error("Simulated error");
+    });
+}

package/src/sleeper-noop.adapter.ts

@@ -0,0 +1,5 @@
+import type { SleeperPort } from "./sleeper.port";
+
+export class SleeperNoopAdapter implements SleeperPort {
+  async wait() {}
+}

package/src/sleeper-system.adapter.ts

@@ -0,0 +1,8 @@
+import type * as tools from "@bgord/tools";
+import type { SleeperPort } from "./sleeper.port";
+
+export class SleeperSystemAdapter implements SleeperPort {
+  async wait(duration: tools.Duration) {
+    await Bun.sleep(duration.ms);
+  }
+}