@h-ai/serv 0.1.0-alpha.76 → 1.0.0-beta.10

package/dist/index.js

@@ -1,17 +1,16 @@
-import { validateInputOrFail, resolveRequestLocale, localizeZodError } from './chunk-65XNI7TH.js';
-import { servM, WILDCARD_ROLE, WILDCARD_PERMISSION, implement, buildHaiErrorBody } from './chunk-JAQIEQJS.js';
+import { validateInputOrFail, resolveRequestLocale, localizeZodError } from './chunk-IQZQTAEW.js';
+import { servM, WILDCARD_ROLE, WILDCARD_PERMISSION, implement, buildHaiErrorBody } from './chunk-FEG22LCX.js';
 import process from 'process';
 import { upgradeWebSocket, serve } from '@hono/node-server';
+import { posix } from 'path';
 import { apiContract, AUDIO_WS_PATH, AudioWsClientMessageSchema } from '@h-ai/api-contract';
 import { audit } from '@h-ai/audit';
-import { core, HaiCommonError, err, ok } from '@h-ai/core';
+import { core, RequestAccessConfigSchema, TrustedProxiesSchema, HaiCommonError, err, ok } from '@h-ai/core';
 import { TRANSPORT_PLAINTEXT_RANGE, createTransportBodyPolicy, TRANSPORT_PROTOCOL, authenticateTransportRequest, TransportTimeError, createTransportErrorResponse, TransportBodyTooLargeError, readTransportBody, TRANSPORT_BODY_LIMITS, isValidSM2PublicKey } from '@h-ai/crypto';
 import { OpenAPIHandler } from '@orpc/openapi/fetch';
-import { RPCHandler } from '@orpc/server/fetch';
 import { Hono } from 'hono';
 import { WebSocketServer } from 'ws';
 import { Buffer } from 'buffer';
-import { BlockList, isIP } from 'net';
 import { z } from 'zod';
 import { getCookie } from 'hono/cookie';
 import { readFile } from 'fs/promises';
@@ -549,134 +548,6 @@ function toArrayBuffer(data) {
   new Uint8Array(buffer).set(data);
   return buffer;
 }
-function readRemoteAddress(metadata) {
-  if (!metadata || typeof metadata !== "object" || !("remoteAddress" in metadata) || typeof metadata.remoteAddress !== "string")
-    return void 0;
-  return normalizeClientIp(metadata.remoteAddress);
-}
-function normalizeClientIp(value) {
-  if (!value)
-    return void 0;
-  const address = value.trim();
-  if (!isIP(address))
-    return void 0;
-  const mapped = address.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i);
-  return mapped?.[1] ?? address;
-}
-function addProxy(blockList, entry) {
-  const [address, prefix, extra] = entry.split("/");
-  const family = address ? isIP(address) : 0;
-  if (!family || extra !== void 0)
-    throw new Error("trustedProxies entries must be IP addresses or CIDRs");
-  const type = family === 4 ? "ipv4" : "ipv6";
-  if (prefix === void 0) {
-    blockList.addAddress(address, type);
-    return;
-  }
-  const bits = Number(prefix);
-  if (!/^\d+$/.test(prefix) || bits < 0 || bits > (family === 4 ? 32 : 128))
-    throw new Error("Invalid trustedProxies CIDR prefix");
-  blockList.addSubnet(address, bits, type);
-}
-function isTrustedProxyEntry(entry) {
-  try {
-    addProxy(new BlockList(), entry);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function createClientIpResolver(trustedProxies) {
-  const proxies = new BlockList();
-  for (const entry of trustedProxies)
-    addProxy(proxies, entry);
-  const trusted = (address) => proxies.check(address, isIP(address) === 4 ? "ipv4" : "ipv6");
-  return (request, remoteAddress) => {
-    const peer = normalizeClientIp(remoteAddress);
-    if (!peer || !trusted(peer))
-      return peer;
-    const forwarded = request.headers.get("x-forwarded-for");
-    if (forwarded === null) {
-      const realIp = request.headers.get("x-real-ip");
-      return realIp === null ? peer : normalizeClientIp(realIp);
-    }
-    const chain = forwarded.split(",");
-    if (chain.length > 32)
-      return void 0;
-    let current = peer;
-    for (let index = chain.length - 1; index >= 0 && trusted(current); index--) {
-      const address = normalizeClientIp(chain[index]);
-      if (!address)
-        return void 0;
-      current = address;
-    }
-    return current;
-  };
-}
-
-// src/pipelines/serv-pipeline-require-internal-rpc.ts
-var pipelineLogger = core.logger.child({ module: "serv", scope: "pipeline" });
-var cachedGetConnInfo;
-async function resolveGetConnInfo() {
-  if (cachedGetConnInfo !== void 0)
-    return cachedGetConnInfo;
-  try {
-    const mod = await import('@hono/node-server/conninfo');
-    cachedGetConnInfo = mod.getConnInfo;
-  } catch (cause) {
-    pipelineLogger.warn("getConnInfo unavailable in this runtime; loopback/private-network access modes will fail closed", { error: cause });
-    cachedGetConnInfo = null;
-  }
-  return cachedGetConnInfo;
-}
-var LOOPBACK_IPS = /* @__PURE__ */ new Set(["127.0.0.1", "::1", "::ffff:127.0.0.1", "localhost"]);
-function requireInternalRPC(config) {
-  return async (c, next) => {
-    const locale = resolveRequestLocale(c.req.raw.headers);
-    if (config.access === "gateway-only") {
-      const headerName = config.gatewayHeader ?? "x-hai-internal-rpc";
-      const received = c.req.header(headerName);
-      if (!config.gatewaySecret || !received || !core.string.constantTimeEqual(received, config.gatewaySecret))
-        return c.json(buildHaiErrorBody(HaiCommonError.FORBIDDEN, servM("serv_errorForbidden", { locale })), 403);
-      return next();
-    }
-    const ip = await getRequestRemoteAddress(c) ?? "";
-    if (config.access === "loopback" && !isLoopbackIP(ip))
-      return c.json(buildHaiErrorBody(HaiCommonError.FORBIDDEN, servM("serv_errorForbidden", { locale })), 403);
-    if (config.access === "private-network" && !isPrivateNetworkIP(ip))
-      return c.json(buildHaiErrorBody(HaiCommonError.FORBIDDEN, servM("serv_errorForbidden", { locale })), 403);
-    return next();
-  };
-}
-async function getRequestRemoteAddress(c) {
-  const remoteAddress = readRemoteAddress(c.env);
-  if (remoteAddress)
-    return remoteAddress;
-  const getConnInfo = await resolveGetConnInfo();
-  if (!getConnInfo)
-    return void 0;
-  try {
-    return getConnInfo(c).remote.address;
-  } catch {
-    return void 0;
-  }
-}
-function normalizeIpAddress(ip) {
-  return ip.startsWith("::ffff:") ? ip.slice("::ffff:".length) : ip;
-}
-function isLoopbackIP(ip) {
-  const normalized = normalizeIpAddress(ip);
-  return LOOPBACK_IPS.has(ip) || LOOPBACK_IPS.has(normalized);
-}
-function isPrivateNetworkIP(ip) {
-  const normalized = normalizeIpAddress(ip);
-  if (isLoopbackIP(ip))
-    return true;
-  if (normalized.startsWith("10.") || normalized.startsWith("192.168."))
-    return true;
-  const second = Number(normalized.split(".")[1]);
-  return normalized.startsWith("172.") && Number.isInteger(second) && second >= 16 && second <= 31;
-}
 
 // src/pipelines/serv-pipeline-security-headers.ts
 function securityHeaders() {
@@ -687,9 +558,14 @@ function securityHeaders() {
     await next();
   };
 }
+function readRemoteAddress(metadata) {
+  if (!metadata || typeof metadata !== "object" || !("remoteAddress" in metadata) || typeof metadata.remoteAddress !== "string")
+    return void 0;
+  return core.access.normalizeClientIp(metadata.remoteAddress);
+}
 var ApiPrefixSchema = z.custom(
-  (value) => typeof value === "string" && value.startsWith("/api/"),
-  "apiPrefix must start with /api/"
+  (value) => typeof value === "string" && /^\/[\w.-]+(?:\/[\w.-]+)*$/.test(value) && !value.split("/").some((segment) => segment === "." || segment === ".."),
+  { error: () => servM("serv_invalidApiPrefix") }
 );
 var AbsolutePathSchema = z.custom(
   (value) => typeof value === "string" && value.startsWith("/"),
@@ -713,15 +589,6 @@ var HealthHttpConfigInputSchema = z.union([
     readyPath: AbsolutePathSchema.optional().default("/ready")
   })
 ]);
-var RpcHttpConfigInputSchema = z.union([
-  z.literal(false),
-  z.object({
-    prefix: AbsolutePathSchema.default("/rpc"),
-    access: z.enum(["loopback", "private-network", "gateway-only"]).default("loopback"),
-    gatewayHeader: z.string().optional(),
-    gatewaySecret: z.string().optional()
-  })
-]);
 var TransportRuntimeConfigInputSchema = z.union([
   z.literal(false),
   z.object({
@@ -743,12 +610,12 @@ var CorsRuntimeConfigInputSchema = z.object({
   credentials: z.boolean().default(false)
 });
 var ServHttpConfigInputSchema = z.object({
-  trustedProxies: z.array(z.string().trim().refine(isTrustedProxyEntry, "Expected an IP address or CIDR")).default([]),
+  trustedProxies: TrustedProxiesSchema.default("auto"),
+  access: RequestAccessConfigSchema.default(false),
   apiPrefix: ApiPrefixSchema.default("/api/v1"),
   openapi: OpenAPIHttpConfigInputSchema.default(false),
   docs: DocsHttpConfigInputSchema.default(false),
-  health: HealthHttpConfigInputSchema.default({ path: "/health", readyPath: "/ready" }),
-  rpc: RpcHttpConfigInputSchema.default(false)
+  health: HealthHttpConfigInputSchema.default({ path: "/health", readyPath: "/ready" })
 });
 var ServConfigSchema = z.object({
   server: ServerConfigInputSchema.optional(),
@@ -803,7 +670,7 @@ function extractBearerToken(value) {
 function parseRequestContext(input) {
   const headers = input.request.headers;
   const requestId = core.context.get().requestId ?? resolveRequestId(headers.get(HEADER_REQUEST_ID));
-  const ip = normalizeClientIp(Object.hasOwn(input, "ip") ? input.ip : input.remoteAddress);
+  const ip = core.access.normalizeClientIp(Object.hasOwn(input, "ip") ? input.ip : input.remoteAddress);
   const locale = resolveRequestLocale(headers);
   const accessToken = extractBearerToken(headers.get(HEADER_AUTHORIZATION));
   const terminal = headers.get("x-hai-terminal");
@@ -999,6 +866,96 @@ async function readRefreshTokenFromBody(request) {
   const body = await request.json().catch(() => void 0);
   return typeof body?.refreshToken === "string" && body.refreshToken.length > 0 ? body.refreshToken : void 0;
 }
+
+// src/serv-cors.ts
+var DEFAULT_CORS_METHODS = ["GET", "HEAD", "PUT", "PATCH", "POST", "DELETE", "OPTIONS"];
+var DEFAULT_CORS_ALLOWED_HEADERS = ["Authorization", "Content-Type", "X-Requested-With", "X-Hai-Reauthentication", "X-Hai-Terminal"];
+var DEFAULT_CORS_MAX_AGE = 86400;
+var corsMiddlewares = /* @__PURE__ */ new WeakSet();
+function isCorsMiddleware(middleware) {
+  return corsMiddlewares.has(middleware);
+}
+function cors(config = {}) {
+  const methods = [...config.methods ?? DEFAULT_CORS_METHODS];
+  const allowedHeaders = [...config.allowedHeaders ?? DEFAULT_CORS_ALLOWED_HEADERS];
+  const exposedHeaders = [.../* @__PURE__ */ new Set(["X-Request-Id", "X-Trace-Id", ...config.exposedHeaders ?? []])];
+  const credentials = config.credentials ?? false;
+  const maxAge = config.maxAge ?? DEFAULT_CORS_MAX_AGE;
+  const originConfig = config.origin ?? "*";
+  const middleware = async (c, next) => {
+    const allowedOrigin = resolveCorsOrigin(c.req.header("Origin"), originConfig);
+    if (c.req.method === "OPTIONS") {
+      return new Response(null, {
+        status: 204,
+        headers: buildCorsHeaders({
+          allowedOrigin,
+          allowedHeaders,
+          credentials,
+          exposedHeaders,
+          maxAge,
+          methods,
+          request: c.req.raw
+        })
+      });
+    }
+    await next();
+    const corsHeaders = buildCorsHeaders({
+      allowedOrigin,
+      allowedHeaders,
+      credentials,
+      exposedHeaders,
+      maxAge,
+      methods,
+      request: c.req.raw
+    });
+    for (const [key, value] of corsHeaders) {
+      if (key.toLowerCase() === "vary") {
+        c.res.headers.append(key, value);
+        continue;
+      }
+      c.res.headers.set(key, value);
+    }
+    return void 0;
+  };
+  corsMiddlewares.add(middleware);
+  return middleware;
+}
+function resolveCorsOrigin(origin, configOrigin) {
+  if (!origin)
+    return null;
+  if (configOrigin === "*")
+    return "*";
+  if (typeof configOrigin === "string")
+    return origin === configOrigin ? origin : null;
+  if (Array.isArray(configOrigin))
+    return configOrigin.includes(origin) ? origin : null;
+  if (typeof configOrigin === "function")
+    return configOrigin(origin) ? origin : null;
+  return null;
+}
+function buildCorsHeaders(options) {
+  const headers = new Headers();
+  if (!options.allowedOrigin)
+    return headers;
+  const requestedHeaders = options.request.headers.get("Access-Control-Request-Headers");
+  headers.set("Access-Control-Allow-Origin", options.allowedOrigin);
+  if (options.credentials)
+    headers.set("Access-Control-Allow-Credentials", "true");
+  if (options.allowedOrigin !== "*") {
+    headers.set(
+      "Vary",
+      requestedHeaders ? "Origin, Access-Control-Request-Headers" : "Origin"
+    );
+  }
+  if (options.exposedHeaders.length > 0)
+    headers.set("Access-Control-Expose-Headers", options.exposedHeaders.join(", "));
+  if (options.request.method === "OPTIONS") {
+    headers.set("Access-Control-Allow-Methods", options.methods.join(", "));
+    headers.set("Access-Control-Allow-Headers", requestedHeaders ?? options.allowedHeaders.join(", "));
+    headers.set("Access-Control-Max-Age", String(options.maxAge));
+  }
+  return headers;
+}
 var SCALAR_ROUTE = "/_hai/scalar.js";
 var SCALAR_BROWSER_ENTRY_FALLBACK = "./dist/browser/standalone.js";
 var scalarScriptCache;
@@ -1063,12 +1020,20 @@ function readScalarBrowserEntry(packageInfo) {
 }
 var logger2 = core.logger.child({ module: "serv", scope: "transport" });
 var ENCRYPTABLE_RESPONSE_CONTENT_TYPES = ["application/json"];
-function createTransportMiddleware(manager, keyExchangePath, excludePaths = [], policy = createTransportBodyPolicy(manager.bodyLimits.plaintextBytes)) {
+function createTransportMiddleware(manager, keyExchangePath, excludePaths = [], policy = createTransportBodyPolicy(manager.bodyLimits.plaintextBytes), encryption) {
   return async (c, next) => {
     const pathname = new URL(c.req.url).pathname;
+    if (c.req.method === "OPTIONS")
+      return next();
     if (pathname === keyExchangePath && c.req.method === "POST")
       return handleKeyExchange(c.req.raw, manager);
-    if (shouldExclude(pathname, excludePaths, keyExchangePath))
+    const mode = encryption?.(pathname, c.req.method);
+    if (mode === "disabled") {
+      if (c.req.raw.headers.has(TRANSPORT_PROTOCOL.ENCRYPTED_HEADER) || c.req.raw.headers.has(TRANSPORT_PROTOCOL.ENVELOPE_HEADER))
+        return Response.json(err({ ...HaiCommonError.VALIDATION_ERROR, message: servM("serv_transportPlaintextRequired"), traceId: core.context.get().traceId ?? core.context.get().requestId }), { status: 400 });
+      return next();
+    }
+    if (mode !== "required" && shouldExclude(pathname, excludePaths, keyExchangePath))
       return next();
     const clientId = c.req.header(TRANSPORT_PROTOCOL.CLIENT_ID_HEADER);
     if (!clientId)
@@ -1222,7 +1187,10 @@ var API_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"];
 var audioWsServers = /* @__PURE__ */ new WeakMap();
 function createApp(options) {
   const http = resolveServHttpConfig(options.http);
-  const resolveIp = createClientIpResolver(http.trustedProxies);
+  const resolveIp = core.access.createClientIpResolver(http.trustedProxies);
+  const checkAccess = core.access.createRequestCheck(http.access);
+  if (checkAccess.requiresEncryption && !options.transport)
+    throw new Error("Request access rules require transport encryption, but Serv transport is not configured");
   const app = new Hono();
   const requestAuditContexts = /* @__PURE__ */ new WeakMap();
   app.onError((error, c) => {
@@ -1280,8 +1248,45 @@ function createApp(options) {
     return cachedSpec;
   };
   app.use("*", securityHeaders());
-  if (options.middlewares)
-    mountCustomMiddlewares(app, options.middlewares);
+  const accessDenied = (c) => {
+    const ipAddress = resolveIp(c.req.raw, readRemoteAddress(c.env));
+    const decision = checkAccess(c.req.path, c.req.method, ipAddress);
+    if (decision.allowed) {
+      if (!options.transport && c.req.method !== "OPTIONS" && (c.req.raw.headers.has(TRANSPORT_PROTOCOL.ENCRYPTED_HEADER) || c.req.raw.headers.has(TRANSPORT_PROTOCOL.ENVELOPE_HEADER)) && checkAccess.encryption(c.req.path, c.req.method) === "disabled") {
+        return c.json(buildHaiErrorBody(HaiCommonError.VALIDATION_ERROR, servM("serv_transportPlaintextRequired")), 400);
+      }
+      return void 0;
+    }
+    core.logger.info("Request access policy denied", { ruleId: decision.ruleId, reason: decision.reason, method: c.req.method, ipAddress });
+    return c.json(buildHaiErrorBody(HaiCommonError.REQUEST_ACCESS_DENIED, core.i18n.coreM("core_requestAccessDenied")), 403);
+  };
+  const cors2 = options.middlewares?.filter((entry) => isCorsMiddleware(entry.middleware)) ?? [];
+  const custom = options.middlewares?.filter((entry) => !isCorsMiddleware(entry.middleware)) ?? [];
+  for (const entry of cors2) {
+    if (http.access === false) {
+      app.use(entry.path ?? "*", entry.middleware);
+      continue;
+    }
+    app.use(entry.path ?? "*", async (c, next) => {
+      if (c.req.method !== "OPTIONS")
+        return entry.middleware(c, next);
+      const rejected = accessDenied(c);
+      const preflight = await entry.middleware(c, async () => {
+      });
+      if (!rejected)
+        return preflight;
+      if (preflight instanceof Response) {
+        for (const [key, value] of preflight.headers)
+          rejected.headers.set(key, value);
+        rejected.headers.set("content-type", "application/json; charset=utf-8");
+      }
+      return rejected;
+    });
+  }
+  const keyExchangePath = options.transport ? `${http.apiPrefix}${options.transport.keyExchangePath ?? "/_hai/key-exchange"}` : void 0;
+  if (http.access !== false && keyExchangePath) {
+    app.use("*", async (c, next) => c.req.path === keyExchangePath && c.req.method === "POST" ? accessDenied(c) ?? next() : next());
+  }
   if (options.transport) {
     const policy = createTransportBodyPolicy(options.transport.maxPlaintextBytes, options.transport.routePlaintextBytes);
     const mgr = options.transport.crypto.transport.createServer({
@@ -1296,9 +1301,11 @@ function createApp(options) {
         mgr.error
       );
     }
-    const keyExchangePath = `${http.apiPrefix}${options.transport.keyExchangePath ?? "/_hai/key-exchange"}`;
-    app.use("*", createTransportMiddleware(mgr.data, keyExchangePath, options.transport.excludePaths, policy));
+    app.use("*", createTransportMiddleware(mgr.data, keyExchangePath, options.transport.excludePaths, policy, checkAccess.encryption));
   }
+  if (http.access !== false)
+    app.use("*", async (c, next) => accessDenied(c) ?? next());
+  mountCustomMiddlewares(app, custom);
   if (http.health !== false)
     mountHealthRoutes(app, http.health);
   if (options.refreshCookie)
@@ -1321,14 +1328,13 @@ function createApp(options) {
     audioWsServers.set(app, new WebSocketServer({ noServer: true }));
   }
   mountOpenAPIRoutes(app, options.procedures, http.apiPrefix, createContext);
-  if (http.rpc !== false)
-    mountRPCRoutes(app, options.procedures, http.rpc, createContext);
   if (http.openapi !== false) {
     app.get(http.openapi.path, async (c) => c.json(await getSpec()));
   }
   if (http.docs !== false) {
     const docs = http.docs;
-    app.get(SCALAR_ROUTE, async (c) => {
+    const docsDirectory = docs.path.slice(0, docs.path.lastIndexOf("/") + 1);
+    app.get(`${docsDirectory}${SCALAR_ROUTE.slice(1)}`, async (c) => {
       const content = await getScalarScript();
       if (!content)
         return c.notFound();
@@ -1342,8 +1348,8 @@ function createApp(options) {
         if (!context.session)
           return c.json(buildHaiErrorBody(HaiCommonError.UNAUTHORIZED, servM("serv_errorUnauthorized", { locale: resolveRequestLocale(c.req.raw.headers) })), 401);
       }
-      const specUrl = http.openapi === false ? void 0 : http.openapi.path;
-      return c.html(createDocsPage(await getSpec(), { specUrl }));
+      const specUrl = http.openapi === false ? void 0 : posix.relative(docsDirectory, http.openapi.path) || ".";
+      return c.html(createDocsPage(await getSpec(), { specUrl, scriptUrl: SCALAR_ROUTE.slice(1) }));
     });
   }
   return app;
@@ -1361,12 +1367,6 @@ function mountOpenAPIRoutes(app, procedures, apiPrefix, createContext) {
   const handler = new OpenAPIHandler(procedures);
   app.on([...API_METHODS], `${apiPrefix}/*`, (c, next) => handleORPC(c, next, apiPrefix, handler, createContext));
 }
-function mountRPCRoutes(app, procedures, rpcConfig, createContext) {
-  const handler = new RPCHandler(procedures);
-  const prefix = rpcConfig.prefix;
-  app.use(`${prefix}/*`, requireInternalRPC(rpcConfig));
-  app.on([...API_METHODS], `${prefix}/*`, (c, next) => handleORPC(c, next, prefix, handler, createContext));
-}
 async function handleORPC(c, next, prefix, handler, createContext) {
   const context = await createContext({ request: c.req.raw, remoteAddress: readRemoteAddress(c.env) });
   const { matched, response } = await core.context.run({ requestId: context.requestId, userId: context.session?.userId, scopeId: context.scopeId }, () => handler.handle(c.req.raw, { prefix, context }));
@@ -1478,90 +1478,6 @@ function listen(app, options = {}) {
   return handle;
 }
 
-// src/serv-cors.ts
-var DEFAULT_CORS_METHODS = ["GET", "HEAD", "PUT", "PATCH", "POST", "DELETE", "OPTIONS"];
-var DEFAULT_CORS_ALLOWED_HEADERS = ["Authorization", "Content-Type", "X-Requested-With", "X-Hai-Reauthentication", "X-Hai-Terminal"];
-var DEFAULT_CORS_MAX_AGE = 86400;
-function cors(config = {}) {
-  const methods = [...config.methods ?? DEFAULT_CORS_METHODS];
-  const allowedHeaders = [...config.allowedHeaders ?? DEFAULT_CORS_ALLOWED_HEADERS];
-  const exposedHeaders = [.../* @__PURE__ */ new Set(["X-Request-Id", "X-Trace-Id", ...config.exposedHeaders ?? []])];
-  const credentials = config.credentials ?? false;
-  const maxAge = config.maxAge ?? DEFAULT_CORS_MAX_AGE;
-  const originConfig = config.origin ?? "*";
-  return async (c, next) => {
-    const allowedOrigin = resolveCorsOrigin(c.req.header("Origin"), originConfig);
-    if (c.req.method === "OPTIONS") {
-      return new Response(null, {
-        status: 204,
-        headers: buildCorsHeaders({
-          allowedOrigin,
-          allowedHeaders,
-          credentials,
-          exposedHeaders,
-          maxAge,
-          methods,
-          request: c.req.raw
-        })
-      });
-    }
-    await next();
-    const corsHeaders = buildCorsHeaders({
-      allowedOrigin,
-      allowedHeaders,
-      credentials,
-      exposedHeaders,
-      maxAge,
-      methods,
-      request: c.req.raw
-    });
-    for (const [key, value] of corsHeaders) {
-      if (key.toLowerCase() === "vary") {
-        c.res.headers.append(key, value);
-        continue;
-      }
-      c.res.headers.set(key, value);
-    }
-    return void 0;
-  };
-}
-function resolveCorsOrigin(origin, configOrigin) {
-  if (!origin)
-    return null;
-  if (configOrigin === "*")
-    return "*";
-  if (typeof configOrigin === "string")
-    return origin === configOrigin ? origin : null;
-  if (Array.isArray(configOrigin))
-    return configOrigin.includes(origin) ? origin : null;
-  if (typeof configOrigin === "function")
-    return configOrigin(origin) ? origin : null;
-  return null;
-}
-function buildCorsHeaders(options) {
-  const headers = new Headers();
-  if (!options.allowedOrigin)
-    return headers;
-  const requestedHeaders = options.request.headers.get("Access-Control-Request-Headers");
-  headers.set("Access-Control-Allow-Origin", options.allowedOrigin);
-  if (options.credentials)
-    headers.set("Access-Control-Allow-Credentials", "true");
-  if (options.allowedOrigin !== "*") {
-    headers.set(
-      "Vary",
-      requestedHeaders ? "Origin, Access-Control-Request-Headers" : "Origin"
-    );
-  }
-  if (options.exposedHeaders.length > 0)
-    headers.set("Access-Control-Expose-Headers", options.exposedHeaders.join(", "));
-  if (options.request.method === "OPTIONS") {
-    headers.set("Access-Control-Allow-Methods", options.methods.join(", "));
-    headers.set("Access-Control-Allow-Headers", requestedHeaders ?? options.allowedHeaders.join(", "));
-    headers.set("Access-Control-Max-Age", String(options.maxAge));
-  }
-  return headers;
-}
-
 // src/serv-runtime-security.ts
 function createRuntimeSecurityPolicy(input) {
   const production = input.environment?.trim().toLowerCase() === "production";