@hoox-sh/hoox-shared 1.4.0 → 1.6.0

package/dist/middleware/index.js

@@ -1,20 +1,4 @@
 // @bun
-var __defProp = Object.defineProperty;
-var __returnValue = (v) => v;
-function __exportSetter(name, newValue) {
-  this[name] = __returnValue.bind(null, newValue);
-}
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, {
-      get: all[name],
-      enumerable: true,
-      configurable: true,
-      set: __exportSetter.bind(all, name)
-    });
-};
-var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
-
 // src/errors.ts
 function toError(err, fallback = "Unknown error") {
   if (err instanceof Error)
@@ -72,14 +56,14 @@ function sanitizeOutput(data) {
     const obj = data;
     const keys = Object.keys(obj);
     if (keys.length < 10) {
-      const sanitized2 = {};
+      const sanitized = {};
       for (const k of keys) {
         if (k === "stack" || k === "cause")
           continue;
         const v = obj[k];
-        sanitized2[k] = v instanceof Error ? { name: v.name, message: v.message } : sanitizeOutput(v);
+        sanitized[k] = v instanceof Error ? { name: v.name, message: v.message } : sanitizeOutput(v);
       }
-      return sanitized2;
+      return sanitized;
     }
     if (!hasSensitiveFields(obj) && !hasErrorValues(obj)) {
       return obj;
@@ -143,6 +127,61 @@ var Errors = {
   }
 };
 
+// src/middleware/logger.ts
+function createLogger(ctx) {
+  const base = { service: ctx.service, module: ctx.module };
+  function emit(level, message, context) {
+    const entry = {
+      level,
+      timestamp: new Date().toISOString(),
+      ...base,
+      message,
+      ...context && { context }
+    };
+    const line = JSON.stringify(entry);
+    if (level === "error")
+      console.error(line);
+    else if (level === "warn")
+      console.warn(line);
+    else if (level === "debug")
+      console.debug(line);
+    else
+      console.info(line);
+  }
+  return {
+    debug: (msg, ctx) => emit("debug", msg, ctx),
+    info: (msg, ctx) => emit("info", msg, ctx),
+    warn: (msg, ctx) => emit("warn", msg, ctx),
+    error: (msg, ctx) => emit("error", msg, ctx)
+  };
+}
+function withRequestLog(handler, logCtx) {
+  return async (request, env, ctx) => {
+    const start = Date.now();
+    const logger = createLogger(logCtx);
+    try {
+      const response = await handler(request, env, ctx);
+      const duration = Date.now() - start;
+      const url = new URL(request.url);
+      logger.info(`${request.method} ${url.pathname}`, {
+        method: request.method,
+        path: url.pathname,
+        status: response.status,
+        durationMs: duration
+      });
+      return response;
+    } catch (error) {
+      const duration = Date.now() - start;
+      logger.error("Request failed", {
+        method: request.method,
+        path: new URL(request.url).pathname,
+        durationMs: duration,
+        error: toError(error)
+      });
+      throw error;
+    }
+  };
+}
 // src/middleware/auth.ts
 function timingSafeEqual(a, b) {
   const encoder = new TextEncoder;
@@ -279,117 +318,6 @@ function checkInternalAuth(request, env, keyName = "INTERNAL_KEY_BINDING") {
   }
   return { authorized: true };
 }
-
-// src/middleware/cors.ts
-var DEFAULT_OPTIONS = {
-  allowOrigin: "",
-  allowMethods: "GET, POST, OPTIONS, PUT, DELETE",
-  allowHeaders: "Content-Type, Authorization, X-Request-ID",
-  allowCredentials: false,
-  maxAge: 86400
-};
-function corsHeaders(options) {
-  const opts = { ...DEFAULT_OPTIONS, ...options };
-  const headers = {
-    "Access-Control-Allow-Methods": opts.allowMethods,
-    "Access-Control-Allow-Headers": opts.allowHeaders,
-    "Access-Control-Max-Age": String(opts.maxAge)
-  };
-  if (opts.allowOrigin) {
-    headers["Access-Control-Allow-Origin"] = opts.allowOrigin;
-  }
-  if (opts.allowCredentials) {
-    headers["Access-Control-Allow-Credentials"] = "true";
-  }
-  return headers;
-}
-function publicCorsHeaders(origin = "*", options) {
-  return corsHeaders({ ...options, allowOrigin: origin });
-}
-function internalCorsHeaders() {
-  return {};
-}
-function resolveCorsOptions(request, env) {
-  const raw = env && typeof env === "object" && "CORS_ALLOW_ORIGIN" in env && typeof env.CORS_ALLOW_ORIGIN === "string" ? env.CORS_ALLOW_ORIGIN : undefined;
-  const configured = raw?.trim();
-  if (!configured) {
-    return {};
-  }
-  const allowed = configured.split(",").map((entry) => entry.trim()).filter(Boolean);
-  const origin = request.headers.get("Origin");
-  if (origin && allowed.includes(origin)) {
-    return { allowOrigin: origin, allowCredentials: true };
-  }
-  if (!origin && allowed.length === 1) {
-    return { allowOrigin: allowed[0] };
-  }
-  return {};
-}
-function handleCorsPreflightRequest(request, options) {
-  if (request.method !== "OPTIONS")
-    return null;
-  return new Response(null, {
-    status: 204,
-    headers: corsHeaders(options)
-  });
-}
-
-// src/middleware/logger.ts
-function createLogger(ctx) {
-  const base = { service: ctx.service, module: ctx.module };
-  function emit(level, message, context) {
-    const entry = {
-      level,
-      timestamp: new Date().toISOString(),
-      ...base,
-      message,
-      ...context && { context }
-    };
-    const line = JSON.stringify(entry);
-    if (level === "error")
-      console.error(line);
-    else if (level === "warn")
-      console.warn(line);
-    else if (level === "debug")
-      console.debug(line);
-    else
-      console.info(line);
-  }
-  return {
-    debug: (msg, ctx2) => emit("debug", msg, ctx2),
-    info: (msg, ctx2) => emit("info", msg, ctx2),
-    warn: (msg, ctx2) => emit("warn", msg, ctx2),
-    error: (msg, ctx2) => emit("error", msg, ctx2)
-  };
-}
-function withRequestLog(handler, logCtx) {
-  return async (request, env, ctx) => {
-    const start = Date.now();
-    const logger = createLogger(logCtx);
-    try {
-      const response = await handler(request, env, ctx);
-      const duration = Date.now() - start;
-      const url = new URL(request.url);
-      logger.info(`${request.method} ${url.pathname}`, {
-        method: request.method,
-        path: url.pathname,
-        status: response.status,
-        durationMs: duration
-      });
-      return response;
-    } catch (error) {
-      const duration = Date.now() - start;
-      logger.error("Request failed", {
-        method: request.method,
-        path: new URL(request.url).pathname,
-        durationMs: duration,
-        error: toError(error)
-      });
-      throw error;
-    }
-  };
-}
-
 // src/middleware/rate-limit.ts
 function createStorage(kv) {
   if (!kv) {
@@ -444,8 +372,8 @@ function createStorage(kv) {
           attempts++;
           if (attempts >= maxAttempts) {
             const current = await this.get(key);
-            const count2 = current ? parseInt(current, 10) : 0;
-            newValue = count2 + 1;
+            const count = current ? parseInt(current, 10) : 0;
+            newValue = count + 1;
             const ttl = opts?.expirationTtl ?? 0;
             const expiresAt = ttl > 0 ? Date.now() + ttl * 1000 : Infinity;
             memory.set(key, { value: String(newValue), expiresAt });
@@ -493,7 +421,7 @@ function createRateLimiter(kv, config) {
       };
     }
     const newCount = await storage.incr(fullKey, {
-      expirationTtl: config.windowSeconds
+      expirationTtl: Math.max(60, config.windowSeconds)
     });
     if (newCount > config.maxRequests) {
       const retryAfter = Math.ceil(config.windowSeconds - Date.now() % (config.windowSeconds * 1000) / 1000);
@@ -530,7 +458,8 @@ function createRateLimiter(kv, config) {
     return null;
   }
   async function checkKey(key) {
-    const fullKey = `${prefix}:${key}`;
+    const windowStart = Math.floor(Date.now() / (config.windowSeconds * 1000));
+    const fullKey = `${prefix}:${key}:${windowStart}`;
     return checkWithKey(fullKey);
   }
   async function enforceKey(key) {
@@ -551,7 +480,6 @@ function createRateLimiter(kv, config) {
   }
   return { check, enforce, checkKey, enforceKey };
 }
-
 // src/middleware/validate.ts
 var DEFAULT_MAX_JSON_BODY_BYTES = 1048576;
 function validateJson(schema, data) {
@@ -619,7 +547,6 @@ function optionalField(body, field, defaultValue) {
     return defaultValue;
   return body[field];
 }
-
 // src/middleware/wait-until.ts
 function safeWaitUntil(ctx, promise, onError) {
   ctx.waitUntil(promise.catch((err) => {
@@ -645,7 +572,59 @@ function waitUntilAll(ctx, promises, onError) {
     }
   }), onError);
 }
-
+// src/middleware/cors.ts
+var DEFAULT_OPTIONS = {
+  allowOrigin: "",
+  allowMethods: "GET, POST, OPTIONS, PUT, DELETE",
+  allowHeaders: "Content-Type, Authorization, X-Request-ID",
+  allowCredentials: false,
+  maxAge: 86400
+};
+function corsHeaders(options) {
+  const opts = { ...DEFAULT_OPTIONS, ...options };
+  const headers = {
+    "Access-Control-Allow-Methods": opts.allowMethods,
+    "Access-Control-Allow-Headers": opts.allowHeaders,
+    "Access-Control-Max-Age": String(opts.maxAge)
+  };
+  if (opts.allowOrigin) {
+    headers["Access-Control-Allow-Origin"] = opts.allowOrigin;
+  }
+  if (opts.allowCredentials) {
+    headers["Access-Control-Allow-Credentials"] = "true";
+  }
+  return headers;
+}
+function publicCorsHeaders(origin = "*", options) {
+  return corsHeaders({ ...options, allowOrigin: origin });
+}
+function internalCorsHeaders() {
+  return {};
+}
+function resolveCorsOptions(request, env) {
+  const raw = env && typeof env === "object" && "CORS_ALLOW_ORIGIN" in env && typeof env.CORS_ALLOW_ORIGIN === "string" ? env.CORS_ALLOW_ORIGIN : undefined;
+  const configured = raw?.trim();
+  if (!configured) {
+    return {};
+  }
+  const allowed = configured.split(",").map((entry) => entry.trim()).filter(Boolean);
+  const origin = request.headers.get("Origin");
+  if (origin && allowed.includes(origin)) {
+    return { allowOrigin: origin, allowCredentials: true };
+  }
+  if (!origin && allowed.length === 1) {
+    return { allowOrigin: allowed[0] };
+  }
+  return {};
+}
+function handleCorsPreflightRequest(request, options) {
+  if (request.method !== "OPTIONS")
+    return null;
+  return new Response(null, {
+    status: 204,
+    headers: corsHeaders(options)
+  });
+}
 // src/middleware/security-headers.ts
 var SECURITY_HEADERS_DEFAULTS = {
   xContentTypeOptions: "nosniff",
@@ -683,33 +662,33 @@ function wrapWithSecurityHeaders(response, options) {
   });
 }
 export {
-  wrapWithSecurityHeaders,
-  withRequestLog,
-  waitUntilAll,
-  validateJsonLegacy,
-  validateJson,
-  timingSafeEqualAsync,
-  timingSafeEqual,
-  secureHeaders,
-  safeWaitUntil,
-  resolveOperatorApiKey,
-  resolveCorsOptions,
-  requireOperatorAuth,
-  requireInternalAuth,
-  requireField,
-  requireAuth,
-  publicCorsHeaders,
-  parseJsonBody,
-  optionalField,
-  internalCorsHeaders,
-  handleCorsPreflightRequest,
-  createRateLimiter,
-  createOperatorAuthMiddleware,
-  createLogger,
-  createInternalAuthMiddleware,
-  corsHeaders,
-  collectInternalAuthKeys,
-  checkInternalAuth,
+  DEFAULT_MAX_JSON_BODY_BYTES,
   SECURITY_HEADERS_DEFAULTS,
-  DEFAULT_MAX_JSON_BODY_BYTES
+  checkInternalAuth,
+  collectInternalAuthKeys,
+  corsHeaders,
+  createInternalAuthMiddleware,
+  createLogger,
+  createOperatorAuthMiddleware,
+  createRateLimiter,
+  handleCorsPreflightRequest,
+  internalCorsHeaders,
+  optionalField,
+  parseJsonBody,
+  publicCorsHeaders,
+  requireAuth,
+  requireField,
+  requireInternalAuth,
+  requireOperatorAuth,
+  resolveCorsOptions,
+  resolveOperatorApiKey,
+  safeWaitUntil,
+  secureHeaders,
+  timingSafeEqual,
+  timingSafeEqualAsync,
+  validateJson,
+  validateJsonLegacy,
+  waitUntilAll,
+  withRequestLog,
+  wrapWithSecurityHeaders
 };

package/dist/middleware/logger.d.ts

@@ -12,6 +12,8 @@ export interface Logger {
     warn(message: string, context?: Record<string, unknown>): void;
     error(message: string, context?: Record<string, unknown>): void;
 }
+/** JSON-line logger bound to a service/module context. */
 export declare function createLogger(ctx: LogContext): Logger;
+/** Wrap a fetch handler so each request logs method, path, status, and duration. */
 export declare function withRequestLog<E>(handler: (request: Request, env: E, ctx: ExecutionContext) => Promise<Response>, logCtx: LogContext): (request: Request, env: E, ctx: ExecutionContext) => Promise<Response>;
 //# sourceMappingURL=logger.d.ts.map

package/dist/middleware/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/middleware/logger.ts"],"names":[],"mappings":"AAAA;;;GAGG;AASH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAWD,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAChE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC/D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC/D,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACjE;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CA4BpD;AAED,wBAAgB,cAAc,CAAC,CAAC,EAC9B,OAAO,EAAE,CACP,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,CAAC,EACN,GAAG,EAAE,gBAAgB,KAClB,OAAO,CAAC,QAAQ,CAAC,EACtB,MAAM,EAAE,UAAU,GACjB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,QAAQ,CAAC,CA2BxE"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/middleware/logger.ts"],"names":[],"mappings":"AAAA;;;GAGG;AASH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAWD,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAChE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC/D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC/D,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACjE;AAED,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CA4BpD;AAED,oFAAoF;AACpF,wBAAgB,cAAc,CAAC,CAAC,EAC9B,OAAO,EAAE,CACP,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,CAAC,EACN,GAAG,EAAE,gBAAgB,KAClB,OAAO,CAAC,QAAQ,CAAC,EACtB,MAAM,EAAE,UAAU,GACjB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,QAAQ,CAAC,CA2BxE"}

package/dist/middleware/logger.js

@@ -1,20 +1,4 @@
 // @bun
-var __defProp = Object.defineProperty;
-var __returnValue = (v) => v;
-function __exportSetter(name, newValue) {
-  this[name] = __returnValue.bind(null, newValue);
-}
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, {
-      get: all[name],
-      enumerable: true,
-      configurable: true,
-      set: __exportSetter.bind(all, name)
-    });
-};
-var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
-
 // src/errors.ts
 function toError(err, fallback = "Unknown error") {
   if (err instanceof Error)
@@ -72,14 +56,14 @@ function sanitizeOutput(data) {
     const obj = data;
     const keys = Object.keys(obj);
     if (keys.length < 10) {
-      const sanitized2 = {};
+      const sanitized = {};
       for (const k of keys) {
         if (k === "stack" || k === "cause")
           continue;
         const v = obj[k];
-        sanitized2[k] = v instanceof Error ? { name: v.name, message: v.message } : sanitizeOutput(v);
+        sanitized[k] = v instanceof Error ? { name: v.name, message: v.message } : sanitizeOutput(v);
       }
-      return sanitized2;
+      return sanitized;
     }
     if (!hasSensitiveFields(obj) && !hasErrorValues(obj)) {
       return obj;
@@ -165,10 +149,10 @@ function createLogger(ctx) {
       console.info(line);
   }
   return {
-    debug: (msg, ctx2) => emit("debug", msg, ctx2),
-    info: (msg, ctx2) => emit("info", msg, ctx2),
-    warn: (msg, ctx2) => emit("warn", msg, ctx2),
-    error: (msg, ctx2) => emit("error", msg, ctx2)
+    debug: (msg, ctx) => emit("debug", msg, ctx),
+    info: (msg, ctx) => emit("info", msg, ctx),
+    warn: (msg, ctx) => emit("warn", msg, ctx),
+    error: (msg, ctx) => emit("error", msg, ctx)
   };
 }
 function withRequestLog(handler, logCtx) {
@@ -199,6 +183,6 @@ function withRequestLog(handler, logCtx) {
   };
 }
 export {
-  withRequestLog,
-  createLogger
+  createLogger,
+  withRequestLog
 };

package/dist/middleware/rate-limit.d.ts

@@ -25,6 +25,13 @@ export interface RateLimiter {
     checkKey(key: string): Promise<RateLimitResult>;
     enforceKey(key: string): Promise<Response | null>;
 }
+/**
+ * Create a KV- or memory-backed rate limiter.
+ *
+ * `check` / `enforce` key by client IP and a clock window.
+ * `checkKey` / `enforceKey` key by the caller string plus the same window
+ * (so a busy key does not accumulate forever).
+ */
 export declare function createRateLimiter(kv: Env["CONFIG_KV"] | undefined, config: RateLimitConfig): RateLimiter;
 export {};
 //# sourceMappingURL=rate-limit.d.ts.map

package/dist/middleware/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/middleware/rate-limit.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAEpC,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,eAAe;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAClD,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACpD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAChD,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;CACnD;AAuHD,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC,GAAG,SAAS,EAChC,MAAM,EAAE,eAAe,GACtB,WAAW,CAiHb"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/middleware/rate-limit.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAEpC,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,eAAe;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAClD,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACpD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAChD,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;CACnD;AAuHD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC,GAAG,SAAS,EAChC,MAAM,EAAE,eAAe,GACtB,WAAW,CAoHb"}

package/dist/middleware/rate-limit.js

@@ -1,20 +1,4 @@
 // @bun
-var __defProp = Object.defineProperty;
-var __returnValue = (v) => v;
-function __exportSetter(name, newValue) {
-  this[name] = __returnValue.bind(null, newValue);
-}
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, {
-      get: all[name],
-      enumerable: true,
-      configurable: true,
-      set: __exportSetter.bind(all, name)
-    });
-};
-var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
-
 // src/middleware/rate-limit.ts
 function createStorage(kv) {
   if (!kv) {
@@ -69,8 +53,8 @@ function createStorage(kv) {
           attempts++;
           if (attempts >= maxAttempts) {
             const current = await this.get(key);
-            const count2 = current ? parseInt(current, 10) : 0;
-            newValue = count2 + 1;
+            const count = current ? parseInt(current, 10) : 0;
+            newValue = count + 1;
             const ttl = opts?.expirationTtl ?? 0;
             const expiresAt = ttl > 0 ? Date.now() + ttl * 1000 : Infinity;
             memory.set(key, { value: String(newValue), expiresAt });
@@ -118,7 +102,7 @@ function createRateLimiter(kv, config) {
       };
     }
     const newCount = await storage.incr(fullKey, {
-      expirationTtl: config.windowSeconds
+      expirationTtl: Math.max(60, config.windowSeconds)
     });
     if (newCount > config.maxRequests) {
       const retryAfter = Math.ceil(config.windowSeconds - Date.now() % (config.windowSeconds * 1000) / 1000);
@@ -155,7 +139,8 @@ function createRateLimiter(kv, config) {
     return null;
   }
   async function checkKey(key) {
-    const fullKey = `${prefix}:${key}`;
+    const windowStart = Math.floor(Date.now() / (config.windowSeconds * 1000));
+    const fullKey = `${prefix}:${key}:${windowStart}`;
     return checkWithKey(fullKey);
   }
   async function enforceKey(key) {

package/dist/middleware/security-headers.js

@@ -1,20 +1,4 @@
 // @bun
-var __defProp = Object.defineProperty;
-var __returnValue = (v) => v;
-function __exportSetter(name, newValue) {
-  this[name] = __returnValue.bind(null, newValue);
-}
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, {
-      get: all[name],
-      enumerable: true,
-      configurable: true,
-      set: __exportSetter.bind(all, name)
-    });
-};
-var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
-
 // src/middleware/security-headers.ts
 var SECURITY_HEADERS_DEFAULTS = {
   xContentTypeOptions: "nosniff",
@@ -52,7 +36,7 @@ function wrapWithSecurityHeaders(response, options) {
   });
 }
 export {
-  wrapWithSecurityHeaders,
+  SECURITY_HEADERS_DEFAULTS,
   secureHeaders,
-  SECURITY_HEADERS_DEFAULTS
+  wrapWithSecurityHeaders
 };

package/dist/middleware/validate.d.ts

@@ -36,6 +36,8 @@ export declare function parseJsonBody<T extends z.ZodTypeAny>(request: Request,
  * Kept for backward compatibility with existing workers.
  */
 export declare function validateJsonLegacy(request: Request): Promise<Result<Record<string, unknown>>>;
+/** Require `field` on a parsed JSON body; fail with a missing-field error. */
 export declare function requireField<T>(body: Record<string, unknown>, field: string): Result<T>;
+/** Read `field` from a parsed JSON body, or `defaultValue` when absent. */
 export declare function optionalField<T>(body: Record<string, unknown>, field: string, defaultValue: T): T;
 //# sourceMappingURL=validate.d.ts.map

package/dist/middleware/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/middleware/validate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAEvC,8DAA8D;AAC9D,eAAO,MAAM,2BAA2B,UAAY,CAAC;AAErD,MAAM,WAAW,oBAAoB;IACnC,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS,CAAC,CAAC,UAAU,EACjD,MAAM,EAAE,CAAC,EACT,IAAI,EAAE,OAAO,GACZ,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAWpB;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,CAAC,SAAS,CAAC,CAAC,UAAU,EACxD,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,CAAC,EACT,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAsC7B;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAU1C;AAED,wBAAgB,YAAY,CAAC,CAAC,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,KAAK,EAAE,MAAM,GACZ,MAAM,CAAC,CAAC,CAAC,CAKX;AAED,wBAAgB,aAAa,CAAC,CAAC,EAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,CAAC,GACd,CAAC,CAGH"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/middleware/validate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAEvC,8DAA8D;AAC9D,eAAO,MAAM,2BAA2B,UAAY,CAAC;AAErD,MAAM,WAAW,oBAAoB;IACnC,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS,CAAC,CAAC,UAAU,EACjD,MAAM,EAAE,CAAC,EACT,IAAI,EAAE,OAAO,GACZ,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAWpB;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,CAAC,SAAS,CAAC,CAAC,UAAU,EACxD,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,CAAC,EACT,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAsC7B;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAU1C;AAED,8EAA8E;AAC9E,wBAAgB,YAAY,CAAC,CAAC,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,KAAK,EAAE,MAAM,GACZ,MAAM,CAAC,CAAC,CAAC,CAKX;AAED,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,CAAC,EAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,CAAC,GACd,CAAC,CAGH"}

package/dist/middleware/validate.js

@@ -1,20 +1,4 @@
 // @bun
-var __defProp = Object.defineProperty;
-var __returnValue = (v) => v;
-function __exportSetter(name, newValue) {
-  this[name] = __returnValue.bind(null, newValue);
-}
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, {
-      get: all[name],
-      enumerable: true,
-      configurable: true,
-      set: __exportSetter.bind(all, name)
-    });
-};
-var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
-
 // src/middleware/validate.ts
 var DEFAULT_MAX_JSON_BODY_BYTES = 1048576;
 function validateJson(schema, data) {
@@ -83,10 +67,10 @@ function optionalField(body, field, defaultValue) {
   return body[field];
 }
 export {
-  validateJsonLegacy,
-  validateJson,
-  requireField,
-  parseJsonBody,
+  DEFAULT_MAX_JSON_BODY_BYTES,
   optionalField,
-  DEFAULT_MAX_JSON_BODY_BYTES
+  parseJsonBody,
+  requireField,
+  validateJson,
+  validateJsonLegacy
 };

package/dist/middleware/wait-until.js

@@ -1,20 +1,4 @@
 // @bun
-var __defProp = Object.defineProperty;
-var __returnValue = (v) => v;
-function __exportSetter(name, newValue) {
-  this[name] = __returnValue.bind(null, newValue);
-}
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, {
-      get: all[name],
-      enumerable: true,
-      configurable: true,
-      set: __exportSetter.bind(all, name)
-    });
-};
-var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
-
 // src/middleware/wait-until.ts
 function safeWaitUntil(ctx, promise, onError) {
   ctx.waitUntil(promise.catch((err) => {
@@ -41,6 +25,6 @@ function waitUntilAll(ctx, promises, onError) {
   }), onError);
 }
 export {
-  waitUntilAll,
-  safeWaitUntil
+  safeWaitUntil,
+  waitUntilAll
 };