@lastshotlabs/bunshot 0.0.25 → 0.0.28

package/dist/lib/wsPresence.js

@@ -1,99 +0,0 @@
-// ---------------------------------------------------------------------------
-// State (in-memory only)
-// ---------------------------------------------------------------------------
-/** socketId → userId (authenticated sockets only) */
-const _socketUsers = new Map();
-/** room → userId → Set<socketId> (multi-tab aware) */
-const _roomPresence = new Map();
-// ---------------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------------
-/** Track an authenticated socket. Skips if userId is null/undefined. */
-export const trackSocket = (socketId, userId) => {
-    if (!userId)
-        return;
-    _socketUsers.set(socketId, userId);
-};
-/** Untrack a socket on disconnect. */
-export const untrackSocket = (socketId) => {
-    _socketUsers.delete(socketId);
-};
-/** Called when a socket subscribes to a room. Returns join info or null if unauthenticated. */
-export const addPresence = (socketId, room) => {
-    const userId = _socketUsers.get(socketId);
-    if (!userId)
-        return null;
-    if (!_roomPresence.has(room))
-        _roomPresence.set(room, new Map());
-    const roomMap = _roomPresence.get(room);
-    const isNewUser = !roomMap.has(userId) || roomMap.get(userId).size === 0;
-    if (!roomMap.has(userId))
-        roomMap.set(userId, new Set());
-    roomMap.get(userId).add(socketId);
-    return { userId, isNewUser };
-};
-/** Called when a socket unsubscribes from a room. Returns leave info or null if unauthenticated. */
-export const removePresence = (socketId, room) => {
-    const userId = _socketUsers.get(socketId);
-    if (!userId)
-        return null;
-    const roomMap = _roomPresence.get(room);
-    if (!roomMap)
-        return null;
-    const sockets = roomMap.get(userId);
-    if (!sockets)
-        return null;
-    sockets.delete(socketId);
-    const isLastSocket = sockets.size === 0;
-    if (isLastSocket) {
-        roomMap.delete(userId);
-        if (roomMap.size === 0)
-            _roomPresence.delete(room);
-    }
-    return { userId, isLastSocket };
-};
-/** Called on disconnect — cleans up all rooms for a socket. Returns rooms where user fully departed. */
-export const cleanupPresence = (socketId, rooms) => {
-    const userId = _socketUsers.get(socketId);
-    if (!userId)
-        return [];
-    const departed = [];
-    for (const room of rooms) {
-        const roomMap = _roomPresence.get(room);
-        if (!roomMap)
-            continue;
-        const sockets = roomMap.get(userId);
-        if (!sockets)
-            continue;
-        sockets.delete(socketId);
-        if (sockets.size === 0) {
-            roomMap.delete(userId);
-            if (roomMap.size === 0)
-                _roomPresence.delete(room);
-            departed.push({ room, userId });
-        }
-    }
-    return departed;
-};
-/** Deduplicated userIds present in a room. */
-export const getRoomPresence = (room) => {
-    const roomMap = _roomPresence.get(room);
-    if (!roomMap)
-        return [];
-    return [...roomMap.keys()];
-};
-/** Rooms where a user is present. */
-export const getUserPresence = (userId) => {
-    const rooms = [];
-    for (const [room, roomMap] of _roomPresence) {
-        const sockets = roomMap.get(userId);
-        if (sockets && sockets.size > 0)
-            rooms.push(room);
-    }
-    return rooms;
-};
-/** Reset all presence state. Useful for test isolation. */
-export const clearPresenceStore = () => {
-    _socketUsers.clear();
-    _roomPresence.clear();
-};

package/dist/middleware/auditLog.js

@@ -1,39 +0,0 @@
-import { getClientIp } from "../lib/clientIp";
-import { logAuditEntry } from "../lib/auditLog";
-export const auditLog = (options) => async (c, next) => {
-    await next();
-    // Exclusion checks run after next() intentionally — c.res.status is only available
-    // after the route handler runs. The route still executes; we're only skipping the log write.
-    if (options.exclude?.methods?.includes(c.req.method))
-        return;
-    // Note: if exclude.paths grows large, regex evaluation on every request adds up.
-    // For high-traffic exclusions, prefer string matching over regex.
-    const path = c.req.path;
-    if (options.exclude?.paths?.some(p => typeof p === "string" ? p === path : p.test(path)))
-        return;
-    let entry = {
-        id: crypto.randomUUID(),
-        requestId: c.get("requestId") ?? undefined,
-        userId: c.get("authUserId") ?? null,
-        sessionId: c.get("sessionId") ?? null,
-        tenantId: c.get("tenantId") ?? null,
-        method: c.req.method,
-        path,
-        status: c.res.status,
-        ip: getClientIp(c),
-        userAgent: c.req.header("user-agent") ?? null,
-        createdAt: new Date().toISOString(),
-    };
-    if (options.onEntry) {
-        try {
-            entry = await options.onEntry(entry, c);
-        }
-        catch (err) {
-            console.error("[auditLog] onEntry hook threw:", err);
-        }
-    }
-    // Fire-and-forget — never block the response; logAuditEntry also swallows errors internally
-    logAuditEntry(entry, options).catch(err => {
-        console.error("[auditLog] write failed:", err);
-    });
-};

package/dist/middleware/bearerAuth.d.ts

@@ -1,2 +0,0 @@
-import type { MiddlewareHandler } from "hono";
-export declare const bearerAuth: MiddlewareHandler;

package/dist/middleware/bearerAuth.js

@@ -1,11 +0,0 @@
-import { timingSafeEqual } from "../lib/crypto";
-export const bearerAuth = async (c, next) => {
-    const isProd = process.env.NODE_ENV === "production";
-    const validToken = isProd ? process.env.BEARER_TOKEN_PROD : process.env.BEARER_TOKEN_DEV;
-    const header = c.req.header("Authorization");
-    const token = header?.startsWith("Bearer ") ? header.slice(7) : null;
-    if (!token || !validToken || !timingSafeEqual(token, validToken)) {
-        return c.json({ error: "Unauthorized" }, 401);
-    }
-    await next();
-};

package/dist/middleware/cacheResponse.d.ts

@@ -1,15 +0,0 @@
-import type { MiddlewareHandler } from "hono";
-import type { AppEnv } from "../lib/context";
-export declare function getCacheModel(): import("mongoose").Model<any, {}, {}, {}, any, any, any>;
-type CacheStore = "redis" | "mongo" | "sqlite" | "memory";
-export declare const setCacheStore: (store: CacheStore) => void;
-export declare const bustCache: (key: string) => Promise<void>;
-export declare const bustCachePattern: (pattern: string) => Promise<void>;
-type KeyFn = (c: Parameters<MiddlewareHandler<any>>[0]) => string;
-interface CacheOptions {
-    ttl?: number;
-    key: string | KeyFn;
-    store?: CacheStore;
-}
-export declare const cacheResponse: ({ ttl, key, store }: CacheOptions) => MiddlewareHandler<AppEnv>;
-export {};

package/dist/middleware/cacheResponse.js

@@ -1,178 +0,0 @@
-import { getRedis } from "../lib/redis";
-import { getAppName } from "../lib/appConfig";
-import { appConnection, mongoose } from "../lib/mongo";
-import { isSqliteReady, sqliteGetCache, sqliteSetCache, sqliteDelCache, sqliteDelCachePattern } from "../adapters/sqliteAuth";
-import { memoryGetCache, memorySetCache, memoryDelCache, memoryDelCachePattern } from "../adapters/memoryAuth";
-export function getCacheModel() {
-    if (appConnection.models["CacheEntry"])
-        return appConnection.models["CacheEntry"];
-    const { Schema } = mongoose;
-    const cacheSchema = new Schema({
-        key: { type: String, required: true, unique: true },
-        value: { type: String, required: true },
-        expiresAt: { type: Date, index: { expireAfterSeconds: 0 } },
-    }, { collection: "cache_entries" });
-    return appConnection.model("CacheEntry", cacheSchema);
-}
-function isMongoReady() {
-    return appConnection.readyState === 1;
-}
-function isRedisReady() {
-    try {
-        getRedis();
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-let _defaultCacheStore = "redis";
-export const setCacheStore = (store) => { _defaultCacheStore = store; };
-async function storeGet(store, cacheKey) {
-    if (store === "memory")
-        return memoryGetCache(cacheKey);
-    if (store === "sqlite") {
-        if (!isSqliteReady())
-            throw new Error(`cacheResponse: store is "sqlite" but SQLite is not initialized. Call setSqliteDb(path) or pass sqliteDb to createServer.`);
-        return sqliteGetCache(cacheKey);
-    }
-    if (store === "mongo") {
-        if (!isMongoReady())
-            throw new Error(`cacheResponse: store is "mongo" but appConnection is not connected. Ensure connectMongo() or connectAppMongo() is called before handling requests.`);
-        const doc = await getCacheModel().findOne({ key: cacheKey }, "value").lean();
-        return doc ? doc.value : null;
-    }
-    return getRedis().get(cacheKey);
-}
-async function storeSet(store, cacheKey, value, ttl) {
-    if (store === "memory") {
-        memorySetCache(cacheKey, value, ttl);
-        return;
-    }
-    if (store === "sqlite") {
-        if (!isSqliteReady())
-            throw new Error(`cacheResponse: store is "sqlite" but SQLite is not initialized. Call setSqliteDb(path) or pass sqliteDb to createServer.`);
-        sqliteSetCache(cacheKey, value, ttl);
-        return;
-    }
-    if (store === "mongo") {
-        if (!isMongoReady())
-            throw new Error(`cacheResponse: store is "mongo" but appConnection is not connected. Ensure connectMongo() or connectAppMongo() is called before handling requests.`);
-        const expiresAt = ttl ? new Date(Date.now() + ttl * 1000) : undefined;
-        await getCacheModel().updateOne({ key: cacheKey }, { $set: { value, ...(expiresAt ? { expiresAt } : {}) } }, { upsert: true });
-        return;
-    }
-    if (ttl) {
-        await getRedis().setex(cacheKey, ttl, value);
-    }
-    else {
-        await getRedis().set(cacheKey, value);
-    }
-}
-async function storeDel(store, cacheKey) {
-    if (store === "memory") {
-        memoryDelCache(cacheKey);
-        return;
-    }
-    if (store === "sqlite") {
-        if (!isSqliteReady())
-            return;
-        sqliteDelCache(cacheKey);
-        return;
-    }
-    if (store === "mongo") {
-        if (!isMongoReady())
-            return;
-        await getCacheModel().deleteOne({ key: cacheKey });
-        return;
-    }
-    if (!isRedisReady())
-        return;
-    await getRedis().del(cacheKey);
-}
-async function storeDelPattern(store, fullPattern) {
-    if (store === "memory") {
-        memoryDelCachePattern(fullPattern);
-        return;
-    }
-    if (store === "sqlite") {
-        if (!isSqliteReady())
-            return;
-        sqliteDelCachePattern(fullPattern);
-        return;
-    }
-    if (store === "mongo") {
-        if (!isMongoReady())
-            return;
-        // Escape all regex metacharacters in the full pattern (including the cache:{appName}: prefix,
-        // which may itself contain dots or other metacharacters). Then restore * as a glob wildcard.
-        // Order matters: escape first, then replace the now-escaped \* with .* for glob semantics.
-        const escaped = fullPattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
-        const regex = new RegExp("^" + escaped.replace(/\*/g, ".*") + "$");
-        await getCacheModel().deleteMany({ key: regex });
-        return;
-    }
-    if (!isRedisReady())
-        return;
-    const redis = getRedis();
-    let cursor = "0";
-    do {
-        const [next, keys] = await redis.scan(cursor, "MATCH", fullPattern, "COUNT", 100);
-        cursor = next;
-        if (keys.length > 0)
-            await redis.del(...keys);
-    } while (cursor !== "0");
-}
-// ---------------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------------
-export const bustCache = async (key) => {
-    const cacheKey = `cache:${getAppName()}:${key}`;
-    await Promise.all([storeDel("redis", cacheKey), storeDel("mongo", cacheKey), storeDel("sqlite", cacheKey), storeDel("memory", cacheKey)]);
-};
-export const bustCachePattern = async (pattern) => {
-    const fullPattern = `cache:${getAppName()}:${pattern}`;
-    await Promise.all([storeDelPattern("redis", fullPattern), storeDelPattern("mongo", fullPattern), storeDelPattern("sqlite", fullPattern), storeDelPattern("memory", fullPattern)]);
-};
-/** Headers that must never be cached — storing these can cause session fixation or auth bypass. */
-const UNCACHEABLE_HEADERS = new Set([
-    "set-cookie",
-    "www-authenticate",
-    "authorization",
-    "x-csrf-token",
-    "proxy-authenticate",
-]);
-export const cacheResponse = ({ ttl, key, store = _defaultCacheStore }) => {
-    return async (c, next) => {
-        const appName = getAppName();
-        const rawKey = typeof key === "function" ? key(c) : key;
-        // Per-tenant namespacing: prevents two tenants caching the same key from colliding
-        const tenantId = c.get("tenantId");
-        const tenantSegment = tenantId ? `${tenantId}:` : "";
-        const cacheKey = `cache:${appName}:${tenantSegment}${rawKey}`;
-        const cached = await storeGet(store, cacheKey);
-        if (cached) {
-            const { status, headers, body } = JSON.parse(cached);
-            return new Response(body, {
-                status,
-                headers: { ...headers, "x-cache": "HIT" },
-            });
-        }
-        await next();
-        const res = c.res;
-        if (res.status >= 200 && res.status < 300) {
-            const body = await res.text();
-            const headers = {};
-            res.headers.forEach((value, name) => {
-                if (!UNCACHEABLE_HEADERS.has(name.toLowerCase())) {
-                    headers[name] = value;
-                }
-            });
-            await storeSet(store, cacheKey, JSON.stringify({ status: res.status, headers, body }), ttl);
-            c.res = new Response(body, {
-                status: res.status,
-                headers: { ...headers, "x-cache": "MISS" },
-            });
-        }
-    };
-};

package/dist/middleware/csrf.js

@@ -1,125 +0,0 @@
-import { getCookie, setCookie, deleteCookie } from "hono/cookie";
-import { timingSafeEqual } from "../lib/crypto";
-import { COOKIE_TOKEN, COOKIE_CSRF_TOKEN, HEADER_CSRF_TOKEN } from "../lib/constants";
-import { createHmac, randomBytes } from "crypto";
-const isProd = process.env.NODE_ENV === "production";
-const STATE_CHANGING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
-function getJwtSecret() {
-    const secret = isProd ? process.env.JWT_SECRET_PROD : process.env.JWT_SECRET_DEV;
-    if (!secret)
-        throw new Error("CSRF middleware requires JWT_SECRET_DEV/JWT_SECRET_PROD to be set");
-    return secret;
-}
-function generateCsrfToken(secret) {
-    const token = randomBytes(32).toString("hex");
-    const sig = createHmac("sha256", secret).update(token).digest("hex");
-    return `${token}.${sig}`;
-}
-function verifyCsrfSignature(cookieValue, secret) {
-    const dotIdx = cookieValue.indexOf(".");
-    if (dotIdx === -1)
-        return false;
-    const token = cookieValue.substring(0, dotIdx);
-    const sig = cookieValue.substring(dotIdx + 1);
-    const expected = createHmac("sha256", secret).update(token).digest("hex");
-    return timingSafeEqual(sig, expected);
-}
-const csrfCookieOptions = {
-    httpOnly: false,
-    secure: isProd,
-    sameSite: "Lax",
-    path: "/",
-    maxAge: 60 * 60 * 24 * 365, // 1 year — tied to browser, not session
-};
-/**
- * Refreshes the CSRF token cookie — call on login/register to prevent
- * session fixation-adjacent attacks.
- */
-export function refreshCsrfToken(c) {
-    const secret = getJwtSecret();
-    const token = generateCsrfToken(secret);
-    setCookie(c, COOKIE_CSRF_TOKEN, token, csrfCookieOptions);
-}
-/**
- * Clears the CSRF token cookie — call on logout.
- */
-export function clearCsrfToken(c) {
-    deleteCookie(c, COOKIE_CSRF_TOKEN, { path: "/" });
-}
-export const csrfProtection = (options = {}) => {
-    const { exemptPaths = [], checkOrigin = true, allowedOrigins } = options;
-    // Normalize allowed origins for origin validation
-    const originSet = new Set();
-    if (allowedOrigins) {
-        const origins = Array.isArray(allowedOrigins) ? allowedOrigins : [allowedOrigins];
-        for (const o of origins) {
-            // "*" is intentionally excluded: validating against a wildcard would accept any origin,
-            // defeating the check. When CORS is open, origin validation is meaningless.
-            if (o !== "*")
-                originSet.add(o.replace(/\/$/, ""));
-        }
-    }
-    if (checkOrigin && originSet.size === 0) {
-        // Warn in all environments — this is a one-time startup message, not per-request noise,
-        // and a misconfigured production deployment should surface it.
-        console.warn("[bunshot] csrfProtection: checkOrigin is enabled but no specific allowed origins are " +
-            "configured (CORS is \"*\" or allowedOrigins is unset). Origin validation is disabled — " +
-            "only the HMAC double-submit cookie check is active. Set security.cors to specific " +
-            "origins to enable origin validation.");
-    }
-    return async (c, next) => {
-        const secret = getJwtSecret();
-        // Set CSRF cookie on every response if not already present
-        const existingCsrf = getCookie(c, COOKIE_CSRF_TOKEN);
-        if (!existingCsrf) {
-            const token = generateCsrfToken(secret);
-            setCookie(c, COOKIE_CSRF_TOKEN, token, csrfCookieOptions);
-        }
-        // Only validate state-changing methods
-        if (!STATE_CHANGING_METHODS.has(c.req.method)) {
-            return next();
-        }
-        // Skip if no auth cookie present — not vulnerable to CSRF
-        const authCookie = getCookie(c, COOKIE_TOKEN);
-        if (!authCookie) {
-            return next();
-        }
-        // Skip exempt paths
-        const path = c.req.path;
-        for (const exempt of exemptPaths) {
-            if (exempt.endsWith("*")) {
-                if (path.startsWith(exempt.slice(0, -1)))
-                    return next();
-            }
-            else {
-                if (path === exempt)
-                    return next();
-            }
-        }
-        // Origin validation (secondary layer)
-        if (checkOrigin && originSet.size > 0) {
-            const origin = c.req.header("origin");
-            if (origin) {
-                const normalized = origin.replace(/\/$/, "");
-                if (!originSet.has(normalized)) {
-                    return c.json({ error: "CSRF origin mismatch" }, 403);
-                }
-            }
-        }
-        // Double submit cookie validation
-        const csrfCookie = getCookie(c, COOKIE_CSRF_TOKEN);
-        const csrfHeader = c.req.header(HEADER_CSRF_TOKEN);
-        if (!csrfCookie || !csrfHeader) {
-            return c.json({ error: "CSRF token missing" }, 403);
-        }
-        // Verify the cookie's HMAC signature (prevents cookie injection)
-        if (!verifyCsrfSignature(csrfCookie, secret)) {
-            return c.json({ error: "CSRF token invalid" }, 403);
-        }
-        // Compare header value to cookie value
-        if (!timingSafeEqual(csrfHeader, csrfCookie)) {
-            return c.json({ error: "CSRF token mismatch" }, 403);
-        }
-        return next();
-    };
-};

package/dist/middleware/errorHandler.js

@@ -1,13 +0,0 @@
-import { HttpError } from "../lib/HttpError";
-export const errorHandler = async (req, next) => {
-    try {
-        return await next(req);
-    }
-    catch (err) {
-        console.error(err);
-        if (err instanceof HttpError) {
-            return Response.json({ error: err.message }, { status: err.status });
-        }
-        return Response.json({ error: "Internal Server Error" }, { status: 500 });
-    }
-};

package/dist/middleware/identify.d.ts

@@ -1,3 +0,0 @@
-import type { MiddlewareHandler } from "hono";
-import type { AppEnv } from "../lib/context";
-export declare const identify: MiddlewareHandler<AppEnv>;

package/dist/middleware/identify.js

@@ -1,95 +0,0 @@
-import { getCookie } from "hono/cookie";
-import { verifyToken } from "../lib/jwt";
-import { getSession, updateSessionLastActive, getSessionFingerprint, setSessionFingerprint } from "../lib/session";
-import { COOKIE_TOKEN, HEADER_USER_TOKEN } from "../lib/constants";
-import { log } from "../lib/logger";
-import { getTrackLastActive, getSigningConfig } from "../lib/appConfig";
-import { getClientIp } from "../lib/clientIp";
-import { sha256 } from "../lib/crypto";
-function computeFingerprint(c, fields) {
-    const parts = fields.map((f) => {
-        if (f === "ip")
-            return getClientIp(c) ?? "";
-        if (f === "ua")
-            return c.req.header("user-agent") ?? "";
-        return c.req.header("accept-language") ?? "";
-    });
-    return sha256(parts.join(":"));
-}
-export const identify = async (c, next) => {
-    c.set("authUserId", null);
-    c.set("roles", null);
-    c.set("sessionId", null);
-    // cookie for browsers, x-user-token header for non-browser clients
-    const token = getCookie(c, COOKIE_TOKEN) ?? c.req.header(HEADER_USER_TOKEN) ?? null;
-    log(`[identify] token=${token ? "present" : "absent"}`);
-    if (token) {
-        try {
-            const payload = await verifyToken(token);
-            const sessionId = payload.sid;
-            if (!sessionId) {
-                log("[identify] token missing sid claim — unauthenticated");
-            }
-            else {
-                const stored = await getSession(sessionId);
-                log(`[identify] token for authUserId=${payload.sub} verified, checking session...`);
-                if (stored === token) {
-                    const signingCfg = getSigningConfig();
-                    const bindingCfg = signingCfg?.sessionBinding;
-                    if (bindingCfg) {
-                        const bindingOpts = typeof bindingCfg === "object" ? bindingCfg : {};
-                        const fields = bindingOpts.fields ?? ["ip", "ua"];
-                        const onMismatch = bindingOpts.onMismatch ?? "unauthenticate";
-                        const current = computeFingerprint(c, fields);
-                        const storedFp = await getSessionFingerprint(sessionId);
-                        if (storedFp === null) {
-                            // First authenticated request — store the fingerprint
-                            setSessionFingerprint(sessionId, current).catch(() => {
-                                log(`[identify] failed to store fingerprint for sessionId=${sessionId}`);
-                            });
-                            c.set("authUserId", payload.sub);
-                            c.set("sessionId", sessionId);
-                        }
-                        else if (storedFp === current) {
-                            c.set("authUserId", payload.sub);
-                            c.set("sessionId", sessionId);
-                        }
-                        else {
-                            log(`[identify] fingerprint mismatch for sessionId=${sessionId} onMismatch=${onMismatch}`);
-                            if (onMismatch === "reject") {
-                                return c.json({ error: "Unauthorized", code: "FINGERPRINT_MISMATCH" }, 401);
-                            }
-                            else if (onMismatch === "log-only") {
-                                c.set("authUserId", payload.sub);
-                                c.set("sessionId", sessionId);
-                            }
-                            // onMismatch === "unauthenticate" — leave authUserId null (already null)
-                        }
-                    }
-                    else {
-                        c.set("authUserId", payload.sub);
-                        c.set("sessionId", sessionId);
-                    }
-                    if (c.get("authUserId")) {
-                        log(`[identify] authUserId=${payload.sub} sessionId=${sessionId}`);
-                        if (getTrackLastActive()) {
-                            updateSessionLastActive(sessionId).catch(() => {
-                                log(`[identify] failed to update lastActiveAt for sessionId=${sessionId}`);
-                            });
-                        }
-                    }
-                }
-                else {
-                    log("[identify] token/session mismatch — unauthenticated");
-                }
-            }
-        }
-        catch {
-            log("[identify] invalid token — unauthenticated");
-        }
-    }
-    else {
-        log("[identify] no token — unauthenticated");
-    }
-    await next();
-};

package/dist/middleware/index.js

@@ -1 +0,0 @@
-export const applyMiddleware = (handler, ...middleware) => middleware.reduceRight((next, mw) => (req) => mw(req, next), handler);

package/dist/middleware/metrics.d.ts

@@ -1,9 +0,0 @@
-import type { MiddlewareHandler } from "hono";
-import type { AppEnv } from "../lib/context";
-export interface MetricsMiddlewareOptions {
-    /** Paths to exclude from metrics collection. Strings use prefix matching. */
-    excludePaths?: (string | RegExp)[];
-    /** Custom path normalizer to prevent cardinality explosion. */
-    normalizePath?: (path: string) => string;
-}
-export declare const metricsCollector: (options?: MetricsMiddlewareOptions) => MiddlewareHandler<AppEnv>;

package/dist/middleware/metrics.js

@@ -1,26 +0,0 @@
-import { incrementCounter, observeHistogram, defaultNormalizePath } from "../lib/metrics";
-const DEFAULT_EXCLUDE = ["/metrics", "/health", "/docs", "/openapi.json"];
-export const metricsCollector = (options = {}) => {
-    const { excludePaths = DEFAULT_EXCLUDE, normalizePath = defaultNormalizePath, } = options;
-    return async (c, next) => {
-        const rawPath = c.req.path;
-        const excluded = excludePaths.some(p => typeof p === "string" ? rawPath.startsWith(p) : p.test(rawPath));
-        if (excluded)
-            return next();
-        const start = performance.now();
-        await next();
-        const duration = (performance.now() - start) / 1000; // seconds
-        const method = c.req.method;
-        const path = normalizePath(rawPath);
-        const status = String(c.res.status);
-        const tenantId = c.get("tenantId") ?? undefined;
-        const labels = { method, path, status };
-        const durationLabels = { method, path };
-        if (tenantId) {
-            labels.tenant = tenantId;
-            durationLabels.tenant = tenantId;
-        }
-        incrementCounter("http_requests_total", labels);
-        observeHistogram("http_request_duration_seconds", durationLabels, duration);
-    };
-};

package/dist/middleware/rateLimit.js

@@ -1,22 +0,0 @@
-import { trackAttempt } from "../lib/authRateLimit";
-import { buildFingerprint } from "../lib/fingerprint";
-import { getClientIp } from "../lib/clientIp";
-export const rateLimit = ({ windowMs, max, fingerprintLimit = false, }) => {
-    const opts = { windowMs, max };
-    return async (c, next) => {
-        const ip = getClientIp(c);
-        // Per-tenant namespacing: each tenant gets independent rate limit buckets
-        const tenantId = c.get("tenantId");
-        const prefix = tenantId ? `t:${tenantId}:` : "";
-        if (await trackAttempt(`${prefix}ip:${ip}`, opts)) {
-            return c.json({ error: "Too Many Requests" }, 429);
-        }
-        if (fingerprintLimit) {
-            const fp = await buildFingerprint(c.req.raw);
-            if (await trackAttempt(`${prefix}fp:${fp}`, opts)) {
-                return c.json({ error: "Too Many Requests" }, 429);
-            }
-        }
-        await next();
-    };
-};

package/dist/middleware/requestId.d.ts

@@ -1,3 +0,0 @@
-import type { MiddlewareHandler } from "hono";
-import type { AppEnv } from "../lib/context";
-export declare const requestId: MiddlewareHandler<AppEnv>;

package/dist/middleware/tenant.d.ts

@@ -1,5 +0,0 @@
-import type { MiddlewareHandler } from "hono";
-import type { AppEnv } from "../lib/context";
-import type { TenancyConfig } from "../app";
-export declare const invalidateTenantCache: (tenantId: string) => void;
-export declare const createTenantMiddleware: (config: TenancyConfig) => MiddlewareHandler<AppEnv>;