@lovrozagar/honey 0.1.0

package/src/init.ts

@@ -0,0 +1,149 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"
+import { basename, dirname, join } from "node:path"
+import { fileURLToPath } from "node:url"
+
+export type InitFlags = {
+	cf: boolean
+	force: boolean
+}
+
+type PackageJson = {
+	dependencies?: Record<string, string>
+	name?: string
+	private?: boolean
+	scripts?: Record<string, string>
+	type?: string
+}
+
+const APP_TS = `import { honey } from "@lovrozagar/honey"
+
+export const app = honey()
+	.get("/health")
+	.handler((ctx) => ctx.res.text("ok", "ok"))
+	.openapi({ docs: "scalar", title: "Honey", version: "0.0.1" })
+`
+
+const SERVER_TS = `import { app } from "./app.ts"
+
+const port = Number(process.env.PORT ?? 3000)
+await app.serve({ port })
+`
+
+const VITE_CONFIG_TS = `import { honey } from "@lovrozagar/honey/plugin"
+
+export default {
+	plugins: [
+		honey({
+			app: "src/app.ts",
+		}),
+	],
+}
+`
+
+const WORKER_TS = `import { cfWebSocket } from "@lovrozagar/honey/ws/cloudflare"
+import { app } from "./app.ts"
+
+app.wsAdapter(cfWebSocket())
+
+export default {
+	fetch: (req: Request, env: Record<string, unknown>, ctx: unknown) => app.fetch(req, env, ctx),
+}
+`
+
+export function parseInitFlags(args: string[]): InitFlags {
+	return {
+		cf: args.includes("--cf"),
+		force: args.includes("--force"),
+	}
+}
+
+export function runInit(cwd: string, flags: InitFlags): void {
+	const files: Record<string, string> = {
+		"src/app.ts": APP_TS,
+		"src/server.ts": SERVER_TS,
+		"vite.config.ts": VITE_CONFIG_TS,
+	}
+	if (flags.cf) {
+		files["src/worker.ts"] = WORKER_TS
+		files["wrangler.jsonc"] = wranglerJsonc(packageNameFromDir(cwd))
+	}
+
+	const collisions = Object.keys(files).filter((rel) => existsSync(join(cwd, rel)))
+	if (collisions.length > 0 && !flags.force) {
+		throw new Error(`${collisions[0]} already exists. Use --force to overwrite.`)
+	}
+
+	for (const [rel, contents] of Object.entries(files)) {
+		writeText(join(cwd, rel), contents)
+	}
+	writePackageJson(cwd)
+	console.log("honey: initialized")
+}
+
+function wranglerJsonc(name: string): string {
+	return `{
+	"compatibility_date": "2026-01-20",
+	"compatibility_flags": ["nodejs_compat"],
+	"main": "src/worker.ts",
+	"name": ${JSON.stringify(name)},
+	"workers_dev": true
+}
+`
+}
+
+function writePackageJson(cwd: string): void {
+	const path = join(cwd, "package.json")
+	const existing = existsSync(path) ? readPackageJson(path) : {}
+	const next: PackageJson = {
+		...existing,
+		name: existing.name ?? packageNameFromDir(cwd),
+		private: existing.private ?? true,
+		type: existing.type ?? "module",
+		scripts: {
+			...existing.scripts,
+			dev: "bun --watch src/server.ts",
+			generate: "honey generate",
+		},
+		dependencies: {
+			...existing.dependencies,
+			honey: existing.dependencies?.honey ?? `^${honeyVersion()}`,
+		},
+	}
+	writeText(path, `${JSON.stringify(next, null, "\t")}\n`)
+}
+
+function readPackageJson(path: string): PackageJson {
+	let parsed: unknown
+	try {
+		parsed = JSON.parse(readFileSync(path, "utf-8"))
+	} catch {
+		throw new Error(`package.json is not valid JSON`)
+	}
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+		throw new Error("package.json must be an object")
+	}
+	return parsed as PackageJson
+}
+
+function writeText(path: string, contents: string): void {
+	mkdirSync(dirname(path), { recursive: true })
+	writeFileSync(path, contents.endsWith("\n") ? contents : `${contents}\n`, "utf-8")
+}
+
+function packageNameFromDir(dir: string): string {
+	const base = basename(dir)
+		.toLowerCase()
+		.replace(/[^a-z0-9._-]+/g, "-")
+		.replace(/^[-.]+|[-.]+$/g, "")
+	return base || "honey-app"
+}
+
+function honeyVersion(): string {
+	try {
+		const pkgPath = join(dirname(fileURLToPath(import.meta.url)), "..", "package.json")
+		const pkg = JSON.parse(readFileSync(pkgPath, "utf-8")) as { version?: string }
+		return typeof pkg.version === "string" ? pkg.version : "0.0.1"
+	} catch {
+		return "0.0.1"
+	}
+}

package/src/input.ts

@@ -0,0 +1,8 @@
+export type ReadableStreamSchema<T> = {
+	readonly _tag: "readableStream"
+	readonly schema: T
+}
+
+export function readableStream<T>(schema: T): ReadableStreamSchema<T> {
+	return { _tag: "readableStream", schema }
+}

package/src/ip-restrict.ts

@@ -0,0 +1,192 @@
+import { HoneyError } from "./error.ts"
+import type { MiddlewareFn } from "./middleware.ts"
+import { EK, SK } from "./types.ts"
+
+type IpRestrictOptions = {
+	allowList?: string[]
+	denyList?: string[]
+	getIp?: (req: Request) => string | null
+	trustProxy?: boolean
+}
+
+function stripBrackets(ip: string): string {
+	if (ip.startsWith("[") && ip.endsWith("]")) {
+		return ip.slice(1, -1)
+	}
+	return ip
+}
+
+function defaultGetIp(req: Request): string | null {
+	const cfIp = req.headers.get("cf-connecting-ip")
+	if (cfIp) return stripBrackets(cfIp.trim())
+
+	return null
+}
+
+function proxyAwareGetIp(req: Request): string | null {
+	const cfIp = req.headers.get("cf-connecting-ip")
+	if (cfIp) return stripBrackets(cfIp.trim())
+
+	const xff = req.headers.get("x-forwarded-for")
+	if (xff) return stripBrackets(xff.split(",")[0].trim())
+
+	const realIp = req.headers.get("x-real-ip")
+	if (realIp) return stripBrackets(realIp.trim())
+
+	return null
+}
+
+function parseIpv4(ip: string): number | null {
+	const parts = ip.split(".")
+	if (parts.length !== 4) return null
+	let result = 0
+	for (const part of parts) {
+		const n = Number.parseInt(part, 10)
+		if (Number.isNaN(n) || n < 0 || n > 255) return null
+		result = (result << 8) | n
+	}
+	return result >>> 0
+}
+
+type Ipv4CidrRule = {
+	base: number
+	mask: number
+	v6: false
+}
+
+type Ipv6CidrRule = {
+	base: bigint
+	mask: bigint
+	v6: true
+}
+
+type CidrRule = Ipv4CidrRule | Ipv6CidrRule
+
+type ParsedRule = {
+	cidr?: CidrRule
+	exact: string
+}
+
+function expandIpv6(ip: string): bigint | null {
+	let addr = ip
+
+	/* handle ::ffff:1.2.3.4 mapped IPv4 */
+	const v4Suffix = addr.match(/:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/)
+	if (v4Suffix) {
+		const v4 = parseIpv4(v4Suffix[1])
+		if (v4 === null) return null
+		addr = `${addr.slice(0, addr.lastIndexOf(":"))}:${((v4 >>> 16) & 0xffff).toString(16)}:${(v4 & 0xffff).toString(16)}`
+	}
+
+	/* expand :: */
+	const halves = addr.split("::")
+	if (halves.length > 2) return null
+
+	let groups: string[]
+	if (halves.length === 2) {
+		const left = halves[0] === "" ? [] : halves[0].split(":")
+		const right = halves[1] === "" ? [] : halves[1].split(":")
+		const fill = 8 - left.length - right.length
+		if (fill < 0) return null
+		groups = [...left, ...Array.from<string>({ length: fill }).fill("0"), ...right]
+	} else {
+		groups = addr.split(":")
+	}
+
+	if (groups.length !== 8) return null
+
+	let result = 0n
+	for (const g of groups) {
+		const n = Number.parseInt(g, 16)
+		if (Number.isNaN(n) || n < 0 || n > 0xffff) return null
+		result = (result << 16n) | BigInt(n)
+	}
+	return result
+}
+
+function isIpv6(ip: string): boolean {
+	return ip.includes(":")
+}
+
+function parseRule(rule: string): ParsedRule {
+	const slashIdx = rule.indexOf("/")
+	if (slashIdx === -1) {
+		return { exact: rule }
+	}
+
+	const ip = rule.slice(0, slashIdx)
+	const bits = Number.parseInt(rule.slice(slashIdx + 1), 10)
+
+	if (isIpv6(ip)) {
+		const base = expandIpv6(ip)
+		if (base === null || Number.isNaN(bits) || bits < 0 || bits > 128) {
+			return { exact: rule }
+		}
+		const mask = bits === 0 ? 0n : ((1n << BigInt(bits)) - 1n) << BigInt(128 - bits)
+		return { cidr: { base: base & mask, mask, v6: true }, exact: rule }
+	}
+
+	const base = parseIpv4(ip)
+	if (base === null || Number.isNaN(bits) || bits < 0 || bits > 32) {
+		return { exact: rule }
+	}
+
+	const mask = bits === 0 ? 0 : (~0 << (32 - bits)) >>> 0
+	return { cidr: { base: (base & mask) >>> 0, mask, v6: false }, exact: rule }
+}
+
+function matchesRule(ip: string, rule: ParsedRule): boolean {
+	if (rule.cidr) {
+		if (rule.cidr.v6) {
+			const parsed = expandIpv6(ip)
+			if (parsed === null) return false
+			return (parsed & rule.cidr.mask) === rule.cidr.base
+		}
+		const parsed = parseIpv4(ip)
+		if (parsed === null) return false
+		return (parsed & rule.cidr.mask) >>> 0 === rule.cidr.base
+	}
+	return ip === rule.exact
+}
+
+function throwForbidden(): never {
+	throw new HoneyError({
+		errorKey: EK.forbidden,
+		status: SK.forbidden,
+	})
+}
+
+export function ipRestrict(opts: IpRestrictOptions): MiddlewareFn<{ req: Request }, {}> {
+	const getIp = opts.getIp ?? (opts.trustProxy === true ? proxyAwareGetIp : defaultGetIp)
+	const denyRules = opts.denyList?.map(parseRule) ?? []
+	const allowRules = opts.allowList?.map(parseRule) ?? []
+	const hasAllowList = allowRules.length > 0
+
+	const mw: MiddlewareFn<{ req: Request }, {}> = (ctx, next) => {
+		const ip = getIp(ctx.req)
+
+		/* deny list checked first */
+		if (ip !== null) {
+			for (const rule of denyRules) {
+				if (matchesRule(ip, rule)) throwForbidden()
+			}
+		}
+
+		/* allow list: if set, IP must match at least one rule */
+		if (hasAllowList) {
+			if (ip === null) throwForbidden()
+			let allowed = false
+			for (const rule of allowRules) {
+				if (matchesRule(ip, rule)) {
+					allowed = true
+					break
+				}
+			}
+			if (!allowed) throwForbidden()
+		}
+
+		return next()
+	}
+
+	return mw
+}

package/src/logger.ts

@@ -0,0 +1,149 @@
+import type { MiddlewareFn } from "./middleware.ts"
+
+/* ── log levels (pino-compatible numeric values) ── */
+
+type LogLevel = "debug" | "error" | "fatal" | "info" | "trace" | "warn"
+
+const LEVELS: Record<LogLevel, number> = {
+	debug: 20,
+	error: 50,
+	fatal: 60,
+	info: 30,
+	trace: 10,
+	warn: 40,
+}
+
+/* ── logger instance ── */
+
+type LoggerInstance = {
+	child(bindings: Record<string, unknown>): LoggerInstance
+	debug(msg: string): void
+	debug(obj: Record<string, unknown>, msg?: string): void
+	error(msg: string): void
+	error(obj: Record<string, unknown>, msg?: string): void
+	fatal(msg: string): void
+	fatal(obj: Record<string, unknown>, msg?: string): void
+	info(msg: string): void
+	info(obj: Record<string, unknown>, msg?: string): void
+	level: LogLevel
+	trace(msg: string): void
+	trace(obj: Record<string, unknown>, msg?: string): void
+	warn(msg: string): void
+	warn(obj: Record<string, unknown>, msg?: string): void
+}
+
+type CreateLoggerOptions = {
+	base?: Record<string, unknown>
+	level?: LogLevel
+	write?: (line: string) => void
+}
+
+function createLogger(opts?: CreateLoggerOptions): LoggerInstance {
+	const threshold = LEVELS[opts?.level ?? "info"]
+	const write = opts?.write ?? ((line: string) => console.log(line))
+	const base = opts?.base ?? {}
+
+	function emit(level: number, first: Record<string, unknown> | string, second?: string): void {
+		if (level < threshold) return
+		const obj = typeof first === "string"
+			? { ...base, level, msg: first, time: Date.now() }
+			: { ...base, ...first, level, msg: second ?? "", time: Date.now() }
+		write(JSON.stringify(obj))
+	}
+
+	const instance: LoggerInstance = {
+		child(bindings: Record<string, unknown>): LoggerInstance {
+			return createLogger({
+				base: { ...base, ...bindings },
+				level: opts?.level,
+				write,
+			})
+		},
+		debug: (first: Record<string, unknown> | string, second?: string) => emit(LEVELS.debug, first, second),
+		error: (first: Record<string, unknown> | string, second?: string) => emit(LEVELS.error, first, second),
+		fatal: (first: Record<string, unknown> | string, second?: string) => emit(LEVELS.fatal, first, second),
+		info: (first: Record<string, unknown> | string, second?: string) => emit(LEVELS.info, first, second),
+		level: opts?.level ?? "info",
+		trace: (first: Record<string, unknown> | string, second?: string) => emit(LEVELS.trace, first, second),
+		warn: (first: Record<string, unknown> | string, second?: string) => emit(LEVELS.warn, first, second),
+	}
+
+	return instance
+}
+
+/* ── request lifecycle middleware ── */
+
+type LogData = {
+	duration: number
+	method: string
+	path: string
+	requestId: string | null
+	status: number
+}
+
+type LoggerOptions = {
+	instance?: LoggerInstance
+	log?: (data: LogData) => void
+	skip?: (data: LogData) => boolean
+}
+
+function defaultLog(data: LogData): void {
+	const rid = data.requestId ? ` ${data.requestId}` : ""
+	console.log(`${data.method} ${data.path} ${data.status} ${data.duration.toFixed(2)}ms${rid}`)
+}
+
+const noop = () => {}
+const noopLogger: LoggerInstance = createLogger({ level: "fatal", write: noop })
+
+function logger(
+	options?: LoggerOptions,
+): MiddlewareFn<{ path: string, req: Request }, { log: LoggerInstance }> {
+	const log = options?.log ?? defaultLog
+	const skip = options?.skip
+	const instance = options?.instance
+
+	return async (ctx, next) => {
+		const start = performance.now()
+		const method = ctx.req.method
+		const path = ctx.path
+		const rid = (ctx as Record<string, unknown>)["requestId"] as string | null ?? null
+
+		const child = instance
+			? instance.child({
+				method,
+				path,
+				...(rid ? { requestId: rid } : {}),
+			})
+			: noopLogger
+
+		if (instance) {
+			child.info(`--> ${method} ${path}`)
+		}
+
+		const response = await next({ log: child })
+
+		const duration = performance.now() - start
+		const data: LogData = {
+			duration,
+			method,
+			path,
+			requestId: rid,
+			status: response.status,
+		}
+
+		if (skip?.(data)) {
+			return response
+		}
+
+		if (instance) {
+			child.info({ duration, status: response.status }, `<-- ${method} ${path}`)
+		} else {
+			log(data)
+		}
+
+		return response
+	}
+}
+
+export { createLogger, logger }
+export type { CreateLoggerOptions, LogData, LoggerInstance, LoggerOptions, LogLevel }

package/src/middleware.ts

@@ -0,0 +1,199 @@
+/** phantom wrapper — at runtime it's just Response, carries TAdds for inference */
+export type MiddlewareResult<TAdds = {}> = Response & {
+	readonly __adds?: TAdds;
+};
+
+export type MiddlewareFn<
+	TCtx = {},
+	TAdds = {},
+	TErrors extends string = string,
+> = ((
+	ctx: TCtx,
+	next: {
+		<T>(additions: T): Promise<MiddlewareResult<T>>;
+		(): Promise<MiddlewareResult<{}>>;
+	},
+) => Promise<MiddlewareResult<TAdds>>) & {
+	errors?: readonly TErrors[];
+};
+
+/** runtime type for stored middleware — erased generics, used internally */
+export type RuntimeMiddleware = (
+	ctx: Record<string, unknown>,
+	next: (additions?: Record<string, unknown>) => Promise<Response>,
+) => Promise<Response>;
+
+/**
+ * Create middleware with error keys constrained to a factory.
+ * Error keys are stored on the function and auto-accumulated by .use().
+ */
+export function defineMiddleware<
+	TReqs,
+	TAdds,
+	TFactory extends Record<string, (...args: never[]) => unknown>,
+	TKeys extends keyof TFactory & string,
+>(opts: {
+	errors?: [TFactory, ...TKeys[]];
+	fn: MiddlewareFn<TReqs, TAdds>;
+}): MiddlewareFn<TReqs, TAdds, TKeys> {
+	const fn = opts.fn as MiddlewareFn<TReqs, TAdds, TKeys>;
+	if (opts.errors) {
+		const [, ...keys] = opts.errors;
+		Object.defineProperty(fn, "errors", { value: keys });
+	}
+	return fn;
+}
+
+type NextFn = {
+	<T>(additions: T): Promise<MiddlewareResult<T>>;
+	(): Promise<MiddlewareResult<{}>>;
+};
+
+/** Extract TAdds from callback return type — distributes over unions */
+type ExtractAdds<T> = T extends Promise<MiddlewareResult<infer A>> ? A : never
+
+/**
+ * Middleware factory — annotate ctx for TReqs, TAdds inferred from return type:
+ *   createMiddleware((ctx: { env: { DB: D1Database } }, next) => next({ db }))
+ */
+export function createMiddleware<TReqs = {}, TRet extends Promise<Response> = Promise<MiddlewareResult<{}>>>(
+	fn: (ctx: TReqs, next: NextFn) => TRet,
+): MiddlewareFn<TReqs, ExtractAdds<TRet>> {
+	return fn as MiddlewareFn<TReqs, ExtractAdds<TRet>>
+}
+
+/**
+ * Context properties that middleware additions must not overwrite.
+ * These are set by the framework during request construction.
+ * TypeScript prevents this at compile time; this guard catches runtime bypasses.
+ */
+const RESERVED_CTX_KEYS = new Set([
+	"background",
+	"cookies",
+	"env",
+	"headers",
+	"params",
+	"req",
+	"res",
+	"search",
+]);
+
+/**
+ * Compile a middleware chain + handler into a single function at registration time.
+ * Eliminates per-request recursive dispatch, closure allocation, and Promise.resolve wrapping.
+ */
+export function compileChain(
+	middlewares: RuntimeMiddleware[],
+	handler: (ctx: object) => Response | Promise<Response>,
+): (ctx: object) => Response | Promise<Response> {
+	if (middlewares.length === 0) {
+		/* sync fast path — avoids microtask overhead for sync handlers */
+		return (ctx) => {
+			const result = handler(ctx);
+			if (result instanceof Promise) {
+				return result.then(validateResponse);
+			}
+			if (result === undefined || result === null) {
+				throw new Error(
+					"handler must return a Response — did you forget 'return ctx.res...()'?",
+				);
+			}
+			return result;
+		};
+	}
+
+	if (middlewares.length === 1) {
+		const mw = middlewares[0];
+		if (!mw) {
+			throw new Error("middleware chain invariant violated");
+		}
+		return (ctx) => {
+			const mwCtx = ctx as Record<string, unknown>;
+			let called = false;
+			return Promise.resolve(
+				mw(mwCtx, (additions?: Record<string, unknown>) => {
+					if (called) throw new Error("next() called multiple times");
+					called = true;
+					if (additions) mergeAdditions(ctx, additions);
+					return Promise.resolve(handler(ctx)).then(validateResponse);
+				}),
+			).then(validateMiddlewareResponse);
+		};
+	}
+
+	/* general case — pre-bind middleware array, no per-request index tracking */
+	return (ctx) => executeChain(middlewares, ctx, handler);
+}
+
+function mergeAdditions(ctx: object, additions: Record<string, unknown>): void {
+	for (const key in additions) {
+		if (!RESERVED_CTX_KEYS.has(key)) {
+			(ctx as Record<string, unknown>)[key] = additions[key];
+		}
+	}
+}
+
+function validateResponse(result: Response): Response {
+	if (result === undefined || result === null) {
+		throw new Error(
+			"handler must return a Response — did you forget 'return ctx.res...()'?",
+		);
+	}
+	return result;
+}
+
+function validateMiddlewareResponse(result: Response): Response {
+	if (result === undefined || result === null) {
+		throw new Error(
+			"middleware must return a Response — did you forget 'return next(...)'?",
+		);
+	}
+	return result;
+}
+
+export function executeChain(
+	middlewares: RuntimeMiddleware[],
+	ctx: object,
+	handler: (ctx: object) => Response | Promise<Response>,
+): Promise<Response> {
+	let index = 0;
+	/* middleware runtime type uses Record<string, unknown> — object satisfies at runtime */
+	const mwCtx = ctx as Record<string, unknown>;
+
+	function dispatch(): Promise<Response> {
+		if (index >= middlewares.length) {
+			return Promise.resolve(handler(ctx)).then((result) => {
+				if (result === undefined || result === null) {
+					throw new Error(
+						"handler must return a Response — did you forget 'return ctx.res...()'?",
+					);
+				}
+				return result;
+			});
+		}
+		const mw = middlewares[index++];
+		if (!mw) {
+			throw new Error("middleware chain invariant violated");
+		}
+		let called = false;
+		return Promise.resolve(
+			mw(mwCtx, (additions?: Record<string, unknown>) => {
+				if (called) {
+					throw new Error("next() called multiple times");
+				}
+				called = true;
+				if (additions) mergeAdditions(ctx, additions);
+				return dispatch();
+			}),
+		).then((result) => {
+			if (result === undefined || result === null) {
+				throw new Error(
+					"middleware must return a Response — did you forget 'return next(...)'?",
+				);
+			}
+			return result;
+		});
+	}
+
+	return dispatch();
+}