@lovrozagar/honey 0.7.3 → 1.0.0-rc.3

package/src/context.ts

@@ -1,325 +0,0 @@
-import { isNodeOutbound } from "./honey-response.ts"
-import type { HoneyError } from "./error.ts"
-import type { ProducerOptions } from "./producer-stream.ts"
-import type { SSEOptions, SSEStream, TypedResponse } from "./response.ts"
-import { HoneyRes } from "./response.ts"
-import { dict } from "./dict.ts"
-import { peerAddressOf } from "./peer.ts"
-import { resolveClient, TRUST_OFF, type ClientInfo, type TrustSetting } from "./client-info.ts"
-import type { PendingTap } from "./types.ts"
-import { EMPTY_OBJ } from "./types.ts"
-import { parseCookies } from "./validation.ts"
-
-/**
- * Per-request res with lazy lastEventId — only reads the header when SSE is actually called.
- * All non-SSE methods (json/text/html/etc) are inherited from HoneyRes with zero overhead.
- */
-class ContextRes extends HoneyRes {
-	private _req: Request
-	private _ctx: HoneyContext<unknown>
-	private _lastEventId: string | undefined | false = false
-
-	constructor(req: Request, ctx: HoneyContext<unknown>) {
-		super(isNodeOutbound(req))
-		this._req = req
-		this._ctx = ctx
-	}
-
-	/** Streams end with the request: `ctx.signal`. Producer failures go to the app logger. */
-	protected override _producer(): ProducerOptions {
-		const ctx = this._ctx
-		return {
-			report: (err) => reportStreamError(ctx, err),
-			signal: () => ctx.signal,
-		}
-	}
-
-	override sse(
-		callback: (stream: SSEStream) => Promise<void>,
-		opts?: SSEOptions,
-	): TypedResponse<"text/event-stream", "ok"> {
-		if (this._lastEventId === false) {
-			this._lastEventId = this._req.headers.get("last-event-id") ?? undefined
-		}
-		return super.sse(callback, {
-			...opts,
-			lastEventId: opts?.lastEventId ?? this._lastEventId,
-		})
-	}
-}
-function parseSearch(ctx: HoneyContext): void {
-	const url = ctx._lzUrlFn ? ctx._lzUrlFn() : new URL(ctx.req.url)
-	/* keys are request data: no prototype, so `?__proto__=` or `?toString=` is just a key */
-	const first = dict<string>()
-	const all = dict<string[]>()
-	for (const [key, value] of url.searchParams) {
-		const values = all[key]
-		if (values === undefined) {
-			first[key] = value
-			all[key] = [value]
-		} else {
-			values.push(value)
-		}
-	}
-	ctx._lzSearch = first
-	ctx._lzSearchAll = all
-}
-
-/** What `ctx._rq` carries for client-info resolution; the dispatcher's FetchCtx has these fields. */
-type ClientSource = { env?: unknown; request?: Request; trust?: TrustSetting }
-
-/**
- * The client address, scheme and host of the request `ctx` serves, decided by the app's
- * `trustProxy()` setting. `ctx.ip` is its `ip`.
- */
-export function clientInfo(ctx: HoneyContext<never> | HoneyContext): ClientInfo {
-	const c = ctx as HoneyContext
-	if (c._lzClient === null) {
-		const src = (c._rq ?? {}) as ClientSource
-		/* the peer is registered on the request the adapter handed over; headers are read from
-		 * ctx.req, which survives Deno's upgrade (a header snapshot) */
-		const peer = peerAddressOf(src.request ?? c.req, src.env ?? c.env)
-		c._lzClient = resolveClient(src.trust ?? TRUST_OFF, c.req, peer)
-	}
-	return c._lzClient
-}
-
-function bgSwallow(p: Promise<unknown>) {
-	p.catch(noop)
-}
-function noop() {}
-
-/**
- * HoneyContext uses `declare` for properties set after construction and
- * class-level getters for lazy-computed properties. No Object.defineProperty
- * on the hot path — V8 optimizes class shapes via hidden classes.
- *
- * `declare` fields have no private brand, so Omit<HoneyContext, "res">
- * works structurally for ApplyOutput type narrowing.
- */
-type Logger = { error?: (obj: unknown, msg?: string) => void }
-
-function reportStreamError(ctx: HoneyContext<unknown>, err: unknown): void {
-	const log = (ctx._rq as { log?: Logger } | null)?.log
-	if (typeof log?.error === "function") {
-		log.error({ err, path: ctx.path }, "stream producer failed")
-		return
-	}
-	console.error("honey: stream producer failed", err)
-}
-
-/**
- * Abort `ctx.signal` (with `reason`) for the request `ctx` serves: `timeout()` uses it. Streams
- * still running for the request end, and handlers that pass the signal on stop their work.
- */
-export function abortRequest(ctx: HoneyContext<never> | HoneyContext, reason?: unknown): void {
-	const c = ctx as HoneyContext
-	if (c._ac === null) linkSignal(c)
-	c._ac?.abort(reason)
-}
-
-/** Create `ctx.signal`, following the request's own signal (client disconnect, shutdown). */
-function linkSignal(ctx: HoneyContext): AbortSignal {
-	const ac = new AbortController()
-	ctx._ac = ac
-	let request: AbortSignal | undefined
-	try {
-		request = ctx.req.signal
-	} catch {
-		/* a request shim without a signal: only timeout() can abort */
-	}
-	if (request !== undefined && request !== null) {
-		if (request.aborted) ac.abort(request.reason)
-		else request.addEventListener("abort", () => ac.abort(request.reason), { once: true })
-	}
-	return ac.signal
-}
-
-export class HoneyContext<TEnv = Record<string, unknown>> {
-	readonly background: (p: Promise<unknown>) => void
-	readonly env: TEnv
-	readonly params: Record<string, string>
-	readonly req: Request
-	readonly res: HoneyRes
-
-	/* set after construction — declare keeps them off the private brand */
-	declare readonly cookies: Record<string, string>
-	declare readonly errors: Record<string, (...args: never[]) => unknown>
-	declare readonly executionCtx: { waitUntil?: (p: Promise<unknown>) => void } | undefined
-	declare readonly headers: Record<string, string>
-	/**
-	 * The client's IP address in canonical form (`::ffff:1.2.3.4` is `1.2.3.4`), or `null` when
-	 * the runtime does not report one. Behind reverse proxies, set `app.trustProxy()`; until then
-	 * this is the proxy's address and forwarding headers are ignored.
-	 */
-	declare readonly ip: string | null
-	declare readonly meta: Record<string, unknown>
-	declare readonly path: string
-	/** Publish into a realtime namespace (see `RealtimePublisher`); spelled out so generated types inline it. */
-	declare readonly realtime: {
-		publish(topic: string, data: unknown): void
-		namespace(name: string): { publish(topic: string, data: unknown): void }
-	}
-	declare readonly routePattern: string
-	declare readonly search: Record<string, string>
-	declare readonly searchAll: Record<string, string[]>
-	/**
-	 * Aborts when the client disconnects, when `timeout()` fires, or when the server shuts down.
-	 * Pass it to `fetch()`, database drivers and timers so abandoned work stops; streams from
-	 * `ctx.res.sse()`, `stream()` and `generate()` already end with it.
-	 */
-	declare readonly signal: AbortSignal
-	/**
-	 * The error behind the response, once a handler or a deeper middleware threw and the
-	 * `next()` boundary turned it into an error response; `undefined` while nothing failed.
-	 * Read it after `await next()` for metrics, logs or reporting: `errorKey`, `status`, and
-	 * `cause` (the original throw when it was not a `HoneyError`). Later errors replace it.
-	 */
-	declare readonly error: HoneyError | undefined
-
-	/* backing state for lazy getters — stored directly on instance to avoid extra object allocation */
-	/** @internal */ _ac: AbortController | null
-	/** @internal */ _lzClient: ClientInfo | null
-	/** @internal */ _lzCookies: Record<string, string> | null
-	/** @internal */ _lzHeaders: Record<string, string> | null
-	/** @internal */ _lzSearch: Record<string, string> | null
-	/** @internal */ _lzSearchAll: Record<string, string[]> | null
-	/** @internal */ _lzUrlFn: (() => URL) | null
-
-	/* error propagation — lets handler errors flow back through middleware chain */
-	/** @internal */ _errorToResponse: ((thrown: unknown) => Promise<Response>) | null
-	/** @internal */ _isErrorResponse: boolean
-
-	/* tap side-effects — queued by c.tap(), drained after handler */
-	/** @internal */ _pendingTaps: PendingTap[] | null
-
-	/* the request this context serves — read by the error boundary and terminal handlers */
-	/** @internal */ _rq: unknown
-
-	constructor(opts: {
-		env: TEnv
-		executionCtx?: { waitUntil?: (p: Promise<unknown>) => void }
-		meta?: Record<string, unknown>
-		params: Record<string, string>
-		path?: string
-		req: Request
-		routePattern?: string
-		urlFn?: () => URL
-	}) {
-		this.req = opts.req
-		this.env = opts.env
-		this.params = opts.params
-		this.res = new ContextRes(opts.req, this as HoneyContext<unknown>)
-
-		/* direct assignment — no defineProperty */
-		;(this as Record<string, unknown>)["executionCtx"] = opts.executionCtx
-		;(this as Record<string, unknown>)["path"] = opts.path ?? ""
-		;(this as Record<string, unknown>)["routePattern"] = opts.routePattern ?? ""
-		;(this as Record<string, unknown>)["meta"] = opts.meta ?? EMPTY_OBJ
-
-		/* invoke through executionCtx so `this` binds to the owning object — workerd's native ExecutionContext.waitUntil throws "Illegal invocation" when called detached */
-		const executionCtx = opts.executionCtx
-		const waitUntil = executionCtx?.waitUntil
-		this.background = waitUntil
-			? (p: Promise<unknown>) => {
-					waitUntil.call(executionCtx, p)
-				}
-			: bgSwallow
-
-		/* lazy getter backing — flat on instance, no extra object */
-		this._ac = null
-		this._lzClient = null
-		this._lzCookies = null
-		this._lzHeaders = null
-		this._lzSearch = null
-		this._lzSearchAll = null
-		this._lzUrlFn = opts.urlFn ?? null
-
-		/* error propagation */
-		;(this as Record<string, unknown>)["error"] = undefined
-		this._errorToResponse = null
-		this._isErrorResponse = false
-
-		/* taps */
-		this._pendingTaps = null
-
-		this._rq = null
-	}
-
-	/** @internal */
-	_setErrors(errors: Record<string, (...args: never[]) => unknown>): void {
-		;(this as { errors: typeof errors }).errors = errors
-	}
-
-	/** Queue a side-effect to fire after handler returns successfully */
-	tap(key: string, payload: unknown): void {
-		if (this._pendingTaps === null) {
-			this._pendingTaps = [{ key, payload }]
-		} else {
-			this._pendingTaps.push({ key, payload })
-		}
-	}
-
-	/* lazy getters on prototype — V8 hidden class optimized, no per-instance defineProperty */
-
-	static {
-		Object.defineProperty(HoneyContext.prototype, "cookies", {
-			configurable: true,
-			enumerable: true,
-			get(this: HoneyContext): Record<string, string> {
-				if (this._lzCookies === null) {
-					this._lzCookies = parseCookies(this.req.headers.get("cookie") ?? "")
-				}
-				return this._lzCookies
-			},
-		})
-		Object.defineProperty(HoneyContext.prototype, "headers", {
-			configurable: true,
-			enumerable: true,
-			get(this: HoneyContext): Record<string, string> {
-				if (this._lzHeaders === null) {
-					const h = dict<string>()
-					this.req.headers.forEach((value, key) => {
-						h[key] = value
-					})
-					this._lzHeaders = h
-				}
-				return this._lzHeaders
-			},
-		})
-		Object.defineProperty(HoneyContext.prototype, "ip", {
-			configurable: true,
-			enumerable: true,
-			get(this: HoneyContext): string | null {
-				return clientInfo(this).ip
-			},
-		})
-		Object.defineProperty(HoneyContext.prototype, "signal", {
-			configurable: true,
-			enumerable: true,
-			get(this: HoneyContext): AbortSignal {
-				return this._ac === null ? linkSignal(this) : this._ac.signal
-			},
-		})
-		Object.defineProperty(HoneyContext.prototype, "search", {
-			configurable: true,
-			enumerable: true,
-			get(this: HoneyContext): Record<string, string> {
-				if (this._lzSearch === null) {
-					parseSearch(this)
-				}
-				return this._lzSearch as Record<string, string>
-			},
-		})
-		Object.defineProperty(HoneyContext.prototype, "searchAll", {
-			configurable: true,
-			enumerable: true,
-			get(this: HoneyContext): Record<string, string[]> {
-				if (this._lzSearchAll === null) {
-					parseSearch(this)
-				}
-				return this._lzSearchAll as Record<string, string[]>
-			},
-		})
-	}
-}

package/src/cookie-sign.ts

@@ -1,119 +0,0 @@
-const encoder = new TextEncoder()
-
-/**
- * Signed value formats:
- *
- * - v2 (current): `<value>.~<sig>`, where `sig` is the HMAC-SHA256 of
- *   `"honey-cookie-v2\0" + name + "\0" + value`. The cookie name is bound into
- *   the MAC, so a signature cannot be replayed under another cookie that shares
- *   the secret. `~` is outside the base64url alphabet, so the two formats never
- *   overlap.
- * - v1 (legacy): `<value>.<sig>`, the HMAC of the value alone. `verify` accepts
- *   it while `legacy` is true (the default) so cookies issued before the change
- *   keep working during a migration window.
- */
-const V2_MARKER = "~"
-const V2_DOMAIN = "honey-cookie-v2\0"
-/* An HMAC-SHA256 tag is 32 bytes: 43 base64url characters, no padding. */
-const SIG_RE = /^[A-Za-z0-9_-]{43}$/
-
-export type SignOptions = {
-	/** The cookie name to bind the signature to. Pass the same name to `verify`. */
-	name?: string
-}
-
-export type VerifyOptions = {
-	/** The cookie name the signature must be bound to. */
-	name?: string
-	/**
-	 * Also accept legacy (v1) signatures, which are not bound to a name.
-	 * Default `true`; set `false` once every v1 cookie has expired.
-	 */
-	legacy?: boolean
-}
-
-const MAX_CACHED_KEYS = 32
-const keyCache = new Map<string, Promise<CryptoKey>>()
-
-function importKey(secret: string): Promise<CryptoKey> {
-	let key = keyCache.get(secret)
-	if (key === undefined) {
-		key = crypto.subtle.importKey("raw", encoder.encode(secret), { hash: "SHA-256", name: "HMAC" }, false, [
-			"sign",
-			"verify",
-		])
-		if (keyCache.size >= MAX_CACHED_KEYS) {
-			const oldest = keyCache.keys().next().value
-			if (oldest !== undefined) keyCache.delete(oldest)
-		}
-		keyCache.set(secret, key)
-		/* A rejected import must not stay cached. */
-		key.catch(() => keyCache.delete(secret))
-	}
-	return key
-}
-
-function toBase64Url(buffer: ArrayBuffer): string {
-	const bytes = new Uint8Array(buffer)
-	let binary = ""
-	for (let i = 0; i < bytes.length; i++) {
-		binary += String.fromCharCode(bytes[i])
-	}
-	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "")
-}
-
-/** Strict decode: the input must be the canonical encoding of a 32-byte tag. */
-function fromBase64Url(str: string): Uint8Array<ArrayBuffer> | null {
-	if (!SIG_RE.test(str)) return null
-	let binary: string
-	try {
-		binary = atob(str.replace(/-/g, "+").replace(/_/g, "/"))
-	} catch {
-		return null
-	}
-	const bytes = new Uint8Array(binary.length)
-	for (let i = 0; i < binary.length; i++) {
-		bytes[i] = binary.charCodeAt(i)
-	}
-	/* Reject non-zero trailing bits, which would make signatures malleable. */
-	if (toBase64Url(bytes.buffer) !== str) return null
-	return bytes
-}
-
-function v2Payload(name: string, value: string): Uint8Array<ArrayBuffer> {
-	return encoder.encode(`${V2_DOMAIN}${name}\0${value}`)
-}
-
-export async function sign(value: string, secret: string, opts: SignOptions = {}): Promise<string> {
-	const key = await importKey(secret)
-	const signature = await crypto.subtle.sign("HMAC", key, v2Payload(opts.name ?? "", value))
-	return `${value}.${V2_MARKER}${toBase64Url(signature)}`
-}
-
-/** Returns the original value, or `null` when no secret verifies it or the input is malformed. */
-export async function verify(signed: string, secrets: string[], opts: VerifyOptions = {}): Promise<string | null> {
-	if (typeof signed !== "string" || signed.length === 0) return null
-	const lastDot = signed.lastIndexOf(".")
-	if (lastDot === -1) return null
-
-	const value = signed.slice(0, lastDot)
-	let sigText = signed.slice(lastDot + 1)
-	const isV2 = sigText.startsWith(V2_MARKER)
-	if (isV2) sigText = sigText.slice(V2_MARKER.length)
-	else if (opts.legacy === false) return null
-
-	const sig = fromBase64Url(sigText)
-	if (sig === null) return null
-	const payload = isV2 ? v2Payload(opts.name ?? "", value) : encoder.encode(value)
-
-	for (const secret of secrets) {
-		try {
-			const key = await importKey(secret)
-			if (await crypto.subtle.verify("HMAC", key, sig, payload)) return value
-		} catch {
-			/* An unusable secret never verifies. */
-		}
-	}
-
-	return null
-}

package/src/cookie.ts

@@ -1,143 +0,0 @@
-export type CookieOptions = {
-	domain?: string
-	expires?: Date
-	httpOnly?: boolean
-	maxAge?: number
-	path?: string
-	sameSite?: "lax" | "none" | "strict"
-	secure?: boolean
-	value: string
-}
-
-const UNSAFE_KEYS = new Set(["__proto__", "constructor", "prototype"])
-
-/**
- * Percent-encode characters outside the RFC 6265 cookie-octet range, plus `%`
- * itself so the value always decodes back to what was set.
- * Cookie-octets: 0x21, 0x23-0x2B, 0x2D-0x3A, 0x3C-0x5B, 0x5D-0x7E
- */
-function encodeCookieValue(value: string): string {
-	let encoded = ""
-	for (const ch of value) {
-		const c = ch.codePointAt(0) ?? 0
-		if (
-			c !== 0x25 &&
-			(c === 0x21 ||
-				(c >= 0x23 && c <= 0x2b) ||
-				(c >= 0x2d && c <= 0x3a) ||
-				(c >= 0x3c && c <= 0x5b) ||
-				(c >= 0x5d && c <= 0x7e))
-		) {
-			encoded += ch
-		} else if (c >= 0xd800 && c <= 0xdfff) {
-			throw new TypeError("Cookie value contains a lone surrogate and cannot be encoded")
-		} else {
-			encoded += encodeURIComponent(ch)
-		}
-	}
-	return encoded
-}
-
-/**
- * Decode `%XX` sequences that form valid UTF-8 and keep every other byte as
- * sent. A stray `%` in a foreign cookie no longer disables decoding for the
- * whole value.
- */
-export function decodeCookieValue(value: string): string {
-	if (value.indexOf("%") === -1) return value
-	try {
-		return decodeURIComponent(value)
-	} catch {
-		return value.replace(/(?:%[0-9A-Fa-f]{2})+/g, (run) => {
-			try {
-				return decodeURIComponent(run)
-			} catch {
-				return run
-			}
-		})
-	}
-}
-
-/**
- * Parse a `Cookie` request header. When a name repeats, the first value wins:
- * browsers send the cookie with the most specific path first (RFC 6265 §5.4).
- * Names are trimmed on both sides; empty names and prototype keys are skipped.
- */
-export function parseCookieHeader(header: string): Record<string, string> {
-	const result: Record<string, string> = {}
-	if (header.length === 0) return result
-	for (const pair of header.split(";")) {
-		const eqIdx = pair.indexOf("=")
-		if (eqIdx === -1) continue
-		const name = pair.slice(0, eqIdx).trim()
-		if (name.length === 0 || UNSAFE_KEYS.has(name) || Object.hasOwn(result, name)) continue
-		let value = pair.slice(eqIdx + 1).trim()
-		/* RFC 6265: strip surrounding double quotes before decoding, so an encoded quote survives. */
-		if (value.length >= 2 && value.charCodeAt(0) === 34 && value.charCodeAt(value.length - 1) === 34) {
-			value = value.slice(1, -1)
-		}
-		result[name] = decodeCookieValue(value)
-	}
-	return result
-}
-
-const validCookieNameRe = /^[\w!#$%&'*.^`|~+-]+$/
-/* A host name or IP literal, optionally with a leading dot. */
-const validDomainRe = /^\.?(?:[A-Za-z0-9-]+\.)*[A-Za-z0-9-]+$|^\[[0-9A-Fa-f:.]+\]$/
-
-export function serializeCookie(name: string, opts: CookieOptions): string {
-	if (!validCookieNameRe.test(name)) {
-		throw new Error(`Invalid cookie name: ${JSON.stringify(name)}`)
-	}
-
-	let secure = opts.secure
-	let path = opts.path
-
-	/* Browsers match the prefixes case-insensitively (RFC 6265bis §4.1.3). */
-	const lower = name.toLowerCase()
-	if (lower.startsWith("__host-")) {
-		if (!opts.secure) throw new Error("__Host- cookies require secure: true")
-		if (opts.domain) throw new Error("__Host- cookies must not set domain")
-		if (opts.path !== "/" && opts.path !== undefined) {
-			throw new Error("__Host- cookies must have path: '/'")
-		}
-		secure = true
-		path = path ?? "/"
-	} else if (lower.startsWith("__secure-")) {
-		if (!opts.secure) throw new Error("__Secure- cookies require secure: true")
-		secure = true
-	}
-
-	if (opts.sameSite === "none" && !secure) {
-		throw new Error("SameSite=None cookies require secure: true")
-	}
-
-	if (opts.domain && !validDomainRe.test(opts.domain)) {
-		throw new Error("Cookie domain contains invalid characters")
-	}
-	/* av-value: any CHAR except CTLs or ";" (RFC 6265 §4.1.1). */
-	if (path && /[^\x20-\x3a\x3c-\x7e]/.test(path)) {
-		throw new Error("Cookie path contains invalid characters")
-	}
-
-	let cookie = `${name}=${encodeCookieValue(opts.value)}`
-	if (opts.domain) cookie += `; Domain=${opts.domain}`
-	if (path) cookie += `; Path=${path}`
-	if (opts.maxAge !== undefined) {
-		if (!Number.isFinite(opts.maxAge) || opts.maxAge < 0) {
-			throw new Error(`Invalid cookie Max-Age: ${opts.maxAge}`)
-		}
-		/* Clamp so the value prints as digits; browsers cap Max-Age at 400 days anyway. */
-		cookie += `; Max-Age=${Math.min(Math.floor(opts.maxAge), Number.MAX_SAFE_INTEGER)}`
-	}
-	if (opts.expires) {
-		if (Number.isNaN(opts.expires.getTime())) {
-			throw new Error("Invalid cookie Expires: date is invalid")
-		}
-		cookie += `; Expires=${opts.expires.toUTCString()}`
-	}
-	if (opts.httpOnly) cookie += "; HttpOnly"
-	if (secure) cookie += "; Secure"
-	if (opts.sameSite) cookie += `; SameSite=${opts.sameSite.charAt(0).toUpperCase()}${opts.sameSite.slice(1)}`
-	return cookie
-}

package/src/cors.ts

@@ -1,95 +0,0 @@
-import { namedMiddleware } from "./middleware.ts"
-import type { MiddlewareFn } from "./middleware.ts"
-import { withHeaders } from "./with-headers.ts"
-
-export type CORSOptions = {
-	/** Requires an explicit `origin` list, string or predicate; `"*"` or no origin throws. */
-	credentials?: boolean
-	exposeHeaders?: string[]
-	headers?: string[]
-	maxAge?: number
-	methods?: string[]
-	origin?: "*" | ((origin: string) => boolean) | string | string[]
-}
-
-const DEFAULT_METHODS = ["GET", "HEAD", "PUT", "PATCH", "POST", "DELETE"]
-const DEFAULT_MAX_AGE = 86400
-
-/**
- * Returns the value for `Access-Control-Allow-Origin`, or null when the origin
- * is not allowed. The opaque origin `null` (sandboxed iframes, `file:`, some
- * redirects) is never reflected: any page can produce it.
- */
-function matchOrigin(origin: string, config: CORSOptions["origin"]): string | null {
-	if (config === undefined || config === "*") return "*"
-	if (origin === "null") return null
-	if (typeof config === "string") return config === origin ? origin : null
-	if (Array.isArray(config)) return config.includes(origin) ? origin : null
-	return config(origin) ? origin : null
-}
-
-/** Append `value` to `Vary` unless it is already listed (or `*`). */
-function addVary(headers: Headers, value: string): void {
-	const current = headers.get("vary")
-	if (current === null || current.trim() === "") {
-		headers.set("vary", value)
-		return
-	}
-	const tokens = current.split(",").map((t) => t.trim().toLowerCase())
-	if (tokens.includes("*") || tokens.includes(value.toLowerCase())) return
-	headers.set("vary", `${current}, ${value}`)
-}
-
-export function cors(options?: CORSOptions): MiddlewareFn<{ req: Request }, {}> {
-	const opts = options ?? {}
-
-	if (opts.credentials === true && (opts.origin === undefined || opts.origin === "*")) {
-		throw new TypeError(
-			"cors: `credentials: true` needs an explicit `origin` (string, list or predicate). A wildcard would let every site make credentialed requests and read the response.",
-		)
-	}
-
-	/* `Vary: Origin` whenever the answer depends on the request's Origin — that is,
-	 * on every response unless the policy is a plain wildcard. Without it a shared
-	 * cache can serve one origin's ACAO (or its absence) to another. */
-	const varies = !(opts.origin === undefined || opts.origin === "*")
-	const methods = (opts.methods ?? DEFAULT_METHODS).join(", ")
-	const allowHeaders = opts.headers && opts.headers.length > 0 ? opts.headers.join(", ") : null
-	const exposeHeaders = opts.exposeHeaders && opts.exposeHeaders.length > 0 ? opts.exposeHeaders.join(", ") : null
-	const maxAge = String(opts.maxAge ?? DEFAULT_MAX_AGE)
-
-	const mw: MiddlewareFn<{ req: Request }, {}> = async (ctx, next) => {
-		const req = ctx.req
-		const requestOrigin = req.headers.get("origin")
-		const allowedOrigin = requestOrigin === null ? null : matchOrigin(requestOrigin, opts.origin)
-
-		if (allowedOrigin !== null && req.method === "OPTIONS" && req.headers.has("access-control-request-method")) {
-			const headers = new Headers()
-			headers.set("access-control-allow-origin", allowedOrigin)
-			headers.set("access-control-allow-methods", methods)
-			if (allowHeaders !== null) {
-				headers.set("access-control-allow-headers", allowHeaders)
-			} else {
-				const requested = req.headers.get("access-control-request-headers")
-				if (requested) headers.set("access-control-allow-headers", requested)
-				addVary(headers, "Access-Control-Request-Headers")
-			}
-			headers.set("access-control-max-age", maxAge)
-			if (opts.credentials) headers.set("access-control-allow-credentials", "true")
-			if (varies) addVary(headers, "Origin")
-			return new Response(null, { headers, status: 204 })
-		}
-
-		const response = await next()
-		if (allowedOrigin === null && !varies) return response
-		return withHeaders(response, (headers) => {
-			if (varies) addVary(headers, "Origin")
-			if (allowedOrigin === null) return
-			headers.set("access-control-allow-origin", allowedOrigin)
-			if (opts.credentials) headers.set("access-control-allow-credentials", "true")
-			if (exposeHeaders !== null) headers.set("access-control-expose-headers", exposeHeaders)
-		})
-	}
-
-	return namedMiddleware("cors", mw)
-}