@lovrozagar/honey 0.7.3 → 1.0.0-rc.3

package/src/ws/shared.ts

@@ -1,140 +0,0 @@
-/**
- * Options every WebSocket adapter takes, with the same meaning and defaults on Node, Bun, Deno
- * and Workers. Each adapter enforces what its runtime does not.
- */
-export type WSAdapterOptions = {
-	/**
-	 * Largest inbound message in bytes. A bigger one closes the connection with 1009.
-	 * Default 1 MiB.
-	 */
-	maxPayload?: number
-	/**
-	 * Outbound bytes a socket may hold unsent before `backpressurePolicy` applies to the next
-	 * `send()`. Default 8 MiB.
-	 */
-	backpressureLimit?: number
-	/**
-	 * Over `backpressureLimit`: `"close"` closes the connection with 1013 (try again later),
-	 * `"drop"` discards the message. Default `"close"`.
-	 */
-	backpressurePolicy?: "close" | "drop"
-	/**
-	 * Close a connection that has received nothing (no message, no pong) for this many
-	 * milliseconds. Idle peers are pinged first where the runtime allows it. `0` disables.
-	 * Default 120 000 (Bun's default). Deno and Bun take whole seconds.
-	 */
-	idleTimeout?: number
-	/**
-	 * Choose the subprotocol from the ones the client offered (`Sec-WebSocket-Protocol`).
-	 * Return `null` or `undefined` for none. Default: the first one offered.
-	 */
-	protocol?: (offered: string[], req: Request) => string | null | undefined
-}
-
-export type ResolvedWSOptions = {
-	backpressureLimit: number
-	backpressurePolicy: "close" | "drop"
-	idleTimeout: number
-	maxPayload: number
-	protocol: (offered: string[], req: Request) => string | null | undefined
-}
-
-export const DEFAULT_MAX_PAYLOAD = 1024 * 1024
-export const DEFAULT_BACKPRESSURE_LIMIT = 8 * 1024 * 1024
-export const DEFAULT_IDLE_TIMEOUT = 120_000
-
-/** Close codes the adapters and the realtime server use. */
-export const CLOSE_NORMAL = 1000
-export const CLOSE_GOING_AWAY = 1001
-export const CLOSE_POLICY = 1008
-export const CLOSE_TOO_BIG = 1009
-export const CLOSE_INTERNAL = 1011
-export const CLOSE_TRY_AGAIN = 1013
-
-/** Longest close reason a frame can carry (125-byte control payload minus the 2-byte code). */
-export const MAX_CLOSE_REASON = 123
-
-const firstOffered = (offered: string[]): string | null => offered[0] ?? null
-
-function nonNegative(name: string, value: number | undefined, fallback: number): number {
-	if (value === undefined) return fallback
-	if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
-		throw new TypeError(`WebSocket adapter: ${name} must be a non-negative number`)
-	}
-	return value
-}
-
-export function resolveWSOptions(opts: WSAdapterOptions | undefined): ResolvedWSOptions {
-	const policy = opts?.backpressurePolicy ?? "close"
-	if (policy !== "close" && policy !== "drop") {
-		throw new TypeError('WebSocket adapter: backpressurePolicy must be "close" or "drop"')
-	}
-	const maxPayload = nonNegative("maxPayload", opts?.maxPayload, DEFAULT_MAX_PAYLOAD)
-	if (maxPayload === 0) throw new TypeError("WebSocket adapter: maxPayload must be positive")
-	return {
-		backpressureLimit: nonNegative("backpressureLimit", opts?.backpressureLimit, DEFAULT_BACKPRESSURE_LIMIT),
-		backpressurePolicy: policy,
-		idleTimeout: nonNegative("idleTimeout", opts?.idleTimeout, DEFAULT_IDLE_TIMEOUT),
-		maxPayload,
-		protocol: opts?.protocol ?? firstOffered,
-	}
-}
-
-/** The subprotocols the client offered, in order. */
-export function offeredProtocols(req: Request): string[] {
-	const raw = req.headers.get("sec-websocket-protocol")
-	if (raw === null) return []
-	const out: string[] = []
-	for (const part of raw.split(",")) {
-		const p = part.trim()
-		if (p !== "") out.push(p)
-	}
-	return out
-}
-
-/** The subprotocol to answer with, or `null`. A choice the client did not offer is ignored. */
-export function selectProtocol(req: Request, opts: ResolvedWSOptions): string | null {
-	const offered = offeredProtocols(req)
-	if (offered.length === 0) return null
-	const chosen = opts.protocol(offered, req)
-	return typeof chosen === "string" && offered.includes(chosen) ? chosen : null
-}
-
-/** Outbound bytes the runtime holds for this socket, when it reports them. */
-export function bufferedAmountOf(raw: unknown): number {
-	if (raw === null || typeof raw !== "object") return 0
-	const r = raw as { bufferedAmount?: unknown; getBufferedAmount?: () => unknown }
-	if (typeof r.getBufferedAmount === "function") {
-		const n = r.getBufferedAmount()
-		return typeof n === "number" ? n : 0
-	}
-	return typeof r.bufferedAmount === "number" ? r.bufferedAmount : 0
-}
-
-/** Whether an inbound message is larger than `limit` bytes. */
-export function exceedsPayload(data: ArrayBuffer | ArrayBufferView | Blob | string, limit: number): boolean {
-	if (typeof data === "string") {
-		if (data.length > limit) return true
-		/* a UTF-16 unit is at most 3 UTF-8 bytes, so most strings need no encode */
-		if (data.length * 3 <= limit) return false
-		return new TextEncoder().encode(data).byteLength > limit
-	}
-	if (typeof Blob !== "undefined" && data instanceof Blob) return data.size > limit
-	return (data as ArrayBuffer | ArrayBufferView).byteLength > limit
-}
-
-/** `data` as an `ArrayBuffer` holding exactly its bytes (a pooled Buffer's backing store is larger). */
-export function toArrayBuffer(data: ArrayBuffer | ArrayBufferView): ArrayBuffer {
-	if (data instanceof ArrayBuffer) return data
-	const { buffer, byteLength, byteOffset } = data
-	if (byteOffset === 0 && byteLength === buffer.byteLength && buffer instanceof ArrayBuffer) return buffer
-	return buffer.slice(byteOffset, byteOffset + byteLength) as ArrayBuffer
-}
-
-/** A close code a server may send: 1000, 1001-1014 except the reserved ones, or 3000-4999. */
-export function sendableCloseCode(code: number | undefined): number {
-	if (code === undefined) return 1000
-	if (code === 1000 || (code >= 3000 && code <= 4999)) return code
-	if (code >= 1001 && code <= 1014 && code !== 1004 && code !== 1005 && code !== 1006) return code
-	return 1000
-}

package/src/ws-origin.ts

@@ -1,53 +0,0 @@
-/**
- * Which browser origins may open a WebSocket. A browser lets any page open a socket to any host
- * and sends that host's cookies with it, so a cookie-authenticated socket is open to cross-site
- * hijacking unless the server checks `Origin`.
- *
- * - `"*"`: every origin.
- * - a list: those exact origins (`https://app.example.com`), plus same-origin.
- * - a function: called with the `Origin` value; same-origin always passes.
- * - unset (the default): same-origin always passes; a cross-origin upgrade is rejected when it
- *   carries credentials (`Cookie` or `Authorization`), since that is what hijacking needs. A
- *   request without `Origin` (not a browser) passes.
- */
-export type WSOriginPolicy = "*" | readonly string[] | ((origin: string) => boolean)
-
-function originHost(origin: string): string | null {
-	if (origin === "null") return null
-	try {
-		return new URL(origin).host.toLowerCase()
-	} catch {
-		return null
-	}
-}
-
-export function validateOriginPolicy(policy: unknown): WSOriginPolicy {
-	if (policy === "*" || typeof policy === "function") return policy as WSOriginPolicy
-	if (Array.isArray(policy) && policy.every((o) => typeof o === "string")) {
-		for (const o of policy as string[]) {
-			if (originHost(o) === null)
-				throw new TypeError(`allowedOrigins: "${o}" is not an origin like https://example.com`)
-		}
-		return Object.freeze([...(policy as string[])])
-	}
-	throw new TypeError('allowedOrigins must be "*", a list of origins, or a function')
-}
-
-/**
- * Whether an upgrade from `origin` may proceed. `host` is the host the client asked for
- * (`clientInfo(ctx).host`, which follows `trustProxy`).
- */
-export function originAllowed(
-	policy: WSOriginPolicy | null,
-	origin: string | null,
-	host: string | null,
-	hasCredentials: boolean,
-): boolean {
-	if (policy === "*") return true
-	if (origin === null) return true
-	const oh = originHost(origin)
-	if (oh !== null && host !== null && oh === host.toLowerCase()) return true
-	if (policy === null) return !hasCredentials
-	if (typeof policy === "function") return policy(origin) === true
-	return policy.includes(origin)
-}

package/src/yaml.ts

@@ -1,103 +0,0 @@
-/**
- * JSON-compatible YAML 1.2 emitter: the same document as `JSON.stringify`, in a
- * different encoding. Input is first normalized through JSON (so `undefined` keys
- * are skipped, `Date` becomes its ISO string, `NaN` becomes `null`), then every
- * string that is not plainly safe is written as a double-quoted scalar, which
- * also reads the same under YAML 1.1 parsers.
- */
-
-const INDENT = "  "
-
-export function yamlSiblingPath(jsonPath: string): string {
-	if (jsonPath.endsWith(".yaml") || jsonPath.endsWith(".yml")) return jsonPath.replace(/\.yml$/, ".yaml")
-	return jsonPath.endsWith(".json") ? `${jsonPath.slice(0, -5)}.yaml` : `${jsonPath}.yaml`
-}
-
-/**
- * Where an OpenAPI output configured at `path` is written. A `.yaml`/`.yml` path is that YAML file
- * alone; any other path is JSON there plus its YAML sibling.
- */
-export function openApiOutputPaths(path: string): { json: string | null; yaml: string } {
-	if (path.endsWith(".yaml") || path.endsWith(".yml")) return { json: null, yaml: path }
-	return { json: path, yaml: yamlSiblingPath(path) }
-}
-
-export function toYaml(value: unknown): string {
-	const json = JSON.stringify(value)
-	/* JSON.stringify(undefined) is undefined; emit the JSON equivalent of "nothing". */
-	const normalized: unknown = json === undefined ? null : JSON.parse(json)
-	return `${emit(normalized, 0)}\n`
-}
-
-function emit(value: unknown, indent: number): string {
-	if (value === null) return "null"
-	if (typeof value === "boolean") return value ? "true" : "false"
-	if (typeof value === "number") return String(value)
-	if (typeof value === "string") return emitString(value)
-	if (Array.isArray(value)) return emitArray(value, indent)
-	return emitObject(value as Record<string, unknown>, indent)
-}
-
-/*
- * A plain scalar is used only for a conservative shape: starts with a letter,
- * `_`, `/` or `$`; contains only word characters, `.`, `/`, `$`, `-`, `+`,
- * `{}`, `()` and inner spaces. That excludes every indicator, `: `, ` #`,
- * leading digits (numbers, YAML 1.1 octal and sexagesimal), and `.inf`/`.nan`.
- */
-const PLAIN_RE = /^[A-Za-z_/$](?:[\w./${}()+-]| (?! ))*$/
-/* Words YAML 1.1 or 1.2 resolves to null or a boolean. */
-const RESERVED_RE = /^(?:y|n|yes|no|on|off|true|false|null|~)$/i
-
-function emitString(value: string): string {
-	if (PLAIN_RE.test(value) && !value.endsWith(" ") && !RESERVED_RE.test(value)) return value
-	return quote(value)
-}
-
-/*
- * JSON string syntax is a valid YAML double-quoted scalar, except that YAML
- * forbids raw DEL, C1 controls (other than NEL) and the BOM/non-characters.
- */
-function quote(value: string): string {
-	return JSON.stringify(value).replace(
-		/[\u007f-\u0084\u0086-\u009f￾￿]/g,
-		(ch) => `\\u${ch.charCodeAt(0).toString(16).padStart(4, "0")}`,
-	)
-}
-
-function isNonEmptyCollection(value: unknown): boolean {
-	if (Array.isArray(value)) return value.length > 0
-	return value !== null && typeof value === "object" && Object.keys(value).length > 0
-}
-
-function emitArray(value: unknown[], indent: number): string {
-	if (value.length === 0) return "[]"
-	const pad = INDENT.repeat(indent)
-	const childPad = INDENT.repeat(indent + 1)
-	return value
-		.map((item) => {
-			if (isNonEmptyCollection(item)) {
-				const inner = emit(item, indent + 1)
-				const lines = inner.split("\n")
-				const first = lines[0]?.startsWith(childPad) ? lines[0].slice(childPad.length) : (lines[0] ?? "")
-				return [`${pad}- ${first}`, ...lines.slice(1)].join("\n")
-			}
-			return `${pad}- ${emit(item, 0)}`
-		})
-		.join("\n")
-}
-
-function emitObject(value: Record<string, unknown>, indent: number): string {
-	const keys = Object.keys(value)
-	if (keys.length === 0) return "{}"
-	const pad = INDENT.repeat(indent)
-	return keys
-		.map((key) => {
-			const child = value[key]
-			const renderedKey = emitString(key)
-			if (isNonEmptyCollection(child)) {
-				return `${pad}${renderedKey}:\n${emit(child, indent + 1)}`
-			}
-			return `${pad}${renderedKey}: ${emit(child, 0)}`
-		})
-		.join("\n")
-}