@objectstack/hono 4.0.2 → 4.0.4

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
 
-> @objectstack/hono@4.0.2 build /home/runner/work/framework/framework/packages/adapters/hono
+> @objectstack/hono@4.0.4 build /home/runner/work/framework/framework/packages/adapters/hono
 > tsup --config ../../../tsup.config.ts
 
 CLI Building entry: src/index.ts
@@ -10,13 +10,13 @@
 CLI Cleaning output folder
 ESM Build start
 CJS Build start
-ESM dist/index.mjs     5.37 KB
-ESM dist/index.mjs.map 11.82 KB
-ESM ⚡️ Build success in 76ms
-CJS dist/index.js     6.44 KB
-CJS dist/index.js.map 11.87 KB
-CJS ⚡️ Build success in 76ms
+CJS dist/index.js     7.85 KB
+CJS dist/index.js.map 15.58 KB
+CJS ⚡️ Build success in 54ms
+ESM dist/index.mjs     6.75 KB
+ESM dist/index.mjs.map 15.55 KB
+ESM ⚡️ Build success in 54ms
 DTS Build start
-DTS ⚡️ Build success in 13532ms
-DTS dist/index.d.mts 1.17 KB
-DTS dist/index.d.ts  1.17 KB
+DTS ⚡️ Build success in 13070ms
+DTS dist/index.d.mts 1.87 KB
+DTS dist/index.d.ts  1.87 KB

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @objectstack/hono
 
+## 4.0.4
+
+### Patch Changes
+
+- @objectstack/runtime@4.0.4
+
+## 4.0.3
+
+### Patch Changes
+
+- @objectstack/runtime@4.0.3
+
 ## 4.0.2
 
 ### Patch Changes

package/dist/index.d.mts

@@ -1,9 +1,27 @@
 import { Hono } from 'hono';
 import { ObjectKernel } from '@objectstack/runtime';
 
+interface ObjectStackHonoCorsOptions {
+    /** Enable or disable CORS. Defaults to true. */
+    enabled?: boolean;
+    /** Allowed origins. Defaults to env `CORS_ORIGIN` or '*'. Comma-separated string or array. */
+    origin?: string | string[];
+    /** Allowed methods. */
+    methods?: string[];
+    /** Allow credentials (cookies, authorization headers). */
+    credentials?: boolean;
+    /** Preflight cache max-age in seconds. */
+    maxAge?: number;
+    /** Allowed headers. */
+    allowHeaders?: string[];
+    /** Exposed headers. */
+    exposeHeaders?: string[];
+}
 interface ObjectStackHonoOptions {
     kernel: ObjectKernel;
     prefix?: string;
+    /** CORS configuration. Set to `false` to disable entirely. */
+    cors?: ObjectStackHonoCorsOptions | false;
 }
 /**
  * Middleware mode for existing Hono apps
@@ -30,4 +48,4 @@ declare function objectStackMiddleware(kernel: ObjectKernel): (c: any, next: any
  */
 declare function createHonoApp(options: ObjectStackHonoOptions): Hono;
 
-export { type ObjectStackHonoOptions, createHonoApp, objectStackMiddleware };
+export { type ObjectStackHonoCorsOptions, type ObjectStackHonoOptions, createHonoApp, objectStackMiddleware };

package/dist/index.d.ts

@@ -1,9 +1,27 @@
 import { Hono } from 'hono';
 import { ObjectKernel } from '@objectstack/runtime';
 
+interface ObjectStackHonoCorsOptions {
+    /** Enable or disable CORS. Defaults to true. */
+    enabled?: boolean;
+    /** Allowed origins. Defaults to env `CORS_ORIGIN` or '*'. Comma-separated string or array. */
+    origin?: string | string[];
+    /** Allowed methods. */
+    methods?: string[];
+    /** Allow credentials (cookies, authorization headers). */
+    credentials?: boolean;
+    /** Preflight cache max-age in seconds. */
+    maxAge?: number;
+    /** Allowed headers. */
+    allowHeaders?: string[];
+    /** Exposed headers. */
+    exposeHeaders?: string[];
+}
 interface ObjectStackHonoOptions {
     kernel: ObjectKernel;
     prefix?: string;
+    /** CORS configuration. Set to `false` to disable entirely. */
+    cors?: ObjectStackHonoCorsOptions | false;
 }
 /**
  * Middleware mode for existing Hono apps
@@ -30,4 +48,4 @@ declare function objectStackMiddleware(kernel: ObjectKernel): (c: any, next: any
  */
 declare function createHonoApp(options: ObjectStackHonoOptions): Hono;
 
-export { type ObjectStackHonoOptions, createHonoApp, objectStackMiddleware };
+export { type ObjectStackHonoCorsOptions, type ObjectStackHonoOptions, createHonoApp, objectStackMiddleware };

package/dist/index.js

@@ -25,6 +25,7 @@ __export(index_exports, {
 });
 module.exports = __toCommonJS(index_exports);
 var import_hono = require("hono");
+var import_cors = require("hono/cors");
 var import_runtime = require("@objectstack/runtime");
 function objectStackMiddleware(kernel) {
   return async (c, next) => {
@@ -36,6 +37,38 @@ function createHonoApp(options) {
   const app = new import_hono.Hono();
   const prefix = options.prefix || "/api";
   const dispatcher = new import_runtime.HttpDispatcher(options.kernel);
+  const corsDisabledByEnv = process.env.CORS_ENABLED === "false";
+  if (options.cors !== false && !corsDisabledByEnv) {
+    const corsOpts = typeof options.cors === "object" ? options.cors : {};
+    const enabled = corsOpts.enabled ?? true;
+    if (enabled) {
+      let configuredOrigin;
+      if (corsOpts.origin) {
+        configuredOrigin = corsOpts.origin;
+      } else if (process.env.CORS_ORIGIN) {
+        const envOrigin = process.env.CORS_ORIGIN.trim();
+        configuredOrigin = envOrigin.includes(",") ? envOrigin.split(",").map((s) => s.trim()) : envOrigin;
+      } else {
+        configuredOrigin = "*";
+      }
+      const credentials = corsOpts.credentials ?? process.env.CORS_CREDENTIALS !== "false";
+      const maxAge = corsOpts.maxAge ?? (process.env.CORS_MAX_AGE ? parseInt(process.env.CORS_MAX_AGE, 10) : 86400);
+      let origin;
+      if (credentials && configuredOrigin === "*") {
+        origin = (requestOrigin) => requestOrigin || "*";
+      } else {
+        origin = configuredOrigin;
+      }
+      app.use("*", (0, import_cors.cors)({
+        origin,
+        allowMethods: corsOpts.methods || ["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"],
+        allowHeaders: corsOpts.allowHeaders || ["Content-Type", "Authorization", "X-Requested-With"],
+        exposeHeaders: corsOpts.exposeHeaders || [],
+        credentials,
+        maxAge
+      }));
+    }
+  }
   const errorJson = (c, message, code = 500) => {
     return c.json({ success: false, error: { message, code } }, code);
   };

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { Hono } from 'hono';\nimport { type ObjectKernel, HttpDispatcher, HttpDispatcherResult } from '@objectstack/runtime';\n\nexport interface ObjectStackHonoOptions {\n  kernel: ObjectKernel;\n  prefix?: string;\n}\n\n/**\n * Auth service interface with handleRequest method\n */\ninterface AuthService {\n  handleRequest(request: Request): Promise<Response>;\n}\n\n/**\n * Middleware mode for existing Hono apps\n */\nexport function objectStackMiddleware(kernel: ObjectKernel) {\n  return async (c: any, next: any) => {\n    c.set('objectStack', kernel);\n    await next();\n  };\n}\n\n/**\n * Creates a full-featured Hono app with all ObjectStack route dispatchers.\n *\n * Only routes that need framework-specific handling (auth service, storage\n * formData, GraphQL raw result, discovery wrapper) are registered explicitly.\n * All other routes (meta, data, packages, analytics, automation, i18n, ui,\n * openapi, custom endpoints, and any future routes) are handled by a\n * catch-all that delegates to `HttpDispatcher.dispatch()`.\n *\n * This means new routes added to `HttpDispatcher` automatically work in\n * every adapter without any adapter-side code changes.\n *\n * @example\n * ```ts\n * import { createHonoApp } from '@objectstack/hono';\n * const app = createHonoApp({ kernel });\n * export default app;\n * ```\n */\nexport function createHonoApp(options: ObjectStackHonoOptions): Hono {\n  const app = new Hono();\n  const prefix = options.prefix || '/api';\n  const dispatcher = new HttpDispatcher(options.kernel);\n\n  const errorJson = (c: any, message: string, code: number = 500) => {\n    return c.json({ success: false, error: { message, code } }, code);\n  };\n\n  const toResponse = (c: any, result: HttpDispatcherResult) => {\n    if (result.handled) {\n      if (result.response) {\n        if (result.response.headers) {\n          Object.entries(result.response.headers).forEach(([k, v]) => c.header(k, v as string));\n        }\n        return c.json(result.response.body, result.response.status);\n      }\n      if (result.result) {\n        const res = result.result;\n        if (res.type === 'redirect' && res.url) {\n          return c.redirect(res.url);\n        }\n        if (res.type === 'stream' && res.events) {\n          // SSE / Vercel Data Stream streaming response\n          const headers: Record<string, string> = {\n            'Content-Type': res.contentType || 'text/event-stream',\n            'Cache-Control': 'no-cache',\n            'Connection': 'keep-alive',\n            ...(res.headers || {}),\n          };\n          const stream = new ReadableStream({\n            async start(controller) {\n              try {\n                const encoder = new TextEncoder();\n                for await (const event of res.events) {\n                  const chunk = res.vercelDataStream\n                    ? (typeof event === 'string' ? event : JSON.stringify(event) + '\\n')\n                    : `data: ${JSON.stringify(event)}\\n\\n`;\n                  controller.enqueue(encoder.encode(chunk));\n                }\n              } catch (err) {\n                // Stream error — close gracefully\n              } finally {\n                controller.close();\n              }\n            },\n          });\n          return new Response(stream, { status: 200, headers });\n        }\n        if (res.type === 'stream' && res.stream) {\n          if (res.headers) {\n            Object.entries(res.headers).forEach(([k, v]) => c.header(k, v as string));\n          }\n          return new Response(res.stream, { status: 200 });\n        }\n        return c.json(res, 200);\n      }\n    }\n    return errorJson(c, 'Not Found', 404);\n  };\n\n  // ─── Explicit routes (framework-specific handling required) ────────────────\n\n  // --- Discovery ---\n  app.get(prefix, async (c) => {\n    return c.json({ data: await dispatcher.getDiscoveryInfo(prefix) });\n  });\n\n  app.get(`${prefix}/discovery`, async (c) => {\n    return c.json({ data: await dispatcher.getDiscoveryInfo(prefix) });\n  });\n\n  // --- .well-known ---\n  app.get('/.well-known/objectstack', (c) => {\n    return c.redirect(prefix);\n  });\n\n  // --- Auth (needs auth service integration) ---\n  app.all(`${prefix}/auth/*`, async (c) => {\n    try {\n      const path = c.req.path.substring(`${prefix}/auth/`.length);\n      const method = c.req.method;\n\n      // Try AuthPlugin service first (prefer async to support factory-based services)\n      let authService: AuthService | null = null;\n      try {\n        if (typeof options.kernel.getServiceAsync === 'function') {\n          authService = await options.kernel.getServiceAsync<AuthService>('auth');\n        } else if (typeof options.kernel.getService === 'function') {\n          authService = options.kernel.getService<AuthService>('auth');\n        }\n      } catch {\n        // Service not registered — fall through to dispatcher\n        authService = null;\n      }\n\n      if (authService && typeof authService.handleRequest === 'function') {\n        const response = await authService.handleRequest(c.req.raw);\n        return new Response(response.body, {\n          status: response.status,\n          headers: response.headers,\n        });\n      }\n\n      // Fallback to legacy dispatcher\n      const body = method === 'GET' || method === 'HEAD'\n        ? {}\n        : await c.req.json().catch(() => ({}));\n      const result = await dispatcher.handleAuth(path, method, body, { request: c.req.raw });\n      return toResponse(c, result);\n    } catch (err: any) {\n      return errorJson(c, err.message || 'Internal Server Error', err.statusCode || 500);\n    }\n  });\n\n  // --- GraphQL (returns raw result, not HttpDispatcherResult) ---\n  app.post(`${prefix}/graphql`, async (c) => {\n    try {\n      const body = await c.req.json();\n      const result = await dispatcher.handleGraphQL(body, { request: c.req.raw });\n      return c.json(result);\n    } catch (err: any) {\n      return errorJson(c, err.message || 'Internal Server Error', err.statusCode || 500);\n    }\n  });\n\n  // --- Storage (needs formData parsing) ---\n  app.all(`${prefix}/storage/*`, async (c) => {\n    try {\n      const subPath = c.req.path.substring(`${prefix}/storage`.length);\n      const method = c.req.method;\n\n      let file: any = undefined;\n      if (method === 'POST' && subPath === '/upload') {\n        const formData = await c.req.formData();\n        file = formData.get('file');\n      }\n\n      const result = await dispatcher.handleStorage(subPath, method, file, { request: c.req.raw });\n      return toResponse(c, result);\n    } catch (err: any) {\n      return errorJson(c, err.message || 'Internal Server Error', err.statusCode || 500);\n    }\n  });\n\n  // ─── Catch-all: delegate to dispatcher.dispatch() ─────────────────────────\n  // Handles meta, data, packages, analytics, automation, i18n, ui, openapi,\n  // custom API endpoints, and any future routes added to HttpDispatcher.\n  app.all(`${prefix}/*`, async (c) => {\n    try {\n      const subPath = c.req.path.substring(prefix.length);\n      const method = c.req.method;\n\n      let body: any = undefined;\n      if (method === 'POST' || method === 'PUT' || method === 'PATCH') {\n        body = await c.req.json().catch(() => ({}));\n      }\n\n      const queryParams: Record<string, any> = {};\n      const url = new URL(c.req.url);\n      url.searchParams.forEach((val, key) => { queryParams[key] = val; });\n\n      const result = await dispatcher.dispatch(method, subPath, body, queryParams, { request: c.req.raw }, prefix);\n      return toResponse(c, result);\n    } catch (err: any) {\n      return errorJson(c, err.message || 'Internal Server Error', err.statusCode || 500);\n    }\n  });\n\n  return app;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,kBAAqB;AACrB,qBAAwE;AAiBjE,SAAS,sBAAsB,QAAsB;AAC1D,SAAO,OAAO,GAAQ,SAAc;AAClC,MAAE,IAAI,eAAe,MAAM;AAC3B,UAAM,KAAK;AAAA,EACb;AACF;AAqBO,SAAS,cAAc,SAAuC;AACnE,QAAM,MAAM,IAAI,iBAAK;AACrB,QAAM,SAAS,QAAQ,UAAU;AACjC,QAAM,aAAa,IAAI,8BAAe,QAAQ,MAAM;AAEpD,QAAM,YAAY,CAAC,GAAQ,SAAiB,OAAe,QAAQ;AACjE,WAAO,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,EAAE,SAAS,KAAK,EAAE,GAAG,IAAI;AAAA,EAClE;AAEA,QAAM,aAAa,CAAC,GAAQ,WAAiC;AAC3D,QAAI,OAAO,SAAS;AAClB,UAAI,OAAO,UAAU;AACnB,YAAI,OAAO,SAAS,SAAS;AAC3B,iBAAO,QAAQ,OAAO,SAAS,OAAO,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,GAAG,CAAW,CAAC;AAAA,QACtF;AACA,eAAO,EAAE,KAAK,OAAO,SAAS,MAAM,OAAO,SAAS,MAAM;AAAA,MAC5D;AACA,UAAI,OAAO,QAAQ;AACjB,cAAM,MAAM,OAAO;AACnB,YAAI,IAAI,SAAS,cAAc,IAAI,KAAK;AACtC,iBAAO,EAAE,SAAS,IAAI,GAAG;AAAA,QAC3B;AACA,YAAI,IAAI,SAAS,YAAY,IAAI,QAAQ;AAEvC,gBAAM,UAAkC;AAAA,YACtC,gBAAgB,IAAI,eAAe;AAAA,YACnC,iBAAiB;AAAA,YACjB,cAAc;AAAA,YACd,GAAI,IAAI,WAAW,CAAC;AAAA,UACtB;AACA,gBAAM,SAAS,IAAI,eAAe;AAAA,YAChC,MAAM,MAAM,YAAY;AACtB,kBAAI;AACF,sBAAM,UAAU,IAAI,YAAY;AAChC,iCAAiB,SAAS,IAAI,QAAQ;AACpC,wBAAM,QAAQ,IAAI,mBACb,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,KAAK,IAAI,OAC7D,SAAS,KAAK,UAAU,KAAK,CAAC;AAAA;AAAA;AAClC,6BAAW,QAAQ,QAAQ,OAAO,KAAK,CAAC;AAAA,gBAC1C;AAAA,cACF,SAAS,KAAK;AAAA,cAEd,UAAE;AACA,2BAAW,MAAM;AAAA,cACnB;AAAA,YACF;AAAA,UACF,CAAC;AACD,iBAAO,IAAI,SAAS,QAAQ,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAAA,QACtD;AACA,YAAI,IAAI,SAAS,YAAY,IAAI,QAAQ;AACvC,cAAI,IAAI,SAAS;AACf,mBAAO,QAAQ,IAAI,OAAO,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,GAAG,CAAW,CAAC;AAAA,UAC1E;AACA,iBAAO,IAAI,SAAS,IAAI,QAAQ,EAAE,QAAQ,IAAI,CAAC;AAAA,QACjD;AACA,eAAO,EAAE,KAAK,KAAK,GAAG;AAAA,MACxB;AAAA,IACF;AACA,WAAO,UAAU,GAAG,aAAa,GAAG;AAAA,EACtC;AAKA,MAAI,IAAI,QAAQ,OAAO,MAAM;AAC3B,WAAO,EAAE,KAAK,EAAE,MAAM,MAAM,WAAW,iBAAiB,MAAM,EAAE,CAAC;AAAA,EACnE,CAAC;AAED,MAAI,IAAI,GAAG,MAAM,cAAc,OAAO,MAAM;AAC1C,WAAO,EAAE,KAAK,EAAE,MAAM,MAAM,WAAW,iBAAiB,MAAM,EAAE,CAAC;AAAA,EACnE,CAAC;AAGD,MAAI,IAAI,4BAA4B,CAAC,MAAM;AACzC,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B,CAAC;AAGD,MAAI,IAAI,GAAG,MAAM,WAAW,OAAO,MAAM;AACvC,QAAI;AACF,YAAM,OAAO,EAAE,IAAI,KAAK,UAAU,GAAG,MAAM,SAAS,MAAM;AAC1D,YAAM,SAAS,EAAE,IAAI;AAGrB,UAAI,cAAkC;AACtC,UAAI;AACF,YAAI,OAAO,QAAQ,OAAO,oBAAoB,YAAY;AACxD,wBAAc,MAAM,QAAQ,OAAO,gBAA6B,MAAM;AAAA,QACxE,WAAW,OAAO,QAAQ,OAAO,eAAe,YAAY;AAC1D,wBAAc,QAAQ,OAAO,WAAwB,MAAM;AAAA,QAC7D;AAAA,MACF,QAAQ;AAEN,sBAAc;AAAA,MAChB;AAEA,UAAI,eAAe,OAAO,YAAY,kBAAkB,YAAY;AAClE,cAAM,WAAW,MAAM,YAAY,cAAc,EAAE,IAAI,GAAG;AAC1D,eAAO,IAAI,SAAS,SAAS,MAAM;AAAA,UACjC,QAAQ,SAAS;AAAA,UACjB,SAAS,SAAS;AAAA,QACpB,CAAC;AAAA,MACH;AAGA,YAAM,OAAO,WAAW,SAAS,WAAW,SACxC,CAAC,IACD,MAAM,EAAE,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACvC,YAAM,SAAS,MAAM,WAAW,WAAW,MAAM,QAAQ,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC;AACrF,aAAO,WAAW,GAAG,MAAM;AAAA,IAC7B,SAAS,KAAU;AACjB,aAAO,UAAU,GAAG,IAAI,WAAW,yBAAyB,IAAI,cAAc,GAAG;AAAA,IACnF;AAAA,EACF,CAAC;AAGD,MAAI,KAAK,GAAG,MAAM,YAAY,OAAO,MAAM;AACzC,QAAI;AACF,YAAM,OAAO,MAAM,EAAE,IAAI,KAAK;AAC9B,YAAM,SAAS,MAAM,WAAW,cAAc,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC;AAC1E,aAAO,EAAE,KAAK,MAAM;AAAA,IACtB,SAAS,KAAU;AACjB,aAAO,UAAU,GAAG,IAAI,WAAW,yBAAyB,IAAI,cAAc,GAAG;AAAA,IACnF;AAAA,EACF,CAAC;AAGD,MAAI,IAAI,GAAG,MAAM,cAAc,OAAO,MAAM;AAC1C,QAAI;AACF,YAAM,UAAU,EAAE,IAAI,KAAK,UAAU,GAAG,MAAM,WAAW,MAAM;AAC/D,YAAM,SAAS,EAAE,IAAI;AAErB,UAAI,OAAY;AAChB,UAAI,WAAW,UAAU,YAAY,WAAW;AAC9C,cAAM,WAAW,MAAM,EAAE,IAAI,SAAS;AACtC,eAAO,SAAS,IAAI,MAAM;AAAA,MAC5B;AAEA,YAAM,SAAS,MAAM,WAAW,cAAc,SAAS,QAAQ,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC;AAC3F,aAAO,WAAW,GAAG,MAAM;AAAA,IAC7B,SAAS,KAAU;AACjB,aAAO,UAAU,GAAG,IAAI,WAAW,yBAAyB,IAAI,cAAc,GAAG;AAAA,IACnF;AAAA,EACF,CAAC;AAKD,MAAI,IAAI,GAAG,MAAM,MAAM,OAAO,MAAM;AAClC,QAAI;AACF,YAAM,UAAU,EAAE,IAAI,KAAK,UAAU,OAAO,MAAM;AAClD,YAAM,SAAS,EAAE,IAAI;AAErB,UAAI,OAAY;AAChB,UAAI,WAAW,UAAU,WAAW,SAAS,WAAW,SAAS;AAC/D,eAAO,MAAM,EAAE,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAAA,MAC5C;AAEA,YAAM,cAAmC,CAAC;AAC1C,YAAM,MAAM,IAAI,IAAI,EAAE,IAAI,GAAG;AAC7B,UAAI,aAAa,QAAQ,CAAC,KAAK,QAAQ;AAAE,oBAAY,GAAG,IAAI;AAAA,MAAK,CAAC;AAElE,YAAM,SAAS,MAAM,WAAW,SAAS,QAAQ,SAAS,MAAM,aAAa,EAAE,SAAS,EAAE,IAAI,IAAI,GAAG,MAAM;AAC3G,aAAO,WAAW,GAAG,MAAM;AAAA,IAC7B,SAAS,KAAU;AACjB,aAAO,UAAU,GAAG,IAAI,WAAW,yBAAyB,IAAI,cAAc,GAAG;AAAA,IACnF;AAAA,EACF,CAAC;AAED,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { Hono } from 'hono';\nimport { cors } from 'hono/cors';\nimport { type ObjectKernel, HttpDispatcher, HttpDispatcherResult } from '@objectstack/runtime';\n\nexport interface ObjectStackHonoCorsOptions {\n  /** Enable or disable CORS. Defaults to true. */\n  enabled?: boolean;\n  /** Allowed origins. Defaults to env `CORS_ORIGIN` or '*'. Comma-separated string or array. */\n  origin?: string | string[];\n  /** Allowed methods. */\n  methods?: string[];\n  /** Allow credentials (cookies, authorization headers). */\n  credentials?: boolean;\n  /** Preflight cache max-age in seconds. */\n  maxAge?: number;\n  /** Allowed headers. */\n  allowHeaders?: string[];\n  /** Exposed headers. */\n  exposeHeaders?: string[];\n}\n\nexport interface ObjectStackHonoOptions {\n  kernel: ObjectKernel;\n  prefix?: string;\n  /** CORS configuration. Set to `false` to disable entirely. */\n  cors?: ObjectStackHonoCorsOptions | false;\n}\n\n/**\n * Auth service interface with handleRequest method\n */\ninterface AuthService {\n  handleRequest(request: Request): Promise<Response>;\n}\n\n/**\n * Middleware mode for existing Hono apps\n */\nexport function objectStackMiddleware(kernel: ObjectKernel) {\n  return async (c: any, next: any) => {\n    c.set('objectStack', kernel);\n    await next();\n  };\n}\n\n/**\n * Creates a full-featured Hono app with all ObjectStack route dispatchers.\n *\n * Only routes that need framework-specific handling (auth service, storage\n * formData, GraphQL raw result, discovery wrapper) are registered explicitly.\n * All other routes (meta, data, packages, analytics, automation, i18n, ui,\n * openapi, custom endpoints, and any future routes) are handled by a\n * catch-all that delegates to `HttpDispatcher.dispatch()`.\n *\n * This means new routes added to `HttpDispatcher` automatically work in\n * every adapter without any adapter-side code changes.\n *\n * @example\n * ```ts\n * import { createHonoApp } from '@objectstack/hono';\n * const app = createHonoApp({ kernel });\n * export default app;\n * ```\n */\nexport function createHonoApp(options: ObjectStackHonoOptions): Hono {\n  const app = new Hono();\n  const prefix = options.prefix || '/api';\n  const dispatcher = new HttpDispatcher(options.kernel);\n\n  // ─── CORS Middleware ──────────────────────────────────────────────────────\n  // Enabled by default. Controlled via options.cors or environment variables:\n  //   CORS_ENABLED     – \"false\" to disable (default: true)\n  //   CORS_ORIGIN      – comma-separated origins or \"*\" (default: \"*\")\n  //   CORS_CREDENTIALS – \"false\" to disallow credentials (default: true)\n  //   CORS_MAX_AGE     – preflight cache seconds (default: 86400)\n  const corsDisabledByEnv = process.env.CORS_ENABLED === 'false';\n  if (options.cors !== false && !corsDisabledByEnv) {\n    const corsOpts = typeof options.cors === 'object' ? options.cors : {};\n    const enabled = corsOpts.enabled ?? true;\n\n    if (enabled) {\n      // Resolve origins: options > env > default '*'\n      let configuredOrigin: string | string[];\n      if (corsOpts.origin) {\n        configuredOrigin = corsOpts.origin;\n      } else if (process.env.CORS_ORIGIN) {\n        const envOrigin = process.env.CORS_ORIGIN.trim();\n        configuredOrigin = envOrigin.includes(',') ? envOrigin.split(',').map(s => s.trim()) : envOrigin;\n      } else {\n        configuredOrigin = '*';\n      }\n\n      const credentials = corsOpts.credentials ?? (process.env.CORS_CREDENTIALS !== 'false');\n      const maxAge = corsOpts.maxAge ?? (process.env.CORS_MAX_AGE ? parseInt(process.env.CORS_MAX_AGE, 10) : 86400);\n\n      // When credentials is true, browsers reject wildcard '*' for Access-Control-Allow-Origin.\n      // Use a function to reflect the request's Origin header instead.\n      let origin: string | string[] | ((origin: string) => string | undefined | null);\n      if (credentials && configuredOrigin === '*') {\n        origin = (requestOrigin: string) => requestOrigin || '*';\n      } else {\n        origin = configuredOrigin;\n      }\n\n      app.use('*', cors({\n        origin: origin as any,\n        allowMethods: corsOpts.methods || ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'HEAD', 'OPTIONS'],\n        allowHeaders: corsOpts.allowHeaders || ['Content-Type', 'Authorization', 'X-Requested-With'],\n        exposeHeaders: corsOpts.exposeHeaders || [],\n        credentials,\n        maxAge,\n      }));\n    }\n  }\n\n  const errorJson = (c: any, message: string, code: number = 500) => {\n    return c.json({ success: false, error: { message, code } }, code);\n  };\n\n  const toResponse = (c: any, result: HttpDispatcherResult) => {\n    if (result.handled) {\n      if (result.response) {\n        if (result.response.headers) {\n          Object.entries(result.response.headers).forEach(([k, v]) => c.header(k, v as string));\n        }\n        return c.json(result.response.body, result.response.status);\n      }\n      if (result.result) {\n        const res = result.result;\n        if (res.type === 'redirect' && res.url) {\n          return c.redirect(res.url);\n        }\n        if (res.type === 'stream' && res.events) {\n          // SSE / Vercel Data Stream streaming response\n          const headers: Record<string, string> = {\n            'Content-Type': res.contentType || 'text/event-stream',\n            'Cache-Control': 'no-cache',\n            'Connection': 'keep-alive',\n            ...(res.headers || {}),\n          };\n          const stream = new ReadableStream({\n            async start(controller) {\n              try {\n                const encoder = new TextEncoder();\n                for await (const event of res.events) {\n                  const chunk = res.vercelDataStream\n                    ? (typeof event === 'string' ? event : JSON.stringify(event) + '\\n')\n                    : `data: ${JSON.stringify(event)}\\n\\n`;\n                  controller.enqueue(encoder.encode(chunk));\n                }\n              } catch (err) {\n                // Stream error — close gracefully\n              } finally {\n                controller.close();\n              }\n            },\n          });\n          return new Response(stream, { status: 200, headers });\n        }\n        if (res.type === 'stream' && res.stream) {\n          if (res.headers) {\n            Object.entries(res.headers).forEach(([k, v]) => c.header(k, v as string));\n          }\n          return new Response(res.stream, { status: 200 });\n        }\n        return c.json(res, 200);\n      }\n    }\n    return errorJson(c, 'Not Found', 404);\n  };\n\n  // ─── Explicit routes (framework-specific handling required) ────────────────\n\n  // --- Discovery ---\n  app.get(prefix, async (c) => {\n    return c.json({ data: await dispatcher.getDiscoveryInfo(prefix) });\n  });\n\n  app.get(`${prefix}/discovery`, async (c) => {\n    return c.json({ data: await dispatcher.getDiscoveryInfo(prefix) });\n  });\n\n  // --- .well-known ---\n  app.get('/.well-known/objectstack', (c) => {\n    return c.redirect(prefix);\n  });\n\n  // --- Auth (needs auth service integration) ---\n  app.all(`${prefix}/auth/*`, async (c) => {\n    try {\n      const path = c.req.path.substring(`${prefix}/auth/`.length);\n      const method = c.req.method;\n\n      // Try AuthPlugin service first (prefer async to support factory-based services)\n      let authService: AuthService | null = null;\n      try {\n        if (typeof options.kernel.getServiceAsync === 'function') {\n          authService = await options.kernel.getServiceAsync<AuthService>('auth');\n        } else if (typeof options.kernel.getService === 'function') {\n          authService = options.kernel.getService<AuthService>('auth');\n        }\n      } catch {\n        // Service not registered — fall through to dispatcher\n        authService = null;\n      }\n\n      if (authService && typeof authService.handleRequest === 'function') {\n        const response = await authService.handleRequest(c.req.raw);\n        return new Response(response.body, {\n          status: response.status,\n          headers: response.headers,\n        });\n      }\n\n      // Fallback to legacy dispatcher\n      const body = method === 'GET' || method === 'HEAD'\n        ? {}\n        : await c.req.json().catch(() => ({}));\n      const result = await dispatcher.handleAuth(path, method, body, { request: c.req.raw });\n      return toResponse(c, result);\n    } catch (err: any) {\n      return errorJson(c, err.message || 'Internal Server Error', err.statusCode || 500);\n    }\n  });\n\n  // --- GraphQL (returns raw result, not HttpDispatcherResult) ---\n  app.post(`${prefix}/graphql`, async (c) => {\n    try {\n      const body = await c.req.json();\n      const result = await dispatcher.handleGraphQL(body, { request: c.req.raw });\n      return c.json(result);\n    } catch (err: any) {\n      return errorJson(c, err.message || 'Internal Server Error', err.statusCode || 500);\n    }\n  });\n\n  // --- Storage (needs formData parsing) ---\n  app.all(`${prefix}/storage/*`, async (c) => {\n    try {\n      const subPath = c.req.path.substring(`${prefix}/storage`.length);\n      const method = c.req.method;\n\n      let file: any = undefined;\n      if (method === 'POST' && subPath === '/upload') {\n        const formData = await c.req.formData();\n        file = formData.get('file');\n      }\n\n      const result = await dispatcher.handleStorage(subPath, method, file, { request: c.req.raw });\n      return toResponse(c, result);\n    } catch (err: any) {\n      return errorJson(c, err.message || 'Internal Server Error', err.statusCode || 500);\n    }\n  });\n\n  // ─── Catch-all: delegate to dispatcher.dispatch() ─────────────────────────\n  // Handles meta, data, packages, analytics, automation, i18n, ui, openapi,\n  // custom API endpoints, and any future routes added to HttpDispatcher.\n  app.all(`${prefix}/*`, async (c) => {\n    try {\n      const subPath = c.req.path.substring(prefix.length);\n      const method = c.req.method;\n\n      let body: any = undefined;\n      if (method === 'POST' || method === 'PUT' || method === 'PATCH') {\n        body = await c.req.json().catch(() => ({}));\n      }\n\n      const queryParams: Record<string, any> = {};\n      const url = new URL(c.req.url);\n      url.searchParams.forEach((val, key) => { queryParams[key] = val; });\n\n      const result = await dispatcher.dispatch(method, subPath, body, queryParams, { request: c.req.raw }, prefix);\n      return toResponse(c, result);\n    } catch (err: any) {\n      return errorJson(c, err.message || 'Internal Server Error', err.statusCode || 500);\n    }\n  });\n\n  return app;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,kBAAqB;AACrB,kBAAqB;AACrB,qBAAwE;AAoCjE,SAAS,sBAAsB,QAAsB;AAC1D,SAAO,OAAO,GAAQ,SAAc;AAClC,MAAE,IAAI,eAAe,MAAM;AAC3B,UAAM,KAAK;AAAA,EACb;AACF;AAqBO,SAAS,cAAc,SAAuC;AACnE,QAAM,MAAM,IAAI,iBAAK;AACrB,QAAM,SAAS,QAAQ,UAAU;AACjC,QAAM,aAAa,IAAI,8BAAe,QAAQ,MAAM;AAQpD,QAAM,oBAAoB,QAAQ,IAAI,iBAAiB;AACvD,MAAI,QAAQ,SAAS,SAAS,CAAC,mBAAmB;AAChD,UAAM,WAAW,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO,CAAC;AACpE,UAAM,UAAU,SAAS,WAAW;AAEpC,QAAI,SAAS;AAEX,UAAI;AACJ,UAAI,SAAS,QAAQ;AACnB,2BAAmB,SAAS;AAAA,MAC9B,WAAW,QAAQ,IAAI,aAAa;AAClC,cAAM,YAAY,QAAQ,IAAI,YAAY,KAAK;AAC/C,2BAAmB,UAAU,SAAS,GAAG,IAAI,UAAU,MAAM,GAAG,EAAE,IAAI,OAAK,EAAE,KAAK,CAAC,IAAI;AAAA,MACzF,OAAO;AACL,2BAAmB;AAAA,MACrB;AAEA,YAAM,cAAc,SAAS,eAAgB,QAAQ,IAAI,qBAAqB;AAC9E,YAAM,SAAS,SAAS,WAAW,QAAQ,IAAI,eAAe,SAAS,QAAQ,IAAI,cAAc,EAAE,IAAI;AAIvG,UAAI;AACJ,UAAI,eAAe,qBAAqB,KAAK;AAC3C,iBAAS,CAAC,kBAA0B,iBAAiB;AAAA,MACvD,OAAO;AACL,iBAAS;AAAA,MACX;AAEA,UAAI,IAAI,SAAK,kBAAK;AAAA,QAChB;AAAA,QACA,cAAc,SAAS,WAAW,CAAC,OAAO,QAAQ,OAAO,UAAU,SAAS,QAAQ,SAAS;AAAA,QAC7F,cAAc,SAAS,gBAAgB,CAAC,gBAAgB,iBAAiB,kBAAkB;AAAA,QAC3F,eAAe,SAAS,iBAAiB,CAAC;AAAA,QAC1C;AAAA,QACA;AAAA,MACF,CAAC,CAAC;AAAA,IACJ;AAAA,EACF;AAEA,QAAM,YAAY,CAAC,GAAQ,SAAiB,OAAe,QAAQ;AACjE,WAAO,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,EAAE,SAAS,KAAK,EAAE,GAAG,IAAI;AAAA,EAClE;AAEA,QAAM,aAAa,CAAC,GAAQ,WAAiC;AAC3D,QAAI,OAAO,SAAS;AAClB,UAAI,OAAO,UAAU;AACnB,YAAI,OAAO,SAAS,SAAS;AAC3B,iBAAO,QAAQ,OAAO,SAAS,OAAO,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,GAAG,CAAW,CAAC;AAAA,QACtF;AACA,eAAO,EAAE,KAAK,OAAO,SAAS,MAAM,OAAO,SAAS,MAAM;AAAA,MAC5D;AACA,UAAI,OAAO,QAAQ;AACjB,cAAM,MAAM,OAAO;AACnB,YAAI,IAAI,SAAS,cAAc,IAAI,KAAK;AACtC,iBAAO,EAAE,SAAS,IAAI,GAAG;AAAA,QAC3B;AACA,YAAI,IAAI,SAAS,YAAY,IAAI,QAAQ;AAEvC,gBAAM,UAAkC;AAAA,YACtC,gBAAgB,IAAI,eAAe;AAAA,YACnC,iBAAiB;AAAA,YACjB,cAAc;AAAA,YACd,GAAI,IAAI,WAAW,CAAC;AAAA,UACtB;AACA,gBAAM,SAAS,IAAI,eAAe;AAAA,YAChC,MAAM,MAAM,YAAY;AACtB,kBAAI;AACF,sBAAM,UAAU,IAAI,YAAY;AAChC,iCAAiB,SAAS,IAAI,QAAQ;AACpC,wBAAM,QAAQ,IAAI,mBACb,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,KAAK,IAAI,OAC7D,SAAS,KAAK,UAAU,KAAK,CAAC;AAAA;AAAA;AAClC,6BAAW,QAAQ,QAAQ,OAAO,KAAK,CAAC;AAAA,gBAC1C;AAAA,cACF,SAAS,KAAK;AAAA,cAEd,UAAE;AACA,2BAAW,MAAM;AAAA,cACnB;AAAA,YACF;AAAA,UACF,CAAC;AACD,iBAAO,IAAI,SAAS,QAAQ,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAAA,QACtD;AACA,YAAI,IAAI,SAAS,YAAY,IAAI,QAAQ;AACvC,cAAI,IAAI,SAAS;AACf,mBAAO,QAAQ,IAAI,OAAO,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,GAAG,CAAW,CAAC;AAAA,UAC1E;AACA,iBAAO,IAAI,SAAS,IAAI,QAAQ,EAAE,QAAQ,IAAI,CAAC;AAAA,QACjD;AACA,eAAO,EAAE,KAAK,KAAK,GAAG;AAAA,MACxB;AAAA,IACF;AACA,WAAO,UAAU,GAAG,aAAa,GAAG;AAAA,EACtC;AAKA,MAAI,IAAI,QAAQ,OAAO,MAAM;AAC3B,WAAO,EAAE,KAAK,EAAE,MAAM,MAAM,WAAW,iBAAiB,MAAM,EAAE,CAAC;AAAA,EACnE,CAAC;AAED,MAAI,IAAI,GAAG,MAAM,cAAc,OAAO,MAAM;AAC1C,WAAO,EAAE,KAAK,EAAE,MAAM,MAAM,WAAW,iBAAiB,MAAM,EAAE,CAAC;AAAA,EACnE,CAAC;AAGD,MAAI,IAAI,4BAA4B,CAAC,MAAM;AACzC,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B,CAAC;AAGD,MAAI,IAAI,GAAG,MAAM,WAAW,OAAO,MAAM;AACvC,QAAI;AACF,YAAM,OAAO,EAAE,IAAI,KAAK,UAAU,GAAG,MAAM,SAAS,MAAM;AAC1D,YAAM,SAAS,EAAE,IAAI;AAGrB,UAAI,cAAkC;AACtC,UAAI;AACF,YAAI,OAAO,QAAQ,OAAO,oBAAoB,YAAY;AACxD,wBAAc,MAAM,QAAQ,OAAO,gBAA6B,MAAM;AAAA,QACxE,WAAW,OAAO,QAAQ,OAAO,eAAe,YAAY;AAC1D,wBAAc,QAAQ,OAAO,WAAwB,MAAM;AAAA,QAC7D;AAAA,MACF,QAAQ;AAEN,sBAAc;AAAA,MAChB;AAEA,UAAI,eAAe,OAAO,YAAY,kBAAkB,YAAY;AAClE,cAAM,WAAW,MAAM,YAAY,cAAc,EAAE,IAAI,GAAG;AAC1D,eAAO,IAAI,SAAS,SAAS,MAAM;AAAA,UACjC,QAAQ,SAAS;AAAA,UACjB,SAAS,SAAS;AAAA,QACpB,CAAC;AAAA,MACH;AAGA,YAAM,OAAO,WAAW,SAAS,WAAW,SACxC,CAAC,IACD,MAAM,EAAE,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACvC,YAAM,SAAS,MAAM,WAAW,WAAW,MAAM,QAAQ,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC;AACrF,aAAO,WAAW,GAAG,MAAM;AAAA,IAC7B,SAAS,KAAU;AACjB,aAAO,UAAU,GAAG,IAAI,WAAW,yBAAyB,IAAI,cAAc,GAAG;AAAA,IACnF;AAAA,EACF,CAAC;AAGD,MAAI,KAAK,GAAG,MAAM,YAAY,OAAO,MAAM;AACzC,QAAI;AACF,YAAM,OAAO,MAAM,EAAE,IAAI,KAAK;AAC9B,YAAM,SAAS,MAAM,WAAW,cAAc,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC;AAC1E,aAAO,EAAE,KAAK,MAAM;AAAA,IACtB,SAAS,KAAU;AACjB,aAAO,UAAU,GAAG,IAAI,WAAW,yBAAyB,IAAI,cAAc,GAAG;AAAA,IACnF;AAAA,EACF,CAAC;AAGD,MAAI,IAAI,GAAG,MAAM,cAAc,OAAO,MAAM;AAC1C,QAAI;AACF,YAAM,UAAU,EAAE,IAAI,KAAK,UAAU,GAAG,MAAM,WAAW,MAAM;AAC/D,YAAM,SAAS,EAAE,IAAI;AAErB,UAAI,OAAY;AAChB,UAAI,WAAW,UAAU,YAAY,WAAW;AAC9C,cAAM,WAAW,MAAM,EAAE,IAAI,SAAS;AACtC,eAAO,SAAS,IAAI,MAAM;AAAA,MAC5B;AAEA,YAAM,SAAS,MAAM,WAAW,cAAc,SAAS,QAAQ,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC;AAC3F,aAAO,WAAW,GAAG,MAAM;AAAA,IAC7B,SAAS,KAAU;AACjB,aAAO,UAAU,GAAG,IAAI,WAAW,yBAAyB,IAAI,cAAc,GAAG;AAAA,IACnF;AAAA,EACF,CAAC;AAKD,MAAI,IAAI,GAAG,MAAM,MAAM,OAAO,MAAM;AAClC,QAAI;AACF,YAAM,UAAU,EAAE,IAAI,KAAK,UAAU,OAAO,MAAM;AAClD,YAAM,SAAS,EAAE,IAAI;AAErB,UAAI,OAAY;AAChB,UAAI,WAAW,UAAU,WAAW,SAAS,WAAW,SAAS;AAC/D,eAAO,MAAM,EAAE,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAAA,MAC5C;AAEA,YAAM,cAAmC,CAAC;AAC1C,YAAM,MAAM,IAAI,IAAI,EAAE,IAAI,GAAG;AAC7B,UAAI,aAAa,QAAQ,CAAC,KAAK,QAAQ;AAAE,oBAAY,GAAG,IAAI;AAAA,MAAK,CAAC;AAElE,YAAM,SAAS,MAAM,WAAW,SAAS,QAAQ,SAAS,MAAM,aAAa,EAAE,SAAS,EAAE,IAAI,IAAI,GAAG,MAAM;AAC3G,aAAO,WAAW,GAAG,MAAM;AAAA,IAC7B,SAAS,KAAU;AACjB,aAAO,UAAU,GAAG,IAAI,WAAW,yBAAyB,IAAI,cAAc,GAAG;AAAA,IACnF;AAAA,EACF,CAAC;AAED,SAAO;AACT;","names":[]}

package/dist/index.mjs

@@ -1,5 +1,6 @@
 // src/index.ts
 import { Hono } from "hono";
+import { cors } from "hono/cors";
 import { HttpDispatcher } from "@objectstack/runtime";
 function objectStackMiddleware(kernel) {
   return async (c, next) => {
@@ -11,6 +12,38 @@ function createHonoApp(options) {
   const app = new Hono();
   const prefix = options.prefix || "/api";
   const dispatcher = new HttpDispatcher(options.kernel);
+  const corsDisabledByEnv = process.env.CORS_ENABLED === "false";
+  if (options.cors !== false && !corsDisabledByEnv) {
+    const corsOpts = typeof options.cors === "object" ? options.cors : {};
+    const enabled = corsOpts.enabled ?? true;
+    if (enabled) {
+      let configuredOrigin;
+      if (corsOpts.origin) {
+        configuredOrigin = corsOpts.origin;
+      } else if (process.env.CORS_ORIGIN) {
+        const envOrigin = process.env.CORS_ORIGIN.trim();
+        configuredOrigin = envOrigin.includes(",") ? envOrigin.split(",").map((s) => s.trim()) : envOrigin;
+      } else {
+        configuredOrigin = "*";
+      }
+      const credentials = corsOpts.credentials ?? process.env.CORS_CREDENTIALS !== "false";
+      const maxAge = corsOpts.maxAge ?? (process.env.CORS_MAX_AGE ? parseInt(process.env.CORS_MAX_AGE, 10) : 86400);
+      let origin;
+      if (credentials && configuredOrigin === "*") {
+        origin = (requestOrigin) => requestOrigin || "*";
+      } else {
+        origin = configuredOrigin;
+      }
+      app.use("*", cors({
+        origin,
+        allowMethods: corsOpts.methods || ["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"],
+        allowHeaders: corsOpts.allowHeaders || ["Content-Type", "Authorization", "X-Requested-With"],
+        exposeHeaders: corsOpts.exposeHeaders || [],
+        credentials,
+        maxAge
+      }));
+    }
+  }
   const errorJson = (c, message, code = 500) => {
     return c.json({ success: false, error: { message, code } }, code);
   };

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { Hono } from 'hono';\nimport { type ObjectKernel, HttpDispatcher, HttpDispatcherResult } from '@objectstack/runtime';\n\nexport interface ObjectStackHonoOptions {\n  kernel: ObjectKernel;\n  prefix?: string;\n}\n\n/**\n * Auth service interface with handleRequest method\n */\ninterface AuthService {\n  handleRequest(request: Request): Promise<Response>;\n}\n\n/**\n * Middleware mode for existing Hono apps\n */\nexport function objectStackMiddleware(kernel: ObjectKernel) {\n  return async (c: any, next: any) => {\n    c.set('objectStack', kernel);\n    await next();\n  };\n}\n\n/**\n * Creates a full-featured Hono app with all ObjectStack route dispatchers.\n *\n * Only routes that need framework-specific handling (auth service, storage\n * formData, GraphQL raw result, discovery wrapper) are registered explicitly.\n * All other routes (meta, data, packages, analytics, automation, i18n, ui,\n * openapi, custom endpoints, and any future routes) are handled by a\n * catch-all that delegates to `HttpDispatcher.dispatch()`.\n *\n * This means new routes added to `HttpDispatcher` automatically work in\n * every adapter without any adapter-side code changes.\n *\n * @example\n * ```ts\n * import { createHonoApp } from '@objectstack/hono';\n * const app = createHonoApp({ kernel });\n * export default app;\n * ```\n */\nexport function createHonoApp(options: ObjectStackHonoOptions): Hono {\n  const app = new Hono();\n  const prefix = options.prefix || '/api';\n  const dispatcher = new HttpDispatcher(options.kernel);\n\n  const errorJson = (c: any, message: string, code: number = 500) => {\n    return c.json({ success: false, error: { message, code } }, code);\n  };\n\n  const toResponse = (c: any, result: HttpDispatcherResult) => {\n    if (result.handled) {\n      if (result.response) {\n        if (result.response.headers) {\n          Object.entries(result.response.headers).forEach(([k, v]) => c.header(k, v as string));\n        }\n        return c.json(result.response.body, result.response.status);\n      }\n      if (result.result) {\n        const res = result.result;\n        if (res.type === 'redirect' && res.url) {\n          return c.redirect(res.url);\n        }\n        if (res.type === 'stream' && res.events) {\n          // SSE / Vercel Data Stream streaming response\n          const headers: Record<string, string> = {\n            'Content-Type': res.contentType || 'text/event-stream',\n            'Cache-Control': 'no-cache',\n            'Connection': 'keep-alive',\n            ...(res.headers || {}),\n          };\n          const stream = new ReadableStream({\n            async start(controller) {\n              try {\n                const encoder = new TextEncoder();\n                for await (const event of res.events) {\n                  const chunk = res.vercelDataStream\n                    ? (typeof event === 'string' ? event : JSON.stringify(event) + '\\n')\n                    : `data: ${JSON.stringify(event)}\\n\\n`;\n                  controller.enqueue(encoder.encode(chunk));\n                }\n              } catch (err) {\n                // Stream error — close gracefully\n              } finally {\n                controller.close();\n              }\n            },\n          });\n          return new Response(stream, { status: 200, headers });\n        }\n        if (res.type === 'stream' && res.stream) {\n          if (res.headers) {\n            Object.entries(res.headers).forEach(([k, v]) => c.header(k, v as string));\n          }\n          return new Response(res.stream, { status: 200 });\n        }\n        return c.json(res, 200);\n      }\n    }\n    return errorJson(c, 'Not Found', 404);\n  };\n\n  // ─── Explicit routes (framework-specific handling required) ────────────────\n\n  // --- Discovery ---\n  app.get(prefix, async (c) => {\n    return c.json({ data: await dispatcher.getDiscoveryInfo(prefix) });\n  });\n\n  app.get(`${prefix}/discovery`, async (c) => {\n    return c.json({ data: await dispatcher.getDiscoveryInfo(prefix) });\n  });\n\n  // --- .well-known ---\n  app.get('/.well-known/objectstack', (c) => {\n    return c.redirect(prefix);\n  });\n\n  // --- Auth (needs auth service integration) ---\n  app.all(`${prefix}/auth/*`, async (c) => {\n    try {\n      const path = c.req.path.substring(`${prefix}/auth/`.length);\n      const method = c.req.method;\n\n      // Try AuthPlugin service first (prefer async to support factory-based services)\n      let authService: AuthService | null = null;\n      try {\n        if (typeof options.kernel.getServiceAsync === 'function') {\n          authService = await options.kernel.getServiceAsync<AuthService>('auth');\n        } else if (typeof options.kernel.getService === 'function') {\n          authService = options.kernel.getService<AuthService>('auth');\n        }\n      } catch {\n        // Service not registered — fall through to dispatcher\n        authService = null;\n      }\n\n      if (authService && typeof authService.handleRequest === 'function') {\n        const response = await authService.handleRequest(c.req.raw);\n        return new Response(response.body, {\n          status: response.status,\n          headers: response.headers,\n        });\n      }\n\n      // Fallback to legacy dispatcher\n      const body = method === 'GET' || method === 'HEAD'\n        ? {}\n        : await c.req.json().catch(() => ({}));\n      const result = await dispatcher.handleAuth(path, method, body, { request: c.req.raw });\n      return toResponse(c, result);\n    } catch (err: any) {\n      return errorJson(c, err.message || 'Internal Server Error', err.statusCode || 500);\n    }\n  });\n\n  // --- GraphQL (returns raw result, not HttpDispatcherResult) ---\n  app.post(`${prefix}/graphql`, async (c) => {\n    try {\n      const body = await c.req.json();\n      const result = await dispatcher.handleGraphQL(body, { request: c.req.raw });\n      return c.json(result);\n    } catch (err: any) {\n      return errorJson(c, err.message || 'Internal Server Error', err.statusCode || 500);\n    }\n  });\n\n  // --- Storage (needs formData parsing) ---\n  app.all(`${prefix}/storage/*`, async (c) => {\n    try {\n      const subPath = c.req.path.substring(`${prefix}/storage`.length);\n      const method = c.req.method;\n\n      let file: any = undefined;\n      if (method === 'POST' && subPath === '/upload') {\n        const formData = await c.req.formData();\n        file = formData.get('file');\n      }\n\n      const result = await dispatcher.handleStorage(subPath, method, file, { request: c.req.raw });\n      return toResponse(c, result);\n    } catch (err: any) {\n      return errorJson(c, err.message || 'Internal Server Error', err.statusCode || 500);\n    }\n  });\n\n  // ─── Catch-all: delegate to dispatcher.dispatch() ─────────────────────────\n  // Handles meta, data, packages, analytics, automation, i18n, ui, openapi,\n  // custom API endpoints, and any future routes added to HttpDispatcher.\n  app.all(`${prefix}/*`, async (c) => {\n    try {\n      const subPath = c.req.path.substring(prefix.length);\n      const method = c.req.method;\n\n      let body: any = undefined;\n      if (method === 'POST' || method === 'PUT' || method === 'PATCH') {\n        body = await c.req.json().catch(() => ({}));\n      }\n\n      const queryParams: Record<string, any> = {};\n      const url = new URL(c.req.url);\n      url.searchParams.forEach((val, key) => { queryParams[key] = val; });\n\n      const result = await dispatcher.dispatch(method, subPath, body, queryParams, { request: c.req.raw }, prefix);\n      return toResponse(c, result);\n    } catch (err: any) {\n      return errorJson(c, err.message || 'Internal Server Error', err.statusCode || 500);\n    }\n  });\n\n  return app;\n}\n"],"mappings":";AAEA,SAAS,YAAY;AACrB,SAA4B,sBAA4C;AAiBjE,SAAS,sBAAsB,QAAsB;AAC1D,SAAO,OAAO,GAAQ,SAAc;AAClC,MAAE,IAAI,eAAe,MAAM;AAC3B,UAAM,KAAK;AAAA,EACb;AACF;AAqBO,SAAS,cAAc,SAAuC;AACnE,QAAM,MAAM,IAAI,KAAK;AACrB,QAAM,SAAS,QAAQ,UAAU;AACjC,QAAM,aAAa,IAAI,eAAe,QAAQ,MAAM;AAEpD,QAAM,YAAY,CAAC,GAAQ,SAAiB,OAAe,QAAQ;AACjE,WAAO,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,EAAE,SAAS,KAAK,EAAE,GAAG,IAAI;AAAA,EAClE;AAEA,QAAM,aAAa,CAAC,GAAQ,WAAiC;AAC3D,QAAI,OAAO,SAAS;AAClB,UAAI,OAAO,UAAU;AACnB,YAAI,OAAO,SAAS,SAAS;AAC3B,iBAAO,QAAQ,OAAO,SAAS,OAAO,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,GAAG,CAAW,CAAC;AAAA,QACtF;AACA,eAAO,EAAE,KAAK,OAAO,SAAS,MAAM,OAAO,SAAS,MAAM;AAAA,MAC5D;AACA,UAAI,OAAO,QAAQ;AACjB,cAAM,MAAM,OAAO;AACnB,YAAI,IAAI,SAAS,cAAc,IAAI,KAAK;AACtC,iBAAO,EAAE,SAAS,IAAI,GAAG;AAAA,QAC3B;AACA,YAAI,IAAI,SAAS,YAAY,IAAI,QAAQ;AAEvC,gBAAM,UAAkC;AAAA,YACtC,gBAAgB,IAAI,eAAe;AAAA,YACnC,iBAAiB;AAAA,YACjB,cAAc;AAAA,YACd,GAAI,IAAI,WAAW,CAAC;AAAA,UACtB;AACA,gBAAM,SAAS,IAAI,eAAe;AAAA,YAChC,MAAM,MAAM,YAAY;AACtB,kBAAI;AACF,sBAAM,UAAU,IAAI,YAAY;AAChC,iCAAiB,SAAS,IAAI,QAAQ;AACpC,wBAAM,QAAQ,IAAI,mBACb,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,KAAK,IAAI,OAC7D,SAAS,KAAK,UAAU,KAAK,CAAC;AAAA;AAAA;AAClC,6BAAW,QAAQ,QAAQ,OAAO,KAAK,CAAC;AAAA,gBAC1C;AAAA,cACF,SAAS,KAAK;AAAA,cAEd,UAAE;AACA,2BAAW,MAAM;AAAA,cACnB;AAAA,YACF;AAAA,UACF,CAAC;AACD,iBAAO,IAAI,SAAS,QAAQ,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAAA,QACtD;AACA,YAAI,IAAI,SAAS,YAAY,IAAI,QAAQ;AACvC,cAAI,IAAI,SAAS;AACf,mBAAO,QAAQ,IAAI,OAAO,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,GAAG,CAAW,CAAC;AAAA,UAC1E;AACA,iBAAO,IAAI,SAAS,IAAI,QAAQ,EAAE,QAAQ,IAAI,CAAC;AAAA,QACjD;AACA,eAAO,EAAE,KAAK,KAAK,GAAG;AAAA,MACxB;AAAA,IACF;AACA,WAAO,UAAU,GAAG,aAAa,GAAG;AAAA,EACtC;AAKA,MAAI,IAAI,QAAQ,OAAO,MAAM;AAC3B,WAAO,EAAE,KAAK,EAAE,MAAM,MAAM,WAAW,iBAAiB,MAAM,EAAE,CAAC;AAAA,EACnE,CAAC;AAED,MAAI,IAAI,GAAG,MAAM,cAAc,OAAO,MAAM;AAC1C,WAAO,EAAE,KAAK,EAAE,MAAM,MAAM,WAAW,iBAAiB,MAAM,EAAE,CAAC;AAAA,EACnE,CAAC;AAGD,MAAI,IAAI,4BAA4B,CAAC,MAAM;AACzC,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B,CAAC;AAGD,MAAI,IAAI,GAAG,MAAM,WAAW,OAAO,MAAM;AACvC,QAAI;AACF,YAAM,OAAO,EAAE,IAAI,KAAK,UAAU,GAAG,MAAM,SAAS,MAAM;AAC1D,YAAM,SAAS,EAAE,IAAI;AAGrB,UAAI,cAAkC;AACtC,UAAI;AACF,YAAI,OAAO,QAAQ,OAAO,oBAAoB,YAAY;AACxD,wBAAc,MAAM,QAAQ,OAAO,gBAA6B,MAAM;AAAA,QACxE,WAAW,OAAO,QAAQ,OAAO,eAAe,YAAY;AAC1D,wBAAc,QAAQ,OAAO,WAAwB,MAAM;AAAA,QAC7D;AAAA,MACF,QAAQ;AAEN,sBAAc;AAAA,MAChB;AAEA,UAAI,eAAe,OAAO,YAAY,kBAAkB,YAAY;AAClE,cAAM,WAAW,MAAM,YAAY,cAAc,EAAE,IAAI,GAAG;AAC1D,eAAO,IAAI,SAAS,SAAS,MAAM;AAAA,UACjC,QAAQ,SAAS;AAAA,UACjB,SAAS,SAAS;AAAA,QACpB,CAAC;AAAA,MACH;AAGA,YAAM,OAAO,WAAW,SAAS,WAAW,SACxC,CAAC,IACD,MAAM,EAAE,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACvC,YAAM,SAAS,MAAM,WAAW,WAAW,MAAM,QAAQ,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC;AACrF,aAAO,WAAW,GAAG,MAAM;AAAA,IAC7B,SAAS,KAAU;AACjB,aAAO,UAAU,GAAG,IAAI,WAAW,yBAAyB,IAAI,cAAc,GAAG;AAAA,IACnF;AAAA,EACF,CAAC;AAGD,MAAI,KAAK,GAAG,MAAM,YAAY,OAAO,MAAM;AACzC,QAAI;AACF,YAAM,OAAO,MAAM,EAAE,IAAI,KAAK;AAC9B,YAAM,SAAS,MAAM,WAAW,cAAc,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC;AAC1E,aAAO,EAAE,KAAK,MAAM;AAAA,IACtB,SAAS,KAAU;AACjB,aAAO,UAAU,GAAG,IAAI,WAAW,yBAAyB,IAAI,cAAc,GAAG;AAAA,IACnF;AAAA,EACF,CAAC;AAGD,MAAI,IAAI,GAAG,MAAM,cAAc,OAAO,MAAM;AAC1C,QAAI;AACF,YAAM,UAAU,EAAE,IAAI,KAAK,UAAU,GAAG,MAAM,WAAW,MAAM;AAC/D,YAAM,SAAS,EAAE,IAAI;AAErB,UAAI,OAAY;AAChB,UAAI,WAAW,UAAU,YAAY,WAAW;AAC9C,cAAM,WAAW,MAAM,EAAE,IAAI,SAAS;AACtC,eAAO,SAAS,IAAI,MAAM;AAAA,MAC5B;AAEA,YAAM,SAAS,MAAM,WAAW,cAAc,SAAS,QAAQ,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC;AAC3F,aAAO,WAAW,GAAG,MAAM;AAAA,IAC7B,SAAS,KAAU;AACjB,aAAO,UAAU,GAAG,IAAI,WAAW,yBAAyB,IAAI,cAAc,GAAG;AAAA,IACnF;AAAA,EACF,CAAC;AAKD,MAAI,IAAI,GAAG,MAAM,MAAM,OAAO,MAAM;AAClC,QAAI;AACF,YAAM,UAAU,EAAE,IAAI,KAAK,UAAU,OAAO,MAAM;AAClD,YAAM,SAAS,EAAE,IAAI;AAErB,UAAI,OAAY;AAChB,UAAI,WAAW,UAAU,WAAW,SAAS,WAAW,SAAS;AAC/D,eAAO,MAAM,EAAE,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAAA,MAC5C;AAEA,YAAM,cAAmC,CAAC;AAC1C,YAAM,MAAM,IAAI,IAAI,EAAE,IAAI,GAAG;AAC7B,UAAI,aAAa,QAAQ,CAAC,KAAK,QAAQ;AAAE,oBAAY,GAAG,IAAI;AAAA,MAAK,CAAC;AAElE,YAAM,SAAS,MAAM,WAAW,SAAS,QAAQ,SAAS,MAAM,aAAa,EAAE,SAAS,EAAE,IAAI,IAAI,GAAG,MAAM;AAC3G,aAAO,WAAW,GAAG,MAAM;AAAA,IAC7B,SAAS,KAAU;AACjB,aAAO,UAAU,GAAG,IAAI,WAAW,yBAAyB,IAAI,cAAc,GAAG;AAAA,IACnF;AAAA,EACF,CAAC;AAED,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { Hono } from 'hono';\nimport { cors } from 'hono/cors';\nimport { type ObjectKernel, HttpDispatcher, HttpDispatcherResult } from '@objectstack/runtime';\n\nexport interface ObjectStackHonoCorsOptions {\n  /** Enable or disable CORS. Defaults to true. */\n  enabled?: boolean;\n  /** Allowed origins. Defaults to env `CORS_ORIGIN` or '*'. Comma-separated string or array. */\n  origin?: string | string[];\n  /** Allowed methods. */\n  methods?: string[];\n  /** Allow credentials (cookies, authorization headers). */\n  credentials?: boolean;\n  /** Preflight cache max-age in seconds. */\n  maxAge?: number;\n  /** Allowed headers. */\n  allowHeaders?: string[];\n  /** Exposed headers. */\n  exposeHeaders?: string[];\n}\n\nexport interface ObjectStackHonoOptions {\n  kernel: ObjectKernel;\n  prefix?: string;\n  /** CORS configuration. Set to `false` to disable entirely. */\n  cors?: ObjectStackHonoCorsOptions | false;\n}\n\n/**\n * Auth service interface with handleRequest method\n */\ninterface AuthService {\n  handleRequest(request: Request): Promise<Response>;\n}\n\n/**\n * Middleware mode for existing Hono apps\n */\nexport function objectStackMiddleware(kernel: ObjectKernel) {\n  return async (c: any, next: any) => {\n    c.set('objectStack', kernel);\n    await next();\n  };\n}\n\n/**\n * Creates a full-featured Hono app with all ObjectStack route dispatchers.\n *\n * Only routes that need framework-specific handling (auth service, storage\n * formData, GraphQL raw result, discovery wrapper) are registered explicitly.\n * All other routes (meta, data, packages, analytics, automation, i18n, ui,\n * openapi, custom endpoints, and any future routes) are handled by a\n * catch-all that delegates to `HttpDispatcher.dispatch()`.\n *\n * This means new routes added to `HttpDispatcher` automatically work in\n * every adapter without any adapter-side code changes.\n *\n * @example\n * ```ts\n * import { createHonoApp } from '@objectstack/hono';\n * const app = createHonoApp({ kernel });\n * export default app;\n * ```\n */\nexport function createHonoApp(options: ObjectStackHonoOptions): Hono {\n  const app = new Hono();\n  const prefix = options.prefix || '/api';\n  const dispatcher = new HttpDispatcher(options.kernel);\n\n  // ─── CORS Middleware ──────────────────────────────────────────────────────\n  // Enabled by default. Controlled via options.cors or environment variables:\n  //   CORS_ENABLED     – \"false\" to disable (default: true)\n  //   CORS_ORIGIN      – comma-separated origins or \"*\" (default: \"*\")\n  //   CORS_CREDENTIALS – \"false\" to disallow credentials (default: true)\n  //   CORS_MAX_AGE     – preflight cache seconds (default: 86400)\n  const corsDisabledByEnv = process.env.CORS_ENABLED === 'false';\n  if (options.cors !== false && !corsDisabledByEnv) {\n    const corsOpts = typeof options.cors === 'object' ? options.cors : {};\n    const enabled = corsOpts.enabled ?? true;\n\n    if (enabled) {\n      // Resolve origins: options > env > default '*'\n      let configuredOrigin: string | string[];\n      if (corsOpts.origin) {\n        configuredOrigin = corsOpts.origin;\n      } else if (process.env.CORS_ORIGIN) {\n        const envOrigin = process.env.CORS_ORIGIN.trim();\n        configuredOrigin = envOrigin.includes(',') ? envOrigin.split(',').map(s => s.trim()) : envOrigin;\n      } else {\n        configuredOrigin = '*';\n      }\n\n      const credentials = corsOpts.credentials ?? (process.env.CORS_CREDENTIALS !== 'false');\n      const maxAge = corsOpts.maxAge ?? (process.env.CORS_MAX_AGE ? parseInt(process.env.CORS_MAX_AGE, 10) : 86400);\n\n      // When credentials is true, browsers reject wildcard '*' for Access-Control-Allow-Origin.\n      // Use a function to reflect the request's Origin header instead.\n      let origin: string | string[] | ((origin: string) => string | undefined | null);\n      if (credentials && configuredOrigin === '*') {\n        origin = (requestOrigin: string) => requestOrigin || '*';\n      } else {\n        origin = configuredOrigin;\n      }\n\n      app.use('*', cors({\n        origin: origin as any,\n        allowMethods: corsOpts.methods || ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'HEAD', 'OPTIONS'],\n        allowHeaders: corsOpts.allowHeaders || ['Content-Type', 'Authorization', 'X-Requested-With'],\n        exposeHeaders: corsOpts.exposeHeaders || [],\n        credentials,\n        maxAge,\n      }));\n    }\n  }\n\n  const errorJson = (c: any, message: string, code: number = 500) => {\n    return c.json({ success: false, error: { message, code } }, code);\n  };\n\n  const toResponse = (c: any, result: HttpDispatcherResult) => {\n    if (result.handled) {\n      if (result.response) {\n        if (result.response.headers) {\n          Object.entries(result.response.headers).forEach(([k, v]) => c.header(k, v as string));\n        }\n        return c.json(result.response.body, result.response.status);\n      }\n      if (result.result) {\n        const res = result.result;\n        if (res.type === 'redirect' && res.url) {\n          return c.redirect(res.url);\n        }\n        if (res.type === 'stream' && res.events) {\n          // SSE / Vercel Data Stream streaming response\n          const headers: Record<string, string> = {\n            'Content-Type': res.contentType || 'text/event-stream',\n            'Cache-Control': 'no-cache',\n            'Connection': 'keep-alive',\n            ...(res.headers || {}),\n          };\n          const stream = new ReadableStream({\n            async start(controller) {\n              try {\n                const encoder = new TextEncoder();\n                for await (const event of res.events) {\n                  const chunk = res.vercelDataStream\n                    ? (typeof event === 'string' ? event : JSON.stringify(event) + '\\n')\n                    : `data: ${JSON.stringify(event)}\\n\\n`;\n                  controller.enqueue(encoder.encode(chunk));\n                }\n              } catch (err) {\n                // Stream error — close gracefully\n              } finally {\n                controller.close();\n              }\n            },\n          });\n          return new Response(stream, { status: 200, headers });\n        }\n        if (res.type === 'stream' && res.stream) {\n          if (res.headers) {\n            Object.entries(res.headers).forEach(([k, v]) => c.header(k, v as string));\n          }\n          return new Response(res.stream, { status: 200 });\n        }\n        return c.json(res, 200);\n      }\n    }\n    return errorJson(c, 'Not Found', 404);\n  };\n\n  // ─── Explicit routes (framework-specific handling required) ────────────────\n\n  // --- Discovery ---\n  app.get(prefix, async (c) => {\n    return c.json({ data: await dispatcher.getDiscoveryInfo(prefix) });\n  });\n\n  app.get(`${prefix}/discovery`, async (c) => {\n    return c.json({ data: await dispatcher.getDiscoveryInfo(prefix) });\n  });\n\n  // --- .well-known ---\n  app.get('/.well-known/objectstack', (c) => {\n    return c.redirect(prefix);\n  });\n\n  // --- Auth (needs auth service integration) ---\n  app.all(`${prefix}/auth/*`, async (c) => {\n    try {\n      const path = c.req.path.substring(`${prefix}/auth/`.length);\n      const method = c.req.method;\n\n      // Try AuthPlugin service first (prefer async to support factory-based services)\n      let authService: AuthService | null = null;\n      try {\n        if (typeof options.kernel.getServiceAsync === 'function') {\n          authService = await options.kernel.getServiceAsync<AuthService>('auth');\n        } else if (typeof options.kernel.getService === 'function') {\n          authService = options.kernel.getService<AuthService>('auth');\n        }\n      } catch {\n        // Service not registered — fall through to dispatcher\n        authService = null;\n      }\n\n      if (authService && typeof authService.handleRequest === 'function') {\n        const response = await authService.handleRequest(c.req.raw);\n        return new Response(response.body, {\n          status: response.status,\n          headers: response.headers,\n        });\n      }\n\n      // Fallback to legacy dispatcher\n      const body = method === 'GET' || method === 'HEAD'\n        ? {}\n        : await c.req.json().catch(() => ({}));\n      const result = await dispatcher.handleAuth(path, method, body, { request: c.req.raw });\n      return toResponse(c, result);\n    } catch (err: any) {\n      return errorJson(c, err.message || 'Internal Server Error', err.statusCode || 500);\n    }\n  });\n\n  // --- GraphQL (returns raw result, not HttpDispatcherResult) ---\n  app.post(`${prefix}/graphql`, async (c) => {\n    try {\n      const body = await c.req.json();\n      const result = await dispatcher.handleGraphQL(body, { request: c.req.raw });\n      return c.json(result);\n    } catch (err: any) {\n      return errorJson(c, err.message || 'Internal Server Error', err.statusCode || 500);\n    }\n  });\n\n  // --- Storage (needs formData parsing) ---\n  app.all(`${prefix}/storage/*`, async (c) => {\n    try {\n      const subPath = c.req.path.substring(`${prefix}/storage`.length);\n      const method = c.req.method;\n\n      let file: any = undefined;\n      if (method === 'POST' && subPath === '/upload') {\n        const formData = await c.req.formData();\n        file = formData.get('file');\n      }\n\n      const result = await dispatcher.handleStorage(subPath, method, file, { request: c.req.raw });\n      return toResponse(c, result);\n    } catch (err: any) {\n      return errorJson(c, err.message || 'Internal Server Error', err.statusCode || 500);\n    }\n  });\n\n  // ─── Catch-all: delegate to dispatcher.dispatch() ─────────────────────────\n  // Handles meta, data, packages, analytics, automation, i18n, ui, openapi,\n  // custom API endpoints, and any future routes added to HttpDispatcher.\n  app.all(`${prefix}/*`, async (c) => {\n    try {\n      const subPath = c.req.path.substring(prefix.length);\n      const method = c.req.method;\n\n      let body: any = undefined;\n      if (method === 'POST' || method === 'PUT' || method === 'PATCH') {\n        body = await c.req.json().catch(() => ({}));\n      }\n\n      const queryParams: Record<string, any> = {};\n      const url = new URL(c.req.url);\n      url.searchParams.forEach((val, key) => { queryParams[key] = val; });\n\n      const result = await dispatcher.dispatch(method, subPath, body, queryParams, { request: c.req.raw }, prefix);\n      return toResponse(c, result);\n    } catch (err: any) {\n      return errorJson(c, err.message || 'Internal Server Error', err.statusCode || 500);\n    }\n  });\n\n  return app;\n}\n"],"mappings":";AAEA,SAAS,YAAY;AACrB,SAAS,YAAY;AACrB,SAA4B,sBAA4C;AAoCjE,SAAS,sBAAsB,QAAsB;AAC1D,SAAO,OAAO,GAAQ,SAAc;AAClC,MAAE,IAAI,eAAe,MAAM;AAC3B,UAAM,KAAK;AAAA,EACb;AACF;AAqBO,SAAS,cAAc,SAAuC;AACnE,QAAM,MAAM,IAAI,KAAK;AACrB,QAAM,SAAS,QAAQ,UAAU;AACjC,QAAM,aAAa,IAAI,eAAe,QAAQ,MAAM;AAQpD,QAAM,oBAAoB,QAAQ,IAAI,iBAAiB;AACvD,MAAI,QAAQ,SAAS,SAAS,CAAC,mBAAmB;AAChD,UAAM,WAAW,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO,CAAC;AACpE,UAAM,UAAU,SAAS,WAAW;AAEpC,QAAI,SAAS;AAEX,UAAI;AACJ,UAAI,SAAS,QAAQ;AACnB,2BAAmB,SAAS;AAAA,MAC9B,WAAW,QAAQ,IAAI,aAAa;AAClC,cAAM,YAAY,QAAQ,IAAI,YAAY,KAAK;AAC/C,2BAAmB,UAAU,SAAS,GAAG,IAAI,UAAU,MAAM,GAAG,EAAE,IAAI,OAAK,EAAE,KAAK,CAAC,IAAI;AAAA,MACzF,OAAO;AACL,2BAAmB;AAAA,MACrB;AAEA,YAAM,cAAc,SAAS,eAAgB,QAAQ,IAAI,qBAAqB;AAC9E,YAAM,SAAS,SAAS,WAAW,QAAQ,IAAI,eAAe,SAAS,QAAQ,IAAI,cAAc,EAAE,IAAI;AAIvG,UAAI;AACJ,UAAI,eAAe,qBAAqB,KAAK;AAC3C,iBAAS,CAAC,kBAA0B,iBAAiB;AAAA,MACvD,OAAO;AACL,iBAAS;AAAA,MACX;AAEA,UAAI,IAAI,KAAK,KAAK;AAAA,QAChB;AAAA,QACA,cAAc,SAAS,WAAW,CAAC,OAAO,QAAQ,OAAO,UAAU,SAAS,QAAQ,SAAS;AAAA,QAC7F,cAAc,SAAS,gBAAgB,CAAC,gBAAgB,iBAAiB,kBAAkB;AAAA,QAC3F,eAAe,SAAS,iBAAiB,CAAC;AAAA,QAC1C;AAAA,QACA;AAAA,MACF,CAAC,CAAC;AAAA,IACJ;AAAA,EACF;AAEA,QAAM,YAAY,CAAC,GAAQ,SAAiB,OAAe,QAAQ;AACjE,WAAO,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,EAAE,SAAS,KAAK,EAAE,GAAG,IAAI;AAAA,EAClE;AAEA,QAAM,aAAa,CAAC,GAAQ,WAAiC;AAC3D,QAAI,OAAO,SAAS;AAClB,UAAI,OAAO,UAAU;AACnB,YAAI,OAAO,SAAS,SAAS;AAC3B,iBAAO,QAAQ,OAAO,SAAS,OAAO,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,GAAG,CAAW,CAAC;AAAA,QACtF;AACA,eAAO,EAAE,KAAK,OAAO,SAAS,MAAM,OAAO,SAAS,MAAM;AAAA,MAC5D;AACA,UAAI,OAAO,QAAQ;AACjB,cAAM,MAAM,OAAO;AACnB,YAAI,IAAI,SAAS,cAAc,IAAI,KAAK;AACtC,iBAAO,EAAE,SAAS,IAAI,GAAG;AAAA,QAC3B;AACA,YAAI,IAAI,SAAS,YAAY,IAAI,QAAQ;AAEvC,gBAAM,UAAkC;AAAA,YACtC,gBAAgB,IAAI,eAAe;AAAA,YACnC,iBAAiB;AAAA,YACjB,cAAc;AAAA,YACd,GAAI,IAAI,WAAW,CAAC;AAAA,UACtB;AACA,gBAAM,SAAS,IAAI,eAAe;AAAA,YAChC,MAAM,MAAM,YAAY;AACtB,kBAAI;AACF,sBAAM,UAAU,IAAI,YAAY;AAChC,iCAAiB,SAAS,IAAI,QAAQ;AACpC,wBAAM,QAAQ,IAAI,mBACb,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,KAAK,IAAI,OAC7D,SAAS,KAAK,UAAU,KAAK,CAAC;AAAA;AAAA;AAClC,6BAAW,QAAQ,QAAQ,OAAO,KAAK,CAAC;AAAA,gBAC1C;AAAA,cACF,SAAS,KAAK;AAAA,cAEd,UAAE;AACA,2BAAW,MAAM;AAAA,cACnB;AAAA,YACF;AAAA,UACF,CAAC;AACD,iBAAO,IAAI,SAAS,QAAQ,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAAA,QACtD;AACA,YAAI,IAAI,SAAS,YAAY,IAAI,QAAQ;AACvC,cAAI,IAAI,SAAS;AACf,mBAAO,QAAQ,IAAI,OAAO,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,GAAG,CAAW,CAAC;AAAA,UAC1E;AACA,iBAAO,IAAI,SAAS,IAAI,QAAQ,EAAE,QAAQ,IAAI,CAAC;AAAA,QACjD;AACA,eAAO,EAAE,KAAK,KAAK,GAAG;AAAA,MACxB;AAAA,IACF;AACA,WAAO,UAAU,GAAG,aAAa,GAAG;AAAA,EACtC;AAKA,MAAI,IAAI,QAAQ,OAAO,MAAM;AAC3B,WAAO,EAAE,KAAK,EAAE,MAAM,MAAM,WAAW,iBAAiB,MAAM,EAAE,CAAC;AAAA,EACnE,CAAC;AAED,MAAI,IAAI,GAAG,MAAM,cAAc,OAAO,MAAM;AAC1C,WAAO,EAAE,KAAK,EAAE,MAAM,MAAM,WAAW,iBAAiB,MAAM,EAAE,CAAC;AAAA,EACnE,CAAC;AAGD,MAAI,IAAI,4BAA4B,CAAC,MAAM;AACzC,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B,CAAC;AAGD,MAAI,IAAI,GAAG,MAAM,WAAW,OAAO,MAAM;AACvC,QAAI;AACF,YAAM,OAAO,EAAE,IAAI,KAAK,UAAU,GAAG,MAAM,SAAS,MAAM;AAC1D,YAAM,SAAS,EAAE,IAAI;AAGrB,UAAI,cAAkC;AACtC,UAAI;AACF,YAAI,OAAO,QAAQ,OAAO,oBAAoB,YAAY;AACxD,wBAAc,MAAM,QAAQ,OAAO,gBAA6B,MAAM;AAAA,QACxE,WAAW,OAAO,QAAQ,OAAO,eAAe,YAAY;AAC1D,wBAAc,QAAQ,OAAO,WAAwB,MAAM;AAAA,QAC7D;AAAA,MACF,QAAQ;AAEN,sBAAc;AAAA,MAChB;AAEA,UAAI,eAAe,OAAO,YAAY,kBAAkB,YAAY;AAClE,cAAM,WAAW,MAAM,YAAY,cAAc,EAAE,IAAI,GAAG;AAC1D,eAAO,IAAI,SAAS,SAAS,MAAM;AAAA,UACjC,QAAQ,SAAS;AAAA,UACjB,SAAS,SAAS;AAAA,QACpB,CAAC;AAAA,MACH;AAGA,YAAM,OAAO,WAAW,SAAS,WAAW,SACxC,CAAC,IACD,MAAM,EAAE,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACvC,YAAM,SAAS,MAAM,WAAW,WAAW,MAAM,QAAQ,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC;AACrF,aAAO,WAAW,GAAG,MAAM;AAAA,IAC7B,SAAS,KAAU;AACjB,aAAO,UAAU,GAAG,IAAI,WAAW,yBAAyB,IAAI,cAAc,GAAG;AAAA,IACnF;AAAA,EACF,CAAC;AAGD,MAAI,KAAK,GAAG,MAAM,YAAY,OAAO,MAAM;AACzC,QAAI;AACF,YAAM,OAAO,MAAM,EAAE,IAAI,KAAK;AAC9B,YAAM,SAAS,MAAM,WAAW,cAAc,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC;AAC1E,aAAO,EAAE,KAAK,MAAM;AAAA,IACtB,SAAS,KAAU;AACjB,aAAO,UAAU,GAAG,IAAI,WAAW,yBAAyB,IAAI,cAAc,GAAG;AAAA,IACnF;AAAA,EACF,CAAC;AAGD,MAAI,IAAI,GAAG,MAAM,cAAc,OAAO,MAAM;AAC1C,QAAI;AACF,YAAM,UAAU,EAAE,IAAI,KAAK,UAAU,GAAG,MAAM,WAAW,MAAM;AAC/D,YAAM,SAAS,EAAE,IAAI;AAErB,UAAI,OAAY;AAChB,UAAI,WAAW,UAAU,YAAY,WAAW;AAC9C,cAAM,WAAW,MAAM,EAAE,IAAI,SAAS;AACtC,eAAO,SAAS,IAAI,MAAM;AAAA,MAC5B;AAEA,YAAM,SAAS,MAAM,WAAW,cAAc,SAAS,QAAQ,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC;AAC3F,aAAO,WAAW,GAAG,MAAM;AAAA,IAC7B,SAAS,KAAU;AACjB,aAAO,UAAU,GAAG,IAAI,WAAW,yBAAyB,IAAI,cAAc,GAAG;AAAA,IACnF;AAAA,EACF,CAAC;AAKD,MAAI,IAAI,GAAG,MAAM,MAAM,OAAO,MAAM;AAClC,QAAI;AACF,YAAM,UAAU,EAAE,IAAI,KAAK,UAAU,OAAO,MAAM;AAClD,YAAM,SAAS,EAAE,IAAI;AAErB,UAAI,OAAY;AAChB,UAAI,WAAW,UAAU,WAAW,SAAS,WAAW,SAAS;AAC/D,eAAO,MAAM,EAAE,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAAA,MAC5C;AAEA,YAAM,cAAmC,CAAC;AAC1C,YAAM,MAAM,IAAI,IAAI,EAAE,IAAI,GAAG;AAC7B,UAAI,aAAa,QAAQ,CAAC,KAAK,QAAQ;AAAE,oBAAY,GAAG,IAAI;AAAA,MAAK,CAAC;AAElE,YAAM,SAAS,MAAM,WAAW,SAAS,QAAQ,SAAS,MAAM,aAAa,EAAE,SAAS,EAAE,IAAI,IAAI,GAAG,MAAM;AAC3G,aAAO,WAAW,GAAG,MAAM;AAAA,IAC7B,SAAS,KAAU;AACjB,aAAO,UAAU,GAAG,IAAI,WAAW,yBAAyB,IAAI,cAAc,GAAG;AAAA,IACnF;AAAA,EACF,CAAC;AAED,SAAO;AACT;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/hono",
-  "version": "4.0.2",
+  "version": "4.0.4",
   "license": "Apache-2.0",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -13,13 +13,13 @@
   },
   "peerDependencies": {
     "hono": "^4.12.8",
-    "@objectstack/runtime": "^4.0.2"
+    "@objectstack/runtime": "^4.0.4"
   },
   "devDependencies": {
-    "hono": "^4.12.10",
+    "hono": "^4.12.12",
     "typescript": "^6.0.2",
-    "vitest": "^4.1.2",
-    "@objectstack/runtime": "4.0.2"
+    "vitest": "^4.1.4",
+    "@objectstack/runtime": "4.0.4"
   },
   "scripts": {
     "build": "tsup --config ../../../tsup.config.ts",

package/src/index.ts

@@ -1,11 +1,31 @@
 // Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
 
 import { Hono } from 'hono';
+import { cors } from 'hono/cors';
 import { type ObjectKernel, HttpDispatcher, HttpDispatcherResult } from '@objectstack/runtime';
 
+export interface ObjectStackHonoCorsOptions {
+  /** Enable or disable CORS. Defaults to true. */
+  enabled?: boolean;
+  /** Allowed origins. Defaults to env `CORS_ORIGIN` or '*'. Comma-separated string or array. */
+  origin?: string | string[];
+  /** Allowed methods. */
+  methods?: string[];
+  /** Allow credentials (cookies, authorization headers). */
+  credentials?: boolean;
+  /** Preflight cache max-age in seconds. */
+  maxAge?: number;
+  /** Allowed headers. */
+  allowHeaders?: string[];
+  /** Exposed headers. */
+  exposeHeaders?: string[];
+}
+
 export interface ObjectStackHonoOptions {
   kernel: ObjectKernel;
   prefix?: string;
+  /** CORS configuration. Set to `false` to disable entirely. */
+  cors?: ObjectStackHonoCorsOptions | false;
 }
 
 /**
@@ -49,6 +69,52 @@ export function createHonoApp(options: ObjectStackHonoOptions): Hono {
   const prefix = options.prefix || '/api';
   const dispatcher = new HttpDispatcher(options.kernel);
 
+  // ─── CORS Middleware ──────────────────────────────────────────────────────
+  // Enabled by default. Controlled via options.cors or environment variables:
+  //   CORS_ENABLED     – "false" to disable (default: true)
+  //   CORS_ORIGIN      – comma-separated origins or "*" (default: "*")
+  //   CORS_CREDENTIALS – "false" to disallow credentials (default: true)
+  //   CORS_MAX_AGE     – preflight cache seconds (default: 86400)
+  const corsDisabledByEnv = process.env.CORS_ENABLED === 'false';
+  if (options.cors !== false && !corsDisabledByEnv) {
+    const corsOpts = typeof options.cors === 'object' ? options.cors : {};
+    const enabled = corsOpts.enabled ?? true;
+
+    if (enabled) {
+      // Resolve origins: options > env > default '*'
+      let configuredOrigin: string | string[];
+      if (corsOpts.origin) {
+        configuredOrigin = corsOpts.origin;
+      } else if (process.env.CORS_ORIGIN) {
+        const envOrigin = process.env.CORS_ORIGIN.trim();
+        configuredOrigin = envOrigin.includes(',') ? envOrigin.split(',').map(s => s.trim()) : envOrigin;
+      } else {
+        configuredOrigin = '*';
+      }
+
+      const credentials = corsOpts.credentials ?? (process.env.CORS_CREDENTIALS !== 'false');
+      const maxAge = corsOpts.maxAge ?? (process.env.CORS_MAX_AGE ? parseInt(process.env.CORS_MAX_AGE, 10) : 86400);
+
+      // When credentials is true, browsers reject wildcard '*' for Access-Control-Allow-Origin.
+      // Use a function to reflect the request's Origin header instead.
+      let origin: string | string[] | ((origin: string) => string | undefined | null);
+      if (credentials && configuredOrigin === '*') {
+        origin = (requestOrigin: string) => requestOrigin || '*';
+      } else {
+        origin = configuredOrigin;
+      }
+
+      app.use('*', cors({
+        origin: origin as any,
+        allowMethods: corsOpts.methods || ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'HEAD', 'OPTIONS'],
+        allowHeaders: corsOpts.allowHeaders || ['Content-Type', 'Authorization', 'X-Requested-With'],
+        exposeHeaders: corsOpts.exposeHeaders || [],
+        credentials,
+        maxAge,
+      }));
+    }
+  }
+
   const errorJson = (c: any, message: string, code: number = 500) => {
     return c.json({ success: false, error: { message, code } }, code);
   };