@osqd/bothandlerjs 0.3.0

package/dist/adapters/index.cjs

@@ -0,0 +1,723 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/adapters/index.ts
+var adapters_exports = {};
+__export(adapters_exports, {
+  botHandler: () => botHandler,
+  createFetchAdapter: () => createFetchAdapter,
+  fastifyBotHandler: () => fastifyBotHandler,
+  koaBotHandler: () => koaBotHandler,
+  withBotHandler: () => withBotHandler
+});
+module.exports = __toCommonJS(adapters_exports);
+
+// src/internal/http.ts
+var MAX_COOKIE_HEADER = 8192;
+var MAX_COOKIES = 64;
+function parseCookies(header) {
+  const cookies = /* @__PURE__ */ Object.create(null);
+  if (header === void 0 || header.length === 0) return cookies;
+  const source = header.length > MAX_COOKIE_HEADER ? header.slice(0, MAX_COOKIE_HEADER) : header;
+  let count = 0;
+  for (const pair of source.split(";")) {
+    if (count >= MAX_COOKIES) break;
+    const equals = pair.indexOf("=");
+    if (equals <= 0) continue;
+    const name = pair.slice(0, equals).trim();
+    if (name.length === 0) continue;
+    const rawValue = pair.slice(equals + 1).trim();
+    const value = rawValue.startsWith('"') && rawValue.endsWith('"') ? rawValue.slice(1, -1) : rawValue;
+    try {
+      cookies[name] = decodeURIComponent(value);
+    } catch {
+      cookies[name] = value;
+    }
+    count++;
+  }
+  return cookies;
+}
+function joinHeaderValue(value) {
+  if (value === void 0) return void 0;
+  return Array.isArray(value) ? value.join(", ") : value;
+}
+
+// src/internal/ip.ts
+function parseIp(value) {
+  const input = value.trim();
+  if (input.length === 0 || input.length > 45) return null;
+  const bare = input.startsWith("[") && input.endsWith("]") ? input.slice(1, -1) : input;
+  if (bare.includes(":")) return parseIpv6(bare);
+  return parseIpv4(bare);
+}
+function parseIpv4(value) {
+  const parts = value.split(".");
+  if (parts.length !== 4) return null;
+  const bytes = new Uint8Array(4);
+  for (let i = 0; i < 4; i++) {
+    const part = parts[i];
+    if (part.length === 0 || part.length > 3) return null;
+    if (!/^\d+$/.test(part)) return null;
+    if (part.length > 1 && part[0] === "0") return null;
+    const n = Number(part);
+    if (n > 255) return null;
+    bytes[i] = n;
+  }
+  return bytes;
+}
+function parseIpv6(value) {
+  const withoutZone = value.split("%")[0];
+  const doubleColon = withoutZone.indexOf("::");
+  if (doubleColon !== withoutZone.lastIndexOf("::")) return null;
+  const [headText, tailText] = doubleColon === -1 ? [withoutZone, ""] : [withoutZone.slice(0, doubleColon), withoutZone.slice(doubleColon + 2)];
+  const head = headText.length > 0 ? headText.split(":") : [];
+  const tail = tailText.length > 0 ? tailText.split(":") : [];
+  let embedded = null;
+  const groups = [...head, ...tail];
+  const last = groups[groups.length - 1];
+  if (last !== void 0 && last.includes(".")) {
+    embedded = parseIpv4(last);
+    if (!embedded) return null;
+    if (tail.length > 0) tail.pop();
+    else head.pop();
+  }
+  const groupCount = head.length + tail.length + (embedded ? 2 : 0);
+  if (doubleColon === -1 ? groupCount !== 8 : groupCount > 7) return null;
+  const bytes = new Uint8Array(16);
+  let offset = 0;
+  for (const group of head) {
+    if (!writeGroup(bytes, offset, group)) return null;
+    offset += 2;
+  }
+  offset = 16 - tail.length * 2 - (embedded ? 4 : 0);
+  for (const group of tail) {
+    if (!writeGroup(bytes, offset, group)) return null;
+    offset += 2;
+  }
+  if (embedded) bytes.set(embedded, 12);
+  if (isIpv4Mapped(bytes)) return bytes.slice(12, 16);
+  return bytes;
+}
+function writeGroup(bytes, offset, group) {
+  if (group.length === 0 || group.length > 4 || !/^[0-9a-fA-F]+$/.test(group)) return false;
+  const n = Number.parseInt(group, 16);
+  bytes[offset] = n >> 8;
+  bytes[offset + 1] = n & 255;
+  return true;
+}
+function isIpv4Mapped(bytes) {
+  for (let i = 0; i < 10; i++) if (bytes[i] !== 0) return false;
+  return bytes[10] === 255 && bytes[11] === 255;
+}
+function formatIp(bytes) {
+  if (bytes.length === 4) return `${bytes[0]}.${bytes[1]}.${bytes[2]}.${bytes[3]}`;
+  const groups = [];
+  for (let i = 0; i < 16; i += 2) groups.push((bytes[i] << 8 | bytes[i + 1]).toString(16));
+  let bestStart = -1;
+  let bestLen = 0;
+  for (let i = 0; i < 8; i++) {
+    if (groups[i] !== "0") continue;
+    let j = i;
+    while (j < 8 && groups[j] === "0") j++;
+    if (j - i > bestLen) {
+      bestLen = j - i;
+      bestStart = i;
+    }
+    i = j;
+  }
+  if (bestLen < 2) return groups.join(":");
+  return `${groups.slice(0, bestStart).join(":")}::${groups.slice(bestStart + bestLen).join(":")}`;
+}
+function normalizeIp(value) {
+  const bytes = parseIp(value);
+  return bytes ? formatIp(bytes) : null;
+}
+function parseCidr(value) {
+  const slash = value.lastIndexOf("/");
+  const addressText = slash === -1 ? value : value.slice(0, slash);
+  const bytes = parseIp(addressText);
+  if (!bytes) return null;
+  const maxPrefix = bytes.length * 8;
+  if (slash === -1) return { bytes, prefix: maxPrefix, source: value };
+  const prefixText = value.slice(slash + 1);
+  if (!/^\d{1,3}$/.test(prefixText)) return null;
+  const prefix = Number(prefixText);
+  if (prefix > maxPrefix) return null;
+  return { bytes, prefix, source: value };
+}
+function cidrContains(cidr, ip) {
+  if (cidr.bytes.length !== ip.length) return false;
+  const fullBytes = cidr.prefix >> 3;
+  for (let i = 0; i < fullBytes; i++) if (cidr.bytes[i] !== ip[i]) return false;
+  const remainder = cidr.prefix & 7;
+  if (remainder === 0) return true;
+  const mask = 255 << 8 - remainder;
+  return (cidr.bytes[fullBytes] & mask) === (ip[fullBytes] & mask);
+}
+var FamilyIndex = class {
+  /** Prefix < 8. Spans first bytes, so it is always scanned. Realistically empty. */
+  wide = [];
+  buckets = /* @__PURE__ */ new Map();
+  add(entry) {
+    const { cidr } = entry;
+    if (cidr.prefix < 8) {
+      this.wide.push(entry);
+      return;
+    }
+    const first = cidr.bytes[0];
+    let bucket = this.buckets.get(first);
+    if (bucket === void 0) {
+      bucket = { mid: [], deep: /* @__PURE__ */ new Map() };
+      this.buckets.set(first, bucket);
+    }
+    if (cidr.prefix < 16) {
+      bucket.mid.push(entry);
+      return;
+    }
+    const second = cidr.bytes[1];
+    let deep = bucket.deep.get(second);
+    if (deep === void 0) {
+      deep = [];
+      bucket.deep.set(second, deep);
+    }
+    deep.push(entry);
+  }
+  /** The earliest-added range containing `ip`, or `undefined`. */
+  find(ip) {
+    let best = scan(this.wide, ip, void 0);
+    const bucket = this.buckets.get(ip[0]);
+    if (bucket !== void 0) {
+      best = scan(bucket.mid, ip, best);
+      const deep = bucket.deep.get(ip[1]);
+      if (deep !== void 0) best = scan(deep, ip, best);
+    }
+    return best;
+  }
+};
+function scan(entries, ip, best) {
+  let winner = best;
+  for (let i = 0; i < entries.length; i++) {
+    const entry = entries[i];
+    if (winner !== void 0 && entry.order > winner.order) continue;
+    if (cidrContains(entry.cidr, ip)) winner = entry;
+  }
+  return winner;
+}
+var IpRangeSet = class {
+  v4 = new FamilyIndex();
+  v6 = new FamilyIndex();
+  count = 0;
+  /**
+   * Every range that parsed, in the order it was added.
+   *
+   * Kept as plain text beside the index rather than reconstructed from it. The index
+   * is shaped for lookups — bucketed by leading byte, prefix-split — and walking it
+   * back into a list would be both slower and, for anything that wants to *show* the
+   * set, wrong: what an operator recognises is the string they wrote, not a normalised
+   * form of it. These sets are configuration-sized, so the array costs nothing.
+   */
+  sources = [];
+  /** Ranges that failed to parse, surfaced so a typo in config is loud rather than silent. */
+  invalid = [];
+  constructor(ranges = []) {
+    for (const range of ranges) this.add(range);
+  }
+  add(range) {
+    const cidr = parseCidr(range);
+    if (!cidr) {
+      this.invalid.push(range);
+      return;
+    }
+    this.sources.push(cidr.source);
+    (cidr.bytes.length === 4 ? this.v4 : this.v6).add({ cidr, order: this.count++ });
+  }
+  get size() {
+    return this.count;
+  }
+  /** The ranges in this set, as written, oldest first. What a reader can act on. */
+  entries() {
+    return this.sources;
+  }
+  /**
+   * Returns the matching range's original text, or `undefined`. Useful for explaining
+   * a decision. When several ranges match, the one added first wins, so the
+   * explanation does not depend on the index's internal layout.
+   */
+  match(ip) {
+    const bytes = typeof ip === "string" ? parseIp(ip) : ip;
+    if (!bytes) return void 0;
+    return (bytes.length === 4 ? this.v4 : this.v6).find(bytes)?.cidr.source;
+  }
+  contains(ip) {
+    const bytes = typeof ip === "string" ? parseIp(ip) : ip;
+    if (!bytes) return false;
+    return (bytes.length === 4 ? this.v4 : this.v6).find(bytes) !== void 0;
+  }
+};
+var SPECIAL_USE_RANGES = [
+  "0.0.0.0/8",
+  "10.0.0.0/8",
+  "100.64.0.0/10",
+  "127.0.0.0/8",
+  "169.254.0.0/16",
+  "172.16.0.0/12",
+  "192.0.0.0/24",
+  "192.0.2.0/24",
+  "192.168.0.0/16",
+  "198.18.0.0/15",
+  "198.51.100.0/24",
+  "203.0.113.0/24",
+  "224.0.0.0/4",
+  "240.0.0.0/4",
+  "::1/128",
+  "fc00::/7",
+  "fe80::/10",
+  "2001:db8::/32"
+];
+var SPECIAL_USE = new IpRangeSet(SPECIAL_USE_RANGES);
+
+// src/facts.ts
+var MAX_URL_LENGTH = 8192;
+var MAX_QUERY_PARAMS = 64;
+function createFacts(input) {
+  const rawUrl = input.url ?? "/";
+  const url = rawUrl.length > MAX_URL_LENGTH ? rawUrl.slice(0, MAX_URL_LENGTH) : rawUrl;
+  const queryStart = url.indexOf("?");
+  const rawPath = queryStart === -1 ? url : url.slice(0, queryStart);
+  const headers = /* @__PURE__ */ Object.create(null);
+  for (const [name, value] of Object.entries(input.headers)) {
+    const joined = joinHeaderValue(value);
+    if (joined !== void 0) headers[name.toLowerCase()] = joined;
+  }
+  const facts = {
+    method: (input.method ?? "GET").toUpperCase(),
+    path: normalizePath(rawPath),
+    query: parseQuery(queryStart === -1 ? "" : url.slice(queryStart + 1)),
+    headers,
+    headerOrder: extractOrder(input.rawHeaders, headers),
+    ip: normalizeIp(input.ip) ?? input.ip,
+    timestamp: input.timestamp ?? Date.now()
+  };
+  const cookieHeader = headers["cookie"];
+  if (cookieHeader !== void 0) facts.cookies = parseCookies(cookieHeader);
+  if (input.protocol !== void 0) facts.protocol = input.protocol;
+  if (input.httpVersion !== void 0) facts.httpVersion = input.httpVersion;
+  if (input.tlsFingerprint !== void 0) facts.tlsFingerprint = input.tlsFingerprint;
+  if (input.partialHeaders === true) facts.partialHeaders = true;
+  if (input.extra !== void 0) facts.extra = input.extra;
+  return facts;
+}
+function normalizePath(rawPath) {
+  let path = rawPath;
+  try {
+    path = decodeURIComponent(rawPath);
+  } catch {
+  }
+  path = path.replace(/\\/g, "/").replace(/\/{2,}/g, "/");
+  if (!path.startsWith("/")) path = `/${path}`;
+  if (path.includes("./")) {
+    const resolved = [];
+    for (const segment of path.split("/")) {
+      if (segment === "" || segment === ".") continue;
+      if (segment === "..") resolved.pop();
+      else resolved.push(segment);
+    }
+    path = `/${resolved.join("/")}`;
+  }
+  return path.length > 1 && path.endsWith("/") ? path.slice(0, -1) : path;
+}
+function parseQuery(search) {
+  const query = /* @__PURE__ */ Object.create(null);
+  if (search.length === 0) return query;
+  let count = 0;
+  for (const [key, value] of new URLSearchParams(search)) {
+    if (count++ >= MAX_QUERY_PARAMS) break;
+    query[key] = value.length > 1024 ? value.slice(0, 1024) : value;
+  }
+  return query;
+}
+var MAX_ORDERED_HEADERS = 64;
+function extractOrder(rawHeaders, headers) {
+  if (!rawHeaders || rawHeaders.length === 0) return EMPTY_ORDER;
+  let isNodeStyle = rawHeaders.length % 2 === 0;
+  if (isNodeStyle) {
+    let everyEntryIsAHeader = true;
+    for (let i = 0; i < rawHeaders.length; i++) {
+      const entry = rawHeaders[i];
+      const known = headers[entry.toLowerCase()] !== void 0;
+      if (i % 2 === 0 && !known && !isHeaderName(entry)) {
+        isNodeStyle = false;
+        break;
+      }
+      if (!known) everyEntryIsAHeader = false;
+    }
+    if (everyEntryIsAHeader) isNodeStyle = false;
+  }
+  const step = isNodeStyle ? 2 : 1;
+  const order = [];
+  for (let i = 0; i < rawHeaders.length && order.length < MAX_ORDERED_HEADERS; i += step) {
+    order.push(rawHeaders[i].toLowerCase());
+  }
+  return order;
+}
+var EMPTY_ORDER = Object.freeze([]);
+function isHeaderName(value) {
+  if (value.length === 0) return false;
+  for (let i = 0; i < value.length; i++) {
+    const code = value.charCodeAt(i);
+    const ok = code >= 48 && code <= 57 || // 0-9
+    code >= 65 && code <= 90 || // A-Z
+    code >= 97 && code <= 122 || // a-z
+    code === 33 || code >= 35 && code <= 39 || code === 42 || code === 43 || code === 45 || code === 46 || code === 94 || code === 95 || code === 96 || code === 124 || code === 126;
+    if (!ok) return false;
+  }
+  return true;
+}
+
+// src/adapters/shared.ts
+var MAX_VERIFY_BODY = 4096;
+function pause(ms) {
+  return new Promise((resolve) => {
+    const timer = setTimeout(resolve, ms);
+    timer.unref?.();
+  });
+}
+function parseJson(text) {
+  if (text.length === 0 || text.length > MAX_VERIFY_BODY) return void 0;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
+function readBoundedBody(request) {
+  return new Promise((resolve) => {
+    let data = "";
+    let bytes = 0;
+    request.on("data", (chunk) => {
+      bytes += chunk.length;
+      if (bytes > MAX_VERIFY_BODY) {
+        request.destroy();
+        return;
+      }
+      data += chunk.toString("utf8");
+    });
+    request.on("end", () => resolve(data));
+    request.on("error", () => resolve(""));
+  });
+}
+function verificationBody(outcome) {
+  return JSON.stringify(outcome.ok ? { ok: true } : { ok: false, error: outcome.reason });
+}
+
+// src/adapters/node.ts
+function botHandler(handler, options = {}) {
+  const mountChallenge = options.mountChallengeEndpoint ?? true;
+  return function botHandlerMiddleware(request, response, next) {
+    let handedOff = false;
+    void (async () => {
+      try {
+        const headers = {};
+        for (const [name, value] of Object.entries(request.headers)) {
+          headers[name] = Array.isArray(value) ? value.join(", ") : value;
+        }
+        const ip = handler.resolveIp(request.socket.remoteAddress, headers);
+        const fingerprint = options.tlsFingerprintHeader !== void 0 ? headers[options.tlsFingerprintHeader.toLowerCase()] : void 0;
+        let facts = createFacts({
+          method: request.method,
+          url: request.url,
+          headers: request.headers,
+          rawHeaders: request.rawHeaders,
+          ip,
+          httpVersion: request.httpVersion,
+          // `encrypted` is present only on a TLS socket. Behind a terminating proxy
+          // the forwarded protocol header is the only truth available.
+          protocol: request.socket.encrypted === true || headers["x-forwarded-proto"] === "https" ? "https" : "http",
+          ...fingerprint !== void 0 ? { tlsFingerprint: fingerprint } : {}
+        });
+        if (options.enrich) facts = options.enrich(request, facts);
+        if (mountChallenge && handler.isChallengeEndpoint(facts)) {
+          await serveVerification(handler, request, response, facts);
+          return;
+        }
+        const { outcome } = await handler.handle(facts);
+        if (outcome.kind === "drop") {
+          request.socket.destroy();
+          return;
+        }
+        if (outcome.kind === "respond") {
+          response.statusCode = outcome.status;
+          for (const [name, value] of Object.entries(outcome.headers)) response.setHeader(name, value);
+          response.end(outcome.body);
+          return;
+        }
+        for (const [name, value] of Object.entries(outcome.requestHeaders ?? {})) {
+          request.headers[name] = value;
+        }
+        if (outcome.responseHeaders) {
+          for (const [name, value] of Object.entries(outcome.responseHeaders)) response.setHeader(name, value);
+        }
+        if (outcome.delayMs !== void 0) await pause(outcome.delayMs);
+        handedOff = true;
+        next();
+      } catch (error) {
+        failOpen(handler, error, "adapter:node");
+        if (!handedOff && !response.headersSent) next();
+      }
+    })();
+  };
+}
+function failOpen(handler, error, source) {
+  handler.config.onError(error, { source });
+}
+async function serveVerification(handler, request, response, facts) {
+  const outcome = await handler.verifyChallenge(facts, parseJson(await readBoundedBody(request)));
+  response.setHeader("content-type", "application/json; charset=utf-8");
+  response.setHeader("cache-control", "no-store");
+  if (outcome.ok) response.setHeader("set-cookie", outcome.setCookie);
+  response.statusCode = outcome.ok ? 200 : outcome.status;
+  response.end(verificationBody(outcome));
+}
+
+// src/adapters/fetch.ts
+var DEFAULT_IP_HEADERS = ["cf-connecting-ip", "x-real-ip"];
+function createFetchAdapter(handler, options = {}) {
+  const ipHeaders = options.ipHeaders ?? DEFAULT_IP_HEADERS;
+  const mountChallenge = options.mountChallengeEndpoint ?? true;
+  let warnedAboutAddress = false;
+  return async function evaluate3(request, context = void 0) {
+    try {
+      return await decide(request, context);
+    } catch (error) {
+      handler.config.onError(error, { source: "adapter:fetch" });
+      return { request };
+    }
+  };
+  async function decide(request, context) {
+    const headers = {};
+    const order = [];
+    for (const [name, value] of request.headers) {
+      headers[name] = value;
+      order.push(name);
+    }
+    const url = new URL(request.url);
+    const ip = options.clientIp?.(request, context) ?? firstHeaderAddress(headers, ipHeaders) ?? "";
+    if (ip === "" && !warnedAboutAddress) {
+      warnedAboutAddress = true;
+      handler.warn(
+        `The fetch adapter could not determine a client address: none of ${ipHeaders.join(", ")} is present and no \`clientIp\` was supplied. Every request will be tracked under one empty actor key, so rate limits and behavioural detection apply to your whole site at once. Pass \`clientIp\` to read the address from your platform's connection info, or list the header your edge sets.`
+      );
+    }
+    const fingerprint = options.tlsFingerprintHeader !== void 0 ? headers[options.tlsFingerprintHeader.toLowerCase()] : void 0;
+    let facts = createFacts({
+      method: request.method,
+      url: `${url.pathname}${url.search}`,
+      headers,
+      // The Fetch API normalises and sorts headers, so wire order is genuinely
+      // unavailable here. Passing the sorted order would be worse than passing none:
+      // the header-order detector would compare against an ordering no client chose.
+      rawHeaders: [],
+      ip,
+      protocol: url.protocol === "https:" ? "https" : "http",
+      ...fingerprint !== void 0 ? { tlsFingerprint: fingerprint } : {}
+    });
+    if (options.enrich) facts = options.enrich(request, facts);
+    if (mountChallenge && handler.isChallengeEndpoint(facts)) {
+      const body = await readBounded(request);
+      const outcome2 = await handler.verifyChallenge(facts, parseJson(body));
+      const responseHeaders = new Headers({ "content-type": "application/json; charset=utf-8", "cache-control": "no-store" });
+      if (outcome2.ok) responseHeaders.set("set-cookie", outcome2.setCookie);
+      return {
+        response: new Response(JSON.stringify(outcome2.ok ? { ok: true } : { ok: false, error: outcome2.reason }), {
+          status: outcome2.ok ? 200 : outcome2.status,
+          headers: responseHeaders
+        }),
+        request
+      };
+    }
+    const result = await handler.handle(facts);
+    const { outcome } = result;
+    if (outcome.kind === "drop") {
+      return { response: new Response(null, { status: 444 }), request, result };
+    }
+    if (outcome.kind === "respond") {
+      return { response: new Response(outcome.body, { status: outcome.status, headers: outcome.headers }), request, result };
+    }
+    if (outcome.delayMs !== void 0) await pause(outcome.delayMs);
+    const tagged = outcome.requestHeaders ? new Request(request, { headers: mergeHeaders(request.headers, outcome.requestHeaders) }) : request;
+    return { request: tagged, result };
+  }
+}
+function withBotHandler(handler, next, options = {}) {
+  const evaluate3 = createFetchAdapter(handler, options);
+  return async (request, context = void 0) => {
+    const decision = await evaluate3(request, context);
+    if (decision.response) return decision.response;
+    const response = await next(decision.request, context);
+    const extra = decision.result?.outcome.kind === "continue" ? decision.result.outcome.responseHeaders : void 0;
+    if (!extra) return response;
+    const merged = new Response(response.body, response);
+    for (const [name, value] of Object.entries(extra)) merged.headers.set(name, value);
+    return merged;
+  };
+}
+function firstHeaderAddress(headers, names) {
+  for (const name of names) {
+    const value = headers[name];
+    if (value === void 0) continue;
+    const first = value.split(",")[0]?.trim();
+    if (first !== void 0 && first.length > 0) return first;
+  }
+  return void 0;
+}
+function mergeHeaders(original, additions) {
+  const merged = new Headers(original);
+  for (const [name, value] of Object.entries(additions)) merged.set(name, value);
+  return merged;
+}
+async function readBounded(request) {
+  const text = await request.clone().text();
+  return text.length > MAX_VERIFY_BODY ? "" : text;
+}
+
+// src/adapters/fastify.ts
+function fastifyBotHandler(handler, options = {}) {
+  const mountChallenge = options.mountChallengeEndpoint ?? true;
+  return async function onRequest(request, reply) {
+    try {
+      await evaluate(handler, options, mountChallenge, request, reply);
+    } catch (error) {
+      handler.config.onError(error, { source: "adapter:fastify" });
+    }
+  };
+}
+async function evaluate(handler, options, mountChallenge, request, reply) {
+  const headers = {};
+  for (const [name, value] of Object.entries(request.headers)) {
+    headers[name] = Array.isArray(value) ? value.join(", ") : value;
+  }
+  const ip = handler.resolveIp(request.raw.socket.remoteAddress, headers);
+  const fingerprint = options.tlsFingerprintHeader !== void 0 ? headers[options.tlsFingerprintHeader.toLowerCase()] : void 0;
+  let facts = createFacts({
+    method: request.method,
+    url: request.url,
+    headers: request.headers,
+    rawHeaders: request.raw.rawHeaders,
+    ip,
+    httpVersion: request.raw.httpVersion,
+    protocol: request.raw.socket.encrypted === true || headers["x-forwarded-proto"] === "https" ? "https" : "http",
+    ...fingerprint !== void 0 ? { tlsFingerprint: fingerprint } : {}
+  });
+  if (options.enrich) facts = options.enrich(request, facts);
+  if (mountChallenge && handler.isChallengeEndpoint(facts)) {
+    const verification = await handler.verifyChallenge(facts, parseJson(await readBoundedBody(request.raw)));
+    reply.code(verification.ok ? 200 : verification.status);
+    reply.header("content-type", "application/json; charset=utf-8");
+    reply.header("cache-control", "no-store");
+    if (verification.ok) reply.header("set-cookie", verification.setCookie);
+    reply.send(verificationBody(verification));
+    return;
+  }
+  const { outcome } = await handler.handle(facts);
+  if (outcome.kind === "drop") {
+    reply.hijack?.();
+    request.raw.socket.destroy();
+    return;
+  }
+  if (outcome.kind === "respond") {
+    reply.code(outcome.status);
+    for (const [name, value] of Object.entries(outcome.headers)) reply.header(name, value);
+    reply.send(outcome.body);
+    return;
+  }
+  for (const [name, value] of Object.entries(outcome.requestHeaders ?? {})) {
+    request.headers[name] = value;
+  }
+  if (outcome.responseHeaders) {
+    for (const [name, value] of Object.entries(outcome.responseHeaders)) reply.header(name, value);
+  }
+  if (outcome.delayMs !== void 0) await pause(outcome.delayMs);
+}
+
+// src/adapters/koa.ts
+function koaBotHandler(handler, options = {}) {
+  const mountChallenge = options.mountChallengeEndpoint ?? true;
+  return async function botHandlerMiddleware(context, next) {
+    let proceed;
+    try {
+      proceed = await evaluate2(handler, mountChallenge, context);
+    } catch (error) {
+      handler.config.onError(error, { source: "adapter:koa" });
+      proceed = true;
+    }
+    if (proceed) await next();
+  };
+}
+async function evaluate2(handler, mountChallenge, context) {
+  const headers = {};
+  for (const [name, value] of Object.entries(context.headers)) {
+    headers[name] = Array.isArray(value) ? value.join(", ") : value;
+  }
+  const facts = createFacts({
+    method: context.method,
+    url: context.url,
+    headers: context.headers,
+    rawHeaders: context.req.rawHeaders,
+    ip: handler.resolveIp(context.req.socket.remoteAddress, headers),
+    httpVersion: context.req.httpVersion,
+    protocol: context.secure === true || context.req.socket.encrypted === true || headers["x-forwarded-proto"] === "https" ? "https" : "http"
+  });
+  if (mountChallenge && handler.isChallengeEndpoint(facts)) {
+    const verification = await handler.verifyChallenge(facts, parseJson(await readBoundedBody(context.req)));
+    context.status = verification.ok ? 200 : verification.status;
+    context.set("content-type", "application/json; charset=utf-8");
+    context.set("cache-control", "no-store");
+    if (verification.ok) context.set("set-cookie", verification.setCookie);
+    context.body = verificationBody(verification);
+    return false;
+  }
+  const { outcome } = await handler.handle(facts);
+  if (outcome.kind === "drop") {
+    context.req.socket.destroy();
+    return false;
+  }
+  if (outcome.kind === "respond") {
+    context.status = outcome.status;
+    for (const [name, value] of Object.entries(outcome.headers)) context.set(name, value);
+    context.body = outcome.body;
+    return false;
+  }
+  for (const [name, value] of Object.entries(outcome.requestHeaders ?? {})) {
+    context.req.headers[name] = value;
+  }
+  if (outcome.responseHeaders) {
+    for (const [name, value] of Object.entries(outcome.responseHeaders)) context.set(name, value);
+  }
+  if (outcome.delayMs !== void 0) await pause(outcome.delayMs);
+  return true;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  botHandler,
+  createFetchAdapter,
+  fastifyBotHandler,
+  koaBotHandler,
+  withBotHandler
+});
+//# sourceMappingURL=index.cjs.map