@pallamart/pm-hono-setup 0.0.0-stage → 1.0.0

package/LICENSE

@@ -0,0 +1,32 @@
+Pallamart Proprietary License
+
+Version 1.0, 23-Jan-2024
+
+1. Grant of License:
+   Pallamart grants you a non-exclusive, non-transferable, revocable license to use the software, solely for internal business purposes.
+
+2. Restrictions:
+   You may not:
+   a. Distribute or sublicense the software to third parties.
+   b. Reverse engineer, decompile, or disassemble the software.
+   c. Remove or alter any proprietary notices or labels on the software.
+
+3. Ownership:
+   Pallamart retains all right, title, and interest in and to the software, including all intellectual property rights.
+
+4. Confidentiality:
+   You agree to keep the software confidential and not disclose it to third parties.
+
+5. Support and Updates:
+   This license does not entitle you to support or updates. Pallamart may, at its discretion, provide support and updates.
+
+6. Termination:
+   This license is effective until terminated. Pallamart may terminate the license at any time if you breach any terms. Upon termination, you must cease using the software.
+
+7. Governing Law:
+   This license is governed by the Canadian Laws. Any disputes arising out of this license shall be resolved in the courts of Canada.
+
+8. Contact Information:
+   For inquiries regarding this license, contact operations@pallamart.com.
+
+[End of License]

package/README.md

@@ -1,3 +1,22 @@
-# Temporary Holding Version
+# @pallamart/pm-hono-setup
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Pallamart Hono app and router setup with OpenAPI, CSRF, rate limiting and JSON errors.
+
+## Development
+
+Use Node.js from `.nvmrc`, then install dependencies:
+
+```sh
+npm install
+```
+
+Available checks:
+
+```sh
+npm run build
+npm run format:check
+npm run lint
+npm test
+```
+
+The package is published from `dist/`. Source code lives in `src/`; do not edit generated output directly.

package/dist/bindings/index.d.ts

@@ -0,0 +1 @@
+export * from './service-bindings.js';

package/dist/bindings/index.js

@@ -0,0 +1 @@
+export * from './service-bindings.js';

package/dist/bindings/service-bindings.d.ts

@@ -0,0 +1,6 @@
+import type { OpenAPIHono } from '@hono/zod-openapi';
+export interface ServiceBindings {
+    Bindings: NodeJS.ProcessEnv;
+    Variables: Record<string, string | number | boolean>;
+}
+export type AppOpenAPI = OpenAPIHono<ServiceBindings>;

package/dist/bindings/service-bindings.js

@@ -0,0 +1 @@
+export {};

package/dist/constants/api-key-auth-config.d.ts

@@ -0,0 +1,8 @@
+import { HttpStatus } from '@pallamart/pm-utilities';
+export declare const ApiKeyAuthConfig: {
+    readonly header: "X-API-Key";
+    readonly missingKeysMessage: "No API keys are configured for this service";
+    readonly openPaths: readonly ["/health"];
+    readonly unauthorizedMessage: "Unauthorized";
+    readonly unauthorizedStatus: HttpStatus.Unauthorized;
+};

package/dist/constants/api-key-auth-config.js

@@ -0,0 +1,8 @@
+import { HttpHeader, HttpStatus } from '@pallamart/pm-utilities';
+export const ApiKeyAuthConfig = {
+    header: HttpHeader.XApiKey,
+    missingKeysMessage: 'No API keys are configured for this service',
+    openPaths: ['/health'],
+    unauthorizedMessage: 'Unauthorized',
+    unauthorizedStatus: HttpStatus.Unauthorized,
+};

package/dist/constants/app-config.d.ts

@@ -0,0 +1,15 @@
+import { HttpMethod, HttpStatus } from '@pallamart/pm-utilities';
+export declare const AppConfig: {
+    readonly rateLimitWindowMs: number;
+    readonly rateLimitHeaders: "draft-6";
+    readonly missingRateLimitMessage: "No Rate Limiter value found";
+    readonly missingOriginMessage: "No CORS allowed origin found";
+    readonly originSeparator: ",";
+    readonly forwardedForHeader: "x-forwarded-for";
+    readonly cloudflareIpHeader: "cf-connecting-ip";
+    readonly upgradeInsecureHeader: "Upgrade-Insecure-Requests";
+    readonly corsMethods: readonly [HttpMethod.Get, HttpMethod.Post, HttpMethod.Put, HttpMethod.Delete, HttpMethod.Options];
+    readonly corsHeaders: readonly ["Content-Type"];
+    readonly exposedHeaders: readonly ["Content-Length"];
+    readonly notFoundStatus: HttpStatus.NotFound;
+};

package/dist/constants/app-config.js

@@ -0,0 +1,21 @@
+import { HttpHeader, HttpMethod, HttpStatus } from '@pallamart/pm-utilities';
+export const AppConfig = {
+    rateLimitWindowMs: 60 * 1000,
+    rateLimitHeaders: 'draft-6',
+    missingRateLimitMessage: 'No Rate Limiter value found',
+    missingOriginMessage: 'No CORS allowed origin found',
+    originSeparator: ',',
+    forwardedForHeader: 'x-forwarded-for',
+    cloudflareIpHeader: 'cf-connecting-ip',
+    upgradeInsecureHeader: 'Upgrade-Insecure-Requests',
+    corsMethods: [
+        HttpMethod.Get,
+        HttpMethod.Post,
+        HttpMethod.Put,
+        HttpMethod.Delete,
+        HttpMethod.Options,
+    ],
+    corsHeaders: [HttpHeader.ContentType],
+    exposedHeaders: ['Content-Length'],
+    notFoundStatus: HttpStatus.NotFound,
+};

package/dist/constants/openapi-config.d.ts

@@ -0,0 +1,11 @@
+export declare const OpenApiConfig: {
+    readonly specPath: "/openapi.json";
+    readonly docsPath: "/";
+    readonly openapi: "3.0.0";
+    readonly theme: "bluePlanet";
+    readonly layout: "classic";
+    readonly httpClient: {
+        readonly targetKey: "js";
+        readonly clientKey: "fetch";
+    };
+};

package/dist/constants/openapi-config.js

@@ -0,0 +1,8 @@
+export const OpenApiConfig = {
+    specPath: '/openapi.json',
+    docsPath: '/',
+    openapi: '3.0.0',
+    theme: 'bluePlanet',
+    layout: 'classic',
+    httpClient: { targetKey: 'js', clientKey: 'fetch' },
+};

package/dist/constants/user-token-auth-config.d.ts

@@ -0,0 +1,15 @@
+import { HttpStatus } from '@pallamart/pm-utilities';
+export declare const UserTokenAuthConfig: {
+    readonly header: "Authorization";
+    readonly scheme: "Bearer ";
+    readonly contextKey: "user";
+    readonly openPaths: readonly ["/health"];
+    readonly domainSeparator: "@";
+    readonly replayCacheLimit: 10000;
+    readonly missingSettingsMessage: "User token auth needs public keys, an issuer and an audience";
+    readonly missingAllowListMessage: "User token auth needs allowed emails or email domains";
+    readonly unauthorizedMessage: "Unauthorized";
+    readonly unauthorizedStatus: HttpStatus.Unauthorized;
+    readonly forbiddenMessage: "Forbidden";
+    readonly forbiddenStatus: HttpStatus.Forbidden;
+};

package/dist/constants/user-token-auth-config.js

@@ -0,0 +1,15 @@
+import { HttpAuthScheme, HttpHeader, HttpStatus } from '@pallamart/pm-utilities';
+export const UserTokenAuthConfig = {
+    header: HttpHeader.Authorization,
+    scheme: HttpAuthScheme.bearerPrefix,
+    contextKey: 'user',
+    openPaths: ['/health'],
+    domainSeparator: '@',
+    replayCacheLimit: 10000,
+    missingSettingsMessage: 'User token auth needs public keys, an issuer and an audience',
+    missingAllowListMessage: 'User token auth needs allowed emails or email domains',
+    unauthorizedMessage: 'Unauthorized',
+    unauthorizedStatus: HttpStatus.Unauthorized,
+    forbiddenMessage: 'Forbidden',
+    forbiddenStatus: HttpStatus.Forbidden,
+};

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+export * as Bindings from './bindings/index.js';
+export * as Server from './setup/index.js';
+export * from './constants/api-key-auth-config.js';
+export * from './constants/user-token-auth-config.js';
+export * from './middleware/api-key-auth.js';
+export * from './middleware/user-token-auth.js';
+export * from './models/api-key-auth-options.js';
+export * from './models/json-error-body-data.js';
+export * from './models/json-error-data.js';
+export * from './models/user-token-auth-options.js';
+export * from './services/json-error-service.js';

package/dist/index.js

@@ -0,0 +1,11 @@
+export * as Bindings from './bindings/index.js';
+export * as Server from './setup/index.js';
+export * from './constants/api-key-auth-config.js';
+export * from './constants/user-token-auth-config.js';
+export * from './middleware/api-key-auth.js';
+export * from './middleware/user-token-auth.js';
+export * from './models/api-key-auth-options.js';
+export * from './models/json-error-body-data.js';
+export * from './models/json-error-data.js';
+export * from './models/user-token-auth-options.js';
+export * from './services/json-error-service.js';

package/dist/middleware/api-key-auth.d.ts

@@ -0,0 +1,3 @@
+import type { Context, Next } from 'hono';
+import type { ApiKeyAuthOptions } from '../models/api-key-auth-options.js';
+export declare const apiKeyAuth: ({ keys, openPaths }: ApiKeyAuthOptions) => (c: Context, next: Next) => Promise<void | Response>;

package/dist/middleware/api-key-auth.js

@@ -0,0 +1,17 @@
+import { TimingSafeService } from '@pallamart/pm-utilities/server';
+import { ApiKeyAuthConfig } from '../constants/api-key-auth-config.js';
+import { JsonErrorService } from '../services/json-error-service.js';
+export const apiKeyAuth = ({ keys, openPaths = [] }) => {
+    const allowed = keys.filter((key) => key !== undefined && key !== '');
+    if (allowed.length === 0)
+        throw new Error(ApiKeyAuthConfig.missingKeysMessage);
+    const open = [...ApiKeyAuthConfig.openPaths, ...openPaths];
+    return async (c, next) => {
+        if (open.some((path) => c.req.path === path || c.req.path.startsWith(`${path}/`)))
+            return await next();
+        const candidate = c.req.header(ApiKeyAuthConfig.header);
+        if (candidate === undefined || !allowed.some((key) => TimingSafeService.equals(candidate, key)))
+            return JsonErrorService.respond(c, ApiKeyAuthConfig.unauthorizedMessage, ApiKeyAuthConfig.unauthorizedStatus);
+        return await next();
+    };
+};

package/dist/middleware/user-token-auth.d.ts

@@ -0,0 +1,3 @@
+import type { Context, Next } from 'hono';
+import type { UserTokenAuthOptions } from '../models/user-token-auth-options.js';
+export declare const userTokenAuth: ({ publicKeys, issuer, audience, allowedEmails, allowedEmailDomains, openPaths, }: UserTokenAuthOptions) => (c: Context, next: Next) => Promise<void | Response>;

package/dist/middleware/user-token-auth.js

@@ -0,0 +1,30 @@
+import { UserTokenService } from '@pallamart/pm-utilities';
+import { UserTokenAuthConfig } from '../constants/user-token-auth-config.js';
+import { UserTokenAccessService } from '../services/user-token-access-service.js';
+import { UserTokenRefusalService } from '../services/user-token-refusal-service.js';
+import { UserTokenReplayService } from '../services/user-token-replay-service.js';
+export const userTokenAuth = ({ publicKeys, issuer, audience, allowedEmails, allowedEmailDomains, openPaths = [], }) => {
+    const keys = publicKeys.filter((key) => key !== undefined && key !== '');
+    if (keys.length === 0 || !issuer || !audience)
+        throw new Error(UserTokenAuthConfig.missingSettingsMessage);
+    const emails = UserTokenAccessService.list(allowedEmails);
+    const domains = UserTokenAccessService.list(allowedEmailDomains);
+    if (emails.length === 0 && domains.length === 0)
+        throw new Error(UserTokenAuthConfig.missingAllowListMessage);
+    const open = [...UserTokenAuthConfig.openPaths, ...openPaths];
+    return async (c, next) => {
+        if (open.some((path) => c.req.path === path || c.req.path.startsWith(`${path}/`)))
+            return await next();
+        const header = c.req.header(UserTokenAuthConfig.header);
+        if (header === undefined || !header.startsWith(UserTokenAuthConfig.scheme))
+            return UserTokenRefusalService.unauthorized(c);
+        const url = new URL(c.req.url);
+        const claims = await UserTokenService.verify(header.slice(UserTokenAuthConfig.scheme.length).trim(), { method: c.req.method, path: `${url.pathname}${url.search}` }, { issuer, audience, publicKeys: keys });
+        if (claims === null || !UserTokenReplayService.claim(claims.jti, claims.exp))
+            return UserTokenRefusalService.unauthorized(c);
+        if (!UserTokenAccessService.isAllowed(claims.email, emails, domains))
+            return UserTokenRefusalService.forbidden(c);
+        c.set(UserTokenAuthConfig.contextKey, claims);
+        return await next();
+    };
+};

package/dist/models/api-key-auth-options.d.ts

@@ -0,0 +1,4 @@
+export interface ApiKeyAuthOptions {
+    keys: (string | undefined)[];
+    openPaths?: string[];
+}

package/dist/models/api-key-auth-options.js

@@ -0,0 +1 @@
+export {};

package/dist/models/json-error-body-data.d.ts

@@ -0,0 +1,5 @@
+import type { JsonErrorData } from './json-error-data';
+export interface JsonErrorBodyData {
+    success: false;
+    error: JsonErrorData;
+}

package/dist/models/json-error-body-data.js

@@ -0,0 +1 @@
+export {};

package/dist/models/json-error-data.d.ts

@@ -0,0 +1,5 @@
+import type { ContentfulStatusCode } from 'hono/utils/http-status';
+export interface JsonErrorData {
+    message: string;
+    status: ContentfulStatusCode;
+}

package/dist/models/json-error-data.js

@@ -0,0 +1 @@
+export {};

package/dist/models/user-token-auth-options.d.ts

@@ -0,0 +1,8 @@
+export interface UserTokenAuthOptions {
+    publicKeys: (string | undefined)[];
+    issuer: string | undefined;
+    audience: string | undefined;
+    allowedEmails?: (string | undefined)[];
+    allowedEmailDomains?: (string | undefined)[];
+    openPaths?: string[];
+}

package/dist/models/user-token-auth-options.js

@@ -0,0 +1 @@
+export {};

package/dist/services/json-error-service.d.ts

@@ -0,0 +1,7 @@
+import type { Context } from 'hono';
+import type { ContentfulStatusCode } from 'hono/utils/http-status';
+import type { JsonErrorBodyData } from '../models/json-error-body-data.js';
+export declare class JsonErrorService {
+    static body(message: string, status: ContentfulStatusCode): JsonErrorBodyData;
+    static respond(c: Context, message: string, status: ContentfulStatusCode): Response;
+}

package/dist/services/json-error-service.js

@@ -0,0 +1,8 @@
+export class JsonErrorService {
+    static body(message, status) {
+        return { success: false, error: { message, status } };
+    }
+    static respond(c, message, status) {
+        return c.json(JsonErrorService.body(message, status), status);
+    }
+}

package/dist/services/user-token-access-service.d.ts

@@ -0,0 +1,4 @@
+export declare class UserTokenAccessService {
+    static list(values: (string | undefined)[] | undefined): string[];
+    static isAllowed(email: string, emails: string[], domains: string[]): boolean;
+}

package/dist/services/user-token-access-service.js

@@ -0,0 +1,19 @@
+import { UserTokenAuthConfig } from '../constants/user-token-auth-config.js';
+export class UserTokenAccessService {
+    static list(values) {
+        if (values === undefined)
+            return [];
+        return values
+            .filter((value) => typeof value === 'string')
+            .flatMap((value) => value.split(','))
+            .map((value) => value.trim().toLowerCase())
+            .filter((value) => value !== '');
+    }
+    static isAllowed(email, emails, domains) {
+        const address = email.trim().toLowerCase();
+        if (emails.includes(address))
+            return true;
+        const parts = address.split(UserTokenAuthConfig.domainSeparator);
+        return parts.length === 2 && parts[0] !== '' && domains.includes(parts[1]);
+    }
+}

package/dist/services/user-token-refusal-service.d.ts

@@ -0,0 +1,5 @@
+import type { Context } from 'hono';
+export declare class UserTokenRefusalService {
+    static unauthorized(c: Context): Response;
+    static forbidden(c: Context): Response;
+}

package/dist/services/user-token-refusal-service.js

@@ -0,0 +1,10 @@
+import { UserTokenAuthConfig } from '../constants/user-token-auth-config.js';
+import { JsonErrorService } from './json-error-service.js';
+export class UserTokenRefusalService {
+    static unauthorized(c) {
+        return JsonErrorService.respond(c, UserTokenAuthConfig.unauthorizedMessage, UserTokenAuthConfig.unauthorizedStatus);
+    }
+    static forbidden(c) {
+        return JsonErrorService.respond(c, UserTokenAuthConfig.forbiddenMessage, UserTokenAuthConfig.forbiddenStatus);
+    }
+}

package/dist/services/user-token-replay-service.d.ts

@@ -0,0 +1,5 @@
+export declare class UserTokenReplayService {
+    private static _seen;
+    static claim(tokenId: string, expiresAt: number): boolean;
+    private static _forgetExpired;
+}

package/dist/services/user-token-replay-service.js

@@ -0,0 +1,26 @@
+import { DateService, UserTokenConfig } from '@pallamart/pm-utilities';
+import { UserTokenAuthConfig } from '../constants/user-token-auth-config.js';
+export class UserTokenReplayService {
+    static claim(tokenId, expiresAt) {
+        const now = DateService.nowUnixSeconds();
+        this._forgetExpired(now);
+        if (this._seen.has(tokenId))
+            return false;
+        if (this._seen.size >= UserTokenAuthConfig.replayCacheLimit) {
+            const oldest = this._seen.keys().next().value;
+            if (oldest !== undefined)
+                this._seen.delete(oldest);
+        }
+        this._seen.set(tokenId, expiresAt + UserTokenConfig.clockSkewSeconds);
+        return true;
+    }
+    static _forgetExpired(now) {
+        const expired = [];
+        this._seen.forEach((expiresAt, tokenId) => {
+            if (expiresAt < now)
+                expired.push(tokenId);
+        });
+        expired.forEach((tokenId) => this._seen.delete(tokenId));
+    }
+}
+UserTokenReplayService._seen = new Map();

package/dist/setup/configure-openapi.d.ts

@@ -0,0 +1,4 @@
+import type { MiddlewareHandler } from 'hono';
+import type { OpenAPIV3 } from 'openapi-types';
+import type { AppOpenAPI } from '../bindings/service-bindings.js';
+export declare const configureOpenAPI: (app: AppOpenAPI, name: string, version: string, middleware?: MiddlewareHandler, security?: OpenAPIV3.SecurityRequirementObject[]) => void;

package/dist/setup/configure-openapi.js

@@ -0,0 +1,23 @@
+import { apiReference } from '@scalar/hono-api-reference';
+import { OpenApiConfig } from '../constants/openapi-config.js';
+export const configureOpenAPI = (app, name, version, middleware, security = []) => {
+    app.doc(OpenApiConfig.specPath, {
+        openapi: OpenApiConfig.openapi,
+        security,
+        info: {
+            version,
+            title: name,
+        },
+    });
+    const reference = apiReference({
+        theme: OpenApiConfig.theme,
+        layout: OpenApiConfig.layout,
+        defaultHttpClient: OpenApiConfig.httpClient,
+        hideDownloadButton: true,
+        url: OpenApiConfig.specPath,
+    });
+    if (middleware === undefined)
+        app.get(OpenApiConfig.docsPath, reference);
+    else
+        app.get(OpenApiConfig.docsPath, middleware, reference);
+};

package/dist/setup/create-app.d.ts

@@ -0,0 +1,2 @@
+import type { Context } from 'hono';
+export declare const createApp: (getIP: (c: Context) => string, getCustomHeaders?: () => string[], useCSRF?: boolean, csrfExemptPrefixes?: string[]) => import("@hono/zod-openapi").OpenAPIHono<import("../bindings/service-bindings.js").ServiceBindings, {}, "/">;

package/dist/setup/create-app.js

@@ -0,0 +1,50 @@
+import { rateLimiter } from 'hono-rate-limiter';
+import { cors } from 'hono/cors';
+import { csrf } from 'hono/csrf';
+import { prettyJSON } from 'hono/pretty-json';
+import { secureHeaders } from 'hono/secure-headers';
+import { AppConfig } from '../constants/app-config.js';
+import { JsonErrorService } from '../services/json-error-service.js';
+import { createRouter } from './create-router.js';
+export const createApp = (getIP, getCustomHeaders = () => [], useCSRF = true, csrfExemptPrefixes = []) => {
+    const app = createRouter();
+    if (!process.env.HONO_RATE_LIMIT)
+        throw new Error(AppConfig.missingRateLimitMessage);
+    const limit = parseInt(process.env.HONO_RATE_LIMIT);
+    app.use(rateLimiter({
+        windowMs: AppConfig.rateLimitWindowMs,
+        limit,
+        standardHeaders: AppConfig.rateLimitHeaders,
+        keyGenerator: (c) => c.req.header(AppConfig.forwardedForHeader) ||
+            c.req.header(AppConfig.cloudflareIpHeader) ||
+            getIP(c),
+    }));
+    if (!process.env.ALLOWED_ORIGIN)
+        throw new Error(AppConfig.missingOriginMessage);
+    const allowedOrigins = process.env.ALLOWED_ORIGIN.split(AppConfig.originSeparator);
+    app.use('*', cors({
+        origin: allowedOrigins,
+        allowHeaders: [
+            AppConfig.upgradeInsecureHeader,
+            ...AppConfig.corsHeaders,
+            ...getCustomHeaders(),
+        ],
+        allowMethods: [...AppConfig.corsMethods],
+        exposeHeaders: [...AppConfig.exposedHeaders],
+    }));
+    if (useCSRF) {
+        const protect = csrf({ origin: allowedOrigins });
+        app.use(async (c, next) => {
+            if (csrfExemptPrefixes.some((prefix) => c.req.path.startsWith(prefix)))
+                return await next();
+            return await protect(c, next);
+        });
+    }
+    app.use('*', secureHeaders({
+        xFrameOptions: false,
+        xXssProtection: true,
+    }));
+    app.use('*', prettyJSON());
+    app.notFound((c) => JsonErrorService.respond(c, `404 Not Found - ${c.req.path}`, AppConfig.notFoundStatus));
+    return app;
+};

package/dist/setup/create-router.d.ts

@@ -0,0 +1,3 @@
+import { OpenAPIHono } from '@hono/zod-openapi';
+import type { ServiceBindings } from '../bindings/service-bindings.js';
+export declare const createRouter: () => OpenAPIHono<ServiceBindings, {}, "/">;

package/dist/setup/create-router.js

@@ -0,0 +1,4 @@
+import { OpenAPIHono } from '@hono/zod-openapi';
+export const createRouter = () => new OpenAPIHono({
+    strict: false,
+});

package/dist/setup/index.d.ts

@@ -0,0 +1,3 @@
+export * from './configure-openapi.js';
+export * from './create-app.js';
+export * from './create-router.js';

package/dist/setup/index.js

@@ -0,0 +1,3 @@
+export * from './configure-openapi.js';
+export * from './create-app.js';
+export * from './create-router.js';

package/package.json

@@ -1,6 +1,77 @@
 {
-  "name": "@pallamart/pm-hono-setup",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+	"name": "@pallamart/pm-hono-setup",
+	"version": "1.0.0",
+	"private": false,
+	"type": "module",
+	"sideEffects": false,
+	"main": "./dist/index.js",
+	"types": "./dist/index.d.ts",
+	"exports": {
+		".": {
+			"types": "./dist/index.d.ts",
+			"import": "./dist/index.js",
+			"default": "./dist/index.js"
+		}
+	},
+	"files": [
+		"/dist"
+	],
+	"scripts": {
+		"husky:prepare": "npx husky",
+		"build": "tsc",
+		"lint": "npm run lint:eslint",
+		"lint:fix": "npm run lint:eslint:fix",
+		"format:check": "npx prettier --check --ignore-unknown \"src/**/*.{ts,json,md}\"",
+		"format:prettier": "npx prettier --write \"src/**/*.{ts,json,md}\"",
+		"lint:eslint": "npx eslint \"src/**/*.ts\"",
+		"lint:eslint:fix": "npx eslint --fix \"src/**/*.ts\"",
+		"release": "semantic-release",
+		"test": "vitest run"
+	},
+	"devDependencies": {
+		"@commitlint/cli": "^20.1.0",
+		"@commitlint/config-conventional": "^20.0.0",
+		"@eslint/compat": "^2.0.0",
+		"@ianvs/prettier-plugin-sort-imports": "^4.7.0",
+		"@semantic-release/changelog": "^6.0.3",
+		"@semantic-release/commit-analyzer": "^13.0.0",
+		"@semantic-release/git": "^10.0.1",
+		"@semantic-release/github": "^11.0.1",
+		"@semantic-release/npm": "^12.0.0",
+		"@semantic-release/release-notes-generator": "^14.0.1",
+		"@types/node": "^22.0.0",
+		"@typescript-eslint/eslint-plugin": "^8.48.0",
+		"@typescript-eslint/parser": "^8.48.0",
+		"commitlint": "^20.1.0",
+		"conventional-changelog-conventionalcommits": "^7.0.2",
+		"eslint": "^9.39.1",
+		"eslint-config-prettier": "^10.1.8",
+		"eslint-plugin-import": "^2.32.0",
+		"eslint-plugin-prettier": "^5.5.4",
+		"husky": "^9.1.7",
+		"lint-staged": "^16.2.7",
+		"prettier": "^3.6.2",
+		"semantic-release": "^24.2.0",
+		"ts-node": "^10.9.2",
+		"typescript": "^5.9.3",
+		"vitest": "^3.2.7"
+	},
+	"publishConfig": {
+		"access": "public",
+		"registry": "https://registry.npmjs.org/"
+	},
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/pallamart/pm-hono-setup.git"
+	},
+	"description": "Pallamart Hono app and router setup with OpenAPI, CSRF, rate limiting and JSON errors",
+	"dependencies": {
+		"@hono/zod-openapi": "^1.1.5",
+		"@pallamart/pm-utilities": "^2.1.0",
+		"@scalar/hono-api-reference": "^0.9.48",
+		"hono": "^4.10.6",
+		"hono-rate-limiter": "^0.4.2",
+		"openapi-types": "^12.1.3",
+		"zod": "^4.1.13"
+	}
+}