@rdlabo/workers-hono-kit 0.2.0 → 0.2.1

package/dist/testing/index.js

@@ -1,10 +1,15 @@
-// @rdlabo/workers-hono-kit/testing — フリート共通のテスト基盤（mysql2/drizzle 依存）。
-// 実行時には読み込まれないテスト専用ヘルパ。各 repo の testing/db.ts・fakes.ts を集約。
+/**
+ * Shared test infrastructure for Hono on Cloudflare Workers projects (depends on `mysql2`/`drizzle-orm`).
+ *
+ * Test-only helpers that are never loaded at runtime. This subpath consolidates the duplicated
+ * test boilerplate (test DB setup, in-memory fakes, auth header builders, Stripe fixtures) that
+ * tends to be copy-pasted across projects into a single, importable surface.
+ */
 export { createTestDb } from './db.js';
 export { FakeFirebaseVerifier, createPoolDatabase, createNoopDatabase } from './fakes.js';
-// 認証テストヘルパ（route spec のヘッダ生成・ユーザ provision を集約）。
+// Authentication test helpers (route-spec header builders and user provisioning).
 export { authHeaders, registerFirebaseToken, provisionUser } from './auth.js';
-// test double ヘルパ（未設定メソッドで明示 throw する部分実装 fake）。
+// Test double helper (partial-implementation fake that throws explicitly on unconfigured members).
 export { configurableFake } from './configurable-fake.js';
-// Stripe オブジェクトの test fixture factory。
+// Test fixture factories for Stripe objects.
 export { fakeApiList, fakePaymentIntent, fakeStripeEvent, fakeCheckoutSession, fakeCustomer, fakePrice, fakeSubscription, } from './stripe-fixtures.js';

package/dist/testing/stripe-fixtures.d.ts

@@ -1,13 +1,103 @@
 import type Stripe from 'stripe';
 /**
- * Stripe オブジェクトの test fixture factory。実 SDK 型は巨大なので、テストが参照する範囲だけを
- * 妥当な既定値で組み、`over` で上書きする（最後に 1 度だけ Stripe 型へキャスト）。fleet 各 repo の
- * 課金テストで同じダミー PaymentIntent/Event/... を手組みしていた重複を集約する。
+ * Test fixture factories for Stripe objects.
+ *
+ * The real SDK types are enormous, so each factory builds only the fields tests typically read,
+ * fills them with reasonable defaults, lets you override via `over`, and casts to the Stripe type
+ * once at the end. This consolidates the duplicated hand-built dummy `PaymentIntent`/`Event`/... that
+ * billing tests tend to reconstruct in every project.
+ */
+/**
+ * Build a fake Stripe `ApiList` wrapping the given data.
+ *
+ * @remarks Defaults: `object: 'list'`, `has_more: false`, `url: '/v1/_test'`.
+ * @typeParam T - Element type of the list.
+ * @param data - Items to place in `data`.
+ * @param over - Field overrides merged last.
+ * @returns A `Stripe.ApiList<T>` fixture.
+ * @example
+ * ```ts
+ * const list = fakeApiList([fakePaymentIntent()]);
+ * ```
  */
 export declare function fakeApiList<T>(data: T[], over?: Partial<Stripe.ApiList<T>>): Stripe.ApiList<T>;
+/**
+ * Build a fake Stripe `PaymentIntent`.
+ *
+ * @remarks Defaults: `id: 'pi_test_1'`, `object: 'payment_intent'`, `amount: 1000`, `currency: 'jpy'`,
+ * `status: 'succeeded'`, `created: 1_700_000_000`.
+ * @param over - Field overrides merged last.
+ * @returns A `Stripe.PaymentIntent` fixture.
+ * @example
+ * ```ts
+ * const pi = fakePaymentIntent({ status: 'requires_payment_method' });
+ * ```
+ */
 export declare function fakePaymentIntent(over?: Partial<Stripe.PaymentIntent>): Stripe.PaymentIntent;
+/**
+ * Build a fake Stripe webhook `Event` wrapping the given payload.
+ *
+ * @remarks Defaults: `id: 'evt_test_1'`, `object: 'event'`, `api_version: '2024-06-20'`,
+ * `created: 1_700_000_000`, `livemode: false`. The payload is placed at `data.object`.
+ * @param type - Event type (e.g. `'payment_intent.succeeded'`), assigned to `type`.
+ * @param dataObject - The object placed at `data.object`.
+ * @param over - Field overrides merged last.
+ * @returns A `Stripe.Event` fixture.
+ * @example
+ * ```ts
+ * const event = fakeStripeEvent('payment_intent.succeeded', fakePaymentIntent());
+ * ```
+ */
 export declare function fakeStripeEvent(type: string, dataObject: unknown, over?: Partial<Stripe.Event>): Stripe.Event;
+/**
+ * Build a fake Stripe `Checkout.Session`.
+ *
+ * @remarks Defaults: `id: 'cs_test_1'`, `object: 'checkout.session'`,
+ * `url: 'https://checkout.stripe.test/cs_test_1'`, `mode: 'subscription'`, `status: 'open'`.
+ * @param over - Field overrides merged last.
+ * @returns A `Stripe.Checkout.Session` fixture.
+ * @example
+ * ```ts
+ * const session = fakeCheckoutSession({ status: 'complete' });
+ * ```
+ */
 export declare function fakeCheckoutSession(over?: Partial<Stripe.Checkout.Session>): Stripe.Checkout.Session;
+/**
+ * Build a fake Stripe `Customer`.
+ *
+ * @remarks Defaults: `id: 'cus_test_1'`, `object: 'customer'`, `created: 1_700_000_000`,
+ * `livemode: false`.
+ * @param over - Field overrides merged last.
+ * @returns A `Stripe.Customer` fixture.
+ * @example
+ * ```ts
+ * const customer = fakeCustomer({ email: 'a@example.com' });
+ * ```
+ */
 export declare function fakeCustomer(over?: Partial<Stripe.Customer>): Stripe.Customer;
+/**
+ * Build a fake Stripe `Price`.
+ *
+ * @remarks Defaults: `id: 'price_test_1'`, `object: 'price'`, `active: true`, `currency: 'jpy'`,
+ * `unit_amount: 1000`.
+ * @param over - Field overrides merged last.
+ * @returns A `Stripe.Price` fixture.
+ * @example
+ * ```ts
+ * const price = fakePrice({ unit_amount: 2000 });
+ * ```
+ */
 export declare function fakePrice(over?: Partial<Stripe.Price>): Stripe.Price;
+/**
+ * Build a fake Stripe `Subscription`.
+ *
+ * @remarks Defaults: `id: 'sub_test_1'`, `object: 'subscription'`, `status: 'active'`,
+ * `customer: 'cus_test_1'`, `created: 1_700_000_000`.
+ * @param over - Field overrides merged last.
+ * @returns A `Stripe.Subscription` fixture.
+ * @example
+ * ```ts
+ * const sub = fakeSubscription({ status: 'canceled' });
+ * ```
+ */
 export declare function fakeSubscription(over?: Partial<Stripe.Subscription>): Stripe.Subscription;

package/dist/testing/stripe-fixtures.js

@@ -1,7 +1,23 @@
 /**
- * Stripe オブジェクトの test fixture factory。実 SDK 型は巨大なので、テストが参照する範囲だけを
- * 妥当な既定値で組み、`over` で上書きする（最後に 1 度だけ Stripe 型へキャスト）。fleet 各 repo の
- * 課金テストで同じダミー PaymentIntent/Event/... を手組みしていた重複を集約する。
+ * Test fixture factories for Stripe objects.
+ *
+ * The real SDK types are enormous, so each factory builds only the fields tests typically read,
+ * fills them with reasonable defaults, lets you override via `over`, and casts to the Stripe type
+ * once at the end. This consolidates the duplicated hand-built dummy `PaymentIntent`/`Event`/... that
+ * billing tests tend to reconstruct in every project.
+ */
+/**
+ * Build a fake Stripe `ApiList` wrapping the given data.
+ *
+ * @remarks Defaults: `object: 'list'`, `has_more: false`, `url: '/v1/_test'`.
+ * @typeParam T - Element type of the list.
+ * @param data - Items to place in `data`.
+ * @param over - Field overrides merged last.
+ * @returns A `Stripe.ApiList<T>` fixture.
+ * @example
+ * ```ts
+ * const list = fakeApiList([fakePaymentIntent()]);
+ * ```
  */
 export function fakeApiList(data, over = {}) {
     return {
@@ -12,6 +28,18 @@ export function fakeApiList(data, over = {}) {
         ...over,
     };
 }
+/**
+ * Build a fake Stripe `PaymentIntent`.
+ *
+ * @remarks Defaults: `id: 'pi_test_1'`, `object: 'payment_intent'`, `amount: 1000`, `currency: 'jpy'`,
+ * `status: 'succeeded'`, `created: 1_700_000_000`.
+ * @param over - Field overrides merged last.
+ * @returns A `Stripe.PaymentIntent` fixture.
+ * @example
+ * ```ts
+ * const pi = fakePaymentIntent({ status: 'requires_payment_method' });
+ * ```
+ */
 export function fakePaymentIntent(over = {}) {
     return {
         id: 'pi_test_1',
@@ -23,6 +51,20 @@ export function fakePaymentIntent(over = {}) {
         ...over,
     };
 }
+/**
+ * Build a fake Stripe webhook `Event` wrapping the given payload.
+ *
+ * @remarks Defaults: `id: 'evt_test_1'`, `object: 'event'`, `api_version: '2024-06-20'`,
+ * `created: 1_700_000_000`, `livemode: false`. The payload is placed at `data.object`.
+ * @param type - Event type (e.g. `'payment_intent.succeeded'`), assigned to `type`.
+ * @param dataObject - The object placed at `data.object`.
+ * @param over - Field overrides merged last.
+ * @returns A `Stripe.Event` fixture.
+ * @example
+ * ```ts
+ * const event = fakeStripeEvent('payment_intent.succeeded', fakePaymentIntent());
+ * ```
+ */
 export function fakeStripeEvent(type, dataObject, over = {}) {
     return {
         id: 'evt_test_1',
@@ -35,6 +77,18 @@ export function fakeStripeEvent(type, dataObject, over = {}) {
         ...over,
     };
 }
+/**
+ * Build a fake Stripe `Checkout.Session`.
+ *
+ * @remarks Defaults: `id: 'cs_test_1'`, `object: 'checkout.session'`,
+ * `url: 'https://checkout.stripe.test/cs_test_1'`, `mode: 'subscription'`, `status: 'open'`.
+ * @param over - Field overrides merged last.
+ * @returns A `Stripe.Checkout.Session` fixture.
+ * @example
+ * ```ts
+ * const session = fakeCheckoutSession({ status: 'complete' });
+ * ```
+ */
 export function fakeCheckoutSession(over = {}) {
     return {
         id: 'cs_test_1',
@@ -45,6 +99,18 @@ export function fakeCheckoutSession(over = {}) {
         ...over,
     };
 }
+/**
+ * Build a fake Stripe `Customer`.
+ *
+ * @remarks Defaults: `id: 'cus_test_1'`, `object: 'customer'`, `created: 1_700_000_000`,
+ * `livemode: false`.
+ * @param over - Field overrides merged last.
+ * @returns A `Stripe.Customer` fixture.
+ * @example
+ * ```ts
+ * const customer = fakeCustomer({ email: 'a@example.com' });
+ * ```
+ */
 export function fakeCustomer(over = {}) {
     return {
         id: 'cus_test_1',
@@ -54,6 +120,18 @@ export function fakeCustomer(over = {}) {
         ...over,
     };
 }
+/**
+ * Build a fake Stripe `Price`.
+ *
+ * @remarks Defaults: `id: 'price_test_1'`, `object: 'price'`, `active: true`, `currency: 'jpy'`,
+ * `unit_amount: 1000`.
+ * @param over - Field overrides merged last.
+ * @returns A `Stripe.Price` fixture.
+ * @example
+ * ```ts
+ * const price = fakePrice({ unit_amount: 2000 });
+ * ```
+ */
 export function fakePrice(over = {}) {
     return {
         id: 'price_test_1',
@@ -64,6 +142,18 @@ export function fakePrice(over = {}) {
         ...over,
     };
 }
+/**
+ * Build a fake Stripe `Subscription`.
+ *
+ * @remarks Defaults: `id: 'sub_test_1'`, `object: 'subscription'`, `status: 'active'`,
+ * `customer: 'cus_test_1'`, `created: 1_700_000_000`.
+ * @param over - Field overrides merged last.
+ * @returns A `Stripe.Subscription` fixture.
+ * @example
+ * ```ts
+ * const sub = fakeSubscription({ status: 'canceled' });
+ * ```
+ */
 export function fakeSubscription(over = {}) {
     return {
         id: 'sub_test_1',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rdlabo/workers-hono-kit",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "private": false,
   "publishConfig": {
     "access": "public"

package/src/ai/gateway.ts

@@ -1,61 +1,100 @@
 /**
- * Cloudflare AI Gateway のプロバイダ生成（`ai` SDK + `ai-gateway-provider`）。
- * フリート共通 = foodlabel / winecode / receptray hono の AI 呼び出しを必ず Gateway 経由にする。
+ * Cloudflare AI Gateway provider factory built on the Vercel AI SDK and `ai-gateway-provider`.
  *
- * `createAiGateway` が返す wrapper で `@ai-sdk/*` のモデルを包むと、SDK が組み立てた
- * プロバイダ宛リクエスト（api.openai.com / api.anthropic.com / *-aiplatform.googleapis.com 等）を
- * AI Gateway の Universal Endpoint 経由に差し替える。OpenAI / Anthropic / Google Vertex(SA) の
- * いずれも同じ `aigateway(model)` で透過的にルーティングされる（Vertex も対応）。
+ * Routes OpenAI, Anthropic, and Google Vertex `@ai-sdk/*` models through the AI Gateway Universal
+ * Endpoint. The wrapper returned by `createAiGateway` intercepts the provider-bound requests the SDK
+ * assembles (`api.openai.com`, `api.anthropic.com`, `*-aiplatform.googleapis.com`, etc.) and redirects
+ * them through the Gateway. Every provider is routed transparently via the same `aigateway(model)` call.
  *
- * ここはインフラ層（Gateway 識別子と認証トークンの注入だけ）。プロバイダの API キーや
- * Vertex の SA 認証情報は各 repo 側でモデル生成時に渡す（pass-through）。
+ * @remarks
+ * This module is purely the infrastructure layer: it injects only the Gateway identifier and (optionally)
+ * the Gateway authentication token. Provider API keys and Vertex service-account credentials are supplied
+ * by the caller at model-construction time and passed through untouched.
  */
 import { createAiGateway } from 'ai-gateway-provider';
 import type { AiGateway, AiGatewayBindingSettings, AiGatewayOptions } from 'ai-gateway-provider';
 
 export type { AiGateway, AiGatewayOptions } from 'ai-gateway-provider';
 
-/** Workers の AI binding（`env.AI.gateway(name)`）の最小形。Cloudflare の `AiGateway` が構造的に適合する。 */
+/**
+ * Minimal shape of a Workers AI binding (`env.AI.gateway(name)`).
+ *
+ * @remarks
+ * Cloudflare's runtime `AiGateway` type is structurally compatible with this binding shape.
+ */
 export type AiGatewayBinding = AiGatewayBindingSettings['binding'];
 
 /**
- * AI Gateway 設定。2 系統:
- *  - binding 形: Workers ランタイム（本番 / `wrangler dev`）。`env.AI.gateway(name)` を渡す。
- *    binding 経由は同一アカウント内で事前認証されるため Gateway トークン不要。
- *  - REST 形: Workers 外（Node の eval ハーネス等、binding 不可）。accountId + gateway + token で REST。
+ * Configuration for the AI Gateway provider. This is a union with two mutually exclusive forms.
+ *
+ * @remarks
+ * - **Binding form** — for the Workers runtime (production and `wrangler dev`). Pass the
+ *   `env.AI.gateway(name)` binding. Requests through a binding are pre-authenticated within the same
+ *   Cloudflare account, so no Gateway token is required.
+ * - **REST form** — for non-Workers contexts where a binding is unavailable (e.g. a Node evaluation
+ *   harness). Supply `accountId`, `gateway`, and (for authenticated Gateways) `token` to reach the
+ *   Gateway over REST.
  */
 export type AiGatewayConfig =
   | {
-      /** `env.AI.gateway(name)` 等の AI Gateway binding。 */
+      /** The AI Gateway binding, typically obtained via `env.AI.gateway(name)`. */
       binding: AiGatewayBinding;
-      /** キャッシュ / リトライ / メタデータ等の Gateway オプション（任意）。 */
+      /** Optional Gateway options such as caching, retries, and request metadata. */
       options?: AiGatewayOptions;
     }
   | {
-      /** Cloudflare アカウント ID。 */
+      /** Cloudflare account ID that owns the Gateway. */
       accountId: string;
-      /** AI Gateway 名。 */
+      /** AI Gateway name. */
       gateway: string;
       /**
-       * `cf-aig-authorization` に載せる Gateway 認証トークン。Authenticated Gateway のときだけ必要。
-       * unauthenticated Gateway では省略可（プロバイダの API キーではなく Gateway 自体への認証）。
+       * Gateway authentication token sent in the `cf-aig-authorization` header. Required only for an
+       * Authenticated Gateway; omit it for an unauthenticated Gateway. This authenticates the request to
+       * the Gateway itself and is distinct from any provider API key.
        */
       token?: string;
-      /** キャッシュ / リトライ / メタデータ等の Gateway オプション（任意）。 */
+      /** Optional Gateway options such as caching, retries, and request metadata. */
       options?: AiGatewayOptions;
     };
 
+/** Provider object exposing the AI Gateway model wrapper. */
 export interface AiGatewayProvider {
   /**
-   * `@ai-sdk/*` のモデルを包んで AI Gateway 経由にする。
-   * 例: `aigateway(createAnthropic({ apiKey }).('claude-...'))`。
-   * 配列を渡すとフォールバック（先頭から順に試行）になる。
+   * Wraps an `@ai-sdk/*` model so its requests are routed through the AI Gateway.
+   *
+   * @remarks
+   * Example invocation: `aigateway(createAnthropic({ apiKey })('claude-...'))`. Passing an array of
+   * models enables fallback behavior — each model is attempted in order from the start of the array.
    */
   aigateway: AiGateway;
 }
 
 /**
- * AI Gateway 用のプロバイダを生成する。binding 形 / REST 形のどちらでも可（欠落時は fail-fast）。
+ * Create an AI Gateway provider from either the binding form or the REST form of the configuration.
+ *
+ * @param config - The Gateway configuration; either the binding form or the REST form.
+ * @returns A provider whose `aigateway` wrapper routes models through the AI Gateway.
+ * @throws Error When the REST form is used and `accountId` or `gateway` is missing (fail-fast).
+ * @example
+ * ```ts
+ * // Binding form (Workers runtime: production / wrangler dev)
+ * import { createAnthropic } from '@ai-sdk/anthropic';
+ *
+ * const { aigateway } = createAiGatewayProvider({ binding: env.AI.gateway('my-gateway') });
+ * const model = aigateway(createAnthropic({ apiKey: env.ANTHROPIC_API_KEY })('claude-3-5-sonnet-latest'));
+ * ```
+ * @example
+ * ```ts
+ * // REST form (non-Workers context, e.g. a Node evaluation harness)
+ * import { createOpenAI } from '@ai-sdk/openai';
+ *
+ * const { aigateway } = createAiGatewayProvider({
+ *   accountId: process.env.CF_ACCOUNT_ID!,
+ *   gateway: 'my-gateway',
+ *   token: process.env.CF_AIG_TOKEN, // only for an Authenticated Gateway
+ * });
+ * const model = aigateway(createOpenAI({ apiKey: process.env.OPENAI_API_KEY })('gpt-4o'));
+ * ```
  */
 export function createAiGatewayProvider(config: AiGatewayConfig): AiGatewayProvider {
   if ('binding' in config) {
@@ -63,13 +102,13 @@ export function createAiGatewayProvider(config: AiGatewayConfig): AiGatewayProvi
   }
 
   if (!config.accountId) {
-    throw new Error('AI Gateway: accountId が未設定です');
+    throw new Error('AI Gateway: accountId is not set');
   }
   if (!config.gateway) {
-    throw new Error('AI Gateway: gateway 名が未設定です');
+    throw new Error('AI Gateway: gateway name is not set');
   }
 
-  // token は Authenticated Gateway のときだけ apiKey として送る。unauthenticated では undefined で可。
+  // The token is sent as apiKey only for an Authenticated Gateway; undefined is fine when unauthenticated.
   return {
     aigateway: createAiGateway({
       accountId: config.accountId,

package/src/aws/cloudfront.ts

@@ -1,10 +1,28 @@
 /**
- * CloudFront 署名付き URL 生成（`@aws-sdk/cloudfront-signer` の getSignedUrl を Web Crypto で再実装）。
- * Cloudflare Workers ネイティブ（aws-sdk 不要）。フリート共通 = tipsys/winecode hono。
+ * Generate a CloudFront signed URL using a canned policy, implemented natively for Cloudflare Workers.
  *
- * canned policy を RSASSA-PKCS1-v1_5 + SHA-1 で署名し、AWS の URL-safe base64 変換
- *   '+' -> '-' , '/' -> '~' , '=' -> '_'
- * を施して `Expires` / `Key-Pair-Id` / `Signature` の順でクエリを付与する（aws-sdk の出力とバイト一致）。
+ * Reimplements `getSignedUrl` from `@aws-sdk/cloudfront-signer` on top of the Web Crypto API, so no
+ * `@aws-sdk` dependency is required. The canned policy is signed with RSASSA-PKCS1-v1_5 and SHA-1, the
+ * signature is converted to AWS URL-safe base64 (`+` -> `-`, `/` -> `~`, `=` -> `_`), and the query
+ * parameters are appended in the order `Expires`, `Key-Pair-Id`, `Signature`.
+ *
+ * @remarks
+ * The output is byte-for-byte identical to that of `@aws-sdk/cloudfront-signer`.
+ *
+ * @param url - The resource URL to sign.
+ * @param privateKeyPem - The CloudFront key group private key in PKCS#8 PEM format.
+ * @param keyPairId - The CloudFront public key (key pair) ID associated with the private key.
+ * @param dateLessThan - Expiry time, accepted as a `Date`, epoch-millisecond number, or date string.
+ * @returns The signed URL with the `Expires`, `Key-Pair-Id`, and `Signature` query parameters appended.
+ * @example
+ * ```ts
+ * const signedUrl = await getCloudFrontSignedUrl(
+ *   'https://cdn.example.com/private/video.mp4',
+ *   env.CLOUDFRONT_PRIVATE_KEY,
+ *   env.CLOUDFRONT_KEY_PAIR_ID,
+ *   Date.now() + 60 * 60 * 1000, // valid for one hour
+ * );
+ * ```
  */
 export async function getCloudFrontSignedUrl(
   url: string,
@@ -34,14 +52,29 @@ export async function getCloudFrontSignedUrl(
   const signature = toUrlSafeBase64(arrayBufferToBase64(signatureBuffer));
   const separator = url.includes('?') ? '&' : '?';
 
-  // @aws-sdk/cloudfront-signer のクエリ順: Expires -> Key-Pair-Id -> Signature
+  // Query order used by @aws-sdk/cloudfront-signer: Expires -> Key-Pair-Id -> Signature
   return `${url}${separator}Expires=${epochSeconds}&Key-Pair-Id=${keyPairId}&Signature=${signature}`;
 }
 
+/**
+ * Convert standard base64 to the URL-safe alphabet expected in CloudFront signatures.
+ *
+ * @param value - A standard base64 string.
+ * @returns The base64 string with `+` -> `-`, `=` -> `_`, and `/` -> `~`.
+ * @internal
+ */
+
 function toUrlSafeBase64(value: string): string {
   return value.replace(/\+/g, '-').replace(/=/g, '_').replace(/\//g, '~');
 }
 
+/**
+ * Encode an `ArrayBuffer` to standard base64.
+ *
+ * @param buffer - The raw bytes to encode.
+ * @returns The standard base64 representation of the buffer.
+ * @internal
+ */
 function arrayBufferToBase64(buffer: ArrayBuffer): string {
   const bytes = new Uint8Array(buffer);
   let binary = '';
@@ -51,6 +84,13 @@ function arrayBufferToBase64(buffer: ArrayBuffer): string {
   return btoa(binary);
 }
 
+/**
+ * Decode a PKCS#8 PEM private key into its DER `ArrayBuffer`.
+ *
+ * @param pem - The PEM-encoded key, including the BEGIN/END armor.
+ * @returns The decoded DER bytes, suitable for `crypto.subtle.importKey('pkcs8', ...)`.
+ * @internal
+ */
 function pemToDer(pem: string): ArrayBuffer {
   const base64 = pem
     .replace(/-----BEGIN [^-]+-----/, '')

package/src/aws/secrets-manager.ts

@@ -1,26 +1,66 @@
 import { AwsClient } from 'aws4fetch';
 
 /**
- * AWS Secrets Manager の GetSecretValue を aws4fetch（SigV4 署名 fetch）で叩く汎用ヘルパ。
- * Cloudflare Workers には AWS SDK も IAM ロールも無いため、AWS の静的キーを Workers secrets として
- * 渡して署名する（移植元 `api/src/secrets-manager.ts` 相当）。DB 認証情報は Hyperdrive 側に持つので対象外。
+ * AWS credentials used to sign Secrets Manager requests.
  *
- * Secret の中身（スキーマ）と secretId は repo ごとに異なるため、`<T>` と `secretId` を呼び出し側が渡す。
+ * @remarks
+ * Cloudflare Workers have neither the AWS SDK nor IAM role credentials, so static AWS keys are supplied
+ * as Workers secrets and used to produce a SigV4 signature.
  */
 export interface AwsSecretsOptions {
+  /** AWS access key ID. */
   accessKeyId: string;
+  /** AWS secret access key. */
   secretAccessKey: string;
+  /** Optional STS session token, required when using temporary credentials. */
   sessionToken?: string;
+  /** AWS region of the Secrets Manager endpoint, e.g. `ap-northeast-1`. */
   region: string;
 }
 
 /**
- * Per-isolate cache: Secrets Manager は isolate ごと 1 回だけ叩く。region+accessKeyId+secretId を
- * キーにし、資格情報ローテーション時は再取得する。promise をキャッシュして同時初回リクエストが 1 回の
- * 呼び出しを共有する。reject 時はキャッシュをクリアして retry を許す。
+ * Per-isolate cache for the fetched secret.
+ *
+ * @remarks
+ * Secrets Manager is queried at most once per isolate. The entry is keyed by
+ * `region:accessKeyId:secretId`, so rotating credentials triggers a fresh fetch. The in-flight promise
+ * itself is cached so that concurrent first-time callers share a single request. On rejection the cache
+ * is cleared so a failed fetch can be retried.
+ *
+ * @internal
  */
 let cache: { key: string; value: Promise<unknown> } | null = null;
 
+/**
+ * Fetch and parse a secret from AWS Secrets Manager, caching the result per isolate.
+ *
+ * Issues a `GetSecretValue` call to Secrets Manager via a SigV4-signed `fetch` (using aws4fetch), with no
+ * AWS SDK involved. The parsed `SecretString` is cached per isolate keyed by region, access key ID, and
+ * secret ID; concurrent first-time callers share one in-flight request, and a rejected fetch clears the
+ * cache entry so the next call retries.
+ *
+ * @typeParam T - The shape of the JSON-parsed secret payload, supplied by the caller.
+ * @param options - AWS credentials and region used to sign the request.
+ * @param secretId - The Secrets Manager secret ID or ARN to retrieve.
+ * @returns The parsed secret value cast to `T`.
+ * @throws Error When the Secrets Manager response is not OK, or when it contains no `SecretString`.
+ * @example
+ * ```ts
+ * interface DbSecret {
+ *   username: string;
+ *   password: string;
+ * }
+ *
+ * const secret = await getAuthenticationSecret<DbSecret>(
+ *   {
+ *     accessKeyId: env.AWS_ACCESS_KEY_ID,
+ *     secretAccessKey: env.AWS_SECRET_ACCESS_KEY,
+ *     region: 'ap-northeast-1',
+ *   },
+ *   'prod/db/credentials',
+ * );
+ * ```
+ */
 export function getAuthenticationSecret<T>(options: AwsSecretsOptions, secretId: string): Promise<T> {
   const key = `${options.region}:${options.accessKeyId}:${secretId}`;
   if (cache?.key !== key) {
@@ -33,6 +73,15 @@ export function getAuthenticationSecret<T>(options: AwsSecretsOptions, secretId:
   return cache.value as Promise<T>;
 }
 
+/**
+ * Perform the SigV4-signed `GetSecretValue` request and parse the returned `SecretString`.
+ *
+ * @param options - AWS credentials and region used to sign the request.
+ * @param secretId - The Secrets Manager secret ID or ARN to retrieve.
+ * @returns The JSON-parsed secret payload.
+ * @throws Error When the response is not OK, or when it contains no `SecretString`.
+ * @internal
+ */
 async function fetchSecret(options: AwsSecretsOptions, secretId: string): Promise<unknown> {
   const aws = new AwsClient({
     accessKeyId: options.accessKeyId,