@rdlabo/workers-hono-kit 0.3.7 → 0.4.0

package/dist/db/jst.js

@@ -1,72 +1,24 @@
 /**
- * Shared building blocks for normalizing JST (Asia/Tokyo) date/time values.
+ * MySQL / Drizzle 向け JST ワイヤ変換と DATE 列正規化。
  *
  * @remarks
- * JST normalization is applied at the column boundary as a write-time side effect, and neither
- * values nor types from `drizzle-orm` are imported here on purpose. Exporting a fully-built
- * `customType` column from the kit would cause type collisions when the kit and the consumer
- * resolve separate copies of `drizzle-orm` (the private `SQL` brand stops being nominally
- * compatible). Instead the kit ships only the params and helpers, and the consumer builds the
- * column with its own `customType`:
- *
- * ```ts
- * import { customType } from 'drizzle-orm/mysql-core';
- * import { jstTimestampParams, jstDateParams } from '@rdlabo/workers-hono-kit/db';
- *
- * export const jstTimestamp = (name: string, opts?: { fsp?: number }) =>
- *   customType<{ data: string | Date; driverData: string | Date }>(jstTimestampParams(opts?.fsp))(name);
- * export const jstDate = (name: string) =>
- *   customType<{ data: string | null; driverData: string | null }>(jstDateParams())(name);
- * ```
- *
- * `timestamp`/`datetime` columns omit `toDriver` and pass `Date` values straight through, so the
- * connection's `timezone: '+09:00'` default makes mysql2 format them as JST; pre-formatted strings
- * also pass through. Drizzle's native `mode: 'date'` is avoided because it stringifies `Date` to
- * UTC before the timezone layer, shifting values by -9h. `date` columns keep `toJstDate` because
- * MySQL `DATE` rejects ISO/empty strings and a JST day-boundary normalization is required.
+ * 業務時刻の意味論は {@link ../business-time/index.js | business-time} に集約する。
+ * このモジュールは「MySQL 接続既定」「DATE 列の toDriver」、列 `customType` params のみを担う。
  */
-const JST_OFFSET_MS = 9 * 60 * 60 * 1000;
+import { normalizeBusinessDate } from '../business-time/index.js';
+/** mysql2 接続 `timezone` 既定（既存 JST DB 運用）。 */
+export const MYSQL_TIMEZONE = '+09:00';
 /**
- * Normalize a client-supplied date to the `YYYY-MM-DD` (JST) form accepted by a MySQL `DATE` column.
- *
- * Accepts ISO 8601 (`...Z`), `YYYY-MM-DD`, or an empty string. Nullish, empty, or unparseable input
- * resolves to `null`.
- *
- * @remarks
- * MySQL `DATE` rejects ISO strings with `ER_TRUNCATED_WRONG_VALUE`, so this cannot be handled by the
- * driver alone; it is needed as the `toDriver` transform for a `date` column.
- *
- * @param value - the raw date string from the client (ISO 8601, `YYYY-MM-DD`, or empty), or nullish.
- * @returns the JST calendar date as `YYYY-MM-DD`, or `null` when the input is empty or unparseable.
+ * クライアント入力を MySQL `DATE` 列向け `YYYY-MM-DD`（JST 業務暦日）へ正規化。
+ * ISO 8601 / `YYYY-MM-DD` / 空文字を受け付ける。`YYYY-MM-DD` は Date 化せずそのまま渡す。
  */
 export function toJstDate(value) {
-    if (!value) {
-        return null;
-    }
-    const ms = new Date(value).getTime();
-    if (Number.isNaN(ms)) {
-        return null;
-    }
-    const jst = new Date(ms + JST_OFFSET_MS);
-    const p = (n) => String(n).padStart(2, '0');
-    return `${jst.getUTCFullYear()}-${p(jst.getUTCMonth() + 1)}-${p(jst.getUTCDate())}`;
+    return normalizeBusinessDate(value ?? null);
 }
 /**
  * Build the params for a `customType` backing a MySQL `timestamp` column with `Date` pass-through.
  *
- * The column omits `toDriver`, so `Date` values flow straight to mysql2 and are formatted as JST by
- * the connection's `timezone: '+09:00'` default.
- *
  * @param fsp - optional fractional-seconds precision; when provided, emits `timestamp(fsp)`.
- * @returns the `customType` params object exposing the column's `dataType`.
- * @example
- * ```ts
- * import { customType } from 'drizzle-orm/mysql-core';
- * import { jstTimestampParams } from '@rdlabo/workers-hono-kit/db';
- *
- * const jstTimestamp = (name: string) =>
- *   customType<{ data: string | Date; driverData: string | Date }>(jstTimestampParams())(name);
- * ```
  */
 export const jstTimestampParams = (fsp) => ({
     dataType: () => (fsp != null ? `timestamp(${fsp})` : 'timestamp'),
@@ -74,19 +26,7 @@ export const jstTimestampParams = (fsp) => ({
 /**
  * Build the params for a `customType` backing a MySQL `datetime` column with `Date` pass-through.
  *
- * Behaves like {@link jstTimestampParams} but emits a `datetime` data type; `Date` values pass
- * through and are formatted as JST by the connection's `timezone: '+09:00'` default.
- *
  * @param fsp - optional fractional-seconds precision; when provided, emits `datetime(fsp)`.
- * @returns the `customType` params object exposing the column's `dataType`.
- * @example
- * ```ts
- * import { customType } from 'drizzle-orm/mysql-core';
- * import { jstDatetimeParams } from '@rdlabo/workers-hono-kit/db';
- *
- * const jstDatetime = (name: string) =>
- *   customType<{ data: string | Date; driverData: string | Date }>(jstDatetimeParams())(name);
- * ```
  */
 export const jstDatetimeParams = (fsp) => ({
     dataType: () => (fsp != null ? `datetime(${fsp})` : 'datetime'),
@@ -94,19 +34,7 @@ export const jstDatetimeParams = (fsp) => ({
 /**
  * Build the params for a `customType` backing a MySQL `date` column with JST normalization.
  *
- * Unlike the timestamp/datetime params, this defines a `toDriver` transform that runs
- * {@link toJstDate} so client-supplied ISO/empty strings are normalized to a JST `YYYY-MM-DD` value
- * the column accepts.
- *
- * @returns the `customType` params object exposing the column's `dataType` and `toDriver`.
- * @example
- * ```ts
- * import { customType } from 'drizzle-orm/mysql-core';
- * import { jstDateParams } from '@rdlabo/workers-hono-kit/db';
- *
- * const jstDate = (name: string) =>
- *   customType<{ data: string | null; driverData: string | null }>(jstDateParams())(name);
- * ```
+ * @returns params with `toDriver` running {@link toJstDate}.
  */
 export const jstDateParams = () => ({
     dataType: () => 'date',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rdlabo/workers-hono-kit",
-  "version": "0.3.7",
+  "version": "0.4.0",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -35,7 +35,6 @@
   },
   "files": [
     "dist",
-    "src",
     "scripts",
     "!src/**/*.spec.ts"
   ],
@@ -55,6 +54,11 @@
       "import": "./dist/db/index.js",
       "default": "./dist/db/index.js"
     },
+    "./business-time": {
+      "types": "./dist/business-time/index.d.ts",
+      "import": "./dist/business-time/index.js",
+      "default": "./dist/business-time/index.js"
+    },
     "./testing": {
       "types": "./dist/testing/index.d.ts",
       "import": "./dist/testing/index.js",
@@ -110,7 +114,7 @@
     "ai": "^6.0.204",
     "ai-gateway-provider": "^3.1.3",
     "aws4fetch": "^1.0.20",
-    "drizzle-orm": "0.45.2",
+    "drizzle-orm": "^0.45.2",
     "eslint": "^9.39.4",
     "hono": "^4.6.0",
     "jose": "^6.2.3",

package/src/ai/gateway.ts

@@ -1,120 +0,0 @@
-/**
- * Cloudflare AI Gateway provider factory built on the Vercel AI SDK and `ai-gateway-provider`.
- *
- * Routes OpenAI, Anthropic, and Google Vertex `@ai-sdk/*` models through the AI Gateway Universal
- * Endpoint. The wrapper returned by `createAiGateway` intercepts the provider-bound requests the SDK
- * assembles (`api.openai.com`, `api.anthropic.com`, `*-aiplatform.googleapis.com`, etc.) and redirects
- * them through the Gateway. Every provider is routed transparently via the same `aigateway(model)` call.
- *
- * @remarks
- * This module is purely the infrastructure layer: it injects only the Gateway identifier and (optionally)
- * the Gateway authentication token. Provider API keys and Vertex service-account credentials are supplied
- * by the caller at model-construction time and passed through untouched.
- */
-import { createAiGateway } from 'ai-gateway-provider';
-import type { AiGateway, AiGatewayBindingSettings, AiGatewayOptions } from 'ai-gateway-provider';
-
-export type { AiGateway, AiGatewayOptions } from 'ai-gateway-provider';
-
-/**
- * Minimal shape of a Workers AI binding (`env.AI.gateway(name)`).
- *
- * @remarks
- * Cloudflare's runtime `AiGateway` type is structurally compatible with this binding shape.
- */
-export type AiGatewayBinding = AiGatewayBindingSettings['binding'];
-
-/**
- * Configuration for the AI Gateway provider. This is a union with two mutually exclusive forms.
- *
- * @remarks
- * - **Binding form** — for the Workers runtime (production and `wrangler dev`). Pass the
- *   `env.AI.gateway(name)` binding. Requests through a binding are pre-authenticated within the same
- *   Cloudflare account, so no Gateway token is required.
- * - **REST form** — for non-Workers contexts where a binding is unavailable (e.g. a Node evaluation
- *   harness). Supply `accountId`, `gateway`, and (for authenticated Gateways) `token` to reach the
- *   Gateway over REST.
- */
-export type AiGatewayConfig =
-  | {
-      /** The AI Gateway binding, typically obtained via `env.AI.gateway(name)`. */
-      binding: AiGatewayBinding;
-      /** Optional Gateway options such as caching, retries, and request metadata. */
-      options?: AiGatewayOptions;
-    }
-  | {
-      /** Cloudflare account ID that owns the Gateway. */
-      accountId: string;
-      /** AI Gateway name. */
-      gateway: string;
-      /**
-       * Gateway authentication token sent in the `cf-aig-authorization` header. Required only for an
-       * Authenticated Gateway; omit it for an unauthenticated Gateway. This authenticates the request to
-       * the Gateway itself and is distinct from any provider API key.
-       */
-      token?: string;
-      /** Optional Gateway options such as caching, retries, and request metadata. */
-      options?: AiGatewayOptions;
-    };
-
-/** Provider object exposing the AI Gateway model wrapper. */
-export interface AiGatewayProvider {
-  /**
-   * Wraps an `@ai-sdk/*` model so its requests are routed through the AI Gateway.
-   *
-   * @remarks
-   * Example invocation: `aigateway(createAnthropic({ apiKey })('claude-...'))`. Passing an array of
-   * models enables fallback behavior — each model is attempted in order from the start of the array.
-   */
-  aigateway: AiGateway;
-}
-
-/**
- * Create an AI Gateway provider from either the binding form or the REST form of the configuration.
- *
- * @param config - The Gateway configuration; either the binding form or the REST form.
- * @returns A provider whose `aigateway` wrapper routes models through the AI Gateway.
- * @throws Error When the REST form is used and `accountId` or `gateway` is missing (fail-fast).
- * @example
- * ```ts
- * // Binding form (Workers runtime: production / wrangler dev)
- * import { createAnthropic } from '@ai-sdk/anthropic';
- *
- * const { aigateway } = createAiGatewayProvider({ binding: env.AI.gateway('my-gateway') });
- * const model = aigateway(createAnthropic({ apiKey: env.ANTHROPIC_API_KEY })('claude-3-5-sonnet-latest'));
- * ```
- * @example
- * ```ts
- * // REST form (non-Workers context, e.g. a Node evaluation harness)
- * import { createOpenAI } from '@ai-sdk/openai';
- *
- * const { aigateway } = createAiGatewayProvider({
- *   accountId: process.env.CF_ACCOUNT_ID!,
- *   gateway: 'my-gateway',
- *   token: process.env.CF_AIG_TOKEN, // only for an Authenticated Gateway
- * });
- * const model = aigateway(createOpenAI({ apiKey: process.env.OPENAI_API_KEY })('gpt-4o'));
- * ```
- */
-export function createAiGatewayProvider(config: AiGatewayConfig): AiGatewayProvider {
-  if ('binding' in config) {
-    return { aigateway: createAiGateway({ binding: config.binding, options: config.options }) };
-  }
-
-  if (!config.accountId) {
-    throw new Error('AI Gateway: accountId is not set');
-  }
-  if (!config.gateway) {
-    throw new Error('AI Gateway: gateway name is not set');
-  }
-
-  // The token is sent as apiKey only for an Authenticated Gateway; undefined is fine when unauthenticated.
-  return {
-    aigateway: createAiGateway({
-      accountId: config.accountId,
-      gateway: config.gateway,
-      apiKey: config.token,
-      options: config.options,
-    }),
-  };
-}

package/src/aws/cloudfront.ts

@@ -1,105 +0,0 @@
-/**
- * Generate a CloudFront signed URL using a canned policy, implemented natively for Cloudflare Workers.
- *
- * Reimplements `getSignedUrl` from `@aws-sdk/cloudfront-signer` on top of the Web Crypto API, so no
- * `@aws-sdk` dependency is required. The canned policy is signed with RSASSA-PKCS1-v1_5 and SHA-1, the
- * signature is converted to AWS URL-safe base64 (`+` -> `-`, `/` -> `~`, `=` -> `_`), and the query
- * parameters are appended in the order `Expires`, `Key-Pair-Id`, `Signature`.
- *
- * @remarks
- * The output is byte-for-byte identical to that of `@aws-sdk/cloudfront-signer`.
- *
- * @param url - The resource URL to sign.
- * @param privateKeyPem - The CloudFront key group private key in PKCS#8 PEM format.
- * @param keyPairId - The CloudFront public key (key pair) ID associated with the private key.
- * @param dateLessThan - Expiry time, accepted as a `Date`, epoch-millisecond number, or date string.
- * @returns The signed URL with the `Expires`, `Key-Pair-Id`, and `Signature` query parameters appended.
- * @example
- * ```ts
- * const signedUrl = await getCloudFrontSignedUrl(
- *   'https://cdn.example.com/private/video.mp4',
- *   env.CLOUDFRONT_PRIVATE_KEY,
- *   env.CLOUDFRONT_KEY_PAIR_ID,
- *   Date.now() + 60 * 60 * 1000, // valid for one hour
- * );
- * ```
- */
-export async function getCloudFrontSignedUrl(
-  url: string,
-  privateKeyPem: string,
-  keyPairId: string,
-  dateLessThan: string | number | Date,
-): Promise<string> {
-  const epochSeconds = Math.round(new Date(dateLessThan).getTime() / 1000);
-
-  const policy = JSON.stringify({
-    Statement: [{ Resource: url, Condition: { DateLessThan: { 'AWS:EpochTime': epochSeconds } } }],
-  });
-
-  const key = await crypto.subtle.importKey(
-    'pkcs8',
-    pemToDer(privateKeyPem),
-    { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-1' },
-    false,
-    ['sign'],
-  );
-  const signatureBuffer = await crypto.subtle.sign(
-    { name: 'RSASSA-PKCS1-v1_5' },
-    key,
-    new TextEncoder().encode(policy),
-  );
-
-  const signature = toUrlSafeBase64(arrayBufferToBase64(signatureBuffer));
-  const separator = url.includes('?') ? '&' : '?';
-
-  // Query order used by @aws-sdk/cloudfront-signer: Expires -> Key-Pair-Id -> Signature
-  return `${url}${separator}Expires=${epochSeconds}&Key-Pair-Id=${keyPairId}&Signature=${signature}`;
-}
-
-/**
- * Convert standard base64 to the URL-safe alphabet expected in CloudFront signatures.
- *
- * @param value - A standard base64 string.
- * @returns The base64 string with `+` -> `-`, `=` -> `_`, and `/` -> `~`.
- * @internal
- */
-
-function toUrlSafeBase64(value: string): string {
-  return value.replace(/\+/g, '-').replace(/=/g, '_').replace(/\//g, '~');
-}
-
-/**
- * Encode an `ArrayBuffer` to standard base64.
- *
- * @param buffer - The raw bytes to encode.
- * @returns The standard base64 representation of the buffer.
- * @internal
- */
-function arrayBufferToBase64(buffer: ArrayBuffer): string {
-  const bytes = new Uint8Array(buffer);
-  let binary = '';
-  for (const b of bytes) {
-    binary += String.fromCharCode(b);
-  }
-  return btoa(binary);
-}
-
-/**
- * Decode a PKCS#8 PEM private key into its DER `ArrayBuffer`.
- *
- * @param pem - The PEM-encoded key, including the BEGIN/END armor.
- * @returns The decoded DER bytes, suitable for `crypto.subtle.importKey('pkcs8', ...)`.
- * @internal
- */
-function pemToDer(pem: string): ArrayBuffer {
-  const base64 = pem
-    .replace(/-----BEGIN [^-]+-----/, '')
-    .replace(/-----END [^-]+-----/, '')
-    .replace(/\s+/g, '');
-  const binary = atob(base64);
-  const bytes = new Uint8Array(binary.length);
-  for (let i = 0; i < binary.length; i++) {
-    bytes[i] = binary.charCodeAt(i);
-  }
-  return bytes.buffer;
-}

package/src/aws/secrets-manager.ts

@@ -1,112 +0,0 @@
-import { AwsClient } from 'aws4fetch';
-
-/**
- * AWS credentials used to sign Secrets Manager requests.
- *
- * @remarks
- * Cloudflare Workers have neither the AWS SDK nor IAM role credentials, so static AWS keys are supplied
- * as Workers secrets and used to produce a SigV4 signature.
- */
-export interface AwsSecretsOptions {
-  /** AWS access key ID. */
-  accessKeyId: string;
-  /** AWS secret access key. */
-  secretAccessKey: string;
-  /** Optional STS session token, required when using temporary credentials. */
-  sessionToken?: string;
-  /** AWS region of the Secrets Manager endpoint, e.g. `ap-northeast-1`. */
-  region: string;
-}
-
-/**
- * Per-isolate cache for the fetched secret.
- *
- * @remarks
- * Secrets Manager is queried at most once per isolate. The entry is keyed by
- * `region:accessKeyId:secretId`, so rotating credentials triggers a fresh fetch. The in-flight promise
- * itself is cached so that concurrent first-time callers share a single request. On rejection the cache
- * is cleared so a failed fetch can be retried.
- *
- * @internal
- */
-let cache: { key: string; value: Promise<unknown> } | null = null;
-
-/**
- * Fetch and parse a secret from AWS Secrets Manager, caching the result per isolate.
- *
- * Issues a `GetSecretValue` call to Secrets Manager via a SigV4-signed `fetch` (using aws4fetch), with no
- * AWS SDK involved. The parsed `SecretString` is cached per isolate keyed by region, access key ID, and
- * secret ID; concurrent first-time callers share one in-flight request, and a rejected fetch clears the
- * cache entry so the next call retries.
- *
- * @typeParam T - The shape of the JSON-parsed secret payload, supplied by the caller.
- * @param options - AWS credentials and region used to sign the request.
- * @param secretId - The Secrets Manager secret ID or ARN to retrieve.
- * @returns The parsed secret value cast to `T`.
- * @throws Error When the Secrets Manager response is not OK, or when it contains no `SecretString`.
- * @example
- * ```ts
- * interface DbSecret {
- *   username: string;
- *   password: string;
- * }
- *
- * const secret = await getAuthenticationSecret<DbSecret>(
- *   {
- *     accessKeyId: env.AWS_ACCESS_KEY_ID,
- *     secretAccessKey: env.AWS_SECRET_ACCESS_KEY,
- *     region: 'ap-northeast-1',
- *   },
- *   'prod/db/credentials',
- * );
- * ```
- */
-export function getAuthenticationSecret<T>(options: AwsSecretsOptions, secretId: string): Promise<T> {
-  const key = `${options.region}:${options.accessKeyId}:${secretId}`;
-  if (cache?.key !== key) {
-    const value = fetchSecret(options, secretId).catch((error: unknown) => {
-      cache = null;
-      throw error;
-    });
-    cache = { key, value };
-  }
-  return cache.value as Promise<T>;
-}
-
-/**
- * Perform the SigV4-signed `GetSecretValue` request and parse the returned `SecretString`.
- *
- * @param options - AWS credentials and region used to sign the request.
- * @param secretId - The Secrets Manager secret ID or ARN to retrieve.
- * @returns The JSON-parsed secret payload.
- * @throws Error When the response is not OK, or when it contains no `SecretString`.
- * @internal
- */
-async function fetchSecret(options: AwsSecretsOptions, secretId: string): Promise<unknown> {
-  const aws = new AwsClient({
-    accessKeyId: options.accessKeyId,
-    secretAccessKey: options.secretAccessKey,
-    sessionToken: options.sessionToken,
-    service: 'secretsmanager',
-    region: options.region,
-  });
-
-  const response = await aws.fetch(`https://secretsmanager.${options.region}.amazonaws.com/`, {
-    method: 'POST',
-    headers: {
-      'Content-Type': 'application/x-amz-json-1.1',
-      'X-Amz-Target': 'secretsmanager.GetSecretValue',
-    },
-    body: JSON.stringify({ SecretId: secretId, VersionStage: 'AWSCURRENT' }),
-  });
-
-  if (!response.ok) {
-    throw new Error(`Secrets Manager GetSecretValue failed: ${response.status} ${await response.text()}`);
-  }
-
-  const body = (await response.json()) as { SecretString?: string };
-  if (!body.SecretString) {
-    throw new Error('Secrets Manager GetSecretValue returned no SecretString');
-  }
-  return JSON.parse(body.SecretString);
-}