@rdlabo/workers-hono-kit 0.3.7 → 0.4.2

package/src/firebase/identity-toolkit.ts

@@ -1,179 +0,0 @@
-import { SignJWT, importPKCS8 } from 'jose';
-
-/**
- * Minimal service-account credential consumed by {@link IdentityToolkit}.
- *
- * @remarks
- * Corresponds to the relevant fields of a Google service-account JSON key file.
- */
-export interface ServiceAccount {
-  /** The service account's email, used as the JWT assertion issuer and subject. */
-  client_email: string;
-  /** The PEM-encoded PKCS#8 RSA private key used to sign the OAuth2 assertion. */
-  private_key: string;
-  /** The Google/Firebase project id the Identity Toolkit calls target. */
-  project_id: string;
-}
-
-/** Google OAuth2 token endpoint used to exchange a signed JWT assertion for an access token. */
-const TOKEN_URL = 'https://oauth2.googleapis.com/token';
-/** Base URL of the Google Identity Toolkit v1 REST API. */
-const IDENTITY_TOOLKIT = 'https://identitytoolkit.googleapis.com/v1';
-/** OAuth2 scopes required for Identity Toolkit account lookup and deletion. */
-const SCOPE = 'https://www.googleapis.com/auth/identitytoolkit https://www.googleapis.com/auth/firebase';
-/** Maximum number of `localId`s the `accounts:lookup` endpoint accepts in a single request. */
-const LOOKUP_CHUNK_SIZE = 100;
-
-/**
- * Minimal Google Identity Toolkit REST client for the user-management operations that token
- * verification does not cover: `accounts:lookup` (getUser) and `accounts:delete` (deleteUser).
- *
- * This replaces the parts of the `firebase-admin` Node SDK that cannot run on Cloudflare
- * Workers (workerd).
- *
- * @remarks
- * Authentication follows the JWT-bearer flow: a JWT assertion is signed with the service
- * account's private key (via `jose`), exchanged at the OAuth2 token endpoint for an access
- * token, and that token is then used to call the REST API. Access tokens are cached in-process
- * and reused until shortly before they expire.
- */
-export class IdentityToolkit {
-  /** Cached OAuth2 access token and its absolute expiry (Unix seconds), or `null` when none. */
-  private accessToken: { value: string; expiresAt: number } | null = null;
-
-  /**
-   * Create a client bound to a single service account.
-   *
-   * @param sa - The service-account credential used to authenticate REST calls.
-   */
-  constructor(private readonly sa: ServiceAccount) {}
-
-  /**
-   * Return a valid OAuth2 access token, minting a new one when the cache is empty or expiring.
-   *
-   * Signs a short-lived JWT assertion with the service-account key and exchanges it at the
-   * Google OAuth2 token endpoint. The result is cached and reused while it remains valid
-   * (with a 60-second safety margin).
-   *
-   * @param nowSeconds - The current Unix time in seconds, used for cache validity and JWT timestamps.
-   * @returns A bearer access token for the Identity Toolkit API.
-   * @throws If the token exchange request fails.
-   * @internal
-   */
-  private async getAccessToken(nowSeconds: number): Promise<string> {
-    if (this.accessToken && this.accessToken.expiresAt > nowSeconds + 60) {
-      return this.accessToken.value;
-    }
-    const key = await importPKCS8(this.sa.private_key, 'RS256');
-    const assertion = await new SignJWT({ scope: SCOPE })
-      .setProtectedHeader({ alg: 'RS256', typ: 'JWT' })
-      .setIssuer(this.sa.client_email)
-      .setSubject(this.sa.client_email)
-      .setAudience(TOKEN_URL)
-      .setIssuedAt(nowSeconds)
-      .setExpirationTime(nowSeconds + 3600)
-      .sign(key);
-
-    const res = await fetch(TOKEN_URL, {
-      method: 'POST',
-      headers: { 'content-type': 'application/x-www-form-urlencoded' },
-      body: new URLSearchParams({
-        grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',
-        assertion,
-      }),
-    });
-    if (!res.ok) {
-      throw new Error(`Identity Toolkit token exchange failed: ${res.status}`);
-    }
-    const json = (await res.json()) as { access_token: string; expires_in: number };
-    this.accessToken = { value: json.access_token, expiresAt: nowSeconds + json.expires_in };
-    return json.access_token;
-  }
-
-  /**
-   * Call the `accounts:lookup` endpoint for a single chunk of `localId`s.
-   *
-   * @param localIds - Up to {@link LOOKUP_CHUNK_SIZE} `localId`s to look up in one request.
-   * @param nowSeconds - The current Unix time in seconds, used for access-token caching.
-   * @returns The raw `users` entries returned by the endpoint (empty when the request is
-   *   unsuccessful or no matching users are returned).
-   * @throws If acquiring an access token fails.
-   * @internal
-   */
-  private async lookupChunk(localIds: string[], nowSeconds: number): Promise<{ localId: string; email?: string }[]> {
-    const token = await this.getAccessToken(nowSeconds);
-    const res = await fetch(`${IDENTITY_TOOLKIT}/projects/${this.sa.project_id}/accounts:lookup`, {
-      method: 'POST',
-      headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json' },
-      body: JSON.stringify({ localId: localIds }),
-    });
-    if (!res.ok) {
-      return [];
-    }
-    const json = (await res.json()) as { users?: { localId: string; email?: string }[] };
-    return json.users ?? [];
-  }
-
-  /**
-   * Look up a user record by uid via the `accounts:lookup` endpoint.
-   *
-   * @param uid - The user's unique id (`localId`).
-   * @param nowSeconds - The current Unix time in seconds, used for access-token caching.
-   * @returns The user's `uid` and optional `email`, or `null` when the request is unsuccessful
-   *   or no matching user is returned.
-   * @throws If acquiring an access token fails.
-   */
-  async lookup(uid: string, nowSeconds: number): Promise<{ uid: string; email?: string } | null> {
-    const users = await this.lookupChunk([uid], nowSeconds);
-    return users.length > 0 ? { uid: users[0].localId, email: users[0].email } : null;
-  }
-
-  /**
-   * Look up multiple user records by uid via the `accounts:lookup` endpoint.
-   *
-   * `uids` are chunked into groups of at most {@link LOOKUP_CHUNK_SIZE} (the maximum `localId`
-   * array size the endpoint accepts), issuing one `accounts:lookup` request per chunk. This lets
-   * callers replace N single-uid lookups with `ceil(N / LOOKUP_CHUNK_SIZE)` requests.
-   *
-   * @param uids - The users' unique ids (`localId`s) to look up.
-   * @param nowSeconds - The current Unix time in seconds, used for access-token caching.
-   * @returns The `uid`/`email` of every matching user. Uids Firebase does not recognize are
-   *   simply absent from the result (never `null` entries), so callers can treat "missing from
-   *   the result" as "not found/invalid".
-   * @throws If acquiring an access token fails.
-   */
-  async lookupMany(uids: string[], nowSeconds: number): Promise<{ uid: string; email?: string }[]> {
-    if (uids.length === 0) {
-      return [];
-    }
-    const results: { uid: string; email?: string }[] = [];
-    for (let i = 0; i < uids.length; i += LOOKUP_CHUNK_SIZE) {
-      const chunk = uids.slice(i, i + LOOKUP_CHUNK_SIZE);
-      const users = await this.lookupChunk(chunk, nowSeconds);
-      for (const user of users) {
-        results.push({ uid: user.localId, email: user.email });
-      }
-    }
-    return results;
-  }
-
-  /**
-   * Delete a user by uid via the `accounts:delete` endpoint.
-   *
-   * @param uid - The user's unique id (`localId`).
-   * @param nowSeconds - The current Unix time in seconds, used for access-token caching.
-   * @returns A promise that resolves once the user has been deleted.
-   * @throws If acquiring an access token fails or the delete request is unsuccessful.
-   */
-  async remove(uid: string, nowSeconds: number): Promise<void> {
-    const token = await this.getAccessToken(nowSeconds);
-    const res = await fetch(`${IDENTITY_TOOLKIT}/projects/${this.sa.project_id}/accounts:delete`, {
-      method: 'POST',
-      headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json' },
-      body: JSON.stringify({ localId: uid }),
-    });
-    if (!res.ok) {
-      throw new Error(`Identity Toolkit delete failed: ${res.status}`);
-    }
-  }
-}

package/src/firebase/jose-firebase-verifier.ts

@@ -1,159 +0,0 @@
-import { jwtVerify } from 'jose';
-import type { CryptoKey, JWK, JWTVerifyGetKey, KeyObject } from 'jose';
-import type { DecodedIdToken, FirebaseVerifier } from './firebase-verifier.js';
-import type { IdentityToolkit } from './identity-toolkit.js';
-
-/**
- * Union of every key shape `jose`'s `jwtVerify` accepts.
- *
- * @remarks
- * `jose` v6 removed `KeyLike`, so the verification key is modelled here as either a static
- * key (production uses `createRemoteJWKSet`, tests use a generated `CryptoKey`) or a dynamic
- * `JWTVerifyGetKey` resolver function. This union covers both `jwtVerify` overloads' key
- * parameters.
- *
- * @internal
- */
-type KeyInput = CryptoKey | KeyObject | JWK | Uint8Array | JWTVerifyGetKey;
-
-/**
- * URL of Google's securetoken JWKS endpoint, which serves the public keys used to sign
- * Firebase ID tokens.
- *
- * @remarks
- * Passed to `createRemoteJWKSet` (see `createRemoteFirebaseVerifier`) so RS256 signatures can
- * be verified against Google's rotating public keys.
- */
-export const SECURETOKEN_JWK_URL =
-  'https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com';
-
-/**
- * Verifies Firebase ID tokens with `jose` RS256 against Google's securetoken JWKS, and
- * optionally looks up or deletes users via the Google Identity Toolkit REST API.
- *
- * This replaces the `firebase-admin` Auth surface (`verifyIdToken` / `getUser` /
- * `deleteUser`) in environments where the Node SDK cannot run, such as Cloudflare Workers.
- * Token verification mirrors the admin SDK's checks: issuer and audience equal to the
- * project id, an RS256 signature, a non-empty subject (the uid), and a valid `auth_time`.
- *
- * @remarks
- * The verification key is supplied as `keyResolver`:
- * - Production: `createRemoteJWKSet(new URL(SECURETOKEN_JWK_URL))`, which fetches and caches
- *   Google's public keys.
- * - Tests: a generated public key, allowing fully offline verification with no network.
- *
- * `getUser` / `deleteUser` delegate to {@link IdentityToolkit} (a network call); when no
- * `IdentityToolkit` is configured they throw.
- *
- * @see {@link FirebaseVerifier} for the abstract boundary this implements.
- */
-export class JoseFirebaseVerifier implements FirebaseVerifier {
-  /**
-   * Create a verifier.
-   *
-   * @param opts - Verifier configuration.
-   * @param opts.projectId - The Firebase project id, used as both the expected token issuer
-   *   (`https://securetoken.google.com/<projectId>`) and audience.
-   * @param opts.keyResolver - The RS256 verification key or a dynamic key resolver function.
-   * @param opts.identity - Optional Identity Toolkit client enabling `getUser` / `deleteUser`.
-   * @param opts.now - Optional clock returning the current time in seconds; injectable for
-   *   deterministic tests. Defaults to the system clock.
-   */
-  constructor(
-    private readonly opts: {
-      projectId: string;
-      keyResolver: KeyInput;
-      identity?: IdentityToolkit;
-      now?: () => number; // seconds; injectable for tests
-    },
-  ) {}
-
-  /**
-   * Verify a Firebase ID token and return its decoded payload.
-   *
-   * Checks the RS256 signature against the configured key, enforces the expected issuer and
-   * audience (the project id), and applies the admin SDK's extra checks: a non-empty string
-   * subject of at most 128 characters and an `auth_time` that is a number not in the future.
-   *
-   * @param idToken - The raw Firebase ID token (JWT) to verify.
-   * @returns The decoded payload, with `uid` set from `sub` and `email` lifted to a top-level field.
-   * @throws If the signature, issuer, audience, or expiry are invalid, if the subject is
-   *   missing/non-string/too long, or if `auth_time` is missing or in the future.
-   */
-  async verifyIdToken(idToken: string): Promise<DecodedIdToken> {
-    const options = {
-      issuer: `https://securetoken.google.com/${this.opts.projectId}`,
-      audience: this.opts.projectId,
-      algorithms: ['RS256'] as string[],
-    };
-    // Branch so each call matches a single jwtVerify overload (static key vs getKey fn).
-    const key = this.opts.keyResolver;
-    const { payload } =
-      typeof key === 'function' ? await jwtVerify(idToken, key, options) : await jwtVerify(idToken, key, options);
-    // Mirror firebase-admin's extra checks beyond signature/iss/aud/exp:
-    if (!payload.sub || typeof payload.sub !== 'string' || payload.sub.length > 128) {
-      throw new Error('Firebase ID token has an invalid subject');
-    }
-    const authTime = payload.auth_time;
-    if (typeof authTime !== 'number' || authTime > this.nowSeconds()) {
-      throw new Error('Firebase ID token has an invalid auth_time');
-    }
-    return { ...payload, uid: payload.sub, email: payload.email as string | undefined };
-  }
-
-  /**
-   * Look up a user record by uid via the Identity Toolkit REST API.
-   *
-   * @param uid - The user's unique id.
-   * @returns The user's `uid` and optional `email`, or `null` when the user does not exist.
-   * @throws If no Identity Toolkit client was configured on this verifier.
-   */
-  async getUser(uid: string): Promise<{ uid: string; email?: string } | null> {
-    if (!this.opts.identity) {
-      throw new Error('Identity Toolkit not configured');
-    }
-    return this.opts.identity.lookup(uid, this.nowSeconds());
-  }
-
-  /**
-   * Look up multiple user records by uid via the Identity Toolkit REST API.
-   *
-   * Batches the lookups into `ceil(uids.length / 100)` `accounts:lookup` requests instead of
-   * one request per uid.
-   *
-   * @param uids - The users' unique ids to look up.
-   * @returns The `uid`/`email` of every matching user. Uids Firebase does not recognize are
-   *   simply absent from the result (never `null` entries).
-   * @throws If no Identity Toolkit client was configured on this verifier.
-   */
-  async getUsers(uids: string[]): Promise<{ uid: string; email?: string }[]> {
-    if (!this.opts.identity) {
-      throw new Error('Identity Toolkit not configured');
-    }
-    return this.opts.identity.lookupMany(uids, this.nowSeconds());
-  }
-
-  /**
-   * Delete a user by uid via the Identity Toolkit REST API.
-   *
-   * @param uid - The user's unique id.
-   * @returns A promise that resolves once the user has been deleted.
-   * @throws If no Identity Toolkit client was configured on this verifier, or the deletion fails.
-   */
-  async deleteUser(uid: string): Promise<void> {
-    if (!this.opts.identity) {
-      throw new Error('Identity Toolkit not configured');
-    }
-    await this.opts.identity.remove(uid, this.nowSeconds());
-  }
-
-  /**
-   * Return the current time in seconds, using the injected clock when provided.
-   *
-   * @returns The current Unix time in seconds.
-   * @internal
-   */
-  private nowSeconds(): number {
-    return this.opts.now ? this.opts.now() : Math.floor(Date.now() / 1000);
-  }
-}

package/src/firebase/remote-verifier.ts

@@ -1,98 +0,0 @@
-import { createRemoteJWKSet } from 'jose';
-import { IdentityToolkit } from './identity-toolkit.js';
-import type { ServiceAccount } from './identity-toolkit.js';
-import { JoseFirebaseVerifier, SECURETOKEN_JWK_URL } from './jose-firebase-verifier.js';
-
-/**
- * Shared remote JWKS for Google's securetoken keys.
- *
- * @remarks
- * The JWKS URL is fixed, so the set is created once per isolate and shared across verifiers
- * (`jose` caches the fetched keys internally). Lazily initialised on first use.
- *
- * @internal
- */
-let jwks: ReturnType<typeof createRemoteJWKSet> | undefined;
-/**
- * Per-`projectId` cache of token-only verifiers, memoized for the lifetime of the isolate.
- *
- * @internal
- */
-const verifiers = new Map<string, JoseFirebaseVerifier>();
-
-/**
- * Create a token-verification-only Firebase verifier for the given project.
- *
- * Uses `createRemoteJWKSet` to fetch Google's securetoken public keys and returns a
- * {@link JoseFirebaseVerifier}. This factory is for token verification only; it configures no
- * Identity Toolkit client, so `getUser` / `deleteUser` are unavailable.
- *
- * @remarks
- * The remote JWKS is created once per isolate and shared, and the returned verifier is
- * memoized per `projectId`. This preserves the caching behaviour of a module-level JWKS so
- * repeated calls do not re-fetch keys or allocate new verifiers.
- *
- * @param projectId - The Firebase project id whose tokens will be verified.
- * @returns A verifier that validates ID tokens for `projectId`.
- * @example
- * ```ts
- * const verifier = createRemoteFirebaseVerifier('my-firebase-project');
- * const decoded = await verifier.verifyIdToken(idToken);
- * console.log(decoded.uid);
- * ```
- */
-export function createRemoteFirebaseVerifier(projectId: string): JoseFirebaseVerifier {
-  jwks ??= createRemoteJWKSet(new URL(SECURETOKEN_JWK_URL));
-  let verifier = verifiers.get(projectId);
-  if (!verifier) {
-    verifier = new JoseFirebaseVerifier({ projectId, keyResolver: jwks });
-    verifiers.set(projectId, verifier);
-  }
-  return verifier;
-}
-
-/**
- * Single-entry cache of the service-account verifier, keyed by the raw service-account JSON.
- *
- * @internal
- */
-let saVerifierCache: { key: string; verifier: JoseFirebaseVerifier } | null = null;
-
-/**
- * Create a Firebase verifier from a service-account JSON string.
- *
- * Unlike {@link createRemoteFirebaseVerifier}, the returned {@link JoseFirebaseVerifier}
- * embeds an {@link IdentityToolkit} client, enabling `getUser` and `deleteUser` in addition to
- * token verification.
- *
- * @remarks
- * The verifier is cached for the lifetime of the isolate, keyed by the service-account JSON
- * string, and is only rebuilt when that secret changes. The remote JWKS is shared with
- * {@link createRemoteFirebaseVerifier}.
- *
- * @param serviceAccountJson - The service-account key as a JSON string (parsed into {@link ServiceAccount}).
- * @returns A verifier that validates ID tokens and can look up or delete users.
- * @throws If `serviceAccountJson` is not valid JSON.
- * @example
- * ```ts
- * const verifier = createServiceAccountVerifier(env.FIREBASE_SERVICE_ACCOUNT);
- * const decoded = await verifier.verifyIdToken(idToken);
- * const user = await verifier.getUser(decoded.uid);
- * await verifier.deleteUser(decoded.uid);
- * ```
- */
-export function createServiceAccountVerifier(serviceAccountJson: string): JoseFirebaseVerifier {
-  if (saVerifierCache?.key !== serviceAccountJson) {
-    jwks ??= createRemoteJWKSet(new URL(SECURETOKEN_JWK_URL));
-    const sa = JSON.parse(serviceAccountJson) as ServiceAccount;
-    saVerifierCache = {
-      key: serviceAccountJson,
-      verifier: new JoseFirebaseVerifier({
-        projectId: sa.project_id,
-        keyResolver: jwks,
-        identity: new IdentityToolkit(sa),
-      }),
-    };
-  }
-  return saVerifierCache.verifier;
-}

package/src/http/app-env.ts

@@ -1,53 +0,0 @@
-/**
- * The resolved runtime environment of the Worker.
- */
-export type AppEnv = 'development' | 'production';
-
-/**
- * Resolve the runtime environment (development or production) from the Worker `env` binding.
- *
- * @remarks
- * Cloudflare Workers have no filesystem or `child_process` at runtime, so the environment cannot be
- * inferred from the presence of a `.git` directory the way a Node/NestJS process might. Instead, the
- * development signal is carried in the committed launch command: `wrangler dev --var APP_ENV:development`
- * injects `APP_ENV`, while `wrangler deploy` injects nothing. Only `env.APP_ENV === 'development'`
- * resolves to `'development'`; every other case (including a missing binding, i.e. a production deploy)
- * resolves to `'production'`. This "absence defaults to production" semantic keeps the safe side as the
- * default.
- *
- * Because it reads from `env` rather than a request header, it works in both `fetch` and `scheduled`
- * contexts and cannot be spoofed by an incoming request.
- *
- * @param env - The Worker environment binding, or `null`/`undefined` when unavailable.
- * @returns `'development'` only when `env.APP_ENV` is exactly `'development'`; otherwise `'production'`.
- *
- * @example
- * ```ts
- * export default {
- *   fetch(req, env) {
- *     if (resolveAppEnv(env) === 'development') {
- *       // enable verbose logging
- *     }
- *   },
- * };
- * ```
- */
-export function resolveAppEnv(env: { APP_ENV?: string } | null | undefined): AppEnv {
-  return env?.APP_ENV === 'development' ? 'development' : 'production';
-}
-
-/**
- * Shorthand for checking whether the resolved environment is production.
- *
- * @param env - The Worker environment binding, or `null`/`undefined` when unavailable.
- * @returns `true` when {@link resolveAppEnv} resolves to `'production'`.
- *
- * @example
- * ```ts
- * if (isProductionEnv(env)) {
- *   // skip dev-only diagnostics
- * }
- * ```
- */
-export const isProductionEnv = (env: { APP_ENV?: string } | null | undefined): boolean =>
-  resolveAppEnv(env) === 'production';

package/src/http/app-info.ts

@@ -1,38 +0,0 @@
-import type { Context } from 'hono';
-
-/**
- * Client application metadata derived from the `x-amz-meta-*` request headers.
- *
- * @remarks
- * Reproduces the per-request app identity that a NestJS service would expose so a Hono app
- * can read the same client-supplied version/uuid pair without changing the wire contract.
- */
-export interface AppInfo {
-  /** Client application version from `x-amz-meta-version`, or `null` when the header is absent. */
-  version: string | null;
-  /** Client installation identifier from `x-amz-meta-uuid`, or `null` when the header is absent. */
-  uuid: string | null;
-}
-
-/**
- * Read {@link AppInfo} from the `x-amz-meta-version` / `x-amz-meta-uuid` request headers.
- *
- * @remarks
- * Typically called by an auth middleware that stores the result per request via
- * `c.set('appInfo', getAppInfo(c))`. Missing headers resolve to `null` rather than throwing.
- *
- * @param c - The Hono request context to read headers from.
- * @returns The client application metadata for the current request.
- *
- * @example
- * ```ts
- * app.use(async (c, next) => {
- *   c.set('appInfo', getAppInfo(c));
- *   await next();
- * });
- * ```
- */
-export const getAppInfo = (c: Context): AppInfo => ({
-  version: c.req.header('x-amz-meta-version') ?? null,
-  uuid: c.req.header('x-amz-meta-uuid') ?? null,
-});

package/src/http/execution-context.ts

@@ -1,11 +0,0 @@
-/**
- * Minimal structural shape of a Workers `ExecutionContext`, limited to `waitUntil`.
- *
- * @remarks
- * Declared structurally to avoid a dependency on `@cloudflare/workers-types`.
- * Lives in the root export path so worker entry modules can import it without pulling in `./db`.
- */
-export interface ExecutionContextLike {
-  /** Extend the request's lifetime until `promise` settles (used to close connections after the response). */
-  waitUntil(promise: Promise<unknown>): void;
-}

package/src/http/http-status.ts

@@ -1,71 +0,0 @@
-/**
- * HTTP status codes mirroring the `HttpStatus` enum from `@nestjs/common`.
- *
- * @remarks
- * Provides a single source of truth for referencing status codes by the same names NestJS uses, so a
- * Hono app can emit responses whose status matches a NestJS service byte-for-byte. The member set and
- * numeric values intentionally track `@nestjs/common` rather than the IANA registry, including a few
- * non-standard codes that NestJS ships.
- */
-export enum HttpStatus {
-  CONTINUE = 100,
-  SWITCHING_PROTOCOLS = 101,
-  PROCESSING = 102,
-  EARLYHINTS = 103,
-  OK = 200,
-  CREATED = 201,
-  ACCEPTED = 202,
-  NON_AUTHORITATIVE_INFORMATION = 203,
-  NO_CONTENT = 204,
-  RESET_CONTENT = 205,
-  PARTIAL_CONTENT = 206,
-  MULTI_STATUS = 207,
-  ALREADY_REPORTED = 208,
-  /** Non-standard WebDAV extension carried over from NestJS. */
-  CONTENT_DIFFERENT = 210,
-  /** Multiple Choices (300). Named `AMBIGUOUS` to match NestJS. */
-  AMBIGUOUS = 300,
-  MOVED_PERMANENTLY = 301,
-  FOUND = 302,
-  SEE_OTHER = 303,
-  NOT_MODIFIED = 304,
-  TEMPORARY_REDIRECT = 307,
-  PERMANENT_REDIRECT = 308,
-  BAD_REQUEST = 400,
-  UNAUTHORIZED = 401,
-  PAYMENT_REQUIRED = 402,
-  FORBIDDEN = 403,
-  NOT_FOUND = 404,
-  METHOD_NOT_ALLOWED = 405,
-  NOT_ACCEPTABLE = 406,
-  PROXY_AUTHENTICATION_REQUIRED = 407,
-  REQUEST_TIMEOUT = 408,
-  CONFLICT = 409,
-  GONE = 410,
-  LENGTH_REQUIRED = 411,
-  PRECONDITION_FAILED = 412,
-  PAYLOAD_TOO_LARGE = 413,
-  URI_TOO_LONG = 414,
-  UNSUPPORTED_MEDIA_TYPE = 415,
-  REQUESTED_RANGE_NOT_SATISFIABLE = 416,
-  EXPECTATION_FAILED = 417,
-  /** "I'm a teapot" (418), from RFC 2324. */
-  I_AM_A_TEAPOT = 418,
-  /** Misdirected Request (421). Named `MISDIRECTED` to match NestJS. */
-  MISDIRECTED = 421,
-  UNPROCESSABLE_ENTITY = 422,
-  LOCKED = 423,
-  FAILED_DEPENDENCY = 424,
-  PRECONDITION_REQUIRED = 428,
-  TOO_MANY_REQUESTS = 429,
-  /** Non-standard code carried over from NestJS. */
-  UNRECOVERABLE_ERROR = 456,
-  INTERNAL_SERVER_ERROR = 500,
-  NOT_IMPLEMENTED = 501,
-  BAD_GATEWAY = 502,
-  SERVICE_UNAVAILABLE = 503,
-  GATEWAY_TIMEOUT = 504,
-  HTTP_VERSION_NOT_SUPPORTED = 505,
-  INSUFFICIENT_STORAGE = 507,
-  LOOP_DETECTED = 508,
-}