@relkit/runtime-hono 0.5.3 → 0.5.5

package/dist/transport-security.js

@@ -1,12 +1,13 @@
 import { AGENT_CAPABILITY_HEADER } from "@relkit/contracts";
-export class TransportSecurityError extends Error {
-    code;
-    constructor(code, message) {
-        super(message);
-        this.code = code;
-        this.name = "TransportSecurityError";
-    }
-}
+import { Context, Effect, Layer } from "effect";
+import { httpBoundary, HttpBoundaryError, observeHttp, runHttp } from "./http-effect.js";
+import { TransportSecurityError } from "./transport-security-errors.js";
+export { TransportSecurityError } from "./transport-security-errors.js";
+/** Installs origin, preflight and CSRF policy before application routes.
+ * @param app - Hono application receiving the configured endpoints or middleware.
+ * @param options - Application dependencies and configuration for this domain.
+ * @returns Nothing; registers preflight, origin and CSRF middleware on the application.
+ */
 export function installTransportSecurity(app, options) {
     if (options === undefined)
         return;
@@ -41,20 +42,52 @@ export function installTransportSecurity(app, options) {
             cors(context, origin);
     });
 }
-export async function assertStateChangingRequest(request, options) {
-    if (await options.trustedService?.(request))
+/** Admit trusted service calls or enforce origin and CSRF policy for a mutation.
+ * @param request - Mutation request containing origin and optional CSRF headers.
+ * @param options - Trusted-service callback, admitted origins and token validator.
+ * @returns An effect succeeding for admitted requests or failing with the public security error.
+ */
+const stateChangingRequest = Effect.fn("RequestSecurity.stateChanging")(function* (request, options) {
+    if (yield* httpBoundary("security.trusted", () => Promise.resolve(options.trustedService?.(request))))
         return;
     const origin = request.headers.get("origin") ?? refererOrigin(request.headers.get("referer"));
     if (origin === new URL(request.url).origin)
         return;
     if (origin === null || !allowedOrigins(options.allowedOrigins).has(origin)) {
-        throw new TransportSecurityError("ORIGIN_DENIED", "Request origin is not allowed.");
+        return yield* Effect.fail(new HttpBoundaryError({
+            operation: "security.origin",
+            cause: new TransportSecurityError("ORIGIN_DENIED", "Request origin is not allowed."),
+        }));
     }
     const token = request.headers.get(options.csrfHeader ?? "x-relkit-csrf");
-    if (token === null || !(await options.validateCsrf?.(request, token))) {
-        throw new TransportSecurityError("CSRF_DENIED", "CSRF validation failed.");
+    if (token === null ||
+        !(yield* httpBoundary("security.csrf", () => Promise.resolve(options.validateCsrf?.(request, token))))) {
+        return yield* Effect.fail(new HttpBoundaryError({
+            operation: "security.csrf",
+            cause: new TransportSecurityError("CSRF_DENIED", "CSRF validation failed."),
+        }));
     }
+});
+/** Validates origin and CSRF policy without replacing the public error class. */
+export class RequestSecurity extends Context.Service()("@relkit/runtime-hono/RequestSecurity") {
+}
+/** Live trusted-service, origin and CSRF checks. */
+export const RequestSecurityLive = Layer.succeed(RequestSecurity, {
+    stateChanging: (...args) => observeHttp("security.stateChanging", stateChangingRequest(...args)),
+});
+/** Executes state-changing request policy at the native middleware edge.
+ * @param request - Native request whose headers, body and cancellation signal define this operation.
+ * @param options - Application dependencies and configuration for this domain.
+ * @returns A Promise succeeding for admitted requests or rejecting with the public security error.
+ */
+export function assertStateChangingRequest(request, options) {
+    return runHttp(Effect.flatMap(RequestSecurity, (security) => security.stateChanging(request, options)).pipe(Effect.provide(RequestSecurityLive)));
 }
+/** Rejects a WebSocket origin outside the configured credentialed origin policy.
+ * @param request - Native request whose headers, body and cancellation signal define this operation.
+ * @param options - Application dependencies and configuration for this domain.
+ * @returns Nothing for an admitted origin; otherwise throws TransportSecurityError.
+ */
 export function assertWebSocketOrigin(request, options) {
     const origin = request.headers.get("origin");
     if (origin === null ||
@@ -63,11 +96,23 @@ export function assertWebSocketOrigin(request, options) {
         throw new TransportSecurityError("ORIGIN_DENIED", "WebSocket origin is not allowed.");
     }
 }
+/** Allows trusted service callers or validates the WebSocket origin.
+ * @param request - Native request whose headers, body and cancellation signal define this operation.
+ * @param options - Application dependencies and configuration for this domain.
+ * @returns A Promise succeeding for trusted callers or admitted WebSocket origins.
+ */
 export async function assertWebSocketRequest(request, options) {
     if (await options.trustedService?.(request))
         return;
     assertWebSocketOrigin(request, options);
 }
+/** Writes credentialed CORS response headers for an admitted origin.
+ * @param context - Trusted Hono or oRPC request context containing request state and authentication.
+ * @param origin - Origin admitted by the current transport-security check.
+ * @param methods - Normalized methods advertised by the preflight response.
+ * @param headers - Native or protocol headers available to this request.
+ * @returns Nothing; appends credentialed CORS and optional preflight headers.
+ */
 function cors(context, origin, methods, headers) {
     context.header("Access-Control-Allow-Origin", origin);
     context.header("Access-Control-Allow-Credentials", "true");
@@ -91,20 +136,37 @@ const DEFAULT_HEADERS = [
     "x-relkit-agent-observe",
     AGENT_CAPABILITY_HEADER,
 ];
-function allowedMethods(values) {
+/** Builds the normalized set of methods admitted by preflight policy.
+ * @param values - Configured values normalized into the resulting lookup set.
+ * @returns Uppercase allowed methods, using the default method set when unspecified.
+ */
+export function allowedMethods(values) {
     return new Set((values ?? DEFAULT_METHODS).map((value) => value.toUpperCase()));
 }
+/** Checks that every requested preflight header is explicitly admitted.
+ * @param value - Value inspected, validated or projected by this operation.
+ * @param configured - Explicitly configured allowlist or timeout bound.
+ * @returns Whether the value satisfies the required public contract.
+ */
 function headersAllowed(value, configured) {
     if (value === null || value.trim() === "")
         return true;
     const allowed = new Set((configured ?? DEFAULT_HEADERS).map((header) => header.toLowerCase()));
     return value.split(",").every((header) => allowed.has(header.trim().toLowerCase()));
 }
-function allowedOrigins(values) {
+/** Normalizes configured origins and rejects credentialed wildcard access.
+ * @param values - Configured values normalized into the resulting lookup set.
+ * @returns Normalized exact origins; invalid or wildcard origins throw a configuration error.
+ */
+export function allowedOrigins(values) {
     if (values.includes("*"))
         throw new TypeError("Credentialed CORS cannot use a wildcard origin.");
     return new Set(values.map((value) => new URL(value).origin));
 }
+/** Extracts a valid referrer origin without throwing on malformed input.
+ * @param value - Value inspected, validated or projected by this operation.
+ * @returns The referrer's origin, or null when missing or malformed.
+ */
 function refererOrigin(value) {
     if (value === null)
         return null;
@@ -115,9 +177,18 @@ function refererOrigin(value) {
         return null;
     }
 }
+/** Identifies methods requiring origin and CSRF checks.
+ * @param method - Normalized native HTTP request method.
+ * @returns Whether the value satisfies the required public contract.
+ */
 function isStateChanging(method) {
     return !["GET", "HEAD", "OPTIONS"].includes(method);
 }
+/** Creates the safe transport-security rejection envelope.
+ * @param context - Trusted Hono or oRPC request context containing request state and authentication.
+ * @param code - Stable public error identifier.
+ * @returns The stable HTTP 403 security error response.
+ */
 function denied(context, code) {
     return context.json({ error: { id: code, message: "Request rejected." } }, 403);
 }

package/dist/transport-security.js.map

@@ -1 +1 @@
-{"version":3,"file":"transport-security.js","sourceRoot":"","sources":["../src/transport-security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAqB,MAAM,mBAAmB,CAAC;AAY/E,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAEpC;IADX,YACW,IAAqC,EAC9C,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAAiC;QAI9C,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,MAAM,UAAU,wBAAwB,CACtC,GAAS,EACT,OAA6C;IAE7C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO;IAClC,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACvD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QACnC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;QAChC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpD,IAAI,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,OAAO,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YAC1C,CAAC;YACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,IAAI,EAAE,CAAC;YAC1E,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YACvD,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;YAC/E,IACE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBAClC,CAAC,cAAc,CAAC,gBAAgB,EAAE,OAAO,CAAC,cAAc,CAAC,EACzD,CAAC;gBACD,OAAO,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;YACjD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5E,IAAI,CAAC;gBACH,MAAM,0BAA0B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,MAAM,CACX,OAAO,EACP,KAAK,YAAY,sBAAsB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CACrE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;QACb,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAAgB,EAChB,OAAiC;IAEjC,IAAI,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC;QAAE,OAAO;IACpD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9F,IAAI,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM;QAAE,OAAO;IACnD,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,sBAAsB,CAAC,eAAe,EAAE,gCAAgC,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,eAAe,CAAC,CAAC;IACzE,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,sBAAsB,CAAC,aAAa,EAAE,yBAAyB,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAgB,EAAE,OAAiC;IACvF,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IACE,MAAM,KAAK,IAAI;QACf,MAAM,KAAK,MAAM;QACjB,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAC/F,CAAC;QACD,MAAM,IAAI,sBAAsB,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAgB,EAChB,OAAiC;IAEjC,IAAI,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC;QAAE,OAAO;IACpD,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,IAAI,CACX,OAAsF,EACtF,MAAc,EACd,OAA6B,EAC7B,OAAuB;IAEvB,OAAO,CAAC,MAAM,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;IACtD,OAAO,CAAC,MAAM,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;IAC3D,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,IAAI,OAAO,KAAK,SAAS;QACvB,OAAO,CAAC,MAAM,CAAC,8BAA8B,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,IAAI,OAAO;QAAE,OAAO,CAAC,MAAM,CAAC,8BAA8B,EAAE,OAAO,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAU,CAAC;AACnF,MAAM,eAAe,GAAG;IACtB,QAAQ;IACR,eAAe;IACf,cAAc;IACd,eAAe;IACf,eAAe;IACf,yBAAyB;IACzB,uBAAuB;IACvB,6BAA6B;IAC7B,wBAAwB;IACxB,wBAAwB;IACxB,uBAAuB;CACf,CAAC;AAEX,SAAS,cAAc,CAAC,MAAqC;IAC3D,OAAO,IAAI,GAAG,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,cAAc,CAAC,KAAoB,EAAE,UAAyC;IACrF,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,IAAI,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC/F,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,cAAc,CAAC,MAAyB;IAC/C,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC;IACjG,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,aAAa,CAAC,KAAoB;IACzC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,MAAM,CAAC,OAAwD,EAAE,IAAY;IACpF,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;AAClF,CAAC"}
+{"version":3,"file":"transport-security.js","sourceRoot":"","sources":["../src/transport-security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAGxE;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAS,EACT,OAA6C;IAE7C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO;IAClC,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACvD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QACnC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;QAChC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpD,IAAI,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,OAAO,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YAC1C,CAAC;YACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,IAAI,EAAE,CAAC;YAC1E,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YACvD,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;YAC/E,IACE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBAClC,CAAC,cAAc,CAAC,gBAAgB,EAAE,OAAO,CAAC,cAAc,CAAC,EACzD,CAAC;gBACD,OAAO,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;YACjD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5E,IAAI,CAAC;gBACH,MAAM,0BAA0B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,MAAM,CACX,OAAO,EACP,KAAK,YAAY,sBAAsB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CACrE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;QACb,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,MAAM,CAAC,EAAE,CAAC,+BAA+B,CAAC,CAAC,QAAQ,CAAC,EAC/E,OAAgB,EAChB,OAAiC;IAEjC,IACE,KAAK,CAAC,CAAC,YAAY,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAC3C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,CAAC,CACnD;QAED,OAAO;IACT,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9F,IAAI,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM;QAAE,OAAO;IACnD,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,iBAAiB,CAAC;YACpB,SAAS,EAAE,iBAAiB;YAC5B,KAAK,EAAE,IAAI,sBAAsB,CAAC,eAAe,EAAE,gCAAgC,CAAC;SACrF,CAAC,CACH,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,eAAe,CAAC,CAAC;IACzE,IACE,KAAK,KAAK,IAAI;QACd,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,eAAe,EAAE,GAAG,EAAE,CAC1C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CACxD,CAAC,EACF,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,iBAAiB,CAAC;YACpB,SAAS,EAAE,eAAe;YAC1B,KAAK,EAAE,IAAI,sBAAsB,CAAC,aAAa,EAAE,yBAAyB,CAAC;SAC5E,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,OAAO,eAAgB,SAAQ,OAAO,CAAC,OAAO,EAGjD,CAAC,sCAAsC,CAAC;CAAG;AAE9C,oDAAoD;AACpD,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE;IAChE,aAAa,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,wBAAwB,EAAE,oBAAoB,CAAC,GAAG,IAAI,CAAC,CAAC;CACjG,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAgB,EAChB,OAAiC;IAEjC,OAAO,OAAO,CACZ,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAC1F,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CACpC,CACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAgB,EAAE,OAAiC;IACvF,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IACE,MAAM,KAAK,IAAI;QACf,MAAM,KAAK,MAAM;QACjB,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAC/F,CAAC;QACD,MAAM,IAAI,sBAAsB,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAgB,EAChB,OAAiC;IAEjC,IAAI,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC;QAAE,OAAO;IACpD,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;GAMG;AACH,SAAS,IAAI,CACX,OAAsF,EACtF,MAAc,EACd,OAA6B,EAC7B,OAAuB;IAEvB,OAAO,CAAC,MAAM,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;IACtD,OAAO,CAAC,MAAM,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;IAC3D,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,IAAI,OAAO,KAAK,SAAS;QACvB,OAAO,CAAC,MAAM,CAAC,8BAA8B,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,IAAI,OAAO;QAAE,OAAO,CAAC,MAAM,CAAC,8BAA8B,EAAE,OAAO,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAU,CAAC;AACnF,MAAM,eAAe,GAAG;IACtB,QAAQ;IACR,eAAe;IACf,cAAc;IACd,eAAe;IACf,eAAe;IACf,yBAAyB;IACzB,uBAAuB;IACvB,6BAA6B;IAC7B,wBAAwB;IACxB,wBAAwB;IACxB,uBAAuB;CACf,CAAC;AAEX;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAqC;IAClE,OAAO,IAAI,GAAG,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAoB,EAAE,UAAyC;IACrF,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,IAAI,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC/F,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACtF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAyB;IACtD,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC;IACjG,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAoB;IACzC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,OAAwD,EAAE,IAAY;IACpF,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;AAClF,CAAC"}

package/dist/transport-security.types.d.ts

@@ -0,0 +1,11 @@
+import type { MaybePromise } from "@relkit/contracts";
+/** transport security options configuring dependencies, callbacks and runtime policy. */
+export interface TransportSecurityOptions {
+    readonly allowedOrigins: readonly string[];
+    readonly allowedMethods?: readonly string[];
+    readonly allowedHeaders?: readonly string[];
+    readonly csrfHeader?: string;
+    readonly validateCsrf?: (request: Request, token: string) => MaybePromise<boolean>;
+    readonly trustedService?: (request: Request) => MaybePromise<boolean>;
+}
+//# sourceMappingURL=transport-security.types.d.ts.map

package/dist/transport-security.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport-security.types.d.ts","sourceRoot":"","sources":["../src/transport-security.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGtD,yFAAyF;AACzF,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,KAAK,YAAY,CAAC,OAAO,CAAC,CAAC;IACnF,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,YAAY,CAAC,OAAO,CAAC,CAAC;CACvE"}

package/dist/transport-security.types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=transport-security.types.js.map

package/dist/transport-security.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport-security.types.js","sourceRoot":"","sources":["../src/transport-security.types.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@relkit/runtime-hono",
-  "version": "0.5.3",
+  "version": "0.5.5",
   "description": "Unsupported internal Hono runtime for RELKIT; use @relkit/app.",
   "license": "MIT",
   "repository": {
@@ -38,29 +38,32 @@
     "@orpc/contract": "2.0.0-beta.31",
     "@orpc/server": "2.0.0-beta.31",
     "@scalar/hono-api-reference": "0.11.16",
-    "@relkit/contracts": "0.5.3",
-    "@relkit/agents": "0.5.3",
-    "@relkit/engine": "0.5.3",
-    "@relkit/graph": "0.5.3",
-    "@relkit/invocation": "0.5.3",
-    "@relkit/jobs": "0.5.3",
-    "@relkit/observability": "0.5.3",
-    "@relkit/openapi": "0.5.3",
-    "@relkit/runtime-effect": "0.5.3",
-    "@relkit/routes": "0.5.3",
-    "@relkit/realtime": "0.5.3",
-    "@relkit/schema": "0.5.3",
+    "@relkit/contracts": "0.5.5",
+    "@relkit/agents": "0.5.5",
+    "@relkit/engine": "0.5.5",
+    "@relkit/graph": "0.5.5",
+    "@relkit/invocation": "0.5.5",
+    "@relkit/jobs": "0.5.5",
+    "@relkit/observability": "0.5.5",
+    "@relkit/openapi": "0.5.5",
+    "@relkit/runtime-effect": "0.5.5",
+    "@relkit/routes": "0.5.5",
+    "@relkit/realtime": "0.5.5",
+    "@relkit/schema": "0.5.5",
+    "effect": "4.0.0-rc.115",
     "hono": "4.13.5",
     "hono-rate-limiter": "0.5.3"
   },
   "devDependencies": {
+    "@effect/vitest": "4.0.0-rc.115",
     "@langchain/core": "1.2.9",
     "@langchain/langgraph": "1.4.14",
     "@modelcontextprotocol/client": "2.0.0",
     "@orpc/client": "2.0.0-beta.31",
-    "@relkit/client": "0.5.3",
-    "@relkit/providers-local": "0.5.3",
-    "langchain": "1.5.10"
+    "@relkit/client": "0.5.5",
+    "@relkit/providers-local": "0.5.5",
+    "langchain": "1.5.10",
+    "vitest": "5.0.1"
   },
   "scripts": {
     "build": "tsc -b",