@vivero/stoma 0.1.0-rc.10

package/dist/policies/transform/assign-content.js

@@ -0,0 +1,185 @@
+import { definePolicy, Priority } from "../sdk";
+async function resolveFields(c, fields) {
+  const resolved = {};
+  for (const [key, value] of Object.entries(fields)) {
+    if (typeof value === "function") {
+      resolved[key] = await value(c);
+    } else {
+      resolved[key] = value;
+    }
+  }
+  return resolved;
+}
+function contentTypeMatches(contentType, allowedTypes) {
+  if (!contentType) return false;
+  return allowedTypes.some((ct) => contentType.includes(ct));
+}
+const assignContent = /* @__PURE__ */ definePolicy({
+  name: "assign-content",
+  priority: Priority.REQUEST_TRANSFORM,
+  defaults: {
+    contentTypes: ["application/json"]
+  },
+  handler: async (c, next, { config, debug }) => {
+    if (config.request) {
+      const reqContentType = c.req.header("content-type");
+      if (contentTypeMatches(reqContentType, config.contentTypes)) {
+        let body = {};
+        try {
+          const cloned = c.req.raw.clone();
+          const text = await cloned.text();
+          if (text) {
+            body = JSON.parse(text);
+          }
+        } catch {
+        }
+        const resolved = await resolveFields(c, config.request);
+        Object.assign(body, resolved);
+        debug(
+          "assigned %d fields to request body",
+          Object.keys(resolved).length
+        );
+        const newReq = new Request(c.req.url, {
+          method: c.req.method,
+          headers: c.req.raw.headers,
+          body: JSON.stringify(body),
+          // @ts-expect-error -- duplex required for streams in some runtimes
+          duplex: "half"
+        });
+        Object.defineProperty(c.req, "raw", {
+          value: newReq,
+          configurable: true
+        });
+      } else {
+        debug(
+          "request content-type %s not in allowed types - skipping request modification",
+          reqContentType
+        );
+      }
+    }
+    await next();
+    if (config.response) {
+      const resContentType = c.res.headers.get("content-type");
+      if (contentTypeMatches(resContentType ?? void 0, config.contentTypes)) {
+        let body = {};
+        try {
+          const text = await c.res.text();
+          if (text) {
+            body = JSON.parse(text);
+          }
+        } catch {
+        }
+        const resolved = await resolveFields(c, config.response);
+        Object.assign(body, resolved);
+        debug(
+          "assigned %d fields to response body",
+          Object.keys(resolved).length
+        );
+        const newRes = new Response(JSON.stringify(body), {
+          status: c.res.status,
+          headers: c.res.headers
+        });
+        c.res = newRes;
+      } else {
+        debug(
+          "response content-type %s not in allowed types - skipping response modification",
+          resContentType
+        );
+      }
+    }
+  },
+  evaluate: {
+    onRequest: async (input, { config, debug }) => {
+      if (!config.request) {
+        return { action: "continue" };
+      }
+      const contentType = input.headers.get("content-type") ?? "";
+      if (!contentTypeMatches(contentType, config.contentTypes)) {
+        debug(
+          "request content-type %s not in allowed types - skipping request modification",
+          contentType
+        );
+        return { action: "continue" };
+      }
+      let body = {};
+      try {
+        if (input.body) {
+          const bodyStr = typeof input.body === "string" ? input.body : new TextDecoder().decode(input.body);
+          if (bodyStr) {
+            body = JSON.parse(bodyStr);
+          }
+        }
+      } catch {
+      }
+      for (const [key, value] of Object.entries(config.request)) {
+        if (typeof value === "function") {
+          body[key] = value({});
+        } else {
+          body[key] = value;
+        }
+      }
+      debug(
+        "assigned %d fields to request body",
+        Object.keys(config.request).length
+      );
+      return {
+        action: "continue",
+        mutations: [
+          {
+            type: "body",
+            op: "replace",
+            content: JSON.stringify(body)
+          }
+        ]
+      };
+    },
+    onResponse: async (input, { config, debug }) => {
+      if (!config.response) {
+        return { action: "continue" };
+      }
+      const contentType = input.headers.get("content-type") ?? "";
+      if (!contentTypeMatches(contentType, config.contentTypes)) {
+        debug(
+          "response content-type %s not in allowed types - skipping response modification",
+          contentType
+        );
+        return { action: "continue" };
+      }
+      let body = {};
+      try {
+        if (input.body) {
+          const bodyStr = typeof input.body === "string" ? input.body : new TextDecoder().decode(input.body);
+          if (bodyStr) {
+            body = JSON.parse(bodyStr);
+          }
+        }
+      } catch {
+      }
+      for (const [key, value] of Object.entries(config.response)) {
+        if (typeof value === "function") {
+          body[key] = value({});
+        } else {
+          body[key] = value;
+        }
+      }
+      debug(
+        "assigned %d fields to response body",
+        Object.keys(config.response).length
+      );
+      return {
+        action: "continue",
+        mutations: [
+          {
+            type: "body",
+            op: "replace",
+            content: JSON.stringify(body)
+          }
+        ]
+      };
+    }
+  }
+});
+export {
+  assignContent
+};
+//# sourceMappingURL=assign-content.js.map

package/dist/policies/transform/assign-content.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/policies/transform/assign-content.ts"],"sourcesContent":["/**\n * Assign (inject/override) fields in JSON request and/or response bodies.\n *\n * Supports static values and dynamic functions that receive the Hono context.\n * Only modifies bodies with matching content types (default: application/json).\n *\n * @module assign-content\n */\nimport type { Context } from \"hono\";\nimport type { Mutation } from \"../../core/protocol\";\nimport { definePolicy, Priority } from \"../sdk\";\nimport type { PolicyConfig } from \"../types\";\n\n/** A field value - either a static value or a function resolving to one. */\ntype FieldValue = unknown | ((c: Context) => unknown | Promise<unknown>);\n\nexport interface AssignContentConfig extends PolicyConfig {\n  /** Fields to set/override in the JSON request body. */\n  request?: Record<string, FieldValue>;\n  /** Fields to set/override in the JSON response body. */\n  response?: Record<string, FieldValue>;\n  /** Only modify bodies with these content types. Default: `[\"application/json\"]`. */\n  contentTypes?: string[];\n}\n\n/**\n * Resolve a field map - evaluates dynamic functions, keeps static values.\n */\nasync function resolveFields(\n  c: Context,\n  fields: Record<string, FieldValue>\n): Promise<Record<string, unknown>> {\n  const resolved: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(fields)) {\n    if (typeof value === \"function\") {\n      resolved[key] = await (\n        value as (c: Context) => unknown | Promise<unknown>\n      )(c);\n    } else {\n      resolved[key] = value;\n    }\n  }\n  return resolved;\n}\n\n/**\n * Check if a content-type header matches any of the allowed types.\n */\nfunction contentTypeMatches(\n  contentType: string | undefined,\n  allowedTypes: string[]\n): boolean {\n  if (!contentType) return false;\n  return allowedTypes.some((ct) => contentType.includes(ct));\n}\n\n/**\n * Assign content policy.\n *\n * Injects or overrides fields in JSON request and/or response bodies.\n * Useful for injecting tenant IDs, timestamps, metadata, or other\n * fields that should be transparently added by the gateway.\n *\n * @example\n * ```ts\n * import { assignContent } from \"@vivero/stoma\";\n *\n * assignContent({\n *   request: {\n *     tenantId: \"acme\",\n *     timestamp: (c) => new Date().toISOString(),\n *   },\n *   response: {\n *     gateway: \"stoma\",\n *   },\n * });\n * ```\n */\nexport const assignContent = /*#__PURE__*/ definePolicy<AssignContentConfig>({\n  name: \"assign-content\",\n  priority: Priority.REQUEST_TRANSFORM,\n  defaults: {\n    contentTypes: [\"application/json\"],\n  },\n  handler: async (c, next, { config, debug }) => {\n    // Request phase - modify request body before upstream\n    if (config.request) {\n      const reqContentType = c.req.header(\"content-type\");\n      if (contentTypeMatches(reqContentType, config.contentTypes!)) {\n        let body: Record<string, unknown> = {};\n\n        // Try to parse existing body\n        try {\n          const cloned = c.req.raw.clone();\n          const text = await cloned.text();\n          if (text) {\n            body = JSON.parse(text) as Record<string, unknown>;\n          }\n        } catch {\n          // No body or invalid JSON - start with empty object\n        }\n\n        // Resolve and merge fields\n        const resolved = await resolveFields(c, config.request);\n        Object.assign(body, resolved);\n\n        debug(\n          \"assigned %d fields to request body\",\n          Object.keys(resolved).length\n        );\n\n        // Replace the request with modified body\n        const newReq = new Request(c.req.url, {\n          method: c.req.method,\n          headers: c.req.raw.headers,\n          body: JSON.stringify(body),\n          // @ts-expect-error -- duplex required for streams in some runtimes\n          duplex: \"half\",\n        });\n        Object.defineProperty(c.req, \"raw\", {\n          value: newReq,\n          configurable: true,\n        });\n      } else {\n        debug(\n          \"request content-type %s not in allowed types - skipping request modification\",\n          reqContentType\n        );\n      }\n    }\n\n    await next();\n\n    // Response phase - modify response body after upstream\n    if (config.response) {\n      const resContentType = c.res.headers.get(\"content-type\");\n      if (\n        contentTypeMatches(resContentType ?? undefined, config.contentTypes!)\n      ) {\n        let body: Record<string, unknown> = {};\n\n        try {\n          const text = await c.res.text();\n          if (text) {\n            body = JSON.parse(text) as Record<string, unknown>;\n          }\n        } catch {\n          // Invalid JSON - start with empty object\n        }\n\n        // Resolve and merge fields\n        const resolved = await resolveFields(c, config.response);\n        Object.assign(body, resolved);\n\n        debug(\n          \"assigned %d fields to response body\",\n          Object.keys(resolved).length\n        );\n\n        // Create new response with modified body, preserving status and headers\n        const newRes = new Response(JSON.stringify(body), {\n          status: c.res.status,\n          headers: c.res.headers,\n        });\n        c.res = newRes;\n      } else {\n        debug(\n          \"response content-type %s not in allowed types - skipping response modification\",\n          resContentType\n        );\n      }\n    }\n  },\n  evaluate: {\n    onRequest: async (input, { config, debug }) => {\n      if (!config.request) {\n        return { action: \"continue\" };\n      }\n\n      const contentType = input.headers.get(\"content-type\") ?? \"\";\n      if (!contentTypeMatches(contentType, config.contentTypes!)) {\n        debug(\n          \"request content-type %s not in allowed types - skipping request modification\",\n          contentType\n        );\n        return { action: \"continue\" };\n      }\n\n      // Parse existing body or start empty\n      let body: Record<string, unknown> = {};\n      try {\n        if (input.body) {\n          const bodyStr =\n            typeof input.body === \"string\"\n              ? input.body\n              : new TextDecoder().decode(input.body);\n          if (bodyStr) {\n            body = JSON.parse(bodyStr);\n          }\n        }\n      } catch {\n        // Invalid JSON - start with empty object\n      }\n\n      // Resolve and merge fields (can't use dynamic functions in evaluate)\n      for (const [key, value] of Object.entries(config.request)) {\n        if (typeof value === \"function\") {\n          body[key] = value({} as Context);\n        } else {\n          body[key] = value;\n        }\n      }\n\n      debug(\n        \"assigned %d fields to request body\",\n        Object.keys(config.request).length\n      );\n\n      return {\n        action: \"continue\",\n        mutations: [\n          {\n            type: \"body\",\n            op: \"replace\",\n            content: JSON.stringify(body),\n          } as Mutation,\n        ],\n      };\n    },\n    onResponse: async (input, { config, debug }) => {\n      if (!config.response) {\n        return { action: \"continue\" };\n      }\n\n      const contentType = input.headers.get(\"content-type\") ?? \"\";\n      if (!contentTypeMatches(contentType, config.contentTypes!)) {\n        debug(\n          \"response content-type %s not in allowed types - skipping response modification\",\n          contentType\n        );\n        return { action: \"continue\" };\n      }\n\n      // Parse existing body or start empty\n      let body: Record<string, unknown> = {};\n      try {\n        if (input.body) {\n          const bodyStr =\n            typeof input.body === \"string\"\n              ? input.body\n              : new TextDecoder().decode(input.body);\n          if (bodyStr) {\n            body = JSON.parse(bodyStr);\n          }\n        }\n      } catch {\n        // Invalid JSON - start with empty object\n      }\n\n      // Resolve and merge fields (can't use dynamic functions in evaluate)\n      for (const [key, value] of Object.entries(config.response)) {\n        if (typeof value === \"function\") {\n          body[key] = value({} as Context);\n        } else {\n          body[key] = value;\n        }\n      }\n\n      debug(\n        \"assigned %d fields to response body\",\n        Object.keys(config.response).length\n      );\n\n      return {\n        action: \"continue\",\n        mutations: [\n          {\n            type: \"body\",\n            op: \"replace\",\n            content: JSON.stringify(body),\n          } as Mutation,\n        ],\n      };\n    },\n  },\n});\n"],"mappings":"AAUA,SAAS,cAAc,gBAAgB;AAkBvC,eAAe,cACb,GACA,QACkC;AAClC,QAAM,WAAoC,CAAC;AAC3C,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,OAAO,UAAU,YAAY;AAC/B,eAAS,GAAG,IAAI,MACd,MACA,CAAC;AAAA,IACL,OAAO;AACL,eAAS,GAAG,IAAI;AAAA,IAClB;AAAA,EACF;AACA,SAAO;AACT;AAKA,SAAS,mBACP,aACA,cACS;AACT,MAAI,CAAC,YAAa,QAAO;AACzB,SAAO,aAAa,KAAK,CAAC,OAAO,YAAY,SAAS,EAAE,CAAC;AAC3D;AAwBO,MAAM,gBAA8B,6BAAkC;AAAA,EAC3E,MAAM;AAAA,EACN,UAAU,SAAS;AAAA,EACnB,UAAU;AAAA,IACR,cAAc,CAAC,kBAAkB;AAAA,EACnC;AAAA,EACA,SAAS,OAAO,GAAG,MAAM,EAAE,QAAQ,MAAM,MAAM;AAE7C,QAAI,OAAO,SAAS;AAClB,YAAM,iBAAiB,EAAE,IAAI,OAAO,cAAc;AAClD,UAAI,mBAAmB,gBAAgB,OAAO,YAAa,GAAG;AAC5D,YAAI,OAAgC,CAAC;AAGrC,YAAI;AACF,gBAAM,SAAS,EAAE,IAAI,IAAI,MAAM;AAC/B,gBAAM,OAAO,MAAM,OAAO,KAAK;AAC/B,cAAI,MAAM;AACR,mBAAO,KAAK,MAAM,IAAI;AAAA,UACxB;AAAA,QACF,QAAQ;AAAA,QAER;AAGA,cAAM,WAAW,MAAM,cAAc,GAAG,OAAO,OAAO;AACtD,eAAO,OAAO,MAAM,QAAQ;AAE5B;AAAA,UACE;AAAA,UACA,OAAO,KAAK,QAAQ,EAAE;AAAA,QACxB;AAGA,cAAM,SAAS,IAAI,QAAQ,EAAE,IAAI,KAAK;AAAA,UACpC,QAAQ,EAAE,IAAI;AAAA,UACd,SAAS,EAAE,IAAI,IAAI;AAAA,UACnB,MAAM,KAAK,UAAU,IAAI;AAAA;AAAA,UAEzB,QAAQ;AAAA,QACV,CAAC;AACD,eAAO,eAAe,EAAE,KAAK,OAAO;AAAA,UAClC,OAAO;AAAA,UACP,cAAc;AAAA,QAChB,CAAC;AAAA,MACH,OAAO;AACL;AAAA,UACE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,KAAK;AAGX,QAAI,OAAO,UAAU;AACnB,YAAM,iBAAiB,EAAE,IAAI,QAAQ,IAAI,cAAc;AACvD,UACE,mBAAmB,kBAAkB,QAAW,OAAO,YAAa,GACpE;AACA,YAAI,OAAgC,CAAC;AAErC,YAAI;AACF,gBAAM,OAAO,MAAM,EAAE,IAAI,KAAK;AAC9B,cAAI,MAAM;AACR,mBAAO,KAAK,MAAM,IAAI;AAAA,UACxB;AAAA,QACF,QAAQ;AAAA,QAER;AAGA,cAAM,WAAW,MAAM,cAAc,GAAG,OAAO,QAAQ;AACvD,eAAO,OAAO,MAAM,QAAQ;AAE5B;AAAA,UACE;AAAA,UACA,OAAO,KAAK,QAAQ,EAAE;AAAA,QACxB;AAGA,cAAM,SAAS,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,UAChD,QAAQ,EAAE,IAAI;AAAA,UACd,SAAS,EAAE,IAAI;AAAA,QACjB,CAAC;AACD,UAAE,MAAM;AAAA,MACV,OAAO;AACL;AAAA,UACE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,UAAU;AAAA,IACR,WAAW,OAAO,OAAO,EAAE,QAAQ,MAAM,MAAM;AAC7C,UAAI,CAAC,OAAO,SAAS;AACnB,eAAO,EAAE,QAAQ,WAAW;AAAA,MAC9B;AAEA,YAAM,cAAc,MAAM,QAAQ,IAAI,cAAc,KAAK;AACzD,UAAI,CAAC,mBAAmB,aAAa,OAAO,YAAa,GAAG;AAC1D;AAAA,UACE;AAAA,UACA;AAAA,QACF;AACA,eAAO,EAAE,QAAQ,WAAW;AAAA,MAC9B;AAGA,UAAI,OAAgC,CAAC;AACrC,UAAI;AACF,YAAI,MAAM,MAAM;AACd,gBAAM,UACJ,OAAO,MAAM,SAAS,WAClB,MAAM,OACN,IAAI,YAAY,EAAE,OAAO,MAAM,IAAI;AACzC,cAAI,SAAS;AACX,mBAAO,KAAK,MAAM,OAAO;AAAA,UAC3B;AAAA,QACF;AAAA,MACF,QAAQ;AAAA,MAER;AAGA,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,OAAO,GAAG;AACzD,YAAI,OAAO,UAAU,YAAY;AAC/B,eAAK,GAAG,IAAI,MAAM,CAAC,CAAY;AAAA,QACjC,OAAO;AACL,eAAK,GAAG,IAAI;AAAA,QACd;AAAA,MACF;AAEA;AAAA,QACE;AAAA,QACA,OAAO,KAAK,OAAO,OAAO,EAAE;AAAA,MAC9B;AAEA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,WAAW;AAAA,UACT;AAAA,YACE,MAAM;AAAA,YACN,IAAI;AAAA,YACJ,SAAS,KAAK,UAAU,IAAI;AAAA,UAC9B;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,YAAY,OAAO,OAAO,EAAE,QAAQ,MAAM,MAAM;AAC9C,UAAI,CAAC,OAAO,UAAU;AACpB,eAAO,EAAE,QAAQ,WAAW;AAAA,MAC9B;AAEA,YAAM,cAAc,MAAM,QAAQ,IAAI,cAAc,KAAK;AACzD,UAAI,CAAC,mBAAmB,aAAa,OAAO,YAAa,GAAG;AAC1D;AAAA,UACE;AAAA,UACA;AAAA,QACF;AACA,eAAO,EAAE,QAAQ,WAAW;AAAA,MAC9B;AAGA,UAAI,OAAgC,CAAC;AACrC,UAAI;AACF,YAAI,MAAM,MAAM;AACd,gBAAM,UACJ,OAAO,MAAM,SAAS,WAClB,MAAM,OACN,IAAI,YAAY,EAAE,OAAO,MAAM,IAAI;AACzC,cAAI,SAAS;AACX,mBAAO,KAAK,MAAM,OAAO;AAAA,UAC3B;AAAA,QACF;AAAA,MACF,QAAQ;AAAA,MAER;AAGA,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,QAAQ,GAAG;AAC1D,YAAI,OAAO,UAAU,YAAY;AAC/B,eAAK,GAAG,IAAI,MAAM,CAAC,CAAY;AAAA,QACjC,OAAO;AACL,eAAK,GAAG,IAAI;AAAA,QACd;AAAA,MACF;AAEA;AAAA,QACE;AAAA,QACA,OAAO,KAAK,OAAO,QAAQ,EAAE;AAAA,MAC/B;AAEA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,WAAW;AAAA,UACT;AAAA,YACE,MAAM;AAAA,YACN,IAAI;AAAA,YACJ,SAAS,KAAK,UAAU,IAAI;AAAA,UAC9B;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF,CAAC;","names":[]}

package/dist/policies/transform/cors.d.ts

@@ -0,0 +1,57 @@
+import { g as PolicyConfig, P as Policy } from '../../protocol-2fD3DJrL.js';
+import 'hono';
+import '../sdk/trace.js';
+import '@vivero/stoma-core';
+
+interface CorsConfig extends PolicyConfig {
+    /** Allowed origins. Default: "*" */
+    origins?: string | string[] | ((origin: string) => boolean);
+    /** Allowed HTTP methods. Default: all. */
+    methods?: string[];
+    /** Headers the client is allowed to send. */
+    allowHeaders?: string[];
+    /** Headers exposed to the client. */
+    exposeHeaders?: string[];
+    /** Max age for preflight cache in seconds. Default: 86400. */
+    maxAge?: number;
+    /** Allow credentials. Default: false. */
+    credentials?: boolean;
+}
+/**
+ * Add Cross-Origin Resource Sharing headers to gateway responses.
+ *
+ * Wraps Hono's built-in CORS middleware as a composable policy. Handles both
+ * simple and preflight (OPTIONS) requests. Runs at priority 5 so CORS headers
+ * are applied before auth or other policies reject the request.
+ *
+ * @param config - Origin rules, allowed methods/headers, and credentials. All fields optional.
+ * @returns A {@link Policy} at priority 5 (runs very early).
+ *
+ * @example
+ * ```ts
+ * import { createGateway } from "@vivero/stoma";
+ * import { cors } from "@vivero/stoma/policies";
+ *
+ * // Allow any origin (default)
+ * createGateway({
+ *   policies: [cors()],
+ *   routes: [{ path: "/api/*", pipeline: { upstream: { type: "url", target: "https://api.example.com" } } }],
+ * });
+ *
+ * // Restrict to specific origins with credentials
+ * cors({
+ *   origins: ["https://app.example.com", "https://staging.example.com"],
+ *   methods: ["GET", "POST", "PUT", "DELETE"],
+ *   credentials: true,
+ *   maxAge: 3600,
+ * });
+ *
+ * // Dynamic origin validation
+ * cors({
+ *   origins: (origin) => origin.endsWith(".example.com"),
+ * });
+ * ```
+ */
+declare function cors(config?: CorsConfig): Policy;
+
+export { type CorsConfig, cors };

package/dist/policies/transform/cors.js

@@ -0,0 +1,23 @@
+import { cors as honoCors } from "hono/cors";
+import { Priority, withSkip } from "../sdk";
+function cors(config) {
+  const origin = config?.origins ?? "*";
+  const honoMiddleware = honoCors({
+    origin: typeof origin === "function" ? (o) => origin(o) ? o : "" : origin,
+    allowMethods: config?.methods,
+    allowHeaders: config?.allowHeaders,
+    exposeHeaders: config?.exposeHeaders,
+    maxAge: config?.maxAge,
+    credentials: config?.credentials
+  });
+  return {
+    name: "cors",
+    priority: Priority.EARLY,
+    handler: withSkip(config?.skip, honoMiddleware),
+    httpOnly: true
+  };
+}
+export {
+  cors
+};
+//# sourceMappingURL=cors.js.map

package/dist/policies/transform/cors.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/policies/transform/cors.ts"],"sourcesContent":["/**\n * CORS policy wrapping Hono's built-in CORS middleware.\n *\n * @module cors\n */\nimport { cors as honoCors } from \"hono/cors\";\nimport { Priority, withSkip } from \"../sdk\";\nimport type { Policy, PolicyConfig } from \"../types\";\n\nexport interface CorsConfig extends PolicyConfig {\n  /** Allowed origins. Default: \"*\" */\n  origins?: string | string[] | ((origin: string) => boolean);\n  /** Allowed HTTP methods. Default: all. */\n  methods?: string[];\n  /** Headers the client is allowed to send. */\n  allowHeaders?: string[];\n  /** Headers exposed to the client. */\n  exposeHeaders?: string[];\n  /** Max age for preflight cache in seconds. Default: 86400. */\n  maxAge?: number;\n  /** Allow credentials. Default: false. */\n  credentials?: boolean;\n}\n\n/**\n * Add Cross-Origin Resource Sharing headers to gateway responses.\n *\n * Wraps Hono's built-in CORS middleware as a composable policy. Handles both\n * simple and preflight (OPTIONS) requests. Runs at priority 5 so CORS headers\n * are applied before auth or other policies reject the request.\n *\n * @param config - Origin rules, allowed methods/headers, and credentials. All fields optional.\n * @returns A {@link Policy} at priority 5 (runs very early).\n *\n * @example\n * ```ts\n * import { createGateway } from \"@vivero/stoma\";\n * import { cors } from \"@vivero/stoma/policies\";\n *\n * // Allow any origin (default)\n * createGateway({\n *   policies: [cors()],\n *   routes: [{ path: \"/api/*\", pipeline: { upstream: { type: \"url\", target: \"https://api.example.com\" } } }],\n * });\n *\n * // Restrict to specific origins with credentials\n * cors({\n *   origins: [\"https://app.example.com\", \"https://staging.example.com\"],\n *   methods: [\"GET\", \"POST\", \"PUT\", \"DELETE\"],\n *   credentials: true,\n *   maxAge: 3600,\n * });\n *\n * // Dynamic origin validation\n * cors({\n *   origins: (origin) => origin.endsWith(\".example.com\"),\n * });\n * ```\n */\nexport function cors(config?: CorsConfig): Policy {\n  const origin = config?.origins ?? \"*\";\n  const honoMiddleware = honoCors({\n    origin: typeof origin === \"function\" ? (o) => (origin(o) ? o : \"\") : origin,\n    allowMethods: config?.methods,\n    allowHeaders: config?.allowHeaders,\n    exposeHeaders: config?.exposeHeaders,\n    maxAge: config?.maxAge,\n    credentials: config?.credentials,\n  });\n\n  return {\n    name: \"cors\",\n    priority: Priority.EARLY,\n    handler: withSkip(config?.skip, honoMiddleware),\n    httpOnly: true,\n  };\n}\n"],"mappings":"AAKA,SAAS,QAAQ,gBAAgB;AACjC,SAAS,UAAU,gBAAgB;AAqD5B,SAAS,KAAK,QAA6B;AAChD,QAAM,SAAS,QAAQ,WAAW;AAClC,QAAM,iBAAiB,SAAS;AAAA,IAC9B,QAAQ,OAAO,WAAW,aAAa,CAAC,MAAO,OAAO,CAAC,IAAI,IAAI,KAAM;AAAA,IACrE,cAAc,QAAQ;AAAA,IACtB,cAAc,QAAQ;AAAA,IACtB,eAAe,QAAQ;AAAA,IACvB,QAAQ,QAAQ;AAAA,IAChB,aAAa,QAAQ;AAAA,EACvB,CAAC;AAED,SAAO;AAAA,IACL,MAAM;AAAA,IACN,UAAU,SAAS;AAAA,IACnB,SAAS,SAAS,QAAQ,MAAM,cAAc;AAAA,IAC9C,UAAU;AAAA,EACZ;AACF;","names":[]}

package/dist/policies/transform/json-validation.d.ts

@@ -0,0 +1,50 @@
+import { g as PolicyConfig, P as Policy } from '../../protocol-2fD3DJrL.js';
+import 'hono';
+import '../sdk/trace.js';
+import '@vivero/stoma-core';
+
+/** Result shape returned by the user-provided validation function. */
+interface JsonValidationResult {
+    valid: boolean;
+    errors?: string[];
+}
+interface JsonValidationConfig extends PolicyConfig {
+    /** Custom validation function. Takes parsed body, returns validation result. */
+    validate?: (body: unknown) => JsonValidationResult | Promise<JsonValidationResult>;
+    /** Content types to validate. Default: ["application/json"] */
+    contentTypes?: string[];
+    /** HTTP status code on validation failure. Default: 422 */
+    rejectStatus?: number;
+    /** Include validation errors in response. Default: true */
+    errorDetail?: boolean;
+}
+/**
+ * Pluggable JSON body validation policy.
+ *
+ * Validates the request body using a user-provided function. When no
+ * `validate` function is configured, checks that the body is parseable JSON.
+ * Requests with content types not in the configured list pass through
+ * without validation.
+ *
+ * @example
+ * ```ts
+ * import { jsonValidation } from "@vivero/stoma";
+ *
+ * // With Zod
+ * jsonValidation({
+ *   validate: (body) => {
+ *     const result = myZodSchema.safeParse(body);
+ *     return {
+ *       valid: result.success,
+ *       errors: result.success ? undefined : result.error.issues.map(i => i.message),
+ *     };
+ *   },
+ * });
+ *
+ * // Just validate JSON is parseable (no validate function)
+ * jsonValidation();
+ * ```
+ */
+declare const jsonValidation: (config?: JsonValidationConfig | undefined) => Policy;
+
+export { type JsonValidationConfig, type JsonValidationResult, jsonValidation };

package/dist/policies/transform/json-validation.js

@@ -0,0 +1,125 @@
+import { GatewayError } from "../../core/errors";
+import { definePolicy, Priority } from "../sdk";
+const jsonValidation = /* @__PURE__ */ definePolicy({
+  name: "json-validation",
+  priority: Priority.AUTH,
+  phases: ["request-body"],
+  defaults: {
+    contentTypes: ["application/json"],
+    rejectStatus: 422,
+    errorDetail: true
+  },
+  handler: async (c, next, { config, debug }) => {
+    const contentType = c.req.header("content-type") ?? "";
+    const matchedType = config.contentTypes.some(
+      (ct) => contentType.includes(ct)
+    );
+    if (!matchedType) {
+      debug(
+        "skipping - content type %s not in %o",
+        contentType,
+        config.contentTypes
+      );
+      await next();
+      return;
+    }
+    let parsed;
+    try {
+      const cloned = c.req.raw.clone();
+      const text = await cloned.text();
+      if (!text) {
+        debug("empty body with JSON content type");
+        throw new GatewayError(
+          config.rejectStatus,
+          "validation_failed",
+          "Request body is empty"
+        );
+      }
+      parsed = JSON.parse(text);
+    } catch (err) {
+      if (err instanceof GatewayError) throw err;
+      debug("body parse failed");
+      throw new GatewayError(
+        config.rejectStatus,
+        "validation_failed",
+        "Request body is not valid JSON"
+      );
+    }
+    if (!config.validate) {
+      debug("no validator configured - JSON parsed successfully");
+      await next();
+      return;
+    }
+    const result = await config.validate(parsed);
+    if (!result.valid) {
+      const message = config.errorDetail && result.errors && result.errors.length > 0 ? `Validation failed: ${result.errors.join("; ")}` : "Validation failed";
+      debug("validation failed: %s", message);
+      throw new GatewayError(
+        config.rejectStatus,
+        "validation_failed",
+        message
+      );
+    }
+    debug("validation passed");
+    await next();
+  },
+  evaluate: {
+    onRequest: async (input, { config, debug }) => {
+      const contentType = input.headers.get("content-type") ?? "";
+      const matchedType = config.contentTypes.some(
+        (ct) => contentType.includes(ct)
+      );
+      if (!matchedType) {
+        debug(
+          "skipping - content type %s not in %o",
+          contentType,
+          config.contentTypes
+        );
+        return { action: "continue" };
+      }
+      let parsed;
+      try {
+        if (!input.body) {
+          debug("empty body with JSON content type");
+          return {
+            action: "reject",
+            status: config.rejectStatus,
+            code: "validation_failed",
+            message: "Request body is empty"
+          };
+        }
+        const bodyStr = typeof input.body === "string" ? input.body : new TextDecoder().decode(input.body);
+        parsed = JSON.parse(bodyStr);
+      } catch {
+        debug("body parse failed");
+        return {
+          action: "reject",
+          status: config.rejectStatus,
+          code: "validation_failed",
+          message: "Request body is not valid JSON"
+        };
+      }
+      if (!config.validate) {
+        debug("no validator configured - JSON parsed successfully");
+        return { action: "continue" };
+      }
+      const result = await config.validate(parsed);
+      if (!result.valid) {
+        const message = config.errorDetail && result.errors && result.errors.length > 0 ? `Validation failed: ${result.errors.join("; ")}` : "Validation failed";
+        debug("validation failed: %s", message);
+        return {
+          action: "reject",
+          status: config.rejectStatus,
+          code: "validation_failed",
+          message
+        };
+      }
+      debug("validation passed");
+      return { action: "continue" };
+    }
+  }
+});
+export {
+  jsonValidation
+};
+//# sourceMappingURL=json-validation.js.map

package/dist/policies/transform/json-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/policies/transform/json-validation.ts"],"sourcesContent":["/**\n * JSON body validation policy - pluggable validation with zero dependencies.\n *\n * Accepts a user-provided `validate` function that can wrap any validation\n * library (Zod, AJV, Valibot, TypeBox, etc.). When no validator is provided,\n * the policy simply checks that the request body is valid JSON.\n *\n * @module json-validation\n */\n\nimport { GatewayError } from \"../../core/errors\";\nimport { definePolicy, Priority } from \"../sdk\";\nimport type { PolicyConfig } from \"../types\";\n\n/** Result shape returned by the user-provided validation function. */\nexport interface JsonValidationResult {\n  valid: boolean;\n  errors?: string[];\n}\n\nexport interface JsonValidationConfig extends PolicyConfig {\n  /** Custom validation function. Takes parsed body, returns validation result. */\n  validate?: (\n    body: unknown\n  ) => JsonValidationResult | Promise<JsonValidationResult>;\n  /** Content types to validate. Default: [\"application/json\"] */\n  contentTypes?: string[];\n  /** HTTP status code on validation failure. Default: 422 */\n  rejectStatus?: number;\n  /** Include validation errors in response. Default: true */\n  errorDetail?: boolean;\n}\n\n/**\n * Pluggable JSON body validation policy.\n *\n * Validates the request body using a user-provided function. When no\n * `validate` function is configured, checks that the body is parseable JSON.\n * Requests with content types not in the configured list pass through\n * without validation.\n *\n * @example\n * ```ts\n * import { jsonValidation } from \"@vivero/stoma\";\n *\n * // With Zod\n * jsonValidation({\n *   validate: (body) => {\n *     const result = myZodSchema.safeParse(body);\n *     return {\n *       valid: result.success,\n *       errors: result.success ? undefined : result.error.issues.map(i => i.message),\n *     };\n *   },\n * });\n *\n * // Just validate JSON is parseable (no validate function)\n * jsonValidation();\n * ```\n */\nexport const jsonValidation = /*#__PURE__*/ definePolicy<JsonValidationConfig>({\n  name: \"json-validation\",\n  priority: Priority.AUTH,\n  phases: [\"request-body\"],\n  defaults: {\n    contentTypes: [\"application/json\"],\n    rejectStatus: 422,\n    errorDetail: true,\n  },\n  handler: async (c, next, { config, debug }) => {\n    const contentType = c.req.header(\"content-type\") ?? \"\";\n    const matchedType = config.contentTypes!.some((ct) =>\n      contentType.includes(ct)\n    );\n\n    if (!matchedType) {\n      debug(\n        \"skipping - content type %s not in %o\",\n        contentType,\n        config.contentTypes\n      );\n      await next();\n      return;\n    }\n\n    // Clone the request to avoid consuming the body stream for downstream handlers\n    let parsed: unknown;\n    try {\n      const cloned = c.req.raw.clone();\n      const text = await cloned.text();\n      if (!text) {\n        // Empty body with JSON content-type - treat as parse failure\n        debug(\"empty body with JSON content type\");\n        throw new GatewayError(\n          config.rejectStatus!,\n          \"validation_failed\",\n          \"Request body is empty\"\n        );\n      }\n      parsed = JSON.parse(text);\n    } catch (err) {\n      if (err instanceof GatewayError) throw err;\n      debug(\"body parse failed\");\n      throw new GatewayError(\n        config.rejectStatus!,\n        \"validation_failed\",\n        \"Request body is not valid JSON\"\n      );\n    }\n\n    // If no validate function provided, valid JSON parse is sufficient\n    if (!config.validate) {\n      debug(\"no validator configured - JSON parsed successfully\");\n      await next();\n      return;\n    }\n\n    const result = await config.validate(parsed);\n\n    if (!result.valid) {\n      const message =\n        config.errorDetail && result.errors && result.errors.length > 0\n          ? `Validation failed: ${result.errors.join(\"; \")}`\n          : \"Validation failed\";\n      debug(\"validation failed: %s\", message);\n      throw new GatewayError(\n        config.rejectStatus!,\n        \"validation_failed\",\n        message\n      );\n    }\n\n    debug(\"validation passed\");\n    await next();\n  },\n  evaluate: {\n    onRequest: async (input, { config, debug }) => {\n      const contentType = input.headers.get(\"content-type\") ?? \"\";\n      const matchedType = config.contentTypes!.some((ct) =>\n        contentType.includes(ct)\n      );\n\n      if (!matchedType) {\n        debug(\n          \"skipping - content type %s not in %o\",\n          contentType,\n          config.contentTypes\n        );\n        return { action: \"continue\" };\n      }\n\n      // Parse body\n      let parsed: unknown;\n      try {\n        if (!input.body) {\n          debug(\"empty body with JSON content type\");\n          return {\n            action: \"reject\",\n            status: config.rejectStatus!,\n            code: \"validation_failed\",\n            message: \"Request body is empty\",\n          };\n        }\n        const bodyStr =\n          typeof input.body === \"string\"\n            ? input.body\n            : new TextDecoder().decode(input.body);\n        parsed = JSON.parse(bodyStr);\n      } catch {\n        debug(\"body parse failed\");\n        return {\n          action: \"reject\",\n          status: config.rejectStatus!,\n          code: \"validation_failed\",\n          message: \"Request body is not valid JSON\",\n        };\n      }\n\n      // If no validate function provided, valid JSON parse is sufficient\n      if (!config.validate) {\n        debug(\"no validator configured - JSON parsed successfully\");\n        return { action: \"continue\" };\n      }\n\n      const result = await config.validate(parsed);\n\n      if (!result.valid) {\n        const message =\n          config.errorDetail && result.errors && result.errors.length > 0\n            ? `Validation failed: ${result.errors.join(\"; \")}`\n            : \"Validation failed\";\n        debug(\"validation failed: %s\", message);\n        return {\n          action: \"reject\",\n          status: config.rejectStatus!,\n          code: \"validation_failed\",\n          message,\n        };\n      }\n\n      debug(\"validation passed\");\n      return { action: \"continue\" };\n    },\n  },\n});\n"],"mappings":"AAUA,SAAS,oBAAoB;AAC7B,SAAS,cAAc,gBAAgB;AAiDhC,MAAM,iBAA+B,6BAAmC;AAAA,EAC7E,MAAM;AAAA,EACN,UAAU,SAAS;AAAA,EACnB,QAAQ,CAAC,cAAc;AAAA,EACvB,UAAU;AAAA,IACR,cAAc,CAAC,kBAAkB;AAAA,IACjC,cAAc;AAAA,IACd,aAAa;AAAA,EACf;AAAA,EACA,SAAS,OAAO,GAAG,MAAM,EAAE,QAAQ,MAAM,MAAM;AAC7C,UAAM,cAAc,EAAE,IAAI,OAAO,cAAc,KAAK;AACpD,UAAM,cAAc,OAAO,aAAc;AAAA,MAAK,CAAC,OAC7C,YAAY,SAAS,EAAE;AAAA,IACzB;AAEA,QAAI,CAAC,aAAa;AAChB;AAAA,QACE;AAAA,QACA;AAAA,QACA,OAAO;AAAA,MACT;AACA,YAAM,KAAK;AACX;AAAA,IACF;AAGA,QAAI;AACJ,QAAI;AACF,YAAM,SAAS,EAAE,IAAI,IAAI,MAAM;AAC/B,YAAM,OAAO,MAAM,OAAO,KAAK;AAC/B,UAAI,CAAC,MAAM;AAET,cAAM,mCAAmC;AACzC,cAAM,IAAI;AAAA,UACR,OAAO;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,eAAS,KAAK,MAAM,IAAI;AAAA,IAC1B,SAAS,KAAK;AACZ,UAAI,eAAe,aAAc,OAAM;AACvC,YAAM,mBAAmB;AACzB,YAAM,IAAI;AAAA,QACR,OAAO;AAAA,QACP;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAGA,QAAI,CAAC,OAAO,UAAU;AACpB,YAAM,oDAAoD;AAC1D,YAAM,KAAK;AACX;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,OAAO,SAAS,MAAM;AAE3C,QAAI,CAAC,OAAO,OAAO;AACjB,YAAM,UACJ,OAAO,eAAe,OAAO,UAAU,OAAO,OAAO,SAAS,IAC1D,sBAAsB,OAAO,OAAO,KAAK,IAAI,CAAC,KAC9C;AACN,YAAM,yBAAyB,OAAO;AACtC,YAAM,IAAI;AAAA,QACR,OAAO;AAAA,QACP;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,mBAAmB;AACzB,UAAM,KAAK;AAAA,EACb;AAAA,EACA,UAAU;AAAA,IACR,WAAW,OAAO,OAAO,EAAE,QAAQ,MAAM,MAAM;AAC7C,YAAM,cAAc,MAAM,QAAQ,IAAI,cAAc,KAAK;AACzD,YAAM,cAAc,OAAO,aAAc;AAAA,QAAK,CAAC,OAC7C,YAAY,SAAS,EAAE;AAAA,MACzB;AAEA,UAAI,CAAC,aAAa;AAChB;AAAA,UACE;AAAA,UACA;AAAA,UACA,OAAO;AAAA,QACT;AACA,eAAO,EAAE,QAAQ,WAAW;AAAA,MAC9B;AAGA,UAAI;AACJ,UAAI;AACF,YAAI,CAAC,MAAM,MAAM;AACf,gBAAM,mCAAmC;AACzC,iBAAO;AAAA,YACL,QAAQ;AAAA,YACR,QAAQ,OAAO;AAAA,YACf,MAAM;AAAA,YACN,SAAS;AAAA,UACX;AAAA,QACF;AACA,cAAM,UACJ,OAAO,MAAM,SAAS,WAClB,MAAM,OACN,IAAI,YAAY,EAAE,OAAO,MAAM,IAAI;AACzC,iBAAS,KAAK,MAAM,OAAO;AAAA,MAC7B,QAAQ;AACN,cAAM,mBAAmB;AACzB,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,QAAQ,OAAO;AAAA,UACf,MAAM;AAAA,UACN,SAAS;AAAA,QACX;AAAA,MACF;AAGA,UAAI,CAAC,OAAO,UAAU;AACpB,cAAM,oDAAoD;AAC1D,eAAO,EAAE,QAAQ,WAAW;AAAA,MAC9B;AAEA,YAAM,SAAS,MAAM,OAAO,SAAS,MAAM;AAE3C,UAAI,CAAC,OAAO,OAAO;AACjB,cAAM,UACJ,OAAO,eAAe,OAAO,UAAU,OAAO,OAAO,SAAS,IAC1D,sBAAsB,OAAO,OAAO,KAAK,IAAI,CAAC,KAC9C;AACN,cAAM,yBAAyB,OAAO;AACtC,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,QAAQ,OAAO;AAAA,UACf,MAAM;AAAA,UACN;AAAA,QACF;AAAA,MACF;AAEA,YAAM,mBAAmB;AACzB,aAAO,EAAE,QAAQ,WAAW;AAAA,IAC9B;AAAA,EACF;AACF,CAAC;","names":[]}

package/dist/policies/transform/override-method.d.ts

@@ -0,0 +1,33 @@
+import { g as PolicyConfig, P as Policy } from '../../protocol-2fD3DJrL.js';
+import 'hono';
+import '../sdk/trace.js';
+import '@vivero/stoma-core';
+
+interface OverrideMethodConfig extends PolicyConfig {
+    /** Header name to read the override method from. Default: `"X-HTTP-Method-Override"`. */
+    header?: string;
+    /** Methods allowed as overrides. Default: `["GET", "PUT", "PATCH", "DELETE"]`. */
+    allowedMethods?: string[];
+}
+/**
+ * Override the HTTP method of a POST request via a header.
+ *
+ * Only applies to POST requests - the industry-standard approach for
+ * tunneling other methods through POST. Non-POST requests with the
+ * override header are ignored.
+ *
+ * @param config - Header name and allowed override methods.
+ * @returns A policy at priority 5 (EARLY).
+ *
+ * @example
+ * ```ts
+ * // Default: reads X-HTTP-Method-Override header
+ * overrideMethod();
+ *
+ * // Custom header and restricted methods
+ * overrideMethod({ header: "X-Method", allowedMethods: ["PUT", "PATCH"] });
+ * ```
+ */
+declare const overrideMethod: (config?: OverrideMethodConfig | undefined) => Policy;
+
+export { type OverrideMethodConfig, overrideMethod };

package/dist/policies/transform/override-method.js

@@ -0,0 +1,48 @@
+import { GatewayError } from "../../core/errors";
+import { definePolicy, Priority } from "../sdk";
+const overrideMethod = /* @__PURE__ */ definePolicy({
+  name: "override-method",
+  priority: Priority.EARLY,
+  phases: ["request-headers"],
+  defaults: {
+    header: "X-HTTP-Method-Override",
+    allowedMethods: ["GET", "PUT", "PATCH", "DELETE"]
+  },
+  handler: async (c, next, { config, debug }) => {
+    const overrideValue = c.req.header(config.header);
+    if (!overrideValue) {
+      await next();
+      return;
+    }
+    if (c.req.method !== "POST") {
+      debug(`ignoring override on ${c.req.method} request`);
+      await next();
+      return;
+    }
+    const method = overrideValue.toUpperCase();
+    const allowed = new Set(
+      (config.allowedMethods ?? []).map((m) => m.toUpperCase())
+    );
+    if (!allowed.has(method)) {
+      throw new GatewayError(
+        400,
+        "invalid_method_override",
+        `Method override not allowed: ${method}`
+      );
+    }
+    debug(`overriding POST \u2192 ${method}`);
+    const newReq = new Request(c.req.url, {
+      method,
+      headers: c.req.raw.headers,
+      body: c.req.raw.body,
+      // @ts-expect-error -- duplex is required for streams but not in all type definitions
+      duplex: "half"
+    });
+    Object.defineProperty(c.req, "raw", { value: newReq, configurable: true });
+    await next();
+  }
+});
+export {
+  overrideMethod
+};
+//# sourceMappingURL=override-method.js.map

package/dist/policies/transform/override-method.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/policies/transform/override-method.ts"],"sourcesContent":["/**\n * HTTP method override policy.\n *\n * Allows clients to tunnel PUT/PATCH/DELETE through POST requests\n * using a configurable header (default `X-HTTP-Method-Override`).\n * This is useful when firewalls, proxies, or browser limitations\n * prevent the use of certain HTTP methods.\n *\n * @module override-method\n */\nimport { GatewayError } from \"../../core/errors\";\nimport { definePolicy, Priority } from \"../sdk\";\nimport type { PolicyConfig } from \"../types\";\n\nexport interface OverrideMethodConfig extends PolicyConfig {\n  /** Header name to read the override method from. Default: `\"X-HTTP-Method-Override\"`. */\n  header?: string;\n  /** Methods allowed as overrides. Default: `[\"GET\", \"PUT\", \"PATCH\", \"DELETE\"]`. */\n  allowedMethods?: string[];\n}\n\n/**\n * Override the HTTP method of a POST request via a header.\n *\n * Only applies to POST requests - the industry-standard approach for\n * tunneling other methods through POST. Non-POST requests with the\n * override header are ignored.\n *\n * @param config - Header name and allowed override methods.\n * @returns A policy at priority 5 (EARLY).\n *\n * @example\n * ```ts\n * // Default: reads X-HTTP-Method-Override header\n * overrideMethod();\n *\n * // Custom header and restricted methods\n * overrideMethod({ header: \"X-Method\", allowedMethods: [\"PUT\", \"PATCH\"] });\n * ```\n */\nexport const overrideMethod = /*#__PURE__*/ definePolicy<OverrideMethodConfig>({\n  name: \"override-method\",\n  priority: Priority.EARLY,\n  phases: [\"request-headers\"],\n  defaults: {\n    header: \"X-HTTP-Method-Override\",\n    allowedMethods: [\"GET\", \"PUT\", \"PATCH\", \"DELETE\"],\n  },\n  handler: async (c, next, { config, debug }) => {\n    const overrideValue = c.req.header(config.header!);\n\n    if (!overrideValue) {\n      await next();\n      return;\n    }\n\n    // Only override POST requests\n    if (c.req.method !== \"POST\") {\n      debug(`ignoring override on ${c.req.method} request`);\n      await next();\n      return;\n    }\n\n    const method = overrideValue.toUpperCase();\n    const allowed = new Set(\n      (config.allowedMethods ?? []).map((m) => m.toUpperCase())\n    );\n\n    if (!allowed.has(method)) {\n      throw new GatewayError(\n        400,\n        \"invalid_method_override\",\n        `Method override not allowed: ${method}`\n      );\n    }\n\n    debug(`overriding POST → ${method}`);\n\n    // Override the method by replacing the raw Request object\n    const newReq = new Request(c.req.url, {\n      method,\n      headers: c.req.raw.headers,\n      body: c.req.raw.body,\n      // @ts-expect-error -- duplex is required for streams but not in all type definitions\n      duplex: \"half\",\n    });\n    Object.defineProperty(c.req, \"raw\", { value: newReq, configurable: true });\n\n    await next();\n  },\n});\n"],"mappings":"AAUA,SAAS,oBAAoB;AAC7B,SAAS,cAAc,gBAAgB;AA6BhC,MAAM,iBAA+B,6BAAmC;AAAA,EAC7E,MAAM;AAAA,EACN,UAAU,SAAS;AAAA,EACnB,QAAQ,CAAC,iBAAiB;AAAA,EAC1B,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,gBAAgB,CAAC,OAAO,OAAO,SAAS,QAAQ;AAAA,EAClD;AAAA,EACA,SAAS,OAAO,GAAG,MAAM,EAAE,QAAQ,MAAM,MAAM;AAC7C,UAAM,gBAAgB,EAAE,IAAI,OAAO,OAAO,MAAO;AAEjD,QAAI,CAAC,eAAe;AAClB,YAAM,KAAK;AACX;AAAA,IACF;AAGA,QAAI,EAAE,IAAI,WAAW,QAAQ;AAC3B,YAAM,wBAAwB,EAAE,IAAI,MAAM,UAAU;AACpD,YAAM,KAAK;AACX;AAAA,IACF;AAEA,UAAM,SAAS,cAAc,YAAY;AACzC,UAAM,UAAU,IAAI;AAAA,OACjB,OAAO,kBAAkB,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC;AAAA,IAC1D;AAEA,QAAI,CAAC,QAAQ,IAAI,MAAM,GAAG;AACxB,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA,gCAAgC,MAAM;AAAA,MACxC;AAAA,IACF;AAEA,UAAM,0BAAqB,MAAM,EAAE;AAGnC,UAAM,SAAS,IAAI,QAAQ,EAAE,IAAI,KAAK;AAAA,MACpC;AAAA,MACA,SAAS,EAAE,IAAI,IAAI;AAAA,MACnB,MAAM,EAAE,IAAI,IAAI;AAAA;AAAA,MAEhB,QAAQ;AAAA,IACV,CAAC;AACD,WAAO,eAAe,EAAE,KAAK,OAAO,EAAE,OAAO,QAAQ,cAAc,KAAK,CAAC;AAEzE,UAAM,KAAK;AAAA,EACb;AACF,CAAC;","names":[]}

package/dist/policies/transform/request-validation.d.ts

@@ -0,0 +1,59 @@
+import { g as PolicyConfig, P as Policy } from '../../protocol-2fD3DJrL.js';
+import 'hono';
+import '../sdk/trace.js';
+import '@vivero/stoma-core';
+
+/** Result shape returned by validation functions that provide error details. */
+interface ValidationResult {
+    valid: boolean;
+    errors?: string[];
+}
+interface RequestValidationConfig extends PolicyConfig {
+    /**
+     * Synchronous validation function.
+     * Return `true`/`false` or an object with optional error details.
+     */
+    validate?: (body: unknown) => boolean | ValidationResult;
+    /**
+     * Async validation function (e.g., for remote schema validation).
+     * If both `validate` and `validateAsync` are provided, `validateAsync` takes precedence.
+     */
+    validateAsync?: (body: unknown) => Promise<boolean | ValidationResult>;
+    /**
+     * Only validate these content types.
+     * Requests with other content types pass through without validation.
+     * Default: `["application/json"]`.
+     */
+    contentTypes?: string[];
+    /** Custom error message prefix. Default: `"Request validation failed"`. */
+    errorMessage?: string;
+}
+/**
+ * Pluggable request body validation policy.
+ *
+ * Validates the request body using a user-provided sync or async function.
+ * Requests with content types not in the configured list pass through
+ * without validation.
+ *
+ * @example
+ * ```ts
+ * import { requestValidation } from "@vivero/stoma";
+ *
+ * // Simple boolean validator
+ * requestValidation({
+ *   validate: (body) => body != null && typeof body === "object",
+ * });
+ *
+ * // Detailed validation with error messages
+ * requestValidation({
+ *   validate: (body) => {
+ *     const errors: string[] = [];
+ *     if (!body || typeof body !== "object") errors.push("Body must be an object");
+ *     return { valid: errors.length === 0, errors };
+ *   },
+ * });
+ * ```
+ */
+declare const requestValidation: (config?: RequestValidationConfig | undefined) => Policy;
+
+export { type RequestValidationConfig, requestValidation };