hono 4.3.11 → 4.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (188) hide show
  1. package/README.md +2 -3
  2. package/dist/adapter/aws-lambda/handler.js +12 -9
  3. package/dist/adapter/bun/conninfo.js +21 -0
  4. package/dist/adapter/bun/index.js +2 -0
  5. package/dist/adapter/bun/websocket.js +1 -3
  6. package/dist/adapter/cloudflare-workers/conninfo.js +10 -0
  7. package/dist/adapter/cloudflare-workers/websocket.js +2 -6
  8. package/dist/adapter/deno/conninfo.js +15 -0
  9. package/dist/adapter/deno/index.js +2 -0
  10. package/dist/adapter/lambda-edge/handler.js +3 -3
  11. package/dist/cjs/adapter/aws-lambda/handler.js +12 -9
  12. package/dist/cjs/adapter/bun/conninfo.js +44 -0
  13. package/dist/cjs/adapter/bun/index.js +3 -0
  14. package/dist/cjs/adapter/cloudflare-workers/conninfo.js +33 -0
  15. package/dist/cjs/adapter/cloudflare-workers/websocket.js +2 -6
  16. package/dist/cjs/adapter/deno/conninfo.js +38 -0
  17. package/dist/cjs/adapter/deno/index.js +3 -0
  18. package/dist/cjs/adapter/lambda-edge/handler.js +3 -3
  19. package/dist/cjs/helper/conninfo/index.js +16 -0
  20. package/dist/cjs/helper/ssg/ssg.js +64 -3
  21. package/dist/cjs/helper/streaming/text.js +1 -1
  22. package/dist/cjs/hono-base.js +10 -6
  23. package/dist/cjs/jsx/base.js +5 -2
  24. package/dist/cjs/jsx/dom/client.js +68 -0
  25. package/dist/cjs/jsx/dom/index.js +8 -4
  26. package/dist/cjs/jsx/dom/jsx-dev-runtime.js +6 -20
  27. package/dist/cjs/jsx/dom/render.js +41 -25
  28. package/dist/cjs/jsx/dom/utils.js +15 -0
  29. package/dist/cjs/jsx/hooks/index.js +4 -1
  30. package/dist/cjs/jsx/index.js +8 -4
  31. package/dist/cjs/middleware/jwt/index.js +5 -82
  32. package/dist/cjs/middleware/jwt/jwt.js +111 -0
  33. package/dist/cjs/middleware/secure-headers/index.js +3 -123
  34. package/dist/cjs/middleware/secure-headers/secure-headers.js +150 -0
  35. package/dist/cjs/middleware/timeout/index.js +48 -0
  36. package/dist/cjs/middleware/timing/index.js +5 -89
  37. package/dist/cjs/middleware/timing/timing.js +118 -0
  38. package/dist/cjs/utils/body.js +34 -9
  39. package/dist/cjs/utils/jwt/jws.js +4 -5
  40. package/dist/cjs/utils/jwt/jwt.js +6 -7
  41. package/dist/cjs/utils/url.js +26 -2
  42. package/dist/helper/css/index.js +4 -4
  43. package/dist/helper/html/index.js +1 -1
  44. package/dist/helper/ssg/ssg.js +63 -5
  45. package/dist/helper/streaming/text.js +1 -1
  46. package/dist/hono-base.js +11 -7
  47. package/dist/jsx/base.js +3 -1
  48. package/dist/jsx/dom/client.js +44 -0
  49. package/dist/jsx/dom/css.js +4 -4
  50. package/dist/jsx/dom/index.js +25 -21
  51. package/dist/jsx/dom/jsx-dev-runtime.js +6 -20
  52. package/dist/jsx/dom/render.js +40 -26
  53. package/dist/jsx/dom/utils.js +14 -0
  54. package/dist/jsx/hooks/index.js +4 -2
  55. package/dist/jsx/index.js +22 -18
  56. package/dist/jsx/jsx-runtime.js +1 -1
  57. package/dist/middleware/jsx-renderer/index.js +1 -1
  58. package/dist/middleware/jwt/index.js +1 -78
  59. package/dist/middleware/jwt/jwt.js +85 -0
  60. package/dist/middleware/secure-headers/index.js +1 -121
  61. package/dist/middleware/secure-headers/secure-headers.js +126 -0
  62. package/dist/middleware/timeout/index.js +25 -0
  63. package/dist/middleware/timing/index.js +1 -85
  64. package/dist/middleware/timing/timing.js +92 -0
  65. package/dist/request.js +1 -1
  66. package/dist/router/reg-exp-router/router.js +2 -2
  67. package/dist/router/smart-router/router.js +1 -1
  68. package/dist/router/trie-router/node.js +1 -1
  69. package/dist/types/adapter/aws-lambda/handler.d.ts +3 -3
  70. package/dist/types/adapter/aws-lambda/index.d.ts +4 -0
  71. package/dist/types/adapter/bun/conninfo.d.ts +7 -0
  72. package/dist/types/adapter/bun/index.d.ts +5 -0
  73. package/dist/types/adapter/bun/websocket.d.ts +2 -3
  74. package/dist/types/adapter/cloudflare-pages/index.d.ts +4 -0
  75. package/dist/types/adapter/cloudflare-workers/conninfo.d.ts +2 -0
  76. package/dist/types/adapter/cloudflare-workers/index.d.ts +4 -0
  77. package/dist/types/adapter/cloudflare-workers/serve-static-module.d.ts +2 -2
  78. package/dist/types/adapter/cloudflare-workers/serve-static.d.ts +1 -2
  79. package/dist/types/adapter/cloudflare-workers/utils.d.ts +1 -2
  80. package/dist/types/adapter/deno/conninfo.d.ts +7 -0
  81. package/dist/types/adapter/deno/index.d.ts +5 -0
  82. package/dist/types/adapter/lambda-edge/handler.d.ts +1 -2
  83. package/dist/types/adapter/lambda-edge/index.d.ts +4 -0
  84. package/dist/types/adapter/netlify/handler.d.ts +1 -7
  85. package/dist/types/adapter/netlify/index.d.ts +4 -0
  86. package/dist/types/adapter/netlify/mod.d.ts +0 -1
  87. package/dist/types/adapter/vercel/index.d.ts +4 -0
  88. package/dist/types/client/index.d.ts +4 -0
  89. package/dist/types/compose.d.ts +1 -1
  90. package/dist/types/helper/accepts/index.d.ts +4 -0
  91. package/dist/types/helper/adapter/index.d.ts +4 -0
  92. package/dist/types/helper/conninfo/index.d.ts +40 -0
  93. package/dist/types/helper/cookie/index.d.ts +5 -1
  94. package/dist/types/helper/css/index.d.ts +4 -0
  95. package/dist/types/helper/dev/index.d.ts +4 -0
  96. package/dist/types/helper/factory/index.d.ts +4 -0
  97. package/dist/types/helper/html/index.d.ts +4 -0
  98. package/dist/types/helper/ssg/index.d.ts +4 -0
  99. package/dist/types/helper/ssg/ssg.d.ts +6 -3
  100. package/dist/types/helper/streaming/index.d.ts +4 -0
  101. package/dist/types/helper/testing/index.d.ts +4 -0
  102. package/dist/types/helper/websocket/index.d.ts +4 -0
  103. package/dist/types/hono-base.d.ts +15 -15
  104. package/dist/types/http-exception.d.ts +4 -0
  105. package/dist/types/index.d.ts +15 -0
  106. package/dist/types/jsx/base.d.ts +10 -11
  107. package/dist/types/jsx/components.d.ts +1 -1
  108. package/dist/types/jsx/context.d.ts +1 -1
  109. package/dist/types/jsx/dom/client.d.ts +26 -0
  110. package/dist/types/jsx/dom/components.d.ts +2 -2
  111. package/dist/types/jsx/dom/css.d.ts +31 -20
  112. package/dist/types/jsx/dom/index.d.ts +13 -7
  113. package/dist/types/jsx/dom/jsx-dev-runtime.d.ts +5 -1
  114. package/dist/types/jsx/dom/jsx-runtime.d.ts +4 -0
  115. package/dist/types/jsx/dom/render.d.ts +4 -3
  116. package/dist/types/jsx/dom/utils.d.ts +6 -0
  117. package/dist/types/jsx/hooks/index.d.ts +4 -0
  118. package/dist/types/jsx/index.d.ts +13 -7
  119. package/dist/types/jsx/intrinsic-elements.d.ts +629 -630
  120. package/dist/types/jsx/jsx-dev-runtime.d.ts +5 -0
  121. package/dist/types/jsx/jsx-runtime.d.ts +5 -0
  122. package/dist/types/jsx/streaming.d.ts +5 -1
  123. package/dist/types/jsx/types.d.ts +1 -0
  124. package/dist/types/middleware/basic-auth/index.d.ts +35 -0
  125. package/dist/types/middleware/bearer-auth/index.d.ts +33 -0
  126. package/dist/types/middleware/body-limit/index.d.ts +28 -11
  127. package/dist/types/middleware/cache/index.d.ts +29 -0
  128. package/dist/types/middleware/compress/index.d.ts +20 -0
  129. package/dist/types/middleware/cors/index.d.ts +43 -0
  130. package/dist/types/middleware/csrf/index.d.ts +41 -0
  131. package/dist/types/middleware/etag/index.d.ts +24 -0
  132. package/dist/types/middleware/jsx-renderer/index.d.ts +63 -2
  133. package/dist/types/middleware/jwt/index.d.ts +5 -17
  134. package/dist/types/middleware/jwt/jwt.d.ts +48 -0
  135. package/dist/types/middleware/logger/index.d.ts +20 -0
  136. package/dist/types/middleware/method-override/index.d.ts +22 -10
  137. package/dist/types/middleware/powered-by/index.d.ts +4 -0
  138. package/dist/types/middleware/pretty-json/index.d.ts +23 -0
  139. package/dist/types/middleware/secure-headers/index.d.ts +6 -64
  140. package/dist/types/middleware/secure-headers/secure-headers.d.ts +97 -0
  141. package/dist/types/middleware/serve-static/index.d.ts +4 -0
  142. package/dist/types/middleware/timeout/index.d.ts +31 -0
  143. package/dist/types/middleware/timing/index.d.ts +5 -29
  144. package/dist/types/middleware/timing/timing.d.ts +111 -0
  145. package/dist/types/middleware/trailing-slash/index.d.ts +29 -5
  146. package/dist/types/preset/quick.d.ts +4 -0
  147. package/dist/types/preset/tiny.d.ts +4 -0
  148. package/dist/types/request.d.ts +5 -4
  149. package/dist/types/router/linear-router/index.d.ts +4 -0
  150. package/dist/types/router/linear-router/router.d.ts +1 -1
  151. package/dist/types/router/pattern-router/index.d.ts +4 -0
  152. package/dist/types/router/reg-exp-router/index.d.ts +4 -0
  153. package/dist/types/router/reg-exp-router/router.d.ts +1 -1
  154. package/dist/types/router/reg-exp-router/trie.d.ts +1 -1
  155. package/dist/types/router/smart-router/index.d.ts +4 -0
  156. package/dist/types/router/smart-router/router.d.ts +1 -1
  157. package/dist/types/router/trie-router/index.d.ts +4 -0
  158. package/dist/types/router.d.ts +4 -0
  159. package/dist/types/types.d.ts +4 -0
  160. package/dist/types/utils/body.d.ts +61 -3
  161. package/dist/types/utils/buffer.d.ts +4 -0
  162. package/dist/types/utils/color.d.ts +4 -0
  163. package/dist/types/utils/concurrent.d.ts +4 -0
  164. package/dist/types/utils/cookie.d.ts +4 -0
  165. package/dist/types/utils/crypto.d.ts +4 -0
  166. package/dist/types/utils/encode.d.ts +4 -0
  167. package/dist/types/utils/filepath.d.ts +4 -0
  168. package/dist/types/utils/handler.d.ts +4 -0
  169. package/dist/types/utils/html.d.ts +4 -0
  170. package/dist/types/utils/http-status.d.ts +4 -0
  171. package/dist/types/utils/jwt/index.d.ts +4 -0
  172. package/dist/types/utils/jwt/jwt.d.ts +3 -3
  173. package/dist/types/utils/mime.d.ts +4 -0
  174. package/dist/types/utils/stream.d.ts +4 -0
  175. package/dist/types/utils/types.d.ts +4 -0
  176. package/dist/types/utils/url.d.ts +4 -0
  177. package/dist/types/validator/index.d.ts +4 -0
  178. package/dist/types/validator/validator.d.ts +1 -1
  179. package/dist/utils/body.js +34 -9
  180. package/dist/utils/jwt/index.js +1 -1
  181. package/dist/utils/jwt/jws.js +1 -2
  182. package/dist/utils/jwt/jwt.js +5 -5
  183. package/dist/utils/url.js +26 -2
  184. package/package.json +27 -6
  185. package/dist/cjs/adapter/aws-lambda/awslambda.d.js +0 -1
  186. package/dist/cjs/helper.js +0 -44
  187. package/dist/helper.js +0 -18
  188. /package/dist/{adapter/aws-lambda/awslambda.d.js → helper/conninfo/index.js} +0 -0
@@ -0,0 +1,111 @@
1
+ "use strict";
2
+ var __defProp = Object.defineProperty;
3
+ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
4
+ var __getOwnPropNames = Object.getOwnPropertyNames;
5
+ var __hasOwnProp = Object.prototype.hasOwnProperty;
6
+ var __export = (target, all) => {
7
+ for (var name in all)
8
+ __defProp(target, name, { get: all[name], enumerable: true });
9
+ };
10
+ var __copyProps = (to, from, except, desc) => {
11
+ if (from && typeof from === "object" || typeof from === "function") {
12
+ for (let key of __getOwnPropNames(from))
13
+ if (!__hasOwnProp.call(to, key) && key !== except)
14
+ __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
15
+ }
16
+ return to;
17
+ };
18
+ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
19
+ var jwt_exports = {};
20
+ __export(jwt_exports, {
21
+ decode: () => decode,
22
+ jwt: () => jwt,
23
+ sign: () => sign,
24
+ verify: () => verify
25
+ });
26
+ module.exports = __toCommonJS(jwt_exports);
27
+ var import_cookie = require("../../helper/cookie");
28
+ var import_http_exception = require("../../http-exception");
29
+ var import_jwt = require("../../utils/jwt");
30
+ var import_context = require("../../context");
31
+ const jwt = (options) => {
32
+ if (!options || !options.secret) {
33
+ throw new Error('JWT auth middleware requires options for "secret"');
34
+ }
35
+ if (!crypto.subtle || !crypto.subtle.importKey) {
36
+ throw new Error("`crypto.subtle.importKey` is undefined. JWT auth middleware requires it.");
37
+ }
38
+ return async function jwt2(ctx, next) {
39
+ const credentials = ctx.req.raw.headers.get("Authorization");
40
+ let token;
41
+ if (credentials) {
42
+ const parts = credentials.split(/\s+/);
43
+ if (parts.length !== 2) {
44
+ const errDescription = "invalid credentials structure";
45
+ throw new import_http_exception.HTTPException(401, {
46
+ message: errDescription,
47
+ res: unauthorizedResponse({
48
+ ctx,
49
+ error: "invalid_request",
50
+ errDescription
51
+ })
52
+ });
53
+ } else {
54
+ token = parts[1];
55
+ }
56
+ } else if (options.cookie) {
57
+ token = (0, import_cookie.getCookie)(ctx)[options.cookie];
58
+ }
59
+ if (!token) {
60
+ const errDescription = "no authorization included in request";
61
+ throw new import_http_exception.HTTPException(401, {
62
+ message: errDescription,
63
+ res: unauthorizedResponse({
64
+ ctx,
65
+ error: "invalid_request",
66
+ errDescription
67
+ })
68
+ });
69
+ }
70
+ let payload;
71
+ let cause;
72
+ try {
73
+ payload = await import_jwt.Jwt.verify(token, options.secret, options.alg);
74
+ } catch (e) {
75
+ cause = e;
76
+ }
77
+ if (!payload) {
78
+ throw new import_http_exception.HTTPException(401, {
79
+ message: "Unauthorized",
80
+ res: unauthorizedResponse({
81
+ ctx,
82
+ error: "invalid_token",
83
+ statusText: "Unauthorized",
84
+ errDescription: "token verification failure"
85
+ }),
86
+ cause
87
+ });
88
+ }
89
+ ctx.set("jwtPayload", payload);
90
+ await next();
91
+ };
92
+ };
93
+ function unauthorizedResponse(opts) {
94
+ return new Response("Unauthorized", {
95
+ status: 401,
96
+ statusText: opts.statusText,
97
+ headers: {
98
+ "WWW-Authenticate": `Bearer realm="${opts.ctx.req.url}",error="${opts.error}",error_description="${opts.errDescription}"`
99
+ }
100
+ });
101
+ }
102
+ const verify = import_jwt.Jwt.verify;
103
+ const decode = import_jwt.Jwt.decode;
104
+ const sign = import_jwt.Jwt.sign;
105
+ // Annotate the CommonJS export names for ESM import in node:
106
+ 0 && (module.exports = {
107
+ decode,
108
+ jwt,
109
+ sign,
110
+ verify
111
+ });
@@ -18,131 +18,11 @@ var __copyProps = (to, from, except, desc) => {
18
18
  var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
19
19
  var secure_headers_exports = {};
20
20
  __export(secure_headers_exports, {
21
- NONCE: () => NONCE,
22
- secureHeaders: () => secureHeaders
21
+ NONCE: () => import_secure_headers.NONCE,
22
+ secureHeaders: () => import_secure_headers.secureHeaders
23
23
  });
24
24
  module.exports = __toCommonJS(secure_headers_exports);
25
- var import_encode = require("../../utils/encode");
26
- const HEADERS_MAP = {
27
- crossOriginEmbedderPolicy: ["Cross-Origin-Embedder-Policy", "require-corp"],
28
- crossOriginResourcePolicy: ["Cross-Origin-Resource-Policy", "same-origin"],
29
- crossOriginOpenerPolicy: ["Cross-Origin-Opener-Policy", "same-origin"],
30
- originAgentCluster: ["Origin-Agent-Cluster", "?1"],
31
- referrerPolicy: ["Referrer-Policy", "no-referrer"],
32
- strictTransportSecurity: ["Strict-Transport-Security", "max-age=15552000; includeSubDomains"],
33
- xContentTypeOptions: ["X-Content-Type-Options", "nosniff"],
34
- xDnsPrefetchControl: ["X-DNS-Prefetch-Control", "off"],
35
- xDownloadOptions: ["X-Download-Options", "noopen"],
36
- xFrameOptions: ["X-Frame-Options", "SAMEORIGIN"],
37
- xPermittedCrossDomainPolicies: ["X-Permitted-Cross-Domain-Policies", "none"],
38
- xXssProtection: ["X-XSS-Protection", "0"]
39
- };
40
- const DEFAULT_OPTIONS = {
41
- crossOriginEmbedderPolicy: false,
42
- crossOriginResourcePolicy: true,
43
- crossOriginOpenerPolicy: true,
44
- originAgentCluster: true,
45
- referrerPolicy: true,
46
- strictTransportSecurity: true,
47
- xContentTypeOptions: true,
48
- xDnsPrefetchControl: true,
49
- xDownloadOptions: true,
50
- xFrameOptions: true,
51
- xPermittedCrossDomainPolicies: true,
52
- xXssProtection: true
53
- };
54
- const generateNonce = () => {
55
- const buffer = new Uint8Array(16);
56
- crypto.getRandomValues(buffer);
57
- return (0, import_encode.encodeBase64)(buffer);
58
- };
59
- const NONCE = (ctx) => {
60
- const nonce = ctx.get("secureHeadersNonce") || (() => {
61
- const newNonce = generateNonce();
62
- ctx.set("secureHeadersNonce", newNonce);
63
- return newNonce;
64
- })();
65
- return `'nonce-${nonce}'`;
66
- };
67
- const secureHeaders = (customOptions) => {
68
- const options = { ...DEFAULT_OPTIONS, ...customOptions };
69
- const headersToSet = getFilteredHeaders(options);
70
- const callbacks = [];
71
- if (options.contentSecurityPolicy) {
72
- const [callback, value] = getCSPDirectives(options.contentSecurityPolicy);
73
- if (callback) {
74
- callbacks.push(callback);
75
- }
76
- headersToSet.push(["Content-Security-Policy", value]);
77
- }
78
- if (options.reportingEndpoints) {
79
- headersToSet.push(["Reporting-Endpoints", getReportingEndpoints(options.reportingEndpoints)]);
80
- }
81
- if (options.reportTo) {
82
- headersToSet.push(["Report-To", getReportToOptions(options.reportTo)]);
83
- }
84
- return async function secureHeaders2(ctx, next) {
85
- const headersToSetForReq = callbacks.length === 0 ? headersToSet : callbacks.reduce((acc, cb) => cb(ctx, acc), headersToSet);
86
- await next();
87
- setHeaders(ctx, headersToSetForReq);
88
- ctx.res.headers.delete("X-Powered-By");
89
- };
90
- };
91
- function getFilteredHeaders(options) {
92
- return Object.entries(HEADERS_MAP).filter(([key]) => options[key]).map(([key, defaultValue]) => {
93
- const overrideValue = options[key];
94
- return typeof overrideValue === "string" ? [defaultValue[0], overrideValue] : defaultValue;
95
- });
96
- }
97
- function getCSPDirectives(contentSecurityPolicy) {
98
- const callbacks = [];
99
- const resultValues = [];
100
- for (const [directive, value] of Object.entries(contentSecurityPolicy)) {
101
- const valueArray = Array.isArray(value) ? value : [value];
102
- valueArray.forEach((value2, i) => {
103
- if (typeof value2 === "function") {
104
- const index = i * 2 + 2 + resultValues.length;
105
- callbacks.push((ctx, values) => {
106
- values[index] = value2(ctx, directive);
107
- });
108
- }
109
- });
110
- resultValues.push(
111
- directive.replace(
112
- /[A-Z]+(?![a-z])|[A-Z]/g,
113
- (match, offset) => offset ? "-" + match.toLowerCase() : match.toLowerCase()
114
- ),
115
- ...valueArray.flatMap((value2) => [" ", value2]),
116
- "; "
117
- );
118
- }
119
- resultValues.pop();
120
- return callbacks.length === 0 ? [void 0, resultValues.join("")] : [
121
- (ctx, headersToSet) => headersToSet.map((values) => {
122
- if (values[0] === "Content-Security-Policy") {
123
- const clone = values[1].slice();
124
- callbacks.forEach((cb) => {
125
- cb(ctx, clone);
126
- });
127
- return [values[0], clone.join("")];
128
- } else {
129
- return values;
130
- }
131
- }),
132
- resultValues
133
- ];
134
- }
135
- function getReportingEndpoints(reportingEndpoints = []) {
136
- return reportingEndpoints.map((endpoint) => `${endpoint.name}="${endpoint.url}"`).join(", ");
137
- }
138
- function getReportToOptions(reportTo = []) {
139
- return reportTo.map((option) => JSON.stringify(option)).join(", ");
140
- }
141
- function setHeaders(ctx, headersToSet) {
142
- headersToSet.forEach(([header, value]) => {
143
- ctx.res.headers.set(header, value);
144
- });
145
- }
25
+ var import_secure_headers = require("./secure-headers");
146
26
  // Annotate the CommonJS export names for ESM import in node:
147
27
  0 && (module.exports = {
148
28
  NONCE,
@@ -0,0 +1,150 @@
1
+ "use strict";
2
+ var __defProp = Object.defineProperty;
3
+ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
4
+ var __getOwnPropNames = Object.getOwnPropertyNames;
5
+ var __hasOwnProp = Object.prototype.hasOwnProperty;
6
+ var __export = (target, all) => {
7
+ for (var name in all)
8
+ __defProp(target, name, { get: all[name], enumerable: true });
9
+ };
10
+ var __copyProps = (to, from, except, desc) => {
11
+ if (from && typeof from === "object" || typeof from === "function") {
12
+ for (let key of __getOwnPropNames(from))
13
+ if (!__hasOwnProp.call(to, key) && key !== except)
14
+ __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
15
+ }
16
+ return to;
17
+ };
18
+ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
19
+ var secure_headers_exports = {};
20
+ __export(secure_headers_exports, {
21
+ NONCE: () => NONCE,
22
+ secureHeaders: () => secureHeaders
23
+ });
24
+ module.exports = __toCommonJS(secure_headers_exports);
25
+ var import_encode = require("../../utils/encode");
26
+ const HEADERS_MAP = {
27
+ crossOriginEmbedderPolicy: ["Cross-Origin-Embedder-Policy", "require-corp"],
28
+ crossOriginResourcePolicy: ["Cross-Origin-Resource-Policy", "same-origin"],
29
+ crossOriginOpenerPolicy: ["Cross-Origin-Opener-Policy", "same-origin"],
30
+ originAgentCluster: ["Origin-Agent-Cluster", "?1"],
31
+ referrerPolicy: ["Referrer-Policy", "no-referrer"],
32
+ strictTransportSecurity: ["Strict-Transport-Security", "max-age=15552000; includeSubDomains"],
33
+ xContentTypeOptions: ["X-Content-Type-Options", "nosniff"],
34
+ xDnsPrefetchControl: ["X-DNS-Prefetch-Control", "off"],
35
+ xDownloadOptions: ["X-Download-Options", "noopen"],
36
+ xFrameOptions: ["X-Frame-Options", "SAMEORIGIN"],
37
+ xPermittedCrossDomainPolicies: ["X-Permitted-Cross-Domain-Policies", "none"],
38
+ xXssProtection: ["X-XSS-Protection", "0"]
39
+ };
40
+ const DEFAULT_OPTIONS = {
41
+ crossOriginEmbedderPolicy: false,
42
+ crossOriginResourcePolicy: true,
43
+ crossOriginOpenerPolicy: true,
44
+ originAgentCluster: true,
45
+ referrerPolicy: true,
46
+ strictTransportSecurity: true,
47
+ xContentTypeOptions: true,
48
+ xDnsPrefetchControl: true,
49
+ xDownloadOptions: true,
50
+ xFrameOptions: true,
51
+ xPermittedCrossDomainPolicies: true,
52
+ xXssProtection: true
53
+ };
54
+ const generateNonce = () => {
55
+ const buffer = new Uint8Array(16);
56
+ crypto.getRandomValues(buffer);
57
+ return (0, import_encode.encodeBase64)(buffer);
58
+ };
59
+ const NONCE = (ctx) => {
60
+ const nonce = ctx.get("secureHeadersNonce") || (() => {
61
+ const newNonce = generateNonce();
62
+ ctx.set("secureHeadersNonce", newNonce);
63
+ return newNonce;
64
+ })();
65
+ return `'nonce-${nonce}'`;
66
+ };
67
+ const secureHeaders = (customOptions) => {
68
+ const options = { ...DEFAULT_OPTIONS, ...customOptions };
69
+ const headersToSet = getFilteredHeaders(options);
70
+ const callbacks = [];
71
+ if (options.contentSecurityPolicy) {
72
+ const [callback, value] = getCSPDirectives(options.contentSecurityPolicy);
73
+ if (callback) {
74
+ callbacks.push(callback);
75
+ }
76
+ headersToSet.push(["Content-Security-Policy", value]);
77
+ }
78
+ if (options.reportingEndpoints) {
79
+ headersToSet.push(["Reporting-Endpoints", getReportingEndpoints(options.reportingEndpoints)]);
80
+ }
81
+ if (options.reportTo) {
82
+ headersToSet.push(["Report-To", getReportToOptions(options.reportTo)]);
83
+ }
84
+ return async function secureHeaders2(ctx, next) {
85
+ const headersToSetForReq = callbacks.length === 0 ? headersToSet : callbacks.reduce((acc, cb) => cb(ctx, acc), headersToSet);
86
+ await next();
87
+ setHeaders(ctx, headersToSetForReq);
88
+ ctx.res.headers.delete("X-Powered-By");
89
+ };
90
+ };
91
+ function getFilteredHeaders(options) {
92
+ return Object.entries(HEADERS_MAP).filter(([key]) => options[key]).map(([key, defaultValue]) => {
93
+ const overrideValue = options[key];
94
+ return typeof overrideValue === "string" ? [defaultValue[0], overrideValue] : defaultValue;
95
+ });
96
+ }
97
+ function getCSPDirectives(contentSecurityPolicy) {
98
+ const callbacks = [];
99
+ const resultValues = [];
100
+ for (const [directive, value] of Object.entries(contentSecurityPolicy)) {
101
+ const valueArray = Array.isArray(value) ? value : [value];
102
+ valueArray.forEach((value2, i) => {
103
+ if (typeof value2 === "function") {
104
+ const index = i * 2 + 2 + resultValues.length;
105
+ callbacks.push((ctx, values) => {
106
+ values[index] = value2(ctx, directive);
107
+ });
108
+ }
109
+ });
110
+ resultValues.push(
111
+ directive.replace(
112
+ /[A-Z]+(?![a-z])|[A-Z]/g,
113
+ (match, offset) => offset ? "-" + match.toLowerCase() : match.toLowerCase()
114
+ ),
115
+ ...valueArray.flatMap((value2) => [" ", value2]),
116
+ "; "
117
+ );
118
+ }
119
+ resultValues.pop();
120
+ return callbacks.length === 0 ? [void 0, resultValues.join("")] : [
121
+ (ctx, headersToSet) => headersToSet.map((values) => {
122
+ if (values[0] === "Content-Security-Policy") {
123
+ const clone = values[1].slice();
124
+ callbacks.forEach((cb) => {
125
+ cb(ctx, clone);
126
+ });
127
+ return [values[0], clone.join("")];
128
+ } else {
129
+ return values;
130
+ }
131
+ }),
132
+ resultValues
133
+ ];
134
+ }
135
+ function getReportingEndpoints(reportingEndpoints = []) {
136
+ return reportingEndpoints.map((endpoint) => `${endpoint.name}="${endpoint.url}"`).join(", ");
137
+ }
138
+ function getReportToOptions(reportTo = []) {
139
+ return reportTo.map((option) => JSON.stringify(option)).join(", ");
140
+ }
141
+ function setHeaders(ctx, headersToSet) {
142
+ headersToSet.forEach(([header, value]) => {
143
+ ctx.res.headers.set(header, value);
144
+ });
145
+ }
146
+ // Annotate the CommonJS export names for ESM import in node:
147
+ 0 && (module.exports = {
148
+ NONCE,
149
+ secureHeaders
150
+ });
@@ -0,0 +1,48 @@
1
+ "use strict";
2
+ var __defProp = Object.defineProperty;
3
+ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
4
+ var __getOwnPropNames = Object.getOwnPropertyNames;
5
+ var __hasOwnProp = Object.prototype.hasOwnProperty;
6
+ var __export = (target, all) => {
7
+ for (var name in all)
8
+ __defProp(target, name, { get: all[name], enumerable: true });
9
+ };
10
+ var __copyProps = (to, from, except, desc) => {
11
+ if (from && typeof from === "object" || typeof from === "function") {
12
+ for (let key of __getOwnPropNames(from))
13
+ if (!__hasOwnProp.call(to, key) && key !== except)
14
+ __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
15
+ }
16
+ return to;
17
+ };
18
+ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
19
+ var timeout_exports = {};
20
+ __export(timeout_exports, {
21
+ timeout: () => timeout
22
+ });
23
+ module.exports = __toCommonJS(timeout_exports);
24
+ var import_http_exception = require("../../http-exception");
25
+ const defaultTimeoutException = new import_http_exception.HTTPException(504, {
26
+ message: "Gateway Timeout"
27
+ });
28
+ const timeout = (duration, exception = defaultTimeoutException) => {
29
+ return async function timeout2(context, next) {
30
+ let timer;
31
+ const timeoutPromise = new Promise((_, reject) => {
32
+ timer = setTimeout(() => {
33
+ reject(typeof exception === "function" ? exception(context) : exception);
34
+ }, duration);
35
+ });
36
+ try {
37
+ await Promise.race([next(), timeoutPromise]);
38
+ } finally {
39
+ if (timer !== void 0) {
40
+ clearTimeout(timer);
41
+ }
42
+ }
43
+ };
44
+ };
45
+ // Annotate the CommonJS export names for ESM import in node:
46
+ 0 && (module.exports = {
47
+ timeout
48
+ });
@@ -18,97 +18,13 @@ var __copyProps = (to, from, except, desc) => {
18
18
  var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
19
19
  var timing_exports = {};
20
20
  __export(timing_exports, {
21
- endTime: () => endTime,
22
- setMetric: () => setMetric,
23
- startTime: () => startTime,
24
- timing: () => timing
21
+ endTime: () => import_timing.endTime,
22
+ setMetric: () => import_timing.setMetric,
23
+ startTime: () => import_timing.startTime,
24
+ timing: () => import_timing.timing
25
25
  });
26
26
  module.exports = __toCommonJS(timing_exports);
27
- var import_context = require("../../context");
28
- const getTime = () => {
29
- try {
30
- return performance.now();
31
- } catch {
32
- }
33
- return Date.now();
34
- };
35
- const timing = (config) => {
36
- const options = {
37
- ...{
38
- total: true,
39
- enabled: true,
40
- totalDescription: "Total Response Time",
41
- autoEnd: true,
42
- crossOrigin: false
43
- },
44
- ...config
45
- };
46
- return async function timing2(c, next) {
47
- const headers = [];
48
- const timers = /* @__PURE__ */ new Map();
49
- c.set("metric", { headers, timers });
50
- if (options.total) {
51
- startTime(c, "total", options.totalDescription);
52
- }
53
- await next();
54
- if (options.total) {
55
- endTime(c, "total");
56
- }
57
- if (options.autoEnd) {
58
- timers.forEach((_, key) => endTime(c, key));
59
- }
60
- const enabled = typeof options.enabled === "function" ? options.enabled(c) : options.enabled;
61
- if (enabled) {
62
- c.res.headers.append("Server-Timing", headers.join(","));
63
- const crossOrigin = typeof options.crossOrigin === "function" ? options.crossOrigin(c) : options.crossOrigin;
64
- if (crossOrigin) {
65
- c.res.headers.append(
66
- "Timing-Allow-Origin",
67
- typeof crossOrigin === "string" ? crossOrigin : "*"
68
- );
69
- }
70
- }
71
- };
72
- };
73
- const setMetric = (c, name, valueDescription, description, precision) => {
74
- const metrics = c.get("metric");
75
- if (!metrics) {
76
- console.warn("Metrics not initialized! Please add the `timing()` middleware to this route!");
77
- return;
78
- }
79
- if (typeof valueDescription === "number") {
80
- const dur = valueDescription.toFixed(precision || 1);
81
- const metric = description ? `${name};dur=${dur};desc="${description}"` : `${name};dur=${dur}`;
82
- metrics.headers.push(metric);
83
- } else {
84
- const metric = valueDescription ? `${name};desc="${valueDescription}"` : `${name}`;
85
- metrics.headers.push(metric);
86
- }
87
- };
88
- const startTime = (c, name, description) => {
89
- const metrics = c.get("metric");
90
- if (!metrics) {
91
- console.warn("Metrics not initialized! Please add the `timing()` middleware to this route!");
92
- return;
93
- }
94
- metrics.timers.set(name, { description, start: getTime() });
95
- };
96
- const endTime = (c, name, precision) => {
97
- const metrics = c.get("metric");
98
- if (!metrics) {
99
- console.warn("Metrics not initialized! Please add the `timing()` middleware to this route!");
100
- return;
101
- }
102
- const timer = metrics.timers.get(name);
103
- if (!timer) {
104
- console.warn(`Timer "${name}" does not exist!`);
105
- return;
106
- }
107
- const { description, start } = timer;
108
- const duration = getTime() - start;
109
- setMetric(c, name, duration, description, precision);
110
- metrics.timers.delete(name);
111
- };
27
+ var import_timing = require("./timing");
112
28
  // Annotate the CommonJS export names for ESM import in node:
113
29
  0 && (module.exports = {
114
30
  endTime,
@@ -0,0 +1,118 @@
1
+ "use strict";
2
+ var __defProp = Object.defineProperty;
3
+ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
4
+ var __getOwnPropNames = Object.getOwnPropertyNames;
5
+ var __hasOwnProp = Object.prototype.hasOwnProperty;
6
+ var __export = (target, all) => {
7
+ for (var name in all)
8
+ __defProp(target, name, { get: all[name], enumerable: true });
9
+ };
10
+ var __copyProps = (to, from, except, desc) => {
11
+ if (from && typeof from === "object" || typeof from === "function") {
12
+ for (let key of __getOwnPropNames(from))
13
+ if (!__hasOwnProp.call(to, key) && key !== except)
14
+ __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
15
+ }
16
+ return to;
17
+ };
18
+ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
19
+ var timing_exports = {};
20
+ __export(timing_exports, {
21
+ endTime: () => endTime,
22
+ setMetric: () => setMetric,
23
+ startTime: () => startTime,
24
+ timing: () => timing
25
+ });
26
+ module.exports = __toCommonJS(timing_exports);
27
+ var import_context = require("../../context");
28
+ const getTime = () => {
29
+ try {
30
+ return performance.now();
31
+ } catch {
32
+ }
33
+ return Date.now();
34
+ };
35
+ const timing = (config) => {
36
+ const options = {
37
+ ...{
38
+ total: true,
39
+ enabled: true,
40
+ totalDescription: "Total Response Time",
41
+ autoEnd: true,
42
+ crossOrigin: false
43
+ },
44
+ ...config
45
+ };
46
+ return async function timing2(c, next) {
47
+ const headers = [];
48
+ const timers = /* @__PURE__ */ new Map();
49
+ c.set("metric", { headers, timers });
50
+ if (options.total) {
51
+ startTime(c, "total", options.totalDescription);
52
+ }
53
+ await next();
54
+ if (options.total) {
55
+ endTime(c, "total");
56
+ }
57
+ if (options.autoEnd) {
58
+ timers.forEach((_, key) => endTime(c, key));
59
+ }
60
+ const enabled = typeof options.enabled === "function" ? options.enabled(c) : options.enabled;
61
+ if (enabled) {
62
+ c.res.headers.append("Server-Timing", headers.join(","));
63
+ const crossOrigin = typeof options.crossOrigin === "function" ? options.crossOrigin(c) : options.crossOrigin;
64
+ if (crossOrigin) {
65
+ c.res.headers.append(
66
+ "Timing-Allow-Origin",
67
+ typeof crossOrigin === "string" ? crossOrigin : "*"
68
+ );
69
+ }
70
+ }
71
+ };
72
+ };
73
+ const setMetric = (c, name, valueDescription, description, precision) => {
74
+ const metrics = c.get("metric");
75
+ if (!metrics) {
76
+ console.warn("Metrics not initialized! Please add the `timing()` middleware to this route!");
77
+ return;
78
+ }
79
+ if (typeof valueDescription === "number") {
80
+ const dur = valueDescription.toFixed(precision || 1);
81
+ const metric = description ? `${name};dur=${dur};desc="${description}"` : `${name};dur=${dur}`;
82
+ metrics.headers.push(metric);
83
+ } else {
84
+ const metric = valueDescription ? `${name};desc="${valueDescription}"` : `${name}`;
85
+ metrics.headers.push(metric);
86
+ }
87
+ };
88
+ const startTime = (c, name, description) => {
89
+ const metrics = c.get("metric");
90
+ if (!metrics) {
91
+ console.warn("Metrics not initialized! Please add the `timing()` middleware to this route!");
92
+ return;
93
+ }
94
+ metrics.timers.set(name, { description, start: getTime() });
95
+ };
96
+ const endTime = (c, name, precision) => {
97
+ const metrics = c.get("metric");
98
+ if (!metrics) {
99
+ console.warn("Metrics not initialized! Please add the `timing()` middleware to this route!");
100
+ return;
101
+ }
102
+ const timer = metrics.timers.get(name);
103
+ if (!timer) {
104
+ console.warn(`Timer "${name}" does not exist!`);
105
+ return;
106
+ }
107
+ const { description, start } = timer;
108
+ const duration = getTime() - start;
109
+ setMetric(c, name, duration, description, precision);
110
+ metrics.timers.delete(name);
111
+ };
112
+ // Annotate the CommonJS export names for ESM import in node:
113
+ 0 && (module.exports = {
114
+ endTime,
115
+ setMetric,
116
+ startTime,
117
+ timing
118
+ });