veryfront/middleware

Import

import {
  authRateLimit,
  cors,
  logger,
  MiddlewarePipeline,
  rateLimit,
  timeout,
} from "veryfront/middleware";

Examples

Single middleware

import { cors } from "veryfront/middleware";

const corsMiddleware = cors({ origin: "https://example.com" });

Pipeline composition

import { cors, logger, MiddlewarePipeline, rateLimit, timeout } from "veryfront/middleware";

const pipeline = new MiddlewarePipeline()
  .use(cors({ origin: "https://example.com" }))
  .use(rateLimit({ maxRequests: 100, windowMs: 60_000 }))
  .use(logger({ format: "combined" }))
  .use(timeout({ timeoutMs: 30_000 }));

API

`middlewarePipeline.use(middleware)`

Add a middleware handler to the pipeline. Returns: this

`middlewarePipeline.useFor(pattern, )`

Add a middleware handler that only runs for matching URL patterns. Returns: this

`middlewarePipeline.onTeardown(cb)`

Register a cleanup callback that runs once per request after each execute()/handle() response body closes, is canceled, or errors. Bodyless, locked, or already-read responses and handler/middleware exceptions clean up before the call resolves. Returns: this

`middlewarePipeline.compose()`

Compose all registered middleware into a single handler function. Returns: MiddlewareHandler

`middlewarePipeline.execute(req, env, executionCtx, adapter)`

Execute the pipeline for an incoming request. Returns: Promise<Response>

`middlewarePipeline.handle(req, handler)`

Run the middleware pipeline with a final request handler. Unlike execute, which returns a 404 when no middleware responds, handle invokes the given handler as the terminal step so middleware can add headers, validate auth, etc. before the handler runs. Returns: Promise<Response>

`middlewarePipeline.teardown()`

Drain and discard all registered teardown callbacks. Unlike the per-request cleanup run by execute() / handle(), this clears callbacks so they never run again. Returns: Promise<void>

`middlewarePipeline.getMiddleware()`

List registered middleware with metadata. Returns: Array<{ name?: string; order?: number }>

Type Reference

`CorsOptions`

Options accepted by cors.

Property	Type	Description	Source
`origin?`	`string \| string[] \| OriginValidator`	Allowed origins (string, regex, array, or function)	source
`methods?`	`string[]`	Allowed HTTP methods	source
`allowedHeaders?`	`string[]`	Allowed request headers	source
`exposedHeaders?`	`string[]`	Headers exposed to client	source
`credentials?`	`boolean`	Allow credentials	source
`maxAge?`	`number`	Preflight cache duration (seconds)	source

`RateLimitOptions`

Options accepted by rate limit.

Property	Type	Description	Source
`maxRequests?`	`number`	Max requests per window	source
`windowMs?`	`number`	Time window (ms)	source
`store?`	`RateLimitStore`	Storage backend	source
`maxEntries?`	`number`	Maximum active identities retained by the default in-memory store. Defaults to 10,000. At capacity, requests for identities without an active entry receive HTTP 503. Active entries are not evicted because doing so would let identity floods reset quotas. Capacity failures log `stage=store-increment`, `failureKind=capacity-exhausted`, and the configured `capacity`. Incompatible with a caller-provided `store`.	source
`keyGenerator?`	`(req: Request) => string`	Function to derive rate limit key from request	source
`trustProxy?`	`boolean`	Trust proxy-set forwarding headers (X-Forwarded-For) for keying. Defaults to false so forwarded headers are ignored and cannot be used to evade limits. Enable only when a trusted proxy that appends the real client IP sits in front of this middleware.	source

`MemoryRateLimitStoreOptions`

Options accepted by the in-memory rate limit store.

Property	Type	Description	Source
`maxEntries?`	`number`	Maximum number of active identities retained by the store. Defaults to 10,000. Size this above the peak number of distinct identities expected during one complete rate-limit window, including burst headroom. At capacity, increments for identities without an active entry fail. Active entries are never evicted because identity flooding could otherwise reset an attacker’s quota. When used through `rateLimit()`, capacity exhaustion logs `stage=store-increment`, `failureKind=capacity-exhausted`, and the configured `capacity`.	source

`LoggerOptions`

Options accepted by logger.

Property	Type	Description	Source
`format?`	`LogFormat`	Log format (combined, common, dev, short)	source
`skip?`	`(req: Request) => boolean`	Skip logging for matching requests	source
`log?`	`(message: string) => void`	Custom log output function	source

`TimeoutOptions`

Options accepted by timeout.

Property	Type	Description	Source
`timeoutMs?`	`number`	Timeout in milliseconds (default: 75000)	source
`message?`	`string`	Custom message for timeout response	source
`exclude?`	`string[]`	Paths to exclude from timeout (e.g., health checks)	source

Exports

Functions

Name	Description	Source
`authRateLimit`	Pre-configured rate limiter for authentication endpoints (5 req/15min).	source
`cors`	Create CORS middleware.	source
`devLogger`	Create development request logging middleware.	source
`getTimeoutFromEnv`	Gets timeout from environment variable REQUEST_TIMEOUT_MS	source
`logger`	Create request logging middleware.	source
`prodLogger`	Create production request logging middleware.	source
`rateLimit`	Create rate-limit middleware.	source
`timeout`	Creates a middleware that enforces request timeouts.	source
`timeoutFromEnv`	Creates a timeout middleware with configuration from environment	source

Classes

Name	Description	Source
`MemoryRateLimitStore`	Implement memory rate limit store.	source
`MiddlewareContext`	Context for middleware.	source
`MiddlewarePipeline`	Implement middleware pipeline.	source
`RedisRateLimitStore`	Redis rate-limit store backed by the registered Redis runtime provider.	source

Types

Name	Description	Source
`AuthRateLimitOptions`	Options accepted by the authentication rate-limit preset.	source
`Context`	Context for context.	source
`CorsOptions`	Options accepted by cors.	source
`ExecutionContext`	Context for execution.	source
`LogFormat`	Public API contract for log format.	source
`LoggerOptions`	Options accepted by logger.	source
`MemoryRateLimitStoreOptions`	Options accepted by the in-memory rate limit store.	source
`MiddlewareFactory`	Public API contract for middleware factory.	source
`MiddlewareHandler`	Handler for middleware.	source
`MiddlewarePipelineOptions`	Options accepted by middleware pipeline.	source
`Next`	Public API contract for next.	source
`RateLimitOptions`	Options accepted by rate limit.	source
`RateLimitStore`	Public API contract for rate limit store.	source
`RedisRateLimitOptions`	Options accepted by the provider-backed Redis rate-limit store.	source
`TimeoutOptions`	Options accepted by timeout.	source

Getting Started

Concepts

Guides

API Reference

veryfront/middleware

Import

Examples

Single middleware

Pipeline composition

API

`middlewarePipeline.use(middleware)`

`middlewarePipeline.useFor(pattern, )`

`middlewarePipeline.onTeardown(cb)`

`middlewarePipeline.compose()`

`middlewarePipeline.execute(req, env, executionCtx, adapter)`

`middlewarePipeline.handle(req, handler)`

`middlewarePipeline.teardown()`

`middlewarePipeline.getMiddleware()`

Type Reference

`CorsOptions`

`RateLimitOptions`

`MemoryRateLimitStoreOptions`

`LoggerOptions`

`TimeoutOptions`

Exports

Functions

Classes

Types

​Import

​Examples

​Single middleware

​Pipeline composition

​API

​middlewarePipeline.use(middleware)

​middlewarePipeline.useFor(pattern, )

​middlewarePipeline.onTeardown(cb)

​middlewarePipeline.compose()

​middlewarePipeline.execute(req, env, executionCtx, adapter)

​middlewarePipeline.handle(req, handler)

​middlewarePipeline.teardown()

​middlewarePipeline.getMiddleware()

​Type Reference

​CorsOptions

​RateLimitOptions

​MemoryRateLimitStoreOptions

​LoggerOptions

​TimeoutOptions

​Exports

​Functions

​Classes

​Types

Import

Examples

Single middleware

Pipeline composition

API

`middlewarePipeline.use(middleware)`

`middlewarePipeline.useFor(pattern, )`

`middlewarePipeline.onTeardown(cb)`

`middlewarePipeline.compose()`

`middlewarePipeline.execute(req, env, executionCtx, adapter)`

`middlewarePipeline.handle(req, handler)`

`middlewarePipeline.teardown()`

`middlewarePipeline.getMiddleware()`

Type Reference

`CorsOptions`

`RateLimitOptions`

`MemoryRateLimitStoreOptions`

`LoggerOptions`

`TimeoutOptions`

Exports

Functions

Classes

Types