@apiboost/omnispec 1.0.0

package/dist/esm/core/public.js

@@ -0,0 +1,102 @@
+export { B as Button, C as ConfigProvider, c as CustomNavSection, D as DEFAULT_SCHEMA_STYLE, e as DocLayout, E as ErrorMessage, F as FREE_SCHEMA_STYLES, I as Icon, L as LoadingScreen, N as NavTree, b as SpecStatusScreen, S as SpecType, T as ThemeProvider, g as breakpoints, h as buildSidebar, d as darkTheme, f as fetchSpec, i as isSidebarNavGroup, l as lightTheme, m as mq, r as resolveSchemaStyle, j as useConfig, a as useSpecFetcher, u as useTheme } from '../chunks/useSpecFetcher-CZvAnU7Z.js';
+export { A as AuthProvider, C as CodeSamples, L as LinkableHeading, M as Modal, O as OAuth2AuthManual, a as OpenIdConnectManual, R as ReferenceLayout, b as ReferenceOperationDetail, c as ResponseViewer, d as ResponsiveColumns, S as SamplesPanel, e as SecretInput, f as authStyles, s as sendDirectRequest, g as sendProxiedRequest, u as useAuth } from '../chunks/OpenIdConnectManual-COfITasf.js';
+export { R as RendererRegistryProvider, u as useRendererRegistry } from '../chunks/RendererRegistry-zlh-WYbU.js';
+export { B as Badge, C as CodeBlock, a as Collapsible, E as EnumItem, b as EnumLabel, c as EnumList, d as ExpandableCard, F as FieldDescription, e as FieldName, M as MarkdownRenderer, f as MethodBar, P as PresentationChildren, g as PresentationContainer, h as PresentationRow, i as PropDefault, j as PropDesc, k as PropFormat, l as PropName, m as PropReq, n as PropRequiredStar, o as PropType, S as SchemaBadge, p as SchemaPropChildren, q as SchemaPropRow, r as SchemaRefLink, s as SchemaSectionTitle, t as SchemaTree, u as SearchBar, v as SpecToolbar, T as Tabs, w as flattenNavItemIds, x as generateExample, y as requestExpand, z as resolveDownloadLink, A as schemaToNodes, D as useHashScroll, G as useScrollSpy } from '../chunks/Collapsible-DA6-nS46.js';
+import { jsx, jsxs } from 'react/jsx-runtime';
+import { useState, useCallback, useRef } from 'react';
+import { css } from '@emotion/css';
+export { css, cx, keyframes } from '@emotion/css';
+export { U as UpgradePrompt, d as detectSpecType, u as useSpecDetector } from '../chunks/useSpecDetector-5SGcKnJx.js';
+import '../chunks/binary-response-Cre_H-Rt.js';
+import '@emotion/styled';
+
+const copyBtnStyle = css({
+  background: "none",
+  border: "1px solid var(--omnispec-border-color)",
+  borderRadius: "var(--omnispec-border-radius)",
+  padding: "4px 10px",
+  fontSize: "var(--omnispec-font-size-xs)",
+  color: "var(--omnispec-fg-secondary)",
+  cursor: "pointer",
+  "&:hover": {
+    color: "var(--omnispec-fg-primary)",
+    borderColor: "var(--omnispec-fg-muted)"
+  }
+});
+function CopyButton({ text, label = "Copy" }) {
+  const [copied, setCopied] = useState(false);
+  const handleCopy = useCallback(async () => {
+    await navigator.clipboard.writeText(text);
+    setCopied(true);
+    setTimeout(() => setCopied(false), 2e3);
+  }, [text]);
+  return /* @__PURE__ */ jsx(
+    "button",
+    {
+      type: "button",
+      onClick: handleCopy,
+      className: copyBtnStyle,
+      "aria-label": label,
+      children: copied ? "Copied!" : label
+    }
+  );
+}
+
+const wrapperStyle = css({
+  position: "relative",
+  display: "inline-block"
+});
+const tipStyle = css({
+  position: "fixed",
+  padding: "4px 8px",
+  backgroundColor: "var(--omnispec-fg-primary)",
+  color: "var(--omnispec-bg-primary)",
+  fontSize: "var(--omnispec-font-size-xs)",
+  borderRadius: "4px",
+  whiteSpace: "nowrap",
+  zIndex: 9999,
+  pointerEvents: "none"
+});
+function Tooltip({ content, children }) {
+  const [visible, setVisible] = useState(false);
+  const [pos, setPos] = useState({ top: 0, left: 0 });
+  const wrapperRef = useRef(null);
+  const handleEnter = useCallback(() => {
+    if (wrapperRef.current) {
+      const rect = wrapperRef.current.getBoundingClientRect();
+      setPos({
+        top: rect.top - 6,
+        left: rect.left + rect.width / 2
+      });
+    }
+    setVisible(true);
+  }, []);
+  return /* @__PURE__ */ jsxs(
+    "span",
+    {
+      ref: wrapperRef,
+      className: `omnispec-tooltip ${wrapperStyle}`,
+      onMouseEnter: handleEnter,
+      onMouseLeave: () => setVisible(false),
+      children: [
+        children,
+        visible && /* @__PURE__ */ jsx(
+          "span",
+          {
+            className: tipStyle,
+            role: "tooltip",
+            style: {
+              top: pos.top,
+              left: pos.left,
+              transform: "translate(-50%, -100%)"
+            },
+            children: content
+          }
+        )
+      ]
+    }
+  );
+}
+
+export { CopyButton, Tooltip };
+//# sourceMappingURL=public.js.map

package/dist/esm/core/public.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public.js","sources":["../../../src/core/components/common/CopyButton.tsx","../../../src/core/components/common/Tooltip.tsx"],"sourcesContent":["/**\n * This source file is part of the Apiboost(R) OmniSpec Core.\n *\n * Copyright (c) Apiboost, Inc.\n *\n * SPDX-License-Identifier: Apache-2.0\n *\n * See LICENSE.md and LICENSING.md in the project root for license information.\n */\n\nimport { useCallback, useState } from 'react'\nimport { css } from '../../styles/css'\n\ninterface CopyButtonProps {\n  text: string\n  label?: string\n}\n\nconst copyBtnStyle = css({\n  background: 'none',\n  border: '1px solid var(--omnispec-border-color)',\n  borderRadius: 'var(--omnispec-border-radius)',\n  padding: '4px 10px',\n  fontSize: 'var(--omnispec-font-size-xs)',\n  color: 'var(--omnispec-fg-secondary)',\n  cursor: 'pointer',\n  '&:hover': {\n    color: 'var(--omnispec-fg-primary)',\n    borderColor: 'var(--omnispec-fg-muted)',\n  },\n})\n\nexport function CopyButton({ text, label = 'Copy' }: CopyButtonProps) {\n  const [copied, setCopied] = useState(false)\n\n  const handleCopy = useCallback(async () => {\n    await navigator.clipboard.writeText(text)\n    setCopied(true)\n    setTimeout(() => setCopied(false), 2000)\n  }, [text])\n\n  return (\n    <button\n      type=\"button\"\n      onClick={handleCopy}\n      className={copyBtnStyle}\n      aria-label={label}\n    >\n      {copied ? 'Copied!' : label}\n    </button>\n  )\n}\n","/**\n * This source file is part of the Apiboost(R) OmniSpec Core.\n *\n * Copyright (c) Apiboost, Inc.\n *\n * SPDX-License-Identifier: Apache-2.0\n *\n * See LICENSE.md and LICENSING.md in the project root for license information.\n */\n\nimport { useCallback, useRef, useState } from 'react'\nimport type { ReactNode } from 'react'\nimport { css } from '../../styles/css'\n\ninterface TooltipProps {\n  content: string\n  children: ReactNode\n}\n\nconst wrapperStyle = css({\n  position: 'relative',\n  display: 'inline-block',\n})\n\nconst tipStyle = css({\n  position: 'fixed',\n  padding: '4px 8px',\n  backgroundColor: 'var(--omnispec-fg-primary)',\n  color: 'var(--omnispec-bg-primary)',\n  fontSize: 'var(--omnispec-font-size-xs)',\n  borderRadius: '4px',\n  whiteSpace: 'nowrap',\n  zIndex: 9999,\n  pointerEvents: 'none',\n})\n\nexport function Tooltip({ content, children }: TooltipProps) {\n  const [visible, setVisible] = useState(false)\n  const [pos, setPos] = useState({ top: 0, left: 0 })\n  const wrapperRef = useRef<HTMLSpanElement>(null)\n\n  const handleEnter = useCallback(() => {\n    if (wrapperRef.current) {\n      const rect = wrapperRef.current.getBoundingClientRect()\n      setPos({\n        top: rect.top - 6,\n        left: rect.left + rect.width / 2,\n      })\n    }\n    setVisible(true)\n  }, [])\n\n  return (\n    <span\n      ref={wrapperRef}\n      className={`omnispec-tooltip ${wrapperStyle}`}\n      onMouseEnter={handleEnter}\n      onMouseLeave={() => setVisible(false)}\n    >\n      {children}\n      {visible && (\n        <span\n          className={tipStyle}\n          role=\"tooltip\"\n          style={{\n            top: pos.top,\n            left: pos.left,\n            transform: 'translate(-50%, -100%)',\n          }}\n        >\n          {content}\n        </span>\n      )}\n    </span>\n  )\n}\n"],"names":[],"mappings":";;;;;;;;;;;;AAkBA,MAAM,eAAe,GAAA,CAAI;AAAA,EACvB,UAAA,EAAY,MAAA;AAAA,EACZ,MAAA,EAAQ,wCAAA;AAAA,EACR,YAAA,EAAc,+BAAA;AAAA,EACd,OAAA,EAAS,UAAA;AAAA,EACT,QAAA,EAAU,8BAAA;AAAA,EACV,KAAA,EAAO,8BAAA;AAAA,EACP,MAAA,EAAQ,SAAA;AAAA,EACR,SAAA,EAAW;AAAA,IACT,KAAA,EAAO,4BAAA;AAAA,IACP,WAAA,EAAa;AAAA;AAEjB,CAAC,CAAA;AAEM,SAAS,UAAA,CAAW,EAAE,IAAA,EAAM,KAAA,GAAQ,QAAO,EAAoB;AACpE,EAAA,MAAM,CAAC,MAAA,EAAQ,SAAS,CAAA,GAAI,SAAS,KAAK,CAAA;AAE1C,EAAA,MAAM,UAAA,GAAa,YAAY,YAAY;AACzC,IAAA,MAAM,SAAA,CAAU,SAAA,CAAU,SAAA,CAAU,IAAI,CAAA;AACxC,IAAA,SAAA,CAAU,IAAI,CAAA;AACd,IAAA,UAAA,CAAW,MAAM,SAAA,CAAU,KAAK,CAAA,EAAG,GAAI,CAAA;AAAA,EACzC,CAAA,EAAG,CAAC,IAAI,CAAC,CAAA;AAET,EAAA,uBACE,GAAA;AAAA,IAAC,QAAA;AAAA,IAAA;AAAA,MACC,IAAA,EAAK,QAAA;AAAA,MACL,OAAA,EAAS,UAAA;AAAA,MACT,SAAA,EAAW,YAAA;AAAA,MACX,YAAA,EAAY,KAAA;AAAA,MAEX,mBAAS,SAAA,GAAY;AAAA;AAAA,GACxB;AAEJ;;AChCA,MAAM,eAAe,GAAA,CAAI;AAAA,EACvB,QAAA,EAAU,UAAA;AAAA,EACV,OAAA,EAAS;AACX,CAAC,CAAA;AAED,MAAM,WAAW,GAAA,CAAI;AAAA,EACnB,QAAA,EAAU,OAAA;AAAA,EACV,OAAA,EAAS,SAAA;AAAA,EACT,eAAA,EAAiB,4BAAA;AAAA,EACjB,KAAA,EAAO,4BAAA;AAAA,EACP,QAAA,EAAU,8BAAA;AAAA,EACV,YAAA,EAAc,KAAA;AAAA,EACd,UAAA,EAAY,QAAA;AAAA,EACZ,MAAA,EAAQ,IAAA;AAAA,EACR,aAAA,EAAe;AACjB,CAAC,CAAA;AAEM,SAAS,OAAA,CAAQ,EAAE,OAAA,EAAS,QAAA,EAAS,EAAiB;AAC3D,EAAA,MAAM,CAAC,OAAA,EAAS,UAAU,CAAA,GAAI,SAAS,KAAK,CAAA;AAC5C,EAAA,MAAM,CAAC,GAAA,EAAK,MAAM,CAAA,GAAI,QAAA,CAAS,EAAE,GAAA,EAAK,CAAA,EAAG,IAAA,EAAM,CAAA,EAAG,CAAA;AAClD,EAAA,MAAM,UAAA,GAAa,OAAwB,IAAI,CAAA;AAE/C,EAAA,MAAM,WAAA,GAAc,YAAY,MAAM;AACpC,IAAA,IAAI,WAAW,OAAA,EAAS;AACtB,MAAA,MAAM,IAAA,GAAO,UAAA,CAAW,OAAA,CAAQ,qBAAA,EAAsB;AACtD,MAAA,MAAA,CAAO;AAAA,QACL,GAAA,EAAK,KAAK,GAAA,GAAM,CAAA;AAAA,QAChB,IAAA,EAAM,IAAA,CAAK,IAAA,GAAO,IAAA,CAAK,KAAA,GAAQ;AAAA,OAChC,CAAA;AAAA,IACH;AACA,IAAA,UAAA,CAAW,IAAI,CAAA;AAAA,EACjB,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,uBACE,IAAA;AAAA,IAAC,MAAA;AAAA,IAAA;AAAA,MACC,GAAA,EAAK,UAAA;AAAA,MACL,SAAA,EAAW,oBAAoB,YAAY,CAAA,CAAA;AAAA,MAC3C,YAAA,EAAc,WAAA;AAAA,MACd,YAAA,EAAc,MAAM,UAAA,CAAW,KAAK,CAAA;AAAA,MAEnC,QAAA,EAAA;AAAA,QAAA,QAAA;AAAA,QACA,OAAA,oBACC,GAAA;AAAA,UAAC,MAAA;AAAA,UAAA;AAAA,YACC,SAAA,EAAW,QAAA;AAAA,YACX,IAAA,EAAK,SAAA;AAAA,YACL,KAAA,EAAO;AAAA,cACL,KAAK,GAAA,CAAI,GAAA;AAAA,cACT,MAAM,GAAA,CAAI,IAAA;AAAA,cACV,SAAA,EAAW;AAAA,aACb;AAAA,YAEC,QAAA,EAAA;AAAA;AAAA;AACH;AAAA;AAAA,GAEJ;AAEJ;;;;"}

package/dist/esm/index.js

@@ -0,0 +1,17 @@
+export { O as OpenApiSpec, a as authSchemeLabel } from './chunks/OpenApiSpec-Cy-oW6jA.js';
+export { AsyncApiSpec } from './chunks/AsyncApiSpec-C3lsUpZk.js';
+export { O as OmniSpecRenderer } from './chunks/OmniSpecRenderer-MqsQFXro.js';
+export { R as RendererRegistryProvider, u as useRendererRegistry } from './chunks/RendererRegistry-zlh-WYbU.js';
+export { S as SpecType, T as ThemeProvider, d as darkTheme, f as fetchSpec, i as isSidebarNavGroup, l as lightTheme, u as useTheme } from './chunks/useSpecFetcher-CZvAnU7Z.js';
+export { d as detectSpecType } from './chunks/useSpecDetector-5SGcKnJx.js';
+import 'react/jsx-runtime';
+import 'react';
+import '@emotion/css';
+import './chunks/Collapsible-DA6-nS46.js';
+import '@emotion/styled';
+import './chunks/OpenIdConnectManual-COfITasf.js';
+import './chunks/binary-response-Cre_H-Rt.js';
+import './chunks/ref-resolver-BIrHJOjz.js';
+import './chunks/ssrf-guard-CsZoYdEq.js';
+import './chunks/ErrorBoundary-posRNrbt.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;"}

package/dist/esm/openapi/index.js

@@ -0,0 +1,13 @@
+export { O as OpenApiSpec } from '../chunks/OpenApiSpec-Cy-oW6jA.js';
+import 'react/jsx-runtime';
+import 'react';
+import '@emotion/css';
+import '../chunks/useSpecFetcher-CZvAnU7Z.js';
+import '../chunks/Collapsible-DA6-nS46.js';
+import '@emotion/styled';
+import '../chunks/OpenIdConnectManual-COfITasf.js';
+import '../chunks/binary-response-Cre_H-Rt.js';
+import '../chunks/ref-resolver-BIrHJOjz.js';
+import '../chunks/ssrf-guard-CsZoYdEq.js';
+import '../chunks/ErrorBoundary-posRNrbt.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/openapi/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;"}

package/dist/esm/server/index.js

@@ -0,0 +1,152 @@
+import { Router } from 'express';
+import { i as isPrivateIp } from '../chunks/ssrf-guard-CsZoYdEq.js';
+import { i as isBinaryContentType } from '../chunks/binary-response-Cre_H-Rt.js';
+
+const DEFAULT_RATE_LIMIT = 60;
+const DEFAULT_TIMEOUT = 3e4;
+const DEFAULT_MAX_BODY = 1048576;
+const createProxyRouter = (options = {}) => {
+  const {
+    rateLimitPerMinute = DEFAULT_RATE_LIMIT,
+    maxTimeout = DEFAULT_TIMEOUT,
+    maxBodySize = DEFAULT_MAX_BODY,
+    allowedDomains = [],
+    onRequest
+  } = options;
+  const router = Router();
+  try {
+    const rateLimit = require("express-rate-limit").default ?? require("express-rate-limit");
+    router.use(
+      rateLimit({
+        windowMs: 6e4,
+        max: rateLimitPerMinute,
+        standardHeaders: true,
+        legacyHeaders: false,
+        message: { error: "Too many proxy requests. Please try again later." }
+      })
+    );
+  } catch {
+    const hits = /* @__PURE__ */ new Map();
+    router.use((req, res, next) => {
+      const key = req.ip ?? "unknown";
+      const now = Date.now();
+      const entry = hits.get(key);
+      if (!entry || now > entry.resetAt) {
+        hits.set(key, { count: 1, resetAt: now + 6e4 });
+        return next();
+      }
+      if (entry.count >= rateLimitPerMinute) {
+        return res.status(429).json({ error: "Too many proxy requests. Please try again later." });
+      }
+      entry.count++;
+      return next();
+    });
+  }
+  router.post("/", async (req, res) => {
+    const proxyReq = req.body;
+    if (!proxyReq?.url || !proxyReq?.method) {
+      return res.status(400).json({ error: "Missing required fields: url, method" });
+    }
+    let targetUrl;
+    try {
+      targetUrl = new URL(proxyReq.url);
+    } catch {
+      return res.status(400).json({ error: "Invalid target URL" });
+    }
+    const hostname = targetUrl.hostname;
+    if (isPrivateIp(hostname)) {
+      return res.status(403).json({ error: "Requests to private/internal addresses are not allowed" });
+    }
+    if (allowedDomains.length > 0) {
+      const allowed = allowedDomains.some(
+        (domain) => hostname === domain || hostname.endsWith(`.${domain}`)
+      );
+      if (!allowed) {
+        return res.status(403).json({ error: `Domain ${hostname} is not in the allowed list` });
+      }
+    }
+    if (proxyReq.body && proxyReq.body.length > maxBodySize) {
+      return res.status(413).json({ error: `Request body exceeds ${maxBodySize} byte limit` });
+    }
+    const timeout = Math.min(proxyReq.timeout ?? maxTimeout, maxTimeout);
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), timeout);
+    const startTime = Date.now();
+    let outboundBody = proxyReq.body ?? void 0;
+    if (outboundBody !== void 0 && proxyReq.bodyEncoding === "base64") {
+      try {
+        outboundBody = Buffer.from(outboundBody, "base64");
+      } catch {
+        return res.status(400).json({ error: "Invalid base64 request body" });
+      }
+    }
+    try {
+      const fetchResponse = await fetch(proxyReq.url, {
+        method: proxyReq.method,
+        headers: proxyReq.headers ?? {},
+        // Buffer is a Uint8Array at runtime; Node's fetch accepts it. The DOM
+        // BodyInit typing doesn't know that, hence the cast.
+        body: outboundBody,
+        signal: controller.signal
+      });
+      const responseContentType = fetchResponse.headers.get("content-type") ?? "";
+      const isBinary = isBinaryContentType(responseContentType);
+      const responseBody = isBinary ? Buffer.from(await fetchResponse.arrayBuffer()).toString("base64") : await fetchResponse.text();
+      const duration = Date.now() - startTime;
+      if (responseBody.length > maxBodySize) {
+        return res.status(502).json({
+          status: 502,
+          statusText: "Response too large",
+          headers: {},
+          body: `Response body exceeds ${maxBodySize} byte limit`,
+          bodyEncoding: "utf-8",
+          duration
+        });
+      }
+      const responseHeaders = {};
+      fetchResponse.headers.forEach((value, key) => {
+        responseHeaders[key] = value;
+      });
+      const proxyRes = {
+        status: fetchResponse.status,
+        statusText: fetchResponse.statusText,
+        headers: responseHeaders,
+        body: responseBody,
+        bodyEncoding: isBinary ? "base64" : "utf-8",
+        duration
+      };
+      if (onRequest) {
+        try {
+          onRequest({
+            targetUrl: proxyReq.url,
+            method: proxyReq.method,
+            statusCode: fetchResponse.status,
+            duration,
+            timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+            ip: req.ip ?? "unknown"
+          });
+        } catch {
+        }
+      }
+      return res.json(proxyRes);
+    } catch (err) {
+      const duration = Date.now() - startTime;
+      const message = err instanceof Error ? err.message : "Unknown error";
+      const isTimeout = message.includes("abort");
+      return res.status(isTimeout ? 504 : 502).json({
+        status: isTimeout ? 504 : 502,
+        statusText: isTimeout ? "Gateway Timeout" : "Bad Gateway",
+        headers: {},
+        body: message,
+        bodyEncoding: "utf-8",
+        duration
+      });
+    } finally {
+      clearTimeout(timeoutId);
+    }
+  });
+  return router;
+};
+
+export { createProxyRouter };
+//# sourceMappingURL=index.js.map

package/dist/esm/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sources":["../../../src/server/proxy-router.ts"],"sourcesContent":["/**\n * This source file is part of the Apiboost(R) OmniSpec Core.\n *\n * Copyright (c) Apiboost, Inc.\n *\n * SPDX-License-Identifier: Apache-2.0\n *\n * See LICENSE.md and LICENSING.md in the project root for license information.\n */\n\nimport { Router } from 'express'\nimport type { Request, Response } from 'express'\nimport type { ProxyRequest, ProxyResponse } from '../core/types/try-it.types'\nimport { isPrivateIp } from './ssrf-guard'\nimport { isBinaryContentType } from '../core/utils/binary-response'\n\nexport interface ProxyRouterOptions {\n  /** Max requests per minute per IP. Default: 60. */\n  rateLimitPerMinute?: number\n  /** Max timeout for proxied requests in ms. Default: 30000. */\n  maxTimeout?: number\n  /** Max request/response body size in bytes. Default: 1048576 (1MB). */\n  maxBodySize?: number\n  /** Allowed target domains. Empty array = allow all external. */\n  allowedDomains?: string[]\n  /** Audit callback fired after each proxy request completes. */\n  onRequest?: (audit: ProxyAuditEntry) => void\n}\n\nexport interface ProxyAuditEntry {\n  targetUrl: string\n  method: string\n  statusCode: number\n  duration: number\n  timestamp: string\n  ip: string\n}\n\nconst DEFAULT_RATE_LIMIT = 60\nconst DEFAULT_TIMEOUT = 30_000\nconst DEFAULT_MAX_BODY = 1_048_576\n\n/**\n * Creates an Express router that proxies Try-It requests to external APIs.\n *\n * @param options - Configuration for rate limiting, timeouts, SSRF protection.\n * @returns Express Router to mount at your proxy path (e.g. `/api/proxy`).\n *\n * @example\n * ```ts\n * import { createProxyRouter } from '@apiboost/omnispec/server'\n * app.use('/api/proxy', createProxyRouter({ rateLimitPerMinute: 60 }))\n * ```\n */\nexport const createProxyRouter = (options: ProxyRouterOptions = {}): Router => {\n  const {\n    rateLimitPerMinute = DEFAULT_RATE_LIMIT,\n    maxTimeout = DEFAULT_TIMEOUT,\n    maxBodySize = DEFAULT_MAX_BODY,\n    allowedDomains = [],\n    onRequest,\n  } = options\n\n  const router = Router()\n\n  // Rate limiting — try to use express-rate-limit if available, otherwise\n  // fall back to a simple in-memory counter.\n  try {\n    // eslint-disable-next-line @typescript-eslint/no-require-imports\n    const rateLimit = require('express-rate-limit').default ?? require('express-rate-limit')\n    router.use(\n      rateLimit({\n        windowMs: 60_000,\n        max: rateLimitPerMinute,\n        standardHeaders: true,\n        legacyHeaders: false,\n        message: { error: 'Too many proxy requests. Please try again later.' },\n      }),\n    )\n  } catch {\n    // express-rate-limit not installed — use basic in-memory limiter.\n    const hits = new Map<string, { count: number; resetAt: number }>()\n    router.use((req: Request, res: Response, next) => {\n      const key = req.ip ?? 'unknown'\n      const now = Date.now()\n      const entry = hits.get(key)\n\n      if (!entry || now > entry.resetAt) {\n        hits.set(key, { count: 1, resetAt: now + 60_000 })\n        return next()\n      }\n\n      if (entry.count >= rateLimitPerMinute) {\n        return res.status(429).json({ error: 'Too many proxy requests. Please try again later.' })\n      }\n\n      entry.count++\n      return next()\n    })\n  }\n\n  router.post('/', async (req: Request, res: Response) => {\n    const proxyReq = req.body as ProxyRequest\n\n    // Validate required fields.\n    if (!proxyReq?.url || !proxyReq?.method) {\n      return res.status(400).json({ error: 'Missing required fields: url, method' })\n    }\n\n    // Validate URL format.\n    let targetUrl: URL\n    try {\n      targetUrl = new URL(proxyReq.url)\n    } catch {\n      return res.status(400).json({ error: 'Invalid target URL' })\n    }\n\n    // SSRF protection — block private IPs.\n    const hostname = targetUrl.hostname\n    if (isPrivateIp(hostname)) {\n      return res.status(403).json({ error: 'Requests to private/internal addresses are not allowed' })\n    }\n\n    // Domain allowlist (if configured).\n    if (allowedDomains.length > 0) {\n      const allowed = allowedDomains.some(\n        (domain) => hostname === domain || hostname.endsWith(`.${domain}`),\n      )\n      if (!allowed) {\n        return res.status(403).json({ error: `Domain ${hostname} is not in the allowed list` })\n      }\n    }\n\n    // Enforce body size limit.\n    if (proxyReq.body && proxyReq.body.length > maxBodySize) {\n      return res.status(413).json({ error: `Request body exceeds ${maxBodySize} byte limit` })\n    }\n\n    const timeout = Math.min(proxyReq.timeout ?? maxTimeout, maxTimeout)\n    const controller = new AbortController()\n    const timeoutId = setTimeout(() => controller.abort(), timeout)\n    const startTime = Date.now()\n\n    // Decode base64-encoded bodies (used for multipart/form-data uploads —\n    // the client serializes the real multipart payload and base64-encodes it\n    // to fit the JSON envelope) back to raw bytes before forwarding.\n    let outboundBody: string | Buffer | undefined = proxyReq.body ?? undefined\n    if (outboundBody !== undefined && proxyReq.bodyEncoding === 'base64') {\n      try {\n        outboundBody = Buffer.from(outboundBody as string, 'base64')\n      } catch {\n        return res.status(400).json({ error: 'Invalid base64 request body' })\n      }\n    }\n\n    try {\n      const fetchResponse = await fetch(proxyReq.url, {\n        method: proxyReq.method,\n        headers: proxyReq.headers ?? {},\n        // Buffer is a Uint8Array at runtime; Node's fetch accepts it. The DOM\n        // BodyInit typing doesn't know that, hence the cast.\n        body: outboundBody as BodyInit | undefined,\n        signal: controller.signal,\n      })\n\n      // Binary content types are read as bytes and base64-encoded so file\n      // downloads survive the JSON envelope; text flows are unchanged.\n      const responseContentType = fetchResponse.headers.get('content-type') ?? ''\n      const isBinary = isBinaryContentType(responseContentType)\n      const responseBody = isBinary\n        ? Buffer.from(await fetchResponse.arrayBuffer()).toString('base64')\n        : await fetchResponse.text()\n      const duration = Date.now() - startTime\n\n      // Enforce response body size limit.\n      if (responseBody.length > maxBodySize) {\n        return res.status(502).json({\n          status: 502,\n          statusText: 'Response too large',\n          headers: {},\n          body: `Response body exceeds ${maxBodySize} byte limit`,\n          bodyEncoding: 'utf-8' as const,\n          duration,\n        })\n      }\n\n      const responseHeaders: Record<string, string> = {}\n      fetchResponse.headers.forEach((value, key) => {\n        responseHeaders[key] = value\n      })\n\n      const proxyRes: ProxyResponse = {\n        status: fetchResponse.status,\n        statusText: fetchResponse.statusText,\n        headers: responseHeaders,\n        body: responseBody,\n        bodyEncoding: isBinary ? 'base64' : 'utf-8',\n        duration,\n      }\n\n      // Fire audit callback (non-blocking).\n      if (onRequest) {\n        try {\n          onRequest({\n            targetUrl: proxyReq.url,\n            method: proxyReq.method,\n            statusCode: fetchResponse.status,\n            duration,\n            timestamp: new Date().toISOString(),\n            ip: req.ip ?? 'unknown',\n          })\n        } catch {\n          // Audit must never block the response.\n        }\n      }\n\n      return res.json(proxyRes)\n    } catch (err) {\n      const duration = Date.now() - startTime\n      const message = err instanceof Error ? err.message : 'Unknown error'\n      const isTimeout = message.includes('abort')\n\n      return res.status(isTimeout ? 504 : 502).json({\n        status: isTimeout ? 504 : 502,\n        statusText: isTimeout ? 'Gateway Timeout' : 'Bad Gateway',\n        headers: {},\n        body: message,\n        bodyEncoding: 'utf-8',\n        duration,\n      } satisfies ProxyResponse)\n    } finally {\n      clearTimeout(timeoutId)\n    }\n  })\n\n  return router\n}\n"],"names":[],"mappings":";;;;AAsCA,MAAM,kBAAA,GAAqB,EAAA;AAC3B,MAAM,eAAA,GAAkB,GAAA;AACxB,MAAM,gBAAA,GAAmB,OAAA;AAclB,MAAM,iBAAA,GAAoB,CAAC,OAAA,GAA8B,EAAC,KAAc;AAC7E,EAAA,MAAM;AAAA,IACJ,kBAAA,GAAqB,kBAAA;AAAA,IACrB,UAAA,GAAa,eAAA;AAAA,IACb,WAAA,GAAc,gBAAA;AAAA,IACd,iBAAiB,EAAC;AAAA,IAClB;AAAA,GACF,GAAI,OAAA;AAEJ,EAAA,MAAM,SAAS,MAAA,EAAO;AAItB,EAAA,IAAI;AAEF,IAAA,MAAM,YAAY,OAAA,CAAQ,oBAAoB,CAAA,CAAE,OAAA,IAAW,QAAQ,oBAAoB,CAAA;AACvF,IAAA,MAAA,CAAO,GAAA;AAAA,MACL,SAAA,CAAU;AAAA,QACR,QAAA,EAAU,GAAA;AAAA,QACV,GAAA,EAAK,kBAAA;AAAA,QACL,eAAA,EAAiB,IAAA;AAAA,QACjB,aAAA,EAAe,KAAA;AAAA,QACf,OAAA,EAAS,EAAE,KAAA,EAAO,kDAAA;AAAmD,OACtE;AAAA,KACH;AAAA,EACF,CAAA,CAAA,MAAQ;AAEN,IAAA,MAAM,IAAA,uBAAW,GAAA,EAAgD;AACjE,IAAA,MAAA,CAAO,GAAA,CAAI,CAAC,GAAA,EAAc,GAAA,EAAe,IAAA,KAAS;AAChD,MAAA,MAAM,GAAA,GAAM,IAAI,EAAA,IAAM,SAAA;AACtB,MAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA;AAE1B,MAAA,IAAI,CAAC,KAAA,IAAS,GAAA,GAAM,KAAA,CAAM,OAAA,EAAS;AACjC,QAAA,IAAA,CAAK,GAAA,CAAI,KAAK,EAAE,KAAA,EAAO,GAAG,OAAA,EAAS,GAAA,GAAM,KAAQ,CAAA;AACjD,QAAA,OAAO,IAAA,EAAK;AAAA,MACd;AAEA,MAAA,IAAI,KAAA,CAAM,SAAS,kBAAA,EAAoB;AACrC,QAAA,OAAO,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,oDAAoD,CAAA;AAAA,MAC3F;AAEA,MAAA,KAAA,CAAM,KAAA,EAAA;AACN,MAAA,OAAO,IAAA,EAAK;AAAA,IACd,CAAC,CAAA;AAAA,EACH;AAEA,EAAA,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,OAAO,GAAA,EAAc,GAAA,KAAkB;AACtD,IAAA,MAAM,WAAW,GAAA,CAAI,IAAA;AAGrB,IAAA,IAAI,CAAC,QAAA,EAAU,GAAA,IAAO,CAAC,UAAU,MAAA,EAAQ;AACvC,MAAA,OAAO,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,wCAAwC,CAAA;AAAA,IAC/E;AAGA,IAAA,IAAI,SAAA;AACJ,IAAA,IAAI;AACF,MAAA,SAAA,GAAY,IAAI,GAAA,CAAI,QAAA,CAAS,GAAG,CAAA;AAAA,IAClC,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,sBAAsB,CAAA;AAAA,IAC7D;AAGA,IAAA,MAAM,WAAW,SAAA,CAAU,QAAA;AAC3B,IAAA,IAAI,WAAA,CAAY,QAAQ,CAAA,EAAG;AACzB,MAAA,OAAO,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,0DAA0D,CAAA;AAAA,IACjG;AAGA,IAAA,IAAI,cAAA,CAAe,SAAS,CAAA,EAAG;AAC7B,MAAA,MAAM,UAAU,cAAA,CAAe,IAAA;AAAA,QAC7B,CAAC,WAAW,QAAA,KAAa,MAAA,IAAU,SAAS,QAAA,CAAS,CAAA,CAAA,EAAI,MAAM,CAAA,CAAE;AAAA,OACnE;AACA,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,CAAA,OAAA,EAAU,QAAQ,CAAA,2BAAA,CAAA,EAA+B,CAAA;AAAA,MACxF;AAAA,IACF;AAGA,IAAA,IAAI,QAAA,CAAS,IAAA,IAAQ,QAAA,CAAS,IAAA,CAAK,SAAS,WAAA,EAAa;AACvD,MAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,CAAA,qBAAA,EAAwB,WAAW,CAAA,WAAA,CAAA,EAAe,CAAA;AAAA,IACzF;AAEA,IAAA,MAAM,UAAU,IAAA,CAAK,GAAA,CAAI,QAAA,CAAS,OAAA,IAAW,YAAY,UAAU,CAAA;AACnE,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,YAAY,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,OAAO,CAAA;AAC9D,IAAA,MAAM,SAAA,GAAY,KAAK,GAAA,EAAI;AAK3B,IAAA,IAAI,YAAA,GAA4C,SAAS,IAAA,IAAQ,MAAA;AACjE,IAAA,IAAI,YAAA,KAAiB,MAAA,IAAa,QAAA,CAAS,YAAA,KAAiB,QAAA,EAAU;AACpE,MAAA,IAAI;AACF,QAAA,YAAA,GAAe,MAAA,CAAO,IAAA,CAAK,YAAA,EAAwB,QAAQ,CAAA;AAAA,MAC7D,CAAA,CAAA,MAAQ;AACN,QAAA,OAAO,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,+BAA+B,CAAA;AAAA,MACtE;AAAA,IACF;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,aAAA,GAAgB,MAAM,KAAA,CAAM,QAAA,CAAS,GAAA,EAAK;AAAA,QAC9C,QAAQ,QAAA,CAAS,MAAA;AAAA,QACjB,OAAA,EAAS,QAAA,CAAS,OAAA,IAAW,EAAC;AAAA;AAAA;AAAA,QAG9B,IAAA,EAAM,YAAA;AAAA,QACN,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AAID,MAAA,MAAM,mBAAA,GAAsB,aAAA,CAAc,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AACzE,MAAA,MAAM,QAAA,GAAW,oBAAoB,mBAAmB,CAAA;AACxD,MAAA,MAAM,YAAA,GAAe,QAAA,GACjB,MAAA,CAAO,IAAA,CAAK,MAAM,aAAA,CAAc,WAAA,EAAa,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA,GAChE,MAAM,cAAc,IAAA,EAAK;AAC7B,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAG9B,MAAA,IAAI,YAAA,CAAa,SAAS,WAAA,EAAa;AACrC,QAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,UAC1B,MAAA,EAAQ,GAAA;AAAA,UACR,UAAA,EAAY,oBAAA;AAAA,UACZ,SAAS,EAAC;AAAA,UACV,IAAA,EAAM,yBAAyB,WAAW,CAAA,WAAA,CAAA;AAAA,UAC1C,YAAA,EAAc,OAAA;AAAA,UACd;AAAA,SACD,CAAA;AAAA,MACH;AAEA,MAAA,MAAM,kBAA0C,EAAC;AACjD,MAAA,aAAA,CAAc,OAAA,CAAQ,OAAA,CAAQ,CAAC,KAAA,EAAO,GAAA,KAAQ;AAC5C,QAAA,eAAA,CAAgB,GAAG,CAAA,GAAI,KAAA;AAAA,MACzB,CAAC,CAAA;AAED,MAAA,MAAM,QAAA,GAA0B;AAAA,QAC9B,QAAQ,aAAA,CAAc,MAAA;AAAA,QACtB,YAAY,aAAA,CAAc,UAAA;AAAA,QAC1B,OAAA,EAAS,eAAA;AAAA,QACT,IAAA,EAAM,YAAA;AAAA,QACN,YAAA,EAAc,WAAW,QAAA,GAAW,OAAA;AAAA,QACpC;AAAA,OACF;AAGA,MAAA,IAAI,SAAA,EAAW;AACb,QAAA,IAAI;AACF,UAAA,SAAA,CAAU;AAAA,YACR,WAAW,QAAA,CAAS,GAAA;AAAA,YACpB,QAAQ,QAAA,CAAS,MAAA;AAAA,YACjB,YAAY,aAAA,CAAc,MAAA;AAAA,YAC1B,QAAA;AAAA,YACA,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAAA,YAClC,EAAA,EAAI,IAAI,EAAA,IAAM;AAAA,WACf,CAAA;AAAA,QACH,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF;AAEA,MAAA,OAAO,GAAA,CAAI,KAAK,QAAQ,CAAA;AAAA,IAC1B,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAC9B,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,eAAA;AACrD,MAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,QAAA,CAAS,OAAO,CAAA;AAE1C,MAAA,OAAO,IAAI,MAAA,CAAO,SAAA,GAAY,GAAA,GAAM,GAAG,EAAE,IAAA,CAAK;AAAA,QAC5C,MAAA,EAAQ,YAAY,GAAA,GAAM,GAAA;AAAA,QAC1B,UAAA,EAAY,YAAY,iBAAA,GAAoB,aAAA;AAAA,QAC5C,SAAS,EAAC;AAAA,QACV,IAAA,EAAM,OAAA;AAAA,QACN,YAAA,EAAc,OAAA;AAAA,QACd;AAAA,OACuB,CAAA;AAAA,IAC3B,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,SAAS,CAAA;AAAA,IACxB;AAAA,EACF,CAAC,CAAA;AAED,EAAA,OAAO,MAAA;AACT;;;;"}