@blixis-io/http 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Michael Voeten
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,37 @@
+# `@blixis-io/http`
+
+The HTTP layer built on [`@blixis-io/core`](https://www.npmjs.com/package/@blixis-io/core) — routing, controllers, request validation with [Zod](https://zod.dev), guards, RFC 9457 error responses.
+
+```bash
+npm install @blixis-io/http @blixis-io/core @blixis-io/di
+```
+
+```ts
+import { Body, Controller, Get, Param, Post, createHttpApplication } from "@blixis-io/http";
+import { Module } from "@blixis-io/core";
+
+@Controller("posts")
+class PostController {
+  constructor(private readonly posts: PostService) {}
+
+  @Get(":id")
+  get(@Param("id") id: string) {
+    return this.posts.get(id);
+  }
+
+  @Post()
+  create(@Body(CreatePostSchema) input: CreatePostInput) {
+    return this.posts.create(input);
+  }
+}
+
+@Module({ providers: [PostService], controllers: [PostController] })
+class AppModule {}
+
+const app = await createHttpApplication(AppModule);
+await app.listen(3000);
+```
+
+Built on the Web-standard `Request`/`Response` — the whole request pipeline is one `(Request) => Promise<Response>` function, testable in-process with no socket needed.
+
+Part of [Blixis Framework](https://github.com/blixis-io/framework) — full docs: [Routing & Controllers](https://blixis-io.github.io/framework/concepts/routing-controllers/) · [API reference](https://blixis-io.github.io/framework/reference/blixis-http/).

package/dist/index.d.ts

@@ -0,0 +1,280 @@
+import { Class, Token } from "@blixis-io/di";
+import { Application, CreateApplicationOptions, ModuleRef } from "@blixis-io/core";
+import { IncomingMessage, ServerResponse } from "node:http";
+import { ZodType } from "zod";
+//#region src/decorators/api-metadata.d.ts
+interface ApiOperationOptions {
+  summary?: string;
+  description?: string;
+  /** Defaults to `${ControllerName}_${methodName}` when omitted — every operation needs a unique one, valid or not. */
+  operationId?: string;
+}
+/** Documents one route for `@blixis-io/openapi` — entirely optional, a route without it still gets a valid (derived) operationId. */
+export declare function ApiOperation(options: ApiOperationOptions): MethodDecorator;
+export declare function getApiOperation(target: object, propertyKey: string | symbol): ApiOperationOptions | undefined;
+/**
+ * Applies OpenAPI tags to a controller (class position) or a single route
+ * (method position) — same dual-shape decorator as `@UseGuards`. Class-level
+ * and method-level tags both apply, concatenated, not one replacing the
+ * other.
+ */
+export declare function ApiTags(...tags: string[]): ClassDecorator & MethodDecorator;
+export declare function getClassApiTags(target: object): string[];
+export declare function getMethodApiTags(target: object, propertyKey: string | symbol): string[];
+//#endregion
+//#region src/decorators/controller.d.ts
+export declare function Controller(prefix?: string): ClassDecorator;
+export declare function getControllerPrefix(target: object): string | undefined;
+//#endregion
+//#region src/decorators/guards.d.ts
+interface ExecutionContext {
+  request: Request;
+  params: Readonly<Record<string, string>>;
+}
+interface CanActivate {
+  canActivate(context: ExecutionContext): boolean | Promise<boolean>;
+}
+/**
+ * Applies guards to a controller (class position) or a single route
+ * (method position) — the same decorator function works in both spots,
+ * matching the shape TS's legacy decorators give it: a class decorator
+ * receives no `propertyKey`, a method decorator does.
+ */
+export declare function UseGuards(...guards: Class<CanActivate>[]): ClassDecorator & MethodDecorator;
+export declare function getClassGuards(target: object): Class<CanActivate>[];
+export declare function getMethodGuards(target: object, propertyKey: string | symbol): Class<CanActivate>[];
+//#endregion
+//#region src/decorators/interceptors.d.ts
+interface Interceptor {
+  intercept(context: ExecutionContext, next: () => Promise<Response>): Response | Promise<Response>;
+}
+/**
+ * Applies interceptors to a controller (class position) or a single route
+ * (method position) — same dual-shape decorator as `@UseGuards`. Interceptors
+ * wrap param resolution + handler invocation (guards already ran and
+ * already decided the request is allowed through); class-level interceptors
+ * wrap outermost, method-level innermost, closest to the handler.
+ */
+export declare function UseInterceptors(...interceptors: Class<Interceptor>[]): ClassDecorator & MethodDecorator;
+export declare function getClassInterceptors(target: object): Class<Interceptor>[];
+export declare function getMethodInterceptors(target: object, propertyKey: string | symbol): Class<Interceptor>[];
+//#endregion
+//#region src/decorators/params.d.ts
+type ParamSource = {
+  kind: "body";
+  schema?: ZodType | undefined;
+} | {
+  kind: "query";
+  schema?: ZodType | undefined;
+} | {
+  kind: "param";
+  name: string;
+  schema?: ZodType | undefined;
+} | {
+  kind: "headers";
+  name?: string | undefined;
+} | {
+  kind: "req";
+};
+/** Parses the JSON request body, validating it with `schema` when given. */
+export declare function Body(schema?: ZodType): ParameterDecorator;
+/** The parsed query string as an object, validated with `schema` when given. */
+export declare function Query(schema?: ZodType): ParameterDecorator;
+/** One route param by name, validated with `schema` when given (otherwise the raw string). */
+export declare function Param(name: string, schema?: ZodType): ParameterDecorator;
+/** One request header by name, or all headers as an object when `name` is omitted. */
+export declare function Headers(name?: string): ParameterDecorator;
+/** The raw Web-standard `Request`. */
+export declare function Req(): ParameterDecorator;
+export declare function getParamSources(target: object, propertyKey: string | symbol): Map<number, ParamSource>;
+//#endregion
+//#region src/types.d.ts
+export declare const HTTP_METHODS: readonly ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"];
+type HttpMethod = (typeof HTTP_METHODS)[number];
+//#endregion
+//#region src/decorators/routes.d.ts
+interface RouteDefinition {
+  method: HttpMethod;
+  path: string;
+  propertyKey: string | symbol;
+}
+export declare const Get: (path?: string) => MethodDecorator;
+export declare const Post: (path?: string) => MethodDecorator;
+export declare const Put: (path?: string) => MethodDecorator;
+export declare const Patch: (path?: string) => MethodDecorator;
+export declare const Delete: (path?: string) => MethodDecorator;
+export declare function getRoutes(target: object): RouteDefinition[];
+/** Overrides the default 200 (or 204 for an `undefined` return) status for one route. */
+export declare function HttpCode(code: number): MethodDecorator;
+export declare function getHttpCode(target: object, propertyKey: string | symbol): number | undefined;
+/**
+ * Declares the response body's shape for one route. Validated after the
+ * handler returns, before serialization — a mismatch is a server bug (the
+ * implementation drifted from its own declared contract), not a client
+ * error, so it never reaches the client as anything but a generic 500.
+ */
+export declare function Returns(schema: ZodType): MethodDecorator;
+export declare function getReturnsSchema(target: object, propertyKey: string | symbol): ZodType | undefined;
+//#endregion
+//#region src/exceptions.d.ts
+/** Thrown from a guard or handler to short-circuit the response with a specific status. */
+export declare class HttpException extends Error {
+  readonly status: number;
+  readonly detail: string;
+  readonly extra?: Record<string, unknown> | undefined;
+  constructor(status: number, detail: string, extra?: Record<string, unknown> | undefined);
+}
+export declare class BadRequestException extends HttpException {
+  constructor(detail?: string, extra?: Record<string, unknown>);
+}
+export declare class UnauthorizedException extends HttpException {
+  constructor(detail?: string);
+}
+export declare class ForbiddenException extends HttpException {
+  constructor(detail?: string);
+}
+export declare class NotFoundException extends HttpException {
+  constructor(detail?: string);
+}
+export declare class ConflictException extends HttpException {
+  constructor(detail?: string);
+}
+export declare class PayloadTooLargeException extends HttpException {
+  constructor(detail?: string);
+}
+export declare class UnsupportedMediaTypeException extends HttpException {
+  constructor(detail?: string);
+}
+//#endregion
+//#region src/router.d.ts
+interface RouteFound<T> {
+  kind: "found";
+  handler: T;
+  params: Record<string, string>;
+}
+interface RouteNotFound {
+  kind: "not-found";
+}
+interface RouteMethodNotAllowed {
+  kind: "method-not-allowed";
+  allowed: HttpMethod[];
+}
+type RouteLookupResult<T> = RouteFound<T> | RouteNotFound | RouteMethodNotAllowed;
+/**
+ * A path router keyed on an opaque handler type `T` — this package plugs in
+ * controller method references; tests plug in plain strings.
+ */
+export declare class Router<T> {
+  #private;
+  add(method: HttpMethod, path: string, handler: T): void;
+  match(method: HttpMethod, path: string): RouteLookupResult<T>;
+}
+//#endregion
+//#region src/handler.d.ts
+interface HandlerOptions {
+  bodyLimit?: number;
+}
+export declare class NotAControllerError extends Error {
+  readonly name = "NotAControllerError";
+  constructor(target: {
+    name: string;
+  });
+}
+interface RouteEntry {
+  controller: Class;
+  propertyKey: string | symbol;
+  paramSources: ReadonlyMap<number, ParamSource>;
+  httpCode?: number | undefined;
+  responseSchema?: ZodType | undefined;
+  guards: Class<CanActivate>[];
+  interceptors: Class<Interceptor>[];
+}
+/**
+ * Flattens every `@Controller`'s route metadata into one `Router`. Guard
+ * classes referenced via `@UseGuards` must also be registered as providers
+ * on the owning module — this doesn't instantiate them, it only records
+ * which classes `createHandler` will later ask the `Application` for.
+ */
+export declare function buildRouter(controllers: readonly Class[]): Router<RouteEntry>;
+/** Builds a single `(Request) => Promise<Response>` function serving every controller's routes. */
+export declare function createHandler(controllers: readonly Class[], application: Application, options?: HandlerOptions): (request: Request) => Promise<Response>;
+//#endregion
+//#region src/http-application.d.ts
+type HttpApplicationOptions = HandlerOptions & CreateApplicationOptions;
+interface ListenHandle {
+  port: number;
+}
+/** The core `Application` plus a request handler, optionally bound to a real Node HTTP socket. */
+export declare class HttpApplication {
+  #private;
+  private constructor();
+  static create(rootModule: ModuleRef, options?: HttpApplicationOptions): Promise<HttpApplication>;
+  /** Fetches an already-resolved provider directly, bypassing HTTP entirely. */
+  get<T>(token: Token<T>): T;
+  /** Every controller class in this app's module graph — what `@blixis-io/openapi` walks to build a document that stays in sync with the real running app. */
+  get controllers(): readonly Class[];
+  /** Runs a request through the handler in-process, without a socket. */
+  handle(request: Request): Promise<Response>;
+  listen(port: number, hostname?: string): Promise<ListenHandle>;
+  close(signal?: string): Promise<void>;
+}
+export declare function createHttpApplication(rootModule: ModuleRef, options?: HttpApplicationOptions): Promise<HttpApplication>;
+//#endregion
+//#region src/node-adapter.d.ts
+/** Builds a Web-standard `Request` from a Node `IncomingMessage`, including a body stream and abort signal. */
+export declare function toWebRequest(req: IncomingMessage, baseUrl: string): Request;
+/** Writes a Web-standard `Response` back onto a Node `ServerResponse`. */
+export declare function sendWebResponse(response: Response, res: ServerResponse): Promise<void>;
+//#endregion
+//#region src/params.d.ts
+interface ParamResolutionContext {
+  request: Request;
+  routeParams: Readonly<Record<string, string>>;
+  /** Reads and JSON-parses the body, memoized per-request by the caller. Rejects with an HttpException (400/413/415) on failure. */
+  getBody: () => Promise<unknown>;
+}
+/** Builds the positional argument list for a route handler from its `@Body`/`@Query`/`@Param`/`@Headers`/`@Req` metadata. */
+export declare function resolveHandlerArgs(sources: ReadonlyMap<number, ParamSource>, context: ParamResolutionContext): Promise<unknown[]>;
+//#endregion
+//#region src/request-context.d.ts
+/** Thrown by `RequestContext.set()` when called outside an active request scope. */
+export declare class RequestContextError extends Error {
+  constructor();
+}
+/**
+ * Per-request key/value store. Injectable as a singleton because its
+ * methods don't hold state themselves — they read/write whichever
+ * `Map` `runInRequestContext` made current for the request now being
+ * handled, via `AsyncLocalStorage`. Reading (`get`/`has`) outside a
+ * request is a legitimate "no request" answer; writing isn't, so
+ * `set()` throws instead of silently doing nothing.
+ */
+export declare class RequestContext {
+  get<T = unknown>(key: string): T | undefined;
+  has(key: string): boolean;
+  set(key: string, value: unknown): void;
+}
+/** Runs `fn` with a fresh, isolated store current for its whole async call chain — what `createHandler` wraps around each request. */
+export declare function runInRequestContext<T>(fn: () => T): T;
+//#endregion
+//#region src/response.d.ts
+interface ResponseValidationIssue {
+  path: PropertyKey[];
+  message: string;
+}
+/**
+ * Thrown when a handler's return value doesn't match its `@Returns`
+ * schema. Deliberately not an `HttpException` — this is a server-side
+ * contract bug, not the client's fault, so it falls through to the
+ * generic 500 path instead of exposing the mismatch (and the app's
+ * internal shape) to the client.
+ */
+export declare class ResponseValidationError extends Error {
+  readonly issues: readonly ResponseValidationIssue[];
+  constructor(issues: readonly ResponseValidationIssue[]);
+}
+/** Validates a handler's return value against its `@Returns` schema, if any — returns the value (possibly parsed/coerced) unchanged when there's no schema. */
+export declare function validateResponse(schema: ZodType | undefined, value: unknown): Promise<unknown>;
+//#endregion
+export type { ApiOperationOptions, CanActivate, ExecutionContext, HandlerOptions, HttpApplicationOptions, HttpMethod, Interceptor, ListenHandle, ParamResolutionContext, ParamSource, RouteDefinition, RouteFound, RouteLookupResult, RouteMethodNotAllowed, RouteNotFound };
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/decorators/api-metadata.ts","../src/decorators/controller.ts","../src/decorators/guards.ts","../src/decorators/interceptors.ts","../src/decorators/params.ts","../src/types.ts","../src/decorators/routes.ts","../src/exceptions.ts","../src/router.ts","../src/handler.ts","../src/http-application.ts","../src/node-adapter.ts","../src/params.ts","../src/request-context.ts","../src/response.ts"],"mappings":";;;;;UAEiB;EACf;EACA;;EAEA;;;wBAOc,aAAa,SAAS,sBAAsB;wBAM5C,gBAAgB,gBAAgB,+BAA+B;;;;;;;wBAU/D,WAAW,iBAAiB,iBAAiB;wBAa7C,gBAAgB;wBAIhB,iBAAiB,gBAAgB;;;wBCtCjC,WAAW,kBAAc;wBAMzB,oBAAoB;;;UCZnB;EACf,SAAS;EACT,QAAQ,SAAS;;UAGF;EACf,YAAY,SAAS,6BAA6B;;;;;;;;wBAWpC,aAAa,QAAQ,MAAM,iBAAiB,iBAAiB;wBAa7D,eAAe,iBAAiB,MAAM;wBAItC,gBAAgB,gBAAgB,+BAA+B,MAAM;;;UCjCpE;EACf,UAAU,SAAS,kBAAkB,YAAY,QAAQ,YAAY,WAAW,QAAQ;;;;;;;;;wBAY1E,mBAAmB,cAAc,MAAM,iBAAiB,iBAAiB;wBAazE,qBAAqB,iBAAiB,MAAM;wBAI5C,sBAAsB,gBAAgB,+BAA+B,MAAM;;;KC9B/E;EACN;EAAc,SAAS;;EACvB;EAAe,SAAS;;EACxB;EAAe;EAAc,SAAS;;EACtC;EAAiB;;EACjB;;;wBAiBU,KAAK,SAAS,UAAU;;wBAKxB,MAAM,SAAS,UAAU;;wBAKzB,MAAM,cAAc,SAAS,UAAU;;wBAKvC,QAAQ,gBAAgB;;wBAKxB,OAAO;wBAIP,gBAAgB,gBAAgB,+BAA+B,YAAY;;;qBCjD9E;KAED,qBAAqB;;;UCEhB;EACf,QAAQ;EACR;EACA;;qBAgBW,MAAG,kBAAgB;qBACnB,OAAI,kBAAgB;qBACpB,MAAG,kBAAgB;qBACnB,QAAK,kBAAgB;qBACrB,SAAM,kBAAgB;wBAEnB,UAAU,iBAAiB;;wBAK3B,SAAS,eAAe;wBAMxB,YAAY,gBAAgB;;;;;;;wBAU5B,QAAQ,QAAQ,UAAU;wBAM1B,iBAAiB,gBAAgB,+BAA+B;;;;qBCvDnE,sBAAsB;WAEf;WACA;WACA,QAAQ;EAH1B,YACkB,gBACA,gBACA,QAAQ;;qBAOf,4BAA4B;EACvC,YAAY,iBAAwB,QAAQ;;qBAMjC,8BAA8B;EACzC,YAAY;;qBAMD,2BAA2B;EACtC,YAAY;;qBAMD,0BAA0B;EACrC,YAAY;;qBAMD,0BAA0B;EACrC,YAAY;;qBAMD,iCAAiC;EAC5C,YAAY;;qBAMD,sCAAsC;EACjD,YAAY;;;;UCrDG,WAAW;EAC1B;EACA,SAAS;EACT,QAAQ;;UAGO;EACf;;UAGe;EACf;EACA,SAAS;;KAGC,kBAAkB,KAAK,WAAW,KAAK,gBAAgB;;;;;qBA8EtD,OAAO;;EAGlB,IAAI,QAAQ,YAAY,cAAc,SAAS;EA4B/C,MAAM,QAAQ,YAAY,eAAe,kBAAkB;;;;UCvG5C;EACf;;qBAGW,4BAA4B;WACrB;EAElB,YAAY;IAAU;;;UAKd;EACR,YAAY;EACZ;EACA,cAAc,oBAAoB;EAClC;EACA,iBAAiB;EACjB,QAAQ,MAAM;EACd,cAAc,MAAM;;;;;;;;wBASN,YAAY,sBAAsB,UAAU,OAAO;;wBA+GnD,cACd,sBAAsB,SACtB,aAAa,aACb,UAAS,kBACP,SAAS,YAAY,QAAQ;;;KC/JrB,yBAAyB,iBAAiB;UAUrC;EACf;;;qBAIW;;UAKJ;SAKM,OAAO,YAAY,WAAW,UAAS,yBAA8B,QAAQ;;EAQ1F,IAAI,GAAG,OAAO,MAAM,KAAK;;MAKrB,wBAAwB;;EAK5B,OAAO,SAAS,UAAU,QAAQ;EAIlC,OAAO,cAAc,oBAAuB,QAAQ;EAmC9C,MAAM,kBAAkB;;wBAyBV,sBACpB,YAAY,WACZ,UAAS,yBACR,QAAQ;;;;wBCjHK,aAAa,KAAK,iBAAiB,kBAAkB;;wBAuC/C,gBAAgB,UAAU,UAAU,KAAK,iBAAiB;;;UCvC/D;EACf,SAAS;EACT,aAAa,SAAS;;EAEtB,eAAe;;;wBAuCK,mBACpB,SAAS,oBAAoB,cAC7B,SAAS,yBACR;;;;qBC5CU,4BAA4B;EACvC;;;;;;;;;;qBAeW;EACX,IAAI,aAAa,cAAc;EAI/B,IAAI;EAIJ,IAAI,aAAa;;;wBAUH,oBAAoB,GAAG,UAAU,IAAI;;;UCvC3C;EACR,MAAM;EACN;;;;;;;;;qBAUW,gCAAgC;WACf,iBAAiB;EAA7C,YAA4B,iBAAiB;;;wBAOzB,iBAAiB,QAAQ,qBAAqB,iBAAiB"}

package/dist/index.js

@@ -0,0 +1,732 @@
+import { Injectable, defineMetadata, getMetadata } from "@blixis-io/di";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { Module, createApplication } from "@blixis-io/core";
+import { createServer } from "node:http";
+import { Readable } from "node:stream";
+//#region src/decorators/api-metadata.ts
+const API_OPERATION = Symbol("blixis:api-operation");
+const API_TAGS = Symbol("blixis:api-tags");
+/** Documents one route for `@blixis-io/openapi` — entirely optional, a route without it still gets a valid (derived) operationId. */
+function ApiOperation(options) {
+	return (target, propertyKey) => {
+		defineMetadata(API_OPERATION, options, target, propertyKey);
+	};
+}
+function getApiOperation(target, propertyKey) {
+	return getMetadata(API_OPERATION, target, propertyKey);
+}
+/**
+* Applies OpenAPI tags to a controller (class position) or a single route
+* (method position) — same dual-shape decorator as `@UseGuards`. Class-level
+* and method-level tags both apply, concatenated, not one replacing the
+* other.
+*/
+function ApiTags(...tags) {
+	const decorator = (target, propertyKey) => {
+		if (propertyKey === void 0) {
+			const existing = getMetadata(API_TAGS, target) ?? [];
+			defineMetadata(API_TAGS, [...existing, ...tags], target);
+		} else {
+			const existing = getMetadata(API_TAGS, target, propertyKey) ?? [];
+			defineMetadata(API_TAGS, [...existing, ...tags], target, propertyKey);
+		}
+	};
+	return decorator;
+}
+function getClassApiTags(target) {
+	return getMetadata(API_TAGS, target) ?? [];
+}
+function getMethodApiTags(target, propertyKey) {
+	return getMetadata(API_TAGS, target, propertyKey) ?? [];
+}
+//#endregion
+//#region src/decorators/controller.ts
+const CONTROLLER_PREFIX = Symbol("blixis:controller-prefix");
+function stripSlashes(value) {
+	return value.replace(/^\/+/, "").replace(/\/+$/, "");
+}
+function Controller(prefix = "") {
+	return (target) => {
+		defineMetadata(CONTROLLER_PREFIX, stripSlashes(prefix), target);
+	};
+}
+function getControllerPrefix(target) {
+	return getMetadata(CONTROLLER_PREFIX, target);
+}
+//#endregion
+//#region src/decorators/guards.ts
+const GUARDS = Symbol("blixis:guards");
+/**
+* Applies guards to a controller (class position) or a single route
+* (method position) — the same decorator function works in both spots,
+* matching the shape TS's legacy decorators give it: a class decorator
+* receives no `propertyKey`, a method decorator does.
+*/
+function UseGuards(...guards) {
+	const decorator = (target, propertyKey) => {
+		if (propertyKey === void 0) {
+			const existing = getMetadata(GUARDS, target) ?? [];
+			defineMetadata(GUARDS, [...existing, ...guards], target);
+		} else {
+			const existing = getMetadata(GUARDS, target, propertyKey) ?? [];
+			defineMetadata(GUARDS, [...existing, ...guards], target, propertyKey);
+		}
+	};
+	return decorator;
+}
+function getClassGuards(target) {
+	return getMetadata(GUARDS, target) ?? [];
+}
+function getMethodGuards(target, propertyKey) {
+	return getMetadata(GUARDS, target, propertyKey) ?? [];
+}
+//#endregion
+//#region src/decorators/interceptors.ts
+const INTERCEPTORS = Symbol("blixis:interceptors");
+/**
+* Applies interceptors to a controller (class position) or a single route
+* (method position) — same dual-shape decorator as `@UseGuards`. Interceptors
+* wrap param resolution + handler invocation (guards already ran and
+* already decided the request is allowed through); class-level interceptors
+* wrap outermost, method-level innermost, closest to the handler.
+*/
+function UseInterceptors(...interceptors) {
+	const decorator = (target, propertyKey) => {
+		if (propertyKey === void 0) {
+			const existing = getMetadata(INTERCEPTORS, target) ?? [];
+			defineMetadata(INTERCEPTORS, [...existing, ...interceptors], target);
+		} else {
+			const existing = getMetadata(INTERCEPTORS, target, propertyKey) ?? [];
+			defineMetadata(INTERCEPTORS, [...existing, ...interceptors], target, propertyKey);
+		}
+	};
+	return decorator;
+}
+function getClassInterceptors(target) {
+	return getMetadata(INTERCEPTORS, target) ?? [];
+}
+function getMethodInterceptors(target, propertyKey) {
+	return getMetadata(INTERCEPTORS, target, propertyKey) ?? [];
+}
+//#endregion
+//#region src/decorators/params.ts
+const PARAMS = Symbol("blixis:params");
+function paramDecorator(source) {
+	return (target, propertyKey, parameterIndex) => {
+		if (propertyKey === void 0) throw new Error("@Body/@Query/@Param/@Headers/@Req can only decorate route handler method parameters, not constructor parameters.");
+		const sources = getMetadata(PARAMS, target, propertyKey) ?? /* @__PURE__ */ new Map();
+		sources.set(parameterIndex, source);
+		defineMetadata(PARAMS, sources, target, propertyKey);
+	};
+}
+/** Parses the JSON request body, validating it with `schema` when given. */
+function Body(schema) {
+	return paramDecorator({
+		kind: "body",
+		schema
+	});
+}
+/** The parsed query string as an object, validated with `schema` when given. */
+function Query(schema) {
+	return paramDecorator({
+		kind: "query",
+		schema
+	});
+}
+/** One route param by name, validated with `schema` when given (otherwise the raw string). */
+function Param(name, schema) {
+	return paramDecorator({
+		kind: "param",
+		name,
+		schema
+	});
+}
+/** One request header by name, or all headers as an object when `name` is omitted. */
+function Headers$1(name) {
+	return paramDecorator({
+		kind: "headers",
+		name
+	});
+}
+/** The raw Web-standard `Request`. */
+function Req() {
+	return paramDecorator({ kind: "req" });
+}
+function getParamSources(target, propertyKey) {
+	return getMetadata(PARAMS, target, propertyKey) ?? /* @__PURE__ */ new Map();
+}
+//#endregion
+//#region src/decorators/routes.ts
+const ROUTES = Symbol("blixis:routes");
+const HTTP_CODE = Symbol("blixis:http-code");
+const RETURNS = Symbol("blixis:returns");
+function routeDecorator(method, path) {
+	return (target, propertyKey) => {
+		const ctor = target.constructor;
+		const routes = getMetadata(ROUTES, ctor) ?? [];
+		routes.push({
+			method,
+			path,
+			propertyKey
+		});
+		defineMetadata(ROUTES, routes, ctor);
+	};
+}
+const Get = (path = "") => routeDecorator("GET", path);
+const Post = (path = "") => routeDecorator("POST", path);
+const Put = (path = "") => routeDecorator("PUT", path);
+const Patch = (path = "") => routeDecorator("PATCH", path);
+const Delete = (path = "") => routeDecorator("DELETE", path);
+function getRoutes(target) {
+	return getMetadata(ROUTES, target) ?? [];
+}
+/** Overrides the default 200 (or 204 for an `undefined` return) status for one route. */
+function HttpCode(code) {
+	return (target, propertyKey) => {
+		defineMetadata(HTTP_CODE, code, target, propertyKey);
+	};
+}
+function getHttpCode(target, propertyKey) {
+	return getMetadata(HTTP_CODE, target, propertyKey);
+}
+/**
+* Declares the response body's shape for one route. Validated after the
+* handler returns, before serialization — a mismatch is a server bug (the
+* implementation drifted from its own declared contract), not a client
+* error, so it never reaches the client as anything but a generic 500.
+*/
+function Returns(schema) {
+	return (target, propertyKey) => {
+		defineMetadata(RETURNS, schema, target, propertyKey);
+	};
+}
+function getReturnsSchema(target, propertyKey) {
+	return getMetadata(RETURNS, target, propertyKey);
+}
+//#endregion
+//#region src/exceptions.ts
+/** Thrown from a guard or handler to short-circuit the response with a specific status. */
+var HttpException = class extends Error {
+	constructor(status, detail, extra) {
+		super(detail);
+		this.status = status;
+		this.detail = detail;
+		this.extra = extra;
+		this.name = "HttpException";
+	}
+};
+var BadRequestException = class extends HttpException {
+	constructor(detail = "Bad Request", extra) {
+		super(400, detail, extra);
+		this.name = "BadRequestException";
+	}
+};
+var UnauthorizedException = class extends HttpException {
+	constructor(detail = "Unauthorized") {
+		super(401, detail);
+		this.name = "UnauthorizedException";
+	}
+};
+var ForbiddenException = class extends HttpException {
+	constructor(detail = "Forbidden") {
+		super(403, detail);
+		this.name = "ForbiddenException";
+	}
+};
+var NotFoundException = class extends HttpException {
+	constructor(detail = "Not Found") {
+		super(404, detail);
+		this.name = "NotFoundException";
+	}
+};
+var ConflictException = class extends HttpException {
+	constructor(detail = "Conflict") {
+		super(409, detail);
+		this.name = "ConflictException";
+	}
+};
+var PayloadTooLargeException = class extends HttpException {
+	constructor(detail = "Payload Too Large") {
+		super(413, detail);
+		this.name = "PayloadTooLargeException";
+	}
+};
+var UnsupportedMediaTypeException = class extends HttpException {
+	constructor(detail = "Unsupported Media Type") {
+		super(415, detail);
+		this.name = "UnsupportedMediaTypeException";
+	}
+};
+//#endregion
+//#region src/params.ts
+async function parseWithSchema(schema, value) {
+	const result = await schema.safeParseAsync(value);
+	if (!result.success) throw new BadRequestException("Validation failed", { issues: result.error.issues });
+	return result.data;
+}
+async function resolveOne(source, context) {
+	switch (source.kind) {
+		case "req": return context.request;
+		case "headers": return source.name ? context.request.headers.get(source.name) : Object.fromEntries(context.request.headers);
+		case "param": {
+			const raw = context.routeParams[source.name];
+			return source.schema ? parseWithSchema(source.schema, raw) : raw;
+		}
+		case "query": {
+			const raw = Object.fromEntries(new URL(context.request.url).searchParams);
+			return source.schema ? parseWithSchema(source.schema, raw) : raw;
+		}
+		case "body": {
+			const raw = await context.getBody();
+			return source.schema ? parseWithSchema(source.schema, raw) : raw;
+		}
+		/* v8 ignore start -- @preserve: exhaustiveness guard, unreachable through the public API */
+		default: throw new Error(`Unreachable: unknown param source kind ${source.kind}`);
+	}
+}
+/** Builds the positional argument list for a route handler from its `@Body`/`@Query`/`@Param`/`@Headers`/`@Req` metadata. */
+async function resolveHandlerArgs(sources, context) {
+	if (sources.size === 0) return [];
+	const args = Array.from({ length: Math.max(...sources.keys()) + 1 });
+	await Promise.all([...sources.entries()].map(async ([index, source]) => {
+		args[index] = await resolveOne(source, context);
+	}));
+	return args;
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.151.0/helpers/esm/decorate.js
+function __decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+//#endregion
+//#region src/request-context.ts
+const storage = new AsyncLocalStorage();
+/** Thrown by `RequestContext.set()` when called outside an active request scope. */
+var RequestContextError = class extends Error {
+	constructor() {
+		super("RequestContext.set() can only be called while handling a request.");
+		this.name = "RequestContextError";
+	}
+};
+let RequestContext = class RequestContext {
+	get(key) {
+		return storage.getStore()?.get(key);
+	}
+	has(key) {
+		return storage.getStore()?.has(key) ?? false;
+	}
+	set(key, value) {
+		const store = storage.getStore();
+		if (!store) throw new RequestContextError();
+		store.set(key, value);
+	}
+};
+RequestContext = __decorate([Injectable()], RequestContext);
+/** Runs `fn` with a fresh, isolated store current for its whole async call chain — what `createHandler` wraps around each request. */
+function runInRequestContext(fn) {
+	return storage.run(/* @__PURE__ */ new Map(), fn);
+}
+//#endregion
+//#region src/response.ts
+/**
+* Thrown when a handler's return value doesn't match its `@Returns`
+* schema. Deliberately not an `HttpException` — this is a server-side
+* contract bug, not the client's fault, so it falls through to the
+* generic 500 path instead of exposing the mismatch (and the app's
+* internal shape) to the client.
+*/
+var ResponseValidationError = class extends Error {
+	constructor(issues) {
+		super(`Response failed its declared schema: ${issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; ")}`);
+		this.issues = issues;
+		this.name = "ResponseValidationError";
+	}
+};
+/** Validates a handler's return value against its `@Returns` schema, if any — returns the value (possibly parsed/coerced) unchanged when there's no schema. */
+async function validateResponse(schema, value) {
+	if (!schema) return value;
+	const result = await schema.safeParseAsync(value);
+	if (!result.success) throw new ResponseValidationError(result.error.issues);
+	return result.data;
+}
+//#endregion
+//#region src/router.ts
+var DuplicateRouteError = class extends Error {
+	constructor(method, path) {
+		super(`Duplicate route: ${method} ${path} is already registered — each method+path pair must be unique.`);
+		this.name = "DuplicateRouteError";
+	}
+};
+function createNode() {
+	return {
+		staticChildren: /* @__PURE__ */ new Map(),
+		handlers: /* @__PURE__ */ new Map()
+	};
+}
+function splitPath(path) {
+	return path.split("/").filter((segment) => segment.length > 0);
+}
+/**
+* Depth-first with backtracking: a static/param branch that leads to a dead
+* end (no route registered there) must not block a sibling branch — e.g.
+* `/posts/new` (static, POST only) must not swallow `/posts/:id` (GET) when
+* someone requests GET /posts/new.
+*/
+function walk(node, segments, index, params) {
+	if (index === segments.length) return node.handlers.size > 0 ? {
+		node,
+		params
+	} : void 0;
+	const segment = segments[index];
+	const staticChild = node.staticChildren.get(segment);
+	if (staticChild) {
+		const result = walk(staticChild, segments, index + 1, params);
+		if (result) return result;
+	}
+	if (node.paramChild) {
+		const { name, node: paramNode } = node.paramChild;
+		const result = walk(paramNode, segments, index + 1, {
+			...params,
+			[name]: segment
+		});
+		if (result) return result;
+	}
+	if (node.wildcardChild) {
+		const { name, node: wildcardNode } = node.wildcardChild;
+		if (wildcardNode.handlers.size > 0) return {
+			node: wildcardNode,
+			params: {
+				...params,
+				[name]: segments.slice(index).join("/")
+			}
+		};
+	}
+}
+/**
+* A path router keyed on an opaque handler type `T` — this package plugs in
+* controller method references; tests plug in plain strings.
+*/
+var Router = class {
+	#root = createNode();
+	add(method, path, handler) {
+		const segments = splitPath(path);
+		let node = this.#root;
+		for (const segment of segments) if (segment.startsWith(":")) {
+			const name = segment.slice(1);
+			node.paramChild ??= {
+				name,
+				node: createNode()
+			};
+			node = node.paramChild.node;
+		} else if (segment === "*") {
+			node.wildcardChild ??= {
+				name: "*",
+				node: createNode()
+			};
+			node = node.wildcardChild.node;
+		} else {
+			let child = node.staticChildren.get(segment);
+			if (!child) {
+				child = createNode();
+				node.staticChildren.set(segment, child);
+			}
+			node = child;
+		}
+		if (node.handlers.has(method)) throw new DuplicateRouteError(method, path);
+		node.handlers.set(method, handler);
+	}
+	match(method, path) {
+		const segments = splitPath(path);
+		const result = walk(this.#root, segments, 0, {});
+		if (!result) return { kind: "not-found" };
+		const handler = result.node.handlers.get(method);
+		if (!handler) return {
+			kind: "method-not-allowed",
+			allowed: [...result.node.handlers.keys()]
+		};
+		return {
+			kind: "found",
+			handler,
+			params: result.params
+		};
+	}
+};
+//#endregion
+//#region src/handler.ts
+const DEFAULT_BODY_LIMIT = 1048576;
+var NotAControllerError = class extends Error {
+	constructor(target) {
+		super(`${target.name} is not a controller — did you forget @Controller()?`);
+		this.name = "NotAControllerError";
+	}
+};
+/**
+* Flattens every `@Controller`'s route metadata into one `Router`. Guard
+* classes referenced via `@UseGuards` must also be registered as providers
+* on the owning module — this doesn't instantiate them, it only records
+* which classes `createHandler` will later ask the `Application` for.
+*/
+function buildRouter(controllers) {
+	const router = new Router();
+	for (const controller of controllers) {
+		const prefix = getControllerPrefix(controller);
+		if (prefix === void 0) throw new NotAControllerError(controller);
+		const prototype = controller.prototype;
+		const classGuards = getClassGuards(controller);
+		const classInterceptors = getClassInterceptors(controller);
+		for (const route of getRoutes(controller)) router.add(route.method, `/${prefix}/${route.path}`, {
+			controller,
+			propertyKey: route.propertyKey,
+			paramSources: getParamSources(prototype, route.propertyKey),
+			httpCode: getHttpCode(prototype, route.propertyKey),
+			responseSchema: getReturnsSchema(prototype, route.propertyKey),
+			guards: [...classGuards, ...getMethodGuards(prototype, route.propertyKey)],
+			interceptors: [...classInterceptors, ...getMethodInterceptors(prototype, route.propertyKey)]
+		});
+	}
+	return router;
+}
+async function readJsonBody(request, bodyLimit) {
+	if (request.body === null) return;
+	if (!(request.headers.get("content-type") ?? "").toLowerCase().startsWith("application/json")) throw new UnsupportedMediaTypeException();
+	const contentLength = request.headers.get("content-length");
+	if (contentLength !== null && Number(contentLength) > bodyLimit) throw new PayloadTooLargeException();
+	const text = await request.text();
+	if (new TextEncoder().encode(text).length > bodyLimit) throw new PayloadTooLargeException();
+	if (text.length === 0) return;
+	try {
+		return JSON.parse(text);
+	} catch {
+		throw new BadRequestException("Invalid JSON body");
+	}
+}
+const STATUS_TITLES = {
+	400: "Bad Request",
+	401: "Unauthorized",
+	403: "Forbidden",
+	404: "Not Found",
+	405: "Method Not Allowed",
+	409: "Conflict",
+	413: "Payload Too Large",
+	415: "Unsupported Media Type",
+	500: "Internal Server Error"
+};
+function problemResponse(status, detail, extra) {
+	const body = {
+		type: "about:blank",
+		title: STATUS_TITLES[status] ?? "Error",
+		status,
+		detail,
+		...extra
+	};
+	return new Response(JSON.stringify(body), {
+		status,
+		headers: { "content-type": "application/problem+json" }
+	});
+}
+function exceptionToResponse(error) {
+	if (error instanceof HttpException) return problemResponse(error.status, error.detail, error.extra);
+	console.error(error);
+	return problemResponse(500, "An unexpected error occurred");
+}
+/**
+* A raw `Response` or an `undefined` (204) return bypasses `responseSchema`
+* entirely — both are deliberate escape hatches from the normal JSON path,
+* not a value the schema was ever meant to describe.
+*/
+async function toResponse(value, httpCode, responseSchema) {
+	if (value instanceof Response) return value;
+	if (value === void 0) return new Response(null, { status: httpCode ?? 204 });
+	const validated = await validateResponse(responseSchema, value);
+	return new Response(JSON.stringify(validated), {
+		status: httpCode ?? 200,
+		headers: { "content-type": "application/json" }
+	});
+}
+/** Builds a single `(Request) => Promise<Response>` function serving every controller's routes. */
+function createHandler(controllers, application, options = {}) {
+	const router = buildRouter(controllers);
+	const bodyLimit = options.bodyLimit ?? DEFAULT_BODY_LIMIT;
+	return async function handle(request) {
+		const url = new URL(request.url);
+		const match = router.match(request.method, url.pathname);
+		if (match.kind === "not-found") return problemResponse(404, "No route matches this path");
+		if (match.kind === "method-not-allowed") {
+			const response = problemResponse(405, `Allowed methods: ${match.allowed.join(", ")}`);
+			response.headers.set("allow", match.allowed.join(", "));
+			return response;
+		}
+		const route = match.handler;
+		return runInRequestContext(async () => {
+			try {
+				for (const guardClass of route.guards) if (!await application.get(guardClass).canActivate({
+					request,
+					params: match.params
+				})) throw new ForbiddenException();
+				const invoke = async () => {
+					let cachedBody;
+					const args = await resolveHandlerArgs(route.paramSources, {
+						request,
+						routeParams: match.params,
+						getBody: async () => {
+							cachedBody ??= { value: await readJsonBody(request, bodyLimit) };
+							return cachedBody.value;
+						}
+					});
+					return toResponse(await application.get(route.controller)[route.propertyKey]?.(...args), route.httpCode, route.responseSchema);
+				};
+				return await route.interceptors.reduceRight((next, interceptorClass) => {
+					const interceptor = application.get(interceptorClass);
+					return async () => interceptor.intercept({
+						request,
+						params: match.params
+					}, next);
+				}, invoke)();
+			} catch (error) {
+				return exceptionToResponse(error);
+			}
+		});
+	};
+}
+//#endregion
+//#region src/node-adapter.ts
+/** Builds a Web-standard `Request` from a Node `IncomingMessage`, including a body stream and abort signal. */
+function toWebRequest(req, baseUrl) {
+	const method = req.method ?? "GET";
+	const url = new URL(req.url ?? "/", baseUrl);
+	const headers = new Headers();
+	for (const [name, value] of Object.entries(req.headers)) {
+		if (value === void 0) continue;
+		for (const one of Array.isArray(value) ? value : [value]) headers.append(name, one);
+	}
+	const controller = new AbortController();
+	req.once("aborted", () => {
+		controller.abort();
+	});
+	const hasBody = method !== "GET" && method !== "HEAD" && (req.headers["transfer-encoding"] !== void 0 || req.headers["content-length"] !== void 0 && req.headers["content-length"] !== "0");
+	return new Request(url, {
+		method,
+		headers,
+		signal: controller.signal,
+		...hasBody ? {
+			body: Readable.toWeb(req),
+			duplex: "half"
+		} : {}
+	});
+}
+/** Writes a Web-standard `Response` back onto a Node `ServerResponse`. */
+async function sendWebResponse(response, res) {
+	const headers = {};
+	for (const [name, value] of response.headers) (headers[name] ??= []).push(value);
+	res.writeHead(response.status, headers);
+	if (!response.body) {
+		res.end();
+		return;
+	}
+	const body = Readable.fromWeb(response.body);
+	await new Promise((resolve, reject) => {
+		res.once("finish", resolve);
+		res.once("error", reject);
+		body.once("error", reject);
+		body.pipe(res);
+	});
+}
+//#endregion
+//#region src/http-application.ts
+/** Provides `RequestContext` app-wide, without the user needing to import anything — every `createHttpApplication` root gets wrapped with this. */
+let RequestContextModule = class RequestContextModule {};
+RequestContextModule = __decorate([Module({
+	providers: [RequestContext],
+	exports: [RequestContext],
+	global: true
+})], RequestContextModule);
+/** Empty static anchor for the synthetic root — its own metadata is unused, only `imports` matters. */
+let HttpRootModule = class HttpRootModule {};
+HttpRootModule = __decorate([Module()], HttpRootModule);
+/** The core `Application` plus a request handler, optionally bound to a real Node HTTP socket. */
+var HttpApplication = class HttpApplication {
+	#app;
+	#handle;
+	#server;
+	constructor(app, handle) {
+		this.#app = app;
+		this.#handle = handle;
+	}
+	static async create(rootModule, options = {}) {
+		const app = await createApplication({
+			module: HttpRootModule,
+			imports: [rootModule, RequestContextModule]
+		}, { overrides: options.overrides });
+		const handle = createHandler(app.controllers, app, options);
+		return new HttpApplication(app, handle);
+	}
+	/** Fetches an already-resolved provider directly, bypassing HTTP entirely. */
+	get(token) {
+		return this.#app.get(token);
+	}
+	/** Every controller class in this app's module graph — what `@blixis-io/openapi` walks to build a document that stays in sync with the real running app. */
+	get controllers() {
+		return this.#app.controllers;
+	}
+	/** Runs a request through the handler in-process, without a socket. */
+	handle(request) {
+		return this.#handle(request);
+	}
+	listen(port, hostname = "0.0.0.0") {
+		return new Promise((resolve, reject) => {
+			const server = createServer((req, res) => {
+				const request = toWebRequest(req, `http://${hostname}:${port}`);
+				this.#handle(request).then((response) => sendWebResponse(response, res)).catch((error) => {
+					console.error(error);
+					if (!res.headersSent) res.writeHead(500);
+					res.end();
+				});
+				/* v8 ignore stop */
+			});
+			server.once("error", reject);
+			server.listen(port, hostname, () => {
+				this.#server = server;
+				const address = server.address();
+				resolve({ port: typeof address === "object" && address !== null ? address.port : port });
+			});
+		});
+	}
+	async close(signal) {
+		if (this.#server) {
+			const server = this.#server;
+			this.#server = void 0;
+			await new Promise((resolve, reject) => {
+				server.close((error) => {
+					/* v8 ignore next 3 -- @preserve */
+					if (error) {
+						reject(error);
+						return;
+					}
+					resolve();
+				});
+			});
+		}
+		await this.#app.close(signal);
+	}
+};
+async function createHttpApplication(rootModule, options = {}) {
+	return HttpApplication.create(rootModule, options);
+}
+//#endregion
+//#region src/types.ts
+const HTTP_METHODS = [
+	"GET",
+	"POST",
+	"PUT",
+	"PATCH",
+	"DELETE",
+	"HEAD",
+	"OPTIONS"
+];
+//#endregion
+export { ApiOperation, ApiTags, BadRequestException, Body, ConflictException, Controller, Delete, ForbiddenException, Get, HTTP_METHODS, Headers$1 as Headers, HttpApplication, HttpCode, HttpException, NotAControllerError, NotFoundException, Param, Patch, PayloadTooLargeException, Post, Put, Query, Req, RequestContext, RequestContextError, ResponseValidationError, Returns, Router, UnauthorizedException, UnsupportedMediaTypeException, UseGuards, UseInterceptors, buildRouter, createHandler, createHttpApplication, getApiOperation, getClassApiTags, getClassGuards, getClassInterceptors, getControllerPrefix, getHttpCode, getMethodApiTags, getMethodGuards, getMethodInterceptors, getParamSources, getReturnsSchema, getRoutes, resolveHandlerArgs, runInRequestContext, sendWebResponse, toWebRequest, validateResponse };
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":["Headers","exhaustive"],"sources":["../src/decorators/api-metadata.ts","../src/decorators/controller.ts","../src/decorators/guards.ts","../src/decorators/interceptors.ts","../src/decorators/params.ts","../src/decorators/routes.ts","../src/exceptions.ts","../src/params.ts","../src/request-context.ts","../src/response.ts","../src/router.ts","../src/handler.ts","../src/node-adapter.ts","../src/http-application.ts","../src/types.ts"],"sourcesContent":["import { defineMetadata, getMetadata } from \"@blixis-io/di\";\n\nexport interface ApiOperationOptions {\n  summary?: string;\n  description?: string;\n  /** Defaults to `${ControllerName}_${methodName}` when omitted — every operation needs a unique one, valid or not. */\n  operationId?: string;\n}\n\nconst API_OPERATION = Symbol(\"blixis:api-operation\");\nconst API_TAGS = Symbol(\"blixis:api-tags\");\n\n/** Documents one route for `@blixis-io/openapi` — entirely optional, a route without it still gets a valid (derived) operationId. */\nexport function ApiOperation(options: ApiOperationOptions): MethodDecorator {\n  return (target, propertyKey) => {\n    defineMetadata(API_OPERATION, options, target, propertyKey);\n  };\n}\n\nexport function getApiOperation(target: object, propertyKey: string | symbol): ApiOperationOptions | undefined {\n  return getMetadata(API_OPERATION, target, propertyKey);\n}\n\n/**\n * Applies OpenAPI tags to a controller (class position) or a single route\n * (method position) — same dual-shape decorator as `@UseGuards`. Class-level\n * and method-level tags both apply, concatenated, not one replacing the\n * other.\n */\nexport function ApiTags(...tags: string[]): ClassDecorator & MethodDecorator {\n  const decorator = (target: object, propertyKey?: string | symbol): void => {\n    if (propertyKey === undefined) {\n      const existing = getMetadata<string[]>(API_TAGS, target) ?? [];\n      defineMetadata(API_TAGS, [...existing, ...tags], target);\n    } else {\n      const existing = getMetadata<string[]>(API_TAGS, target, propertyKey) ?? [];\n      defineMetadata(API_TAGS, [...existing, ...tags], target, propertyKey);\n    }\n  };\n  return decorator;\n}\n\nexport function getClassApiTags(target: object): string[] {\n  return getMetadata(API_TAGS, target) ?? [];\n}\n\nexport function getMethodApiTags(target: object, propertyKey: string | symbol): string[] {\n  return getMetadata(API_TAGS, target, propertyKey) ?? [];\n}\n","import { defineMetadata, getMetadata } from \"@blixis-io/di\";\n\nconst CONTROLLER_PREFIX = Symbol(\"blixis:controller-prefix\");\n\nfunction stripSlashes(value: string): string {\n  return value.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\");\n}\n\nexport function Controller(prefix = \"\"): ClassDecorator {\n  return (target) => {\n    defineMetadata(CONTROLLER_PREFIX, stripSlashes(prefix), target);\n  };\n}\n\nexport function getControllerPrefix(target: object): string | undefined {\n  return getMetadata(CONTROLLER_PREFIX, target);\n}\n","import { defineMetadata, getMetadata, type Class } from \"@blixis-io/di\";\n\nexport interface ExecutionContext {\n  request: Request;\n  params: Readonly<Record<string, string>>;\n}\n\nexport interface CanActivate {\n  canActivate(context: ExecutionContext): boolean | Promise<boolean>;\n}\n\nconst GUARDS = Symbol(\"blixis:guards\");\n\n/**\n * Applies guards to a controller (class position) or a single route\n * (method position) — the same decorator function works in both spots,\n * matching the shape TS's legacy decorators give it: a class decorator\n * receives no `propertyKey`, a method decorator does.\n */\nexport function UseGuards(...guards: Class<CanActivate>[]): ClassDecorator & MethodDecorator {\n  const decorator = (target: object, propertyKey?: string | symbol): void => {\n    if (propertyKey === undefined) {\n      const existing = getMetadata<Class<CanActivate>[]>(GUARDS, target) ?? [];\n      defineMetadata(GUARDS, [...existing, ...guards], target);\n    } else {\n      const existing = getMetadata<Class<CanActivate>[]>(GUARDS, target, propertyKey) ?? [];\n      defineMetadata(GUARDS, [...existing, ...guards], target, propertyKey);\n    }\n  };\n  return decorator;\n}\n\nexport function getClassGuards(target: object): Class<CanActivate>[] {\n  return getMetadata(GUARDS, target) ?? [];\n}\n\nexport function getMethodGuards(target: object, propertyKey: string | symbol): Class<CanActivate>[] {\n  return getMetadata(GUARDS, target, propertyKey) ?? [];\n}\n","import { defineMetadata, getMetadata, type Class } from \"@blixis-io/di\";\nimport type { ExecutionContext } from \"./guards.js\";\n\nexport interface Interceptor {\n  intercept(context: ExecutionContext, next: () => Promise<Response>): Response | Promise<Response>;\n}\n\nconst INTERCEPTORS = Symbol(\"blixis:interceptors\");\n\n/**\n * Applies interceptors to a controller (class position) or a single route\n * (method position) — same dual-shape decorator as `@UseGuards`. Interceptors\n * wrap param resolution + handler invocation (guards already ran and\n * already decided the request is allowed through); class-level interceptors\n * wrap outermost, method-level innermost, closest to the handler.\n */\nexport function UseInterceptors(...interceptors: Class<Interceptor>[]): ClassDecorator & MethodDecorator {\n  const decorator = (target: object, propertyKey?: string | symbol): void => {\n    if (propertyKey === undefined) {\n      const existing = getMetadata<Class<Interceptor>[]>(INTERCEPTORS, target) ?? [];\n      defineMetadata(INTERCEPTORS, [...existing, ...interceptors], target);\n    } else {\n      const existing = getMetadata<Class<Interceptor>[]>(INTERCEPTORS, target, propertyKey) ?? [];\n      defineMetadata(INTERCEPTORS, [...existing, ...interceptors], target, propertyKey);\n    }\n  };\n  return decorator;\n}\n\nexport function getClassInterceptors(target: object): Class<Interceptor>[] {\n  return getMetadata(INTERCEPTORS, target) ?? [];\n}\n\nexport function getMethodInterceptors(target: object, propertyKey: string | symbol): Class<Interceptor>[] {\n  return getMetadata(INTERCEPTORS, target, propertyKey) ?? [];\n}\n","import { defineMetadata, getMetadata } from \"@blixis-io/di\";\nimport type { ZodType } from \"zod\";\n\nexport type ParamSource =\n  | { kind: \"body\"; schema?: ZodType | undefined }\n  | { kind: \"query\"; schema?: ZodType | undefined }\n  | { kind: \"param\"; name: string; schema?: ZodType | undefined }\n  | { kind: \"headers\"; name?: string | undefined }\n  | { kind: \"req\" };\n\nconst PARAMS = Symbol(\"blixis:params\");\n\nfunction paramDecorator(source: ParamSource): ParameterDecorator {\n  return (target, propertyKey, parameterIndex) => {\n    if (propertyKey === undefined) {\n      throw new Error(\"@Body/@Query/@Param/@Headers/@Req can only decorate route handler method parameters, not constructor parameters.\");\n    }\n    const sources =\n      getMetadata<Map<number, ParamSource>>(PARAMS, target, propertyKey) ?? new Map<number, ParamSource>();\n    sources.set(parameterIndex, source);\n    defineMetadata(PARAMS, sources, target, propertyKey);\n  };\n}\n\n/** Parses the JSON request body, validating it with `schema` when given. */\nexport function Body(schema?: ZodType): ParameterDecorator {\n  return paramDecorator({ kind: \"body\", schema });\n}\n\n/** The parsed query string as an object, validated with `schema` when given. */\nexport function Query(schema?: ZodType): ParameterDecorator {\n  return paramDecorator({ kind: \"query\", schema });\n}\n\n/** One route param by name, validated with `schema` when given (otherwise the raw string). */\nexport function Param(name: string, schema?: ZodType): ParameterDecorator {\n  return paramDecorator({ kind: \"param\", name, schema });\n}\n\n/** One request header by name, or all headers as an object when `name` is omitted. */\nexport function Headers(name?: string): ParameterDecorator {\n  return paramDecorator({ kind: \"headers\", name });\n}\n\n/** The raw Web-standard `Request`. */\nexport function Req(): ParameterDecorator {\n  return paramDecorator({ kind: \"req\" });\n}\n\nexport function getParamSources(target: object, propertyKey: string | symbol): Map<number, ParamSource> {\n  return getMetadata(PARAMS, target, propertyKey) ?? new Map();\n}\n","import { defineMetadata, getMetadata } from \"@blixis-io/di\";\nimport type { ZodType } from \"zod\";\nimport type { HttpMethod } from \"../types.js\";\n\nexport interface RouteDefinition {\n  method: HttpMethod;\n  path: string;\n  propertyKey: string | symbol;\n}\n\nconst ROUTES = Symbol(\"blixis:routes\");\nconst HTTP_CODE = Symbol(\"blixis:http-code\");\nconst RETURNS = Symbol(\"blixis:returns\");\n\nfunction routeDecorator(method: HttpMethod, path: string): MethodDecorator {\n  return (target, propertyKey) => {\n    const ctor = target.constructor;\n    const routes = getMetadata<RouteDefinition[]>(ROUTES, ctor) ?? [];\n    routes.push({ method, path, propertyKey });\n    defineMetadata(ROUTES, routes, ctor);\n  };\n}\n\nexport const Get = (path = \"\"): MethodDecorator => routeDecorator(\"GET\", path);\nexport const Post = (path = \"\"): MethodDecorator => routeDecorator(\"POST\", path);\nexport const Put = (path = \"\"): MethodDecorator => routeDecorator(\"PUT\", path);\nexport const Patch = (path = \"\"): MethodDecorator => routeDecorator(\"PATCH\", path);\nexport const Delete = (path = \"\"): MethodDecorator => routeDecorator(\"DELETE\", path);\n\nexport function getRoutes(target: object): RouteDefinition[] {\n  return getMetadata(ROUTES, target) ?? [];\n}\n\n/** Overrides the default 200 (or 204 for an `undefined` return) status for one route. */\nexport function HttpCode(code: number): MethodDecorator {\n  return (target, propertyKey) => {\n    defineMetadata(HTTP_CODE, code, target, propertyKey);\n  };\n}\n\nexport function getHttpCode(target: object, propertyKey: string | symbol): number | undefined {\n  return getMetadata(HTTP_CODE, target, propertyKey);\n}\n\n/**\n * Declares the response body's shape for one route. Validated after the\n * handler returns, before serialization — a mismatch is a server bug (the\n * implementation drifted from its own declared contract), not a client\n * error, so it never reaches the client as anything but a generic 500.\n */\nexport function Returns(schema: ZodType): MethodDecorator {\n  return (target, propertyKey) => {\n    defineMetadata(RETURNS, schema, target, propertyKey);\n  };\n}\n\nexport function getReturnsSchema(target: object, propertyKey: string | symbol): ZodType | undefined {\n  return getMetadata(RETURNS, target, propertyKey);\n}\n","/** Thrown from a guard or handler to short-circuit the response with a specific status. */\nexport class HttpException extends Error {\n  constructor(\n    public readonly status: number,\n    public readonly detail: string,\n    public readonly extra?: Record<string, unknown>,\n  ) {\n    super(detail);\n    this.name = \"HttpException\";\n  }\n}\n\nexport class BadRequestException extends HttpException {\n  constructor(detail = \"Bad Request\", extra?: Record<string, unknown>) {\n    super(400, detail, extra);\n    this.name = \"BadRequestException\";\n  }\n}\n\nexport class UnauthorizedException extends HttpException {\n  constructor(detail = \"Unauthorized\") {\n    super(401, detail);\n    this.name = \"UnauthorizedException\";\n  }\n}\n\nexport class ForbiddenException extends HttpException {\n  constructor(detail = \"Forbidden\") {\n    super(403, detail);\n    this.name = \"ForbiddenException\";\n  }\n}\n\nexport class NotFoundException extends HttpException {\n  constructor(detail = \"Not Found\") {\n    super(404, detail);\n    this.name = \"NotFoundException\";\n  }\n}\n\nexport class ConflictException extends HttpException {\n  constructor(detail = \"Conflict\") {\n    super(409, detail);\n    this.name = \"ConflictException\";\n  }\n}\n\nexport class PayloadTooLargeException extends HttpException {\n  constructor(detail = \"Payload Too Large\") {\n    super(413, detail);\n    this.name = \"PayloadTooLargeException\";\n  }\n}\n\nexport class UnsupportedMediaTypeException extends HttpException {\n  constructor(detail = \"Unsupported Media Type\") {\n    super(415, detail);\n    this.name = \"UnsupportedMediaTypeException\";\n  }\n}\n","import type { ZodType } from \"zod\";\nimport type { ParamSource } from \"./decorators/params.js\";\nimport { BadRequestException } from \"./exceptions.js\";\n\nexport interface ParamResolutionContext {\n  request: Request;\n  routeParams: Readonly<Record<string, string>>;\n  /** Reads and JSON-parses the body, memoized per-request by the caller. Rejects with an HttpException (400/413/415) on failure. */\n  getBody: () => Promise<unknown>;\n}\n\nasync function parseWithSchema(schema: ZodType, value: unknown): Promise<unknown> {\n  const result = await schema.safeParseAsync(value);\n  if (!result.success) {\n    throw new BadRequestException(\"Validation failed\", { issues: result.error.issues });\n  }\n  return result.data;\n}\n\nasync function resolveOne(source: ParamSource, context: ParamResolutionContext): Promise<unknown> {\n  switch (source.kind) {\n    case \"req\":\n      return context.request;\n    case \"headers\":\n      return source.name ? context.request.headers.get(source.name) : Object.fromEntries(context.request.headers);\n    case \"param\": {\n      const raw = context.routeParams[source.name];\n      return source.schema ? parseWithSchema(source.schema, raw) : raw;\n    }\n    case \"query\": {\n      const raw = Object.fromEntries(new URL(context.request.url).searchParams);\n      return source.schema ? parseWithSchema(source.schema, raw) : raw;\n    }\n    case \"body\": {\n      const raw = await context.getBody();\n      return source.schema ? parseWithSchema(source.schema, raw) : raw;\n    }\n    /* v8 ignore start -- @preserve: exhaustiveness guard, unreachable through the public API */\n    default: {\n      const exhaustive: never = source;\n      throw new Error(`Unreachable: unknown param source kind ${(exhaustive as ParamSource).kind}`);\n    }\n    /* v8 ignore stop */\n  }\n}\n\n/** Builds the positional argument list for a route handler from its `@Body`/`@Query`/`@Param`/`@Headers`/`@Req` metadata. */\nexport async function resolveHandlerArgs(\n  sources: ReadonlyMap<number, ParamSource>,\n  context: ParamResolutionContext,\n): Promise<unknown[]> {\n  if (sources.size === 0) {\n    return [];\n  }\n\n  const args: unknown[] = Array.from<unknown>({ length: Math.max(...sources.keys()) + 1 });\n\n  await Promise.all(\n    [...sources.entries()].map(async ([index, source]) => {\n      args[index] = await resolveOne(source, context);\n    }),\n  );\n\n  return args;\n}\n","import { Injectable } from \"@blixis-io/di\";\nimport { AsyncLocalStorage } from \"node:async_hooks\";\n\nconst storage = new AsyncLocalStorage<Map<string, unknown>>();\n\n/** Thrown by `RequestContext.set()` when called outside an active request scope. */\nexport class RequestContextError extends Error {\n  constructor() {\n    super(\"RequestContext.set() can only be called while handling a request.\");\n    this.name = \"RequestContextError\";\n  }\n}\n\n/**\n * Per-request key/value store. Injectable as a singleton because its\n * methods don't hold state themselves — they read/write whichever\n * `Map` `runInRequestContext` made current for the request now being\n * handled, via `AsyncLocalStorage`. Reading (`get`/`has`) outside a\n * request is a legitimate \"no request\" answer; writing isn't, so\n * `set()` throws instead of silently doing nothing.\n */\n@Injectable()\nexport class RequestContext {\n  get<T = unknown>(key: string): T | undefined {\n    return storage.getStore()?.get(key) as T | undefined;\n  }\n\n  has(key: string): boolean {\n    return storage.getStore()?.has(key) ?? false;\n  }\n\n  set(key: string, value: unknown): void {\n    const store = storage.getStore();\n    if (!store) {\n      throw new RequestContextError();\n    }\n    store.set(key, value);\n  }\n}\n\n/** Runs `fn` with a fresh, isolated store current for its whole async call chain — what `createHandler` wraps around each request. */\nexport function runInRequestContext<T>(fn: () => T): T {\n  return storage.run(new Map(), fn);\n}\n","import type { ZodType } from \"zod\";\n\ninterface ResponseValidationIssue {\n  path: PropertyKey[];\n  message: string;\n}\n\n/**\n * Thrown when a handler's return value doesn't match its `@Returns`\n * schema. Deliberately not an `HttpException` — this is a server-side\n * contract bug, not the client's fault, so it falls through to the\n * generic 500 path instead of exposing the mismatch (and the app's\n * internal shape) to the client.\n */\nexport class ResponseValidationError extends Error {\n  constructor(public readonly issues: readonly ResponseValidationIssue[]) {\n    super(`Response failed its declared schema: ${issues.map((issue) => `${issue.path.join(\".\")}: ${issue.message}`).join(\"; \")}`);\n    this.name = \"ResponseValidationError\";\n  }\n}\n\n/** Validates a handler's return value against its `@Returns` schema, if any — returns the value (possibly parsed/coerced) unchanged when there's no schema. */\nexport async function validateResponse(schema: ZodType | undefined, value: unknown): Promise<unknown> {\n  if (!schema) {\n    return value;\n  }\n  const result = await schema.safeParseAsync(value);\n  if (!result.success) {\n    throw new ResponseValidationError(result.error.issues);\n  }\n  return result.data;\n}\n","import type { HttpMethod } from \"./types.js\";\n\nexport interface RouteFound<T> {\n  kind: \"found\";\n  handler: T;\n  params: Record<string, string>;\n}\n\nexport interface RouteNotFound {\n  kind: \"not-found\";\n}\n\nexport interface RouteMethodNotAllowed {\n  kind: \"method-not-allowed\";\n  allowed: HttpMethod[];\n}\n\nexport type RouteLookupResult<T> = RouteFound<T> | RouteNotFound | RouteMethodNotAllowed;\n\nexport class DuplicateRouteError extends Error {\n  override readonly name = \"DuplicateRouteError\";\n\n  constructor(method: HttpMethod, path: string) {\n    super(`Duplicate route: ${method} ${path} is already registered — each method+path pair must be unique.`);\n  }\n}\n\ninterface TrieNode<T> {\n  staticChildren: Map<string, TrieNode<T>>;\n  paramChild?: { name: string; node: TrieNode<T> };\n  wildcardChild?: { name: string; node: TrieNode<T> };\n  handlers: Map<HttpMethod, T>;\n}\n\nfunction createNode<T>(): TrieNode<T> {\n  return { staticChildren: new Map(), handlers: new Map() };\n}\n\nfunction splitPath(path: string): string[] {\n  return path.split(\"/\").filter((segment) => segment.length > 0);\n}\n\ninterface WalkResult<T> {\n  node: TrieNode<T>;\n  params: Record<string, string>;\n}\n\n/**\n * Depth-first with backtracking: a static/param branch that leads to a dead\n * end (no route registered there) must not block a sibling branch — e.g.\n * `/posts/new` (static, POST only) must not swallow `/posts/:id` (GET) when\n * someone requests GET /posts/new.\n */\nfunction walk<T>(\n  node: TrieNode<T>,\n  segments: readonly string[],\n  index: number,\n  params: Record<string, string>,\n): WalkResult<T> | undefined {\n  if (index === segments.length) {\n    return node.handlers.size > 0 ? { node, params } : undefined;\n  }\n\n  const segment = segments[index] as string;\n\n  const staticChild = node.staticChildren.get(segment);\n  if (staticChild) {\n    const result = walk(staticChild, segments, index + 1, params);\n    if (result) {\n      return result;\n    }\n  }\n\n  if (node.paramChild) {\n    const { name, node: paramNode } = node.paramChild;\n    const result = walk(paramNode, segments, index + 1, { ...params, [name]: segment });\n    if (result) {\n      return result;\n    }\n  }\n\n  if (node.wildcardChild) {\n    const { name, node: wildcardNode } = node.wildcardChild;\n    if (wildcardNode.handlers.size > 0) {\n      return { node: wildcardNode, params: { ...params, [name]: segments.slice(index).join(\"/\") } };\n    }\n  }\n\n  return undefined;\n}\n\n/**\n * A path router keyed on an opaque handler type `T` — this package plugs in\n * controller method references; tests plug in plain strings.\n */\nexport class Router<T> {\n  readonly #root = createNode<T>();\n\n  add(method: HttpMethod, path: string, handler: T): void {\n    const segments = splitPath(path);\n    let node = this.#root;\n\n    for (const segment of segments) {\n      if (segment.startsWith(\":\")) {\n        const name = segment.slice(1);\n        node.paramChild ??= { name, node: createNode() };\n        node = node.paramChild.node;\n      } else if (segment === \"*\") {\n        node.wildcardChild ??= { name: \"*\", node: createNode() };\n        node = node.wildcardChild.node;\n      } else {\n        let child = node.staticChildren.get(segment);\n        if (!child) {\n          child = createNode();\n          node.staticChildren.set(segment, child);\n        }\n        node = child;\n      }\n    }\n\n    if (node.handlers.has(method)) {\n      throw new DuplicateRouteError(method, path);\n    }\n    node.handlers.set(method, handler);\n  }\n\n  match(method: HttpMethod, path: string): RouteLookupResult<T> {\n    const segments = splitPath(path);\n    const result = walk(this.#root, segments, 0, {});\n\n    if (!result) {\n      return { kind: \"not-found\" };\n    }\n\n    const handler = result.node.handlers.get(method);\n    if (!handler) {\n      return { kind: \"method-not-allowed\", allowed: [...result.node.handlers.keys()] };\n    }\n\n    return { kind: \"found\", handler, params: result.params };\n  }\n}\n","import type { Application } from \"@blixis-io/core\";\nimport type { Class } from \"@blixis-io/di\";\nimport type { ZodType } from \"zod\";\nimport { getControllerPrefix } from \"./decorators/controller.js\";\nimport { getClassGuards, getMethodGuards, type CanActivate } from \"./decorators/guards.js\";\nimport { getClassInterceptors, getMethodInterceptors, type Interceptor } from \"./decorators/interceptors.js\";\nimport { getParamSources, type ParamSource } from \"./decorators/params.js\";\nimport { getHttpCode, getReturnsSchema, getRoutes } from \"./decorators/routes.js\";\nimport {\n  BadRequestException,\n  ForbiddenException,\n  HttpException,\n  PayloadTooLargeException,\n  UnsupportedMediaTypeException,\n} from \"./exceptions.js\";\nimport { resolveHandlerArgs } from \"./params.js\";\nimport { runInRequestContext } from \"./request-context.js\";\nimport { validateResponse } from \"./response.js\";\nimport { Router } from \"./router.js\";\nimport type { HttpMethod } from \"./types.js\";\n\nconst DEFAULT_BODY_LIMIT = 1024 * 1024; // 1 MiB\n\nexport interface HandlerOptions {\n  bodyLimit?: number;\n}\n\nexport class NotAControllerError extends Error {\n  override readonly name = \"NotAControllerError\";\n\n  constructor(target: { name: string }) {\n    super(`${target.name} is not a controller — did you forget @Controller()?`);\n  }\n}\n\ninterface RouteEntry {\n  controller: Class;\n  propertyKey: string | symbol;\n  paramSources: ReadonlyMap<number, ParamSource>;\n  httpCode?: number | undefined;\n  responseSchema?: ZodType | undefined;\n  guards: Class<CanActivate>[];\n  interceptors: Class<Interceptor>[];\n}\n\n/**\n * Flattens every `@Controller`'s route metadata into one `Router`. Guard\n * classes referenced via `@UseGuards` must also be registered as providers\n * on the owning module — this doesn't instantiate them, it only records\n * which classes `createHandler` will later ask the `Application` for.\n */\nexport function buildRouter(controllers: readonly Class[]): Router<RouteEntry> {\n  const router = new Router<RouteEntry>();\n\n  for (const controller of controllers) {\n    const prefix = getControllerPrefix(controller);\n    if (prefix === undefined) {\n      throw new NotAControllerError(controller);\n    }\n\n    const prototype = controller.prototype as object;\n    const classGuards = getClassGuards(controller);\n    const classInterceptors = getClassInterceptors(controller);\n\n    for (const route of getRoutes(controller)) {\n      router.add(route.method, `/${prefix}/${route.path}`, {\n        controller,\n        propertyKey: route.propertyKey,\n        paramSources: getParamSources(prototype, route.propertyKey),\n        httpCode: getHttpCode(prototype, route.propertyKey),\n        responseSchema: getReturnsSchema(prototype, route.propertyKey),\n        guards: [...classGuards, ...getMethodGuards(prototype, route.propertyKey)],\n        interceptors: [...classInterceptors, ...getMethodInterceptors(prototype, route.propertyKey)],\n      });\n    }\n  }\n\n  return router;\n}\n\nasync function readJsonBody(request: Request, bodyLimit: number): Promise<unknown> {\n  if (request.body === null) {\n    return undefined;\n  }\n\n  const contentType = request.headers.get(\"content-type\") ?? \"\";\n  if (!contentType.toLowerCase().startsWith(\"application/json\")) {\n    throw new UnsupportedMediaTypeException();\n  }\n\n  const contentLength = request.headers.get(\"content-length\");\n  if (contentLength !== null && Number(contentLength) > bodyLimit) {\n    throw new PayloadTooLargeException();\n  }\n\n  const text = await request.text();\n  if (new TextEncoder().encode(text).length > bodyLimit) {\n    throw new PayloadTooLargeException();\n  }\n  if (text.length === 0) {\n    return undefined;\n  }\n\n  try {\n    return JSON.parse(text);\n  } catch {\n    throw new BadRequestException(\"Invalid JSON body\");\n  }\n}\n\nconst STATUS_TITLES: Record<number, string> = {\n  400: \"Bad Request\",\n  401: \"Unauthorized\",\n  403: \"Forbidden\",\n  404: \"Not Found\",\n  405: \"Method Not Allowed\",\n  409: \"Conflict\",\n  413: \"Payload Too Large\",\n  415: \"Unsupported Media Type\",\n  500: \"Internal Server Error\",\n};\n\nfunction problemResponse(status: number, detail: string, extra?: Record<string, unknown>): Response {\n  const body = {\n    type: \"about:blank\",\n    title: STATUS_TITLES[status] ?? \"Error\",\n    status,\n    detail,\n    ...extra,\n  };\n  return new Response(JSON.stringify(body), { status, headers: { \"content-type\": \"application/problem+json\" } });\n}\n\nfunction exceptionToResponse(error: unknown): Response {\n  if (error instanceof HttpException) {\n    return problemResponse(error.status, error.detail, error.extra);\n  }\n  // Internal errors are logged but never surfaced to the client.\n  console.error(error);\n  return problemResponse(500, \"An unexpected error occurred\");\n}\n\n/**\n * A raw `Response` or an `undefined` (204) return bypasses `responseSchema`\n * entirely — both are deliberate escape hatches from the normal JSON path,\n * not a value the schema was ever meant to describe.\n */\nasync function toResponse(value: unknown, httpCode: number | undefined, responseSchema: ZodType | undefined): Promise<Response> {\n  if (value instanceof Response) {\n    return value;\n  }\n  if (value === undefined) {\n    return new Response(null, { status: httpCode ?? 204 });\n  }\n  const validated = await validateResponse(responseSchema, value);\n  return new Response(JSON.stringify(validated), {\n    status: httpCode ?? 200,\n    headers: { \"content-type\": \"application/json\" },\n  });\n}\n\n/** Builds a single `(Request) => Promise<Response>` function serving every controller's routes. */\nexport function createHandler(\n  controllers: readonly Class[],\n  application: Application,\n  options: HandlerOptions = {},\n): (request: Request) => Promise<Response> {\n  const router = buildRouter(controllers);\n  const bodyLimit = options.bodyLimit ?? DEFAULT_BODY_LIMIT;\n\n  return async function handle(request: Request): Promise<Response> {\n    const url = new URL(request.url);\n    const match = router.match(request.method as HttpMethod, url.pathname);\n\n    if (match.kind === \"not-found\") {\n      return problemResponse(404, \"No route matches this path\");\n    }\n    if (match.kind === \"method-not-allowed\") {\n      const response = problemResponse(405, `Allowed methods: ${match.allowed.join(\", \")}`);\n      response.headers.set(\"allow\", match.allowed.join(\", \"));\n      return response;\n    }\n\n    const route = match.handler;\n\n    return runInRequestContext(async () => {\n      try {\n        // Sequential and short-circuiting on purpose: a later guard must not\n        // run once an earlier one has already denied the request.\n        for (const guardClass of route.guards) {\n          const guard = application.get(guardClass);\n          const allowed = await guard.canActivate({ request, params: match.params });\n          if (!allowed) {\n            throw new ForbiddenException();\n          }\n        }\n\n        const invoke = async (): Promise<Response> => {\n          let cachedBody: { value: unknown } | undefined;\n          const args = await resolveHandlerArgs(route.paramSources, {\n            request,\n            routeParams: match.params,\n            getBody: async () => {\n              cachedBody ??= { value: await readJsonBody(request, bodyLimit) };\n              return cachedBody.value;\n            },\n          });\n\n          const instance = application.get(route.controller) as Record<PropertyKey, (...args: unknown[]) => unknown>;\n          const result: unknown = await instance[route.propertyKey]?.(...args);\n\n          return toResponse(result, route.httpCode, route.responseSchema);\n        };\n\n        // Class-level interceptors wrap outermost, method-level innermost —\n        // built right-to-left so the first entry ends up as the outer call.\n        const pipeline = route.interceptors.reduceRight<() => Promise<Response>>((next, interceptorClass) => {\n          const interceptor = application.get(interceptorClass);\n          return async () => interceptor.intercept({ request, params: match.params }, next);\n        }, invoke);\n\n        return await pipeline();\n      } catch (error) {\n        return exceptionToResponse(error);\n      }\n    });\n  };\n}\n","import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport { Readable } from \"node:stream\";\n\n/** Builds a Web-standard `Request` from a Node `IncomingMessage`, including a body stream and abort signal. */\nexport function toWebRequest(req: IncomingMessage, baseUrl: string): Request {\n  const method = req.method ?? \"GET\";\n  const url = new URL(req.url ?? \"/\", baseUrl);\n\n  const headers = new Headers();\n  for (const [name, value] of Object.entries(req.headers)) {\n    if (value === undefined) {\n      continue;\n    }\n    for (const one of Array.isArray(value) ? value : [value]) {\n      headers.append(name, one);\n    }\n  }\n\n  const controller = new AbortController();\n  req.once(\"aborted\", () => {\n    controller.abort();\n  });\n\n  // GET/HEAD can never carry a body (Fetch spec forbids it on the Request\n  // we're about to construct). Otherwise, trust the standard signals for\n  // \"the client is actually sending body bytes\" rather than the method —\n  // a bodyless POST is common and must not turn into an open, empty stream.\n  const hasBody =\n    method !== \"GET\" &&\n    method !== \"HEAD\" &&\n    (req.headers[\"transfer-encoding\"] !== undefined ||\n      (req.headers[\"content-length\"] !== undefined && req.headers[\"content-length\"] !== \"0\"));\n\n  return new Request(url, {\n    method,\n    headers,\n    signal: controller.signal,\n    // `duplex: \"half\"` is required by Node's fetch implementation whenever body is a stream.\n    ...(hasBody ? { body: Readable.toWeb(req), duplex: \"half\" as const } : {}),\n  });\n}\n\n/** Writes a Web-standard `Response` back onto a Node `ServerResponse`. */\nexport async function sendWebResponse(response: Response, res: ServerResponse): Promise<void> {\n  const headers: Record<string, string[]> = {};\n  for (const [name, value] of response.headers) {\n    (headers[name] ??= []).push(value);\n  }\n  res.writeHead(response.status, headers);\n\n  if (!response.body) {\n    res.end();\n    return;\n  }\n\n  const body = Readable.fromWeb(response.body);\n  await new Promise<void>((resolve, reject) => {\n    res.once(\"finish\", resolve);\n    res.once(\"error\", reject);\n    body.once(\"error\", reject);\n    body.pipe(res);\n  });\n}\n","import { createApplication, Module, type Application, type CreateApplicationOptions, type ModuleRef } from \"@blixis-io/core\";\nimport type { Class, Token } from \"@blixis-io/di\";\nimport { createServer, type Server } from \"node:http\";\nimport { createHandler, type HandlerOptions } from \"./handler.js\";\nimport { sendWebResponse, toWebRequest } from \"./node-adapter.js\";\nimport { RequestContext } from \"./request-context.js\";\n\nexport type HttpApplicationOptions = HandlerOptions & CreateApplicationOptions;\n\n/** Provides `RequestContext` app-wide, without the user needing to import anything — every `createHttpApplication` root gets wrapped with this. */\n@Module({ providers: [RequestContext], exports: [RequestContext], global: true })\nclass RequestContextModule {}\n\n/** Empty static anchor for the synthetic root — its own metadata is unused, only `imports` matters. */\n@Module()\nclass HttpRootModule {}\n\nexport interface ListenHandle {\n  port: number;\n}\n\n/** The core `Application` plus a request handler, optionally bound to a real Node HTTP socket. */\nexport class HttpApplication {\n  readonly #app: Application;\n  readonly #handle: (request: Request) => Promise<Response>;\n  #server: Server | undefined;\n\n  private constructor(app: Application, handle: (request: Request) => Promise<Response>) {\n    this.#app = app;\n    this.#handle = handle;\n  }\n\n  static async create(rootModule: ModuleRef, options: HttpApplicationOptions = {}): Promise<HttpApplication> {\n    const wrappedRoot = { module: HttpRootModule, imports: [rootModule, RequestContextModule] };\n    const app = await createApplication(wrappedRoot, { overrides: options.overrides });\n    const handle = createHandler(app.controllers, app, options);\n    return new HttpApplication(app, handle);\n  }\n\n  /** Fetches an already-resolved provider directly, bypassing HTTP entirely. */\n  get<T>(token: Token<T>): T {\n    return this.#app.get(token);\n  }\n\n  /** Every controller class in this app's module graph — what `@blixis-io/openapi` walks to build a document that stays in sync with the real running app. */\n  get controllers(): readonly Class[] {\n    return this.#app.controllers;\n  }\n\n  /** Runs a request through the handler in-process, without a socket. */\n  handle(request: Request): Promise<Response> {\n    return this.#handle(request);\n  }\n\n  listen(port: number, hostname = \"0.0.0.0\"): Promise<ListenHandle> {\n    return new Promise((resolve, reject) => {\n      const server = createServer((req, res) => {\n        const request = toWebRequest(req, `http://${hostname}:${port}`);\n        this.#handle(request)\n          .then((response) => sendWebResponse(response, res))\n          /* v8 ignore start -- @preserve: safety net for a write failure\n          (e.g. the client disconnects mid-stream); createHandler's own\n          try/catch already turns every request-handling error into a\n          Response, so this only fires for socket-level failures, which\n          aren't reliably reproducible without a flaky, timing-dependent\n          test. */\n          .catch((error: unknown) => {\n            console.error(error);\n            if (!res.headersSent) {\n              res.writeHead(500);\n            }\n            res.end();\n          });\n          /* v8 ignore stop */\n      });\n\n      server.once(\"error\", reject);\n      server.listen(port, hostname, () => {\n        this.#server = server;\n        const address = server.address();\n        // `address()` only returns a string for a Unix domain socket; `listen()`\n        // here always takes a TCP port, so that arm is unreachable in practice.\n        /* v8 ignore next -- @preserve */\n        const actualPort = typeof address === \"object\" && address !== null ? address.port : port;\n        resolve({ port: actualPort });\n      });\n    });\n  }\n\n  async close(signal?: string): Promise<void> {\n    if (this.#server) {\n      const server = this.#server;\n      // Cleared before closing, not after: makes close() idempotent (a\n      // second call is a no-op instead of ERR_SERVER_NOT_RUNNING) even if\n      // the close below is still in flight.\n      this.#server = undefined;\n      await new Promise<void>((resolve, reject) => {\n        server.close((error) => {\n          // #server is only ever set right after a successful listen() and\n          // cleared right before this close(), so ERR_SERVER_NOT_RUNNING\n          // (the one realistic cause) can't occur here.\n          /* v8 ignore next 3 -- @preserve */\n          if (error) {\n            reject(error);\n            return;\n          }\n          resolve();\n        });\n      });\n    }\n    await this.#app.close(signal);\n  }\n}\n\nexport async function createHttpApplication(\n  rootModule: ModuleRef,\n  options: HttpApplicationOptions = {},\n): Promise<HttpApplication> {\n  return HttpApplication.create(rootModule, options);\n}\n","export const HTTP_METHODS = [\"GET\", \"POST\", \"PUT\", \"PATCH\", \"DELETE\", \"HEAD\", \"OPTIONS\"] as const;\n\nexport type HttpMethod = (typeof HTTP_METHODS)[number];\n"],"mappings":";;;;;;AASA,MAAM,gBAAgB,OAAO,sBAAsB;AACnD,MAAM,WAAW,OAAO,iBAAiB;;AAGzC,SAAgB,aAAa,SAA+C;CAC1E,QAAQ,QAAQ,gBAAgB;EAC9B,eAAe,eAAe,SAAS,QAAQ,WAAW;CAC5D;AACF;AAEA,SAAgB,gBAAgB,QAAgB,aAA+D;CAC7G,OAAO,YAAY,eAAe,QAAQ,WAAW;AACvD;;;;;;;AAQA,SAAgB,QAAQ,GAAG,MAAkD;CAC3E,MAAM,aAAa,QAAgB,gBAAwC;EACzE,IAAI,gBAAgB,KAAA,GAAW;GAC7B,MAAM,WAAW,YAAsB,UAAU,MAAM,KAAK,CAAC;GAC7D,eAAe,UAAU,CAAC,GAAG,UAAU,GAAG,IAAI,GAAG,MAAM;EACzD,OAAO;GACL,MAAM,WAAW,YAAsB,UAAU,QAAQ,WAAW,KAAK,CAAC;GAC1E,eAAe,UAAU,CAAC,GAAG,UAAU,GAAG,IAAI,GAAG,QAAQ,WAAW;EACtE;CACF;CACA,OAAO;AACT;AAEA,SAAgB,gBAAgB,QAA0B;CACxD,OAAO,YAAY,UAAU,MAAM,KAAK,CAAC;AAC3C;AAEA,SAAgB,iBAAiB,QAAgB,aAAwC;CACvF,OAAO,YAAY,UAAU,QAAQ,WAAW,KAAK,CAAC;AACxD;;;AC9CA,MAAM,oBAAoB,OAAO,0BAA0B;AAE3D,SAAS,aAAa,OAAuB;CAC3C,OAAO,MAAM,QAAQ,QAAQ,EAAE,CAAC,CAAC,QAAQ,QAAQ,EAAE;AACrD;AAEA,SAAgB,WAAW,SAAS,IAAoB;CACtD,QAAQ,WAAW;EACjB,eAAe,mBAAmB,aAAa,MAAM,GAAG,MAAM;CAChE;AACF;AAEA,SAAgB,oBAAoB,QAAoC;CACtE,OAAO,YAAY,mBAAmB,MAAM;AAC9C;;;ACLA,MAAM,SAAS,OAAO,eAAe;;;;;;;AAQrC,SAAgB,UAAU,GAAG,QAAgE;CAC3F,MAAM,aAAa,QAAgB,gBAAwC;EACzE,IAAI,gBAAgB,KAAA,GAAW;GAC7B,MAAM,WAAW,YAAkC,QAAQ,MAAM,KAAK,CAAC;GACvE,eAAe,QAAQ,CAAC,GAAG,UAAU,GAAG,MAAM,GAAG,MAAM;EACzD,OAAO;GACL,MAAM,WAAW,YAAkC,QAAQ,QAAQ,WAAW,KAAK,CAAC;GACpF,eAAe,QAAQ,CAAC,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,WAAW;EACtE;CACF;CACA,OAAO;AACT;AAEA,SAAgB,eAAe,QAAsC;CACnE,OAAO,YAAY,QAAQ,MAAM,KAAK,CAAC;AACzC;AAEA,SAAgB,gBAAgB,QAAgB,aAAoD;CAClG,OAAO,YAAY,QAAQ,QAAQ,WAAW,KAAK,CAAC;AACtD;;;AC/BA,MAAM,eAAe,OAAO,qBAAqB;;;;;;;;AASjD,SAAgB,gBAAgB,GAAG,cAAsE;CACvG,MAAM,aAAa,QAAgB,gBAAwC;EACzE,IAAI,gBAAgB,KAAA,GAAW;GAC7B,MAAM,WAAW,YAAkC,cAAc,MAAM,KAAK,CAAC;GAC7E,eAAe,cAAc,CAAC,GAAG,UAAU,GAAG,YAAY,GAAG,MAAM;EACrE,OAAO;GACL,MAAM,WAAW,YAAkC,cAAc,QAAQ,WAAW,KAAK,CAAC;GAC1F,eAAe,cAAc,CAAC,GAAG,UAAU,GAAG,YAAY,GAAG,QAAQ,WAAW;EAClF;CACF;CACA,OAAO;AACT;AAEA,SAAgB,qBAAqB,QAAsC;CACzE,OAAO,YAAY,cAAc,MAAM,KAAK,CAAC;AAC/C;AAEA,SAAgB,sBAAsB,QAAgB,aAAoD;CACxG,OAAO,YAAY,cAAc,QAAQ,WAAW,KAAK,CAAC;AAC5D;;;ACzBA,MAAM,SAAS,OAAO,eAAe;AAErC,SAAS,eAAe,QAAyC;CAC/D,QAAQ,QAAQ,aAAa,mBAAmB;EAC9C,IAAI,gBAAgB,KAAA,GAClB,MAAM,IAAI,MAAM,kHAAkH;EAEpI,MAAM,UACJ,YAAsC,QAAQ,QAAQ,WAAW,qBAAK,IAAI,IAAyB;EACrG,QAAQ,IAAI,gBAAgB,MAAM;EAClC,eAAe,QAAQ,SAAS,QAAQ,WAAW;CACrD;AACF;;AAGA,SAAgB,KAAK,QAAsC;CACzD,OAAO,eAAe;EAAE,MAAM;EAAQ;CAAO,CAAC;AAChD;;AAGA,SAAgB,MAAM,QAAsC;CAC1D,OAAO,eAAe;EAAE,MAAM;EAAS;CAAO,CAAC;AACjD;;AAGA,SAAgB,MAAM,MAAc,QAAsC;CACxE,OAAO,eAAe;EAAE,MAAM;EAAS;EAAM;CAAO,CAAC;AACvD;;AAGA,SAAgBA,UAAQ,MAAmC;CACzD,OAAO,eAAe;EAAE,MAAM;EAAW;CAAK,CAAC;AACjD;;AAGA,SAAgB,MAA0B;CACxC,OAAO,eAAe,EAAE,MAAM,MAAM,CAAC;AACvC;AAEA,SAAgB,gBAAgB,QAAgB,aAAwD;CACtG,OAAO,YAAY,QAAQ,QAAQ,WAAW,qBAAK,IAAI,IAAI;AAC7D;;;ACzCA,MAAM,SAAS,OAAO,eAAe;AACrC,MAAM,YAAY,OAAO,kBAAkB;AAC3C,MAAM,UAAU,OAAO,gBAAgB;AAEvC,SAAS,eAAe,QAAoB,MAA+B;CACzE,QAAQ,QAAQ,gBAAgB;EAC9B,MAAM,OAAO,OAAO;EACpB,MAAM,SAAS,YAA+B,QAAQ,IAAI,KAAK,CAAC;EAChE,OAAO,KAAK;GAAE;GAAQ;GAAM;EAAY,CAAC;EACzC,eAAe,QAAQ,QAAQ,IAAI;CACrC;AACF;AAEA,MAAa,OAAO,OAAO,OAAwB,eAAe,OAAO,IAAI;AAC7E,MAAa,QAAQ,OAAO,OAAwB,eAAe,QAAQ,IAAI;AAC/E,MAAa,OAAO,OAAO,OAAwB,eAAe,OAAO,IAAI;AAC7E,MAAa,SAAS,OAAO,OAAwB,eAAe,SAAS,IAAI;AACjF,MAAa,UAAU,OAAO,OAAwB,eAAe,UAAU,IAAI;AAEnF,SAAgB,UAAU,QAAmC;CAC3D,OAAO,YAAY,QAAQ,MAAM,KAAK,CAAC;AACzC;;AAGA,SAAgB,SAAS,MAA+B;CACtD,QAAQ,QAAQ,gBAAgB;EAC9B,eAAe,WAAW,MAAM,QAAQ,WAAW;CACrD;AACF;AAEA,SAAgB,YAAY,QAAgB,aAAkD;CAC5F,OAAO,YAAY,WAAW,QAAQ,WAAW;AACnD;;;;;;;AAQA,SAAgB,QAAQ,QAAkC;CACxD,QAAQ,QAAQ,gBAAgB;EAC9B,eAAe,SAAS,QAAQ,QAAQ,WAAW;CACrD;AACF;AAEA,SAAgB,iBAAiB,QAAgB,aAAmD;CAClG,OAAO,YAAY,SAAS,QAAQ,WAAW;AACjD;;;;ACzDA,IAAa,gBAAb,cAAmC,MAAM;CACvC,YACE,QACA,QACA,OACA;EACA,MAAM,MAAM;EAJI,KAAA,SAAA;EACA,KAAA,SAAA;EACA,KAAA,QAAA;EAGhB,KAAK,OAAO;CACd;AACF;AAEA,IAAa,sBAAb,cAAyC,cAAc;CACrD,YAAY,SAAS,eAAe,OAAiC;EACnE,MAAM,KAAK,QAAQ,KAAK;EACxB,KAAK,OAAO;CACd;AACF;AAEA,IAAa,wBAAb,cAA2C,cAAc;CACvD,YAAY,SAAS,gBAAgB;EACnC,MAAM,KAAK,MAAM;EACjB,KAAK,OAAO;CACd;AACF;AAEA,IAAa,qBAAb,cAAwC,cAAc;CACpD,YAAY,SAAS,aAAa;EAChC,MAAM,KAAK,MAAM;EACjB,KAAK,OAAO;CACd;AACF;AAEA,IAAa,oBAAb,cAAuC,cAAc;CACnD,YAAY,SAAS,aAAa;EAChC,MAAM,KAAK,MAAM;EACjB,KAAK,OAAO;CACd;AACF;AAEA,IAAa,oBAAb,cAAuC,cAAc;CACnD,YAAY,SAAS,YAAY;EAC/B,MAAM,KAAK,MAAM;EACjB,KAAK,OAAO;CACd;AACF;AAEA,IAAa,2BAAb,cAA8C,cAAc;CAC1D,YAAY,SAAS,qBAAqB;EACxC,MAAM,KAAK,MAAM;EACjB,KAAK,OAAO;CACd;AACF;AAEA,IAAa,gCAAb,cAAmD,cAAc;CAC/D,YAAY,SAAS,0BAA0B;EAC7C,MAAM,KAAK,MAAM;EACjB,KAAK,OAAO;CACd;AACF;;;AChDA,eAAe,gBAAgB,QAAiB,OAAkC;CAChF,MAAM,SAAS,MAAM,OAAO,eAAe,KAAK;CAChD,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,oBAAoB,qBAAqB,EAAE,QAAQ,OAAO,MAAM,OAAO,CAAC;CAEpF,OAAO,OAAO;AAChB;AAEA,eAAe,WAAW,QAAqB,SAAmD;CAChG,QAAQ,OAAO,MAAf;EACE,KAAK,OACH,OAAO,QAAQ;EACjB,KAAK,WACH,OAAO,OAAO,OAAO,QAAQ,QAAQ,QAAQ,IAAI,OAAO,IAAI,IAAI,OAAO,YAAY,QAAQ,QAAQ,OAAO;EAC5G,KAAK,SAAS;GACZ,MAAM,MAAM,QAAQ,YAAY,OAAO;GACvC,OAAO,OAAO,SAAS,gBAAgB,OAAO,QAAQ,GAAG,IAAI;EAC/D;EACA,KAAK,SAAS;GACZ,MAAM,MAAM,OAAO,YAAY,IAAI,IAAI,QAAQ,QAAQ,GAAG,CAAC,CAAC,YAAY;GACxE,OAAO,OAAO,SAAS,gBAAgB,OAAO,QAAQ,GAAG,IAAI;EAC/D;EACA,KAAK,QAAQ;GACX,MAAM,MAAM,MAAM,QAAQ,QAAQ;GAClC,OAAO,OAAO,SAAS,gBAAgB,OAAO,QAAQ,GAAG,IAAI;EAC/D;;EAEA,SAEE,MAAM,IAAI,MAAM,0CAA2CC,OAA2B,MAAM;CAGhG;AACF;;AAGA,eAAsB,mBACpB,SACA,SACoB;CACpB,IAAI,QAAQ,SAAS,GACnB,OAAO,CAAC;CAGV,MAAM,OAAkB,MAAM,KAAc,EAAE,QAAQ,KAAK,IAAI,GAAG,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;CAEvF,MAAM,QAAQ,IACZ,CAAC,GAAG,QAAQ,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,OAAO,YAAY;EACpD,KAAK,SAAS,MAAM,WAAW,QAAQ,OAAO;CAChD,CAAC,CACH;CAEA,OAAO;AACT;;;;;;;;;;;AC7DA,MAAM,UAAU,IAAI,kBAAwC;;AAG5D,IAAa,sBAAb,cAAyC,MAAM;CAC7C,cAAc;EACZ,MAAM,mEAAmE;EACzE,KAAK,OAAO;CACd;AACF;AAWO,IAAM,iBAAN,MAAM,eAAe;CAC1B,IAAiB,KAA4B;EAC3C,OAAO,QAAQ,SAAS,CAAC,EAAE,IAAI,GAAG;CACpC;CAEA,IAAI,KAAsB;EACxB,OAAO,QAAQ,SAAS,CAAC,EAAE,IAAI,GAAG,KAAK;CACzC;CAEA,IAAI,KAAa,OAAsB;EACrC,MAAM,QAAQ,QAAQ,SAAS;EAC/B,IAAI,CAAC,OACH,MAAM,IAAI,oBAAoB;EAEhC,MAAM,IAAI,KAAK,KAAK;CACtB;AACF;AAjBC,iBAAA,WAAA,CAAA,WAAW,CAAA,GAAA,cAAA;;AAoBZ,SAAgB,oBAAuB,IAAgB;CACrD,OAAO,QAAQ,oBAAI,IAAI,IAAI,GAAG,EAAE;AAClC;;;;;;;;;;AC7BA,IAAa,0BAAb,cAA6C,MAAM;CACjD,YAAY,QAA4D;EACtE,MAAM,wCAAwC,OAAO,KAAK,UAAU,GAAG,MAAM,KAAK,KAAK,GAAG,EAAE,IAAI,MAAM,SAAS,CAAC,CAAC,KAAK,IAAI,GAAG;EADnG,KAAA,SAAA;EAE1B,KAAK,OAAO;CACd;AACF;;AAGA,eAAsB,iBAAiB,QAA6B,OAAkC;CACpG,IAAI,CAAC,QACH,OAAO;CAET,MAAM,SAAS,MAAM,OAAO,eAAe,KAAK;CAChD,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,wBAAwB,OAAO,MAAM,MAAM;CAEvD,OAAO,OAAO;AAChB;;;ACZA,IAAa,sBAAb,cAAyC,MAAM;CAG7C,YAAY,QAAoB,MAAc;EAC5C,MAAM,oBAAoB,OAAO,GAAG,KAAK,+DAA+D;EAHjF,KAAA,OAAA;CAIzB;AACF;AASA,SAAS,aAA6B;CACpC,OAAO;EAAE,gCAAgB,IAAI,IAAI;EAAG,0BAAU,IAAI,IAAI;CAAE;AAC1D;AAEA,SAAS,UAAU,MAAwB;CACzC,OAAO,KAAK,MAAM,GAAG,CAAC,CAAC,QAAQ,YAAY,QAAQ,SAAS,CAAC;AAC/D;;;;;;;AAaA,SAAS,KACP,MACA,UACA,OACA,QAC2B;CAC3B,IAAI,UAAU,SAAS,QACrB,OAAO,KAAK,SAAS,OAAO,IAAI;EAAE;EAAM;CAAO,IAAI,KAAA;CAGrD,MAAM,UAAU,SAAS;CAEzB,MAAM,cAAc,KAAK,eAAe,IAAI,OAAO;CACnD,IAAI,aAAa;EACf,MAAM,SAAS,KAAK,aAAa,UAAU,QAAQ,GAAG,MAAM;EAC5D,IAAI,QACF,OAAO;CAEX;CAEA,IAAI,KAAK,YAAY;EACnB,MAAM,EAAE,MAAM,MAAM,cAAc,KAAK;EACvC,MAAM,SAAS,KAAK,WAAW,UAAU,QAAQ,GAAG;GAAE,GAAG;IAAS,OAAO;EAAQ,CAAC;EAClF,IAAI,QACF,OAAO;CAEX;CAEA,IAAI,KAAK,eAAe;EACtB,MAAM,EAAE,MAAM,MAAM,iBAAiB,KAAK;EAC1C,IAAI,aAAa,SAAS,OAAO,GAC/B,OAAO;GAAE,MAAM;GAAc,QAAQ;IAAE,GAAG;KAAS,OAAO,SAAS,MAAM,KAAK,CAAC,CAAC,KAAK,GAAG;GAAE;EAAE;CAEhG;AAGF;;;;;AAMA,IAAa,SAAb,MAAuB;CACrB,QAAiB,WAAc;CAE/B,IAAI,QAAoB,MAAc,SAAkB;EACtD,MAAM,WAAW,UAAU,IAAI;EAC/B,IAAI,OAAO,KAAK;EAEhB,KAAK,MAAM,WAAW,UACpB,IAAI,QAAQ,WAAW,GAAG,GAAG;GAC3B,MAAM,OAAO,QAAQ,MAAM,CAAC;GAC5B,KAAK,eAAe;IAAE;IAAM,MAAM,WAAW;GAAE;GAC/C,OAAO,KAAK,WAAW;EACzB,OAAO,IAAI,YAAY,KAAK;GAC1B,KAAK,kBAAkB;IAAE,MAAM;IAAK,MAAM,WAAW;GAAE;GACvD,OAAO,KAAK,cAAc;EAC5B,OAAO;GACL,IAAI,QAAQ,KAAK,eAAe,IAAI,OAAO;GAC3C,IAAI,CAAC,OAAO;IACV,QAAQ,WAAW;IACnB,KAAK,eAAe,IAAI,SAAS,KAAK;GACxC;GACA,OAAO;EACT;EAGF,IAAI,KAAK,SAAS,IAAI,MAAM,GAC1B,MAAM,IAAI,oBAAoB,QAAQ,IAAI;EAE5C,KAAK,SAAS,IAAI,QAAQ,OAAO;CACnC;CAEA,MAAM,QAAoB,MAAoC;EAC5D,MAAM,WAAW,UAAU,IAAI;EAC/B,MAAM,SAAS,KAAK,KAAK,OAAO,UAAU,GAAG,CAAC,CAAC;EAE/C,IAAI,CAAC,QACH,OAAO,EAAE,MAAM,YAAY;EAG7B,MAAM,UAAU,OAAO,KAAK,SAAS,IAAI,MAAM;EAC/C,IAAI,CAAC,SACH,OAAO;GAAE,MAAM;GAAsB,SAAS,CAAC,GAAG,OAAO,KAAK,SAAS,KAAK,CAAC;EAAE;EAGjF,OAAO;GAAE,MAAM;GAAS;GAAS,QAAQ,OAAO;EAAO;CACzD;AACF;;;ACxHA,MAAM,qBAAqB;AAM3B,IAAa,sBAAb,cAAyC,MAAM;CAG7C,YAAY,QAA0B;EACpC,MAAM,GAAG,OAAO,KAAK,qDAAqD;EAHnD,KAAA,OAAA;CAIzB;AACF;;;;;;;AAkBA,SAAgB,YAAY,aAAmD;CAC7E,MAAM,SAAS,IAAI,OAAmB;CAEtC,KAAK,MAAM,cAAc,aAAa;EACpC,MAAM,SAAS,oBAAoB,UAAU;EAC7C,IAAI,WAAW,KAAA,GACb,MAAM,IAAI,oBAAoB,UAAU;EAG1C,MAAM,YAAY,WAAW;EAC7B,MAAM,cAAc,eAAe,UAAU;EAC7C,MAAM,oBAAoB,qBAAqB,UAAU;EAEzD,KAAK,MAAM,SAAS,UAAU,UAAU,GACtC,OAAO,IAAI,MAAM,QAAQ,IAAI,OAAO,GAAG,MAAM,QAAQ;GACnD;GACA,aAAa,MAAM;GACnB,cAAc,gBAAgB,WAAW,MAAM,WAAW;GAC1D,UAAU,YAAY,WAAW,MAAM,WAAW;GAClD,gBAAgB,iBAAiB,WAAW,MAAM,WAAW;GAC7D,QAAQ,CAAC,GAAG,aAAa,GAAG,gBAAgB,WAAW,MAAM,WAAW,CAAC;GACzE,cAAc,CAAC,GAAG,mBAAmB,GAAG,sBAAsB,WAAW,MAAM,WAAW,CAAC;EAC7F,CAAC;CAEL;CAEA,OAAO;AACT;AAEA,eAAe,aAAa,SAAkB,WAAqC;CACjF,IAAI,QAAQ,SAAS,MACnB;CAIF,IAAI,EADgB,QAAQ,QAAQ,IAAI,cAAc,KAAK,GAAA,CAC1C,YAAY,CAAC,CAAC,WAAW,kBAAkB,GAC1D,MAAM,IAAI,8BAA8B;CAG1C,MAAM,gBAAgB,QAAQ,QAAQ,IAAI,gBAAgB;CAC1D,IAAI,kBAAkB,QAAQ,OAAO,aAAa,IAAI,WACpD,MAAM,IAAI,yBAAyB;CAGrC,MAAM,OAAO,MAAM,QAAQ,KAAK;CAChC,IAAI,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,SAAS,WAC1C,MAAM,IAAI,yBAAyB;CAErC,IAAI,KAAK,WAAW,GAClB;CAGF,IAAI;EACF,OAAO,KAAK,MAAM,IAAI;CACxB,QAAQ;EACN,MAAM,IAAI,oBAAoB,mBAAmB;CACnD;AACF;AAEA,MAAM,gBAAwC;CAC5C,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;AACP;AAEA,SAAS,gBAAgB,QAAgB,QAAgB,OAA2C;CAClG,MAAM,OAAO;EACX,MAAM;EACN,OAAO,cAAc,WAAW;EAChC;EACA;EACA,GAAG;CACL;CACA,OAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;EAAE;EAAQ,SAAS,EAAE,gBAAgB,2BAA2B;CAAE,CAAC;AAC/G;AAEA,SAAS,oBAAoB,OAA0B;CACrD,IAAI,iBAAiB,eACnB,OAAO,gBAAgB,MAAM,QAAQ,MAAM,QAAQ,MAAM,KAAK;CAGhE,QAAQ,MAAM,KAAK;CACnB,OAAO,gBAAgB,KAAK,8BAA8B;AAC5D;;;;;;AAOA,eAAe,WAAW,OAAgB,UAA8B,gBAAwD;CAC9H,IAAI,iBAAiB,UACnB,OAAO;CAET,IAAI,UAAU,KAAA,GACZ,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,YAAY,IAAI,CAAC;CAEvD,MAAM,YAAY,MAAM,iBAAiB,gBAAgB,KAAK;CAC9D,OAAO,IAAI,SAAS,KAAK,UAAU,SAAS,GAAG;EAC7C,QAAQ,YAAY;EACpB,SAAS,EAAE,gBAAgB,mBAAmB;CAChD,CAAC;AACH;;AAGA,SAAgB,cACd,aACA,aACA,UAA0B,CAAC,GACc;CACzC,MAAM,SAAS,YAAY,WAAW;CACtC,MAAM,YAAY,QAAQ,aAAa;CAEvC,OAAO,eAAe,OAAO,SAAqC;EAChE,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;EAC/B,MAAM,QAAQ,OAAO,MAAM,QAAQ,QAAsB,IAAI,QAAQ;EAErE,IAAI,MAAM,SAAS,aACjB,OAAO,gBAAgB,KAAK,4BAA4B;EAE1D,IAAI,MAAM,SAAS,sBAAsB;GACvC,MAAM,WAAW,gBAAgB,KAAK,oBAAoB,MAAM,QAAQ,KAAK,IAAI,GAAG;GACpF,SAAS,QAAQ,IAAI,SAAS,MAAM,QAAQ,KAAK,IAAI,CAAC;GACtD,OAAO;EACT;EAEA,MAAM,QAAQ,MAAM;EAEpB,OAAO,oBAAoB,YAAY;GACrC,IAAI;IAGF,KAAK,MAAM,cAAc,MAAM,QAG7B,IAAI,CAAC,MAFS,YAAY,IAAI,UACJ,CAAC,CAAC,YAAY;KAAE;KAAS,QAAQ,MAAM;IAAO,CAAC,GAEvE,MAAM,IAAI,mBAAmB;IAIjC,MAAM,SAAS,YAA+B;KAC5C,IAAI;KACJ,MAAM,OAAO,MAAM,mBAAmB,MAAM,cAAc;MACxD;MACA,aAAa,MAAM;MACnB,SAAS,YAAY;OACnB,eAAe,EAAE,OAAO,MAAM,aAAa,SAAS,SAAS,EAAE;OAC/D,OAAO,WAAW;MACpB;KACF,CAAC;KAKD,OAAO,WAAW,MAHD,YAAY,IAAI,MAAM,UACF,CAAC,CAAC,MAAM,YAAY,GAAG,GAAG,IAAI,GAEzC,MAAM,UAAU,MAAM,cAAc;IAChE;IASA,OAAO,MALU,MAAM,aAAa,aAAsC,MAAM,qBAAqB;KACnG,MAAM,cAAc,YAAY,IAAI,gBAAgB;KACpD,OAAO,YAAY,YAAY,UAAU;MAAE;MAAS,QAAQ,MAAM;KAAO,GAAG,IAAI;IAClF,GAAG,MAEiB,CAAC,CAAC;GACxB,SAAS,OAAO;IACd,OAAO,oBAAoB,KAAK;GAClC;EACF,CAAC;CACH;AACF;;;;AC/NA,SAAgB,aAAa,KAAsB,SAA0B;CAC3E,MAAM,SAAS,IAAI,UAAU;CAC7B,MAAM,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,OAAO;CAE3C,MAAM,UAAU,IAAI,QAAQ;CAC5B,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,IAAI,OAAO,GAAG;EACvD,IAAI,UAAU,KAAA,GACZ;EAEF,KAAK,MAAM,OAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK,GACrD,QAAQ,OAAO,MAAM,GAAG;CAE5B;CAEA,MAAM,aAAa,IAAI,gBAAgB;CACvC,IAAI,KAAK,iBAAiB;EACxB,WAAW,MAAM;CACnB,CAAC;CAMD,MAAM,UACJ,WAAW,SACX,WAAW,WACV,IAAI,QAAQ,yBAAyB,KAAA,KACnC,IAAI,QAAQ,sBAAsB,KAAA,KAAa,IAAI,QAAQ,sBAAsB;CAEtF,OAAO,IAAI,QAAQ,KAAK;EACtB;EACA;EACA,QAAQ,WAAW;EAEnB,GAAI,UAAU;GAAE,MAAM,SAAS,MAAM,GAAG;GAAG,QAAQ;EAAgB,IAAI,CAAC;CAC1E,CAAC;AACH;;AAGA,eAAsB,gBAAgB,UAAoB,KAAoC;CAC5F,MAAM,UAAoC,CAAC;CAC3C,KAAK,MAAM,CAAC,MAAM,UAAU,SAAS,SACnC,CAAC,QAAQ,UAAU,CAAC,EAAA,CAAG,KAAK,KAAK;CAEnC,IAAI,UAAU,SAAS,QAAQ,OAAO;CAEtC,IAAI,CAAC,SAAS,MAAM;EAClB,IAAI,IAAI;EACR;CACF;CAEA,MAAM,OAAO,SAAS,QAAQ,SAAS,IAAI;CAC3C,MAAM,IAAI,SAAe,SAAS,WAAW;EAC3C,IAAI,KAAK,UAAU,OAAO;EAC1B,IAAI,KAAK,SAAS,MAAM;EACxB,KAAK,KAAK,SAAS,MAAM;EACzB,KAAK,KAAK,GAAG;CACf,CAAC;AACH;;;;ACpDA,IACM,uBADN,MACM,qBAAqB,CAAC;AAD3B,uBAAA,WAAA,CAAA,OAAO;CAAE,WAAW,CAAC,cAAc;CAAG,SAAS,CAAC,cAAc;CAAG,QAAQ;AAAK,CAAC,CAAA,GAAA,oBAAA;;AAIhF,IACM,iBADN,MACM,eAAe,CAAC;AADrB,iBAAA,WAAA,CAAA,OAAO,CAAA,GAAA,cAAA;;AAQR,IAAa,kBAAb,MAAa,gBAAgB;CAC3B;CACA;CACA;CAEA,YAAoB,KAAkB,QAAiD;EACrF,KAAK,OAAO;EACZ,KAAK,UAAU;CACjB;CAEA,aAAa,OAAO,YAAuB,UAAkC,CAAC,GAA6B;EAEzG,MAAM,MAAM,MAAM,kBAAkB;GADd,QAAQ;GAAgB,SAAS,CAAC,YAAY,oBAAoB;EAC1C,GAAG,EAAE,WAAW,QAAQ,UAAU,CAAC;EACjF,MAAM,SAAS,cAAc,IAAI,aAAa,KAAK,OAAO;EAC1D,OAAO,IAAI,gBAAgB,KAAK,MAAM;CACxC;;CAGA,IAAO,OAAoB;EACzB,OAAO,KAAK,KAAK,IAAI,KAAK;CAC5B;;CAGA,IAAI,cAAgC;EAClC,OAAO,KAAK,KAAK;CACnB;;CAGA,OAAO,SAAqC;EAC1C,OAAO,KAAK,QAAQ,OAAO;CAC7B;CAEA,OAAO,MAAc,WAAW,WAAkC;EAChE,OAAO,IAAI,SAAS,SAAS,WAAW;GACtC,MAAM,SAAS,cAAc,KAAK,QAAQ;IACxC,MAAM,UAAU,aAAa,KAAK,UAAU,SAAS,GAAG,MAAM;IAC9D,KAAK,QAAQ,OAAO,CAAC,CAClB,MAAM,aAAa,gBAAgB,UAAU,GAAG,CAAC,CAAC,CAOlD,OAAO,UAAmB;KACzB,QAAQ,MAAM,KAAK;KACnB,IAAI,CAAC,IAAI,aACP,IAAI,UAAU,GAAG;KAEnB,IAAI,IAAI;IACV,CAAC;;GAEL,CAAC;GAED,OAAO,KAAK,SAAS,MAAM;GAC3B,OAAO,OAAO,MAAM,gBAAgB;IAClC,KAAK,UAAU;IACf,MAAM,UAAU,OAAO,QAAQ;IAK/B,QAAQ,EAAE,MADS,OAAO,YAAY,YAAY,YAAY,OAAO,QAAQ,OAAO,KACzD,CAAC;GAC9B,CAAC;EACH,CAAC;CACH;CAEA,MAAM,MAAM,QAAgC;EAC1C,IAAI,KAAK,SAAS;GAChB,MAAM,SAAS,KAAK;GAIpB,KAAK,UAAU,KAAA;GACf,MAAM,IAAI,SAAe,SAAS,WAAW;IAC3C,OAAO,OAAO,UAAU;;KAKtB,IAAI,OAAO;MACT,OAAO,KAAK;MACZ;KACF;KACA,QAAQ;IACV,CAAC;GACH,CAAC;EACH;EACA,MAAM,KAAK,KAAK,MAAM,MAAM;CAC9B;AACF;AAEA,eAAsB,sBACpB,YACA,UAAkC,CAAC,GACT;CAC1B,OAAO,gBAAgB,OAAO,YAAY,OAAO;AACnD;;;ACvHA,MAAa,eAAe;CAAC;CAAO;CAAQ;CAAO;CAAS;CAAU;CAAQ;AAAS"}

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@blixis-io/http",
+  "version": "0.1.0",
+  "description": "The HTTP layer built on @blixis-io/core — routing, controllers, request validation with Zod, guards, RFC 9457 error responses.",
+  "license": "MIT",
+  "author": "Michael Voeten <michael@voeten.online>",
+  "homepage": "https://blixis-io.github.io/framework/",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/blixis-io/framework.git",
+    "directory": "packages/http"
+  },
+  "type": "module",
+  "engines": {
+    "node": ">=24"
+  },
+  "keywords": [
+    "http",
+    "framework",
+    "rest",
+    "typescript"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist"
+  ],
+  "exports": {
+    ".": {
+      "@blixis-io/source": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "dependencies": {
+    "@blixis-io/core": "0.1.0",
+    "@blixis-io/di": "0.1.0",
+    "zod": "^4.6.5"
+  },
+  "scripts": {
+    "typecheck": "tsc -p tsconfig.json",
+    "build": "rolldown -c"
+  }
+}