@codewithagents/openapi-server 1.3.1 → 1.4.0

package/dist/cli.cjs

@@ -277,24 +277,24 @@ var require_normalize = __commonJS({
       };
     }
     exports2.normalizeOptions = normalizeOptions;
-    function normalizeArgs(args2, options) {
+    function normalizeArgs(args, options) {
       let originalError;
       let props;
       let formatArgs;
       let message = "";
-      if (typeof args2[0] === "string") {
-        formatArgs = args2;
-      } else if (typeof args2[1] === "string") {
-        if (args2[0] instanceof Error) {
-          originalError = args2[0];
+      if (typeof args[0] === "string") {
+        formatArgs = args;
+      } else if (typeof args[1] === "string") {
+        if (args[0] instanceof Error) {
+          originalError = args[0];
         } else {
-          props = args2[0];
+          props = args[0];
         }
-        formatArgs = args2.slice(1);
+        formatArgs = args.slice(1);
       } else {
-        originalError = args2[0];
-        props = args2[1];
-        formatArgs = args2.slice(2);
+        originalError = args[0];
+        props = args[1];
+        formatArgs = args.slice(2);
       }
       if (formatArgs.length > 0) {
         if (options.format) {
@@ -325,8 +325,8 @@ var require_constructor = __commonJS({
     exports2.Ono = constructor;
     function Ono(ErrorConstructor, options) {
       options = normalize_1.normalizeOptions(options);
-      function ono(...args2) {
-        let { originalError, props, message } = normalize_1.normalizeArgs(args2, options);
+      function ono(...args) {
+        let { originalError, props, message } = normalize_1.normalizeArgs(args, options);
         let newError = new ErrorConstructor(message);
         return extend_error_1.extendError(newError, originalError, props);
       }
@@ -365,19 +365,19 @@ var require_singleton = __commonJS({
     ono.type = new constructor_1.Ono(TypeError);
     ono.uri = new constructor_1.Ono(URIError);
     var onoMap = ono;
-    function ono(...args2) {
-      let originalError = args2[0];
+    function ono(...args) {
+      let originalError = args[0];
       if (typeof originalError === "object" && typeof originalError.name === "string") {
         for (let typedOno of Object.values(onoMap)) {
           if (typeof typedOno === "function" && typedOno.name === "ono") {
             let species = typedOno[Symbol.species];
             if (species && species !== Error && (originalError instanceof species || originalError.name === species.name)) {
-              return typedOno.apply(void 0, args2);
+              return typedOno.apply(void 0, args);
             }
           }
         }
       }
-      return ono.error.apply(void 0, args2);
+      return ono.error.apply(void 0, args);
     }
   }
 });
@@ -482,23 +482,23 @@ var require_code = __commonJS({
     };
     exports2._Code = _Code;
     exports2.nil = new _Code("");
-    function _(strs, ...args2) {
+    function _(strs, ...args) {
       const code = [strs[0]];
       let i = 0;
-      while (i < args2.length) {
-        addCodeArg(code, args2[i]);
+      while (i < args.length) {
+        addCodeArg(code, args[i]);
         code.push(strs[++i]);
       }
       return new _Code(code);
     }
     exports2._ = _;
     var plus = new _Code("+");
-    function str(strs, ...args2) {
+    function str(strs, ...args) {
       const expr = [safeStringify(strs[0])];
       let i = 0;
-      while (i < args2.length) {
+      while (i < args.length) {
         expr.push(plus);
-        addCodeArg(expr, args2[i]);
+        addCodeArg(expr, args[i]);
         expr.push(plus, safeStringify(strs[++i]));
       }
       optimize(expr);
@@ -1053,10 +1053,10 @@ var require_codegen = __commonJS({
       }
     };
     var Func = class extends BlockNode {
-      constructor(name, args2, async) {
+      constructor(name, args, async) {
         super();
         this.name = name;
-        this.args = args2;
+        this.args = args;
         this.async = async;
       }
       render(opts) {
@@ -1331,8 +1331,8 @@ var require_codegen = __commonJS({
         return this;
       }
       // `function` heading (or definition if funcBody is passed)
-      func(name, args2 = code_1.nil, async, funcBody) {
-        this._blockNode(new Func(name, args2, async));
+      func(name, args = code_1.nil, async, funcBody) {
+        this._blockNode(new Func(name, args, async));
         if (funcBody)
           this.code(funcBody).endFunc();
         return this;
@@ -1426,13 +1426,13 @@ var require_codegen = __commonJS({
     }
     exports2.not = not;
     var andCode = mappend(exports2.operators.AND);
-    function and(...args2) {
-      return args2.reduce(andCode);
+    function and(...args) {
+      return args.reduce(andCode);
     }
     exports2.and = and;
     var orCode = mappend(exports2.operators.OR);
-    function or(...args2) {
-      return args2.reduce(orCode);
+    function or(...args) {
+      return args.reduce(orCode);
     }
     exports2.or = or;
     function mappend(op) {
@@ -2165,8 +2165,8 @@ var require_code2 = __commonJS({
       ];
       if (it.opts.dynamicRef)
         valCxt.push([names_1.default.dynamicAnchors, names_1.default.dynamicAnchors]);
-      const args2 = (0, codegen_1._)`${dataAndSchema}, ${gen.object(...valCxt)}`;
-      return context !== codegen_1.nil ? (0, codegen_1._)`${func}.call(${context}, ${args2})` : (0, codegen_1._)`${func}(${args2})`;
+      const args = (0, codegen_1._)`${dataAndSchema}, ${gen.object(...valCxt)}`;
+      return context !== codegen_1.nil ? (0, codegen_1._)`${func}.call(${context}, ${args})` : (0, codegen_1._)`${func}(${args})`;
     }
     exports2.callValidateCode = callValidateCode;
     var newRegExp = (0, codegen_1._)`new RegExp`;
@@ -4161,18 +4161,18 @@ var require_fast_uri = __commonJS({
       return uriTokens.join("");
     }
     var URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;
-    function getParseError(parsed, matches) {
-      if (matches[2] !== void 0 && parsed.path && parsed.path[0] !== "/") {
+    function getParseError(parsed2, matches) {
+      if (matches[2] !== void 0 && parsed2.path && parsed2.path[0] !== "/") {
         return 'URI path must start with "/" when authority is present.';
       }
-      if (typeof parsed.port === "number" && (parsed.port < 0 || parsed.port > 65535)) {
+      if (typeof parsed2.port === "number" && (parsed2.port < 0 || parsed2.port > 65535)) {
         return "URI port is malformed.";
       }
       return void 0;
     }
     function parseWithStatus(uri, opts) {
       const options = Object.assign({}, opts);
-      const parsed = {
+      const parsed2 = {
         scheme: void 0,
         userinfo: void 0,
         host: "",
@@ -4192,80 +4192,80 @@ var require_fast_uri = __commonJS({
       }
       const matches = uri.match(URI_PARSE);
       if (matches) {
-        parsed.scheme = matches[1];
-        parsed.userinfo = matches[3];
-        parsed.host = matches[4];
-        parsed.port = parseInt(matches[5], 10);
-        parsed.path = matches[6] || "";
-        parsed.query = matches[7];
-        parsed.fragment = matches[8];
-        if (isNaN(parsed.port)) {
-          parsed.port = matches[5];
-        }
-        const parseError = getParseError(parsed, matches);
+        parsed2.scheme = matches[1];
+        parsed2.userinfo = matches[3];
+        parsed2.host = matches[4];
+        parsed2.port = parseInt(matches[5], 10);
+        parsed2.path = matches[6] || "";
+        parsed2.query = matches[7];
+        parsed2.fragment = matches[8];
+        if (isNaN(parsed2.port)) {
+          parsed2.port = matches[5];
+        }
+        const parseError = getParseError(parsed2, matches);
         if (parseError !== void 0) {
-          parsed.error = parsed.error || parseError;
+          parsed2.error = parsed2.error || parseError;
           malformedAuthorityOrPort = true;
         }
-        if (parsed.host) {
-          const ipv4result = isIPv4(parsed.host);
+        if (parsed2.host) {
+          const ipv4result = isIPv4(parsed2.host);
           if (ipv4result === false) {
-            const ipv6result = normalizeIPv6(parsed.host);
-            parsed.host = ipv6result.host.toLowerCase();
+            const ipv6result = normalizeIPv6(parsed2.host);
+            parsed2.host = ipv6result.host.toLowerCase();
             isIP = ipv6result.isIPV6;
           } else {
             isIP = true;
           }
         }
-        if (parsed.scheme === void 0 && parsed.userinfo === void 0 && parsed.host === void 0 && parsed.port === void 0 && parsed.query === void 0 && !parsed.path) {
-          parsed.reference = "same-document";
-        } else if (parsed.scheme === void 0) {
-          parsed.reference = "relative";
-        } else if (parsed.fragment === void 0) {
-          parsed.reference = "absolute";
+        if (parsed2.scheme === void 0 && parsed2.userinfo === void 0 && parsed2.host === void 0 && parsed2.port === void 0 && parsed2.query === void 0 && !parsed2.path) {
+          parsed2.reference = "same-document";
+        } else if (parsed2.scheme === void 0) {
+          parsed2.reference = "relative";
+        } else if (parsed2.fragment === void 0) {
+          parsed2.reference = "absolute";
         } else {
-          parsed.reference = "uri";
+          parsed2.reference = "uri";
         }
-        if (options.reference && options.reference !== "suffix" && options.reference !== parsed.reference) {
-          parsed.error = parsed.error || "URI is not a " + options.reference + " reference.";
+        if (options.reference && options.reference !== "suffix" && options.reference !== parsed2.reference) {
+          parsed2.error = parsed2.error || "URI is not a " + options.reference + " reference.";
         }
-        const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme);
+        const schemeHandler = getSchemeHandler(options.scheme || parsed2.scheme);
         if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
-          if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
+          if (parsed2.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed2.host)) {
             try {
-              parsed.host = URL.domainToASCII(parsed.host.toLowerCase());
+              parsed2.host = URL.domainToASCII(parsed2.host.toLowerCase());
             } catch (e) {
-              parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
+              parsed2.error = parsed2.error || "Host's domain name can not be converted to ASCII: " + e;
             }
           }
         }
         if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
           if (uri.indexOf("%") !== -1) {
-            if (parsed.scheme !== void 0) {
-              parsed.scheme = unescape(parsed.scheme);
+            if (parsed2.scheme !== void 0) {
+              parsed2.scheme = unescape(parsed2.scheme);
             }
-            if (parsed.host !== void 0) {
-              parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP);
+            if (parsed2.host !== void 0) {
+              parsed2.host = reescapeHostDelimiters(unescape(parsed2.host), isIP);
             }
           }
-          if (parsed.path) {
-            parsed.path = normalizePathEncoding(parsed.path);
+          if (parsed2.path) {
+            parsed2.path = normalizePathEncoding(parsed2.path);
           }
-          if (parsed.fragment) {
+          if (parsed2.fragment) {
             try {
-              parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment));
+              parsed2.fragment = encodeURI(decodeURIComponent(parsed2.fragment));
             } catch {
-              parsed.error = parsed.error || "URI malformed";
+              parsed2.error = parsed2.error || "URI malformed";
             }
           }
         }
         if (schemeHandler && schemeHandler.parse) {
-          schemeHandler.parse(parsed, options);
+          schemeHandler.parse(parsed2, options);
         }
       } else {
-        parsed.error = parsed.error || "URI can not be parsed.";
+        parsed2.error = parsed2.error || "URI can not be parsed.";
       }
-      return { parsed, malformedAuthorityOrPort };
+      return { parsed: parsed2, malformedAuthorityOrPort };
     }
     function parse(uri, opts) {
       return parseWithStatus(uri, opts).parsed;
@@ -4274,9 +4274,9 @@ var require_fast_uri = __commonJS({
       return normalizeStringWithStatus(uri, opts).normalized;
     }
     function normalizeStringWithStatus(uri, opts) {
-      const { parsed, malformedAuthorityOrPort } = parseWithStatus(uri, opts);
+      const { parsed: parsed2, malformedAuthorityOrPort } = parseWithStatus(uri, opts);
       return {
-        normalized: malformedAuthorityOrPort ? uri : serialize(parsed, opts),
+        normalized: malformedAuthorityOrPort ? uri : serialize(parsed2, opts),
         malformedAuthorityOrPort
       };
     }
@@ -12957,7 +12957,7 @@ var require_url = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.parse = void 0;
     exports2.resolve = resolve4;
-    exports2.cwd = cwd2;
+    exports2.cwd = cwd;
     exports2.getProtocol = getProtocol;
     exports2.getExtension = getExtension;
     exports2.stripQuery = stripQuery;
@@ -12994,7 +12994,7 @@ var require_url = __commonJS({
       }
       return resolvedUrl.toString() + endSpaces;
     }
-    function cwd2() {
+    function cwd() {
       if (typeof window !== "undefined") {
         return location.href;
       }
@@ -13066,7 +13066,7 @@ var require_url = __commonJS({
     }
     function fromFileSystemPath(path) {
       if ((0, is_windows_1.isWindows)()) {
-        const projectDir = cwd2();
+        const projectDir = cwd();
         const upperPath = path.toUpperCase();
         const projectDirPosixPath = (0, convert_path_to_posix_1.default)(projectDir);
         const posixUpper = projectDirPosixPath.toUpperCase();
@@ -15259,15 +15259,15 @@ var require_loader = __commonJS({
       }
     }
     var directiveHandlers = {
-      YAML: function handleYamlDirective(state, name, args2) {
+      YAML: function handleYamlDirective(state, name, args) {
         var match, major, minor;
         if (state.version !== null) {
           throwError(state, "duplication of %YAML directive");
         }
-        if (args2.length !== 1) {
+        if (args.length !== 1) {
           throwError(state, "YAML directive accepts exactly one argument");
         }
-        match = /^([0-9]+)\.([0-9]+)$/.exec(args2[0]);
+        match = /^([0-9]+)\.([0-9]+)$/.exec(args[0]);
         if (match === null) {
           throwError(state, "ill-formed argument of the YAML directive");
         }
@@ -15276,19 +15276,19 @@ var require_loader = __commonJS({
         if (major !== 1) {
           throwError(state, "unacceptable YAML version of the document");
         }
-        state.version = args2[0];
+        state.version = args[0];
         state.checkLineBreaks = minor < 2;
         if (minor !== 1 && minor !== 2) {
           throwWarning(state, "unsupported YAML version of the document");
         }
       },
-      TAG: function handleTagDirective(state, name, args2) {
+      TAG: function handleTagDirective(state, name, args) {
         var handle, prefix;
-        if (args2.length !== 2) {
+        if (args.length !== 2) {
           throwError(state, "TAG directive accepts exactly two arguments");
         }
-        handle = args2[0];
-        prefix = args2[1];
+        handle = args[0];
+        prefix = args[1];
         if (!PATTERN_TAG_HANDLE.test(handle)) {
           throwError(state, "ill-formed tag handle (first argument) of the TAG directive");
         }
@@ -17427,23 +17427,23 @@ var require_normalize_args = __commonJS({
       let schema;
       let options;
       let callback;
-      const args2 = Array.prototype.slice.call(_args);
-      if (typeof args2[args2.length - 1] === "function") {
-        callback = args2.pop();
-      }
-      if (typeof args2[0] === "string") {
-        path = args2[0];
-        if (typeof args2[2] === "object") {
-          schema = args2[1];
-          options = args2[2];
+      const args = Array.prototype.slice.call(_args);
+      if (typeof args[args.length - 1] === "function") {
+        callback = args.pop();
+      }
+      if (typeof args[0] === "string") {
+        path = args[0];
+        if (typeof args[2] === "object") {
+          schema = args[1];
+          options = args[2];
         } else {
           schema = void 0;
-          options = args2[1];
+          options = args[1];
         }
       } else {
         path = "";
-        schema = args2[0];
-        options = args2[1];
+        schema = args[0];
+        options = args[1];
       }
       try {
         options = (0, options_js_1.getNewOptions)(options);
@@ -17637,8 +17637,8 @@ var require_bundle = __commonJS({
       if (pointer === null) {
         return;
       }
-      const parsed = pointer_js_1.default.parse(pathFromRoot);
-      const depth = parsed.length;
+      const parsed2 = pointer_js_1.default.parse(pathFromRoot);
+      const depth = parsed2.length;
       const file = url.stripHash(pointer.path);
       const hash = url.getHash(pointer.path);
       const external = file !== $refs._root$Ref.path;
@@ -18042,51 +18042,51 @@ var require_lib3 = __commonJS({
         this.$refs = new refs_js_1.default();
       }
       async parse() {
-        const args2 = (0, normalize_args_js_1.default)(arguments);
+        const args = (0, normalize_args_js_1.default)(arguments);
         let promise;
-        if (!args2.path && !args2.schema) {
-          const err = (0, ono_1.ono)(`Expected a file path, URL, or object. Got ${args2.path || args2.schema}`);
-          return (0, maybe_js_1.default)(args2.callback, Promise.reject(err));
+        if (!args.path && !args.schema) {
+          const err = (0, ono_1.ono)(`Expected a file path, URL, or object. Got ${args.path || args.schema}`);
+          return (0, maybe_js_1.default)(args.callback, Promise.reject(err));
         }
         this.schema = null;
         this.$refs = new refs_js_1.default();
         let pathType = "http";
-        if (url.isFileSystemPath(args2.path)) {
-          args2.path = url.fromFileSystemPath(args2.path);
+        if (url.isFileSystemPath(args.path)) {
+          args.path = url.fromFileSystemPath(args.path);
           pathType = "file";
-        } else if (!args2.path && args2.schema && "$id" in args2.schema && args2.schema.$id) {
-          const params = url.parse(args2.schema.$id);
+        } else if (!args.path && args.schema && "$id" in args.schema && args.schema.$id) {
+          const params = url.parse(args.schema.$id);
           const port = params.protocol === "https:" ? 443 : 80;
-          args2.path = `${params.protocol}//${params.hostname}:${port}`;
+          args.path = `${params.protocol}//${params.hostname}:${port}`;
         }
-        args2.path = url.resolve(url.cwd(), args2.path);
-        if (args2.schema && typeof args2.schema === "object") {
-          const $ref = this.$refs._add(args2.path);
-          $ref.value = args2.schema;
+        args.path = url.resolve(url.cwd(), args.path);
+        if (args.schema && typeof args.schema === "object") {
+          const $ref = this.$refs._add(args.path);
+          $ref.value = args.schema;
           $ref.pathType = pathType;
-          promise = Promise.resolve(args2.schema);
+          promise = Promise.resolve(args.schema);
         } else {
-          promise = (0, parse_js_1.default)(args2.path, this.$refs, args2.options);
+          promise = (0, parse_js_1.default)(args.path, this.$refs, args.options);
         }
         try {
           const result = await promise;
           if (result !== null && typeof result === "object" && !Buffer.isBuffer(result)) {
             this.schema = result;
-            return (0, maybe_js_1.default)(args2.callback, Promise.resolve(this.schema));
-          } else if (args2.options.continueOnError) {
+            return (0, maybe_js_1.default)(args.callback, Promise.resolve(this.schema));
+          } else if (args.options.continueOnError) {
             this.schema = null;
-            return (0, maybe_js_1.default)(args2.callback, Promise.resolve(this.schema));
+            return (0, maybe_js_1.default)(args.callback, Promise.resolve(this.schema));
           } else {
             throw ono_1.ono.syntax(`"${this.$refs._root$Ref.path || result}" is not a valid JSON Schema`);
           }
         } catch (err) {
-          if (!args2.options.continueOnError || !(0, errors_js_1.isHandledError)(err)) {
-            return (0, maybe_js_1.default)(args2.callback, Promise.reject(err));
+          if (!args.options.continueOnError || !(0, errors_js_1.isHandledError)(err)) {
+            return (0, maybe_js_1.default)(args.callback, Promise.reject(err));
           }
-          if (this.$refs._$refs[url.stripHash(args2.path)]) {
-            this.$refs._$refs[url.stripHash(args2.path)].addError(err);
+          if (this.$refs._$refs[url.stripHash(args.path)]) {
+            this.$refs._$refs[url.stripHash(args.path)].addError(err);
           }
-          return (0, maybe_js_1.default)(args2.callback, Promise.resolve(null));
+          return (0, maybe_js_1.default)(args.callback, Promise.resolve(null));
         }
       }
       static parse() {
@@ -18094,14 +18094,14 @@ var require_lib3 = __commonJS({
         return parser.parse.apply(parser, arguments);
       }
       async resolve() {
-        const args2 = (0, normalize_args_js_1.default)(arguments);
+        const args = (0, normalize_args_js_1.default)(arguments);
         try {
-          await this.parse(args2.path, args2.schema, args2.options);
-          await (0, resolve_external_js_1.default)(this, args2.options);
+          await this.parse(args.path, args.schema, args.options);
+          await (0, resolve_external_js_1.default)(this, args.options);
           finalize(this);
-          return (0, maybe_js_1.default)(args2.callback, Promise.resolve(this.$refs));
+          return (0, maybe_js_1.default)(args.callback, Promise.resolve(this.$refs));
         } catch (err) {
-          return (0, maybe_js_1.default)(args2.callback, Promise.reject(err));
+          return (0, maybe_js_1.default)(args.callback, Promise.reject(err));
         }
       }
       static resolve() {
@@ -18113,14 +18113,14 @@ var require_lib3 = __commonJS({
         return instance.bundle.apply(instance, arguments);
       }
       async bundle() {
-        const args2 = (0, normalize_args_js_1.default)(arguments);
+        const args = (0, normalize_args_js_1.default)(arguments);
         try {
-          await this.resolve(args2.path, args2.schema, args2.options);
-          (0, bundle_js_1.default)(this, args2.options);
+          await this.resolve(args.path, args.schema, args.options);
+          (0, bundle_js_1.default)(this, args.options);
           finalize(this);
-          return (0, maybe_js_1.default)(args2.callback, Promise.resolve(this.schema));
+          return (0, maybe_js_1.default)(args.callback, Promise.resolve(this.schema));
         } catch (err) {
-          return (0, maybe_js_1.default)(args2.callback, Promise.reject(err));
+          return (0, maybe_js_1.default)(args.callback, Promise.reject(err));
         }
       }
       static dereference() {
@@ -18128,14 +18128,14 @@ var require_lib3 = __commonJS({
         return instance.dereference.apply(instance, arguments);
       }
       async dereference() {
-        const args2 = (0, normalize_args_js_1.default)(arguments);
+        const args = (0, normalize_args_js_1.default)(arguments);
         try {
-          await this.resolve(args2.path, args2.schema, args2.options);
-          (0, dereference_js_1.default)(this, args2.options);
+          await this.resolve(args.path, args.schema, args.options);
+          (0, dereference_js_1.default)(this, args.options);
           finalize(this);
-          return (0, maybe_js_1.default)(args2.callback, Promise.resolve(this.schema));
+          return (0, maybe_js_1.default)(args.callback, Promise.resolve(this.schema));
         } catch (err) {
-          return (0, maybe_js_1.default)(args2.callback, Promise.reject(err));
+          return (0, maybe_js_1.default)(args.callback, Promise.reject(err));
         }
       }
     };
@@ -18273,13 +18273,13 @@ var require_lib4 = __commonJS({
        * @returns {Promise} - The returned promise resolves with the parsed API object.
        */
       async parse(path, api, options, callback) {
-        let args2 = normalizeArgs(arguments);
-        args2.options = new Options(args2.options);
+        let args = normalizeArgs(arguments);
+        args.options = new Options(args.options);
         try {
-          let schema = await super.parse(args2.path, args2.schema, args2.options);
+          let schema = await super.parse(args.path, args.schema, args.options);
           if (schema.swagger) {
             if (schema.swagger === void 0 || schema.info === void 0 || schema.paths === void 0) {
-              throw ono.syntax(`${args2.path || args2.schema} is not a valid Swagger API definition`);
+              throw ono.syntax(`${args.path || args.schema} is not a valid Swagger API definition`);
             } else if (typeof schema.swagger === "number") {
               throw ono.syntax('Swagger version number must be a string (e.g. "2.0") not a number.');
             } else if (typeof schema.info.version === "number") {
@@ -18289,14 +18289,14 @@ var require_lib4 = __commonJS({
             }
           } else {
             if (schema.openapi === void 0 || schema.info === void 0) {
-              throw ono.syntax(`${args2.path || args2.schema} is not a valid Openapi API definition`);
+              throw ono.syntax(`${args.path || args.schema} is not a valid Openapi API definition`);
             } else if (schema.paths === void 0) {
               if (supported31Versions.indexOf(schema.openapi) !== -1) {
                 if (schema.webhooks === void 0) {
-                  throw ono.syntax(`${args2.path || args2.schema} is not a valid Openapi API definition`);
+                  throw ono.syntax(`${args.path || args.schema} is not a valid Openapi API definition`);
                 }
               } else {
-                throw ono.syntax(`${args2.path || args2.schema} is not a valid Openapi API definition`);
+                throw ono.syntax(`${args.path || args.schema} is not a valid Openapi API definition`);
               }
             } else if (typeof schema.openapi === "number") {
               throw ono.syntax('Openapi version number must be a string (e.g. "3.0.0") not a number.');
@@ -18307,11 +18307,11 @@ var require_lib4 = __commonJS({
                 `Unsupported OpenAPI version: ${schema.openapi}. Swagger Parser only supports versions ${supportedVersions.join(", ")}`
               );
             }
-            util.fixOasRelativeServers(schema, args2.path);
+            util.fixOasRelativeServers(schema, args.path);
           }
-          return maybe(args2.callback, Promise.resolve(schema));
+          return maybe(args.callback, Promise.resolve(schema));
         } catch (err) {
-          return maybe(args2.callback, Promise.reject(err));
+          return maybe(args.callback, Promise.reject(err));
         }
       }
       /**
@@ -18326,29 +18326,29 @@ var require_lib4 = __commonJS({
        */
       async validate(path, api, options, callback) {
         let me = this;
-        let args2 = normalizeArgs(arguments);
-        args2.options = new Options(args2.options);
-        let circular$RefOption = args2.options.dereference.circular;
-        args2.options.validate.schema && (args2.options.dereference.circular = "ignore");
+        let args = normalizeArgs(arguments);
+        args.options = new Options(args.options);
+        let circular$RefOption = args.options.dereference.circular;
+        args.options.validate.schema && (args.options.dereference.circular = "ignore");
         try {
-          await this.dereference(args2.path, args2.schema, args2.options);
-          args2.options.dereference.circular = circular$RefOption;
-          if (args2.options.validate.schema) {
+          await this.dereference(args.path, args.schema, args.options);
+          args.options.dereference.circular = circular$RefOption;
+          if (args.options.validate.schema) {
             validateSchema(me.api);
             if (me.$refs.circular) {
               if (circular$RefOption === true) {
-                dereference(me, args2.options);
+                dereference(me, args.options);
               } else if (circular$RefOption === false) {
                 throw ono.reference("The API contains circular references");
               }
             }
           }
-          if (args2.options.validate.spec) {
+          if (args.options.validate.spec) {
             validateSpec(me.api);
           }
-          return maybe(args2.callback, Promise.resolve(me.schema));
+          return maybe(args.callback, Promise.resolve(me.schema));
         } catch (err) {
-          return maybe(args2.callback, Promise.reject(err));
+          return maybe(args.callback, Promise.reject(err));
         }
       }
     };
@@ -18360,25 +18360,25 @@ var require_lib4 = __commonJS({
       }
     });
     var defaultExport = SwaggerParser2;
-    defaultExport.validate = (...args2) => {
+    defaultExport.validate = (...args) => {
       const defaultInstance = new SwaggerParser2();
-      return defaultInstance.validate(...args2);
+      return defaultInstance.validate(...args);
     };
-    defaultExport.dereference = (...args2) => {
+    defaultExport.dereference = (...args) => {
       const defaultInstance = new SwaggerParser2();
-      return defaultInstance.dereference(...args2);
+      return defaultInstance.dereference(...args);
     };
-    defaultExport.bundle = (...args2) => {
+    defaultExport.bundle = (...args) => {
       const defaultInstance = new SwaggerParser2();
-      return defaultInstance.bundle(...args2);
+      return defaultInstance.bundle(...args);
     };
-    defaultExport.parse = (...args2) => {
+    defaultExport.parse = (...args) => {
       const defaultInstance = new SwaggerParser2();
-      return defaultInstance.parse(...args2);
+      return defaultInstance.parse(...args);
     };
-    defaultExport.resolve = (...args2) => {
+    defaultExport.resolve = (...args) => {
       const defaultInstance = new SwaggerParser2();
-      return defaultInstance.resolve(...args2);
+      return defaultInstance.resolve(...args);
     };
     defaultExport.default = defaultExport;
     defaultExport.SwaggerParser = defaultExport;
@@ -18387,7 +18387,8 @@ var require_lib4 = __commonJS({
 });
 
 // src/cli.ts
-var import_node_path3 = require("node:path");
+var import_node_fs = require("node:fs");
+var import_node_path4 = require("node:path");
 
 // src/generator.ts
 var import_promises2 = require("node:fs/promises");
@@ -18451,8 +18452,8 @@ function validateInputPath(resolvedInput) {
     }
   }
 }
-async function loadConfig(cwd2, configPath) {
-  const resolvedConfigPath = configPath ?? (0, import_node_path.join)(cwd2, "openapi-server.config.json");
+async function loadConfig(cwd, configPath) {
+  const resolvedConfigPath = configPath ?? (0, import_node_path.join)(cwd, "openapi-server.config.json");
   if (configPath !== void 0) {
     validateConfigPath(configPath);
   }
@@ -18462,16 +18463,16 @@ async function loadConfig(cwd2, configPath) {
   } catch {
     throw new Error(`Config file not found: ${resolvedConfigPath}`);
   }
-  let parsed;
+  let parsed2;
   try {
-    parsed = JSON.parse(raw);
+    parsed2 = JSON.parse(raw);
   } catch {
     throw new Error(`Config file is not valid JSON: ${resolvedConfigPath}`);
   }
-  if (typeof parsed !== "object" || parsed === null) {
+  if (typeof parsed2 !== "object" || parsed2 === null) {
     throw new Error("Config must be a JSON object");
   }
-  const config = parsed;
+  const config = parsed2;
   if (typeof config["input_openapi"] !== "string" || !config["input_openapi"]) {
     throw new Error('Config missing required field: "input_openapi" (path to OpenAPI 3.1 spec)');
   }
@@ -18484,8 +18485,8 @@ async function loadConfig(cwd2, configPath) {
   if (config["input_schema"] !== void 0 && (typeof config["input_schema"] !== "string" || !config["input_schema"])) {
     throw new Error('"input_schema" must be a non-empty string path to your Zod schema file');
   }
-  const resolvedInput = (0, import_node_path.resolve)(cwd2, config["input_openapi"]);
-  const resolvedOutput = (0, import_node_path.resolve)(cwd2, config["output"]);
+  const resolvedInput = (0, import_node_path.resolve)(cwd, config["input_openapi"]);
+  const resolvedOutput = (0, import_node_path.resolve)(cwd, config["output"]);
   validateInputPath(resolvedInput);
   validateOutputPath(resolvedOutput);
   return {
@@ -18498,8 +18499,225 @@ async function loadConfig(cwd2, configPath) {
 
 // ../openapi-gen/dist/parser.js
 var import_swagger_parser = __toESM(require_lib4(), 1);
+
+// ../openapi-gen/dist/utils/schema-depth.js
+var MAX_SCHEMA_DEPTH = 100;
+function isRef(schema) {
+  return "$ref" in schema;
+}
+function inlineChildren(s) {
+  const children = [];
+  for (const key of ["allOf", "anyOf", "oneOf"]) {
+    const list = s[key];
+    if (list !== void 0)
+      children.push(...list);
+  }
+  if (s.properties !== void 0) {
+    children.push(...Object.values(s.properties));
+  }
+  const items = s.items;
+  if (items !== void 0)
+    children.push(items);
+  if (s.additionalProperties !== void 0 && typeof s.additionalProperties === "object") {
+    children.push(s.additionalProperties);
+  }
+  return children;
+}
+function assertBoundedDepth(root) {
+  const stack = [
+    { node: root, depth: 0 }
+  ];
+  while (stack.length > 0) {
+    const { node, depth } = stack.pop();
+    if (depth > MAX_SCHEMA_DEPTH) {
+      throw new Error(`Schema nesting exceeds the maximum supported depth (${MAX_SCHEMA_DEPTH}). This usually indicates a malformed or hostile OpenAPI spec.`);
+    }
+    if (isRef(node))
+      continue;
+    for (const child of inlineChildren(node)) {
+      stack.push({ node: child, depth: depth + 1 });
+    }
+  }
+}
+
+// ../openapi-gen/dist/utils/normalize-nullable.js
+function isRef2(schema) {
+  return "$ref" in schema;
+}
+var PRIMITIVE_TYPES = /* @__PURE__ */ new Set(["string", "number", "integer", "boolean"]);
+function wrapInNullableAnyOf(s) {
+  const innerCopy = {};
+  for (const key of Object.keys(s)) {
+    innerCopy[key] = s[key];
+  }
+  for (const key of Object.keys(s)) {
+    delete s[key];
+  }
+  s["anyOf"] = [innerCopy, { type: "null" }];
+}
+function hasStructuralKeywords(s) {
+  return s["properties"] !== void 0 || s["items"] !== void 0 || s["additionalProperties"] !== void 0 && typeof s["additionalProperties"] === "object" || Array.isArray(s["allOf"]) || Array.isArray(s["anyOf"]) || Array.isArray(s["oneOf"]);
+}
+function applyNullableEnum(s) {
+  if (!s["enum"].includes(null)) {
+    s["enum"] = [...s["enum"], null];
+  }
+  delete s["type"];
+}
+function applyNullableTypeArray(s) {
+  if (!s["type"].includes("null")) {
+    s["type"] = [...s["type"], "null"];
+  }
+}
+function applyNullablePrimitiveType(s) {
+  s["type"] = [s["type"], "null"];
+}
+function normalizeNode(schema) {
+  const s = schema;
+  const isNullable = s["nullable"] === true || s["x-nullable"] === true;
+  if (!isNullable)
+    return;
+  delete s["nullable"];
+  delete s["x-nullable"];
+  if (Array.isArray(s["enum"])) {
+    applyNullableEnum(s);
+    return;
+  }
+  if (Array.isArray(s["type"])) {
+    applyNullableTypeArray(s);
+    return;
+  }
+  if (typeof s["type"] === "string" && PRIMITIVE_TYPES.has(s["type"]) && !hasStructuralKeywords(s)) {
+    applyNullablePrimitiveType(s);
+    return;
+  }
+  wrapInNullableAnyOf(s);
+}
+function walkSchema(schema, visited) {
+  if (visited.has(schema))
+    return;
+  visited.add(schema);
+  if (isRef2(schema))
+    return;
+  normalizeNode(schema);
+  walkSchemaChildren(schema, visited);
+}
+function walkSchemaChildren(s, visited) {
+  walkCompositionArrays(s, visited);
+  walkPropertySchemas(s, visited);
+  walkArrayItems(s, visited);
+  walkAdditionalProperties(s, visited);
+}
+function walkCompositionArrays(s, visited) {
+  for (const key of ["allOf", "anyOf", "oneOf"]) {
+    const list = s[key];
+    if (list !== void 0) {
+      for (const item of list) {
+        walkSchema(item, visited);
+      }
+    }
+  }
+}
+function walkPropertySchemas(s, visited) {
+  if (s.properties === void 0)
+    return;
+  for (const propSchema of Object.values(s.properties)) {
+    walkSchema(propSchema, visited);
+  }
+}
+function walkArrayItems(s, visited) {
+  const items = s.items;
+  if (items !== void 0) {
+    walkSchema(items, visited);
+  }
+}
+function walkAdditionalProperties(s, visited) {
+  if (s.additionalProperties !== void 0 && typeof s.additionalProperties === "object") {
+    walkSchema(s.additionalProperties, visited);
+  }
+}
+function walkComponentSchemas(spec, visited) {
+  const schemas = spec.components?.schemas;
+  if (schemas === void 0)
+    return;
+  for (const schema of Object.values(schemas)) {
+    walkSchema(schema, visited);
+  }
+}
+function walkParameterSchema(param, visited) {
+  if ("schema" in param && param.schema !== void 0) {
+    walkSchema(param.schema, visited);
+  }
+}
+function walkRequestBody(requestBody, visited) {
+  if (isRef2(requestBody))
+    return;
+  const body = requestBody;
+  if (body.content === void 0)
+    return;
+  for (const mediaType of Object.values(body.content)) {
+    if (mediaType.schema !== void 0) {
+      walkSchema(mediaType.schema, visited);
+    }
+  }
+}
+function walkResponses(responses, visited) {
+  for (const response of Object.values(responses)) {
+    if (isRef2(response))
+      continue;
+    const r = response;
+    if (r.content === void 0)
+      continue;
+    for (const mediaType of Object.values(r.content)) {
+      if (mediaType.schema !== void 0) {
+        walkSchema(mediaType.schema, visited);
+      }
+    }
+  }
+}
+function walkOperation(operation, visited) {
+  if (operation.parameters !== void 0) {
+    for (const param of operation.parameters) {
+      walkParameterSchema(param, visited);
+    }
+  }
+  if (operation.requestBody !== void 0) {
+    walkRequestBody(operation.requestBody, visited);
+  }
+  if (operation.responses !== void 0) {
+    walkResponses(operation.responses, visited);
+  }
+}
+var HTTP_METHODS = ["get", "put", "post", "delete", "options", "head", "patch", "trace"];
+function walkPathSchemas(spec, visited) {
+  const paths = spec.paths;
+  if (paths === void 0)
+    return;
+  for (const pathItem of Object.values(paths)) {
+    if (pathItem == null || typeof pathItem !== "object")
+      continue;
+    const pi = pathItem;
+    for (const method of HTTP_METHODS) {
+      const op = pi[method];
+      if (op == null || typeof op !== "object")
+        continue;
+      walkOperation(op, visited);
+    }
+  }
+}
+function normalizeNullable(spec) {
+  const visited = /* @__PURE__ */ new Set();
+  walkComponentSchemas(spec, visited);
+  walkPathSchemas(spec, visited);
+}
+
+// ../openapi-gen/dist/parser.js
 async function parseSpec(inputPath) {
   const api = await import_swagger_parser.default.bundle(inputPath);
+  for (const schema of Object.values(api.components?.schemas ?? {})) {
+    assertBoundedDepth(schema);
+  }
+  normalizeNullable(api);
   return api;
 }
 
@@ -18517,7 +18735,7 @@ function toTypeName(name) {
 
 // src/plugins/service.ts
 var SUPPORTED_METHODS = ["get", "post", "put", "patch", "delete"];
-function isRef(obj) {
+function isRef3(obj) {
   return typeof obj === "object" && obj !== null && "$ref" in obj;
 }
 function refToName(ref) {
@@ -18530,13 +18748,13 @@ function extractPathParamsFromPath(path) {
   return matches.map((m) => sanitizeOperationId(m.slice(1, -1)));
 }
 function resolveParam(p, spec) {
-  if (!isRef(p)) return p;
+  if (!isRef3(p)) return p;
   const refStr = p.$ref;
   const name = refToName(refStr);
   const components = spec.components;
   if (components?.parameters === void 0) return void 0;
   const resolved = components.parameters[name];
-  if (resolved === void 0 || isRef(resolved)) return void 0;
+  if (resolved === void 0 || isRef3(resolved)) return void 0;
   return resolved;
 }
 function deriveServiceName(spec) {
@@ -18603,7 +18821,7 @@ function getQueryParams(operation, spec) {
     if (resolved === void 0 || resolved.in !== "query") continue;
     const schema = resolved.schema;
     let tsType = "string";
-    if (schema !== void 0 && !isRef(schema)) {
+    if (schema !== void 0 && !isRef3(schema)) {
       const s = schema;
       if (s.type === "number" || s.type === "integer") tsType = "number";
       else if (s.type === "boolean") tsType = "boolean";
@@ -18619,14 +18837,14 @@ function getQueryParams(operation, spec) {
 function getBodyInfo(operation) {
   const requestBody = operation.requestBody;
   if (requestBody === void 0) return void 0;
-  if (isRef(requestBody)) return { typeName: void 0 };
+  if (isRef3(requestBody)) return { typeName: void 0 };
   const rb = requestBody;
   const content = rb.content;
   if (content === void 0) return { typeName: void 0 };
   const jsonContent = content["application/json"];
   if (jsonContent === void 0 || jsonContent.schema === void 0) return { typeName: void 0 };
   const schema = jsonContent.schema;
-  if (isRef(schema)) {
+  if (isRef3(schema)) {
     return { typeName: refToName(schema.$ref) };
   }
   return { typeName: void 0 };
@@ -18637,14 +18855,14 @@ function getReturnInfo(operation) {
   for (const code of ["200", "201"]) {
     const response = responses[code];
     if (response === void 0) continue;
-    if (isRef(response)) continue;
+    if (isRef3(response)) continue;
     const resp = response;
     const content = resp.content;
     if (content === void 0) continue;
     const jsonContent = content["application/json"];
     if (jsonContent === void 0 || jsonContent.schema === void 0) continue;
     const schema = jsonContent.schema;
-    if (isRef(schema)) {
+    if (isRef3(schema)) {
       return {
         typeName: refToName(schema.$ref),
         isArray: false,
@@ -18654,7 +18872,7 @@ function getReturnInfo(operation) {
     const s = schema;
     if (s.type === "array") {
       const items = s.items;
-      if (items !== void 0 && isRef(items)) {
+      if (items !== void 0 && isRef3(items)) {
         return {
           typeName: refToName(items.$ref),
           isArray: true,
@@ -18704,22 +18922,22 @@ function collectOperations(spec) {
   return operations;
 }
 function buildMethodSignature(op) {
-  const args2 = [];
+  const args = [];
   for (const p of op.pathParams) {
-    args2.push(`${p}: string`);
+    args.push(`${p}: string`);
   }
   if (op.bodyInfo !== void 0) {
     const typeName = op.bodyInfo.typeName ?? "unknown";
-    args2.push(`body: ${typeName}`);
+    args.push(`body: ${typeName}`);
   }
   if (op.queryParams.length > 0) {
     const allOptional = op.queryParams.every((q) => !q.required);
     const fields = op.queryParams.map((q) => `${q.name}${q.required ? "" : "?"}: ${q.tsType}`).join("; ");
     const paramsToken = allOptional ? "params?" : "params";
-    args2.push(`${paramsToken}: { ${fields} }`);
+    args.push(`${paramsToken}: { ${fields} }`);
   }
   const returnType = buildReturnType(op.returnInfo);
-  const argStr = args2.join(", ");
+  const argStr = args.join(", ");
   return `${op.methodName}(${argStr}): ${returnType}`;
 }
 function generateService(spec) {
@@ -18757,7 +18975,7 @@ function generateService(spec) {
 
 // src/plugins/router.ts
 var SUPPORTED_METHODS2 = ["get", "post", "put", "patch", "delete"];
-function isRef2(obj) {
+function isRef4(obj) {
   return typeof obj === "object" && obj !== null && "$ref" in obj;
 }
 function refToName2(ref) {
@@ -18773,13 +18991,13 @@ function toHonoPath(openapiPath) {
   return openapiPath.replace(/\{([^}]+)\}/g, ":$1");
 }
 function resolveParam2(p, spec) {
-  if (!isRef2(p)) return p;
+  if (!isRef4(p)) return p;
   const refStr = p.$ref;
   const name = refToName2(refStr);
   const components = spec.components;
   if (components?.parameters === void 0) return void 0;
   const resolved = components.parameters[name];
-  if (resolved === void 0 || isRef2(resolved)) return void 0;
+  if (resolved === void 0 || isRef4(resolved)) return void 0;
   return resolved;
 }
 function deriveServiceName2(spec) {
@@ -18838,7 +19056,7 @@ function normalizeParamName2(name) {
   return /^[^a-zA-Z_$]/.test(camel) ? `_${camel}` : camel;
 }
 function schemaToTsType(schema) {
-  if (schema === void 0 || isRef2(schema)) return "string";
+  if (schema === void 0 || isRef4(schema)) return "string";
   const s = schema;
   if (s.type === "number" || s.type === "integer") return "number";
   if (s.type === "boolean") return "boolean";
@@ -18860,23 +19078,166 @@ function getQueryParams2(operation, spec) {
   }
   return result;
 }
+function formatToZodModifier(format) {
+  switch (format) {
+    case "uuid":
+      return ".uuid()";
+    case "email":
+      return ".email()";
+    case "uri":
+    case "url":
+      return ".url()";
+    case "date-time":
+      return ".datetime()";
+    default:
+      return "";
+  }
+}
+function pathParamZodExpr(schema) {
+  if (schema === void 0 || isRef4(schema)) return void 0;
+  const s = schema;
+  if (s.type !== "string") return void 0;
+  const format = s.format;
+  if (format === void 0) return void 0;
+  const modifier = formatToZodModifier(format);
+  if (modifier === "") return void 0;
+  return `z.string()${modifier}`;
+}
+function paramZodExpr(tsType, required, schema) {
+  let base;
+  if (tsType === "number") {
+    base = "z.number()";
+  } else if (tsType === "boolean") {
+    base = "z.boolean()";
+  } else {
+    if (schema !== void 0 && !isRef4(schema)) {
+      const s = schema;
+      const format = s.format;
+      const modifier = format !== void 0 ? formatToZodModifier(format) : "";
+      base = `z.string()${modifier}`;
+    } else {
+      base = "z.string()";
+    }
+  }
+  return required ? base : `${base}.optional()`;
+}
+function getPathParamValidations(operation, spec, rawPathParamNames) {
+  const parameters = operation.parameters;
+  if (parameters === void 0) return [];
+  const zodByName = /* @__PURE__ */ new Map();
+  for (const p of parameters) {
+    const resolved = resolveParam2(p, spec);
+    if (resolved === void 0 || resolved.in !== "path") continue;
+    const schema = resolved.schema;
+    const zodExpr = pathParamZodExpr(schema);
+    if (zodExpr !== void 0) zodByName.set(resolved.name, zodExpr);
+  }
+  const result = [];
+  for (const rawName of rawPathParamNames) {
+    const zodExpr = zodByName.get(rawName);
+    if (zodExpr !== void 0) result.push({ rawName, zodExpr });
+  }
+  return result;
+}
+function getHeaderParams(operation, spec) {
+  const parameters = operation.parameters;
+  if (parameters === void 0) return [];
+  const result = [];
+  for (const p of parameters) {
+    const resolved = resolveParam2(p, spec);
+    if (resolved === void 0 || resolved.in !== "header") continue;
+    result.push({
+      rawName: resolved.name,
+      required: resolved.required === true
+    });
+  }
+  return result;
+}
+function queryParamsNeedValidation(queryParams) {
+  return queryParams.some((q) => q.required || q.tsType !== "string");
+}
+function emitQueryValidation(lines, queryParams, indent) {
+  const inner = `${indent}  `;
+  const fieldIndent = `${indent}    `;
+  const fields = queryParams.map((q) => {
+    const expr = paramZodExpr(q.tsType, q.required);
+    return `${fieldIndent}${q.name}: ${expr}`;
+  }).join(",\n");
+  lines.push(`${inner}// Validate query parameters: returns 422 with Zod issues on failure`);
+  lines.push(`${inner}const _qv = z.object({`);
+  lines.push(fields);
+  lines.push(`${inner}}).safeParse(params)`);
+}
+function emitPathValidation(lines, validations, indent, framework) {
+  const inner = `${indent}  `;
+  const fieldIndent = `${indent}    `;
+  const schemaFields = validations.map((v) => {
+    const key = /[^a-zA-Z0-9_$]/.test(v.rawName) ? JSON.stringify(v.rawName) : v.rawName;
+    return `${fieldIndent}${key}: ${v.zodExpr}`;
+  }).join(",\n");
+  const rawFields = validations.map((v) => {
+    const key = /[^a-zA-Z0-9_$]/.test(v.rawName) ? JSON.stringify(v.rawName) : v.rawName;
+    let access;
+    if (framework === "hono") {
+      access = `c.req.param(${JSON.stringify(v.rawName)})`;
+    } else if (framework === "express") {
+      access = `req.params[${JSON.stringify(v.rawName)}]`;
+    } else {
+      access = /[^a-zA-Z0-9_$]/.test(v.rawName) ? `req.params[${JSON.stringify(v.rawName)}]` : `req.params.${v.rawName}`;
+    }
+    return `${fieldIndent}${key}: ${access}`;
+  }).join(",\n");
+  lines.push(`${inner}// Validate path parameters: returns 422 with Zod issues on failure`);
+  lines.push(`${inner}const _pv = z.object({`);
+  lines.push(schemaFields);
+  lines.push(`${inner}}).safeParse({`);
+  lines.push(rawFields);
+  lines.push(`${inner}})`);
+}
+function emitHeaderValidation(lines, headerParams, indent, framework) {
+  const inner = `${indent}  `;
+  const fieldIndent = `${indent}    `;
+  const schemaFields = headerParams.map((h) => {
+    const key = JSON.stringify(h.rawName);
+    const expr = h.required ? "z.string()" : "z.string().optional()";
+    return `${fieldIndent}${key}: ${expr}`;
+  }).join(",\n");
+  const rawFields = headerParams.map((h) => {
+    const key = JSON.stringify(h.rawName);
+    let access;
+    if (framework === "hono") {
+      access = `c.req.header(${key})`;
+    } else if (framework === "express") {
+      access = `req.headers[${key}] as string | undefined`;
+    } else {
+      access = `req.headers[${key}]`;
+    }
+    return `${fieldIndent}${key}: ${access}`;
+  }).join(",\n");
+  lines.push(`${inner}// Validate request headers: returns 422 with Zod issues on failure`);
+  lines.push(`${inner}const _hv = z.object({`);
+  lines.push(schemaFields);
+  lines.push(`${inner}}).safeParse({`);
+  lines.push(rawFields);
+  lines.push(`${inner}})`);
+}
 function getBodyInfo2(operation) {
   const requestBody = operation.requestBody;
   if (requestBody === void 0) return void 0;
-  if (isRef2(requestBody)) return { typeName: void 0 };
+  if (isRef4(requestBody)) return { typeName: void 0 };
   const rb = requestBody;
   const content = rb.content;
   if (content === void 0) return { typeName: void 0 };
   const jsonContent = content["application/json"];
   if (jsonContent === void 0 || jsonContent.schema === void 0) return { typeName: void 0 };
   const schema = jsonContent.schema;
-  if (isRef2(schema)) {
+  if (isRef4(schema)) {
     return { typeName: refToName2(schema.$ref) };
   }
   return { typeName: void 0 };
 }
 function response200IsVoid(resp) {
-  if (isRef2(resp)) return false;
+  if (isRef4(resp)) return false;
   const r = resp;
   const content = r.content;
   return content === void 0 || Object.keys(content).length === 0;
@@ -18904,7 +19265,9 @@ function collectOperations2(spec) {
       if (operation === void 0) continue;
       const methodName = deriveMethodName2(operation.operationId, method, path);
       const pathParams = extractPathParamsFromPath2(path);
+      const pathParamValidations = getPathParamValidations(operation, spec, pathParams);
       const queryParams = getQueryParams2(operation, spec);
+      const headerParams = getHeaderParams(operation, spec);
       const bodyInfo = getBodyInfo2(operation);
       const responseStatus = getResponseStatus(operation, method);
       operations.push({
@@ -18913,7 +19276,9 @@ function collectOperations2(spec) {
         path,
         honoPath: toHonoPath(path),
         pathParams,
+        pathParamValidations,
         queryParams,
+        headerParams,
         bodyInfo,
         responseStatus
       });
@@ -18921,9 +19286,40 @@ function collectOperations2(spec) {
   }
   return operations;
 }
+function collectSortedBodyTypes(operations) {
+  const bodyTypes = /* @__PURE__ */ new Set();
+  for (const op of operations) {
+    if (op.bodyInfo?.typeName !== void 0) bodyTypes.add(op.bodyInfo.typeName);
+  }
+  return Array.from(bodyTypes).sort();
+}
+function collectUsedSchemaNames(operations, schemaNames) {
+  const used = /* @__PURE__ */ new Set();
+  for (const op of operations) {
+    const typeName = op.bodyInfo?.typeName;
+    if (typeName === void 0) continue;
+    const schemaName = `${typeName}Schema`;
+    if (schemaNames.has(schemaName)) used.add(schemaName);
+  }
+  return used;
+}
+function collectGeneratorSetup(operations, options) {
+  const sortedBodyTypes = collectSortedBodyTypes(operations);
+  const usedSchemaNames = options?.schemaNames !== void 0 ? collectUsedSchemaNames(operations, options.schemaNames) : /* @__PURE__ */ new Set();
+  const needsZod = usedSchemaNames.size > 0 && options?.schemaImportPath !== void 0 || operationsNeedZodForParams(operations);
+  return { sortedBodyTypes, usedSchemaNames, needsZod };
+}
 function buildRouteHandler(op, indent, schemaNames) {
   const lines = [];
-  lines.push(`${indent}app.${op.httpMethod}('${op.honoPath}', async (c) => {`);
+  lines.push(`${indent}app.${op.httpMethod}(${JSON.stringify(op.honoPath)}, async (c) => {`);
+  if (op.pathParamValidations.length > 0) {
+    emitPathValidation(lines, op.pathParamValidations, indent, "hono");
+    lines.push(`${indent}  if (!_pv.success) {`);
+    lines.push(
+      `${indent}    return c.json({ error: 'Invalid path parameters', issues: _pv.error.issues }, 422)`
+    );
+    lines.push(`${indent}  }`);
+  }
   if (op.queryParams.length > 0) {
     const fields = op.queryParams.map((q) => {
       if (q.tsType === "number") {
@@ -18934,6 +19330,22 @@ function buildRouteHandler(op, indent, schemaNames) {
     lines.push(`${indent}  const params = {`);
     lines.push(fields);
     lines.push(`${indent}  }`);
+    if (queryParamsNeedValidation(op.queryParams)) {
+      emitQueryValidation(lines, op.queryParams, indent);
+      lines.push(`${indent}  if (!_qv.success) {`);
+      lines.push(
+        `${indent}    return c.json({ error: 'Invalid query parameters', issues: _qv.error.issues }, 422)`
+      );
+      lines.push(`${indent}  }`);
+    }
+  }
+  if (op.headerParams.length > 0) {
+    emitHeaderValidation(lines, op.headerParams, indent, "hono");
+    lines.push(`${indent}  if (!_hv.success) {`);
+    lines.push(
+      `${indent}    return c.json({ error: 'Invalid request headers', issues: _hv.error.issues }, 422)`
+    );
+    lines.push(`${indent}  }`);
   }
   let bodyVarName = "body";
   if (op.bodyInfo !== void 0) {
@@ -18954,7 +19366,7 @@ function buildRouteHandler(op, indent, schemaNames) {
   }
   const serviceArgs = [];
   for (const p of op.pathParams) {
-    serviceArgs.push(`c.req.param('${p}')`);
+    serviceArgs.push(`c.req.param(${JSON.stringify(p)})`);
   }
   if (op.bodyInfo !== void 0) {
     serviceArgs.push(bodyVarName);
@@ -18977,8 +19389,16 @@ function buildRouteHandler(op, indent, schemaNames) {
 function buildExpressRouteHandler(op, indent, schemaNames) {
   const lines = [];
   lines.push(
-    `${indent}router.${op.httpMethod}('${op.honoPath}', async (req: Request, res: Response) => {`
+    `${indent}router.${op.httpMethod}(${JSON.stringify(op.honoPath)}, async (req: Request, res: Response) => {`
   );
+  if (op.pathParamValidations.length > 0) {
+    emitPathValidation(lines, op.pathParamValidations, indent, "express");
+    lines.push(`${indent}  if (!_pv.success) {`);
+    lines.push(
+      `${indent}    return void res.status(422).json({ error: 'Invalid path parameters', issues: _pv.error.issues })`
+    );
+    lines.push(`${indent}  }`);
+  }
   if (op.queryParams.length > 0) {
     const fields = op.queryParams.map((q) => {
       if (q.tsType === "number") {
@@ -18992,6 +19412,22 @@ function buildExpressRouteHandler(op, indent, schemaNames) {
     lines.push(`${indent}  const params = {`);
     lines.push(fields);
     lines.push(`${indent}  }`);
+    if (queryParamsNeedValidation(op.queryParams)) {
+      emitQueryValidation(lines, op.queryParams, indent);
+      lines.push(`${indent}  if (!_qv.success) {`);
+      lines.push(
+        `${indent}    return void res.status(422).json({ error: 'Invalid query parameters', issues: _qv.error.issues })`
+      );
+      lines.push(`${indent}  }`);
+    }
+  }
+  if (op.headerParams.length > 0) {
+    emitHeaderValidation(lines, op.headerParams, indent, "express");
+    lines.push(`${indent}  if (!_hv.success) {`);
+    lines.push(
+      `${indent}    return void res.status(422).json({ error: 'Invalid request headers', issues: _hv.error.issues })`
+    );
+    lines.push(`${indent}  }`);
   }
   let bodyVarName = "body";
   if (op.bodyInfo !== void 0) {
@@ -19034,61 +19470,6 @@ function buildExpressRouteHandler(op, indent, schemaNames) {
   lines.push(`${indent}})`);
   return lines.join("\n");
 }
-function generateExpressRouter(spec, options) {
-  const serviceName = deriveServiceName2(spec);
-  const operations = collectOperations2(spec);
-  const bodyTypes = /* @__PURE__ */ new Set();
-  for (const op of operations) {
-    if (op.bodyInfo?.typeName !== void 0) {
-      bodyTypes.add(op.bodyInfo.typeName);
-    }
-  }
-  const sortedBodyTypes = Array.from(bodyTypes).sort();
-  const usedSchemaNames = /* @__PURE__ */ new Set();
-  if (options?.schemaNames !== void 0) {
-    for (const op of operations) {
-      const typeName = op.bodyInfo?.typeName;
-      if (typeName !== void 0) {
-        const schemaName = `${typeName}Schema`;
-        if (options.schemaNames.has(schemaName)) {
-          usedSchemaNames.add(schemaName);
-        }
-      }
-    }
-  }
-  const lines = [];
-  lines.push("// This file is auto-generated. Do not edit manually.");
-  lines.push(
-    "// Express: apply express.json() middleware before mounting this router so req.body is populated."
-  );
-  lines.push("");
-  lines.push("import { Router } from 'express'");
-  lines.push("import type { Request, Response } from 'express'");
-  if (sortedBodyTypes.length > 0) {
-    lines.push(`import type { ${sortedBodyTypes.join(", ")} } from './models.js'`);
-  }
-  lines.push(`import type { ${serviceName} } from './service.js'`);
-  if (usedSchemaNames.size > 0 && options?.schemaImportPath !== void 0) {
-    lines.push(`import { z } from 'zod'`);
-    const sortedUsedSchemas = Array.from(usedSchemaNames).sort();
-    lines.push(`import { ${sortedUsedSchemas.join(", ")} } from '${options.schemaImportPath}'`);
-  }
-  lines.push("");
-  lines.push(`export function createRouter(service: ${serviceName}): Router {`);
-  lines.push("  const router = Router()");
-  lines.push("");
-  for (const op of operations) {
-    lines.push(buildExpressRouteHandler(op, "  ", options?.schemaNames));
-    lines.push("");
-  }
-  lines.push("  return router");
-  lines.push("}");
-  lines.push("");
-  return {
-    filename: "router.ts",
-    content: lines.join("\n")
-  };
-}
 function buildFastifyRouteHandler(op, indent, schemaNames) {
   const lines = [];
   const genericParts = [];
@@ -19110,12 +19491,41 @@ function buildFastifyRouteHandler(op, indent, schemaNames) {
     genericParts.push(`Params: { ${paramFields} }`);
   }
   const generic = genericParts.length > 0 ? `<{ ${genericParts.join("; ")} }>` : "";
-  lines.push(`${indent}app.${op.httpMethod}${generic}('${op.honoPath}', async (req, reply) => {`);
+  lines.push(
+    `${indent}app.${op.httpMethod}${generic}(${JSON.stringify(op.honoPath)}, async (req, reply) => {`
+  );
+  if (op.pathParamValidations.length > 0) {
+    emitPathValidation(lines, op.pathParamValidations, indent, "fastify");
+    lines.push(`${indent}  if (!_pv.success) {`);
+    lines.push(`${indent}    return reply.status(422).send({`);
+    lines.push(`${indent}      error: 'Invalid path parameters',`);
+    lines.push(`${indent}      issues: _pv.error.issues,`);
+    lines.push(`${indent}    })`);
+    lines.push(`${indent}  }`);
+  }
   if (op.queryParams.length > 0) {
     const fields = op.queryParams.map((q) => `    ${q.name}: req.query.${q.name}`).join(",\n");
     lines.push(`${indent}  const params = {`);
     lines.push(fields);
     lines.push(`${indent}  }`);
+    if (queryParamsNeedValidation(op.queryParams)) {
+      emitQueryValidation(lines, op.queryParams, indent);
+      lines.push(`${indent}  if (!_qv.success) {`);
+      lines.push(`${indent}    return reply.status(422).send({`);
+      lines.push(`${indent}      error: 'Invalid query parameters',`);
+      lines.push(`${indent}      issues: _qv.error.issues,`);
+      lines.push(`${indent}    })`);
+      lines.push(`${indent}  }`);
+    }
+  }
+  if (op.headerParams.length > 0) {
+    emitHeaderValidation(lines, op.headerParams, indent, "fastify");
+    lines.push(`${indent}  if (!_hv.success) {`);
+    lines.push(`${indent}    return reply.status(422).send({`);
+    lines.push(`${indent}      error: 'Invalid request headers',`);
+    lines.push(`${indent}      issues: _hv.error.issues,`);
+    lines.push(`${indent}    })`);
+    lines.push(`${indent}  }`);
   }
   let bodyVarName = "req.body";
   if (op.bodyInfo !== void 0) {
@@ -19155,28 +19565,57 @@ function buildFastifyRouteHandler(op, indent, schemaNames) {
   lines.push(`${indent}})`);
   return lines.join("\n");
 }
-function generateFastifyRouter(spec, options) {
+function operationsNeedZodForParams(operations) {
+  for (const op of operations) {
+    if (op.pathParamValidations.length > 0) return true;
+    if (queryParamsNeedValidation(op.queryParams)) return true;
+    if (op.headerParams.length > 0) return true;
+  }
+  return false;
+}
+function generateExpressRouter(spec, options) {
   const serviceName = deriveServiceName2(spec);
   const operations = collectOperations2(spec);
-  const bodyTypes = /* @__PURE__ */ new Set();
-  for (const op of operations) {
-    if (op.bodyInfo?.typeName !== void 0) {
-      bodyTypes.add(op.bodyInfo.typeName);
-    }
+  const { sortedBodyTypes, usedSchemaNames, needsZod } = collectGeneratorSetup(operations, options);
+  const lines = [];
+  lines.push("// This file is auto-generated. Do not edit manually.");
+  lines.push(
+    "// Express: apply express.json() middleware before mounting this router so req.body is populated."
+  );
+  lines.push("");
+  lines.push("import { Router } from 'express'");
+  lines.push("import type { Request, Response } from 'express'");
+  if (sortedBodyTypes.length > 0) {
+    lines.push(`import type { ${sortedBodyTypes.join(", ")} } from './models.js'`);
   }
-  const sortedBodyTypes = Array.from(bodyTypes).sort();
-  const usedSchemaNames = /* @__PURE__ */ new Set();
-  if (options?.schemaNames !== void 0) {
-    for (const op of operations) {
-      const typeName = op.bodyInfo?.typeName;
-      if (typeName !== void 0) {
-        const schemaName = `${typeName}Schema`;
-        if (options.schemaNames.has(schemaName)) {
-          usedSchemaNames.add(schemaName);
-        }
-      }
-    }
+  lines.push(`import type { ${serviceName} } from './service.js'`);
+  if (needsZod) {
+    lines.push(`import { z } from 'zod'`);
+  }
+  if (usedSchemaNames.size > 0 && options?.schemaImportPath !== void 0) {
+    const sortedUsedSchemas = Array.from(usedSchemaNames).sort();
+    lines.push(`import { ${sortedUsedSchemas.join(", ")} } from '${options.schemaImportPath}'`);
   }
+  lines.push("");
+  lines.push(`export function createRouter(service: ${serviceName}): Router {`);
+  lines.push("  const router = Router()");
+  lines.push("");
+  for (const op of operations) {
+    lines.push(buildExpressRouteHandler(op, "  ", options?.schemaNames));
+    lines.push("");
+  }
+  lines.push("  return router");
+  lines.push("}");
+  lines.push("");
+  return {
+    filename: "router.ts",
+    content: lines.join("\n")
+  };
+}
+function generateFastifyRouter(spec, options) {
+  const serviceName = deriveServiceName2(spec);
+  const operations = collectOperations2(spec);
+  const { sortedBodyTypes, usedSchemaNames, needsZod } = collectGeneratorSetup(operations, options);
   const lines = [];
   lines.push("// This file is auto-generated. Do not edit manually.");
   lines.push("");
@@ -19185,8 +19624,10 @@ function generateFastifyRouter(spec, options) {
     lines.push(`import type { ${sortedBodyTypes.join(", ")} } from './models.js'`);
   }
   lines.push(`import type { ${serviceName} } from './service.js'`);
-  if (usedSchemaNames.size > 0 && options?.schemaImportPath !== void 0) {
+  if (needsZod) {
     lines.push(`import { z } from 'zod'`);
+  }
+  if (usedSchemaNames.size > 0 && options?.schemaImportPath !== void 0) {
     const sortedUsedSchemas = Array.from(usedSchemaNames).sort();
     lines.push(`import { ${sortedUsedSchemas.join(", ")} } from '${options.schemaImportPath}'`);
   }
@@ -19206,25 +19647,7 @@ function generateFastifyRouter(spec, options) {
 function generateRouter(spec, options) {
   const serviceName = deriveServiceName2(spec);
   const operations = collectOperations2(spec);
-  const bodyTypes = /* @__PURE__ */ new Set();
-  for (const op of operations) {
-    if (op.bodyInfo?.typeName !== void 0) {
-      bodyTypes.add(op.bodyInfo.typeName);
-    }
-  }
-  const sortedBodyTypes = Array.from(bodyTypes).sort();
-  const usedSchemaNames = /* @__PURE__ */ new Set();
-  if (options?.schemaNames !== void 0) {
-    for (const op of operations) {
-      const typeName = op.bodyInfo?.typeName;
-      if (typeName !== void 0) {
-        const schemaName = `${typeName}Schema`;
-        if (options.schemaNames.has(schemaName)) {
-          usedSchemaNames.add(schemaName);
-        }
-      }
-    }
-  }
+  const { sortedBodyTypes, usedSchemaNames, needsZod } = collectGeneratorSetup(operations, options);
   const lines = [];
   lines.push("// This file is auto-generated. Do not edit manually.");
   lines.push("");
@@ -19233,8 +19656,10 @@ function generateRouter(spec, options) {
     lines.push(`import type { ${sortedBodyTypes.join(", ")} } from './models.js'`);
   }
   lines.push(`import type { ${serviceName} } from './service.js'`);
-  if (usedSchemaNames.size > 0 && options?.schemaImportPath !== void 0) {
+  if (needsZod) {
     lines.push(`import { z } from 'zod'`);
+  }
+  if (usedSchemaNames.size > 0 && options?.schemaImportPath !== void 0) {
     const sortedUsedSchemas = Array.from(usedSchemaNames).sort();
     lines.push(`import { ${sortedUsedSchemas.join(", ")} } from '${options.schemaImportPath}'`);
   }
@@ -19261,11 +19686,11 @@ async function formatTs(content, filePath) {
   const config = await resolveConfig(filePath);
   return format(content, { ...config, parser: "typescript" });
 }
-async function generate2(cwd2, configPath) {
+async function generate2(cwd, configPath) {
   console.log("Loading config...");
-  const config = await loadConfig(cwd2, configPath);
-  const inputPath = (0, import_node_path2.resolve)(cwd2, config.input_openapi);
-  const outputDir = (0, import_node_path2.resolve)(cwd2, config.output);
+  const config = await loadConfig(cwd, configPath);
+  const inputPath = (0, import_node_path2.resolve)(cwd, config.input_openapi);
+  const outputDir = (0, import_node_path2.resolve)(cwd, config.output);
   const framework = config.framework ?? "none";
   console.log(`Parsing spec: ${inputPath}`);
   const spec = await parseSpec(inputPath);
@@ -19286,7 +19711,7 @@ async function generate2(cwd2, configPath) {
     console.log(`  \u2713 ${file.filename}`);
   }
   if ((framework === "hono" || framework === "express" || framework === "fastify") && config.input_schema !== void 0) {
-    const schemaPath = (0, import_node_path2.resolve)(cwd2, config.input_schema);
+    const schemaPath = (0, import_node_path2.resolve)(cwd, config.input_schema);
     let schemaContent;
     try {
       schemaContent = await (0, import_promises2.readFile)(schemaPath, "utf-8");
@@ -19320,22 +19745,63 @@ async function generate2(cwd2, configPath) {
   console.log(`Done! Generated ${generatedFiles.length} file(s).`);
 }
 
+// src/cli-args.ts
+var import_node_path3 = require("node:path");
+function parseCliArgs(argv, cwd) {
+  const args = argv.slice(2);
+  if (args.includes("--help") || args.includes("-h")) {
+    return { action: "help" };
+  }
+  if (args.includes("--version") || args.includes("-v")) {
+    return { action: "version" };
+  }
+  const configIdx = args.indexOf("--config");
+  if (configIdx !== -1) {
+    const next = args[configIdx + 1];
+    if (next === void 0 || next.startsWith("--")) {
+      return {
+        action: "error",
+        message: [
+          "Error: --config requires a file path argument",
+          "Usage: openapi-server [--config <path-to-config.json>]"
+        ].join("\n")
+      };
+    }
+    const configFile = (0, import_node_path3.resolve)(cwd, next);
+    return { action: "run", configFile, cwd: (0, import_node_path3.dirname)(configFile) };
+  }
+  return { action: "run", cwd };
+}
+
 // src/cli.ts
-var args = process.argv.slice(2);
-var configIdx = args.indexOf("--config");
-var cwd = process.cwd();
-var configFile;
-if (configIdx !== -1) {
-  const next = args[configIdx + 1];
-  if (next === void 0 || next.startsWith("--")) {
-    console.error("Error: --config requires a file path argument");
-    console.error("Usage: openapi-server [--config <path-to-config.json>]");
-    process.exit(1);
-  }
-  configFile = (0, import_node_path3.resolve)(cwd, next);
-  cwd = (0, import_node_path3.dirname)(configFile);
+var parsed = parseCliArgs(process.argv, process.cwd());
+if (parsed.action === "help") {
+  console.log(
+    [
+      "Usage: openapi-server [--config <path>]",
+      "",
+      "Generate a typed service interface and a Hono router from an OpenAPI 3.1 spec.",
+      "",
+      "Options:",
+      "  --config <path>   Path to config file (default: openapi-server.config.json in cwd)",
+      "  --help, -h        Show this help message",
+      "  --version, -v     Show version number"
+    ].join("\n")
+  );
+  process.exit(0);
+}
+if (parsed.action === "version") {
+  const pkg = JSON.parse(
+    (0, import_node_fs.readFileSync)((0, import_node_path4.join)(__dirname, "../package.json"), "utf-8")
+  );
+  console.log(pkg.version);
+  process.exit(0);
+}
+if (parsed.action === "error") {
+  console.error(parsed.message);
+  process.exit(1);
 }
-generate2(cwd, configFile).catch((err) => {
+generate2(parsed.cwd, parsed.configFile).catch((err) => {
   console.error(`Error: ${err.message}`);
   process.exit(1);
 });