@croutonian/with-openapi 0.2.0

package/dist/index.js

@@ -0,0 +1,1419 @@
+import { defineMiddleware } from "@supabase/middleware";
+import { dereference, validate } from "@cfworker/json-schema";
+
+//#region src/params.ts
+const ABSENT = {
+	present: false,
+	value: void 0
+};
+function typesOf(schema) {
+	const type = schema?.type;
+	if (type === void 0) return [];
+	return Array.isArray(type) ? type : [type];
+}
+/** Classify a schema, falling back to its keywords when `type` is absent. */
+function schemaKind(schema) {
+	const types = typesOf(schema);
+	if (types.includes("array")) return "array";
+	if (types.includes("object")) return "object";
+	if (types.length > 0) return "primitive";
+	if (schema?.items !== void 0 || schema?.prefixItems !== void 0) return "array";
+	if (schema?.properties !== void 0) return "object";
+	return "primitive";
+}
+/** `['a','1','b','2']` — the un-exploded object encoding. */
+function pairsToObject(tokens) {
+	const out = {};
+	for (let i = 0; i + 1 < tokens.length; i += 2) {
+		const key = tokens[i];
+		const value = tokens[i + 1];
+		if (key !== void 0 && value !== void 0) out[key] = value;
+	}
+	return out;
+}
+/** `['a=1','b=2']` — the exploded object encoding. */
+function assignmentsToObject(tokens) {
+	const out = {};
+	for (const token of tokens) {
+		const at = token.indexOf("=");
+		if (at > 0) out[token.slice(0, at)] = token.slice(at + 1);
+	}
+	return out;
+}
+/** Split that treats the empty string as the empty list, not `['']`. */
+function splitList(raw, delimiter) {
+	return raw === "" ? [] : raw.split(delimiter);
+}
+/** Parse a `Cookie` header into a name/value record. */
+function parseCookies(header) {
+	const out = {};
+	if (!header) return out;
+	for (const part of header.split(";")) {
+		const at = part.indexOf("=");
+		if (at < 1) continue;
+		const name = part.slice(0, at).trim();
+		const raw = part.slice(at + 1).trim();
+		try {
+			out[name] = decodeURIComponent(raw);
+		} catch {
+			out[name] = raw;
+		}
+	}
+	return out;
+}
+function readPath(param, raw) {
+	const kind = schemaKind(param.resolved);
+	if (param.style === "matrix") {
+		const body = raw.startsWith(";") ? raw.slice(1) : raw;
+		if (kind === "object") return param.explode ? {
+			present: true,
+			value: assignmentsToObject(splitList(body, ";"))
+		} : {
+			present: true,
+			value: pairsToObject(splitList(afterName(body, param.name), ","))
+		};
+		if (kind === "array") {
+			if (param.explode) return {
+				present: true,
+				value: splitList(body, ";").flatMap((token) => {
+					const at = token.indexOf("=");
+					return at > 0 ? [token.slice(at + 1)] : [];
+				})
+			};
+			return {
+				present: true,
+				value: splitList(afterName(body, param.name), ",")
+			};
+		}
+		return {
+			present: true,
+			value: afterName(body, param.name)
+		};
+	}
+	if (param.style === "label") {
+		const body = raw.startsWith(".") ? raw.slice(1) : raw;
+		const delimiter = param.explode ? "." : ",";
+		if (kind === "object") return {
+			present: true,
+			value: param.explode ? assignmentsToObject(splitList(body, ".")) : pairsToObject(splitList(body, ","))
+		};
+		if (kind === "array") return {
+			present: true,
+			value: splitList(body, delimiter)
+		};
+		return {
+			present: true,
+			value: body
+		};
+	}
+	if (kind === "object") return {
+		present: true,
+		value: param.explode ? assignmentsToObject(splitList(raw, ",")) : pairsToObject(splitList(raw, ","))
+	};
+	if (kind === "array") return {
+		present: true,
+		value: splitList(raw, ",")
+	};
+	return {
+		present: true,
+		value: raw
+	};
+}
+function afterName(body, name) {
+	const prefix = `${name}=`;
+	return body.startsWith(prefix) ? body.slice(prefix.length) : body;
+}
+function readDeepObject(param, search) {
+	const prefix = `${param.name}[`;
+	const out = {};
+	let present = false;
+	for (const [key, value] of search) {
+		if (!key.startsWith(prefix) || !key.endsWith("]")) continue;
+		out[key.slice(prefix.length, -1)] = value;
+		present = true;
+	}
+	return present ? {
+		present,
+		value: out
+	} : ABSENT;
+}
+function readExplodedObject(param, lookup) {
+	const properties = param.resolved?.properties;
+	if (properties === void 0) return ABSENT;
+	const out = {};
+	let present = false;
+	for (const key of Object.keys(properties)) {
+		const value = lookup(key);
+		if (value === void 0) continue;
+		out[key] = value;
+		present = true;
+	}
+	return present ? {
+		present,
+		value: out
+	} : ABSENT;
+}
+function readQuery(param, search) {
+	const kind = schemaKind(param.resolved);
+	if (param.style === "deepObject") return kind === "object" ? readDeepObject(param, search) : ABSENT;
+	const delimiter = param.style === "spaceDelimited" ? " " : param.style === "pipeDelimited" ? "|" : ",";
+	if (kind === "object" && param.explode && param.style === "form") return readExplodedObject(param, (key) => search.get(key) ?? void 0);
+	if (kind === "array" && param.explode) return search.has(param.name) ? {
+		present: true,
+		value: search.getAll(param.name)
+	} : ABSENT;
+	const raw = search.get(param.name);
+	if (raw === null) return ABSENT;
+	if (kind === "array") return {
+		present: true,
+		value: splitList(raw, delimiter)
+	};
+	if (kind === "object") return {
+		present: true,
+		value: pairsToObject(splitList(raw, delimiter))
+	};
+	return {
+		present: true,
+		value: raw
+	};
+}
+function readSimpleString(param, raw) {
+	const kind = schemaKind(param.resolved);
+	if (kind === "array") return {
+		present: true,
+		value: splitList(raw, ",").map((v) => v.trim())
+	};
+	if (kind === "object") {
+		const tokens = splitList(raw, ",").map((v) => v.trim());
+		return {
+			present: true,
+			value: param.explode ? assignmentsToObject(tokens) : pairsToObject(tokens)
+		};
+	}
+	return {
+		present: true,
+		value: raw
+	};
+}
+function readCookie(param, cookies) {
+	const kind = schemaKind(param.resolved);
+	if (kind === "object" && param.explode) return readExplodedObject(param, (key) => cookies[key]);
+	const raw = cookies[param.name];
+	if (raw === void 0) return ABSENT;
+	if (kind === "array") return {
+		present: true,
+		value: splitList(raw, ",")
+	};
+	if (kind === "object") return {
+		present: true,
+		value: pairsToObject(splitList(raw, ","))
+	};
+	return {
+		present: true,
+		value: raw
+	};
+}
+/** Read one parameter out of the request, undoing its `style`/`explode`. */
+function readParameter(param, sources) {
+	switch (param.in) {
+		case "path": {
+			const raw = sources.pathValues[param.name];
+			return raw === void 0 ? ABSENT : readPath(param, raw);
+		}
+		case "query": return readQuery(param, sources.search);
+		case "header": {
+			const raw = sources.headers.get(param.name);
+			return raw === null ? ABSENT : readSimpleString(param, raw);
+		}
+		case "cookie": return readCookie(param, sources.cookies);
+	}
+}
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function coerceScalar(value, schema) {
+	const types = typesOf(schema);
+	if (types.length === 0) {
+		const values = schema.enum;
+		if (Array.isArray(values) && values.length > 0 && values.every((v) => typeof v === "number")) {
+			const parsed = toNumber(value);
+			return parsed === void 0 ? value : parsed;
+		}
+		return value;
+	}
+	if (types.includes("string")) return value;
+	if (types.includes("boolean")) {
+		if (value === "true") return true;
+		if (value === "false") return false;
+	}
+	if (types.includes("integer")) {
+		const parsed = toNumber(value);
+		if (parsed !== void 0 && Number.isInteger(parsed)) return parsed;
+	}
+	if (types.includes("number")) {
+		const parsed = toNumber(value);
+		if (parsed !== void 0) return parsed;
+	}
+	if (types.includes("null") && value === "null") return null;
+	return value;
+}
+function toNumber(value) {
+	if (value.trim() === "") return void 0;
+	const parsed = Number(value);
+	return Number.isFinite(parsed) ? parsed : void 0;
+}
+/**
+* Recursively convert a deserialized value into the JSON types its schema
+* describes. Non-string leaves and unknown properties are passed through
+* untouched.
+*/
+function coerceToSchema(value, schema, resolve) {
+	if (schema === void 0) return value;
+	if (Array.isArray(value)) {
+		const prefixItems = schema.prefixItems;
+		const items = resolve(schema.items);
+		return value.map((entry, index) => {
+			const prefix = prefixItems?.[index];
+			return coerceToSchema(entry, prefix !== void 0 ? resolve(prefix) : items, resolve);
+		});
+	}
+	if (isPlainObject(value)) {
+		const properties = schema.properties;
+		const additional = typeof schema.additionalProperties === "object" ? resolve(schema.additionalProperties) : void 0;
+		const out = {};
+		for (const [key, entry] of Object.entries(value)) {
+			const declared = properties?.[key];
+			out[key] = coerceToSchema(entry, declared !== void 0 ? resolve(declared) : additional, resolve);
+		}
+		return out;
+	}
+	return typeof value === "string" ? coerceScalar(value, schema) : value;
+}
+
+//#endregion
+//#region src/body.ts
+/** Lowercase `type/subtype` of a content-type header, parameters dropped. */
+function essenceOf(contentType) {
+	if (contentType === null) return void 0;
+	const essence = contentType.split(";")[0]?.trim().toLowerCase();
+	return essence === void 0 || essence === "" ? void 0 : essence;
+}
+/**
+* Find the Media Type Object covering a request's content type.
+*
+* Exact match first, then a `type` wildcard range, then the
+* catch-all range — the precedence the spec gives for `content` map keys.
+*/
+function matchMediaType(contents, essence) {
+	const type = essence.split("/")[0] ?? "";
+	return contents.find((entry) => entry.mediaType === essence) ?? contents.find((entry) => entry.mediaType === `${type}/*`) ?? contents.find((entry) => entry.mediaType === "*/*");
+}
+/**
+* Decide how to read the body from what the *request* says it is, not from
+* what the document declared — a catch-all range matches anything, and the
+* request is the only thing that knows what was actually sent.
+*/
+function bodyFormFor(essence) {
+	if (essence === "application/json" || essence.endsWith("+json")) return "json";
+	if (essence.endsWith("/json")) return "json";
+	if (essence === "application/x-www-form-urlencoded") return "urlencoded";
+	if (essence === "multipart/form-data") return "multipart";
+	if (essence.startsWith("text/") || essence.endsWith("+xml")) return "text";
+	return "opaque";
+}
+/**
+* Flatten form entries into an object, consulting the schema to decide which
+* keys are arrays. `?tag=a&tag=b` is `['a','b']` only where the schema says so;
+* everywhere else a repeated key keeps its last value, as a form post would.
+*/
+function formEntriesToObject(entries, schema, resolve) {
+	const collected = /* @__PURE__ */ new Map();
+	for (const [key, value] of entries) {
+		const existing = collected.get(key);
+		if (existing) existing.push(value);
+		else collected.set(key, [value]);
+	}
+	const properties = schema?.properties;
+	const out = {};
+	for (const [key, values] of collected) {
+		const declared = properties?.[key];
+		out[key] = schemaKind(declared === void 0 ? void 0 : resolve(declared)) === "array" ? values : values[values.length - 1];
+	}
+	return out;
+}
+/**
+* Read and parse the request body against an operation's Request Body Object.
+*
+* `absent` means no body was sent — whether that is an error is the caller's
+* call, since it depends on the Request Body Object's `required`.
+*/
+async function readBody(req, contents, resolve) {
+	if (req.body === null) return { outcome: "absent" };
+	const essence = essenceOf(req.headers.get("content-type"));
+	if (essence === void 0) return await req.text() === "" ? { outcome: "absent" } : {
+		outcome: "unsupported",
+		essence
+	};
+	const content = matchMediaType(contents, essence);
+	if (content === void 0) return {
+		outcome: "unsupported",
+		essence
+	};
+	const form = bodyFormFor(essence);
+	const schema = content.resolved;
+	if (form === "opaque") return {
+		outcome: "read",
+		content,
+		value: void 0,
+		validatable: false
+	};
+	if (form === "multipart") {
+		let parsed;
+		try {
+			parsed = await req.formData();
+		} catch {
+			return {
+				outcome: "malformed",
+				message: "body is not valid multipart/form-data",
+				content
+			};
+		}
+		return {
+			outcome: "read",
+			content,
+			value: formEntriesToObject(parsed, schema, resolve),
+			validatable: false
+		};
+	}
+	const raw = await req.text();
+	if (raw === "") return { outcome: "absent" };
+	if (form === "json") try {
+		return {
+			outcome: "read",
+			content,
+			value: JSON.parse(raw),
+			validatable: true
+		};
+	} catch {
+		return {
+			outcome: "malformed",
+			message: "body is not valid JSON",
+			content
+		};
+	}
+	if (form === "urlencoded") return {
+		outcome: "read",
+		content,
+		value: coerceToSchema(formEntriesToObject(new URLSearchParams(raw), schema, resolve), schema, resolve),
+		validatable: true
+	};
+	return {
+		outcome: "read",
+		content,
+		value: raw,
+		validatable: true
+	};
+}
+
+//#endregion
+//#region src/document.ts
+/** The HTTP methods an OpenAPI Path Item Object may declare an operation for. */
+const HTTP_METHODS = [
+	"get",
+	"put",
+	"post",
+	"delete",
+	"options",
+	"head",
+	"patch",
+	"trace"
+];
+const METHOD_SET = new Set(HTTP_METHODS);
+/** Narrow an arbitrary lowercase method string to an {@link HttpMethod}. */
+function isHttpMethod(value) {
+	return METHOD_SET.has(value);
+}
+/** True when a node is a Reference Object rather than the thing it points at. */
+function isRef(node) {
+	return typeof node === "object" && node !== null && typeof node.$ref === "string";
+}
+function unescapePointerToken(token) {
+	return token.replace(/~1/g, "/").replace(/~0/g, "~");
+}
+function pointerGet(document, ref) {
+	if (!ref.startsWith("#/") && ref !== "#") throw new Error(`withOpenApi: only local $refs are supported, got ${JSON.stringify(ref)}. Bundle external references into the document before passing it in.`);
+	if (ref === "#") return document;
+	let node = document;
+	for (const raw of ref.slice(2).split("/")) {
+		const token = unescapePointerToken(decodeURIComponent(raw));
+		if (typeof node !== "object" || node === null) return void 0;
+		node = node[token];
+	}
+	return node;
+}
+/**
+* Follow a `$ref` chain to the node it names.
+*
+* Structural nodes only — Path Items, Operations, Parameters, Request Bodies.
+* Schemas are deliberately **not** resolved before validation: the validator
+* resolves `$ref` itself against the whole document, which is what lets a
+* recursive schema work. {@link resolveSchema} is the exception, and exists
+* only so coercion can see a schema's `type`.
+*/
+function resolveRef(document, node, seen = /* @__PURE__ */ new Set()) {
+	let current = node;
+	while (isRef(current)) {
+		const ref = current.$ref;
+		if (seen.has(ref)) throw new Error(`withOpenApi: circular $ref chain at ${ref}`);
+		seen.add(ref);
+		const target = pointerGet(document, ref);
+		if (target === void 0) throw new Error(`withOpenApi: $ref ${JSON.stringify(ref)} does not resolve`);
+		current = target;
+	}
+	return current;
+}
+/**
+* Resolve a schema's `$ref` chain far enough to read its `type`, `items` and
+* `properties`. Used only to decide how to deserialize and coerce a parameter;
+* the *unresolved* schema is what gets handed to the validator.
+*
+* Returns `undefined` rather than throwing on a dangling ref, because a schema
+* the validator can still report on is more useful than a crash.
+*/
+function resolveSchema(document, schema) {
+	if (schema === void 0) return void 0;
+	try {
+		return resolveRef(document, schema);
+	} catch {
+		return;
+	}
+}
+const PARAM_PATTERN = /^\{(.+)\}$/;
+function parseTemplate(template) {
+	if (!template.startsWith("/")) throw new Error(`withOpenApi: path template ${JSON.stringify(template)} must start with "/"`);
+	return normalizePathname(template).slice(1).split("/").map((raw) => {
+		const match = PARAM_PATTERN.exec(raw);
+		return match?.[1] ? {
+			kind: "param",
+			name: match[1]
+		} : {
+			kind: "static",
+			value: raw
+		};
+	});
+}
+/**
+* Drop a single trailing slash so `/users` and `/users/` are the same route.
+* Applied to both templates and request pathnames, so the two always agree.
+*/
+function normalizePathname(pathname) {
+	return pathname.length > 1 && pathname.endsWith("/") ? pathname.slice(0, -1) : pathname;
+}
+/** The shape a template reduces to when parameter *names* are ignored. */
+function templateShape(segments) {
+	return segments.map((s) => s.kind === "static" ? s.value : "{}").join("/");
+}
+function defaultStyleFor(location) {
+	switch (location) {
+		case "path":
+		case "header": return "simple";
+		default: return "form";
+	}
+}
+function indexParameter(document, param) {
+	const style = param.style ?? defaultStyleFor(param.in);
+	return {
+		name: param.name,
+		in: param.in,
+		description: param.description,
+		required: param.in === "path" ? true : param.required ?? false,
+		style,
+		explode: param.explode ?? (style === "form" || style === "deepObject"),
+		allowEmptyValue: param.allowEmptyValue ?? false,
+		schema: param.schema,
+		resolved: resolveSchema(document, param.schema)
+	};
+}
+function mergeParameters(document, pathLevel, operationLevel) {
+	const byIdentity = /* @__PURE__ */ new Map();
+	for (const list of [pathLevel ?? [], operationLevel ?? []]) for (const entry of list) {
+		const param = resolveRef(document, entry);
+		byIdentity.set(`${param.in}:${param.name}`, indexParameter(document, param));
+	}
+	const grouped = {
+		path: [],
+		query: [],
+		header: [],
+		cookie: []
+	};
+	for (const param of byIdentity.values()) grouped[param.in].push(param);
+	return grouped;
+}
+function indexRequestBody(document, node) {
+	if (node === void 0) return void 0;
+	const body = resolveRef(document, node);
+	const contents = Object.entries(body.content ?? {}).map(([mediaType, media]) => ({
+		mediaType: mediaType.toLowerCase(),
+		schema: media?.schema,
+		resolved: resolveSchema(document, media?.schema)
+	}));
+	return {
+		required: body.required ?? false,
+		description: body.description,
+		contents
+	};
+}
+function queryConsumption(params) {
+	const names = /* @__PURE__ */ new Set();
+	const prefixes = [];
+	for (const param of params) {
+		if (param.style === "deepObject") {
+			prefixes.push(`${param.name}[`);
+			continue;
+		}
+		const properties = param.resolved?.properties;
+		if (param.style === "form" && param.explode && properties) {
+			for (const key of Object.keys(properties)) names.add(key);
+			continue;
+		}
+		names.add(param.name);
+	}
+	return {
+		names,
+		prefixes
+	};
+}
+/**
+* Read a document into a flat list of routes, outermost work done once.
+*
+* Throws on anything that cannot be made sense of — a dangling `$ref`, a path
+* template that does not start with `/`, or two templates that differ only in
+* the *names* of their parameters (`/a/{id}` and `/a/{key}` are one path, and
+* the spec forbids declaring both).
+*/
+function indexDocument(document) {
+	const routes = [];
+	const shapes = /* @__PURE__ */ new Map();
+	for (const [template, node] of Object.entries(document.paths ?? {})) {
+		if (node === void 0 || node === null) continue;
+		const pathItem = resolveRef(document, node);
+		const segments = parseTemplate(template);
+		const shape = templateShape(segments);
+		const clash = shapes.get(shape);
+		if (clash !== void 0) throw new Error(`withOpenApi: path templates ${JSON.stringify(clash)} and ${JSON.stringify(template)} are the same path — they differ only in parameter names.`);
+		shapes.set(shape, template);
+		const declared = new Set(segments.flatMap((s) => s.kind === "param" ? [s.name] : []));
+		const operations = /* @__PURE__ */ new Map();
+		for (const method of HTTP_METHODS) {
+			const operation = pathItem[method];
+			if (operation === void 0) continue;
+			const parameters = mergeParameters(document, pathItem.parameters, operation.parameters);
+			for (const param of parameters.path) if (!declared.has(param.name)) throw new Error(`withOpenApi: ${method.toUpperCase()} ${template} declares a path parameter "${param.name}" that the template does not contain.`);
+			const { names, prefixes } = queryConsumption(parameters.query);
+			operations.set(method, {
+				method,
+				route: template,
+				operation,
+				operationId: operation.operationId,
+				security: operation.security ?? document.security,
+				parameters,
+				requestBody: indexRequestBody(document, operation.requestBody),
+				knownQueryNames: names,
+				knownQueryPrefixes: prefixes
+			});
+		}
+		routes.push({
+			template,
+			segments,
+			operations,
+			allow: [...operations.keys()].map((m) => m.toUpperCase())
+		});
+	}
+	return routes;
+}
+
+//#endregion
+//#region src/cors.ts
+/**
+* Response headers a browser exposes without being asked, so naming them in
+* `Access-Control-Expose-Headers` is noise.
+*
+* @see https://fetch.spec.whatwg.org/#cors-safelisted-response-header-name
+*/
+const SAFELISTED_RESPONSE_HEADERS = new Set([
+	"cache-control",
+	"content-language",
+	"content-length",
+	"content-type",
+	"expires",
+	"last-modified",
+	"pragma"
+]);
+/** Header names are case-insensitive; keep the first spelling seen. */
+var HeaderNames = class {
+	#byLower = /* @__PURE__ */ new Map();
+	add(name) {
+		const lower = name.toLowerCase();
+		if (!this.#byLower.has(lower)) this.#byLower.set(lower, name);
+	}
+	has(name) {
+		return this.#byLower.has(name.toLowerCase());
+	}
+	join() {
+		return [...this.#byLower.values()].join(", ");
+	}
+};
+/**
+* The request header a security scheme travels in, or `undefined` when it
+* travels somewhere CORS does not care about (a cookie, a query parameter).
+*/
+function securityHeaderName(scheme) {
+	switch (scheme.type) {
+		case "apiKey": return scheme.in === "header" ? scheme.name : void 0;
+		case "http":
+		case "oauth2":
+		case "openIdConnect": return "Authorization";
+		default: return;
+	}
+}
+function deriveRouteCors(document, route, schemeHeaders, options) {
+	const allowed = new HeaderNames();
+	const exposed = new HeaderNames();
+	for (const operation of route.operations.values()) {
+		for (const param of operation.parameters.header) allowed.add(param.name);
+		if (operation.requestBody !== void 0) allowed.add("Content-Type");
+		for (const requirement of operation.security ?? []) for (const schemeName of Object.keys(requirement)) {
+			const header = schemeHeaders.get(schemeName);
+			if (header !== void 0) allowed.add(header);
+		}
+		for (const response of Object.values(operation.operation.responses ?? {})) {
+			const resolved = resolveRef(document, response);
+			for (const name of Object.keys(resolved.headers ?? {})) if (!SAFELISTED_RESPONSE_HEADERS.has(name.toLowerCase())) exposed.add(name);
+		}
+	}
+	for (const name of options.allowedHeaders ?? []) allowed.add(name);
+	for (const name of options.exposedHeaders ?? []) exposed.add(name);
+	return {
+		methods: route.allow.join(", "),
+		allowedHeaders: allowed.join(),
+		exposedHeaders: exposed.join()
+	};
+}
+function resolveAllowOrigin(options, requestOrigin) {
+	const { origin } = options;
+	if (typeof origin === "function") return origin(requestOrigin) ? requestOrigin ?? "*" : null;
+	if (origin === "*") return options.credentials === true ? requestOrigin : "*";
+	return requestOrigin !== null && (typeof origin === "string" ? [origin] : origin).includes(requestOrigin) ? requestOrigin : null;
+}
+function applyCommonHeaders(headers, options, allowOrigin) {
+	if (allowOrigin === null) return;
+	headers.set("Access-Control-Allow-Origin", allowOrigin);
+	if (options.credentials === true) headers.set("Access-Control-Allow-Credentials", "true");
+	if (allowOrigin !== "*" && !varyIncludesOrigin(headers)) headers.append("Vary", "Origin");
+}
+function varyIncludesOrigin(headers) {
+	const vary = headers.get("Vary");
+	return vary !== null && vary.split(",").some((token) => token.trim().toLowerCase() === "origin");
+}
+/** Derive a CORS policy from the document, once. */
+function createCorsPolicy(document, routes, options) {
+	const schemeHeaders = /* @__PURE__ */ new Map();
+	for (const [name, node] of Object.entries(document.components?.securitySchemes ?? {})) {
+		const header = securityHeaderName(resolveRef(document, node));
+		if (header !== void 0) schemeHeaders.set(name, header);
+	}
+	const byRoute = /* @__PURE__ */ new Map();
+	for (const route of routes) byRoute.set(route, deriveRouteCors(document, route, schemeHeaders, options));
+	const successStatus = options.optionsSuccessStatus ?? 204;
+	return {
+		isPreflight: (req) => req.method === "OPTIONS" && req.headers.has("Access-Control-Request-Method"),
+		preflight(req, route) {
+			const derived = byRoute.get(route);
+			const headers = new Headers();
+			applyCommonHeaders(headers, options, resolveAllowOrigin(options, req.headers.get("Origin")));
+			if (derived !== void 0) {
+				if (derived.methods !== "") headers.set("Access-Control-Allow-Methods", derived.methods);
+				if (derived.allowedHeaders !== "") headers.set("Access-Control-Allow-Headers", derived.allowedHeaders);
+			}
+			if (options.maxAge !== void 0) headers.set("Access-Control-Max-Age", String(options.maxAge));
+			headers.append("Vary", "Access-Control-Request-Method");
+			return new Response(null, {
+				status: successStatus,
+				headers
+			});
+		},
+		stamp(response, req, route) {
+			const headers = new Headers(response.headers);
+			applyCommonHeaders(headers, options, resolveAllowOrigin(options, req.headers.get("Origin")));
+			const exposed = route === void 0 ? void 0 : byRoute.get(route)?.exposedHeaders;
+			if (exposed !== void 0 && exposed !== "") headers.set("Access-Control-Expose-Headers", exposed);
+			return new Response(response.body, {
+				status: response.status,
+				statusText: response.statusText,
+				headers
+			});
+		}
+	};
+}
+
+//#endregion
+//#region src/router.ts
+/**
+* Matching a request pathname against the document's path templates.
+*
+* Routes are bucketed by segment count and, within a bucket, ordered by
+* specificity: reading left to right, a static segment beats a templated one.
+* That is the ordering OpenAPI asks for — `/pets/mine` wins over `/pets/{id}`
+* — and doing it once at construction keeps matching to a linear scan of a
+* bucket that is usually one or two entries deep.
+*/
+function moreSpecific(a, b) {
+	const length = Math.min(a.segments.length, b.segments.length);
+	for (let i = 0; i < length; i++) {
+		const left = a.segments[i]?.kind === "static";
+		if (left !== (b.segments[i]?.kind === "static")) return left ? -1 : 1;
+	}
+	return a.template < b.template ? -1 : a.template > b.template ? 1 : 0;
+}
+function decodeSegment(raw) {
+	try {
+		return decodeURIComponent(raw);
+	} catch {
+		return raw;
+	}
+}
+function matchSegments(segments, actual) {
+	const pathValues = {};
+	for (let i = 0; i < segments.length; i++) {
+		const segment = segments[i];
+		const value = actual[i];
+		if (segment === void 0 || value === void 0) return void 0;
+		if (segment.kind === "static") {
+			if (segment.value !== value) return void 0;
+		} else {
+			if (value === "") return void 0;
+			pathValues[segment.name] = decodeSegment(value);
+		}
+	}
+	return pathValues;
+}
+/** Build a matcher over an indexed document. */
+function createRouter(routes) {
+	const byLength = /* @__PURE__ */ new Map();
+	for (const route of routes) {
+		const bucket = byLength.get(route.segments.length);
+		if (bucket) bucket.push(route);
+		else byLength.set(route.segments.length, [route]);
+	}
+	for (const bucket of byLength.values()) bucket.sort(moreSpecific);
+	return { match(pathname) {
+		const actual = normalizePathname(pathname).slice(1).split("/");
+		const bucket = byLength.get(actual.length);
+		if (bucket === void 0) return void 0;
+		for (const route of bucket) {
+			const pathValues = matchSegments(route.segments, actual);
+			if (pathValues !== void 0) return {
+				route,
+				pathValues
+			};
+		}
+	} };
+}
+
+//#endregion
+//#region src/reference.ts
+/** Default CDN for Scalar's standalone browser build. */
+const SCALAR_CDN_URL = "https://cdn.jsdelivr.net/npm/@scalar/api-reference";
+const HTML_ESCAPES = {
+	"&": "&amp;",
+	"<": "&lt;",
+	">": "&gt;",
+	"\"": "&quot;"
+};
+function escapeHtml(value) {
+	return value.replace(/[&<>"]/g, (char) => HTML_ESCAPES[char] ?? char);
+}
+/**
+* Serialize for embedding inside a `<script>` body. Escaping `<` is what stops
+* a `<\/script>` sequence anywhere in the config from ending the element early —
+* the standard XSS hole in inline JSON.
+*/
+function jsonForScript(value) {
+	return JSON.stringify(value).replace(/</g, "\\u003c");
+}
+function renderScalarHtml(input) {
+	return `<!doctype html>
+<html>
+  <head>
+    <title>${escapeHtml(input.title)}</title>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <style>
+      body {
+        margin: 0;
+      }
+    </style>
+  </head>
+  <body>
+    <div id="app"></div>
+    <script src="${escapeHtml(input.cdnUrl)}"><\/script>
+    <script>
+      Scalar.createApiReference('#app', ${jsonForScript(input.configuration)})
+    <\/script>
+  </body>
+</html>
+`;
+}
+function joinPath(base, child) {
+	return `${base.endsWith("/") ? base.slice(0, -1) : base}/${child}`;
+}
+/** Fill in the reference endpoint's defaults, once, at construction. */
+function resolveReference(document, options) {
+	const path = options.path ?? "/reference";
+	if (!path.startsWith("/")) throw new Error(`withOpenApi: reference.path must start with "/", got ${JSON.stringify(path)}`);
+	const documentPath = options.documentPath ?? joinPath(path, "openapi.json");
+	const title = options.title ?? document.info?.title ?? "API Reference";
+	const cdnUrl = options.cdnUrl ?? SCALAR_CDN_URL;
+	const configuration = {
+		url: documentPath,
+		...options.configuration
+	};
+	const page = (options.html ?? renderScalarHtml)({
+		documentPath,
+		title,
+		cdnUrl,
+		configuration
+	});
+	return {
+		path,
+		documentPath,
+		cacheControl: options.cacheControl ?? "no-cache",
+		render: () => page
+	};
+}
+
+//#endregion
+//#region src/schema.ts
+/**
+* JSON Schema validation against the document, on every runtime this package
+* targets.
+*
+* OpenAPI 3.1 schemas *are* JSON Schema 2020-12, so no translation layer is
+* needed — but the validator has to be one that works where `eval` and `new
+* Function` do not, which rules out the code-generating validators. `@cfworker
+* /json-schema` interprets rather than compiles, has no dependencies, and is
+* built for exactly this constraint.
+*
+* The one thing worth understanding here is the `lookup`. `dereference` walks
+* a document once and returns a map from absolute URI to node; `validate`
+* takes that map and resolves `$ref` through it. Because the map is a plain
+* argument, the whole document can be walked **once** at construction and every
+* subschema in it validated against the shared map afterwards. That is what
+* makes `#/components/schemas/…` resolve from a parameter schema buried in a
+* path item, recursive schemas included, without inlining anything.
+*/
+/**
+* Keywords whose only job is to say that something nested failed. The specific
+* errors always follow them, so repeating "a subschema had errors" above every
+* one of them just pads the response.
+*/
+const CONTAINER_KEYWORDS = new Set([
+	"$ref",
+	"$recursiveRef",
+	"properties",
+	"patternProperties",
+	"additionalProperties",
+	"unevaluatedProperties",
+	"items",
+	"prefixItems",
+	"additionalItems",
+	"unevaluatedItems",
+	"allOf",
+	"then",
+	"else",
+	"dependentSchemas",
+	"contains"
+]);
+/**
+* Reduce the validator's output to the errors worth showing a caller.
+*
+* Drops the container keywords above, then de-duplicates. The last step is a
+* workaround: with `shortCircuit: false`, `additionalProperties` is re-applied
+* to any property `properties` already *rejected* — the implementation only
+* marks a property evaluated when it passes — so an `additionalProperties:
+* false` schema reports a second, misleading "not allowed here" against a
+* property it does in fact declare. It never changes `valid`, only the error
+* list.
+*
+* Undoing it: drop a boolean-`false` error at a path that some *other* error
+* already accounts for, at that path or below it. A `false` schema never
+* recurses, so it can never be the reason for a deeper error — if there is
+* one, the `false` is the re-check and not the real complaint.
+*/
+function normalizeErrors(units) {
+	const kept = [];
+	const seen = /* @__PURE__ */ new Set();
+	const explained = [];
+	for (const unit of units) {
+		if (CONTAINER_KEYWORDS.has(unit.keyword)) continue;
+		const id = `${unit.instanceLocation}\u0000${unit.keyword}`;
+		if (seen.has(id)) continue;
+		seen.add(id);
+		kept.push(unit);
+		if (unit.keyword !== "false") explained.push(unit.instanceLocation);
+	}
+	return kept.filter((unit) => unit.keyword !== "false" || !explained.some((at) => at === unit.instanceLocation || at.startsWith(`${unit.instanceLocation}/`)));
+}
+/**
+* Walk the document once and return a validator over it.
+*
+* `dereference` records each node's absolute URI on the node itself, as
+* non-enumerable properties (`__absolute_uri__`, `__absolute_ref__`). That
+* mutates the document object the consumer passed in, but invisibly:
+* non-enumerable properties do not appear in `Object.keys`, spreads, or
+* `JSON.stringify`, so the document served at the reference endpoint is
+* byte-for-byte the one that came in.
+*/
+function createSchemaValidator(document, draft) {
+	let lookup;
+	try {
+		lookup = dereference(document);
+	} catch (cause) {
+		throw new Error(`withOpenApi: could not index the document for validation — ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+	}
+	addPointerAliases(lookup, document);
+	return (value, schema) => {
+		const result = validate(value, schema, draft, lookup, false);
+		return result.valid ? [] : normalizeErrors(result.errors);
+	};
+}
+/**
+* Register every node under its bare JSON pointer as well as its absolute URI.
+*
+* `dereference` stamps each node it walks with the absolute URI its `$ref`
+* resolves to, and `validate` prefers that stamp. But the walk only descends
+* through *JSON Schema* keywords, and an OpenAPI `parameters` list is a plain
+* array under a key it does not recognise — so a parameter whose schema is
+* `{ $ref: '#/components/schemas/Foo' }` is never stamped, and resolving it
+* falls back to looking up the raw `'#/components/schemas/Foo'`, which is not
+* a key the lookup has.
+*
+* Aliasing each `<root>#<pointer>` key to its bare `<pointer>` closes that,
+* for parameters and for anything else the walk does not reach.
+*/
+function addPointerAliases(lookup, document) {
+	const root = document.__absolute_uri__;
+	if (root === void 0) return;
+	for (const [uri, schema] of Object.entries(lookup)) {
+		if (uri === root) {
+			lookup["#"] ??= schema;
+			continue;
+		}
+		if (!uri.startsWith(`${root}#`)) continue;
+		const pointer = uri.slice(root.length);
+		lookup[pointer] ??= schema;
+	}
+}
+/**
+* The `description` of the schema the failing keyword belongs to.
+*
+* A validator says what is mechanically wrong — `"-3 is less than 0."` — while
+* the document says what the field is *for*. The second is the half a caller
+* can usually act on, and it is already written; this goes and gets it.
+*
+* `keywordLocation` is a JSON pointer into the schema in which `$ref` appears
+* as a literal segment, meaning "the validator followed the reference here",
+* so walking it means resolving those hops as they come. The final segment is
+* the keyword itself, so the node before it is the schema that failed.
+*
+* Never throws. A description is a nicety, and a walk that does not land is
+* simply one violation without one.
+*/
+function describeFailure(document, rootSchema, unit) {
+	const node = schemaAt(document, rootSchema, unit.keywordLocation);
+	if (node === void 0) return void 0;
+	if (unit.keyword === "required") {
+		const missing = /required property "([^"]+)"/.exec(unit.error)?.[1];
+		const property = missing === void 0 ? void 0 : node.properties?.[missing];
+		if (property !== void 0 && typeof property !== "boolean") {
+			const described = descriptionOf(follow(document, property));
+			if (described !== void 0) return described;
+		}
+	}
+	return descriptionOf(node);
+}
+/** Walk a schema-side JSON pointer to the schema holding the failing keyword. */
+function schemaAt(document, rootSchema, keywordLocation) {
+	if (!keywordLocation.startsWith("#")) return void 0;
+	const segments = keywordLocation.slice(1).split("/").filter((part) => part !== "");
+	segments.pop();
+	let node = rootSchema;
+	for (const raw of segments) {
+		if (typeof node !== "object" || node === null) return void 0;
+		if (raw === "$ref") {
+			node = follow(document, node);
+			continue;
+		}
+		const key = decodeURIComponent(raw).replace(/~1/g, "/").replace(/~0/g, "~");
+		node = node[key];
+	}
+	return follow(document, node);
+}
+function descriptionOf(schema) {
+	const description = schema?.description;
+	return typeof description === "string" && description !== "" ? description : void 0;
+}
+function follow(document, node) {
+	if (typeof node !== "object" || node === null) return void 0;
+	try {
+		return resolveRef(document, node);
+	} catch {
+		return;
+	}
+}
+/**
+* Pick the schema draft matching the document's `openapi` version.
+*
+* 3.1 aligned with JSON Schema 2020-12; 3.0 used a bespoke subset closer to
+* draft 4. Neither the `nullable` keyword nor 3.0's other divergences are
+* translated, so a 3.0 document is best converted to 3.1 before it gets here.
+*/
+function draftFor(document) {
+	return document.openapi?.startsWith("3.0") ? "4" : "2020-12";
+}
+
+//#endregion
+//#region src/with-openapi.ts
+/**
+* `withOpenApi` — match every request against an OpenAPI document, optionally
+* refuse the ones it does not describe, and optionally serve a Scalar
+* reference for it.
+*
+* The whole document is read at construction. A request then costs a segment
+* walk, a map lookup, and whatever validation was asked for.
+*/
+const PARAMETER_LOCATIONS = [
+	"path",
+	"query",
+	"header",
+	"cookie"
+];
+const EMPTY_PARAMS = {
+	path: {},
+	query: {},
+	header: {},
+	cookie: {}
+};
+const REJECTION_MESSAGES = {
+	route_not_found: "no operation in the API description matches this path",
+	method_not_allowed: "this path does not accept this method",
+	unsupported_media_type: "this operation does not accept this content type",
+	validation_failed: "the request does not match the API description"
+};
+function resolveValidateOptions(validate) {
+	if (validate === false) return void 0;
+	const given = validate === void 0 || validate === true ? {} : validate;
+	return {
+		path: given.path ?? true,
+		query: given.query ?? true,
+		header: given.header ?? true,
+		cookie: given.cookie ?? true,
+		body: given.body ?? true,
+		additionalQuery: given.additionalQuery ?? "allow",
+		status: given.status ?? 400,
+		describe: given.describe ?? true,
+		maxViolations: given.maxViolations ?? 20
+	};
+}
+function normalizeBasePath(basePath) {
+	if (basePath === void 0 || basePath === "" || basePath === "/") return void 0;
+	if (!basePath.startsWith("/")) throw new Error(`withOpenApi: basePath must start with "/", got ${JSON.stringify(basePath)}`);
+	return basePath.endsWith("/") ? basePath.slice(0, -1) : basePath;
+}
+/** `undefined` when the pathname is outside the mount point entirely. */
+function stripBasePath(pathname, basePath) {
+	if (basePath === void 0) return pathname;
+	if (pathname === basePath) return "/";
+	return pathname.startsWith(`${basePath}/`) ? pathname.slice(basePath.length) : void 0;
+}
+function toViolation(location, name, unit, description) {
+	return {
+		in: location,
+		...name === void 0 ? {} : { name },
+		location: unit.instanceLocation,
+		keyword: unit.keyword,
+		...description === void 0 ? {} : { description },
+		message: unit.keyword === "false" ? "this value is not allowed here" : unit.error
+	};
+}
+function defaultRejectionResponse(rejection) {
+	const headers = new Headers({ "content-type": "application/json" });
+	if (rejection.allow !== void 0 && rejection.allow.length > 0) headers.set("allow", rejection.allow.join(", "));
+	return Response.json({
+		error: rejection.kind,
+		message: REJECTION_MESSAGES[rejection.kind],
+		...rejection.accepts === void 0 ? {} : { accepts: rejection.accepts },
+		violations: rejection.violations
+	}, {
+		status: rejection.status,
+		headers
+	});
+}
+function unmatched(document, reason, method, route) {
+	return { openapi: {
+		matched: false,
+		reason,
+		document,
+		route,
+		method,
+		operation: void 0,
+		operationId: void 0,
+		security: void 0,
+		params: EMPTY_PARAMS,
+		body: void 0,
+		mediaType: void 0,
+		validated: false
+	} };
+}
+/**
+* Read every declared parameter off the request, coercing and checking as
+* configured. Mutates `params` and `violations` rather than allocating four
+* intermediate records per request.
+*/
+function collectParameters(document, operation, sources, options, coerce, resolve, validateSchema, params, violations) {
+	const describe = options?.describe === true;
+	for (const location of PARAMETER_LOCATIONS) {
+		const checking = options !== void 0 && options[location];
+		for (const param of operation.parameters[location]) {
+			const read = readParameter(param, sources);
+			if (!read.present) {
+				if (checking && param.required) violations.push({
+					in: location,
+					name: param.name,
+					message: `required ${location} parameter "${param.name}" is missing`,
+					...describe && param.description !== void 0 ? { description: param.description } : {}
+				});
+				continue;
+			}
+			const value = coerce ? coerceToSchema(read.value, param.resolved, resolve) : read.value;
+			params[location][param.name] = value;
+			if (checking && param.schema !== void 0 && validateSchema !== void 0) for (const unit of validateSchema(value, param.schema)) violations.push(toViolation(location, param.name, unit, describe ? param.description ?? describeFailure(document, param.schema, unit) : void 0));
+		}
+	}
+}
+/**
+* Middleware that holds an API to its own description.
+*
+* @example Reject anything the document does not describe, and serve the docs.
+* ```ts
+* import { pipeline } from '@supabase/middleware'
+* import { withOpenApi } from '@croutonian/with-openapi'
+* import document from './openapi.json' with { type: 'json' }
+*
+* export default {
+*   fetch: pipeline(
+*     [withOpenApi({ document, reference: true })],
+*     async (_req, ctx) => {
+*       if (!ctx.openapi.matched) return new Response(null, { status: 404 })
+*       return Response.json({ op: ctx.openapi.operationId })
+*     },
+*   ),
+* }
+* ```
+*
+* @example Describe and document, but do not enforce.
+* ```ts
+* withOpenApi({
+*   document,
+*   validate: false,
+*   onUnknownRoute: 'pass',
+*   reference: { path: '/docs' },
+* })
+* ```
+*
+* @category Middleware
+*/
+const withOpenApi = defineMiddleware({
+	key: "openapi",
+	run: (config) => {
+		const { document } = config;
+		const routes = indexDocument(document);
+		const router = createRouter(routes);
+		const options = resolveValidateOptions(config.validate);
+		const coerce = config.coerce ?? true;
+		const basePath = normalizeBasePath(config.basePath);
+		const onUnknownRoute = config.onUnknownRoute ?? "reject";
+		const onUnknownMethod = config.onUnknownMethod ?? "reject";
+		const resolve = (schema) => resolveSchema(document, schema);
+		const validateSchema = options === void 0 ? void 0 : createSchemaValidator(document, config.schemaDraft ?? draftFor(document));
+		const reference = config.reference === void 0 || config.reference === false ? void 0 : resolveReference(document, config.reference === true ? {} : config.reference);
+		const documentJson = reference === void 0 ? void 0 : JSON.stringify(document);
+		const cors = config.cors === void 0 ? void 0 : createCorsPolicy(document, routes, config.cors);
+		/**
+		* One request, taken to the point where it either has an answer of its own
+		* or a contribution to hand downstream.
+		*
+		* The matched route is reported alongside, because the CORS response phase
+		* derives `Access-Control-Expose-Headers` from it and threading it out
+		* here beats reaching for a side channel keyed on the request.
+		*/
+		const handle = async (req) => {
+			const respond = async (rejection) => ({
+				result: await config.reject?.(rejection, req) ?? defaultRejectionResponse(rejection),
+				route: void 0
+			});
+			if (config.skip?.(req) === true) return {
+				result: unmatched(document, "skipped", req.method, void 0),
+				route: void 0
+			};
+			const url = new URL(req.url);
+			const method = req.method.toLowerCase();
+			if (reference !== void 0 && (method === "get" || method === "head")) {
+				const head = method === "head";
+				if (url.pathname === reference.path) return {
+					result: new Response(head ? null : reference.render(), { headers: {
+						"content-type": "text/html; charset=utf-8",
+						"cache-control": reference.cacheControl
+					} }),
+					route: void 0
+				};
+				if (url.pathname === reference.documentPath) return {
+					result: new Response(head ? null : documentJson, { headers: {
+						"content-type": "application/json; charset=utf-8",
+						"cache-control": reference.cacheControl
+					} }),
+					route: void 0
+				};
+			}
+			const pathname = stripBasePath(url.pathname, basePath);
+			const match = pathname === void 0 ? void 0 : router.match(pathname);
+			if (match === void 0) {
+				if (onUnknownRoute === "pass") return {
+					result: unmatched(document, "no_route", req.method, void 0),
+					route: void 0
+				};
+				return respond({
+					kind: "route_not_found",
+					status: 404,
+					method: req.method,
+					pathname: url.pathname,
+					violations: []
+				});
+			}
+			if (cors !== void 0 && cors.isPreflight(req)) return {
+				result: cors.preflight(req, match.route),
+				route: match.route
+			};
+			const operation = isHttpMethod(method) ? match.route.operations.get(method) : void 0;
+			if (operation === void 0) {
+				if (onUnknownMethod === "pass") return {
+					result: unmatched(document, "no_operation", req.method, match.route.template),
+					route: match.route
+				};
+				return respond({
+					kind: "method_not_allowed",
+					status: 405,
+					method: req.method,
+					pathname: url.pathname,
+					route: match.route.template,
+					allow: match.route.allow,
+					violations: []
+				});
+			}
+			const violations = [];
+			const params = {
+				path: {},
+				query: {},
+				header: {},
+				cookie: {}
+			};
+			collectParameters(document, operation, {
+				pathValues: match.pathValues,
+				search: url.searchParams,
+				headers: req.headers,
+				cookies: operation.parameters.cookie.length > 0 ? parseCookies(req.headers.get("cookie")) : {}
+			}, options, coerce, resolve, validateSchema, params, violations);
+			if (options?.additionalQuery === "reject") for (const name of new Set(url.searchParams.keys())) {
+				if (operation.knownQueryNames.has(name)) continue;
+				if (operation.knownQueryPrefixes.some((prefix) => name.startsWith(prefix))) continue;
+				violations.push({
+					in: "query",
+					name,
+					message: `query parameter "${name}" is not declared by this operation`
+				});
+			}
+			let body;
+			let mediaType;
+			const requestBody = operation.requestBody;
+			if (requestBody !== void 0 && options?.body === true) {
+				const read = await readBody(req, requestBody.contents, resolve);
+				if (read.outcome === "unsupported") return respond({
+					kind: "unsupported_media_type",
+					status: 415,
+					method: req.method,
+					pathname: url.pathname,
+					route: operation.route,
+					accepts: requestBody.contents.map((entry) => entry.mediaType),
+					violations: [{
+						in: "body",
+						message: read.essence === void 0 ? "a content-type header is required for a request with a body" : `content type "${read.essence}" is not accepted by this operation`
+					}]
+				});
+				if (read.outcome === "absent") {
+					if (requestBody.required) violations.push({
+						in: "body",
+						message: "a request body is required",
+						...options?.describe === true && requestBody.description !== void 0 ? { description: requestBody.description } : {}
+					});
+				} else if (read.outcome === "malformed") {
+					mediaType = read.content.mediaType;
+					violations.push({
+						in: "body",
+						message: read.message
+					});
+				} else {
+					mediaType = read.content.mediaType;
+					body = read.value;
+					if (read.validatable && read.content.schema !== void 0 && validateSchema) {
+						const schema = read.content.schema;
+						for (const unit of validateSchema(read.value, schema)) violations.push(toViolation("body", void 0, unit, options?.describe === true ? describeFailure(document, schema, unit) : void 0));
+					}
+				}
+			}
+			if (violations.length > 0) return respond({
+				kind: "validation_failed",
+				status: options?.status ?? 400,
+				method: req.method,
+				pathname: url.pathname,
+				route: operation.route,
+				violations: violations.slice(0, options?.maxViolations ?? violations.length)
+			});
+			return {
+				result: { openapi: {
+					matched: true,
+					document,
+					route: operation.route,
+					method: operation.method,
+					operation: operation.operation,
+					operationId: operation.operationId,
+					security: operation.security,
+					params,
+					body,
+					mediaType,
+					validated: options !== void 0
+				} },
+				route: match.route
+			};
+		};
+		if (cors === void 0) return async (req) => (await handle(req)).result;
+		return async function* (req) {
+			const { result, route } = await handle(req);
+			if (result instanceof Response) return cors.stamp(result, req, route);
+			const response = yield result;
+			return cors.stamp(response, req, route);
+		};
+	}
+});
+
+//#endregion
+export { SCALAR_CDN_URL, withOpenApi };