@daloyjs/core 0.1.0

package/README.md

@@ -0,0 +1,296 @@
+# DaloyJS
+
+> A **runtime-portable TypeScript web framework** with built-in **contract-first routing**, **validation**, **OpenAPI (Hey API)**, **typed client generation**, **large-scale maintainability**, and **highly secured by default (pnpm)**.
+
+📚 **Documentation site:** [`./daloyjs.dev`](./daloyjs.dev) — a Next.js 16 + shadcn/ui + Tailwind v4 site with the landing page, getting-started guide, tutorials, security docs, and full API reference. Run it with:
+
+```zsh
+cd daloyjs.dev
+pnpm install
+pnpm dev      # http://localhost:3000
+pnpm build    # static prerender of every docs route
+```
+
+---
+
+DaloyJS exists to be the framework you'd build if you took the best ideas from each modern stack:
+
+| You want | Today's best-of | What DaloyJS gives you |
+|---|---|---|
+| Best **OpenAPI ergonomics** | [FastAPI](https://fastapi.tiangolo.com) | First-class OpenAPI 3.1 generation from a single route definition. |
+| Best **Vercel / serverless / edge fit** | [Hono](https://hono.dev/docs/) | Web-standard `Request → Response` core, multi-runtime adapters. |
+| Mature **Swagger / docs / ops** in Node | [Fastify](https://fastify.dev/docs/latest/Reference/) | Encapsulated plugins, structured logger, graceful shutdown, request ids, hooks. |
+| Modern **TS-first DX**, Bun acceptable | [Elysia](https://elysiajs.com/at-glance.html) | End-to-end typed handlers, typed context, typed client. |
+| Best-in-class **typed client codegen** for any consumer | [Hey API](https://heyapi.dev/openapi-ts/get-started) | One command (`pnpm gen`) emits a fully-typed fetch SDK from your spec. |
+| **Better supply-chain security** than npm | [pnpm](https://pnpm.io/motivation) | Strict, content-addressable installs; reproducible lockfile; per-project `.npmrc` hardening. |
+
+```
+56/56 tests passing · clean strict TypeScript 6 · runs on Node, Bun, Deno, Cloudflare, Vercel
+~12.3M static-route ops/sec · ~1.5M dynamic-route ops/sec on M-class CPU
+```
+
+---
+
+## Why a new framework?
+
+Each existing stack is excellent at one thing and forces tradeoffs everywhere else:
+
+- Hono is small and portable but OpenAPI is a plugin afterthought.
+- Elysia has gorgeous typing but pulls you toward Bun.
+- Fastify has the best Node ops story but is Node-only and validation/types/docs are not unified.
+- FastAPI has the best docs ergonomics — but it's Python.
+- Hey API gives you the best typed client — but you still need a server that produces a clean spec.
+- npm leaves supply-chain protection up to you.
+
+DaloyJS combines the wins:
+
+1. **Explicit contracts, minimal ceremony.** One `app.route({...})` is the source of truth for validation, types, OpenAPI, the typed client, and contract tests.
+2. **One source of truth for validation, typing, and docs** via [Standard Schema](https://github.com/standard-schema/standard-schema) — Zod 4 / Valibot / ArkType / TypeBox all work, no lock-in.
+3. **Portable core, optional runtime optimizations** — the only thing the core knows is `Request → Response`. Adapters live at the edge.
+4. **Secure by default — bad defaults are bugs.** Body limits, prototype-pollution-safe JSON, path-traversal rejection, request timeouts, Helmet-grade headers, RFC 9457 problem+json errors with prod-mode redaction.
+5. **Tooling and inspectability over magic.** `app.introspect()` is a public API; contract-test runner is built in.
+6. **Optimize for large-team maintenance**, not only solo-dev speed. Encapsulated plugins, decorators, request ids, structured logger.
+
+---
+
+## Install
+
+DaloyJS is distributed via **pnpm** for [supply-chain hygiene](https://pnpm.io/motivation) — strict isolation, content-addressable store, deterministic lockfile, no phantom dependencies.
+
+```bash
+pnpm add daloy zod@^4
+```
+
+Zod 4 is the recommended validator for new DaloyJS apps because it is modern, smaller, and Standard-Schema-compatible. DaloyJS still accepts any Standard Schema validator, so teams can use Valibot, ArkType, TypeBox, or another compatible schema library when that better fits their stack.
+
+The repo ships an [`.npmrc`](.npmrc) with hardened defaults:
+
+```ini
+auto-install-peers=true
+strict-peer-dependencies=true
+prefer-frozen-lockfile=true
+verify-store-integrity=true
+# Optional: pnpm 10+ supply-chain controls
+# minimum-release-age=1440        # wait 24h before installing fresh releases
+# ignore-scripts=true             # whitelist install scripts via approve-builds
+```
+
+Run `pnpm audit --prod` regularly (or `pnpm run audit` in this repo) — and `pnpm install --frozen-lockfile` in CI.
+
+---
+
+## Hello world
+
+```ts
+import { z } from "zod";
+import { App, NotFoundError, secureHeaders, rateLimit, requestId } from "daloy";
+import { serve } from "daloy/node";
+
+const app = new App({ bodyLimitBytes: 1024 * 1024, requestTimeoutMs: 5_000 });
+
+// Security defaults — usually three plugins in other frameworks.
+app.use(requestId());
+app.use(secureHeaders());
+app.use(rateLimit({ windowMs: 60_000, max: 120 }));
+
+app.route({
+  method: "GET",
+  path: "/books/:id",
+  operationId: "getBookById",
+  tags: ["Books"],
+  request: { params: z.object({ id: z.string() }) },
+  responses: {
+    200: { description: "Found", body: z.object({ id: z.string(), title: z.string() }) },
+    404: { description: "Not found" },
+  },
+  handler: async ({ params }) => ({
+    status: 200,
+    body: { id: params.id, title: `Book ${params.id}` },
+  }),
+});
+
+serve(app, { port: 3000 });
+```
+
+---
+
+## OpenAPI + Hey API typed client
+
+DaloyJS produces a clean OpenAPI 3.1 document with **zero plugins**, then [@hey-api/openapi-ts](https://heyapi.dev/openapi-ts/get-started) turns that into a fully typed TypeScript SDK that any consumer (your web app, mobile RN bundle, internal CLI) can drop in.
+
+```bash
+pnpm gen          # writes generated/openapi.json + generated/client/
+```
+
+That single command runs the two scripts:
+
+```jsonc
+// package.json
+"scripts": {
+  "gen:openapi": "node --import tsx scripts/dump-openapi.ts",
+  "gen:client":  "openapi-ts",
+  "gen":         "pnpm gen:openapi && pnpm gen:client"
+}
+```
+
+`openapi-ts.config.ts`:
+
+```ts
+import { defineConfig } from "@hey-api/openapi-ts";
+export default defineConfig({
+  input:  "./generated/openapi.json",
+  output: { path: "./generated/client", postProcess: ["prettier"] },
+  plugins: ["@hey-api/client-fetch", "@hey-api/typescript", "@hey-api/sdk"],
+});
+```
+
+For TypeScript consumers in the same monorepo you can skip codegen entirely and use the **in-process typed client**:
+
+```ts
+import { createClient } from "daloy/client";
+const client = createClient(app, { baseUrl: "http://localhost:3000" });
+const r = await client.getBookById({ params: { id: "1" } });
+//    ^? { status: 200; body: { id: string; title: string } } | { status: 404; ... }
+```
+
+---
+
+## Built-in docs UI (Scalar / Swagger UI)
+
+```ts
+import { scalarHtml, htmlResponse } from "daloy/docs";
+// returns a self-contained HTML page that loads /openapi.json
+```
+
+Mount at `/docs` and the UI is always contract-accurate — never stale.
+
+---
+
+## Security defaults (no plugins required)
+
+| Threat | Default behavior |
+|---|---|
+| **Body-size DoS** | Streamed read, hard cap (default 1 MiB), `Content-Length` checked first. |
+| **Prototype pollution** | `safeJsonParse` strips `__proto__` / `constructor` / `prototype` via reviver. |
+| **Header / response splitting** | `sanitizeHeaderName` / `sanitizeHeaderValue` reject CRLF + NUL. |
+| **Path traversal** | Router rejects `..` segments and `//` before walking. |
+| **Slow-loris / hung handlers** | `requestTimeoutMs` aborts handlers (default 30 s); Node adapter sets `requestTimeout` + `headersTimeout` + `maxHeaderSize`. |
+| **MIME sniffing** | `secureHeaders()` sets `X-Content-Type-Options: nosniff`. |
+| **Clickjacking** | `X-Frame-Options: DENY` + CSP `frame-ancestors 'none'`. |
+| **XSS via injected scripts** | Strict CSP `default-src 'self'` baseline. |
+| **Cross-origin leakage** | `cross-origin-opener-policy` + `cross-origin-resource-policy` set to `same-origin`. |
+| **Information disclosure (5xx)** | Production mode strips `detail` from 5xx problem+json automatically. |
+| **Credential timing attacks** | `timingSafeEqual()` for tokens & signatures. |
+| **Brute-force / scraping** | `rateLimit()` with token-bucket + `Retry-After`. |
+| **Method confusion** | Real **405** with `Allow` header, not a misleading 404. |
+| **CORS misconfig** | Explicit allowlist; never `*` with credentials. |
+| **Request correlation** | Cryptographic `randomId()` request ids on every response. |
+| **Supply chain** | Distributed via pnpm with hardening `.npmrc`; reproducible lockfile; opt-in `ignore-scripts` + `minimum-release-age`. |
+
+---
+
+## Performance
+
+```text
+$ pnpm bench
+static route lookup        12,363,799 ops/sec
+dynamic 4-segment lookup    1,513,983 ops/sec
+miss                        4,763,878 ops/sec
+```
+
+- Static (no-param) routes resolve via a single `Map.get` — **~12M ops/sec**.
+- Dynamic routes walk a trie, **O(path-segments)** regardless of route count.
+- Body parsing is lazy and only runs when a route declares a body schema.
+- No regex on the hot path.
+
+---
+
+## Test client + contract tests
+
+```ts
+const res = await app.request("/books/1");
+
+import { runContractTests } from "daloy/contract";
+const report = await runContractTests(app);
+if (!report.ok) process.exit(1);
+```
+
+The contract runner verifies that declared examples actually match their schemas, flags duplicate/missing operationIds, dead routes, and accidental body schemas on safe methods.
+
+---
+
+## Plugin encapsulation (Fastify-style)
+
+```ts
+const usersPlugin = {
+  name: "users",
+  register(app) {
+    app.route({ method: "GET", path: "/me", operationId: "me",
+      responses: { 200: { description: "ok" } },
+      handler: async () => ({ status: 200, body: { user: "alice" } }) });
+  },
+};
+app.register(usersPlugin, { prefix: "/users", tags: ["Users"] });
+await app.ready();
+```
+
+---
+
+## Multi-runtime
+
+```ts
+import { serve } from "daloy/node";          // Node
+import { serve } from "daloy/bun";           // Bun
+import { serve } from "daloy/deno";          // Deno
+import { toFetchHandler } from "daloy/cloudflare"; // Cloudflare Workers
+import { toEdgeHandler }  from "daloy/vercel";     // Vercel Edge / Next.js
+```
+
+The core only ever sees `Request → Response`. Adapters live at the edge.
+
+---
+
+## References
+
+- Hey API — typed OpenAPI client codegen: <https://heyapi.dev/openapi-ts/get-started>
+- Hono — portable web-standard router: <https://hono.dev/docs/>
+- Elysia — TS-first DX & typed context: <https://elysiajs.com/at-glance.html>
+- Fastify — production Node web framework: <https://fastify.dev/docs/latest/Reference/>
+- pnpm — strict, secure, content-addressable package manager: <https://pnpm.io/motivation>
+- Standard Schema — universal validator interface: <https://github.com/standard-schema/standard-schema>
+- RFC 9457 — Problem Details for HTTP APIs: <https://www.rfc-editor.org/rfc/rfc9457>
+
+---
+
+## Status & roadmap
+
+**Implemented (v0.1):**
+
+- [x] Trie router with static fast path + 405 with `Allow` + traversal guard
+- [x] Contract-first `app.route()`, groups, encapsulated plugins, decorators
+- [x] Standard Schema validation (Zod 4 / Valibot / ArkType / TypeBox)
+- [x] Problem+json error model with prod-mode redaction
+- [x] OpenAPI 3.1 generator (built-in)
+- [x] In-process test client + contract-test runner
+- [x] In-process typed client factory + Hey API codegen integration (`pnpm gen`)
+- [x] Node / Bun / Deno / Cloudflare / Vercel adapters
+- [x] Security: body limits, content-type allowlist, prototype-pollution-safe JSON, path-traversal rejection, request timeout, header injection guards
+- [x] Security middleware: `secureHeaders` / `cors` / `rateLimit` / `requestId` / `bearerAuth` / `timing` / `timingSafeEqual`
+- [x] Pluggable structured logger + request id propagation
+- [x] Graceful shutdown
+- [x] Mock mode
+- [x] Scalar + Swagger UI handlers
+- [x] **pnpm-first distribution with hardened `.npmrc`**
+
+**Next:**
+
+- [ ] WebSocket primitives + adapter coverage
+- [ ] Streaming response helpers (SSE, NDJSON)
+- [ ] CSRF helper
+- [ ] CLI: route inspector, schema inspector, dead-route detector
+- [ ] OpenTelemetry tracing hook
+- [ ] HTTP/2 + HTTP/3 adapters
+
+## License
+
+MIT

package/dist/adapters/bun.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Bun adapter — `Bun.serve` already speaks web-standard fetch,
+ * so this is the smallest possible wrapper.
+ */
+import type { App } from "../app.js";
+export interface BunServeOptions {
+    port?: number;
+    hostname?: string;
+    /** Maximum request body bytes (Bun-level cap). Default: 16 MiB. */
+    maxRequestBodySize?: number;
+}
+export declare function serve(app: App, opts?: BunServeOptions): {
+    stop: () => Promise<void>;
+    port: number;
+};
+//# sourceMappingURL=bun.d.ts.map

package/dist/adapters/bun.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bun.d.ts","sourceRoot":"","sources":["../../src/adapters/bun.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAErC,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAgB,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,GAAE,eAAoB,GAAG;IAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CA0BvG"}

package/dist/adapters/bun.js

@@ -0,0 +1,25 @@
+export function serve(app, opts = {}) {
+    const Bun = globalThis.Bun;
+    if (!Bun?.serve)
+        throw new Error("Bun runtime not detected");
+    const server = Bun.serve({
+        port: opts.port ?? 3000,
+        hostname: opts.hostname ?? "0.0.0.0",
+        maxRequestBodySize: opts.maxRequestBodySize ?? 16 * 1024 * 1024,
+        fetch: (req) => app.fetch(req),
+        error: (err) => new Response(JSON.stringify({
+            type: "https://daloyjs.dev/errors/internal",
+            title: "Internal Server Error",
+            status: 500,
+            detail: err.message,
+        }), { status: 500, headers: { "content-type": "application/problem+json" } }),
+    });
+    return {
+        port: server.port,
+        stop: async () => {
+            await app.shutdown();
+            server.stop(true);
+        },
+    };
+}
+//# sourceMappingURL=bun.js.map

package/dist/adapters/bun.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bun.js","sourceRoot":"","sources":["../../src/adapters/bun.ts"],"names":[],"mappings":"AAaA,MAAM,UAAU,KAAK,CAAC,GAAQ,EAAE,OAAwB,EAAE;IACxD,MAAM,GAAG,GAAI,UAAkB,CAAC,GAAG,CAAC;IACpC,IAAI,CAAC,GAAG,EAAE,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC;QACvB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,SAAS;QACpC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI;QAC/D,KAAK,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;QACvC,KAAK,EAAE,CAAC,GAAU,EAAE,EAAE,CACpB,IAAI,QAAQ,CACV,IAAI,CAAC,SAAS,CAAC;YACb,IAAI,EAAE,qCAAqC;YAC3C,KAAK,EAAE,uBAAuB;YAC9B,MAAM,EAAE,GAAG;YACX,MAAM,EAAE,GAAG,CAAC,OAAO;SACpB,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,EAAE,CACzE;KACJ,CAAC,CAAC;IACH,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/adapters/cloudflare.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Cloudflare Workers / generic fetch handler adapter.
+ *
+ * Usage:
+ *   export default toFetchHandler(app);
+ */
+import type { App } from "../app.js";
+export declare function toFetchHandler(app: App): {
+    fetch: (req: Request, env?: unknown, ctx?: unknown) => Promise<Response>;
+};
+//# sourceMappingURL=cloudflare.d.ts.map

package/dist/adapters/cloudflare.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare.d.ts","sourceRoot":"","sources":["../../src/adapters/cloudflare.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAErC,wBAAgB,cAAc,CAAC,GAAG,EAAE,GAAG,GAAG;IAAE,KAAK,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAAE,CAIrH"}

package/dist/adapters/cloudflare.js

@@ -0,0 +1,6 @@
+export function toFetchHandler(app) {
+    return {
+        fetch: (req) => app.fetch(req),
+    };
+}
+//# sourceMappingURL=cloudflare.js.map

package/dist/adapters/cloudflare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare.js","sourceRoot":"","sources":["../../src/adapters/cloudflare.ts"],"names":[],"mappings":"AAQA,MAAM,UAAU,cAAc,CAAC,GAAQ;IACrC,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;KAC/B,CAAC;AACJ,CAAC"}

package/dist/adapters/deno.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Deno adapter — `Deno.serve` is web-standard fetch.
+ */
+import type { App } from "../app.js";
+export interface DenoServeOptions {
+    port?: number;
+    hostname?: string;
+}
+export declare function serve(app: App, opts?: DenoServeOptions): {
+    shutdown: () => Promise<void>;
+};
+//# sourceMappingURL=deno.d.ts.map

package/dist/adapters/deno.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deno.d.ts","sourceRoot":"","sources":["../../src/adapters/deno.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAErC,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,GAAE,gBAAqB,GAAG;IAAE,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAa9F"}

package/dist/adapters/deno.js

@@ -0,0 +1,13 @@
+export function serve(app, opts = {}) {
+    const D = globalThis.Deno;
+    if (!D?.serve)
+        throw new Error("Deno runtime not detected");
+    const server = D.serve({ port: opts.port ?? 3000, hostname: opts.hostname ?? "0.0.0.0" }, (req) => app.fetch(req));
+    return {
+        shutdown: async () => {
+            await app.shutdown();
+            await server.shutdown?.();
+        },
+    };
+}
+//# sourceMappingURL=deno.js.map

package/dist/adapters/deno.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deno.js","sourceRoot":"","sources":["../../src/adapters/deno.ts"],"names":[],"mappings":"AAUA,MAAM,UAAU,KAAK,CAAC,GAAQ,EAAE,OAAyB,EAAE;IACzD,MAAM,CAAC,GAAI,UAAkB,CAAC,IAAI,CAAC;IACnC,IAAI,CAAC,CAAC,EAAE,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CACpB,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,SAAS,EAAE,EACjE,CAAC,GAAY,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CACjC,CAAC;IACF,OAAO;QACL,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC5B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/adapters/node.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Node adapter: translates IncomingMessage/ServerResponse to web-standard
+ * Request/Response. Includes graceful shutdown wired to SIGTERM/SIGINT.
+ */
+import { type Server } from "node:http";
+import type { App } from "../app.js";
+export interface NodeServerOptions {
+    port?: number;
+    hostname?: string;
+    /** Connection-level timeout in ms. Default: 30000. */
+    connectionTimeoutMs?: number;
+    /** Drain timeout for graceful shutdown. Default: 10000. */
+    shutdownTimeoutMs?: number;
+    /** Listen for SIGTERM/SIGINT and shut down. Default: true. */
+    handleSignals?: boolean;
+    /** Maximum HTTP header size bytes (DoS protection). Default: 16 KiB. */
+    maxHeaderBytes?: number;
+}
+export interface NodeServerHandle {
+    server: Server;
+    port: number;
+    close(): Promise<void>;
+}
+export declare function serve(app: App, opts?: NodeServerOptions): NodeServerHandle;
+//# sourceMappingURL=node.d.ts.map

package/dist/adapters/node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../src/adapters/node.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAA2D,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAEjG,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAErC,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,2DAA2D;IAC3D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,8DAA8D;IAC9D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,wBAAgB,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,GAAE,iBAAsB,GAAG,gBAAgB,CAmD9E"}

package/dist/adapters/node.js

@@ -0,0 +1,90 @@
+/**
+ * Node adapter: translates IncomingMessage/ServerResponse to web-standard
+ * Request/Response. Includes graceful shutdown wired to SIGTERM/SIGINT.
+ */
+import { createServer } from "node:http";
+import { Readable } from "node:stream";
+export function serve(app, opts = {}) {
+    const server = createServer({ maxHeaderSize: opts.maxHeaderBytes ?? 16 * 1024 }, async (req, res) => {
+        try {
+            const request = await toWebRequest(req);
+            const response = await app.fetch(request);
+            await sendWebResponse(response, res);
+        }
+        catch (e) {
+            if (!res.headersSent) {
+                res.statusCode = 500;
+                res.setHeader("content-type", "application/problem+json");
+                res.end(JSON.stringify({
+                    type: "https://daloyjs.dev/errors/internal",
+                    title: "Internal Server Error",
+                    status: 500,
+                }));
+            }
+            else {
+                res.destroy(e);
+            }
+        }
+    });
+    server.requestTimeout = opts.connectionTimeoutMs ?? 30_000;
+    server.headersTimeout = opts.connectionTimeoutMs ?? 30_000;
+    server.keepAliveTimeout = 5_000;
+    const port = opts.port ?? 3000;
+    const hostname = opts.hostname ?? "0.0.0.0";
+    server.listen(port, hostname);
+    let closed = false;
+    const close = async () => {
+        if (closed)
+            return;
+        closed = true;
+        await app.shutdown(opts.shutdownTimeoutMs ?? 10_000);
+        await new Promise((resolve, reject) => server.close((err) => (err ? reject(err) : resolve())));
+    };
+    if (opts.handleSignals !== false) {
+        const onSignal = (sig) => {
+            app.log.info({ sig }, "DaloyJS received signal, shutting down");
+            void close().then(() => process.exit(0));
+        };
+        process.once("SIGTERM", () => onSignal("SIGTERM"));
+        process.once("SIGINT", () => onSignal("SIGINT"));
+    }
+    return { server, port, close };
+}
+async function toWebRequest(req) {
+    const host = req.headers.host ?? "localhost";
+    const url = `http://${host}${req.url ?? "/"}`;
+    const headers = new Headers();
+    for (const [k, v] of Object.entries(req.headers)) {
+        if (v === undefined)
+            continue;
+        if (Array.isArray(v))
+            headers.set(k, v.join(", "));
+        else
+            headers.set(k, String(v));
+    }
+    const method = req.method ?? "GET";
+    const init = { method, headers };
+    if (method !== "GET" && method !== "HEAD") {
+        init.body = Readable.toWeb(req);
+        init.duplex = "half";
+    }
+    return new Request(url, init);
+}
+async function sendWebResponse(res, out) {
+    out.statusCode = res.status;
+    res.headers.forEach((v, k) => out.setHeader(k, v));
+    if (!res.body) {
+        out.end();
+        return;
+    }
+    const reader = res.body.getReader();
+    while (true) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        if (value)
+            out.write(value);
+    }
+    out.end();
+}
+//# sourceMappingURL=node.js.map

package/dist/adapters/node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.js","sourceRoot":"","sources":["../../src/adapters/node.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAsBvC,MAAM,UAAU,KAAK,CAAC,GAAQ,EAAE,OAA0B,EAAE;IAC1D,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE,GAAG,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClG,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;YACxC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC1C,MAAM,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;gBAC1D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,IAAI,EAAE,qCAAqC;oBAC3C,KAAK,EAAE,uBAAuB;oBAC9B,MAAM,EAAE,GAAG;iBACZ,CAAC,CACH,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,OAAO,CAAC,CAAU,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC,mBAAmB,IAAI,MAAM,CAAC;IAC3D,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC,mBAAmB,IAAI,MAAM,CAAC;IAC3D,MAAM,CAAC,gBAAgB,GAAG,KAAK,CAAC;IAEhC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;IAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC;IAC5C,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAE9B,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE;QACvB,IAAI,MAAM;YAAE,OAAO;QACnB,MAAM,GAAG,IAAI,CAAC;QACd,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,IAAI,MAAM,CAAC,CAAC;QACrD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAC1C,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CACvD,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,IAAI,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAE,EAAE;YAC/B,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,wCAAwC,CAAC,CAAC;YAChE,KAAK,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,CAAC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,GAAoB;IAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IAC7C,MAAM,GAAG,GAAG,UAAU,IAAI,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;IAC9C,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;;YAC9C,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IACnC,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC9C,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACzC,IAAY,CAAC,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;QAC1D,IAAY,CAAC,MAAM,GAAG,MAAM,CAAC;IAChC,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,GAAa,EAAE,GAAmB;IAC/D,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC;IAC5B,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACd,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACpC,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,IAAI,KAAK;YAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,GAAG,CAAC,GAAG,EAAE,CAAC;AACZ,CAAC"}

package/dist/adapters/vercel.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Vercel Edge / generic Web-standard handler.
+ *
+ * Usage in Next.js Route Handlers:
+ *   export const GET = (req) => app.fetch(req);
+ *   export const POST = (req) => app.fetch(req);
+ *
+ * Or just:
+ *   export default toEdgeHandler(app);
+ */
+import type { App } from "../app.js";
+export declare function toEdgeHandler(app: App): (req: Request) => Promise<Response>;
+//# sourceMappingURL=vercel.d.ts.map

package/dist/adapters/vercel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vercel.d.ts","sourceRoot":"","sources":["../../src/adapters/vercel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAErC,wBAAgB,aAAa,CAAC,GAAG,EAAE,GAAG,IAC5B,KAAK,OAAO,uBACrB"}

package/dist/adapters/vercel.js

@@ -0,0 +1,4 @@
+export function toEdgeHandler(app) {
+    return (req) => app.fetch(req);
+}
+//# sourceMappingURL=vercel.js.map

package/dist/adapters/vercel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vercel.js","sourceRoot":"","sources":["../../src/adapters/vercel.ts"],"names":[],"mappings":"AAYA,MAAM,UAAU,aAAa,CAAC,GAAQ;IACpC,OAAO,CAAC,GAAY,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC1C,CAAC"}