@daloyjs/core 0.1.0

package/dist/logger.js

@@ -0,0 +1,74 @@
+/**
+ * Pluggable logger interface.
+ *
+ * The default logger is a tiny structured JSON logger writing to stdout.
+ * Plug pino / winston / your own by implementing `Logger`.
+ */
+const LEVELS = {
+    trace: 10,
+    debug: 20,
+    info: 30,
+    warn: 40,
+    error: 50,
+    fatal: 60,
+};
+export function createLogger(opts = {}) {
+    const level = opts.level ?? "info";
+    const threshold = LEVELS[level];
+    const bindings = opts.bindings ?? {};
+    const write = opts.write ??
+        (typeof process !== "undefined" && process.stdout?.write
+            ? (line) => {
+                process.stdout.write(line + "\n");
+            }
+            : (line) => console.log(line));
+    function emit(lvl, obj, msg) {
+        if (LEVELS[lvl] < threshold)
+            return;
+        const base = {
+            level: lvl,
+            time: new Date().toISOString(),
+            ...bindings,
+        };
+        if (typeof obj === "string") {
+            base.msg = obj;
+        }
+        else {
+            Object.assign(base, obj);
+            if (msg !== undefined)
+                base.msg = msg;
+        }
+        try {
+            write(JSON.stringify(base));
+        }
+        catch {
+            write(`{"level":"${lvl}","time":"${base.time}","msg":"<unserializable log>"}`);
+        }
+    }
+    const logger = {
+        level,
+        trace: (o, m) => emit("trace", o, m),
+        debug: (o, m) => emit("debug", o, m),
+        info: (o, m) => emit("info", o, m),
+        warn: (o, m) => emit("warn", o, m),
+        error: (o, m) => emit("error", o, m),
+        fatal: (o, m) => emit("fatal", o, m),
+        child(extra) {
+            return createLogger({ level, bindings: { ...bindings, ...extra }, write });
+        },
+    };
+    return logger;
+}
+export const noopLogger = {
+    level: "fatal",
+    trace() { },
+    debug() { },
+    info() { },
+    warn() { },
+    error() { },
+    fatal() { },
+    child() {
+        return noopLogger;
+    },
+};
+//# sourceMappingURL=logger.js.map

package/dist/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAeH,MAAM,MAAM,GAA6B;IACvC,KAAK,EAAE,EAAE;IACT,KAAK,EAAE,EAAE;IACT,IAAI,EAAE,EAAE;IACR,IAAI,EAAE,EAAE;IACR,KAAK,EAAE,EAAE;IACT,KAAK,EAAE,EAAE;CACV,CAAC;AASF,MAAM,UAAU,YAAY,CAAC,OAA6B,EAAE;IAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC;IACnC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACrC,MAAM,KAAK,GACT,IAAI,CAAC,KAAK;QACV,CAAC,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK;YACtD,CAAC,CAAC,CAAC,IAAY,EAAE,EAAE;gBACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;YACpC,CAAC;YACH,CAAC,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAE3C,SAAS,IAAI,CAAC,GAAa,EAAE,GAAoB,EAAE,GAAY;QAC7D,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS;YAAE,OAAO;QACpC,MAAM,IAAI,GAA4B;YACpC,KAAK,EAAE,GAAG;YACV,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC9B,GAAG,QAAQ;SACZ,CAAC;QACF,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACzB,IAAI,GAAG,KAAK,SAAS;gBAAE,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACxC,CAAC;QACD,IAAI,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,aAAa,GAAG,aAAa,IAAI,CAAC,IAAI,iCAAiC,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAW;QACrB,KAAK;QACL,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACpC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAClC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACpC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACpC,KAAK,CAAC,KAAK;YACT,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7E,CAAC;KACF,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAW;IAChC,KAAK,EAAE,OAAO;IACd,KAAK,KAAI,CAAC;IACV,KAAK,KAAI,CAAC;IACV,IAAI,KAAI,CAAC;IACT,IAAI,KAAI,CAAC;IACT,KAAK,KAAI,CAAC;IACV,KAAK,KAAI,CAAC;IACV,KAAK;QACH,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC"}

package/dist/middleware.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Built-in security & operational middleware.
+ *
+ * All middlewares return `Hooks` objects so they compose with `app.use(...)`,
+ * groups, and per-route hooks identically.
+ */
+import type { Hooks, BaseContext } from "./types.js";
+import { timingSafeEqual } from "./security.js";
+export interface RequestIdOptions {
+    header?: string;
+    /** Trust an incoming header value (e.g. from a proxy). Default: false. */
+    trustIncoming?: boolean;
+    generator?: () => string;
+}
+export declare function requestId(opts?: RequestIdOptions): Hooks;
+export interface SecureHeadersOptions {
+    contentSecurityPolicy?: string | false;
+    hsts?: {
+        maxAgeSeconds: number;
+        includeSubDomains?: boolean;
+        preload?: boolean;
+    } | false;
+    frameOptions?: "DENY" | "SAMEORIGIN" | false;
+    referrerPolicy?: string | false;
+    permissionsPolicy?: string | false;
+    crossOriginOpenerPolicy?: string | false;
+    crossOriginResourcePolicy?: string | false;
+    noSniff?: boolean;
+    xssProtection?: boolean;
+}
+export declare function secureHeaders(opts?: SecureHeadersOptions): Hooks;
+export interface CorsOptions {
+    origin: string | string[] | ((origin: string) => boolean);
+    methods?: string[];
+    allowedHeaders?: string[];
+    exposedHeaders?: string[];
+    credentials?: boolean;
+    maxAgeSeconds?: number;
+}
+export declare function cors(opts: CorsOptions): Hooks;
+export interface RateLimitStore {
+    hit(key: string, windowMs: number): Promise<{
+        count: number;
+        resetMs: number;
+    }>;
+}
+export interface RateLimitOptions {
+    windowMs: number;
+    max: number;
+    keyGenerator?: (ctx: BaseContext<any, any>) => string;
+    store?: RateLimitStore;
+    /** When true, set Retry-After header on 429. Default: true. */
+    retryAfter?: boolean;
+}
+export declare function rateLimit(opts: RateLimitOptions): Hooks;
+export declare function timing(headerName?: string): Hooks;
+export declare function bearerAuth(opts: {
+    validate: (token: string) => boolean | Promise<boolean>;
+    realm?: string;
+}): Hooks;
+export { timingSafeEqual };
+//# sourceMappingURL=middleware.d.ts.map

package/dist/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAErD,OAAO,EAAY,eAAe,EAAE,MAAM,eAAe,CAAC;AAI1D,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC;CAC1B;AAED,wBAAgB,SAAS,CAAC,IAAI,GAAE,gBAAqB,GAAG,KAAK,CAgB5D;AAID,MAAM,WAAW,oBAAoB;IACnC,qBAAqB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACvC,IAAI,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,KAAK,CAAC;IACzF,YAAY,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,KAAK,CAAC;IAC7C,cAAc,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACnC,uBAAuB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACzC,yBAAyB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,wBAAgB,aAAa,CAAC,IAAI,GAAE,oBAAyB,GAAG,KAAK,CAsCpE;AAID,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC;IAC1D,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,KAAK,CA0C7C;AAID,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjF;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,MAAM,CAAC;IACtD,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAqBD,wBAAgB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,KAAK,CAwBvD;AAID,wBAAgB,MAAM,CAAC,UAAU,SAAkB,GAAG,KAAK,CAe1D;AAID,wBAAgB,UAAU,CAAC,IAAI,EAAE;IAC/B,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,KAAK,CA0BR;AAED,OAAO,EAAE,eAAe,EAAE,CAAC"}

package/dist/middleware.js

@@ -0,0 +1,201 @@
+/**
+ * Built-in security & operational middleware.
+ *
+ * All middlewares return `Hooks` objects so they compose with `app.use(...)`,
+ * groups, and per-route hooks identically.
+ */
+import { TooManyRequestsError, ForbiddenError } from "./errors.js";
+import { randomId, timingSafeEqual } from "./security.js";
+export function requestId(opts = {}) {
+    const header = (opts.header ?? "x-request-id").toLowerCase();
+    const gen = opts.generator ?? randomId;
+    return {
+        beforeHandle(ctx) {
+            const incoming = opts.trustIncoming ? ctx.request.headers.get(header) : null;
+            const id = incoming && /^[A-Za-z0-9._-]{1,200}$/.test(incoming) ? incoming : gen();
+            ctx.state.requestId = id;
+            ctx.set.headers.set(header, id);
+        },
+        onResponse(res) {
+            // Defence in depth: also stamp on responses produced by error paths.
+            // (No-op if already set.)
+            void res;
+        },
+    };
+}
+export function secureHeaders(opts = {}) {
+    const headers = {};
+    const csp = opts.contentSecurityPolicy ?? "default-src 'self'; frame-ancestors 'none'";
+    if (csp !== false)
+        headers["content-security-policy"] = csp;
+    const hsts = opts.hsts ?? { maxAgeSeconds: 31536000, includeSubDomains: true };
+    if (hsts !== false) {
+        let v = `max-age=${hsts.maxAgeSeconds}`;
+        if (hsts.includeSubDomains)
+            v += "; includeSubDomains";
+        if (hsts.preload)
+            v += "; preload";
+        headers["strict-transport-security"] = v;
+    }
+    const frame = opts.frameOptions ?? "DENY";
+    if (frame !== false)
+        headers["x-frame-options"] = frame;
+    const ref = opts.referrerPolicy ?? "no-referrer";
+    if (ref !== false)
+        headers["referrer-policy"] = ref;
+    const perm = opts.permissionsPolicy ?? "camera=(), microphone=(), geolocation=()";
+    if (perm !== false)
+        headers["permissions-policy"] = perm;
+    const coop = opts.crossOriginOpenerPolicy ?? "same-origin";
+    if (coop !== false)
+        headers["cross-origin-opener-policy"] = coop;
+    const corp = opts.crossOriginResourcePolicy ?? "same-origin";
+    if (corp !== false)
+        headers["cross-origin-resource-policy"] = corp;
+    if (opts.noSniff !== false)
+        headers["x-content-type-options"] = "nosniff";
+    if (opts.xssProtection ?? false)
+        headers["x-xss-protection"] = "0"; // modern guidance
+    return {
+        onResponse(res) {
+            for (const [k, v] of Object.entries(headers)) {
+                if (!res.headers.has(k))
+                    res.headers.set(k, v);
+            }
+        },
+    };
+}
+export function cors(opts) {
+    const allow = (origin) => {
+        if (!origin)
+            return null;
+        if (typeof opts.origin === "string")
+            return opts.origin === "*" || opts.origin === origin ? opts.origin : null;
+        if (Array.isArray(opts.origin))
+            return opts.origin.includes(origin) ? origin : null;
+        return opts.origin(origin) ? origin : null;
+    };
+    const methods = (opts.methods ?? ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"]).join(", ");
+    const allowedHeaders = (opts.allowedHeaders ?? ["content-type", "authorization"]).join(", ");
+    const exposed = opts.exposedHeaders?.join(", ");
+    const maxAge = String(opts.maxAgeSeconds ?? 600);
+    return {
+        beforeHandle(ctx) {
+            const origin = ctx.request.headers.get("origin");
+            const allowed = allow(origin);
+            if (allowed) {
+                ctx.set.headers.set("access-control-allow-origin", allowed);
+                ctx.set.headers.set("vary", "Origin");
+                if (opts.credentials)
+                    ctx.set.headers.set("access-control-allow-credentials", "true");
+                if (exposed)
+                    ctx.set.headers.set("access-control-expose-headers", exposed);
+            }
+            if (ctx.request.method === "OPTIONS") {
+                const h = new Headers();
+                if (allowed) {
+                    h.set("access-control-allow-origin", allowed);
+                    h.set("vary", "Origin");
+                    if (opts.credentials)
+                        h.set("access-control-allow-credentials", "true");
+                }
+                h.set("access-control-allow-methods", methods);
+                h.set("access-control-allow-headers", allowedHeaders);
+                h.set("access-control-max-age", maxAge);
+                return new Response(null, { status: 204, headers: h });
+            }
+            return undefined;
+        },
+        onResponse(res) {
+            // Mirror set headers onto the final response.
+            // (No-op if already present.)
+            void res;
+        },
+    };
+}
+class MemoryStore {
+    buckets = new Map();
+    async hit(key, windowMs) {
+        const now = Date.now();
+        const b = this.buckets.get(key);
+        if (!b || b.resetMs <= now) {
+            const fresh = { count: 1, resetMs: now + windowMs };
+            this.buckets.set(key, fresh);
+            // Opportunistic cleanup so the map can't grow without bound.
+            if (this.buckets.size > 10_000) {
+                for (const [k, v] of this.buckets)
+                    if (v.resetMs <= now)
+                        this.buckets.delete(k);
+            }
+            return fresh;
+        }
+        b.count++;
+        return b;
+    }
+}
+export function rateLimit(opts) {
+    const store = opts.store ?? new MemoryStore();
+    const keyOf = opts.keyGenerator ??
+        ((ctx) => ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ||
+            ctx.request.headers.get("x-real-ip") ||
+            "global");
+    return {
+        async beforeHandle(ctx) {
+            const key = keyOf(ctx);
+            const { count, resetMs } = await store.hit(key, opts.windowMs);
+            const remaining = Math.max(0, opts.max - count);
+            ctx.set.headers.set("x-ratelimit-limit", String(opts.max));
+            ctx.set.headers.set("x-ratelimit-remaining", String(remaining));
+            ctx.set.headers.set("x-ratelimit-reset", String(Math.ceil(resetMs / 1000)));
+            if (count > opts.max) {
+                const retry = Math.ceil((resetMs - Date.now()) / 1000);
+                throw new TooManyRequestsError(opts.retryAfter !== false ? retry : undefined);
+            }
+            return undefined;
+        },
+    };
+}
+// ---------- Timing ----------
+export function timing(headerName = "server-timing") {
+    const now = () => typeof performance !== "undefined" && performance.now ? performance.now() : Date.now();
+    return {
+        beforeHandle(ctx) {
+            ctx.state.__start = now();
+        },
+        afterHandle(ctx, value) {
+            const start = ctx.state.__start;
+            if (typeof start === "number") {
+                ctx.set.headers.set(headerName, `app;dur=${(now() - start).toFixed(2)}`);
+            }
+            return value;
+        },
+    };
+}
+// ---------- Bearer auth helper ----------
+export function bearerAuth(opts) {
+    return {
+        async beforeHandle(ctx) {
+            const h = ctx.request.headers.get("authorization") ?? "";
+            const m = /^Bearer\s+(.+)$/i.exec(h);
+            if (!m) {
+                return new Response(JSON.stringify({
+                    type: "https://daloyjs.dev/errors/unauthorized",
+                    title: "Unauthorized",
+                    status: 401,
+                }), {
+                    status: 401,
+                    headers: {
+                        "content-type": "application/problem+json",
+                        "www-authenticate": `Bearer realm="${opts.realm ?? "api"}"`,
+                    },
+                });
+            }
+            const ok = await opts.validate(m[1]);
+            if (!ok)
+                throw new ForbiddenError("Invalid token");
+            return undefined;
+        },
+    };
+}
+export { timingSafeEqual };
+//# sourceMappingURL=middleware.js.map

package/dist/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAW1D,MAAM,UAAU,SAAS,CAAC,OAAyB,EAAE;IACnD,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC;IACvC,OAAO;QACL,YAAY,CAAC,GAAG;YACd,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7E,MAAM,EAAE,GAAG,QAAQ,IAAI,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAClF,GAAG,CAAC,KAAiC,CAAC,SAAS,GAAG,EAAE,CAAC;YACtD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAClC,CAAC;QACD,UAAU,CAAC,GAAG;YACZ,qEAAqE;YACrE,0BAA0B;YAC1B,KAAK,GAAG,CAAC;QACX,CAAC;KACF,CAAC;AACJ,CAAC;AAgBD,MAAM,UAAU,aAAa,CAAC,OAA6B,EAAE;IAC3D,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,IAAI,4CAA4C,CAAC;IACvF,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,CAAC,yBAAyB,CAAC,GAAG,GAAG,CAAC;IAE5D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;IAC/E,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,GAAG,WAAW,IAAI,CAAC,aAAa,EAAE,CAAC;QACxC,IAAI,IAAI,CAAC,iBAAiB;YAAE,CAAC,IAAI,qBAAqB,CAAC;QACvD,IAAI,IAAI,CAAC,OAAO;YAAE,CAAC,IAAI,WAAW,CAAC;QACnC,OAAO,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC;IAC1C,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,KAAK,CAAC;IAExD,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,IAAI,aAAa,CAAC;IACjD,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,GAAG,CAAC;IAEpD,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,IAAI,0CAA0C,CAAC;IAClF,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAAC;IAEzD,MAAM,IAAI,GAAG,IAAI,CAAC,uBAAuB,IAAI,aAAa,CAAC;IAC3D,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,CAAC,4BAA4B,CAAC,GAAG,IAAI,CAAC;IAEjE,MAAM,IAAI,GAAG,IAAI,CAAC,yBAAyB,IAAI,aAAa,CAAC;IAC7D,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,CAAC,8BAA8B,CAAC,GAAG,IAAI,CAAC;IAEnE,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,CAAC,wBAAwB,CAAC,GAAG,SAAS,CAAC;IAC1E,IAAI,IAAI,CAAC,aAAa,IAAI,KAAK;QAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,GAAG,CAAC,CAAC,kBAAkB;IAEtF,OAAO;QACL,UAAU,CAAC,GAAG;YACZ,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;oBAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAaD,MAAM,UAAU,IAAI,CAAC,IAAiB;IACpC,MAAM,KAAK,GAAG,CAAC,MAAqB,EAAiB,EAAE;QACrD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/G,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QACpF,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClG,MAAM,cAAc,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7F,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,GAAG,CAAC,CAAC;IAEjD,OAAO;QACL,YAAY,CAAC,GAAG;YACd,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACjD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YAC9B,IAAI,OAAO,EAAE,CAAC;gBACZ,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,OAAO,CAAC,CAAC;gBAC5D,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACtC,IAAI,IAAI,CAAC,WAAW;oBAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;gBACtF,IAAI,OAAO;oBAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,OAAO,CAAC,CAAC;YAC7E,CAAC;YACD,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACrC,MAAM,CAAC,GAAG,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,OAAO,EAAE,CAAC;oBACZ,CAAC,CAAC,GAAG,CAAC,6BAA6B,EAAE,OAAO,CAAC,CAAC;oBAC9C,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;oBACxB,IAAI,IAAI,CAAC,WAAW;wBAAE,CAAC,CAAC,GAAG,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;gBAC1E,CAAC;gBACD,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,OAAO,CAAC,CAAC;gBAC/C,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;gBACtD,CAAC,CAAC,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;gBACxC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,UAAU,CAAC,GAAG;YACZ,8CAA8C;YAC9C,8BAA8B;YAC9B,KAAK,GAAG,CAAC;QACX,CAAC;KACF,CAAC;AACJ,CAAC;AAiBD,MAAM,WAAW;IACP,OAAO,GAAG,IAAI,GAAG,EAA8C,CAAC;IACxE,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,QAAgB;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,QAAQ,EAAE,CAAC;YACpD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC7B,6DAA6D;YAC7D,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,MAAM,EAAE,CAAC;gBAC/B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO;oBAAE,IAAI,CAAC,CAAC,OAAO,IAAI,GAAG;wBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAClF,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,CAAC,CAAC,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,CAAC;IACX,CAAC;CACF;AAED,MAAM,UAAU,SAAS,CAAC,IAAsB;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,WAAW,EAAE,CAAC;IAC9C,MAAM,KAAK,GACT,IAAI,CAAC,YAAY;QACjB,CAAC,CAAC,GAA0B,EAAE,EAAE,CAC9B,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;YACjE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YACpC,QAAQ,CAAC,CAAC;IAEd,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,GAAG;YACpB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;YACvB,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC;YAChD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YAChE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5E,IAAI,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACrB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;gBACvD,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAChF,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+BAA+B;AAE/B,MAAM,UAAU,MAAM,CAAC,UAAU,GAAG,eAAe;IACjD,MAAM,GAAG,GAAG,GAAW,EAAE,CACvB,OAAO,WAAW,KAAK,WAAW,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IACzF,OAAO;QACL,YAAY,CAAC,GAAG;YACb,GAAG,CAAC,KAAiC,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;QACzD,CAAC;QACD,WAAW,CAAC,GAAG,EAAE,KAAK;YACpB,MAAM,KAAK,GAAI,GAAG,CAAC,KAAiC,CAAC,OAA6B,CAAC;YACnF,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED,2CAA2C;AAE3C,MAAM,UAAU,UAAU,CAAC,IAG1B;IACC,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,GAAG;YACpB,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;YACzD,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACP,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;oBACb,IAAI,EAAE,yCAAyC;oBAC/C,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE,GAAG;iBACZ,CAAC,EACF;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE;wBACP,cAAc,EAAE,0BAA0B;wBAC1C,kBAAkB,EAAE,iBAAiB,IAAI,CAAC,KAAK,IAAI,KAAK,GAAG;qBAC5D;iBACF,CACF,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;YACtC,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,cAAc,CAAC,eAAe,CAAC,CAAC;YACnD,OAAO,SAAS,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,eAAe,EAAE,CAAC"}

package/dist/openapi.d.ts

@@ -0,0 +1,28 @@
+/**
+ * OpenAPI 3.1 document generator.
+ *
+ * Built-in (not a plugin afterthought) — that's the whole point.
+ *
+ * If a schema exposes a `toJSONSchema()` method (Zod 4, Valibot, etc.)
+ * we use it. Otherwise we emit a permissive `{}` placeholder rather than
+ * fail — codegen and docs still work, just with looser types for that field.
+ */
+import type { App } from "./app.js";
+export interface OpenAPIInfo {
+    title: string;
+    version: string;
+    description?: string;
+}
+export interface SecuritySchemeMap {
+    [name: string]: Record<string, unknown>;
+}
+export interface OpenAPIOptions {
+    info: OpenAPIInfo;
+    servers?: Array<{
+        url: string;
+        description?: string;
+    }>;
+    securitySchemes?: SecuritySchemeMap;
+}
+export declare function generateOpenAPI(app: App, options: OpenAPIOptions): Record<string, unknown>;
+//# sourceMappingURL=openapi.d.ts.map

package/dist/openapi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../src/openapi.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAIpC,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvD,eAAe,CAAC,EAAE,iBAAiB,CAAC;CACrC;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyC1F"}

package/dist/openapi.js

@@ -0,0 +1,178 @@
+/**
+ * OpenAPI 3.1 document generator.
+ *
+ * Built-in (not a plugin afterthought) — that's the whole point.
+ *
+ * If a schema exposes a `toJSONSchema()` method (Zod 4, Valibot, etc.)
+ * we use it. Otherwise we emit a permissive `{}` placeholder rather than
+ * fail — codegen and docs still work, just with looser types for that field.
+ */
+export function generateOpenAPI(app, options) {
+    const paths = {};
+    for (const route of app.routes) {
+        const oasPath = route.path.replace(/:([A-Za-z0-9_]+)/g, "{$1}");
+        paths[oasPath] ??= {};
+        paths[oasPath][route.method.toLowerCase()] = buildOperation(route);
+    }
+    return {
+        openapi: "3.1.0",
+        info: options.info,
+        ...(options.servers ? { servers: options.servers } : {}),
+        paths,
+        components: {
+            ...(options.securitySchemes ? { securitySchemes: options.securitySchemes } : {}),
+            schemas: {
+                Problem: {
+                    type: "object",
+                    required: ["type", "title", "status"],
+                    properties: {
+                        type: { type: "string", format: "uri" },
+                        title: { type: "string" },
+                        status: { type: "integer" },
+                        detail: { type: "string" },
+                        instance: { type: "string" },
+                        errors: {
+                            type: "array",
+                            items: {
+                                type: "object",
+                                properties: {
+                                    path: { type: "string" },
+                                    message: { type: "string" },
+                                },
+                            },
+                        },
+                    },
+                },
+            },
+        },
+    };
+}
+function buildOperation(route) {
+    const op = {
+        ...(route.operationId ? { operationId: route.operationId } : {}),
+        ...(route.summary ? { summary: route.summary } : {}),
+        ...(route.description ? { description: route.description } : {}),
+        ...(route.tags?.length ? { tags: route.tags } : {}),
+        ...(route.deprecated ? { deprecated: true } : {}),
+    };
+    const parameters = [];
+    // Path params: emit one entry per :name in the path.
+    const paramNames = [...route.path.matchAll(/:([A-Za-z0-9_]+)/g)].map((m) => m[1]);
+    for (const name of paramNames) {
+        parameters.push({
+            name,
+            in: "path",
+            required: true,
+            schema: extractPropertySchema(route.request?.params, name) ?? { type: "string" },
+        });
+    }
+    if (route.request?.query) {
+        const schema = toJsonSchema(route.request.query) ?? { type: "object" };
+        const props = schema.properties ?? {};
+        const required = schema.required ?? [];
+        for (const [name, propSchema] of Object.entries(props)) {
+            parameters.push({
+                name,
+                in: "query",
+                required: required.includes(name),
+                schema: propSchema,
+            });
+        }
+    }
+    if (parameters.length)
+        op.parameters = parameters;
+    if (route.request?.body) {
+        op.requestBody = {
+            required: true,
+            content: {
+                "application/json": { schema: toJsonSchema(route.request.body) ?? {} },
+            },
+        };
+    }
+    const responses = {};
+    const responseEntries = Object.entries(route.responses);
+    for (const [status, spec] of responseEntries) {
+        if (!spec)
+            continue;
+        responses[status] = {
+            description: spec.description,
+            ...(spec.body
+                ? {
+                    content: {
+                        "application/json": {
+                            schema: toJsonSchema(spec.body) ?? {},
+                            ...(spec.examples ? { examples: spec.examples } : {}),
+                        },
+                    },
+                }
+                : {}),
+        };
+    }
+    op.responses = responses;
+    if (route.auth) {
+        op.security = [{ [route.auth.scheme]: route.auth.scopes ?? [] }];
+    }
+    return op;
+}
+function toJsonSchema(schema) {
+    if (!schema)
+        return undefined;
+    const anySchema = schema;
+    // Zod 4 has `.toJSONSchema()`; Valibot/TypeBox vary by adapter/version.
+    if (typeof anySchema.toJSONSchema === "function") {
+        try {
+            return anySchema.toJSONSchema();
+        }
+        catch {
+            /* fall through */
+        }
+    }
+    if (anySchema._def && typeof anySchema._def === "object") {
+        // Zod fallback — tiny heuristic; real apps should pass `.toJSONSchema()`-capable schemas.
+        return zodFallback(anySchema);
+    }
+    return {};
+}
+function extractPropertySchema(schema, prop) {
+    if (!schema)
+        return undefined;
+    const js = toJsonSchema(schema);
+    return js?.properties?.[prop];
+}
+function zodFallback(z) {
+    const t = z._def?.typeName ?? z._def?.type;
+    switch (t) {
+        case "ZodString":
+        case "string":
+            return { type: "string" };
+        case "ZodNumber":
+        case "number":
+            return { type: "number" };
+        case "ZodBoolean":
+        case "boolean":
+            return { type: "boolean" };
+        case "object":
+        case "ZodObject": {
+            const shape = typeof z._def.shape === "function" ? z._def.shape() : z._def.shape;
+            const properties = {};
+            const required = [];
+            for (const [k, v] of Object.entries(shape)) {
+                properties[k] = zodFallback(v);
+                if (!v.isOptional?.())
+                    required.push(k);
+            }
+            return { type: "object", properties, required };
+        }
+        case "ZodArray":
+        case "array":
+            return { type: "array", items: zodFallback(z._def.element ?? z._def.type) };
+        case "ZodOptional":
+        case "optional":
+        case "ZodNullable":
+        case "nullable":
+            return zodFallback(z._def.innerType);
+        default:
+            return {};
+    }
+}
+//# sourceMappingURL=openapi.js.map

package/dist/openapi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.js","sourceRoot":"","sources":["../src/openapi.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAsBH,MAAM,UAAU,eAAe,CAAC,GAAQ,EAAE,OAAuB;IAC/D,MAAM,KAAK,GAA4C,EAAE,CAAC;IAE1D,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QAChE,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACtB,KAAK,CAAC,OAAO,CAAE,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IAED,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,KAAK;QACL,UAAU,EAAE;YACV,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,OAAO,EAAE;gBACP,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;oBACrC,UAAU,EAAE;wBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE;wBACvC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;wBAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBAC1B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBAC5B,MAAM,EAAE;4BACN,IAAI,EAAE,OAAO;4BACb,KAAK,EAAE;gCACL,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE;oCACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oCACxB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iCAC5B;6BACF;yBACF;qBACF;iBACF;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAA0C;IAChE,MAAM,EAAE,GAA4B;QAClC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;IAEF,MAAM,UAAU,GAAmC,EAAE,CAAC;IAEtD,qDAAqD;IACrD,MAAM,UAAU,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IACnF,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,UAAU,CAAC,IAAI,CAAC;YACd,IAAI;YACJ,EAAE,EAAE,MAAM;YACV,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,qBAAqB,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE;SACjF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACvE,MAAM,KAAK,GAAI,MAAc,CAAC,UAAU,IAAI,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAc,MAAc,CAAC,QAAQ,IAAI,EAAE,CAAC;QAC1D,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACvD,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI;gBACJ,EAAE,EAAE,OAAO;gBACX,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACjC,MAAM,EAAE,UAAU;aACnB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,MAAM;QAAE,EAAE,CAAC,UAAU,GAAG,UAAU,CAAC;IAElD,IAAI,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;QACxB,EAAE,CAAC,WAAW,GAAG;YACf,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE;gBACP,kBAAkB,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE;aACvE;SACF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAA4B,EAAE,CAAC;IAC9C,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAGpD,CAAC;IACH,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,eAAe,EAAE,CAAC;QAC7C,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,SAAS,CAAC,MAAM,CAAC,GAAG;YAClB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,GAAG,CAAC,IAAI,CAAC,IAAI;gBACX,CAAC,CAAC;oBACE,OAAO,EAAE;wBACP,kBAAkB,EAAE;4BAClB,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;4BACrC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBACtD;qBACF;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IACD,EAAE,CAAC,SAAS,GAAG,SAAS,CAAC;IAEzB,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACf,EAAE,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,YAAY,CAAC,MAAoC;IACxD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,SAAS,GAAG,MAAa,CAAC;IAChC,wEAAwE;IACxE,IAAI,OAAO,SAAS,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;QACjD,IAAI,CAAC;YACH,OAAO,SAAS,CAAC,YAAY,EAAE,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,IAAI,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACzD,0FAA0F;QAC1F,OAAO,WAAW,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,qBAAqB,CAC5B,MAAoC,EACpC,IAAY;IAEZ,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,CAAQ,CAAC;IACvC,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,WAAW,CAAC,CAAM;IACzB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC;IAC3C,QAAQ,CAAC,EAAE,CAAC;QACV,KAAK,WAAW,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC5B,KAAK,WAAW,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC5B,KAAK,YAAY,CAAC;QAClB,KAAK,SAAS;YACZ,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,KAAK,QAAQ,CAAC;QACd,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;YACjF,MAAM,UAAU,GAA4B,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAM,KAAK,CAAC,EAAE,CAAC;gBAChD,UAAU,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;gBAC/B,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,EAAE;oBAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1C,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;QAClD,CAAC;QACD,KAAK,UAAU,CAAC;QAChB,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9E,KAAK,aAAa,CAAC;QACnB,KAAK,UAAU,CAAC;QAChB,KAAK,aAAa,CAAC;QACnB,KAAK,UAAU;YACb,OAAO,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC;YACE,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/router.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Trie / radix-style router with a static-route fast path.
+ *
+ * Performance:
+ *   - Static (parameter-free) paths resolve via a single Map.get — O(1).
+ *   - Dynamic paths walk a trie, O(path-segments) regardless of route count.
+ *   - Path string is split by `indexOf` rather than a regex/replace.
+ *
+ * Safety:
+ *   - Path traversal (`..`) and empty segments are rejected at lookup time.
+ *   - Duplicate routes and duplicate operationIds throw at registration.
+ *   - Wildcard segments must be terminal.
+ */
+import type { HttpMethod } from "./types.js";
+export interface RouteMatch<T> {
+    handler: T;
+    params: Record<string, string>;
+}
+export declare class Router<T> {
+    private root;
+    private operationIds;
+    /** Static (no-param/no-wildcard) routes for O(1) lookup. */
+    private staticTable;
+    add(method: HttpMethod, path: string, handler: T, operationId?: string): void;
+    find(method: HttpMethod, path: string): RouteMatch<T> | undefined;
+    /** Returns the set of methods registered at this exact path (for 405 responses). */
+    allowedMethods(path: string): HttpMethod[];
+    private walk;
+}
+//# sourceMappingURL=router.d.ts.map

package/dist/router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,WAAW,UAAU,CAAC,CAAC;IAC3B,OAAO,EAAE,CAAC,CAAC;IACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAaD,qBAAa,MAAM,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAmB;IAC/B,OAAO,CAAC,YAAY,CAAqB;IACzC,4DAA4D;IAC5D,OAAO,CAAC,WAAW,CAAqD;IAExE,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI;IAsD7E,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,SAAS;IAsBjE,oFAAoF;IACpF,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,EAAE;IAS1C,OAAO,CAAC,IAAI;CA0Bb"}