@daloyjs/core 0.1.0

package/dist/router.js

@@ -0,0 +1,135 @@
+/**
+ * Trie / radix-style router with a static-route fast path.
+ *
+ * Performance:
+ *   - Static (parameter-free) paths resolve via a single Map.get — O(1).
+ *   - Dynamic paths walk a trie, O(path-segments) regardless of route count.
+ *   - Path string is split by `indexOf` rather than a regex/replace.
+ *
+ * Safety:
+ *   - Path traversal (`..`) and empty segments are rejected at lookup time.
+ *   - Duplicate routes and duplicate operationIds throw at registration.
+ *   - Wildcard segments must be terminal.
+ */
+function createNode() {
+    return { children: new Map(), handlers: {} };
+}
+export class Router {
+    root = createNode();
+    operationIds = new Set();
+    /** Static (no-param/no-wildcard) routes for O(1) lookup. */
+    staticTable = new Map();
+    add(method, path, handler, operationId) {
+        if (operationId) {
+            if (this.operationIds.has(operationId)) {
+                throw new Error(`Duplicate operationId: "${operationId}"`);
+            }
+            this.operationIds.add(operationId);
+        }
+        const segments = splitPath(path);
+        const isStatic = segments.every((s) => !s.startsWith(":") && !s.startsWith("*"));
+        const normalized = "/" + segments.join("/");
+        if (isStatic) {
+            let entry = this.staticTable.get(normalized);
+            if (!entry) {
+                entry = {};
+                this.staticTable.set(normalized, entry);
+            }
+            if (entry[method])
+                throw new Error(`Duplicate route: ${method} ${path}`);
+            entry[method] = handler;
+            return;
+        }
+        let node = this.root;
+        for (const seg of segments) {
+            if (seg.startsWith(":")) {
+                const name = seg.slice(1);
+                if (!node.paramChild) {
+                    node.paramChild = { name, node: createNode() };
+                }
+                else if (node.paramChild.name !== name) {
+                    throw new Error(`Conflicting param names at same position: "${node.paramChild.name}" vs "${name}"`);
+                }
+                node = node.paramChild.node;
+            }
+            else if (seg.startsWith("*")) {
+                const name = seg.length > 1 ? seg.slice(1) : "wildcard";
+                node.wildcardChild = { name, node: createNode() };
+                node = node.wildcardChild.node;
+                break;
+            }
+            else {
+                let next = node.children.get(seg);
+                if (!next) {
+                    next = createNode();
+                    node.children.set(seg, next);
+                }
+                node = next;
+            }
+        }
+        if (node.handlers[method])
+            throw new Error(`Duplicate route: ${method} ${path}`);
+        node.handlers[method] = handler;
+    }
+    find(method, path) {
+        // Reject path traversal attempts before walking.
+        if (path.includes("/../") || path.endsWith("/..") || path.includes("//")) {
+            return undefined;
+        }
+        // Static fast path.
+        const normalized = path.replace(/\/+$/, "") || "/";
+        const staticEntry = this.staticTable.get(normalized);
+        if (staticEntry && staticEntry[method]) {
+            return { handler: staticEntry[method], params: {} };
+        }
+        const segments = splitPath(path);
+        const params = {};
+        const found = this.walk(this.root, segments, 0, params);
+        if (!found)
+            return undefined;
+        const handler = found.handlers[method];
+        if (!handler)
+            return undefined;
+        return { handler, params };
+    }
+    /** Returns the set of methods registered at this exact path (for 405 responses). */
+    allowedMethods(path) {
+        const normalized = path.replace(/\/+$/, "") || "/";
+        const fromStatic = this.staticTable.get(normalized);
+        if (fromStatic)
+            return Object.keys(fromStatic);
+        const segments = splitPath(path);
+        const found = this.walk(this.root, segments, 0, {});
+        return found ? Object.keys(found.handlers) : [];
+    }
+    walk(node, segs, i, params) {
+        if (i === segs.length)
+            return node;
+        const seg = segs[i];
+        const staticNext = node.children.get(seg);
+        if (staticNext) {
+            const r = this.walk(staticNext, segs, i + 1, params);
+            if (r)
+                return r;
+        }
+        if (node.paramChild) {
+            params[node.paramChild.name] = decodeURIComponent(seg);
+            const r = this.walk(node.paramChild.node, segs, i + 1, params);
+            if (r)
+                return r;
+            delete params[node.paramChild.name];
+        }
+        if (node.wildcardChild) {
+            params[node.wildcardChild.name] = segs.slice(i).map(decodeURIComponent).join("/");
+            return node.wildcardChild.node;
+        }
+        return undefined;
+    }
+}
+function splitPath(path) {
+    const clean = path.replace(/\/+$/, "") || "/";
+    if (clean === "/")
+        return [];
+    return clean.replace(/^\//, "").split("/");
+}
+//# sourceMappingURL=router.js.map

package/dist/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAgBH,SAAS,UAAU;IACjB,OAAO,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,OAAO,MAAM;IACT,IAAI,GAAG,UAAU,EAAK,CAAC;IACvB,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,4DAA4D;IACpD,WAAW,GAAG,IAAI,GAAG,EAA0C,CAAC;IAExE,GAAG,CAAC,MAAkB,EAAE,IAAY,EAAE,OAAU,EAAE,WAAoB;QACpE,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CAAC,2BAA2B,WAAW,GAAG,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACjF,MAAM,UAAU,GAAG,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE5C,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,KAAK,GAAG,EAAE,CAAC;gBACX,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;YACzE,KAAK,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC;YACxB,OAAO;QACT,CAAC;QAED,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACrB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC1B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;oBACrB,IAAI,CAAC,UAAU,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAK,EAAE,CAAC;gBACpD,CAAC;qBAAM,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;oBACzC,MAAM,IAAI,KAAK,CACb,8CAA8C,IAAI,CAAC,UAAU,CAAC,IAAI,SAAS,IAAI,GAAG,CACnF,CAAC;gBACJ,CAAC;gBACD,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAC9B,CAAC;iBAAM,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;gBACxD,IAAI,CAAC,aAAa,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAK,EAAE,CAAC;gBACrD,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;gBAC/B,MAAM;YACR,CAAC;iBAAM,CAAC;gBACN,IAAI,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAClC,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,IAAI,GAAG,UAAU,EAAK,CAAC;oBACvB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC/B,CAAC;gBACD,IAAI,GAAG,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC;IAClC,CAAC;IAED,IAAI,CAAC,MAAkB,EAAE,IAAY;QACnC,iDAAiD;QACjD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACzE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,oBAAoB;QACpB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;QACnD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,CAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACvD,CAAC;QAED,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC7B,CAAC;IAED,oFAAoF;IACpF,cAAc,CAAC,IAAY;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;QACnD,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,UAAU;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAAiB,CAAC;QAC/D,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpD,OAAO,KAAK,CAAC,CAAC,CAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,CAAC;IAEO,IAAI,CACV,IAAa,EACb,IAAc,EACd,CAAS,EACT,MAA8B;QAE9B,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEnC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACrB,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;YACrD,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACvD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;YAC/D,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC;YAChB,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClF,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QACjC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;IAC9C,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IAC7B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC7C,CAAC"}

package/dist/schema.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Standard Schema v1 — minimal subset.
+ * https://github.com/standard-schema/standard-schema
+ *
+ * By coding to this interface, DaloyJS supports Zod, Valibot, ArkType,
+ * TypeBox-as-StandardSchema, and any future validator that exposes
+ * `~standard`. No vendor lock-in.
+ */
+export interface StandardSchemaV1<Input = unknown, Output = Input> {
+    readonly "~standard": StandardSchemaV1.Props<Input, Output>;
+}
+export declare namespace StandardSchemaV1 {
+    interface Props<Input = unknown, Output = Input> {
+        readonly version: 1;
+        readonly vendor: string;
+        readonly validate: (value: unknown) => Result<Output> | Promise<Result<Output>>;
+        readonly types?: Types<Input, Output>;
+    }
+    type Result<Output> = SuccessResult<Output> | FailureResult;
+    interface SuccessResult<Output> {
+        readonly value: Output;
+        readonly issues?: undefined;
+    }
+    interface FailureResult {
+        readonly issues: ReadonlyArray<Issue>;
+    }
+    interface Issue {
+        readonly message: string;
+        readonly path?: ReadonlyArray<PropertyKey | PathSegment>;
+    }
+    interface PathSegment {
+        readonly key: PropertyKey;
+    }
+    interface Types<Input, Output> {
+        readonly input: Input;
+        readonly output: Output;
+    }
+    type InferInput<S extends StandardSchemaV1> = NonNullable<S["~standard"]["types"]>["input"];
+    type InferOutput<S extends StandardSchemaV1> = NonNullable<S["~standard"]["types"]>["output"];
+}
+/** Validate any Standard-Schema-compatible schema. */
+export declare function validate<S extends StandardSchemaV1>(schema: S, value: unknown): Promise<StandardSchemaV1.Result<StandardSchemaV1.InferOutput<S>>>;
+/** Light-weight check for "looks like a Standard Schema". */
+export declare function isStandardSchema(x: unknown): x is StandardSchemaV1;
+//# sourceMappingURL=schema.d.ts.map

package/dist/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB,CAAC,KAAK,GAAG,OAAO,EAAE,MAAM,GAAG,KAAK;IAC/D,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;CAC7D;AAED,yBAAiB,gBAAgB,CAAC;IAChC,UAAiB,KAAK,CAAC,KAAK,GAAG,OAAO,EAAE,MAAM,GAAG,KAAK;QACpD,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,QAAQ,EAAE,CACjB,KAAK,EAAE,OAAO,KACX,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;KACvC;IAED,KAAY,MAAM,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,GAAG,aAAa,CAAC;IAEnE,UAAiB,aAAa,CAAC,MAAM;QACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;KAC7B;IAED,UAAiB,aAAa;QAC5B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;KACvC;IAED,UAAiB,KAAK;QACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,WAAW,GAAG,WAAW,CAAC,CAAC;KAC1D;IAED,UAAiB,WAAW;QAC1B,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC;KAC3B;IAED,UAAiB,KAAK,CAAC,KAAK,EAAE,MAAM;QAClC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;QACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB;IAED,KAAY,UAAU,CAAC,CAAC,SAAS,gBAAgB,IAC/C,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAChD,KAAY,WAAW,CAAC,CAAC,SAAS,gBAAgB,IAChD,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;CAClD;AAED,sDAAsD;AACtD,wBAAsB,QAAQ,CAAC,CAAC,SAAS,gBAAgB,EACvD,MAAM,EAAE,CAAC,EACT,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAGnE;AAED,6DAA6D;AAC7D,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,gBAAgB,CAOlE"}

package/dist/schema.js

@@ -0,0 +1,13 @@
+/** Validate any Standard-Schema-compatible schema. */
+export async function validate(schema, value) {
+    const r = schema["~standard"].validate(value);
+    return r instanceof Promise ? r : r;
+}
+/** Light-weight check for "looks like a Standard Schema". */
+export function isStandardSchema(x) {
+    return (!!x &&
+        typeof x === "object" &&
+        "~standard" in x &&
+        typeof x["~standard"]?.validate === "function");
+}
+//# sourceMappingURL=schema.js.map

package/dist/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAqDA,sDAAsD;AACtD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,MAAS,EACT,KAAc;IAEd,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,CAAC,YAAY,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAS,CAAC;AAC/C,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,gBAAgB,CAAC,CAAU;IACzC,OAAO,CACL,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,QAAQ;QACrB,WAAW,IAAK,CAAY;QAC5B,OAAQ,CAAS,CAAC,WAAW,CAAC,EAAE,QAAQ,KAAK,UAAU,CACxD,CAAC;AACJ,CAAC"}

package/dist/security.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Security primitives. Used by the App core and the public middleware.
+ *
+ * - readBodyLimited: streaming read with a hard byte cap (DoS protection).
+ * - safeJsonParse: JSON parser that strips __proto__ / constructor / prototype
+ *   keys to prevent prototype-pollution attacks.
+ * - sanitizeHeaderName / sanitizeHeaderValue: prevent CRLF header injection.
+ * - timingSafeEqual: constant-time string comparison for token checks.
+ * - randomId: cryptographically strong request id.
+ */
+/** Read a request body to bytes with a hard size cap. */
+export declare function readBodyLimited(req: Request, limit: number): Promise<Uint8Array>;
+/** JSON.parse that drops dangerous keys (prototype pollution defence). */
+export declare function safeJsonParse(text: string): unknown;
+export declare function sanitizeHeaderName(name: string): string;
+export declare function sanitizeHeaderValue(value: string): string;
+/** Constant-time string comparison. Use for tokens, signatures, etc. */
+export declare function timingSafeEqual(a: string, b: string): boolean;
+/** Cryptographically strong request id (URL-safe, ~22 chars). */
+export declare function randomId(): string;
+//# sourceMappingURL=security.d.ts.map

package/dist/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,yDAAyD;AACzD,wBAAsB,eAAe,CACnC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,UAAU,CAAC,CAsCrB;AAID,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAUnD;AAID,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKvD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMzD;AAED,wEAAwE;AACxE,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAO7D;AAED,iEAAiE;AACjE,wBAAgB,QAAQ,IAAI,MAAM,CAUjC"}

package/dist/security.js

@@ -0,0 +1,107 @@
+/**
+ * Security primitives. Used by the App core and the public middleware.
+ *
+ * - readBodyLimited: streaming read with a hard byte cap (DoS protection).
+ * - safeJsonParse: JSON parser that strips __proto__ / constructor / prototype
+ *   keys to prevent prototype-pollution attacks.
+ * - sanitizeHeaderName / sanitizeHeaderValue: prevent CRLF header injection.
+ * - timingSafeEqual: constant-time string comparison for token checks.
+ * - randomId: cryptographically strong request id.
+ */
+import { PayloadTooLargeError, BadRequestError, } from "./errors.js";
+/** Read a request body to bytes with a hard size cap. */
+export async function readBodyLimited(req, limit) {
+    // Trust Content-Length when present — fail fast.
+    const cl = req.headers.get("content-length");
+    if (cl) {
+        const n = Number(cl);
+        if (!Number.isFinite(n) || n < 0)
+            throw new BadRequestError("Invalid Content-Length");
+        if (n > limit)
+            throw new PayloadTooLargeError(limit);
+    }
+    if (!req.body)
+        return new Uint8Array(0);
+    const reader = req.body.getReader();
+    const chunks = [];
+    let total = 0;
+    // eslint-disable-next-line no-constant-condition
+    while (true) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        if (!value)
+            continue;
+        total += value.byteLength;
+        if (total > limit) {
+            try {
+                await reader.cancel();
+            }
+            catch {
+                /* ignore */
+            }
+            throw new PayloadTooLargeError(limit);
+        }
+        chunks.push(value);
+    }
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const c of chunks) {
+        out.set(c, offset);
+        offset += c.byteLength;
+    }
+    return out;
+}
+const FORBIDDEN_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+/** JSON.parse that drops dangerous keys (prototype pollution defence). */
+export function safeJsonParse(text) {
+    if (text.length === 0)
+        return undefined;
+    try {
+        return JSON.parse(text, (key, value) => {
+            if (FORBIDDEN_KEYS.has(key))
+                return undefined;
+            return value;
+        });
+    }
+    catch {
+        throw new BadRequestError("Invalid JSON");
+    }
+}
+const HEADER_NAME_RE = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+export function sanitizeHeaderName(name) {
+    if (!HEADER_NAME_RE.test(name)) {
+        throw new BadRequestError(`Invalid header name: ${name}`);
+    }
+    return name.toLowerCase();
+}
+export function sanitizeHeaderValue(value) {
+    // Block CRLF + NUL — the classic header / response splitting vector.
+    if (/[\r\n\0]/.test(value)) {
+        throw new BadRequestError("Invalid header value");
+    }
+    return value;
+}
+/** Constant-time string comparison. Use for tokens, signatures, etc. */
+export function timingSafeEqual(a, b) {
+    const len = Math.max(a.length, b.length);
+    let mismatch = a.length ^ b.length;
+    for (let i = 0; i < len; i++) {
+        mismatch |= (a.charCodeAt(i) || 0) ^ (b.charCodeAt(i) || 0);
+    }
+    return mismatch === 0;
+}
+/** Cryptographically strong request id (URL-safe, ~22 chars). */
+export function randomId() {
+    const c = globalThis.crypto;
+    if (c?.randomUUID)
+        return c.randomUUID();
+    if (c?.getRandomValues) {
+        const buf = new Uint8Array(16);
+        c.getRandomValues(buf);
+        return Array.from(buf, (b) => b.toString(16).padStart(2, "0")).join("");
+    }
+    // Last-resort fallback (should never trigger on Node 20+/Bun/Deno/Workers).
+    return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
+}
+//# sourceMappingURL=security.js.map

package/dist/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,oBAAoB,EACpB,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB,yDAAyD;AACzD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAY,EACZ,KAAa;IAEb,iDAAiD;IACjD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC7C,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,wBAAwB,CAAC,CAAC;QACtF,IAAI,CAAC,GAAG,KAAK;YAAE,MAAM,IAAI,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAExC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACpC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,iDAAiD;IACjD,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;QAC1B,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,MAAM,IAAI,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACnB,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;AAE1E,0EAA0E;AAC1E,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YACrC,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC9C,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAG,gCAAgC,CAAC;AAExD,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,eAAe,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,qEAAqE;IACrE,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,eAAe,CAAC,sBAAsB,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,QAAQ,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,QAAQ;IACtB,MAAM,CAAC,GAAwB,UAAkB,CAAC,MAAM,CAAC;IACzD,IAAI,CAAC,EAAE,UAAU;QAAE,OAAO,CAAC,CAAC,UAAU,EAAE,CAAC;IACzC,IAAI,CAAC,EAAE,eAAe,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAC/B,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,4EAA4E;IAC5E,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7E,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,98 @@
+import type { StandardSchemaV1 } from "./schema.js";
+/** HTTP methods supported by DaloyJS. */
+export type HttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS";
+/** A path string, e.g. "/books/:id". */
+export type PathString = `/${string}`;
+/** Extract path-parameter names from a route path. */
+export type ParamsOf<P extends string> = P extends `${string}:${infer Param}/${infer Rest}` ? Param | ParamsOf<`/${Rest}`> : P extends `${string}:${infer Param}` ? Param : never;
+/** Map of path params with all string values (raw). */
+export type PathParams<P extends string> = {
+    [K in ParamsOf<P>]: string;
+};
+export interface RequestSchemas {
+    params?: StandardSchemaV1;
+    query?: StandardSchemaV1;
+    headers?: StandardSchemaV1;
+    body?: StandardSchemaV1;
+}
+export type InferOut<S> = S extends StandardSchemaV1 ? StandardSchemaV1.InferOutput<S> : undefined;
+export type InferRequest<R extends RequestSchemas | undefined, P extends string> = {
+    params: R extends {
+        params: StandardSchemaV1;
+    } ? StandardSchemaV1.InferOutput<R["params"]> : PathParams<P>;
+    query: R extends {
+        query: StandardSchemaV1;
+    } ? StandardSchemaV1.InferOutput<R["query"]> : Record<string, string | string[] | undefined>;
+    headers: R extends {
+        headers: StandardSchemaV1;
+    } ? StandardSchemaV1.InferOutput<R["headers"]> : Record<string, string | undefined>;
+    body: R extends {
+        body: StandardSchemaV1;
+    } ? InferOut<R["body"]> : unknown;
+};
+export interface ResponseSpec {
+    description: string;
+    body?: StandardSchemaV1;
+    headers?: Record<string, {
+        description?: string;
+        schema?: StandardSchemaV1;
+    }>;
+    examples?: Record<string, unknown>;
+}
+export type ResponsesMap = {
+    [Status in number]?: ResponseSpec;
+};
+export type StatusOf<R extends ResponsesMap> = Extract<keyof R, number>;
+export type HandlerReturn<R extends ResponsesMap> = {
+    [S in StatusOf<R>]: {
+        status: S;
+        body: R[S] extends {
+            body: StandardSchemaV1;
+        } ? StandardSchemaV1.InferInput<NonNullable<R[S]>["body"] & StandardSchemaV1> : unknown;
+        headers?: Record<string, string>;
+    };
+}[StatusOf<R>];
+export interface AuthSpec {
+    /** Name referenced in OpenAPI components.securitySchemes */
+    scheme: string;
+    /** Optional scopes/permissions, surfaces in OpenAPI security requirement */
+    scopes?: string[];
+}
+export interface BaseContext<P extends string, R extends RequestSchemas | undefined> {
+    request: Request;
+    /** Validated request data (or raw fallbacks if no schema). */
+    params: InferRequest<R, P>["params"];
+    query: InferRequest<R, P>["query"];
+    headers: InferRequest<R, P>["headers"];
+    body: InferRequest<R, P>["body"];
+    /** Mutable per-request state. Plugin-augmented context lives here. */
+    state: Record<string, unknown>;
+    /** Convenience response helpers (do not bypass schema validation). */
+    set: {
+        status?: number;
+        headers: Headers;
+    };
+}
+export interface Hooks {
+    onRequest?: (req: Request) => void | Promise<void>;
+    beforeHandle?: (ctx: BaseContext<any, any>) => void | Response | Promise<void | Response>;
+    afterHandle?: (ctx: BaseContext<any, any>, result: unknown) => void | unknown | Promise<void | unknown>;
+    onError?: (err: unknown, ctx: BaseContext<any, any> | undefined) => void | Response | Promise<void | Response>;
+    onResponse?: (res: Response) => void | Promise<void>;
+}
+export interface RouteDefinition<P extends PathString = PathString, M extends HttpMethod = HttpMethod, Req extends RequestSchemas | undefined = undefined, Res extends ResponsesMap = ResponsesMap> {
+    method: M;
+    path: P;
+    operationId?: string;
+    summary?: string;
+    description?: string;
+    tags?: string[];
+    deprecated?: boolean;
+    version?: string;
+    request?: Req;
+    responses: Res;
+    auth?: AuthSpec;
+    hooks?: Hooks;
+    handler: (ctx: BaseContext<P, Req>) => HandlerReturn<Res> | Promise<HandlerReturn<Res>>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,yCAAyC;AACzC,MAAM,MAAM,UAAU,GAClB,KAAK,GACL,MAAM,GACN,KAAK,GACL,OAAO,GACP,QAAQ,GACR,MAAM,GACN,SAAS,CAAC;AAEd,wCAAwC;AACxC,MAAM,MAAM,UAAU,GAAG,IAAI,MAAM,EAAE,CAAC;AAEtC,sDAAsD;AACtD,MAAM,MAAM,QAAQ,CAAC,CAAC,SAAS,MAAM,IACnC,CAAC,SAAS,GAAG,MAAM,IAAI,MAAM,KAAK,IAAI,MAAM,IAAI,EAAE,GAC9C,KAAK,GAAG,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,GAC5B,CAAC,SAAS,GAAG,MAAM,IAAI,MAAM,KAAK,EAAE,GACpC,KAAK,GACL,KAAK,CAAC;AAEZ,uDAAuD;AACvD,MAAM,MAAM,UAAU,CAAC,CAAC,SAAS,MAAM,IAAI;KACxC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,GAAG,MAAM;CAC3B,CAAC;AAIF,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,IAAI,CAAC,EAAE,gBAAgB,CAAC;CACzB;AAED,MAAM,MAAM,QAAQ,CAAC,CAAC,IAAI,CAAC,SAAS,gBAAgB,GAChD,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,GAC/B,SAAS,CAAC;AAEd,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,cAAc,GAAG,SAAS,EAAE,CAAC,SAAS,MAAM,IAAI;IACjF,MAAM,EAAE,CAAC,SAAS;QAAE,MAAM,EAAE,gBAAgB,CAAA;KAAE,GAC1C,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GACzC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClB,KAAK,EAAE,CAAC,SAAS;QAAE,KAAK,EAAE,gBAAgB,CAAA;KAAE,GACxC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GACxC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IAClD,OAAO,EAAE,CAAC,SAAS;QAAE,OAAO,EAAE,gBAAgB,CAAA;KAAE,GAC5C,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAC1C,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACvC,IAAI,EAAE,CAAC,SAAS;QAAE,IAAI,EAAE,gBAAgB,CAAA;KAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC;CAC5E,CAAC;AAIF,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAAC;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,MAAM,YAAY,GAAG;KACxB,MAAM,IAAI,MAAM,CAAC,CAAC,EAAE,YAAY;CAClC,CAAC;AAEF,MAAM,MAAM,QAAQ,CAAC,CAAC,SAAS,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AAExE,MAAM,MAAM,aAAa,CAAC,CAAC,SAAS,YAAY,IAAI;KACjD,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,GAAG;QAClB,MAAM,EAAE,CAAC,CAAC;QACV,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;YAAE,IAAI,EAAE,gBAAgB,CAAA;SAAE,GACzC,gBAAgB,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,gBAAgB,CAAC,GACzE,OAAO,CAAC;QACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAClC;CACF,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAIf,MAAM,WAAW,QAAQ;IACvB,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAID,MAAM,WAAW,WAAW,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,cAAc,GAAG,SAAS;IACjF,OAAO,EAAE,OAAO,CAAC;IACjB,8DAA8D;IAC9D,MAAM,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACrC,KAAK,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACjC,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,sEAAsE;IACtE,GAAG,EAAE;QACH,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;CACH;AAID,MAAM,WAAW,KAAK;IACpB,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,IAAI,GAAG,QAAQ,GAAG,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,CAAC;IAC1F,WAAW,CAAC,EAAE,CACZ,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,EAC1B,MAAM,EAAE,OAAO,KACZ,IAAI,GAAG,OAAO,GAAG,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,CAAC;IAC9C,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,SAAS,KAAK,IAAI,GAAG,QAAQ,GAAG,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,CAAC;IAC/G,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD;AAID,MAAM,WAAW,eAAe,CAC9B,CAAC,SAAS,UAAU,GAAG,UAAU,EACjC,CAAC,SAAS,UAAU,GAAG,UAAU,EACjC,GAAG,SAAS,cAAc,GAAG,SAAS,GAAG,SAAS,EAClD,GAAG,SAAS,YAAY,GAAG,YAAY;IAEvC,MAAM,EAAE,CAAC,CAAC;IACV,IAAI,EAAE,CAAC,CAAC;IAGR,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,OAAO,CAAC,EAAE,GAAG,CAAC;IACd,SAAS,EAAE,GAAG,CAAC;IAEf,IAAI,CAAC,EAAE,QAAQ,CAAC;IAEhB,KAAK,CAAC,EAAE,KAAK,CAAC;IAEd,OAAO,EAAE,CACP,GAAG,EAAE,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,KACrB,aAAa,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;CACvD"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,108 @@
+{
+  "name": "@daloyjs/core",
+  "version": "0.1.0",
+  "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
+  "type": "module",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/daloyjs/daloy.git"
+  },
+  "homepage": "https://github.com/daloyjs/daloy#readme",
+  "bugs": {
+    "url": "https://github.com/daloyjs/daloy/issues"
+  },
+  "author": "DaloyJS",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "packageManager": "pnpm@11.1.2",
+  "engines": {
+    "node": ">=20.10.0",
+    "pnpm": ">=9.0.0"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./node": {
+      "types": "./dist/adapters/node.d.ts",
+      "import": "./dist/adapters/node.js"
+    },
+    "./bun": {
+      "types": "./dist/adapters/bun.d.ts",
+      "import": "./dist/adapters/bun.js"
+    },
+    "./deno": {
+      "types": "./dist/adapters/deno.d.ts",
+      "import": "./dist/adapters/deno.js"
+    },
+    "./cloudflare": {
+      "types": "./dist/adapters/cloudflare.d.ts",
+      "import": "./dist/adapters/cloudflare.js"
+    },
+    "./vercel": {
+      "types": "./dist/adapters/vercel.d.ts",
+      "import": "./dist/adapters/vercel.js"
+    },
+    "./client": {
+      "types": "./dist/client.d.ts",
+      "import": "./dist/client.js"
+    },
+    "./openapi": {
+      "types": "./dist/openapi.d.ts",
+      "import": "./dist/openapi.js"
+    },
+    "./docs": {
+      "types": "./dist/docs.d.ts",
+      "import": "./dist/docs.js"
+    },
+    "./contract": {
+      "types": "./dist/contract.d.ts",
+      "import": "./dist/contract.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "dev": "tsc -w -p tsconfig.json",
+    "example": "node --import tsx examples/basic.ts",
+    "bench": "node --import tsx bench/router.bench.ts",
+    "test": "node --import tsx --test tests/**/*.test.ts",
+    "typecheck": "tsc --noEmit",
+    "gen:openapi": "node --import tsx scripts/dump-openapi.ts",
+    "gen:client": "openapi-ts",
+    "gen": "pnpm gen:openapi && pnpm gen:client",
+    "audit": "pnpm audit --prod",
+    "prepublishOnly": "pnpm build"
+  },
+  "keywords": [
+    "framework",
+    "http",
+    "openapi",
+    "hey-api",
+    "contract-first",
+    "typescript",
+    "hono",
+    "elysia",
+    "fastify",
+    "fastapi",
+    "standard-schema",
+    "security",
+    "pnpm"
+  ],
+  "license": "MIT",
+  "devDependencies": {
+    "@hey-api/openapi-ts": "^0.97.1",
+    "@types/node": "^25.7.0",
+    "prettier": "^3.8.3",
+    "tsx": "^4.22.0",
+    "typescript": "^6.0.3",
+    "zod": "^4.4.3"
+  }
+}