@daloyjs/core 1.0.0-rc.2 → 1.0.0-rc.4

package/dist/cli.js

@@ -704,6 +704,44 @@ async function runDoctor(opts, io) {
                     "header-count amplification defence.",
             });
         }
+        // JSON structural limits audit. The new jsonMaxKeys / jsonMaxDepth
+        // guards protect against hash-flood / deep-nesting DoS inside the byte
+        // limit. Surface when disabled (0) or raised to an implausibly high
+        // value.
+        const jsonMaxKeys = o.jsonMaxKeys;
+        if (jsonMaxKeys === 0) {
+            findings.push({
+                level: "warn",
+                code: "audit.jsonMaxKeys.disabled",
+                message: "jsonMaxKeys is 0 — the wide-object / hash-flood structural limit " +
+                    "is disabled. An attacker can send tens or hundreds of thousands " +
+                    "of keys in a body that still fits under bodyLimitBytes.",
+            });
+        }
+        else if (typeof jsonMaxKeys === "number" && jsonMaxKeys > 100_000) {
+            findings.push({
+                level: "warn",
+                code: "audit.jsonMaxKeys.blanket",
+                message: `jsonMaxKeys is ${jsonMaxKeys} (> 100k). A cap this high weakens ` +
+                    "protection against wide-object DoS payloads.",
+            });
+        }
+        const jsonMaxDepth = o.jsonMaxDepth;
+        if (jsonMaxDepth === 0) {
+            findings.push({
+                level: "warn",
+                code: "audit.jsonMaxDepth.disabled",
+                message: "jsonMaxDepth is 0 — deep nesting DoS protection is disabled.",
+            });
+        }
+        else if (typeof jsonMaxDepth === "number" && jsonMaxDepth > 200) {
+            findings.push({
+                level: "warn",
+                code: "audit.jsonMaxDepth.blanket",
+                message: `jsonMaxDepth is ${jsonMaxDepth} (> 200). Extremely deep JSON is ` +
+                    "almost never legitimate and can amplify CPU during validation.",
+            });
+        }
         // Idle-timeout / request-timeout audit. Reaffirms the
         // existing requestTimeoutMs check; also surface an explicit zero
         // idleTimeoutMs in production. The framework also keeps adapter
@@ -921,7 +959,9 @@ function aiResponses(responses) {
     for (const [status, spec] of Object.entries(responses)) {
         if (!spec)
             continue;
-        const entry = { description: spec.description };
+        const entry = {
+            description: spec.description ?? `HTTP ${status} response`,
+        };
         if (spec.body)
             entry.body = aiSchema(spec.body);
         if (spec.examples)

package/dist/client.d.ts

@@ -19,11 +19,9 @@ export type RoutesOf<A extends App> = A["routes"][number];
  * the route's request and response schemas.
  *
  * The per-method types are recovered from the `App`'s accumulated route tuple,
- * which is built up as you **chain** `app.route(...)` calls. If the `App` type
- * is widened back to its bare default — e.g. a `const app: App` annotation, a
- * `: App` factory return type, or registering routes as separate statements
- * rather than a chain — the tuple is erased and this type collapses to an
- * untyped, string-indexed record.
+ * built by chained registrations or `app.registerRoutes([...])`. If the result
+ * is widened back to a bare `App` annotation, the tuple is intentionally erased
+ * and this type becomes a string-indexed record.
  */
 export type ClientFor<A extends App> = {
     [R in Extract<RoutesOf<A>, {
@@ -52,8 +50,15 @@ export interface ClientOptions {
     /** Default headers merged into every request (per-call `input.headers` wins). */
     headers?: Record<string, string>;
 }
+/** Options for {@link createInProcessClient}. */
+export interface InProcessClientOptions {
+    /** Synthetic absolute origin used while constructing requests. Default: `http://daloy.local`. */
+    baseUrl?: string;
+    /** Default headers merged into every request. Per-call headers win. */
+    headers?: Record<string, string>;
+}
 /**
- * Build a typed, in-process fetch client whose methods are keyed by
+ * Build a typed fetch client whose methods are keyed by
  * `operationId`. Parameters and response types are inferred from the same
  * route definitions registered on `app`, so the client and server cannot
  * drift apart at the type level.
@@ -66,11 +71,10 @@ export interface ClientOptions {
  * from the OpenAPI document instead.
  *
  * @remarks
- * The method signatures are inferred from the `App`'s accumulated route tuple,
- * so chain your `app.route(...)` registrations and let TypeScript infer the
- * variable's type. A widening `const app: App` annotation, a `: App` factory
- * return type, or registering routes as separate statements erases the
- * per-route types and yields an untyped client.
+ * The method signatures are inferred from the `App`'s accumulated route tuple.
+ * Chain registrations or compose independently exported contracts with
+ * `app.registerRoutes([...])`, and avoid widening the result to a bare `App`
+ * annotation because that deliberately discards the per-route tuple.
  *
  * @example
  * ```ts
@@ -96,4 +100,17 @@ export interface ClientOptions {
  * @since 0.1.0
  */
 export declare function createClient<A extends App>(app: A, opts: ClientOptions): ClientFor<A>;
+/**
+ * Build a typed client that dispatches directly through an App without
+ * opening a socket or binding a port.
+ *
+ * Requests still traverse the complete validation, middleware, security, and
+ * serialization pipeline through {@link "./app.js".App.fetch}.
+ *
+ * @param app - App whose registered route tuple drives the client surface.
+ * @param opts - Optional synthetic origin and default request headers.
+ * @returns A typed operation-id client backed by in-process dispatch.
+ * @since 1.0.0
+ */
+export declare function createInProcessClient<A extends App>(app: A, opts?: InProcessClientOptions): ClientFor<A>;
 export {};

package/dist/client.js

@@ -10,7 +10,7 @@
  * can still be generated from the OpenAPI doc for non-TS clients).
  */
 /**
- * Build a typed, in-process fetch client whose methods are keyed by
+ * Build a typed fetch client whose methods are keyed by
  * `operationId`. Parameters and response types are inferred from the same
  * route definitions registered on `app`, so the client and server cannot
  * drift apart at the type level.
@@ -23,11 +23,10 @@
  * from the OpenAPI document instead.
  *
  * @remarks
- * The method signatures are inferred from the `App`'s accumulated route tuple,
- * so chain your `app.route(...)` registrations and let TypeScript infer the
- * variable's type. A widening `const app: App` annotation, a `: App` factory
- * return type, or registering routes as separate statements erases the
- * per-route types and yields an untyped client.
+ * The method signatures are inferred from the `App`'s accumulated route tuple.
+ * Chain registrations or compose independently exported contracts with
+ * `app.registerRoutes([...])`, and avoid widening the result to a bare `App`
+ * annotation because that deliberately discards the per-route tuple.
  *
  * @example
  * ```ts
@@ -93,6 +92,30 @@ export function createClient(app, opts) {
     }
     return out;
 }
+/**
+ * Build a typed client that dispatches directly through an App without
+ * opening a socket or binding a port.
+ *
+ * Requests still traverse the complete validation, middleware, security, and
+ * serialization pipeline through {@link "./app.js".App.fetch}.
+ *
+ * @param app - App whose registered route tuple drives the client surface.
+ * @param opts - Optional synthetic origin and default request headers.
+ * @returns A typed operation-id client backed by in-process dispatch.
+ * @since 1.0.0
+ */
+export function createInProcessClient(app, opts = {}) {
+    const clientOptions = {
+        baseUrl: opts.baseUrl ?? "http://daloy.local",
+        fetch: (input, init) => {
+            const request = input instanceof Request ? input : new Request(input, init);
+            return app.fetch(request);
+        },
+    };
+    if (opts.headers)
+        clientOptions.headers = opts.headers;
+    return createClient(app, clientOptions);
+}
 function safeJson(text) {
     try {
         return JSON.parse(text);

package/dist/combine.d.ts

@@ -5,7 +5,7 @@
  *
  * @since 0.19.0
  */
-import type { Hooks, BaseContext } from "./types.js";
+import type { Hooks, BaseContext, PreBodyContext } from "./types.js";
 /**
  * Run every supplied {@link Hooks} bundle in order, pipeline-style.
  * Equivalent to passing the bundles to `app.use(...)` one after another,
@@ -13,7 +13,7 @@ import type { Hooks, BaseContext } from "./types.js";
  * stack for the admin section"). All lifecycle phases compose:
  *
  * - `onRequest` / `onResponse` run in registration order.
- * - `beforeHandle` / `onError` short-circuit on the first `Response`.
+ * - `preBody` / `beforeHandle` / `onError` short-circuit on the first `Response`.
  * - `afterHandle` / `onSend` thread the value through every bundle.
  *
  * Symbol-keyed security markers (CORS / CSRF / session / secure-headers)
@@ -35,14 +35,14 @@ import type { Hooks, BaseContext } from "./types.js";
  */
 export declare function every(...layers: Hooks[]): Hooks;
 /**
- * Run the supplied bundles until one of them passes its `beforeHandle`
+ * Run the supplied bundles until one of them passes its auth gate
  * check without throwing. Useful for "this route accepts a bearer token
  * OR a signed cookie OR an API key" patterns where any single proof of
  * identity is enough.
  *
  * Semantics:
  *
- * - The bundles' `beforeHandle` hooks are awaited in order. The first one
+ * - The bundles' `preBody` or `beforeHandle` hooks are awaited in order. The first one
  *   that resolves without throwing wins; its `ctx` mutations (headers,
  *   `ctx.state`, etc.) are preserved.
  * - When a bundle returns a `Response`, that response is treated as a
@@ -52,7 +52,7 @@ export declare function every(...layers: Hooks[]): Hooks;
  *   client gets a deterministic status code. Place the auth method whose
  *   `WWW-Authenticate` challenge you want clients to see first.
  * - `afterHandle`, `onSend`, `onResponse`, and `onError` from every bundle
- *   still compose normally — `some()` only changes the `beforeHandle`
+ *   still compose normally — `some()` only changes the auth-gate
  *   evaluation strategy.
  *
  * @example
@@ -63,8 +63,8 @@ export declare function every(...layers: Hooks[]): Hooks;
  * ));
  * ```
  *
- * @param layers Candidate hook bundles; the first `beforeHandle` that passes wins.
- * @returns A merged {@link Hooks} bundle with the OR-style `beforeHandle` strategy.
+ * @param layers Candidate hook bundles; the first auth gate that passes wins.
+ * @returns A merged {@link Hooks} bundle with an OR-style auth-gate strategy.
  * @since 0.19.0
  */
 export declare function some(...layers: Hooks[]): Hooks;
@@ -76,7 +76,7 @@ export declare function some(...layers: Hooks[]): Hooks;
  *
  * @since 0.19.0
  */
-export type ExceptPredicate = string | string[] | ((ctx: BaseContext<any, any>) => boolean | Promise<boolean>);
+export type ExceptPredicate = string | string[] | ((ctx: PreBodyContext<any> | BaseContext<any, any>) => boolean | Promise<boolean>);
 /**
  * Run a hook bundle on every request EXCEPT those matching `when`. The
  * canonical use is "apply auth everywhere except the public endpoints":
@@ -89,15 +89,15 @@ export type ExceptPredicate = string | string[] | ((ctx: BaseContext<any, any>)
  * ));
  * ```
  *
- * Only the `beforeHandle` phase is gated — the surrounding
+ * The `preBody` and `beforeHandle` phases are gated — the surrounding
  * `onRequest`/`afterHandle`/`onSend`/`onResponse` phases still run so
  * shared concerns like request-id propagation are not accidentally
  * exempted. Wrap each bundle with {@link except} individually when you
  * need to gate other phases.
  *
  * @param when Paths or predicate ({@link ExceptPredicate}) that exempt a request.
- * @param hooks The hook bundle whose `beforeHandle` is skipped on a match.
- * @returns A {@link Hooks} bundle whose `beforeHandle` is gated by `when`.
+ * @param hooks The hook bundle whose `preBody` and `beforeHandle` gates are skipped on a match.
+ * @returns A {@link Hooks} bundle whose request gates are controlled by `when`.
  * @throws Error at composition time if a string pattern does not start with `/`.
  * @since 0.19.0
  */

package/dist/combine.js

@@ -5,6 +5,7 @@
  *
  * @since 0.19.0
  */
+import { _mergePreBodyWithEarlyRejections, EARLY_REJECTION_HOOK_MARKER } from "./middleware.js";
 /**
  * Run every supplied {@link Hooks} bundle in order, pipeline-style.
  * Equivalent to passing the bundles to `app.use(...)` one after another,
@@ -12,7 +13,7 @@
  * stack for the admin section"). All lifecycle phases compose:
  *
  * - `onRequest` / `onResponse` run in registration order.
- * - `beforeHandle` / `onError` short-circuit on the first `Response`.
+ * - `preBody` / `beforeHandle` / `onError` short-circuit on the first `Response`.
  * - `afterHandle` / `onSend` thread the value through every bundle.
  *
  * Symbol-keyed security markers (CORS / CSRF / session / secure-headers)
@@ -36,14 +37,14 @@ export function every(...layers) {
     return mergeCombineHooks(layers);
 }
 /**
- * Run the supplied bundles until one of them passes its `beforeHandle`
+ * Run the supplied bundles until one of them passes its auth gate
  * check without throwing. Useful for "this route accepts a bearer token
  * OR a signed cookie OR an API key" patterns where any single proof of
  * identity is enough.
  *
  * Semantics:
  *
- * - The bundles' `beforeHandle` hooks are awaited in order. The first one
+ * - The bundles' `preBody` or `beforeHandle` hooks are awaited in order. The first one
  *   that resolves without throwing wins; its `ctx` mutations (headers,
  *   `ctx.state`, etc.) are preserved.
  * - When a bundle returns a `Response`, that response is treated as a
@@ -53,7 +54,7 @@ export function every(...layers) {
  *   client gets a deterministic status code. Place the auth method whose
  *   `WWW-Authenticate` challenge you want clients to see first.
  * - `afterHandle`, `onSend`, `onResponse`, and `onError` from every bundle
- *   still compose normally — `some()` only changes the `beforeHandle`
+ *   still compose normally — `some()` only changes the auth-gate
  *   evaluation strategy.
  *
  * @example
@@ -64,45 +65,65 @@ export function every(...layers) {
  * ));
  * ```
  *
- * @param layers Candidate hook bundles; the first `beforeHandle` that passes wins.
- * @returns A merged {@link Hooks} bundle with the OR-style `beforeHandle` strategy.
+ * @param layers Candidate hook bundles; the first auth gate that passes wins.
+ * @returns A merged {@link Hooks} bundle with an OR-style auth-gate strategy.
  * @since 0.19.0
  */
 export function some(...layers) {
     if (layers.length === 0)
         return {};
-    const stripped = layers.map(({ beforeHandle: _b, ...rest }) => rest);
+    const stripped = layers.map(({ preBody: _p, beforeHandle: _b, ...rest }) => rest);
     const base = mergeCombineHooks(stripped);
-    const candidates = layers
+    const preBodyCandidates = layers
+        .map((h) => h.preBody)
+        .filter((f) => typeof f === "function");
+    const beforeHandleCandidates = layers
         .map((h) => h.beforeHandle)
         .filter((f) => typeof f === "function");
+    const usePreBody = preBodyCandidates.length > 0 && beforeHandleCandidates.length === 0;
+    const candidates = usePreBody
+        ? preBodyCandidates
+        : layers.flatMap((hooks) => {
+            if (hooks.preBody && hooks.beforeHandle) {
+                return [
+                    async (ctx) => {
+                        const early = await hooks.preBody(ctx);
+                        return early instanceof Response ? early : hooks.beforeHandle(ctx);
+                    },
+                ];
+            }
+            const gate = hooks.preBody ?? hooks.beforeHandle;
+            return gate ? [gate] : [];
+        });
     if (candidates.length === 0)
         return base;
-    return {
-        ...base,
-        async beforeHandle(ctx) {
-            let firstFailure;
-            for (const fn of candidates) {
-                try {
-                    const r = await fn(ctx);
-                    if (r instanceof Response) {
-                        // Treat as a denial — try the next layer.
-                        if (!firstFailure)
-                            firstFailure = { kind: "response", res: r };
-                        continue;
-                    }
-                    // Undefined = pass; bundle accepts the request.
-                    return undefined;
-                }
-                catch (err) {
+    const runCandidates = async (ctx) => {
+        let firstFailure;
+        for (const fn of candidates) {
+            try {
+                const r = await fn(ctx);
+                if (r instanceof Response) {
                     if (!firstFailure)
-                        firstFailure = { kind: "throw", err };
+                        firstFailure = { kind: "response", res: r };
+                    continue;
                 }
+                return undefined;
+            }
+            catch (err) {
+                if (!firstFailure)
+                    firstFailure = { kind: "throw", err };
             }
-            if (firstFailure?.kind === "response")
-                return firstFailure.res;
-            throw firstFailure.err;
-        },
+        }
+        if (firstFailure?.kind === "response")
+            return firstFailure.res;
+        throw firstFailure.err;
+    };
+    if (usePreBody) {
+        return { ...base, preBody: runCandidates };
+    }
+    return {
+        ...base,
+        beforeHandle: runCandidates,
     };
 }
 /**
@@ -117,31 +138,41 @@ export function some(...layers) {
  * ));
  * ```
  *
- * Only the `beforeHandle` phase is gated — the surrounding
+ * The `preBody` and `beforeHandle` phases are gated — the surrounding
  * `onRequest`/`afterHandle`/`onSend`/`onResponse` phases still run so
  * shared concerns like request-id propagation are not accidentally
  * exempted. Wrap each bundle with {@link except} individually when you
  * need to gate other phases.
  *
  * @param when Paths or predicate ({@link ExceptPredicate}) that exempt a request.
- * @param hooks The hook bundle whose `beforeHandle` is skipped on a match.
- * @returns A {@link Hooks} bundle whose `beforeHandle` is gated by `when`.
+ * @param hooks The hook bundle whose `preBody` and `beforeHandle` gates are skipped on a match.
+ * @returns A {@link Hooks} bundle whose request gates are controlled by `when`.
  * @throws Error at composition time if a string pattern does not start with `/`.
  * @since 0.19.0
  */
 export function except(when, hooks) {
-    const matches = compileExceptMatcher(when);
-    const original = hooks.beforeHandle;
-    if (!original)
+    const earlyRejectionHooks = hooks[EARLY_REJECTION_HOOK_MARKER];
+    if (!hooks.preBody && !hooks.beforeHandle && !Array.isArray(earlyRejectionHooks))
         return hooks;
-    return {
-        ...hooks,
-        async beforeHandle(ctx) {
-            if (await matches(ctx))
-                return undefined;
-            return original(ctx);
-        },
-    };
+    const matches = compileExceptMatcher(when);
+    const wrapped = { ...hooks };
+    if (Array.isArray(earlyRejectionHooks)) {
+        wrapped[EARLY_REJECTION_HOOK_MARKER] =
+            earlyRejectionHooks.map((hook) => {
+                if (typeof hook !== "function")
+                    return hook;
+                return async (ctx) => (await matches(ctx)) ? undefined : hook(ctx);
+            });
+    }
+    if (hooks.preBody) {
+        const original = hooks.preBody;
+        wrapped.preBody = async (ctx) => ((await matches(ctx)) ? undefined : original(ctx));
+    }
+    if (hooks.beforeHandle) {
+        const original = hooks.beforeHandle;
+        wrapped.beforeHandle = async (ctx) => ((await matches(ctx)) ? undefined : original(ctx));
+    }
+    return wrapped;
 }
 function compileExceptMatcher(when) {
     if (typeof when === "function") {
@@ -175,9 +206,7 @@ function compilePathPattern(pattern) {
     return (path) => regex.test(path);
 }
 function mergeCombineHooks(layers) {
-    const pick = (key) => layers
-        .map((h) => h[key])
-        .filter((f) => typeof f === "function");
+    const pick = (key) => layers.map((h) => h[key]).filter((f) => typeof f === "function");
     const merged = {};
     const onRequest = pick("onRequest");
     if (onRequest.length > 0) {
@@ -186,6 +215,9 @@ function mergeCombineHooks(layers) {
                 await fn(req);
         };
     }
+    const preBody = _mergePreBodyWithEarlyRejections(layers);
+    if (preBody !== undefined)
+        merged.preBody = preBody;
     const beforeHandle = pick("beforeHandle");
     if (beforeHandle.length > 0) {
         merged.beforeHandle = async (ctx) => {
@@ -245,6 +277,17 @@ function mergeCombineHooks(layers) {
     for (const hooks of layers) {
         const record = hooks;
         for (const key of Object.getOwnPropertySymbols(record)) {
+            if (key === EARLY_REJECTION_HOOK_MARKER && merged.preBody !== undefined)
+                continue;
+            if (key === EARLY_REJECTION_HOOK_MARKER) {
+                const existing = merged[key];
+                const incoming = record[key];
+                merged[key] = [
+                    ...(Array.isArray(existing) ? existing : []),
+                    ...(Array.isArray(incoming) ? incoming : []),
+                ];
+                continue;
+            }
             if (!(key in merged)) {
                 merged[key] = record[key];
             }

package/dist/docs.d.ts

@@ -233,16 +233,12 @@ export interface RedocConfiguration {
     };
 }
 /**
- * Override CDN URLs and pin Subresource Integrity (SRI) hashes for the docs
- * UI assets.
+ * Override the version-pinned CDN URLs and Subresource Integrity (SRI) hashes
+ * used by the docs UI assets.
  *
- * Supplying an `*Integrity` value emits an `integrity="…"` attribute plus a
- * `crossorigin` attribute on the matching `<script>` / `<link>` tag so the
- * browser refuses to execute a CDN asset whose bytes don't match the pinned
- * hash. SRI is only meaningful against a **version-pinned** URL
- * (e.g. `…/@scalar/api-reference@1.25.0`); pair each integrity hash with a
- * pinned `*Url`, since the framework's default URLs intentionally track the
- * latest upstream release and therefore cannot carry a stable hash.
+ * Defaults use exact upstream versions with matching SHA-384 digests. A custom
+ * URL without a custom `*Integrity` value intentionally omits SRI; pair URL
+ * overrides with hashes whose exact bytes you control or have verified.
  *
  * @since 0.37.0
  */

package/dist/docs.js

@@ -8,6 +8,18 @@
  * (You can self-host the assets if your CSP forbids CDNs.)
  */
 const JSDELIVR_ORIGIN = "https://cdn.jsdelivr.net";
+const DEFAULT_SCALAR_SCRIPT_URL = `${JSDELIVR_ORIGIN}/npm/@scalar/api-reference@1.62.5`;
+const DEFAULT_SCALAR_SCRIPT_INTEGRITY = "sha384-jVBCKhcCfx34USN27x4iQK1SBNdL/HxKq3KuBAxTS4WPaP5w80K4fjpwB+DezJL5";
+const DEFAULT_SWAGGER_CSS_URL = `${JSDELIVR_ORIGIN}/npm/swagger-ui-dist@5.32.8/swagger-ui.css`;
+const DEFAULT_SWAGGER_CSS_INTEGRITY = "sha384-9Q2fpS+xeS4ffJy6CagnwoUl+4ldAYhOs9pgZuEKxypVModhmZFzeMlvVsAjf7uT";
+const DEFAULT_SWAGGER_BUNDLE_URL = `${JSDELIVR_ORIGIN}/npm/swagger-ui-dist@5.32.8/swagger-ui-bundle.js`;
+const DEFAULT_SWAGGER_BUNDLE_INTEGRITY = "sha384-IKpAWwsTL0pcw7/Amtnt2eXF4P1BK64WNuY2E/RG15SWLUW5HXzFuyqCSAr/DP8C";
+const DEFAULT_REDOC_SCRIPT_URL = `${JSDELIVR_ORIGIN}/npm/redoc@2.5.3/bundles/redoc.standalone.js`;
+const DEFAULT_REDOC_SCRIPT_INTEGRITY = "sha384-xiEssMQFSpSfLbzRZCGfxxIM5QDb2DTrU6vyoZdp2sV1L6pmOMy6MpTtUoLbpC96";
+const DEFAULT_ASYNCAPI_SCRIPT_URL = `${JSDELIVR_ORIGIN}/npm/@asyncapi/react-component@3.1.4/browser/standalone/index.js`;
+const DEFAULT_ASYNCAPI_SCRIPT_INTEGRITY = "sha384-ZI+8twyvBIiWAquvsA8HFRvWjFn7l9/JlCHI3sekdQ6s7xK8ZDT6TDQOickRDQ0t";
+const DEFAULT_ASYNCAPI_STYLE_URL = `${JSDELIVR_ORIGIN}/npm/@asyncapi/react-component@3.1.4/styles/default.min.css`;
+const DEFAULT_ASYNCAPI_STYLE_INTEGRITY = "sha384-hcBf581bZwhXX8SyfsmPFkODqlIruk2b6gfX+b2WuK+am42GxstWJlJLiosKZoiL";
 /**
  * Matches a single Subresource Integrity digest: a `sha256-`/`sha384-`/
  * `sha512-` prefix followed by standard base64 (with up to two `=` pads).
@@ -53,8 +65,10 @@ function integrityAttr(integrity, crossOrigin) {
 export function scalarHtml(opts) {
     const title = escapeHtml(opts.title ?? "API Reference");
     const url = escapeHtml(opts.specUrl);
-    const scriptUrl = escapeHtml(opts.assets?.scalarScriptUrl ?? `${JSDELIVR_ORIGIN}/npm/@scalar/api-reference`);
-    const scriptSri = integrityAttr(opts.assets?.scalarScriptIntegrity, opts.assets?.crossOrigin);
+    const usesDefaultScript = opts.assets?.scalarScriptUrl === undefined;
+    const scriptUrl = escapeHtml(opts.assets?.scalarScriptUrl ?? DEFAULT_SCALAR_SCRIPT_URL);
+    const scriptSri = integrityAttr(opts.assets?.scalarScriptIntegrity ??
+        (usesDefaultScript ? DEFAULT_SCALAR_SCRIPT_INTEGRITY : undefined), opts.assets?.crossOrigin);
     const nonce = nonceAttr(opts.scriptNonce);
     const configuration = scalarConfigurationAttr(opts.specUrl, opts.configuration);
     return `<!doctype html>
@@ -82,10 +96,14 @@ ${docsAuthLauncherHtml(opts.auth, opts.scriptNonce)}
  */
 export function swaggerUiHtml(opts) {
     const title = escapeHtml(opts.title ?? "API Docs");
-    const cssUrl = escapeHtml(opts.assets?.swaggerUiCssUrl ?? `${JSDELIVR_ORIGIN}/npm/swagger-ui-dist/swagger-ui.css`);
-    const bundleUrl = escapeHtml(opts.assets?.swaggerUiBundleUrl ?? `${JSDELIVR_ORIGIN}/npm/swagger-ui-dist/swagger-ui-bundle.js`);
-    const cssSri = integrityAttr(opts.assets?.swaggerUiCssIntegrity, opts.assets?.crossOrigin);
-    const bundleSri = integrityAttr(opts.assets?.swaggerUiBundleIntegrity, opts.assets?.crossOrigin);
+    const usesDefaultCss = opts.assets?.swaggerUiCssUrl === undefined;
+    const usesDefaultBundle = opts.assets?.swaggerUiBundleUrl === undefined;
+    const cssUrl = escapeHtml(opts.assets?.swaggerUiCssUrl ?? DEFAULT_SWAGGER_CSS_URL);
+    const bundleUrl = escapeHtml(opts.assets?.swaggerUiBundleUrl ?? DEFAULT_SWAGGER_BUNDLE_URL);
+    const cssSri = integrityAttr(opts.assets?.swaggerUiCssIntegrity ??
+        (usesDefaultCss ? DEFAULT_SWAGGER_CSS_INTEGRITY : undefined), opts.assets?.crossOrigin);
+    const bundleSri = integrityAttr(opts.assets?.swaggerUiBundleIntegrity ??
+        (usesDefaultBundle ? DEFAULT_SWAGGER_BUNDLE_INTEGRITY : undefined), opts.assets?.crossOrigin);
     const nonce = nonceAttr(opts.scriptNonce);
     const configuration = jsonForScript({
         persistAuthorization: true,
@@ -125,8 +143,10 @@ ${docsAuthLauncherHtml(opts.auth, opts.scriptNonce)}
  */
 export function redocHtml(opts) {
     const title = escapeHtml(opts.title ?? "API Docs");
-    const scriptUrl = escapeHtml(opts.assets?.redocScriptUrl ?? `${JSDELIVR_ORIGIN}/npm/redoc/bundles/redoc.standalone.js`);
-    const scriptSri = integrityAttr(opts.assets?.redocScriptIntegrity, opts.assets?.crossOrigin);
+    const usesDefaultScript = opts.assets?.redocScriptUrl === undefined;
+    const scriptUrl = escapeHtml(opts.assets?.redocScriptUrl ?? DEFAULT_REDOC_SCRIPT_URL);
+    const scriptSri = integrityAttr(opts.assets?.redocScriptIntegrity ??
+        (usesDefaultScript ? DEFAULT_REDOC_SCRIPT_INTEGRITY : undefined), opts.assets?.crossOrigin);
     const nonce = nonceAttr(opts.scriptNonce);
     const specArg = jsonForScript(opts.specUrl);
     const optionsArg = jsonForScript(opts.configuration ?? {});
@@ -163,12 +183,14 @@ ${docsAuthLauncherHtml(opts.auth, opts.scriptNonce)}
  */
 export function asyncapiHtml(opts) {
     const title = escapeHtml(opts.title ?? "AsyncAPI");
-    const scriptUrl = escapeHtml(opts.assets?.asyncapiScriptUrl ??
-        `${JSDELIVR_ORIGIN}/npm/@asyncapi/react-component/browser/standalone/index.js`);
-    const styleUrl = escapeHtml(opts.assets?.asyncapiStyleUrl ??
-        `${JSDELIVR_ORIGIN}/npm/@asyncapi/react-component/styles/default.min.css`);
-    const scriptSri = integrityAttr(opts.assets?.asyncapiScriptIntegrity, opts.assets?.crossOrigin);
-    const styleSri = integrityAttr(opts.assets?.asyncapiStyleIntegrity, opts.assets?.crossOrigin);
+    const usesDefaultScript = opts.assets?.asyncapiScriptUrl === undefined;
+    const usesDefaultStyle = opts.assets?.asyncapiStyleUrl === undefined;
+    const scriptUrl = escapeHtml(opts.assets?.asyncapiScriptUrl ?? DEFAULT_ASYNCAPI_SCRIPT_URL);
+    const styleUrl = escapeHtml(opts.assets?.asyncapiStyleUrl ?? DEFAULT_ASYNCAPI_STYLE_URL);
+    const scriptSri = integrityAttr(opts.assets?.asyncapiScriptIntegrity ??
+        (usesDefaultScript ? DEFAULT_ASYNCAPI_SCRIPT_INTEGRITY : undefined), opts.assets?.crossOrigin);
+    const styleSri = integrityAttr(opts.assets?.asyncapiStyleIntegrity ??
+        (usesDefaultStyle ? DEFAULT_ASYNCAPI_STYLE_INTEGRITY : undefined), opts.assets?.crossOrigin);
     const nonce = nonceAttr(opts.scriptNonce);
     const specArg = jsonForScript(opts.specUrl);
     const configArg = jsonForScript(opts.configuration ?? { show: { sidebar: true, errors: true } });

package/dist/idempotency.js

@@ -32,6 +32,7 @@
  * @since 0.37.0
  */
 import { BadRequestError, ConflictError, HttpError } from "./errors.js";
+import { markSchemaValidatedResponse } from "./internal-response.js";
 const enc = new TextEncoder();
 /** Internal `ctx.state` key carrying the reservation between hooks. */
 const PENDING_STATE_KEY = "__idempotencyPending";
@@ -200,7 +201,7 @@ function buildReplayResponse(stored, replayHeaderName) {
         headers.set(name, value);
     headers.set(replayHeaderName, "true");
     const body = stored.body ? base64ToBytes(stored.body) : null;
-    return new Response(body, { status: stored.status, headers });
+    return markSchemaValidatedResponse(new Response(body, { status: stored.status, headers }));
 }
 // ---------- Middleware ----------
 /**