@databehave/server 0.1.0

package/dist/cors.js

@@ -0,0 +1,167 @@
+const DEFAULT_METHODS = ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'];
+const DEFAULT_HEADERS = ['content-type', 'authorization'];
+const resolveOrigin = (cfg, reqOrigin) => {
+    if (cfg.origin)
+        return cfg.origin(reqOrigin);
+    return reqOrigin === '' ? '*' : reqOrigin;
+};
+/**
+ * Merge two `Vary` header values, deduplicating tokens
+ * case-insensitively while preserving the first occurrence's casing.
+ * `Vary: *` short-circuits to `*` (HTTP semantic: “varies on every
+ * possible header”, no further tokens add information).
+ *
+ * Exported so server-level decorators (and tests) can compose the
+ * CORS `Vary` onto whatever the handler already declared.
+ */
+export const mergeVary = (existing, additional) => {
+    if (!existing)
+        return additional;
+    const seen = new Map();
+    for (const raw of [existing, additional]) {
+        for (const tok of raw.split(',')) {
+            const t = tok.trim();
+            if (t === '')
+                continue;
+            if (t === '*')
+                return '*';
+            const key = t.toLowerCase();
+            if (!seen.has(key))
+                seen.set(key, t);
+        }
+    }
+    return Array.from(seen.values()).join(', ');
+};
+/**
+ * Build the `Access-Control-*` header bag for a non-preflight
+ * response.
+ *
+ * - `Access-Control-Allow-Origin` is omitted when the resolved origin
+ *   is an empty string (browsers reject empty header values, and an
+ *   empty header is the de-facto “reject” signal anyway).
+ * - `Vary: Origin` is always added when CORS is enabled so reverse
+ *   proxies and CDNs don't cache one origin's response and serve it
+ *   to another. The server-level decorator merges this token with
+ *   any handler-supplied `Vary` (see {@link mergeVary}).
+ */
+export const buildCorsResponseHeaders = (cfg, req) => {
+    const headers = {};
+    const reqOrigin = req.headers['origin'] ?? '';
+    const allowed = resolveOrigin(cfg, reqOrigin);
+    if (allowed !== '') {
+        headers['access-control-allow-origin'] = allowed;
+    }
+    headers['vary'] = 'Origin';
+    if (cfg.credentials)
+        headers['access-control-allow-credentials'] = 'true';
+    if (cfg.exposeHeaders && cfg.exposeHeaders.length > 0) {
+        headers['access-control-expose-headers'] = cfg.exposeHeaders.join(', ');
+    }
+    return headers;
+};
+/**
+ * Intersect the browser's `Access-Control-Request-Headers` with the
+ * configured allowlist. Returns a comma-separated header value.
+ *
+ * Semantics:
+ * - `configured === undefined`  → echo the request value verbatim
+ *   (legacy permissive default for backwards compatibility). If the
+ *   request also omitted the header, fall back to {@link DEFAULT_HEADERS}.
+ * - `configured.length === 0`   → deny everything; returns `''`. The
+ *   caller is expected to treat the empty string as "do not emit the
+ *   header" (see {@link buildPreflightResponse}). This lets operators
+ *   express a hard lockdown without inventing a separate flag.
+ * - `configured` non-empty      → keep only requested tokens whose
+ *   case-insensitive name appears in the allowlist, preserving input
+ *   order, de-duplicating case-insensitive repeats. If the request
+ *   omitted the header, the full allowlist is advertised so a browser
+ *   that probes without `Access-Control-Request-Headers` still knows
+ *   what is permitted.
+ *
+ * Token comparison is case-insensitive. The casing of the **request**
+ * is preserved (so a request asking for `Content-Type` gets
+ * `Content-Type` back), since browsers compare returned tokens
+ * case-insensitively anyway and round-tripping the request casing
+ * avoids needless diffs in test snapshots.
+ */
+const intersectAllowHeaders = (requested, configured) => {
+    if (configured === undefined) {
+        return requested ?? DEFAULT_HEADERS.join(', ');
+    }
+    if (configured.length === 0) {
+        // Hard lockdown: empty allowlist means deny all requested headers.
+        return '';
+    }
+    if (requested === undefined || requested === '') {
+        // No request header → advertise the full allowlist, deduped by
+        // case-insensitive name while preserving the configured casing.
+        const seen = new Set();
+        const out = [];
+        for (const h of configured) {
+            const key = h.toLowerCase();
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            out.push(h);
+        }
+        return out.join(', ');
+    }
+    const allow = new Set();
+    for (const h of configured)
+        allow.add(h.toLowerCase());
+    const seen = new Set();
+    const out = [];
+    for (const raw of requested.split(',')) {
+        const tok = raw.trim();
+        if (tok === '')
+            continue;
+        const key = tok.toLowerCase();
+        if (!allow.has(key))
+            continue;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push(tok);
+    }
+    return out.join(', ');
+};
+/**
+ * Build the preflight (`OPTIONS`) response for a given CORS config.
+ * The body is empty (204); headers cover origin, methods, headers,
+ * max-age, and `Vary: Origin`.
+ *
+ * `Access-Control-Allow-Headers` honours `cfg.allowHeaders` as a
+ * strict allowlist when it is set — anything off the list is dropped
+ * even if the browser requested it. When `cfg.allowHeaders` is unset
+ * the request value is echoed verbatim (legacy permissive default).
+ *
+ * The preflight response body itself does not vary on
+ * `Access-Control-Request-Method` / `…-Request-Headers` (we always
+ * derive the allow-headers value from the request), so those tokens
+ * are intentionally omitted to avoid fragmenting downstream caches.
+ */
+export const buildPreflightResponse = (cfg, req) => {
+    const reqOrigin = req.headers['origin'] ?? '';
+    const allowMethods = (cfg.allowMethods ?? DEFAULT_METHODS).join(', ');
+    const requested = req.headers['access-control-request-headers'];
+    const allowHeaders = intersectAllowHeaders(requested, cfg.allowHeaders);
+    const allowed = resolveOrigin(cfg, reqOrigin);
+    const headers = {
+        'access-control-allow-methods': allowMethods,
+        'access-control-max-age': String(cfg.maxAge ?? 86_400),
+        vary: 'Origin',
+    };
+    // Empty string == hard lockdown from intersectAllowHeaders.
+    // Emitting `access-control-allow-headers: ` would be a syntactically
+    // valid but functionally hostile header; omit it instead so the
+    // browser falls back to denying the preflight cleanly.
+    if (allowHeaders !== '') {
+        headers['access-control-allow-headers'] = allowHeaders;
+    }
+    if (allowed !== '')
+        headers['access-control-allow-origin'] = allowed;
+    if (cfg.credentials)
+        headers['access-control-allow-credentials'] = 'true';
+    return { empty: true, status: 204, headers };
+};
+//# sourceMappingURL=cors.js.map

package/dist/cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../src/cors.ts"],"names":[],"mappings":"AAkBA,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;AAC5E,MAAM,eAAe,GAAG,CAAC,cAAc,EAAE,eAAe,CAAC,CAAA;AAEzD,MAAM,aAAa,GAAG,CAAC,GAAe,EAAE,SAAiB,EAAU,EAAE;IACnE,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAC5C,OAAO,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AAC3C,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,QAA4B,EAAE,UAAkB,EAAU,EAAE;IACpF,IAAI,CAAC,QAAQ;QAAE,OAAO,UAAU,CAAA;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAA;IACtC,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;QACzC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;YACpB,IAAI,CAAC,KAAK,EAAE;gBAAE,SAAQ;YACtB,IAAI,CAAC,KAAK,GAAG;gBAAE,OAAO,GAAG,CAAA;YACzB,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;YAC3B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QACtC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC7C,CAAC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,GAAe,EACf,GAAgB,EACQ,EAAE;IAC1B,MAAM,OAAO,GAA2B,EAAE,CAAA;IAC1C,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;IAC7C,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;IAC7C,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,OAAO,CAAC,6BAA6B,CAAC,GAAG,OAAO,CAAA;IAClD,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAA;IAC1B,IAAI,GAAG,CAAC,WAAW;QAAE,OAAO,CAAC,kCAAkC,CAAC,GAAG,MAAM,CAAA;IACzE,IAAI,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,OAAO,CAAC,+BAA+B,CAAC,GAAG,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,qBAAqB,GAAG,CAC5B,SAA6B,EAC7B,UAAyC,EACjC,EAAE;IACV,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,SAAS,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChD,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,mEAAmE;QACnE,OAAO,EAAE,CAAA;IACX,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QAChD,+DAA+D;QAC/D,gEAAgE;QAChE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;QAC9B,MAAM,GAAG,GAAa,EAAE,CAAA;QACxB,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;YAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAQ;YAC3B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACb,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACb,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACvB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,KAAK,MAAM,CAAC,IAAI,UAAU;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;QACtB,IAAI,GAAG,KAAK,EAAE;YAAE,SAAQ;QACxB,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,EAAE,CAAA;QAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAQ;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAQ;QAC3B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACb,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACf,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACvB,CAAC,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,GAAe,EACf,GAAgB,EACF,EAAE;IAChB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;IAC7C,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACrE,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAA;IAC/D,MAAM,YAAY,GAAG,qBAAqB,CAAC,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,CAAA;IACvE,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;IAC7C,MAAM,OAAO,GAA2B;QACtC,8BAA8B,EAAE,YAAY;QAC5C,wBAAwB,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC;QACtD,IAAI,EAAE,QAAQ;KACf,CAAA;IACD,4DAA4D;IAC5D,qEAAqE;IACrE,gEAAgE;IAChE,uDAAuD;IACvD,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;QACxB,OAAO,CAAC,8BAA8B,CAAC,GAAG,YAAY,CAAA;IACxD,CAAC;IACD,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,CAAC,6BAA6B,CAAC,GAAG,OAAO,CAAA;IACpE,IAAI,GAAG,CAAC,WAAW;QAAE,OAAO,CAAC,kCAAkC,CAAC,GAAG,MAAM,CAAA;IACzE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;AAC9C,CAAC,CAAA"}

package/dist/define.d.ts

@@ -0,0 +1,26 @@
+import type { Config } from './types.js';
+/**
+ * Identity helper providing TypeScript intellisense at the config
+ * call site. Equivalent to `(config: Config) => config`.
+ *
+ * In non-production environments the returned config is **deep**-frozen
+ * so accidental mutation — including `config.routes['GET /x'] = …`
+ * or pushing into `cors.allowMethods` — throws loudly in tests instead
+ * of corrupting the server silently. Production skips the freeze to
+ * avoid breaking callers that legitimately patch the object after
+ * `defineConfig()` for env-specific wiring.
+ *
+ * Handler functions inside `routes` are intentionally left mutable
+ * (they're rebuilt per call anyway) — freeze stops at function
+ * boundaries.
+ *
+ * Usage:
+ * ```ts
+ * import { defineConfig } from '@databehave/server'
+ * export default defineConfig({ routes: { ... } })
+ * ```
+ */
+export declare const defineConfig: (config: Config) => Config;
+/** @internal exported for the JSON config loader to apply the same protection. */
+export declare const _deepFreezeForDev: <T>(value: T) => T;
+//# sourceMappingURL=define.d.ts.map

package/dist/define.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"define.d.ts","sourceRoot":"","sources":["../src/define.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AAoBxC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,YAAY,GAAI,QAAQ,MAAM,KAAG,MAK7C,CAAA;AAED,kFAAkF;AAClF,eAAO,MAAM,iBAAiB,GAAI,CAAC,EAAE,OAAO,CAAC,KAAG,CAG/C,CAAA"}

package/dist/define.js

@@ -0,0 +1,55 @@
+/**
+ * Recursively freeze a value so mutation throws in strict mode.
+ * Skips functions (handlers stay callable, and freezing their
+ * own properties is rarely useful) and respects already-frozen
+ * branches to avoid revisiting cycles.
+ */
+const deepFreeze = (value, seen = new WeakSet()) => {
+    if (value === null || typeof value !== 'object')
+        return value;
+    if (seen.has(value))
+        return value;
+    seen.add(value);
+    if (Object.isFrozen(value))
+        return value;
+    for (const v of Object.values(value)) {
+        if (v !== null && typeof v === 'object')
+            deepFreeze(v, seen);
+    }
+    Object.freeze(value);
+    return value;
+};
+/**
+ * Identity helper providing TypeScript intellisense at the config
+ * call site. Equivalent to `(config: Config) => config`.
+ *
+ * In non-production environments the returned config is **deep**-frozen
+ * so accidental mutation — including `config.routes['GET /x'] = …`
+ * or pushing into `cors.allowMethods` — throws loudly in tests instead
+ * of corrupting the server silently. Production skips the freeze to
+ * avoid breaking callers that legitimately patch the object after
+ * `defineConfig()` for env-specific wiring.
+ *
+ * Handler functions inside `routes` are intentionally left mutable
+ * (they're rebuilt per call anyway) — freeze stops at function
+ * boundaries.
+ *
+ * Usage:
+ * ```ts
+ * import { defineConfig } from '@databehave/server'
+ * export default defineConfig({ routes: { ... } })
+ * ```
+ */
+export const defineConfig = (config) => {
+    if (process.env.NODE_ENV !== 'production') {
+        deepFreeze(config);
+    }
+    return config;
+};
+/** @internal exported for the JSON config loader to apply the same protection. */
+export const _deepFreezeForDev = (value) => {
+    if (process.env.NODE_ENV !== 'production')
+        deepFreeze(value);
+    return value;
+};
+//# sourceMappingURL=define.js.map

package/dist/define.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"define.js","sourceRoot":"","sources":["../src/define.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,UAAU,GAAG,CAAI,KAAQ,EAAE,OAAwB,IAAI,OAAO,EAAE,EAAK,EAAE;IAC3E,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC7D,IAAI,IAAI,CAAC,GAAG,CAAC,KAAe,CAAC;QAAE,OAAO,KAAK,CAAA;IAC3C,IAAI,CAAC,GAAG,CAAC,KAAe,CAAC,CAAA;IACzB,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACxC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IAC9D,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACpB,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAc,EAAU,EAAE;IACrD,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,UAAU,CAAC,MAAM,CAAC,CAAA;IACpB,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,kFAAkF;AAClF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAI,KAAQ,EAAK,EAAE;IAClD,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QAAE,UAAU,CAAC,KAAK,CAAC,CAAA;IAC5D,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}

package/dist/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Public entry point for `@databehave/server`.
+ *
+ * Re-exports the surface that consumers are allowed to use. Internal
+ * modules (`request`, `response`, `route-key`) are not re-exported on
+ * purpose — they are implementation details.
+ *
+ * `@databehave/server` is standalone — it ships with an in-server
+ * OAS-driven mock generator and pulls no DSL dependency at runtime.
+ * For richer mock data (distributions, datasets, FK-aware generation)
+ * install the DSL package separately and import it directly.
+ */
+export { defineConfig } from './define.js';
+export { run, type RunHandle, type RunOptions } from './run.js';
+export { createServer } from './server.js';
+export { seedFor, type SeedInput } from './openapi/seed.js';
+export { loadConfig, type EndpointResponse, type EndpointSpec, type LoadedConfig, type LoadConfigOptions, type JsonConfig, } from './json-config.js';
+export { resolveStatus, type MockModeConfig, type MockModeLogger, } from './mock-mode.js';
+export type { Config, CorsConfig, Handler, ListenHandle, ListenOptions, Method, MockRequest, MockResponse, MockResponseBody, ObservedMethod, RouteKey, Server, } from './types.js';
+export type { AdminModeConfig, ErrorMode, StickyOverride, OverrideMatcher, AdminModeCors, } from './admin/admin-types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,GAAG,EAAE,KAAK,SAAS,EAAE,KAAK,UAAU,EAAE,MAAM,UAAU,CAAA;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,EACL,UAAU,EACV,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,UAAU,GAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,aAAa,EACb,KAAK,cAAc,EACnB,KAAK,cAAc,GACpB,MAAM,gBAAgB,CAAA;AACvB,YAAY,EACV,MAAM,EACN,UAAU,EACV,OAAO,EACP,YAAY,EACZ,aAAa,EACb,MAAM,EACN,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,cAAc,EACd,QAAQ,EACR,MAAM,GACP,MAAM,YAAY,CAAA;AAGnB,YAAY,EACV,eAAe,EACf,SAAS,EACT,cAAc,EACd,eAAe,EACf,aAAa,GACd,MAAM,wBAAwB,CAAA"}

package/dist/index.js

@@ -0,0 +1,19 @@
+/**
+ * Public entry point for `@databehave/server`.
+ *
+ * Re-exports the surface that consumers are allowed to use. Internal
+ * modules (`request`, `response`, `route-key`) are not re-exported on
+ * purpose — they are implementation details.
+ *
+ * `@databehave/server` is standalone — it ships with an in-server
+ * OAS-driven mock generator and pulls no DSL dependency at runtime.
+ * For richer mock data (distributions, datasets, FK-aware generation)
+ * install the DSL package separately and import it directly.
+ */
+export { defineConfig } from './define.js';
+export { run } from './run.js';
+export { createServer } from './server.js';
+export { seedFor } from './openapi/seed.js';
+export { loadConfig, } from './json-config.js';
+export { resolveStatus, } from './mock-mode.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,GAAG,EAAmC,MAAM,UAAU,CAAA;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAkB,MAAM,mBAAmB,CAAA;AAC3D,OAAO,EACL,UAAU,GAMX,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,aAAa,GAGd,MAAM,gBAAgB,CAAA"}

package/dist/json-config.d.ts

@@ -0,0 +1,170 @@
+import { type MockModeConfig } from './mock-mode.js';
+import type { Config, CorsConfig, Handler } from './types.js';
+/**
+ * Static response declarable per endpoint. Returned verbatim when the
+ * endpoint uses the `{ response }` form. Mirrors the JSON-safe subset
+ * of `MockResponse` (no `text` / `html` / `raw`).
+ */
+export interface EndpointResponse {
+    status: number;
+    json?: unknown;
+    empty?: boolean;
+    headers?: Record<string, string>;
+}
+/**
+ * Per-endpoint declaration. Three forms:
+ *
+ *   - **string**: module path to a handler (shorthand for `{ handler }`)
+ *   - **`{ handler, status? }`**: dynamic-import handler. Optional
+ *     `status` registers an HTTP status override for this route in
+ *     the mock-mode `pathOverrides` map (e.g. force 500 for that route).
+ *   - **`{ response }`**: static response only — no handler module.
+ *     The handler is synthesized to return the literal response.
+ *
+ * `handler` and `response` are mutually exclusive.
+ */
+export type EndpointSpec = string | {
+    handler: string;
+    status?: number;
+    response?: never;
+} | {
+    response: EndpointResponse;
+    handler?: never;
+    status?: never;
+};
+/**
+ * Raw JSON shape declared inside `databehave.json`. Mirrors a
+ * narrow subset of `Config` plus the on-disk additions
+ * (`endpoints` map of route-key → `EndpointSpec`).
+ */
+export interface JsonConfig {
+    /** Path to the JSON OpenAPI document, relative to this file. */
+    openapi?: string;
+    /** Server listen options used by the CLI. */
+    server?: {
+        host?: string;
+        port?: number;
+    };
+    /**
+     * Prefix automatically prepended to every `endpoints` key.
+     * Lets callers write `"GET products/list"` instead of
+     * repeating the API prefix in every entry. Must start with `/` and
+     * must not end with `/` (e.g. `"/api/v1"`). OpenAPI paths are
+     * left untouched — they already carry their full path in the OAS document.
+     */
+    basePath?: string;
+    /**
+     * CORS knobs. `origin` may be a single allowed origin string or an
+     * allowlist of strings (the function form on `CorsConfig`
+     * is reserved for the programmatic API). Anything off the allowlist
+     * is rejected (empty header) so misconfigured callers fail loudly
+     * instead of silently leaking `*`.
+     */
+    cors?: Omit<CorsConfig, 'origin'> & {
+        origin?: string | readonly string[];
+    };
+    /** Built-in mock-mode behaviour. Disabled by default. */
+    mockMode?: MockModeConfig;
+    /**
+     * Opt-in admin / error-injection panel. Default: disabled.
+     * Pass-through to `Config.admin`. The JSON loader
+     * automatically supplements `openapiBody` from the resolved OpenAPI
+     * document so the UI route picker works without manual wiring.
+     */
+    admin?: Config['admin'];
+    /**
+     * Opt-in per-request access logs. Pass-through to
+     * `Config.log`. Default: disabled. See README
+     * "Access logs" for the shape.
+     */
+    log?: Config['log'];
+    /**
+     * Opt-in inbound request validation against the OpenAPI document.
+     * Pass-through to `Config.validation`. Default off
+     * (`{ request: false }`) — when omitted the runtime behaves
+     * byte-identical to a build without the validator.
+     */
+    validation?: Config['validation'];
+    /**
+     * Opt-in auto-schema mode (Phase 2C). When `enabled: true`, every
+     * OAS path not covered by `endpoints` is served from data
+     * generated by `@databehave/schema`'s `mock()` engine, derived
+     * from the OpenAPI document. The peer is loaded via dynamic
+     * `import()` at server-creation time; install it separately with
+     * `npm i @databehave/schema`. See README "Auto-schema mode".
+     *
+     * Always an object — the legacy boolean shorthand
+     * (`schema: true`) was removed. Unknown keys throw at
+     * config-load time. Fields:
+     *
+     * - `enabled` — required boolean. `false` (or omitting the
+     *   `schema` field entirely) keeps the default JSONC mock-only
+     *   flow.
+     * - `seed` — `number` (fixed), `"stable"` (per-request hash),
+     *            or `"random"` (fresh per request). Default `"stable"`.
+     * - `locale` — optional locale tag (forwarded as a future hint).
+     * - `arrayCount` — default array length when OAS lacks `minItems`.
+     */
+    schema?: {
+        enabled: boolean;
+        seed?: number | 'stable' | 'random';
+        locale?: string;
+        arrayCount?: number;
+    };
+    /**
+     * Route-key → endpoint declaration map. Keys may be written
+     * relative to `basePath` (e.g. `"GET products/list"`); they
+     * may also be absolute (`"GET /health"`) — any key starting with
+     * `/` after the method is registered verbatim.
+     */
+    endpoints?: Partial<Record<string, EndpointSpec>>;
+}
+/** Result of loading a JSON config from disk. */
+export interface LoadedConfig {
+    /** Fully-assembled config ready for `createServer`. */
+    readonly config: Config;
+    /** Server listen options copied verbatim from the JSON. */
+    readonly server: {
+        host: string;
+        port: number;
+    };
+}
+/**
+ * Options for `loadConfig`.
+ */
+export interface LoadConfigOptions {
+    /**
+     * Pre-resolved handler map. Keys may match the JSONC `endpoints`
+     * value either exactly (e.g. `./src/routes/health.js`) or in any
+     * canonically equivalent form — leading `./` and the file extension
+     * (`.js`/`.mjs`/`.cjs`/`.ts`/`.tsx`/`.mts`/`.cts`) are stripped
+     * before comparison. When a key matches, the handler is used
+     * directly and the dynamic `import()` for that route is skipped.
+     *
+     * Use case: test environments (vitest under plain Node 18) that cannot
+     * load `.ts` source files through native `import()`. Construct the map
+     * via static imports or `import.meta.glob('eager')`, then pass it in.
+     *
+     * Handlers not present in the map fall back to dynamic import. Values
+     * that are not functions raise an error at boot time.
+     */
+    handlers?: Record<string, Handler>;
+    /**
+     * Sink for non-fatal warnings emitted while wiring the OpenAPI
+     * adapter (walk errors, empty schemas). Defaults to `console.warn`.
+     * Inject a no-op logger from tests to silence the output, or a
+     * structured logger in production to capture the messages.
+     */
+    logger?: {
+        warn(message: string): void;
+    };
+}
+/**
+ * Load and fully resolve a `databehave.json`.
+ *
+ * Returns a ready-to-run `Config` plus the listen options the
+ * CLI should bind to. Errors are thrown synchronously after parsing
+ * to fail fast on bad configs.
+ */
+export declare const loadConfig: (configPath: string, options?: LoadConfigOptions) => Promise<LoadedConfig>;
+//# sourceMappingURL=json-config.d.ts.map

package/dist/json-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-config.d.ts","sourceRoot":"","sources":["../src/json-config.ts"],"names":[],"mappings":"AAoBA,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,gBAAgB,CAAA;AAYvB,OAAO,KAAK,EACV,MAAM,EACN,UAAU,EACV,OAAO,EAGR,MAAM,YAAY,CAAA;AAEnB;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACjC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,YAAY,GACpB,MAAM,GACN;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,KAAK,CAAA;CAAE,GACtD;IAAE,QAAQ,EAAE,gBAAgB,CAAC;IAAC,OAAO,CAAC,EAAE,KAAK,CAAC;IAAC,MAAM,CAAC,EAAE,KAAK,CAAA;CAAE,CAAA;AAEnE;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,6CAA6C;IAC7C,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG;QAClC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAA;KACpC,CAAA;IACD,yDAAyD;IACzD,QAAQ,CAAC,EAAE,cAAc,CAAA;IACzB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;IACvB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;IACnB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,CAAA;IACjC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,MAAM,CAAC,EAAE;QACP,OAAO,EAAE,OAAO,CAAA;QAChB,IAAI,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAA;QACnC,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,CAAA;IACD;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAA;CAClD;AAED,iDAAiD;AACjD,MAAM,WAAW,YAAY;IAC3B,uDAAuD;IACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAChD;AAybD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC;;;;;OAKG;IACH,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;CACzC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,GACrB,YAAY,MAAM,EAClB,UAAU,iBAAiB,KAC1B,OAAO,CAAC,YAAY,CAgUtB,CAAA"}