@databehave/server 0.1.4 → 0.2.0

package/CHANGELOG.md

@@ -7,6 +7,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+Upcoming package version: **0.2.0**. This section describes planned release contents, not a published release.
+
+### Breaking changes
+
+- Require Node.js 24 or 26; support and test majors 24 and 26. Drop Node.js 18, 20 and 22.
+- Replace `createServer` and server-owned JSONC/CLI assembly with core host composition and explicit HTTP plugins.
+- Move OpenAPI, request validation, admin UI, fault controls and CLI ownership to their separate packages.
+- Move the shared drain timeout to `httpPlugin`; HTTP owns both in-process requests and response stream lifetimes.
+
+### Added
+
+- Public route, middleware, bind-guard and route-source contracts with registration sealing and staged startup.
+- Explicit Node transport, CORS and access logging plugins, authority validation, bounded shutdown and cancellation.
+- Consistent HEAD fallback, response decoration, route precedence and single-outcome observation.
+
+See [migration](../../MIGRATION.md) and [release procedures](../../docs/releasing.md).
+
 ## [0.1.0] - 2026-06-03
 
 Initial public release of `@databehave/server`.

package/README.md

@@ -1,87 +1,89 @@
-<!-- markdownlint-disable MD033 MD041 -->
-
-<div align="center">
-
 # @databehave/server
 
-<b>A JSON file config-driven mock server</b>
-
-[![npm version](https://img.shields.io/npm/v/@databehave/server.svg)](https://www.npmjs.com/package/@databehave/server)
-[![CI](https://github.com/ochairo/databehave/actions/workflows/ci.yml/badge.svg)](https://github.com/ochairo/databehave/actions/workflows/ci.yml)
-[![Node.js](https://img.shields.io/badge/node-%E2%89%A518.17-brightgreen)](https://nodejs.org/)
-[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
-
-</div>
-
-## Install
-
-You can install `@databehave/server` alone but to get full functionality, the recommended companion is `@databehave/schema`.
-
-```bash
-npm install @databehave/schema @databehave/server
-# or: pnpm add @databehave/schema @databehave/server
-# or: yarn add @databehave/schema @databehave/server
-```
-
-> `@databehave/schema` is declared as an optional peer dependency. Install it alongside `@databehave/server` whenever you enable auto-schema mode.
-
-## A 60-second tour
-
-**1. OpenAPI specs driven data** — realistic mock data derived from your OpenAPI document, with zero config. See [docs/openapi.md](docs/openapi.md) for the `openapi` field reference.
-
-**2. Auto-schema mode (`@databehave/schema`)** — realistic distributions, referential integrity, and deterministic seeding. See [docs/openapi/auto-schema.md](docs/openapi/auto-schema.md) for the `schema` field reference (knobs, defaults, install hint).
-
-**3. Full custom data** — hand-write response generators as modules, and point routes to them. The module exports a function that receives the request and returns a response shape. You can use `@databehave/schema` or any other data source.
-
-**4. Admin UI** You have a UI to override any route's response, with the override "sticking" until you remove it. No code change required for error injection.
-
-```jsonc
-{
-  "server": {
-    "host": "127.0.0.1",
-    "port": "8000"
-  },
-  // 1. OpenAPI specs driven data
-  "openapi": "./openapi.json",
-  // 2. Auto-schema mode (Adds @databehave/schema data generation engine to OpenAPI specs)
-  "schema": { "enabled": true },
-  // 3. Full custom data
-  "endpoints": {
-    "GET /health": { "response": { "status": 200, "json": { "ok": true } } },
-    "GET /products/list": "./src/routes/products/list.js",
-    "POST /products/bulk-update": "./src/routes/products/bulk-update.js"
-  },
-  // 4. Admin UI: http://[server.host]:[server.port]/[admin.path]
-  "admin": { "enabled": true, "path": "/databehave" },
-}
+HTTP contracts and explicit HTTP plugins for Databehave. The package has no schema,
+OpenAPI, admin, UI-build or CLI dependency.
+
+```ts
+import { createHost } from '@databehave/core'
+import {
+  httpPlugin, routesPlugin, corsPlugin, accessLogPlugin, nodeHttpPlugin,
+} from '@databehave/server'
+
+const host = createHost({ plugins: [
+  httpPlugin(),
+  routesPlugin({ 'GET /hello': () => ({ status: 200, json: { hello: 'world' } }) }),
+  corsPlugin({ origin: () => '*' }),
+  accessLogPlugin(),
+  nodeHttpPlugin({ host: '127.0.0.1', port: 3000 }),
+] })
+await host.start()
+// await host.close() when the application shuts down.
 ```
 
-## Documentation
-
-### Start here
-
-- [Index](docs/index.md) — package TOC and reading order.
-- [Getting Started](docs/getting-started.md) — 5-step tutorial from install to a custom route.
-- [Troubleshooting](docs/troubleshooting.md) — symptom → cause → fix.
-
-### Reference
-
-- [Config](docs/config/index.md) — every `databehave.json` field.
-- [Config Validation](docs/config/validation.md) — opt-in inbound request validation (RFC 7807).
-- [Admin](docs/admin/index.md) — admin UI, REST endpoints, matchers, ErrorMode, `x-mock-*` headers, scenarios, security notes.
-- [OpenAPI](docs/openapi/fallback.md) — OAS fallback walker, [Auto-schema](docs/openapi/auto-schema.md), keyword parity.
-- [CLI](docs/cli.md) — `@databehave/server` CLI reference.
-- [Errors](docs/errors.md) — every user-visible error message, source-cited.
-
-### Deeper
-
-- [Design](docs/design.md) — architecture, dispatch pipeline, why the HTTP framework is hidden.
-- [Stability](docs/stability.md) — public-surface lock, SemVer triggers, contract surfaces.
-- [Recipes](docs/recipes.md) — error injection, static responses, programmatic hooks, in-process tests with `fetch()`.
-
-<br /><br />
-<div align="center">
-
-© 2026-present ochairo. See [LICENSE](LICENSE)
-
-</div>
+For in-process requests, omit the listener and call
+`host.get(httpCapability).fetch(new Request('http://localhost/hello'))` after startup.
+
+External plugins declare `requires: [httpCapability]` and register route sources,
+middleware or bind guards during `setup`. Pass `ctx.order` as the contribution order;
+this preserves explicit composition order independently of capability dependency order.
+Route sources materialize once after every plugin has prepared. Explicit routes replace
+generated routes with the same key; equal-priority duplicates fail with both owners.
+Exact paths precede parameterized paths. Parameterized ties use composition order and
+then declaration order.
+
+`http.resolveRoute(method, path)` uses the same precedence and HEAD fallback as dispatch. A route contribution's
+`cors` field can override application CORS, or be `false` when its owner supplies the policy. General CORS only
+handles resolved routes; preflights resolve the `Access-Control-Request-Method` target. Unknown paths receive no
+implicit CORS authorization. This keeps feature-owned admin restrictions effective in either composition order.
+
+The middleware pipeline runs preflight, validation, interception, the selected handler,
+response decoration, and final observation. Short circuits and error responses receive
+decoration once. Error handlers are bounded; an error-handler failure yields a generic
+500. Observation cannot replace a response. HEAD calls an explicit HEAD handler or GET
+fallback once, retains `request.method === 'HEAD'`, exposes `effectiveMethod`, and strips
+the body after decoration. One request produces one observation.
+
+`terminateTransport()` produces a terminal transport outcome for Node listeners.
+Fetch cannot destroy a connection and reports `UnsupportedTransportError`. Request
+signals cancel on disconnect or host shutdown. Dispatch is admitted only after HTTP's open
+phase and rejects already-aborted callers before executing middleware or handlers. The HTTP
+runtime stops admission synchronously, cancels work, then waits for handlers and returned
+response bodies (EOF, error, or completed cancellation) before dependent resources are disposed.
+HEAD-suppressed bodies are cancelled. Callers must consume or cancel returned bodies.
+
+Configure the shared shutdown budget with `httpPlugin({ drainTimeoutMs: 1000 })` (1000 ms
+by default). The deadline begins when admission stops and covers both logical requests and
+Node connections; it is not restarted for each drain. The listener force-closes remaining
+connections at that deadline. Uncooperative handlers or body cancellation report a failed
+close instead of claiming a clean drain; callbacks cannot be forcibly stopped by JavaScript.
+The former `nodeHttpPlugin({ drainTimeoutMs })` option moves to `httpPlugin`.
+
+Node validates exactly one Host header and the origin-form request target before dispatch.
+Host must use the actual listener port and match its binding, local socket address, or a
+loopback alias for a loopback endpoint. For custom DNS use
+`nodeHttpPlugin({ allowedHosts: ['app.example.test'] })`; entries are explicit hostnames or
+IP literals, without ports, schemes, credentials, paths, or wildcards. Forwarded headers do
+not grant authority. Malformed requests receive 400; unapproved authorities receive 421.
+In-process Fetch requests remain trusted caller-supplied requests.
+
+Incoming Node bodies are pulled in bounded chunks. Cancelling a body stops intake without
+destroying the response socket, allowing early validation errors to reach uploading clients.
+Incomplete uploads receive `Connection: close`, but remain readable while a response stream
+consumes them. Explicit cancellation arms the rejection cleanup deadline immediately. Otherwise,
+response-source completion stops remaining input and arms cleanup before waiting for the response
+to flush. There is no ordinary response-write timeout; an uncancelled stalled duplex exchange
+remains backpressured until completion, disconnection or bounded host shutdown. Fully read bodies
+retain normal keep-alive behavior.
+
+Feature packages use this same public boundary:
+
+- [OpenAPI](../openapi/README.md): catalogs, selectable generators, validation and mock status policy.
+- [Admin](../admin/README.md): opt-in fault injection, UI/API and scenarios.
+- [CLI](../cli/README.md): explicit ESM composition and process lifecycle.
+- [Core](../core/README.md): capability dependencies and lifecycle.
+
+The upcoming 0.2 release removes the former JSONC configuration and monolithic `createServer` API.
+See the [migration guide](../../MIGRATION.md) for the replacement of each option.
+
+Requires Node.js 24 or 26; supported majors are 24 and 26. Start with the
+[runnable HTTP example](../../examples/http.mjs) and [plugin author guide](../../docs/plugins.md).

package/dist/cors.d.ts

@@ -12,7 +12,7 @@
  * migration stays backwards-compatible:
  * - origin: mirror request `Origin`, or `*` when absent
  * - credentials: header omitted by default; set `credentials: true` in
- *   `Config.cors` to send `Access-Control-Allow-Credentials: true`
+ *   `corsPlugin` to send `Access-Control-Allow-Credentials: true`
  */
 import type { CorsConfig, MockRequest, MockResponse } from './types.js';
 /**

package/dist/cors.js

@@ -1,4 +1,4 @@
-const DEFAULT_METHODS = ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'];
+const DEFAULT_METHODS = ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'HEAD', 'OPTIONS'];
 const DEFAULT_HEADERS = ['content-type', 'authorization'];
 const resolveOrigin = (cfg, reqOrigin) => {
     if (cfg.origin)

package/dist/cors.js.map

@@ -1 +1 @@
-{"version":3,"file":"cors.js","sourceRoot":"","sources":["../src/cors.ts"],"names":[],"mappings":"AAkBA,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;AAC5E,MAAM,eAAe,GAAG,CAAC,cAAc,EAAE,eAAe,CAAC,CAAA;AAEzD,MAAM,aAAa,GAAG,CAAC,GAAe,EAAE,SAAiB,EAAU,EAAE;IACnE,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAC5C,OAAO,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AAC3C,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,QAA4B,EAAE,UAAkB,EAAU,EAAE;IACpF,IAAI,CAAC,QAAQ;QAAE,OAAO,UAAU,CAAA;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAA;IACtC,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;QACzC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;YACpB,IAAI,CAAC,KAAK,EAAE;gBAAE,SAAQ;YACtB,IAAI,CAAC,KAAK,GAAG;gBAAE,OAAO,GAAG,CAAA;YACzB,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;YAC3B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QACtC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC7C,CAAC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,GAAe,EACf,GAAgB,EACQ,EAAE;IAC1B,MAAM,OAAO,GAA2B,EAAE,CAAA;IAC1C,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;IAC7C,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;IAC7C,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,OAAO,CAAC,6BAA6B,CAAC,GAAG,OAAO,CAAA;IAClD,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAA;IAC1B,IAAI,GAAG,CAAC,WAAW;QAAE,OAAO,CAAC,kCAAkC,CAAC,GAAG,MAAM,CAAA;IACzE,IAAI,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,OAAO,CAAC,+BAA+B,CAAC,GAAG,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,qBAAqB,GAAG,CAC5B,SAA6B,EAC7B,UAAyC,EACjC,EAAE;IACV,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,SAAS,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChD,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,mEAAmE;QACnE,OAAO,EAAE,CAAA;IACX,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QAChD,+DAA+D;QAC/D,gEAAgE;QAChE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;QAC9B,MAAM,GAAG,GAAa,EAAE,CAAA;QACxB,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;YAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAQ;YAC3B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACb,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACb,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACvB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,KAAK,MAAM,CAAC,IAAI,UAAU;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;QACtB,IAAI,GAAG,KAAK,EAAE;YAAE,SAAQ;QACxB,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,EAAE,CAAA;QAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAQ;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAQ;QAC3B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACb,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACf,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACvB,CAAC,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,GAAe,EACf,GAAgB,EACF,EAAE;IAChB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;IAC7C,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACrE,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAA;IAC/D,MAAM,YAAY,GAAG,qBAAqB,CAAC,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,CAAA;IACvE,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;IAC7C,MAAM,OAAO,GAA2B;QACtC,8BAA8B,EAAE,YAAY;QAC5C,wBAAwB,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC;QACtD,IAAI,EAAE,QAAQ;KACf,CAAA;IACD,4DAA4D;IAC5D,qEAAqE;IACrE,gEAAgE;IAChE,uDAAuD;IACvD,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;QACxB,OAAO,CAAC,8BAA8B,CAAC,GAAG,YAAY,CAAA;IACxD,CAAC;IACD,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,CAAC,6BAA6B,CAAC,GAAG,OAAO,CAAA;IACpE,IAAI,GAAG,CAAC,WAAW;QAAE,OAAO,CAAC,kCAAkC,CAAC,GAAG,MAAM,CAAA;IACzE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;AAC9C,CAAC,CAAA"}
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../src/cors.ts"],"names":[],"mappings":"AAkBA,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;AACpF,MAAM,eAAe,GAAG,CAAC,cAAc,EAAE,eAAe,CAAC,CAAA;AAEzD,MAAM,aAAa,GAAG,CAAC,GAAe,EAAE,SAAiB,EAAU,EAAE;IACnE,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAC5C,OAAO,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AAC3C,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,QAA4B,EAAE,UAAkB,EAAU,EAAE;IACpF,IAAI,CAAC,QAAQ;QAAE,OAAO,UAAU,CAAA;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAA;IACtC,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;QACzC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;YACpB,IAAI,CAAC,KAAK,EAAE;gBAAE,SAAQ;YACtB,IAAI,CAAC,KAAK,GAAG;gBAAE,OAAO,GAAG,CAAA;YACzB,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;YAC3B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QACtC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC7C,CAAC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,GAAe,EACf,GAAgB,EACQ,EAAE;IAC1B,MAAM,OAAO,GAA2B,EAAE,CAAA;IAC1C,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;IAC7C,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;IAC7C,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,OAAO,CAAC,6BAA6B,CAAC,GAAG,OAAO,CAAA;IAClD,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAA;IAC1B,IAAI,GAAG,CAAC,WAAW;QAAE,OAAO,CAAC,kCAAkC,CAAC,GAAG,MAAM,CAAA;IACzE,IAAI,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,OAAO,CAAC,+BAA+B,CAAC,GAAG,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,qBAAqB,GAAG,CAC5B,SAA6B,EAC7B,UAAyC,EACjC,EAAE;IACV,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,SAAS,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChD,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,mEAAmE;QACnE,OAAO,EAAE,CAAA;IACX,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QAChD,+DAA+D;QAC/D,gEAAgE;QAChE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;QAC9B,MAAM,GAAG,GAAa,EAAE,CAAA;QACxB,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;YAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAQ;YAC3B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACb,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACb,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACvB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,KAAK,MAAM,CAAC,IAAI,UAAU;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;QACtB,IAAI,GAAG,KAAK,EAAE;YAAE,SAAQ;QACxB,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,EAAE,CAAA;QAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAQ;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAQ;QAC3B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACb,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACf,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACvB,CAAC,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,GAAe,EACf,GAAgB,EACF,EAAE;IAChB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;IAC7C,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACrE,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAA;IAC/D,MAAM,YAAY,GAAG,qBAAqB,CAAC,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,CAAA;IACvE,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;IAC7C,MAAM,OAAO,GAA2B;QACtC,8BAA8B,EAAE,YAAY;QAC5C,wBAAwB,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC;QACtD,IAAI,EAAE,QAAQ;KACf,CAAA;IACD,4DAA4D;IAC5D,qEAAqE;IACrE,gEAAgE;IAChE,uDAAuD;IACvD,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;QACxB,OAAO,CAAC,8BAA8B,CAAC,GAAG,YAAY,CAAA;IACxD,CAAC;IACD,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,CAAC,6BAA6B,CAAC,GAAG,OAAO,CAAA;IACpE,IAAI,GAAG,CAAC,WAAW;QAAE,OAAO,CAAC,kCAAkC,CAAC,GAAG,MAAM,CAAA;IACzE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;AAC9C,CAAC,CAAA"}

package/dist/http.d.ts

@@ -0,0 +1,94 @@
+import type { CorsConfig, Handler, Method, MockRequest, MockResponse, RouteKey } from './types.js';
+/** A contributed route; explicit routes replace generated defaults with the same key. */
+export interface RouteDefinition {
+    readonly key: RouteKey;
+    readonly handler: Handler;
+    readonly priority: 'explicit' | 'generated';
+    readonly source?: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+    /** Override application CORS, or false when the route owner supplies its own policy. */
+    readonly cors?: CorsConfig | false;
+}
+/** Registered in setup, materialized exactly once after every plugin has prepared. */
+export interface RouteSource {
+    readonly owner: string;
+    readonly order: number;
+    materialize(): readonly RouteDefinition[];
+}
+/** Frozen resolved route metadata exposed after HTTP activation. Exact paths match first;
+ * parameterized ties follow source composition order, then source declaration order. */
+export interface ResolvedRoute extends RouteDefinition {
+    readonly owner: string;
+    readonly method: Method;
+    readonly path: string;
+}
+/** Final outcome, including transport effects which cannot be represented by Fetch responses. */
+export type HttpOutcome = {
+    readonly kind: 'response';
+    readonly response: Response;
+} | {
+    readonly kind: 'terminate';
+    readonly reason: string;
+};
+/** One final observation per request, after decoration and HEAD body suppression. */
+export interface HttpObservation {
+    readonly request: MockRequest;
+    readonly outcome: HttpOutcome;
+    readonly durationMs: number;
+    readonly error?: unknown;
+}
+/** Fixed pipeline phase with explicit composition order, independent of dependency sorting. */
+export type HttpMiddleware = {
+    readonly owner: string;
+    readonly order: number;
+} & ({
+    readonly stage: 'preflight' | 'validation' | 'interception';
+    readonly handle: (request: MockRequest) => MockResponse | void | Promise<MockResponse | void>;
+} | {
+    readonly stage: 'decoration';
+    readonly handle: (request: MockRequest, response: MockResponse) => MockResponse | void | Promise<MockResponse | void>;
+} | {
+    readonly stage: 'error';
+    readonly handle: (request: MockRequest, error: unknown) => MockResponse | void | Promise<MockResponse | void>;
+} | {
+    readonly stage: 'observation';
+    readonly handle: (observation: HttpObservation) => void | Promise<void>;
+});
+/** Listener bind intent passed to every guard before any socket opens. */
+export interface HttpBind {
+    readonly host: string;
+    readonly port: number;
+}
+/** Feature-owned policy registered before HTTP registration is sealed. */
+export interface BindGuard {
+    readonly owner: string;
+    check(bind: HttpBind): void | Promise<void>;
+}
+/** HTTP registration, resolved catalog, request dispatch, and pre-bind policy contract. */
+export interface HttpRuntime {
+    /** Shared logical/transport shutdown policy; deadline uses performance.now(). */
+    readonly drainTimeoutMs: number;
+    readonly drainDeadline: number | undefined;
+    registerRoutes(source: RouteSource): void;
+    registerMiddleware(middleware: HttpMiddleware): void;
+    registerBindGuard(guard: BindGuard): void;
+    readonly routes: readonly ResolvedRoute[];
+    /** Resolve with dispatch precedence, including HEAD fallback; available after activation. */
+    resolveRoute(method: string, path: string): ResolvedRoute | undefined;
+    checkBind(bind: HttpBind): Promise<void>;
+    dispatch(request: Request): Promise<HttpOutcome>;
+    fetch(request: Request): Promise<Response>;
+}
+export declare const httpCapability: import("@databehave/core").Capability<HttpRuntime>;
+/** A terminal transport effect; the pipeline observes it without running response decorators. */
+export declare class HttpTransportTermination extends Error {
+    constructor(message?: string);
+}
+/** Fetch has no socket to terminate; callers receive this explicit unsupported-effect error. */
+export declare class UnsupportedTransportError extends Error {
+    readonly reason: string;
+    constructor(reason: string);
+}
+/** Terminate the actual HTTP connection when invoked by a handler or middleware. */
+export declare const terminateTransport: (reason?: string) => never;
+//# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAElG,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,UAAU,GAAG,WAAW,CAAA;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACrD,wFAAwF;IACxF,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,GAAG,KAAK,CAAA;CACnC;AAED,sFAAsF;AACtF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,WAAW,IAAI,SAAS,eAAe,EAAE,CAAA;CAC1C;AAED;wFACwF;AACxF,MAAM,WAAW,aAAc,SAAQ,eAAe;IACpD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,iGAAiG;AACjG,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAE3D,qFAAqF;AACrF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB;AAED,+FAA+F;AAC/F,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB,GAAG,CACA;IAAE,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,YAAY,GAAG,cAAc,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;CAAE,GAC9J;IAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,KAAK,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;CAAE,GACvJ;IAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,KAAK,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;CAAE,GAC1I;IAAE,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,eAAe,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAC7G,CAAA;AAED,0EAA0E;AAC1E,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,0EAA0E;AAC1E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,KAAK,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC5C;AAED,2FAA2F;AAC3F,MAAM,WAAW,WAAW;IAC1B,iFAAiF;IACjF,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1C,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAA;IACzC,kBAAkB,CAAC,UAAU,EAAE,cAAc,GAAG,IAAI,CAAA;IACpD,iBAAiB,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,CAAA;IACzC,QAAQ,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAA;IACzC,6FAA6F;IAC7F,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAAA;IACrE,SAAS,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACxC,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAChD,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC3C;AAED,eAAO,MAAM,cAAc,oDAAgD,CAAA;AAE3E,iGAAiG;AACjG,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,SAAyC;CAI7D;AAED,gGAAgG;AAChG,qBAAa,yBAA0B,SAAQ,KAAK;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM;CAIpC;AAED,oFAAoF;AACpF,eAAO,MAAM,kBAAkB,GAAI,SAAS,MAAM,KAAG,KAEpD,CAAA"}

package/dist/http.js

@@ -0,0 +1,23 @@
+import { capability } from '@databehave/core';
+export const httpCapability = capability('databehave.http', 1);
+/** A terminal transport effect; the pipeline observes it without running response decorators. */
+export class HttpTransportTermination extends Error {
+    constructor(message = 'Connection terminated by HTTP policy') {
+        super(message);
+        this.name = 'HttpTransportTermination';
+    }
+}
+/** Fetch has no socket to terminate; callers receive this explicit unsupported-effect error. */
+export class UnsupportedTransportError extends Error {
+    reason;
+    constructor(reason) {
+        super(`Transport termination is unsupported by fetch: ${reason}`);
+        this.reason = reason;
+        this.name = 'UnsupportedTransportError';
+    }
+}
+/** Terminate the actual HTTP connection when invoked by a handler or middleware. */
+export const terminateTransport = (reason) => {
+    throw new HttpTransportTermination(reason);
+};
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAiF7C,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAc,iBAAiB,EAAE,CAAC,CAAC,CAAA;AAE3E,iGAAiG;AACjG,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAO,GAAG,sCAAsC;QAC1D,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAED,gGAAgG;AAChG,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAC7B;IAArB,YAAqB,MAAc;QACjC,KAAK,CAAC,kDAAkD,MAAM,EAAE,CAAC,CAAA;QAD9C,WAAM,GAAN,MAAM,CAAQ;QAEjC,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;IACzC,CAAC;CACF;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAe,EAAS,EAAE;IAC3D,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAA;AAC5C,CAAC,CAAA"}

package/dist/index.d.ts

@@ -1,21 +1,11 @@
-/**
- * Public entry point for `@databehave/server`.
- *
- * Re-exports the surface that consumers are allowed to use. Internal
- * modules (`request`, `response`, `route-key`) are not re-exported on
- * purpose — they are implementation details.
- *
- * `@databehave/server` is standalone — it ships with an in-server
- * OAS-driven mock generator and pulls no DSL dependency at runtime.
- * For richer mock data (distributions, datasets, FK-aware generation)
- * install the DSL package separately and import it directly.
- */
-export { defineConfig } from './define.js';
-export { run, type RunHandle, type RunOptions } from './run.js';
-export { createServer } from './server.js';
-export { seedFor, type SeedInput } from './openapi/seed.js';
-export { loadConfig, type EndpointResponse, type EndpointSpec, type LoadedConfig, type LoadConfigOptions, type JsonConfig, } from './json-config.js';
-export { resolveStatus, type MockModeConfig, type MockModeLogger, } from './mock-mode.js';
-export type { Config, CorsConfig, Handler, ListenHandle, ListenOptions, Method, MockRequest, MockResponse, MockResponseBody, ObservedMethod, RouteKey, Server, } from './types.js';
-export type { AdminModeConfig, ErrorMode, StickyOverride, OverrideMatcher, AdminModeCors, } from './admin/admin-types.js';
+/** Public HTTP contracts and optional HTTP plugins. Feature packages depend on this boundary. */
+export { httpPlugin, type HttpOptions } from './server.js';
+export { httpCapability, terminateTransport, HttpTransportTermination, UnsupportedTransportError, type HttpRuntime, type HttpMiddleware, type HttpOutcome, type HttpObservation, type HttpBind, type BindGuard, type RouteDefinition, type RouteSource, type ResolvedRoute, } from './http.js';
+export { nodeHttpPlugin, listenerCapability, type HttpListener, type NodeHttpOptions } from './node-http.js';
+export { routesPlugin } from './plugins/routes.js';
+export { corsPlugin } from './plugins/cors.js';
+export { accessLogPlugin, type AccessLogOptions } from './plugins/access-log.js';
+export { parseRouteKey, parseRoutePattern, matchPattern, type RoutePattern, type PatternSegment, type ParsedRouteKey } from './route-key.js';
+export type { LogFormatOptions } from './log.js';
+export type { Handler, Method, MockRequest, MockResponse, MockResponseBody, ObservedMethod, RouteKey, CorsConfig } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,GAAG,EAAE,KAAK,SAAS,EAAE,KAAK,UAAU,EAAE,MAAM,UAAU,CAAA;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,EACL,UAAU,EACV,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,UAAU,GAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,aAAa,EACb,KAAK,cAAc,EACnB,KAAK,cAAc,GACpB,MAAM,gBAAgB,CAAA;AACvB,YAAY,EACV,MAAM,EACN,UAAU,EACV,OAAO,EACP,YAAY,EACZ,aAAa,EACb,MAAM,EACN,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,cAAc,EACd,QAAQ,EACR,MAAM,GACP,MAAM,YAAY,CAAA;AAGnB,YAAY,EACV,eAAe,EACf,SAAS,EACT,cAAc,EACd,eAAe,EACf,aAAa,GACd,MAAM,wBAAwB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,OAAO,EAAE,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,EACL,cAAc,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,EACvF,KAAK,WAAW,EAAE,KAAK,cAAc,EAAE,KAAK,WAAW,EAAE,KAAK,eAAe,EAC7E,KAAK,QAAQ,EAAE,KAAK,SAAS,EAAE,KAAK,eAAe,EAAE,KAAK,WAAW,EAAE,KAAK,aAAa,GAC1F,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAC5G,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAChF,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,YAAY,EAAE,KAAK,YAAY,EAAE,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC5I,YAAY,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAChD,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA"}

package/dist/index.js

@@ -1,19 +1,9 @@
-/**
- * Public entry point for `@databehave/server`.
- *
- * Re-exports the surface that consumers are allowed to use. Internal
- * modules (`request`, `response`, `route-key`) are not re-exported on
- * purpose — they are implementation details.
- *
- * `@databehave/server` is standalone — it ships with an in-server
- * OAS-driven mock generator and pulls no DSL dependency at runtime.
- * For richer mock data (distributions, datasets, FK-aware generation)
- * install the DSL package separately and import it directly.
- */
-export { defineConfig } from './define.js';
-export { run } from './run.js';
-export { createServer } from './server.js';
-export { seedFor } from './openapi/seed.js';
-export { loadConfig, } from './json-config.js';
-export { resolveStatus, } from './mock-mode.js';
+/** Public HTTP contracts and optional HTTP plugins. Feature packages depend on this boundary. */
+export { httpPlugin } from './server.js';
+export { httpCapability, terminateTransport, HttpTransportTermination, UnsupportedTransportError, } from './http.js';
+export { nodeHttpPlugin, listenerCapability } from './node-http.js';
+export { routesPlugin } from './plugins/routes.js';
+export { corsPlugin } from './plugins/cors.js';
+export { accessLogPlugin } from './plugins/access-log.js';
+export { parseRouteKey, parseRoutePattern, matchPattern } from './route-key.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,GAAG,EAAmC,MAAM,UAAU,CAAA;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAkB,MAAM,mBAAmB,CAAA;AAC3D,OAAO,EACL,UAAU,GAMX,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,aAAa,GAGd,MAAM,gBAAgB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,OAAO,EAAE,UAAU,EAAoB,MAAM,aAAa,CAAA;AAC1D,OAAO,EACL,cAAc,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,GAGxF,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAA2C,MAAM,gBAAgB,CAAA;AAC5G,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,eAAe,EAAyB,MAAM,yBAAyB,CAAA;AAChF,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,YAAY,EAA+D,MAAM,gBAAgB,CAAA"}

package/dist/log.d.ts

@@ -1,57 +1,17 @@
-/**
- * Opt-in per-request access logger.
- *
- * One line per request, written to **stdout**. Default off — when the
- * top-level `log` config is absent or `false`, no logger is built and
- * the request hot path is untouched.
- *
- * Format `pretty` (default) — ANSI-coloured one-liner like:
- *
- *     GET /api/v1/health → 200 4 ms · 56
- *
- * Format `json` — newline-terminated JSON object suitable for piping
- * into structured log collectors:
- *
- *     {"t":"2026-05-28T…","method":"GET","path":"/api/v1/health","status":200,"ms":4,"bytes":56}
- *
- * Sticky / header overrides synthesised by the admin inject hook are
- * marked with ` [override:<mode.kind>]` (pretty) or `"override":"<kind>"` (json).
- *
- * Admin-panel traffic is suppressed by default — set `includeAdmin: true`
- * to log it too. The hot-path check is a single `startsWith` against the
- * resolved admin base path.
- */
-import type { LogConfig } from './types.js';
-export interface ResolvedLogConfig {
-    readonly access: boolean;
-    readonly includeAdmin: boolean;
-    readonly colors: boolean;
-    readonly format: 'pretty' | 'json';
-}
+/** One access event, already reduced to fields intended for logging. */
 export interface LogEvent {
     readonly method: string;
     readonly path: string;
-    readonly status: number;
+    readonly status: number | 'terminated';
     readonly ms: number;
     readonly bytes: string;
-    readonly override: string | undefined;
-    readonly error: string | undefined;
+    readonly error?: string;
 }
-export interface AccessLogger {
-    readonly emit: (ev: LogEvent) => void;
-    readonly isAdminPath: (path: string) => boolean;
+/** Access formatter configuration, independent of request filtering and output. */
+export interface LogFormatOptions {
+    readonly format?: 'pretty' | 'json';
+    readonly colors?: 'auto' | 'always' | 'never';
 }
-/**
- * Resolve a user-supplied `log` config into a normalised shape, or
- * `null` when logging is disabled. Pure — safe to call at construction.
- */
-export declare const resolveLogConfig: (cfg: LogConfig | undefined) => ResolvedLogConfig | null;
-/**
- * Build an access logger bound to the resolved config + admin path.
- * `adminPath` is the resolved `admin.path` (e.g. `/mock`), or
- * `undefined` when admin mode is off. Returns `null` when logging is
- * disabled — callers should short-circuit on `null` to avoid any
- * per-request allocation.
- */
-export declare const createAccessLogger: (cfg: LogConfig | undefined, adminPath: string | undefined) => AccessLogger | null;
+/** Format one newline-terminated event without reading or consuming a response body. */
+export declare const formatAccessLog: (event: LogEvent, options: LogFormatOptions) => string;
 //# sourceMappingURL=log.d.ts.map

package/dist/log.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../src/log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAE3C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,MAAM,CAAA;CACnC;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;CACnC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,QAAQ,KAAK,IAAI,CAAA;IACrC,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;CAChD;AAgCD;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAC3B,KAAK,SAAS,GAAG,SAAS,KACzB,iBAAiB,GAAG,IAkBtB,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,GAC7B,KAAK,SAAS,GAAG,SAAS,EAC1B,WAAW,MAAM,GAAG,SAAS,KAC5B,YAAY,GAAG,IA0CjB,CAAA"}
+{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../src/log.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAAA;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,mFAAmF;AACnF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAA;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAA;CAC9C;AAcD,wFAAwF;AACxF,eAAO,MAAM,eAAe,GAAI,OAAO,QAAQ,EAAE,SAAS,gBAAgB,KAAG,MAQ5E,CAAA"}