@decohere/http 0.0.1-dev.126 → 0.0.1-dev.5

package/types/src/auth/ability.d.ts

@@ -1,19 +0,0 @@
-import type { Principal } from "./auth.types.js";
-/** Root role — expands to CASL `manage`/`all` (covers every future ability). */
-export declare const ADMIN_ROLE = "admin";
-/**
- * Default CASL ability factory.
- *
- * - `admin` role → `manage` / `all` (wildcard)
- * - otherwise map `principal.scopes` of the form `"action:Subject"` to CASL rules
- *
- * Pass a custom factory to `withAuth()` (or override the app stub) for product-specific rules.
- */
-export declare function defineAbilitiesFor(principal: Principal): import("@casl/ability").MongoAbility<import("@casl/ability").AbilityTuple, import("@casl/ability").MongoQuery>;
-/**
- * Map a raw JWT payload → {@link Principal}.
- *
- * Merges OAuth `scope` / `scopes` with an IdP `permissions` claim (e.g. Auth0 API permissions).
- * Override via `withAuth(..., { principalMapper })` when claims differ.
- */
-export declare function createPrincipalFromPayload(payload: Record<string, unknown>): Principal;

package/types/src/auth/auth.config.d.ts

@@ -1,28 +0,0 @@
-import type { Principal } from "./auth.types.js";
-/**
- * Configuration for the TokenService, read from the `auth` section of the
- * application config file. Exactly one of the discriminant fields must be set.
- *
- * Production  → use `jwksUrl`, `publicKey`, or `secret`.
- * Development → use `devStatic` (only works when NODE_ENV=development).
- */
-export declare class AuthConfig {
-    /** OIDC discovery URL — the issuer base URL, e.g. https://accounts.google.com.
-     *  The framework appends `/.well-known/openid-configuration` automatically.
-     *  Use this instead of `jwksUrl` for any standard OIDC-compliant IdP.
-     */
-    discoveryUrl?: string;
-    /** JWKS endpoint URL (RS256 / ES256 via remote key set). */
-    jwksUrl?: string;
-    /** PEM-encoded public key or JWK JSON string (RS256 / ES256 static key). */
-    publicKey?: string;
-    algorithms?: string[];
-    /** Shared secret for HS256. */
-    secret?: string;
-    /** Issuer claim to validate (all non-devStatic variants). */
-    issuer?: string;
-    /** Audience claim to validate (all non-devStatic variants). */
-    audience?: string;
-    /** Static principal injected for every request (development only). */
-    devStatic?: Principal;
-}

package/types/src/auth/auth.extensions.d.ts

@@ -1,53 +0,0 @@
-import { Builder } from "../builder/builder.js";
-import type { PrincipalMapper } from "./auth.types.js";
-import type { AbilityFactory } from "./casl-authorization.service.js";
-export { ADMIN_ROLE, createPrincipalFromPayload, defineAbilitiesFor } from "./ability.js";
-export type WithAuthOptions = {
-    /**
-     * Override the default JWT payload → Principal mapping.
-     * Use this when your IdP stores roles or scopes in non-standard claims.
-     *
-     * @example Keycloak realm roles:
-     * ```ts
-     * builder.withAuth(factory, {
-     *   principalMapper: (p) => ({
-     *     sub: p.sub as string,
-     *     scopes: (p.realm_access as any)?.roles?.map((r: string) => `manage:${r}`) ?? [],
-     *   }),
-     * });
-     * ```
-     */
-    principalMapper?: PrincipalMapper;
-};
-declare module "@decohere/http" {
-    interface Builder {
-        /**
-         * Configure JWT authentication from the `auth` config section and wire
-         * up a CASL authorization service.
-         *
-         * By default, `defineAbilitiesFor` grants `manage`/`all` for the `admin`
-         * role and maps `principal.scopes` of the form `"action:Subject"` to CASL
-         * rules. Pass a custom `abilityFactory` to override that behaviour.
-         *
-         * Requires `.withConfiguration(...)` to be called on the builder.
-         *
-         * @example Default (scope-based, no boilerplate):
-         * ```ts
-         * builder.withConfiguration(YamlDataSource).withAuth();
-         * ```
-         *
-         * @example Custom override:
-         * ```ts
-         * builder.withAuth((principal) => {
-         *   const { can, build } = new AbilityBuilder(createMongoAbility);
-         *   // custom logic ...
-         *   return build();
-         * });
-         * ```
-         */
-        withAuth(abilityFactory?: AbilityFactory, options?: WithAuthOptions): Builder;
-    }
-}
-export declare class BuilderExtensions {
-    static withAuth(builder: Builder, abilityFactory?: AbilityFactory, options?: WithAuthOptions): Builder<import("@decohere/http").App>;
-}

package/types/src/auth/auth.types.d.ts

@@ -1,73 +0,0 @@
-export type Principal = {
-    sub: string;
-    roles?: string[];
-    scopes?: string[];
-    [key: string]: unknown;
-};
-/** Maps a raw JWT payload to a Principal. Override the default via withAuth() options. */
-export type PrincipalMapper = (payload: Record<string, unknown>) => Principal;
-export type JwksConfig = {
-    jwksUrl: string;
-    issuer?: string;
-    /** Required — empty/undefined disables jose `aud` checks (cross-API token accept). */
-    audience: string;
-};
-export type PublicKeyConfig = {
-    publicKey: string;
-    algorithms?: string[];
-    issuer?: string;
-    /** Required — empty/undefined disables jose `aud` checks (cross-API token accept). */
-    audience: string;
-};
-export type SecretConfig = {
-    secret: string;
-    issuer?: string;
-    /** Required — empty/undefined disables jose `aud` checks (cross-API token accept). */
-    audience: string;
-};
-export type DevStaticConfig = {
-    devStatic: Principal;
-};
-/**
- * Resolve IdP configuration automatically from an OIDC discovery endpoint
- * (`{discoveryUrl}/.well-known/openid-configuration`). The `discoveryUrl` is
- * also used as the expected `iss` claim unless the discovery document provides
- * a different value.
- */
-export type DiscoveryConfig = {
-    discoveryUrl: string;
-    /** Required — empty/undefined disables jose `aud` checks (cross-API token accept). */
-    audience: string;
-};
-/**
- * Framework-agnostic authorization service. Implement this interface (e.g.
- * via CaslAuthorizationService) and register it under AuthorizationServiceToken.
- * Throw ForbiddenError to deny access.
- */
-export interface IAuthorizationService {
-    authorizeRequest(request: import("../routing/anvil.types.js").HttpRequest, action: string, subject: string): Promise<Principal>;
-    /**
-     * Verify the request has a valid principal without checking a CASL ability.
-     * Used when auth is enabled but the route has no `@Authorize` metadata.
-     */
-    authenticateRequest(request: import("../routing/anvil.types.js").HttpRequest): Promise<Principal>;
-    authorize(principal: Principal, action: string, subject: string): Promise<void>;
-}
-export type TokenServiceConfig = JwksConfig | PublicKeyConfig | SecretConfig | DevStaticConfig | DiscoveryConfig;
-export declare function isDiscoveryConfig(config: TokenServiceConfig): config is DiscoveryConfig;
-export declare function isDevStaticConfig(config: TokenServiceConfig): config is DevStaticConfig;
-export declare function isJwksConfig(config: TokenServiceConfig): config is JwksConfig;
-export declare function isPublicKeyConfig(config: TokenServiceConfig): config is PublicKeyConfig;
-export declare function isSecretConfig(config: TokenServiceConfig): config is SecretConfig;
-/** `devStatic` is only valid for local development NODE_ENV values. */
-export declare function isDevelopmentNodeEnv(nodeEnv?: string): boolean;
-/**
- * Refuse `devStatic` outside development — otherwise any Bearer string is
- * accepted as the configured principal (auth bypass in production).
- */
-export declare function assertDevStaticAllowed(nodeEnv?: string): void;
-/**
- * jose skips `aud` validation when `audience` is undefined or "". Require a
- * non-empty audience for every non-devStatic verification strategy.
- */
-export declare function assertNonEmptyAudience(audience: string | undefined): asserts audience is string;

package/types/src/auth/casl-authorization.service.d.ts

@@ -1,28 +0,0 @@
-import type { AnyAbility } from "@casl/ability";
-import type { HttpRequest } from "../routing/anvil.types.js";
-import type { IAuthorizationService, Principal } from "./auth.types.js";
-import type { TokenService } from "./token-service.js";
-export type AbilityFactory = (principal: Principal) => AnyAbility;
-/**
- * IAuthorizationService implementation backed by CASL.
- *
- * Register it under AuthorizationServiceToken:
- * ```ts
- * builder.withServices((c) =>
- *   c.registerSingleton(AuthorizationServiceToken, new CaslAuthorizationService((principal) => {
- *     const { can, build } = new AbilityBuilder(createMongoAbility);
- *     if (principal.roles?.includes("admin")) can("manage", "all");
- *     else can("read", "Post");
- *     return build();
- *   }))
- * );
- * ```
- */
-export declare class CaslAuthorizationService implements IAuthorizationService {
-    private readonly factory;
-    private readonly tokenService?;
-    constructor(factory: AbilityFactory, tokenService?: TokenService);
-    authorizeRequest(request: HttpRequest, action: string, subject: string): Promise<Principal>;
-    authenticateRequest(request: HttpRequest): Promise<Principal>;
-    authorize(principal: Principal, action: string, subject: string): Promise<void>;
-}

package/types/src/auth/safe-outbound-url.d.ts

@@ -1,9 +0,0 @@
-/**
- * Validate URLs used for OIDC discovery / JWKS fetches to reduce SSRF risk.
- *
- * - http(s) only; https required except loopback (local IdP tests)
- * - no credentials in the URL
- * - hostname must not resolve to private, link-local, or metadata ranges
- *   (loopback allowed only when NODE_ENV is development/dev/test)
- */
-export declare function assertSafeOutboundUrl(raw: string, label: string): Promise<URL>;

package/types/src/auth/token-service.d.ts

@@ -1,31 +0,0 @@
-import { type JWTPayload } from "jose";
-import type { HttpRequest } from "../routing/anvil.types.js";
-import type { Principal, PrincipalMapper, TokenServiceConfig } from "./auth.types.js";
-export declare class TokenService {
-    private readonly config;
-    private readonly principalMapper?;
-    /** Lazily resolved JWKS set when using OIDC discovery. */
-    private discoveryJwks?;
-    private discoveryIssuer?;
-    /** Remote key set for `jwksUrl` mode, created once so jose can cache the keys. */
-    private configuredJwks?;
-    constructor(config: TokenServiceConfig, principalMapper?: PrincipalMapper);
-    verifyRequest(request: HttpRequest): Promise<Principal>;
-    verify(credentials: string): Promise<Principal>;
-    /**
-     * Resolve how to verify tokens for the configured strategy:
-     * - OIDC discovery → fetch JWKS + issuer from `/.well-known/openid-configuration`
-     * - explicit JWKS URL → remote key set + configured issuer/audience
-     * - public key / shared secret → static key material + configured issuer/audience
-     */
-    private resolveVerificationContext;
-    private resolveOidcDiscovery;
-    /**
-     * Sign a payload and return a JWT string.
-     * Only available when configured with a SecretConfig (HS256).
-     * For RS256/ES256 issuance, the caller is responsible for key management.
-     */
-    sign(payload: Omit<JWTPayload, "iss" | "aud"> & Record<string, unknown>, expiresIn?: string): Promise<string>;
-    private getStaticKey;
-    private mapPrincipal;
-}

package/types/src/builder/builder.d.ts

@@ -1,36 +0,0 @@
-import { type ContainerBuilder, ServiceContainerBuilder, type IContainer } from "@decohere/crucible";
-import { type IConfigurationService } from "@decohere/core/configuration";
-import type { Constructable } from "@decohere/core/reflection";
-import { App } from "../app/app.js";
-import type { HostedService } from "../hosting/hosted-service.js";
-export type BuilderOptions = {
-    containerBuilder?: ServiceContainerBuilder;
-    applicationName?: string;
-};
-export declare class Builder<T extends App = App> {
-    static create<T extends App = App>(options?: BuilderOptions): Builder<T>;
-    readonly containerBuilder: ServiceContainerBuilder;
-    readonly applicationName?: string;
-    private readonly logger;
-    private userServices;
-    private preBuildSteps;
-    private postBuildSteps;
-    private readonly hostedServices;
-    constructor(options?: BuilderOptions);
-    withServices(userServices: (containerBuilder: ContainerBuilder) => void): Builder<T>;
-    /**
-     * Run {@link HostedService}s for the life of the app: started in this order before the HTTP
-     * server listens, stopped in reverse when the app stops (including SIGTERM and Flux reboots).
-     * Each is registered as a singleton, so other services can inject it by its class.
-     */
-    withHostedService(...types: Constructable<HostedService>[]): Builder<T>;
-    registerPreBuildStep(step: (config: IConfigurationService, containerBuilder: ContainerBuilder) => Promise<void> | void): void;
-    registerPostBuildStep(step: (container: IContainer) => Promise<void> | void): void;
-    buildAndStart<T extends App>(type?: Constructable<T>): Promise<T | App>;
-    build<T extends App = App>(type?: Constructable<T>): Promise<T | App>;
-    private configureUserServices;
-    private runPreBuildSteps;
-    private runPostBuildSteps;
-    private configureApp;
-    private resolveApp;
-}

package/types/src/const.d.ts

@@ -1,32 +0,0 @@
-export declare const RouteRegistryToken: unique symbol;
-export declare const HttpProviderToken: unique symbol;
-export declare const RouterToken: unique symbol;
-export declare const PrincipalToken: unique symbol;
-export declare const IPrincipalProviderToken: unique symbol;
-export declare const TokenServiceToken: unique symbol;
-export declare const AuthorizationServiceToken: unique symbol;
-export declare const HttpOptionsToken: unique symbol;
-export declare const ExceptionFilterHostToken: unique symbol;
-export declare const ReadinessCheckToken: unique symbol;
-export declare const ReadinessServiceToken: unique symbol;
-export declare const HostedServiceHostToken: unique symbol;
-export type HTTPMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "OPTIONS";
-export declare const HTTPMethods: {
-    GET: "GET";
-    PUT: "PUT";
-    POST: "POST";
-    PATCH: "PATCH";
-    DELETE: "DELETE";
-};
-export declare const MetadataKeys: {
-    controller: string;
-    route: string;
-    parameter: string;
-    fieldMap: string;
-    authorize: string;
-    allowAnonymous: string;
-    httpCode: string;
-    headers: string;
-    catch: string;
-    sse: string;
-};

package/types/src/health/health.controller.d.ts

@@ -1,16 +0,0 @@
-import { ReadinessService } from "./readiness.service.js";
-/**
- * Liveness (`/health`) and readiness (`/ready`) probes.
- * Both are anonymous so orchestration can scrape them with auth enabled, and stay at the root
- * under a global prefix, where platforms look for them.
- */
-export declare class HealthController {
-    private readonly readiness;
-    constructor(readiness: ReadinessService);
-    health(): {
-        status: string;
-    };
-    ready(): Promise<{
-        status: string;
-    }>;
-}

package/types/src/health/health.extensions.d.ts

@@ -1,31 +0,0 @@
-import { Builder } from "../builder/builder.js";
-import "../http/http.extensions.js";
-import type { IReadinessCheck } from "./readiness.types.js";
-export type WithHealthOptions = {
-    /** Extra readiness probes (e.g. custom dependency checks). */
-    checks?: IReadinessCheck[];
-    /**
-     * Serve the probes under the global prefix (`/api/health`) instead of at the root. Default
-     * `false`: Cloud Run, Kubernetes and most load balancers probe the root.
-     */
-    underGlobalPrefix?: boolean;
-};
-declare module "@decohere/http" {
-    interface Builder {
-        /**
-         * Register anonymous `/health` (liveness) and `/ready` (readiness) routes.
-         *
-         * Readiness runs every {@link IReadinessCheck} registered under
-         * {@link ReadinessCheckToken} (TypeORM registers one per datasource when
-         * `.withTypeOrm()` is used). Pass `checks` for app-specific probes.
-         *
-         * The probes stay at the root under `withGlobalPrefix`, unless `underGlobalPrefix` is set.
-         *
-         * Requires `.withHttpProvider(...)` (or `@decohere/http/http` side-effect).
-         */
-        withHealth(options?: WithHealthOptions): Builder;
-    }
-}
-export declare class BuilderExtensions {
-    static withHealth(builder: Builder, options?: WithHealthOptions): Builder<import("@decohere/http").App>;
-}

package/types/src/health/readiness.service.d.ts

@@ -1,9 +0,0 @@
-import type { HostedServiceHost } from "../hosting/hosted-service-host.js";
-import type { IReadinessCheck, ReadinessResult } from "./readiness.types.js";
-export declare class ReadinessService {
-    private readonly hostedServices?;
-    private readonly checks;
-    constructor(checks?: IReadinessCheck[], hostedServices?: HostedServiceHost);
-    /** Registered checks, then each started hosted service that has a `check()` (still warming up). */
-    checkAll(): Promise<ReadinessResult>;
-}

package/types/src/hosting/hosted-service-host.d.ts

@@ -1,37 +0,0 @@
-import type { IContainer } from "@decohere/crucible";
-import type { Constructable } from "@decohere/core/reflection";
-import type { IReadinessCheck } from "../health/readiness.types.js";
-import type { HostedService } from "./hosted-service.js";
-/**
- * Starts and stops the app's {@link HostedService}s. One per app; `Builder.withHostedService`
- * adds the types and `App` drives it.
- */
-export declare class HostedServiceHost {
-    private readonly logger;
-    private readonly types;
-    private readonly controller;
-    /** In start order; stopped in reverse. */
-    private readonly started;
-    private starting;
-    private stopping;
-    add(...types: Constructable<HostedService>[]): void;
-    get isEmpty(): boolean;
-    /**
-     * Start every service in registration order. If one throws, the ones already started are
-     * stopped and the error is rethrown. Stops launching more once {@link stop} has begun.
-     */
-    start(container: IContainer): Promise<void>;
-    /** Abort the services' signal: background work should wind down. {@link stop} does this too. */
-    abort(): void;
-    /**
-     * Abort the signal, wait for a start still in progress, then stop the started services in
-     * reverse order. Every `stop()` runs even if one throws; the failures are rethrown after.
-     */
-    stop(): Promise<void>;
-    /** The started services that report readiness, for `GET /ready`. */
-    readinessChecks(): IReadinessCheck[];
-    private startAll;
-    private stopAll;
-    /** Stop what is started, newest first. Takes each service off the list, so it runs once. */
-    private stopStarted;
-}

package/types/src/hosting/hosted-service.d.ts

@@ -1,31 +0,0 @@
-/**
- * Work that runs for the life of the app outside a request: a feed, a poller, a queue consumer.
- * Register it with `builder.withHostedService(Type)`; it is a singleton, so other services can
- * inject it by its class.
- *
- * The app starts hosted services in registration order before the HTTP server listens, and stops
- * them in reverse order when it stops (`app.dispose()`, SIGTERM or SIGINT, a Flux reboot).
- */
-export interface HostedService {
-    /**
-     * Called once when the app starts, and awaited: a throw fails `app.start()`. Do what must be
-     * ready before traffic, then start long work (a first load that takes minutes, a timer) in
-     * the background and return. Waiting for it here keeps the HTTP server dark.
-     *
-     * `signal` is aborted as soon as the app starts stopping, before `stop()` is called, also
-     * while `start()` itself is still running. Stop background work and clear timers on it.
-     */
-    start(signal: AbortSignal): Promise<void> | void;
-    /**
-     * Called once when the app stops, after the HTTP server has drained and before the container
-     * is disposed, so the services it uses (a DataSource) are still open. Wait here for the
-     * background work to finish. Optional: a service with nothing to wait for can rely on the
-     * signal, or on `Symbol.asyncDispose`, which the container calls later.
-     */
-    stop?(): Promise<void> | void;
-    /**
-     * Readiness while the service is started but still warming up: throw until it can serve, and
-     * `GET /ready` answers 503 (`withHealth()`). Optional.
-     */
-    check?(): Promise<void>;
-}

package/types/src/http/http.compression.d.ts

@@ -1,32 +0,0 @@
-/**
- * Response compression (`builder.withCompression`). Provider-neutral options and defaults;
- * the HTTP provider hands them to its compression plugin and the plugin owns the policy
- * (which responses are compressed, `Vary`, `HEAD`, streams). See ADR 0008.
- */
-/** A content coding the HTTP package can offer. */
-export type CompressionEncoding = "br" | "gzip" | "deflate";
-/** Bodies smaller than this many bytes are sent as they are (not applied to streams, such as files). */
-export declare const DEFAULT_COMPRESSION_THRESHOLD = 1024;
-/** The codings offered by default, in order of preference. `deflate` is left out on purpose. */
-export declare const DEFAULT_COMPRESSION_ENCODINGS: readonly CompressionEncoding[];
-/** Options for {@link Builder.withCompression}. `false` turns compression off. */
-export type CompressionOptions = false | {
-    /** Smallest body, in bytes, that is compressed. Defaults to 1024. Not applied to streamed bodies. */
-    threshold?: number;
-    /** The codings to offer, in order of preference. Defaults to `["br", "gzip"]`. */
-    encodings?: CompressionEncoding[];
-    /**
-     * Content types to compress, tested against the `Content-Type` header. Passed to the
-     * plugin as `customTypes`: it replaces the plugin's default pattern (text, JSON, XML,
-     * `octet-stream`; never `text/event-stream`) and anything the MIME database marks
-     * compressible is still compressed. Use it to add a type; do not match
-     * `text/event-stream` unless you want streams buffered.
-     */
-    types?: RegExp | ((contentType: string) => boolean);
-    /**
-     * Fastify-specific. Any other `@fastify/compress` option (`brotliOptions`, `zlibOptions`,
-     * `onUnsupportedEncoding`, `inflateIfDeflated`, ...), merged last so it overrides the
-     * values above. Not portable to another HTTP provider.
-     */
-    providerOptions?: Record<string, unknown>;
-};

package/types/src/http/http.extensions.d.ts

@@ -1,79 +0,0 @@
-import type { Constructable } from "@decohere/core/reflection";
-import { Builder } from "../builder/builder.js";
-import type { OpenApiOptions } from "../openapi/openapi.types.js";
-import type { CorsOptions, HttpProvider } from "../routing/anvil.types.js";
-import type { ExceptionFilter } from "../routing/filters/exception-filter.js";
-import type { Middleware } from "../routing/middleware/middleware.js";
-import type { WithHttpOptions } from "./http.options.js";
-import type { CompressionOptions } from "./http.compression.js";
-import type { HelmetOptions, RateLimitOptions } from "./http.security.js";
-import { type StaticOptions } from "./http.static.js";
-declare module "@decohere/http" {
-    interface Builder {
-        withHttpProvider<Thttp extends Constructable<HttpProvider>>(type: Thttp): Builder;
-        /**
-         * HTTP provider plus scaffold defaults (request id + Scribe access log).
-         * Prefer this over {@link Builder.withHttpProvider} for application entrypoints.
-         */
-        withHttp<Thttp extends Constructable<HttpProvider>>(type: Thttp, options?: WithHttpOptions): Builder;
-        withControllers(...controllers: Constructable[]): Builder;
-        /**
-         * Prefix every controller route (`/api` makes `/lp/portfolio` into `/api/lp/portfolio`).
-         * It covers controller routes only: not static mounts (`withStatic`), not the OpenAPI
-         * document, and not a controller declared with `@Controller({ globalPrefix: false })`,
-         * such as the `withHealth()` probes, which platforms expect at the root. With a prefix
-         * set, the static fallback treats everything under it as the API.
-         */
-        withGlobalPrefix(prefix: string): Builder;
-        withCors(options: CorsOptions): Builder;
-        /**
-         * Override or disable default `@fastify/helmet` headers.
-         * Defaults are on with `withHttpProvider`; pass `false` to disable.
-         */
-        withHelmet(options?: HelmetOptions): Builder;
-        /**
-         * Override or disable default `@fastify/rate-limit` (100 req / 1 minute).
-         * Pass `false` to disable.
-         */
-        withRateLimit(options?: RateLimitOptions): Builder;
-        /**
-         * Compress responses with `br` or `gzip` when the client accepts it, using `@fastify/compress`
-         * with best-practice defaults (on by default, 1 KB threshold, no `deflate`). Pass `false` to
-         * turn it off, or `{ threshold, encodings, types, providerOptions }` to override. The plugin
-         * does not compress `text/event-stream` by default. Compressing a response that mixes a secret
-         * with input an attacker controls can leak the secret over HTTPS (BREACH); see ADR 0008.
-         */
-        withCompression(options?: CompressionOptions): Builder;
-        /**
-         * Override the default request body size limit (1 MiB).
-         */
-        withBodyLimit(bytes: number): Builder;
-        withMiddleware(...middlewares: Constructable<Middleware>[]): Builder;
-        withExceptionFilters(...filters: Constructable<ExceptionFilter>[]): Builder;
-        withOpenApi(options: OpenApiOptions): Builder;
-        /**
-         * Serve a built UI (a folder of static files) from this API, for example
-         * `.withStatic("/ui/", "ui")`. The directory is resolved from the process working
-         * directory, like `./config`. The files are public: they are served before auth,
-         * validation and middleware, and outside the rate limit. An unknown path under the prefix
-         * serves `index.html` to a browser (`Accept: text/html`) so client routes survive a reload. `"/"` mounts it at the root. Hashed assets are cached for a
-         * year, `index.html` is not cached. See {@link StaticOptions}.
-         */
-        withStatic(prefix: string, directory: string, options?: StaticOptions): Builder;
-    }
-}
-export declare class BuilderExtensions {
-    static withHttpProvider<Thttp extends Constructable<HttpProvider>>(builder: Builder, type: Thttp): Builder<import("@decohere/http").App>;
-    static withHttp<Thttp extends Constructable<HttpProvider>>(builder: Builder, type: Thttp, options?: WithHttpOptions): Builder<import("@decohere/http").App>;
-    static withControllers(builder: Builder, ...controllers: Constructable[]): Builder<import("@decohere/http").App>;
-    static withGlobalPrefix(builder: Builder, prefix: string): Builder<import("@decohere/http").App>;
-    static withCors(builder: Builder, options: CorsOptions): Builder<import("@decohere/http").App>;
-    static withHelmet(builder: Builder, options?: HelmetOptions): Builder<import("@decohere/http").App>;
-    static withRateLimit(builder: Builder, options?: RateLimitOptions): Builder<import("@decohere/http").App>;
-    static withCompression(builder: Builder, options?: CompressionOptions): Builder<import("@decohere/http").App>;
-    static withBodyLimit(builder: Builder, bytes: number): Builder<import("@decohere/http").App>;
-    static withMiddleware(builder: Builder, ...middlewares: Constructable<Middleware>[]): Builder<import("@decohere/http").App>;
-    static withExceptionFilters(builder: Builder, ...filters: Constructable<ExceptionFilter>[]): Builder<import("@decohere/http").App>;
-    static withOpenApi(builder: Builder, options: OpenApiOptions): Builder<import("@decohere/http").App>;
-    static withStatic(builder: Builder, prefix: string, directory: string, options?: StaticOptions): Builder<import("@decohere/http").App>;
-}

package/types/src/http/http.options.d.ts

@@ -1,39 +0,0 @@
-import type { Constructable } from "@decohere/core/reflection";
-import type { OpenApiOptions } from "../openapi/openapi.types.js";
-import type { CorsOptions } from "../routing/anvil.types.js";
-import type { ExceptionFilter } from "../routing/filters/exception-filter.js";
-import type { Middleware } from "../routing/middleware/middleware.js";
-import type { CompressionOptions } from "./http.compression.js";
-import type { StaticMount } from "./http.static.js";
-import type { HelmetOptions, RateLimitOptions } from "./http.security.js";
-/** Options for {@link Builder.withHttp} (request-id / access-log defaults, etc.). */
-export type WithHttpOptions = {
-    /**
-     * Register {@link HttpAccessLogMiddleware} (request id echo + Scribe access log).
-     * Defaults to `true`.
-     */
-    accessLog?: boolean;
-};
-/** App-level HTTP options set via builder extensions (`withCors`, `withGlobalPrefix`, …). */
-export declare class HttpOptions {
-    globalPrefix: string;
-    /**
-     * Controllers put under the global prefix although they declare `globalPrefix: false`
-     * (`withHealth({ underGlobalPrefix: true })`).
-     */
-    readonly underGlobalPrefix: Set<Constructable>;
-    cors?: CorsOptions;
-    openapi?: OpenApiOptions;
-    /** `undefined` = helmet on with defaults; `false` = off; object = plugin options. */
-    helmet?: HelmetOptions;
-    /** `undefined` = rate-limit on with defaults; `false` = off; object = plugin options. */
-    rateLimit?: RateLimitOptions;
-    /** `undefined` = compression on with defaults; `false` = off; object = options. See `withCompression`. */
-    compression?: CompressionOptions;
-    /** Request body size limit in bytes; `undefined` uses the 1 MiB default. */
-    bodyLimit?: number;
-    /** Built UIs served from this API, see `withStatic`. */
-    statics: StaticMount[];
-    middlewareTypes: Constructable<Middleware>[];
-    filterTypes: Constructable<ExceptionFilter>[];
-}