@dunx/http 3.6.0 → 3.7.0

package/dist/index.js

@@ -12,6 +12,8 @@ import {
   PUBLIC2,
   HIDDEN2,
   UNMATCHED2,
+  STREAMS2,
+  REQUEST_SERVER,
   Roles2,
   Public2,
   ApiHidden2,
@@ -19,89 +21,32 @@ import {
   metaOf2,
   mergeMeta2,
   discoverRoutes2,
-  RoutePrefix2,
+  RoutePrefix2
+} from "./chunk-1jt27yka.js";
+import {
   HandlerKind,
   markHandler,
   markGateway,
   discoverGateways,
-  buildContext2
-} from "./chunk-p9hdmkm6.js";
+  buildContext2,
+  StaticOptions2,
+  StaticFiles2
+} from "./chunk-3eecdh6d.js";
 import {
   TRACEPARENT_HEADER2,
   TRACESTATE_HEADER2,
   TRACERESPONSE_HEADER2,
   TraceContext2
 } from "./chunk-gmtwad7f.js";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __name = (target, name) => {
-  Object.defineProperty(target, "name", {
-    value: name,
-    enumerable: false,
-    configurable: true
-  });
-  return target;
-};
-var __knownSymbol = (name, symbol) => (symbol = Symbol[name]) ? symbol : Symbol.for("Symbol." + name);
-var __typeError = (msg) => {
-  throw TypeError(msg);
-};
-var __defNormalProp = (obj, key, value) => (key in obj) ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
-var __privateIn = (member, obj) => Object(obj) !== obj ? __typeError('Cannot use the "in" operator on this value') : member.has(obj);
-var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
-var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
-var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
-var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "access private method"), method);
-var __decoratorStart = (base) => [, , , __create(base?.[__knownSymbol("metadata")] ?? null)];
-var __decoratorStrings = ["class", "method", "getter", "setter", "accessor", "field", "value", "get", "set"];
-var __expectFn = (fn) => fn !== undefined && typeof fn !== "function" ? __typeError("Function expected") : fn;
-var __decoratorContext = (kind, name, done, metadata, fns) => ({
-  kind: __decoratorStrings[kind],
-  name,
-  metadata,
-  addInitializer: (fn) => done._ ? __typeError("Already initialized") : fns.push(__expectFn(fn || null))
-});
-var __decoratorMetadata = (array, target) => __defNormalProp(target, __knownSymbol("metadata"), array[3]);
-var __runInitializers = (array, flags, self, value) => {
-  for (var i = 0, fns = array[flags >> 1], n = fns && fns.length;i < n; i++)
-    flags & 1 ? fns[i].call(self) : value = fns[i].call(self, value);
-  return value;
-};
-var __decorateElement = (array, flags, name, decorators, target, extra) => {
-  var fn, it, done, ctx, access, k = flags & 7, s = !!(flags & 8), p = !!(flags & 16);
-  var j = k > 3 ? array.length + 1 : k ? s ? 1 : 2 : 0, key = __decoratorStrings[k + 5];
-  var initializers = k > 3 && (array[j - 1] = []), extraInitializers = array[j] || (array[j] = []);
-  var desc = k && (!p && !s && (target = target.prototype), k < 5 && (k > 3 || !p) && __getOwnPropDesc(k < 4 ? target : {
-    get [name]() {
-      return __privateGet(this, extra);
-    },
-    set [name](x) {
-      __privateSet(this, extra, x);
-    }
-  }, name));
-  k ? p && k < 4 && __name(extra, (k > 2 ? "set " : k > 1 ? "get " : "") + name) : __name(target, name);
-  for (var i = decorators.length - 1;i >= 0; i--) {
-    ctx = __decoratorContext(k, name, done = {}, array[3], extraInitializers);
-    if (k) {
-      ctx.static = s, ctx.private = p, access = ctx.access = { has: p ? (x) => __privateIn(target, x) : (x) => (name in x) };
-      if (k ^ 3)
-        access.get = p ? (x) => (k ^ 1 ? __privateGet : __privateMethod)(x, target, k ^ 4 ? extra : desc.get) : (x) => x[name];
-      if (k > 2)
-        access.set = p ? (x, y) => __privateSet(x, target, y, k ^ 4 ? extra : desc.set) : (x, y) => x[name] = y;
-    }
-    it = (0, decorators[i])(k ? k < 4 ? p ? extra : desc[key] : k > 4 ? undefined : { get: desc.get, set: desc.set } : target, ctx);
-    done._ = 1;
-    if (k ^ 4 || it === undefined)
-      __expectFn(it) && (k > 4 ? initializers.unshift(it) : k ? p ? extra = it : desc[key] = it : target = it);
-    else if (typeof it !== "object" || it === null)
-      __typeError("Object expected");
-    else
-      __expectFn(fn = it.get) && (desc.get = fn), __expectFn(fn = it.set) && (desc.set = fn), __expectFn(fn = it.init) && initializers.unshift(fn);
-  }
-  return k || __decoratorMetadata(array, target), desc && __defProp(target, name, desc), p ? k ^ 4 ? extra : desc : target;
-};
+import {
+  __privateGet,
+  __privateAdd,
+  __decoratorStart,
+  __decoratorMetadata,
+  __runInitializers,
+  __decorateElement,
+  PathClaims
+} from "./chunk-08k9vq31.js";
 
 // src/route/decorators.ts
 var Controller = (prefix = "") => (target) => {
@@ -217,6 +162,17 @@ import {
   RequestContext as RequestContext3
 } from "@dunx/core";
 
+// src/server/claimed-routes.ts
+class ClaimedRoutes {
+  #paths = new Set;
+  attach(paths) {
+    this.#paths = new Set(paths);
+  }
+  has(path) {
+    return this.#paths.has(path);
+  }
+}
+
 // src/server/metrics.ts
 import { Durations } from "@dunx/core";
 var UNMATCHED_ROUTE = "(unmatched)";
@@ -922,6 +878,10 @@ import {
   teardownFailures as toFailures
 } from "@dunx/core";
 
+// src/server/middleware.ts
+var compose = (middleware, ctx, handler) => middleware.reduceRight((next, current) => (req) => current.handle(req, ctx, () => next(req)), handler);
+var hasClaimedPaths = (value) => typeof value.claimedPaths === "function";
+
 // src/server/request-logging.ts
 import {
   Logger as Logger2,
@@ -1213,7 +1173,7 @@ var applyCors = (options, req, response) => {
   return response;
 };
 var withCors = (options, handler) => {
-  return async (req) => applyCors(options, req, await handler(req));
+  return async (req, server) => applyCors(options, req, await handler(req, server));
 };
 var preflight = (options, methods) => {
   const allowMethods = (options.methods ?? methods).join(", ");
@@ -1336,9 +1296,6 @@ var buildInputReader = (options) => {
   return (req) => fill({ req });
 };
 
-// src/server/middleware.ts
-var compose = (middleware, ctx, handler) => middleware.reduceRight((next, current) => (req) => current.handle(req, ctx, () => next(req)), handler);
-
 // src/server/routes.ts
 var construct = (guard) => new guard;
 var toResponse = (value, status) => {
@@ -1351,15 +1308,9 @@ var toResponse = (value, status) => {
 };
 var statusFor = (route) => route.options?.status ?? defaultStatusFor2(route.method);
 var assertNoCollisions = (discovered) => {
-  const owners = new Map;
+  const claims = new PathClaims("Route", "Bun would keep only one of them.");
   for (const route of discovered) {
-    const key = `${route.method} ${route.path}`;
-    const owner = `${route.controller}.${route.handlerName}`;
-    const existing = owners.get(key);
-    if (existing !== undefined) {
-      throw new AppError6(`Route collision: ${key} is declared by ${existing} and by ${owner}. ` + "Bun would keep only one of them.");
-    }
-    owners.set(key, owner);
+    claims.claim(`${route.method} ${route.path}`, `${route.controller}.${route.handlerName}`);
   }
 };
 var assertNoGatewayCollisions = (discovered, gatewayPaths) => {
@@ -1376,7 +1327,7 @@ var withUpgradeRoutes = (routes, gateways) => {
     merged[path] = { GET: upgrade };
   return merged;
 };
-var unmatchedContext = (req, isPublic) => Object.freeze({
+var unmatchedContext = (req, isPublic, server) => Object.freeze({
   controller: "(unmatched)",
   handler: "(none)",
   method: req.method,
@@ -1387,16 +1338,37 @@ var unmatchedContext = (req, isPublic) => Object.freeze({
       return true;
     if (key.id === PUBLIC2.id && isPublic)
       return true;
+    if (key.id === REQUEST_SERVER.id)
+      return server;
     return;
   }
 });
+var assertNoShadowedClaims = (discovered, middleware) => {
+  const routed = new Map;
+  for (const route of discovered) {
+    if (!routed.has(route.path)) {
+      routed.set(route.path, `${route.controller}.${route.handlerName}`);
+    }
+  }
+  for (const entry of middleware) {
+    if (!hasClaimedPaths(entry))
+      continue;
+    const owner = entry.constructor.name;
+    for (const path of entry.claimedPaths()) {
+      const taken = routed.get(path);
+      if (taken !== undefined) {
+        throw new AppError6(`Path collision: ${path} is declared by ${taken} and claimed by ` + `${owner}. A route wins, so the middleware would never see it.`);
+      }
+    }
+  }
+};
 var buildFallback = (middleware = [], onError = defaultErrorMapper, cors, notFound = "guarded") => {
   const miss = () => {
     throw new HttpError(HttpStatusCode2.NOT_FOUND, "NOT_FOUND");
   };
-  const run = async (req) => {
+  const run = async (req, server) => {
     try {
-      return await compose(middleware, unmatchedContext(req, notFound === "public"), miss)(req);
+      return await compose(middleware, unmatchedContext(req, notFound === "public", server), miss)(req);
     } catch (error) {
       return TraceContext2.stamp(onError(error, req), req);
     }
@@ -1450,7 +1422,8 @@ var buildRoutes = (discovered, middleware = [], onError = defaultErrorMapper, co
       ...(route.moduleMiddleware ?? []).map((entry) => guardOf(entry, route.module)),
       ...(route.guards ?? []).map((guard) => guardOf(guard, route.module))
     ];
-    const chained = compose(chain, buildContext2(route), async (req) => toResponse(await route.handler(await read(req)), status));
+    const context = buildContext2(route);
+    const chained = compose(chain, context, async (req) => toResponse(await route.handler(await read(req)), status));
     const guarded = async (req) => {
       try {
         return await chained(req);
@@ -1458,8 +1431,12 @@ var buildRoutes = (discovered, middleware = [], onError = defaultErrorMapper, co
         return TraceContext2.stamp(onError(error, req), req);
       }
     };
+    const served = cors ? withCors(cors, guarded) : directOr(guarded, route, read, status, onError, chain.length === 0);
     const byMethod = routes[route.path] ??= {};
-    byMethod[route.method] = cors ? withCors(cors, guarded) : directOr(guarded, route, read, status, onError, chain.length === 0);
+    byMethod[route.method] = context.get(STREAMS2) === true ? (req, server) => {
+      server?.timeout(req, 0);
+      return served(req, server);
+    } : served;
   }
   if (cors) {
     for (const byMethod of Object.values(routes)) {
@@ -1488,7 +1465,7 @@ class ServerBinding {
   }
   bind(plan) {
     const { websocket: ws } = plan;
-    const { http2, http1, gatewayPort } = this.#protocols;
+    const { http2, http1, gatewayPort, idleTimeout } = this.#protocols;
     const split = ws !== undefined && gatewayPort !== undefined;
     const table = ws && !split ? {
       routes: withUpgradeRoutes(plan.routes, ws.routes),
@@ -1499,6 +1476,7 @@ class ServerBinding {
       fetch: plan.fetch,
       ...http2 !== undefined && { http2 },
       ...http1 !== undefined && { http1 },
+      ...idleTimeout !== undefined && { idleTimeout },
       ...table
     });
     if (split) {
@@ -1506,6 +1484,7 @@ class ServerBinding {
         this.#gateways = Bun.serve({
           port: gatewayPort,
           fetch: plan.fetch,
+          ...idleTimeout !== undefined && { idleTimeout },
           routes: withUpgradeRoutes({}, ws.routes),
           websocket: ws.websocket
         });
@@ -1598,7 +1577,8 @@ class HttpApplication extends ShutdownAware {
     this.#binding = new ServerBinding({
       http2: options.http2,
       http1: options.http1,
-      gatewayPort: options.gatewayPort
+      gatewayPort: options.gatewayPort,
+      idleTimeout: options.idleTimeout
     });
     this.#split = options.gatewayPort !== undefined && websocket !== undefined;
     this.gatewayPaths = websocket?.paths ?? [];
@@ -1664,6 +1644,8 @@ class HttpApplication extends ShutdownAware {
     const ws = this.#websocket;
     if (ws && !this.#split)
       assertNoGatewayCollisions(prefixed, ws.paths);
+    assertNoShadowedClaims(prefixed, middleware);
+    this.#app.get(ClaimedRoutes).attach(middleware.flatMap((entry) => hasClaimedPaths(entry) ? [...entry.claimedPaths()] : []));
     const fetch = buildFallback(middleware, this.#onError, this.#cors, this.#notFound);
     const bound = this.#binding.bind({ port, routes, fetch, websocket: ws });
     attachAddressSource(this.#app.get(ClientAddress), {
@@ -1805,6 +1787,9 @@ class HttpOptionsProvider {
   get gatewayPort() {
     return;
   }
+  get idleTimeout() {
+    return;
+  }
 }
 
 class DefaultHttpOptions extends HttpOptionsProvider {
@@ -1831,7 +1816,8 @@ function resolveHttpOptions(settings, given) {
     relayResubscribe: settings.relayResubscribe,
     http2: settings.http2,
     http1: settings.http1,
-    gatewayPort: settings.gatewayPort
+    gatewayPort: settings.gatewayPort,
+    idleTimeout: settings.idleTimeout
   };
   for (const key of Object.keys(given)) {
     merged[key] = given[key];
@@ -1866,7 +1852,13 @@ class HttpFactory {
       useFactory: (logger, context, settings) => new SocketLoggingMiddleware(logger, context, pick(options.socketLogging, settings.socketLogging)),
       inject: [Logger4, RequestContext3, HttpOptionsProvider]
     });
-    const services = [PubSub, ClientAddress, RequestMetrics, RoutePrefix2];
+    const services = [
+      PubSub,
+      ClientAddress,
+      RequestMetrics,
+      RoutePrefix2,
+      ClaimedRoutes
+    ];
     const providers = [...services, logging, metricsMiddleware, socketLogging];
     const scope = {
       module: HttpModule,
@@ -1921,89 +1913,14 @@ class HttpFactory {
     return entries.map((entry) => app.get(entry, root));
   }
 }
-// src/static/files.ts
-import { join, normalize, resolve } from "path";
-
-// src/static/options.ts
-class StaticOptions {
-  root;
-  path;
-  maxAge;
-  immutable;
-  constructor(init) {
-    this.root = init.root;
-    this.path = normalizePrefix(init.path ?? "/");
-    this.maxAge = init.maxAge ?? 60;
-    this.immutable = init.immutable ?? (() => false);
-  }
-}
-Object.defineProperty(StaticOptions, Symbol.for("dunx.deps"), { value: () => [{ unresolved: "init: StaticOptionsInit" }] });
-var normalizePrefix = (path) => {
-  const trimmed = path.split("/").filter(Boolean).join("/");
-  return trimmed === "" ? "/" : `/${trimmed}`;
-};
-
-// src/static/files.ts
-class StaticFiles {
-  #options;
-  #root;
-  #prefix;
-  constructor(options) {
-    this.#options = options;
-    this.#root = resolve(options.root);
-    this.#prefix = options.path === "/" ? "/" : `${options.path}/`;
-  }
-  resolvePath(pathname) {
-    const relative = pathname.startsWith(this.#prefix) ? pathname.slice(this.#prefix.length) : pathname.slice(this.#options.path.length);
-    let decoded;
-    try {
-      decoded = decodeURIComponent(relative);
-    } catch {
-      return;
-    }
-    if (decoded.includes("\x00"))
-      return;
-    const candidate = resolve(join(this.#root, normalize(decoded)));
-    if (candidate !== this.#root && !candidate.startsWith(`${this.#root}/`)) {
-      return;
-    }
-    return candidate;
-  }
-  #cacheControl(pathname) {
-    const { immutable, maxAge } = this.#options;
-    return immutable(pathname) ? "public, max-age=31536000, immutable" : `public, max-age=${maxAge}`;
-  }
-  async handle(req, _ctx, next) {
-    const { pathname } = new URL(req.url);
-    if (pathname !== this.#options.path && !pathname.startsWith(this.#prefix)) {
-      return next();
-    }
-    if (req.method !== "GET" && req.method !== "HEAD")
-      return next();
-    const path = this.resolvePath(pathname);
-    if (path === undefined)
-      return next();
-    const file = Bun.file(path);
-    if (!await file.exists())
-      return next();
-    return new Response(file, {
-      headers: {
-        "cache-control": this.#cacheControl(pathname),
-        ...file.type === "" ? { "content-type": "application/octet-stream" } : {},
-        "x-content-type-options": "nosniff"
-      }
-    });
-  }
-}
-Object.defineProperty(StaticFiles, Symbol.for("dunx.deps"), { value: () => [StaticOptions] });
 // src/static/module.ts
 import {
   Module,
   provide as provide2
 } from "@dunx/core";
-var files = () => provide2(StaticFiles, {
-  useFactory: (options) => new StaticFiles(options),
-  inject: [StaticOptions]
+var files = () => provide2(StaticFiles2, {
+  useFactory: (options) => new StaticFiles2(options),
+  inject: [StaticOptions2]
 });
 var _dec = [
   Module({})
@@ -2014,9 +1931,9 @@ class StaticModule {
   static forRoot(init) {
     return {
       module: StaticModule,
-      exports: [StaticOptions, StaticFiles],
+      exports: [StaticOptions2, StaticFiles2],
       providers: [
-        provide2(StaticOptions, { useValue: new StaticOptions(init) }),
+        provide2(StaticOptions2, { useValue: new StaticOptions2(init) }),
         files()
       ]
     };
@@ -2025,10 +1942,10 @@ class StaticModule {
     return {
       module: StaticModule,
       ...config.imports && { imports: config.imports },
-      exports: [StaticOptions, StaticFiles],
+      exports: [StaticOptions2, StaticFiles2],
       providers: [
-        provide2(StaticOptions, {
-          useFactory: async (...deps) => new StaticOptions(await config.useFactory(...deps)),
+        provide2(StaticOptions2, {
+          useFactory: async (...deps) => new StaticOptions2(await config.useFactory(...deps)),
           inject: config.inject ?? []
         }),
         files()
@@ -2092,10 +2009,13 @@ var COMPRESSIBLE = new Set([
   "application/xml",
   "image/svg+xml"
 ]);
+var ENDLESS = new Set(["text/event-stream"]);
 var isCompressibleType = (contentType) => {
   if (contentType === null)
     return false;
   const type = contentType.split(";")[0]?.trim().toLowerCase() ?? "";
+  if (ENDLESS.has(type))
+    return false;
   if (type.startsWith("text/"))
     return true;
   if (type.endsWith("+json") || type.endsWith("+xml"))
@@ -2304,6 +2224,143 @@ CompressionModule = __decorateElement(_init, 0, "CompressionModule", _dec, Compr
 __runInitializers(_init, 1, CompressionModule);
 __decoratorMetadata(_init, CompressionModule);
 let _CompressionModule = CompressionModule;
+// src/sse/event.ts
+var lines = (value) => value.split(/\r\n|\r|\n/);
+var oneLine = (value) => lines(value)[0] ?? "";
+var frameEvent = (event) => {
+  const fields = [];
+  if (event.event !== undefined)
+    fields.push(`event: ${oneLine(event.event)}`);
+  if (event.id !== undefined)
+    fields.push(`id: ${oneLine(event.id)}`);
+  if (event.retry !== undefined) {
+    fields.push(`retry: ${Math.trunc(event.retry)}`);
+  }
+  if (event.data !== undefined) {
+    const data = typeof event.data === "string" ? event.data : JSON.stringify(event.data);
+    for (const line of lines(data ?? ""))
+      fields.push(`data: ${line}`);
+  }
+  return `${fields.join(`
+`)}
+
+`;
+};
+var frameComment = (text) => `${lines(text).map((line) => `:${line}`).join(`
+`)}
+
+`;
+
+// src/sse/stream.ts
+var DEFAULT_HEARTBEAT_MS = 15000;
+var encoder = new TextEncoder;
+var SSE_HEADERS = Object.freeze({
+  "content-type": "text/event-stream",
+  "cache-control": "no-cache, no-transform",
+  connection: "keep-alive"
+});
+
+class SseStream {
+  #body;
+  #controller;
+  #timer;
+  #lastEventId;
+  #closed = false;
+  constructor(options = {}) {
+    this.#body = new ReadableStream({
+      start: (controller) => {
+        this.#controller = controller;
+      },
+      cancel: () => {
+        this.#stop();
+      }
+    });
+    this.comment();
+    const heartbeatMs = options.heartbeatMs ?? DEFAULT_HEARTBEAT_MS;
+    if (heartbeatMs > 0) {
+      this.#timer = setInterval(() => {
+        this.comment();
+      }, heartbeatMs);
+      this.#timer.unref();
+    }
+  }
+  static from(events, options = {}) {
+    const stream = new SseStream(options);
+    (async () => {
+      try {
+        for await (const event of events) {
+          if (stream.#closed)
+            break;
+          stream.send(event);
+        }
+        stream.close();
+      } catch (error) {
+        stream.#fail(error);
+      }
+    })();
+    return stream;
+  }
+  get lastEventId() {
+    return this.#lastEventId;
+  }
+  get closed() {
+    return this.#closed;
+  }
+  send(event) {
+    if (event.id !== undefined)
+      this.#lastEventId = event.id;
+    this.#write(frameEvent(event));
+  }
+  comment(text = "") {
+    this.#write(frameComment(text));
+  }
+  close() {
+    if (this.#closed)
+      return;
+    this.#stop();
+    this.#controller?.close();
+  }
+  toResponse(headers = {}) {
+    return new Response(this.#body, {
+      headers: { ...headers, ...SSE_HEADERS }
+    });
+  }
+  #write(text) {
+    if (this.#closed)
+      return;
+    this.#controller?.enqueue(encoder.encode(text));
+  }
+  #fail(error) {
+    if (this.#closed)
+      return;
+    this.#stop();
+    this.#controller?.error(error);
+  }
+  #stop() {
+    this.#closed = true;
+    if (this.#timer !== undefined)
+      clearInterval(this.#timer);
+    this.#timer = undefined;
+  }
+}
+Object.defineProperty(SseStream, Symbol.for("dunx.deps"), { value: () => [{ unresolved: "options: SseStreamOptions = {}", optional: true }] });
+
+// src/sse/decorators.ts
+var LAST_EVENT_ID = "last-event-id";
+var respond = (result) => (result instanceof SseStream ? result : SseStream.from(result)).toResponse();
+var Sse = (path = "/", options) => (value, _context) => {
+  const handler = value;
+  function served(input) {
+    const result = handler.call(this, {
+      ...input,
+      lastEventId: input.req.headers.get(LAST_EVENT_ID) ?? undefined
+    });
+    return result instanceof Promise ? result.then((settled) => respond(settled)) : respond(result);
+  }
+  markRoute(served, { method: "GET", path, options });
+  meta2(STREAMS2, true)(served);
+  return served;
+};
 // src/throttle/decorators.ts
 var THROTTLE = metaKey2("throttle");
 var SKIP_THROTTLE = metaKey2("skip-throttle");
@@ -2415,16 +2472,19 @@ class ThrottleGuard {
   store;
   address;
   logger;
+  claimed;
   #warned = false;
-  constructor(options, store, address, logger) {
+  constructor(options, store, address, logger, claimed) {
     this.options = options;
     this.store = store;
     this.address = address;
     this.logger = logger;
+    this.claimed = claimed;
   }
   async handle(req, ctx, next) {
-    if (ctx.get(UNMATCHED2) === true)
+    if (ctx.get(UNMATCHED2) === true && !this.claimed.has(ctx.path)) {
       return next();
+    }
     if (ctx.get(SKIP_THROTTLE) === true)
       return next();
     const limit = ctx.get(THROTTLE) ?? this.options;
@@ -2477,7 +2537,7 @@ class ThrottleGuard {
     this.logger.warn("The rate limiter is unreachable, so requests are not being counted.", { reason: error.message });
   }
 }
-Object.defineProperty(ThrottleGuard, Symbol.for("dunx.deps"), { value: () => [ThrottleOptions, ThrottleStore, ClientAddress, Logger5] });
+Object.defineProperty(ThrottleGuard, Symbol.for("dunx.deps"), { value: () => [ThrottleOptions, ThrottleStore, ClientAddress, Logger5, ClaimedRoutes] });
 // src/throttle/module.ts
 import {
   Logger as Logger6,
@@ -2486,8 +2546,14 @@ import {
 } from "@dunx/core";
 var EXPORTS = [ThrottleOptions, ThrottleStore, ThrottleGuard];
 var guard = () => provide4(ThrottleGuard, {
-  useFactory: (options, store, address, logger) => new ThrottleGuard(options, store, address, logger),
-  inject: [ThrottleOptions, ThrottleStore, ClientAddress, Logger6]
+  useFactory: (options, store, address, logger, claimed) => new ThrottleGuard(options, store, address, logger, claimed),
+  inject: [
+    ThrottleOptions,
+    ThrottleStore,
+    ClientAddress,
+    Logger6,
+    ClaimedRoutes
+  ]
 });
 var store = () => provide4(ThrottleStore, {
   useFactory: (options) => options.store ?? new MemoryThrottleStore,
@@ -3259,11 +3325,14 @@ export {
   RequestMetrics,
   Roles2 as Roles,
   SKIP_THROTTLE,
+  STREAMS2 as STREAMS,
   SkipThrottle,
   SocketLoggingMiddleware,
-  StaticFiles,
+  Sse,
+  SseStream,
+  StaticFiles2 as StaticFiles,
   StaticModule,
-  StaticOptions,
+  StaticOptions2 as StaticOptions,
   THROTTLE,
   TRACEPARENT_HEADER2 as TRACEPARENT_HEADER,
   TRACERESPONSE_HEADER2 as TRACERESPONSE_HEADER,

package/dist/internal.d.ts

@@ -1,20 +1,18 @@
 /**
- * What the framework calls on itself, and the only place it is exported from.
+ * What the framework calls on itself, and the only place it is exported from: the
+ * discovery readers and route metadata `@dunx/dashboard`, `@dunx/mcp`,
+ * `@dunx/openapi` and `@dunx/testing` import. The barrel stays the surface an app
+ * writes against.
  *
- * The barrel was a semver promise 173 symbols wide, which is more than this
- * package meant to make. What stays public there is the surface an app writes
- * against. What is here is the discovery readers and route metadata that
- * `@dunx/dashboard`, `@dunx/mcp`, `@dunx/openapi` and `@dunx/testing` import.
- *
- * It held 62 symbols and 50 had no importer, all of them reachable from inside
- * this package by relative import. Add one back when a sibling needs it.
- *
- * No stability promise attaches to this subpath.
+ * It held 62 symbols and 50 had no importer, all reachable from inside this
+ * package by relative import. Add one back when a sibling needs it. No stability
+ * promise attaches here.
  */
 export { discoverRoutes, joinPath, type DiscoveredRoute, } from './route/discover.js';
 export { RoutePrefix } from './route/prefix.js';
 export { defaultStatusFor } from './route/marker.js';
 export { gatewaysOf, routesOf, type GatewayHandler, type GatewayNode, type RouteInputs, type RouteNode, } from './inspect.js';
 export { buildContext } from './server/context.js';
+export { IMMUTABLE_CACHE_CONTROL } from './static/files.js';
 export { embedJson } from './server/html.js';
 export { isGateway } from './ws/marker.js';