@fishenv/http 0.0.0-stage → 0.0.3

package/dist/core/compose.js

@@ -0,0 +1,87 @@
+import { defaultErrorHandler } from "./error.js";
+import { parseInput } from "./request.js";
+/**
+ * Run the middleware pipeline, accumulating context via object spread.
+ * Each middleware receives the accumulated ctx and returns new fields to merge.
+ */
+export async function runMiddlewarePipeline(req, middlewares, container) {
+    let ctx = { req, container };
+    for (const mw of middlewares) {
+        const additions = await mw({ ...ctx, req });
+        ctx = { ...ctx, ...additions };
+    }
+    return ctx;
+}
+/**
+ * Run before interceptors, the handler, then after interceptors (in reverse).
+ * Before and after share a mutable `state` object created per-request.
+ */
+export async function runInterceptors(interceptors, req, ctx, handlerFn) {
+    const state = {};
+    // Run all before interceptors
+    for (const { before } of interceptors) {
+        if (before)
+            await before({ req, ctx, state });
+    }
+    // Run handler
+    let response = await handlerFn();
+    // Run all after interceptors in reverse order
+    for (const { after } of [...interceptors].reverse()) {
+        if (after)
+            response = await after({ response, ctx, state });
+    }
+    return response;
+}
+/**
+ * Coerce a handler's return value into a Response.
+ * - If already a Response, pass through.
+ * - If output schema is defined, serialize as JSON.
+ * - Otherwise throw — handler contract violation.
+ */
+export function coerceToResponse(raw, def) {
+    if (raw instanceof Response)
+        return raw;
+    if (def.outputSchema != null)
+        return Response.json(raw);
+    throw new TypeError("Handler must return a Response when no output schema is defined");
+}
+/**
+ * Full request dispatch: middleware → input parsing → interceptors + handler → error chain.
+ */
+export async function dispatch(req, definition, params, container, errorHandlers) {
+    try {
+        // 0. Guards run before any middleware
+        if (definition.guards) {
+            for (const guard of definition.guards)
+                await guard(req);
+        }
+        // 1. Build context via middleware chain
+        const ctx = await runMiddlewarePipeline(req, definition.middlewares, container);
+        // 2. Parse & validate input
+        const input = await parseInput(req, definition, params);
+        // 3. Run interceptors + handler
+        const response = await runInterceptors(definition.interceptors, req, ctx, async () => {
+            const raw = await definition.handler({
+                req,
+                ctx,
+                container,
+                path: input.path,
+                body: input.body,
+                headers: input.headers,
+                query: input.query,
+                cookies: input.cookies,
+            });
+            return coerceToResponse(raw, definition);
+        });
+        return response;
+    }
+    catch (err) {
+        for (const handler of errorHandlers) {
+            const result = await handler(err, { req });
+            if (result != null)
+                return result;
+        }
+        // Built-in fallback always returns
+        return defaultErrorHandler(err, { req });
+    }
+}

package/dist/core/cors.d.ts

@@ -0,0 +1,38 @@
+export interface CorsOptions {
+    /**
+     * Allowed origin(s).
+     * - `'*'`          — allow all origins (when credentials is false)
+     * - `string`       — allow a single explicit origin
+     * - `string[]`     — allow any origin in the list
+     * - `(origin) =>` — dynamic resolver; return the origin to allow or null/undefined to deny
+     */
+    origin: string | string[] | ((origin: string) => string | null | undefined);
+    /** HTTP methods to allow. Default: GET HEAD PUT POST DELETE PATCH */
+    allowMethods?: string[];
+    /**
+     * Headers to allow. Default: [] — when empty the middleware echoes the
+     * request's Access-Control-Request-Headers value (wildcard-like behaviour).
+     */
+    allowHeaders?: string[];
+    /** Headers to expose to the browser. Default: [] */
+    exposeHeaders?: string[];
+    /** Whether to include credentials. Default: false */
+    credentials?: boolean;
+    /** Max-age for preflight cache in seconds. Default: not set */
+    maxAge?: number;
+}
+export interface CompiledCors {
+    /**
+     * Build and return a 204 preflight response.
+     * Always returns a Response — callers decide whether to use it based on the
+     * request method being OPTIONS.
+     */
+    preflight(req: Request): Response;
+    /**
+     * Clone the response (if needed) and inject the CORS response-phase headers:
+     * Access-Control-Allow-Origin, Access-Control-Allow-Credentials,
+     * Access-Control-Expose-Headers, Vary.
+     */
+    applyTo(req: Request, res: Response): Response;
+}
+export declare function buildCors(options: CorsOptions): CompiledCors;

package/dist/core/cors.js

@@ -0,0 +1,96 @@
+// ---------------------------------------------------------------------------
+// CORS types
+// ---------------------------------------------------------------------------
+// ---------------------------------------------------------------------------
+// buildCors
+// ---------------------------------------------------------------------------
+const DEFAULT_ALLOW_METHODS = ["GET", "HEAD", "PUT", "POST", "DELETE", "PATCH"];
+export function buildCors(options) {
+    const { origin, allowMethods = DEFAULT_ALLOW_METHODS, allowHeaders = [], exposeHeaders = [], credentials = false, maxAge, } = options;
+    // Build a synchronous origin resolver -----------------------------------
+    function resolveOrigin(requestOrigin) {
+        if (typeof origin === "function") {
+            return origin(requestOrigin) ?? null;
+        }
+        if (origin === "*") {
+            // The spec forbids Access-Control-Allow-Origin: * together with
+            // Access-Control-Allow-Credentials: true — reflect the request origin.
+            return credentials ? requestOrigin || null : "*";
+        }
+        if (Array.isArray(origin)) {
+            return origin.includes(requestOrigin) ? requestOrigin : null;
+        }
+        // Single explicit origin string
+        return origin === requestOrigin ? requestOrigin : null;
+    }
+    // Whether to add Vary: Origin -------------------------------------------
+    function needsVary() {
+        // When the effective origin is always literal '*' (no credentials, no
+        // dynamic/list/single origin), Vary is unnecessary.
+        return credentials || origin !== "*";
+    }
+    // ── preflight -----------------------------------------------------------
+    function preflight(req) {
+        const requestOrigin = req.headers.get("origin") ?? "";
+        const allowed = resolveOrigin(requestOrigin);
+        const headers = new Headers();
+        if (allowed) {
+            headers.set("Access-Control-Allow-Origin", allowed);
+        }
+        if (credentials) {
+            headers.set("Access-Control-Allow-Credentials", "true");
+        }
+        if (needsVary()) {
+            headers.set("Vary", "Origin");
+        }
+        if (maxAge != null) {
+            headers.set("Access-Control-Max-Age", String(maxAge));
+        }
+        if (allowMethods.length) {
+            headers.set("Access-Control-Allow-Methods", allowMethods.join(", "));
+        }
+        // Allowed headers: use configured list or echo the request header
+        let effectiveAllowHeaders = allowHeaders;
+        if (!effectiveAllowHeaders.length) {
+            const requested = req.headers.get("access-control-request-headers");
+            if (requested) {
+                effectiveAllowHeaders = requested.split(/\s*,\s*/);
+            }
+        }
+        if (effectiveAllowHeaders.length) {
+            headers.set("Access-Control-Allow-Headers", effectiveAllowHeaders.join(", "));
+            // Vary on this header when it was echoed from the request
+            if (!allowHeaders.length) {
+                const vary = headers.get("Vary");
+                headers.set("Vary", vary
+                    ? `${vary}, Access-Control-Request-Headers`
+                    : "Access-Control-Request-Headers");
+            }
+        }
+        return new Response(null, { status: 204, headers });
+    }
+    // ── applyTo -------------------------------------------------------------
+    function applyTo(req, res) {
+        const requestOrigin = req.headers.get("origin") ?? "";
+        const allowed = resolveOrigin(requestOrigin);
+        // Nothing to add if origin is not allowed
+        if (!allowed)
+            return res;
+        // Clone response so we can safely mutate headers
+        const next = new Response(res.body, res);
+        next.headers.set("Access-Control-Allow-Origin", allowed);
+        if (credentials) {
+            next.headers.set("Access-Control-Allow-Credentials", "true");
+        }
+        if (exposeHeaders.length) {
+            next.headers.set("Access-Control-Expose-Headers", exposeHeaders.join(", "));
+        }
+        if (needsVary()) {
+            // Append rather than set to preserve any existing Vary value
+            const existing = next.headers.get("Vary");
+            next.headers.set("Vary", existing ? `${existing}, Origin` : "Origin");
+        }
+        return next;
+    }
+    return { preflight, applyTo };
+}

package/dist/core/error.d.ts

@@ -0,0 +1,73 @@
+import type * as v from "valibot";
+import type { HttpMethod } from "./types.ts";
+/** Stable machine-readable code for a status, e.g. `403` → `"forbidden"`. */
+export declare function errorCodeForStatus(status: number): string;
+/**
+ * Transport-neutral error payload. HTTP responses and WebSocket replies are
+ * both rendered from this, so they share one disclosure policy.
+ */
+export interface HttpErrorJSON {
+    status: number;
+    code: string;
+    message: string;
+    details?: Record<string, unknown>;
+    stack?: string;
+}
+export declare class HttpError extends Error {
+    readonly status: number;
+    constructor(status: number, message: string, cause?: unknown);
+    /** Machine-readable code. Override in subclasses for custom errors. */
+    get code(): string;
+    /** Extra public fields (e.g. validation issues). Never include secrets. */
+    protected details(): Record<string, unknown> | undefined;
+    /** The public payload; the stack is only included in development. */
+    toJSON(development?: boolean): HttpErrorJSON;
+    toResponse(development?: boolean): Response;
+}
+export declare class BadRequestError extends HttpError {
+    constructor(message?: string, cause?: unknown);
+}
+export declare class UnauthorizedError extends HttpError {
+    constructor(message?: string);
+}
+export declare class ForbiddenError extends HttpError {
+    constructor(message?: string);
+}
+export declare class NotFoundError extends HttpError {
+    constructor(message?: string);
+}
+export declare class MethodNotAllowedError extends HttpError {
+    constructor(message?: string);
+}
+export declare class ConflictError extends HttpError {
+    constructor(message?: string, cause?: unknown);
+}
+export declare class UnprocessableEntityError extends HttpError {
+    constructor(message?: string, cause?: unknown);
+}
+export declare class TooManyRequestsError extends HttpError {
+    constructor(message?: string);
+}
+export declare class InternalServerError extends HttpError {
+    constructor(message?: string, cause?: unknown);
+}
+export type ValidationField = "body" | "headers" | "query" | "cookies" | "path";
+export declare class ValidationError extends HttpError {
+    readonly field: ValidationField;
+    readonly issues: v.BaseIssue<unknown>[];
+    constructor(field: ValidationField, issues: v.BaseIssue<unknown>[]);
+    get code(): string;
+    protected details(): Record<string, unknown>;
+    toResponse(): Response;
+}
+export interface ErrorHandlerOpts {
+    development?: boolean;
+    logger?: {
+        error: (...args: unknown[]) => void;
+    };
+}
+export declare function defaultErrorHandler(err: unknown, _args: {
+    req: Request;
+}, opts?: ErrorHandlerOpts): Response;
+export declare function defaultNotFoundHandler(req: Request): Response;
+export declare function defaultMethodNotAllowedHandler(_req: Request, allowed: HttpMethod[]): Response;

package/dist/core/error.js

@@ -0,0 +1,142 @@
+const CODES = {
+    400: "bad_request",
+    401: "unauthorized",
+    403: "forbidden",
+    404: "not_found",
+    405: "method_not_allowed",
+    409: "conflict",
+    422: "unprocessable_entity",
+    429: "too_many_requests",
+    500: "internal",
+};
+/** Stable machine-readable code for a status, e.g. `403` → `"forbidden"`. */
+export function errorCodeForStatus(status) {
+    return CODES[status] ?? `http_${status}`;
+}
+export class HttpError extends Error {
+    status;
+    constructor(status, message, cause) {
+        super(message, { cause });
+        this.status = status;
+        this.name = "HttpError";
+    }
+    /** Machine-readable code. Override in subclasses for custom errors. */
+    get code() {
+        return errorCodeForStatus(this.status);
+    }
+    /** Extra public fields (e.g. validation issues). Never include secrets. */
+    details() {
+        return undefined;
+    }
+    /** The public payload; the stack is only included in development. */
+    toJSON(development = false) {
+        const json = {
+            status: this.status,
+            code: this.code,
+            message: this.message,
+        };
+        const details = this.details();
+        if (details != null)
+            json.details = details;
+        if (development && this.stack)
+            json.stack = this.stack;
+        return json;
+    }
+    toResponse(development = false) {
+        const json = this.toJSON(development);
+        const body = { error: json.message };
+        if (json.stack)
+            body.stack = json.stack;
+        return Response.json(body, { status: this.status });
+    }
+}
+export class BadRequestError extends HttpError {
+    constructor(message = "Bad Request", cause) {
+        super(400, message, cause);
+    }
+}
+export class UnauthorizedError extends HttpError {
+    constructor(message = "Unauthorized") {
+        super(401, message);
+    }
+}
+export class ForbiddenError extends HttpError {
+    constructor(message = "Forbidden") {
+        super(403, message);
+    }
+}
+export class NotFoundError extends HttpError {
+    constructor(message = "Not Found") {
+        super(404, message);
+    }
+}
+export class MethodNotAllowedError extends HttpError {
+    constructor(message = "Method Not Allowed") {
+        super(405, message);
+    }
+}
+export class ConflictError extends HttpError {
+    constructor(message = "Conflict", cause) {
+        super(409, message, cause);
+    }
+}
+export class UnprocessableEntityError extends HttpError {
+    constructor(message = "Unprocessable Entity", cause) {
+        super(422, message, cause);
+    }
+}
+export class TooManyRequestsError extends HttpError {
+    constructor(message = "Too Many Requests") {
+        super(429, message);
+    }
+}
+export class InternalServerError extends HttpError {
+    constructor(message = "Internal Server Error", cause) {
+        super(500, message, cause);
+    }
+}
+export class ValidationError extends HttpError {
+    field;
+    issues;
+    constructor(field, issues) {
+        super(400, "Validation Error");
+        this.name = "ValidationError";
+        this.field = field;
+        this.issues = issues;
+    }
+    get code() {
+        return "validation_error";
+    }
+    details() {
+        return {
+            field: this.field,
+            issues: this.issues.map((i) => ({
+                message: i.message,
+                path: i.path?.map((p) => p.key) ?? [],
+            })),
+        };
+    }
+    toResponse() {
+        return Response.json({ error: "ValidationError", ...this.details() }, { status: 400 });
+    }
+}
+export function defaultErrorHandler(err, _args, opts = {}) {
+    if (err instanceof HttpError) {
+        return err.toResponse(opts.development);
+    }
+    const logger = opts.logger ?? console;
+    logger.error("[fishenv.http] Unhandled error:", err);
+    const body = { error: "Internal Server Error" };
+    if (opts.development && err instanceof Error)
+        body.stack = err.stack;
+    return Response.json(body, { status: 500 });
+}
+export function defaultNotFoundHandler(req) {
+    return Response.json({ error: "Not Found", path: new URL(req.url).pathname }, { status: 404 });
+}
+export function defaultMethodNotAllowedHandler(_req, allowed) {
+    return new Response(null, {
+        status: 405,
+        headers: { Allow: allowed.join(", ") },
+    });
+}

package/dist/core/index.d.ts

@@ -0,0 +1,20 @@
+export { coerceToResponse, dispatch, runInterceptors, runMiddlewarePipeline, } from "./compose.ts";
+export type { CompiledCors, CorsOptions } from "./cors.ts";
+export { buildCors } from "./cors.ts";
+export type { HttpErrorJSON, ValidationField } from "./error.ts";
+export { BadRequestError, ConflictError, defaultErrorHandler, defaultMethodNotAllowedHandler, defaultNotFoundHandler, errorCodeForStatus, ForbiddenError, HttpError, InternalServerError, MethodNotAllowedError, NotFoundError, TooManyRequestsError, UnauthorizedError, UnprocessableEntityError, ValidationError, } from "./error.ts";
+export type { MatchedRoute, RouterMatcher } from "./matcher.ts";
+export { Matcher } from "./matcher.ts";
+export type { ParsedInput } from "./request.ts";
+export { extractHeaders, extractQuery, parseBody, parseCookies, parseInput, } from "./request.ts";
+export type { RouterRef } from "./route-builder.ts";
+export { createRouteBuilder, createRouteBuilderFromContract, FinishedRoute, RouteBuilder, } from "./route-builder.ts";
+export type { CtxOf, HttpServer, Logger, ServeOptions } from "./router.ts";
+export { Router, r, router, serve } from "./router.ts";
+export type { Transport, TransportBridge, TransportEnvelope, WithoutOrigin, } from "./transport.ts";
+export { createMemoryTransport, createTransportBridge } from "./transport.ts";
+export type { AfterInterceptorFn, AnySchema, BasePathParams, BeforeInterceptorFn, BuildEnv, DIContainer, ErrorHandlerFn, ExtractParams, HandlerArgs, HandlerFn, HttpMethod, InferBody, InferCookies, InferHeaders, InferOutput, InferQuery, InputKind, InputOptions, InterceptorPair, InterceptorState, MergeCtx, MergeParam, MiddlewareFn, NotFoundHandler, ResolvedInput, RouteDefinition, RouteGuardFn, RouteMeta, ValibotSchema, } from "./types.ts";
+export type { SocketData, SocketHandlers, UpgradedSocket, UpgradeIntent, WebSocketRuntime, WsServerOptions, } from "./upgrade.ts";
+export { CLOSE_GOING_AWAY, CLOSE_INTERNAL_ERROR, completeUpgrade, createWebSocketRuntime, DEFAULT_BACKPRESSURE_LIMIT, DEFAULT_MAX_PAYLOAD_LENGTH, requestUpgrade, takeUpgrade, } from "./upgrade.ts";
+export { buildRouteRegex, extractParamNames, mergePaths } from "./utils/url.ts";
+export { validateField, validatePathParams } from "./validation.ts";

package/dist/core/index.js

@@ -0,0 +1,23 @@
+// Types
+// Compose (pipeline)
+export { coerceToResponse, dispatch, runInterceptors, runMiddlewarePipeline, } from "./compose.js";
+// CORS
+export { buildCors } from "./cors.js";
+// Errors
+export { BadRequestError, ConflictError, defaultErrorHandler, defaultMethodNotAllowedHandler, defaultNotFoundHandler, errorCodeForStatus, ForbiddenError, HttpError, InternalServerError, MethodNotAllowedError, NotFoundError, TooManyRequestsError, UnauthorizedError, UnprocessableEntityError, ValidationError, } from "./error.js";
+// Matcher
+export { Matcher } from "./matcher.js";
+// Request parsing
+export { extractHeaders, extractQuery, parseBody, parseCookies, parseInput, } from "./request.js";
+// Route Builder
+export { createRouteBuilder, createRouteBuilderFromContract, FinishedRoute, RouteBuilder, } from "./route-builder.js";
+// Router
+export { Router, r, router, serve } from "./router.js";
+// Transport (shared by SSE and WS hubs)
+export { createMemoryTransport, createTransportBridge } from "./transport.js";
+// WebSocket upgrade plumbing
+export { CLOSE_GOING_AWAY, CLOSE_INTERNAL_ERROR, completeUpgrade, createWebSocketRuntime, DEFAULT_BACKPRESSURE_LIMIT, DEFAULT_MAX_PAYLOAD_LENGTH, requestUpgrade, takeUpgrade, } from "./upgrade.js";
+// URL utilities
+export { buildRouteRegex, extractParamNames, mergePaths } from "./utils/url.js";
+// Validation
+export { validateField, validatePathParams } from "./validation.js";

package/dist/core/matcher.d.ts

@@ -0,0 +1,17 @@
+import type { HttpMethod, RouteDefinition } from "./types.ts";
+export interface MatchedRoute {
+    definition: RouteDefinition;
+    params: Record<string, string>;
+    allowedMethods?: HttpMethod[];
+}
+export interface RouterMatcher {
+    add(method: HttpMethod | "ALL", path: string, def: RouteDefinition): void;
+    match(method: string, path: string): MatchedRoute | null;
+    compile(): void;
+}
+export declare class Matcher implements RouterMatcher {
+    #private;
+    add(method: HttpMethod | "ALL", path: string, def: RouteDefinition): void;
+    compile(): void;
+    match(method: string, path: string): MatchedRoute | null;
+}

package/dist/core/matcher.js

@@ -0,0 +1,110 @@
+import { buildRouteRegex } from "./utils/url.js";
+/** Score: more static segments = higher, broad globs = lower */
+function specificity(path) {
+    return path.split("/").reduce((score, seg) => {
+        if (!seg)
+            return score;
+        if (seg === "**" || (seg.startsWith(":") && seg.endsWith("*"))) {
+            return score + 0;
+        }
+        if (seg.includes("*") || seg.includes("{"))
+            return score + 1;
+        if (seg.startsWith(":"))
+            return score + 2;
+        return score + 3;
+    }, 0);
+}
+function hasPatternSyntax(path) {
+    return path.includes(":") || path.includes("*") || path.includes("{");
+}
+export class Matcher {
+    #rawRoutes = [];
+    #compiled = false;
+    // Per method: static map + dynamic list
+    #staticRoutes = new Map();
+    #dynamicRoutes = new Map();
+    add(method, path, def) {
+        if (this.#compiled) {
+            throw new Error("Cannot add routes after compile()");
+        }
+        this.#rawRoutes.push({ method: method.toUpperCase(), path, def });
+    }
+    compile() {
+        for (const { method, path, def } of this.#rawRoutes) {
+            if (!hasPatternSyntax(path)) {
+                // Static path
+                if (!this.#staticRoutes.has(method)) {
+                    this.#staticRoutes.set(method, new Map());
+                }
+                this.#staticRoutes.get(method).set(path, def);
+            }
+            else {
+                // Dynamic path
+                const { regex, paramNames } = buildRouteRegex(path);
+                const compiled = { regex, paramNames, definition: def };
+                if (!this.#dynamicRoutes.has(method)) {
+                    this.#dynamicRoutes.set(method, []);
+                }
+                this.#dynamicRoutes.get(method).push(compiled);
+            }
+        }
+        // Sort dynamic routes: higher specificity first
+        for (const list of this.#dynamicRoutes.values()) {
+            list.sort((a, b) => specificity(b.definition.path) - specificity(a.definition.path));
+        }
+        this.#compiled = true;
+    }
+    match(method, path) {
+        method = method.toUpperCase();
+        // Check static routes (exact method, then ALL)
+        const def = this.#staticRoutes.get(method)?.get(path) ??
+            this.#staticRoutes.get("ALL")?.get(path);
+        if (def)
+            return { definition: def, params: {} };
+        // Check dynamic routes (exact method, then ALL)
+        const dynamicForMethod = this.#dynamicRoutes.get(method) ?? [];
+        const dynamicForAll = this.#dynamicRoutes.get("ALL") ?? [];
+        for (const route of [...dynamicForMethod, ...dynamicForAll]) {
+            const m = route.regex.exec(path);
+            if (m) {
+                const params = {};
+                route.paramNames.forEach((name, i) => {
+                    if (m[i + 1] !== undefined) {
+                        params[name] = m[i + 1];
+                    }
+                });
+                return { definition: route.definition, params };
+            }
+        }
+        // 405: check if ANY method matches this path
+        const allowed = this.#findAllowedMethods(path);
+        if (allowed.length > 0) {
+            return {
+                definition: undefined,
+                params: {},
+                allowedMethods: allowed,
+            };
+        }
+        return null;
+    }
+    #findAllowedMethods(path) {
+        const methods = new Set();
+        for (const [method, map] of this.#staticRoutes) {
+            if (method === "ALL")
+                continue;
+            if (map.has(path))
+                methods.add(method);
+        }
+        for (const [method, routes] of this.#dynamicRoutes) {
+            if (method === "ALL")
+                continue;
+            for (const route of routes) {
+                if (route.regex.test(path)) {
+                    methods.add(method);
+                    break;
+                }
+            }
+        }
+        return [...methods];
+    }
+}

package/dist/core/request.d.ts

@@ -0,0 +1,28 @@
+import type { InputKind, InputOptions, RouteDefinition } from "./types.ts";
+export interface ParsedInput {
+    body: unknown;
+    headers: Record<string, string>;
+    query: Record<string, string | string[]>;
+    cookies: Record<string, string>;
+    path: Record<string, unknown>;
+}
+/**
+ * Parse and validate all input from a request according to the route definition.
+ */
+export declare function parseInput(req: Request, def: RouteDefinition, rawParams: Record<string, string>): Promise<ParsedInput>;
+/**
+ * Parse the request body based on InputKind.
+ */
+export declare function parseBody(req: Request, kind: InputKind, opts: InputOptions<InputKind>): Promise<unknown>;
+/**
+ * Extract all headers as a lowercased-key record.
+ */
+export declare function extractHeaders(req: Request): Record<string, string>;
+/**
+ * Parse cookies from the Cookie header.
+ */
+export declare function parseCookies(req: Request): Record<string, string>;
+/**
+ * Extract query parameters. Duplicate keys become arrays.
+ */
+export declare function extractQuery(req: Request): Record<string, string | string[]>;