@fluixi/api 0.0.0-stage → 0.1.0-alpha.3

package/dist/index.cjs

@@ -0,0 +1,667 @@
+/*! @fluixi/api v0.1.0-alpha.3 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  ApiError: () => ApiError,
+  CONTRACT: () => CONTRACT,
+  DEFAULT_BODY_LIMIT: () => DEFAULT_BODY_LIMIT,
+  DEFAULT_SECURITY_HEADERS: () => DEFAULT_SECURITY_HEADERS,
+  REVALIDATE_HEADER: () => REVALIDATE_HEADER,
+  apiSecurity: () => apiSecurity,
+  badRequest: () => badRequest,
+  conflict: () => conflict,
+  contractOf: () => contractOf,
+  cors: () => cors,
+  createOpenApiDocument: () => createOpenApiDocument,
+  describedBy: () => describedBy,
+  errorResponse: () => errorResponse,
+  forbidden: () => forbidden,
+  includeDocument: () => includeDocument,
+  memoryRateLimitStore: () => memoryRateLimitStore,
+  notFound: () => notFound,
+  openApiRoute: () => openApiRoute,
+  originCheck: () => originCheck,
+  postgresRateLimitStore: () => postgresRateLimitStore,
+  rateLimit: () => rateLimit,
+  readJson: () => readJson,
+  readQuery: () => readQuery,
+  route: () => route,
+  securityHeaders: () => securityHeaders,
+  setErrorReporter: () => setErrorReporter,
+  setJsonSchemaConverter: () => setJsonSchemaConverter,
+  toApiError: () => toApiError,
+  unauthorized: () => unauthorized
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/errors.ts
+var ApiError = class extends Error {
+  constructor(status, code, message, details) {
+    super(message);
+    this.name = "ApiError";
+    this.status = status;
+    this.code = code;
+    this.details = details;
+  }
+};
+var badRequest = (message, details) => new ApiError(400, "bad_request", message, details);
+var unauthorized = (message = "Sign in to continue.") => new ApiError(401, "unauthorized", message);
+var forbidden = (message = "Not allowed.") => new ApiError(403, "forbidden", message);
+var notFound = (message = "Not found.") => new ApiError(404, "not_found", message);
+var conflict = (message, details) => new ApiError(409, "conflict", message, details);
+function toApiError(error) {
+  if (error instanceof ApiError) return { error, internal: false };
+  const { status, code, message } = error ?? {};
+  if (status === 401 || status === 403) {
+    if (typeof code === "string" && typeof message === "string") return { error: new ApiError(status, code, message), internal: false };
+    return { error: status === 401 ? unauthorized() : forbidden(), internal: false };
+  }
+  return { error: new ApiError(500, "internal", "Something went wrong on our side."), internal: true };
+}
+function errorResponse(error) {
+  const body = { error: { code: error.code, message: error.message } };
+  if (error.details !== void 0) body.error.details = error.details;
+  return new Response(JSON.stringify(body), {
+    status: error.status,
+    headers: { "content-type": "application/json; charset=utf-8" }
+  });
+}
+
+// src/input.ts
+var DEFAULT_BODY_LIMIT = 1024 * 1024;
+function readQuery(url) {
+  const out = {};
+  for (const [key, value] of url.searchParams) {
+    const seen = out[key];
+    if (seen === void 0) out[key] = value;
+    else out[key] = Array.isArray(seen) ? [...seen, value] : [seen, value];
+  }
+  return out;
+}
+async function readJson(request, limit = DEFAULT_BODY_LIMIT) {
+  const declared = Number(request.headers.get("content-length"));
+  if (Number.isFinite(declared) && declared > limit) throw tooLarge(limit);
+  if (!request.body) return void 0;
+  const type = request.headers.get("content-type") ?? "";
+  const reader = request.body.getReader();
+  const chunks = [];
+  let size = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    size += value.byteLength;
+    if (size > limit) {
+      await reader.cancel();
+      throw tooLarge(limit);
+    }
+    chunks.push(value);
+  }
+  if (size === 0) return void 0;
+  if (!isJson(type)) {
+    throw new ApiError(415, "unsupported_media_type", "Send the body as application/json.");
+  }
+  const bytes = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  try {
+    return JSON.parse(new TextDecoder().decode(bytes));
+  } catch {
+    throw new ApiError(400, "invalid_json", "The body is not valid JSON.");
+  }
+}
+function isJson(type) {
+  const mime = type.split(";")[0].trim().toLowerCase();
+  return mime === "application/json" || mime.endsWith("+json");
+}
+function tooLarge(limit) {
+  return new ApiError(413, "payload_too_large", `The body is larger than ${limit} bytes.`);
+}
+
+// src/route.ts
+var CONTRACT = /* @__PURE__ */ Symbol.for("fluixi.api.contract");
+var report = (error, request) => {
+  console.error(`[fluixi/api] ${request.method} ${new URL(request.url).pathname}`, error);
+};
+function setErrorReporter(reporter) {
+  report = reporter;
+}
+function route(contract) {
+  const handle = async (request, context = {}) => {
+    try {
+      const auth = contract.guard ? await contract.guard.check(request) : void 0;
+      const issues = [];
+      const params = await check(contract.params, context.params ?? {}, "params", issues);
+      const query = await check(contract.query, readQuery(new URL(request.url)), "query", issues);
+      const body = contract.body ? await check(contract.body, await readJson(request, contract.bodyLimit), "body", issues) : void 0;
+      if (issues.length) throw new ApiError(400, "validation_failed", "The request is not valid.", issues);
+      const input = { params, query, body, auth, request };
+      const out = await contract.handler(input);
+      const stale = !contract.revalidates ? [] : typeof contract.revalidates === "function" ? contract.revalidates(out, input) : contract.revalidates;
+      if (out instanceof Response) return withRevalidate(out, stale);
+      if (out === void 0 && !contract.response) return withRevalidate(new Response(null, { status: contract.status ?? 204 }), stale);
+      let value = out;
+      if (contract.response && contract.validateResponse !== false) {
+        const result = await contract.response["~standard"].validate(out);
+        if (result.issues) {
+          throw Object.assign(new Error("Response does not match the route contract."), {
+            issues: result.issues.map((issue) => toIssue(issue, "response"))
+          });
+        }
+        value = result.value;
+      }
+      return withRevalidate(
+        new Response(JSON.stringify(value ?? null), {
+          status: contract.status ?? 200,
+          headers: { "content-type": "application/json; charset=utf-8" }
+        }),
+        stale
+      );
+    } catch (thrown) {
+      const { error, internal } = toApiError(thrown);
+      if (internal) report(thrown, request);
+      return errorResponse(error);
+    }
+  };
+  Object.defineProperty(handle, CONTRACT, { value: contract });
+  return handle;
+}
+var REVALIDATE_HEADER = "x-fx-revalidate";
+function withRevalidate(response, names) {
+  if (!names.length || !response.ok) return response;
+  const value = names.join(", ");
+  try {
+    response.headers.append(REVALIDATE_HEADER, value);
+    return response;
+  } catch {
+    const headers = new Headers(response.headers);
+    headers.append(REVALIDATE_HEADER, value);
+    return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
+  }
+}
+function contractOf(handler) {
+  return typeof handler === "function" ? handler[CONTRACT] : void 0;
+}
+async function check(schema, value, where, issues) {
+  if (!schema) return value;
+  const result = await schema["~standard"].validate(value);
+  if (result.issues) {
+    for (const issue of result.issues) issues.push(toIssue(issue, where));
+    return void 0;
+  }
+  return result.value;
+}
+function toIssue(issue, where) {
+  const path = (issue.path ?? []).map(
+    (segment) => String(typeof segment === "object" && segment !== null ? segment.key : segment)
+  );
+  return { path: [where, ...path].join("."), message: issue.message };
+}
+
+// src/openapi.ts
+var convert;
+function setJsonSchemaConverter(converter) {
+  convert = converter;
+}
+var METHODS = ["get", "post", "put", "patch", "delete"];
+var DESCRIBES = /* @__PURE__ */ Symbol.for("fluixi.api.describes");
+var DESCRIBED_BY = /* @__PURE__ */ Symbol.for("fluixi.api.described-by");
+function describedBy(document, handler) {
+  Object.defineProperty(handler, DESCRIBED_BY, { value: document });
+  return handler;
+}
+var ERROR_SCHEMA = {
+  type: "object",
+  required: ["error"],
+  properties: {
+    error: {
+      type: "object",
+      required: ["code", "message"],
+      properties: {
+        code: { type: "string", description: "Machine-readable, stable: `validation_failed`, `not_found`, `internal`." },
+        message: { type: "string", description: "For people. May change between versions." },
+        details: { description: "For `validation_failed`, the list of `{ path, message }` issues." }
+      }
+    }
+  }
+};
+function createOpenApiDocument(routes, info) {
+  const paths = {};
+  const securitySchemes = {};
+  for (const route2 of routes) {
+    if (!route2.path) continue;
+    for (const method of METHODS) {
+      const handler = route2.mod[method.toUpperCase()];
+      if (typeof handler !== "function") continue;
+      const marks = handler;
+      if (marks[DESCRIBES] || marks[DESCRIBED_BY]) continue;
+      (paths[route2.path] ??= {})[method] = operation(method, route2.path, contractOf(handler), securitySchemes);
+    }
+  }
+  const { servers, ...rest } = info;
+  return {
+    openapi: "3.1.0",
+    info: rest,
+    ...servers?.length ? { servers } : {},
+    paths,
+    components: { schemas: { Error: ERROR_SCHEMA }, ...Object.keys(securitySchemes).length ? { securitySchemes } : {} }
+  };
+}
+function openApiRoute(routes, info) {
+  let cached;
+  const handler = async () => {
+    cached ??= describe(routes(), info).catch((error) => {
+      cached = void 0;
+      throw error;
+    });
+    return new Response(await cached, { headers: { "content-type": "application/json; charset=utf-8" } });
+  };
+  Object.defineProperty(handler, DESCRIBES, { value: true });
+  return handler;
+}
+async function describe(routes, info) {
+  const doc = createOpenApiDocument(routes, info);
+  const mounts = /* @__PURE__ */ new Map();
+  for (const route2 of routes) {
+    if (!route2.path) continue;
+    for (const handler of Object.values(route2.mod)) {
+      const source = typeof handler === "function" ? handler[DESCRIBED_BY] : void 0;
+      if (source && !mounts.has(source)) mounts.set(source, route2.path.replace(/\/\{[^}]+\}$/, ""));
+    }
+  }
+  for (const [source, mount] of mounts) includeDocument(doc, await source(), mount);
+  return JSON.stringify(doc, null, 2);
+}
+function includeDocument(target, source, mount) {
+  const prefix = pascal(mount.split("/").filter(Boolean).pop() ?? "included");
+  const components = target.components ??= {};
+  const prefixed = (name) => prefix + name[0].toUpperCase() + name.slice(1);
+  const renames = /* @__PURE__ */ new Map();
+  for (const [section, entries] of Object.entries(source.components ?? {})) {
+    for (const [name, value] of Object.entries(entries)) {
+      const existing = components[section]?.[name];
+      if (existing !== void 0 && JSON.stringify(existing) !== JSON.stringify(value)) {
+        renames.set(`#/components/${section}/${name}`, `#/components/${section}/${prefixed(name)}`);
+      }
+    }
+  }
+  const rewrite = (node) => {
+    if (Array.isArray(node)) return node.map(rewrite);
+    if (!node || typeof node !== "object") return node;
+    const out = Object.fromEntries(
+      Object.entries(node).map(([key, value]) => [key, key === "$ref" && typeof value === "string" ? renames.get(value) ?? value : rewrite(value)])
+    );
+    return "nullable" in out ? nullable(out) : out;
+  };
+  for (const [section, entries] of Object.entries(source.components ?? {})) {
+    const into = components[section] ??= {};
+    for (const [name, value] of Object.entries(entries)) {
+      const renamed = renames.has(`#/components/${section}/${name}`) ? prefixed(name) : name;
+      into[renamed] = rewrite(value);
+    }
+  }
+  const paths = target.paths ??= {};
+  const ids = new Set(Object.values(paths).flatMap((item) => Object.values(item).map((op) => op?.operationId)));
+  for (const [path, item] of Object.entries(source.paths ?? {})) {
+    const described = rewrite(item);
+    for (const [method, op] of Object.entries(described)) {
+      if (Array.isArray(op.security)) {
+        op.security = op.security.map(
+          (requirement) => Object.fromEntries(
+            Object.entries(requirement).map(([name, scopes]) => [
+              renames.has(`#/components/securitySchemes/${name}`) ? prefixed(name) : name,
+              scopes
+            ])
+          )
+        );
+      }
+      if (METHODS.includes(method) && !op.summary) op.summary = summaryOf(op, method, mount + path);
+      if (typeof op.operationId === "string" && ids.has(op.operationId)) {
+        op.operationId = prefix[0].toLowerCase() + prefix.slice(1) + op.operationId[0].toUpperCase() + op.operationId.slice(1);
+      }
+      if (typeof op.operationId === "string") ids.add(op.operationId);
+    }
+    paths[mount + path] = described;
+  }
+  const tags = source.tags ?? [];
+  if (tags.length) {
+    const known = target.tags ??= [];
+    for (const tag of tags) if (!known.some((t) => t.name === tag.name)) known.push(tag);
+  }
+}
+function nullable(schema) {
+  const { nullable: isNullable, ...rest } = schema;
+  if (isNullable !== true) return rest;
+  if (typeof rest.type === "string") return { ...rest, type: [rest.type, "null"] };
+  if (Array.isArray(rest.type)) return rest.type.includes("null") ? rest : { ...rest, type: [...rest.type, "null"] };
+  return { anyOf: [rest, { type: "null" }] };
+}
+function summaryOf(op, method, path) {
+  const description = typeof op.description === "string" ? op.description.split(/\.\s|\n/)[0].trim() : "";
+  if (description && description.length <= 60) return description.replace(/\.$/, "");
+  return typeof op.operationId === "string" ? op.operationId.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/^./, (c) => c.toUpperCase()) : summaryFor(method, path);
+}
+function pascal(word) {
+  return word.split(/[^a-zA-Z0-9]+/).filter(Boolean).map((w) => w[0].toUpperCase() + w.slice(1)).join("");
+}
+function operation(method, path, contract, schemes) {
+  const operationId = contract?.operationId ?? idFor(method, path);
+  if (!contract) {
+    return {
+      operationId,
+      tags: [tagFor(path)],
+      summary: `${method.toUpperCase()} ${path}`,
+      description: "This route declares no contract, so nothing about its input or output is known.",
+      "x-fluixi-contract": false,
+      responses: { default: { description: "Undocumented." } }
+    };
+  }
+  const parameters = [
+    ...parametersFrom(contract.params, "path", pathNames(path)),
+    ...parametersFrom(contract.query, "query", [])
+  ];
+  const success = contract.status ?? (contract.response ? 200 : 204);
+  const responses = {
+    [success]: contract.response ? { description: "Success.", content: { "application/json": { schema: schemaFor(contract.response, "output") } } } : { description: "Success, no content." }
+  };
+  const error = (description) => ({ description, content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } });
+  if (contract.params || contract.query || contract.body) responses[400] = error("The request is not valid: `validation_failed`, `invalid_json`.");
+  if (contract.body) {
+    responses[413] = error("The body is over the limit.");
+    responses[415] = error("The body is not JSON.");
+  }
+  const guard = contract.guard;
+  if (guard) {
+    const refuses = guard.refuses ?? [401];
+    if (refuses.includes(401)) responses[401] = error("Not signed in: `unauthorized`.");
+    if (refuses.includes(403)) responses[403] = error("Signed in, not allowed: `forbidden`, or a more precise code.");
+    if (refuses.includes(503)) responses[503] = error("A service the check depends on cannot answer now; try again.");
+  }
+  if (pathNames(path).length) responses[404] = error("Nothing at this path.");
+  responses[500] = error("A fault on the server. Its detail is logged, never sent.");
+  return {
+    operationId,
+    tags: contract.tags?.length ? contract.tags : [tagFor(path)],
+    // Tools name the request after it (Postman does), so there is always one.
+    summary: contract.summary ?? summaryFor(method, path),
+    ...contract.description ? { description: contract.description } : {},
+    ...contract.deprecated ? { deprecated: true } : {},
+    // Stated on every contracted route, so a public one reads as public rather than unknown.
+    security: security(guard, schemes),
+    ...parameters.length ? { parameters } : {},
+    ...contract.body ? { requestBody: { required: true, content: { "application/json": { schema: schemaFor(contract.body, "input") } } } } : {},
+    responses
+  };
+}
+function security(guard, schemes) {
+  if (!guard?.security) return [];
+  const { name, scheme, scopes } = guard.security;
+  schemes[name] = scheme;
+  return [{ [name]: scopes ?? [] }];
+}
+function parametersFrom(schema, where, names) {
+  if (!schema) return where === "path" ? names.map((name) => ({ name, in: "path", required: true, schema: { type: "string" } })) : [];
+  const json = schemaFor(schema, "input");
+  const properties = json.properties ?? {};
+  const required = new Set(json.required ?? []);
+  return Object.entries(properties).map(([name, property]) => ({
+    name,
+    in: where,
+    required: where === "path" ? true : required.has(name),
+    ...typeof property.description === "string" ? { description: property.description } : {},
+    schema: property,
+    ...where === "query" && property.type === "array" ? { style: "form", explode: true } : {}
+  }));
+}
+function schemaFor(schema, io) {
+  const standard = schema["~standard"].jsonSchema;
+  try {
+    const json = standard?.[io]({ target: "draft-2020-12", libraryOptions: { unrepresentable: "any" } }) ?? convert?.(schema, io);
+    if (json) {
+      const { $schema: _dialect, ...rest } = json;
+      return rest;
+    }
+  } catch {
+  }
+  return { "x-fluixi-unconverted": schema["~standard"].vendor };
+}
+function pathNames(path) {
+  return [...path.matchAll(/\{([^}]+)\}/g)].map((m) => m[1]);
+}
+function tagFor(path) {
+  const segments = path.split("/").filter((s) => s && !s.startsWith("{"));
+  const meaningful = segments.filter((s, i) => !(i === 0 && s === "api") && !/^v\d+$/.test(s));
+  return meaningful[0] ?? "default";
+}
+function summaryFor(method, path) {
+  const words = idFor(method, path).replace(/([a-z0-9])([A-Z])/g, "$1 $2").toLowerCase();
+  return words[0].toUpperCase() + words.slice(1);
+}
+function idFor(method, path) {
+  const words = path.split("/").filter((s) => s && s !== "api" && !/^v\d+$/.test(s)).map((s) => s.startsWith("{") ? `By-${s.slice(1, -1)}` : s).flatMap((s) => s.split(/[^a-zA-Z0-9]+/)).filter(Boolean);
+  return method + words.map((w) => w[0].toUpperCase() + w.slice(1)).join("");
+}
+
+// src/middleware.ts
+function withHeaders(response, set) {
+  try {
+    set(response.headers);
+    return response;
+  } catch {
+    const copy = new Response(response.body, response);
+    set(copy.headers);
+    return copy;
+  }
+}
+function appendVary(headers, name) {
+  const vary = headers.get("vary");
+  if (!vary) headers.set("vary", name);
+  else if (!vary.split(",").some((v) => v.trim().toLowerCase() === name.toLowerCase())) headers.set("vary", `${vary}, ${name}`);
+}
+
+// src/rate-limit.ts
+var import_rate_limiter_flexible = require("rate-limiter-flexible");
+function memoryRateLimitStore() {
+  return storeOf(async (limit, windowSeconds) => new import_rate_limiter_flexible.RateLimiterMemory({ points: limit, duration: windowSeconds }));
+}
+function postgresRateLimitStore(client, options = {}) {
+  const { table = "rate_limits", schema, createTable = true } = options;
+  const storeClient = { query: (q) => client.query(q.text, q.values) };
+  let hits = 0;
+  return storeOf(
+    (limit, windowSeconds) => new Promise((resolve, reject) => {
+      const limiter = new import_rate_limiter_flexible.RateLimiterPostgres(
+        {
+          storeClient,
+          storeType: "pool",
+          tableName: table,
+          schemaName: schema,
+          tableCreated: !createTable,
+          clearExpiredByTimeout: false,
+          points: limit,
+          duration: windowSeconds,
+          insuranceLimiter: new import_rate_limiter_flexible.RateLimiterMemory({ points: limit, duration: windowSeconds })
+        },
+        // Called inside the constructor when the table exists already: resolve once it returned.
+        (error) => error ? reject(error) : queueMicrotask(() => resolve(limiter))
+      );
+    }),
+    (limiter) => {
+      const sweep = limiter;
+      if (++hits % 1e3 === 0) void sweep.clearExpired(Date.now() - 36e5).catch(() => {
+      });
+    }
+  );
+}
+function storeOf(make, onHit) {
+  const limiters = /* @__PURE__ */ new Map();
+  return {
+    async hit(key, limit, windowSeconds) {
+      const id = `${limit}/${windowSeconds}`;
+      let pending = limiters.get(id);
+      if (!pending) {
+        limiters.set(id, pending = make(limit, windowSeconds));
+        pending.catch(() => limiters.delete(id));
+      }
+      const limiter = await pending;
+      onHit?.(limiter);
+      try {
+        const res = await limiter.consume(key);
+        return { allowed: true, remaining: res.remainingPoints, resetMs: res.msBeforeNext };
+      } catch (thrown) {
+        if (thrown instanceof import_rate_limiter_flexible.RateLimiterRes) return { allowed: false, remaining: 0, resetMs: thrown.msBeforeNext };
+        throw thrown;
+      }
+    }
+  };
+}
+var ADDRESSES = /* @__PURE__ */ Symbol.for("fluixi.clientAddress");
+var sharedMemory = memoryRateLimitStore();
+var created = 0;
+function clientAddressOf(request) {
+  return globalThis[ADDRESSES]?.get(request);
+}
+function rateLimit(options) {
+  const { match, methods, limit, window, key = clientAddressOf, store = sharedMemory } = options;
+  const applies = matcher(match);
+  const methodSet = methods && new Set(methods.map((m) => m.toUpperCase()));
+  const bucket = options.name ?? `limit${++created}`;
+  return async (request, next) => {
+    if (methodSet && !methodSet.has(request.method)) return next();
+    if (!applies(request)) return next();
+    const who = await key(request);
+    if (!who) return next();
+    const { allowed, remaining, resetMs } = await store.hit(`${bucket}:${who}`, limit, window);
+    const reset = String(Math.ceil(resetMs / 1e3));
+    const set = (headers) => {
+      headers.set("ratelimit-limit", String(limit));
+      headers.set("ratelimit-remaining", String(remaining));
+      headers.set("ratelimit-reset", reset);
+    };
+    if (!allowed) {
+      const refused = errorResponse(new ApiError(429, "rate_limited", "Too many requests. Try again later."));
+      refused.headers.set("retry-after", reset);
+      set(refused.headers);
+      return refused;
+    }
+    return withHeaders(await next(), set);
+  };
+}
+function matcher(match) {
+  if (!match) return () => true;
+  if (typeof match === "function") return match;
+  const exact = new Set(match.filter((p) => !p.endsWith("/*")));
+  const prefixes = match.filter((p) => p.endsWith("/*")).map((p) => p.slice(0, -1));
+  return (request) => {
+    const { pathname } = new URL(request.url);
+    return exact.has(pathname) || prefixes.some((p) => pathname.startsWith(p));
+  };
+}
+
+// src/security.ts
+var allows = (origins, origin) => typeof origins === "function" ? origins(origin) : origins.includes(origin);
+var DEFAULT_SECURITY_HEADERS = {
+  "content-security-policy": "default-src 'none'; frame-ancestors 'none'",
+  "cross-origin-opener-policy": "same-origin",
+  "cross-origin-resource-policy": "same-origin",
+  "referrer-policy": "no-referrer",
+  "strict-transport-security": "max-age=31536000; includeSubDomains",
+  "x-content-type-options": "nosniff",
+  "x-frame-options": "DENY",
+  "x-permitted-cross-domain-policies": "none",
+  "cache-control": "no-store"
+};
+function securityHeaders(options = {}) {
+  const merged = { ...DEFAULT_SECURITY_HEADERS, ...options };
+  const entries = Object.entries(merged).filter((e) => e[1] !== false);
+  return async (request, next) => withHeaders(await next(), (headers) => {
+    for (const [name, value] of entries) if (!headers.has(name)) headers.set(name, value);
+  });
+}
+var METHODS2 = ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE"];
+function cors(options) {
+  const { origins, credentials = true, methods = METHODS2, allowHeaders, exposeHeaders, maxAge = 600 } = options;
+  return async (request, next) => {
+    const origin = request.headers.get("origin");
+    if (!origin || origin === new URL(request.url).origin) return next();
+    const allowed = allows(origins, origin);
+    const preflight = request.method === "OPTIONS" && request.headers.has("access-control-request-method");
+    if (preflight) {
+      if (!allowed) return refusal(403, "origin_not_allowed", "This origin may not call the API.");
+      const headers = new Headers({
+        "access-control-allow-origin": origin,
+        "access-control-allow-methods": methods.join(", "),
+        "access-control-max-age": String(maxAge),
+        vary: "Origin, Access-Control-Request-Headers"
+      });
+      const asked = request.headers.get("access-control-request-headers");
+      const allowedHeaders = allowHeaders ? allowHeaders.join(", ") : asked;
+      if (allowedHeaders) headers.set("access-control-allow-headers", allowedHeaders);
+      if (credentials) headers.set("access-control-allow-credentials", "true");
+      return new Response(null, { status: 204, headers });
+    }
+    const response = await next();
+    return withHeaders(response, (headers) => {
+      appendVary(headers, "Origin");
+      if (!allowed) return;
+      headers.set("access-control-allow-origin", origin);
+      if (credentials) headers.set("access-control-allow-credentials", "true");
+      if (exposeHeaders?.length) headers.set("access-control-expose-headers", exposeHeaders.join(", "));
+    });
+  };
+}
+var SAFE = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+function originCheck(options) {
+  return (request, next) => {
+    if (SAFE.has(request.method) || !request.headers.has("cookie")) return next();
+    const origin = request.headers.get("origin");
+    const site = request.headers.get("sec-fetch-site");
+    const self = new URL(request.url).origin;
+    if (site === "same-origin" || site === "none") return next();
+    if (origin && (origin === self || allows(options.origins, origin))) return next();
+    if (!site && !origin) return next();
+    return refusal(403, "cross_origin_refused", "Requests from this origin are refused.");
+  };
+}
+function apiSecurity(options = {}) {
+  const origins = options.origins ?? [];
+  const prefix = (options.prefix ?? "/api").replace(/\/$/, "");
+  const chain = [];
+  if (options.headers !== false) chain.push(securityHeaders(options.headers));
+  if (options.cors !== false) chain.push(cors({ ...options.cors, origins }));
+  if (options.originCheck !== false) chain.push(originCheck({ origins }));
+  for (const limit of options.rateLimits ?? []) chain.push(rateLimit(limit));
+  return (request, next) => {
+    const { pathname } = new URL(request.url);
+    if (pathname !== prefix && !pathname.startsWith(prefix + "/")) return next();
+    const run = (i) => {
+      const middleware = chain[i];
+      return middleware ? Promise.resolve(middleware(request, () => run(i + 1))) : next();
+    };
+    return run(0);
+  };
+}
+function refusal(status, code, message) {
+  return errorResponse(new ApiError(status, code, message));
+}