@forinda/kickjs 7.3.0 → 8.0.0

package/dist/csrf-Bc4gp4d0.mjs

@@ -1,12 +0,0 @@
-/**
- * @forinda/kickjs v7.3.0
- *
- * Copyright (c) Felix Orinda
- *
- * This source code is licensed under the MIT license found in the
- * LICENSE file in the root directory of this source tree.
- *
- * @license MIT
- */
-import{n as resolvePathname}from"./client-ip-fQJ_21xU.mjs";function randomHex(bytes){let buf=crypto.getRandomValues(new Uint8Array(bytes));return Array.from(buf,b=>b.toString(16).padStart(2,`0`)).join(``)}function csrf(options={}){let cookieName=options.cookie??`_csrf`,headerName=options.header??`x-csrf-token`,protectedMethods=new Set((options.methods??[`POST`,`PUT`,`PATCH`,`DELETE`]).map(m=>m.toUpperCase())),ignorePaths=new Set(options.ignorePaths??[]),tokenLength=options.tokenLength??32,cookieOpts={httpOnly:!0,sameSite:`strict`,secure:process.env.NODE_ENV===`production`,path:`/`,...options.cookieOptions};return(req,res,next)=>{let token=(req.cookies||{})[cookieName];if(token||(token=randomHex(tokenLength),res.cookie(cookieName,token,cookieOpts)),!protectedMethods.has(req.method.toUpperCase())||ignorePaths.has(resolvePathname(req)))return next();let headerToken=req.headers[headerName];if(!headerToken||headerToken!==token)return res.status(403).json({message:`CSRF token mismatch`});next()}}export{randomHex as n,csrf as t};
-//# sourceMappingURL=csrf-Bc4gp4d0.mjs.map

package/dist/csrf-Bc4gp4d0.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"csrf-Bc4gp4d0.mjs","names":[],"sources":["../src/core/web-crypto.ts","../src/http/middleware/csrf.ts"],"sourcesContent":["/**\n * Web Crypto helpers — portable across node/bun/deno/workers via\n * `globalThis.crypto`. The Web Crypto migration lives here so the request\n * path never imports `node:crypto` (edge-runtime portability, see\n * `web-standards-edge-design.md` P0).\n */\n\n/** Random hex string — replacement for `randomBytes(n).toString('hex')`. */\nexport function randomHex(bytes: number): string {\n  const buf = crypto.getRandomValues(new Uint8Array(bytes))\n  return Array.from(buf, (b) => b.toString(16).padStart(2, '0')).join('')\n}\n","import type { Request, Response, NextFunction } from 'express'\nimport { resolvePathname, type ClientRequestLike } from '../client-ip'\n\nimport { randomHex } from '../../core/web-crypto'\n\nexport interface CsrfOptions {\n  /** Cookie name for the CSRF token (default: '_csrf') */\n  cookie?: string\n  /** Header name to check for the token (default: 'x-csrf-token') */\n  header?: string\n  /** HTTP methods that require CSRF validation (default: POST, PUT, PATCH, DELETE) */\n  methods?: string[]\n  /** Paths to exclude from CSRF checks (e.g. webhooks) */\n  ignorePaths?: string[]\n  /** Token byte length before hex encoding (default: 32 = 64 hex chars) */\n  tokenLength?: number\n  /** Cookie options */\n  cookieOptions?: {\n    httpOnly?: boolean\n    sameSite?: 'strict' | 'lax' | 'none'\n    secure?: boolean\n    path?: string\n  }\n}\n\n/**\n * Double-submit cookie CSRF protection middleware.\n *\n * On every request, sets a CSRF token cookie. For state-changing methods\n * (POST, PUT, PATCH, DELETE), validates that the request header matches\n * the cookie value.\n *\n * @example\n * ```ts\n * import { csrf } from '@forinda/kickjs'\n *\n * bootstrap({\n *   modules,\n *   middleware: [\n *     cookieParser(),\n *     csrf(),\n *     // ... other middleware\n *   ],\n * })\n * ```\n *\n * Client usage:\n * 1. Read the `_csrf` cookie value\n * 2. Send it in the `x-csrf-token` header on every mutating request\n */\nexport function csrf(options: CsrfOptions = {}) {\n  const cookieName = options.cookie ?? '_csrf'\n  const headerName = options.header ?? 'x-csrf-token'\n  const protectedMethods = new Set(\n    (options.methods ?? ['POST', 'PUT', 'PATCH', 'DELETE']).map((m) => m.toUpperCase()),\n  )\n  const ignorePaths = new Set(options.ignorePaths ?? [])\n  const tokenLength = options.tokenLength ?? 32\n  const cookieOpts = {\n    httpOnly: true,\n    sameSite: 'strict' as const,\n    secure: process.env.NODE_ENV === 'production',\n    path: '/',\n    ...options.cookieOptions,\n  }\n\n  return (req: Request, res: Response, next: NextFunction) => {\n    // Generate or reuse CSRF token\n    const cookies = (req as any).cookies || {}\n    let token = cookies[cookieName]\n\n    if (!token) {\n      token = randomHex(tokenLength)\n      res.cookie(cookieName, token, cookieOpts)\n    }\n\n    // Skip validation for safe methods and ignored paths\n    if (!protectedMethods.has(req.method.toUpperCase())) {\n      return next()\n    }\n\n    // `req.path` is Express-only, so `has(undefined)` never matched and\n    // configured exemptions were silently ignored on Fastify / h3.\n    if (ignorePaths.has(resolvePathname(req as ClientRequestLike))) {\n      return next()\n    }\n\n    // Validate: header token must match cookie token\n    const headerToken = req.headers[headerName] as string | undefined\n\n    if (!headerToken || headerToken !== token) {\n      return res.status(403).json({\n        message: 'CSRF token mismatch',\n      })\n    }\n\n    next()\n  }\n}\n"],"mappings":";;;;;;;;;;2DAQA,SAAgB,UAAU,MAAuB,CAC/C,IAAM,IAAM,OAAO,gBAAgB,IAAI,WAAW,KAAK,CAAC,EACxD,OAAO,MAAM,KAAK,IAAM,GAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CACxE,CCuCA,SAAgB,KAAK,QAAuB,CAAC,EAAG,CAC9C,IAAM,WAAa,QAAQ,QAAU,QAC/B,WAAa,QAAQ,QAAU,eAC/B,iBAAmB,IAAI,KAC1B,QAAQ,SAAW,CAAC,OAAQ,MAAO,QAAS,QAAQ,EAAA,CAAG,IAAK,GAAM,EAAE,YAAY,CAAC,CACpF,EACM,YAAc,IAAI,IAAI,QAAQ,aAAe,CAAC,CAAC,EAC/C,YAAc,QAAQ,aAAe,GACrC,WAAa,CACjB,SAAU,GACV,SAAU,SACV,OAAQ,QAAQ,IAAI,WAAa,aACjC,KAAM,IACN,GAAG,QAAQ,aACb,EAEA,OAAQ,IAAc,IAAe,OAAuB,CAG1D,IAAI,OADa,IAAY,SAAW,CAAC,EAAA,CACrB,YAcpB,GAZK,QACH,MAAQ,UAAU,WAAW,EAC7B,IAAI,OAAO,WAAY,MAAO,UAAU,GAItC,CAAC,iBAAiB,IAAI,IAAI,OAAO,YAAY,CAAC,GAM9C,YAAY,IAAI,gBAAgB,GAAwB,CAAC,EAC3D,OAAO,KAAK,EAId,IAAM,YAAc,IAAI,QAAQ,YAEhC,GAAI,CAAC,aAAe,cAAgB,MAClC,OAAO,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,CAC1B,QAAS,qBACX,CAAC,EAGH,KAAK,CACP,CACF"}

package/dist/csrf-vR23CJas.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"csrf-vR23CJas.d.mts","names":[],"sources":["../src/http/middleware/csrf.ts"],"mappings":";;;UAKiB;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;IACE;IACA;IACA;IACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6BY,KAAK,UAAS,eAAgB,KAgB/B,SAAO,KAAO,UAAQ,MAAQ,wBAAY,cAAA"}

package/dist/decorators-Bks7cgBJ.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"decorators-Bks7cgBJ.d.mts","names":[],"sources":["../src/core/assets.ts","../src/core/decorators.ts"],"mappings":";;;;;cA6Ba;;;;;;;;UAmBI;;;;;;;cAQJ,QAAQ,eAAe;cAEvB,0BAA0B;WAC5B;WACA;EACT,YAAY,mBAAmB;;iBAmCjB,aAAa,mBAAmB;;iBAchC;;;;;;;;;;;cA6TH,QAAQ;;;;;;;;;;;;;;;;;iBAkBL,aAAa;;;;iBChXb,WAAW,UAAU,iBAAiB;;iBAQtC,QAAQ,UAAU,iBAAiB;;iBAQnC,UAAU,UAAU,iBAAiB;;iBAQrC,WAAW,UAAU,iBAAiB;;;;;;;;;;iBAgBtC,cAAc;;iBAUd,iBAAiB;;;;;;;;;iBAcjB,cAAc;;;;;;;;;UAgBb;;GAEd,gBAAgB;;GAEhB,gBAAgB,0CAA0C;;;;;;;;;;;;;;;;;;;;iBA2C7C,UAAU,gBAAgB,yBACxC,OAAO,IACN;iBACa,UAAU,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAyC5B,OAAO,gBAAgB,yBACrC,OAAO,IACN;iBACa,OAAO,kBAAkB;;;;;;;;;;;;QAsBjC;YAEI;;;KAIA,eAAe;;;;;;;;;;;;;;;;KAiBf,IAAI,UAAU,SAAS,UAAU,QAAQ;;;;;;;;;;;;KAahD,SAAS,qBAAqB,0BAA0B,IAAI,IAAI;;;;;;;;;;;;;;;;iBAiBrD,MAAM,kBACpB,QAAQ,SAAS,IACjB,eAAe,UAAU,SAAS,QAAQ,eACzC;;;;;;;;;;;;KAqBE,cAAc,GAAG,iCACnB,WAAW,aAAa,EAAE,+BACpB,SAAS,MACZ,EAAE,WAAW,0BACX,cAAc,EAAE,OAAO,SAAS,uBAEhC;;KAGI,WAAW,cAAc;;;;;;;KAQhC,YAAY,qBAAqB,4BAA4B,IAAI,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmC1D,MAAM,kBAAkB,UAAU,YAAY,KAAK;UAQlD;EACf;EACA;EACA;EACA;;IAEE;;IAEA;;IAEA;;;;;;;IAOA;;IAEA;;;cAiBS,MAAG,eAZO,aAAe,kCAAgC;cAazD,OAAI,eAbM,aAAe,kCAAgC;cAczD,MAAG,eAdO,aAAe,kCAAgC;cAezD,SAAM,eAfI,aAAe,kCAAgC;cAgBzD,QAAK,eAhBK,aAAe,kCAAgC;UAoBrD;;EAEf;;EAEA;;EAEA;;;;;;UAOe;EACf,SAAS;EACT,WAAW;EACX;GACC;;;;;;iBAOa,8BACd,QAAQ,uBAAuB,6BAC9B;;;;;;;;;;;;;;;;;;;;;iBAiCa,eACd,QAAQ,uBAAuB,6BAC9B;;;;;;;;;;;;;;;;KAwBS,kBAAkB,eAAe,KAAK,MAAM,4BAA4B;;iBAGpE,cAAc,UAAU,sBAAsB,iBAAiB;;;;;KAqBnE,8BAA8B,kBAAkB;;;;;UAM3C;;EAEf;;;;;;EAMA,eAAe;;EAEf,gBAAgB;;UAGD,yBAAyB;EACxC;;EAEA;;EAEA;;;iBAIc,WAAW,QAAQ,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;iBAoDtC,QAAQ;;;;;;;;;;;;;;;;;iBAoBR,YAAY,kBAAkB,qBAC5C,MAAM,IACL;EAAM,WAAW,UAAU,aAAa"}

package/dist/error-handler-Ch3WCWSU.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"error-handler-Ch3WCWSU.d.mts","names":[],"sources":["../src/http/middleware/error-handler.ts"],"mappings":";;;;;;;;;;;UAUU;EACR;EACA;;EAEA;EACA,SAAS;;;iBAaK,oBAAe,MACf,cAAY,KAAO,iBAAe;;;;;;;;;;;;;;;;;;;;iBAwBlC,iBAAY,UAEV,KAAO,cAAY,KAAO,iBAAe,sBAAmB"}

package/dist/handler-LCMLtNs0.mjs

@@ -1,13 +0,0 @@
-/**
- * @forinda/kickjs v7.3.0
- *
- * Copyright (c) Felix Orinda
- *
- * This source code is licensed under the MIT license found in the
- * LICENSE file in the root directory of this source tree.
- *
- * @license MIT
- */
-import{createLogger,describeError}from"./core/logger.mjs";import{i as requestStore,t as RequestContext}from"./context-CxYSC26o.mjs";import{a as disposeRequestStore,i as createRequestStore,t as applyHandlerResult}from"./reply-DYiNuBi5.mjs";import{validate}from"./http/middleware/validate.mjs";import{t as applyUploadConfig}from"./upload-config-Bm3Lxt4A.mjs";var WebRequestShim=class{method;url;headers;body;params={};query={};requestId;file;files;signal;constructor(request,url){this.method=request.method,this.url=url.pathname+url.search,this.signal=request.signal;let headers={};request.headers.forEach((value,key)=>{headers[key]=value}),this.headers=headers;let query={};for(let key of url.searchParams.keys()){let all=url.searchParams.getAll(key);query[key]=all.length>1?all:all[0]}this.query=query}once(event,listener){return event===`close`&&this.signal.addEventListener(`abort`,listener,{once:!0}),this}on(event,listener){return this.once(event,listener)}};const encoder=new TextEncoder;function toBytes(chunk){return chunk instanceof Uint8Array?chunk:encoder.encode(String(chunk))}var WebResponseDriver=class{signal;ready;settled=!1;_status=200;headers=new Headers;_headersSent=!1;writer;resolveReady;constructor(signal){this.signal=signal,this.ready=new Promise(resolve=>{this.resolveReady=resolve})}status(code){return this._status=code,this}json(data){return this.headers.has(`content-type`)||this.headers.set(`content-type`,`application/json; charset=utf-8`),this.finish(JSON.stringify(data))}send(data){return typeof data==`object`&&data&&!(data instanceof Uint8Array)?this.json(data):this.finish(data)}type(contentType){return this.headers.set(`content-type`,contentType),this}setHeader(name,value){if(Array.isArray(value)){this.headers.delete(name);for(let v of value)this.headers.append(name,String(v))}else this.headers.set(name,String(value));return this}render(){throw Error(`ctx.render() is not supported on the web runtime (no view engine).`)}writeHead(statusCode,headers){if(this._status=statusCode,headers)for(let[name,value]of Object.entries(headers))this.setHeader(name,value);return this.startStream(),this}flushHeaders(){return this.startStream(),this}write(chunk){return this.startStream(),this.writer.write(toBytes(chunk)).catch(()=>{}),!0}end(data){return this.writer?(data!==void 0&&this.write(data),this.writer.close().catch(()=>{}),this.writer=void 0,this):this.finish(data)}once(event,listener){return event===`close`&&this.signal&&this.signal.addEventListener(`abort`,listener,{once:!0}),this}get headersSent(){return this._headersSent}finish(body){if(this.settled)return this;this.settled=!0,this._headersSent=!0;let bodyAllowed=this._status!==204&&this._status!==304;return this.resolveReady(new Response(bodyAllowed?body??null:null,{status:this._status,headers:this.headers})),this}startStream(){if(this.writer||this.settled)return;let{readable,writable}=new TransformStream;this.writer=writable.getWriter(),this.settled=!0,this._headersSent=!0,this.signal?.addEventListener(`abort`,()=>{this.writer?.abort().catch(()=>{}),this.writer=void 0},{once:!0}),this.resolveReady(new Response(readable,{status:this._status,headers:this.headers}))}};const log=createLogger(`WebPipeline`),NOOP_NEXT=()=>{},BODY_METHODS=new Set([`POST`,`PUT`,`PATCH`,`DELETE`]);function defaultErrorResponse(err,driver){let status=typeof err?.status==`number`?err.status:typeof err?.statusCode==`number`?err.statusCode:500;if(status>=500){log.error(err,`Unhandled error in web pipeline — ${describeError(err)}`);let stack=err?.stack;driver.status(status).json({error:`Internal Server Error`,...isProduction()?{}:{message:describeError(err),...typeof stack==`string`?{stack:stack.split(`
-`)}:{}}});return}driver.status(status).json({error:err?.message??`Request failed`})}function isProduction(){return typeof process<`u`&&process.env?.NODE_ENV===`production`}function compileWebRoute(entry,hooks){let validator=entry.meta.validation?validate(entry.meta.validation):void 0,upload=entry.meta.upload&&entry.meta.upload.mode!==`none`?entry.meta.upload:null;return async({request,url,params})=>{let req=new WebRequestShim(request,url);if(req.params=params,upload){let form=await request.formData().catch(()=>void 0);if(form){let rawParts=[],fields={};for(let[name,value]of form.entries())typeof value==`string`?fields[name]=value:rawParts.push({fieldname:name,filename:value.name??``,mimetype:value.type||`application/octet-stream`,buffer:new Uint8Array(await value.arrayBuffer())});let{file,files}=applyUploadConfig(rawParts,entry.meta.upload);req.file=file,req.files=files,req.body=fields}}else if(BODY_METHODS.has(request.method)){let contentType=req.headers[`content-type`]??``;if(contentType.includes(`application/json`))req.body=await request.json().catch(()=>void 0);else if(contentType.includes(`application/x-www-form-urlencoded`)){let text=await request.text().catch(()=>``);req.body=Object.fromEntries(new URLSearchParams(text))}else contentType.startsWith(`text/`)&&(req.body=await request.text().catch(()=>void 0))}let store=createRequestStore(req.headers[`x-request-id`]);req.requestId=store.requestId;let driver=new WebResponseDriver(request.signal);driver.setHeader(`x-request-id`,store.requestId);let pipeline=requestStore.run(store,async()=>{let ctx=new RequestContext(req,driver,NOOP_NEXT,driver);validator&&await new Promise((resolve,reject)=>{validator(req,void 0,err=>err?reject(err):resolve())});for(let mw of entry.middlewares){let advanced=!1;if(await new Promise((resolve,reject)=>{Promise.resolve(mw(ctx,err=>{advanced=!0,err?reject(err):resolve()})).catch(reject)}),!advanced||driver.settled)return}if(entry.contributorRunner&&await entry.contributorRunner(ctx),driver.settled)return;let result=await entry.handler(ctx);driver.settled||applyHandlerResult(ctx,result)});try{try{await Promise.race([pipeline,driver.ready])}catch(err){driver.settled||(hooks?.onError&&await hooks.onError(err,req,driver),driver.settled||defaultErrorResponse(err,driver))}return driver.settled||driver.status(404).json({error:`Not Found`}),await driver.ready}finally{Promise.resolve(pipeline).catch(()=>{}).then(()=>disposeRequestStore(store))}}}export{WebRequestShim as n,WebResponseDriver as r,compileWebRoute as t};
-//# sourceMappingURL=handler-LCMLtNs0.mjs.map

package/dist/handler-LCMLtNs0.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"handler-LCMLtNs0.mjs","names":[],"sources":["../src/http/web/driver.ts","../src/http/web/handler.ts"],"sourcesContent":["// Web-standard driver pair — the request/response bridge between web\n// primitives (WHATWG Request/Response) and the KickJS RequestContext surface.\n//\n// Deliberately imports NOTHING from node: this module is the edge-safe core\n// shared by the h3 v2 runtime (`runtimes/h3-web.ts`, node bootstrap) and the\n// `@forinda/kickjs/web` fetch entry (edge/Bun/Deno). See\n// `web-standards-edge-design.md` §3.1.\n\nimport type { RuntimeResponse } from '../runtime'\n\n/**\n * Presents a web `Request` as the express-shaped `req` object that\n * `RequestContext` (and route validation) reads: plain-object `headers`,\n * assignable `body`/`params`/`query`, and `on/once('close')` bridged from\n * the request's `AbortSignal` — the only EventEmitter surface the context\n * layer uses (`ctx.signal`, SSE close).\n */\nexport class WebRequestShim {\n  readonly method: string\n  readonly url: string\n  /** Lower-cased plain header object (RequestContext indexes it directly). */\n  readonly headers: Record<string, string>\n  body: unknown\n  params: Record<string, string> = {}\n  query: Record<string, unknown> = {}\n  requestId?: string\n  file?: unknown\n  files?: unknown;\n  // Ad-hoc props middleware may set (session, user, ...) — index signature\n  // keeps assignment open like a node req object.\n  [key: string]: unknown\n\n  private readonly signal: AbortSignal\n\n  constructor(request: Request, url: URL) {\n    this.method = request.method\n    // Express-shaped `req.url` is path + search, not the absolute URL.\n    this.url = url.pathname + url.search\n    this.signal = request.signal\n    const headers: Record<string, string> = {}\n    request.headers.forEach((value, key) => {\n      headers[key] = value\n    })\n    this.headers = headers\n    const query: Record<string, unknown> = {}\n    for (const key of url.searchParams.keys()) {\n      const all = url.searchParams.getAll(key)\n      query[key] = all.length > 1 ? all : all[0]\n    }\n    this.query = query\n  }\n\n  /** `req.once('close')` — abort of the underlying request signal. */\n  once(event: string, listener: () => void): this {\n    if (event === 'close') this.signal.addEventListener('abort', listener, { once: true })\n    return this\n  }\n\n  /** `req.on('close')` — same bridge; signals only abort once anyway. */\n  on(event: string, listener: () => void): this {\n    return this.once(event, listener)\n  }\n}\n\nconst encoder = new TextEncoder()\n\nfunction toBytes(chunk: unknown): Uint8Array {\n  if (chunk instanceof Uint8Array) return chunk\n  return encoder.encode(String(chunk))\n}\n\n/**\n * `RuntimeResponse` over a web `Response`.\n *\n * Two modes:\n * - **Buffered** (default): `status/json/send/type/setHeader` record state;\n *   the terminal call resolves {@link ready} with a complete `Response`.\n * - **Streaming**: the first `writeHead`/`flushHeaders`/`write` call switches\n *   to a `TransformStream` and resolves {@link ready} IMMEDIATELY with a\n *   streamed `Response` — SSE works on edge this way; `write` feeds the\n *   writer, `end` closes it.\n *\n * A class so the method table lives on a shared prototype (one allocation\n * per request — same rationale as the Fastify/h3 driver classes).\n */\nexport class WebResponseDriver implements RuntimeResponse {\n  /** Resolves with the final (or streamed) Response. */\n  readonly ready: Promise<Response>\n  /** True once a terminal/streaming action produced the Response. */\n  settled = false\n\n  private _status = 200\n  private readonly headers = new Headers()\n  private _headersSent = false\n  private writer?: WritableStreamDefaultWriter<Uint8Array>\n  private resolveReady!: (response: Response) => void\n\n  constructor(private readonly signal?: AbortSignal) {\n    this.ready = new Promise<Response>((resolve) => {\n      this.resolveReady = resolve\n    })\n  }\n\n  status(code: number): this {\n    this._status = code\n    return this\n  }\n\n  json(data: unknown): this {\n    if (!this.headers.has('content-type'))\n      this.headers.set('content-type', 'application/json; charset=utf-8')\n    return this.finish(JSON.stringify(data))\n  }\n\n  send(data: unknown): this {\n    if (\n      data !== undefined &&\n      data !== null &&\n      typeof data === 'object' &&\n      !(data instanceof Uint8Array)\n    ) {\n      return this.json(data)\n    }\n    return this.finish(data as string | Uint8Array | null | undefined)\n  }\n\n  type(contentType: string): this {\n    this.headers.set('content-type', contentType)\n    return this\n  }\n\n  setHeader(name: string, value: unknown): this {\n    if (Array.isArray(value)) {\n      this.headers.delete(name)\n      for (const v of value) this.headers.append(name, String(v))\n    } else {\n      this.headers.set(name, String(value))\n    }\n    return this\n  }\n\n  render(): never {\n    throw new Error('ctx.render() is not supported on the web runtime (no view engine).')\n  }\n\n  writeHead(statusCode: number, headers?: Record<string, string | number | string[]>): this {\n    this._status = statusCode\n    if (headers) {\n      for (const [name, value] of Object.entries(headers)) this.setHeader(name, value)\n    }\n    this.startStream()\n    return this\n  }\n\n  flushHeaders(): this {\n    this.startStream()\n    return this\n  }\n\n  write(chunk: unknown): boolean {\n    this.startStream()\n    // Fire-and-forget: backpressure is absorbed by the stream's queue. Write\n    // failures (client gone) surface via the abort listener, not here.\n    void this.writer!.write(toBytes(chunk)).catch(() => {})\n    return true\n  }\n\n  end(data?: unknown): this {\n    if (this.writer) {\n      if (data !== undefined) this.write(data)\n      void this.writer.close().catch(() => {})\n      this.writer = undefined\n      return this\n    }\n    return this.finish(data as string | Uint8Array | null | undefined)\n  }\n\n  once(event: string, listener: (...args: unknown[]) => void): this {\n    if (event === 'close' && this.signal)\n      this.signal.addEventListener('abort', listener as () => void, { once: true })\n    return this\n  }\n\n  get headersSent(): boolean {\n    return this._headersSent\n  }\n\n  /** Buffered terminal: build the final Response exactly once. */\n  private finish(body?: string | Uint8Array | null): this {\n    if (this.settled) return this\n    this.settled = true\n    this._headersSent = true\n    // 204/304 must not carry a body per the Response constructor contract.\n    const bodyAllowed = this._status !== 204 && this._status !== 304\n    this.resolveReady(\n      new Response(bodyAllowed ? (body ?? null) : null, {\n        status: this._status,\n        headers: this.headers,\n      }),\n    )\n    return this\n  }\n\n  /** Switch to streaming mode and resolve `ready` with the streamed Response. */\n  private startStream(): void {\n    if (this.writer || this.settled) return\n    const { readable, writable } = new TransformStream<Uint8Array, Uint8Array>()\n    this.writer = writable.getWriter()\n    this.settled = true\n    this._headersSent = true\n    // Abort from the client tears the stream down so the writer stops queueing.\n    this.signal?.addEventListener(\n      'abort',\n      () => {\n        void this.writer?.abort().catch(() => {})\n        this.writer = undefined\n      },\n      { once: true },\n    )\n    this.resolveReady(new Response(readable, { status: this._status, headers: this.headers }))\n  }\n}\n","// Engine-neutral web pipeline: run one KickJS RouteEntry against a WHATWG\n// Request and produce a WHATWG Response. Shared by the h3 v2 runtime\n// (node bootstrap) and the `@forinda/kickjs/web` fetch entry (edge/Bun/Deno).\n// Edge-safe: no node imports beyond the sanctioned ALS request store.\n\nimport { RequestContext } from '../context'\nimport { applyHandlerResult } from '../reply'\nimport { requestStore } from '../request-store'\nimport { createRequestStore, disposeRequestStore } from '../middleware/request-scope'\nimport { validate } from '../middleware/validate'\nimport { applyUploadConfig, type RawUploadPart } from '../middleware/upload-config'\nimport type { RouteEntry, RuntimeResponse } from '../runtime'\nimport { WebRequestShim, WebResponseDriver } from './driver'\nimport { createLogger, describeError } from '../../core/logger'\n\nconst log = createLogger('WebPipeline')\nconst NOOP_NEXT = (): void => {}\nconst BODY_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE'])\n\nexport interface WebRouteInvocation {\n  request: Request\n  url: URL\n  params: Record<string, string>\n}\n\nexport interface WebRouteHooks {\n  /**\n   * Error bridge — receives pipeline rejections (validation failures,\n   * handler throws) with the shim + driver so an engine can dispatch the\n   * framework's connect-style error handler. When absent (or when it\n   * doesn't settle the driver), a minimal JSON error is produced from\n   * `err.status`/`err.statusCode` (500 default).\n   */\n  onError?: (err: unknown, req: WebRequestShim, res: WebResponseDriver) => void | Promise<void>\n}\n\n/**\n * Fallback error shape when no engine error handler settles the response.\n *\n * This path used to be completely silent: a bare\n * `{ error: 'Internal Server Error' }` with no log line anywhere, so a\n * failure that reached here left no trace on either side. It is a\n * last-resort branch, which is exactly when diagnostics matter most.\n */\nfunction defaultErrorResponse(err: unknown, driver: WebResponseDriver): void {\n  const status =\n    typeof (err as { status?: number })?.status === 'number'\n      ? (err as { status: number }).status\n      : typeof (err as { statusCode?: number })?.statusCode === 'number'\n        ? (err as { statusCode: number }).statusCode\n        : 500\n\n  if (status >= 500) {\n    log.error(err, `Unhandled error in web pipeline — ${describeError(err)}`)\n    const stack = (err as Error)?.stack\n    driver.status(status).json({\n      error: 'Internal Server Error',\n      ...(isProduction()\n        ? {}\n        : {\n            message: describeError(err),\n            ...(typeof stack === 'string' ? { stack: stack.split('\\n') } : {}),\n          }),\n    })\n    return\n  }\n\n  driver.status(status).json({ error: (err as Error)?.message ?? 'Request failed' })\n}\n\n/**\n * Read per-call, not at module scope: the web entry is imported once and\n * reused across invocations, and edge runtimes may not expose `process`.\n */\nfunction isProduction(): boolean {\n  return typeof process !== 'undefined' && process.env?.NODE_ENV === 'production'\n}\n\n/**\n * Compile a RouteEntry into a `(invocation) => Promise<Response>` function.\n * Everything derivable at route-build time (validator, upload config) is\n * hoisted here — per-request work is shim + store + pipeline only.\n */\nexport function compileWebRoute(\n  entry: RouteEntry,\n  hooks?: WebRouteHooks,\n): (invocation: WebRouteInvocation) => Promise<Response> {\n  const validator = entry.meta.validation ? validate(entry.meta.validation) : undefined\n  const upload = entry.meta.upload && entry.meta.upload.mode !== 'none' ? entry.meta.upload : null\n\n  return async ({ request, url, params }) => {\n    const req = new WebRequestShim(request, url)\n    req.params = params\n\n    // Body: uploads consume the stream as FormData; everything else parses\n    // by content-type. A failed parse leaves body undefined (validation\n    // rejects it downstream if the route demands a shape).\n    if (upload) {\n      const form = await request.formData().catch(() => undefined)\n      if (form) {\n        const rawParts: RawUploadPart[] = []\n        const fields: Record<string, unknown> = {}\n        for (const [name, value] of form.entries()) {\n          if (typeof value === 'string') {\n            fields[name] = value\n          } else {\n            rawParts.push({\n              fieldname: name,\n              filename: value.name ?? '',\n              mimetype: value.type || 'application/octet-stream',\n              buffer: new Uint8Array(await value.arrayBuffer()) as unknown as Buffer,\n            })\n          }\n        }\n        const { file, files } = applyUploadConfig(rawParts, entry.meta.upload!)\n        req.file = file\n        req.files = files\n        req.body = fields\n      }\n    } else if (BODY_METHODS.has(request.method)) {\n      const contentType = req.headers['content-type'] ?? ''\n      if (contentType.includes('application/json')) {\n        req.body = await request.json().catch(() => undefined)\n      } else if (contentType.includes('application/x-www-form-urlencoded')) {\n        const text = await request.text().catch(() => '')\n        req.body = Object.fromEntries(new URLSearchParams(text))\n      } else if (contentType.startsWith('text/')) {\n        req.body = await request.text().catch(() => undefined)\n      }\n    }\n\n    const store = createRequestStore(req.headers['x-request-id'])\n    req.requestId = store.requestId\n\n    const driver = new WebResponseDriver(request.signal)\n    driver.setHeader('x-request-id', store.requestId)\n\n    const pipeline = requestStore.run(store, async () => {\n      const ctx = new RequestContext(\n        req as never,\n        driver as never,\n        NOOP_NEXT,\n        driver as RuntimeResponse,\n      )\n\n      if (validator) {\n        await new Promise<void>((resolve, reject) => {\n          validator(req as never, undefined as never, (err?: unknown) =>\n            err ? reject(err) : resolve(),\n          )\n        })\n      }\n\n      for (const mw of entry.middlewares) {\n        let advanced = false\n        await new Promise<void>((resolve, reject) => {\n          const next = (err?: unknown): void => {\n            advanced = true\n            if (err) reject(err)\n            else resolve()\n          }\n          Promise.resolve(mw(ctx, next)).catch(reject)\n        })\n        if (!advanced || driver.settled) return\n      }\n\n      if (entry.contributorRunner) await entry.contributorRunner(ctx)\n      if (driver.settled) return\n      const result = await entry.handler(ctx)\n      // Return-value handlers (reply.ts): auto-send when nothing was written.\n      // `undefined` falls through to the canonical 404 below.\n      if (!driver.settled) applyHandlerResult(ctx, result)\n    })\n\n    try {\n      // Streaming responses resolve `ready` mid-pipeline (SSE); buffered ones\n      // resolve at the terminal ctx call. Race so both shapes return promptly.\n      try {\n        await Promise.race([pipeline, driver.ready])\n      } catch (err) {\n        if (!driver.settled) {\n          if (hooks?.onError) await hooks.onError(err, req, driver)\n          if (!driver.settled) defaultErrorResponse(err, driver)\n        }\n      }\n      if (!driver.settled) {\n        // Pipeline finished without responding — canonical 404 shape.\n        driver.status(404).json({ error: 'Not Found' })\n      }\n      return await driver.ready\n    } finally {\n      // @PreDestroy teardown. For buffered responses this runs post-response;\n      // for streams it runs when the pipeline (not the stream) completes —\n      // stream lifetime is governed by the client abort signal.\n      void Promise.resolve(pipeline)\n        .catch(() => {})\n        .then(() => disposeRequestStore(store))\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;qWAiBA,IAAa,eAAb,KAA4B,CAC1B,OACA,IAEA,QACA,KACA,OAAiC,CAAC,EAClC,MAAiC,CAAC,EAClC,UACA,KACA,MAKA,OAEA,YAAY,QAAkB,IAAU,CACtC,KAAK,OAAS,QAAQ,OAEtB,KAAK,IAAM,IAAI,SAAW,IAAI,OAC9B,KAAK,OAAS,QAAQ,OACtB,IAAM,QAAkC,CAAC,EACzC,QAAQ,QAAQ,SAAS,MAAO,MAAQ,CACtC,QAAQ,KAAO,KACjB,CAAC,EACD,KAAK,QAAU,QACf,IAAM,MAAiC,CAAC,EACxC,IAAK,IAAM,OAAO,IAAI,aAAa,KAAK,EAAG,CACzC,IAAM,IAAM,IAAI,aAAa,OAAO,GAAG,EACvC,MAAM,KAAO,IAAI,OAAS,EAAI,IAAM,IAAI,EAC1C,CACA,KAAK,MAAQ,KACf,CAGA,KAAK,MAAe,SAA4B,CAE9C,OADI,QAAU,SAAS,KAAK,OAAO,iBAAiB,QAAS,SAAU,CAAE,KAAM,EAAK,CAAC,EAC9E,IACT,CAGA,GAAG,MAAe,SAA4B,CAC5C,OAAO,KAAK,KAAK,MAAO,QAAQ,CAClC,CACF,EAEA,MAAM,QAAU,IAAI,YAEpB,SAAS,QAAQ,MAA4B,CAE3C,OADI,iBAAiB,WAAmB,MACjC,QAAQ,OAAO,OAAO,KAAK,CAAC,CACrC,CAgBA,IAAa,kBAAb,KAA0D,CAY3B,OAV7B,MAEA,QAAU,GAEV,QAAkB,IAClB,QAA2B,IAAI,QAC/B,aAAuB,GACvB,OACA,aAEA,YAAY,OAAuC,CAAtB,KAAA,OAAA,OAC3B,KAAK,MAAQ,IAAI,QAAmB,SAAY,CAC9C,KAAK,aAAe,OACtB,CAAC,CACH,CAEA,OAAO,KAAoB,CAEzB,MADA,MAAK,QAAU,KACR,IACT,CAEA,KAAK,KAAqB,CAGxB,OAFK,KAAK,QAAQ,IAAI,cAAc,GAClC,KAAK,QAAQ,IAAI,eAAgB,iCAAiC,EAC7D,KAAK,OAAO,KAAK,UAAU,IAAI,CAAC,CACzC,CAEA,KAAK,KAAqB,CASxB,OALE,OAAO,MAAS,UAFhB,MAGA,EAAE,gBAAgB,YAEX,KAAK,KAAK,IAAI,EAEhB,KAAK,OAAO,IAA8C,CACnE,CAEA,KAAK,YAA2B,CAE9B,OADA,KAAK,QAAQ,IAAI,eAAgB,WAAW,EACrC,IACT,CAEA,UAAU,KAAc,MAAsB,CAC5C,GAAI,MAAM,QAAQ,KAAK,EAAG,CACxB,KAAK,QAAQ,OAAO,IAAI,EACxB,IAAK,IAAM,KAAK,MAAO,KAAK,QAAQ,OAAO,KAAM,OAAO,CAAC,CAAC,CAC5D,MACE,KAAK,QAAQ,IAAI,KAAM,OAAO,KAAK,CAAC,EAEtC,OAAO,IACT,CAEA,QAAgB,CACd,MAAU,MAAM,oEAAoE,CACtF,CAEA,UAAU,WAAoB,QAA4D,CAExF,GADA,KAAK,QAAU,WACX,QACF,IAAK,GAAM,CAAC,KAAM,SAAU,OAAO,QAAQ,OAAO,EAAG,KAAK,UAAU,KAAM,KAAK,EAGjF,OADA,KAAK,YAAY,EACV,IACT,CAEA,cAAqB,CAEnB,OADA,KAAK,YAAY,EACV,IACT,CAEA,MAAM,MAAyB,CAK7B,OAJA,KAAK,YAAY,EAGjB,KAAU,OAAQ,MAAM,QAAQ,KAAK,CAAC,CAAC,CAAC,UAAY,CAAC,CAAC,EAC/C,EACT,CAEA,IAAI,KAAsB,CAOxB,OANI,KAAK,QACH,OAAS,IAAA,IAAW,KAAK,MAAM,IAAI,EACvC,KAAU,OAAO,MAAM,CAAC,CAAC,UAAY,CAAC,CAAC,EACvC,KAAK,OAAS,IAAA,GACP,MAEF,KAAK,OAAO,IAA8C,CACnE,CAEA,KAAK,MAAe,SAA8C,CAGhE,OAFI,QAAU,SAAW,KAAK,QAC5B,KAAK,OAAO,iBAAiB,QAAS,SAAwB,CAAE,KAAM,EAAK,CAAC,EACvE,IACT,CAEA,IAAI,aAAuB,CACzB,OAAO,KAAK,YACd,CAGA,OAAe,KAAyC,CACtD,GAAI,KAAK,QAAS,OAAO,KACzB,KAAK,QAAU,GACf,KAAK,aAAe,GAEpB,IAAM,YAAc,KAAK,UAAY,KAAO,KAAK,UAAY,IAO7D,OANA,KAAK,aACH,IAAI,SAAS,YAAe,MAAQ,KAAQ,KAAM,CAChD,OAAQ,KAAK,QACb,QAAS,KAAK,OAChB,CAAC,CACH,EACO,IACT,CAGA,aAA4B,CAC1B,GAAI,KAAK,QAAU,KAAK,QAAS,OACjC,GAAM,CAAE,SAAU,UAAa,IAAI,gBACnC,KAAK,OAAS,SAAS,UAAU,EACjC,KAAK,QAAU,GACf,KAAK,aAAe,GAEpB,KAAK,QAAQ,iBACX,YACM,CACJ,KAAU,QAAQ,MAAM,CAAC,CAAC,UAAY,CAAC,CAAC,EACxC,KAAK,OAAS,IAAA,EAChB,EACA,CAAE,KAAM,EAAK,CACf,EACA,KAAK,aAAa,IAAI,SAAS,SAAU,CAAE,OAAQ,KAAK,QAAS,QAAS,KAAK,OAAQ,CAAC,CAAC,CAC3F,CACF,EC9MA,MAAM,IAAM,aAAa,aAAa,EAChC,cAAwB,CAAC,EACzB,aAAe,IAAI,IAAI,CAAC,OAAQ,MAAO,QAAS,QAAQ,CAAC,EA2B/D,SAAS,qBAAqB,IAAc,OAAiC,CAC3E,IAAM,OACJ,OAAQ,KAA6B,QAAW,SAC3C,IAA2B,OAC5B,OAAQ,KAAiC,YAAe,SACrD,IAA+B,WAChC,IAER,GAAI,QAAU,IAAK,CACjB,IAAI,MAAM,IAAK,qCAAqC,cAAc,GAAG,GAAG,EACxE,IAAM,MAAS,KAAe,MAC9B,OAAO,OAAO,MAAM,CAAC,CAAC,KAAK,CACzB,MAAO,wBACP,GAAI,aAAa,EACb,CAAC,EACD,CACE,QAAS,cAAc,GAAG,EAC1B,GAAI,OAAO,OAAU,SAAW,CAAE,MAAO,MAAM,MAAM;CAAI,CAAE,EAAI,CAAC,CAClE,CACN,CAAC,EACD,MACF,CAEA,OAAO,OAAO,MAAM,CAAC,CAAC,KAAK,CAAE,MAAQ,KAAe,SAAW,gBAAiB,CAAC,CACnF,CAMA,SAAS,cAAwB,CAC/B,OAAO,OAAO,QAAY,KAAe,QAAQ,KAAK,WAAa,YACrE,CAOA,SAAgB,gBACd,MACA,MACuD,CACvD,IAAM,UAAY,MAAM,KAAK,WAAa,SAAS,MAAM,KAAK,UAAU,EAAI,IAAA,GACtE,OAAS,MAAM,KAAK,QAAU,MAAM,KAAK,OAAO,OAAS,OAAS,MAAM,KAAK,OAAS,KAE5F,OAAO,MAAO,CAAE,QAAS,IAAK,UAAa,CACzC,IAAM,IAAM,IAAI,eAAe,QAAS,GAAG,EAM3C,GALA,IAAI,OAAS,OAKT,OAAQ,CACV,IAAM,KAAO,MAAM,QAAQ,SAAS,CAAC,CAAC,UAAY,IAAA,EAAS,EAC3D,GAAI,KAAM,CACR,IAAM,SAA4B,CAAC,EAC7B,OAAkC,CAAC,EACzC,IAAK,GAAM,CAAC,KAAM,SAAU,KAAK,QAAQ,EACnC,OAAO,OAAU,SACnB,OAAO,MAAQ,MAEf,SAAS,KAAK,CACZ,UAAW,KACX,SAAU,MAAM,MAAQ,GACxB,SAAU,MAAM,MAAQ,2BACxB,OAAQ,IAAI,WAAW,MAAM,MAAM,YAAY,CAAC,CAClD,CAAC,EAGL,GAAM,CAAE,KAAM,OAAU,kBAAkB,SAAU,MAAM,KAAK,MAAO,EACtE,IAAI,KAAO,KACX,IAAI,MAAQ,MACZ,IAAI,KAAO,MACb,CACF,MAAO,GAAI,aAAa,IAAI,QAAQ,MAAM,EAAG,CAC3C,IAAM,YAAc,IAAI,QAAQ,iBAAmB,GACnD,GAAI,YAAY,SAAS,kBAAkB,EACzC,IAAI,KAAO,MAAM,QAAQ,KAAK,CAAC,CAAC,UAAY,IAAA,EAAS,OAChD,GAAI,YAAY,SAAS,mCAAmC,EAAG,CACpE,IAAM,KAAO,MAAM,QAAQ,KAAK,CAAC,CAAC,UAAY,EAAE,EAChD,IAAI,KAAO,OAAO,YAAY,IAAI,gBAAgB,IAAI,CAAC,CACzD,MAAW,YAAY,WAAW,OAAO,IACvC,IAAI,KAAO,MAAM,QAAQ,KAAK,CAAC,CAAC,UAAY,IAAA,EAAS,EAEzD,CAEA,IAAM,MAAQ,mBAAmB,IAAI,QAAQ,eAAe,EAC5D,IAAI,UAAY,MAAM,UAEtB,IAAM,OAAS,IAAI,kBAAkB,QAAQ,MAAM,EACnD,OAAO,UAAU,eAAgB,MAAM,SAAS,EAEhD,IAAM,SAAW,aAAa,IAAI,MAAO,SAAY,CACnD,IAAM,IAAM,IAAI,eACd,IACA,OACA,UACA,MACF,EAEI,WACF,MAAM,IAAI,SAAe,QAAS,SAAW,CAC3C,UAAU,IAAc,IAAA,GAAqB,KAC3C,IAAM,OAAO,GAAG,EAAI,QAAQ,CAC9B,CACF,CAAC,EAGH,IAAK,IAAM,MAAM,MAAM,YAAa,CAClC,IAAI,SAAW,GASf,GARA,MAAM,IAAI,SAAe,QAAS,SAAW,CAM3C,QAAQ,QAAQ,GAAG,IALL,KAAwB,CACpC,SAAW,GACP,IAAK,OAAO,GAAG,EACd,QAAQ,CACf,CAC4B,CAAC,CAAC,CAAC,MAAM,MAAM,CAC7C,CAAC,EACG,CAAC,UAAY,OAAO,QAAS,MACnC,CAGA,GADI,MAAM,mBAAmB,MAAM,MAAM,kBAAkB,GAAG,EAC1D,OAAO,QAAS,OACpB,IAAM,OAAS,MAAM,MAAM,QAAQ,GAAG,EAGjC,OAAO,SAAS,mBAAmB,IAAK,MAAM,CACrD,CAAC,EAED,GAAI,CAGF,GAAI,CACF,MAAM,QAAQ,KAAK,CAAC,SAAU,OAAO,KAAK,CAAC,CAC7C,OAAS,IAAK,CACP,OAAO,UACN,OAAO,SAAS,MAAM,MAAM,QAAQ,IAAK,IAAK,MAAM,EACnD,OAAO,SAAS,qBAAqB,IAAK,MAAM,EAEzD,CAKA,OAJK,OAAO,SAEV,OAAO,OAAO,GAAG,CAAC,CAAC,KAAK,CAAE,MAAO,WAAY,CAAC,EAEzC,MAAM,OAAO,KACtB,QAAU,CAIR,QAAa,QAAQ,QAAQ,CAAC,CAC3B,UAAY,CAAC,CAAC,CAAC,CACf,SAAW,oBAAoB,KAAK,CAAC,CAC1C,CACF,CACF"}

package/dist/helmet-CFQUTVig.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"helmet-CFQUTVig.d.mts","names":[],"sources":["../src/http/middleware/helmet.ts"],"mappings":";;;UAEiB;;EAEf,kCAAkC;;EAElC;;EAEA;;EAEA;IAAiB;IAAiB;IAA6B;;;EAE/D;;EAEA;;EAEA;;EAEA;;;;;;;;;;;;;iBAcc,OAAO,UAAS,iBAAkB,KAYnC,SAAO,KAAO,UAAQ,MAAQ"}

package/dist/kv-stores-DkzZE21Q.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"kv-stores-DkzZE21Q.mjs","names":[],"sources":["../src/http/middleware/rate-limit-guard.ts","../src/http/middleware/kv-stores.ts"],"sourcesContent":["// Ctx-style rate limiter — runs on BOTH pipelines: the node runtimes (via\n// `@Middleware()` / class middleware) and the `@forinda/kickjs/web` fetch\n// entry (via `@Middleware()` or `createWebApp({ middleware })`), unlike the\n// connect-style `rateLimit()` which is node-only. Zero runtime imports —\n// part of the edge purity graph.\nimport type { MiddlewareHandler } from '../../core/decorators'\nimport type { RequestContext } from '../context'\nimport type { RateLimitStore } from './rate-limit'\n\nexport interface RateLimitGuardOptions {\n  /** Maximum number of requests per window (default: 100). */\n  max?: number\n  /** Time window in milliseconds (default: 60_000). */\n  windowMs?: number\n  /** Response message when the limit is exceeded (default: 'Too Many Requests'). */\n  message?: string\n  /** HTTP status code when the limit is exceeded (default: 429). */\n  statusCode?: number\n  /**\n   * Rate-limit key per request. Default: `cf-connecting-ip`, then the first\n   * hop of `x-forwarded-for`, then `x-real-ip`, then `'global'`. Return a\n   * user/tenant id here for authenticated quotas.\n   */\n  keyGenerator?: (ctx: RequestContext) => string\n  /** Send `X-RateLimit-*` / `Retry-After` headers (default: true). */\n  headers?: boolean\n  /**\n   * Counter backend. Defaults to a per-isolate in-memory map — fine for a\n   * single node process, useless on edge where isolates recycle: pass a\n   * `KvRateLimitStore` (or Redis-backed store) there.\n   */\n  store?: RateLimitStore\n  /** Skip limiting for a request (health checks, allowlists). */\n  skip?: (ctx: RequestContext) => boolean\n}\n\n/** Timer-free in-memory store: sweeps expired entries when the map grows. */\nclass LazyMemoryStore implements RateLimitStore {\n  private readonly hits = new Map<string, { hits: number; reset: number }>()\n\n  constructor(private readonly windowMs: number) {}\n\n  async increment(key: string): Promise<{ totalHits: number; resetTime: Date }> {\n    const now = Date.now()\n    const entry = this.hits.get(key)\n    if (entry && entry.reset > now) {\n      entry.hits++\n      return { totalHits: entry.hits, resetTime: new Date(entry.reset) }\n    }\n    // ponytail: sweep-on-growth instead of a cleanup interval — no timer to\n    // dispose, edge-safe. Bound is 10k live keys before a full sweep.\n    if (this.hits.size > 10_000) {\n      for (const [k, e] of this.hits) if (e.reset <= now) this.hits.delete(k)\n    }\n    const fresh = { hits: 1, reset: now + this.windowMs }\n    this.hits.set(key, fresh)\n    return { totalHits: 1, resetTime: new Date(fresh.reset) }\n  }\n\n  async decrement(key: string): Promise<void> {\n    const entry = this.hits.get(key)\n    if (entry && entry.hits > 0) entry.hits--\n  }\n\n  async reset(key: string): Promise<void> {\n    this.hits.delete(key)\n  }\n}\n\nfunction defaultKey(ctx: RequestContext): string {\n  // `ctx.ip` carries the resolution that used to live here: prefer the\n  // runtime-computed address (Express derives it from `trust proxy`), fall\n  // back to forwarded headers only for runtimes that compute none.\n  return ctx.ip ?? 'global'\n}\n\n/**\n * Rate limiting as a `(ctx, next)` middleware.\n *\n * ```ts\n * // Edge (Cloudflare Workers) — app-wide:\n * const app = createWebApp({\n *   h3, modules,\n *   middleware: [rateLimitGuard({ max: 60, windowMs: 60_000, store: new KvRateLimitStore(env.KV, { windowMs: 60_000 }) })],\n * })\n *\n * // Any runtime — per controller/route:\n * @Middleware(rateLimitGuard({ max: 10 }))\n * @Post('/login')\n * ```\n */\nexport function rateLimitGuard(options: RateLimitGuardOptions = {}): MiddlewareHandler {\n  const max = options.max ?? 100\n  const windowMs = options.windowMs ?? 60_000\n  const message = options.message ?? 'Too Many Requests'\n  const statusCode = options.statusCode ?? 429\n  const keyGenerator = options.keyGenerator ?? defaultKey\n  const sendHeaders = options.headers ?? true\n  const store = options.store ?? new LazyMemoryStore(windowMs)\n\n  return async (ctx: RequestContext, next: () => void): Promise<void> => {\n    if (options.skip?.(ctx)) return next()\n\n    const { totalHits, resetTime } = await store.increment(keyGenerator(ctx))\n    const remaining = Math.max(0, max - totalHits)\n\n    if (sendHeaders) {\n      ctx.setHeader('X-RateLimit-Limit', String(max))\n      ctx.setHeader('X-RateLimit-Remaining', String(remaining))\n      ctx.setHeader('X-RateLimit-Reset', String(Math.ceil(resetTime.getTime() / 1000)))\n    }\n\n    if (totalHits > max) {\n      const retryAfter = Math.max(1, Math.ceil((resetTime.getTime() - Date.now()) / 1000))\n      if (sendHeaders) ctx.setHeader('Retry-After', String(retryAfter))\n      ctx.json({ message }, statusCode)\n      return\n    }\n\n    next()\n  }\n}\n","// Edge-safe store adapters over a minimal KV surface. Zero runtime imports —\n// this file must stay importable from the `@forinda/kickjs/web` purity graph.\nimport type { RateLimitStore } from './rate-limit'\nimport type { SessionData, SessionStore } from './session'\n\n/**\n * The minimal async KV surface both stores need. Structurally compatible\n * with a Cloudflare Workers `KVNamespace` binding — pass it straight in:\n *\n * ```ts\n * export default {\n *   fetch(req: Request, env: Env) {\n *     const store = new KvRateLimitStore(env.MY_KV, { windowMs: 60_000 })\n *     // ...\n *   },\n * }\n * ```\n *\n * Anything with the same shape works too (Deno KV wrapper, Upstash Redis\n * REST client adapter, a Map-backed fake in tests).\n */\nexport interface KvLike {\n  get(key: string): Promise<string | null>\n  put(key: string, value: string, options?: { expirationTtl?: number }): Promise<void>\n  delete(key: string): Promise<void>\n}\n\n/** Cloudflare KV rejects TTLs under 60 seconds — clamp up, never down. */\nfunction kvTtlSeconds(ms: number): number {\n  return Math.max(60, Math.ceil(ms / 1000))\n}\n\nexport interface KvRateLimitStoreOptions {\n  /** Window length in ms — must match the `windowMs` given to the limiter. */\n  windowMs: number\n  /** Key prefix in the KV namespace (default `'rl:'`). */\n  prefix?: string\n}\n\n/**\n * {@link RateLimitStore} over a {@link KvLike} namespace, for edge deployments\n * where in-memory counters reset on every isolate.\n *\n * KV is eventually consistent and this is a read-modify-write counter, so\n * limiting is **approximate** under concurrency — bursts racing across\n * isolates can each read the same count. That is the accepted trade-off for\n * abuse throttling; use a Durable Object / Redis store when you need an\n * exact ceiling (billing quotas, strict per-key locks).\n */\nexport class KvRateLimitStore implements RateLimitStore {\n  private readonly prefix: string\n  private readonly windowMs: number\n\n  constructor(\n    private readonly kv: KvLike,\n    options: KvRateLimitStoreOptions,\n  ) {\n    this.windowMs = options.windowMs\n    this.prefix = options.prefix ?? 'rl:'\n  }\n\n  async increment(key: string): Promise<{ totalHits: number; resetTime: Date }> {\n    const now = Date.now()\n    const entry = await this.read(key)\n    if (entry && entry.reset > now) {\n      entry.hits++\n      await this.write(key, entry)\n      return { totalHits: entry.hits, resetTime: new Date(entry.reset) }\n    }\n    const fresh = { hits: 1, reset: now + this.windowMs }\n    await this.write(key, fresh)\n    return { totalHits: 1, resetTime: new Date(fresh.reset) }\n  }\n\n  async decrement(key: string): Promise<void> {\n    const entry = await this.read(key)\n    if (entry && entry.hits > 0) {\n      entry.hits--\n      await this.write(key, entry)\n    }\n  }\n\n  async reset(key: string): Promise<void> {\n    await this.kv.delete(this.prefix + key)\n  }\n\n  private async read(key: string): Promise<{ hits: number; reset: number } | null> {\n    const raw = await this.kv.get(this.prefix + key)\n    if (raw === null) return null\n    try {\n      return JSON.parse(raw) as { hits: number; reset: number }\n    } catch {\n      return null\n    }\n  }\n\n  private async write(key: string, entry: { hits: number; reset: number }): Promise<void> {\n    await this.kv.put(this.prefix + key, JSON.stringify(entry), {\n      expirationTtl: kvTtlSeconds(Math.max(entry.reset - Date.now(), 1000)),\n    })\n  }\n}\n\nexport interface KvSessionStoreOptions {\n  /** Key prefix in the KV namespace (default `'sess:'`). */\n  prefix?: string\n}\n\n/**\n * {@link SessionStore} over a {@link KvLike} namespace. Plug into the node\n * `session()` middleware today (e.g. backed by Upstash/Cloudflare KV via\n * REST) so sessions survive restarts and horizontal scaling; TTL expiry is\n * delegated to the KV layer via `expirationTtl`.\n *\n * Cost note: `touch()` is a get + put round-trip (KvLike has no TTL-only\n * refresh), so `session({ rolling: true })` doubles KV operations per\n * request — per-operation-billed platforms may prefer `rolling: false`.\n */\nexport class KvSessionStore implements SessionStore {\n  private readonly prefix: string\n\n  constructor(\n    private readonly kv: KvLike,\n    options: KvSessionStoreOptions = {},\n  ) {\n    this.prefix = options.prefix ?? 'sess:'\n  }\n\n  async get(sid: string): Promise<SessionData | null> {\n    const raw = await this.kv.get(this.prefix + sid)\n    if (raw === null) return null\n    try {\n      return JSON.parse(raw) as SessionData\n    } catch {\n      return null\n    }\n  }\n\n  async set(sid: string, data: SessionData, maxAge: number): Promise<void> {\n    await this.kv.put(this.prefix + sid, JSON.stringify(data), {\n      expirationTtl: kvTtlSeconds(maxAge),\n    })\n  }\n\n  async destroy(sid: string): Promise<void> {\n    await this.kv.delete(this.prefix + sid)\n  }\n\n  async touch(sid: string, maxAge: number): Promise<void> {\n    const data = await this.get(sid)\n    if (data !== null) await this.set(sid, data, maxAge)\n  }\n}\n"],"mappings":";;;;;;;;;;AAqCA,IAAM,gBAAN,KAAgD,CAGjB,SAF7B,KAAwB,IAAI,IAE5B,YAAY,SAAmC,CAAlB,KAAA,SAAA,QAAmB,CAEhD,MAAM,UAAU,IAA8D,CAC5E,IAAM,IAAM,KAAK,IAAI,EACf,MAAQ,KAAK,KAAK,IAAI,GAAG,EAC/B,GAAI,OAAS,MAAM,MAAQ,IAEzB,MADA,OAAM,OACC,CAAE,UAAW,MAAM,KAAM,UAAW,IAAI,KAAK,MAAM,KAAK,CAAE,EAInE,GAAI,KAAK,KAAK,KAAO,IACd,IAAA,GAAM,CAAC,EAAG,KAAM,KAAK,KAAU,EAAE,OAAS,KAAK,KAAK,KAAK,OAAO,CAAC,EAExE,IAAM,MAAQ,CAAE,KAAM,EAAG,MAAO,IAAM,KAAK,QAAS,EAEpD,OADA,KAAK,KAAK,IAAI,IAAK,KAAK,EACjB,CAAE,UAAW,EAAG,UAAW,IAAI,KAAK,MAAM,KAAK,CAAE,CAC1D,CAEA,MAAM,UAAU,IAA4B,CAC1C,IAAM,MAAQ,KAAK,KAAK,IAAI,GAAG,EAC3B,OAAS,MAAM,KAAO,GAAG,MAAM,MACrC,CAEA,MAAM,MAAM,IAA4B,CACtC,KAAK,KAAK,OAAO,GAAG,CACtB,CACF,EAEA,SAAS,WAAW,IAA6B,CAI/C,OAAO,IAAI,IAAM,QACnB,CAiBA,SAAgB,eAAe,QAAiC,CAAC,EAAsB,CACrF,IAAM,IAAM,QAAQ,KAAO,IACrB,SAAW,QAAQ,UAAY,IAC/B,QAAU,QAAQ,SAAW,oBAC7B,WAAa,QAAQ,YAAc,IACnC,aAAe,QAAQ,cAAgB,WACvC,YAAc,QAAQ,SAAW,GACjC,MAAQ,QAAQ,OAAS,IAAI,gBAAgB,QAAQ,EAE3D,OAAO,MAAO,IAAqB,OAAoC,CACrE,GAAI,QAAQ,OAAO,GAAG,EAAG,OAAO,KAAK,EAErC,GAAM,CAAE,UAAW,WAAc,MAAM,MAAM,UAAU,aAAa,GAAG,CAAC,EAClE,UAAY,KAAK,IAAI,EAAG,IAAM,SAAS,EAQ7C,GANI,cACF,IAAI,UAAU,oBAAqB,OAAO,GAAG,CAAC,EAC9C,IAAI,UAAU,wBAAyB,OAAO,SAAS,CAAC,EACxD,IAAI,UAAU,oBAAqB,OAAO,KAAK,KAAK,UAAU,QAAQ,EAAI,GAAI,CAAC,CAAC,GAG9E,UAAY,IAAK,CACnB,IAAM,WAAa,KAAK,IAAI,EAAG,KAAK,MAAM,UAAU,QAAQ,EAAI,KAAK,IAAI,GAAK,GAAI,CAAC,EAC/E,aAAa,IAAI,UAAU,cAAe,OAAO,UAAU,CAAC,EAChE,IAAI,KAAK,CAAE,OAAQ,EAAG,UAAU,EAChC,MACF,CAEA,KAAK,CACP,CACF,CC7FA,SAAS,aAAa,GAAoB,CACxC,OAAO,KAAK,IAAI,GAAI,KAAK,KAAK,GAAK,GAAI,CAAC,CAC1C,CAmBA,IAAa,iBAAb,KAAwD,CAKnC,GAJnB,OACA,SAEA,YACE,GACA,QACA,CAFiB,KAAA,GAAA,GAGjB,KAAK,SAAW,QAAQ,SACxB,KAAK,OAAS,QAAQ,QAAU,KAClC,CAEA,MAAM,UAAU,IAA8D,CAC5E,IAAM,IAAM,KAAK,IAAI,EACf,MAAQ,MAAM,KAAK,KAAK,GAAG,EACjC,GAAI,OAAS,MAAM,MAAQ,IAGzB,MAFA,OAAM,OACN,MAAM,KAAK,MAAM,IAAK,KAAK,EACpB,CAAE,UAAW,MAAM,KAAM,UAAW,IAAI,KAAK,MAAM,KAAK,CAAE,EAEnE,IAAM,MAAQ,CAAE,KAAM,EAAG,MAAO,IAAM,KAAK,QAAS,EAEpD,OADA,MAAM,KAAK,MAAM,IAAK,KAAK,EACpB,CAAE,UAAW,EAAG,UAAW,IAAI,KAAK,MAAM,KAAK,CAAE,CAC1D,CAEA,MAAM,UAAU,IAA4B,CAC1C,IAAM,MAAQ,MAAM,KAAK,KAAK,GAAG,EAC7B,OAAS,MAAM,KAAO,IACxB,MAAM,OACN,MAAM,KAAK,MAAM,IAAK,KAAK,EAE/B,CAEA,MAAM,MAAM,IAA4B,CACtC,MAAM,KAAK,GAAG,OAAO,KAAK,OAAS,GAAG,CACxC,CAEA,MAAc,KAAK,IAA8D,CAC/E,IAAM,IAAM,MAAM,KAAK,GAAG,IAAI,KAAK,OAAS,GAAG,EAC/C,GAAI,MAAQ,KAAM,OAAO,KACzB,GAAI,CACF,OAAO,KAAK,MAAM,GAAG,CACvB,MAAQ,CACN,OAAO,IACT,CACF,CAEA,MAAc,MAAM,IAAa,MAAuD,CACtF,MAAM,KAAK,GAAG,IAAI,KAAK,OAAS,IAAK,KAAK,UAAU,KAAK,EAAG,CAC1D,cAAe,aAAa,KAAK,IAAI,MAAM,MAAQ,KAAK,IAAI,EAAG,GAAI,CAAC,CACtE,CAAC,CACH,CACF,EAiBa,eAAb,KAAoD,CAI/B,GAHnB,OAEA,YACE,GACA,QAAiC,CAAC,EAClC,CAFiB,KAAA,GAAA,GAGjB,KAAK,OAAS,QAAQ,QAAU,OAClC,CAEA,MAAM,IAAI,IAA0C,CAClD,IAAM,IAAM,MAAM,KAAK,GAAG,IAAI,KAAK,OAAS,GAAG,EAC/C,GAAI,MAAQ,KAAM,OAAO,KACzB,GAAI,CACF,OAAO,KAAK,MAAM,GAAG,CACvB,MAAQ,CACN,OAAO,IACT,CACF,CAEA,MAAM,IAAI,IAAa,KAAmB,OAA+B,CACvE,MAAM,KAAK,GAAG,IAAI,KAAK,OAAS,IAAK,KAAK,UAAU,IAAI,EAAG,CACzD,cAAe,aAAa,MAAM,CACpC,CAAC,CACH,CAEA,MAAM,QAAQ,IAA4B,CACxC,MAAM,KAAK,GAAG,OAAO,KAAK,OAAS,GAAG,CACxC,CAEA,MAAM,MAAM,IAAa,OAA+B,CACtD,IAAM,KAAO,MAAM,KAAK,IAAI,GAAG,EAC3B,OAAS,MAAM,MAAM,KAAK,IAAI,IAAK,KAAM,MAAM,CACrD,CACF"}

package/dist/path-BVA9MfN1.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"path-BVA9MfN1.d.mts","names":[],"sources":["../src/core/path.ts"],"mappings":";;;;;;;;;iBAOgB,cAAc;;;;;;;;;;;;iBAsBd,aAAa"}

package/dist/reply-DYiNuBi5.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"reply-DYiNuBi5.mjs","names":[],"sources":["../src/http/middleware/request-scope.ts","../src/http/reply.ts"],"sourcesContent":["// Web Crypto via globalThis.crypto (randomUUID) — portable across\n// node/bun/deno/workers; node:crypto deliberately NOT imported here so this\n// module stays on the edge-safe request path.\nimport type { Request, Response, NextFunction } from 'express'\nimport { requestStore, type RequestStore } from '../request-store'\nimport { METADATA } from '../../core/interfaces'\nimport { getClassMetaOrUndefined } from '../../core/metadata'\nimport { createLogger } from '../../core/logger'\n\nconst log = createLogger('RequestScope')\n\n// Per-class @PreDestroy method-name cache: the metadata is immutable after\n// class definition, so pay the Reflect read once per class, not once per\n// instance per request. `null` = \"checked, none declared\".\nconst preDestroyCache = new Map<Function, string | symbol | null>()\n\nfunction preDestroyMethod(ctor: Function): string | symbol | null {\n  let method = preDestroyCache.get(ctor)\n  if (method === undefined) {\n    method =\n      getClassMetaOrUndefined<string | symbol>(METADATA.PRE_DESTROY, (ctor as any).prototype) ??\n      null\n    preDestroyCache.set(ctor, method)\n  }\n  return method\n}\n\n/**\n * Run `@PreDestroy` hooks on every REQUEST-scoped instance the request\n * created, then drop them. Called when the response closes (finished or\n * aborted) — the counterpart to `@PostConstruct`, closing the lifecycle gap\n * where per-request services holding transactions/handles/subscriptions were\n * silently dropped with no cleanup callback.\n *\n * Idempotent (guarded by `store.disposed`); hook errors are logged and\n * swallowed so one failing teardown can't break request completion. Async\n * hooks are fired without being awaited — the response is already gone.\n */\nexport function disposeRequestStore(store: RequestStore): void {\n  if (store.disposed) return\n  store.disposed = true\n  if (store.instances.size === 0) return\n  for (const instance of store.instances.values()) {\n    if (instance === null || typeof instance !== 'object') continue\n    const method = preDestroyMethod(instance.constructor)\n    if (!method || typeof instance[method] !== 'function') continue\n    try {\n      const result = instance[method]()\n      if (result && typeof result.then === 'function') {\n        ;(result as Promise<void>).catch((err) =>\n          log.error(err, `@PreDestroy on ${instance.constructor.name} rejected`),\n        )\n      }\n    } catch (err) {\n      log.error(err, `@PreDestroy on ${instance.constructor.name} threw`)\n    }\n  }\n  store.instances.clear()\n}\n\n/**\n * Marker symbol stamped on the function returned by {@link requestScopeMiddleware}.\n *\n * `Application.setup()` uses {@link isRequestScopeMiddleware} to detect whether\n * the user-supplied middleware list already contains the request-scope wrapper,\n * and skips its automatic auto-mount when one is found. Lets adopters control\n * the exact position of the ALS frame in their pipeline (e.g., after a custom\n * tracing wrapper) without ending up with two nested frames.\n */\n// `Symbol.for(...)` returns a plain `symbol` (not `unique symbol`), but the\n// runtime detection marker doesn't need the unique nominal property — it only\n// needs the interned-slot reference equality that `Symbol.for` already provides.\nconst REQUEST_SCOPE_MIDDLEWARE_MARKER = Symbol.for('@kickjs/requestScopeMiddleware')\n\n/**\n * Build a fresh per-request store. Shared by {@link requestScopeMiddleware}\n * (Express) and by runtimes whose handler runs outside the connect-middleware\n * chain (e.g. Fastify), so both establish an identical ALS frame.\n */\nexport function createRequestStore(requestId?: string): RequestStore {\n  return {\n    requestId: requestId || crypto.randomUUID(),\n    instances: new Map(),\n    // Explicit generic locks the \"string keys only\" decision.\n    values: new Map<string, unknown>(),\n  }\n}\n\n/**\n * Wraps each request in an AsyncLocalStorage context.\n * Enables REQUEST-scoped DI and automatic requestId propagation to logs.\n *\n * Should be mounted early in the middleware pipeline (before route handlers).\n * `Application` mounts this automatically unless `contextStore: 'manual'` is set\n * or the user already includes one in their middleware list.\n */\nexport function requestScopeMiddleware() {\n  const mw = (req: Request, res: Response, next: NextFunction) => {\n    const requestIdHeader = req.headers['x-request-id']\n    const requestId =\n      (Array.isArray(requestIdHeader) ? requestIdHeader[0] : requestIdHeader) || crypto.randomUUID()\n    const store = createRequestStore(requestId)\n    // Surface the requestId on req so the standalone requestId() middleware\n    // (when also mounted) reuses this value instead of generating a divergent\n    // second one. Without this, log lines that read from the ALS store would\n    // disagree with the X-Request-Id response header for any request that\n    // didn't carry an inbound x-request-id header.\n    ;(req as Request & { requestId?: string }).requestId = requestId\n    // 'close' fires once the response finished OR the client aborted — run\n    // @PreDestroy teardown for the request's scoped instances either way.\n    res.once('close', () => disposeRequestStore(store))\n    // Pass `next` directly — `run` invokes it with no args, so the arrow\n    // wrapper previously allocated per request added nothing.\n    requestStore.run(store, next)\n  }\n  ;(mw as unknown as Record<symbol, unknown>)[REQUEST_SCOPE_MIDDLEWARE_MARKER] = true\n  return mw\n}\n\n/**\n * Returns `true` when `value` is the function produced by {@link requestScopeMiddleware}.\n *\n * Detection uses a `Symbol.for(...)` marker so the check survives different\n * copies of `@forinda/kickjs` loaded under different module identities (e.g.,\n * a published package alongside a workspace-linked one during local dev).\n */\nexport function isRequestScopeMiddleware(value: unknown): boolean {\n  if (typeof value !== 'function') return false\n  return (value as unknown as Record<symbol, unknown>)[REQUEST_SCOPE_MIDDLEWARE_MARKER] === true\n}\n","// Return-value handler support (response-inference-design.md §3.1).\n//\n// Handlers may RETURN their response payload instead of calling `ctx.json`:\n// the runtime auto-sends it when the pipeline finishes with nothing written.\n// `reply(status, body)` wraps a payload with a non-200 status while staying\n// transparent to type inference (`Reply<201, Task>` carries both statically).\n//\n// Edge-safe: no node imports — shared by all four runtimes including the\n// `@forinda/kickjs/web` entry.\n\nimport type { RequestContext } from './context'\nimport type { RuntimeResponse } from './runtime'\n\n// `Symbol.for` so the brand survives duplicate module copies (workspace-linked\n// + published package in one process — same rationale as the request-scope\n// middleware marker).\nconst REPLY_BRAND = Symbol.for('kickjs.reply')\n\n/**\n * A status-carrying response payload for return-value handlers. Create via\n * {@link reply} — the brand is what runtimes detect, and the generics are\n * what the `kick/routes` response typegen unwraps (`Reply<S, T>` → `T`).\n */\nexport interface Reply<S extends number = number, T = unknown> {\n  readonly [REPLY_BRAND]: true\n  readonly status: S\n  readonly body: T\n}\n\n/**\n * Wrap a return-value handler's payload with an explicit status code:\n *\n * ```ts\n * @Post('/')\n * async create(ctx: RequestContext) {\n *   return reply(201, await this.tasks.create(ctx.body))\n * }\n * ```\n */\nexport function reply<S extends number, T>(status: S, body: T): Reply<S, T> {\n  return { [REPLY_BRAND]: true, status, body }\n}\n\n/** `reply(200, body)` — explicit form of a bare `return body`. */\nreply.ok = <T>(body: T): Reply<200, T> => reply(200, body)\n/** `reply(201, body)` */\nreply.created = <T>(body: T): Reply<201, T> => reply(201, body)\n/** `reply(202, body)` */\nreply.accepted = <T>(body: T): Reply<202, T> => reply(202, body)\n/** Empty 204 — maps to `ctx.noContent()`. */\nreply.noContent = (): Reply<204, undefined> => reply(204, undefined)\n\n/**\n * The statically-inferred response type of a controller handler — what\n * `kick typegen` emits into `KickRoutes[...].response`:\n *\n * - `Awaited<ReturnType>` of the method\n * - `Reply<S, T>` unwraps to `T`\n * - `void`/`undefined` members are dropped (imperative `ctx.json` branches);\n *   a handler that never returns a value stays `unknown`, matching the\n *   pre-inference emission\n *\n * ```ts\n * type R = InferHandlerResponse<UsersController['get']> // → User\n * ```\n */\nexport type InferHandlerResponse<H> = H extends (...args: never[]) => infer R\n  ? [Exclude<Awaited<R>, void | undefined>] extends [never]\n    ? unknown\n    : UnwrapReply<Exclude<Awaited<R>, void | undefined>>\n  : unknown\n\ntype UnwrapReply<A> =\n  A extends Reply<number, infer B>\n    ? B\n    : A extends RuntimeResponse\n      ? // The engine's own response object says nothing about the body, so a\n        // handler ending `return ctx.json(...)` degrades to `unknown` — which is\n        // what the typegen comment always claimed happened. It did not: the bare\n        // `RuntimeResponse` leaked into `KickRoutes[...].response`, offering\n        // `.status()` / `.setHeader()` to a client expecting a payload.\n        // Confidently wrong is worse than unknown.\n        //\n        // To carry a payload, return it (`return user`) or wrap it\n        // (`return reply(201, user)`) — that is what `reply` is for.\n        unknown\n      : A\n\nexport function isReply(value: unknown): value is Reply {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    (value as Record<symbol, unknown>)[REPLY_BRAND] === true\n  )\n}\n\n/**\n * Send a handler's RETURN value when the pipeline finished without anything\n * having written a response. Callers guard on \"driver/response unsettled\" —\n * this only decides how to send:\n *\n * - `undefined` → not handled (returns false; runtime keeps today's behavior)\n * - `Reply` wrapper → status + body (204 → `ctx.noContent()`)\n * - anything else → `ctx.json(value)` (200)\n *\n * Returns true when a response was produced.\n */\nexport function applyHandlerResult(ctx: RequestContext, result: unknown): boolean {\n  if (result === undefined) return false\n  if (isReply(result)) {\n    // Only 204 maps to noContent — an undefined body must NOT coerce the\n    // declared status (reply(304, undefined) keeps its 304; the json body\n    // is simply empty).\n    if (result.status === 204) {\n      ctx.noContent()\n      return true\n    }\n    ctx.json(result.body, result.status)\n    return true\n  }\n  ctx.json(result)\n  return true\n}\n"],"mappings":";;;;;;;;;;gNASA,MAAM,IAAM,aAAa,cAAc,EAKjC,gBAAkB,IAAI,IAE5B,SAAS,iBAAiB,KAAwC,CAChE,IAAI,OAAS,gBAAgB,IAAI,IAAI,EAOrC,OANI,SAAW,IAAA,KACb,OACE,wBAAyC,SAAS,YAAc,KAAa,SAAS,GACtF,KACF,gBAAgB,IAAI,KAAM,MAAM,GAE3B,MACT,CAaA,SAAgB,oBAAoB,MAA2B,CACzD,UAAM,WACV,MAAM,SAAW,GACb,MAAM,UAAU,OAAS,GAC7B,KAAK,IAAM,YAAY,MAAM,UAAU,OAAO,EAAG,CAC/C,GAAyB,OAAO,UAAa,WAAzC,SAAmD,SACvD,IAAM,OAAS,iBAAiB,SAAS,WAAW,EAChD,MAAC,QAAU,OAAO,SAAS,SAAY,YAC3C,GAAI,CACF,IAAM,OAAS,SAAS,OAAO,CAAC,EAC5B,QAAU,OAAO,OAAO,MAAS,YAClC,OAA0B,MAAO,KAChC,IAAI,MAAM,IAAK,kBAAkB,SAAS,YAAY,KAAK,UAAU,CACvE,CAEJ,OAAS,IAAK,CACZ,IAAI,MAAM,IAAK,kBAAkB,SAAS,YAAY,KAAK,OAAO,CACpE,CACF,CACA,MAAM,UAAU,MAAM,CADtB,CAEF,CAcA,MAAM,gCAAkC,OAAO,IAAI,gCAAgC,EAOnF,SAAgB,mBAAmB,UAAkC,CACnE,MAAO,CACL,UAAW,WAAa,OAAO,WAAW,EAC1C,UAAW,IAAI,IAEf,OAAQ,IAAI,GACd,CACF,CAUA,SAAgB,wBAAyB,CACvC,IAAM,IAAM,IAAc,IAAe,OAAuB,CAC9D,IAAM,gBAAkB,IAAI,QAAQ,gBAC9B,WACH,MAAM,QAAQ,eAAe,EAAI,gBAAgB,GAAK,kBAAoB,OAAO,WAAW,EACzF,MAAQ,mBAAmB,SAAS,EAMzC,IAA0C,UAAY,UAGvD,IAAI,KAAK,YAAe,oBAAoB,KAAK,CAAC,EAGlD,aAAa,IAAI,MAAO,IAAI,CAC9B,EAEA,MADC,IAA2C,iCAAmC,GACxE,EACT,CASA,SAAgB,yBAAyB,MAAyB,CAEhE,OADI,OAAO,OAAU,YACb,MAA6C,mCAAqC,EAC5F,CCjHA,MAAM,YAAc,OAAO,IAAI,cAAc,EAuB7C,SAAgB,MAA2B,OAAW,KAAsB,CAC1E,MAAO,EAAG,aAAc,GAAM,OAAQ,IAAK,CAC7C,CAGA,MAAM,GAAS,MAA2B,MAAM,IAAK,IAAI,EAEzD,MAAM,QAAc,MAA2B,MAAM,IAAK,IAAI,EAE9D,MAAM,SAAe,MAA2B,MAAM,IAAK,IAAI,EAE/D,MAAM,cAAyC,MAAM,IAAK,IAAA,EAAS,EAsCnE,SAAgB,QAAQ,MAAgC,CACtD,OACE,OAAO,OAAU,YACjB,OACC,MAAkC,eAAiB,EAExD,CAaA,SAAgB,mBAAmB,IAAqB,OAA0B,CAchF,OAbI,SAAW,IAAA,GAAkB,GAC7B,QAAQ,MAAM,EAIZ,OAAO,SAAW,KACpB,IAAI,UAAU,EACP,KAET,IAAI,KAAK,OAAO,KAAM,OAAO,MAAM,EAC5B,KAET,IAAI,KAAK,MAAM,EACR,GACT"}

package/dist/request-logger-D_pf4xzE.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"request-logger-D_pf4xzE.d.mts","names":[],"sources":["../src/http/middleware/request-logger.ts"],"mappings":";;;;;;;;UAMU;EACR;EACA;;EAEA;;EAEA;EACA,SAAS;;UAGD;EACR;EACA,GAAG,iBAAiB;;UAWL;;EAEf;;EAEA;;EAEA;;;;;;;;;;;;;;;;;;iBAmBc,cAAc,UAAS,wBAAyB,KAKjD,eAAa,KAAO,gBAAc"}

package/dist/spa-BWzyTGRq.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"spa-BWzyTGRq.d.mts","names":[],"sources":["../src/core/disposables.ts","../src/core/kick-error.ts","../src/core/circuit-breaker.ts","../src/core/context-errors.ts","../src/core/mount-sort.ts","../src/core/asset-keys.ts","../src/http/cluster.ts","../src/http/define-http-context-decorator.ts","../src/http/runtimes/express.ts","../src/http/request-store.ts","../src/http/middleware/request-scope.ts","../src/http/middleware/trace-context.ts","../src/http/middleware/views.ts","../src/http/middleware/spa.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAaY,0BAA0B;;iBAKtB,mBAAmB,IAAI;;iBA6BjB,cAAc;;;;;;;;;;;;;;;;;;;;UC9BnB;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA,UAAU;;cAGC,kBAAkB;WACb;WACA;WACA;WACA;WACA;WACA,UAAU;EAE1B,YAAY,MAAM;;UAiDH;;;;;;EAMf;;;;;;;iBAQc,gBACd,KAAK,gBAAgB,WACrB,UAAS;;;;;;;;;;;;;;;;;;;;KCvFC;UAEK;;EAEf;;EAEA;;EAEA;;UAGe;EACf;EACA;EACA,OAAO;EACP,cAAc;;;;;cAMH,yBAAyB;WACR;EAA5B,YAA4B;;cAMjB;WAaO;UAZV;UACA;UACA;UACA;UACA;UACA;mBAES;mBACA;mBACA;EAEjB,YACkB,cAChB,SAAS;;;;;EAWL,QAAQ,GAAG,UAAU,QAAQ,KAAK,QAAQ;;EA0BhD,YAAY;;EAMZ,YAAY;;EAWZ;UASQ;UAWA;UAeA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cC1HG,gCAAgC;WAClC;WACA;WACA;WACA;EAET,YAAY,aAAa,mBAAmB,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA0CjD,iCAAiC;WACnC;WACA;EAET,YAAY,aAAa;;;;;;;;;;;;cA6Cd,8BAA8B;WAChC;WACA;EAET,YAAY,0BAA0B;;;;;;;;;;;;;;;;;;;cA0B3B,kCAAkC;WACpC;WACA;EAET,YAAY,aAAa;;;;;;;;;;;;;;;;;;;;;UC5IV;;EAEf;;;;;;EAMA;;;KAIU;;;;;cAMC,gCAAgC;WAClC,MAAM;WACN;EAET,YAAY,MAAM,WAAW;;;;;;;;cAclB,6BAA6B;WAC/B,MAAM;WACN;WACA;EAET,YAAY,MAAM,WAAW,iBAAiB;;;;;;;cAiBnC,wBAAwB;WAC1B,MAAM;WACN;EAET,YAAY,MAAM,WAAW;;;;;;;;;;;;;;;;iBAsBf,UAAU,UAAU,eAAe,gBAAgB,KAAK,MAAM,YAAY;;;KC/E9E;UAEK;;EAEf;;EAEA;;UAGe;;;;;;;;EAQf,WAAW;;UAGI;EACf,OAAO;;;;;;;;EAQP;;;;;;;;;;;;iBAac,eACd,mBACA,0BACA,OAAM,wBACL;;iBA2Da,SAAS;;;UCzHR;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;;iBAIc;;;;;;;;UCwDC,qCAAqC,UAAU;GAC7D,UAAU,gBAAgB,UAAU,eAAe,YAAY,uBAC9D,MAAM,qBAAqB,GAAG,GAAG,GAAG,kBACnC,iBAAiB,GAAG,GAAG,GAAG;;;;;;;UAQd;GAEb,UAAU,gBACV,UAAU,eAAe,YAAY,uBACrC,UAAU,0BAA0B,uBAEpC,MAAM,qBAAqB,GAAG,GAAG,GAAG,kBACnC,iBAAiB,GAAG,GAAG,GAAG;;;;;;;;;;;;;;;;EAiB7B,WAAW,UAAU,4BAA4B,qCAAqC;;cAW3E,4BAA4B;;;;;;;;;;;iBCpFzB,kBAAkB,SAAS,eAAe;;;;;;;;;iBAiE1C,YAAY,sBAAsB,UAAS,qBAA0B;;;;;iBAQrE,kBAAkB,YAAY;;;;UC5G7B;;EAEf;;;;;;EAMA,WAAW;;;;;;;;;;;;;;;;;;;;;EAqBX,QAAQ;;EAER;;;cAIW,cAAY,kBAAA;;;;;iBAMT,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoCnB,gBAAgB,UAAU,gBAAgB,KAAK,IAAI,UAAU;;;;;;;;;;;iBCe7D,2BAAsB,KACnB,SAAO,KAAO,UAAQ,MAAQ;;;;;;;cCxFpC;UAKI;;;;;EAKf;;;;;UAMe;;EAEf;;EAEA;;EAEA;;EAEA;;;;;;iBAqBc,iBAAiB,iBAAiB;;;;;;;;;;;;;;;;;;;;;;iBA0ClC,aAAa,UAAS,uBAAwB,KAC/C,SAAO,KAAO,UAAQ,MAAQ;;;UC5F5B;;;;;;;;;;;;;;;EAef;;EAGA;;EAGA;;EAGA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAgCW,aAAW,eAAA;;;UCtDP;;;;;;;;;;;;;;EAcf;;;;;;;;;;;;;;;EAgBA;;;;;;;;;;EAWA;;;;;EAMA;;;;;EAMA;;;;;;;;;;;;;;EAeA;;;;;;;;;;;;;;;;;;;;;iBAoCc,iBACd,mBAKA,cACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAoJW,YAAU,eAAA"}