@fuzdev/fuz_app 0.148.0 → 0.150.0

package/dist/schema_meta.d.ts

@@ -11,7 +11,11 @@ import type { Sensitivity } from './sensitivity.js';
 /** Zod `.meta()` shape for fuz_app schema metadata conventions. */
 export interface SchemaFieldMeta {
     description?: string;
-    /** Sensitivity level for masking/redaction. `'secret'` masks the value. */
+    /**
+     * Sensitivity level for masking/redaction. `'secret'` masks the value.
+     * Read through every wrapping layer (`schema_sensitivity`), so
+     * `.meta({sensitivity: 'secret'}).optional()` masks too.
+     */
     sensitivity?: Sensitivity;
     /**
      * Set on an action's **input** schema that accepts `{}` by design while
@@ -25,6 +29,29 @@ export interface SchemaFieldMeta {
      * schema itself, so a wrapper (`.optional()`, `.extend()`) drops it.
      */
     empty_input_handler_guarded?: boolean;
+    /**
+     * The `error.data.reason` an action input refuses this field with. On a
+     * field of an action's **input** schema, every `invalid_params` whose first
+     * Zod issue lands on the field — missing, wrong type, `null`, out of range,
+     * malformed, or a fault anywhere inside it — carries this reason, where an
+     * undeclared field's refusal carries none. The message stays the generic
+     * `invalid params`. A body with faults on several fields answers the first
+     * issue's reason in Zod's order, which a twin checking in another order
+     * need not match, so the reason is defined for a single-fault body only —
+     * except that an issue on the input itself (an unknown key) anywhere among
+     * the issues means no reason, as the Rust twin refuses unknown keys first.
+     * Declared reasons are named `<field>_invalid`.
+     *
+     * The declaration is the one source of the reason: the dispatcher reads it
+     * (`perform_action`), the adversarial suites expect it, and the Rust twin
+     * owes the same reason on every refusal of the field. Read through the
+     * field's optional, nullable, default, prefault, transform and pipe layers
+     * (not `.readonly()`, `.catch()` or `z.lazy()`), so it may sit on any of
+     * them; a declaration on a nested field overrides its parent's for a fault
+     * inside it, and an object-level refine whose issue names the field takes
+     * its reason too. See `resolve_issues_invalid_reason`.
+     */
+    invalid_reason?: string;
 }
 /**
  * Whether `schema` carries `empty_input_handler_guarded: true` in its `.meta()`.
@@ -33,4 +60,68 @@ export interface SchemaFieldMeta {
  * @returns whether its handler refuses the `{}` the schema admits
  */
 export declare const is_empty_input_handler_guarded: (schema: z.ZodType) => boolean;
+/**
+ * A `SchemaFieldMeta` key's value as a schema declares it, read through its
+ * optional, nullable, default, prefault, transform and pipe layers — Zod
+ * keeps `.meta()` on the instance it was set on, so a wrapper added after it
+ * carries none — the outermost declaration winning.
+ *
+ * @param schema - a field schema, possibly wrapped
+ * @param key - the metadata key to read
+ * @returns the declared value, or `undefined` when no layer declares one
+ */
+export declare const schema_meta_value: <TKey extends keyof SchemaFieldMeta>(schema: z.ZodType, key: TKey) => SchemaFieldMeta[TKey] | undefined;
+/**
+ * The `invalid_reason` a schema declares, read through its wrappers, the
+ * outermost declaration winning.
+ *
+ * @param schema - a field schema, possibly wrapped
+ * @returns the declared reason, or `undefined` when no layer declares one
+ */
+export declare const schema_invalid_reason: (schema: z.ZodType) => string | undefined;
+/**
+ * The `sensitivity` a schema declares anywhere among its wrapping layers, so
+ * a secret stays masked however the field is wrapped. Fail-safe where
+ * `schema_meta_value` reads one chain: the walk follows the `innerType` of
+ * every wrapper that has one (optional, nullable, default, prefault,
+ * nonoptional, catch, readonly), both sides of a pipe (so `.transform()`,
+ * `z.preprocess()` and `.pipe(secret)` all reach the secret), and a
+ * `z.lazy()` getter, and every member of a union or intersection (the
+ * value is one of them), visiting each schema once, and answers `'secret'`
+ * when any layer reached declares it. It stops at structural schemas — an
+ * object's fields and an array's element carry their own.
+ *
+ * @param schema - a field schema, possibly wrapped
+ * @returns `'secret'` when any reachable layer declares it, else `undefined`
+ */
+export declare const schema_sensitivity: (schema: z.ZodType) => Sensitivity | undefined;
+/**
+ * The `error.data.reason` an input validation failure at `path` carries: the
+ * `invalid_reason` of the deepest field along `path` that declares one.
+ *
+ * Walks object fields only, each through its wrappers: a segment that is not
+ * a key of an object schema (an array index, a union member's key, an unknown
+ * key) ends the walk, so a fault inside a declared field still resolves to
+ * that field's reason. An empty path — a whole-input fault such as an
+ * unrecognized key on the input object — resolves to none, as does a schema
+ * that is not an object.
+ *
+ * @param input_schema - an action's input schema
+ * @param path - the failing issue's path (`ZodError.issues[0].path`)
+ * @returns the declared reason, or `undefined`
+ */
+export declare const resolve_invalid_reason: (input_schema: z.ZodType, path: ReadonlyArray<PropertyKey>) => string | undefined;
+/**
+ * The `error.data.reason` a failed input parse answers: the declared reason
+ * of the first issue's field (`resolve_invalid_reason`), or none when any
+ * issue sits on the input itself. Such an issue is an unknown key on the
+ * input object (or a non-object input), which the Rust twin refuses before
+ * reading any field, so a stale client sending an extra key gets the same
+ * answer from both spines whatever else its body gets wrong.
+ *
+ * @param input_schema - an action's input schema
+ * @param issues - the failed parse's issues, in Zod's order
+ * @returns the declared reason, or `undefined`
+ */
+export declare const resolve_issues_invalid_reason: (input_schema: z.ZodType, issues: ReadonlyArray<z.core.$ZodIssue>) => string | undefined;
 //# sourceMappingURL=schema_meta.d.ts.map

package/dist/schema_meta.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema_meta.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/schema_meta.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;;;;;OAUG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAC;CACtC;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAAI,QAAQ,CAAC,CAAC,OAAO,KAAG,OACkB,CAAC"}
+{"version":3,"file":"schema_meta.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/schema_meta.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGpD,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;;;;;OAUG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAAI,QAAQ,CAAC,CAAC,OAAO,KAAG,OACkB,CAAC;AAEtF;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAAI,IAAI,SAAS,MAAM,eAAe,EACnE,QAAQ,CAAC,CAAC,OAAO,EACjB,KAAK,IAAI,KACP,eAAe,CAAC,IAAI,CAAC,GAAG,SAM1B,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,GAAI,QAAQ,CAAC,CAAC,OAAO,KAAG,MAAM,GAAG,SACvB,CAAC;AAE7C;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,kBAAkB,GAAI,QAAQ,CAAC,CAAC,OAAO,KAAG,WAAW,GAAG,SAuBpE,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,GAClC,cAAc,CAAC,CAAC,OAAO,EACvB,MAAM,aAAa,CAAC,WAAW,CAAC,KAC9B,MAAM,GAAG,SAYX,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,GACzC,cAAc,CAAC,CAAC,OAAO,EACvB,QAAQ,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KACrC,MAAM,GAAG,SAIX,CAAC"}

package/dist/schema_meta.js

@@ -6,6 +6,7 @@
  *
  * @module
  */
+import { zod_get_schema_layers, zod_unwrap_to_object } from './zod.js';
 /**
  * Whether `schema` carries `empty_input_handler_guarded: true` in its `.meta()`.
  *
@@ -13,3 +14,119 @@
  * @returns whether its handler refuses the `{}` the schema admits
  */
 export const is_empty_input_handler_guarded = (schema) => schema.meta()?.empty_input_handler_guarded === true;
+/**
+ * A `SchemaFieldMeta` key's value as a schema declares it, read through its
+ * optional, nullable, default, prefault, transform and pipe layers — Zod
+ * keeps `.meta()` on the instance it was set on, so a wrapper added after it
+ * carries none — the outermost declaration winning.
+ *
+ * @param schema - a field schema, possibly wrapped
+ * @param key - the metadata key to read
+ * @returns the declared value, or `undefined` when no layer declares one
+ */
+export const schema_meta_value = (schema, key) => {
+    for (const layer of zod_get_schema_layers(schema)) {
+        const value = layer.meta()?.[key];
+        if (value !== undefined)
+            return value;
+    }
+    return undefined;
+};
+/**
+ * The `invalid_reason` a schema declares, read through its wrappers, the
+ * outermost declaration winning.
+ *
+ * @param schema - a field schema, possibly wrapped
+ * @returns the declared reason, or `undefined` when no layer declares one
+ */
+export const schema_invalid_reason = (schema) => schema_meta_value(schema, 'invalid_reason');
+/**
+ * The `sensitivity` a schema declares anywhere among its wrapping layers, so
+ * a secret stays masked however the field is wrapped. Fail-safe where
+ * `schema_meta_value` reads one chain: the walk follows the `innerType` of
+ * every wrapper that has one (optional, nullable, default, prefault,
+ * nonoptional, catch, readonly), both sides of a pipe (so `.transform()`,
+ * `z.preprocess()` and `.pipe(secret)` all reach the secret), and a
+ * `z.lazy()` getter, and every member of a union or intersection (the
+ * value is one of them), visiting each schema once, and answers `'secret'`
+ * when any layer reached declares it. It stops at structural schemas — an
+ * object's fields and an array's element carry their own.
+ *
+ * @param schema - a field schema, possibly wrapped
+ * @returns `'secret'` when any reachable layer declares it, else `undefined`
+ */
+export const schema_sensitivity = (schema) => {
+    const seen = new Set();
+    const pending = [schema];
+    while (pending.length > 0) {
+        const layer = pending.pop();
+        if (seen.has(layer))
+            continue;
+        seen.add(layer);
+        if (layer.meta()?.sensitivity === 'secret')
+            return 'secret';
+        const def = layer.def;
+        if (def.type === 'lazy') {
+            pending.push(layer._zod.innerType);
+            continue;
+        }
+        if (def.type === 'union' && Array.isArray(def.options)) {
+            pending.push(...def.options);
+            continue;
+        }
+        for (const key of ['innerType', 'in', 'out', 'left', 'right']) {
+            const sub = def[key];
+            if (sub && typeof sub === 'object' && 'def' in sub)
+                pending.push(sub);
+        }
+    }
+    return undefined;
+};
+/**
+ * The `error.data.reason` an input validation failure at `path` carries: the
+ * `invalid_reason` of the deepest field along `path` that declares one.
+ *
+ * Walks object fields only, each through its wrappers: a segment that is not
+ * a key of an object schema (an array index, a union member's key, an unknown
+ * key) ends the walk, so a fault inside a declared field still resolves to
+ * that field's reason. An empty path — a whole-input fault such as an
+ * unrecognized key on the input object — resolves to none, as does a schema
+ * that is not an object.
+ *
+ * @param input_schema - an action's input schema
+ * @param path - the failing issue's path (`ZodError.issues[0].path`)
+ * @returns the declared reason, or `undefined`
+ */
+export const resolve_invalid_reason = (input_schema, path) => {
+    let reason;
+    let schema = input_schema;
+    for (const segment of path) {
+        if (typeof segment !== 'string')
+            break;
+        const shape = zod_unwrap_to_object(schema)?.shape;
+        if (!shape || !Object.hasOwn(shape, segment))
+            break;
+        const field = shape[segment];
+        reason = schema_invalid_reason(field) ?? reason;
+        schema = field;
+    }
+    return reason;
+};
+/**
+ * The `error.data.reason` a failed input parse answers: the declared reason
+ * of the first issue's field (`resolve_invalid_reason`), or none when any
+ * issue sits on the input itself. Such an issue is an unknown key on the
+ * input object (or a non-object input), which the Rust twin refuses before
+ * reading any field, so a stale client sending an extra key gets the same
+ * answer from both spines whatever else its body gets wrong.
+ *
+ * @param input_schema - an action's input schema
+ * @param issues - the failed parse's issues, in Zod's order
+ * @returns the declared reason, or `undefined`
+ */
+export const resolve_issues_invalid_reason = (input_schema, issues) => {
+    const first = issues[0];
+    if (!first || issues.some((issue) => issue.path.length === 0))
+        return undefined;
+    return resolve_invalid_reason(input_schema, first.path);
+};

package/dist/server/app_server.d.ts

@@ -88,7 +88,10 @@ export interface AppServerOptions {
     backend: AppBackend;
     /** Session options for cookie-based auth. */
     session_options: SessionOptions<string>;
-    /** Parsed allowed origin patterns. */
+    /**
+     * Parsed allowed origin patterns. Must not be empty — an empty list would
+     * refuse every browser request, so assembly throws.
+     */
     allowed_origins: Array<RegExp>;
     /**
      * Paths the origin check skips, each with its reason. The check covers
@@ -188,9 +191,11 @@ export interface AppServerOptions {
      */
     action_account_rate_limiter?: RateLimiter | null;
     /**
-     * Maximum allowed request body size in bytes.
-     * Omit or `undefined` to use the default (1 MiB).
-     * Pass `null` to explicitly disable body size limiting.
+     * Maximum allowed request body size in bytes, a safe integer `0` or more
+     * (anything else throws at assembly). Omit or `undefined` to use the
+     * default (1 MiB). Pass `null` to explicitly disable body size limiting,
+     * which adds a security warning to the surface's diagnostics (logged at
+     * startup).
      */
     max_body_size?: number | null;
     /** Daemon token state for keeper auth. Omit to disable. */
@@ -583,13 +588,16 @@ export interface ConfigDiagnosticsInput {
     rate_limiter_mode: RateLimiterMode;
     /** The resolved limiters, from `resolve_rate_limiters`. */
     rate_limiters: Record<AppServerRateLimiterKey, RateLimiter | null>;
+    /** `AppServerOptions.max_body_size` as passed; `null` disables the body size limit. */
+    max_body_size: number | null | undefined;
 }
 /**
  * The config-level diagnostics `create_app_server` appends to the surface's
  * spec-level ones: a weakened session cookie, and an open rate-limited
  * surface — one warning for `'disabled_for_testing'`, otherwise one per
  * explicitly-null limiter, so a deployment that disables login's limiter but
- * keeps signup's reads differently from one that disables both.
+ * keeps signup's reads differently from one that disables both — and a
+ * disabled request body size limit (`max_body_size: null`).
  *
  * @internal
  */

package/dist/server/app_server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app_server.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/app_server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,KAAK,OAAO,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAIN,KAAK,WAAW,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACN,WAAW,EAMX,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGhE,OAAO,oBAAoB,CAAC;AAE5B,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEhF,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACrF,OAAO,EAGN,KAAK,eAAe,EACpB,MAAM,6BAA6B,CAAC;AAcrC,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,gCAAgC,CAAC;AAExC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAAsB,KAAK,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAEzF;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAClC,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,sBAAsB,GACjC,wBAAwB,GAAG,2BAA2B,GAAG,oBAAoB,CAAC;AAE/E,MAAM,WAAW,wBAAwB;IACxC,IAAI,EAAE,UAAU,CAAC;CACjB;AAED,MAAM,WAAW,2BAA2B;IAC3C,IAAI,EAAE,cAAc,CAAC;IACrB,6FAA6F;IAC7F,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,2FAA2F;IAC3F,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,uBAAuB,EAAE,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9E;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAChC,2DAA2D;IAC3D,OAAO,EAAE,UAAU,CAAC;IACpB,6CAA6C;IAC7C,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,sCAAsC;IACtC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAE9C,6BAA6B;IAC7B,KAAK,EAAE;QACN,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,iBAAiB,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAC;KACtD,CAAC;IAEF;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,eAAe,CAAC;IAChC;;;;;;;;;;;;;OAaG;IACH,qBAAqB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C;;;;;;;OAOG;IACH,sBAAsB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5C;;;;;;;OAOG;IACH,yBAAyB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAChD;;;;;OAKG;IACH,2BAA2B,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjD;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5C;;;;;;;;;;OAUG;IACH,2BAA2B,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjD;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,2DAA2D;IAC3D,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;IAEtC,yEAAyE;IACzE,SAAS,CAAC,EAAE,sBAAsB,CAAC;IAEnC;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB;;;OAGG;IACH,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAEpE;;;;;;;;;;;;;;;;OAgBG;IACH,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,cAAc,CAAC,CAAC;IAE/E;;;;;;;;;;;;;;;OAeG;IACH,aAAa,CAAC,EAAE,IAAI,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAEzC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,YAAY,CAAC,EAAE,OAAO,GAAG,0BAA0B,CAAC;IAEpD,gFAAgF;IAChF,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAE/B;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAEjG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,wBAAwB,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,KAAK,gBAAgB,CAAC;IAE3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;IACH,YAAY,CAAC,EACZ,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,gBAAgB,KAAK,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAEhG;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IAEzB,mFAAmF;IACnF,qBAAqB,CAAC,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IAE9C,6DAA6D;IAC7D,cAAc,CAAC,EAAE;QAChB,YAAY,EAAE,kBAAkB,CAAC;QACjC,4DAA4D;QAC5D,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,gEAAgE;QAChE,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;WAIG;QACH,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;KACzC,CAAC;IAEF;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAEhC;;;;OAIG;IACH,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,kBAAkB,KAAK,IAAI,CAAC;IAExE,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,uCAAuC;AACvC,MAAM,WAAW,SAAS;IACzB,GAAG,EAAE,IAAI,CAAC;IACV,wEAAwE;IACxE,YAAY,EAAE,cAAc,CAAC;IAC7B,gBAAgB,EAAE,eAAe,CAAC;IAClC,oGAAoG;IACpG,iBAAiB,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAClD;;;;OAIG;IACH,SAAS,EAAE,WAAW,GAAG,IAAI,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAClE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,iBAAiB,GAAI,QAAQ;IAAE,SAAS,EAAE,WAAW,GAAG,IAAI,CAAA;CAAE,KAAG,WAO7E,CAAC;AAEF,gDAAgD;AAChD,eAAO,MAAM,qBAAqB,QAAc,CAAC;AAEjD;;;;;GAKG;AACH,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiB4D,CAAC;AAErF;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,MAAM,OAAO,kBAAkB,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,EAEpC,aAAa,CAAC,uBAAuB,CAAC,CAAC;AAE5C;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACpC,2DAA2D;IAC3D,IAAI,EAAE,eAAe,CAAC;IACtB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC,uBAAuB,EAAE,WAAW,GAAG,IAAI,CAAC,CAAC;IAC9D;;;OAGG;IACH,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;CAC1B;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,IAAI,CAAC,gBAAgB,EAAE,uBAAuB,GAAG,eAAe,CAAC,KACxE,oBAkBF,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACtC,6EAA6E;IAC7E,cAAc,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,SAAS,CAAC;IAC1D,2CAA2C;IAC3C,iBAAiB,EAAE,eAAe,CAAC;IACnC,2DAA2D;IAC3D,aAAa,EAAE,MAAM,CAAC,uBAAuB,EAAE,WAAW,GAAG,IAAI,CAAC,CAAC;CACnE;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,GACtC,OAAO,sBAAsB,KAC3B,KAAK,CAAC,oBAAoB,CAiD5B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,eAAO,MAAM,iBAAiB,GAAU,SAAS,gBAAgB,KAAG,OAAO,CAAC,SAAS,CAQpF,CAAC"}
+{"version":3,"file":"app_server.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/app_server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,KAAK,OAAO,EAA0B,MAAM,MAAM,CAAC;AAElE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAIN,KAAK,WAAW,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACN,WAAW,EAMX,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGhE,OAAO,oBAAoB,CAAC;AAE5B,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEhF,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACrF,OAAO,EAGN,KAAK,eAAe,EACpB,MAAM,6BAA6B,CAAC;AAcrC,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,gCAAgC,CAAC;AAExC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAAsB,KAAK,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAEzF;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAClC,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,sBAAsB,GACjC,wBAAwB,GAAG,2BAA2B,GAAG,oBAAoB,CAAC;AAE/E,MAAM,WAAW,wBAAwB;IACxC,IAAI,EAAE,UAAU,CAAC;CACjB;AAED,MAAM,WAAW,2BAA2B;IAC3C,IAAI,EAAE,cAAc,CAAC;IACrB,6FAA6F;IAC7F,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,2FAA2F;IAC3F,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,uBAAuB,EAAE,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9E;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAChC,2DAA2D;IAC3D,OAAO,EAAE,UAAU,CAAC;IACpB,6CAA6C;IAC7C,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;OAGG;IACH,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAE9C,6BAA6B;IAC7B,KAAK,EAAE;QACN,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,iBAAiB,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAC;KACtD,CAAC;IAEF;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,eAAe,CAAC;IAChC;;;;;;;;;;;;;OAaG;IACH,qBAAqB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C;;;;;;;OAOG;IACH,sBAAsB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5C;;;;;;;OAOG;IACH,yBAAyB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAChD;;;;;OAKG;IACH,2BAA2B,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjD;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5C;;;;;;;;;;OAUG;IACH,2BAA2B,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjD;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,2DAA2D;IAC3D,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;IAEtC,yEAAyE;IACzE,SAAS,CAAC,EAAE,sBAAsB,CAAC;IAEnC;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB;;;OAGG;IACH,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAEpE;;;;;;;;;;;;;;;;OAgBG;IACH,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,cAAc,CAAC,CAAC;IAE/E;;;;;;;;;;;;;;;OAeG;IACH,aAAa,CAAC,EAAE,IAAI,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAEzC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,YAAY,CAAC,EAAE,OAAO,GAAG,0BAA0B,CAAC;IAEpD,gFAAgF;IAChF,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAE/B;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAEjG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,wBAAwB,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,KAAK,gBAAgB,CAAC;IAE3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;IACH,YAAY,CAAC,EACZ,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,gBAAgB,KAAK,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAEhG;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IAEzB,mFAAmF;IACnF,qBAAqB,CAAC,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IAE9C,6DAA6D;IAC7D,cAAc,CAAC,EAAE;QAChB,YAAY,EAAE,kBAAkB,CAAC;QACjC,4DAA4D;QAC5D,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,gEAAgE;QAChE,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;WAIG;QACH,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;KACzC,CAAC;IAEF;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAEhC;;;;OAIG;IACH,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,kBAAkB,KAAK,IAAI,CAAC;IAExE,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,uCAAuC;AACvC,MAAM,WAAW,SAAS;IACzB,GAAG,EAAE,IAAI,CAAC;IACV,wEAAwE;IACxE,YAAY,EAAE,cAAc,CAAC;IAC7B,gBAAgB,EAAE,eAAe,CAAC;IAClC,oGAAoG;IACpG,iBAAiB,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAClD;;;;OAIG;IACH,SAAS,EAAE,WAAW,GAAG,IAAI,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAClE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,iBAAiB,GAAI,QAAQ;IAAE,SAAS,EAAE,WAAW,GAAG,IAAI,CAAA;CAAE,KAAG,WAO7E,CAAC;AAEF,gDAAgD;AAChD,eAAO,MAAM,qBAAqB,QAAc,CAAC;AAEjD;;;;;GAKG;AACH,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiB4D,CAAC;AAErF;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,MAAM,OAAO,kBAAkB,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,EAEpC,aAAa,CAAC,uBAAuB,CAAC,CAAC;AAE5C;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACpC,2DAA2D;IAC3D,IAAI,EAAE,eAAe,CAAC;IACtB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC,uBAAuB,EAAE,WAAW,GAAG,IAAI,CAAC,CAAC;IAC9D;;;OAGG;IACH,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;CAC1B;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,IAAI,CAAC,gBAAgB,EAAE,uBAAuB,GAAG,eAAe,CAAC,KACxE,oBAkBF,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACtC,6EAA6E;IAC7E,cAAc,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,SAAS,CAAC;IAC1D,2CAA2C;IAC3C,iBAAiB,EAAE,eAAe,CAAC;IACnC,2DAA2D;IAC3D,aAAa,EAAE,MAAM,CAAC,uBAAuB,EAAE,WAAW,GAAG,IAAI,CAAC,CAAC;IACnE,uFAAuF;IACvF,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACzC;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,GACtC,OAAO,sBAAsB,KAC3B,KAAK,CAAC,oBAAoB,CA0D5B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,eAAO,MAAM,iBAAiB,GAAU,SAAS,gBAAgB,KAAG,OAAO,CAAC,SAAS,CAQpF,CAAC"}

package/dist/server/app_server.js

@@ -126,7 +126,8 @@ export const resolve_rate_limiters = (options) => {
  * spec-level ones: a weakened session cookie, and an open rate-limited
  * surface — one warning for `'disabled_for_testing'`, otherwise one per
  * explicitly-null limiter, so a deployment that disables login's limiter but
- * keeps signup's reads differently from one that disables both.
+ * keeps signup's reads differently from one that disables both — and a
+ * disabled request body size limit (`max_body_size: null`).
  *
  * @internal
  */
@@ -176,6 +177,14 @@ export const collect_config_diagnostics = (input) => {
             }
         }
     }
+    if (input.max_body_size === null) {
+        diagnostics.push({
+            level: 'warning',
+            category: 'security',
+            message: 'request body size limit explicitly disabled (max_body_size: null) — ' +
+                'every route must cap its own body'
+        });
+    }
     return diagnostics;
 };
 /**
@@ -249,6 +258,16 @@ const assemble_app_server = async (options, releases) => {
     const { backend } = options;
     const { deps } = backend;
     const { log } = deps;
+    // option checks first, before anything is acquired
+    if (options.allowed_origins.length === 0) {
+        throw new Error('create_app_server: allowed_origins is empty — list at least one origin pattern ' +
+            '(an empty list refuses every browser request)');
+    }
+    // body size limit — rejects oversized payloads before auth/validation; the
+    // middleware throws on a cap that is not a safe integer 0 or more
+    const body_limit_middleware = options.max_body_size === null
+        ? null
+        : create_body_limit_middleware(options.max_body_size ?? DEFAULT_MAX_BODY_SIZE);
     // Rate limiters — the ones built here are the server's to dispose, on
     // close or when assembly fails.
     const { mode: rate_limiter_mode, limiters: rate_limiters, built: built_rate_limiters } = resolve_rate_limiters(options);
@@ -392,7 +411,8 @@ const assemble_app_server = async (options, releases) => {
     // WS path checks — pure data, so they run before anything mounts.
     // `register_ws_endpoint` mounts a `GET path` upgrade route: a duplicate
     // path, or one a `RouteSpec` already registered as `GET path`, would be
-    // silently shadowed by Hono's last-wins semantics — fail fast instead.
+    // silently shadowed by Hono's last-wins semantics — fail fast instead. An
+    // endpoint's own empty `allowed_origins` would refuse every browser upgrade.
     if (ws_mount) {
         const route_spec_get_paths = new Set();
         for (const r of route_specs) {
@@ -407,6 +427,11 @@ const assemble_app_server = async (options, releases) => {
             if (route_spec_get_paths.has(endpoint.path)) {
                 throw new Error(`create_app_server: ws_endpoints path collides with a GET RouteSpec: ${endpoint.path}`);
             }
+            if (endpoint.allowed_origins.length === 0) {
+                throw new Error(`create_app_server: ws_endpoints allowed_origins is empty for ${endpoint.path} — ` +
+                    'list at least one origin pattern, or omit it to take the server list ' +
+                    '(an empty list refuses every browser upgrade)');
+            }
             seen_paths.add(endpoint.path);
         }
     }
@@ -430,7 +455,8 @@ const assemble_app_server = async (options, releases) => {
     const config_diagnostics = collect_config_diagnostics({
         cookie_options: options.session_options.cookie_options,
         rate_limiter_mode,
-        rate_limiters
+        rate_limiters,
+        max_body_size: options.max_body_size
     });
     if (config_diagnostics.length) {
         surface_spec.surface.diagnostics = [...surface_spec.surface.diagnostics, ...config_diagnostics];
@@ -483,11 +509,9 @@ const assemble_app_server = async (options, releases) => {
     if (log.level !== 'off') {
         app.use(logger((msg) => log.info(msg)));
     }
-    // Body size limit — rejects oversized payloads before auth/validation.
-    // Default 1 MiB; pass null to disable.
-    if (options.max_body_size !== null) {
-        const max_size = options.max_body_size ?? DEFAULT_MAX_BODY_SIZE;
-        app.use(create_body_limit_middleware(max_size));
+    // body size limit, built with the option checks above
+    if (body_limit_middleware) {
+        app.use(body_limit_middleware);
     }
     apply_middleware_specs(app, middleware_specs);
     const authorize = create_fuz_authorization_handler({ db: deps.db });