@lovrozagar/honey 0.1.0

package/package.json

@@ -0,0 +1,120 @@
+{
+	"name": "@lovrozagar/honey",
+	"version": "0.1.0",
+	"description": "Type-safe API framework built on Web Standards. Builder-pattern DX, precompiled radix tree in production.",
+	"keywords": [
+		"api",
+		"framework",
+		"honey",
+		"radix-tree",
+		"router",
+		"type-safe",
+		"web-standards"
+	],
+	"license": "MIT",
+	"repository": {
+		"type": "git",
+		"url": "https://github.com/lovrozagar/honey"
+	},
+	"publishConfig": {
+		"access": "public"
+	},
+	"bin": {
+		"honey": "./src/cli.ts"
+	},
+	"files": [
+		"docs",
+		"src"
+	],
+	"type": "module",
+	"sideEffects": [
+		"./src/i18n.ts",
+		"./src/openapi/register.ts",
+		"./src/serve-register.ts"
+	],
+	"exports": {
+		".": "./src/index.ts",
+		"./accepts": "./src/accepts.ts",
+		"./body-limit": "./src/body-limit.ts",
+		"./build": "./src/build/index.ts",
+		"./cli": "./src/cli.ts",
+		"./client": "./src/client/index.ts",
+		"./client/sdk": "./src/client/sdk.ts",
+		"./codegen": "./src/codegen.ts",
+		"./codegen-go-cli": "./src/codegen-go-cli.ts",
+		"./codegen/extract": "./src/type-extractor.ts",
+		"./cookie": "./src/cookie.ts",
+		"./cookie-sign": "./src/cookie-sign.ts",
+		"./cors": "./src/cors.ts",
+		"./crypto": "./src/crypto.ts",
+		"./curl-logger": "./src/curl-logger.ts",
+		"./csrf": "./src/csrf.ts",
+		"./errors": "./src/errors.ts",
+		"./etag": "./src/etag.ts",
+		"./i18n": "./src/i18n.ts",
+		"./input": "./src/input.ts",
+		"./ip-restrict": "./src/ip-restrict.ts",
+		"./logger": "./src/logger.ts",
+		"./node": "./src/node.ts",
+		"./openapi": "./src/openapi/register.ts",
+		"./openapi/spec": "./src/openapi/spec.ts",
+		"./openapi/scalar": "./src/openapi/scalar.ts",
+		"./openapi/swagger": "./src/openapi/swagger.ts",
+		"./plugin": "./src/plugin.ts",
+		"./powered-by": "./src/powered-by.ts",
+		"./pretty-json": "./src/pretty-json.ts",
+		"./proxy": "./src/proxy.ts",
+		"./request-to-curl": "./src/request-to-curl.ts",
+		"./request-id": "./src/request-id.ts",
+		"./secure-headers": "./src/secure-headers.ts",
+		"./serve": "./src/serve-register.ts",
+		"./server-timing": "./src/server-timing.ts",
+		"./static": "./src/static.ts",
+		"./telemetry/otel": "./src/telemetry/otel.ts",
+		"./testing": "./src/testing.ts",
+		"./timeout": "./src/timeout.ts",
+		"./tree": "./src/tree.ts",
+		"./ws/bun": "./src/ws/bun.ts",
+		"./ws/cloudflare": "./src/ws/cloudflare.ts",
+		"./ws/deno": "./src/ws/deno.ts",
+		"./ws/node": "./src/ws/node.ts"
+	},
+	"scripts": {
+		"test": "vitest run",
+		"test:all": "vitest run --config vitest.all.config.ts",
+		"test:harness": "vitest run --config vitest.harness.config.ts",
+		"test:harness:rust": "vitest run --config vitest.harness.rust.config.ts",
+		"test:watch": "vitest",
+		"type:check": "tsc --noEmit -p tsconfig.src.json && tsc --noEmit -p tsconfig.types.json",
+		"type:check:tests": "NODE_OPTIONS='--max-old-space-size=4096' tsc --noEmit",
+		"type:check:types": "tsc --noEmit -p tsconfig.types.json"
+	},
+	"dependencies": {
+		"jiti": "2.7.0"
+	},
+	"devDependencies": {
+		"@honey/e2e-surface": "workspace:*",
+		"@honey/e2e-kitchen": "workspace:*",
+		"@modelcontextprotocol/sdk": "^1.29.0",
+		"@total-typescript/ts-reset": "catalog:",
+		"@types/node": "catalog:",
+		"@types/ws": "catalog:",
+		"arktype": "catalog:",
+		"effect": "catalog:",
+		"ts-morph": "catalog:",
+		"typescript": "catalog:",
+		"valibot": "catalog:",
+		"vite": "catalog:",
+		"vitest": "catalog:",
+		"yup": "catalog:",
+		"zod": "catalog:"
+	},
+	"peerDependencies": {
+		"ts-morph": ">=25.0.0"
+	},
+	"peerDependenciesMeta": {
+		"ts-morph": {
+			"optional": true
+		}
+	}
+}

package/src/accepts.ts

@@ -0,0 +1,78 @@
+type ParsedType = {
+	q: number
+	subtype: string
+	type: string
+}
+
+function parseAccept(header: string): ParsedType[] {
+	const types: ParsedType[] = []
+	for (const part of header.split(",")) {
+		const trimmed = part.trim()
+		if (trimmed.length === 0) continue
+
+		const segments = trimmed.split(";")
+		const mediaType = segments[0].trim()
+		const slash = mediaType.indexOf("/")
+		if (slash === -1) continue
+
+		let q = 1.0
+		for (let i = 1; i < segments.length; i++) {
+			const param = segments[i].trim()
+			if (param.startsWith("q=")) {
+				const parsed = Number.parseFloat(param.slice(2))
+				if (!Number.isNaN(parsed)) q = parsed
+			}
+		}
+
+		types.push({
+			q,
+			subtype: mediaType.slice(slash + 1).toLowerCase(),
+			type: mediaType.slice(0, slash).toLowerCase(),
+		})
+	}
+	return types.sort((a, b) => b.q - a.q)
+}
+
+function matches(accept: ParsedType, supported: string): boolean {
+	const slash = supported.indexOf("/")
+	if (slash === -1) return false
+	const sType = supported.slice(0, slash)
+	const sSub = supported.slice(slash + 1)
+
+	if (accept.type === "*" && accept.subtype === "*") return true
+	if (accept.type === sType && accept.subtype === "*") return true
+	return accept.type === sType && accept.subtype === sSub
+}
+
+/**
+ * Pick the best supported content type based on the request's Accept header.
+ * Returns null if no match found. Returns first supported type if no Accept header.
+ */
+export function accepts(req: Request, supported: string[]): string | null {
+	const header = req.headers.get("accept")
+	if (header === null || header.length === 0) {
+		return supported[0] ?? null
+	}
+
+	const parsed = parseAccept(header)
+	if (parsed.length === 0) {
+		return supported[0] ?? null
+	}
+
+	/* for each supported type (server preference order), find best q match */
+	let bestMatch: string | null = null
+	let bestQ = -1
+
+	for (const s of supported) {
+		for (const accept of parsed) {
+			if (accept.q === 0) continue
+			if (matches(accept, s) && accept.q > bestQ) {
+				bestQ = accept.q
+				bestMatch = s
+				break
+			}
+		}
+	}
+
+	return bestMatch
+}

package/src/body-limit.ts

@@ -0,0 +1,100 @@
+import { HoneyError } from "./error.ts"
+import type { MiddlewareFn } from "./middleware.ts"
+import { EK, SK } from "./types.ts"
+
+type BodyLimitOptions = {
+	/** Per content-type size limits (matched via startsWith against request Content-Type header) */
+	limits?: Record<string, number>
+	/** Default max body size in bytes — used when no content-type match or no limits map */
+	maxSize: number
+	/**
+	 * Skip stream byte-counting when Content-Length header is present and within bounds.
+	 * HTTP/1.1 and HTTP/2 framing guarantees body cannot exceed declared Content-Length
+	 * regardless of TLS — the protocol enforces it at the transport level.
+	 * When false, every request body is wrapped in a counting TransformStream even
+	 * when Content-Length is present. Chunked requests (no Content-Length) are always
+	 * stream-counted regardless of this setting.
+	 * Default: false.
+	 */
+	trustContentLength?: boolean
+}
+
+export type { BodyLimitOptions }
+
+export function bodyLimit(opts: BodyLimitOptions): MiddlewareFn<{ req: Request }, {}> {
+	const { limits, maxSize, trustContentLength } = opts
+	const limitEntries = limits !== undefined ? Object.entries(limits) : null
+
+	const mw: MiddlewareFn<{ req: Request }, {}> = (ctx, next) => {
+		const req = ctx.req
+		const method = req.method
+		if (method === "GET" || method === "HEAD" || method === "OPTIONS" || method === "DELETE") {
+			return next()
+		}
+
+		/* resolve max size from content-type */
+		let resolvedMax = maxSize
+		if (limitEntries !== null) {
+			const ct = req.headers.get("content-type")
+			if (ct !== null) {
+				for (const [key, limit] of limitEntries) {
+					if (ct.startsWith(key)) {
+						resolvedMax = limit
+						break
+					}
+				}
+			}
+		}
+
+		/* fast path: Content-Length header present */
+		const contentLength = req.headers.get("content-length")
+		if (contentLength !== null) {
+			const len = Number.parseInt(contentLength, 10)
+			if (!Number.isNaN(len) && len > resolvedMax) {
+				throw new HoneyError({
+					errorKey: EK.content_too_large,
+					status: SK.content_too_large,
+				})
+			}
+			if (trustContentLength === true) return next()
+		}
+
+		/* slow path: stream-count when no Content-Length (chunked) or trustContentLength disabled */
+		if (req.body !== null) {
+			let totalBytes = 0
+			const limit = resolvedMax
+			const transform = new TransformStream<Uint8Array, Uint8Array>({
+				transform(chunk, controller) {
+					totalBytes += chunk.byteLength
+					if (totalBytes > limit) {
+						controller.error(
+							new HoneyError({
+								errorKey: EK.content_too_large,
+								status: SK.content_too_large,
+							}),
+						)
+						return
+					}
+					controller.enqueue(chunk)
+				},
+			})
+
+			const limited = req.body.pipeThrough(transform)
+			const replaceBody = (req as unknown as Record<symbol, unknown>)[Symbol.for("honey.replaceBody")]
+			if (typeof replaceBody === "function") {
+				;(replaceBody as (stream: ReadableStream<Uint8Array>) => void).call(req, limited)
+			} else {
+				/* duplex: "half" required by Node/undici when body is a ReadableStream */
+				const newReq = new Request(req, {
+					body: limited,
+					duplex: "half",
+				} as RequestInit)
+				Object.defineProperty(ctx, "req", { configurable: true, value: newReq })
+			}
+		}
+
+		return next()
+	}
+
+	return mw
+}

package/src/build/index.ts

@@ -0,0 +1,174 @@
+import { existsSync, readFileSync } from "node:fs"
+import { builtinModules } from "node:module"
+import { resolve } from "node:path"
+
+/* ---- Public types ---- */
+
+export type HoneyBuildConfig = {
+	external?: string[]
+	minify?: boolean
+	outDir?: string
+	port?: number
+	target: "bun" | "cloudflare" | "deno" | "node"
+}
+
+/* ---- Internal types ---- */
+
+type ResolvedBuildConfig = {
+	entry: string
+	export: string
+	port: number
+}
+
+type BuildAdapterDef = {
+	entry(config: ResolvedBuildConfig): string
+	ssrTarget: "node" | "webworker"
+}
+
+/* ---- Entry helpers ---- */
+
+function featurePrelude(appSource: string): string {
+	const lines: string[] = []
+	if (/\.openapi\s*\(|\.manifest\s*\(/.test(appSource)) {
+		lines.push('import { enableOpenApi } from "@lovrozagar/honey/openapi"', "enableOpenApi()")
+	}
+	if (/\.errorI18n\s*\(/.test(appSource)) {
+		lines.push('import { enableI18n } from "@lovrozagar/honey/i18n"', "enableI18n()")
+	}
+	if (/(?<!Bun)(?<!Deno)\.serve\s*\(/.test(appSource)) {
+		lines.push('import { enableServe } from "@lovrozagar/honey/serve"', "enableServe()")
+	}
+	return lines.length > 0 ? `${lines.join("\n")}\n` : ""
+}
+
+function importApp(entry: string, exportName: string): string {
+	if (exportName === "default") return `import app from "./${entry}"`
+	return `import { ${exportName} as app } from "./${entry}"`
+}
+
+/* ---- Adapter definitions ---- */
+
+const adapters: Record<HoneyBuildConfig["target"], BuildAdapterDef> = {
+	bun: {
+		entry(config) {
+			return [
+				importApp(config.entry, config.export),
+				"",
+				`const port = Number(process.env.PORT ?? ${config.port})`,
+				"Bun.serve({",
+				"  fetch: (req, server) => app.fetch(req, { server }),",
+				'  hostname: "0.0.0.0",',
+				"  port,",
+				"})",
+			].join("\n")
+		},
+		ssrTarget: "node",
+	},
+	cloudflare: {
+		entry(config) {
+			return [
+				importApp(config.entry, config.export),
+				"",
+				"export default {",
+				"  fetch: (req, env, ctx) => app.fetch(req, env, ctx),",
+				"}",
+			].join("\n")
+		},
+		ssrTarget: "webworker",
+	},
+	deno: {
+		entry(config) {
+			return [
+				importApp(config.entry, config.export),
+				"",
+				`const port = Number(Deno.env.get("PORT") ?? "${config.port}")`,
+				'Deno.serve({ hostname: "0.0.0.0", port }, (req) => app.fetch(req, {}))',
+			].join("\n")
+		},
+		ssrTarget: "webworker",
+	},
+	node: {
+		entry(config) {
+			return [
+				'import { serve } from "@lovrozagar/honey/node"',
+				importApp(config.entry, config.export),
+				"",
+				`const port = Number(process.env.PORT ?? ${config.port})`,
+				'serve(app, { env: process.env, hostname: "0.0.0.0", port })',
+			].join("\n")
+		},
+		ssrTarget: "node",
+	},
+}
+
+/* ---- Virtual module constants ---- */
+
+const VIRTUAL_BUILD_ENTRY = "virtual:honey-build-entry"
+const RESOLVED_BUILD_ENTRY = `\0${VIRTUAL_BUILD_ENTRY}`
+
+/* ---- Build plugin factory ---- */
+
+export function createBuildPlugin(
+	buildConfig: HoneyBuildConfig,
+	shared: { entry: string; export: string },
+) {
+	const adapter = adapters[buildConfig.target]
+	const resolvedConfig: ResolvedBuildConfig = {
+		entry: shared.entry,
+		export: shared.export,
+		port: buildConfig.port ?? 3000,
+	}
+
+	let root = ""
+
+	return {
+		apply: "build" as const,
+
+		config() {
+			return {
+				build: {
+					emptyOutDir: false,
+					minify: buildConfig.minify ?? true,
+					outDir: buildConfig.outDir ?? "./dist",
+					rolldownOptions: {
+						external: [
+							...builtinModules,
+							...builtinModules.map((m) => `node:${m}`),
+							...(buildConfig.external ?? []),
+						],
+						input: VIRTUAL_BUILD_ENTRY,
+						output: { entryFileNames: "index.js" },
+					},
+					ssr: true,
+				},
+				ssr: {
+					noExternal: true,
+					target: adapter.ssrTarget,
+				},
+			}
+		},
+
+		configResolved(cfg: { root: string }) {
+			root = cfg.root
+		},
+
+		load(id: string): { code: string; moduleType: string } | undefined {
+			if (id === RESOLVED_BUILD_ENTRY) {
+				const appPath = resolve(root || ".", shared.entry)
+				const appSource = existsSync(appPath) ? readFileSync(appPath, "utf-8") : ""
+				return {
+					code: `${featurePrelude(appSource)}${adapter.entry(resolvedConfig)}`,
+					moduleType: "js",
+				}
+			}
+			return undefined
+		},
+
+		name: "honey:build",
+
+		resolveId(id: string): string | undefined {
+			if (id === VIRTUAL_BUILD_ENTRY) return RESOLVED_BUILD_ENTRY
+			return undefined
+		},
+	}
+}

package/src/cli-go/auth.go

@@ -0,0 +1,15 @@
+// Code generated by honey. DO NOT EDIT.
+package cli
+
+import "errors"
+
+// ErrMissingAPIKey is returned when no API key can be found via flags, env, or config file.
+var ErrMissingAPIKey = errors.New("api key required: set --api-key, env var, or config file")
+
+// ResolveAPIKey returns the resolved API key or ErrMissingAPIKey if none is available.
+func ResolveAPIKey(cfg Config) (string, error) {
+	if cfg.APIKey != "" {
+		return cfg.APIKey, nil
+	}
+	return "", ErrMissingAPIKey
+}

package/src/cli-go/config.go

@@ -0,0 +1,165 @@
+// Code generated by honey. DO NOT EDIT.
+package cli
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+
+	"github.com/pelletier/go-toml/v2"
+	"github.com/spf13/pflag"
+)
+
+// Config holds resolved runtime values for the CLI binary.
+//
+// Precedence (high → low) — see LoadConfig below:
+//
+//  1. --api-key / --base-url / --output / … flag set on the command line.
+//  2. Env var: <ENV_PREFIX>_API_KEY / _BASE_URL / _OUTPUT / …
+//  3. Config file from --config, $<ENV_PREFIX>_CONFIG, $XDG_CONFIG_HOME/<name>/config.toml,
+//     $HOME/.config/<name>/config.toml, os.UserConfigDir()/<name>/config.toml.
+//  4. Built-in defaults.
+//  5. (missing api-key → ErrMissingAPIKey, mapped to exit 4).
+type Config struct {
+	APIKey     string
+	BaseURL    string
+	Output     string
+	Timeout    string
+	Verbose    bool
+	ConfigPath string
+}
+
+type tomlConfig struct {
+	APIKey  string `toml:"api_key"`
+	BaseURL string `toml:"base_url"`
+	Output  string `toml:"output"`
+	Timeout string `toml:"timeout"`
+}
+
+// LoadConfig merges flag values, env vars, and a TOML config file into a Config.
+//
+// The resolution order matches the Config doc-comment precedence list.
+func LoadConfig(flags *pflag.FlagSet, envPrefix, configName string) (Config, error) {
+	var cfg Config
+
+	cfgPath := ""
+	if flags.Changed("config") {
+		v, _ := flags.GetString("config")
+		cfgPath = v
+	} else if v := os.Getenv(envPrefix + "_CONFIG"); v != "" {
+		cfgPath = v
+	} else {
+		cfgPath = defaultConfigPath(configName)
+	}
+
+	var fromFile tomlConfig
+	if cfgPath != "" {
+		if data, err := os.ReadFile(cfgPath); err == nil {
+			if err := toml.Unmarshal(data, &fromFile); err != nil {
+				return cfg, fmt.Errorf("parse config %s: %w", cfgPath, err)
+			}
+		}
+	}
+	cfg.ConfigPath = cfgPath
+
+	cfg.APIKey = fromFile.APIKey
+	if v := os.Getenv(envPrefix + "_API_KEY"); v != "" {
+		cfg.APIKey = v
+	}
+	if flags.Changed("api-key") {
+		v, _ := flags.GetString("api-key")
+		cfg.APIKey = v
+	}
+
+	cfg.BaseURL = fromFile.BaseURL
+	if v := os.Getenv(envPrefix + "_BASE_URL"); v != "" {
+		cfg.BaseURL = v
+	}
+	if flags.Changed("base-url") {
+		v, _ := flags.GetString("base-url")
+		cfg.BaseURL = v
+	}
+
+	cfg.Output = fromFile.Output
+	if v := os.Getenv(envPrefix + "_OUTPUT"); v != "" {
+		cfg.Output = v
+	}
+	if flags.Changed("output") {
+		v, _ := flags.GetString("output")
+		cfg.Output = v
+	}
+	if cfg.Output == "" {
+		cfg.Output = "json"
+	}
+
+	cfg.Timeout = fromFile.Timeout
+	if v := os.Getenv(envPrefix + "_TIMEOUT"); v != "" {
+		cfg.Timeout = v
+	}
+	if flags.Changed("timeout") {
+		v, _ := flags.GetString("timeout")
+		cfg.Timeout = v
+	}
+	if cfg.Timeout == "" {
+		cfg.Timeout = "30s"
+	}
+
+	if flags.Changed("verbose") {
+		v, _ := flags.GetBool("verbose")
+		cfg.Verbose = v
+	}
+
+	return cfg, nil
+}
+
+func defaultConfigPath(configName string) string {
+	if configName == "" {
+		return ""
+	}
+	if xdg := os.Getenv("XDG_CONFIG_HOME"); xdg != "" {
+		return filepath.Join(xdg, configName, "config.toml")
+	}
+	if home := os.Getenv("HOME"); home != "" {
+		return filepath.Join(home, ".config", configName, "config.toml")
+	}
+	if dir, err := os.UserConfigDir(); err == nil {
+		return filepath.Join(dir, configName, "config.toml")
+	}
+	return ""
+}
+
+// readDataFlag resolves the value of a --data flag into raw bytes.
+//
+// Rules:
+//   - "@path"        → reads file at path.
+//   - "-"            → reads os.Stdin.
+//   - ""             → returns nil, nil (caller decides whether required).
+//   - anything else  → treats val as literal JSON.
+//
+// Exported as ReadDataFlag for use from cmd/*.go.
+func ReadDataFlag(val string) ([]byte, error) {
+	return readDataFlag(val)
+}
+
+func readDataFlag(val string) ([]byte, error) {
+	if val == "" {
+		return nil, nil
+	}
+	if val == "-" {
+		data, err := io.ReadAll(os.Stdin)
+		if err != nil {
+			return nil, fmt.Errorf("read stdin: %w", err)
+		}
+		return data, nil
+	}
+	if val[0] == '@' {
+		path := val[1:]
+		data, err := os.ReadFile(path)
+		if err != nil {
+			return nil, fmt.Errorf("read data file %s: %w", path, err)
+		}
+		return data, nil
+	}
+	return []byte(val), nil
+}