@lovrozagar/honey 0.6.5 → 0.7.0

package/dist/media-type.js

@@ -0,0 +1,97 @@
+/**
+ * One media-type parser (RFC 9110 §8.3.1) for every place that reads a `Content-Type`:
+ * input validation, `bodyLimit`, and the client. Type, subtype and parameter names are
+ * case-insensitive, so they are lowercased; parameter values keep their case.
+ *
+ * Pure and dependency-free: the client entry imports it too.
+ */
+/* RFC 9110 token characters */
+const TOKEN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+function isToken(s) {
+    return s.length > 0 && TOKEN.test(s);
+}
+/**
+ * Parses a `Content-Type` (or any media type) value. Returns `null` for an absent or
+ * malformed value, so a caller never mistakes `application/jsonx` or `json` for JSON.
+ */
+export function parseMediaType(value) {
+    if (value === null || value === undefined)
+        return null;
+    const semi = value.indexOf(";");
+    const head = (semi === -1 ? value : value.slice(0, semi)).trim();
+    const slash = head.indexOf("/");
+    if (slash === -1)
+        return null;
+    const type = head.slice(0, slash).toLowerCase();
+    const subtype = head.slice(slash + 1).toLowerCase();
+    if (!isToken(type) || !isToken(subtype))
+        return null;
+    const plus = subtype.lastIndexOf("+");
+    const suffix = plus > 0 && plus < subtype.length - 1 ? subtype.slice(plus + 1) : null;
+    const params = Object.create(null);
+    if (semi !== -1)
+        parseParams(value, semi + 1, params);
+    return { essence: `${type}/${subtype}`, params, subtype, suffix, type };
+}
+/* `; name=value` pairs; value is a token or a quoted-string. Malformed pairs are skipped,
+ * as browsers and undici do, rather than rejecting the whole header. */
+function parseParams(value, start, out) {
+    let i = start;
+    const n = value.length;
+    while (i < n) {
+        while (i < n && (value[i] === " " || value[i] === "\t" || value[i] === ";"))
+            i++;
+        const eq = value.indexOf("=", i);
+        const nextSemi = value.indexOf(";", i);
+        if (eq === -1 || (nextSemi !== -1 && nextSemi < eq)) {
+            i = nextSemi === -1 ? n : nextSemi + 1;
+            continue;
+        }
+        const name = value.slice(i, eq).trim().toLowerCase();
+        i = eq + 1;
+        let v;
+        if (value[i] === '"') {
+            i++;
+            let buf = "";
+            while (i < n && value[i] !== '"') {
+                if (value[i] === "\\" && i + 1 < n)
+                    i++;
+                buf += value[i];
+                i++;
+            }
+            v = buf;
+            i++; /* closing quote */
+            const after = value.indexOf(";", i);
+            i = after === -1 ? n : after + 1;
+        }
+        else {
+            const end = value.indexOf(";", i);
+            v = (end === -1 ? value.slice(i) : value.slice(i, end)).trim();
+            i = end === -1 ? n : end + 1;
+        }
+        if (isToken(name) && !(name in out))
+            out[name] = v;
+    }
+}
+/** `application/json`, or any `+json` structured-syntax type (`application/problem+json`). */
+export function isJsonMediaType(mt) {
+    return mt !== null && (mt.essence === "application/json" || mt.suffix === "json");
+}
+/** Text-like bodies: `text/*`, `application/xml`, and any `+xml` type. */
+export function isTextMediaType(mt) {
+    return mt !== null && (mt.type === "text" || mt.essence === "application/xml" || mt.suffix === "xml");
+}
+/** Which body parser a request `Content-Type` selects, or `null` when none applies. */
+export function bodyParserFor(contentType) {
+    const mt = parseMediaType(contentType);
+    if (mt === null)
+        return null;
+    if (isJsonMediaType(mt))
+        return "json";
+    if (mt.essence === "multipart/form-data")
+        return "multipart";
+    if (mt.essence === "application/x-www-form-urlencoded")
+        return "urlencoded";
+    return null;
+}
+//# sourceMappingURL=media-type.js.map

package/dist/media-type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-type.js","sourceRoot":"","sources":["../src/media-type.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAaH,+BAA+B;AAC/B,MAAM,KAAK,GAAG,+BAA+B,CAAA;AAE7C,SAAS,OAAO,CAAC,CAAS;IACzB,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAgC;IAC9D,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACtD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC/B,MAAM,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAChE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IACnD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IACpD,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACrF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAA2B,CAAA;IAC5D,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,WAAW,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,EAAE,MAAM,CAAC,CAAA;IACrD,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,IAAI,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;AACxE,CAAC;AAED;wEACwE;AACxE,SAAS,WAAW,CAAC,KAAa,EAAE,KAAa,EAAE,GAA2B;IAC7E,IAAI,CAAC,GAAG,KAAK,CAAA;IACb,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAA;IACtB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;YAAE,CAAC,EAAE,CAAA;QAChF,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QACtC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAC;YACrD,CAAC,GAAG,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAA;YACtC,SAAQ;QACT,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACpD,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACV,IAAI,CAAS,CAAA;QACb,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACtB,CAAC,EAAE,CAAA;YACH,IAAI,GAAG,GAAG,EAAE,CAAA;YACZ,OAAO,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAClC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,CAAC,EAAE,CAAA;gBACvC,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAA;gBACf,CAAC,EAAE,CAAA;YACJ,CAAC;YACD,CAAC,GAAG,GAAG,CAAA;YACP,CAAC,EAAE,CAAA,CAAC,mBAAmB;YACvB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;YACnC,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAA;QACjC,CAAC;aAAM,CAAC;YACP,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;YACjC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YAC9D,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAA;QAC7B,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACnD,CAAC;AACF,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,eAAe,CAAC,EAAoB;IACnD,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,KAAK,kBAAkB,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;AAClF,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,eAAe,CAAC,EAAoB;IACnD,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,EAAE,CAAC,OAAO,KAAK,iBAAiB,IAAI,EAAE,CAAC,MAAM,KAAK,KAAK,CAAC,CAAA;AACtG,CAAC;AAID,uFAAuF;AACvF,MAAM,UAAU,aAAa,CAAC,WAAsC;IACnE,MAAM,EAAE,GAAG,cAAc,CAAC,WAAW,CAAC,CAAA;IACtC,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC5B,IAAI,eAAe,CAAC,EAAE,CAAC;QAAE,OAAO,MAAM,CAAA;IACtC,IAAI,EAAE,CAAC,OAAO,KAAK,qBAAqB;QAAE,OAAO,WAAW,CAAA;IAC5D,IAAI,EAAE,CAAC,OAAO,KAAK,mCAAmC;QAAE,OAAO,YAAY,CAAA;IAC3E,OAAO,IAAI,CAAA;AACZ,CAAC"}

package/dist/meta-spec-merge.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Composition of metaSpec policies across mounted sub-apps. Kept apart from the policy engine
+ * so the app core can merge policies without loading the engine.
+ */
+import type { MetaSpecConfig, MetaSpecStrictness } from "./types.ts";
+/** The strictness a declared policy actually runs with: `"error"` unless it says otherwise. */
+export declare function resolvedStrictness(config: MetaSpecConfig | null): MetaSpecStrictness;
+/**
+ * Merge a mounted sub-app's policy into a parent's.
+ *
+ * The parent wins on conflict, so one gateway keeps one answer for its aggregate document —
+ * with a single exception. A sub entry of `false` wins over anything the parent says, because
+ * hiding is a safety claim and the strictest claim has to survive composition: a worker that
+ * declares a field unpublishable must not have the gateway publish it. Wrongly hidden is a
+ * visible gap; wrongly published is a leak.
+ *
+ * Strictness is the parent's *resolved* setting: a parent that never wrote `strict` runs with
+ * `"error"`, and a sub-app's `"off"` must not downgrade it. Every other disagreement is
+ * recorded in `conflicts` and reported at codegen.
+ *
+ * Order-independent with respect to when the parent declares its own policy: callers may keep
+ * the absorbed sub policies and merge them in at codegen time.
+ */
+export declare function mergeMetaSpec(own: MetaSpecConfig | null, sub: MetaSpecConfig | null): MetaSpecConfig | null;
+/** A policy as an app holds it: its own declaration and each mounted sub-app's source, unmerged. */
+export type MetaSpecSource = {
+    readonly declared: MetaSpecConfig | null;
+    readonly absorbed: readonly MetaSpecSource[];
+};
+/** The policy codegen applies to `app`: its own, with every mounted sub-app's merged in mount order. */
+export declare function metaSpecOf(app: unknown): MetaSpecConfig | null;
+//# sourceMappingURL=meta-spec-merge.d.ts.map

package/dist/meta-spec-merge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"meta-spec-merge.d.ts","sourceRoot":"","sources":["../src/meta-spec-merge.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,cAAc,EAAwC,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAE1G,+FAA+F;AAC/F,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,GAAG,kBAAkB,CAEpF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI,EAAE,GAAG,EAAE,cAAc,GAAG,IAAI,GAAG,cAAc,GAAG,IAAI,CAkC3G;AAED,oGAAoG;AACpG,MAAM,MAAM,cAAc,GAAG;IAC5B,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAA;IACxC,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAA;CAC5C,CAAA;AAQD,wGAAwG;AACxG,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,GAAG,IAAI,CAG9D"}

package/dist/meta-spec-merge.js

@@ -0,0 +1,68 @@
+/** The strictness a declared policy actually runs with: `"error"` unless it says otherwise. */
+export function resolvedStrictness(config) {
+    return config?.strict ?? (config ? "error" : "off");
+}
+/**
+ * Merge a mounted sub-app's policy into a parent's.
+ *
+ * The parent wins on conflict, so one gateway keeps one answer for its aggregate document —
+ * with a single exception. A sub entry of `false` wins over anything the parent says, because
+ * hiding is a safety claim and the strictest claim has to survive composition: a worker that
+ * declares a field unpublishable must not have the gateway publish it. Wrongly hidden is a
+ * visible gap; wrongly published is a leak.
+ *
+ * Strictness is the parent's *resolved* setting: a parent that never wrote `strict` runs with
+ * `"error"`, and a sub-app's `"off"` must not downgrade it. Every other disagreement is
+ * recorded in `conflicts` and reported at codegen.
+ *
+ * Order-independent with respect to when the parent declares its own policy: callers may keep
+ * the absorbed sub policies and merge them in at codegen time.
+ */
+export function mergeMetaSpec(own, sub) {
+    if (!sub)
+        return own;
+    if (!own)
+        return sub;
+    const conflicts = [...(own.conflicts ?? []), ...(sub.conflicts ?? [])];
+    const meta = { ...sub.meta, ...own.meta };
+    for (const [key, subEntry] of Object.entries(sub.meta ?? {})) {
+        const ownEntry = own.meta?.[key];
+        if (ownEntry === undefined || ownEntry === subEntry)
+            continue;
+        if (subEntry === false && ownEntry !== false) {
+            meta[key] = false;
+            conflicts.push({ key, resolution: "hidden", section: "meta" });
+            continue;
+        }
+        conflicts.push({ key, resolution: "parent", section: "meta" });
+    }
+    const recordOverlap = (section, subSide, ownSide) => {
+        for (const [key, subEntry] of Object.entries(subSide)) {
+            const ownEntry = ownSide[key];
+            if (ownEntry === undefined || ownEntry === subEntry)
+                continue;
+            conflicts.push({ key, resolution: "parent", section });
+        }
+    };
+    recordOverlap("schema", sub.schema ?? {}, own.schema ?? {});
+    recordOverlap("profiles", sub.profiles ?? {}, own.profiles ?? {});
+    return {
+        conflicts,
+        meta,
+        profiles: { ...sub.profiles, ...own.profiles },
+        schema: { ...sub.schema, ...own.schema },
+        strict: resolvedStrictness(own),
+    };
+}
+function resolveSource(source) {
+    let merged = source.declared;
+    for (const sub of source.absorbed)
+        merged = mergeMetaSpec(merged, resolveSource(sub));
+    return merged;
+}
+/** The policy codegen applies to `app`: its own, with every mounted sub-app's merged in mount order. */
+export function metaSpecOf(app) {
+    const source = app._metaSpecSource;
+    return source === undefined ? null : resolveSource(source);
+}
+//# sourceMappingURL=meta-spec-merge.js.map

package/dist/meta-spec-merge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"meta-spec-merge.js","sourceRoot":"","sources":["../src/meta-spec-merge.ts"],"names":[],"mappings":"AAMA,+FAA+F;AAC/F,MAAM,UAAU,kBAAkB,CAAC,MAA6B;IAC/D,OAAO,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;AACpD,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,aAAa,CAAC,GAA0B,EAAE,GAA0B;IACnF,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAA;IACpB,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAA;IACpB,MAAM,SAAS,GAA4B,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAA;IAE/F,MAAM,IAAI,GAAkC,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IACxE,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,QAAQ;YAAE,SAAQ;QAC7D,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC9C,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;YACjB,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;YAC9D,SAAQ;QACT,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;IAC/D,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,OAA8B,EAAE,OAAe,EAAE,OAAe,EAAQ,EAAE;QAChG,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACvD,MAAM,QAAQ,GAAI,OAAmC,CAAC,GAAG,CAAC,CAAA;YAC1D,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,QAAQ;gBAAE,SAAQ;YAC7D,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;QACvD,CAAC;IACF,CAAC,CAAA;IACD,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;IAC3D,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAA;IAEjE,OAAO;QACN,SAAS;QACT,IAAI;QACJ,QAAQ,EAAE,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE;QAC9C,MAAM,EAAE,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE;QACxC,MAAM,EAAE,kBAAkB,CAAC,GAAG,CAAC;KAC/B,CAAA;AACF,CAAC;AAQD,SAAS,aAAa,CAAC,MAAsB;IAC5C,IAAI,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAA;IAC5B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ;QAAE,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAA;IACrF,OAAO,MAAM,CAAA;AACd,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,UAAU,CAAC,GAAY;IACtC,MAAM,MAAM,GAAI,GAA4C,CAAC,eAAe,CAAA;IAC5E,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;AAC3D,CAAC"}

package/dist/meta-spec.d.ts

@@ -3,10 +3,19 @@
  * Never consulted at request time. See docs/meta-spec.md.
  */
 import type { MetaSpecConfig, MetaSpecContext, MetaSpecProfile, MetaSpecSchemaSearch, MetaSpecSchemaSource, MetaSpecStrictness, MetaSpecVersionGuard, StandardSchemaLike } from "./types.ts";
+export { mergeMetaSpec, resolvedStrictness } from "./meta-spec-merge.ts";
 export declare const DEFAULT_PROFILE = "default";
-/** Normalize security shorthand → standard OpenAPI security array */
+/**
+ * Normalize security shorthand → standard OpenAPI security array.
+ *
+ * `"jwt"`, `["jwt", "apiKey"]` (alternatives), `[["key", "domain"]]` (all of a group) and the
+ * standard `[{ jwt: [] }]` form are accepted. `[]` is an explicit "no authentication". Anything
+ * else throws: guessing would turn a protected route into a documented public one.
+ */
 export declare function normalizeSecurity(raw: unknown): Record<string, string[]>[];
-export type MetaSpecDiagnosticCode = "AMBIGUOUS_SCHEMA_KEY" | "ASYNC_VALIDATION" | "DESCRIPTOR_MISMATCH" | "SUBAPP_ENTRY_CONFLICT" | "DUPLICATE_TARGET" | "INVALID_VALUE" | "MAP_THREW" | "MISSING_ENTRY" | "RESERVED_FIELD" | "UNKNOWN_FIELD" | "UNKNOWN_PROFILE" | "UNSUPPORTED_VERSION";
+/** Scheme names an operation's `security` refers to. */
+export declare function securitySchemeNames(security: unknown): string[];
+export type MetaSpecDiagnosticCode = "AMBIGUOUS_SCHEMA_KEY" | "ASYNC_VALIDATION" | "DESCRIPTOR_MISMATCH" | "SUBAPP_ENTRY_CONFLICT" | "DUPLICATE_OPERATION_ID" | "DUPLICATE_TARGET" | "INVALID_SELECTOR" | "INVALID_VALUE" | "MAP_THREW" | "MISSING_ENTRY" | "RESERVED_FIELD" | "UNKNOWN_FIELD" | "UNKNOWN_PROFILE" | "UNKNOWN_SECURITY_SCHEME" | "UNSUPPORTED_METHOD" | "UNSUPPORTED_VERSION" | "WS_SHADOWED";
 export type MetaSpecDiagnostic = {
     code: MetaSpecDiagnosticCode;
     level: "error" | "warn";
@@ -49,6 +58,11 @@ export type CompiledMetaSpec = {
     strict: MetaSpecStrictness;
 };
 export declare function compileMetaSpec(config: MetaSpecConfig | null, collector: MetaSpecCollector): CompiledMetaSpec;
+/**
+ * Meta keys a published artifact (the served manifest) may carry: keys with a policy entry
+ * that is not `false`, plus the built-ins. Keys with no entry are unreviewed, so they stay out.
+ */
+export declare function publishableMetaKeys(config: MetaSpecConfig | null): (key: string) => boolean;
 export declare function resolveProfile(spec: CompiledMetaSpec, profile: string | undefined, collector: MetaSpecCollector): {
     filter: (key: string) => boolean;
     name: string;
@@ -77,5 +91,4 @@ export type ApplyMetaSpecArgs = {
     spec: CompiledMetaSpec;
 };
 export declare function applyMetaSpec(args: ApplyMetaSpecArgs): void;
-export {};
 //# sourceMappingURL=meta-spec.d.ts.map

package/dist/meta-spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"meta-spec.d.ts","sourceRoot":"","sources":["../src/meta-spec.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EACX,cAAc,EACd,eAAe,EAEf,eAAe,EAEf,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,MAAM,YAAY,CAAA;AA4BnB,eAAO,MAAM,eAAe,YAAY,CAAA;AAIxC,qEAAqE;AACrE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,CAe1E;AAID,MAAM,MAAM,sBAAsB,GAC/B,sBAAsB,GACtB,kBAAkB,GAClB,qBAAqB,GACrB,uBAAuB,GACvB,kBAAkB,GAClB,eAAe,GACf,WAAW,GACX,eAAe,GACf,gBAAgB,GAChB,eAAe,GACf,iBAAiB,GACjB,qBAAqB,CAAA;AAExB,MAAM,MAAM,kBAAkB,GAAG;IAChC,IAAI,EAAE,sBAAsB,CAAA;IAC5B,KAAK,EAAE,OAAO,GAAG,MAAM,CAAA;IACvB,OAAO,EAAE,MAAM,CAAA;CACf,CAAA;AAED,qBAAa,iBAAiB;IAC7B,QAAQ,CAAC,WAAW,EAAE,kBAAkB,EAAE,CAAK;IAC/C,iFAAiF;IACjF,QAAQ,CAAC,eAAe,cAAoB;IAC5C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoB;IAEzC,GAAG,CAAC,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAKhF;IAED,kFAAkF;IAClF,KAAK,IAAI,IAAI,CAUZ;CACD;AAID,KAAK,OAAO,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAA;AAE5F,KAAK,aAAa,GAAG;IACpB,0DAA0D;IAC1D,IAAI,EAAE,SAAS,oBAAoB,EAAE,GAAG,IAAI,CAAA;IAC5C,IAAI,EAAE,OAAO,CAAA;IACb,0FAA0F;IAC1F,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IACvB,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAA;IAClC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IACrC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAA;IACX,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAAA;IACjC,MAAM,EAAE,oBAAoB,CAAA;IAC5B,OAAO,EAAE,oBAAoB,GAAG,IAAI,CAAA;IACpC,SAAS,EAAE,MAAM,CAAA;IACjB,EAAE,EAAE,OAAO,CAAA;CACX,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC9B,OAAO,EAAE,SAAS,aAAa,EAAE,CAAA;IACjC,qFAAqF;IACrF,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1B,YAAY,EAAE,OAAO,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IACzC,MAAM,EAAE,kBAAkB,CAAA;CAC1B,CAAA;AAmKD,wBAAgB,eAAe,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,EAAE,SAAS,EAAE,iBAAiB,GAAG,gBAAgB,CAsD7G;AAID,wBAAgB,cAAc,CAC7B,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,SAAS,EAAE,iBAAiB,GAC1B;IAAE,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAwBpD;AAID,4EAA4E;AAC5E,MAAM,MAAM,aAAa,GACtB;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,SAAS,OAAO,EAAE,CAAA;CAAE,GAClD;IAAE,KAAK,EAAE,KAAK,CAAA;CAAE,GAChB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAA;AAElC,MAAM,MAAM,gBAAgB,GAAG,CAC9B,MAAM,EAAE,oBAAoB,EAC5B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,oBAAoB,KACxB,aAAa,CAAA;AAElB,MAAM,MAAM,iBAAiB,GAAG;IAC/B,SAAS,EAAE,iBAAiB,CAAA;IAC5B,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAA;IAChC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,IAAI,EAAE,gBAAgB,CAAA;CACtB,CAAA;AAqHD,wBAAgB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAmG3D"}
+{"version":3,"file":"meta-spec.d.ts","sourceRoot":"","sources":["../src/meta-spec.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EACX,cAAc,EACd,eAAe,EAEf,eAAe,EAEf,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,MAAM,YAAY,CAAA;AAGnB,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AA4BxE,eAAO,MAAM,eAAe,YAAY,CAAA;AAIxC;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,CAoB1E;AAiBD,wDAAwD;AACxD,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,EAAE,CAQ/D;AASD,MAAM,MAAM,sBAAsB,GAC/B,sBAAsB,GACtB,kBAAkB,GAClB,qBAAqB,GACrB,uBAAuB,GACvB,wBAAwB,GACxB,kBAAkB,GAClB,kBAAkB,GAClB,eAAe,GACf,WAAW,GACX,eAAe,GACf,gBAAgB,GAChB,eAAe,GACf,iBAAiB,GACjB,yBAAyB,GACzB,oBAAoB,GACpB,qBAAqB,GACrB,aAAa,CAAA;AAEhB,MAAM,MAAM,kBAAkB,GAAG;IAChC,IAAI,EAAE,sBAAsB,CAAA;IAC5B,KAAK,EAAE,OAAO,GAAG,MAAM,CAAA;IACvB,OAAO,EAAE,MAAM,CAAA;CACf,CAAA;AAED,qBAAa,iBAAiB;IAC7B,QAAQ,CAAC,WAAW,EAAE,kBAAkB,EAAE,CAAK;IAC/C,iFAAiF;IACjF,QAAQ,CAAC,eAAe,cAAoB;IAC5C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoB;IAEzC,GAAG,CAAC,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAKhF;IAED,kFAAkF;IAClF,KAAK,IAAI,IAAI,CAUZ;CACD;AAID,KAAK,OAAO,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAA;AAE5F,KAAK,aAAa,GAAG;IACpB,0DAA0D;IAC1D,IAAI,EAAE,SAAS,oBAAoB,EAAE,GAAG,IAAI,CAAA;IAC5C,IAAI,EAAE,OAAO,CAAA;IACb,0FAA0F;IAC1F,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IACvB,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAA;IAClC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IACrC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAA;IACX,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAAA;IACjC,MAAM,EAAE,oBAAoB,CAAA;IAC5B,OAAO,EAAE,oBAAoB,GAAG,IAAI,CAAA;IACpC,SAAS,EAAE,MAAM,CAAA;IACjB,EAAE,EAAE,OAAO,CAAA;CACX,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC9B,OAAO,EAAE,SAAS,aAAa,EAAE,CAAA;IACjC,qFAAqF;IACrF,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1B,YAAY,EAAE,OAAO,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IACzC,MAAM,EAAE,kBAAkB,CAAA;CAC1B,CAAA;AA8KD,wBAAgB,eAAe,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,EAAE,SAAS,EAAE,iBAAiB,GAAG,gBAAgB,CAsD7G;AAID;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAY3F;AAID,wBAAgB,cAAc,CAC7B,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,SAAS,EAAE,iBAAiB,GAC1B;IAAE,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAwBpD;AAID,4EAA4E;AAC5E,MAAM,MAAM,aAAa,GACtB;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,SAAS,OAAO,EAAE,CAAA;CAAE,GAClD;IAAE,KAAK,EAAE,KAAK,CAAA;CAAE,GAChB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAA;AAElC,MAAM,MAAM,gBAAgB,GAAG,CAC9B,MAAM,EAAE,oBAAoB,EAC5B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,oBAAoB,KACxB,aAAa,CAAA;AAElB,MAAM,MAAM,iBAAiB,GAAG;IAC/B,SAAS,EAAE,iBAAiB,CAAA;IAC5B,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAA;IAChC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,IAAI,EAAE,gBAAgB,CAAA;CACtB,CAAA;AAqHD,wBAAgB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAmG3D"}