@lovrozagar/honey 0.7.3 → 1.0.0-rc.1

package/dist/testing/testing.d.ts

@@ -0,0 +1,42 @@
+type FetchApp<TEnv> = {
+    fetch(request: Request, env: TEnv): Response | Promise<Response>;
+};
+export type TestRequestOptions = {
+    /** Sent as `multipart/form-data`, one field per entry. */
+    form?: Record<string, string>;
+    headers?: Record<string, string>;
+    /** The peer address the request comes from, as a server adapter would report it (`ctx.ip`). In process only. */
+    ip?: string;
+    /** Sent as `application/json`; wins over `form`. */
+    json?: unknown;
+    /** Set on the URL's query, one parameter per entry. */
+    search?: Record<string, string>;
+};
+export type TestClientOptions<TEnv> = {
+    /** Keep each response's `Set-Cookie` and send the cookies on later requests. Default off. */
+    cookies?: boolean;
+    /** Handed to the app as `ctx.env`. */
+    env: TEnv;
+    /** The default peer address for every request; a request's own `ip` wins. In process only. */
+    ip?: string;
+    /**
+     * `"fetch"` (default) calls `app.fetch` in process. `"serve"` serves the app with `serve(app)` on a free local
+     * port, started on first use, and sends real HTTP through the runtime's adapter; `close()` stops it.
+     */
+    transport?: "fetch" | "serve";
+};
+export type TestClient = {
+    delete(path: string, options?: TestRequestOptions): Promise<Response>;
+    get(path: string, options?: TestRequestOptions): Promise<Response>;
+    head(path: string, options?: TestRequestOptions): Promise<Response>;
+    options(path: string, options?: TestRequestOptions): Promise<Response>;
+    patch(path: string, options?: TestRequestOptions): Promise<Response>;
+    post(path: string, options?: TestRequestOptions): Promise<Response>;
+    put(path: string, options?: TestRequestOptions): Promise<Response>;
+    /** Any method, a custom one included. */
+    request(method: string, path: string, options?: TestRequestOptions): Promise<Response>;
+    /** Stop the server `transport: "serve"` started; nothing otherwise. */
+    close(): Promise<void>;
+};
+export declare function testClient<TEnv>(app: FetchApp<TEnv>, options: TestClientOptions<TEnv>): TestClient;
+export {};

package/dist/testing/testing.js

@@ -0,0 +1,101 @@
+/**
+ * `testClient(app, options)`: requests against an app from a test, each answered as the raw Web `Response`
+ * (`@lovrozagar/honey/testing`). By default it calls `app.fetch` in process; `transport: "serve"` serves the app
+ * through `serve(app)` on a free local port and sends real HTTP, so the runtime's adapter (its request view, its
+ * response writer, the socket's peer) is in the path. An opt-in cookie jar carries `Set-Cookie` into the next
+ * request. A plain function: nothing registers itself (H23).
+ */
+import { serve } from "../adapters/serve.js";
+import { PEER_ADDRESS } from "../context/peer.js";
+const IN_PROCESS_ORIGIN = "http://localhost";
+function buildRequest(method, path, origin, options) {
+    const url = new URL(path, origin);
+    for (const [key, value] of Object.entries(options.search ?? {}))
+        url.searchParams.set(key, value);
+    const headers = new Headers(options.headers);
+    let body = null;
+    if (options.json !== undefined) {
+        headers.set("content-type", "application/json");
+        body = JSON.stringify(options.json);
+    }
+    else if (options.form !== undefined) {
+        const form = new FormData();
+        for (const [key, value] of Object.entries(options.form))
+            form.append(key, value);
+        body = form;
+    }
+    return new Request(url, { body, headers, method });
+}
+/** A `Set-Cookie` line's name and value, and whether it expires the cookie (`Max-Age<=0`, or `Expires` in the past). */
+function parseSetCookie(line, now) {
+    const [pair = "", ...attributes] = line.split(";");
+    const eq = pair.indexOf("=");
+    const name = pair.slice(0, eq).trim();
+    if (eq === -1 || name === "")
+        return null;
+    let maxAge = null;
+    let expires = null;
+    for (const attribute of attributes) {
+        const at = attribute.indexOf("=");
+        const key = (at === -1 ? attribute : attribute.slice(0, at)).trim().toLowerCase();
+        const value = at === -1 ? "" : attribute.slice(at + 1).trim();
+        if (key === "max-age" && /^-?\d+$/.test(value))
+            maxAge = Number(value);
+        else if (key === "expires" && !Number.isNaN(Date.parse(value)))
+            expires = Date.parse(value);
+    }
+    /* Max-Age wins over Expires (RFC 6265 §5.3) */
+    const expired = maxAge === null ? expires !== null && expires <= now : maxAge <= 0;
+    return { expired, name, value: pair.slice(eq + 1).trim() };
+}
+export function testClient(app, options) {
+    const jar = new Map();
+    let server = null;
+    const send = async (request, ip) => {
+        if (options.transport === "serve") {
+            server ??= serve(app, { env: options.env, hostname: "127.0.0.1", port: 0 });
+            return fetch(request((await server).url), { redirect: "manual" });
+        }
+        const req = request(IN_PROCESS_ORIGIN);
+        if (ip !== undefined)
+            Object.defineProperty(req, PEER_ADDRESS, { value: ip });
+        return app.fetch(req, options.env);
+    };
+    const call = async (method, path, given = {}) => {
+        const headers = { ...given.headers };
+        if (options.cookies === true && jar.size > 0) {
+            const kept = [...jar].map(([name, value]) => `${name}=${value}`).join("; ");
+            headers.cookie = headers.cookie === undefined ? kept : `${headers.cookie}; ${kept}`;
+        }
+        const response = await send((origin) => buildRequest(method, path, origin, { ...given, headers }), given.ip ?? options.ip);
+        if (options.cookies === true) {
+            const now = Date.now();
+            for (const line of response.headers.getSetCookie()) {
+                const cookie = parseSetCookie(line, now);
+                if (cookie === null)
+                    continue;
+                if (cookie.expired)
+                    jar.delete(cookie.name);
+                else
+                    jar.set(cookie.name, cookie.value);
+            }
+        }
+        return response;
+    };
+    return {
+        async close() {
+            const started = server;
+            server = null;
+            if (started !== null)
+                await (await started).close();
+        },
+        delete: (path, given) => call("DELETE", path, given),
+        get: (path, given) => call("GET", path, given),
+        head: (path, given) => call("HEAD", path, given),
+        options: (path, given) => call("OPTIONS", path, given),
+        patch: (path, given) => call("PATCH", path, given),
+        post: (path, given) => call("POST", path, given),
+        put: (path, given) => call("PUT", path, given),
+        request: (method, path, given) => call(method, path, given),
+    };
+}

package/dist/validation/content-type.d.ts

@@ -0,0 +1,21 @@
+import { type BodyParser } from "../response/media-type.ts";
+/** The body sources a route may declare; any other key is a non-body source. */
+type BodySchemas = {
+    readonly [source: string]: unknown;
+    readonly binary?: unknown;
+    readonly form?: unknown;
+    readonly json?: unknown;
+};
+/**
+ * Throws when `schemas` declare a body that `methods` at `path` can never receive (every method
+ * GET or HEAD), or more than one body. A route that also takes another method keeps its schema:
+ * a GET reaching it without a body answers 415.
+ */
+export declare function assertBodySchemaAllowed(schemas: BodySchemas, methods: readonly string[], path: string): void;
+/**
+ * The parser the request's Content-Type selects for the declared body, or `null` when no body is
+ * declared. A missing, malformed or other media type is a 415 `unsupported_media_type`; the body
+ * is never read here.
+ */
+export declare function assertRequestContentType(schemas: BodySchemas, contentType: string | null): BodyParser | null;
+export {};

package/dist/validation/content-type.js

@@ -0,0 +1,42 @@
+/**
+ * A route's declared body against what can reach it. At registration: a json or form schema on a
+ * route only GET or HEAD reach can never be met (Fetch forbids them a body), and a request carries
+ * one body, so json and form are exclusive. Per request: the media type must select the declared
+ * parser, by essence, before the body is read; anything else is a 415.
+ */
+import { EK, HoneyError } from "../errors/error.js";
+import { bodyParserFor } from "../response/media-type.js";
+const BODIES = ["binary", "form", "json"];
+/**
+ * Throws when `schemas` declare a body that `methods` at `path` can never receive (every method
+ * GET or HEAD), or more than one body. A route that also takes another method keeps its schema:
+ * a GET reaching it without a body answers 415.
+ */
+export function assertBodySchemaAllowed(schemas, methods, path) {
+    const declared = BODIES.filter((kind) => schemas[kind] !== undefined);
+    const kind = declared[0];
+    if (kind === undefined)
+        return;
+    const method = methods[0];
+    if (declared.length > 1) {
+        throw new Error(`${method} ${path} declares more than one body (${declared.join(", ")}); a request carries one body.`);
+    }
+    if (!methods.every((m) => m === "GET" || m === "HEAD"))
+        return;
+    throw new Error(`${method} ${path} declares a ${kind} body schema, but ${method} requests have no body. ` +
+        "Validate query data with `search`, or register the route for a method that carries a body.");
+}
+/**
+ * The parser the request's Content-Type selects for the declared body, or `null` when no body is
+ * declared. A missing, malformed or other media type is a 415 `unsupported_media_type`; the body
+ * is never read here.
+ */
+export function assertRequestContentType(schemas, contentType) {
+    if (schemas.json === undefined && schemas.form === undefined)
+        return null;
+    const parser = bodyParserFor(contentType);
+    const accepted = schemas.json !== undefined ? parser === "json" : parser === "multipart" || parser === "urlencoded";
+    if (accepted)
+        return parser;
+    throw new HoneyError({ errorKey: EK.unsupported_media_type, status: "unsupported_media_type" });
+}

package/dist/validation/standard-schema.d.ts

@@ -0,0 +1,41 @@
+/**
+ * The Standard Schema V1 interface: the vendor-neutral contract zod, valibot, arktype and effect
+ * implement. honey validates, converts and types schemas only through it, never through a vendor.
+ */
+export type StandardSchemaIssue = {
+    readonly message: string;
+    readonly path?: ReadonlyArray<PropertyKey | {
+        readonly key: PropertyKey;
+    }> | undefined;
+};
+export type StandardSchemaResult = {
+    readonly issues?: ReadonlyArray<StandardSchemaIssue> | undefined;
+    readonly value?: unknown;
+};
+export type StandardSchemaLike = {
+    readonly "~standard": {
+        readonly types?: {
+            readonly input: unknown;
+            readonly output: unknown;
+        } | undefined;
+        readonly validate: (value: unknown) => Promise<StandardSchemaResult> | StandardSchemaResult;
+        readonly vendor: string;
+        readonly version: number;
+    };
+};
+/** The type a schema produces once it validated a value. */
+export type InferOutput<T> = T extends {
+    readonly "~standard": {
+        readonly types?: infer TTypes;
+    };
+} ? NonNullable<TTypes> extends {
+    readonly output: infer O;
+} ? O : unknown : unknown;
+/** The type a schema accepts as input. */
+export type InferInput<T> = T extends {
+    readonly "~standard": {
+        readonly types?: infer TTypes;
+    };
+} ? NonNullable<TTypes> extends {
+    readonly input: infer I;
+} ? I : unknown : unknown;

package/dist/validation/standard-schema.js

@@ -0,0 +1,5 @@
+/**
+ * The Standard Schema V1 interface: the vendor-neutral contract zod, valibot, arktype and effect
+ * implement. honey validates, converts and types schemas only through it, never through a vendor.
+ */
+export {};

package/dist/validation/validate-input.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Running an input schema: a validator's answer, synchronous when the validator is, and its
+ * issues as field errors. The vendor's own code is read off each issue (`code` from zod and
+ * arktype, `type` from valibot) and mapped through one table, so clients see the same field
+ * error keys whichever validator the server uses.
+ */
+import { type FieldError } from "../errors/error.ts";
+import type { StandardSchemaIssue, StandardSchemaLike } from "./standard-schema.ts";
+/** An issue with its vendor code read and its path flattened to property keys. */
+export type NormalizedIssue = {
+    readonly code: string;
+    readonly message: string;
+    readonly meta: {
+        readonly field?: string;
+    };
+    readonly path: readonly PropertyKey[];
+};
+/** The field error key for a vendor code; a code the table lacks is `field_invalid`. */
+export declare function mapNormalizedCode(code: string): string;
+/** Each issue with its vendor code, its path as property keys and its field named by the last one. */
+export declare function normalizeIssues(issues: ReadonlyArray<StandardSchemaIssue>, vendor: string): NormalizedIssue[];
+/**
+ * Field errors keyed by field: the last path segment, or `unknown` for an issue with no path.
+ * Field names come from the request, so the record has no prototype.
+ */
+export declare function issuesToFieldErrors(issues: readonly NormalizedIssue[], prefix: string): Record<string, FieldError[]>;
+/**
+ * Validate `value` against `schema`: its output, or a promise of it only when the validator
+ * returns one. Issues are a 400 `validation_failed` whose fields carry `prefix` (the source).
+ */
+export declare function runSchema(schema: StandardSchemaLike, value: unknown, prefix: string): unknown;
+type KeyShape = "array" | "natural" | "scalar";
+/** Each key's shape as the schema types it. */
+export type Shape = ReadonlyMap<string, KeyShape>;
+/**
+ * The schema's per-key shapes, from its Standard JSON Schema; `null` when it publishes none.
+ * Computed once per route when the input step is compiled, never per request.
+ */
+export declare function shapeOf(schema: StandardSchemaLike): Shape | null;
+/**
+ * `entries` as one record by the repeated-key policy for `shape` (`null`: every key natural),
+ * dangerous keys dropped. The record has no prototype.
+ */
+export declare function shapedRecord<T>(entries: Iterable<[string, T]>, shape: Shape | null): Record<string, T | T[]>;
+export {};

package/dist/validation/validate-input.js

@@ -0,0 +1,174 @@
+/**
+ * Running an input schema: a validator's answer, synchronous when the validator is, and its
+ * issues as field errors. The vendor's own code is read off each issue (`code` from zod and
+ * arktype, `type` from valibot) and mapped through one table, so clients see the same field
+ * error keys whichever validator the server uses.
+ */
+import { EK, HoneyError } from "../errors/error.js";
+import { dict } from "../routing/tree.js";
+/** Vendor code → field error key: the client contract. */
+const CODE_MAP = {
+    invalid_format: "field_invalid_format",
+    invalid_value: "field_invalid_enum",
+    not_multiple: "field_not_multiple_of",
+    required: "field_required",
+    too_big: "field_too_big",
+    too_long: "field_too_long",
+    too_short: "field_too_short",
+    too_small: "field_too_small",
+    unrecognized: "field_unrecognized_keys",
+};
+/** The field error key for a vendor code; a code the table lacks is `field_invalid`. */
+export function mapNormalizedCode(code) {
+    /* own keys only: a code like `toString` must not find a prototype member */
+    return Object.hasOwn(CODE_MAP, code) ? CODE_MAP[code] : "field_invalid";
+}
+/** The vendor's code on an issue: `code` (zod, arktype), `type` (valibot), else `unknown`. */
+function vendorCode(issue, vendor) {
+    const code = vendor === "valibot" ? issue.type : vendor === "zod" || vendor === "arktype" ? issue.code : undefined;
+    return typeof code === "string" ? code : "unknown";
+}
+function propertyKey(segment) {
+    return typeof segment === "object" ? segment.key : segment;
+}
+/** Each issue with its vendor code, its path as property keys and its field named by the last one. */
+export function normalizeIssues(issues, vendor) {
+    return issues.map((issue) => {
+        const path = issue.path?.map(propertyKey) ?? [];
+        return { code: vendorCode(issue, vendor), message: issue.message, meta: { field: path.at(-1)?.toString() }, path };
+    });
+}
+/**
+ * Field errors keyed by field: the last path segment, or `unknown` for an issue with no path.
+ * Field names come from the request, so the record has no prototype.
+ */
+export function issuesToFieldErrors(issues, prefix) {
+    const fields = dict();
+    for (const issue of issues) {
+        const field = issue.path.at(-1)?.toString() ?? "unknown";
+        const error = {
+            error_key: mapNormalizedCode(issue.code),
+            message: issue.message,
+            path: `${prefix}.${issue.path.join(".")}`,
+        };
+        (fields[field] ??= []).push(error);
+    }
+    return fields;
+}
+function fail(schema, issues, prefix) {
+    throw new HoneyError({
+        errorKey: EK.validation_failed,
+        fields: issuesToFieldErrors(normalizeIssues(issues, schema["~standard"].vendor), prefix),
+        status: "bad_request",
+    });
+}
+function settled(schema, result, prefix) {
+    return result.issues === undefined ? result.value : fail(schema, result.issues, prefix);
+}
+/**
+ * Validate `value` against `schema`: its output, or a promise of it only when the validator
+ * returns one. Issues are a 400 `validation_failed` whose fields carry `prefix` (the source).
+ */
+export function runSchema(schema, value, prefix) {
+    const result = schema["~standard"].validate(value);
+    return result instanceof Promise ? result.then((r) => settled(schema, r, prefix)) : settled(schema, result, prefix);
+}
+/** A key a request must never put on a record a validator sees (H18.13: search and form alike). */
+function dangerous(key) {
+    return key === "__proto__" || key === "constructor" || key === "prototype";
+}
+/* nesting followed before a node counts as natural: a guard against a self-referencing schema */
+const MAX_DEPTH = 8;
+function deref(node, root) {
+    const match = typeof node.$ref === "string" ? /^#\/(\$defs|definitions)\/(.+)$/.exec(node.$ref) : null;
+    if (match === null)
+        return node;
+    const defs = match[1] === "$defs" ? root.$defs : root.definitions;
+    const name = match[2];
+    return defs !== undefined && Object.hasOwn(defs, name) ? defs[name] : node;
+}
+/** One shape from the shapes of a union's branches, or of an intersection's parts. */
+function combined(kinds, intersection) {
+    if (kinds.length === 0)
+        return null;
+    if (intersection)
+        return kinds.includes("array") ? "array" : kinds.includes("scalar") ? "scalar" : null;
+    if (kinds.every((kind) => kind === "array"))
+        return "array";
+    return kinds.every((kind) => kind === "scalar") ? "scalar" : "natural";
+}
+function classify(node, root, depth = 0) {
+    if (depth > MAX_DEPTH)
+        return "natural";
+    const n = deref(node, root);
+    if (typeof n.type === "string")
+        return n.type === "array" ? "array" : "scalar";
+    if (Array.isArray(n.type)) {
+        const types = n.type.filter((t) => t !== "null");
+        return (combined(types.map((t) => (t === "array" ? "array" : "scalar")), false) ?? "natural");
+    }
+    const branches = n.anyOf ?? n.oneOf;
+    if (branches !== undefined) {
+        const kinds = branches.filter((b) => deref(b, root).type !== "null").map((b) => classify(b, root, depth + 1));
+        return combined(kinds, false) ?? "natural";
+    }
+    if (n.allOf !== undefined)
+        return (combined(n.allOf.map((part) => classify(part, root, depth + 1)), true) ?? "natural");
+    return "natural";
+}
+function collectProperties(node, root, out, depth = 0) {
+    if (depth > MAX_DEPTH)
+        return;
+    const n = deref(node, root);
+    for (const key of Object.keys(n.properties ?? {})) {
+        if (!out.has(key))
+            out.set(key, classify(n.properties[key], root));
+    }
+    for (const part of n.allOf ?? [])
+        collectProperties(part, root, out, depth + 1);
+}
+/**
+ * The schema's per-key shapes, from its Standard JSON Schema; `null` when it publishes none.
+ * Computed once per route when the input step is compiled, never per request.
+ */
+export function shapeOf(schema) {
+    let shape = null;
+    const source = schema["~standard"].jsonSchema;
+    if (typeof source?.input === "function") {
+        try {
+            const root = source.input({ libraryOptions: { unrepresentable: "any" }, target: "draft-2020-12" });
+            if (typeof root === "object" && root !== null) {
+                const out = new Map();
+                collectProperties(root, root, out);
+                shape = out;
+            }
+        }
+        catch {
+            /* a schema that cannot describe itself gets the natural shape for every key, as one without jsonSchema */
+            shape = null;
+        }
+    }
+    return shape;
+}
+/**
+ * `entries` as one record by the repeated-key policy for `shape` (`null`: every key natural),
+ * dangerous keys dropped. The record has no prototype.
+ */
+export function shapedRecord(entries, shape) {
+    const all = new Map();
+    for (const [key, value] of entries) {
+        if (dangerous(key))
+            continue;
+        const values = all.get(key);
+        if (values === undefined)
+            all.set(key, [value]);
+        else
+            values.push(value);
+    }
+    const out = dict();
+    for (const [key, values] of all) {
+        const kind = shape?.get(key) ?? "natural";
+        out[key] = kind === "array" ? values : kind === "scalar" || values.length === 1 ? values[0] : values;
+    }
+    return out;
+}

package/dist/validation/validate-output.d.ts

@@ -0,0 +1,34 @@
+import type { MaybePromise } from "../middleware/middleware.ts";
+import type { HeadersCheck } from "../response/response-headers.ts";
+import type { OutputSchemas } from "../routing/output-types.ts";
+import type { StandardSchemaLike } from "./standard-schema.ts";
+/** Whether `.output()` routes check their answers: never, always, or outside production. */
+export type OutputValidationMode = "always" | "dev" | "off";
+type ProcessLike = {
+    readonly env?: {
+        readonly NODE_ENV?: string | undefined;
+    };
+} | undefined;
+/**
+ * Whether `mode` checks answers here. `"dev"` checks unless NODE_ENV is `production`, and checks
+ * nothing where there is no `process` to read it from (Workers): never a cost where it cannot be
+ * turned off.
+ */
+export declare function outputValidationOn(mode: OutputValidationMode, runtime: ProcessLike): boolean;
+/**
+ * Check `data` against the schema for `statusKey`: nothing back when it passes, a promise only for
+ * an async validator. A failure is a 500 `output_validation_failed` naming the status key; the
+ * issues stay server-side.
+ */
+export declare function validateOutput(schema: StandardSchemaLike, statusKey: string, data: unknown): Promise<void> | undefined;
+/** A route's compiled check: the answer back as it was, or the failure. */
+export type OutputCheck = (response: Response) => MaybePromise<Response>;
+/**
+ * The check for a route declaring `schemas`, for an app whose mode is on: `headers`, its declared
+ * headers' check, first, whatever the answer carries. The declared media types are fixed here,
+ * once; `redirect` and `headers` name no body type.
+ */
+export declare function compileOutput(schemas: OutputSchemas, headers: HeadersCheck | null): OutputCheck;
+/** `handler` with `check` on what it answers: synchronously when the handler and the check are. */
+export declare function withOutput(check: OutputCheck, handler: (ctx: object) => MaybePromise<Response>): (ctx: object) => MaybePromise<Response>;
+export {};

package/dist/validation/validate-output.js

@@ -0,0 +1,107 @@
+/**
+ * Checking what a route answers against its `.output()` (off by default). An answer of a media
+ * type the route does not declare is a 500 `output_content_type_mismatch`, compared by exact
+ * essence (H18.2). A JSON body is checked against its status's schema, read from the raw body the
+ * answer was built from, never by cloning it (H18.1); a stream honey produced is never buffered.
+ * Any other declared type is a type contract only (F8). Failures are a 500 that names the status
+ * key and nothing of the issues.
+ */
+import { EK, HoneyError } from "../errors/error.js";
+import { bodyKind } from "../input/body-kind.js";
+import { isProducedStream, rawBodyOf } from "../response/builder.js";
+import { parseMediaType } from "../response/media-type.js";
+import { codeToStatusKey } from "../response/status.js";
+/**
+ * Whether `mode` checks answers here. `"dev"` checks unless NODE_ENV is `production`, and checks
+ * nothing where there is no `process` to read it from (Workers): never a cost where it cannot be
+ * turned off.
+ */
+export function outputValidationOn(mode, runtime) {
+    if (mode !== "dev")
+        return mode === "always";
+    return runtime !== undefined && runtime.env?.NODE_ENV !== "production";
+}
+function failed(statusKey) {
+    return new HoneyError({ errorKey: EK.output_validation_failed, status: "internal_server_error", vars: { statusKey } });
+}
+function checked(result, statusKey) {
+    if (result.issues !== undefined)
+        throw failed(statusKey);
+}
+/**
+ * Check `data` against the schema for `statusKey`: nothing back when it passes, a promise only for
+ * an async validator. A failure is a 500 `output_validation_failed` naming the status key; the
+ * issues stay server-side.
+ */
+export function validateOutput(schema, statusKey, data) {
+    const result = schema["~standard"].validate(data);
+    if (result instanceof Promise)
+        return result.then((r) => checked(r, statusKey));
+    checked(result, statusKey);
+    return undefined;
+}
+// per-process-constant: text-codec
+const decoder = /* @__PURE__ */ new TextDecoder();
+/** The retained body as data: an empty one, as `json(undefined)` writes, is `null`. */
+function parse(raw) {
+    const text = typeof raw === "string" ? raw : decoder.decode(raw);
+    return text.length === 0 ? null : JSON.parse(text);
+}
+/**
+ * The check for a route declaring `schemas`, for an app whose mode is on: `headers`, its declared
+ * headers' check, first, whatever the answer carries. The declared media types are fixed here,
+ * once; `redirect` and `headers` name no body type.
+ */
+export function compileOutput(schemas, headers) {
+    const declared = new Set();
+    for (const key of Object.keys(schemas)) {
+        const mt = key.includes("/") ? parseMediaType(key) : null;
+        if (mt !== null)
+            declared.add(mt.essence);
+    }
+    const json = schemas["application/json"];
+    const body = (response) => {
+        if (bodyKind(response) === "empty")
+            return response;
+        const type = response.headers.get("content-type");
+        if (type === null)
+            return response;
+        const essence = parseMediaType(type)?.essence;
+        if (essence === undefined || !declared.has(essence)) {
+            throw new HoneyError({ errorKey: EK.output_content_type_mismatch, status: "internal_server_error" });
+        }
+        if (essence !== "application/json" || json === undefined || isProducedStream(response))
+            return response;
+        const statusKey = codeToStatusKey[response.status];
+        const schema = statusKey === undefined ? undefined : json[statusKey];
+        if (schema === undefined || schema === true)
+            return response;
+        const raw = rawBodyOf(response);
+        if (raw !== null) {
+            const pending = validateOutput(schema, statusKey, parse(raw));
+            return pending === undefined ? response : pending.then(() => response);
+        }
+        /* a body honey did not build: read a copy, hand the client the original */
+        return response
+            .clone()
+            .json()
+            .then((data) => validateOutput(schema, statusKey, data))
+            .then(() => response);
+    };
+    if (headers === null)
+        return body;
+    return (response) => {
+        const pending = headers(response);
+        return pending === undefined ? body(response) : pending.then(() => body(response));
+    };
+}
+/** `handler` with `check` on what it answers: synchronously when the handler and the check are. */
+export function withOutput(check, handler) {
+    /* a handler that answered nothing is the chain's to report: no check on what is not there */
+    return (ctx) => {
+        const answer = handler(ctx);
+        if (answer instanceof Promise)
+            return answer.then((response) => (response == null ? response : check(response)));
+        return answer == null ? answer : check(answer);
+    };
+}