@lovrozagar/honey 0.7.3 → 1.0.0-rc.3

package/src/openapi/json-schema-slot.ts

@@ -1,53 +0,0 @@
-import { sanitizeZodJsonSchema } from "../codegen-sanitize.ts"
-import type { StandardSchemaLike } from "../types.ts"
-
-export type JsonSchemaConverter = (schema: StandardSchemaLike, io?: "input" | "output") => Record<string, unknown>
-
-let converter: JsonSchemaConverter | undefined
-
-export function setJsonSchemaConverter(next: JsonSchemaConverter | undefined): void {
-	converter = next
-}
-
-export function getJsonSchemaConverter(): JsonSchemaConverter | undefined {
-	return converter
-}
-
-type InstanceConverters = {
-	"~standard": {
-		jsonSchema?: Partial<Record<"input" | "output", (params?: unknown) => unknown>>
-		vendor: string
-	}
-	toJsonSchema?: () => unknown
-}
-
-/**
- * The converter used when the full codegen one is not loaded (`@lovrozagar/honey/openapi/spec`
- * on a worker). It uses only what the schema instance carries — Zod 4's Standard JSON Schema
- * and ArkType's `toJsonSchema()` — so it pulls in no validator package. A node JSON Schema
- * cannot express degrades to `{}`, never the whole schema.
- */
-export function instanceJsonSchema(
-	schema: StandardSchemaLike,
-	io: "input" | "output" = "output",
-): Record<string, unknown> {
-	const s = schema as unknown as InstanceConverters
-	try {
-		const fromStandard = s["~standard"].jsonSchema?.[io]
-		if (typeof fromStandard === "function") {
-			const result = fromStandard({ libraryOptions: { unrepresentable: "any" }, target: "draft-2020-12" })
-			if (result !== null && typeof result === "object") {
-				return s["~standard"].vendor === "zod"
-					? sanitizeZodJsonSchema(result as Record<string, unknown>)
-					: (result as Record<string, unknown>)
-			}
-		}
-		if (typeof s.toJsonSchema === "function") {
-			const result = s.toJsonSchema()
-			if (result !== null && typeof result === "object") return result as Record<string, unknown>
-		}
-	} catch {
-		/* the schema cannot describe itself — an unconstrained schema is the honest answer */
-	}
-	return {}
-}

package/src/openapi/register.ts

@@ -1,23 +0,0 @@
-import { generateManifest, generateOpenApi } from "../codegen.ts"
-import { toYaml } from "../yaml.ts"
-import { scalar } from "./scalar.ts"
-import { artifactResponse, toServedArtifact } from "./serve.ts"
-import { swagger } from "./swagger.ts"
-import { registerOpenApiRuntime } from "./spec-factory.ts"
-
-export function enableOpenApi(): void {
-	registerOpenApiRuntime({
-		artifactResponse,
-		docsUi: (kind, specUrl) => (kind === "swagger" ? swagger({ url: specUrl }) : scalar({ url: specUrl })),
-		/* served artifacts follow the document's visibility policy and never fail on one schema */
-		generateManifest: (app, options) =>
-			Promise.resolve(generateManifest(app as never, { visibility: "published", ...options })),
-		generateOpenApi: (app, options) => generateOpenApi(app as never, { onSchemaError: "warn", ...options }),
-		toServedArtifact,
-		toYaml,
-	})
-}
-
-enableOpenApi()
-
-export { spec } from "./spec.ts"

package/src/openapi/scalar.ts

@@ -1,34 +0,0 @@
-import type { TypedResponse } from "../response.ts"
-import { docsPage, escapeAttribute, inlineJson, SCALAR } from "./docs-page.ts"
-
-type ScalarOptions = {
-	url: string
-	[key: string]: unknown
-}
-
-export function scalar(
-	options: ScalarOptions,
-): (ctx: {
-	res: { html(sk: "ok", body: string, opts?: { headers?: Record<string, string> }): TypedResponse }
-}) => TypedResponse {
-	const { url, ...rest } = options
-	const config = inlineJson({ url, ...rest })
-
-	return docsPage(
-		(nonce) => `<!DOCTYPE html>
-<html>
-<head>
-  <meta charset="utf-8" />
-  <meta name="viewport" content="width=device-width, initial-scale=1" />
-  <title>API Reference</title>
-</head>
-<body>
-  <div id="app"></div>
-  <script src="${SCALAR.js.url}" integrity="${SCALAR.js.integrity}" crossorigin="anonymous"></script>
-  <script nonce="${escapeAttribute(nonce)}">
-    Scalar.createApiReference(document.getElementById("app"), ${config})
-  </script>
-</body>
-</html>`,
-	)
-}

package/src/openapi/serve.ts

@@ -1,39 +0,0 @@
-/**
- * Serving side of `app.openapi()` and `app.manifest()`: serialize a document once, tag it, and
- * answer conditional requests. Part of the lazily loaded OpenAPI feature, so none of this sits
- * in the core bundle.
- */
-import { ifNoneMatchHits } from "../etag.ts"
-import type { ServedArtifact } from "./spec-factory.ts"
-
-const encoder = new TextEncoder()
-
-/** Base64url of the first 16 bytes of SHA-256, quoted: a strong validator for the exact bytes. */
-async function entityTag(body: string): Promise<string> {
-	const hash = new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(body))).subarray(0, 16)
-	let binary = ""
-	for (let i = 0; i < hash.length; i++) binary += String.fromCharCode(hash[i])
-	return `"${btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "")}"`
-}
-
-/** Serialize `value` once; the result is cached per route epoch by the caller. */
-export async function toServedArtifact(body: string, contentType: string): Promise<ServedArtifact> {
-	return { body, contentType, etag: await entityTag(body) }
-}
-
-/**
- * The response for a served artifact. Clients revalidate (`no-cache`) rather than reuse a stale
- * document after a deploy; an unchanged document costs a 304.
- */
-export function artifactResponse(request: Request, artifact: ServedArtifact): Response {
-	const headers = {
-		"cache-control": "no-cache",
-		"content-type": artifact.contentType,
-		etag: artifact.etag,
-		"x-content-type-options": "nosniff",
-	}
-	if (ifNoneMatchHits(request.headers.get("if-none-match"), artifact.etag)) {
-		return new Response(null, { headers, status: 304 })
-	}
-	return new Response(artifact.body, { headers })
-}

package/src/openapi/spec-factory.ts

@@ -1,100 +0,0 @@
-/** Slot for runtime spec/manifest generation. Filled by `import "@lovrozagar/honey/openapi"`. */
-
-export type OpenApiGenerate = (
-	app: unknown,
-	options: {
-		filterRoutes?: (route: { meta: unknown; method: string; path: string }) => boolean
-		info: { description?: string; title: string; version: string }
-		invalidate?: "error" | "off" | "warn" | { entityKey?: string; level?: "error" | "off" | "warn" }
-		onSchemaError?: "throw" | "warn"
-		profile?: string
-		securitySchemes?: Record<string, unknown>
-	},
-) => Promise<unknown>
-
-export type ManifestGenerate = (
-	app: unknown,
-	options?: {
-		filterRoutes?: (route: { meta: unknown; method: string; path: string }) => boolean
-		visibility?: "all" | "published"
-	},
-) => Promise<unknown>
-
-export type YamlGenerate = (value: unknown) => string
-
-import type { HoneyRes } from "../response.ts"
-
-export type DocsUi = (
-	kind: "scalar" | "swagger",
-	specUrl: string,
-) => (ctx: { res: HoneyRes }) => Response | Promise<Response>
-
-/** A served document, serialized once per route epoch: the bytes, their type and a strong ETag. */
-export type ServedArtifact = { body: string; contentType: string; etag: string }
-
-export type OpenApiRuntime = {
-	/** Answer a request for a served artifact: `ETag`, `Cache-Control`, and 304 on a match. */
-	artifactResponse: (request: Request, artifact: ServedArtifact) => Response
-	docsUi: DocsUi
-	generateManifest: ManifestGenerate
-	generateOpenApi: OpenApiGenerate
-	toServedArtifact: (body: string, contentType: string) => Promise<ServedArtifact>
-	toYaml: YamlGenerate
-}
-
-const MISSING = 'Runtime OpenAPI/manifest generation requires `import "@lovrozagar/honey/openapi"` in the app entry.'
-
-let runtime: OpenApiRuntime | undefined
-
-export function registerOpenApiRuntime(next: OpenApiRuntime): void {
-	runtime = next
-}
-
-export function resetOpenApiRuntime(): void {
-	runtime = undefined
-}
-
-export function getOpenApiRuntime(): OpenApiRuntime {
-	if (!runtime) throw new Error(MISSING)
-	return runtime
-}
-
-export function tryGetOpenApiRuntime(): OpenApiRuntime | undefined {
-	return runtime
-}
-
-/**
- * Memoize `compute` per route epoch. A failure is cached too, until the routes change: a
- * document that cannot be generated fails every request the same way instead of re-running the
- * whole generation per request.
- */
-export function epochCached<T>(epochOf: () => number, compute: () => Promise<T>): () => Promise<T> {
-	let entry: { epoch: number; value: Promise<T> } | null = null
-	return () => {
-		const epoch = epochOf()
-		if (entry === null || entry.epoch !== epoch) {
-			const value = Promise.resolve().then(compute)
-			/* handled here so a failure no request is awaiting yet is never an unhandled rejection */
-			value.catch(() => {})
-			entry = { epoch, value }
-		}
-		return entry.value
-	}
-}
-
-const APP = Symbol.for("honey.app")
-
-/**
- * Bind an internal handler (`spec()`, docs UIs) to the app serving it. Returns a new function
- * per app, so one `spec()` handler mounted on two apps documents each of them — binding onto
- * the shared function object would make the second mount throw or steal the first.
- */
-export function bindInternalHandler<F extends (ctx: never, app?: unknown) => unknown>(fn: F, app: unknown): F {
-	const bound = ((ctx: never) => fn(ctx, app)) as unknown as F
-	for (const key of Reflect.ownKeys(fn)) {
-		if (typeof key !== "symbol" || key === APP) continue
-		Object.defineProperty(bound, key, { value: (fn as unknown as Record<symbol, unknown>)[key] })
-	}
-	Object.defineProperty(bound, APP, { value: app })
-	return bound
-}

package/src/openapi/spec.ts

@@ -1,74 +0,0 @@
-import type { TypedResponse } from "../response.ts"
-import type { DefaultMeta } from "../types.ts"
-import { generateOpenApiFromTree, type OpenApiRouteInfo } from "./document.ts"
-import { tryGetOpenApiRuntime } from "./spec-factory.ts"
-
-type SpecOptions<TMeta = Record<string, unknown> | null> = {
-	description?: string
-	filterRoutes?: (route: OpenApiRouteInfo<DefaultMeta & TMeta>) => boolean
-	/** Named metaSpec profile selecting which emitted keys this document carries */
-	profile?: string
-	securitySchemes?: Record<string, unknown>
-	title: string
-	version: string
-}
-
-type SpecCtx = { res: { raw(response: Response): TypedResponse } }
-
-type Cached = { body: Promise<string>; epoch: number }
-
-const JSON_HEADERS = { "content-type": "application/json; charset=utf-8" }
-
-function appEpoch(app: object): number {
-	return (app as { _epoch?: number })._epoch ?? 0
-}
-
-/**
- * Serve an OpenAPI document for the app the handler is mounted on.
- *
- * Walks the live route graph. Schemas are converted with the full codegen converter when
- * `@lovrozagar/honey/openapi` is loaded, and otherwise with what the schema instances carry
- * (Zod 4, ArkType), so a worker bundle still documents bodies and parameters. The serialized
- * document is cached per app and rebuilt when routes change; a failed build is cached for the
- * same route graph too, so a broken schema costs one build, not one per request.
- */
-export function spec<TMeta = Record<string, unknown> | null>(
-	options: SpecOptions<TMeta>,
-): (ctx: SpecCtx, app?: unknown) => Promise<TypedResponse> {
-	const cache = new WeakMap<object, Cached>()
-	const info = { description: options.description, title: options.title, version: options.version }
-
-	const build = async (app: object): Promise<string> => {
-		const generateOptions = {
-			filterRoutes: options.filterRoutes as ((route: OpenApiRouteInfo) => boolean) | undefined,
-			info,
-			/* a served document is not an authoring moment — the check belongs to `honey generate` */
-			invalidate: "off" as const,
-			profile: options.profile,
-			securitySchemes: options.securitySchemes,
-		}
-		const runtime = tryGetOpenApiRuntime()
-		const document = runtime
-			? await runtime.generateOpenApi(app, { ...generateOptions, onSchemaError: "warn" })
-			: generateOpenApiFromTree(app, generateOptions)
-		return JSON.stringify(document)
-	}
-
-	const handler = async (ctx: SpecCtx, bound?: unknown): Promise<TypedResponse> => {
-		const app = (bound ?? Object.getOwnPropertyDescriptor(handler, Symbol.for("honey.app"))?.value) as
-			| object
-			| undefined
-		if (app === undefined) {
-			throw new Error("spec(): the handler is not mounted on an app — register it with app.get(path, spec(...))")
-		}
-		const epoch = appEpoch(app)
-		let entry = cache.get(app)
-		if (entry === undefined || entry.epoch !== epoch) {
-			entry = { body: build(app), epoch }
-			cache.set(app, entry)
-		}
-		return ctx.res.raw(new Response(await entry.body, { headers: JSON_HEADERS }))
-	}
-	Object.defineProperty(handler, Symbol.for("honey.internal"), { value: true })
-	return handler
-}

package/src/openapi/swagger.ts

@@ -1,35 +0,0 @@
-import type { TypedResponse } from "../response.ts"
-import { docsPage, escapeAttribute, inlineJson, SWAGGER_UI } from "./docs-page.ts"
-
-type SwaggerOptions = {
-	url: string
-	[key: string]: unknown
-}
-
-export function swagger(
-	options: SwaggerOptions,
-): (ctx: {
-	res: { html(sk: "ok", body: string, opts?: { headers?: Record<string, string> }): TypedResponse }
-}) => TypedResponse {
-	const { url, ...rest } = options
-	const config = inlineJson({ dom_id: "#swagger-ui", url, ...rest })
-
-	return docsPage(
-		(nonce) => `<!DOCTYPE html>
-<html>
-<head>
-  <meta charset="utf-8" />
-  <meta name="viewport" content="width=device-width, initial-scale=1" />
-  <title>Swagger UI</title>
-  <link rel="stylesheet" href="${SWAGGER_UI.css.url}" integrity="${SWAGGER_UI.css.integrity}" crossorigin="anonymous" />
-</head>
-<body>
-  <div id="swagger-ui"></div>
-  <script src="${SWAGGER_UI.js.url}" integrity="${SWAGGER_UI.js.integrity}" crossorigin="anonymous"></script>
-  <script nonce="${escapeAttribute(nonce)}">
-    SwaggerUIBundle(${config})
-  </script>
-</body>
-</html>`,
-	)
-}

package/src/pattern.ts

@@ -1,245 +0,0 @@
-/**
- * The one route-pattern grammar. Registration, the router tree, scope matching, codegen
- * selectors and OpenAPI paths all consume the parsed form; nothing re-derives params from
- * a pattern string with its own regex.
- *
- *     pattern  = "/" | ("/" segment)+ ["/"]
- *     segment  = static | param | wildcard
- *     param    = ":" name ["?"]        optional only as the last segment
- *     wildcard = "*" [name]            last segment only; unnamed is called "*"
- *     name     = [A-Za-z_$][A-Za-z0-9_$-]*
- *
- * Empty segments are dropped (`//a` is `/a`), a trailing slash is not significant, and a
- * pattern without a leading slash gets one. `.` and `..` segments are rejected.
- */
-
-import { encodeSegment } from "./request-path.ts"
-
-export type StaticSegment = { readonly k: "static"; readonly v: string }
-export type ParamSegment = { readonly k: "param"; readonly n: string; readonly o: boolean }
-export type WildcardSegment = { readonly k: "wildcard"; readonly n: string }
-export type Segment = StaticSegment | ParamSegment | WildcardSegment
-
-/** `METHOD /canonical/pattern` — stable identity of a route across apps, trees and codegen. */
-export type RouteId = string
-
-const NAME = /^[A-Za-z_$][A-Za-z0-9_$-]*$/
-const DOT_SEGMENT = /^(?:\.|%2e){1,2}$/i
-
-/** Name given to a `*` wildcard without a name. */
-export const UNNAMED_WILDCARD = "*"
-
-function invalid(path: string, why: string): never {
-	throw new Error(`Invalid route pattern "${path}": ${why}`)
-}
-
-export function parsePattern(path: string): Segment[] {
-	if (typeof path !== "string") invalid(String(path), "must be a string")
-	if (path.includes("#")) invalid(path, "fragments are not part of a route pattern")
-	const raw = path.split("/")
-	const segments: Segment[] = []
-	const names = new Set<string>()
-	for (let i = 0; i < raw.length; i++) {
-		const seg = raw[i]
-		if (seg === "") continue
-		/* `%2e` is a dot to every URL parser, so `/%2e%2e` can never be requested either */
-		if (DOT_SEGMENT.test(seg)) invalid(path, `"${seg}" segments are not allowed`)
-		const c = seg.charCodeAt(0)
-		if (c === 58 /* : */) {
-			const optional = seg.endsWith("?")
-			const name = optional ? seg.slice(1, -1) : seg.slice(1)
-			if (!NAME.test(name)) {
-				invalid(
-					path,
-					`parameter ":${name}" is not a valid name (letters, digits, "_", "$" and "-"; it takes the whole segment)`,
-				)
-			}
-			if (names.has(name)) invalid(path, `parameter ":${name}" appears twice`)
-			names.add(name)
-			segments.push({ k: "param", n: name, o: optional })
-			continue
-		}
-		if (c === 42 /* * */) {
-			const name = seg.length > 1 ? seg.slice(1) : UNNAMED_WILDCARD
-			if (name !== UNNAMED_WILDCARD && !NAME.test(name)) {
-				invalid(path, `wildcard "*${name}" is not a valid name`)
-			}
-			if (names.has(name)) invalid(path, `"${name}" appears twice`)
-			names.add(name)
-			segments.push({ k: "wildcard", n: name })
-			continue
-		}
-		if (seg.includes("?")) invalid(path, "query strings are not part of a route pattern")
-		/* the request path is percent-encoded the way URL parsing encodes it; so is a literal */
-		segments.push({ k: "static", v: encodeSegment(seg) })
-	}
-	for (let i = 0; i < segments.length - 1; i++) {
-		const s = segments[i]
-		if (s.k === "wildcard") invalid(path, "a wildcard must be the last segment")
-		if (s.k === "param" && s.o) invalid(path, "an optional parameter must be the last segment")
-	}
-	return segments
-}
-
-export function formatSegment(seg: Segment): string {
-	if (seg.k === "static") return seg.v
-	if (seg.k === "param") return `:${seg.n}${seg.o ? "?" : ""}`
-	return seg.n === UNNAMED_WILDCARD ? "*" : `*${seg.n}`
-}
-
-/** Canonical pattern string: leading slash, no empty segments, no trailing slash. */
-export function canonical(segments: readonly Segment[]): string {
-	if (segments.length === 0) return "/"
-	let out = ""
-	for (const seg of segments) out += `/${formatSegment(seg)}`
-	return out
-}
-
-/** Parse and re-print — throws on anything the grammar cannot express. */
-export function normalizePattern(path: string): string {
-	return canonical(parsePattern(path))
-}
-
-/** Join two patterns: `joinPatterns("/api/", "users")` is `/api/users`. */
-export function joinPatterns(base: string, path: string): string {
-	const b = parsePattern(base)
-	const p = parsePattern(path)
-	if (b.length > 0) {
-		const last = b[b.length - 1]
-		if (last.k === "wildcard" || (last.k === "param" && last.o)) {
-			if (p.length > 0) invalid(`${base}${path}`, "cannot append to a wildcard or optional parameter")
-		}
-	}
-	/* re-parse: a name used on both sides (`/:id` + `/:id`) is only caught on the whole pattern */
-	return normalizePattern(canonical([...b, ...p]))
-}
-
-/**
- * Concrete variants of a pattern: an optional last parameter yields the pattern with and
- * without it. Every other pattern is its own single variant.
- */
-export function expandOptional(segments: readonly Segment[]): Segment[][] {
-	const last = segments[segments.length - 1]
-	if (last !== undefined && last.k === "param" && last.o) {
-		return [segments.slice(0, -1), [...segments.slice(0, -1), { k: "param", n: last.n, o: false }]]
-	}
-	return [[...segments]]
-}
-
-export function isStaticPattern(segments: readonly Segment[]): boolean {
-	for (const s of segments) if (s.k !== "static") return false
-	return true
-}
-
-/** Parameter and wildcard names, in order. */
-export function patternParams(segments: readonly Segment[]): string[] {
-	const out: string[] = []
-	for (const s of segments) if (s.k !== "static") out.push(s.n)
-	return out
-}
-
-export function routeId(method: string, pattern: string): RouteId {
-	return `${method} ${pattern}`
-}
-
-/** Split a RouteId back into method and canonical pattern. */
-export function splitRouteId(id: RouteId): { method: string; pattern: string } {
-	const sp = id.indexOf(" ")
-	return { method: id.slice(0, sp), pattern: id.slice(sp + 1) }
-}
-
-/** OpenAPI path template: `:id` and named wildcards become `{name}`. */
-export function toOpenApiTemplate(segments: readonly Segment[]): string {
-	if (segments.length === 0) return "/"
-	let out = ""
-	for (const s of segments) {
-		if (s.k === "static") out += `/${s.v}`
-		else if (s.k === "param") out += `/{${s.n}}`
-		else out += s.n === UNNAMED_WILDCARD ? "/{wildcard}" : `/{${s.n}}`
-	}
-	return out
-}
-
-/*
- * Scopes. `app.use("/admin", mw)` guards request paths: a path is inside the scope when its
- * leading segments match the scope pattern — static segments literally, `:param` any one
- * segment, `*` and an optional last param everything below. The scope uses the route
- * grammar, so `/orgs/:id` and `/admin/*` mean what they mean in a route.
- */
-
-/** How much of a route a scope covers: every path it serves, none, or only some. */
-export type ScopeCoverage = "all" | "none" | "some"
-
-function coverVariant(route: readonly Segment[], scope: readonly Segment[]): ScopeCoverage {
-	let uncertain = false
-	for (let i = 0; i < scope.length; i++) {
-		const s = scope[i] as Segment
-		/* a wildcard or optional last param covers everything at and below this depth */
-		if (s.k === "wildcard" || (s.k === "param" && s.o)) return uncertain ? "some" : "all"
-		const r = route[i]
-		/* the route's paths end before the scope's do */
-		if (r === undefined) return "none"
-		/* a route wildcard serves paths both inside and outside the rest of the scope */
-		if (r.k === "wildcard") return "some"
-		if (r.k === "static") {
-			if (s.k === "static" && s.v !== r.v && safeDecode(r.v) !== safeDecode(s.v)) return "none"
-			continue
-		}
-		/* route param against a scope literal: inside the scope only when the value matches */
-		if (s.k === "static") uncertain = true
-	}
-	return uncertain ? "some" : "all"
-}
-
-function combine(a: ScopeCoverage, b: ScopeCoverage): ScopeCoverage {
-	return a === b ? a : "some"
-}
-
-/**
- * Decide at registration time whether a scope covers a route. `"some"` means the answer
- * depends on the request path (a route param or wildcard can land inside the scope), so the
- * scope's middleware is guarded by {@link pathInScope} at request time.
- */
-export function scopeCoverage(route: readonly Segment[], scope: readonly Segment[]): ScopeCoverage {
-	let out: ScopeCoverage | undefined
-	for (const rv of expandOptional(route)) {
-		const c = coverVariant(rv, scope)
-		out = out === undefined ? c : combine(out, c)
-	}
-	return out ?? "none"
-}
-
-function safeDecode(s: string): string {
-	if (s.indexOf("%") === -1) return s
-	try {
-		return decodeURIComponent(s)
-	} catch {
-		return s
-	}
-}
-
-/**
- * Is a request path inside a scope? Splits the path the way the router does (empty segments
- * dropped) and compares each segment both as sent and percent-decoded, so a route param that
- * decodes to a scoped literal is guarded exactly like the literal.
- */
-export function pathInScope(path: string, scope: readonly Segment[]): boolean {
-	let pos = 0
-	const len = path.length
-	for (let i = 0; i < scope.length; i++) {
-		const s = scope[i] as Segment
-		if (s.k === "wildcard" || (s.k === "param" && s.o)) return true
-		while (pos < len && path.charCodeAt(pos) === 47) pos++
-		if (pos >= len) return false
-		let end = path.indexOf("/", pos)
-		if (end === -1) end = len
-		if (s.k === "static") {
-			const seg = path.substring(pos, end)
-			/* both sides decoded: a literal is stored encoded (`%C3%A9`), and a request may spell the
-			 * same bytes with lowercase escapes (`%c3%a9`) or raw */
-			if (seg !== s.v && safeDecode(seg) !== safeDecode(s.v)) return false
-		}
-		pos = end
-	}
-	return true
-}

package/src/peer.ts

@@ -1,53 +0,0 @@
-/**
- * The address of the TCP peer of a request, as the runtime reports it. Adapters register it;
- * `ctx.ip` reads it through the app's trust setting (`trust.ts`).
- *
- * - Node (`serve()` from `/node`): the socket's `remoteAddress`
- * - Bun: `server.requestIP(req)`, whether `serve()` or `Bun.serve({ fetch: app.fetch })` passed the server
- * - Deno: `info.remoteAddr`, whether `serve()` or `Deno.serve(app.fetch)` passed the info
- * - Cloudflare Workers: `CF-Connecting-IP`, which the edge sets and a client cannot
- */
-
-type PeerSource = string | (() => string | null)
-
-const peers = new WeakMap<object, PeerSource>()
-
-/** A request object can report its own peer under this key (the Node shim does, allocation-free). */
-export const PEER_ADDRESS = Symbol.for("honey.peerAddress")
-
-/** Called by adapters before `app.fetch`. A function is called at most once, on first read. */
-export function setPeerAddress(req: Request, address: PeerSource): void {
-	peers.set(req, address)
-}
-
-function isWorkers(): boolean {
-	return (globalThis as { navigator?: { userAgent?: string } }).navigator?.userAgent === "Cloudflare-Workers"
-}
-
-type BunServerLike = { requestIP?: (req: Request) => { address?: string } | null }
-
-export function peerAddressOf(req: Request, env: unknown): string | null {
-	const own = (req as unknown as Record<symbol, unknown>)[PEER_ADDRESS]
-	if (typeof own === "string") return own
-	const registered = peers.get(req)
-	if (registered !== undefined) {
-		if (typeof registered === "string") return registered === "" ? null : registered
-		const resolved = registered()
-		peers.set(req, resolved ?? "")
-		return resolved
-	}
-	if (env !== null && typeof env === "object") {
-		const e = env as BunServerLike & { server?: BunServerLike; remoteAddr?: { hostname?: unknown } }
-		const server = typeof e.requestIP === "function" ? e : e.server
-		if (server !== undefined && typeof server.requestIP === "function") {
-			try {
-				return server.requestIP(req)?.address ?? null
-			} catch {
-				return null
-			}
-		}
-		if (typeof e.remoteAddr?.hostname === "string") return e.remoteAddr.hostname
-	}
-	if (isWorkers()) return req.headers.get("cf-connecting-ip")
-	return null
-}