@mionjs/router 0.13.2 → 0.14.0

package/.dist/esm/src/middlewares/security.js

@@ -0,0 +1,213 @@
+import "../constants.js";
+import { endChain } from "../lib/dispatchError.js";
+import { middleware } from "../lib/handlers.js";
+import { __rt_A0Qb_Ju6MvJU } from "../../.mion/types/A0Qb_Ju6MvJU.js";
+import { __rt_Ky89_Ju6MvJU } from "../../.mion/types/Ky89_Ju6MvJU.js";
+import { __rt_OBOg_Ju6MvJU } from "../../.mion/types/OBOg_Ju6MvJU.js";
+import { __rt_Xhuv_Ju6MvJU } from "../../.mion/types/Xhuv_Ju6MvJU.js";
+import { __rt_mzca_Ju6MvJU } from "../../.mion/types/mzca_Ju6MvJU.js";
+import { __rt_A0Qb_NXjo9wB } from "../../.mion/types/A0Qb_NXjo9wB.js";
+import { __rt_Ky89_NXjo9wB } from "../../.mion/types/Ky89_NXjo9wB.js";
+import { __rt_Xhuv_NXjo9wB } from "../../.mion/types/Xhuv_NXjo9wB.js";
+import { __rt_OBOg_NXjo9wB } from "../../.mion/types/OBOg_NXjo9wB.js";
+import { __rt_A7jnlIr, __rt_Ju6MvJU, __rt_Keofqp1, __rt_NXjo9wB, __rt_tWcwFuM } from "../../.mion/types/rt/KjC1OsUQp4.js";
+import { BUILD_VERSION_HEADER, FatalError, StatusCodes } from "@mionjs/core";
+//#region src/middlewares/security.ts
+/** mion's own response headers the client reads */
+var MION_EXPOSED_HEADERS = ["x-rpc-error", BUILD_VERSION_HEADER];
+var QUERY_METHODS = [
+	"GET",
+	"HEAD",
+	"POST"
+];
+var POST_ONLY = ["POST"];
+/** Place it first: a preflight carries none of the app's headers.
+*  `alwaysRun`, so an error answer still carries the CORS headers. */
+function mionSecurity(options = {}) {
+	const { origins } = options;
+	const cors = options.cors || void 0;
+	const csrfOptions = options.csrf;
+	const csrf = csrfOptions === false ? void 0 : {
+		crossOrigin: csrfOptions?.crossOrigin !== false,
+		methodByIntent: csrfOptions?.methodByIntent !== false
+	};
+	if (cors && origins === void 0) throw new Error("mionSecurity: `cors` needs the `origins` allowed to read answers.");
+	if (cors?.credentials && origins === "*") throw new Error("mionSecurity: `cors.credentials` needs the allowed origins listed, never '*'.");
+	const maxAge = cors?.maxAge === void 0 ? void 0 : String(cors.maxAge);
+	const preflightVary = cors ? ["Origin"] : [];
+	const chainRules = /* @__PURE__ */ new WeakMap();
+	/** Asks only when the answer matters: always with CORS, else a cross-site request with no error yet.
+	*  `null` is a sandboxed page's origin: never trusted. */
+	function prepare(ctx) {
+		const { headers, method } = ctx.request;
+		const origin = headers.get("origin");
+		const sameOrigin = !csrf?.crossOrigin || method === "GET" || method === "HEAD" || method === "OPTIONS" || isPlainlySameOrigin(headers);
+		const matters = !!cors || !sameOrigin && !ctx.response.hasErrors;
+		return {
+			origin,
+			sameOrigin,
+			ask: origin && origin !== "null" && matters ? origin : void 0
+		};
+	}
+	function respond(ctx, origin, trusted, sameOrigin) {
+		const { request, response, executionChain } = ctx;
+		const method = request.method;
+		let rules = chainRules.get(executionChain);
+		if (!rules) chainRules.set(executionChain, rules = describeChain(executionChain, cors));
+		response.headers.set("x-content-type-options", "nosniff");
+		if (response.headers.get("server") === "mionjs") response.headers.delete("server");
+		const vary = method === "OPTIONS" ? preflightVary : rules.vary;
+		if (vary.length) addVary(response.headers, vary);
+		if (cors) {
+			if (origin && trusted) {
+				response.headers.set("access-control-allow-origin", origin);
+				if (cors.credentials) response.headers.set("access-control-allow-credentials", "true");
+				if (method !== "OPTIONS") response.headers.set("access-control-expose-headers", rules.exposeHeaders);
+				else if (request.headers.has("access-control-request-method")) {
+					response.headers.set("access-control-allow-methods", rules.allowMethods);
+					response.headers.set("access-control-allow-headers", rules.allowHeaders);
+					if (maxAge !== void 0) response.headers.set("access-control-max-age", maxAge);
+				}
+			}
+		}
+		if (hasUnclearLength(request.headers)) {
+			response.headers.set("connection", "close");
+			return new FatalError({
+				statusCode: StatusCodes.BAD_REQUEST,
+				type: "unclear-body-length",
+				publicMessage: "Bad Request: invalid content-length or transfer-encoding."
+			});
+		}
+		if (method === "OPTIONS") return endChain(ctx);
+		if (!csrf || response.hasErrors) return;
+		if (csrf.methodByIntent && rules.acceptedMethods && !rules.acceptedMethods.includes(method)) {
+			const allowed = rules.acceptedMethods.join(", ");
+			response.headers.set("allow", allowed);
+			return new FatalError({
+				statusCode: StatusCodes.METHOD_NOT_ALLOWED,
+				type: "method-not-allowed",
+				publicMessage: `The route accepts only ${allowed}.`
+			});
+		}
+		if (method === "GET" || method === "HEAD") return;
+		if (!sameOrigin && !trusted) return new FatalError({
+			statusCode: StatusCodes.FORBIDDEN,
+			type: "cross-origin-request-refused",
+			publicMessage: "Cross-origin request refused."
+		});
+		if (!isJsonContentType(request.headers.get("content-type"))) return new FatalError({
+			statusCode: StatusCodes.UNSUPPORTED_MEDIA_TYPE,
+			type: "unsupported-media-type",
+			publicMessage: "Unsupported Media Type: send the body as application/json."
+		});
+	}
+	if (typeof origins === "function") return middleware(async (ctx) => {
+		const { origin, sameOrigin, ask } = prepare(ctx);
+		return respond(ctx, origin, ask ? await origins(ctx, ask) : false, sameOrigin);
+	}, { alwaysRun: true }, [
+		__rt_Xhuv_Ju6MvJU,
+		__rt_OBOg_Ju6MvJU,
+		__rt_mzca_Ju6MvJU,
+		__rt_A0Qb_Ju6MvJU,
+		__rt_Ky89_Ju6MvJU
+	], [
+		__rt_Xhuv_NXjo9wB,
+		__rt_OBOg_NXjo9wB,
+		__rt_A0Qb_NXjo9wB,
+		__rt_Ky89_NXjo9wB
+	], __rt_Ju6MvJU, __rt_NXjo9wB, __rt_Keofqp1, __rt_tWcwFuM);
+	const allowed = new Set(origins === "*" || origins === void 0 ? [] : origins);
+	return middleware((ctx) => {
+		const { origin, sameOrigin, ask } = prepare(ctx);
+		return respond(ctx, origin, !!ask && (origins === "*" || allowed.has(ask)), sameOrigin);
+	}, { alwaysRun: true }, [
+		__rt_Xhuv_Ju6MvJU,
+		__rt_OBOg_Ju6MvJU,
+		__rt_mzca_Ju6MvJU,
+		__rt_A0Qb_Ju6MvJU,
+		__rt_Ky89_Ju6MvJU
+	], [
+		__rt_Xhuv_NXjo9wB,
+		__rt_OBOg_NXjo9wB,
+		__rt_A0Qb_NXjo9wB,
+		__rt_Ky89_NXjo9wB
+	], __rt_Ju6MvJU, __rt_NXjo9wB, __rt_A7jnlIr, __rt_tWcwFuM);
+}
+/** Mirrors Go 1.25 CrossOriginProtection; a caller sending neither header is no browser: no cookie to abuse */
+function isPlainlySameOrigin(headers) {
+	const site = headers.get("sec-fetch-site");
+	if (site) return site === "same-origin" || site === "none";
+	const origin = headers.get("origin");
+	if (!origin) return true;
+	if (origin === "null") return false;
+	try {
+		return new URL(origin).host === headers.get("host");
+	} catch {
+		return false;
+	}
+}
+function addVary(headers, names) {
+	const vary = headers.get("vary");
+	if (!vary) return headers.set("vary", names.join(", "));
+	const present = vary.toLowerCase().split(",").map((name) => name.trim());
+	if (present.includes("*")) return;
+	const missing = names.filter((name) => !present.includes(name.toLowerCase()));
+	if (missing.length) headers.set("vary", `${vary}, ${missing.join(", ")}`);
+}
+/** A repeated or non-numeric content-length, or a transfer-encoding other than chunked: some servers (uWS) read
+*  these loosely, taking the first length or treating any coding as chunked */
+function hasUnclearLength(headers) {
+	const length = headers.get("content-length");
+	if (length != null && !DECIMAL_LENGTH.test(length)) return true;
+	const coding = headers.get("transfer-encoding");
+	return coding != null && coding.toLowerCase() !== "chunked";
+}
+var DECIMAL_LENGTH = /^\d+$/;
+function isJsonContentType(contentType) {
+	if (!contentType) return false;
+	if (contentType === "application/json; charset=utf-8" || contentType === "application/json") return true;
+	const end = contentType.indexOf(";");
+	return (end === -1 ? contentType : contentType.slice(0, end)).trim().toLowerCase() === "application/json";
+}
+function describeChain(chain, cors) {
+	const route = chain.routeIndex === -1 ? void 0 : chain.methods[chain.routeIndex];
+	const acceptedMethods = !route ? void 0 : !chain.batchId && route.options.isMutation === false ? QUERY_METHODS : POST_ONLY;
+	const varyNames = /* @__PURE__ */ new Set();
+	for (const member of chain.methods) member.headersParam?.headerNames.forEach((name) => varyNames.add(name.toLowerCase()));
+	if (cors) varyNames.delete("origin");
+	const vary = cors ? ["Origin", ...varyNames] : [...varyNames];
+	if (!cors) return {
+		acceptedMethods,
+		vary,
+		allowHeaders: "",
+		exposeHeaders: "",
+		allowMethods: ""
+	};
+	const allowHeaders = new Set(["content-type"]);
+	const exposeHeaders = new Set(MION_EXPOSED_HEADERS);
+	const excluded = new Set(cors.excludeHeaders?.map((name) => name.toLowerCase()));
+	for (const member of chain.methods) {
+		const corsOff = member.options.cors === false;
+		const allowed = corsOff ? excluded : allowHeaders;
+		const exposed = corsOff ? excluded : exposeHeaders;
+		member.headersParam?.headerNames.forEach((name) => allowed.add(name.toLowerCase()));
+		member.headersReturn?.headerNames.forEach((name) => exposed.add(name.toLowerCase()));
+	}
+	cors.allowHeaders?.forEach((name) => allowHeaders.add(name.toLowerCase()));
+	cors.exposeHeaders?.forEach((name) => exposeHeaders.add(name.toLowerCase()));
+	excluded.forEach((name) => {
+		allowHeaders.delete(name);
+		exposeHeaders.delete(name);
+	});
+	return {
+		acceptedMethods,
+		vary,
+		allowHeaders: [...allowHeaders].join(", "),
+		exposeHeaders: [...exposeHeaders].join(", "),
+		allowMethods: acceptedMethods === QUERY_METHODS ? "GET, POST" : "POST"
+	};
+}
+//#endregion
+export { mionSecurity };
+
+//# sourceMappingURL=security.js.map

package/.dist/esm/src/middlewares/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","names":[],"sources":["../../../../src/middlewares/security.ts"],"sourcesContent":["/* ########\n * 2026 mion\n * Author: Ma-jerez\n * License: MIT\n * The software is provided \"as is\", without warranty of any kind.\n * ######## */\n\nimport {BUILD_VERSION_HEADER, FatalError, StatusCodes} from '@mionjs/core';\nimport {middleware} from '../lib/handlers.ts';\nimport {endChain} from '../lib/dispatchError.ts';\nimport {MION_SERVER_NAME} from '../constants.ts';\nimport type {CallContext} from '../types/context.ts';\nimport type {HeadersMethod, MethodsExecutionChain} from '../types/remoteMethods.ts';\nimport type {MionCorsSettings, MionSecurityHandlerOptions, MionSecurityOptions} from '../types/general.ts';\n\n/** mion's own response headers the client reads */\nconst MION_EXPOSED_HEADERS = ['x-rpc-error', BUILD_VERSION_HEADER];\nconst QUERY_METHODS: readonly string[] = ['GET', 'HEAD', 'POST'];\nconst POST_ONLY: readonly string[] = ['POST'];\n\n/** Place it first: a preflight carries none of the app's headers.\n *  `alwaysRun`, so an error answer still carries the CORS headers. */\nexport function mionSecurity(options: MionSecurityOptions = {}) {\n  const {origins} = options;\n  const cors = options.cors || undefined;\n  // `!== false`, so a missing config value never turns a check off\n  const csrfOptions = options.csrf;\n  const csrf =\n    csrfOptions === false\n      ? undefined\n      : {\n          crossOrigin: csrfOptions?.crossOrigin !== false,\n          methodByIntent: csrfOptions?.methodByIntent !== false,\n        };\n  if (cors && origins === undefined) throw new Error('mionSecurity: `cors` needs the `origins` allowed to read answers.');\n  // any origin echoed with cookies would let every site read the user's answers\n  if (cors?.credentials && origins === '*')\n    throw new Error(\"mionSecurity: `cors.credentials` needs the allowed origins listed, never '*'.\");\n  const maxAge = cors?.maxAge === undefined ? undefined : String(cors.maxAge);\n  // a preflight's answer depends only on the origin; the headers a chain reads change only a real answer\n  const preflightVary: readonly string[] = cors ? ['Origin'] : [];\n  // built on a chain's first request; keyed by the chain itself: not-found and batch chains carry no id\n  const chainRules = new WeakMap<MethodsExecutionChain, ReturnType<typeof describeChain>>();\n\n  /** Asks only when the answer matters: always with CORS, else a cross-site request with no error yet.\n   *  `null` is a sandboxed page's origin: never trusted. */\n  function prepare(ctx: CallContext) {\n    const {headers, method} = ctx.request;\n    const origin = headers.get('origin');\n    const sameOrigin =\n      !csrf?.crossOrigin || method === 'GET' || method === 'HEAD' || method === 'OPTIONS' || isPlainlySameOrigin(headers);\n    const matters = !!cors || (!sameOrigin && !ctx.response.hasErrors);\n    const ask = origin && origin !== 'null' && matters ? origin : undefined;\n    return {origin, sameOrigin, ask};\n  }\n\n  function respond(ctx: CallContext, origin: string | null | undefined, trusted: boolean, sameOrigin: boolean) {\n    const {request, response, executionChain} = ctx;\n    const method = request.method;\n    let rules = chainRules.get(executionChain);\n    if (!rules) chainRules.set(executionChain, (rules = describeChain(executionChain, cors)));\n    // mion answers only JSON: a browser must never guess another type from the body\n    response.headers.set('x-content-type-options', 'nosniff');\n    // the default names the framework to anyone scanning for it\n    if (response.headers.get('server') === MION_SERVER_NAME) response.headers.delete('server');\n\n    // a shared cache missing a request header the answer depends on serves one user's answer to another\n    const vary = method === 'OPTIONS' ? preflightVary : rules.vary;\n    if (vary.length) addVary(response.headers, vary);\n\n    if (cors) {\n      if (origin && trusted) {\n        response.headers.set('access-control-allow-origin', origin);\n        if (cors.credentials) response.headers.set('access-control-allow-credentials', 'true');\n        if (method !== 'OPTIONS') {\n          response.headers.set('access-control-expose-headers', rules.exposeHeaders);\n        } else if (request.headers.has('access-control-request-method')) {\n          response.headers.set('access-control-allow-methods', rules.allowMethods);\n          response.headers.set('access-control-allow-headers', rules.allowHeaders);\n          if (maxAge !== undefined) response.headers.set('access-control-max-age', maxAge);\n        }\n      }\n    }\n    // RFC 9112: answer 400 and close, or a proxy reading the length another way sends the leftover bytes as a request\n    if (hasUnclearLength(request.headers)) {\n      response.headers.set('connection', 'close');\n      return new FatalError({\n        statusCode: StatusCodes.BAD_REQUEST,\n        type: 'unclear-body-length',\n        publicMessage: 'Bad Request: invalid content-length or transfer-encoding.',\n      });\n    }\n    // a preflight never reaches a route; a disallowed one gets no CORS headers, so the browser blocks the call\n    if (method === 'OPTIONS') return endChain(ctx);\n    if (!csrf || response.hasErrors) return;\n\n    if (csrf.methodByIntent && rules.acceptedMethods && !rules.acceptedMethods.includes(method)) {\n      const allowed = rules.acceptedMethods.join(', ');\n      response.headers.set('allow', allowed);\n      return new FatalError({\n        statusCode: StatusCodes.METHOD_NOT_ALLOWED,\n        type: 'method-not-allowed',\n        publicMessage: `The route accepts only ${allowed}.`,\n      });\n    }\n    if (method === 'GET' || method === 'HEAD') return;\n    if (!sameOrigin && !trusted)\n      return new FatalError({\n        statusCode: StatusCodes.FORBIDDEN,\n        type: 'cross-origin-request-refused',\n        publicMessage: 'Cross-origin request refused.',\n      });\n    // mion reads every body as JSON: a form or a typeless fetch another site sends could parse as a call\n    if (!isJsonContentType(request.headers.get('content-type')))\n      return new FatalError({\n        statusCode: StatusCodes.UNSUPPORTED_MEDIA_TYPE,\n        type: 'unsupported-media-type',\n        publicMessage: 'Unsupported Media Type: send the body as application/json.',\n      });\n  }\n\n  // only a lookup may be async: a list never pays for a promise\n  if (typeof origins === 'function') {\n    return middleware(\n      async (ctx: CallContext): Promise<ReturnType<typeof respond>> => {\n        const {origin, sameOrigin, ask} = prepare(ctx);\n        const trusted = ask ? await origins(ctx, ask) : false;\n        return respond(ctx, origin, trusted, sameOrigin);\n      },\n      {alwaysRun: true}\n    );\n  }\n  const allowed = new Set(origins === '*' || origins === undefined ? [] : origins);\n  return middleware(\n    (ctx: CallContext): ReturnType<typeof respond> => {\n      const {origin, sameOrigin, ask} = prepare(ctx);\n      const trusted = !!ask && (origins === '*' || allowed.has(ask));\n      return respond(ctx, origin, trusted, sameOrigin);\n    },\n    {alwaysRun: true}\n  );\n}\n\n/** Mirrors Go 1.25 CrossOriginProtection; a caller sending neither header is no browser: no cookie to abuse */\nfunction isPlainlySameOrigin(headers: CallContext['request']['headers']): boolean {\n  const site = headers.get('sec-fetch-site');\n  if (site) return site === 'same-origin' || site === 'none';\n  const origin = headers.get('origin');\n  if (!origin) return true;\n  if (origin === 'null') return false;\n  try {\n    return new URL(origin).host === headers.get('host');\n  } catch {\n    return false;\n  }\n}\n\nfunction addVary(headers: CallContext['response']['headers'], names: readonly string[]): void {\n  const vary = headers.get('vary');\n  if (!vary) return headers.set('vary', names.join(', '));\n  const present = vary\n    .toLowerCase()\n    .split(',')\n    .map((name) => name.trim());\n  if (present.includes('*')) return;\n  const missing = names.filter((name) => !present.includes(name.toLowerCase()));\n  if (missing.length) headers.set('vary', `${vary}, ${missing.join(', ')}`);\n}\n\n/** A repeated or non-numeric content-length, or a transfer-encoding other than chunked: some servers (uWS) read\n *  these loosely, taking the first length or treating any coding as chunked */\nfunction hasUnclearLength(headers: CallContext['request']['headers']): boolean {\n  const length = headers.get('content-length');\n  if (length != null && !DECIMAL_LENGTH.test(length)) return true;\n  const coding = headers.get('transfer-encoding');\n  return coding != null && coding.toLowerCase() !== 'chunked';\n}\nconst DECIMAL_LENGTH = /^\\d+$/;\n\nfunction isJsonContentType(contentType: string | null | undefined): boolean {\n  if (!contentType) return false;\n  // what the mion client sends, without the parse below\n  if (contentType === 'application/json; charset=utf-8' || contentType === 'application/json') return true;\n  const end = contentType.indexOf(';');\n  return (end === -1 ? contentType : contentType.slice(0, end)).trim().toLowerCase() === 'application/json';\n}\n\nfunction describeChain(chain: MethodsExecutionChain, cors: MionCorsSettings | undefined) {\n  const route = chain.routeIndex === -1 ? undefined : chain.methods[chain.routeIndex];\n  // a batch is one POST; a query reads, so it may come as GET; a mutation and an intent-less route only POST\n  const acceptedMethods = !route ? undefined : !chain.batchId && route.options.isMutation === false ? QUERY_METHODS : POST_ONLY;\n  // lower case, so an `origin` a chain reads is not listed twice next to the CORS one\n  const varyNames = new Set<string>();\n  for (const member of chain.methods)\n    (member as HeadersMethod).headersParam?.headerNames.forEach((name) => varyNames.add(name.toLowerCase()));\n  if (cors) varyNames.delete('origin');\n  const vary: readonly string[] = cors ? ['Origin', ...varyNames] : [...varyNames];\n  if (!cors) return {acceptedMethods, vary, allowHeaders: '', exposeHeaders: '', allowMethods: ''};\n  const allowHeaders = new Set<string>(['content-type']);\n  const exposeHeaders = new Set<string>(MION_EXPOSED_HEADERS);\n  const excluded = new Set<string>(cors.excludeHeaders?.map((name) => name.toLowerCase()));\n  for (const member of chain.methods) {\n    // a `cors: false` handler's headers are excluded like `excludeHeaders`, whoever else declares them\n    const corsOff = (member.options as MionSecurityHandlerOptions).cors === false;\n    const allowed = corsOff ? excluded : allowHeaders;\n    const exposed = corsOff ? excluded : exposeHeaders;\n    (member as HeadersMethod).headersParam?.headerNames.forEach((name) => allowed.add(name.toLowerCase()));\n    member.headersReturn?.headerNames.forEach((name) => exposed.add(name.toLowerCase()));\n  }\n  cors.allowHeaders?.forEach((name) => allowHeaders.add(name.toLowerCase()));\n  cors.exposeHeaders?.forEach((name) => exposeHeaders.add(name.toLowerCase()));\n  // last, so no other source adds an excluded name back\n  excluded.forEach((name) => {\n    allowHeaders.delete(name);\n    exposeHeaders.delete(name);\n  });\n  return {\n    acceptedMethods,\n    vary,\n    allowHeaders: [...allowHeaders].join(', '),\n    exposeHeaders: [...exposeHeaders].join(', '),\n    allowMethods: acceptedMethods === QUERY_METHODS ? 'GET, POST' : 'POST',\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAgBA,IAAM,uBAAuB,CAAC,eAAe,oBAAoB;AACjE,IAAM,gBAAmC;CAAC;CAAO;CAAQ;AAAM;AAC/D,IAAM,YAA+B,CAAC,MAAM;;;AAI5C,SAAgB,aAAa,UAA+B,CAAC,GAAG;CAC9D,MAAM,EAAC,YAAW;CAClB,MAAM,OAAO,QAAQ,QAAQ,KAAA;CAE7B,MAAM,cAAc,QAAQ;CAC5B,MAAM,OACJ,gBAAgB,QACZ,KAAA,IACA;EACE,aAAa,aAAa,gBAAgB;EAC1C,gBAAgB,aAAa,mBAAmB;CAClD;CACN,IAAI,QAAQ,YAAY,KAAA,GAAW,MAAM,IAAI,MAAM,mEAAmE;CAEtH,IAAI,MAAM,eAAe,YAAY,KACnC,MAAM,IAAI,MAAM,+EAA+E;CACjG,MAAM,SAAS,MAAM,WAAW,KAAA,IAAY,KAAA,IAAY,OAAO,KAAK,MAAM;CAE1E,MAAM,gBAAmC,OAAO,CAAC,QAAQ,IAAI,CAAC;CAE9D,MAAM,6BAAa,IAAI,QAAiE;;;CAIxF,SAAS,QAAQ,KAAkB;EACjC,MAAM,EAAC,SAAS,WAAU,IAAI;EAC9B,MAAM,SAAS,QAAQ,IAAI,QAAQ;EACnC,MAAM,aACJ,CAAC,MAAM,eAAe,WAAW,SAAS,WAAW,UAAU,WAAW,aAAa,oBAAoB,OAAO;EACpH,MAAM,UAAU,CAAC,CAAC,QAAS,CAAC,cAAc,CAAC,IAAI,SAAS;EAExD,OAAO;GAAC;GAAQ;GAAY,KADhB,UAAU,WAAW,UAAU,UAAU,SAAS,KAAA;EAC/B;CACjC;CAEA,SAAS,QAAQ,KAAkB,QAAmC,SAAkB,YAAqB;EAC3G,MAAM,EAAC,SAAS,UAAU,mBAAkB;EAC5C,MAAM,SAAS,QAAQ;EACvB,IAAI,QAAQ,WAAW,IAAI,cAAc;EACzC,IAAI,CAAC,OAAO,WAAW,IAAI,gBAAiB,QAAQ,cAAc,gBAAgB,IAAI,CAAE;EAExF,SAAS,QAAQ,IAAI,0BAA0B,SAAS;EAExD,IAAI,SAAS,QAAQ,IAAI,QAAQ,MAAA,UAAwB,SAAS,QAAQ,OAAO,QAAQ;EAGzF,MAAM,OAAO,WAAW,YAAY,gBAAgB,MAAM;EAC1D,IAAI,KAAK,QAAQ,QAAQ,SAAS,SAAS,IAAI;EAE/C,IAAI;OACE,UAAU,SAAS;IACrB,SAAS,QAAQ,IAAI,+BAA+B,MAAM;IAC1D,IAAI,KAAK,aAAa,SAAS,QAAQ,IAAI,oCAAoC,MAAM;IACrF,IAAI,WAAW,WACb,SAAS,QAAQ,IAAI,iCAAiC,MAAM,aAAa;SACpE,IAAI,QAAQ,QAAQ,IAAI,+BAA+B,GAAG;KAC/D,SAAS,QAAQ,IAAI,gCAAgC,MAAM,YAAY;KACvE,SAAS,QAAQ,IAAI,gCAAgC,MAAM,YAAY;KACvE,IAAI,WAAW,KAAA,GAAW,SAAS,QAAQ,IAAI,0BAA0B,MAAM;IACjF;GACF;;EAGF,IAAI,iBAAiB,QAAQ,OAAO,GAAG;GACrC,SAAS,QAAQ,IAAI,cAAc,OAAO;GAC1C,OAAO,IAAI,WAAW;IACpB,YAAY,YAAY;IACxB,MAAM;IACN,eAAe;GACjB,CAAC;EACH;EAEA,IAAI,WAAW,WAAW,OAAO,SAAS,GAAG;EAC7C,IAAI,CAAC,QAAQ,SAAS,WAAW;EAEjC,IAAI,KAAK,kBAAkB,MAAM,mBAAmB,CAAC,MAAM,gBAAgB,SAAS,MAAM,GAAG;GAC3F,MAAM,UAAU,MAAM,gBAAgB,KAAK,IAAI;GAC/C,SAAS,QAAQ,IAAI,SAAS,OAAO;GACrC,OAAO,IAAI,WAAW;IACpB,YAAY,YAAY;IACxB,MAAM;IACN,eAAe,0BAA0B,QAAQ;GACnD,CAAC;EACH;EACA,IAAI,WAAW,SAAS,WAAW,QAAQ;EAC3C,IAAI,CAAC,cAAc,CAAC,SAClB,OAAO,IAAI,WAAW;GACpB,YAAY,YAAY;GACxB,MAAM;GACN,eAAe;EACjB,CAAC;EAEH,IAAI,CAAC,kBAAkB,QAAQ,QAAQ,IAAI,cAAc,CAAC,GACxD,OAAO,IAAI,WAAW;GACpB,YAAY,YAAY;GACxB,MAAM;GACN,eAAe;EACjB,CAAC;CACL;CAGA,IAAI,OAAO,YAAY,YACrB,OAAO,WACL,OAAO,QAA0D;EAC/D,MAAM,EAAC,QAAQ,YAAY,QAAO,QAAQ,GAAG;EAE7C,OAAO,QAAQ,KAAK,QADJ,MAAM,MAAM,QAAQ,KAAK,GAAG,IAAI,OACX,UAAU;CACjD,GACA,EAAC,WAAW,KAAI,GACnB;EAAA;EAAA;EAAA;EAAA;EAAA;CAAA,GAAA;EAAA;EAAA;EAAA;EAAA;CAAA,GAAA,cAAA,cAAA,cAAA,YAAC;CAEF,MAAM,UAAU,IAAI,IAAI,YAAY,OAAO,YAAY,KAAA,IAAY,CAAC,IAAI,OAAO;CAC/E,OAAO,YACJ,QAAiD;EAChD,MAAM,EAAC,QAAQ,YAAY,QAAO,QAAQ,GAAG;EAE7C,OAAO,QAAQ,KAAK,QADJ,CAAC,CAAC,QAAQ,YAAY,OAAO,QAAQ,IAAI,GAAG,IACvB,UAAU;CACjD,GACA,EAAC,WAAW,KAAI,GACnB;EAAA;EAAA;EAAA;EAAA;EAAA;CAAA,GAAA;EAAA;EAAA;EAAA;EAAA;CAAA,GAAA,cAAA,cAAA,cAAA,YAAC;AACF;;AAGA,SAAS,oBAAoB,SAAqD;CAChF,MAAM,OAAO,QAAQ,IAAI,gBAAgB;CACzC,IAAI,MAAM,OAAO,SAAS,iBAAiB,SAAS;CACpD,MAAM,SAAS,QAAQ,IAAI,QAAQ;CACnC,IAAI,CAAC,QAAQ,OAAO;CACpB,IAAI,WAAW,QAAQ,OAAO;CAC9B,IAAI;EACF,OAAO,IAAI,IAAI,MAAM,EAAE,SAAS,QAAQ,IAAI,MAAM;CACpD,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,QAAQ,SAA6C,OAAgC;CAC5F,MAAM,OAAO,QAAQ,IAAI,MAAM;CAC/B,IAAI,CAAC,MAAM,OAAO,QAAQ,IAAI,QAAQ,MAAM,KAAK,IAAI,CAAC;CACtD,MAAM,UAAU,KACb,YAAY,EACZ,MAAM,GAAG,EACT,KAAK,SAAS,KAAK,KAAK,CAAC;CAC5B,IAAI,QAAQ,SAAS,GAAG,GAAG;CAC3B,MAAM,UAAU,MAAM,QAAQ,SAAS,CAAC,QAAQ,SAAS,KAAK,YAAY,CAAC,CAAC;CAC5E,IAAI,QAAQ,QAAQ,QAAQ,IAAI,QAAQ,GAAG,KAAK,IAAI,QAAQ,KAAK,IAAI,GAAG;AAC1E;;;AAIA,SAAS,iBAAiB,SAAqD;CAC7E,MAAM,SAAS,QAAQ,IAAI,gBAAgB;CAC3C,IAAI,UAAU,QAAQ,CAAC,eAAe,KAAK,MAAM,GAAG,OAAO;CAC3D,MAAM,SAAS,QAAQ,IAAI,mBAAmB;CAC9C,OAAO,UAAU,QAAQ,OAAO,YAAY,MAAM;AACpD;AACA,IAAM,iBAAiB;AAEvB,SAAS,kBAAkB,aAAiD;CAC1E,IAAI,CAAC,aAAa,OAAO;CAEzB,IAAI,gBAAgB,qCAAqC,gBAAgB,oBAAoB,OAAO;CACpG,MAAM,MAAM,YAAY,QAAQ,GAAG;CACnC,QAAQ,QAAQ,KAAK,cAAc,YAAY,MAAM,GAAG,GAAG,GAAG,KAAK,EAAE,YAAY,MAAM;AACzF;AAEA,SAAS,cAAc,OAA8B,MAAoC;CACvF,MAAM,QAAQ,MAAM,eAAe,KAAK,KAAA,IAAY,MAAM,QAAQ,MAAM;CAExE,MAAM,kBAAkB,CAAC,QAAQ,KAAA,IAAY,CAAC,MAAM,WAAW,MAAM,QAAQ,eAAe,QAAQ,gBAAgB;CAEpH,MAAM,4BAAY,IAAI,IAAY;CAClC,KAAK,MAAM,UAAU,MAAM,SACzB,OAA0B,cAAc,YAAY,SAAS,SAAS,UAAU,IAAI,KAAK,YAAY,CAAC,CAAC;CACzG,IAAI,MAAM,UAAU,OAAO,QAAQ;CACnC,MAAM,OAA0B,OAAO,CAAC,UAAU,GAAG,SAAS,IAAI,CAAC,GAAG,SAAS;CAC/E,IAAI,CAAC,MAAM,OAAO;EAAC;EAAiB;EAAM,cAAc;EAAI,eAAe;EAAI,cAAc;CAAE;CAC/F,MAAM,eAAe,IAAI,IAAY,CAAC,cAAc,CAAC;CACrD,MAAM,gBAAgB,IAAI,IAAY,oBAAoB;CAC1D,MAAM,WAAW,IAAI,IAAY,KAAK,gBAAgB,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC;CACvF,KAAK,MAAM,UAAU,MAAM,SAAS;EAElC,MAAM,UAAW,OAAO,QAAuC,SAAS;EACxE,MAAM,UAAU,UAAU,WAAW;EACrC,MAAM,UAAU,UAAU,WAAW;EACrC,OAA0B,cAAc,YAAY,SAAS,SAAS,QAAQ,IAAI,KAAK,YAAY,CAAC,CAAC;EACrG,OAAO,eAAe,YAAY,SAAS,SAAS,QAAQ,IAAI,KAAK,YAAY,CAAC,CAAC;CACrF;CACA,KAAK,cAAc,SAAS,SAAS,aAAa,IAAI,KAAK,YAAY,CAAC,CAAC;CACzE,KAAK,eAAe,SAAS,SAAS,cAAc,IAAI,KAAK,YAAY,CAAC,CAAC;CAE3E,SAAS,SAAS,SAAS;EACzB,aAAa,OAAO,IAAI;EACxB,cAAc,OAAO,IAAI;CAC3B,CAAC;CACD,OAAO;EACL;EACA;EACA,cAAc,CAAC,GAAG,YAAY,EAAE,KAAK,IAAI;EACzC,eAAe,CAAC,GAAG,aAAa,EAAE,KAAK,IAAI;EAC3C,cAAc,oBAAoB,gBAAgB,cAAc;CAClE;AACF"}

package/.dist/esm/src/middlewares/syncRoutes.js

@@ -1,16 +1,16 @@
 import { middleware, mionInternalRouteIds } from "../lib/handlers.js";
 import { getRouteExecutable } from "../router.js";
 import { getMethodsDataFor } from "./fetchMetadata.js";
-import { __rt_A0Qb_FSFQzFT } from "../../.mion/types/A0Qb_FSFQzFT.js";
-import { __rt_A0Qb_N4upY9e } from "../../.mion/types/A0Qb_N4upY9e.js";
-import { __rt_Ky89_FSFQzFT } from "../../.mion/types/Ky89_FSFQzFT.js";
-import { __rt_Ky89_N4upY9e } from "../../.mion/types/Ky89_N4upY9e.js";
-import { __rt_Xhuv_FSFQzFT } from "../../.mion/types/Xhuv_FSFQzFT.js";
-import { __rt_OBOg_FSFQzFT } from "../../.mion/types/OBOg_FSFQzFT.js";
-import { __rt_OBOg_N4upY9e } from "../../.mion/types/OBOg_N4upY9e.js";
-import { __rt_Xhuv_N4upY9e } from "../../.mion/types/Xhuv_N4upY9e.js";
-import { __rt_mzca_N4upY9e } from "../../.mion/types/mzca_N4upY9e.js";
-import { __rt_FSFQzFT, __rt_N4upY9e, __rt_gnkW9ux, __rt_uCLmI7s } from "../../.mion/types/rt/C7ezVBCtGn.js";
+import { __rt_A0Qb_UE6lPE3 } from "../../.mion/types/A0Qb_UE6lPE3.js";
+import { __rt_A0Qb_b8JOgtl } from "../../.mion/types/A0Qb_b8JOgtl.js";
+import { __rt_Ky89_UE6lPE3 } from "../../.mion/types/Ky89_UE6lPE3.js";
+import { __rt_Ky89_b8JOgtl } from "../../.mion/types/Ky89_b8JOgtl.js";
+import { __rt_OBOg_UE6lPE3 } from "../../.mion/types/OBOg_UE6lPE3.js";
+import { __rt_Xhuv_b8JOgtl } from "../../.mion/types/Xhuv_b8JOgtl.js";
+import { __rt_OBOg_b8JOgtl } from "../../.mion/types/OBOg_b8JOgtl.js";
+import { __rt_Xhuv_UE6lPE3 } from "../../.mion/types/Xhuv_UE6lPE3.js";
+import { __rt_mzca_UE6lPE3 } from "../../.mion/types/mzca_UE6lPE3.js";
+import { __rt_A7jnlIr, __rt_UE6lPE3, __rt_b8JOgtl, __rt_gG20bU1 } from "../../.mion/types/rt/C7ezVBCtGn.js";
 import { FatalError } from "@mionjs/core";
 //#region src/middlewares/syncRoutes.ts
 /** Refuses a call whose route sync ids are missing or differ, before any route runs. */
@@ -49,17 +49,17 @@ var mionSyncRoutes = middleware(syncRoutes, {
 	},
 	maxBodySize: 1024
 }, [
-	__rt_Xhuv_N4upY9e,
-	__rt_OBOg_N4upY9e,
-	__rt_mzca_N4upY9e,
-	__rt_A0Qb_N4upY9e,
-	__rt_Ky89_N4upY9e
+	__rt_Xhuv_UE6lPE3,
+	__rt_OBOg_UE6lPE3,
+	__rt_mzca_UE6lPE3,
+	__rt_A0Qb_UE6lPE3,
+	__rt_Ky89_UE6lPE3
 ], [
-	__rt_Xhuv_FSFQzFT,
-	__rt_OBOg_FSFQzFT,
-	__rt_A0Qb_FSFQzFT,
-	__rt_Ky89_FSFQzFT
-], __rt_N4upY9e, __rt_FSFQzFT, __rt_uCLmI7s, __rt_gnkW9ux);
+	__rt_Xhuv_b8JOgtl,
+	__rt_OBOg_b8JOgtl,
+	__rt_A0Qb_b8JOgtl,
+	__rt_Ky89_b8JOgtl
+], __rt_UE6lPE3, __rt_b8JOgtl, __rt_A7jnlIr, __rt_gG20bU1);
 //#endregion
 export { mionSyncRoutes };
 

package/.dist/esm/src/router.d.ts

@@ -3,21 +3,20 @@ import { RemoteMethod, MethodsExecutionChain, RawMethod, HeadersMethod, Middlewa
 import { PrivateDef, MiddlewaresCollection } from './types/publicMethods.ts';
 import { HeadersMiddlewareDef, MiddlewareDef, RawMiddlewareDef } from './types/definitions.ts';
 import { ResponseDefaults } from './types/context.ts';
-import { MionRouter, RouterOptionsInput, RouterOptionsArg } from './types/mionRouter.ts';
+import { CheckedRouterTypes, KnownKeysOf, MionRouter, RouterOptionsInput, RouterOptionsArg, RouterTypes, TypedRouterFactory, WithShared } from './types/mionRouter.ts';
 export declare let startMiddlewares: RemoteMethod[];
 export declare let endMiddlewares: RemoteMethod[];
 export declare const getRouteExecutionChain: (path: string) => MethodsExecutionChain | undefined;
 export declare const getNotFoundExecutionChain: (id: string) => MethodsExecutionChain | undefined;
-export declare const getRouteEntries: () => MapIterator<[string, MethodsExecutionChain]>;
-export declare const geRoutesSize: () => number;
+export declare const getRoutesSize: () => number;
 export declare const getRouteExecutable: (id: string) => RouteMethod<any> | undefined;
-export declare const getMiddlewareExecutable: (id: string) => RawMethod<any> | HeadersMethod<any> | MiddlewareMethod<any> | undefined;
+export declare const getMiddlewareExecutable: (id: string) => HeadersMethod<any> | RawMethod<any> | MiddlewareMethod<any> | undefined;
 export declare const getMiddlewaresSize: () => number;
 export declare const getComplexity: () => number;
 export declare const getRouterOptions: <Opts extends RouterOptions>() => Readonly<Opts>;
 export declare const getBuildVersion: () => string | undefined;
 export declare const getResponseDefaults: () => ResponseDefaults;
-export declare const getAnyExecutable: (id: string) => RawMethod<any> | HeadersMethod<any> | RouteMethod<any> | MiddlewareMethod<any> | undefined;
+export declare const getAnyExecutable: (id: string) => HeadersMethod<any> | RouteMethod<any> | RawMethod<any> | MiddlewareMethod<any> | undefined;
 export declare function setPlatformConfig(config: Record<string, unknown>): void;
 export declare const getPlatformConfig: () => Readonly<Record<string, unknown>> | undefined;
 export declare function setHostOwnsSocket(ownsSocket: boolean): void;
@@ -25,7 +24,10 @@ export declare const hostOwnsSocket: () => boolean;
 export declare function handOverToHost(handler: HostRequestHandler): boolean;
 export declare const getHostRequestHandler: () => HostRequestHandler | undefined;
 export declare const resetRouter: () => void;
-export declare function createMionRouter<const O extends RouterOptionsInput = RouterOptionsInput>(opts?: RouterOptionsArg<O>): MionRouter<O>;
+export declare function createMionRouter<const O extends RouterOptionsInput & KnownKeysOf<O, object> = Record<never, never>>(opts?: RouterOptionsArg<O>): MionRouter<O, WithShared<O, object>>;
+export declare namespace createMionRouter {
+    var withTypes: <T extends RouterTypes & CheckedRouterTypes<T> = object>() => TypedRouterFactory<T>;
+}
 export declare function addStartMiddlewares(middlewaresDef: MiddlewaresCollection, appendBeforeExisting?: boolean): void;
 export declare function addEndMiddlewares(middlewaresDef: MiddlewaresCollection, prependAfterExisting?: boolean): void;
 export declare function isPrivateDefinition(entry: RouterEntry, id: string): entry is PrivateDef;

package/.dist/esm/src/router.js

@@ -1,5 +1,6 @@
 import { isAnyMiddlewareDef, isExecutable, isHeadersMiddlewareDef, isMiddlewareDef, isPublicExecutable, isRawMiddlewareDef, isRoute, isRoutes } from "./types/guards.js";
-import { DEFAULT_ROUTE_OPTIONS, JSON_CONTENT_TYPE } from "./constants.js";
+import { DEFAULT_ROUTE_OPTIONS, JSON_CONTENT_TYPE, MION_SERVER_NAME } from "./constants.js";
+import { assertHeaderSafe } from "./lib/headers.js";
 import { assertCompiledParser, getHandlerReflection, getRawMethodReflection } from "./lib/reflection.js";
 import { resolveChainMaxBodySize } from "./lib/bodyLimit.js";
 import { capBatchBodySizes, clearBatches, getMaxBatchBodySize, refreshBatchChainBodyLimits } from "./batches.js";
@@ -8,18 +9,18 @@ import { getOnEveryCall, headersMiddleware, isOnDemandMiddleware, middleware, mi
 import { serializerMiddlewares } from "./routes/serializer.routes.js";
 import { getPublicApi, resetRemoteMethodsMetadata } from "./lib/remoteMethods.js";
 import { batchNotFoundMiddleware, mionErrorsRoutes, notFoundMiddleware } from "./routes/errors.routes.js";
-import { BUILD_VERSION_HEADER, DEFAULT_MAX_BODY_SIZE, HandlerType, MION_BATCH_KEY, MION_ROUTES, getENV, getOrCreateGlobal, getRoutePath, getRouterItemId, isTestEnv, isUnsafePropertyName, resetRoutesCache, resolveParser, routesCache, setErrorOptions } from "@mionjs/core";
+import { BUILD_VERSION_HEADER, DEFAULT_MAX_BODY_SIZE, HandlerType, MION_BATCH_KEY, MION_ROUTES, getENV, getRoutePath, getRouterItemId, isUnsafePropertyName, resetRoutesCache, resolveParser, routesCache, setErrorOptions } from "@mionjs/core";
 //#region src/router.ts
-var flatRouter = getOrCreateGlobal("mion.router.flatRouter", () => /* @__PURE__ */ new Map());
+var flatRouter = /* @__PURE__ */ new Map();
 /** mion's two not-found chains (an unknown path, an unknown batch id) are NOT routes and not in the
 *  router above: each is the global middleware behind a first member that throws, and is rebuilt on
 *  every registration because that middleware is. */
-var notFoundChains = getOrCreateGlobal("mion.router.notFoundChains", () => /* @__PURE__ */ new Map());
-var middlewaresById = getOrCreateGlobal("mion.router.middlewaresById", () => /* @__PURE__ */ new Map());
-var routesById = getOrCreateGlobal("mion.router.routesById", () => /* @__PURE__ */ new Map());
-var rawMiddlewaresById = getOrCreateGlobal("mion.router.rawMiddlewaresById", () => /* @__PURE__ */ new Map());
-var middlewareNames = getOrCreateGlobal("mion.router.middlewareNames", () => /* @__PURE__ */ new Set());
-var routeNames = getOrCreateGlobal("mion.router.routeNames", () => /* @__PURE__ */ new Set());
+var notFoundChains = /* @__PURE__ */ new Map();
+var middlewaresById = /* @__PURE__ */ new Map();
+var routesById = /* @__PURE__ */ new Map();
+var rawMiddlewaresById = /* @__PURE__ */ new Map();
+var middlewareNames = /* @__PURE__ */ new Set();
+var routeNames = /* @__PURE__ */ new Set();
 var complexity = 0;
 var routerOptions = { ...DEFAULT_ROUTE_OPTIONS };
 var isRouterInitialized = false;
@@ -42,8 +43,7 @@ var endMiddlewares = [];
 var getRouteExecutionChain = (path) => flatRouter.get(path);
 /** The chain that answers an unknown path or an unknown batch id, by its `MION_ROUTES` id. */
 var getNotFoundExecutionChain = (id) => notFoundChains.get(id);
-var getRouteEntries = () => flatRouter.entries();
-var geRoutesSize = () => flatRouter.size;
+var getRoutesSize = () => flatRouter.size;
 var getRouteExecutable = (id) => routesById.get(id);
 var getMiddlewareExecutable = (id) => middlewaresById.get(id);
 var getMiddlewaresSize = () => middlewaresById.size;
@@ -64,10 +64,10 @@ function setPlatformConfig(config) {
 	refreshChainBodyLimits();
 }
 var getPlatformConfig = () => platformConfig;
-var devHost = getOrCreateGlobal("mion.router.devHost", () => ({
+var devHost = {
 	ownsSocket: false,
 	handler: void 0
-}));
+};
 /** Set by a dev host that owns the socket (the mion vite plugin) BEFORE it loads the server entry, so whatever
 *  platform adapter the entry starts registers its routes and hands over its handler instead of listening. */
 function setHostOwnsSocket(ownsSocket) {
@@ -106,11 +106,8 @@ var resetRouter = () => {
 	resetRoutesCache();
 	clearBatches();
 };
-/** The ONE way to initialize the router and to declare routes and middlewares: the options are written once
-*  and carried BY TYPE into every helper the factory returns, so a handler's `ctx.shared` is typed from
-*  `contextDataFactory` and router-wide defaults can be read at build time. The helpers are plain closures
-*  (no `this`), so destructuring them is fine. Create the router once per app: a second call throws until
-*  `resetRouter()` (tests) clears it. */
+/** Options ride BY TYPE into every helper, so router-wide defaults are read at build time and `ctx.shared` is typed from
+*  `sharedDataFactory`'s written return type. The helpers are plain closures (no `this`), safe to destructure. */
 function createMionRouter(opts) {
 	if (isRouterCreated) throw new Error("createMionRouter has already been called: create the router once per app (resetRouter() clears it in tests)");
 	isRouterCreated = true;
@@ -132,6 +129,16 @@ function createMionRouter(opts) {
 		}
 	};
 }
+/** Declares the keys a router adds (see `RouterTypes`) and returns `createMionRouter` typed by them. Types only: a type
+*  argument on `createMionRouter` itself would stop the options literal from being inferred.
+*  @example
+*  ```ts
+*  const mion = createMionRouter.withTypes<{handler: MionSecurityHandlerOptions}>()({basePath: 'api'});
+*  mion.route(handler, {cors: false});
+*  ``` */
+createMionRouter.withTypes = function withTypes() {
+	return createMionRouter;
+};
 /** Once per app; `resetRouter()` clears it. */
 function initRouter(opts, version) {
 	if (isRouterInitialized) throw new Error("Router has already been initialized");
@@ -147,7 +154,6 @@ function initRouter(opts, version) {
 	setErrorOptions(routerOptions);
 	isRouterInitialized = true;
 	registerRoutes({ ...mionErrorsRoutes });
-	if (!isTestEnv()) console.log("mion router initialized", { routerOptions });
 }
 function registerRoutes(routes) {
 	if (!isRouterInitialized) throw new Error("the router must be initialized first");
@@ -215,11 +221,9 @@ function getAllExecutablesIds() {
 function shouldFullGenerateSpec() {
 	return routerOptions.getPublicRoutesData || getENV("GENERATE_ROUTER_SPEC") === "true";
 }
-/** Flattens the routes object into a list of Executable objects. `currentPointer` is the position in that
-*  object (i.e. ['users', 'get']); `preMiddlewares` / `postMiddlewares` are the middlewares one level up, before
-*  and after that position. */
+/** `currentPointer` is the position in `routes` (e.g. ['users', 'get']); the middlewares come from one level up. */
 function recursiveFlatRoutes(routes, currentPointer = [], preMiddlewares = [], postMiddlewares = [], nestLevel = 0) {
-	if (nestLevel > 10) throw new Error("Too many nested routes, you can only nest routes ${MAX_ROUTE_NESTING} levels");
+	if (nestLevel > 10) throw new Error(`Too many nested routes, you can only nest routes 10 levels`);
 	const entries = Object.entries(routes);
 	if (entries.length === 0) throw new Error(`Invalid route: ${currentPointer.length ? joinPath(...currentPointer) : "*"}. Can Not define empty routes`);
 	let minus1Props = null;
@@ -231,6 +235,7 @@ function recursiveFlatRoutes(routes, currentPointer = [], preMiddlewares = [], p
 		if (key.includes(",")) throw new Error(`Invalid route: ${joinPath(...newPointer)}. Route names cannot contain commas.`);
 		if (isUnsafePropertyName(key)) throw new Error(`Invalid route: ${joinPath(...newPointer)}. '${key}' is not a valid route name.`);
 		if (key === MION_BATCH_KEY) throw new Error(`Invalid route: ${joinPath(...newPointer)}. '${MION_BATCH_KEY}' is a reserved mion route name.`);
+		if (key === "then") throw new Error(`Invalid route: ${joinPath(...newPointer)}. 'then' is a reserved mion route name.`);
 		if (isAnyMiddlewareDef(item)) {
 			if (nestLevel === 0 && (Object.hasOwn(startMiddlewaresDef, key) || Object.hasOwn(endMiddlewaresDef, key))) throw new Error(`Invalid middleware: ${joinPath(...newPointer)}. '${key}' is a reserved mion middleware name.`);
 			if (isOnDemandMiddleware(item) && (nestLevel !== 0 || entries.slice(0, index).some(([, entry]) => !isAnyMiddlewareDef(entry)))) throw new Error(`Invalid middleware: ${joinPath(...newPointer)}. Place '${key}' at the root of your routes, before any route or group.`);
@@ -344,6 +349,7 @@ function getExecutableFromMiddleware(middleware, middlewarePointer, nestLevel) {
 			quotedId: JSON.stringify(middlewareId),
 			...reflectionData,
 			options: {
+				...middleware.options,
 				alwaysRun: !!middleware.options?.alwaysRun,
 				description: middleware.options?.description,
 				parser,
@@ -379,6 +385,7 @@ function getExecutableFromRawMiddleware(middleware, middlewarePointer, nestLevel
 		quotedId: JSON.stringify(middlewareId),
 		...reflectionData,
 		options: {
+			...middleware.options,
 			alwaysRun: !!middleware.options?.alwaysRun,
 			description: middleware.options?.description
 		}
@@ -407,6 +414,7 @@ function getExecutableFromRoute(route, routePointer, nestLevel) {
 			quotedId: JSON.stringify(routeId),
 			...reflectionData,
 			options: {
+				...route.options,
 				alwaysRun: false,
 				description: route.options?.description,
 				parser,
@@ -451,9 +459,9 @@ function getExecutablesFromMiddlewaresCollection(middlewaresDef) {
 	return results;
 }
 function validateSharedDataFactory(opts) {
-	if (!opts?.contextDataFactory) return;
-	const testSharedData = opts.contextDataFactory();
-	if (typeof testSharedData !== "object" || Array.isArray(testSharedData) || testSharedData === null || Object.keys(testSharedData).length === 0) throw new Error("contextDataFactory must return a plain object with at least one property");
+	if (!opts?.sharedDataFactory) return;
+	const testSharedData = opts.sharedDataFactory();
+	if (typeof testSharedData !== "object" || Array.isArray(testSharedData) || testSharedData === null || Object.keys(testSharedData).length === 0) throw new Error("sharedDataFactory must return a plain object with at least one property");
 }
 /** Hand-rolled: Node's 'path' module is not available in edge runtimes. */
 function joinPath(...parts) {
@@ -501,12 +509,15 @@ function refreshChainBodyLimits() {
 /** `server` first so the option can replace it, `content-type` last so it cannot; lowercased, or `Headers` would
 *  append a name repeated in another case. */
 function mergeResponseDefaults(responseHeaders) {
-	const merged = { server: "mionjs" };
-	for (const name in responseHeaders) merged[name.toLowerCase()] = responseHeaders[name];
+	const merged = { server: MION_SERVER_NAME };
+	for (const name in responseHeaders) {
+		assertHeaderSafe(name, responseHeaders[name]);
+		merged[name.toLowerCase()] = responseHeaders[name];
+	}
 	merged["content-type"] = JSON_CONTENT_TYPE;
 	return merged;
 }
 //#endregion
-export { addEndMiddlewares, addStartMiddlewares, createMionRouter, endMiddlewares, geRoutesSize, getAllExecutablesIds, getAnyExecutable, getBuildVersion, getComplexity, getExecutableFromMiddleware, getExecutableFromRawMiddleware, getExecutableFromRoute, getHostRequestHandler, getMaxRouteBodySize, getMiddlewareExecutable, getMiddlewaresSize, getNotFoundExecutionChain, getPlatformConfig, getPlatformMaxBodySize, getPlatformRequestCap, getResponseDefaults, getRouteEntries, getRouteExecutable, getRouteExecutionChain, getRouterOptions, getTotalExecutables, handOverToHost, hostOwnsSocket, isPrivateDefinition, resetRouter, setHostOwnsSocket, setPlatformConfig, shouldFullGenerateSpec, startMiddlewares };
+export { addEndMiddlewares, addStartMiddlewares, createMionRouter, endMiddlewares, getAllExecutablesIds, getAnyExecutable, getBuildVersion, getComplexity, getExecutableFromMiddleware, getExecutableFromRawMiddleware, getExecutableFromRoute, getHostRequestHandler, getMaxRouteBodySize, getMiddlewareExecutable, getMiddlewaresSize, getNotFoundExecutionChain, getPlatformConfig, getPlatformMaxBodySize, getPlatformRequestCap, getResponseDefaults, getRouteExecutable, getRouteExecutionChain, getRouterOptions, getRoutesSize, getTotalExecutables, handOverToHost, hostOwnsSocket, isPrivateDefinition, resetRouter, setHostOwnsSocket, setPlatformConfig, shouldFullGenerateSpec, startMiddlewares };
 
 //# sourceMappingURL=router.js.map