@nifrajs/core 2.13.0 → 3.1.0

package/dist/edge-kit.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Edge kit - the moat-neutral free functions a compact fetch-handler server needs to enforce the
+ * SAME request trust boundary the full `Server` does, without pulling in the full builder.
+ *
+ * A minimal edge entrypoint (`@nifrajs/edge`) is not allowed to re-derive the body lane: the assembly
+ * order of the content-type dispatch, the bounded read, the Content-Length pre-reject, and the
+ * prototype-poisoning guard is a security contract, and a second copy of it would drift. This subpath
+ * exposes the one lane the fused body runner already calls, so a compact server reuses it verbatim:
+ *
+ *   - {@link readBodyFramed}   read + cap + proto-guard + content-type framing (JSON / urlencoded / 415)
+ *   - {@link toResponse}       render a {@link ResponseResult} (e.g. a 413 / 415 rejection) to a `Response`
+ *   - {@link plainError}       the structured rejection envelope the lane returns
+ *   - {@link queryObjectOf} / {@link searchOf}   query parse without a full WHATWG URL construction
+ *
+ * Everything here carries only structure - bytes, guards, and envelopes - never routing, lifecycle,
+ * or app state. It is the interface, not the framework.
+ */
+export { plainError } from "./server/http.js";
+export type { ProtoPoisoning } from "./server/proto-guard.js";
+export { type QueryValue, queryObjectOf, searchOf } from "./server/query.js";
+export { readBodyFramed } from "./server/request-context.js";
+export { toResponse } from "./server/respond.js";
+export type { ResponseResult } from "./server/runtime-core.js";
+export { EMPTY_RESPONSE_CONTROLS } from "./server/runtime-core.js";
+export type { CtxSet, MaybePromise, RequestSource } from "./server/server.js";
+export { plainValidationError } from "./server/server.js";
+//# sourceMappingURL=edge-kit.d.ts.map

package/dist/edge-kit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"edge-kit.d.ts","sourceRoot":"","sources":["../src/edge-kit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,YAAY,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAC7D,OAAO,EAAE,KAAK,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,YAAY,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAA;AAClE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA"}

package/dist/edge-kit.js

@@ -0,0 +1,24 @@
+/**
+ * Edge kit - the moat-neutral free functions a compact fetch-handler server needs to enforce the
+ * SAME request trust boundary the full `Server` does, without pulling in the full builder.
+ *
+ * A minimal edge entrypoint (`@nifrajs/edge`) is not allowed to re-derive the body lane: the assembly
+ * order of the content-type dispatch, the bounded read, the Content-Length pre-reject, and the
+ * prototype-poisoning guard is a security contract, and a second copy of it would drift. This subpath
+ * exposes the one lane the fused body runner already calls, so a compact server reuses it verbatim:
+ *
+ *   - {@link readBodyFramed}   read + cap + proto-guard + content-type framing (JSON / urlencoded / 415)
+ *   - {@link toResponse}       render a {@link ResponseResult} (e.g. a 413 / 415 rejection) to a `Response`
+ *   - {@link plainError}       the structured rejection envelope the lane returns
+ *   - {@link queryObjectOf} / {@link searchOf}   query parse without a full WHATWG URL construction
+ *
+ * Everything here carries only structure - bytes, guards, and envelopes - never routing, lifecycle,
+ * or app state. It is the interface, not the framework.
+ */
+export { plainError } from "./server/http.js";
+export { queryObjectOf, searchOf } from "./server/query.js";
+export { readBodyFramed } from "./server/request-context.js";
+export { toResponse } from "./server/respond.js";
+export { EMPTY_RESPONSE_CONTROLS } from "./server/runtime-core.js";
+export { plainValidationError } from "./server/server.js";
+//# sourceMappingURL=edge-kit.js.map

package/dist/edge-kit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"edge-kit.js","sourceRoot":"","sources":["../src/edge-kit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C,OAAO,EAAmB,aAAa,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAEhD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAA;AAElE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA"}

package/dist/errors.d.ts

@@ -8,7 +8,7 @@ export declare class FrameworkError extends Error {
     constructor(code: string, message: string);
 }
 /** Stable codes for boot-time (L2) route configuration failures. */
-export type RouteConfigErrorCode = "DUPLICATE_ROUTE" | "DUPLICATE_PARAM" | "PARAM_NAME_CONFLICT" | "INVALID_PATH" | "INVALID_PARAM_NAME" | "WILDCARD_NOT_LAST" | "INVALID_METHOD" | "INVALID_ASSURANCE" | "INVALID_IDEMPOTENCY" | "INVALID_BODY_LIMIT";
+export type RouteConfigErrorCode = "DUPLICATE_ROUTE" | "DUPLICATE_PARAM" | "PARAM_NAME_CONFLICT" | "INVALID_PATH" | "INVALID_PARAM_NAME" | "WILDCARD_NOT_LAST" | "INVALID_METHOD" | "INVALID_ASSURANCE" | "INVALID_IDEMPOTENCY" | "INVALID_WS_SEND_VALIDATION" | "INVALID_BODY_LIMIT";
 /**
  * Thrown at route registration when a route is misconfigured. This is the
  * boot-time rejection layer: loud and early,

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;gBAET,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1C;AAED,oEAAoE;AACpE,MAAM,MAAM,oBAAoB,GAC5B,iBAAiB,GACjB,iBAAiB,GACjB,qBAAqB,GACrB,cAAc,GACd,oBAAoB,GACpB,mBAAmB,GACnB,gBAAgB,GAChB,mBAAmB,GACnB,qBAAqB,GACrB,oBAAoB,CAAA;AAExB;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,cAAc;IAElD,SAAiB,IAAI,EAAE,oBAAoB,CAAA;gBAE/B,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM;CAIxD"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;gBAET,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1C;AAED,oEAAoE;AACpE,MAAM,MAAM,oBAAoB,GAC5B,iBAAiB,GACjB,iBAAiB,GACjB,qBAAqB,GACrB,cAAc,GACd,oBAAoB,GACpB,mBAAmB,GACnB,gBAAgB,GAChB,mBAAmB,GACnB,qBAAqB,GACrB,4BAA4B,GAC5B,oBAAoB,CAAA;AAExB;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,cAAc;IAElD,SAAiB,IAAI,EAAE,oBAAoB,CAAA;gBAE/B,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM;CAIxD"}

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAEpD;;;;GAIG;AACH,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,IAAI,CAAQ;IAErB,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC,CAAA;QACvC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAA;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;CACF;AAeD;;;;GAIG;AACH,MAAM,OAAO,gBAAiB,SAAQ,cAAc;IAIlD,YAAY,IAA0B,EAAE,OAAe;QACrD,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QACpB,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAA;IAChC,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAEpD;;;;GAIG;AACH,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,IAAI,CAAQ;IAErB,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC,CAAA;QACvC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAA;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;CACF;AAgBD;;;;GAIG;AACH,MAAM,OAAO,gBAAiB,SAAQ,cAAc;IAIlD,YAAY,IAA0B,EAAE,OAAe;QACrD,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QACpB,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAA;IAChC,CAAC;CACF"}

package/dist/index.d.ts

@@ -9,7 +9,7 @@
  * read its own package.json at runtime. `scripts/version.ts` rewrites it on every release bump and
  * `check:publish` asserts it equals `@nifrajs/core`'s package version.
  */
-export declare const VERSION: "2.13.0";
+export declare const VERSION: "3.1.0";
 export type Version = typeof VERSION;
 export * from "./server.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;GAIG;AACH,eAAO,MAAM,OAAO,EAAG,QAAiB,CAAA;AAExC,MAAM,MAAM,OAAO,GAAG,OAAO,OAAO,CAAA;AAEpC,cAAc,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;GAIG;AACH,eAAO,MAAM,OAAO,EAAG,OAAgB,CAAA;AAEvC,MAAM,MAAM,OAAO,GAAG,OAAO,OAAO,CAAA;AAEpC,cAAc,aAAa,CAAA"}

package/dist/index.js

@@ -9,6 +9,6 @@
  * read its own package.json at runtime. `scripts/version.ts` rewrites it on every release bump and
  * `check:publish` asserts it equals `@nifrajs/core`'s package version.
  */
-export const VERSION = "2.13.0";
+export const VERSION = "3.1.0";
 export * from "./server.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,QAAiB,CAAA;AAIxC,cAAc,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,OAAgB,CAAA;AAIvC,cAAc,aAAa,CAAA"}

package/dist/internal/durable-approval-protocol.d.ts

@@ -0,0 +1,13 @@
+import type { ApprovalConsumeResult, ApprovalRecord, ApprovalStore } from "../durable-execution.js";
+export type DurableApprovalDecisionInput = Parameters<ApprovalStore["decide"]>[0];
+export type DurableApprovalConsumeInput = Parameters<ApprovalStore["consume"]>[0];
+export interface DurableApprovalConsumeTransition {
+    readonly result: ApprovalConsumeResult;
+    readonly next?: ApprovalRecord;
+}
+export interface DurableApprovalProtocol {
+    decide(current: ApprovalRecord | undefined, input: DurableApprovalDecisionInput): ApprovalRecord | undefined;
+    consume(current: ApprovalRecord | undefined, input: DurableApprovalConsumeInput): DurableApprovalConsumeTransition;
+}
+export declare const durableApprovalProtocol: DurableApprovalProtocol;
+//# sourceMappingURL=durable-approval-protocol.d.ts.map

package/dist/internal/durable-approval-protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"durable-approval-protocol.d.ts","sourceRoot":"","sources":["../../src/internal/durable-approval-protocol.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAGnG,MAAM,MAAM,4BAA4B,GAAG,UAAU,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACjF,MAAM,MAAM,2BAA2B,GAAG,UAAU,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAEjF,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAA;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,CAAA;CAC/B;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,CACJ,OAAO,EAAE,cAAc,GAAG,SAAS,EACnC,KAAK,EAAE,4BAA4B,GAClC,cAAc,GAAG,SAAS,CAAA;IAC7B,OAAO,CACL,OAAO,EAAE,cAAc,GAAG,SAAS,EACnC,KAAK,EAAE,2BAA2B,GACjC,gCAAgC,CAAA;CACpC;AAoED,eAAO,MAAM,uBAAuB,EAAE,uBAGpC,CAAA"}

package/dist/internal/durable-approval-protocol.js

@@ -0,0 +1,66 @@
+import { safeEqual } from "./safe-equal.js";
+function decideApproval(current, input) {
+    if (current === undefined ||
+        current.tenantId !== input.tenantId ||
+        current.state !== "pending" ||
+        current.expiresAt <= input.now) {
+        return undefined;
+    }
+    return Object.freeze({
+        ...current,
+        state: input.decision,
+        decidedBy: input.decidedBy,
+        updatedAt: input.now,
+        version: current.version + 1,
+    });
+}
+function consumeApproval(current, input) {
+    if (current === undefined)
+        return { result: { state: "missing" } };
+    if (current.tenantId !== input.tenantId ||
+        current.principalId !== input.principalId ||
+        current.capability !== input.capability ||
+        current.target !== input.target ||
+        !safeEqual(current.digest, input.digest)) {
+        return { result: { state: "binding" } };
+    }
+    if (!safeEqual(current.tokenHash, input.tokenHash))
+        return { result: { state: "token" } };
+    if (current.state === "consumed")
+        return { result: { state: "replay" } };
+    if (current.state === "denied")
+        return { result: { state: "denied" } };
+    if (current.state === "pending")
+        return { result: { state: "pending" } };
+    if (current.state === "expired" || current.expiresAt <= input.now) {
+        return {
+            result: { state: "expired" },
+            ...(current.state === "expired"
+                ? {}
+                : {
+                    next: Object.freeze({
+                        ...current,
+                        state: "expired",
+                        updatedAt: input.now,
+                        version: current.version + 1,
+                    }),
+                }),
+        };
+    }
+    if (current.state !== "approved")
+        return { result: { state: "token" } };
+    return {
+        result: { state: "consumed" },
+        next: Object.freeze({
+            ...current,
+            state: "consumed",
+            updatedAt: input.now,
+            version: current.version + 1,
+        }),
+    };
+}
+export const durableApprovalProtocol = Object.freeze({
+    decide: decideApproval,
+    consume: consumeApproval,
+});
+//# sourceMappingURL=durable-approval-protocol.js.map

package/dist/internal/durable-approval-protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"durable-approval-protocol.js","sourceRoot":"","sources":["../../src/internal/durable-approval-protocol.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAqB3C,SAAS,cAAc,CACrB,OAAmC,EACnC,KAAmC;IAEnC,IACE,OAAO,KAAK,SAAS;QACrB,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QACnC,OAAO,CAAC,KAAK,KAAK,SAAS;QAC3B,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,GAAG,EAC9B,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,OAAO;QACV,KAAK,EAAE,KAAK,CAAC,QAAQ;QACrB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,GAAG;QACpB,OAAO,EAAE,OAAO,CAAC,OAAO,GAAG,CAAC;KAC7B,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,OAAmC,EACnC,KAAkC;IAElC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAA;IAClE,IACE,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QACnC,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QACzC,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;QACvC,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAC/B,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,EACxC,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAA;IACzC,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAA;IACzF,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAA;IACxE,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAA;IACtE,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAA;IACxE,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QAClE,OAAO;YACL,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;YAC5B,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS;gBAC7B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;wBAClB,GAAG,OAAO;wBACV,KAAK,EAAE,SAAkB;wBACzB,SAAS,EAAE,KAAK,CAAC,GAAG;wBACpB,OAAO,EAAE,OAAO,CAAC,OAAO,GAAG,CAAC;qBAC7B,CAAC;iBACH,CAAC;SACP,CAAA;IACH,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAA;IACvE,OAAO;QACL,MAAM,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;YAClB,GAAG,OAAO;YACV,KAAK,EAAE,UAAmB;YAC1B,SAAS,EAAE,KAAK,CAAC,GAAG;YACpB,OAAO,EAAE,OAAO,CAAC,OAAO,GAAG,CAAC;SAC7B,CAAC;KACH,CAAA;AACH,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAA4B,MAAM,CAAC,MAAM,CAAC;IAC5E,MAAM,EAAE,cAAc;IACtB,OAAO,EAAE,eAAe;CACzB,CAAC,CAAA"}

package/dist/internal/durable-effect-protocol.d.ts

@@ -0,0 +1,14 @@
+import type { DurableEffectRecord, DurableEffectState } from "../durable-execution.js";
+export interface DurableEffectTransitionInput {
+    readonly effectId: string;
+    readonly version: number;
+    readonly from: DurableEffectState;
+    readonly to: DurableEffectState;
+    readonly updatedAt: number;
+    readonly errorCode?: string;
+}
+export interface DurableEffectProtocol {
+    transition(current: DurableEffectRecord | undefined, input: DurableEffectTransitionInput): DurableEffectRecord | undefined;
+}
+export declare const durableEffectProtocol: DurableEffectProtocol;
+//# sourceMappingURL=durable-effect-protocol.d.ts.map

package/dist/internal/durable-effect-protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"durable-effect-protocol.d.ts","sourceRoot":"","sources":["../../src/internal/durable-effect-protocol.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAEtF,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;IACjC,QAAQ,CAAC,EAAE,EAAE,kBAAkB,CAAA;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,CACR,OAAO,EAAE,mBAAmB,GAAG,SAAS,EACxC,KAAK,EAAE,4BAA4B,GAClC,mBAAmB,GAAG,SAAS,CAAA;CACnC;AAkBD,eAAO,MAAM,qBAAqB,EAAE,qBAElC,CAAA"}

package/dist/internal/durable-effect-protocol.js

@@ -0,0 +1,16 @@
+function transitionEffect(current, input) {
+    if (current === undefined || current.version !== input.version || current.state !== input.from) {
+        return undefined;
+    }
+    return Object.freeze({
+        ...current,
+        state: input.to,
+        updatedAt: input.updatedAt,
+        version: current.version + 1,
+        ...(input.errorCode === undefined ? {} : { errorCode: input.errorCode }),
+    });
+}
+export const durableEffectProtocol = Object.freeze({
+    transition: transitionEffect,
+});
+//# sourceMappingURL=durable-effect-protocol.js.map

package/dist/internal/durable-effect-protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"durable-effect-protocol.js","sourceRoot":"","sources":["../../src/internal/durable-effect-protocol.ts"],"names":[],"mappings":"AAkBA,SAAS,gBAAgB,CACvB,OAAwC,EACxC,KAAmC;IAEnC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;QAC/F,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,OAAO;QACV,KAAK,EAAE,KAAK,CAAC,EAAE;QACf,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,OAAO,CAAC,OAAO,GAAG,CAAC;QAC5B,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;KACzE,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAA0B,MAAM,CAAC,MAAM,CAAC;IACxE,UAAU,EAAE,gBAAgB;CAC7B,CAAC,CAAA"}

package/dist/internal/durable-saga-protocol.d.ts

@@ -0,0 +1,8 @@
+import type { SagaRecord, SagaState, SagaStepRecord, SagaStore } from "../durable-execution.js";
+export type DurableSagaTransitionInput = Parameters<SagaStore["compareAndSet"]>[0];
+export interface DurableSagaProtocol {
+    transition(current: SagaRecord | undefined, input: DurableSagaTransitionInput): SagaRecord | undefined;
+    withStep(record: SagaRecord, index: number, step: SagaStepRecord, state: SagaState, updatedAt: number): Omit<SagaRecord, "version">;
+}
+export declare const durableSagaProtocol: DurableSagaProtocol;
+//# sourceMappingURL=durable-saga-protocol.d.ts.map

package/dist/internal/durable-saga-protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"durable-saga-protocol.d.ts","sourceRoot":"","sources":["../../src/internal/durable-saga-protocol.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAE/F,MAAM,MAAM,0BAA0B,GAAG,UAAU,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAElF,MAAM,WAAW,mBAAmB;IAClC,UAAU,CACR,OAAO,EAAE,UAAU,GAAG,SAAS,EAC/B,KAAK,EAAE,0BAA0B,GAChC,UAAU,GAAG,SAAS,CAAA;IACzB,QAAQ,CACN,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE,SAAS,EAChB,SAAS,EAAE,MAAM,GAChB,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;CAC/B;AAmCD,eAAO,MAAM,mBAAmB,EAAE,mBAGhC,CAAA"}

package/dist/internal/durable-saga-protocol.js

@@ -0,0 +1,21 @@
+function transitionSaga(current, input) {
+    if (input.record.version !== input.version + 1 ||
+        (current !== undefined &&
+            (current.sagaId !== input.sagaId || current.version !== input.version))) {
+        return undefined;
+    }
+    return Object.freeze({ ...input.record });
+}
+function withSagaStep(record, index, step, state, updatedAt) {
+    return {
+        ...record,
+        state,
+        steps: Object.freeze(record.steps.map((candidate, candidateIndex) => candidateIndex === index ? Object.freeze(step) : candidate)),
+        updatedAt,
+    };
+}
+export const durableSagaProtocol = Object.freeze({
+    transition: transitionSaga,
+    withStep: withSagaStep,
+});
+//# sourceMappingURL=durable-saga-protocol.js.map

package/dist/internal/durable-saga-protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"durable-saga-protocol.js","sourceRoot":"","sources":["../../src/internal/durable-saga-protocol.ts"],"names":[],"mappings":"AAkBA,SAAS,cAAc,CACrB,OAA+B,EAC/B,KAAiC;IAEjC,IACE,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,GAAG,CAAC;QAC1C,CAAC,OAAO,KAAK,SAAS;YACpB,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC,EACzE,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;AAC3C,CAAC;AAED,SAAS,YAAY,CACnB,MAAkB,EAClB,KAAa,EACb,IAAoB,EACpB,KAAgB,EAChB,SAAiB;IAEjB,OAAO;QACL,GAAG,MAAM;QACT,KAAK;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,CAClB,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,cAAc,EAAE,EAAE,CAC7C,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAC3D,CACF;QACD,SAAS;KACV,CAAA;AACH,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAwB,MAAM,CAAC,MAAM,CAAC;IACpE,UAAU,EAAE,cAAc;IAC1B,QAAQ,EAAE,YAAY;CACvB,CAAC,CAAA"}

package/dist/internal/route-catalog.d.ts

@@ -51,6 +51,9 @@ export declare class RouteCatalog {
     addBatch(routes: readonly CatalogRoute[]): void;
     find(method: string, path: string): RouterMatch<RouteEntry>;
     entries(): readonly CatalogRoute[];
+    /** Number of registered routes. Read at hook push time and at seal to detect an order-scoped hook
+     * that captured no route (see `Server.sealConfiguration`). */
+    get size(): number;
     routeDescriptors(): ReadonlyArray<RouteDescriptor>;
     lastDescriptor(): RouteDescriptor | undefined;
     hasAssurance(): boolean;

package/dist/internal/route-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-catalog.d.ts","sourceRoot":"","sources":["../../src/internal/route-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,EAAE,KAAK,MAAM,EAAU,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEtD;sFACsF;AACtF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;IACtC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAA;IACpC,QAAQ,CAAC,SAAS,EAAE,SAAS,oBAAoB,EAAE,CAAA;CACpD;AAED;;;;;;;;;;GAUG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,OAAO,CAA2B;IAC1C,OAAO,CAAC,OAAO,CAAqB;IACpC,qGAAqG;IACrG,OAAO,CAAC,WAAW,CAAwB;IAC3C,OAAO,CAAC,gBAAgB,CAAQ;IAEhC,GAAG,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI;IAO9B,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,GAAG,IAAI;IAe/C,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC;IAI3D,OAAO,IAAI,SAAS,YAAY,EAAE;IAIlC,gBAAgB,IAAI,aAAa,CAAC,eAAe,CAAC;IAIlD,cAAc,IAAI,eAAe,GAAG,SAAS;IAI7C,YAAY,IAAI,OAAO;CAGxB"}
+{"version":3,"file":"route-catalog.d.ts","sourceRoot":"","sources":["../../src/internal/route-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,EAAE,KAAK,MAAM,EAAU,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEtD;sFACsF;AACtF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;IACtC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAA;IACpC,QAAQ,CAAC,SAAS,EAAE,SAAS,oBAAoB,EAAE,CAAA;CACpD;AAED;;;;;;;;;;GAUG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,OAAO,CAA2B;IAC1C,OAAO,CAAC,OAAO,CAAqB;IACpC,qGAAqG;IACrG,OAAO,CAAC,WAAW,CAAwB;IAC3C,OAAO,CAAC,gBAAgB,CAAQ;IAEhC,GAAG,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI;IAO9B,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,GAAG,IAAI;IAe/C,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC;IAI3D,OAAO,IAAI,SAAS,YAAY,EAAE;IAIlC;kEAC8D;IAC9D,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,gBAAgB,IAAI,aAAa,CAAC,eAAe,CAAC;IAIlD,cAAc,IAAI,eAAe,GAAG,SAAS;IAI7C,YAAY,IAAI,OAAO;CAGxB"}

package/dist/internal/route-catalog.js

@@ -45,6 +45,11 @@ export class RouteCatalog {
     entries() {
         return this.records;
     }
+    /** Number of registered routes. Read at hook push time and at seal to detect an order-scoped hook
+     * that captured no route (see `Server.sealConfiguration`). */
+    get size() {
+        return this.records.length;
+    }
     routeDescriptors() {
         return this.descriptors;
     }

package/dist/internal/route-catalog.js.map

@@ -1 +1 @@
-{"version":3,"file":"route-catalog.js","sourceRoot":"","sources":["../../src/internal/route-catalog.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAe,MAAM,EAAoB,MAAM,qBAAqB,CAAA;AAgB3E;;;;;;;;;;GAUG;AACH,MAAM,OAAO,YAAY;IACf,OAAO,GAAG,IAAI,MAAM,EAAc,CAAA;IAClC,OAAO,GAAmB,EAAE,CAAA;IACpC,qGAAqG;IAC7F,WAAW,GAAsB,EAAE,CAAA;IACnC,gBAAgB,GAAG,KAAK,CAAA;IAEhC,GAAG,CAAC,KAAmB;QACrB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;QAC1D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACxB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QACvC,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAA;IAC9D,CAAC;IAED,QAAQ,CAAC,MAA+B;QACtC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAM;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC/C,MAAM,eAAe,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;QAC3F,MAAM,oBAAoB,GACxB,IAAI,CAAC,gBAAgB,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QAC7E,MAAM,MAAM,GAAG,IAAI,MAAM,EAAc,CAAA;QACvC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;QACtF,KAAK,MAAM,KAAK,IAAI,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;QAChF,IAAI,CAAC,OAAO,GAAG,MAAM,CAAA;QACrB,IAAI,CAAC,OAAO,GAAG,WAAW,CAAA;QAC1B,IAAI,CAAC,WAAW,GAAG,eAAe,CAAA;QAClC,IAAI,CAAC,gBAAgB,GAAG,oBAAoB,CAAA;IAC9C,CAAC;IAED,IAAI,CAAC,MAAc,EAAE,IAAY;QAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACxC,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,OAAO,CAAA;IACrB,CAAC;IAED,gBAAgB;QACd,OAAO,IAAI,CAAC,WAAW,CAAA;IACzB,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,UAAU,CAAA;IAC1D,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,gBAAgB,CAAA;IAC9B,CAAC;CACF"}
+{"version":3,"file":"route-catalog.js","sourceRoot":"","sources":["../../src/internal/route-catalog.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAe,MAAM,EAAoB,MAAM,qBAAqB,CAAA;AAgB3E;;;;;;;;;;GAUG;AACH,MAAM,OAAO,YAAY;IACf,OAAO,GAAG,IAAI,MAAM,EAAc,CAAA;IAClC,OAAO,GAAmB,EAAE,CAAA;IACpC,qGAAqG;IAC7F,WAAW,GAAsB,EAAE,CAAA;IACnC,gBAAgB,GAAG,KAAK,CAAA;IAEhC,GAAG,CAAC,KAAmB;QACrB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;QAC1D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACxB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QACvC,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAA;IAC9D,CAAC;IAED,QAAQ,CAAC,MAA+B;QACtC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAM;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC/C,MAAM,eAAe,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;QAC3F,MAAM,oBAAoB,GACxB,IAAI,CAAC,gBAAgB,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QAC7E,MAAM,MAAM,GAAG,IAAI,MAAM,EAAc,CAAA;QACvC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;QACtF,KAAK,MAAM,KAAK,IAAI,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;QAChF,IAAI,CAAC,OAAO,GAAG,MAAM,CAAA;QACrB,IAAI,CAAC,OAAO,GAAG,WAAW,CAAA;QAC1B,IAAI,CAAC,WAAW,GAAG,eAAe,CAAA;QAClC,IAAI,CAAC,gBAAgB,GAAG,oBAAoB,CAAA;IAC9C,CAAC;IAED,IAAI,CAAC,MAAc,EAAE,IAAY;QAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACxC,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,OAAO,CAAA;IACrB,CAAC;IAED;kEAC8D;IAC9D,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAA;IAC5B,CAAC;IAED,gBAAgB;QACd,OAAO,IAAI,CAAC,WAAW,CAAA;IACzB,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,UAAU,CAAA;IAC1D,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,gBAAgB,CAAA;IAC9B,CAAC;CACF"}

package/dist/internal/route-execution.d.ts

@@ -23,7 +23,7 @@ import type { ResolvedIdempotency } from "../server/idempotency-lane.js";
 import type { ResolvedEffectLedger } from "../server/ledger-lane.js";
 import type { Registry } from "../server/registry.js";
 import type { ResponseContractRuntime } from "../server/response-contract-lane.js";
-import type { HandlerResult } from "../server/runtime-core.js";
+import type { HandlerResult, ResponseResult } from "../server/runtime-core.js";
 import type { CtxSet, MaybePromise, RawContext, RequestSource, Server } from "../server/server.js";
 export type InternalHandler = (ctx: RawContext) => MaybePromise<HandlerResult>;
 /** A `derive` computes per-request context extensions; stored path-erased. */
@@ -32,8 +32,8 @@ export type RawBeforeHandle = (ctx: RawContext) => MaybePromise<unknown>;
 export type RawAfterHandle = (result: unknown, ctx: RawContext) => MaybePromise<unknown>;
 export type RawErrorHandler = (error: unknown, ctx: RawContext) => MaybePromise<unknown>;
 export type RawAround = <T>(ctx: RawContext, next: () => MaybePromise<T>) => MaybePromise<T>;
-export type RouteExecutionRunner = <T, R extends Registry, Ctx>(runtime: Server<R, Ctx>, entry: RouteEntry, source: RequestSource, params: Record<string, string>, search: string | undefined, signal: AbortSignal, budget: RequestBudget, platform: Platform | undefined, nativeContext: boolean, finalize: (result: unknown, set: CtxSet) => T, wrapResponse: (response: Response) => T) => MaybePromise<T>;
-export type ContextRouteRunner = <T, R extends Registry, Ctx>(runtime: Server<R, Ctx>, entry: RouteEntry, source: RequestSource, ctx: RawContext, finalize: (result: unknown, set: CtxSet) => T, wrapResponse: (response: Response) => T) => MaybePromise<T>;
+export type RouteExecutionRunner = <T, R extends Registry, Ctx>(runtime: Server<R, Ctx>, entry: RouteEntry, source: RequestSource, params: Record<string, string>, search: string | undefined, signal: AbortSignal, budget: RequestBudget, platform: Platform | undefined, nativeContext: boolean, finalize: (result: unknown, set: CtxSet) => T, wrapResponse: (response: Response | ResponseResult) => T) => MaybePromise<T>;
+export type ContextRouteRunner = <T, R extends Registry, Ctx>(runtime: Server<R, Ctx>, entry: RouteEntry, source: RequestSource, ctx: RawContext, finalize: (result: unknown, set: CtxSet) => T, wrapResponse: (response: Response | ResponseResult) => T) => MaybePromise<T>;
 export type RouteExecutionLane = "bare" | "body" | "query" | "lifecycle";
 export type LifecycleExecutionLane = "hooks" | "query" | "body" | "body-query" | undefined;
 /** Compile the one immutable route decision at registration time. The request path only invokes the
@@ -64,7 +64,13 @@ export interface RouteExecutionPlan {
 export interface RouteEntry {
     readonly handler: InternalHandler;
     readonly schema: RouteSchema | undefined;
-    /** Effective transport body cap; `undefined` is an explicit streaming/upload exemption. */
+    /**
+     * Effective transport body cap, already resolved at registration: the route's own
+     * `schema.bodyLimit` when it declared one, the server's `maxBodyBytes` otherwise. `undefined` is
+     * an explicit streaming/upload exemption (`bodyLimit: "unlimited"`) and means NO cap - readers
+     * must fall back to {@link UNLIMITED_BODY_BYTES}, never to the server default, which would be a
+     * tighter bound than the route asked for.
+     */
     readonly bodyLimit: number | undefined;
     /** Resolved idempotency config; `undefined` = off (the dedupe lane is never entered). */
     readonly idempotent: ResolvedIdempotency | undefined;
@@ -99,5 +105,5 @@ export interface RouteEntry {
 export type FusedWebRunner = (source: RequestSource, params: Record<string, string>, search: string | undefined, signal: AbortSignal, budget: RequestBudget, platform: Platform | undefined, nativeContext: boolean) => MaybePromise<Response>;
 /** Registration-compiled body lane. The finalizer receives the live context so Web can preserve lazy
  * response controls while Node can emit its native outcome directly. */
-export type FusedBodyRunner = <T>(source: RequestSource, params: Record<string, string>, search: string | undefined, signal: AbortSignal, budget: RequestBudget, platform: Platform | undefined, nativeContext: boolean, finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T, wrapResponse: (response: Response) => T) => MaybePromise<T>;
+export type FusedBodyRunner = <T>(source: RequestSource, params: Record<string, string>, search: string | undefined, signal: AbortSignal, budget: RequestBudget, platform: Platform | undefined, nativeContext: boolean, finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T, wrapResponse: (response: Response | ResponseResult) => T) => MaybePromise<T>;
 //# sourceMappingURL=route-execution.d.ts.map

package/dist/internal/route-execution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-execution.d.ts","sourceRoot":"","sources":["../../src/internal/route-execution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAEjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAA;AACxE,OAAO,KAAK,EAAuB,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAEzF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAErD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAClF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAElG,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,UAAU,KAAK,YAAY,CAAC,aAAa,CAAC,CAAA;AAE9E,8EAA8E;AAC9E,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,UAAU,KAAK,YAAY,CAAC,MAAM,CAAC,CAAA;AACjE,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,UAAU,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;AACxE,MAAM,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;AACxF,MAAM,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;AACxF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,CAAA;AAE5F,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,EAAE,CAAC,SAAS,QAAQ,EAAE,GAAG,EAC5D,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,EACvB,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,QAAQ,GAAG,SAAS,EAC9B,aAAa,EAAE,OAAO,EACtB,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC,EAC7C,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,CAAC,KACpC,YAAY,CAAC,CAAC,CAAC,CAAA;AAEpB,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,EAAE,CAAC,SAAS,QAAQ,EAAE,GAAG,EAC1D,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,EACvB,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,aAAa,EACrB,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC,EAC7C,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,CAAC,KACpC,YAAY,CAAC,CAAC,CAAC,CAAA;AAsFpB,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,WAAW,CAAA;AACxE,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,YAAY,GAAG,SAAS,CAAA;AAE1F;;;gFAGgF;AAChF,wBAAgB,yBAAyB,CAAC,OAAO,EAAE;IACjD,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;IACjC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,aAAa,EAAE,sBAAsB,CAAA;IAC9C,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,SAAS,CAAA;IAC7C,QAAQ,CAAC,SAAS,EAAE,eAAe,GAAG,SAAS,CAAA;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAA;CAC1D,GAAG,kBAAkB,CAwKrB;AAED;8FAC8F;AAC9F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,oBAAoB,CAAA;IAClC,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,SAAS,CAAA;IAC7C,QAAQ,CAAC,SAAS,EAAE,eAAe,GAAG,SAAS,CAAA;IAC/C;;qDAEiD;IACjD,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAA;CAC1D;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;IACjC,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,CAAA;IACxC,2FAA2F;IAC3F,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IACtC,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE,mBAAmB,GAAG,SAAS,CAAA;IACpD,gGAAgG;IAChG,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,SAAS,CAAA;IACnD;;6CAEyC;IACzC,QAAQ,CAAC,gBAAgB,EACrB;QAAE,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;KAAE,GAChF,SAAS,CAAA;IACb,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,CAAA;IAC1C,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IAClD;8DAC0D;IAC1D,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,eAAe,CAAC,CAAA;IACrD,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,cAAc,CAAC,CAAA;IACnD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,CAAA;IAChD,2FAA2F;IAC3F,QAAQ,CAAC,iBAAiB,EAAE,eAAe,GAAG,SAAS,CAAA;IACvD,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,CAAA;IACzC,uGAAuG;IACvG,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAA;CACvC;AAED,mGAAmG;AACnG,MAAM,MAAM,cAAc,GAAG,CAC3B,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,QAAQ,GAAG,SAAS,EAC9B,aAAa,EAAE,OAAO,KACnB,YAAY,CAAC,QAAQ,CAAC,CAAA;AAE3B;wEACwE;AACxE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,EAC9B,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,QAAQ,GAAG,SAAS,EAC9B,aAAa,EAAE,OAAO,EACtB,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,KAAK,CAAC,EAC9D,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,CAAC,KACpC,YAAY,CAAC,CAAC,CAAC,CAAA"}
+{"version":3,"file":"route-execution.d.ts","sourceRoot":"","sources":["../../src/internal/route-execution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAEjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAE7D,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAA;AACxE,OAAO,KAAK,EAAuB,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAEzF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAErD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAClF,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC9E,OAAO,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAElG,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,UAAU,KAAK,YAAY,CAAC,aAAa,CAAC,CAAA;AAE9E,8EAA8E;AAC9E,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,UAAU,KAAK,YAAY,CAAC,MAAM,CAAC,CAAA;AACjE,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,UAAU,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;AACxE,MAAM,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;AACxF,MAAM,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;AACxF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,CAAA;AAE5F,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,EAAE,CAAC,SAAS,QAAQ,EAAE,GAAG,EAC5D,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,EACvB,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,QAAQ,GAAG,SAAS,EAC9B,aAAa,EAAE,OAAO,EACtB,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC,EAC7C,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,KAAK,CAAC,KACrD,YAAY,CAAC,CAAC,CAAC,CAAA;AAEpB,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,EAAE,CAAC,SAAS,QAAQ,EAAE,GAAG,EAC1D,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,EACvB,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,aAAa,EACrB,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC,EAC7C,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,KAAK,CAAC,KACrD,YAAY,CAAC,CAAC,CAAC,CAAA;AAsFpB,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,WAAW,CAAA;AACxE,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,YAAY,GAAG,SAAS,CAAA;AAE1F;;;gFAGgF;AAChF,wBAAgB,yBAAyB,CAAC,OAAO,EAAE;IACjD,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;IACjC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,aAAa,EAAE,sBAAsB,CAAA;IAC9C,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,SAAS,CAAA;IAC7C,QAAQ,CAAC,SAAS,EAAE,eAAe,GAAG,SAAS,CAAA;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAA;CAC1D,GAAG,kBAAkB,CAwKrB;AAED;8FAC8F;AAC9F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,oBAAoB,CAAA;IAClC,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,SAAS,CAAA;IAC7C,QAAQ,CAAC,SAAS,EAAE,eAAe,GAAG,SAAS,CAAA;IAC/C;;qDAEiD;IACjD,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAA;CAC1D;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;IACjC,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,CAAA;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IACtC,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE,mBAAmB,GAAG,SAAS,CAAA;IACpD,gGAAgG;IAChG,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,SAAS,CAAA;IACnD;;6CAEyC;IACzC,QAAQ,CAAC,gBAAgB,EACrB;QAAE,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;KAAE,GAChF,SAAS,CAAA;IACb,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,CAAA;IAC1C,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IAClD;8DAC0D;IAC1D,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,eAAe,CAAC,CAAA;IACrD,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,cAAc,CAAC,CAAA;IACnD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,CAAA;IAChD,2FAA2F;IAC3F,QAAQ,CAAC,iBAAiB,EAAE,eAAe,GAAG,SAAS,CAAA;IACvD,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,CAAA;IACzC,uGAAuG;IACvG,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAA;CACvC;AAED,mGAAmG;AACnG,MAAM,MAAM,cAAc,GAAG,CAC3B,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,QAAQ,GAAG,SAAS,EAC9B,aAAa,EAAE,OAAO,KACnB,YAAY,CAAC,QAAQ,CAAC,CAAA;AAE3B;wEACwE;AACxE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,EAC9B,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,QAAQ,GAAG,SAAS,EAC9B,aAAa,EAAE,OAAO,EACtB,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,KAAK,CAAC,EAC9D,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,KAAK,CAAC,KACrD,YAAY,CAAC,CAAC,CAAC,CAAA"}

package/dist/internal/route-execution.js

@@ -1,3 +1,4 @@
+import { UNLIMITED_BODY_BYTES } from "../server/body.js";
 import { RequestContext } from "../server/request-context.js";
 /** Compile the one immutable route decision at registration time. The request path only invokes the
  * selected closure; it never repeats this eligibility ladder. The closures reach the kernel's private
@@ -43,7 +44,7 @@ export function compileRouteExecutionPlan(options) {
         : inner;
     const run = (runtime, entry, source, params, search, signal, budget, platform, nativeContext, finalize, wrapResponse) => {
         const server = runtime;
-        const maxBodyBytes = entry.bodyLimit ?? server.maxBodyBytes;
+        const maxBodyBytes = entry.bodyLimit ?? UNLIMITED_BODY_BYTES;
         const ctx = nativeContext
             ? RequestContext.native(source, params, search, maxBodyBytes, platform, server.protoPoisoning)
             : new RequestContext(source, params, search, signal, budget, platform, maxBodyBytes, server.protoPoisoning);

package/dist/internal/route-execution.js.map

@@ -1 +1 @@
-{"version":3,"file":"route-execution.js","sourceRoot":"","sources":["../../src/internal/route-execution.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AA4H7D;;;gFAGgF;AAChF,MAAM,UAAU,yBAAyB,CAAC,OASzC;IACC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,GAC9F,OAAO,CAAA;IAET,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,GAAG,GAAyB,CAChC,OAAO,EACP,KAAK,EACL,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,QAAQ,EACR,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,EAAE,CACD,OAA4C,CAAC,kBAAkB,CAC9D,KAAK,EACL,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,YAAY,CACb,CAAA;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAA;IAC/D,CAAC;IAED,IAAI,KAAyB,CAAA;IAC7B,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,KAAK,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAC9D,OAA4C,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAA;YAC3F,MAAK;QACP,KAAK,MAAM;YACT,KAAK,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAC7D,OAA4C,CAAC,WAAW,CACvD,KAAK,EACL,MAAM,EACN,GAAG,EACH,QAAQ,EACR,YAAY,CACb,CAAA;YACH,MAAK;QACP,KAAK,OAAO;YACV,KAAK,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAC9D,OAA4C,CAAC,YAAY,CACxD,KAAK,EACL,GAAG,EACH,QAAQ,EACR,YAAY,CACb,CAAA;YACH,MAAK;QACP;YACE,QAAQ,aAAa,EAAE,CAAC;gBACtB,KAAK,OAAO;oBACV,KAAK,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAC9D,OAA4C,CAAC,iBAAiB,CAC7D,KAAK,EACL,GAAG,EACH,QAAQ,EACR,YAAY,CACb,CAAA;oBACH,MAAK;gBACP,KAAK,OAAO;oBACV,KAAK,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAC9D,OAA4C,CAAC,iBAAiB,CAC7D,KAAK,EACL,GAAG,EACH,QAAQ,EACR,YAAY,CACb,CAAA;oBACH,MAAK;gBACP,KAAK,MAAM;oBACT,KAAK,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAC7D,OAA4C,CAAC,gBAAgB,CAC5D,KAAK,EACL,MAAM,EACN,GAAG,EACH,QAAQ,EACR,YAAY,CACb,CAAA;oBACH,MAAK;gBACP,KAAK,YAAY;oBACf,KAAK,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAC7D,OAA4C,CAAC,qBAAqB,CACjE,KAAK,EACL,MAAM,EACN,GAAG,EACH,QAAQ,EACR,YAAY,CACb,CAAA;oBACH,MAAK;gBACP;oBACE,KAAK,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAC7D,OAA4C,CAAC,YAAY,CACxD,KAAK,EACL,MAAM,EACN,GAAG,EACH,QAAQ,EACR,YAAY,CACb,CAAA;YACP,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAuB,SAAS;QAC3C,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CACrD,OAA4C,CAAC,aAAa,CACzD,KAAK,EACL,GAAG,EACH,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,EAChE,QAAQ,EACR,YAAY,CACb;QACL,CAAC,CAAC,KAAK,CAAA;IAET,MAAM,GAAG,GAAyB,CAChC,OAAO,EACP,KAAK,EACL,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,QAAQ,EACR,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,EAAE;QACF,MAAM,MAAM,GAAG,OAA2C,CAAA;QAC1D,MAAM,YAAY,GAAG,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,YAAY,CAAA;QAC3D,MAAM,GAAG,GAAG,aAAa;YACvB,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC;YAC9F,CAAC,CAAC,IAAI,cAAc,CAChB,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,MAAM,CAAC,cAAc,CACtB,CAAA;QACL,IAAI,MAAiC,CAAA;QACrC,2FAA2F;QAC3F,MAAM,aAAa,GAAG,MAAM,CAAC,mBAAmB,CAAA;QAChD,IAAI,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAgC,CAAA;YACvD,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YACvC,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACnC,CAAC;QACD,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAA;QAC1E,IAAI,MAAM,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YACxD,MAAM,MAAM,GAAG,MAAM,CAAA;YACrB,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAgC,CAAA;YACvD,OAAO,GAAG,CAAC,OAAO,YAAY,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACzF,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,CACvD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,MAAM,CAAC,CACzD,CACF,CAAA;QACH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC,CAAA;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAA;AAC/D,CAAC"}
+{"version":3,"file":"route-execution.js","sourceRoot":"","sources":["../../src/internal/route-execution.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAMxD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AA4H7D;;;gFAGgF;AAChF,MAAM,UAAU,yBAAyB,CAAC,OASzC;IACC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,GAC9F,OAAO,CAAA;IAET,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,GAAG,GAAyB,CAChC,OAAO,EACP,KAAK,EACL,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,QAAQ,EACR,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,EAAE,CACD,OAA4C,CAAC,kBAAkB,CAC9D,KAAK,EACL,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,YAAY,CACb,CAAA;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAA;IAC/D,CAAC;IAED,IAAI,KAAyB,CAAA;IAC7B,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,KAAK,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAC9D,OAA4C,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAA;YAC3F,MAAK;QACP,KAAK,MAAM;YACT,KAAK,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAC7D,OAA4C,CAAC,WAAW,CACvD,KAAK,EACL,MAAM,EACN,GAAG,EACH,QAAQ,EACR,YAAY,CACb,CAAA;YACH,MAAK;QACP,KAAK,OAAO;YACV,KAAK,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAC9D,OAA4C,CAAC,YAAY,CACxD,KAAK,EACL,GAAG,EACH,QAAQ,EACR,YAAY,CACb,CAAA;YACH,MAAK;QACP;YACE,QAAQ,aAAa,EAAE,CAAC;gBACtB,KAAK,OAAO;oBACV,KAAK,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAC9D,OAA4C,CAAC,iBAAiB,CAC7D,KAAK,EACL,GAAG,EACH,QAAQ,EACR,YAAY,CACb,CAAA;oBACH,MAAK;gBACP,KAAK,OAAO;oBACV,KAAK,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAC9D,OAA4C,CAAC,iBAAiB,CAC7D,KAAK,EACL,GAAG,EACH,QAAQ,EACR,YAAY,CACb,CAAA;oBACH,MAAK;gBACP,KAAK,MAAM;oBACT,KAAK,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAC7D,OAA4C,CAAC,gBAAgB,CAC5D,KAAK,EACL,MAAM,EACN,GAAG,EACH,QAAQ,EACR,YAAY,CACb,CAAA;oBACH,MAAK;gBACP,KAAK,YAAY;oBACf,KAAK,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAC7D,OAA4C,CAAC,qBAAqB,CACjE,KAAK,EACL,MAAM,EACN,GAAG,EACH,QAAQ,EACR,YAAY,CACb,CAAA;oBACH,MAAK;gBACP;oBACE,KAAK,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAC7D,OAA4C,CAAC,YAAY,CACxD,KAAK,EACL,MAAM,EACN,GAAG,EACH,QAAQ,EACR,YAAY,CACb,CAAA;YACP,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAuB,SAAS;QAC3C,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CACrD,OAA4C,CAAC,aAAa,CACzD,KAAK,EACL,GAAG,EACH,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,EAChE,QAAQ,EACR,YAAY,CACb;QACL,CAAC,CAAC,KAAK,CAAA;IAET,MAAM,GAAG,GAAyB,CAChC,OAAO,EACP,KAAK,EACL,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,QAAQ,EACR,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,EAAE;QACF,MAAM,MAAM,GAAG,OAA2C,CAAA;QAC1D,MAAM,YAAY,GAAG,KAAK,CAAC,SAAS,IAAI,oBAAoB,CAAA;QAC5D,MAAM,GAAG,GAAG,aAAa;YACvB,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC;YAC9F,CAAC,CAAC,IAAI,cAAc,CAChB,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,MAAM,CAAC,cAAc,CACtB,CAAA;QACL,IAAI,MAAiC,CAAA;QACrC,2FAA2F;QAC3F,MAAM,aAAa,GAAG,MAAM,CAAC,mBAAmB,CAAA;QAChD,IAAI,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAgC,CAAA;YACvD,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YACvC,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACnC,CAAC;QACD,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAA;QAC1E,IAAI,MAAM,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YACxD,MAAM,MAAM,GAAG,MAAM,CAAA;YACrB,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAgC,CAAA;YACvD,OAAO,GAAG,CAAC,OAAO,YAAY,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACzF,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,CACvD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,MAAM,CAAC,CACzD,CACF,CAAA;QACH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC,CAAA;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAA;AAC/D,CAAC"}

package/dist/response-observer.d.ts

@@ -0,0 +1,25 @@
+import type { AnyServer } from "./server/server.js";
+export type { ResponseBodyHook, ResponseHeadersHook, ResponseObserverMethods, ResponseObserverRuntime, } from "./server/response-observer-runtime.js";
+/** A server shape with the opt-in response observation methods installed. */
+export type ResponseObserverServer<S extends AnyServer> = S & import("./server/response-observer-runtime.js").ResponseObserverMethods;
+/** A plugin that enables response header, body, and raw-response observation methods. */
+export type ResponseObserverPlugin = (<S extends AnyServer>(app: S) => ResponseObserverServer<S>) & {
+    readonly pluginName?: string;
+};
+/**
+ * Enable the response observation methods on a server.
+ *
+ * The default server does not carry the header, body, or raw-response observation adapters. Apply
+ * this plugin before using those methods:
+ *
+ * ```ts
+ * import { responseObserver } from "@nifrajs/core/response-observer"
+ * const app = server().use(responseObserver()).onResponseHeaders((headers) => {
+ *   headers.set("cache-control", "no-store")
+ * })
+ * ```
+ */
+export declare function responseObserver(): ResponseObserverPlugin;
+/** Attach the opt-in observer runtime to a middleware bundle that uses response observation. */
+export declare function withResponseObserver<T extends object>(middleware: T): T;
+//# sourceMappingURL=response-observer.d.ts.map

package/dist/response-observer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-observer.d.ts","sourceRoot":"","sources":["../src/response-observer.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAEnD,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,uCAAuC,CAAA;AAE9C,6EAA6E;AAC7E,MAAM,MAAM,sBAAsB,CAAC,CAAC,SAAS,SAAS,IAAI,CAAC,GACzD,OAAO,uCAAuC,EAAE,uBAAuB,CAAA;AAEzE,yFAAyF;AACzF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,CAAC,SAAS,SAAS,EACxD,GAAG,EAAE,CAAC,KACH,sBAAsB,CAAC,CAAC,CAAC,CAAC,GAAG;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAElE;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,IAAI,sBAAsB,CAiBzD;AAED,gGAAgG;AAChG,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,MAAM,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,CAOvE"}

package/dist/response-observer.js

@@ -0,0 +1,40 @@
+import { INSTALL_RESPONSE_OBSERVER } from "./server/install.js";
+import { createResponseObserverRuntime, } from "./server/response-observer-runtime.js";
+/**
+ * Enable the response observation methods on a server.
+ *
+ * The default server does not carry the header, body, or raw-response observation adapters. Apply
+ * this plugin before using those methods:
+ *
+ * ```ts
+ * import { responseObserver } from "@nifrajs/core/response-observer"
+ * const app = server().use(responseObserver()).onResponseHeaders((headers) => {
+ *   headers.set("cache-control", "no-store")
+ * })
+ * ```
+ */
+export function responseObserver() {
+    const apply = (app) => {
+        const install = app[INSTALL_RESPONSE_OBSERVER];
+        if (typeof install !== "function") {
+            throw new TypeError("[nifra] responseObserver() requires a compatible Server");
+        }
+        const methods = install.call(app, createResponseObserverRuntime());
+        if (methods === null || typeof methods !== "object") {
+            throw new TypeError("[nifra] responseObserver() failed to install its methods");
+        }
+        Object.assign(app, methods);
+        return app;
+    };
+    return Object.assign(apply, { pluginName: "nifra:response-observer" });
+}
+/** Attach the opt-in observer runtime to a middleware bundle that uses response observation. */
+export function withResponseObserver(middleware) {
+    Object.defineProperty(middleware, INSTALL_RESPONSE_OBSERVER, {
+        value: createResponseObserverRuntime(),
+        enumerable: false,
+        configurable: false,
+    });
+    return middleware;
+}
+//# sourceMappingURL=response-observer.js.map

package/dist/response-observer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-observer.js","sourceRoot":"","sources":["../src/response-observer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EACL,6BAA6B,GAE9B,MAAM,uCAAuC,CAAA;AAmB9C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,KAAK,GAAG,CAAsB,GAAM,EAA6B,EAAE;QACvE,MAAM,OAAO,GAAI,GAA0C,CAAC,yBAAyB,CAAC,CAAA;QACtF,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;YAClC,MAAM,IAAI,SAAS,CAAC,yDAAyD,CAAC,CAAA;QAChF,CAAC;QACD,MAAM,OAAO,GAAI,OAAyD,CAAC,IAAI,CAC7E,GAAG,EACH,6BAA6B,EAAE,CAChC,CAAA;QACD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,IAAI,SAAS,CAAC,0DAA0D,CAAC,CAAA;QACjF,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAC3B,OAAO,GAAgC,CAAA;IACzC,CAAC,CAAA;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,yBAAyB,EAAE,CAAC,CAAA;AACxE,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,oBAAoB,CAAmB,UAAa;IAClE,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,yBAAyB,EAAE;QAC3D,KAAK,EAAE,6BAA6B,EAAE;QACtC,UAAU,EAAE,KAAK;QACjB,YAAY,EAAE,KAAK;KACpB,CAAC,CAAA;IACF,OAAO,UAAU,CAAA;AACnB,CAAC"}

package/dist/security/baseline.d.ts

@@ -0,0 +1,68 @@
+import type { AssurancePolicy } from "../assurance.js";
+/**
+ * How much a {@link securityBaseline} demands. Each level is a superset of the one before it, so
+ * raising the level only ever adds findings.
+ *
+ * - `"essential"` - the invariants that hold for ANY app and never false-positive on a reasonable
+ *   one: a body read must be bounded, an unlimited body may never claim to be bounded, an agent tool
+ *   ingress must be bounded, and an authenticated state change must prove CSRF. Every required piece
+ *   of evidence here is either published by the core from the route schema or only demanded when the
+ *   route already opted into the risk (CSRF is required only where authentication is present). Safe to
+ *   adopt on day one.
+ * - `"standard"` (default) - essential, plus: a route the app itself classified as `pii` or higher
+ *   must be authenticated, whether it reads or writes. High signal, low noise - it fires only on
+ *   routes the application already labelled sensitive.
+ * - `"strict"` - standard, plus the opinionated, higher-friction requirements: every route must carry
+ *   a response contract, every read must carry security headers, and every mutation must be rate
+ *   limited. These need middleware the app has to install, so they are opt-in rather than default.
+ */
+export type SecurityBaselineLevel = "essential" | "standard" | "strict";
+/** Tuning for {@link securityBaseline}. Every knob only ever tightens the policy. */
+export interface SecurityBaselineOptions {
+    /** How much the baseline demands. Default `"standard"`. See {@link SecurityBaselineLevel}. */
+    readonly level?: SecurityBaselineLevel;
+    /**
+     * How to treat a route no rule matched. Default `"ignore"` so the baseline is purely additive - it
+     * asserts the invariants below and stays silent on everything else, which lets a project adopt it
+     * without first classifying its whole route table. Set `"error"` to make an unclassified route a
+     * finding, turning the baseline into a closed allow-list (recommended once the table is covered).
+     */
+    readonly unmatched?: "error" | "ignore";
+    /**
+     * Require that a matched route's evidence was installed by runtime enforcement (middleware/plugin
+     * or framework policy) rather than asserted inline on `schema.assurance`. Default `true`: an author
+     * label is not proof, and a security baseline that accepts labels is theater. Set `false` only to
+     * stage adoption before guards emit runtime evidence.
+     */
+    readonly requireRuntimeProvenance?: boolean;
+}
+/**
+ * A first-match-wins security policy that turns the recurring audit finding classes into machine
+ * checked route invariants. Composed only from the public assurance engine, so it inherits its
+ * fail-closed evaluation, provenance checks, and selector validation - no bespoke evaluator.
+ *
+ * The rules are ordered most-specific-first because assurance evaluation is first-match-wins: each
+ * route is owned by exactly one rule, so that rule carries the FULL requirement bundle for its class
+ * (a body-carrying mutation proves bounded-body AND CSRF in one rule, not two). Raising the `level`
+ * widens those bundles; it never reorders them.
+ *
+ * Coverage by level (see {@link SecurityBaselineLevel} for the rationale):
+ *
+ * | invariant | essential | standard | strict |
+ * | --- | :-: | :-: | :-: |
+ * | unlimited body can never be "bounded" (F-001) | ✓ | ✓ | ✓ |
+ * | every body read is bounded | ✓ | ✓ | ✓ |
+ * | agent tool ingress is bounded | ✓ | ✓ | ✓ |
+ * | authenticated mutation proves CSRF | ✓ | ✓ | ✓ |
+ * | pii+ route is authenticated | | ✓ | ✓ |
+ * | every route carries a response contract | | | ✓ |
+ * | every read carries security headers | | | ✓ |
+ * | every mutation is rate limited | | | ✓ |
+ *
+ * The baseline deliberately does not select on `access`/`zone` capabilities: those selectors require
+ * capability definitions and would make the preset refuse an app that declares none. Extend the
+ * returned policy's `rules` for capability- or path-specific requirements; put more specific rules
+ * before these so they own their routes first.
+ */
+export declare function securityBaseline(options?: SecurityBaselineOptions): AssurancePolicy;
+//# sourceMappingURL=baseline.d.ts.map

package/dist/security/baseline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseline.d.ts","sourceRoot":"","sources":["../../src/security/baseline.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAiB,MAAM,iBAAiB,CAAA;AAGrE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,qBAAqB,GAAG,WAAW,GAAG,UAAU,GAAG,QAAQ,CAAA;AAEvE,qFAAqF;AACrF,MAAM,WAAW,uBAAuB;IACtC,8FAA8F;IAC9F,QAAQ,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAA;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAA;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAA;CAC5C;AAOD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,uBAA4B,GAAG,eAAe,CAgGvF"}