@nifrajs/core 2.14.1 → 3.2.0

package/dist/internal/route-program.js

@@ -0,0 +1,199 @@
+/**
+ * Registration-compiled general route program.
+ *
+ * This is deliberately a data-and-control-flow compiler, not source generation: user functions and
+ * schemas remain opaque references and no request value is ever converted into executable code. The
+ * program is frozen at registration so the request path walks one immutable stage sequence instead
+ * of rediscovering which lifecycle features are present.
+ */
+import { CONTEXT_SET, EMPTY_RESPONSE_CONTROLS, isResponseResult, } from "../server/runtime-core.js";
+/** Build the immutable stage sequence once, while the server is still configurable. */
+export function compileRouteProgram(input) {
+    const stages = [];
+    const validationStages = [];
+    const schema = input.schema;
+    if (schema?.headers !== undefined) {
+        const stage = { kind: "headers", schema: schema.headers };
+        stages.push(stage);
+        validationStages.push(stage);
+    }
+    if (schema?.params !== undefined) {
+        const stage = { kind: "params", schema: schema.params };
+        stages.push(stage);
+        validationStages.push(stage);
+    }
+    if (schema?.body !== undefined) {
+        const stage = { kind: "body", schema: schema.body };
+        stages.push(stage);
+        validationStages.push(stage);
+    }
+    if (schema?.query !== undefined) {
+        const stage = { kind: "query", schema: schema.query };
+        stages.push(stage);
+        validationStages.push(stage);
+    }
+    for (const derive of input.derives)
+        stages.push({ kind: "derive", run: derive });
+    for (const before of input.beforeHandle)
+        stages.push({ kind: "before", run: before });
+    stages.push({ kind: "handler", run: input.handler });
+    for (const after of input.afterHandle)
+        stages.push({ kind: "after", run: after });
+    return Object.freeze({
+        stages: Object.freeze(stages),
+        validationStages: Object.freeze(validationStages),
+        derives: Object.freeze([...input.derives]),
+        beforeHandle: Object.freeze([...input.beforeHandle]),
+        afterHandle: Object.freeze([...input.afterHandle]),
+        onError: Object.freeze([...input.onError]),
+        handler: input.handler,
+        decorations: Object.freeze({ ...input.decorations }),
+        hasDecorations: input.hasDecorations,
+        bodySchema: input.bodySchema,
+        bodyLimit: input.bodyLimit,
+        responseContract: input.responseContract,
+    });
+}
+function responseSet(ctx) {
+    return ctx[CONTEXT_SET]() ?? EMPTY_RESPONSE_CONTROLS;
+}
+function isEarly(value) {
+    return value instanceof Response || isResponseResult(value);
+}
+/** Execute the general program. The first synchronous stage sequence stays synchronous. */
+export function executeRouteProgram(runtime, entry, program, source, ctx, finalize, wrapResponse) {
+    const host = runtime;
+    try {
+        if (program.hasDecorations)
+            Object.assign(ctx, program.decorations);
+        return runSync(host, entry, program, source, ctx, finalize, wrapResponse, 0, undefined);
+    }
+    catch (error) {
+        return host.handleProgramError(entry, error, ctx, finalize, wrapResponse);
+    }
+}
+function runSync(host, entry, program, source, ctx, finalize, wrapResponse, validationIndex, initial) {
+    const validations = program.validationStages;
+    for (let i = validationIndex; i < validations.length; i++) {
+        const stage = validations[i];
+        const outcome = stage.kind === "body"
+            ? host.readProgramBody(entry, source, ctx)
+            : host.validateProgramStage(entry, stage, source, ctx);
+        if (outcome instanceof Promise) {
+            return continueProgram(host, entry, program, source, ctx, finalize, wrapResponse, { kind: "validation", next: i + 1 }, outcome, initial);
+        }
+        if (outcome !== undefined)
+            return wrapResponse(outcome);
+    }
+    return runHooksSync(host, entry, program, source, ctx, finalize, wrapResponse, 0, 0, 0, initial);
+}
+function runHooksSync(host, entry, program, source, ctx, finalize, wrapResponse, deriveIndex, beforeIndex, afterIndex, initial) {
+    for (let i = deriveIndex; i < program.derives.length; i++) {
+        const outcome = program.derives[i](ctx);
+        if (outcome instanceof Promise) {
+            return continueProgram(host, entry, program, source, ctx, finalize, wrapResponse, { kind: "derive", next: i + 1 }, outcome, initial);
+        }
+        if (isEarly(outcome))
+            return finalize(outcome, responseSet(ctx));
+        Object.assign(ctx, outcome);
+    }
+    for (let i = beforeIndex; i < program.beforeHandle.length; i++) {
+        const outcome = program.beforeHandle[i](ctx);
+        if (outcome instanceof Promise) {
+            return continueProgram(host, entry, program, source, ctx, finalize, wrapResponse, { kind: "before", next: i + 1 }, outcome, initial);
+        }
+        if (outcome !== undefined)
+            return finalize(outcome, responseSet(ctx));
+    }
+    const output = program.handler(ctx);
+    if (output instanceof Promise) {
+        return continueProgram(host, entry, program, source, ctx, finalize, wrapResponse, { kind: "handler" }, output, initial);
+    }
+    let result = output;
+    for (let i = afterIndex; i < program.afterHandle.length; i++) {
+        const outcome = program.afterHandle[i](result, ctx);
+        if (outcome instanceof Promise) {
+            return continueProgram(host, entry, program, source, ctx, finalize, wrapResponse, { kind: "after", next: i + 1 }, outcome, result);
+        }
+        result = outcome;
+    }
+    return host.finishProgramResult(entry, ctx, result, finalize, wrapResponse);
+}
+async function continueProgram(host, entry, program, source, ctx, finalize, wrapResponse, pendingPhase, pending, initial) {
+    try {
+        const settled = await pending;
+        let result = initial;
+        if (pendingPhase.kind === "validation") {
+            if (settled !== undefined)
+                return wrapResponse(settled);
+        }
+        else if (pendingPhase.kind === "derive") {
+            if (isEarly(settled))
+                return finalize(settled, responseSet(ctx));
+            Object.assign(ctx, settled);
+        }
+        else if (pendingPhase.kind === "before") {
+            if (settled !== undefined)
+                return finalize(settled, responseSet(ctx));
+        }
+        else if (pendingPhase.kind === "handler") {
+            result = settled;
+        }
+        else {
+            result = settled;
+        }
+        return await runAsyncStages(host, entry, program, source, ctx, finalize, wrapResponse, pendingPhase, result);
+    }
+    catch (error) {
+        return await host.handleProgramError(entry, error, ctx, finalize, wrapResponse);
+    }
+}
+async function runAsyncStages(host, entry, program, source, ctx, finalize, wrapResponse, pendingPhase, result) {
+    try {
+        if (pendingPhase.kind === "validation") {
+            const validations = program.validationStages;
+            for (let i = pendingPhase.next; i < validations.length; i++) {
+                const stage = validations[i];
+                const outcome = stage.kind === "body"
+                    ? await host.readProgramBody(entry, source, ctx)
+                    : host.validateProgramStage(entry, stage, source, ctx);
+                const settled = outcome instanceof Promise ? await outcome : outcome;
+                if (settled !== undefined)
+                    return wrapResponse(settled);
+            }
+        }
+        const deriveStart = pendingPhase.kind === "derive" ? pendingPhase.next : 0;
+        if (pendingPhase.kind === "validation" || pendingPhase.kind === "derive") {
+            for (let i = deriveStart; i < program.derives.length; i++) {
+                const outcome = program.derives[i](ctx);
+                const settled = outcome instanceof Promise ? await outcome : outcome;
+                if (isEarly(settled))
+                    return finalize(settled, responseSet(ctx));
+                Object.assign(ctx, settled);
+            }
+        }
+        const beforeStart = pendingPhase.kind === "before" ? pendingPhase.next : 0;
+        if (pendingPhase.kind === "validation" ||
+            pendingPhase.kind === "derive" ||
+            pendingPhase.kind === "before") {
+            for (let i = beforeStart; i < program.beforeHandle.length; i++) {
+                const outcome = program.beforeHandle[i](ctx);
+                const settled = outcome instanceof Promise ? await outcome : outcome;
+                if (settled !== undefined)
+                    return finalize(settled, responseSet(ctx));
+            }
+            const output = program.handler(ctx);
+            result = output instanceof Promise ? await output : output;
+        }
+        const afterStart = pendingPhase.kind === "after" ? pendingPhase.next : 0;
+        for (let i = afterStart; i < program.afterHandle.length; i++) {
+            const outcome = program.afterHandle[i](result, ctx);
+            result = outcome instanceof Promise ? await outcome : outcome;
+        }
+        return await host.finishProgramResult(entry, ctx, result, finalize, wrapResponse);
+    }
+    catch (error) {
+        return await host.handleProgramError(entry, error, ctx, finalize, wrapResponse);
+    }
+}
+//# sourceMappingURL=route-program.js.map

package/dist/internal/route-program.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-program.js","sourceRoot":"","sources":["../../src/internal/route-program.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,gBAAgB,GAEjB,MAAM,2BAA2B,CAAA;AAkDlC,uFAAuF;AACvF,MAAM,UAAU,mBAAmB,CAAC,KAAwB;IAC1D,MAAM,MAAM,GAAwB,EAAE,CAAA;IACtC,MAAM,gBAAgB,GAAkE,EAAE,CAAA;IAC1F,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;IAC3B,IAAI,MAAM,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAW,CAAA;QAClE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClB,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9B,CAAC;IACD,IAAI,MAAM,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAW,CAAA;QAChE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClB,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9B,CAAC;IACD,IAAI,MAAM,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAW,CAAA;QAC5D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClB,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9B,CAAC;IACD,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAW,CAAA;QAC9D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClB,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9B,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;IAChF,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,YAAY;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;IACrF,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;IACpD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,WAAW;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;IAEjF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC;QACjD,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1C,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;QACpD,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;QAClD,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACpD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAA;AACJ,CAAC;AA8BD,SAAS,WAAW,CAAC,GAAe;IAClC,OAAO,GAAG,CAAC,WAAW,CAAC,EAAE,IAAI,uBAAuB,CAAA;AACtD,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,YAAY,QAAQ,IAAI,gBAAgB,CAAC,KAAK,CAAC,CAAA;AAC7D,CAAC;AAWD,2FAA2F;AAC3F,MAAM,UAAU,mBAAmB,CACjC,OAAuB,EACvB,KAAiB,EACjB,OAAqB,EACrB,MAAqB,EACrB,GAAe,EACf,QAA6C,EAC7C,YAAwD;IAExD,MAAM,IAAI,GAAG,OAAyC,CAAA;IACtD,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,cAAc;YAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAA;QACnE,OAAO,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;IACzF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAA;IAC3E,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CACd,IAAyB,EACzB,KAAiB,EACjB,OAAqB,EACrB,MAAqB,EACrB,GAAe,EACf,QAA6C,EAC7C,YAAwD,EACxD,eAAuB,EACvB,OAAgB;IAEhB,MAAM,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAA;IAC5C,KAAK,IAAI,CAAC,GAAG,eAAe,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAE,CAAA;QAC7B,MAAM,OAAO,GACX,KAAK,CAAC,IAAI,KAAK,MAAM;YACnB,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC;YAC1C,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;QAC1D,IAAI,OAAO,YAAY,OAAO,EAAE,CAAC;YAC/B,OAAO,eAAe,CACpB,IAAI,EACJ,KAAK,EACL,OAAO,EACP,MAAM,EACN,GAAG,EACH,QAAQ,EACR,YAAY,EACZ,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,EACnC,OAAO,EACP,OAAO,CACR,CAAA;QACH,CAAC;QACD,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,YAAY,CAAC,OAAO,CAAC,CAAA;IACzD,CAAC;IACD,OAAO,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAA;AAClG,CAAC;AAED,SAAS,YAAY,CACnB,IAAyB,EACzB,KAAiB,EACjB,OAAqB,EACrB,MAAqB,EACrB,GAAe,EACf,QAA6C,EAC7C,YAAwD,EACxD,WAAmB,EACnB,WAAmB,EACnB,UAAkB,EAClB,OAAgB;IAEhB,KAAK,IAAI,CAAC,GAAG,WAAW,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAA;QACxC,IAAI,OAAO,YAAY,OAAO,EAAE,CAAC;YAC/B,OAAO,eAAe,CACpB,IAAI,EACJ,KAAK,EACL,OAAO,EACP,MAAM,EACN,GAAG,EACH,QAAQ,EACR,YAAY,EACZ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,EAC/B,OAAO,EACP,OAAO,CACR,CAAA;QACH,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,CAAC;YAAE,OAAO,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;QAChE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IAC7B,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,WAAW,EAAE,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAA;QAC7C,IAAI,OAAO,YAAY,OAAO,EAAE,CAAC;YAC/B,OAAO,eAAe,CACpB,IAAI,EACJ,KAAK,EACL,OAAO,EACP,MAAM,EACN,GAAG,EACH,QAAQ,EACR,YAAY,EACZ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,EAC/B,OAAO,EACP,OAAO,CACR,CAAA;QACH,CAAC;QACD,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;IACvE,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACnC,IAAI,MAAM,YAAY,OAAO,EAAE,CAAC;QAC9B,OAAO,eAAe,CACpB,IAAI,EACJ,KAAK,EACL,OAAO,EACP,MAAM,EACN,GAAG,EACH,QAAQ,EACR,YAAY,EACZ,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,MAAM,EACN,OAAO,CACR,CAAA;IACH,CAAC;IACD,IAAI,MAAM,GAAG,MAAM,CAAA;IACnB,KAAK,IAAI,CAAC,GAAG,UAAU,EAAE,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACpD,IAAI,OAAO,YAAY,OAAO,EAAE,CAAC;YAC/B,OAAO,eAAe,CACpB,IAAI,EACJ,KAAK,EACL,OAAO,EACP,MAAM,EACN,GAAG,EACH,QAAQ,EACR,YAAY,EACZ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,EAC9B,OAAO,EACP,MAAM,CACP,CAAA;QACH,CAAC;QACD,MAAM,GAAG,OAAO,CAAA;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAA;AAC7E,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,IAAyB,EACzB,KAAiB,EACjB,OAAqB,EACrB,MAAqB,EACrB,GAAe,EACf,QAA6C,EAC7C,YAAwD,EACxD,YAA0B,EAC1B,OAAyB,EACzB,OAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAA;QAC7B,IAAI,MAAM,GAAG,OAAO,CAAA;QACpB,IAAI,YAAY,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACvC,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,YAAY,CAAC,OAAoC,CAAC,CAAA;QACtF,CAAC;aAAM,IAAI,YAAY,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1C,IAAI,OAAO,CAAC,OAAO,CAAC;gBAAE,OAAO,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;YAChE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAC7B,CAAC;aAAM,IAAI,YAAY,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1C,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;QACvE,CAAC;aAAM,IAAI,YAAY,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC3C,MAAM,GAAG,OAAO,CAAA;QAClB,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,OAAO,CAAA;QAClB,CAAC;QACD,OAAO,MAAM,cAAc,CACzB,IAAI,EACJ,KAAK,EACL,OAAO,EACP,MAAM,EACN,GAAG,EACH,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,MAAM,CACP,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAA;IACjF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,IAAyB,EACzB,KAAiB,EACjB,OAAqB,EACrB,MAAqB,EACrB,GAAe,EACf,QAA6C,EAC7C,YAAwD,EACxD,YAA0B,EAC1B,MAAe;IAEf,IAAI,CAAC;QACH,IAAI,YAAY,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACvC,MAAM,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAA;YAC5C,KAAK,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5D,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAE,CAAA;gBAC7B,MAAM,OAAO,GACX,KAAK,CAAC,IAAI,KAAK,MAAM;oBACnB,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC;oBAChD,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;gBAC1D,MAAM,OAAO,GAAG,OAAO,YAAY,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,OAAO,CAAA;gBACpE,IAAI,OAAO,KAAK,SAAS;oBAAE,OAAO,YAAY,CAAC,OAAO,CAAC,CAAA;YACzD,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QAC1E,IAAI,YAAY,CAAC,IAAI,KAAK,YAAY,IAAI,YAAY,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACzE,KAAK,IAAI,CAAC,GAAG,WAAW,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAA;gBACxC,MAAM,OAAO,GAAG,OAAO,YAAY,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,OAAO,CAAA;gBACpE,IAAI,OAAO,CAAC,OAAO,CAAC;oBAAE,OAAO,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;gBAChE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;YAC7B,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QAC1E,IACE,YAAY,CAAC,IAAI,KAAK,YAAY;YAClC,YAAY,CAAC,IAAI,KAAK,QAAQ;YAC9B,YAAY,CAAC,IAAI,KAAK,QAAQ,EAC9B,CAAC;YACD,KAAK,IAAI,CAAC,GAAG,WAAW,EAAE,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAA;gBAC7C,MAAM,OAAO,GAAG,OAAO,YAAY,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,OAAO,CAAA;gBACpE,IAAI,OAAO,KAAK,SAAS;oBAAE,OAAO,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;YACvE,CAAC;YACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACnC,MAAM,GAAG,MAAM,YAAY,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;QAC5D,CAAC;QAED,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QACxE,KAAK,IAAI,CAAC,GAAG,UAAU,EAAE,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;YACpD,MAAM,GAAG,OAAO,YAAY,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,OAAO,CAAA;QAC/D,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAA;IACnF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAA;IACjF,CAAC;AACH,CAAC"}

package/dist/response-observer.d.ts

@@ -0,0 +1,25 @@
+import type { AnyServer } from "./server/server.js";
+export type { ResponseBodyHook, ResponseHeadersHook, ResponseObserverMethods, ResponseObserverRuntime, } from "./server/response-observer-runtime.js";
+/** A server shape with the opt-in response observation methods installed. */
+export type ResponseObserverServer<S extends AnyServer> = S & import("./server/response-observer-runtime.js").ResponseObserverMethods;
+/** A plugin that enables response header, body, and raw-response observation methods. */
+export type ResponseObserverPlugin = (<S extends AnyServer>(app: S) => ResponseObserverServer<S>) & {
+    readonly pluginName?: string;
+};
+/**
+ * Enable the response observation methods on a server.
+ *
+ * The default server does not carry the header, body, or raw-response observation adapters. Apply
+ * this plugin before using those methods:
+ *
+ * ```ts
+ * import { responseObserver } from "@nifrajs/core/response-observer"
+ * const app = server().use(responseObserver()).onResponseHeaders((headers) => {
+ *   headers.set("cache-control", "no-store")
+ * })
+ * ```
+ */
+export declare function responseObserver(): ResponseObserverPlugin;
+/** Attach the opt-in observer runtime to a middleware bundle that uses response observation. */
+export declare function withResponseObserver<T extends object>(middleware: T): T;
+//# sourceMappingURL=response-observer.d.ts.map

package/dist/response-observer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-observer.d.ts","sourceRoot":"","sources":["../src/response-observer.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAEnD,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,uCAAuC,CAAA;AAE9C,6EAA6E;AAC7E,MAAM,MAAM,sBAAsB,CAAC,CAAC,SAAS,SAAS,IAAI,CAAC,GACzD,OAAO,uCAAuC,EAAE,uBAAuB,CAAA;AAEzE,yFAAyF;AACzF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,CAAC,SAAS,SAAS,EACxD,GAAG,EAAE,CAAC,KACH,sBAAsB,CAAC,CAAC,CAAC,CAAC,GAAG;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAElE;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,IAAI,sBAAsB,CAiBzD;AAED,gGAAgG;AAChG,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,MAAM,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,CAOvE"}

package/dist/response-observer.js

@@ -0,0 +1,40 @@
+import { INSTALL_RESPONSE_OBSERVER } from "./server/install.js";
+import { createResponseObserverRuntime, } from "./server/response-observer-runtime.js";
+/**
+ * Enable the response observation methods on a server.
+ *
+ * The default server does not carry the header, body, or raw-response observation adapters. Apply
+ * this plugin before using those methods:
+ *
+ * ```ts
+ * import { responseObserver } from "@nifrajs/core/response-observer"
+ * const app = server().use(responseObserver()).onResponseHeaders((headers) => {
+ *   headers.set("cache-control", "no-store")
+ * })
+ * ```
+ */
+export function responseObserver() {
+    const apply = (app) => {
+        const install = app[INSTALL_RESPONSE_OBSERVER];
+        if (typeof install !== "function") {
+            throw new TypeError("[nifra] responseObserver() requires a compatible Server");
+        }
+        const methods = install.call(app, createResponseObserverRuntime());
+        if (methods === null || typeof methods !== "object") {
+            throw new TypeError("[nifra] responseObserver() failed to install its methods");
+        }
+        Object.assign(app, methods);
+        return app;
+    };
+    return Object.assign(apply, { pluginName: "nifra:response-observer" });
+}
+/** Attach the opt-in observer runtime to a middleware bundle that uses response observation. */
+export function withResponseObserver(middleware) {
+    Object.defineProperty(middleware, INSTALL_RESPONSE_OBSERVER, {
+        value: createResponseObserverRuntime(),
+        enumerable: false,
+        configurable: false,
+    });
+    return middleware;
+}
+//# sourceMappingURL=response-observer.js.map

package/dist/response-observer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-observer.js","sourceRoot":"","sources":["../src/response-observer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EACL,6BAA6B,GAE9B,MAAM,uCAAuC,CAAA;AAmB9C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,KAAK,GAAG,CAAsB,GAAM,EAA6B,EAAE;QACvE,MAAM,OAAO,GAAI,GAA0C,CAAC,yBAAyB,CAAC,CAAA;QACtF,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;YAClC,MAAM,IAAI,SAAS,CAAC,yDAAyD,CAAC,CAAA;QAChF,CAAC;QACD,MAAM,OAAO,GAAI,OAAyD,CAAC,IAAI,CAC7E,GAAG,EACH,6BAA6B,EAAE,CAChC,CAAA;QACD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,IAAI,SAAS,CAAC,0DAA0D,CAAC,CAAA;QACjF,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAC3B,OAAO,GAAgC,CAAA;IACzC,CAAC,CAAA;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,yBAAyB,EAAE,CAAC,CAAA;AACxE,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,oBAAoB,CAAmB,UAAa;IAClE,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,yBAAyB,EAAE;QAC3D,KAAK,EAAE,6BAA6B,EAAE;QACtC,UAAU,EAAE,KAAK;QACjB,YAAY,EAAE,KAAK;KACpB,CAAC,CAAA;IACF,OAAO,UAAU,CAAA;AACnB,CAAC"}

package/dist/security/baseline.d.ts

@@ -0,0 +1,68 @@
+import type { AssurancePolicy } from "../assurance.js";
+/**
+ * How much a {@link securityBaseline} demands. Each level is a superset of the one before it, so
+ * raising the level only ever adds findings.
+ *
+ * - `"essential"` - the invariants that hold for ANY app and never false-positive on a reasonable
+ *   one: a body read must be bounded, an unlimited body may never claim to be bounded, an agent tool
+ *   ingress must be bounded, and an authenticated state change must prove CSRF. Every required piece
+ *   of evidence here is either published by the core from the route schema or only demanded when the
+ *   route already opted into the risk (CSRF is required only where authentication is present). Safe to
+ *   adopt on day one.
+ * - `"standard"` (default) - essential, plus: a route the app itself classified as `pii` or higher
+ *   must be authenticated, whether it reads or writes. High signal, low noise - it fires only on
+ *   routes the application already labelled sensitive.
+ * - `"strict"` - standard, plus the opinionated, higher-friction requirements: every route must carry
+ *   a response contract, every read must carry security headers, and every mutation must be rate
+ *   limited. These need middleware the app has to install, so they are opt-in rather than default.
+ */
+export type SecurityBaselineLevel = "essential" | "standard" | "strict";
+/** Tuning for {@link securityBaseline}. Every knob only ever tightens the policy. */
+export interface SecurityBaselineOptions {
+    /** How much the baseline demands. Default `"standard"`. See {@link SecurityBaselineLevel}. */
+    readonly level?: SecurityBaselineLevel;
+    /**
+     * How to treat a route no rule matched. Default `"ignore"` so the baseline is purely additive - it
+     * asserts the invariants below and stays silent on everything else, which lets a project adopt it
+     * without first classifying its whole route table. Set `"error"` to make an unclassified route a
+     * finding, turning the baseline into a closed allow-list (recommended once the table is covered).
+     */
+    readonly unmatched?: "error" | "ignore";
+    /**
+     * Require that a matched route's evidence was installed by runtime enforcement (middleware/plugin
+     * or framework policy) rather than asserted inline on `schema.assurance`. Default `true`: an author
+     * label is not proof, and a security baseline that accepts labels is theater. Set `false` only to
+     * stage adoption before guards emit runtime evidence.
+     */
+    readonly requireRuntimeProvenance?: boolean;
+}
+/**
+ * A first-match-wins security policy that turns the recurring audit finding classes into machine
+ * checked route invariants. Composed only from the public assurance engine, so it inherits its
+ * fail-closed evaluation, provenance checks, and selector validation - no bespoke evaluator.
+ *
+ * The rules are ordered most-specific-first because assurance evaluation is first-match-wins: each
+ * route is owned by exactly one rule, so that rule carries the FULL requirement bundle for its class
+ * (a body-carrying mutation proves bounded-body AND CSRF in one rule, not two). Raising the `level`
+ * widens those bundles; it never reorders them.
+ *
+ * Coverage by level (see {@link SecurityBaselineLevel} for the rationale):
+ *
+ * | invariant | essential | standard | strict |
+ * | --- | :-: | :-: | :-: |
+ * | unlimited body can never be "bounded" (F-001) | ✓ | ✓ | ✓ |
+ * | every body read is bounded | ✓ | ✓ | ✓ |
+ * | agent tool ingress is bounded | ✓ | ✓ | ✓ |
+ * | authenticated mutation proves CSRF | ✓ | ✓ | ✓ |
+ * | pii+ route is authenticated | | ✓ | ✓ |
+ * | every route carries a response contract | | | ✓ |
+ * | every read carries security headers | | | ✓ |
+ * | every mutation is rate limited | | | ✓ |
+ *
+ * The baseline deliberately does not select on `access`/`zone` capabilities: those selectors require
+ * capability definitions and would make the preset refuse an app that declares none. Extend the
+ * returned policy's `rules` for capability- or path-specific requirements; put more specific rules
+ * before these so they own their routes first.
+ */
+export declare function securityBaseline(options?: SecurityBaselineOptions): AssurancePolicy;
+//# sourceMappingURL=baseline.d.ts.map

package/dist/security/baseline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseline.d.ts","sourceRoot":"","sources":["../../src/security/baseline.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAiB,MAAM,iBAAiB,CAAA;AAGrE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,qBAAqB,GAAG,WAAW,GAAG,UAAU,GAAG,QAAQ,CAAA;AAEvE,qFAAqF;AACrF,MAAM,WAAW,uBAAuB;IACtC,8FAA8F;IAC9F,QAAQ,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAA;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAA;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAA;CAC5C;AAOD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,uBAA4B,GAAG,eAAe,CAgGvF"}

package/dist/security/baseline.js

@@ -0,0 +1,118 @@
+import { NIFRA_ASSURANCE_IDS } from "../internal/route-assurance.js";
+const MUTATING = ["POST", "PUT", "PATCH", "DELETE"];
+const READING = ["GET", "HEAD"];
+/** The classification threshold above which the baseline demands authentication. */
+const SENSITIVE = "pii";
+/**
+ * A first-match-wins security policy that turns the recurring audit finding classes into machine
+ * checked route invariants. Composed only from the public assurance engine, so it inherits its
+ * fail-closed evaluation, provenance checks, and selector validation - no bespoke evaluator.
+ *
+ * The rules are ordered most-specific-first because assurance evaluation is first-match-wins: each
+ * route is owned by exactly one rule, so that rule carries the FULL requirement bundle for its class
+ * (a body-carrying mutation proves bounded-body AND CSRF in one rule, not two). Raising the `level`
+ * widens those bundles; it never reorders them.
+ *
+ * Coverage by level (see {@link SecurityBaselineLevel} for the rationale):
+ *
+ * | invariant | essential | standard | strict |
+ * | --- | :-: | :-: | :-: |
+ * | unlimited body can never be "bounded" (F-001) | ✓ | ✓ | ✓ |
+ * | every body read is bounded | ✓ | ✓ | ✓ |
+ * | agent tool ingress is bounded | ✓ | ✓ | ✓ |
+ * | authenticated mutation proves CSRF | ✓ | ✓ | ✓ |
+ * | pii+ route is authenticated | | ✓ | ✓ |
+ * | every route carries a response contract | | | ✓ |
+ * | every read carries security headers | | | ✓ |
+ * | every mutation is rate limited | | | ✓ |
+ *
+ * The baseline deliberately does not select on `access`/`zone` capabilities: those selectors require
+ * capability definitions and would make the preset refuse an app that declares none. Extend the
+ * returned policy's `rules` for capability- or path-specific requirements; put more specific rules
+ * before these so they own their routes first.
+ */
+export function securityBaseline(options = {}) {
+    const level = options.level ?? "standard";
+    const strict = level === "strict";
+    const authSensitive = level !== "essential";
+    const provenance = options.requireRuntimeProvenance === false ? "any" : "runtime";
+    const A = NIFRA_ASSURANCE_IDS;
+    // Evidence the app must install middleware for, gated to the levels that assume that cost.
+    const contract = strict ? [A.RESPONSE_CONTRACT] : [];
+    const headers = strict ? [A.SECURITY_HEADERS] : [];
+    const rateLimit = strict ? [A.RATE_LIMITED] : [];
+    const authed = authSensitive ? [A.AUTHENTICATED] : [];
+    const rules = [
+        // The static twin of the config-time rejection: a schema route that opted into `bodyLimit:
+        // "unlimited"` can never carry `nifra.body-bounded` (the core withholds it), so requiring it is a
+        // standing ban. Owns the unlimited case before any body rule below can soften it. (F-001.)
+        {
+            name: "banned-unlimited-body",
+            match: { hasBody: true, bodyLimit: "unlimited" },
+            require: [A.BODY_BOUNDED],
+        },
+        // Agent tool ingress buffers attacker-influenced arguments; it must be bounded. Not CSRF-guarded:
+        // tool calls are token-authenticated machine traffic, not ambient-cookie browser posts.
+        {
+            name: "tool-ingress-bounded",
+            match: { tools: true, hasBody: true },
+            require: [A.BODY_BOUNDED, ...contract],
+            requireProvenance: provenance,
+        },
+    ];
+    // Sensitive mutations, split by body shape so bounded-body is required only where a body exists.
+    // Emitted only when a level adds a requirement beyond the generic mutation rules, otherwise they
+    // would be redundant duplicates that only slow evaluation.
+    if (authSensitive || strict) {
+        rules.push({
+            name: "sensitive-mutation-body",
+            match: { methods: [...MUTATING], hasBody: true, classificationAtLeast: SENSITIVE },
+            require: [A.BODY_BOUNDED, ...authed, ...contract, ...rateLimit],
+            requireCsrfWithAuthenticated: true,
+            requireProvenance: provenance,
+        }, {
+            name: "sensitive-mutation",
+            match: { methods: [...MUTATING], classificationAtLeast: SENSITIVE },
+            require: [...authed, ...contract, ...rateLimit],
+            requireCsrfWithAuthenticated: true,
+            requireProvenance: provenance,
+        });
+    }
+    rules.push({
+        name: "mutation-body",
+        match: { methods: [...MUTATING], hasBody: true },
+        require: [A.BODY_BOUNDED, ...contract, ...rateLimit],
+        requireCsrfWithAuthenticated: true,
+        requireProvenance: provenance,
+    }, {
+        name: "mutation",
+        match: { methods: [...MUTATING] },
+        require: [...contract, ...rateLimit],
+        requireCsrfWithAuthenticated: true,
+        requireProvenance: provenance,
+    });
+    if (authSensitive || strict) {
+        rules.push({
+            name: "sensitive-read",
+            match: { methods: [...READING], classificationAtLeast: SENSITIVE },
+            require: [...authed, ...contract, ...headers],
+            requireProvenance: provenance,
+        });
+    }
+    // The catch-all read rule. At essential/standard its requirement bundle is empty, so it is a pure
+    // classification that simply marks reads as covered - which matters only under `unmatched: "error"`,
+    // where an unowned route would otherwise fail. At strict it demands the response + header contract.
+    rules.push({
+        name: "read",
+        match: { methods: [...READING] },
+        require: [...contract, ...headers],
+        ...(strict ? { requireProvenance: provenance } : {}),
+    });
+    return {
+        rules,
+        unmatched: options.unmatched ?? "ignore",
+        // A wrong import reflecting zero routes must fail, not silently pass a security gate.
+        allowEmpty: false,
+    };
+}
+//# sourceMappingURL=baseline.js.map

package/dist/security/baseline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseline.js","sourceRoot":"","sources":["../../src/security/baseline.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAA;AAyCpE,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAU,CAAA;AAC5D,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,MAAM,CAAU,CAAA;AACxC,oFAAoF;AACpF,MAAM,SAAS,GAAG,KAAc,CAAA;AAEhC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAmC,EAAE;IACpE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAA;IACzC,MAAM,MAAM,GAAG,KAAK,KAAK,QAAQ,CAAA;IACjC,MAAM,aAAa,GAAG,KAAK,KAAK,WAAW,CAAA;IAC3C,MAAM,UAAU,GAAG,OAAO,CAAC,wBAAwB,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;IAEjF,MAAM,CAAC,GAAG,mBAAmB,CAAA;IAC7B,2FAA2F;IAC3F,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACpD,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAChD,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAErD,MAAM,KAAK,GAAoB;QAC7B,2FAA2F;QAC3F,kGAAkG;QAClG,2FAA2F;QAC3F;YACE,IAAI,EAAE,uBAAuB;YAC7B,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE;YAChD,OAAO,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;SAC1B;QACD,kGAAkG;QAClG,wFAAwF;QACxF;YACE,IAAI,EAAE,sBAAsB;YAC5B,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;YACrC,OAAO,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,GAAG,QAAQ,CAAC;YACtC,iBAAiB,EAAE,UAAU;SAC9B;KACF,CAAA;IAED,iGAAiG;IACjG,iGAAiG;IACjG,2DAA2D;IAC3D,IAAI,aAAa,IAAI,MAAM,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CACR;YACE,IAAI,EAAE,yBAAyB;YAC/B,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,SAAS,EAAE;YAClF,OAAO,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,EAAE,GAAG,SAAS,CAAC;YAC/D,4BAA4B,EAAE,IAAI;YAClC,iBAAiB,EAAE,UAAU;SAC9B,EACD;YACE,IAAI,EAAE,oBAAoB;YAC1B,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,qBAAqB,EAAE,SAAS,EAAE;YACnE,OAAO,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,QAAQ,EAAE,GAAG,SAAS,CAAC;YAC/C,4BAA4B,EAAE,IAAI;YAClC,iBAAiB,EAAE,UAAU;SAC9B,CACF,CAAA;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CACR;QACE,IAAI,EAAE,eAAe;QACrB,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;QAChD,OAAO,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,GAAG,QAAQ,EAAE,GAAG,SAAS,CAAC;QACpD,4BAA4B,EAAE,IAAI;QAClC,iBAAiB,EAAE,UAAU;KAC9B,EACD;QACE,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE;QACjC,OAAO,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,SAAS,CAAC;QACpC,4BAA4B,EAAE,IAAI;QAClC,iBAAiB,EAAE,UAAU;KAC9B,CACF,CAAA;IAED,IAAI,aAAa,IAAI,MAAM,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,qBAAqB,EAAE,SAAS,EAAE;YAClE,OAAO,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC;YAC7C,iBAAiB,EAAE,UAAU;SAC9B,CAAC,CAAA;IACJ,CAAC;IAED,kGAAkG;IAClG,qGAAqG;IACrG,oGAAoG;IACpG,KAAK,CAAC,IAAI,CAAC;QACT,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE;QAChC,OAAO,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC;QAClC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC,CAAA;IAEF,OAAO;QACL,KAAK;QACL,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,QAAQ;QACxC,sFAAsF;QACtF,UAAU,EAAE,KAAK;KAClB,CAAA;AACH,CAAC"}

package/dist/server/bare-error-lane.d.ts

@@ -0,0 +1,26 @@
+import type { Logger } from "./logger.js";
+import { type ResponseResult } from "./runtime-core.js";
+import type { CtxSet, RawContext } from "./server.js";
+/** How much of a thrown error's own text reaches the log sink. Mirrors `Server`'s option. */
+export type ErrorLogDetail = "full" | "message" | "none";
+/**
+ * Render a value thrown on the bare lane. Three shapes, in the order the lane means them:
+ *   - a bare `Response` is the app answering directly - passed through untouched;
+ *   - a thrown `status(...)` is control flow, still plain data: rendered through the same `finalize`
+ *     a RETURNED one takes, with the request's `c.set`, so it costs what the return costs;
+ *   - anything else is a real fault: logged once, then a bodyless 500 (never the caller's error text).
+ *
+ * `responseSet` and `logError` are injected rather than imported so this file keeps no runtime edge
+ * back to `server.ts` (`responseSet` reaches into the context's set symbol; `logError` closes over the
+ * server's logger). Both run only on the throw path, so the closures cost nothing on the hot lane.
+ */
+export declare function renderBareError<T>(err: unknown, ctx: RawContext, finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T, wrapResponse: (response: Response | ResponseResult) => T, responseSet: (ctx: RawContext) => CtxSet, logError: (err: unknown, ctx: RawContext) => void, internalError: () => T): T;
+/**
+ * Write an unhandled request error to the log. An error's own text can quote the input that produced
+ * it, so how much of it reaches the sink is the app's call (`detail`). The default keeps it: a 500
+ * with no message and no stack is an incident nobody can diagnose, and the framework already ships
+ * the narrower instrument for the leak - a redacting logger with `valuePatterns`. `"none"` is there
+ * for an untrusted sink.
+ */
+export declare function emitRequestErrorLog(logger: Logger, detail: ErrorLogDetail, err: unknown, ctx: RawContext): void;
+//# sourceMappingURL=bare-error-lane.d.ts.map

package/dist/server/bare-error-lane.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bare-error-lane.d.ts","sourceRoot":"","sources":["../../src/server/bare-error-lane.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAoB,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACzE,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAErD,6FAA6F;AAC7F,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAAA;AAExD;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAC/B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,KAAK,CAAC,EAC9D,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,KAAK,CAAC,EACxD,WAAW,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,MAAM,EACxC,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,KAAK,IAAI,EACjD,aAAa,EAAE,MAAM,CAAC,GACrB,CAAC,CAKH;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,cAAc,EACtB,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,UAAU,GACd,IAAI,CAWN"}

package/dist/server/bare-error-lane.js

@@ -0,0 +1,60 @@
+/**
+ * The bare lane's ERROR rendering, as free functions the kernel delegates to.
+ *
+ * ## Why this is a lane module and not methods on `Server`
+ *
+ * These are the cold half of the bare request lane: what happens when a handler (or a `derive`)
+ * throws, rather than returns. The success half stays on the class - it reads request-lifecycle
+ * state and is the async-frame-skip hot path - but the error half needs none of that class state:
+ * `renderBareError` is pure control-flow routing, and `emitRequestErrorLog` needs only the logger
+ * and the detail policy, both of which are config fixed at construction. Passing those two in keeps
+ * this file free of any runtime dependency back on `server.ts`, so there is no import cycle: the
+ * `RawContext`/`CtxSet` imports are type-only and erased (the same shape `edge.ts` already relies on).
+ *
+ * A single source of truth for the thrown-value contract matters because it is a security surface:
+ * an unhandled throw must render as a 500 with no caller-controlled body, and the amount of the
+ * error's own text that reaches the log sink is the app's `errorLogDetail` call, not an accident of
+ * which lane caught it. Both the generic bare lane and the fused body runner route here, so that
+ * decision lives in exactly one place.
+ */
+import { pathnameOf } from "./http.js";
+import { isResponseResult } from "./runtime-core.js";
+/**
+ * Render a value thrown on the bare lane. Three shapes, in the order the lane means them:
+ *   - a bare `Response` is the app answering directly - passed through untouched;
+ *   - a thrown `status(...)` is control flow, still plain data: rendered through the same `finalize`
+ *     a RETURNED one takes, with the request's `c.set`, so it costs what the return costs;
+ *   - anything else is a real fault: logged once, then a bodyless 500 (never the caller's error text).
+ *
+ * `responseSet` and `logError` are injected rather than imported so this file keeps no runtime edge
+ * back to `server.ts` (`responseSet` reaches into the context's set symbol; `logError` closes over the
+ * server's logger). Both run only on the throw path, so the closures cost nothing on the hot lane.
+ */
+export function renderBareError(err, ctx, finalize, wrapResponse, responseSet, logError, internalError) {
+    if (err instanceof Response)
+        return wrapResponse(err);
+    if (isResponseResult(err))
+        return finalize(err, responseSet(ctx), ctx);
+    logError(err, ctx);
+    return internalError();
+}
+/**
+ * Write an unhandled request error to the log. An error's own text can quote the input that produced
+ * it, so how much of it reaches the sink is the app's call (`detail`). The default keeps it: a 500
+ * with no message and no stack is an incident nobody can diagnose, and the framework already ships
+ * the narrower instrument for the leak - a redacting logger with `valuePatterns`. `"none"` is there
+ * for an untrusted sink.
+ */
+export function emitRequestErrorLog(logger, detail, err, ctx) {
+    logger.error("unhandled request error", {
+        method: ctx.req.method,
+        path: pathnameOf(ctx.req.url),
+        name: err instanceof Error ? err.name : "Error",
+        // `detail`, not `message`: the logger uses `message` for its own first argument, so a field of
+        // that name is silently overwritten and the thrown error's own text never reaches the sink. It
+        // survived only incidentally inside `stack`, and was lost outright for a non-Error throw.
+        ...(detail === "none" ? {} : { detail: err instanceof Error ? err.message : String(err) }),
+        ...(detail === "full" && err instanceof Error ? { stack: err.stack } : {}),
+    });
+}
+//# sourceMappingURL=bare-error-lane.js.map

package/dist/server/bare-error-lane.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bare-error-lane.js","sourceRoot":"","sources":["../../src/server/bare-error-lane.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAEtC,OAAO,EAAE,gBAAgB,EAAuB,MAAM,mBAAmB,CAAA;AAMzE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAY,EACZ,GAAe,EACf,QAA8D,EAC9D,YAAwD,EACxD,WAAwC,EACxC,QAAiD,EACjD,aAAsB;IAEtB,IAAI,GAAG,YAAY,QAAQ;QAAE,OAAO,YAAY,CAAC,GAAG,CAAC,CAAA;IACrD,IAAI,gBAAgB,CAAC,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAA;IACtE,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAClB,OAAO,aAAa,EAAE,CAAA;AACxB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAc,EACd,MAAsB,EACtB,GAAY,EACZ,GAAe;IAEf,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE;QACtC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM;QACtB,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;QAC7B,IAAI,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;QAC/C,+FAA+F;QAC/F,+FAA+F;QAC/F,0FAA0F;QAC1F,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1F,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC,CAAA;AACJ,CAAC"}

package/dist/server/body-lane.d.ts

@@ -0,0 +1,13 @@
+import { type ProtoPoisoning } from "./proto-guard.js";
+import { type ResponseResult } from "./runtime-core.js";
+import type { MaybePromise, RequestSource } from "./server.js";
+type JsonResultContinuation<T> = (result: unknown | ResponseResult) => T | Promise<T>;
+type JsonErrorContinuation<T> = (error: unknown) => T | Promise<T>;
+/** Read a JSON source with the declared-length precheck, delivered-byte recheck, streaming cap, and
+ * prototype-poisoning guard in one lane. */
+export declare function readBoundedJsonSource(req: RequestSource, maxBytes: number, protoPoisoning?: ProtoPoisoning): Promise<unknown | ResponseResult>;
+export declare function readBoundedJsonSource<T>(req: RequestSource, maxBytes: number, protoPoisoning: ProtoPoisoning, onResult: JsonResultContinuation<T>, onError: JsonErrorContinuation<T>): Promise<T>;
+/** The shared content-type dispatcher around the JSON and urlencoded lanes. */
+export declare function readBodyFramed<T>(source: RequestSource, maxBodyBytes: number, protoPoisoning: ProtoPoisoning, onParsed: (parsed: unknown) => MaybePromise<T>, wrapResponse: (response: Response | ResponseResult) => T, onError: (err: unknown) => MaybePromise<T>): Promise<T>;
+export {};
+//# sourceMappingURL=body-lane.d.ts.map

package/dist/server/body-lane.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-lane.d.ts","sourceRoot":"","sources":["../../src/server/body-lane.ts"],"names":[],"mappings":"AAOA,OAAO,EAAoB,KAAK,cAAc,EAAoB,MAAM,kBAAkB,CAAA;AAE1F,OAAO,EAKL,KAAK,cAAc,EAEpB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE9D,KAAK,sBAAsB,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,GAAG,cAAc,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;AACrF,KAAK,qBAAqB,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;AAYlE;4CAC4C;AAC5C,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,aAAa,EAClB,QAAQ,EAAE,MAAM,EAChB,cAAc,CAAC,EAAE,cAAc,GAC9B,OAAO,CAAC,OAAO,GAAG,cAAc,CAAC,CAAA;AACpC,wBAAgB,qBAAqB,CAAC,CAAC,EACrC,GAAG,EAAE,aAAa,EAClB,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,sBAAsB,CAAC,CAAC,CAAC,EACnC,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC,GAChC,OAAO,CAAC,CAAC,CAAC,CAAA;AA+Hb,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,CAAC,EAC9B,MAAM,EAAE,aAAa,EACrB,YAAY,EAAE,MAAM,EACpB,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,EAC9C,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,KAAK,CAAC,EACxD,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,GACzC,OAAO,CAAC,CAAC,CAAC,CAsBZ"}