@nifrajs/core 3.5.0 → 4.0.0

package/dist/server/not-found-answer.d.ts

@@ -0,0 +1,40 @@
+/** The not-found rules (see `./not-found.ts`), shared by `notFound()` and the edge server. */
+import type { Platform } from "./context.js";
+import { type ResponseResult } from "./runtime-core.js";
+import type { MaybePromise, RequestSource } from "./server.js";
+/** What a {@link NotFoundHandler} is given: the request line and headers of a request no route matched. */
+export interface NotFoundInput<Env = unknown> {
+    /** The request method, exactly as received. Always a token a route could be registered under. */
+    readonly method: string;
+    /** The request URL, exactly as received. */
+    readonly url: string;
+    /** The path the router looked up, exactly as received: NOT percent-decoded, so `/a%2Fb` stays
+     * `/a%2Fb`. Escape it before writing it into a body. */
+    readonly pathname: string;
+    /** The request headers. */
+    readonly headers: Headers;
+    /** Read one request header (case-insensitive), or `null` when it is absent. */
+    header(name: string): string | null;
+    /** Aborts when the server's `requestTimeoutMs` elapses before the handler settles. Never aborts
+     * when no timeout is configured. */
+    readonly signal: AbortSignal;
+    /** The platform inputs (`env`, `waitUntil`, the caller address) the serving adapter supplied. */
+    readonly platform: Platform<Env> | undefined;
+}
+/**
+ * Answers a request no route matched. Return a `Response`, or `undefined` for the default `404`.
+ * May be async; a thrown `Response` is treated like a returned one.
+ */
+export type NotFoundHandler<Env = unknown> = (input: NotFoundInput<Env>) => MaybePromise<Response | undefined>;
+/** @internal The read-only view a {@link NotFoundHandler} receives. `url` and `headers` stay getters
+ * so a source that builds them on demand is not forced to for a handler that never reads them. */
+export declare function notFoundInput<Env>(source: RequestSource, pathname: string, platform: Platform<Env> | undefined, signal?: AbortSignal): NotFoundInput<Env>;
+/**
+ * @internal Run a {@link NotFoundHandler} and turn what it produced into the answer. One function
+ * for every server that has a `404` site, so the rules above hold identically on each of them.
+ * `wrap` lifts a response into the caller's output type; `failed` renders the fault answer.
+ */
+export declare function answerNotFound<T, Env>(handler: NotFoundHandler<Env>, input: NotFoundInput<Env>, wrap: (response: Response | ResponseResult) => T, failed: (error: unknown) => T): MaybePromise<T>;
+/** @internal What the kernel calls at its `404` site once a handler is installed. */
+export type NotFoundLane = <T>(host: unknown, source: RequestSource, pathname: string, platform: Platform<unknown> | undefined, wrap: (response: Response | ResponseResult) => T, onTimeout: () => T) => MaybePromise<T>;
+//# sourceMappingURL=not-found-answer.d.ts.map

package/dist/server/not-found-answer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"not-found-answer.d.ts","sourceRoot":"","sources":["../../src/server/not-found-answer.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAE5C,OAAO,EAAiC,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACtF,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE9D,2GAA2G;AAC3G,MAAM,WAAW,aAAa,CAAC,GAAG,GAAG,OAAO;IAC1C,iGAAiG;IACjG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,4CAA4C;IAC5C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB;4DACwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,2BAA2B;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,+EAA+E;IAC/E,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;IACnC;wCACoC;IACpC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;IAC5B,iGAAiG;IACjG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,SAAS,CAAA;CAC7C;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,CAAC,GAAG,GAAG,OAAO,IAAI,CAC3C,KAAK,EAAE,aAAa,CAAC,GAAG,CAAC,KACtB,YAAY,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAA;AAEvC;kGACkG;AAClG,wBAAgB,aAAa,CAAC,GAAG,EAC/B,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,SAAS,EACnC,MAAM,GAAE,WAAmC,GAC1C,aAAa,CAAC,GAAG,CAAC,CAcpB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,GAAG,EACnC,OAAO,EAAE,eAAe,CAAC,GAAG,CAAC,EAC7B,KAAK,EAAE,aAAa,CAAC,GAAG,CAAC,EACzB,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,KAAK,CAAC,EAChD,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC,GAC5B,YAAY,CAAC,CAAC,CAAC,CA+BjB;AAED,qFAAqF;AACrF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,EAC3B,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,SAAS,EACvC,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,KAAK,CAAC,EAChD,SAAS,EAAE,MAAM,CAAC,KACf,YAAY,CAAC,CAAC,CAAC,CAAA"}

package/dist/server/not-found-answer.js

@@ -0,0 +1,56 @@
+import { isRoutableMethod, plainError } from "./http.js";
+import { getNeverAbortSignal, headerOf } from "./runtime-core.js";
+/** @internal The read-only view a {@link NotFoundHandler} receives. `url` and `headers` stay getters
+ * so a source that builds them on demand is not forced to for a handler that never reads them. */
+export function notFoundInput(source, pathname, platform, signal = getNeverAbortSignal()) {
+    return {
+        method: source.method,
+        pathname,
+        signal,
+        platform,
+        get url() {
+            return source.url;
+        },
+        get headers() {
+            return source.headers;
+        },
+        header: (name) => headerOf(source, name),
+    };
+}
+/**
+ * @internal Run a {@link NotFoundHandler} and turn what it produced into the answer. One function
+ * for every server that has a `404` site, so the rules above hold identically on each of them.
+ * `wrap` lifts a response into the caller's output type; `failed` renders the fault answer.
+ */
+export function answerNotFound(handler, input, wrap, failed) {
+    if (!isRoutableMethod(input.method))
+        return wrap(plainError(404, "not_found"));
+    const settle = (value, thrown) => {
+        if (value instanceof Response) {
+            // A status below 200 is `Response.error()`: a network-error marker, not an answer.
+            if (value.bodyUsed || value.status < 200) {
+                return failed(new TypeError("notFound handler answered with an unusable Response"));
+            }
+            // A miss is never a success. The body and headers are the handler's; the status is not.
+            return wrap(value.status < 300
+                ? new Response(value.body, { status: 404, headers: value.headers })
+                : value);
+        }
+        if (thrown)
+            return failed(value);
+        if (value === undefined)
+            return wrap(plainError(404, "not_found"));
+        return failed(new TypeError("notFound handler must return a Response or undefined"));
+    };
+    let result;
+    try {
+        result = handler(input);
+    }
+    catch (error) {
+        return settle(error, true);
+    }
+    return result instanceof Promise
+        ? result.then((value) => settle(value, false), (error) => settle(error, true))
+        : settle(result, false);
+}
+//# sourceMappingURL=not-found-answer.js.map

package/dist/server/not-found-answer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"not-found-answer.js","sourceRoot":"","sources":["../../src/server/not-found-answer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACxD,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAuB,MAAM,mBAAmB,CAAA;AA+BtF;kGACkG;AAClG,MAAM,UAAU,aAAa,CAC3B,MAAqB,EACrB,QAAgB,EAChB,QAAmC,EACnC,SAAsB,mBAAmB,EAAE;IAE3C,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ;QACR,MAAM;QACN,QAAQ;QACR,IAAI,GAAG;YACL,OAAO,MAAM,CAAC,GAAG,CAAA;QACnB,CAAC;QACD,IAAI,OAAO;YACT,OAAO,MAAM,CAAC,OAAO,CAAA;QACvB,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;KACzC,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,OAA6B,EAC7B,KAAyB,EACzB,IAAgD,EAChD,MAA6B;IAE7B,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAA;IAC9E,MAAM,MAAM,GAAG,CAAC,KAAc,EAAE,MAAe,EAAK,EAAE;QACpD,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;YAC9B,mFAAmF;YACnF,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBACzC,OAAO,MAAM,CAAC,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC,CAAA;YACrF,CAAC;YACD,wFAAwF;YACxF,OAAO,IAAI,CACT,KAAK,CAAC,MAAM,GAAG,GAAG;gBAChB,CAAC,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;gBACnE,CAAC,CAAC,KAAK,CACV,CAAA;QACH,CAAC;QACD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;QAChC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAA;QAClE,OAAO,MAAM,CAAC,IAAI,SAAS,CAAC,sDAAsD,CAAC,CAAC,CAAA;IACtF,CAAC,CAAA;IACD,IAAI,MAA0C,CAAA;IAC9C,IAAI,CAAC;QACH,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IAC5B,CAAC;IACD,OAAO,MAAM,YAAY,OAAO;QAC9B,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAC/B,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAC/B;QACH,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;AAC3B,CAAC"}

package/dist/server/not-found.d.ts

@@ -0,0 +1,23 @@
+import { type NotFoundHandler } from "./not-found-answer.js";
+import type { IdentityPlugin } from "./plugin.js";
+export type { NotFoundHandler, NotFoundInput } from "./not-found-answer.js";
+/**
+ * Answer requests no route matched with a handler of your own: `app.use(notFound(handler))`.
+ *
+ * ```ts
+ * import { notFound } from "@nifrajs/core/not-found"
+ *
+ * const app = server().use(
+ *   notFound(({ pathname }) => Response.json({ ok: false, error: "no_such_route", pathname })),
+ * )
+ * ```
+ *
+ * The answer is a `404` whatever `2xx` status the handler gives it; see the module notes for the
+ * full rules. The server's `requestTimeoutMs` bounds an async handler and aborts `input.signal`.
+ *
+ * A server takes one handler, and it belongs to the server that listens: applying `notFound()` a
+ * second time throws, and so does applying it inside a `group()` (a miss has no prefix to scope it
+ * to). A server composed into another with `merge()` does not carry its handler along.
+ */
+export declare function notFound<Env = unknown>(handler: NotFoundHandler<Env>): IdentityPlugin;
+//# sourceMappingURL=not-found.d.ts.map

package/dist/server/not-found.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"not-found.d.ts","sourceRoot":"","sources":["../../src/server/not-found.ts"],"names":[],"mappings":"AAaA,OAAO,EAEL,KAAK,eAAe,EAGrB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAIjD,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAgB3E;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,QAAQ,CAAC,GAAG,GAAG,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,GAAG,CAAC,GAAG,cAAc,CA+DrF"}

package/dist/server/not-found.js

@@ -0,0 +1,81 @@
+/**
+ * The `notFound()` handler's rules:
+ * - Only for a `404`: a wrong method stays a `405`, a malformed path a `400`, a mount's `404` its own.
+ * - It sees the request line and headers, never the body: an unrouted request has no body limit.
+ * - A method token no route could take gets the default `404`, as it skips `onRequest` hooks.
+ * - A `2xx` is sent as a `404`; a `3xx`, `410` or other error status is sent as built.
+ * - Fails closed: a throw or an unsendable value is logged and answered with the plain `500`.
+ */
+import { emitRequestErrorLog } from "./bare-error-lane.js";
+import { plainError } from "./http.js";
+import { INSTALL_NOT_FOUND } from "./install.js";
+import { answerNotFound, notFoundInput, } from "./not-found-answer.js";
+/**
+ * Answer requests no route matched with a handler of your own: `app.use(notFound(handler))`.
+ *
+ * ```ts
+ * import { notFound } from "@nifrajs/core/not-found"
+ *
+ * const app = server().use(
+ *   notFound(({ pathname }) => Response.json({ ok: false, error: "no_such_route", pathname })),
+ * )
+ * ```
+ *
+ * The answer is a `404` whatever `2xx` status the handler gives it; see the module notes for the
+ * full rules. The server's `requestTimeoutMs` bounds an async handler and aborts `input.signal`.
+ *
+ * A server takes one handler, and it belongs to the server that listens: applying `notFound()` a
+ * second time throws, and so does applying it inside a `group()` (a miss has no prefix to scope it
+ * to). A server composed into another with `merge()` does not carry its handler along.
+ */
+export function notFound(handler) {
+    if (typeof handler !== "function")
+        throw new TypeError("notFound() needs a handler function");
+    const lane = (host, source, pathname, platform, wrap, onTimeout) => {
+        const { requestTimeoutMs, logger, errorLogDetail } = host;
+        const env = platform;
+        const failed = (error) => {
+            // A logger that throws must not decide the answer: the fault is still the plain `500`.
+            try {
+                emitRequestErrorLog(logger, errorLogDetail, error, { req: source });
+            }
+            catch { }
+            return wrap(plainError(500, "internal_error"));
+        };
+        if (requestTimeoutMs === 0) {
+            return answerNotFound(handler, notFoundInput(source, pathname, env), wrap, failed);
+        }
+        const controller = new AbortController();
+        const answer = answerNotFound(handler, notFoundInput(source, pathname, env, controller.signal), wrap, failed);
+        if (!(answer instanceof Promise))
+            return answer;
+        // The same bound a matched route gets: abort the signal, answer the timeout, discard the late
+        // result. Both arms are attached, so a handler that settles after the deadline is still observed.
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                controller.abort();
+                resolve(onTimeout());
+            }, requestTimeoutMs);
+            answer.then((value) => {
+                clearTimeout(timer);
+                resolve(value);
+            }, (error) => {
+                clearTimeout(timer);
+                reject(error);
+            });
+        });
+    };
+    const apply = (app) => {
+        const host = app;
+        if (host.notFoundLane !== undefined) {
+            throw new TypeError("notFound() is already applied to this server");
+        }
+        if (host.routePrefix !== "") {
+            throw new TypeError("notFound() inside a group answers nothing - apply it to the parent server");
+        }
+        host[INSTALL_NOT_FOUND](lane);
+        return app;
+    };
+    return apply;
+}
+//# sourceMappingURL=not-found.js.map

package/dist/server/not-found.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"not-found.js","sourceRoot":"","sources":["../../src/server/not-found.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAuB,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAE/E,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAEhD,OAAO,EACL,cAAc,EAGd,aAAa,GACd,MAAM,uBAAuB,CAAA;AAqB9B;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,QAAQ,CAAgB,OAA6B;IACnE,IAAI,OAAO,OAAO,KAAK,UAAU;QAAE,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAA;IAC7F,MAAM,IAAI,GAAiB,CACzB,IAAa,EACb,MAAqB,EACrB,QAAgB,EAChB,QAAuC,EACvC,IAAgD,EAChD,SAAkB,EACD,EAAE;QACnB,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,IAAoB,CAAA;QACzE,MAAM,GAAG,GAAG,QAAqC,CAAA;QACjD,MAAM,MAAM,GAAG,CAAC,KAAc,EAAK,EAAE;YACnC,uFAAuF;YACvF,IAAI,CAAC;gBACH,mBAAmB,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;YACrE,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACV,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAA;QAChD,CAAC,CAAA;QACD,IAAI,gBAAgB,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;QACpF,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,MAAM,GAAG,cAAc,CAC3B,OAAO,EACP,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,EACvD,IAAI,EACJ,MAAM,CACP,CAAA;QACD,IAAI,CAAC,CAAC,MAAM,YAAY,OAAO,CAAC;YAAE,OAAO,MAAM,CAAA;QAC/C,8FAA8F;QAC9F,kGAAkG;QAClG,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,UAAU,CAAC,KAAK,EAAE,CAAA;gBAClB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;YACtB,CAAC,EAAE,gBAAgB,CAAC,CAAA;YACpB,MAAM,CAAC,IAAI,CACT,CAAC,KAAK,EAAE,EAAE;gBACR,YAAY,CAAC,KAAK,CAAC,CAAA;gBACnB,OAAO,CAAC,KAAK,CAAC,CAAA;YAChB,CAAC,EACD,CAAC,KAAK,EAAE,EAAE;gBACR,YAAY,CAAC,KAAK,CAAC,CAAA;gBACnB,MAAM,CAAC,KAAK,CAAC,CAAA;YACf,CAAC,CACF,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IACD,MAAM,KAAK,GAAG,CAAsB,GAAM,EAAK,EAAE;QAC/C,MAAM,IAAI,GAAG,GAAqC,CAAA;QAClD,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAA;QACrE,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,SAAS,CACjB,2EAA2E,CAC5E,CAAA;QACH,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAA;QAC7B,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;IACD,OAAO,KAAuB,CAAA;AAChC,CAAC"}

package/dist/server/plugin.d.ts

@@ -3,7 +3,9 @@
  * `use`/`derive`/`decorate` and/or registering routes) and returns it; these helpers attach a name
  * for idempotent dedupe and pin the type-threading so `.use()` preserves the caller's typed server.
  */
-import type { Registry } from "./registry.js";
+import type { Method } from "../router/router.js";
+import type { RouteSchema } from "./context.js";
+import type { AddRoute, Registry, RouteInfoFor } from "./registry.js";
 import type { AnyServer, Server } from "./server.js";
 /**
  * A nifra **plugin**: a function that augments an app - calling `use`/`derive`/`decorate` and/or
@@ -50,6 +52,29 @@ export type ContextPlugin<D extends object> = (<R extends Registry, Ctx>(app: Se
  * ```
  */
 export declare function defineContextPlugin<D extends object>(name: string, apply: <R extends Registry, Ctx>(app: Server<R, Ctx>) => Server<R, Ctx & D>): ContextPlugin<D>;
+declare const METHOD_ROUTES: unique symbol;
+/**
+ * What `all()` and `method()` from `@nifrajs/core/methods` return: a plugin for `app.use()` that
+ * registers one handler under the methods `M` of `Path`. It is opaque - apply it with `use`, which
+ * reads the route's types from it and adds them to the app's registry.
+ */
+export interface MethodRoutesPlugin<M extends string, Path extends string, S extends RouteSchema, Output, Ctx> {
+    readonly [METHOD_ROUTES]: {
+        readonly methods: M;
+        readonly path: Path;
+        readonly schema: S;
+        readonly output: Output;
+        /** The context the handler was written against; the app must provide at least this. */
+        readonly context: (context: Ctx) => void;
+    };
+}
+/** The standard methods among `M`, as the registry keys them. A custom token contributes none. */
+type StandardMethodOf<M extends string> = Extract<Uppercase<M>, Method>;
+/**
+ * The registry after a {@link MethodRoutesPlugin} is applied: `Path` gains the standard methods
+ * among `M`. A method outside the standard set is served but not typed, so it adds nothing.
+ */
+export type WithMethodRoutes<R extends Registry, M extends string, Path extends string, S extends RouteSchema, Output, HookOutput> = [StandardMethodOf<M>] extends [never] ? R : AddRoute<R, StandardMethodOf<M>, Path, RouteInfoFor<Path, S, Output, HookOutput>>;
 declare const COLLAPSED: unique symbol;
 /**
  * What {@link definePlugin} returns when its `apply` argument never pinned the input server type -

package/dist/server/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/server/plugin.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpD;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,CAAC,EAAE,SAAS,SAAS,GAAG,SAAS,EAAE,GAAG,SAAS,SAAS,GAAG,EAAE,IAAI,CAAC,CACvF,GAAG,EAAE,EAAE,KACJ,GAAG,CAAC,GAAG;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAE5C;;;;GAIG;AACH,MAAM,MAAM,cAAc,CAAC,eAAe,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,QAAQ,EAAE,GAAG,EAAE,UAAU,EACzF,GAAG,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,KAC5B,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,GAAG,eAAe,CAAC,CAAC,GAAG;IACnD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAC7B,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS,QAAQ,EAAE,GAAG,EACrE,GAAG,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,KAChB,MAAM,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAE3D;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,MAAM,EAClD,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,CAAC,CAAC,SAAS,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,GAC1E,aAAa,CAAC,CAAC,CAAC,CAElB;AAED,OAAO,CAAC,MAAM,SAAS,EAAE,OAAO,MAAM,CAAA;AAEtC;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,CAAC,SAAS,CAAC,EAAE,uJAAuJ,CAAA;CAC9K;AAED;;;GAGG;AAEH,MAAM,MAAM,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,GAClE,CAAC,SAAS,CAAC,GAAG,CAAC,GACb,IAAI,GACJ,KAAK,GACP,KAAK,CAAA;AAET,MAAM,MAAM,kBAAkB,CAAC,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,SAAS,IACxE,kBAAkB,CAAC,EAAE,CAAC,SAAS,IAAI,GAAG,mBAAmB,GAAG,WAAW,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;AAElF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,YAAY,CAAC,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,SAAS,EACtE,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,GAAG,GACtB,kBAAkB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;AAQ9B;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,eAAe,GAAG,KAAK,EAC1D,IAAI,EAAE,MAAM,EAKZ,KAAK,EAAE,CAAC,CAAC,SAAS,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,SAAS,GACpD,cAAc,CAAC,eAAe,CAAC,CAEjC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,kBAAkB,EAAE,OAAO,oBAA2C,CAAA"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/server/plugin.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpD;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,CAAC,EAAE,SAAS,SAAS,GAAG,SAAS,EAAE,GAAG,SAAS,SAAS,GAAG,EAAE,IAAI,CAAC,CACvF,GAAG,EAAE,EAAE,KACJ,GAAG,CAAC,GAAG;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAE5C;;;;GAIG;AACH,MAAM,MAAM,cAAc,CAAC,eAAe,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,QAAQ,EAAE,GAAG,EAAE,UAAU,EACzF,GAAG,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,KAC5B,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,GAAG,eAAe,CAAC,CAAC,GAAG;IACnD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAC7B,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS,QAAQ,EAAE,GAAG,EACrE,GAAG,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,KAChB,MAAM,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAE3D;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,MAAM,EAClD,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,CAAC,CAAC,SAAS,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,GAC1E,aAAa,CAAC,CAAC,CAAC,CAElB;AAED,OAAO,CAAC,MAAM,aAAa,EAAE,OAAO,MAAM,CAAA;AAE1C;;;;GAIG;AACH,MAAM,WAAW,kBAAkB,CACjC,CAAC,SAAS,MAAM,EAChB,IAAI,SAAS,MAAM,EACnB,CAAC,SAAS,WAAW,EACrB,MAAM,EACN,GAAG;IAEH,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE;QACxB,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;QACnB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;QACnB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QAClB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;QACvB,uFAAuF;QACvF,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,IAAI,CAAA;KACzC,CAAA;CACF;AAED,kGAAkG;AAClG,KAAK,gBAAgB,CAAC,CAAC,SAAS,MAAM,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;AAEvE;;;GAGG;AACH,MAAM,MAAM,gBAAgB,CAC1B,CAAC,SAAS,QAAQ,EAClB,CAAC,SAAS,MAAM,EAChB,IAAI,SAAS,MAAM,EACnB,CAAC,SAAS,WAAW,EACrB,MAAM,EACN,UAAU,IACR,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GACrC,CAAC,GACD,QAAQ,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAA;AAErF,OAAO,CAAC,MAAM,SAAS,EAAE,OAAO,MAAM,CAAA;AAEtC;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,CAAC,SAAS,CAAC,EAAE,uJAAuJ,CAAA;CAC9K;AAED;;;GAGG;AAEH,MAAM,MAAM,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,GAClE,CAAC,SAAS,CAAC,GAAG,CAAC,GACb,IAAI,GACJ,KAAK,GACP,KAAK,CAAA;AAET,MAAM,MAAM,kBAAkB,CAAC,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,SAAS,IACxE,kBAAkB,CAAC,EAAE,CAAC,SAAS,IAAI,GAAG,mBAAmB,GAAG,WAAW,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;AAElF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,YAAY,CAAC,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,SAAS,EACtE,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,GAAG,GACtB,kBAAkB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;AAQ9B;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,eAAe,GAAG,KAAK,EAC1D,IAAI,EAAE,MAAM,EAKZ,KAAK,EAAE,CAAC,CAAC,SAAS,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,SAAS,GACpD,cAAc,CAAC,eAAe,CAAC,CAEjC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,kBAAkB,EAAE,OAAO,oBAA2C,CAAA"}

package/dist/server/plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/server/plugin.ts"],"names":[],"mappings":"AAyCA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,KAA2E;IAE3E,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAqB,CAAA;AACvE,CAAC;AA8DD,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,KAAoC;IAEpC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;AACnD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAY;AACZ,iGAAiG;AACjG,2FAA2F;AAC3F,mGAAmG;AACnG,8FAA8F;AAC9F,KAAqD;IAErD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAoC,CAAA;AACtF,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAgC,oBAAoB,CAAA"}
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/server/plugin.ts"],"names":[],"mappings":"AA2CA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,KAA2E;IAE3E,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAqB,CAAA;AACvE,CAAC;AAwGD,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,KAAoC;IAEpC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;AACnD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAY;AACZ,iGAAiG;AACjG,2FAA2F;AAC3F,mGAAmG;AACnG,8FAA8F;AAC9F,KAAqD;IAErD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAoC,CAAA;AACtF,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAgC,oBAAoB,CAAA"}

package/dist/server/proto-guard.d.ts

@@ -20,11 +20,24 @@ export type ProtoPoisoning = "reject" | "strip" | "ignore";
  */
 export declare function parseJsonGuarded(text: string, policy: ProtoPoisoning): unknown;
 /**
- * The policy applied to an already-parsed value - the native-`json()` lane, which never holds the
- * raw text, and the transport codecs, which parse with their own decoder. Escapes are resolved by
- * the time a key is an own property, so a `\u`-spelled `__proto__` and a literal one look identical
- * here. Cost is one iterative pass over the value's object nodes; `"ignore"` skips even that.
- * Throws the reject singleton; callers map it to their lane's flat error.
+ * The policy applied to an already-parsed JSON value - the native-`json()` lane, which never holds
+ * the raw text. Escapes are resolved by the time a key is an own property, so a `\u`-spelled
+ * `__proto__` and a literal one look identical here. Cost is one iterative pass over the value's
+ * object nodes; `"ignore"` skips even that. The walk assumes a tree, which JSON always is; a
+ * transport codec's output goes through {@link guardDecodedValue}. Throws the reject singleton;
+ * callers map it to their lane's flat error.
  */
 export declare function guardParsedValue(value: unknown, policy: ProtoPoisoning): unknown;
+/**
+ * The policy for a value a transport codec decoded. Unlike `JSON.parse` output that can be a graph -
+ * a codec that keeps references, as the rich wire codec does, returns shared nodes and cycles - while
+ * everything downstream (validators, handlers, serializers) walks a body as a tree. So a cycle is
+ * refused, and shared nodes may add at most {@link MAX_SHARED_EXPANSION} nodes to the tree they expand
+ * to: forty levels of doubled references fit in 2KB and expand to 2^40 paths. Map and Set members are
+ * walked like properties. These shape rules hold under every policy, `"ignore"` included.
+ *
+ * A `RegExp` is refused unless `patterns` allows it: a pattern from the client is code, and one with
+ * catastrophic backtracking stalls the event loop the moment anything runs it.
+ */
+export declare function guardDecodedValue(value: unknown, policy: ProtoPoisoning, patterns?: boolean): unknown;
 //# sourceMappingURL=proto-guard.d.ts.map

package/dist/server/proto-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proto-guard.d.ts","sourceRoot":"","sources":["../../src/server/proto-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAA;AAK1D;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAE9E;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAGhF"}
+{"version":3,"file":"proto-guard.d.ts","sourceRoot":"","sources":["../../src/server/proto-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAA;AAK1D;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAE9E;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAGhF;AAiGD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,cAAc,EACtB,QAAQ,UAAQ,GACf,OAAO,CAuBT"}

package/dist/server/proto-guard.js

@@ -23,11 +23,12 @@ export function parseJsonGuarded(text, policy) {
     return guardParsedValue(JSON.parse(text), policy);
 }
 /**
- * The policy applied to an already-parsed value - the native-`json()` lane, which never holds the
- * raw text, and the transport codecs, which parse with their own decoder. Escapes are resolved by
- * the time a key is an own property, so a `\u`-spelled `__proto__` and a literal one look identical
- * here. Cost is one iterative pass over the value's object nodes; `"ignore"` skips even that.
- * Throws the reject singleton; callers map it to their lane's flat error.
+ * The policy applied to an already-parsed JSON value - the native-`json()` lane, which never holds
+ * the raw text. Escapes are resolved by the time a key is an own property, so a `\u`-spelled
+ * `__proto__` and a literal one look identical here. Cost is one iterative pass over the value's
+ * object nodes; `"ignore"` skips even that. The walk assumes a tree, which JSON always is; a
+ * transport codec's output goes through {@link guardDecodedValue}. Throws the reject singleton;
+ * callers map it to their lane's flat error.
  */
 export function guardParsedValue(value, policy) {
     if (policy === "ignore")
@@ -77,10 +78,10 @@ function sweep(root, policy) {
         // `for-in`, not `Object.keys()`: the keys array would be an allocation per node (~2x the whole
         // walk on measured bodies, both engines, at realistic widths; V8 only prefers `Object.keys` on
         // 200+-property dictionary-mode objects). On JSON.parse output the two enumerate identically -
-        // own enumerable string keys, nothing enumerable on the prototype chain. A custom transport
-        // codec could hand `guardParsedValue` an object with enumerable INHERITED properties; `for-in`
-        // sweeps those too, which only over-sweeps - a poisoned inherited subtree rejects rather than
-        // slips through. A *non-enumerable* own `__proto__` is the one shape this misses, and it is
+        // own enumerable string keys, nothing enumerable on the prototype chain. Were a value with
+        // enumerable INHERITED properties handed in, `for-in` would sweep those too, which only
+        // over-sweeps - a poisoned inherited subtree rejects rather than slips through. A
+        // *non-enumerable* own `__proto__` is the one shape this misses, and it is
         // not the poisoning shape: `JSON.parse` never produces one, and the merges that carry the
         // payload onward (spread, `Object.assign`, key loops) copy enumerable own keys only.
         for (const key in record) {
@@ -113,4 +114,108 @@ function sweep(root, policy) {
     }
     return root;
 }
+/** How many nodes shared references may add to a decoded value, counted as a tree walk visits it. */
+const MAX_SHARED_EXPANSION = 100_000;
+/** Thrown (reused singleton, mapped like {@link POISONED}) for a decoded value no tree walk can finish,
+ * or one holding a pattern the caller did not allow. */
+const NOT_A_TREE = /* @__PURE__ */ new Error("decoded_value_not_a_tree");
+/** Marks a node whose subtree is still being walked: meeting it again then is a cycle. */
+const ON_PATH = -1;
+/**
+ * The policy for a value a transport codec decoded. Unlike `JSON.parse` output that can be a graph -
+ * a codec that keeps references, as the rich wire codec does, returns shared nodes and cycles - while
+ * everything downstream (validators, handlers, serializers) walks a body as a tree. So a cycle is
+ * refused, and shared nodes may add at most {@link MAX_SHARED_EXPANSION} nodes to the tree they expand
+ * to: forty levels of doubled references fit in 2KB and expand to 2^40 paths. Map and Set members are
+ * walked like properties. These shape rules hold under every policy, `"ignore"` included.
+ *
+ * A `RegExp` is refused unless `patterns` allows it: a pattern from the client is code, and one with
+ * catastrophic backtracking stalls the event loop the moment anything runs it.
+ */
+export function guardDecodedValue(value, policy, patterns = false) {
+    if (value === null || typeof value !== "object")
+        return value;
+    const sizes = new Map();
+    const frames = [openDecoded(value, policy, patterns, sizes)];
+    let expanded = 0;
+    for (let frame = frames.at(-1); frame !== undefined; frame = frames.at(-1)) {
+        const child = frame.children[frame.next];
+        if (child !== undefined) {
+            frame.next++;
+            const known = sizes.get(child);
+            if (known === undefined)
+                frames.push(openDecoded(child, policy, patterns, sizes));
+            else if (known === ON_PATH)
+                throw NOT_A_TREE;
+            else
+                frame.size += known;
+            continue;
+        }
+        frames.pop();
+        sizes.set(frame.node, frame.size);
+        const parent = frames.at(-1);
+        if (parent === undefined)
+            expanded = frame.size;
+        else
+            parent.size += frame.size;
+    }
+    if (expanded - sizes.size > MAX_SHARED_EXPANSION)
+        throw NOT_A_TREE;
+    return value;
+}
+function openDecoded(node, policy, patterns, sizes) {
+    if (!patterns && node instanceof RegExp)
+        throw NOT_A_TREE;
+    sizes.set(node, ON_PATH);
+    return { node, children: decodedChildren(node, policy), next: 0, size: 1 };
+}
+function decodedChildren(node, policy) {
+    const children = [];
+    const add = (value) => {
+        if (value !== null && typeof value === "object")
+            children.push(value);
+    };
+    if (Array.isArray(node)) {
+        for (let i = 0; i < node.length; i++)
+            add(node[i]);
+        return children;
+    }
+    if (node instanceof Map) {
+        for (const [key, value] of node) {
+            add(key);
+            add(value);
+        }
+        return children;
+    }
+    if (node instanceof Set) {
+        for (const item of node)
+            add(item);
+        return children;
+    }
+    // Binary and scalar wrappers carry no keys to poison; `for-in` over a typed array would enumerate
+    // every index.
+    if (ArrayBuffer.isView(node) ||
+        node instanceof ArrayBuffer ||
+        node instanceof Date ||
+        node instanceof RegExp ||
+        node instanceof URL) {
+        return children;
+    }
+    for (const key in node) {
+        const value = Reflect.get(node, key);
+        if (policy !== "ignore" &&
+            (key === "__proto__" ||
+                (key === "constructor" &&
+                    value !== null &&
+                    typeof value === "object" &&
+                    Object.hasOwn(value, "prototype")))) {
+            if (policy === "reject")
+                throw POISONED;
+            Reflect.deleteProperty(node, key);
+            continue;
+        }
+        add(value);
+    }
+    return children;
+}
 //# sourceMappingURL=proto-guard.js.map

package/dist/server/proto-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"proto-guard.js","sourceRoot":"","sources":["../../src/server/proto-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,kGAAkG;AAClG,MAAM,QAAQ,GAAG,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;AAElD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,MAAsB;IACnE,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc,EAAE,MAAsB;IACrE,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACrC,OAAO,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;AAC7B,CAAC;AAED;;;;;;GAMG;AACH;2FAC2F;AAC3F,MAAM,KAAK,GAAc,EAAE,CAAA;AAE3B,SAAS,KAAK,CAAC,IAAa,EAAE,MAA0B;IACtD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAC1D,MAAM,KAAK,GAAG,KAAK,CAAA;IACnB,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;IAChB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAY,CAAA;QAClC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,4FAA4F;YAC5F,yFAAyF;YACzF,8FAA8F;YAC9F,EAAE;YACF,2FAA2F;YAC3F,4FAA4F;YAC5F,6FAA6F;YAC7F,2FAA2F;YAC3F,0FAA0F;YAC1F,gDAAgD;YAChD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACrC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;gBACpB,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACjE,CAAC;YACD,SAAQ;QACV,CAAC;QACD,MAAM,MAAM,GAAG,IAA+B,CAAA;QAC9C,8FAA8F;QAC9F,6FAA6F;QAC7F,+FAA+F;QAC/F,+FAA+F;QAC/F,+FAA+F;QAC/F,+FAA+F;QAC/F,4FAA4F;QAC5F,+FAA+F;QAC/F,8FAA8F;QAC9F,4FAA4F;QAC5F,0FAA0F;QAC1F,qFAAqF;QACrF,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;YACzB,MAAM,MAAM,GAAG,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAA;YAC1D,6FAA6F;YAC7F,2FAA2F;YAC3F,+EAA+E;YAC/E,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;gBAChF,IAAI,MAAM,KAAK,QAAQ;oBAAE,MAAM,QAAQ,CAAA;gBACvC,+HAA+H;gBAC/H,OAAO,MAAM,CAAC,WAAW,CAAC,CAAA;gBAC1B,SAAQ;YACV,CAAC;YACD,IACE,GAAG,CAAC,MAAM,KAAK,EAAE;gBACjB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO;gBAChC,GAAG,KAAK,aAAa;gBACrB,MAAM;gBACN,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,EACjC,CAAC;gBACD,IAAI,MAAM,KAAK,QAAQ;oBAAE,MAAM,QAAQ,CAAA;gBACvC,+HAA+H;gBAC/H,OAAO,MAAM,CAAC,aAAa,CAAC,CAAA;gBAC5B,SAAQ;YACV,CAAC;YACD,IAAI,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}
+{"version":3,"file":"proto-guard.js","sourceRoot":"","sources":["../../src/server/proto-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,kGAAkG;AAClG,MAAM,QAAQ,GAAG,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;AAElD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,MAAsB;IACnE,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc,EAAE,MAAsB;IACrE,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACrC,OAAO,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;AAC7B,CAAC;AAED;;;;;;GAMG;AACH;2FAC2F;AAC3F,MAAM,KAAK,GAAc,EAAE,CAAA;AAE3B,SAAS,KAAK,CAAC,IAAa,EAAE,MAA0B;IACtD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAC1D,MAAM,KAAK,GAAG,KAAK,CAAA;IACnB,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;IAChB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAY,CAAA;QAClC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,4FAA4F;YAC5F,yFAAyF;YACzF,8FAA8F;YAC9F,EAAE;YACF,2FAA2F;YAC3F,4FAA4F;YAC5F,6FAA6F;YAC7F,2FAA2F;YAC3F,0FAA0F;YAC1F,gDAAgD;YAChD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACrC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;gBACpB,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACjE,CAAC;YACD,SAAQ;QACV,CAAC;QACD,MAAM,MAAM,GAAG,IAA+B,CAAA;QAC9C,8FAA8F;QAC9F,6FAA6F;QAC7F,+FAA+F;QAC/F,+FAA+F;QAC/F,+FAA+F;QAC/F,+FAA+F;QAC/F,2FAA2F;QAC3F,wFAAwF;QACxF,kFAAkF;QAClF,2EAA2E;QAC3E,0FAA0F;QAC1F,qFAAqF;QACrF,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;YACzB,MAAM,MAAM,GAAG,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAA;YAC1D,6FAA6F;YAC7F,2FAA2F;YAC3F,+EAA+E;YAC/E,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;gBAChF,IAAI,MAAM,KAAK,QAAQ;oBAAE,MAAM,QAAQ,CAAA;gBACvC,+HAA+H;gBAC/H,OAAO,MAAM,CAAC,WAAW,CAAC,CAAA;gBAC1B,SAAQ;YACV,CAAC;YACD,IACE,GAAG,CAAC,MAAM,KAAK,EAAE;gBACjB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO;gBAChC,GAAG,KAAK,aAAa;gBACrB,MAAM;gBACN,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,EACjC,CAAC;gBACD,IAAI,MAAM,KAAK,QAAQ;oBAAE,MAAM,QAAQ,CAAA;gBACvC,+HAA+H;gBAC/H,OAAO,MAAM,CAAC,aAAa,CAAC,CAAA;gBAC5B,SAAQ;YACV,CAAC;YACD,IAAI,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,qGAAqG;AACrG,MAAM,oBAAoB,GAAG,OAAO,CAAA;AAEpC;wDACwD;AACxD,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;AAExE,0FAA0F;AAC1F,MAAM,OAAO,GAAG,CAAC,CAAC,CAAA;AASlB;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAc,EACd,MAAsB,EACtB,QAAQ,GAAG,KAAK;IAEhB,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAA;IACvC,MAAM,MAAM,GAAmB,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAA;IAC5E,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,KAAK,IAAI,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,SAAS,EAAE,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACxC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,EAAE,CAAA;YACZ,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YAC9B,IAAI,KAAK,KAAK,SAAS;gBAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAA;iBAC5E,IAAI,KAAK,KAAK,OAAO;gBAAE,MAAM,UAAU,CAAA;;gBACvC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAA;YACxB,SAAQ;QACV,CAAC;QACD,MAAM,CAAC,GAAG,EAAE,CAAA;QACZ,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QAC5B,IAAI,MAAM,KAAK,SAAS;YAAE,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAA;;YAC1C,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAA;IAChC,CAAC;IACD,IAAI,QAAQ,GAAG,KAAK,CAAC,IAAI,GAAG,oBAAoB;QAAE,MAAM,UAAU,CAAA;IAClE,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,WAAW,CAClB,IAAY,EACZ,MAAsB,EACtB,QAAiB,EACjB,KAA0B;IAE1B,IAAI,CAAC,QAAQ,IAAI,IAAI,YAAY,MAAM;QAAE,MAAM,UAAU,CAAA;IACzD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACxB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAA;AAC5E,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,MAAsB;IAC3D,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,MAAM,GAAG,GAAG,CAAC,KAAc,EAAQ,EAAE;QACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACvE,CAAC,CAAA;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QAClD,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,IAAI,IAAI,YAAY,GAAG,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;YAChC,GAAG,CAAC,GAAG,CAAC,CAAA;YACR,GAAG,CAAC,KAAK,CAAC,CAAA;QACZ,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,IAAI,IAAI,YAAY,GAAG,EAAE,CAAC;QACxB,KAAK,MAAM,IAAI,IAAI,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,CAAA;QAClC,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,kGAAkG;IAClG,eAAe;IACf,IACE,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,YAAY,WAAW;QAC3B,IAAI,YAAY,IAAI;QACpB,IAAI,YAAY,MAAM;QACtB,IAAI,YAAY,GAAG,EACnB,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QAC7C,IACE,MAAM,KAAK,QAAQ;YACnB,CAAC,GAAG,KAAK,WAAW;gBAClB,CAAC,GAAG,KAAK,aAAa;oBACpB,KAAK,KAAK,IAAI;oBACd,OAAO,KAAK,KAAK,QAAQ;oBACzB,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,EACvC,CAAC;YACD,IAAI,MAAM,KAAK,QAAQ;gBAAE,MAAM,QAAQ,CAAA;YACvC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;YACjC,SAAQ;QACV,CAAC;QACD,GAAG,CAAC,KAAK,CAAC,CAAA;IACZ,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/server/query.d.ts

@@ -10,6 +10,13 @@ export type QueryValue = string | string[];
 /** Return a value-equal, likely-internalized copy of a parsed record key. See the note above. */
 export declare function internParseKey(key: string): string;
 export declare function queryObjectOf(search: string): Record<string, QueryValue>;
+/**
+ * `application/json` or an `application/*+json` type, with or without parameters, compared as a media
+ * type rather than searched as a substring. A substring test also matches `text/plain; x=application/json`,
+ * whose essence is `text/plain` - a type a browser sends cross-origin with credentials and no preflight,
+ * so a JSON route would parse a body no CORS policy ever saw.
+ */
+export declare function isJsonMediaType(contentType: string): boolean;
 /** `application/x-www-form-urlencoded`, with or without a charset suffix. */
 export declare function isUrlEncodedForm(contentType: string): boolean;
 /**

package/dist/server/query.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../src/server/query.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAMhD,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED;;;;mDAImD;AACnD,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;AAgB1C,iGAAiG;AACjG,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAOlD;AAsCD,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAyBxE;AAED,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAK7D;AAID;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,aAAa,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,cAAc,CAAC,CActD"}
+{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../src/server/query.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAMhD,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED;;;;mDAImD;AACnD,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;AAgB1C,iGAAiG;AACjG,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAOlD;AAsCD,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAyBxE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAyC5D;AAED,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAK7D;AAID;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,aAAa,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,cAAc,CAAC,CActD"}

package/dist/server/query.js

@@ -99,6 +99,53 @@ export function queryObjectOf(search) {
     }
     return out;
 }
+/**
+ * `application/json` or an `application/*+json` type, with or without parameters, compared as a media
+ * type rather than searched as a substring. A substring test also matches `text/plain; x=application/json`,
+ * whose essence is `text/plain` - a type a browser sends cross-origin with credentials and no preflight,
+ * so a JSON route would parse a body no CORS policy ever saw.
+ */
+export function isJsonMediaType(contentType) {
+    // The spellings common clients send, by exact match.
+    if (contentType === "application/json" ||
+        contentType === "application/json; charset=utf-8" ||
+        contentType === "application/json;charset=UTF-8") {
+        return true;
+    }
+    // Every other lowercase `application/json` spelling, parameters or not, without slicing or lowercasing.
+    if (contentType.startsWith("application/json")) {
+        let delimiter = 16;
+        while (delimiter < contentType.length) {
+            const char = contentType.charCodeAt(delimiter);
+            if (char !== 32 /* SP */ && char !== 9 /* HTAB */)
+                break;
+            delimiter++;
+        }
+        if (delimiter === contentType.length || contentType.charCodeAt(delimiter) === 59 /* ; */) {
+            return true;
+        }
+    }
+    // Lowercase `application/*+json` spellings by the same rules as the parse below, without allocating.
+    if (contentType.startsWith("application/")) {
+        const params = contentType.indexOf(";", 12);
+        let end = params === -1 ? contentType.length : params;
+        while (end > 12) {
+            const char = contentType.charCodeAt(end - 1);
+            if (char !== 32 /* SP */ && char !== 9 /* HTAB */)
+                break;
+            end--;
+        }
+        if (end >= 17 && contentType.startsWith("+json", end - 5)) {
+            const space = contentType.indexOf(" ", 12);
+            if (space === -1 || space >= end)
+                return true;
+        }
+    }
+    const semi = contentType.indexOf(";");
+    const essence = (semi === -1 ? contentType : contentType.slice(0, semi)).trim().toLowerCase();
+    return (essence === "application/json" ||
+        (essence.startsWith("application/") && essence.endsWith("+json") && !essence.includes(" ")));
+}
 /** `application/x-www-form-urlencoded`, with or without a charset suffix. */
 export function isUrlEncodedForm(contentType) {
     return (contentType === "application/x-www-form-urlencoded" ||

package/dist/server/query.js.map

@@ -1 +1 @@
-{"version":3,"file":"query.js","sourceRoot":"","sources":["../../src/server/query.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAIlD,+FAA+F;AAC/F,oGAAoG;AACpG,oGAAoG;AACpG,2DAA2D;AAC3D,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;AAC/B,CAAC;AASD,iGAAiG;AACjG,kGAAkG;AAClG,gGAAgG;AAChG,8FAA8F;AAC9F,kGAAkG;AAClG,mGAAmG;AACnG,8FAA8F;AAC9F,kGAAkG;AAClG,yDAAyD;AACzD,MAAM,wBAAwB,GAAG,OAAQ,UAAgC,CAAC,GAAG,KAAK,WAAW,CAAA;AAC7F,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAA;AAClD,MAAM,oBAAoB,GAAG,IAAI,CAAA;AACjC,MAAM,oBAAoB,GAAG,EAAE,CAAA;AAE/B,iGAAiG;AACjG,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,wBAAwB;QAAE,OAAO,GAAG,CAAA;IACxC,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAA;IACjC,IAAI,GAAG,CAAC,MAAM,GAAG,oBAAoB,IAAI,gBAAgB,CAAC,IAAI,IAAI,oBAAoB;QAAE,OAAO,GAAG,CAAA;IAClG,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAC9B,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;8EAG8E;AAC9E,SAAS,aAAa,CAAC,GAA+B,EAAE,MAAc,EAAE,KAAa;IACnF,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;IAClC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;IACzB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAClB,CAAC;SAAM,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACxC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IAC9B,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACtB,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAc;IACzC,uFAAuF;IACvF,+EAA+E;IAC/E,MAAM,GAAG,GAA+B,MAAM,CAAC,MAAM,CAAC,IAAI,CAA+B,CAAA;IACzF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QACvD,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IAChC,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;GAKG;AACH,iGAAiG;AACjG,0DAA0D;AAC1D,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAA+B,CAAA;AAEpF,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACzD,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,WAAW,CAAA;IAE9C,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QAC9B,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO;YAAE,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAA;IAC9E,CAAC;IAED,MAAM,GAAG,GAA+B,MAAM,CAAC,MAAM,CAAC,IAAI,CAA+B,CAAA;IACzF,IAAI,GAAG,GAAG,KAAK,CAAA;IACf,OAAO,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACpC,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAA;QAC5C,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;YACd,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YACnC,MAAM,KAAK,GAAG,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA;YAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YACpC,MAAM,KAAK,GAAG,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,CAAA;YAC/D,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;QAChC,CAAC;QACD,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,MAAK;QACrB,GAAG,GAAG,GAAG,GAAG,CAAC,CAAA;IACf,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,WAAmB;IAClD,OAAO,CACL,WAAW,KAAK,mCAAmC;QACnD,WAAW,CAAC,UAAU,CAAC,oCAAoC,CAAC,CAC7D,CAAA;AACH,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAA;AAEtC;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAkB,EAClB,QAAgB;IAEhB,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IAClD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,MAAM,KAAK,GAAG;YACxB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,mBAAmB,CAAC;YACtC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAA;IAC/C,CAAC;IACD,MAAM,GAAG,GAA+B,MAAM,CAAC,MAAM,CAAC,IAAI,CAA+B,CAAA;IACzF,yFAAyF;IACzF,iEAAiE;IACjE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,eAAe,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAChF,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IAChC,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"query.js","sourceRoot":"","sources":["../../src/server/query.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAIlD,+FAA+F;AAC/F,oGAAoG;AACpG,oGAAoG;AACpG,2DAA2D;AAC3D,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;AAC/B,CAAC;AASD,iGAAiG;AACjG,kGAAkG;AAClG,gGAAgG;AAChG,8FAA8F;AAC9F,kGAAkG;AAClG,mGAAmG;AACnG,8FAA8F;AAC9F,kGAAkG;AAClG,yDAAyD;AACzD,MAAM,wBAAwB,GAAG,OAAQ,UAAgC,CAAC,GAAG,KAAK,WAAW,CAAA;AAC7F,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAA;AAClD,MAAM,oBAAoB,GAAG,IAAI,CAAA;AACjC,MAAM,oBAAoB,GAAG,EAAE,CAAA;AAE/B,iGAAiG;AACjG,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,wBAAwB;QAAE,OAAO,GAAG,CAAA;IACxC,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAA;IACjC,IAAI,GAAG,CAAC,MAAM,GAAG,oBAAoB,IAAI,gBAAgB,CAAC,IAAI,IAAI,oBAAoB;QAAE,OAAO,GAAG,CAAA;IAClG,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAC9B,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;8EAG8E;AAC9E,SAAS,aAAa,CAAC,GAA+B,EAAE,MAAc,EAAE,KAAa;IACnF,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;IAClC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;IACzB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAClB,CAAC;SAAM,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACxC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IAC9B,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACtB,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAc;IACzC,uFAAuF;IACvF,+EAA+E;IAC/E,MAAM,GAAG,GAA+B,MAAM,CAAC,MAAM,CAAC,IAAI,CAA+B,CAAA;IACzF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QACvD,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IAChC,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;GAKG;AACH,iGAAiG;AACjG,0DAA0D;AAC1D,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAA+B,CAAA;AAEpF,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACzD,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,WAAW,CAAA;IAE9C,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QAC9B,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO;YAAE,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAA;IAC9E,CAAC;IAED,MAAM,GAAG,GAA+B,MAAM,CAAC,MAAM,CAAC,IAAI,CAA+B,CAAA;IACzF,IAAI,GAAG,GAAG,KAAK,CAAA;IACf,OAAO,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACpC,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAA;QAC5C,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;YACd,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YACnC,MAAM,KAAK,GAAG,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA;YAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YACpC,MAAM,KAAK,GAAG,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,CAAA;YAC/D,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;QAChC,CAAC;QACD,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,MAAK;QACrB,GAAG,GAAG,GAAG,GAAG,CAAC,CAAA;IACf,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,WAAmB;IACjD,qDAAqD;IACrD,IACE,WAAW,KAAK,kBAAkB;QAClC,WAAW,KAAK,iCAAiC;QACjD,WAAW,KAAK,gCAAgC,EAChD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,wGAAwG;IACxG,IAAI,WAAW,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC/C,IAAI,SAAS,GAAG,EAAE,CAAA;QAClB,OAAO,SAAS,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;YAC9C,IAAI,IAAI,KAAK,EAAE,CAAC,QAAQ,IAAI,IAAI,KAAK,CAAC,CAAC,UAAU;gBAAE,MAAK;YACxD,SAAS,EAAE,CAAA;QACb,CAAC;QACD,IAAI,SAAS,KAAK,WAAW,CAAC,MAAM,IAAI,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC;YACzF,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IACD,qGAAqG;IACrG,IAAI,WAAW,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;QAC3C,IAAI,GAAG,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;QACrD,OAAO,GAAG,GAAG,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;YAC5C,IAAI,IAAI,KAAK,EAAE,CAAC,QAAQ,IAAI,IAAI,KAAK,CAAC,CAAC,UAAU;gBAAE,MAAK;YACxD,GAAG,EAAE,CAAA;QACP,CAAC;QACD,IAAI,GAAG,IAAI,EAAE,IAAI,WAAW,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YAC1C,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,KAAK,IAAI,GAAG;gBAAE,OAAO,IAAI,CAAA;QAC/C,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACrC,MAAM,OAAO,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC7F,OAAO,CACL,OAAO,KAAK,kBAAkB;QAC9B,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAC5F,CAAA;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,WAAmB;IAClD,OAAO,CACL,WAAW,KAAK,mCAAmC;QACnD,WAAW,CAAC,UAAU,CAAC,oCAAoC,CAAC,CAC7D,CAAA;AACH,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAA;AAEtC;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAkB,EAClB,QAAgB;IAEhB,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IAClD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,MAAM,KAAK,GAAG;YACxB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,mBAAmB,CAAC;YACtC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAA;IAC/C,CAAC;IACD,MAAM,GAAG,GAA+B,MAAM,CAAC,MAAM,CAAC,IAAI,CAA+B,CAAA;IACzF,yFAAyF;IACzF,iEAAiE;IACjE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,eAAe,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAChF,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IAChC,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/server/registry.d.ts

@@ -1,6 +1,6 @@
 import type { BinaryResponse, RawResponse } from "../binary.js";
 import type { InferInput, InferOutput, StandardSchemaV1 } from "../schema/standard.js";
-import type { Params, RouteSchema } from "./context.js";
+import type { Params, RoutePaths, RouteSchema } from "./context.js";
 import type { StatusResponse } from "./runtime-core.js";
 /**
  * One route's input/output shape as the **client** will consume it. `query`/`body`
@@ -138,11 +138,22 @@ export type WsRouteInfoFor<Path extends string, In extends StandardSchemaV1 | un
  * `.merge()` them (each group is a short chain; a merge is one `R & R2` intersection with no
  * per-call context work), or contract-first `implement()` (the registry is one object type declared
  * upfront - no grow-R-per-call, so no ceiling at all).
+ *
+ * A path ending in optional parameters is keyed once per concrete path it serves (`RoutePaths`), all
+ * sharing the one route info, so `/users/:id?` adds `/users` and `/users/:id`.
  */
 export type AddRoute<R extends Registry, Method extends string, Path extends string, Info extends RouteInfo> = R & {
-    [P in Path]: {
+    [P in RoutePaths<Path>]: {
         [M in Method]: Info;
     };
 };
+/** Join a group prefix and a route path the way `Server.group` does at runtime: a group's `/` route
+ * serves the prefix itself (no trailing slash), every other path is appended verbatim. */
+export type JoinRoutePath<Prefix extends string, Path extends string> = Path extends "/" ? Prefix : `${Prefix}${Path}`;
+/** Re-key a registry under a static path prefix. Route info (params, schemas, responses) is carried
+ * unchanged: a prefix is static text, so it adds no params and cannot change any route's contract. */
+export type PrefixRegistry<Prefix extends string, R extends Registry> = {
+    [Path in keyof R & string as JoinRoutePath<Prefix, Path>]: R[Path];
+};
 export {};
 //# sourceMappingURL=registry.d.ts.map