@rapidrest/service-core 1.0.0-rc.9 → 1.0.0

package/dist/types/decorators/ModelDecorators.d.ts

@@ -1,5 +1,5 @@
 import "reflect-metadata";
-import { AccessControlList } from "../security/AccessControlList.js";
+import { type AccessControlList } from "../security/AccessControlList.js";
 /**
  * Describes a column registration that must be bridged into TypeORM's metadata storage when (and only when) a SQL
  * connection is established. Entries are queued here by decorators so that this module does not depend on the
@@ -23,7 +23,7 @@ export declare const pendingTypeOrmColumns: PendingTypeOrmColumn[];
  */
 export declare function Cache(ttl?: number): (target: any) => void;
 /**
- * Indicates that a class is a child entity to some parent. Child entities will inherit all datastore configuration
+ * Indicates that a class is a child entity to some parent. Child entities will inherit all datasource configuration
  * of the parent, including cache settings.
  */
 export declare function ChildEntity(): <T extends {
@@ -35,15 +35,22 @@ export declare function ChildEntity(): <T extends {
     };
 } & T;
 /**
- * Indicates that the class describes an entity that will be persisted in the datastore with the given name.
+ * Indicates that the class describes an entity that will be persisted in the datasource with the given name.
  *
- * @param datastore The name of the datastore to store records of the decorated class.
+ * @param datasource The name of the datasource to store records of the decorated class.
  */
-export declare function DataStore(datastore: string): (target: any) => void;
+export declare function DataStore(datasource: string): (target: any) => void;
 /**
  * Apply this to a property that is considered a unique identifier.
  */
 export declare function Identifier(target: any, propertyKey: string | symbol): void;
+/**
+ * Apply this to a property that must never be settable by a client. `RepoUtils.create()`/`update()` strip any
+ * client-supplied value for a `@ReadOnly` property before persisting — the property's existing/declared-default
+ * value is kept instead, regardless of what the request body contains. Use this for fields that should only ever
+ * be changed by application/business logic (e.g. `roles`, ownership fields, computed/derived state).
+ */
+export declare function ReadOnly(target: any, propertyKey: string | symbol): void;
 type PartialACL = Partial<AccessControlList> & Pick<AccessControlList, "records">;
 /**
  * Apply this to a model class to indicate that it should be protected by the AccessControlList security system.

package/dist/types/decorators/PersistenceDecorators.d.ts

@@ -18,7 +18,7 @@ export interface CollationOptions {
  * The set of options available when declaring a persisted column/property via the `@Column` decorator.
  */
 export interface ColumnOptions {
-    /** The name of the column in the datastore. Defaults to the property name. */
+    /** The name of the column in the datasource. Defaults to the property name. */
     name?: string;
     /** Set to `true` if the column may store `null`/`undefined` values. */
     nullable?: boolean;
@@ -26,6 +26,13 @@ export interface ColumnOptions {
     primary?: boolean;
     /** Set to `true` if the column stores a MongoDB `ObjectId` value. */
     isObjectId?: boolean;
+    /**
+     * Explicitly declares the SQL column type, overriding the type that would otherwise be inferred from
+     * TypeScript's reflected property type. Required whenever the design-time type cannot be reliably inferred,
+     * such as nullable/union-typed properties (which TypeScript reflects as `Object`) or properties whose value is
+     * a complex/nested structure that has no direct SQL column equivalent (e.g. `"simple-json"`).
+     */
+    type?: string | Function;
 }
 /**
  * The set of options to use when declaring a persistent class type via the `@Entity` decorator.
@@ -75,13 +82,13 @@ export interface IndexInfo {
     options: IndexOptions;
 }
 /**
- * Indicates that the decorated property will be persisted as a column/property in the datastore.
+ * Indicates that the decorated property will be persisted as a column/property in the datasource.
  *
  * @param options The options describing the column.
  */
 export declare function Column(options?: ColumnOptions): (target: any, propertyKey: string | symbol) => void;
 /**
- * Indicates that the decorated property is a primary key column in the datastore.
+ * Indicates that the decorated property is a primary key column in the datasource.
  *
  * @param options The options describing the column.
  */
@@ -114,7 +121,7 @@ export declare function Unique(name?: string): PropertyDecorator;
 export declare function Unique(fields: string[]): ClassDecorator;
 export declare function Unique(name: string, fields: string[]): ClassDecorator;
 /**
- * Indicates that the class describes an entity that is persisted to a datastore.
+ * Indicates that the class describes an entity that is persisted to a datasource.
  *
  * @param options The options to set.
  */

package/dist/types/decorators/RouteDecorators.d.ts

@@ -1,5 +1,5 @@
 import "reflect-metadata";
-import { AccessControlList } from "../security/AccessControlList.js";
+import { type AccessControlList } from "../security/AccessControlList.js";
 /**
  * Indicates a provided function or list of functions to execute *after* the decorated function and before the response
  * is sent to a client. Note that the function must call `next()` in order for this decorator to work.
@@ -8,10 +8,19 @@ import { AccessControlList } from "../security/AccessControlList.js";
  */
 export declare function After(func: Function | string | (Function | string)[]): (target: any, propertyKey: string, descriptor: PropertyDescriptor) => void;
 /**
- * Applies PassportJS authentication to the decorated route or method for the provided strategy or list of strategies
+ * Indicates that the decorated class contains route definitions. This prepends `/api` or `/api/v{version}` to
+ * all provided path(s). e.g. `@ApiRoute('my-api')` results in `/api/my-api`. `@ApiRoute('my-api',2) results in
+ * `/api/v2/my-api`.
+ *
+ * @param paths The base path(s) that all route definitions will use.
+ * @param version The optional version number to prepend the path with. Prefixes the provided version with `v` in the path.
+ */
+export declare function ApiRoute(paths: string | string[], version?: string | number): (target: Function) => void;
+/**
+ * Applies authentication to the decorated route or method for the provided strategy or list of strategies
  * should be attempted before processing the route.
  *
- * @param strategies The PassportJS strategies that will be applied when incoming requests are processed.
+ * @param strategies The strategies that will be applied when incoming requests are processed.
  * @param require Set to `true` to indicate that at least one of the specified authentication strategies must pass to
  * proceed, otherwise set to `false`. Default is `true`.
  */
@@ -127,13 +136,19 @@ export declare function Protect(acl?: PartialACL): (target: any, propertyKey?: s
  */
 export declare function Query(name?: string | undefined): (target: any, propertyKey: string, index: number) => void;
 /**
- * Injects the Express request object as the value of the decorated argument.
+ * Injects the HTTP request object as the value of the decorated argument.
  */
 export declare function Request(target: any, propertyKey: string, index: number): void;
 /**
- * Injects the Express response object as the value of the decorated argument.
+ * Injects the HTTP response object as the value of the decorated argument.
  */
 export declare function Response(target: any, propertyKey: string, index: number): void;
+/**
+ * Indicates that elevated user permissions is required to perform the action. Optionally, set a `lastStart` which is the number
+ * of seconds that the user has most recently confirmed elevation. A negative value indicates until the end of the elevated
+ * window. Default is `-1`.
+ */
+export declare function RequiresElevation(lastStart?: number): (target: any, propertyKey?: string, descriptor?: PropertyDescriptor) => void;
 /**
  * Indicates that the client must be an authenticated user with at least one of the specified role(s) to process the
  * request.
@@ -142,7 +157,22 @@ export declare function Response(target: any, propertyKey: string, index: number
  */
 export declare function RequiresRole(roles: string | string[]): (target: any, propertyKey: string, descriptor: PropertyDescriptor) => void;
 /**
- * Indicates that the decorated class contains Express route definitions.
+ * Indicates that the client's token must carry at least one of the specified OAuth-style scope(s) to process the
+ * request. This is a coarse, token-level pre-check performed before the per-resource `AccessControlList` check —
+ * it answers "can this token ever perform this class of action" rather than "can this user perform this action on
+ * this specific resource".
+ *
+ * @param scopes The scope(s) that the authenticated user's token must carry to make the request. The sentinel
+ * value `ACLAction.FULL` (`"*"`) also satisfies any required scope.
+ */
+export declare function RequiresScope(scopes: string | string[]): (target: any, propertyKey: string, descriptor: PropertyDescriptor) => void;
+/**
+ * Indicates that the client must be an authenticated user with at least one trusted role(s) to process the
+ * request.
+ */
+export declare function RequiresTrustedRole(): (target: any, propertyKey: string, descriptor: PropertyDescriptor) => void;
+/**
+ * Indicates that the decorated class contains route definitions.
  *
  * @param paths The base path(s) that all route definitions will use.
  */

package/dist/types/http/IWebSocketShim.d.ts

@@ -0,0 +1,11 @@
+import { EventEmitter } from "events";
+/**
+ * Framework-agnostic WebSocket shim surface. Both the uWS-backed and Bun-backed WebSocket shims
+ * implement this, so route/middleware code (e.g. `BaseAdminRoute`, `AuthMiddleware.authWebSocket`)
+ * never depends on the concrete runtime implementation.
+ */
+export interface IWebSocketShim extends EventEmitter {
+    readyState: number;
+    send(data: any, cb?: (err?: Error) => void): void;
+    close(code?: number, reason?: string): void;
+}

package/dist/types/http/MiddlewareChain.d.ts

@@ -0,0 +1,47 @@
+import type { HttpRequest, HttpResponse, RequestHandler } from "./types.js";
+/**
+ * Runs an ordered array of middleware handlers sequentially, Express-style.
+ * Supports both 3-param `(req, res, next)` handlers and 4-param `(err, req, res, next)`
+ * error handlers. On error, execution skips to the next error handler.
+ *
+ * Each handler is awaited via a Promise that resolves when next() is called, not when
+ * the handler's return value resolves. This correctly handles: (1) sync handlers that
+ * call next() synchronously, (2) async handlers that return next() or await before
+ * calling it, and (3) sync handlers that schedule next() via callbacks such as
+ * setTimeout or socket.once. The chain terminates early when a handler ends the
+ * response without calling next().
+ *
+ * Framework-agnostic — used by both the uWS-backed and Bun-backed routers.
+ */
+export declare function runChain(handlers: RequestHandler[], req: HttpRequest, res: HttpResponse): Promise<void>;
+/** Result returned by a pre-upgrade WebSocket auth function. */
+export type WsUpgradeAuthResult = {
+    user?: any;
+    authPayload?: any;
+    authToken?: string;
+    /** Set to `true` to reject the connection with HTTP 401 before the WebSocket handshake. */
+    reject?: boolean;
+};
+/**
+ * Optional pre-upgrade auth function for WebSocket routes. Called synchronously before the
+ * WebSocket handshake completes. Returning `{ reject: true }` sends an HTTP 401 and skips the
+ * upgrade entirely. Returning `{}` falls through to the post-upgrade message-based LOGIN flow.
+ * Returning `{ user, ... }` pre-authenticates the connection so clients that can send an
+ * Authorization header skip the LOGIN step.
+ */
+export type WsUpgradeAuth = (req: HttpRequest) => WsUpgradeAuthResult;
+/** Parses `:param` names out of a route pattern (e.g. `/users/:uid/:version` → `["uid","version"]`). */
+export declare function extractParamNames(routePath: string): string[];
+/**
+ * Builds a stub `HttpResponse` used for WebSocket routes: the framework middleware chain runs
+ * against a WebSocket "request" that has no real HTTP response to write to, so all writes are
+ * no-ops other than tracking `writableEnded`.
+ *
+ * @param onUnhandledError Invoked when `runChain()` reaches the end of the chain with an
+ * unhandled error and falls back to `res.status(...).json(...)` — the only way that fallback
+ * (or any other middleware) can signal an error for a WS connection, since there is no real
+ * response to write to. The router's `ws()` open handler uses this to close the socket the same
+ * way route handlers do themselves (a `1002` close carrying the error's short code), instead of
+ * silently doing nothing.
+ */
+export declare function makeWsStubResponse(onUnhandledError?: (status: number, payload: any) => void): HttpResponse;

package/dist/types/http/RuntimeDetect.d.ts

@@ -0,0 +1,2 @@
+/** Returns `true` when the current process is running under the Bun runtime. */
+export declare function isBunRuntime(): boolean;

package/dist/types/http/bun/BunAdapters.d.ts

@@ -0,0 +1,139 @@
+import type { HttpRequest, HttpResponse } from "../types.js";
+/**
+ * Minimal structural slice of Bun's `Server` used by `BunRequest`. Deliberately NOT typed as
+ * `Bun.Server` — a public constructor parameter typed against the ambient `Bun` namespace would
+ * leak into this package's emitted `.d.ts`, breaking `tsc` for downstream consumers who don't have
+ * `@types/bun` installed even though they never touch the Bun adapter (confirmed: without this,
+ * the emitted declaration file contains a bare unresolvable `Bun.Server<any>` reference). Bun's
+ * real `Server` structurally satisfies this interface, so `bun/BunRouter.ts` (which has its own
+ * `/// <reference types="bun" />`) can pass a real instance unchanged.
+ */
+export interface RequestIPSource {
+    requestIP(req: Request): {
+        address?: string;
+    } | null;
+}
+/**
+ * Adapts a Bun/Fetch API `Request` to the framework-agnostic `HttpRequest` interface.
+ *
+ * Unlike uWS's stack-allocated request, a Fetch API `Request` stays valid across `await`, so there
+ * is no urgency to capture everything synchronously in the constructor the way `UWSRequest` must —
+ * this is done here purely for parity/simplicity, not correctness.
+ */
+export declare class BunRequest implements HttpRequest {
+    readonly method: string;
+    readonly url: string;
+    readonly path: string;
+    readonly headers: Record<string, string>;
+    params: Record<string, string>;
+    readonly query: Record<string, string | string[]>;
+    body: any;
+    rawBody?: Buffer;
+    readonly cookies: Record<string, string>;
+    readonly signedCookies: Record<string, string>;
+    readonly socket: {
+        remoteAddress?: string;
+    };
+    user?: any;
+    authPayload?: any;
+    authToken?: string;
+    /** Allow arbitrary per-request properties (websocket, wsHandled, etc.) */
+    [key: string]: any;
+    constructor(req: Request, server: RequestIPSource);
+}
+/**
+ * Adapts a buffered/streamed set of response calls to the framework-agnostic `HttpResponse`
+ * interface, bridging them into a Fetch API `Response` that `Bun.serve()`'s `fetch()` handler
+ * resolves and returns.
+ *
+ * Two modes:
+ * - Buffered (default): `end()`/`json()`/`send()` finalize the body and resolve `responseReady`
+ * with a single complete `Response`.
+ * - Streaming: `flushHeaders()`/`write()` construct a `ReadableStream`-backed `Response` and
+ * resolve `responseReady` immediately (before the body is fully known) so the client starts
+ * receiving bytes right away; further `write()` calls enqueue chunks, `end()` closes the stream.
+ */
+export declare class BunResponse implements HttpResponse {
+    private _statusCode;
+    private _headers;
+    private _headersSent;
+    private _writableEnded;
+    private _streaming;
+    private _aborted;
+    private _abortHandlers;
+    private _finished;
+    private _finishHandlers;
+    /** Set to true for HEAD requests — body bytes must not be sent. */
+    isHead: boolean;
+    /** Intermediate result passed between middleware. */
+    result?: any;
+    /** Allow arbitrary per-response properties. */
+    [key: string]: any;
+    private _body;
+    private _controller;
+    private _stream;
+    private _resolveReady;
+    /** Resolves once headers are known — either the full buffered Response, or a streaming one. */
+    readonly responseReady: Promise<Response>;
+    constructor(rawRequest: Request);
+    get statusCode(): number;
+    get headersSent(): boolean;
+    get writableEnded(): boolean;
+    status(code: number): this;
+    setHeader(key: string, value: string | number | string[]): this;
+    appendHeader(key: string, value: string | number): this;
+    getHeader(key: string): string | string[] | undefined;
+    json(data: any): void;
+    send(data?: any): void;
+    end(data?: any): void;
+    /**
+     * Flushes status and headers to the wire immediately without ending the response, via a
+     * `ReadableStream`, and resolves `responseReady` right away so the client starts receiving
+     * bytes before the rest of the middleware chain finishes. Required before streaming data
+     * (e.g. SSE). Safe to call multiple times — only acts on the first call.
+     */
+    flushHeaders(): void;
+    /**
+     * Writes a chunk to the response without ending it (streaming / SSE).
+     * Flushes headers on the first call if they haven't been sent yet.
+     */
+    write(data: string | Buffer): void;
+    /**
+     * Registers a callback to run when the client aborts the connection — either before any
+     * response was sent (via the request's `AbortSignal`) or mid-stream (via the `ReadableStream`'s
+     * `cancel` callback).
+     */
+    onAbort(callback: () => void): void;
+    /**
+     * Registers a callback fired exactly once when the response lifecycle ends — a normal end(),
+     * a client abort, or a streaming abort. Fires immediately if the response has already finished.
+     * Handlers run fire-and-forget (via a resolved microtask) so slow/async work (e.g. a Redis
+     * write) never delays or blocks the actual response flush.
+     */
+    onFinish(handler: () => void | Promise<void>): void;
+    private _fireFinish;
+    /**
+     * Errors the underlying stream if it's still open. Used when a middleware chain throws after
+     * streaming has already started and the `Response` has already been handed back to the client.
+     */
+    abortStream(err: any): void;
+    private _enqueue;
+    private _buildHeaders;
+    private _buildResponse;
+    private _buildStreamingResponse;
+}
+export type ReadBunBodyResult = {
+    ok: true;
+} | {
+    ok: false;
+    response: Response;
+};
+/**
+ * Reads the full request body from a Bun `Request` into a Buffer, mirroring `readBody()`'s uWS
+ * behavior exactly: body parsing (JSON / URL-encoded) is applied based on content-type and the
+ * result is cached on `req.body` / `req.rawBody`. Rejects with a 413 JSON `Response` if the body
+ * exceeds `maxBodySize` — checked both against the declared `Content-Length` up front (fast path)
+ * and against the actual accumulated byte count as chunks arrive, so chunked/unknown-length bodies
+ * that lie about or omit `Content-Length` are still caught, matching uWS's guarantee.
+ */
+export declare function readBunBody(req: BunRequest, rawRequest: Request, maxBodySize?: number): Promise<ReadBunBodyResult>;

package/dist/types/http/bun/BunRouter.d.ts

@@ -0,0 +1,79 @@
+import type { IHttpRouter, RequestHandler } from "../types.js";
+import { type WsUpgradeAuth } from "../MiddlewareChain.js";
+/**
+ * Bun-native HTTP/WebSocket router built on `Bun.serve()`. Exposes the same public surface as the
+ * uWS-backed `HttpRouter` (`use/get/post/put/delete/patch/head/options/ws/listen/close/isListening/
+ * listenPort`) so `RouteUtils.registerRoute()` and `Server.ts` work against either implementation
+ * unchanged.
+ *
+ * Unlike uWS, `Bun.serve()` has no built-in dynamic router, so this class maintains its own route
+ * table matched inside a single `fetch()` callback, with static-segment > `:param` > `/*` wildcard
+ * precedence — replicating uWS's specificity-based matching.
+ */
+export declare class BunRouter implements IHttpRouter {
+    private readonly routesByMethod;
+    private readonly wsRoutes;
+    private readonly globalMiddleware;
+    private preRouteCount;
+    private readonly rootWildcardVerbs;
+    private readonly maxBodySize;
+    private readonly sslConfig;
+    private _bunServer;
+    /** The port the server is currently listening on (set after a successful `listen()` call). */
+    listenPort: number;
+    constructor(maxBodySize?: number, sslConfig?: any);
+    /** Returns `true` if the server is currently listening. */
+    get isListening(): boolean;
+    /** Register global middleware that runs before every route handler. */
+    use(...handlers: RequestHandler[]): this;
+    /**
+     * Freezes the pre-route middleware count the first time a route is registered.
+     * All global middleware registered BEFORE this call is "pre-route" middleware;
+     * everything added after is "post-route" (error handlers, metrics, etc.).
+     */
+    private capturePreRouteCount;
+    private pushRoute;
+    private register;
+    get(routePath: string, ...handlers: RequestHandler[]): this;
+    post(routePath: string, ...handlers: RequestHandler[]): this;
+    put(routePath: string, ...handlers: RequestHandler[]): this;
+    delete(routePath: string, ...handlers: RequestHandler[]): this;
+    patch(routePath: string, ...handlers: RequestHandler[]): this;
+    head(routePath: string, ...handlers: RequestHandler[]): this;
+    options(routePath: string, ...handlers: RequestHandler[]): this;
+    /**
+     * Registers a WebSocket route. Handlers follow the same `(req, res, next)` pattern as HTTP
+     * routes; they receive `req.websocket` containing the Bun WebSocket shim.
+     *
+     * `upgradeAuth` is an optional pre-upgrade auth function, run synchronously inside `fetch()`
+     * before the handshake. If it returns `{ reject: true }`, an HTTP 401 is sent and the upgrade
+     * is aborted. If it returns `{ user, ... }`, those credentials are attached to the request so
+     * downstream middleware sees an authenticated user. If it returns `{}`, auth falls through to
+     * the post-upgrade message-based LOGIN flow.
+     */
+    ws(routePath: string, handlers: RequestHandler[], _wsOptions?: any, upgradeAuth?: WsUpgradeAuth): this;
+    /**
+     * Matches a request against the route table. Exact-length static/param routes always outrank
+     * wildcard-suffixed routes, matching uWS's `best ?? wildcard` fallback behavior. Among wildcard
+     * candidates, the one with the longest (most specific) matching prefix wins — e.g. `/static/*`
+     * beats a bare `/*` for requests under `/static`.
+     *
+     * `reqHasTrailingSlash` is required to replicate uWS's own wildcard boundary rule, verified
+     * empirically against real uWS: a `<prefix>/*` route matches `<prefix>/` and anything nested
+     * under it, but NOT the bare `<prefix>` with no trailing slash — a distinction that's lost if
+     * matching were done on segment arrays alone, since `/static` and `/static/` produce the same
+     * segment list once empty segments are filtered out.
+     */
+    private matchRoute;
+    private matchWsRoute;
+    private readonly fetchHandler;
+    private readonly websocketConfig;
+    /**
+     * Starts listening on the given host and port.
+     * Resolves when the server is ready; rejects if the port cannot be bound.
+     */
+    listen(host: string, port: number): Promise<void>;
+    /** Stops the server, closing the listen socket. */
+    close(): void;
+    [key: string]: any;
+}

package/dist/types/http/bun/BunWebSocket.d.ts

@@ -0,0 +1,35 @@
+import { EventEmitter } from "events";
+import type { IWebSocketShim } from "../IWebSocketShim.js";
+/**
+ * Minimal structural slice of Bun's `ServerWebSocket` used by this shim. Deliberately NOT typed as
+ * `Bun.ServerWebSocket` — a public constructor parameter typed against the ambient `Bun` namespace
+ * would leak into this package's emitted `.d.ts`, breaking `tsc` for downstream consumers who don't
+ * have `@types/bun` installed even though they never touch the Bun adapter. Bun's real
+ * `ServerWebSocket` structurally satisfies this interface, so `bun/BunRouter.ts` (which has its own
+ * `/// <reference types="bun" />`) can pass a real instance unchanged.
+ */
+export interface WebSocketSendTarget {
+    send(data: string | Uint8Array): number;
+    close(code?: number, reason?: string): void;
+}
+/**
+ * Wraps a Bun `ServerWebSocket` handle and exposes an EventEmitter-based API compatible with
+ * `IWebSocketShim`, mirroring `UWSWebSocketShim`'s behavior for the uWS-backed router so that
+ * route handlers (e.g. `BaseAdminRoute`) and `AuthMiddleware.authWebSocket()` work unchanged
+ * regardless of which runtime is active.
+ */
+export declare class BunWebSocketShim extends EventEmitter implements IWebSocketShim {
+    private readonly _ws;
+    readyState: number;
+    constructor(ws: WebSocketSendTarget);
+    /**
+     * Sends data over the WebSocket connection.
+     * @param data The data to send.
+     * @param cb Optional callback invoked on completion or error.
+     */
+    send(data: any, cb?: (err?: Error) => void): void;
+    /**
+     * Closes the WebSocket connection with an optional code and reason.
+     */
+    close(code?: number, reason?: string): void;
+}

package/dist/types/http/index.d.ts

@@ -1,6 +1,16 @@
-export type { HttpRequest, HttpResponse, NextFunction, RequestHandler, ErrorHandler } from "./types.js";
-export { UWSRequest, UWSResponse, readBody } from "./Adapters.js";
-export { HttpRouter, runChain } from "./Router.js";
-export type { WsUpgradeAuth, WsUpgradeAuthResult } from "./Router.js";
-export type { RequestWS } from "./WebSocket.js";
-export { UWSWebSocketShim, createWebSocketStream } from "./WebSocket.js";
+export type { ErrorHandler, HttpRequest, HttpResponse, IHttpRouter, NextFunction, RequestHandler } from "./types.js";
+export { isBunRuntime } from "./RuntimeDetect.js";
+export type { IWebSocketShim } from "./IWebSocketShim.js";
+export { extractParamNames, makeWsStubResponse, runChain } from "./MiddlewareChain.js";
+export type { WsUpgradeAuth, WsUpgradeAuthResult } from "./MiddlewareChain.js";
+export type { SessionStore } from "./session/SessionStore.js";
+export { RedisSessionStore } from "./session/RedisSessionStore.js";
+export { SessionManager } from "./session/SessionManager.js";
+export { createSessionMiddleware } from "./session/sessionMiddleware.js";
+export { UWSRequest, UWSResponse, readBody } from "./uWS/Adapters.js";
+export type { HttpRouter } from "./uWS/Router.js";
+export type { RequestWS } from "./uWS/WebSocket.js";
+export { UWSWebSocketShim, createWebSocketStream } from "./uWS/WebSocket.js";
+export { BunRequest, BunResponse, readBunBody } from "./bun/BunAdapters.js";
+export { BunRouter } from "./bun/BunRouter.js";
+export { BunWebSocketShim } from "./bun/BunWebSocket.js";

package/dist/types/http/session/RedisSessionStore.d.ts

@@ -0,0 +1,15 @@
+import type { RedisClientType } from "redis";
+import type { SessionStore } from "./SessionStore.js";
+/**
+ * Redis-backed session store for multi-instance/production deployments, where an in-process
+ * `MemorySessionStore` would not be shared across horizontally-scaled instances.
+ */
+export declare class RedisSessionStore implements SessionStore {
+    private client;
+    /** The default record TTL (in seconds). */
+    defaultTTL: number;
+    constructor(client: RedisClientType);
+    load(sessionId: string): Promise<Record<string, any> | undefined>;
+    save(sessionId: string, data: Record<string, any>, ttlSeconds?: number): Promise<void>;
+    delete(sessionId: string): Promise<void>;
+}

package/dist/types/http/session/SessionManager.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Owns session-ID generation/signing and store selection (in-memory by default, Redis-backed when
+ * a `cache` datasource connection is available and `session.store` isn't forced to `"memory"`).
+ * Registered by `Server.ts` only when a `session` config block is present.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export declare class SessionManager {
+    private _objectFactory?;
+    private options;
+    private globalCookieSecret?;
+    /** The redis client used as a session store when configured. Special-cased to not throw if absent. */
+    private cacheClient?;
+    private logger?;
+    private store;
+    private secret;
+    cookieName: string;
+    ttlSeconds: number;
+    cookieSecure: boolean;
+    cookieSameSite: string;
+    cookiePath: string;
+    private init;
+    /** Generates a new, cryptographically random session ID. */
+    generateId(): string;
+    /** Signs a session ID for safe storage in a cookie value. */
+    signId(id: string): string;
+    /**
+     * Verifies a signed session ID cookie value, returning the original session ID if the
+     * signature is valid, or `undefined` if it's missing, malformed, or tampered with.
+     */
+    verifyId(signed: string): string | undefined;
+    load(sessionId: string): Promise<Record<string, any> | undefined>;
+    save(sessionId: string, data: Record<string, any>): Promise<void>;
+    delete(sessionId: string): Promise<void>;
+}

package/dist/types/http/session/SessionStore.d.ts

@@ -0,0 +1,12 @@
+/**
+ * A pluggable backing store for session data, keyed by session ID. Implementations must be safe
+ * to call from concurrent requests.
+ */
+export interface SessionStore {
+    /** Loads the session data for the given session ID, or `undefined` if none exists (or has expired). */
+    load(sessionId: string): Promise<Record<string, any> | undefined>;
+    /** Persists the given session data, resetting its expiration to `ttlSeconds` from now. */
+    save(sessionId: string, data: Record<string, any>, ttlSeconds?: number): Promise<void>;
+    /** Removes the session data for the given session ID, if any. */
+    delete(sessionId: string): Promise<void>;
+}

package/dist/types/http/session/sessionMiddleware.d.ts

@@ -0,0 +1,10 @@
+import type { RequestHandler } from "../types.js";
+import type { SessionManager } from "./SessionManager.js";
+/**
+ * Builds a global, framework-agnostic session middleware backed by the given `SessionManager`.
+ * Lazily loads-or-creates `req.session` and persists any mutations back to the store once the
+ * response finishes. Cheap for requests that never touch sessions: no store round-trip unless a
+ * valid session cookie was actually sent, and no `Set-Cookie`/store write for sessions that end up
+ * empty.
+ */
+export declare function createSessionMiddleware(mgr: SessionManager): RequestHandler;