@riddl/core 0.2.7 → 0.9.0

package/dist/adapters.d.ts

@@ -1,6 +1,6 @@
-import type { Handler } from "./types";
-import type { IncomingMessage, ServerResponse } from "node:http";
-import express, { type Router, Application } from "express";
+import type { Handler } from './types';
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import express, { type Router, Application } from 'express';
 export declare const mountApi: (app: Application, prefix: string, apiHandler: Handler) => express.Application;
 export declare const setResponse: (res: ServerResponse, response: Response) => Promise<void>;
 export declare const rawAdapter: (apiHandler: Handler) => (req: IncomingMessage, res: ServerResponse) => Promise<void>;

package/dist/adapters.js

@@ -1,7 +1,7 @@
-import express from "express";
-import { toFetchRequest } from "./utils.js";
-import * as set_cookie_parser from "set-cookie-parser";
-import { logError } from "./log.js";
+import express from 'express';
+import { toFetchRequest } from './utils.js';
+import * as set_cookie_parser from 'set-cookie-parser';
+import { logError } from './log.js';
 export const mountApi = (app, prefix, apiHandler) => app.use(prefix, expressAdapter(apiHandler));
 export const setResponse = async (res, response) => {
     for (const [key, value] of response.headers) {
@@ -11,7 +11,7 @@ export const setResponse = async (res, response) => {
                 : value);
         }
         catch (error) {
-            logError("failed to set response header", error);
+            logError('failed to set response header', error);
             res.getHeaderNames().forEach((name) => res.removeHeader(name));
             res.writeHead(500).end(String(error));
             return;
@@ -62,11 +62,11 @@ export const setResponse = async (res, response) => {
         }
     }
 };
-export const rawAdapter = (apiHandler) => (async (req, res) => {
+export const rawAdapter = (apiHandler) => async (req, res) => {
     const response = await apiHandler(toFetchRequest(req));
     // Delegate entirely to setResponse. Do not preset Content-Length: 0 or
     // Content-Type: application/json — that breaks SSE and other streaming
     // bodies whose Response omits content-length (chunked transfer).
     await setResponse(res, response);
-});
+};
 export const expressAdapter = (apiHandler) => express.Router().use(rawAdapter(apiHandler));

package/dist/api.d.ts

@@ -1,2 +1,2 @@
 import type { APIOptions, API } from './types';
-export declare const api: ({ routeModuleMap, config, base, cors, registry, onInternalError, }: APIOptions) => Promise<API>;
+export declare const api: ({ routeModuleMap, config, base, cors, registry, onInternalError, matchers, maxBodySize, }: APIOptions) => Promise<API>;

package/dist/api.js

@@ -1,6 +1,6 @@
 import { OpenAPIRegistry } from '@asteasolutions/zod-to-openapi';
-import { json, recursiveAwait } from './utils.js';
-import { CORS_DEFAULT, METHOD } from './constants.js';
+import { json, recursiveAwait, validateRouteId } from './utils.js';
+import { CORS_DEFAULT, METHOD, MAX_BODY_SIZE_DEFAULT } from './constants.js';
 import { log, logError } from './log.js';
 import { parseBody, parseOutput, parseParam, parseQuery } from './validation.js';
 import { cleanupTempFiles } from './multipart.js';
@@ -8,7 +8,7 @@ import { parseRouteId } from './parser.js';
 import { buildRouter } from './routing.js';
 import { openapiHandler, registerRoutes } from './openapi.js';
 import { error } from './errors.js';
-export const api = async ({ routeModuleMap, config, base = '', cors = true, registry = new OpenAPIRegistry(), onInternalError, }) => {
+export const api = async ({ routeModuleMap, config, base = '', cors = true, registry = new OpenAPIRegistry(), onInternalError, matchers = {}, maxBodySize = MAX_BODY_SIZE_DEFAULT, }) => {
     const reportInternalError = (error) => {
         logError('internal error', error);
         onInternalError === null || onInternalError === void 0 ? void 0 : onInternalError(error);
@@ -22,8 +22,18 @@ export const api = async ({ routeModuleMap, config, base = '', cors = true, regi
         const id = parts.slice(0, -1).join('/');
         if (METHOD.test(last)) {
             const method = last.toUpperCase();
-            const endpoint = (await module())
-                .apiEndpoint;
+            let endpointModule;
+            try {
+                endpointModule = (await module());
+            }
+            catch (e) {
+                throw new Error(`Failed to load route module "${path}": ${e instanceof Error ? e.message : String(e)}`);
+            }
+            const endpoint = endpointModule.apiEndpoint;
+            if (!endpoint) {
+                throw new Error(`Route module "${path}" does not export "apiEndpoint"`);
+            }
+            validateRouteId(id);
             acc.routes[id] = {
                 matcher: parseRouteId(id),
                 handlers: {
@@ -33,7 +43,12 @@ export const api = async ({ routeModuleMap, config, base = '', cors = true, regi
             };
         }
         if (last === 'middleware') {
-            acc.middlewares[id] = (await module());
+            try {
+                acc.middlewares[id] = (await module());
+            }
+            catch (e) {
+                throw new Error(`Failed to load middleware module "${path}": ${e instanceof Error ? e.message : String(e)}`);
+            }
         }
         return acc;
     }, Promise.resolve({
@@ -45,14 +60,14 @@ export const api = async ({ routeModuleMap, config, base = '', cors = true, regi
     log('config: %O', config);
     log('base: %s', base);
     registerRoutes({ routes, registry, base });
-    const router = buildRouter(routes, middlewares);
+    const router = buildRouter(routes, middlewares, matchers);
     const effectiveCorsSettings = cors
         ? typeof cors === 'object'
             ? cors
             : CORS_DEFAULT
         : undefined;
     const handler = async (request) => {
-        var _a, _b, _c;
+        var _a, _b, _c, _d, _e, _f;
         // Temp files produced by streamed multipart uploads; removed once the
         // handler has finished reading them (it copies bytes to permanent
         // storage before returning).
@@ -75,7 +90,13 @@ export const api = async ({ routeModuleMap, config, base = '', cors = true, regi
                     headers: (_b = effectiveCorsSettings) !== null && _b !== void 0 ? _b : {},
                 });
             }
-            const endpoint = routeWithMiddlewares.handlers[request.method.toUpperCase()];
+            const isHead = request.method.toUpperCase() === 'HEAD';
+            // HEAD requests fall back to the GET handler
+            const reqMethod = (isHead ? 'GET' : request.method.toUpperCase());
+            let endpoint = routeWithMiddlewares.handlers[reqMethod];
+            if (!(endpoint === null || endpoint === void 0 ? void 0 : endpoint.handle) && isHead) {
+                endpoint = routeWithMiddlewares.handlers.GET;
+            }
             if (!(endpoint === null || endpoint === void 0 ? void 0 : endpoint.handle)) {
                 throw error(405, 'Method not allowed');
             }
@@ -83,9 +104,9 @@ export const api = async ({ routeModuleMap, config, base = '', cors = true, regi
             for (const mw of routeWithMiddlewares.middlewares) {
                 ctxEvent = await mw.pre(ctxEvent);
             }
-            const param = await parseParam(params !== null && params !== void 0 ? params : {}, endpoint);
-            const query = await parseQuery(request, endpoint);
-            const body = await parseBody(request, endpoint, tempFiles);
+            const param = parseParam(params !== null && params !== void 0 ? params : {}, endpoint);
+            const query = parseQuery(request, endpoint);
+            const body = await parseBody(request, endpoint, tempFiles, maxBodySize);
             log('handler: %O', endpoint.handle);
             const output = await endpoint.handle({
                 body,
@@ -97,17 +118,17 @@ export const api = async ({ routeModuleMap, config, base = '', cors = true, regi
                 ctxEvent = await mw.post(ctxEvent);
             }
             log('output: %O', output);
+            let res;
             if (output instanceof Response) {
                 if (effectiveCorsSettings) {
                     for (const [key, value] of Object.entries(effectiveCorsSettings)) {
                         output.headers.set(key, value);
                     }
                 }
-                return output;
+                res = output;
             }
-            // ReadableStream for Server-Sent Events
-            if (output instanceof ReadableStream) {
-                const res = new Response(output, {
+            else if (output instanceof ReadableStream) {
+                res = new Response(output, {
                     headers: {
                         'Content-Type': 'text/event-stream',
                         'Cache-Control': 'no-cache',
@@ -115,38 +136,66 @@ export const api = async ({ routeModuleMap, config, base = '', cors = true, regi
                         ...(effectiveCorsSettings !== null && effectiveCorsSettings !== void 0 ? effectiveCorsSettings : {}),
                     },
                 });
-                return res;
             }
-            if (output instanceof ArrayBuffer) {
-                const res = new Response(output, {
+            else if (output instanceof ArrayBuffer) {
+                res = new Response(output, {
                     headers: {
                         'Content-Type': 'application/octet-stream',
                         ...(effectiveCorsSettings !== null && effectiveCorsSettings !== void 0 ? effectiveCorsSettings : {}),
                     },
                 });
-                return res;
             }
             else {
-                const out = await recursiveAwait(await parseOutput(output, endpoint));
-                const res = json(out, {
+                // Skip recursiveAwait for primitives — it just returns them directly
+                // anyway, but avoids the unnecessary Promise wrapping.
+                const resolved = typeof output === 'object' &&
+                    output !== null &&
+                    !(output instanceof Response) &&
+                    !(output instanceof ReadableStream) &&
+                    !(output instanceof ArrayBuffer)
+                    ? await recursiveAwait(output)
+                    : output;
+                const out = await parseOutput(resolved, endpoint);
+                res = json(out, {
                     headers: (_c = effectiveCorsSettings) !== null && _c !== void 0 ? _c : {},
                 });
-                return res;
             }
+            // For HEAD requests, strip the response body while preserving
+            // status code and headers (including Content-Length from the original).
+            if (isHead) {
+                return new Response(null, {
+                    status: res.status,
+                    headers: res.headers,
+                });
+            }
+            return res;
         }
         catch (e) {
             if (e && typeof e === 'object' && '__HTTP_ERROR__' in e) {
                 const httpError = e;
-                if (typeof httpError.status === 'number' && httpError.status >= 500) {
+                const status = typeof httpError.status === 'number' ? httpError.status : 500;
+                if (status >= 500) {
                     reportInternalError(e);
+                    // For server errors, return an opaque response — don't expose
+                    // internal error details, keys, or the __HTTP_ERROR__ flag.
+                    return json({ message: 'Internal server error', status: 500 }, {
+                        status: 500,
+                        headers: (_d = effectiveCorsSettings) !== null && _d !== void 0 ? _d : {},
+                    });
                 }
-                return json(e, {
-                    status: httpError.status,
+                // For client errors (4xx), the error key and HTTP status code are
+                // intentional — they're part of the API contract. Strip only the
+                // internal __HTTP_ERROR__ flag so it doesn't leak to clients.
+                const { __HTTP_ERROR__, ...publicError } = e;
+                return json(publicError, {
+                    status,
+                    headers: (_e = effectiveCorsSettings) !== null && _e !== void 0 ? _e : {},
                 });
             }
             reportInternalError(e);
             return json({ message: 'Internal server error', status: 500 }, {
                 status: 500,
+                headers: (_f = effectiveCorsSettings) !== null && _f !== void 0 ? _f : {},
             });
         }
         finally {

package/dist/constants.d.ts

@@ -1,6 +1,7 @@
 export declare const METHOD: RegExp;
+export declare const MAX_BODY_SIZE_DEFAULT: number;
 export declare const CORS_DEFAULT: {
-    readonly "Access-Control-Allow-Origin": "*";
-    readonly "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, PATCH, OPTIONS";
-    readonly "Access-Control-Allow-Headers": "Content-Type, Authorization";
+    readonly 'Access-Control-Allow-Origin': "*";
+    readonly 'Access-Control-Allow-Methods': "GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD";
+    readonly 'Access-Control-Allow-Headers': "Content-Type, Authorization";
 };

package/dist/constants.js

@@ -1,6 +1,7 @@
-export const METHOD = /^(GET|POST|PUT|DELETE|PATCH|OPTIONS)$/i;
+export const METHOD = /^(GET|POST|PUT|DELETE|PATCH|OPTIONS|HEAD)$/i;
+export const MAX_BODY_SIZE_DEFAULT = 1024 * 1024 * 1024; // 1 GB
 export const CORS_DEFAULT = {
-    "Access-Control-Allow-Origin": "*",
-    "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, PATCH, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type, Authorization",
+    'Access-Control-Allow-Origin': '*',
+    'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD',
+    'Access-Control-Allow-Headers': 'Content-Type, Authorization',
 };

package/dist/endpoint.d.ts

@@ -1,4 +1,4 @@
-import type { EndpointHandler, EndpointSpecification, APIEndpoint, ParamType, QueryType, InputType, OutputType, StreamType, ErrorType } from "./types";
+import type { EndpointHandler, EndpointSpecification, APIEndpoint, ParamType, QueryType, InputType, OutputType, StreamType, ErrorType } from './types';
 export declare const endpoint: <P extends ParamType, Q extends QueryType, I extends InputType, O extends OutputType, S extends StreamType, E extends ErrorType>(data?: EndpointSpecification<P, Q, I, O, S, E>) => {
     handler: (handle: EndpointHandler<P, Q, I, O>) => APIEndpoint<P, Q, I, O, S, E>;
 };

package/dist/index.d.ts

@@ -1,6 +1,10 @@
-export * from "./api";
-export * from "./openapi";
-export * from "./zod";
-export * from "./adapters";
-export * from "./types";
-export * from "./endpoint";
+export * from './api';
+export * from './openapi';
+export * from './zod';
+export * from './adapters';
+export * from './types';
+export * from './endpoint';
+export * from './errors';
+export * from './utils';
+export * from './parser';
+export * from './constants';

package/dist/index.js

@@ -1,6 +1,10 @@
-export * from "./api.js";
-export * from "./openapi.js";
-export * from "./zod.js";
-export * from "./adapters.js";
-export * from "./types.js";
-export * from "./endpoint.js";
+export * from './api.js';
+export * from './openapi.js';
+export * from './zod.js';
+export * from './adapters.js';
+export * from './types.js';
+export * from './endpoint.js';
+export * from './errors.js';
+export * from './utils.js';
+export * from './parser.js';
+export * from './constants.js';

package/dist/log.d.ts

@@ -1,4 +1,4 @@
-import debug from "debug";
+import debug from 'debug';
 export declare const log: debug.Debugger;
 /** Always-on stderr log for internal errors (independent of DEBUG). */
 export declare const logError: (message: string, error: unknown) => void;

package/dist/log.js

@@ -1,5 +1,5 @@
-import debug from "debug";
-export const log = debug("riddl");
+import debug from 'debug';
+export const log = debug('riddl');
 /** Always-on stderr log for internal errors (independent of DEBUG). */
 export const logError = (message, error) => {
     console.error(`riddl: ${message}`, error);

package/dist/multipart.d.ts

@@ -18,8 +18,13 @@ export type FormBody = Record<string, FormValue | FormValue[]>;
  * Returns the parsed body together with the temp paths the caller must delete
  * once the handler has finished reading the files — see
  * {@link cleanupTempFiles}.
+ *
+ * @param req       The incoming Request.
+ * @param maxBodySize Maximum total bytes to accept (content-length is checked
+ *                    in the caller; individual file sizes are also bounded by
+ *                    busboy's `fileSize` limit as a backstop).
  */
-export declare const parseMultipart: (req: Request) => Promise<{
+export declare const parseMultipart: (req: Request, maxBodySize?: number) => Promise<{
     body: FormBody;
     tempFiles: string[];
 }>;

package/dist/multipart.js

@@ -1,11 +1,13 @@
-import busboy from "busboy";
-import { randomBytes } from "node:crypto";
-import { createWriteStream, openAsBlob } from "node:fs";
-import { unlink } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { Readable } from "node:stream";
-import { pipeline } from "node:stream/promises";
+import busboy from 'busboy';
+import { randomBytes } from 'node:crypto';
+import { createWriteStream, openAsBlob } from 'node:fs';
+import { unlink } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import { MAX_BODY_SIZE_DEFAULT } from './constants.js';
+import { error } from './errors.js';
 const addEntry = (body, name, value) => {
     const existing = body[name];
     if (existing === undefined) {
@@ -27,32 +29,54 @@ const addEntry = (body, name, value) => {
  * Returns the parsed body together with the temp paths the caller must delete
  * once the handler has finished reading the files — see
  * {@link cleanupTempFiles}.
+ *
+ * @param req       The incoming Request.
+ * @param maxBodySize Maximum total bytes to accept (content-length is checked
+ *                    in the caller; individual file sizes are also bounded by
+ *                    busboy's `fileSize` limit as a backstop).
  */
-export const parseMultipart = async (req) => {
-    const contentType = req.headers.get("content-type");
+export const parseMultipart = async (req, maxBodySize = MAX_BODY_SIZE_DEFAULT) => {
+    const contentType = req.headers.get('content-type');
     if (!req.body || !contentType) {
         return { body: {}, tempFiles: [] };
     }
+    // Check Content-Length first to reject oversized requests early
+    const contentLength = req.headers.get('content-length');
+    if (contentLength) {
+        const size = parseInt(contentLength, 10);
+        if (!Number.isNaN(size) && size > maxBodySize) {
+            throw error(413, 'Request body too large');
+        }
+    }
     const tempFiles = [];
     const body = {};
     await new Promise((resolve, reject) => {
-        const bb = busboy({ headers: { "content-type": contentType } });
+        const bb = busboy({
+            headers: { 'content-type': contentType },
+            limits: { fileSize: maxBodySize },
+        });
         // File parts finish writing asynchronously; `close` can fire before the
         // last temp file is fully flushed, so we wait on these before resolving.
         const pending = [];
-        bb.on("field", (name, value) => addEntry(body, name, value));
-        bb.on("file", (name, stream, info) => {
-            const tempPath = join(tmpdir(), `riddl-upload-${randomBytes(16).toString("hex")}`);
+        bb.on('field', (name, value) => addEntry(body, name, value));
+        bb.on('file', (name, stream, info) => {
+            const tempPath = join(tmpdir(), `riddl-upload-${randomBytes(16).toString('hex')}`);
             tempFiles.push(tempPath);
-            pending.push(pipeline(stream, createWriteStream(tempPath)).then(async () => {
+            pending.push(pipeline(stream, createWriteStream(tempPath))
+                .then(async () => {
                 const blob = await openAsBlob(tempPath, {
                     type: info.mimeType,
                 });
                 addEntry(body, name, Object.assign(blob, { name: info.filename }));
+            })
+                .catch((err) => {
+                // Abort the whole parse on oversized file — clean up
+                // any temp files already created.
+                Promise.all(tempFiles.map((p) => unlink(p).catch(() => undefined))).finally(() => reject(err));
             }));
         });
-        bb.on("error", reject);
-        bb.on("close", () => {
+        bb.on('error', reject);
+        bb.on('close', () => {
             Promise.all(pending)
                 .then(() => resolve())
                 .catch(reject);

package/dist/openapi.d.ts

@@ -1,4 +1,4 @@
-import { OpenAPIRegistry } from "@asteasolutions/zod-to-openapi";
-import type { OpenAPIOptions, OpenAPIObjectConfig } from "./types";
+import { OpenAPIRegistry } from '@asteasolutions/zod-to-openapi';
+import type { OpenAPIOptions, OpenAPIObjectConfig } from './types';
 export declare const registerRoutes: ({ routes, registry, base, }: OpenAPIOptions) => void;
 export declare const openapiHandler: (registry: OpenAPIRegistry, config: OpenAPIObjectConfig) => (request: Request) => Promise<Response>;

package/dist/openapi.js

@@ -1,12 +1,10 @@
-import { OpenApiGeneratorV3, } from "@asteasolutions/zod-to-openapi";
-import { z } from "./zod.js";
-const openApiPath = (id, base) => id.split("/")
-    .slice(0, -1)
-    .join("/")
+import { OpenApiGeneratorV3, } from '@asteasolutions/zod-to-openapi';
+import { z } from './zod.js';
+const openApiPath = (id, base) => id
     .replace(/^\./, base)
-    .replace(/\[(\.{3})?(.+?)\]/g, "{$2}")
-    .replace(/\(.+\)\//g, "");
-export const registerRoutes = ({ routes, registry, base = "", }) => {
+    .replace(/\[(\.{3})?(.+?)\]/g, '{$2}')
+    .replace(/\(.+\)\//g, '');
+export const registerRoutes = ({ routes, registry, base = '', }) => {
     for (const [id, { handlers }] of Object.entries(routes)) {
         Object.entries(handlers).forEach(([methodString, module]) => {
             var _a;
@@ -16,6 +14,31 @@ export const registerRoutes = ({ routes, registry, base = "", }) => {
             const body = module.Input || undefined;
             const path = openApiPath(id, base);
             const method = methodString.toLowerCase();
+            // Merge Output and Stream into a single 200 response with both
+            // content types rather than overwriting one with the other.
+            const hasOutput = !!module.Output;
+            const hasStream = !!module.Stream;
+            const response200 = hasOutput || hasStream
+                ? {
+                    description: '',
+                    content: {
+                        ...(hasOutput
+                            ? {
+                                'application/json': {
+                                    schema: module.Output,
+                                },
+                            }
+                            : undefined),
+                        ...(hasStream
+                            ? {
+                                'text/event-stream': {
+                                    schema: module.Stream,
+                                },
+                            }
+                            : undefined),
+                    },
+                }
+                : undefined;
             registry.registerPath(modifier({
                 method,
                 path,
@@ -24,15 +47,15 @@ export const registerRoutes = ({ routes, registry, base = "", }) => {
                     query,
                     body: body
                         ? {
-                            description: "",
+                            description: '',
                             content: {
-                                "application/json": {
+                                'application/json': {
                                     schema: body,
                                 },
-                                "application/x-www-form-urlencoded": {
+                                'application/x-www-form-urlencoded': {
                                     schema: body,
                                 },
-                                "multipart/form-data": {
+                                'multipart/form-data': {
                                     schema: body,
                                 },
                             },
@@ -40,36 +63,13 @@ export const registerRoutes = ({ routes, registry, base = "", }) => {
                         : undefined,
                 },
                 responses: {
-                    ...(module.Output
-                        ? {
-                            "200": {
-                                description: "",
-                                content: {
-                                    "application/json": {
-                                        schema: module.Output,
-                                    },
-                                },
-                            },
-                        }
-                        : undefined),
-                    ...(module.Stream
-                        ? {
-                            "200": {
-                                description: "",
-                                content: {
-                                    "text/event-stream": {
-                                        schema: module.Stream,
-                                    },
-                                },
-                            },
-                        }
-                        : undefined),
+                    ...(response200 ? { '200': response200 } : undefined),
                     ...(query || module.Param || body
                         ? {
-                            "400": {
-                                description: "Invalid input (path parameters, query string, or body)",
+                            '400': {
+                                description: 'Invalid input (path parameters, query string, or body)',
                                 content: {
-                                    "application/json": {
+                                    'application/json': {
                                         schema: z.object({
                                             message: z.string(),
                                         }),
@@ -91,23 +91,37 @@ export const registerRoutes = ({ routes, registry, base = "", }) => {
 };
 export const openapiHandler = (registry, config) => {
     let document = undefined;
+    let cachedOrigin = undefined;
     return async (request) => {
-        if (!document) {
-            const url = new URL(request.url).origin;
+        const origin = new URL(request.url).origin;
+        // Regenerate the document if the origin changes (e.g., behind a
+        // load balancer with different hostnames over time).
+        if (!document || cachedOrigin !== origin) {
             const generator = new OpenApiGeneratorV3(registry.definitions);
             document = generator.generateDocument({
                 servers: [
                     {
-                        url,
+                        url: origin,
                     },
                 ],
                 ...config,
             });
+            cachedOrigin = origin;
+        }
+        try {
+            return new Response(JSON.stringify(document), {
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+            });
+        }
+        catch {
+            return new Response(JSON.stringify({ error: 'Failed to serialize OpenAPI document' }), {
+                status: 500,
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+            });
         }
-        return new Response(JSON.stringify(document), {
-            headers: {
-                "Content-Type": "application/json",
-            },
-        });
     };
 };

package/dist/parser.d.ts

@@ -1,29 +1,11 @@
-import type { RouteParam } from "./types";
+import type { RouteParam } from './types';
 export declare const parseRouteId: (id: string) => {
     pattern: RegExp;
     params: RouteParam[];
 };
-/**
- * Removes optional params from a route ID.
- */
-export declare const removeOptionalParams: (id: string) => string;
 /**
  * Splits a route id into its segments, removing segments that
  * don't affect the path (i.e. groups). The root route is represented by `/`
  * and will be returned as `['']`.
  */
 export declare const getRouteSegments: (route: string) => string[];
-/**
- * Populate a route ID with params to resolve a pathname.
- * @example
- * ```js
- * resolveRoute(
- *   `/blog/[slug]/[...somethingElse]`,
- *   {
- *     slug: 'hello-world',
- *     somethingElse: 'something/else'
- *   }
- * ); // `/blog/hello-world/something/else`
- * ```
- */
-export declare const resolveRoute: (id: string, params: Record<string, string | undefined>) => string;

package/dist/parser.js

@@ -13,7 +13,7 @@ export const parseRouteId = (id) => {
                     matcher: restMatch[2],
                     optional: false,
                     rest: true,
-                    chained: true
+                    chained: true,
                 });
                 return '(?:/([^]*))?';
             }
@@ -25,7 +25,7 @@ export const parseRouteId = (id) => {
                     matcher: optionalMatch[2],
                     optional: true,
                     rest: false,
-                    chained: true
+                    chained: true,
                 });
                 return '(?:/([^/]+))?';
             }
@@ -45,7 +45,7 @@ export const parseRouteId = (id) => {
                             .split('-')
                             .map((code) => parseInt(code, 16))));
                     }
-                    const match = (paramPattern.exec(content));
+                    const match = paramPattern.exec(content);
                     if (!match) {
                         throw new Error(`Invalid param: ${content}. Params and matcher names can only have underscores and alphanumeric characters.`);
                     }
@@ -58,9 +58,13 @@ export const parseRouteId = (id) => {
                         matcher,
                         optional: !!isOptional,
                         rest: !!isRest,
-                        chained: isRest ? i === 1 && parts[0] === '' : false
+                        chained: isRest ? i === 1 && parts[0] === '' : false,
                     });
-                    return isRest ? '([^]*?)' : isOptional ? '([^/]*)?' : '([^/]+?)';
+                    return isRest
+                        ? '([^]*?)'
+                        : isOptional
+                            ? '([^/]*)?'
+                            : '([^/]+?)';
                 }
                 return escape(content);
             })
@@ -70,16 +74,6 @@ export const parseRouteId = (id) => {
             .join('')}/?$`);
     return { pattern, params };
 };
-const optionalParamRegex = /\/\[\[\w+?(?:=\w+)?\]\]/;
-/**
- * Removes optional params from a route ID.
- */
-export const removeOptionalParams = (id) => {
-    return id.replace(optionalParamRegex, '');
-};
-/**
- * Returns `false` for `(group)` segments
- */
 function affectsPath(segment) {
     return segment !== '' && !/^\([^)]+\)$/.test(segment);
 }
@@ -104,40 +98,3 @@ const escape = (str) => {
         // escape characters that have special meaning in regex
         .replace(/[.*+?^${}()|\\]/g, '\\$&'));
 };
-const basicParamPattern = /\[(\[)?(\.\.\.)?(\w+?)(?:=(\w+))?\]\]?/g;
-/**
- * Populate a route ID with params to resolve a pathname.
- * @example
- * ```js
- * resolveRoute(
- *   `/blog/[slug]/[...somethingElse]`,
- *   {
- *     slug: 'hello-world',
- *     somethingElse: 'something/else'
- *   }
- * ); // `/blog/hello-world/something/else`
- * ```
- */
-export const resolveRoute = (id, params) => {
-    const segments = getRouteSegments(id);
-    const hasIdTrailingSlash = id != '/' && id.endsWith('/');
-    return ('/' +
-        segments
-            .map((segment) => segment.replace(basicParamPattern, (_, optional, rest, name) => {
-            const paramValue = params[name];
-            // This is nested so TS correctly narrows the type
-            if (!paramValue) {
-                if (optional)
-                    return '';
-                if (rest && paramValue !== undefined)
-                    return '';
-                throw new Error(`Missing parameter '${name}' in route ${id}`);
-            }
-            if (paramValue.startsWith('/') || paramValue.endsWith('/'))
-                throw new Error(`Parameter '${name}' in route ${id} cannot start or end with a slash -- this would cause an invalid route like foo//bar`);
-            return paramValue;
-        }))
-            .filter(Boolean)
-            .join('/') +
-        (hasIdTrailingSlash ? '/' : ''));
-};

package/dist/routing.d.ts

@@ -1,5 +1,5 @@
-import type { MiddlewareMap, RouteModuleMap, RouteParam } from "./types";
-export declare const buildRouter: (routesMap: RouteModuleMap, middlewaresMap: MiddlewareMap) => (path: string) => {
+import type { MiddlewareMap, ParamMatcher, RouteModuleMap, RouteParam } from './types';
+export declare const buildRouter: (routesMap: RouteModuleMap, middlewaresMap: MiddlewareMap, matchers?: Record<string, ParamMatcher>) => (path: string) => {
     id: string;
     params: Record<string, string> | undefined;
     routeWithMiddlewares: {
@@ -8,7 +8,7 @@ export declare const buildRouter: (routesMap: RouteModuleMap, middlewaresMap: Mi
             pattern: RegExp;
             params: RouteParam[];
         };
-        handlers: Record<import("./types").Method, import("./types").GenericApiEndpoint>;
+        handlers: Partial<Record<import("./types").Method, import("./types").GenericApiEndpoint>>;
         id: string;
     };
 } | undefined;

package/dist/routing.js

@@ -25,13 +25,18 @@ const exec = (match, params, matchers) => {
                 continue;
             }
         }
-        if (!param.matcher || matchers[param.matcher](value)) {
+        if (!param.matcher ||
+            (matchers[param.matcher] && matchers[param.matcher](value))) {
             result[param.name] = value;
             // Now that the params match, reset the buffer if the next param isn't the [...rest]
             // and the next value is defined, otherwise the buffer will cause us to skip values
             const nextParam = params[i + 1];
             const nextValue = values[i + 1];
-            if (nextParam && !nextParam.rest && nextParam.optional && nextValue && param.chained) {
+            if (nextParam &&
+                !nextParam.rest &&
+                nextParam.optional &&
+                nextValue &&
+                param.chained) {
                 buffered = 0;
             }
             // There are no more params and no more values, but all non-empty values have been matched
@@ -67,19 +72,27 @@ const routeSorter = (a, b) => {
         return byParams;
     return b.id.length - a.id.length;
 };
-export const buildRouter = (routesMap, middlewaresMap) => {
+export const buildRouter = (routesMap, middlewaresMap, matchers = {}) => {
     const middlewareEntries = Object.entries(middlewaresMap).sort((a, b) => a[0].length - b[0].length);
-    const routesWithMiddlewaresList = Object.entries(routesMap).map(([id, route]) => ({
+    const routesWithMiddlewaresList = Object.entries(routesMap)
+        .map(([id, route]) => ({
         id,
         ...route,
-        middlewares: middlewareEntries.filter(([middlewareId]) => id.startsWith(middlewareId)).map(([_, middleware]) => middleware),
-    })).sort(routeSorter);
+        middlewares: middlewareEntries
+            .filter(([middlewareId]) => id.startsWith(middlewareId))
+            .map(([, middleware]) => middleware),
+    }))
+        .sort(routeSorter);
     return (path) => {
         for (const route of routesWithMiddlewaresList) {
             const { pattern } = route.matcher;
             const matches = pattern.exec(path);
             if (matches) {
-                return { id: route.id, params: exec(matches, route.matcher.params, {}), routeWithMiddlewares: route };
+                return {
+                    id: route.id,
+                    params: exec(matches, route.matcher.params, matchers),
+                    routeWithMiddlewares: route,
+                };
             }
         }
         return undefined;

package/dist/types.d.ts

@@ -1,9 +1,9 @@
-import type { RouteConfig, OpenAPIRegistry } from "@asteasolutions/zod-to-openapi";
-import type { OpenAPIObjectConfig } from "@asteasolutions/zod-to-openapi/dist/v3.0/openapi-generator";
-import type { z } from "./zod";
-export type { OpenAPIObject } from "openapi3-ts/oas30";
-export type { OpenAPIObjectConfig } from "@asteasolutions/zod-to-openapi/dist/v3.0/openapi-generator";
-export type Method = "GET" | "POST" | "PUT" | "DELETE" | "PATCH" | "OPTIONS";
+import type { RouteConfig, OpenAPIRegistry } from '@asteasolutions/zod-to-openapi';
+import type { OpenAPIObjectConfig } from '@asteasolutions/zod-to-openapi/dist/v3.0/openapi-generator';
+import type { z } from './zod';
+export type { OpenAPIObject } from 'openapi3-ts/oas30';
+export type { OpenAPIObjectConfig } from '@asteasolutions/zod-to-openapi/dist/v3.0/openapi-generator';
+export type Method = 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH' | 'OPTIONS' | 'HEAD';
 export interface HttpError {
     status: number;
     key?: string;
@@ -26,7 +26,7 @@ export interface ApiRoute {
         pattern: RegExp;
         params: RouteParam[];
     };
-    handlers: Record<Method, GenericApiEndpoint>;
+    handlers: Partial<Record<Method, GenericApiEndpoint>>;
 }
 export interface ApiRouteWithMiddlewares extends ApiRoute {
     middlewares: Middleware[];
@@ -36,7 +36,7 @@ export type RouteModuleMap = Record<string, {
         pattern: RegExp;
         params: RouteParam[];
     };
-    handlers: Record<Method, GenericApiEndpoint>;
+    handlers: Partial<Record<Method, GenericApiEndpoint>>;
 }>;
 export type RouteWithMiddlewaresMap = Record<string, ApiRouteWithMiddlewares>;
 export type MiddlewareMap = Record<string, Middleware>;
@@ -66,9 +66,9 @@ export interface APIContext {
  */
 export type EndpointModifier = (r: RouteConfig) => RouteConfig;
 export interface CORS {
-    "Access-Control-Allow-Origin": string;
-    "Access-Control-Allow-Methods": string;
-    "Access-Control-Allow-Headers": string;
+    'Access-Control-Allow-Origin': string;
+    'Access-Control-Allow-Methods': string;
+    'Access-Control-Allow-Headers': string;
 }
 export interface APIOptions {
     routeModuleMap: Record<string, () => Promise<unknown>>;
@@ -78,6 +78,10 @@ export interface APIOptions {
     registry?: OpenAPIRegistry;
     /** Called for unexpected throws and HTTP errors with status >= 500. */
     onInternalError?: (error: unknown) => void;
+    /** Custom parameter matchers, keyed by name. Used in `[param=matcher]` route syntax. */
+    matchers?: Record<string, ParamMatcher>;
+    /** Maximum request body size in bytes. Defaults to 1 GB. */
+    maxBodySize?: number;
 }
 export interface OpenAPIOptions {
     base?: string;
@@ -85,7 +89,7 @@ export interface OpenAPIOptions {
     registry: OpenAPIRegistry;
 }
 export interface EndpointHandler<P, Q, I, O> {
-    ({ body, query, param, event }: {
+    ({ body, query, param, event, }: {
         body: z.infer<I>;
         query: z.infer<Q>;
         param: z.infer<P>;
@@ -114,9 +118,9 @@ export interface APIEndpoint<P extends ParamType = z.ZodObject<Record<never, nev
     handle?: EndpointHandler<P, Q, I, O>;
 }
 export interface EndpointBuilder<P extends ParamType, Q extends QueryType, I extends InputType, O extends OutputType, S extends StreamType, E extends ErrorType> {
-    (spec: EndpointSpecification<P, Q, I, O, S, E>): ({
+    (spec: EndpointSpecification<P, Q, I, O, S, E>): {
         handler: () => APIEndpoint<P, Q, I, O, S, E>;
-    });
+    };
 }
 export interface EndpointStreamSetter<P extends ParamType, Q extends QueryType, I extends InputType, O extends OutputType, S extends StreamType, E extends ErrorType> {
     (data: APIEndpoint<P, Q, I, O, S, E>): EndpointBuilder<P, Q, I, O, S, E>;

package/dist/utils.d.ts

@@ -1,5 +1,5 @@
-import type { IncomingMessage } from "http";
-import type { Request as ExpressRequest } from "express";
+import type { IncomingMessage } from 'http';
+import type { Request as ExpressRequest } from 'express';
 export declare const recursiveAwait: (obj: unknown) => unknown;
 export declare const validateRouteId: (id: string) => void;
 export declare const toFetchRequest: (req: IncomingMessage | ExpressRequest) => Request;

package/dist/utils.js

@@ -8,6 +8,20 @@ export const recursiveAwait = (obj) => {
         // dates become `{}` in API responses after the plain-object walk below.
         return obj;
     }
+    else if (obj instanceof Map) {
+        // `Map` extends `Object`, but `Object.keys(new Map())` is [] — without this branch,
+        // maps become `{}` in API responses after the plain-object walk below.
+        const entries = Array.from(obj.entries());
+        if (entries.length === 0)
+            return {};
+        return Promise.all(entries.map(async ([k, v]) => [await recursiveAwait(k), await recursiveAwait(v)])).then((resolved) => Object.fromEntries(resolved));
+    }
+    else if (obj instanceof Set) {
+        // `Set` extends `Object`, but `Object.keys(new Set())` is [] — without this branch,
+        // sets become `{}` in API responses after the plain-object walk below.
+        const values = Array.from(obj.values());
+        return Promise.all(values.map(recursiveAwait));
+    }
     else if (obj instanceof Array) {
         return Promise.all(obj.map(recursiveAwait));
     }
@@ -48,21 +62,21 @@ export const validateRouteId = (id) => {
         throw new Error(`Invalid route ${id} — a rest route segment is always optional, remove the outer square brackets`);
     }
 };
-const isNodeReadable = (value) => !!value && typeof value.pipe === "function";
+const isNodeReadable = (value) => !!value && typeof value.pipe === 'function';
 const isBodyInit = (value) => {
-    if (typeof value === "string")
+    if (typeof value === 'string')
         return true;
     if (value instanceof ArrayBuffer)
         return true;
     if (ArrayBuffer.isView(value))
         return true;
-    if (typeof Blob !== "undefined" && value instanceof Blob)
+    if (typeof Blob !== 'undefined' && value instanceof Blob)
         return true;
-    if (typeof FormData !== "undefined" && value instanceof FormData)
+    if (typeof FormData !== 'undefined' && value instanceof FormData)
         return true;
     if (value instanceof URLSearchParams)
         return true;
-    if (typeof ReadableStream !== "undefined" && value instanceof ReadableStream)
+    if (typeof ReadableStream !== 'undefined' && value instanceof ReadableStream)
         return true;
     if (isNodeReadable(value))
         return true;
@@ -73,42 +87,52 @@ const coerceBody = (body, headers) => {
         return undefined;
     if (isBodyInit(body))
         return body;
+    // At this point, `body` is a plain object (e.g., from Express's body
+    // parser). We JSON-stringify it so the Fetch Request can carry it as
+    // a JSON string body. Note: if Express's body parser was used, this
+    // means the body is serialized here and re-parsed in `parseBody` —
+    // a minor double-processing overhead. To avoid this, don't use
+    // Express body-parser middleware on riddl-mounted routes.
     const json = JSON.stringify(body);
-    if (!headers.has("content-type")) {
-        headers.set("content-type", "application/json; charset=utf-8");
+    if (!headers.has('content-type')) {
+        headers.set('content-type', 'application/json; charset=utf-8');
     }
     return json;
 };
 const getRequestUrl = (req) => {
     var _a;
-    const rawUrl = "originalUrl" in req ? req.originalUrl || req.url || "/" : req.url || "/";
+    const rawUrl = 'originalUrl' in req ? req.originalUrl || req.url || '/' : req.url || '/';
     if (/^https?:\/\//i.test(rawUrl))
         return new URL(rawUrl);
-    if ("protocol" in req) {
-        return new URL(rawUrl, `${req.protocol}://${req.get("host")}`);
+    if ('protocol' in req) {
+        return new URL(rawUrl, `${req.protocol}://${req.get('host')}`);
     }
-    const host = (_a = req.headers.host) !== null && _a !== void 0 ? _a : "localhost";
-    const forwardedProto = req.headers["x-forwarded-proto"];
+    const host = (_a = req.headers.host) !== null && _a !== void 0 ? _a : 'localhost';
+    const forwardedProto = req.headers['x-forwarded-proto'];
     const proto = Array.isArray(forwardedProto)
         ? forwardedProto[0]
         : forwardedProto;
-    const protocol = (proto === null || proto === void 0 ? void 0 : proto.split(",")[0].trim()) || "http";
+    const protocol = (proto === null || proto === void 0 ? void 0 : proto.split(',')[0].trim()) || 'http';
     return new URL(rawUrl, `${protocol}://${host}`);
 };
 export const toFetchRequest = (req) => {
     const headers = new Headers();
     for (const [key, value] of Object.entries(req.headers)) {
         if (Array.isArray(value))
-            headers.append(key, value.join(","));
+            headers.append(key, value.join(','));
         else if (value != null)
             headers.set(key, value);
     }
-    const method = req.method || "GET";
+    const method = req.method || 'GET';
+    // `rawBody` is set by some Express body-parsing middleware (e.g.,
+    // express.json()). If the middleware isn't present, `rawBody` is
+    // undefined and we fall through to using the parsed body or the raw
+    // stream itself.
     const expressReq = req;
-    const parsedBody = "body" in expressReq ? expressReq.body : undefined;
-    const rawBody = "rawBody" in expressReq ? expressReq.rawBody : undefined;
+    const parsedBody = 'body' in expressReq ? expressReq.body : undefined;
+    const rawBody = 'rawBody' in expressReq ? expressReq.rawBody : undefined;
     let body;
-    if (method !== "GET" && method !== "HEAD") {
+    if (method !== 'GET' && method !== 'HEAD') {
         body = coerceBody(rawBody !== null && rawBody !== void 0 ? rawBody : parsedBody, headers);
         if (body === undefined && isNodeReadable(req) && !req.readableEnded) {
             body = req;
@@ -120,7 +144,7 @@ export const toFetchRequest = (req) => {
         body: body,
     };
     if (isNodeReadable(body)) {
-        init.duplex = "half"; // required when body is a stream
+        init.duplex = 'half'; // required when body is a stream
     }
     return new Request(getRequestUrl(req).toString(), init);
 };

package/dist/validation.d.ts

@@ -1,5 +1,5 @@
-import { GenericApiEndpoint } from './types';
-export declare const parseBody: (req: Request, module: GenericApiEndpoint, tempFiles?: string[]) => Promise<unknown>;
-export declare const parseQuery: (request: Request, module: GenericApiEndpoint) => Promise<Record<string, string | string[]>>;
-export declare const parseParam: (params: Record<string, string>, module: GenericApiEndpoint) => Promise<Record<string, string | never>>;
+import type { GenericApiEndpoint } from './types';
+export declare const parseBody: (req: Request, module: GenericApiEndpoint, tempFiles?: string[], maxBodySize?: number) => Promise<unknown>;
+export declare const parseQuery: (request: Request, module: GenericApiEndpoint) => Record<string, string | string[]>;
+export declare const parseParam: (params: Record<string, string>, module: GenericApiEndpoint) => Record<string, string | never>;
 export declare const parseOutput: (out: unknown, module: GenericApiEndpoint) => Promise<Record<string, unknown> | unknown[]>;

package/dist/validation.js

@@ -3,22 +3,10 @@ import { log } from './log.js';
 import { z } from './zod.js';
 import { error } from './errors.js';
 import { parseMultipart } from './multipart.js';
-const parseJsonBody = async (req) => {
-    var _a;
-    const clonedRequest = req.clone();
-    if ((_a = clonedRequest.headers.get('content-type')) === null || _a === void 0 ? void 0 : _a.startsWith('application/json')) {
-        try {
-            const json = await clonedRequest.json();
-            if (typeof json === 'object') {
-                return json;
-            }
-        }
-        catch {
-            throw error(400, 'Invalid JSON body');
-        }
-    }
-};
-export const parseBody = async (req, module, tempFiles = []) => {
+import { MAX_BODY_SIZE_DEFAULT } from './constants.js';
+/** Cached default schema — avoids recreating z.object({}) on every request. */
+const EMPTY_SCHEMA = z.object({});
+export const parseBody = async (req, module, tempFiles = [], maxBodySize = MAX_BODY_SIZE_DEFAULT) => {
     var _a, _b;
     let body = {};
     // GET, HEAD, DELETE, OPTIONS have no body
@@ -27,27 +15,32 @@ export const parseBody = async (req, module, tempFiles = []) => {
         return body;
     }
     const contentType = (_a = req.headers.get('content-type')) !== null && _a !== void 0 ? _a : '';
+    // Enforce body size limit via Content-Length when available
+    const contentLength = req.headers.get('content-length');
+    if (contentLength) {
+        const size = parseInt(contentLength, 10);
+        if (!Number.isNaN(size) && size > maxBodySize) {
+            throw error(413, 'Request body too large');
+        }
+    }
+    // parseBody is the sole consumer of the request body — no clone() needed.
     // JSON body
     if (contentType.startsWith('application/json')) {
-        body = await req
-            .clone()
-            .json()
-            .catch(() => {
+        body = await req.json().catch(() => {
             throw error(400, 'Invalid JSON body');
         });
     }
     // Multipart form body: stream uploads to disk rather than buffering the
-    // whole payload in memory. Consume `req` directly (no `clone()` — a tee
-    // would re-buffer the unread branch, defeating the point).
+    // whole payload in memory. Consume `req` directly.
     else if (contentType.startsWith('multipart/form-data')) {
-        const result = await parseMultipart(req);
+        const result = await parseMultipart(req, maxBodySize);
         tempFiles.push(...result.tempFiles);
         body = result.body;
     }
     // URL-encoded form body (always small — buffering is fine)
     else if (contentType.startsWith('application/x-www-form-urlencoded')) {
         const formBody = {};
-        const form = await req.clone().formData();
+        const form = await req.formData();
         for (const [key, value] of form.entries()) {
             if (formBody[key]) {
                 const existing = formBody[key];
@@ -66,15 +59,15 @@ export const parseBody = async (req, module, tempFiles = []) => {
     }
     // Text body
     else if (contentType.startsWith('text/plain')) {
-        body = { text: await req.clone().text() };
+        body = { text: await req.text() };
     }
     // Binary body
     else if (contentType.startsWith('application/octet-stream')) {
-        const buffer = await req.clone().arrayBuffer();
+        const buffer = await req.arrayBuffer();
         body = { buffer };
     }
     log('body: %O', body);
-    const validator = (_b = module.Input) !== null && _b !== void 0 ? _b : z.object({});
+    const validator = (_b = module.Input) !== null && _b !== void 0 ? _b : EMPTY_SCHEMA;
     const validation = validator.safeParse(body);
     if (!validation.success) {
         throw error(400, `Invalid body.\n${fromZodError(validation.error).message}`);
@@ -84,7 +77,7 @@ export const parseBody = async (req, module, tempFiles = []) => {
     }
     return body;
 };
-export const parseQuery = async (request, module) => {
+export const parseQuery = (request, module) => {
     var _a;
     let query = {};
     for (const [key, value] of new URL(request.url).searchParams.entries()) {
@@ -102,7 +95,7 @@ export const parseQuery = async (request, module) => {
         }
     }
     log('query: %O', query);
-    const validator = (_a = module.Query) !== null && _a !== void 0 ? _a : z.object({});
+    const validator = (_a = module.Query) !== null && _a !== void 0 ? _a : EMPTY_SCHEMA;
     const validation = validator.safeParse(query);
     if (!validation.success) {
         throw error(400, `Invalid query.\n${fromZodError(validation.error).message}`);
@@ -112,10 +105,10 @@ export const parseQuery = async (request, module) => {
     }
     return query;
 };
-export const parseParam = async (params, module) => {
+export const parseParam = (params, module) => {
     var _a;
     log('param: %O', params);
-    const validator = (_a = module.Param) !== null && _a !== void 0 ? _a : z.object({});
+    const validator = (_a = module.Param) !== null && _a !== void 0 ? _a : EMPTY_SCHEMA;
     const validation = validator.safeParse(params);
     if (!validation.success) {
         throw error(400, `Invalid param.\n${fromZodError(validation.error).message}`);
@@ -131,8 +124,8 @@ export const parseOutput = async (out, module) => {
         : out && typeof out === 'object'
             ? out
             : {};
-    const validator = (_a = module.Output) !== null && _a !== void 0 ? _a : z.object({});
-    const validation = await validator.spa(output);
+    const validator = (_a = module.Output) !== null && _a !== void 0 ? _a : EMPTY_SCHEMA;
+    const validation = validator.safeParse(output);
     if (!validation.success) {
         const details = fromZodError(validation.error).message;
         log.extend('error')('output: %O failed validation: %O', output, validation.error);

package/dist/zod.d.ts

@@ -1,2 +1,2 @@
-import { z } from "zod";
+import { z } from 'zod';
 export { z };

package/dist/zod.js

@@ -1,4 +1,4 @@
-import { extendZodWithOpenApi } from "@asteasolutions/zod-to-openapi";
-import { z } from "zod";
+import { extendZodWithOpenApi } from '@asteasolutions/zod-to-openapi';
+import { z } from 'zod';
 extendZodWithOpenApi(z);
 export { z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@riddl/core",
-  "version": "0.2.7",
+  "version": "0.9.0",
   "license": "MIT",
   "type": "module",
   "dependencies": {
@@ -9,7 +9,6 @@
     "debug": "^4.4.0",
     "express": "^5.2.1",
     "set-cookie-parser": "^3.0.1",
-    "sse.js": "^2.5.0",
     "zod": "^4.4.3",
     "zod-validation-error": "^5.0.0"
   },
@@ -32,17 +31,23 @@
     "concurrently": "^9.1.2",
     "eslint": "^9.17.0",
     "eslint-config-prettier": "^9.1.0",
+    "@eslint/js": "^9.17.0",
+    "eslint-plugin-prettier": "^5.5.1",
     "openapi3-ts": "^4.5.0",
     "prettier": "^3.4.2",
     "tsc-alias": "^1.8.10",
     "type-fest": "^4.31.0",
-    "typescript": "^5.7.2"
+    "typescript": "^5.7.2",
+    "vitest": "^5.0.4"
   },
   "scripts": {
     "lint": "prettier --check . && eslint .",
     "format": "prettier --write .",
     "clean": "rm -f tsconfig.tsbuildinfo dist",
     "build": "tsc && tsc-alias",
-    "build:watch": "tsc && tsc-alias && (concurrently \"tsc -w\" \"tsc-alias -w\")"
+    "build:watch": "tsc && tsc-alias && (concurrently \"tsc -w\" \"tsc-alias -w\")",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "prepublishOnly": "pnpm build"
   }
-}
+}

package/dist/middlewares.js

@@ -1 +0,0 @@
-"use strict";